pullfrog 0.1.83 → 0.1.85

package/dist/internal/index.d.ts

@@ -20,11 +20,14 @@ export type { ResourceUsage, UsageSummary } from "../utils/github.ts";
 export { isPullfrog } from "../utils/isPullfrog.ts";
 export { isLeapingIntoActionCommentBody, LEAPING_INTO_ACTION_PREFIX, } from "../utils/leapingComment.ts";
 export { MAX_LEARNINGS_LENGTH, truncateAtLineBoundary } from "../utils/learningsTruncate.ts";
+export { countOutstandingPullfrogThreads } from "../utils/outstandingThreads.ts";
 export type { CreateProgressCommentTarget, ProgressComment, ProgressCommentType, } from "../utils/progressComment.ts";
 export { createLeapingProgressComment, deleteProgressCommentApi, getProgressComment, updateProgressComment, } from "../utils/progressComment.ts";
 export { PROVIDER_DASHBOARDS, type ProviderDashboard } from "../utils/providerDashboards.ts";
 export type { RunStatusCheckConclusion, RunStatusCheckOctokit, } from "../utils/runStatusCheck.ts";
 export { APPROVAL_CHECK_NAME, createRunStatusCheck, finalizeRunStatusCheck, RUN_STATUS_CHECK_NAME, runStatusCheckNeedsFinalizing, } from "../utils/runStatusCheck.ts";
+export * from "../utils/subscriptionCredentials.ts";
+export { probeSubscription, SubscriptionCredentialError, subscriptionIdentity, } from "../utils/subscriptionProbe.ts";
 export { isValidTimeString, parseTimeString, TIMEOUT_DISABLED, } from "../utils/time.ts";
 export type { XaiAuthBody } from "../utils/xaiOAuth.ts";
 export { parseXaiAuthBody, refreshXaiAuthBody, stringifyXaiAuthBody, } from "../utils/xaiOAuth.ts";

package/dist/internal.js

@@ -8,7 +8,7 @@ var __export = (target, all) => {
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.83",
+  version: "0.1.85",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -44,8 +44,8 @@ var package_default = {
     "@octokit/plugin-throttling": "^11.0.3",
     "@octokit/rest": "^22.0.0",
     "@octokit/webhooks-types": "^7.6.1",
-    "@openai/codex": "0.153.4",
-    "@openai/codex-sdk": "0.153.4",
+    "@openai/codex": "0.157.0",
+    "@openai/codex-sdk": "0.157.0",
     "@opencode-ai/sdk": "1.18.29",
     "@standard-schema/spec": "1.1.0",
     "@toon-format/toon": "^1.0.0",
@@ -14931,22 +14931,14 @@ var providers = {
         displayName: "Qwen Max",
         resolve: "opencode/qwen3.8-max",
         openRouterEffort: ["minimal", "low", "medium", "high", "xhigh"],
-        openRouterResolve: "openrouter/qwen/qwen3.8-max-0902",
-        // unlisted until a published `pullfrog` carries this alias (the
-        // merge-vs-publish rule in wiki/models-catalog.md). unhide in the release
-        // that ships it.
-        hidden: true
+        openRouterResolve: "openrouter/qwen/qwen3.8-max-0902"
       },
       "qwen-flash": {
         displayName: "Qwen Flash",
         resolve: "opencode/qwen3.8-flash",
         effort: ["low", "medium", "xhigh"],
         openRouterEffort: [],
-        openRouterResolve: "openrouter/qwen/qwen3.8-flash",
-        // unlisted until a published `pullfrog` carries this alias (the
-        // merge-vs-publish rule in wiki/models-catalog.md). unhide in the release
-        // that ships it.
-        hidden: true
+        openRouterResolve: "openrouter/qwen/qwen3.8-flash"
       },
       "gpt-5-nano": {
         displayName: "GPT Nano",
@@ -15006,11 +14998,18 @@ var providers = {
         effort: ["low", "medium", "high", "xhigh", "max"],
         // free to run, still gated on the provider's own OPENCODE_API_KEY —
         // see the big-pickle note above (#1077).
-        isFree: true,
-        // unlisted until a published `pullfrog` carries this alias: 0.1.82
-        // predates it, so a run passes `opencode/space-bunny` through raw and
-        // Zen answers a 500. unhide in the release that ships it.
-        hidden: true
+        isFree: true
+      },
+      // Zen's FREE Meituan preview (listed 2026-09-25). Zen's docs: zero
+      // retention, no training. Go lists the same free id, but one key reaches
+      // both, so the promo gets one row, here with the other free ones.
+      "longcat-preview": {
+        displayName: "LongCat Preview",
+        description: "Meituan preview, free for a limited time",
+        resolve: "opencode/longcat-2.5-preview-free",
+        // free to run, still gated on the provider's own OPENCODE_API_KEY —
+        // see the big-pickle note above (#1077).
+        isFree: true
       },
       // Zen's live free MiMo, and the second free row in a menu that big-pickle
       // was alone in since `mimo-v2-pro-free` lost its model.
@@ -15645,7 +15644,7 @@ function isRouterTier(value) {
 }
 var PROVIDER_LADDERS = {
   anthropic: {
-    minimal: "anthropic/claude-haiku",
+    minimal: "anthropic/claude-sonnet",
     light: "anthropic/claude-sonnet",
     standard: "anthropic/claude-opus",
     deep: "anthropic/claude-opus"
@@ -15963,7 +15962,7 @@ For simple, well-defined tasks, skip the plan phase and go straight to build.`
 6. Finalize:
    - **only if code changed**, ${finalizeStep} (same push/prepush guidance as Build mode in *SYSTEM*). If push/commit fails, report the exact error and STOP without claiming a fix or resolving its threads.
    - reply ONCE per relevant thread via \`${t("reply_to_review_comment")}\`, including when no code changed. The \`comment_id\` is the root comment's numeric \`id=\`, NOT the \`thread=\` value from \`${t("get_review_comments")}\`. The runtime dedupes identical bodies within a session.
-   - resolve a thread via \`${t("resolve_review_thread")}\` (using \`thread=\` as \`thread_id\`) only after its requested fix is fully on the remote, or the user explicitly asks to resolve it. Leave discussion-only replies, partial fixes, and disagreements open.
+   - resolve a thread via \`${t("resolve_review_thread")}\` (using \`thread=\` as \`thread_id\`) only after its requested fix is fully on the remote, the user explicitly asks to resolve it, or it is a Pullfrog finding you agree to withdraw. Leave other discussion-only replies, partial fixes, and disagreements open.
    - call \`${t("report_progress")}\` with a brief summary. If your last \`${t("get_review_comments")}\` turned up threads you did not address, name them there \u2014 a review arriving this late is suppressed as a duplicate and nothing else will pick it up.`
     },
     // Review and IncrementalReview route the minimum reviewfrog specialists
@@ -16223,35 +16222,25 @@ var modes = computeModes("opencode");
 
 // utils/billingErrors.ts
 function commercialPaywallBody(params) {
-  const pitch = "Pro is required on private organization repos like this one: a flat $30/month per organization for unlimited runs, members, and repos.";
+  let action;
   switch (params.reason) {
     case "commercial":
-      return [
-        `**${params.ownerLogin}'s Pullfrog trial has expired.**`,
-        "",
-        pitch,
-        "",
-        `[Upgrade now \u2192](${params.url})`
-      ].join("\n");
+      action = "upgrade";
+      break;
     case "subscription_ended":
-      return [
-        `**${params.ownerLogin}'s Pullfrog Pro subscription has ended.**`,
-        "",
-        pitch,
-        "",
-        `[Resubscribe \u2192](${params.url})`
-      ].join("\n");
+      action = "resubscribe";
+      break;
     case "subscription_unpaid":
-      return [
-        `**Pullfrog paused runs on ${params.ownerLogin}: the Pro renewal failed.**`,
-        "",
-        "Update the card on file to resume runs.",
-        "",
-        `[Update billing \u2192](${params.url})`
-      ].join("\n");
+      action = "update billing";
+      break;
     default:
       return params.reason;
   }
+  return [
+    `**Pullfrog is ${params.freshReply ? "still paused" : "paused"} for ${params.ownerLogin}.**`,
+    "",
+    `An org owner can [${action}](${params.url}) to resume private-repo runs.`
+  ].join("\n");
 }
 
 // utils/buildPullfrogFooter.ts
@@ -16590,6 +16579,42 @@ function truncateAtLineBoundary(body, cap) {
   return head.slice(0, lastNewline);
 }
 
+// utils/outstandingThreads.ts
+var OUTSTANDING_THREADS_QUERY = `
+query ($owner: String!, $name: String!, $prNumber: Int!, $cursor: String) {
+  repository(owner: $owner, name: $name) {
+    pullRequest(number: $prNumber) {
+      reviewThreads(first: 100, after: $cursor) {
+        pageInfo { hasNextPage endCursor }
+        nodes {
+          isResolved
+          comments(first: 1) { nodes { author { login } } }
+        }
+      }
+    }
+  }
+}
+`;
+async function countOutstandingPullfrogThreads(ctx, pullNumber) {
+  let count = 0;
+  let cursor = null;
+  for (let page = 0; page < 50; page += 1) {
+    const response = await ctx.octokit.graphql(
+      OUTSTANDING_THREADS_QUERY,
+      { owner: ctx.repo.owner, name: ctx.repo.name, prNumber: pullNumber, cursor }
+    );
+    const conn = response.repository?.pullRequest?.reviewThreads;
+    for (const thread of conn?.nodes ?? []) {
+      if (!thread || thread.isResolved) continue;
+      const root = thread.comments?.nodes?.find((c) => c != null);
+      if (root && isPullfrog(root.author?.login)) count += 1;
+    }
+    if (!conn?.pageInfo.hasNextPage) break;
+    cursor = conn.pageInfo.endCursor;
+  }
+  return count;
+}
+
 // utils/progressComment.ts
 async function getProgressComment(ctx, comment) {
   const result = await (comment.type === "review" ? ctx.octokit.rest.pulls.getReviewComment({
@@ -16911,19 +16936,47 @@ async function runStatusCheckNeedsFinalizing(params) {
   }
 }
 
-// utils/time.ts
-var TIMEOUT_DISABLED = "none";
-var TIME_STRING_REGEX = /^(?:(\d+)h)?(?:(\d+)m)?(?:(\d+)s)?$/;
-function parseTimeString(input) {
-  const match = input.match(TIME_STRING_REGEX);
-  if (!match || !match[1] && !match[2] && !match[3]) return null;
-  const hours = parseInt(match[1] || "0", 10);
-  const minutes = parseInt(match[2] || "0", 10);
-  const seconds = parseInt(match[3] || "0", 10);
-  return (hours * 3600 + minutes * 60 + seconds) * 1e3;
-}
-function isValidTimeString(input) {
-  return parseTimeString(input) !== null;
+// utils/subscriptionCredentials.ts
+var subscriptionNameSchema = external_exports.enum([
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "CODEX_AUTH_JSON",
+  "GROK_AUTH_JSON"
+]);
+var subscriptionSchema = external_exports.object({
+  id: external_exports.string(),
+  credentialId: external_exports.string(),
+  name: subscriptionNameSchema,
+  label: external_exports.string(),
+  owner: external_exports.string(),
+  inherited: external_exports.boolean(),
+  shared: external_exports.boolean(),
+  registeredAt: external_exports.string()
+});
+var subscriptionListSchema = external_exports.object({
+  subscriptions: external_exports.array(subscriptionSchema),
+  writable: external_exports.boolean()
+});
+var subscriptionInputSchema = external_exports.object({
+  name: subscriptionNameSchema,
+  value: external_exports.string().trim().min(1).refine((value) => Buffer.byteLength(value, "utf8") <= 49152),
+  replaceId: external_exports.string().optional()
+});
+var credentialCandidateSchema = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  source: external_exports.enum(["repo", "account", "personal"])
+});
+var credentialAccessSchema = external_exports.object({
+  token: external_exports.string(),
+  candidates: external_exports.array(credentialCandidateSchema)
+});
+var selectedCredentialSchema = external_exports.object({
+  name: external_exports.string(),
+  value: external_exports.string(),
+  receipt: external_exports.string()
+});
+function subscriptionLabel(input) {
+  return input.email ?? `\u2022\u2022\u2022\u2022 ${input.suffix}`;
 }
 
 // utils/xaiOAuth.ts
@@ -16988,6 +17041,137 @@ function stringifyXaiAuthBody(body) {
   return `${JSON.stringify(body, null, 2)}
 `;
 }
+
+// utils/subscriptionProbe.ts
+var identitySchema = external_exports.object({
+  email: external_exports.string().email().optional(),
+  sub: external_exports.string().optional(),
+  user_id: external_exports.string().optional(),
+  account_id: external_exports.string().optional(),
+  email_verified: external_exports.boolean().optional()
+});
+var codexUsageSchema = external_exports.object({
+  rate_limit: external_exports.object({ allowed: external_exports.boolean(), limit_reached: external_exports.boolean() }).optional()
+});
+var SubscriptionCredentialError = class extends Error {
+};
+async function subscriptionIdentity(input) {
+  const empty = { email: null, subject: null };
+  if (input.name === "CLAUDE_CODE_OAUTH_TOKEN") return empty;
+  const codex = input.name === "CODEX_AUTH_JSON" ? parseCodexAuthBody(input.value) : null;
+  const grok = input.name === "GROK_AUTH_JSON" ? parseXaiAuthBody(input.value) : null;
+  const token = codex?.tokens.access_token ?? grok?.tokens.access_token;
+  if (!token) throw new SubscriptionCredentialError("invalid subscription credential");
+  const response = await readSubscriptionEndpoint({
+    url: codex ? "https://chatgpt.com/backend-api/wham/usage" : "https://auth.x.ai/oauth2/userinfo",
+    token,
+    accountId: codex?.tokens.account_id
+  });
+  if (response?.status === 401)
+    throw new SubscriptionCredentialError("subscription credential was rejected");
+  if (!response?.ok) return empty;
+  const parsed = identitySchema.safeParse(await response.json().catch(() => null));
+  if (!parsed.success) return empty;
+  const subject = parsed.data.sub ?? parsed.data.user_id;
+  return {
+    email: parsed.data.email_verified === false ? null : parsed.data.email ?? null,
+    subject: subject ? `${subject}:${parsed.data.account_id ?? ""}` : null
+  };
+}
+async function readSubscriptionEndpoint(input) {
+  const headers = new Headers({ authorization: `Bearer ${input.token}` });
+  if (input.accountId) headers.set("ChatGPT-Account-Id", input.accountId);
+  if (input.grokBilling) headers.set("x-xai-token-auth", "xai-grok-cli");
+  return fetch(input.url, {
+    headers,
+    redirect: "error",
+    signal: AbortSignal.timeout(1e4)
+  }).catch(() => null);
+}
+async function probeSubscription(input) {
+  if (input.name === "CLAUDE_CODE_OAUTH_TOKEN") {
+    const result = await preflightClaudeSubscription({ token: input.value, model: input.model });
+    return result.usable ? "usable" : "rejected";
+  }
+  const codex = input.name === "CODEX_AUTH_JSON" ? parseCodexAuthBody(input.value) : null;
+  const grok = input.name === "GROK_AUTH_JSON" ? parseXaiAuthBody(input.value) : null;
+  const auth = codex ?? grok;
+  if (!auth || auth.refresh_rejected_at) return "rejected";
+  if (grok && input.model)
+    return probeInference({
+      name: "XAI_API_KEY",
+      value: grok.tokens.access_token,
+      model: input.model
+    });
+  const response = await readSubscriptionEndpoint({
+    url: codex ? "https://chatgpt.com/backend-api/wham/usage" : "https://cli-chat-proxy.grok.com/v1/billing?format=credits",
+    token: auth.tokens.access_token,
+    accountId: codex?.tokens.account_id,
+    grokBilling: !!grok
+  });
+  if (response?.status === 401) return "rejected";
+  if (!response?.ok) return "unknown";
+  const body = await response.json().catch(() => null);
+  if (codex) {
+    const parsed = codexUsageSchema.safeParse(body);
+    const limit = parsed.success ? parsed.data.rate_limit : void 0;
+    if (!limit) return "unknown";
+    return limit.allowed && !limit.limit_reached ? "usable" : "rejected";
+  }
+  return "unknown";
+}
+async function probeInference(input) {
+  const anthropic = input.name === "ANTHROPIC_API_KEY";
+  const openai = input.name === "OPENAI_API_KEY";
+  if (!anthropic && !openai && input.name !== "XAI_API_KEY") {
+    const result = await verifyCredential({ envVar: input.name, value: input.value });
+    return result === "dead" ? "rejected" : result === "alive" ? "usable" : "unknown";
+  }
+  const headers = new Headers({ "content-type": "application/json" });
+  if (anthropic) {
+    headers.set("x-api-key", input.value);
+    headers.set("anthropic-version", "2023-06-01");
+  } else headers.set("authorization", `Bearer ${input.value}`);
+  const response = await fetch(
+    anthropic ? "https://api.anthropic.com/v1/messages" : openai ? "https://api.openai.com/v1/responses" : "https://api.x.ai/v1/chat/completions",
+    {
+      method: "POST",
+      headers,
+      body: JSON.stringify(
+        openai ? { model: input.model, input: "Reply OK.", max_output_tokens: 16, store: false } : {
+          model: input.model,
+          messages: [{ role: "user", content: "Reply OK." }],
+          max_tokens: 1
+        }
+      ),
+      redirect: "error",
+      signal: AbortSignal.timeout(1e4)
+    }
+  ).catch(() => null);
+  if (response?.status === 400 && input.name === "XAI_API_KEY") {
+    const error48 = external_exports.object({ error: external_exports.string() }).safeParse(await response.json().catch(() => null));
+    return error48.success && error48.data.error.startsWith("Incorrect API key provided.") ? "rejected" : "unknown";
+  }
+  await response?.body?.cancel();
+  if (!response) return "unknown";
+  if (response.ok) return "usable";
+  return [401, 402, 403, 429].includes(response.status) ? "rejected" : "unknown";
+}
+
+// utils/time.ts
+var TIMEOUT_DISABLED = "none";
+var TIME_STRING_REGEX = /^(?:(\d+)h)?(?:(\d+)m)?(?:(\d+)s)?$/;
+function parseTimeString(input) {
+  const match = input.match(TIME_STRING_REGEX);
+  if (!match || !match[1] && !match[2] && !match[3]) return null;
+  const hours = parseInt(match[1] || "0", 10);
+  const minutes = parseInt(match[2] || "0", 10);
+  const seconds = parseInt(match[3] || "0", 10);
+  return (hours * 3600 + minutes * 60 + seconds) * 1e3;
+}
+function isValidTimeString(input) {
+  return parseTimeString(input) !== null;
+}
 export {
   APPROVAL_CHECK_NAME,
   AUTO_EFFICIENT,
@@ -17012,6 +17196,7 @@ export {
   ROUTER_TIERS,
   RUN_STATUS_CHECK_NAME,
   SUBSIDY_RUNG,
+  SubscriptionCredentialError,
   TIMEOUT_DISABLED,
   autoLadder,
   autoRoutedSlug,
@@ -17021,8 +17206,11 @@ export {
   configFields,
   configResponseSchema,
   configValueSchema,
+  countOutstandingPullfrogThreads,
   createLeapingProgressComment,
   createRunStatusCheck,
+  credentialAccessSchema,
+  credentialCandidateSchema,
   decodeJwtExpMs,
   defaultAutoTier,
   deleteProgressCommentApi,
@@ -17056,6 +17244,7 @@ export {
   parseModel,
   parseTimeString,
   parseXaiAuthBody,
+  probeSubscription,
   providers,
   pullfrogMcpName,
   refreshCodexAuthBody,
@@ -17071,9 +17260,16 @@ export {
   runStatusCheckNeedsFinalizing,
   rungLabel,
   rungPosition,
+  selectedCredentialSchema,
   stringifyCodexAuthBody,
   stringifyXaiAuthBody,
   stripExistingFooter,
+  subscriptionIdentity,
+  subscriptionInputSchema,
+  subscriptionLabel,
+  subscriptionListSchema,
+  subscriptionNameSchema,
+  subscriptionSchema,
   truncateAtLineBoundary,
   updateProgressComment,
   verifyCredential

package/dist/mcp/review.d.ts

@@ -23,20 +23,6 @@ export declare const TRANSIENT_REVIEW_RETRY_DELAYS_MS: number[];
  */
 export declare function commentableLinesForFile(patch: string | undefined): CommentableLines;
 export declare function buildCommentableMap(ctx: ToolContext, pullNumber: number): Promise<Map<string, CommentableLines>>;
-/**
- * count unresolved review threads on a PR whose root comment was authored by
- * Pullfrog's bot. this is the full set of open Pullfrog findings on the PR —
- * the basis for both the never-approve-with-outstanding-issues invariant (the
- * approval gate below) and the `pullfrog-approval` status verdict. it is a
- * function of all open findings, NOT just the latest commit's delta.
- *
- * outdated-but-unresolved threads still count — GitHub marks a thread
- * `[OUTDATED]` when the anchor line moved (reformat, rename, force-push), which
- * is not the same as the concern being addressed. human-reviewer threads are
- * excluded: they belong to those reviewers to resolve. walks every page so a
- * long-lived PR with >100 threads can't hide an outstanding finding.
- */
-export declare function countOutstandingPullfrogThreads(ctx: ToolContext, pullNumber: number): Promise<number>;
 /**
  * proactive approve-when-clean for the Fix-all / Fix-👍s flow (`fix_review`
  * trigger). when such a run completes successfully and every Pullfrog-originated

package/dist/utils/billingErrors.d.ts

@@ -63,6 +63,7 @@ export declare function commercialPaywallBody(params: {
     reason: CommercialRefusal;
     ownerLogin: string;
     url: string;
+    freshReply?: boolean | undefined;
 }): string;
 /**
  * commercial-gate copy for action runs, linked to the account billing card.

package/dist/utils/codexHome.d.ts

@@ -1,3 +1,4 @@
+export declare function clearInstalledSubscription(name: "CODEX_AUTH_JSON" | "GROK_AUTH_JSON"): void;
 /** sandbox-hidden home for pullfrog-managed on-disk secrets in CI. bash via
  * MCP shell tmpfs-overlays this path; opencode's internal auth module
  * bypasses external_directory and reaches the real file. mirrors the

package/dist/utils/credentialPool.d.ts

@@ -0,0 +1,10 @@
+import type { RunContextData } from "./runContextData.ts";
+/** load one subscription per provider for model discovery; keep the pool unflattened. */
+export declare function initializeCredentialPool(ctx: RunContextData, model?: string): Promise<void>;
+export declare function resolvePoolModel(input: {
+    codexAgent: boolean;
+}): string | undefined;
+export declare function selectConfiguredCredential(input: {
+    ctx: RunContextData;
+    model: string | undefined;
+}): Promise<boolean>;

package/dist/utils/outstandingThreads.d.ts

@@ -0,0 +1,25 @@
+/** the slice of a run or webhook context the query needs — shared by the action and the server. */
+export type OutstandingThreadsCtx = {
+    octokit: {
+        graphql: <T>(query: string, variables: Record<string, unknown>) => Promise<T>;
+    };
+    repo: {
+        owner: string;
+        name: string;
+    };
+};
+/**
+ * count unresolved review threads on a PR whose root comment was authored by
+ * Pullfrog's bot. this is the full set of open Pullfrog findings on the PR —
+ * the basis for both the never-approve-with-outstanding-issues invariant (the
+ * approval gate in create_pull_request_review) and the `pullfrog-approval`
+ * status verdict. it is a function of all open findings, NOT just the latest
+ * commit's delta.
+ *
+ * outdated-but-unresolved threads still count — GitHub marks a thread
+ * `[OUTDATED]` when the anchor line moved (reformat, rename, force-push), which
+ * is not the same as the concern being addressed. human-reviewer threads are
+ * excluded: they belong to those reviewers to resolve. walks every page so a
+ * long-lived PR with >100 threads can't hide an outstanding finding.
+ */
+export declare function countOutstandingPullfrogThreads(ctx: OutstandingThreadsCtx, pullNumber: number): Promise<number>;

package/dist/utils/payload.d.ts

@@ -11,7 +11,7 @@ export declare const JsonPayload: import("arktype/internal/variants/object.ts").
         tier: "minimal" | "light" | "standard" | "deep";
         stakes: number;
         workload: number;
-        source: "scorer" | "heuristic" | "fixed";
+        source: "jev" | "scorer" | "heuristic" | "fixed";
         rationale: string;
     } | undefined;
     effort?: string | number | undefined;
@@ -65,7 +65,7 @@ export declare function resolvePayload(resolvedPromptInput: ResolvedPromptInput,
         tier: "minimal" | "light" | "standard" | "deep";
         stakes: number;
         workload: number;
-        source: "scorer" | "heuristic" | "fixed";
+        source: "jev" | "scorer" | "heuristic" | "fixed";
         rationale: string;
     } | undefined;
     effort: number | undefined;

package/dist/utils/runContext.d.ts

@@ -2,6 +2,7 @@ import type { PushPermission, ShellPermission } from "../external.ts";
 import type { RouterTier } from "../models.ts";
 import type { CommercialRefusal } from "./billingErrors.ts";
 import type { RepoContext } from "./github.ts";
+import type { CredentialAccess } from "./subscriptionCredentials.ts";
 export interface Mode {
     id: string;
     name: string;
@@ -57,6 +58,7 @@ export interface RepoSettings {
  */
 export type AccountPlan = "none" | "payg";
 export interface RunContext {
+    credentialAccess?: CredentialAccess | undefined;
     settings: RepoSettings;
     apiToken: string;
     oss: boolean;

package/dist/utils/runContextData.d.ts

@@ -3,7 +3,9 @@ import type { RouterTier } from "../models.ts";
 import type { CommercialRefusal } from "./billingErrors.ts";
 import { type OctokitWithPlugins } from "./github.ts";
 import { type AccountPlan, type RepoSettings } from "./runContext.ts";
+import type { CredentialAccess } from "./subscriptionCredentials.ts";
 export interface RunContextData {
+    credentialAccess?: CredentialAccess | undefined;
     repo: {
         owner: string;
         name: string;

package/dist/utils/setup.d.ts

@@ -5,9 +5,15 @@ export interface SetupOptions {
     tempDir: string;
 }
 /**
- * Create a shared temp directory for the action
+ * Create a shared temp directory for the action, removed when the run's scope
+ * exits. a persistent self-hosted runner never wipes `/tmp`, so every run used
+ * to leave its tree (the OpenCode install alone is hundreds of MB) until the
+ * disk filled and every job on the runner died.
  */
-export declare function createTempDirectory(): string;
+export declare function createTempDirectory(): {
+    path: string;
+    [Symbol.dispose]: () => void;
+};
 /**
  * snapshot-and-delete the GHA runner's known credential leak surfaces inside
  * `$RUNNER_TEMP` before the agent spawns. without this, a shell-capable agent

package/dist/utils/subscriptionCredentials.d.ts

@@ -0,0 +1,80 @@
+import { z } from "zod";
+export declare const subscriptionNameSchema: z.ZodEnum<{
+    CLAUDE_CODE_OAUTH_TOKEN: "CLAUDE_CODE_OAUTH_TOKEN";
+    CODEX_AUTH_JSON: "CODEX_AUTH_JSON";
+    GROK_AUTH_JSON: "GROK_AUTH_JSON";
+}>;
+export type SubscriptionName = z.infer<typeof subscriptionNameSchema>;
+export declare const subscriptionSchema: z.ZodObject<{
+    id: z.ZodString;
+    credentialId: z.ZodString;
+    name: z.ZodEnum<{
+        CLAUDE_CODE_OAUTH_TOKEN: "CLAUDE_CODE_OAUTH_TOKEN";
+        CODEX_AUTH_JSON: "CODEX_AUTH_JSON";
+        GROK_AUTH_JSON: "GROK_AUTH_JSON";
+    }>;
+    label: z.ZodString;
+    owner: z.ZodString;
+    inherited: z.ZodBoolean;
+    shared: z.ZodBoolean;
+    registeredAt: z.ZodString;
+}, z.core.$strip>;
+export type Subscription = z.infer<typeof subscriptionSchema>;
+export declare const subscriptionListSchema: z.ZodObject<{
+    subscriptions: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        credentialId: z.ZodString;
+        name: z.ZodEnum<{
+            CLAUDE_CODE_OAUTH_TOKEN: "CLAUDE_CODE_OAUTH_TOKEN";
+            CODEX_AUTH_JSON: "CODEX_AUTH_JSON";
+            GROK_AUTH_JSON: "GROK_AUTH_JSON";
+        }>;
+        label: z.ZodString;
+        owner: z.ZodString;
+        inherited: z.ZodBoolean;
+        shared: z.ZodBoolean;
+        registeredAt: z.ZodString;
+    }, z.core.$strip>>;
+    writable: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const subscriptionInputSchema: z.ZodObject<{
+    name: z.ZodEnum<{
+        CLAUDE_CODE_OAUTH_TOKEN: "CLAUDE_CODE_OAUTH_TOKEN";
+        CODEX_AUTH_JSON: "CODEX_AUTH_JSON";
+        GROK_AUTH_JSON: "GROK_AUTH_JSON";
+    }>;
+    value: z.ZodString;
+    replaceId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const credentialCandidateSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    source: z.ZodEnum<{
+        repo: "repo";
+        account: "account";
+        personal: "personal";
+    }>;
+}, z.core.$strip>;
+export type CredentialCandidate = z.infer<typeof credentialCandidateSchema>;
+export declare const credentialAccessSchema: z.ZodObject<{
+    token: z.ZodString;
+    candidates: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        source: z.ZodEnum<{
+            repo: "repo";
+            account: "account";
+            personal: "personal";
+        }>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type CredentialAccess = z.infer<typeof credentialAccessSchema>;
+export declare const selectedCredentialSchema: z.ZodObject<{
+    name: z.ZodString;
+    value: z.ZodString;
+    receipt: z.ZodString;
+}, z.core.$strip>;
+export declare function subscriptionLabel(input: {
+    email: string | null;
+    suffix: string;
+}): string;