pullfrog 0.1.84 → 0.1.85

package/dist/internal/index.d.ts

@@ -26,6 +26,8 @@ export { createLeapingProgressComment, deleteProgressCommentApi, getProgressComm
 export { PROVIDER_DASHBOARDS, type ProviderDashboard } from "../utils/providerDashboards.ts";
 export type { RunStatusCheckConclusion, RunStatusCheckOctokit, } from "../utils/runStatusCheck.ts";
 export { APPROVAL_CHECK_NAME, createRunStatusCheck, finalizeRunStatusCheck, RUN_STATUS_CHECK_NAME, runStatusCheckNeedsFinalizing, } from "../utils/runStatusCheck.ts";
+export * from "../utils/subscriptionCredentials.ts";
+export { probeSubscription, SubscriptionCredentialError, subscriptionIdentity, } from "../utils/subscriptionProbe.ts";
 export { isValidTimeString, parseTimeString, TIMEOUT_DISABLED, } from "../utils/time.ts";
 export type { XaiAuthBody } from "../utils/xaiOAuth.ts";
 export { parseXaiAuthBody, refreshXaiAuthBody, stringifyXaiAuthBody, } from "../utils/xaiOAuth.ts";

package/dist/internal.js

@@ -8,7 +8,7 @@ var __export = (target, all) => {
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.84",
+  version: "0.1.85",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -15000,6 +15000,17 @@ var providers = {
         // see the big-pickle note above (#1077).
         isFree: true
       },
+      // Zen's FREE Meituan preview (listed 2026-09-25). Zen's docs: zero
+      // retention, no training. Go lists the same free id, but one key reaches
+      // both, so the promo gets one row, here with the other free ones.
+      "longcat-preview": {
+        displayName: "LongCat Preview",
+        description: "Meituan preview, free for a limited time",
+        resolve: "opencode/longcat-2.5-preview-free",
+        // free to run, still gated on the provider's own OPENCODE_API_KEY —
+        // see the big-pickle note above (#1077).
+        isFree: true
+      },
       // Zen's live free MiMo, and the second free row in a menu that big-pickle
       // was alone in since `mimo-v2-pro-free` lost its model.
       mimo: {
@@ -15633,7 +15644,7 @@ function isRouterTier(value) {
 }
 var PROVIDER_LADDERS = {
   anthropic: {
-    minimal: "anthropic/claude-haiku",
+    minimal: "anthropic/claude-sonnet",
     light: "anthropic/claude-sonnet",
     standard: "anthropic/claude-opus",
     deep: "anthropic/claude-opus"
@@ -16211,35 +16222,25 @@ var modes = computeModes("opencode");
 
 // utils/billingErrors.ts
 function commercialPaywallBody(params) {
-  const pitch = "Pro is required on private organization repos like this one: a flat $30/month per organization for unlimited runs, members, and repos.";
+  let action;
   switch (params.reason) {
     case "commercial":
-      return [
-        `**${params.ownerLogin}'s Pullfrog trial has expired.**`,
-        "",
-        pitch,
-        "",
-        `[Upgrade now \u2192](${params.url})`
-      ].join("\n");
+      action = "upgrade";
+      break;
     case "subscription_ended":
-      return [
-        `**${params.ownerLogin}'s Pullfrog Pro subscription has ended.**`,
-        "",
-        pitch,
-        "",
-        `[Resubscribe \u2192](${params.url})`
-      ].join("\n");
+      action = "resubscribe";
+      break;
     case "subscription_unpaid":
-      return [
-        `**Pullfrog paused runs on ${params.ownerLogin}: the Pro renewal failed.**`,
-        "",
-        "Update the card on file to resume runs.",
-        "",
-        `[Update billing \u2192](${params.url})`
-      ].join("\n");
+      action = "update billing";
+      break;
     default:
       return params.reason;
   }
+  return [
+    `**Pullfrog is ${params.freshReply ? "still paused" : "paused"} for ${params.ownerLogin}.**`,
+    "",
+    `An org owner can [${action}](${params.url}) to resume private-repo runs.`
+  ].join("\n");
 }
 
 // utils/buildPullfrogFooter.ts
@@ -16935,19 +16936,47 @@ async function runStatusCheckNeedsFinalizing(params) {
   }
 }
 
-// utils/time.ts
-var TIMEOUT_DISABLED = "none";
-var TIME_STRING_REGEX = /^(?:(\d+)h)?(?:(\d+)m)?(?:(\d+)s)?$/;
-function parseTimeString(input) {
-  const match = input.match(TIME_STRING_REGEX);
-  if (!match || !match[1] && !match[2] && !match[3]) return null;
-  const hours = parseInt(match[1] || "0", 10);
-  const minutes = parseInt(match[2] || "0", 10);
-  const seconds = parseInt(match[3] || "0", 10);
-  return (hours * 3600 + minutes * 60 + seconds) * 1e3;
-}
-function isValidTimeString(input) {
-  return parseTimeString(input) !== null;
+// utils/subscriptionCredentials.ts
+var subscriptionNameSchema = external_exports.enum([
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "CODEX_AUTH_JSON",
+  "GROK_AUTH_JSON"
+]);
+var subscriptionSchema = external_exports.object({
+  id: external_exports.string(),
+  credentialId: external_exports.string(),
+  name: subscriptionNameSchema,
+  label: external_exports.string(),
+  owner: external_exports.string(),
+  inherited: external_exports.boolean(),
+  shared: external_exports.boolean(),
+  registeredAt: external_exports.string()
+});
+var subscriptionListSchema = external_exports.object({
+  subscriptions: external_exports.array(subscriptionSchema),
+  writable: external_exports.boolean()
+});
+var subscriptionInputSchema = external_exports.object({
+  name: subscriptionNameSchema,
+  value: external_exports.string().trim().min(1).refine((value) => Buffer.byteLength(value, "utf8") <= 49152),
+  replaceId: external_exports.string().optional()
+});
+var credentialCandidateSchema = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  source: external_exports.enum(["repo", "account", "personal"])
+});
+var credentialAccessSchema = external_exports.object({
+  token: external_exports.string(),
+  candidates: external_exports.array(credentialCandidateSchema)
+});
+var selectedCredentialSchema = external_exports.object({
+  name: external_exports.string(),
+  value: external_exports.string(),
+  receipt: external_exports.string()
+});
+function subscriptionLabel(input) {
+  return input.email ?? `\u2022\u2022\u2022\u2022 ${input.suffix}`;
 }
 
 // utils/xaiOAuth.ts
@@ -17012,6 +17041,137 @@ function stringifyXaiAuthBody(body) {
   return `${JSON.stringify(body, null, 2)}
 `;
 }
+
+// utils/subscriptionProbe.ts
+var identitySchema = external_exports.object({
+  email: external_exports.string().email().optional(),
+  sub: external_exports.string().optional(),
+  user_id: external_exports.string().optional(),
+  account_id: external_exports.string().optional(),
+  email_verified: external_exports.boolean().optional()
+});
+var codexUsageSchema = external_exports.object({
+  rate_limit: external_exports.object({ allowed: external_exports.boolean(), limit_reached: external_exports.boolean() }).optional()
+});
+var SubscriptionCredentialError = class extends Error {
+};
+async function subscriptionIdentity(input) {
+  const empty = { email: null, subject: null };
+  if (input.name === "CLAUDE_CODE_OAUTH_TOKEN") return empty;
+  const codex = input.name === "CODEX_AUTH_JSON" ? parseCodexAuthBody(input.value) : null;
+  const grok = input.name === "GROK_AUTH_JSON" ? parseXaiAuthBody(input.value) : null;
+  const token = codex?.tokens.access_token ?? grok?.tokens.access_token;
+  if (!token) throw new SubscriptionCredentialError("invalid subscription credential");
+  const response = await readSubscriptionEndpoint({
+    url: codex ? "https://chatgpt.com/backend-api/wham/usage" : "https://auth.x.ai/oauth2/userinfo",
+    token,
+    accountId: codex?.tokens.account_id
+  });
+  if (response?.status === 401)
+    throw new SubscriptionCredentialError("subscription credential was rejected");
+  if (!response?.ok) return empty;
+  const parsed = identitySchema.safeParse(await response.json().catch(() => null));
+  if (!parsed.success) return empty;
+  const subject = parsed.data.sub ?? parsed.data.user_id;
+  return {
+    email: parsed.data.email_verified === false ? null : parsed.data.email ?? null,
+    subject: subject ? `${subject}:${parsed.data.account_id ?? ""}` : null
+  };
+}
+async function readSubscriptionEndpoint(input) {
+  const headers = new Headers({ authorization: `Bearer ${input.token}` });
+  if (input.accountId) headers.set("ChatGPT-Account-Id", input.accountId);
+  if (input.grokBilling) headers.set("x-xai-token-auth", "xai-grok-cli");
+  return fetch(input.url, {
+    headers,
+    redirect: "error",
+    signal: AbortSignal.timeout(1e4)
+  }).catch(() => null);
+}
+async function probeSubscription(input) {
+  if (input.name === "CLAUDE_CODE_OAUTH_TOKEN") {
+    const result = await preflightClaudeSubscription({ token: input.value, model: input.model });
+    return result.usable ? "usable" : "rejected";
+  }
+  const codex = input.name === "CODEX_AUTH_JSON" ? parseCodexAuthBody(input.value) : null;
+  const grok = input.name === "GROK_AUTH_JSON" ? parseXaiAuthBody(input.value) : null;
+  const auth = codex ?? grok;
+  if (!auth || auth.refresh_rejected_at) return "rejected";
+  if (grok && input.model)
+    return probeInference({
+      name: "XAI_API_KEY",
+      value: grok.tokens.access_token,
+      model: input.model
+    });
+  const response = await readSubscriptionEndpoint({
+    url: codex ? "https://chatgpt.com/backend-api/wham/usage" : "https://cli-chat-proxy.grok.com/v1/billing?format=credits",
+    token: auth.tokens.access_token,
+    accountId: codex?.tokens.account_id,
+    grokBilling: !!grok
+  });
+  if (response?.status === 401) return "rejected";
+  if (!response?.ok) return "unknown";
+  const body = await response.json().catch(() => null);
+  if (codex) {
+    const parsed = codexUsageSchema.safeParse(body);
+    const limit = parsed.success ? parsed.data.rate_limit : void 0;
+    if (!limit) return "unknown";
+    return limit.allowed && !limit.limit_reached ? "usable" : "rejected";
+  }
+  return "unknown";
+}
+async function probeInference(input) {
+  const anthropic = input.name === "ANTHROPIC_API_KEY";
+  const openai = input.name === "OPENAI_API_KEY";
+  if (!anthropic && !openai && input.name !== "XAI_API_KEY") {
+    const result = await verifyCredential({ envVar: input.name, value: input.value });
+    return result === "dead" ? "rejected" : result === "alive" ? "usable" : "unknown";
+  }
+  const headers = new Headers({ "content-type": "application/json" });
+  if (anthropic) {
+    headers.set("x-api-key", input.value);
+    headers.set("anthropic-version", "2023-06-01");
+  } else headers.set("authorization", `Bearer ${input.value}`);
+  const response = await fetch(
+    anthropic ? "https://api.anthropic.com/v1/messages" : openai ? "https://api.openai.com/v1/responses" : "https://api.x.ai/v1/chat/completions",
+    {
+      method: "POST",
+      headers,
+      body: JSON.stringify(
+        openai ? { model: input.model, input: "Reply OK.", max_output_tokens: 16, store: false } : {
+          model: input.model,
+          messages: [{ role: "user", content: "Reply OK." }],
+          max_tokens: 1
+        }
+      ),
+      redirect: "error",
+      signal: AbortSignal.timeout(1e4)
+    }
+  ).catch(() => null);
+  if (response?.status === 400 && input.name === "XAI_API_KEY") {
+    const error48 = external_exports.object({ error: external_exports.string() }).safeParse(await response.json().catch(() => null));
+    return error48.success && error48.data.error.startsWith("Incorrect API key provided.") ? "rejected" : "unknown";
+  }
+  await response?.body?.cancel();
+  if (!response) return "unknown";
+  if (response.ok) return "usable";
+  return [401, 402, 403, 429].includes(response.status) ? "rejected" : "unknown";
+}
+
+// utils/time.ts
+var TIMEOUT_DISABLED = "none";
+var TIME_STRING_REGEX = /^(?:(\d+)h)?(?:(\d+)m)?(?:(\d+)s)?$/;
+function parseTimeString(input) {
+  const match = input.match(TIME_STRING_REGEX);
+  if (!match || !match[1] && !match[2] && !match[3]) return null;
+  const hours = parseInt(match[1] || "0", 10);
+  const minutes = parseInt(match[2] || "0", 10);
+  const seconds = parseInt(match[3] || "0", 10);
+  return (hours * 3600 + minutes * 60 + seconds) * 1e3;
+}
+function isValidTimeString(input) {
+  return parseTimeString(input) !== null;
+}
 export {
   APPROVAL_CHECK_NAME,
   AUTO_EFFICIENT,
@@ -17036,6 +17196,7 @@ export {
   ROUTER_TIERS,
   RUN_STATUS_CHECK_NAME,
   SUBSIDY_RUNG,
+  SubscriptionCredentialError,
   TIMEOUT_DISABLED,
   autoLadder,
   autoRoutedSlug,
@@ -17048,6 +17209,8 @@ export {
   countOutstandingPullfrogThreads,
   createLeapingProgressComment,
   createRunStatusCheck,
+  credentialAccessSchema,
+  credentialCandidateSchema,
   decodeJwtExpMs,
   defaultAutoTier,
   deleteProgressCommentApi,
@@ -17081,6 +17244,7 @@ export {
   parseModel,
   parseTimeString,
   parseXaiAuthBody,
+  probeSubscription,
   providers,
   pullfrogMcpName,
   refreshCodexAuthBody,
@@ -17096,9 +17260,16 @@ export {
   runStatusCheckNeedsFinalizing,
   rungLabel,
   rungPosition,
+  selectedCredentialSchema,
   stringifyCodexAuthBody,
   stringifyXaiAuthBody,
   stripExistingFooter,
+  subscriptionIdentity,
+  subscriptionInputSchema,
+  subscriptionLabel,
+  subscriptionListSchema,
+  subscriptionNameSchema,
+  subscriptionSchema,
   truncateAtLineBoundary,
   updateProgressComment,
   verifyCredential

package/dist/utils/billingErrors.d.ts

@@ -63,6 +63,7 @@ export declare function commercialPaywallBody(params: {
     reason: CommercialRefusal;
     ownerLogin: string;
     url: string;
+    freshReply?: boolean | undefined;
 }): string;
 /**
  * commercial-gate copy for action runs, linked to the account billing card.

package/dist/utils/codexHome.d.ts

@@ -1,3 +1,4 @@
+export declare function clearInstalledSubscription(name: "CODEX_AUTH_JSON" | "GROK_AUTH_JSON"): void;
 /** sandbox-hidden home for pullfrog-managed on-disk secrets in CI. bash via
  * MCP shell tmpfs-overlays this path; opencode's internal auth module
  * bypasses external_directory and reaches the real file. mirrors the

package/dist/utils/credentialPool.d.ts

@@ -0,0 +1,10 @@
+import type { RunContextData } from "./runContextData.ts";
+/** load one subscription per provider for model discovery; keep the pool unflattened. */
+export declare function initializeCredentialPool(ctx: RunContextData, model?: string): Promise<void>;
+export declare function resolvePoolModel(input: {
+    codexAgent: boolean;
+}): string | undefined;
+export declare function selectConfiguredCredential(input: {
+    ctx: RunContextData;
+    model: string | undefined;
+}): Promise<boolean>;

package/dist/utils/runContext.d.ts

@@ -2,6 +2,7 @@ import type { PushPermission, ShellPermission } from "../external.ts";
 import type { RouterTier } from "../models.ts";
 import type { CommercialRefusal } from "./billingErrors.ts";
 import type { RepoContext } from "./github.ts";
+import type { CredentialAccess } from "./subscriptionCredentials.ts";
 export interface Mode {
     id: string;
     name: string;
@@ -57,6 +58,7 @@ export interface RepoSettings {
  */
 export type AccountPlan = "none" | "payg";
 export interface RunContext {
+    credentialAccess?: CredentialAccess | undefined;
     settings: RepoSettings;
     apiToken: string;
     oss: boolean;

package/dist/utils/runContextData.d.ts

@@ -3,7 +3,9 @@ import type { RouterTier } from "../models.ts";
 import type { CommercialRefusal } from "./billingErrors.ts";
 import { type OctokitWithPlugins } from "./github.ts";
 import { type AccountPlan, type RepoSettings } from "./runContext.ts";
+import type { CredentialAccess } from "./subscriptionCredentials.ts";
 export interface RunContextData {
+    credentialAccess?: CredentialAccess | undefined;
     repo: {
         owner: string;
         name: string;

package/dist/utils/setup.d.ts

@@ -5,9 +5,15 @@ export interface SetupOptions {
     tempDir: string;
 }
 /**
- * Create a shared temp directory for the action
+ * Create a shared temp directory for the action, removed when the run's scope
+ * exits. a persistent self-hosted runner never wipes `/tmp`, so every run used
+ * to leave its tree (the OpenCode install alone is hundreds of MB) until the
+ * disk filled and every job on the runner died.
  */
-export declare function createTempDirectory(): string;
+export declare function createTempDirectory(): {
+    path: string;
+    [Symbol.dispose]: () => void;
+};
 /**
  * snapshot-and-delete the GHA runner's known credential leak surfaces inside
  * `$RUNNER_TEMP` before the agent spawns. without this, a shell-capable agent

package/dist/utils/subscriptionCredentials.d.ts

@@ -0,0 +1,80 @@
+import { z } from "zod";
+export declare const subscriptionNameSchema: z.ZodEnum<{
+    CLAUDE_CODE_OAUTH_TOKEN: "CLAUDE_CODE_OAUTH_TOKEN";
+    CODEX_AUTH_JSON: "CODEX_AUTH_JSON";
+    GROK_AUTH_JSON: "GROK_AUTH_JSON";
+}>;
+export type SubscriptionName = z.infer<typeof subscriptionNameSchema>;
+export declare const subscriptionSchema: z.ZodObject<{
+    id: z.ZodString;
+    credentialId: z.ZodString;
+    name: z.ZodEnum<{
+        CLAUDE_CODE_OAUTH_TOKEN: "CLAUDE_CODE_OAUTH_TOKEN";
+        CODEX_AUTH_JSON: "CODEX_AUTH_JSON";
+        GROK_AUTH_JSON: "GROK_AUTH_JSON";
+    }>;
+    label: z.ZodString;
+    owner: z.ZodString;
+    inherited: z.ZodBoolean;
+    shared: z.ZodBoolean;
+    registeredAt: z.ZodString;
+}, z.core.$strip>;
+export type Subscription = z.infer<typeof subscriptionSchema>;
+export declare const subscriptionListSchema: z.ZodObject<{
+    subscriptions: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        credentialId: z.ZodString;
+        name: z.ZodEnum<{
+            CLAUDE_CODE_OAUTH_TOKEN: "CLAUDE_CODE_OAUTH_TOKEN";
+            CODEX_AUTH_JSON: "CODEX_AUTH_JSON";
+            GROK_AUTH_JSON: "GROK_AUTH_JSON";
+        }>;
+        label: z.ZodString;
+        owner: z.ZodString;
+        inherited: z.ZodBoolean;
+        shared: z.ZodBoolean;
+        registeredAt: z.ZodString;
+    }, z.core.$strip>>;
+    writable: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const subscriptionInputSchema: z.ZodObject<{
+    name: z.ZodEnum<{
+        CLAUDE_CODE_OAUTH_TOKEN: "CLAUDE_CODE_OAUTH_TOKEN";
+        CODEX_AUTH_JSON: "CODEX_AUTH_JSON";
+        GROK_AUTH_JSON: "GROK_AUTH_JSON";
+    }>;
+    value: z.ZodString;
+    replaceId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const credentialCandidateSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    source: z.ZodEnum<{
+        repo: "repo";
+        account: "account";
+        personal: "personal";
+    }>;
+}, z.core.$strip>;
+export type CredentialCandidate = z.infer<typeof credentialCandidateSchema>;
+export declare const credentialAccessSchema: z.ZodObject<{
+    token: z.ZodString;
+    candidates: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        source: z.ZodEnum<{
+            repo: "repo";
+            account: "account";
+            personal: "personal";
+        }>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type CredentialAccess = z.infer<typeof credentialAccessSchema>;
+export declare const selectedCredentialSchema: z.ZodObject<{
+    name: z.ZodString;
+    value: z.ZodString;
+    receipt: z.ZodString;
+}, z.core.$strip>;
+export declare function subscriptionLabel(input: {
+    email: string | null;
+    suffix: string;
+}): string;

package/dist/utils/subscriptionProbe.d.ts

@@ -0,0 +1,22 @@
+import type { SubscriptionName } from "./subscriptionCredentials.ts";
+export declare class SubscriptionCredentialError extends Error {
+}
+export declare function subscriptionIdentity(input: {
+    name: SubscriptionName;
+    value: string;
+}): Promise<{
+    email: string | null;
+    subject: string | null;
+}>;
+/** unknown quota is not a reason to skip a credential or change who pays. */
+export declare function probeSubscription(input: {
+    name: SubscriptionName;
+    value: string;
+    model?: string | undefined;
+}): Promise<"usable" | "rejected" | "unknown">;
+/** probe the chosen model, not a models-list permission a restricted key may lack. */
+export declare function probeInference(input: {
+    name: string;
+    value: string;
+    model: string;
+}): Promise<"usable" | "rejected" | "unknown">;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.84",
+  "version": "0.1.85",
   "cliContractVersion": "1",
   "type": "module",
   "bin": {