pullfrog 0.1.84 → 0.1.86

package/dist/cli.mjs

@@ -96,7 +96,7 @@ var require_arg = __commonJS({
         Object.setPrototypeOf(this, _ArgError.prototype);
       }
     };
-    function arg9(opts, {
+    function arg10(opts, {
       argv = process.argv.slice(2),
       permissive = false,
       stopAtPositional = false
@@ -171,15 +171,15 @@ var require_arg = __commonJS({
         if (wholeArg.length > 1 && wholeArg[0] === "-") {
           const separatedArguments = wholeArg[1] === "-" || wholeArg.length === 2 ? [wholeArg] : wholeArg.slice(1).split("").map((a2) => `-${a2}`);
           for (let j2 = 0; j2 < separatedArguments.length; j2++) {
-            const arg10 = separatedArguments[j2];
-            const [originalArgName, argStr] = arg10[1] === "-" ? arg10.split(/=(.*)/, 2) : [arg10, void 0];
+            const arg11 = separatedArguments[j2];
+            const [originalArgName, argStr] = arg11[1] === "-" ? arg11.split(/=(.*)/, 2) : [arg11, void 0];
             let argName = originalArgName;
             while (argName in aliases) {
               argName = aliases[argName];
             }
             if (!(argName in handlers2)) {
               if (permissive) {
-                result._.push(arg10);
+                result._.push(arg11);
                 continue;
               } else {
                 throw new ArgError(
@@ -218,13 +218,13 @@ var require_arg = __commonJS({
       }
       return result;
     }
-    arg9.flag = (fn2) => {
+    arg10.flag = (fn2) => {
       fn2[flagSymbol] = true;
       return fn2;
     };
-    arg9.COUNT = arg9.flag((v, name, existingCount) => (existingCount || 0) + 1);
-    arg9.ArgError = ArgError;
-    module.exports = arg9;
+    arg10.COUNT = arg10.flag((v, name, existingCount) => (existingCount || 0) + 1);
+    arg10.ArgError = ArgError;
+    module.exports = arg10;
   }
 });
 
@@ -2094,13 +2094,13 @@ var init_doc = __esm({
         fn2(this);
         this.indent -= 1;
       }
-      write(arg9) {
-        if (typeof arg9 === "function") {
-          arg9(this, { execution: "sync" });
-          arg9(this, { execution: "async" });
+      write(arg10) {
+        if (typeof arg10 === "function") {
+          arg10(this, { execution: "sync" });
+          arg10(this, { execution: "async" });
           return;
         }
-        const content = arg9;
+        const content = arg10;
         const lines = content.split("\n").filter((x2) => x2);
         const minIndent = Math.min(...lines.map((x2) => x2.length - x2.trimStart().length));
         const dedented = lines.map((x2) => x2.slice(minIndent)).map((x2) => " ".repeat(this.indent * 2) + x2);
@@ -31439,11 +31439,11 @@ var require_toolrunner = __commonJS({
         const upperToolPath = this.toolPath.toUpperCase();
         return this._endsWith(upperToolPath, ".CMD") || this._endsWith(upperToolPath, ".BAT");
       }
-      _windowsQuoteCmdArg(arg9) {
+      _windowsQuoteCmdArg(arg10) {
         if (!this._isCmdFile()) {
-          return this._uvQuoteCmdArg(arg9);
+          return this._uvQuoteCmdArg(arg10);
         }
-        if (!arg9) {
+        if (!arg10) {
           return '""';
         }
         const cmdSpecialChars = [
@@ -31471,22 +31471,22 @@ var require_toolrunner = __commonJS({
           '"'
         ];
         let needsQuotes = false;
-        for (const char of arg9) {
+        for (const char of arg10) {
           if (cmdSpecialChars.some((x2) => x2 === char)) {
             needsQuotes = true;
             break;
           }
         }
         if (!needsQuotes) {
-          return arg9;
+          return arg10;
         }
         let reverse = '"';
         let quoteHit = true;
-        for (let i2 = arg9.length; i2 > 0; i2--) {
-          reverse += arg9[i2 - 1];
-          if (quoteHit && arg9[i2 - 1] === "\\") {
+        for (let i2 = arg10.length; i2 > 0; i2--) {
+          reverse += arg10[i2 - 1];
+          if (quoteHit && arg10[i2 - 1] === "\\") {
             reverse += "\\";
-          } else if (arg9[i2 - 1] === '"') {
+          } else if (arg10[i2 - 1] === '"') {
             quoteHit = true;
             reverse += '"';
           } else {
@@ -31496,23 +31496,23 @@ var require_toolrunner = __commonJS({
         reverse += '"';
         return reverse.split("").reverse().join("");
       }
-      _uvQuoteCmdArg(arg9) {
-        if (!arg9) {
+      _uvQuoteCmdArg(arg10) {
+        if (!arg10) {
           return '""';
         }
-        if (!arg9.includes(" ") && !arg9.includes("	") && !arg9.includes('"')) {
-          return arg9;
+        if (!arg10.includes(" ") && !arg10.includes("	") && !arg10.includes('"')) {
+          return arg10;
         }
-        if (!arg9.includes('"') && !arg9.includes("\\")) {
-          return `"${arg9}"`;
+        if (!arg10.includes('"') && !arg10.includes("\\")) {
+          return `"${arg10}"`;
         }
         let reverse = '"';
         let quoteHit = true;
-        for (let i2 = arg9.length; i2 > 0; i2--) {
-          reverse += arg9[i2 - 1];
-          if (quoteHit && arg9[i2 - 1] === "\\") {
+        for (let i2 = arg10.length; i2 > 0; i2--) {
+          reverse += arg10[i2 - 1];
+          if (quoteHit && arg10[i2 - 1] === "\\") {
             reverse += "\\";
-          } else if (arg9[i2 - 1] === '"') {
+          } else if (arg10[i2 - 1] === '"') {
             quoteHit = true;
             reverse += "\\";
           } else {
@@ -31566,8 +31566,8 @@ var require_toolrunner = __commonJS({
           return new Promise((resolve3, reject) => __awaiter(this, void 0, void 0, function* () {
             this._debug(`exec tool: ${this.toolPath}`);
             this._debug("arguments:");
-            for (const arg9 of this.args) {
-              this._debug(`   ${arg9}`);
+            for (const arg10 of this.args) {
+              this._debug(`   ${arg10}`);
             }
             const optionsNonNull = this._cloneExecOptions(this.options);
             if (!optionsNonNull.silent && optionsNonNull.outStream) {
@@ -31664,12 +31664,12 @@ var require_toolrunner = __commonJS({
       const args2 = [];
       let inQuotes = false;
       let escaped = false;
-      let arg9 = "";
+      let arg10 = "";
       function append2(c2) {
         if (escaped && c2 !== '"') {
-          arg9 += "\\";
+          arg10 += "\\";
         }
-        arg9 += c2;
+        arg10 += c2;
         escaped = false;
       }
       for (let i2 = 0; i2 < argString.length; i2++) {
@@ -31691,16 +31691,16 @@ var require_toolrunner = __commonJS({
           continue;
         }
         if (c2 === " " && !inQuotes) {
-          if (arg9.length > 0) {
-            args2.push(arg9);
-            arg9 = "";
+          if (arg10.length > 0) {
+            args2.push(arg10);
+            arg10 = "";
           }
           continue;
         }
         append2(c2);
       }
-      if (arg9.length > 0) {
-        args2.push(arg9.trim());
+      if (arg10.length > 0) {
+        args2.push(arg10.trim());
       }
       return args2;
     }
@@ -40191,20 +40191,20 @@ var require_escape = __commonJS({
   "node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/escape.js"(exports, module) {
     "use strict";
     var metaCharsRegExp = /([()\][%!^"`<>&|;, *?])/g;
-    function escapeCommand(arg9) {
-      arg9 = arg9.replace(metaCharsRegExp, "^$1");
-      return arg9;
-    }
-    function escapeArgument(arg9, doubleEscapeMetaChars) {
-      arg9 = `${arg9}`;
-      arg9 = arg9.replace(/(?=(\\+?)?)\1"/g, '$1$1\\"');
-      arg9 = arg9.replace(/(?=(\\+?)?)\1$/, "$1$1");
-      arg9 = `"${arg9}"`;
-      arg9 = arg9.replace(metaCharsRegExp, "^$1");
+    function escapeCommand(arg10) {
+      arg10 = arg10.replace(metaCharsRegExp, "^$1");
+      return arg10;
+    }
+    function escapeArgument(arg10, doubleEscapeMetaChars) {
+      arg10 = `${arg10}`;
+      arg10 = arg10.replace(/(?=(\\+?)?)\1"/g, '$1$1\\"');
+      arg10 = arg10.replace(/(?=(\\+?)?)\1$/, "$1$1");
+      arg10 = `"${arg10}"`;
+      arg10 = arg10.replace(metaCharsRegExp, "^$1");
       if (doubleEscapeMetaChars) {
-        arg9 = arg9.replace(metaCharsRegExp, "^$1");
+        arg10 = arg10.replace(metaCharsRegExp, "^$1");
       }
-      return arg9;
+      return arg10;
     }
     module.exports.command = escapeCommand;
     module.exports.argument = escapeArgument;
@@ -40292,7 +40292,7 @@ var require_parse3 = __commonJS({
         const needsDoubleEscapeMetaChars = isCmdShimRegExp.test(commandFile);
         parsed2.command = path4.normalize(parsed2.command);
         parsed2.command = escape2.command(parsed2.command);
-        parsed2.args = parsed2.args.map((arg9) => escape2.argument(arg9, needsDoubleEscapeMetaChars));
+        parsed2.args = parsed2.args.map((arg10) => escape2.argument(arg10, needsDoubleEscapeMetaChars));
         const shellCommand = [parsed2.command].concat(parsed2.args).join(" ");
         parsed2.args = ["/d", "/s", "/c", `"${shellCommand}"`];
         parsed2.command = process.env.comspec || "cmd.exe";
@@ -40581,10 +40581,10 @@ var require_timers2 = __commonJS({
        * before the specified function or code is executed.
        * @param {*} arg
        */
-      constructor(callback, delay2, arg9) {
+      constructor(callback, delay2, arg10) {
         this._onTimeout = callback;
         this._idleTimeout = delay2;
-        this._timerArg = arg9;
+        this._timerArg = arg10;
         this.refresh();
       }
       /**
@@ -40628,8 +40628,8 @@ var require_timers2 = __commonJS({
        * when the timer expires.
        * @returns {NodeJS.Timeout|FastTimer}
        */
-      setTimeout(callback, delay2, arg9) {
-        return delay2 <= RESOLUTION_MS ? setTimeout(callback, delay2, arg9) : new FastTimer(callback, delay2, arg9);
+      setTimeout(callback, delay2, arg10) {
+        return delay2 <= RESOLUTION_MS ? setTimeout(callback, delay2, arg10) : new FastTimer(callback, delay2, arg10);
       },
       /**
        * The clearTimeout method cancels an instantiated Timer previously created
@@ -40655,8 +40655,8 @@ var require_timers2 = __commonJS({
        * when the timer expires.
        * @returns {FastTimer}
        */
-      setFastTimeout(callback, delay2, arg9) {
-        return new FastTimer(callback, delay2, arg9);
+      setFastTimeout(callback, delay2, arg10) {
+        return new FastTimer(callback, delay2, arg10);
       },
       /**
        * The clearTimeout method cancels an instantiated FastTimer previously
@@ -69742,9 +69742,9 @@ var init_types = __esm({
         const { status, ctx } = this._processInputParams(input);
         const effect = this._def.effect || null;
         const checkCtx = {
-          addIssue: (arg9) => {
-            addIssueToContext(ctx, arg9);
-            if (arg9.fatal) {
+          addIssue: (arg10) => {
+            addIssueToContext(ctx, arg10);
+            if (arg10.fatal) {
               status.abort();
             } else {
               status.dirty();
@@ -71911,13 +71911,13 @@ var require_code = __commonJS({
       return new _Code(expr);
     }
     exports.str = str;
-    function addCodeArg(code, arg9) {
-      if (arg9 instanceof _Code)
-        code.push(...arg9._items);
-      else if (arg9 instanceof Name)
-        code.push(arg9);
+    function addCodeArg(code, arg10) {
+      if (arg10 instanceof _Code)
+        code.push(...arg10._items);
+      else if (arg10 instanceof Name)
+        code.push(arg10);
       else
-        code.push(interpolate(arg9));
+        code.push(interpolate(arg10));
     }
     exports.addCodeArg = addCodeArg;
     function optimize(expr) {
@@ -83548,8 +83548,8 @@ var require_select = __commonJS({
         return selectors[":is"](sel);
       },
       ":nth-match": function(param, last) {
-        var args2 = param.split(/\s*,\s*/), arg9 = args2.shift(), test = compileGroup(args2.join(","));
-        return nth(arg9, test, last);
+        var args2 = param.split(/\s*,\s*/), arg10 = args2.shift(), test = compileGroup(args2.join(","));
+        return nth(arg10, test, last);
       },
       ":nth-last-match": function(param) {
         return selectors[":nth-match"](param, true);
@@ -103311,7 +103311,7 @@ var init_file_type = __esm({
 });
 
 // cli.ts
-var import_arg8 = __toESM(require_arg(), 1);
+var import_arg9 = __toESM(require_arg(), 1);
 var import_picocolors5 = __toESM(require_picocolors(), 1);
 import { basename as basename2 } from "node:path";
 
@@ -104498,7 +104498,7 @@ ${f}
 var i = `${styleText2("gray", S_BAR)}  `;
 
 // commands/auth.ts
-var import_arg2 = __toESM(require_arg(), 1);
+var import_arg3 = __toESM(require_arg(), 1);
 var import_picocolors2 = __toESM(require_picocolors(), 1);
 
 // utils/codexAuth.ts
@@ -105528,8 +105528,8 @@ var ZodType = /* @__PURE__ */ $constructor("ZodType", (inst, def) => {
   inst.nullish = () => optional(nullable(inst));
   inst.nonoptional = (params) => nonoptional(inst, params);
   inst.array = () => array(inst);
-  inst.or = (arg9) => union([inst, arg9]);
-  inst.and = (arg9) => intersection(inst, arg9);
+  inst.or = (arg10) => union([inst, arg10]);
+  inst.and = (arg10) => intersection(inst, arg10);
   inst.transform = (tx) => pipe(inst, transform(tx));
   inst.default = (def2) => _default2(inst, def2);
   inst.prefault = (def2) => prefault(inst, def2);
@@ -107103,7 +107103,7 @@ var import_picocolors = __toESM(require_picocolors(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.84",
+  version: "0.1.86",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -107366,24 +107366,6 @@ async function fetchStatus(ctx) {
     hasRuns: result.data.hasRuns === true
   };
 }
-async function setPullfrogSecret(ctx) {
-  const result = await pullfrogApi({
-    path: "/api/cli/secrets",
-    token: ctx.token,
-    method: "POST",
-    body: {
-      owner: ctx.owner,
-      repo: ctx.repo,
-      name: ctx.name,
-      value: ctx.value,
-      scope: ctx.scope
-    }
-  });
-  if (result.ok && result.data.success === true) {
-    return { saved: true, error: "" };
-  }
-  return { saved: false, error: result.data.error || `api returned ${result.status}` };
-}
 function describeSecretTarget(ctx) {
   if (ctx.scope === "account") return `account ${import_picocolors.default.cyan(`@${ctx.owner}`)}`;
   return `repo ${import_picocolors.default.cyan(`${ctx.owner}/${ctx.repo}`)}`;
@@ -107479,8 +107461,125 @@ async function confirmChange(input) {
   }
 }
 
-// commands/secret.ts
+// commands/_subscriptions.ts
 var import_arg = __toESM(require_arg(), 1);
+
+// utils/subscriptionCredentials.ts
+var subscriptionNameSchema = external_exports.enum([
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "CODEX_AUTH_JSON",
+  "GROK_AUTH_JSON"
+]);
+var subscriptionSchema = external_exports.object({
+  id: external_exports.string(),
+  credentialId: external_exports.string(),
+  name: subscriptionNameSchema,
+  label: external_exports.string(),
+  owner: external_exports.string(),
+  inherited: external_exports.boolean(),
+  shared: external_exports.boolean(),
+  registeredAt: external_exports.string()
+});
+var subscriptionListSchema = external_exports.object({
+  subscriptions: external_exports.array(subscriptionSchema),
+  writable: external_exports.boolean()
+});
+var subscriptionInputSchema = external_exports.object({
+  name: subscriptionNameSchema,
+  value: external_exports.string().trim().min(1).refine((value2) => Buffer.byteLength(value2, "utf8") <= 49152),
+  replaceId: external_exports.string().optional()
+});
+var credentialCandidateSchema = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  source: external_exports.enum(["repo", "account", "personal"])
+});
+var credentialAccessSchema = external_exports.object({
+  token: external_exports.string(),
+  candidates: external_exports.array(credentialCandidateSchema)
+});
+var selectedCredentialSchema = external_exports.object({
+  name: external_exports.string(),
+  value: external_exports.string(),
+  receipt: external_exports.string()
+});
+
+// commands/_subscriptions.ts
+async function chooseSubscription(input) {
+  const result = subscriptionListSchema.parse(
+    await configurationApi({ ...input, path: "subscriptions" })
+  );
+  const current = result.subscriptions.filter((row) => row.name === input.name && !row.inherited);
+  if (!current.length) return { replaceId: void 0 };
+  const chosen = await select({
+    message: "Add or replace a subscription?",
+    options: [
+      { value: "add", label: "Add another", hint: "keep existing subscriptions as fallbacks" },
+      ...current.map((row) => ({ value: row.id, label: `Replace ${row.label}` })),
+      { value: "cancel", label: "Cancel" }
+    ]
+  });
+  handleCancel(chosen);
+  if (typeof chosen !== "string" || chosen === "cancel") return null;
+  return { replaceId: chosen === "add" ? void 0 : chosen };
+}
+async function saveSubscription(input) {
+  return external_exports.object({ label: external_exports.string(), reconnected: external_exports.boolean() }).parse(
+    await configurationApi({
+      target: input.target,
+      token: input.token,
+      path: "subscriptions",
+      method: "POST",
+      body: { name: input.name, value: input.value, replaceId: input.replaceId }
+    })
+  );
+}
+async function manageSubscriptions(input) {
+  const args2 = (0, import_arg.default)({ ...scopeArgs, "--from": String, "--yes": Boolean }, { argv: input.args });
+  if (args2["--help"]) {
+    console.log(
+      "usage: pullfrog auth list|remove|share|unshare [ID] --org OWNER | --repo OWNER/REPO [--from PERSONAL_OWNER] [--yes]"
+    );
+    return;
+  }
+  const target = resolveTarget({ org: args2["--org"], repo: args2["--repo"] });
+  if (input.command === "list") {
+    const result = subscriptionListSchema.parse(
+      await configurationApi({ target, path: "subscriptions" })
+    );
+    console.log("BINDING ID	CREDENTIAL ID	PROVIDER	ACCOUNT");
+    for (const item of result.subscriptions)
+      console.log(
+        `${item.id}	${item.credentialId}	${item.name}	${item.label}${item.inherited ? " (inherited)" : ""}`
+      );
+    return;
+  }
+  const id = args2._[0];
+  if (!id || args2._.length !== 1) throw new Error("specify exactly one ID from pullfrog auth list");
+  if (input.command === "remove") {
+    await confirmChange({
+      message: `Remove subscription ${id} from ${target.owner}${target.repo ? `/${target.repo}` : " and inheriting repositories (removing a personal connection also revokes its shares)"}?`,
+      yes: args2["--yes"] ?? false
+    });
+    await configurationApi({ target, path: "subscriptions", method: "DELETE", body: { id } });
+    return;
+  }
+  const from = args2["--from"];
+  if (!from) throw new Error("--from PERSONAL_OWNER is required");
+  await confirmChange({
+    message: input.command === "share" ? `Allow every authorized run on ${target.owner}${target.repo ? `/${target.repo}` : " and its repositories"} to use personal subscription ${id}?` : `Revoke personal subscription ${id} from this target?`,
+    yes: args2["--yes"] ?? false
+  });
+  await configurationApi({
+    target,
+    path: "subscriptions/share",
+    method: input.command === "share" ? "POST" : "DELETE",
+    body: { from, credentialId: id, ...target, confirmed: true }
+  });
+}
+
+// commands/secret.ts
+var import_arg2 = __toESM(require_arg(), 1);
 var secretNamesSchema = external_exports.object({
   target: external_exports.string(),
   secrets: external_exports.array(external_exports.string()),
@@ -107491,7 +107590,7 @@ var secretNamesSchema = external_exports.object({
   writable: external_exports.boolean()
 });
 async function runCli(input) {
-  const args2 = (0, import_arg.default)({ ...scopeArgs, "--file": String, "--yes": Boolean }, { argv: input.args });
+  const args2 = (0, import_arg2.default)({ ...scopeArgs, "--file": String, "--yes": Boolean }, { argv: input.args });
   if (input.showHelp || args2["--help"] || !args2._.length) {
     console.log(`usage: ${input.prog} secret <list|set|delete> [NAME...]
 
@@ -107615,6 +107714,9 @@ function printAuthUsage(params) {
   params.stream("  codex    mint a Codex (ChatGPT) subscription credential");
   params.stream("  claude   save a Claude Code subscription OAuth token");
   params.stream("  grok     mint a Grok (SuperGrok / X Premium) subscription credential");
+  params.stream("  list     list subscriptions and their IDs");
+  params.stream("  remove   remove a subscription by binding ID");
+  params.stream("  share | unshare   grant or revoke personal subscription access (--from OWNER)");
   params.stream("");
   params.stream("options:");
   params.stream("  --org OWNER | --repo OWNER/REPO   select the credential scope");
@@ -107647,6 +107749,10 @@ async function runCli2(params) {
   }
   const subcommand = firstArg;
   const rest = params.args.slice(1);
+  if (["list", "remove", "share", "unshare"].includes(subcommand)) {
+    await manageSubscriptions({ command: subcommand, args: rest });
+    return;
+  }
   if (subcommand === "codex") {
     await runCodex({ args: rest, prog: params.prog });
     return;
@@ -107665,7 +107771,7 @@ async function runCli2(params) {
   process.exit(1);
 }
 function parseCodexArgs(args2) {
-  return (0, import_arg2.default)(
+  return (0, import_arg3.default)(
     {
       ...scopeArgs
     },
@@ -107690,16 +107796,6 @@ async function runCodex(params) {
   if (parsed2._.length) throw new Error("unexpected auth argument");
   await runCodexAuth(parsed2);
 }
-function refuseWhenRepoCopiesShadow(params) {
-  const refusal = shadowRefusal({
-    overrides: params.access.overrides,
-    owner: params.owner,
-    name: params.name
-  });
-  if (!refusal) return;
-  log.warn(refusal);
-  bail("nothing saved.");
-}
 async function runCodexAuth(parsed2) {
   intro(import_picocolors2.default.bgGreen(import_picocolors2.default.black(" pullfrog auth codex ")));
   const spin = spinner();
@@ -107740,20 +107836,18 @@ async function runCodexAuth(parsed2) {
       bail(
         scope2 === "repo" ? "repo admin required to change secrets" : "org owner required to change secrets"
       );
-    refuseWhenRepoCopiesShadow({ access, owner: remote.owner, name: CODEX_AUTH_SECRET });
-    if (access.secrets.includes(CODEX_AUTH_SECRET)) {
-      const overwrite = await select({
-        message: `${import_picocolors2.default.cyan(CODEX_AUTH_SECRET)} is already configured \u2014 overwrite?`,
-        options: [
-          { value: true, label: "overwrite", hint: "rotate to a freshly minted credential" },
-          { value: false, label: "cancel" }
-        ]
-      });
-      handleCancel(overwrite);
-      if (!overwrite) {
-        cancel("canceled.");
-        return;
-      }
+    const subscriptionTarget = {
+      owner: remote.owner,
+      repo: scope2 === "repo" ? remote.repo : void 0
+    };
+    const choice = await chooseSubscription({
+      target: subscriptionTarget,
+      token,
+      name: CODEX_AUTH_SECRET
+    });
+    if (!choice) {
+      cancel("canceled.");
+      return;
     }
     log.info(
       [
@@ -107824,23 +107918,16 @@ async function runCodexAuth(parsed2) {
     }
     const target = describeSecretTarget({ owner: remote.owner, repo: remote.repo, scope: scope2 });
     spin.start(`saving ${import_picocolors2.default.cyan(CODEX_AUTH_SECRET)} to ${target}`);
-    const result = await setPullfrogSecret({
+    const result = await saveSubscription({
       token,
-      owner: remote.owner,
-      repo: remote.repo,
+      target: subscriptionTarget,
       name: CODEX_AUTH_SECRET,
       value: savable.json,
-      scope: scope2
+      replaceId: choice.replaceId
     });
-    if (!result.saved) {
-      spin.stop(import_picocolors2.default.red("could not save secret"));
-      log.warn(
-        `${result.error}
-  ${import_picocolors2.default.dim("set it manually at:")} ${PULLFROG_API_URL}/console/${remote.owner}`
-      );
-      process.exit(1);
-    }
-    spin.stop(`saved ${import_picocolors2.default.cyan(CODEX_AUTH_SECRET)} to ${target}`);
+    spin.stop(
+      `${result.reconnected ? "reconnected" : "added"} ${import_picocolors2.default.cyan(result.label)} to ${target}`
+    );
     setActiveSpin(null);
     outro("done.");
   } catch (error49) {
@@ -107852,7 +107939,7 @@ async function runCodexAuth(parsed2) {
   }
 }
 function parseClaudeArgs(args2) {
-  return (0, import_arg2.default)(
+  return (0, import_arg3.default)(
     {
       ...scopeArgs
     },
@@ -107917,20 +108004,18 @@ async function runClaudeAuth(parsed2) {
       bail(
         scope2 === "repo" ? "repo admin required to change secrets" : "org owner required to change secrets"
       );
-    refuseWhenRepoCopiesShadow({ access, owner: remote.owner, name: CLAUDE_OAUTH_SECRET });
-    if (access.secrets.includes(CLAUDE_OAUTH_SECRET)) {
-      const overwrite = await select({
-        message: `${import_picocolors2.default.cyan(CLAUDE_OAUTH_SECRET)} is already configured \u2014 overwrite?`,
-        options: [
-          { value: true, label: "overwrite", hint: "replace with a freshly minted token" },
-          { value: false, label: "cancel" }
-        ]
-      });
-      handleCancel(overwrite);
-      if (!overwrite) {
-        cancel("canceled.");
-        return;
-      }
+    const subscriptionTarget = {
+      owner: remote.owner,
+      repo: scope2 === "repo" ? remote.repo : void 0
+    };
+    const choice = await chooseSubscription({
+      target: subscriptionTarget,
+      token,
+      name: CLAUDE_OAUTH_SECRET
+    });
+    if (!choice) {
+      cancel("canceled.");
+      return;
     }
     log.info(
       [
@@ -107958,23 +108043,16 @@ async function runClaudeAuth(parsed2) {
     }
     const target = describeSecretTarget({ owner: remote.owner, repo: remote.repo, scope: scope2 });
     spin.start(`saving ${import_picocolors2.default.cyan(CLAUDE_OAUTH_SECRET)} to ${target}`);
-    const result = await setPullfrogSecret({
+    const result = await saveSubscription({
       token,
-      owner: remote.owner,
-      repo: remote.repo,
+      target: subscriptionTarget,
       name: CLAUDE_OAUTH_SECRET,
       value: value2,
-      scope: scope2
+      replaceId: choice.replaceId
     });
-    if (!result.saved) {
-      spin.stop(import_picocolors2.default.red("could not save secret"));
-      log.warn(
-        `${result.error}
-  ${import_picocolors2.default.dim("set it manually at:")} ${PULLFROG_API_URL}/console/${remote.owner}`
-      );
-      process.exit(1);
-    }
-    spin.stop(`saved ${import_picocolors2.default.cyan(CLAUDE_OAUTH_SECRET)} to ${target}`);
+    spin.stop(
+      `${result.reconnected ? "reconnected" : "added"} ${import_picocolors2.default.cyan(result.label)} to ${target}`
+    );
     setActiveSpin(null);
     outro("done.");
   } catch (error49) {
@@ -108052,20 +108130,18 @@ async function runGrokAuth(parsed2) {
       bail(
         scope2 === "repo" ? "repo admin required to change secrets" : "org owner required to change secrets"
       );
-    refuseWhenRepoCopiesShadow({ access, owner: remote.owner, name: GROK_AUTH_SECRET });
-    if (access.secrets.includes(GROK_AUTH_SECRET)) {
-      const overwrite = await select({
-        message: `${import_picocolors2.default.cyan(GROK_AUTH_SECRET)} is already configured \u2014 overwrite?`,
-        options: [
-          { value: true, label: "overwrite", hint: "replace with a freshly minted credential" },
-          { value: false, label: "cancel" }
-        ]
-      });
-      handleCancel(overwrite);
-      if (!overwrite) {
-        cancel("canceled.");
-        return;
-      }
+    const subscriptionTarget = {
+      owner: remote.owner,
+      repo: scope2 === "repo" ? remote.repo : void 0
+    };
+    const choice = await chooseSubscription({
+      target: subscriptionTarget,
+      token,
+      name: GROK_AUTH_SECRET
+    });
+    if (!choice) {
+      cancel("canceled.");
+      return;
     }
     spin.start("requesting a device code from xAI");
     const device = await startXaiDeviceAuth();
@@ -108089,23 +108165,16 @@ async function runGrokAuth(parsed2) {
     spin.stop("credential rotated");
     const target = describeSecretTarget({ owner: remote.owner, repo: remote.repo, scope: scope2 });
     spin.start(`saving ${import_picocolors2.default.cyan(GROK_AUTH_SECRET)} to ${target}`);
-    const result = await setPullfrogSecret({
+    const result = await saveSubscription({
       token,
-      owner: remote.owner,
-      repo: remote.repo,
+      target: subscriptionTarget,
       name: GROK_AUTH_SECRET,
       value: stringifyXaiAuthBody(fresh),
-      scope: scope2
+      replaceId: choice.replaceId
     });
-    if (!result.saved) {
-      spin.stop(import_picocolors2.default.red("could not save secret"));
-      log.warn(
-        `${result.error}
-  ${import_picocolors2.default.dim("set it manually at:")} ${PULLFROG_API_URL}/console/${remote.owner}`
-      );
-      process.exit(1);
-    }
-    spin.stop(`saved ${import_picocolors2.default.cyan(GROK_AUTH_SECRET)} to ${target}`);
+    spin.stop(
+      `${result.reconnected ? "reconnected" : "added"} ${import_picocolors2.default.cyan(result.label)} to ${target}`
+    );
     setActiveSpin(null);
     outro("done.");
   } catch (error49) {
@@ -108118,7 +108187,7 @@ async function runGrokAuth(parsed2) {
 }
 
 // commands/config.ts
-var import_arg3 = __toESM(require_arg(), 1);
+var import_arg4 = __toESM(require_arg(), 1);
 
 // configuration.ts
 var defaults = [
@@ -108547,7 +108616,7 @@ function parseValue(field, raw2) {
   return result.data;
 }
 async function runCli3(input) {
-  const args2 = (0, import_arg3.default)(
+  const args2 = (0, import_arg4.default)(
     { ...scopeArgs, "--file": String, "--yes": Boolean, "--ack-auto-merge": Boolean },
     { argv: input.args }
   );
@@ -108649,10 +108718,10 @@ write access: ${args2["--org"] !== void 0 ? field.privileged ? "org owner" : "or
 }
 
 // commands/console.ts
-var import_arg4 = __toESM(require_arg(), 1);
+var import_arg5 = __toESM(require_arg(), 1);
 import { spawnSync } from "node:child_process";
 async function runCli4(input) {
-  const args2 = (0, import_arg4.default)({ ...scopeArgs, "--no-browser": Boolean }, { argv: input.args });
+  const args2 = (0, import_arg5.default)({ ...scopeArgs, "--no-browser": Boolean }, { argv: input.args });
   if (input.showHelp || args2["--help"]) {
     console.log(
       `usage: ${input.prog} console [--org OWNER | --repo OWNER/REPO] [--no-browser]
@@ -108679,7 +108748,7 @@ without a terminal, only print its URL.`
 
 // commands/gha.ts
 var core8 = __toESM(require_core(), 1);
-var import_arg5 = __toESM(require_arg(), 1);
+var import_arg6 = __toESM(require_arg(), 1);
 import { dirname as dirname6 } from "node:path";
 
 // main.ts
@@ -109754,6 +109823,17 @@ var providers = {
         // see the big-pickle note above (#1077).
         isFree: true
       },
+      // Zen's FREE Meituan preview (listed 2026-09-25). Zen's docs: zero
+      // retention, no training. Go lists the same free id, but one key reaches
+      // both, so the promo gets one row, here with the other free ones.
+      "longcat-preview": {
+        displayName: "LongCat Preview",
+        description: "Meituan preview, free for a limited time",
+        resolve: "opencode/longcat-2.5-preview-free",
+        // free to run, still gated on the provider's own OPENCODE_API_KEY —
+        // see the big-pickle note above (#1077).
+        isFree: true
+      },
       // Zen's live free MiMo, and the second free row in a menu that big-pickle
       // was alone in since `mimo-v2-pro-free` lost its model.
       mimo: {
@@ -110230,8 +110310,8 @@ var providers = {
       },
       "claude-sonnet": {
         displayName: "Claude Sonnet",
-        resolve: "vercel/anthropic/claude-sonnet-5",
-        effort: ["none", "low", "medium", "high", "xhigh", "max"]
+        resolve: "vercel/anthropic/claude-sonnet-5.5",
+        effort: ["low", "medium", "high", "xhigh", "max"]
       },
       "claude-haiku": {
         displayName: "Claude Haiku",
@@ -110367,7 +110447,7 @@ function isAutoTier(slug2) {
 }
 var PROVIDER_LADDERS = {
   anthropic: {
-    minimal: "anthropic/claude-haiku",
+    minimal: "anthropic/claude-sonnet",
     light: "anthropic/claude-sonnet",
     standard: "anthropic/claude-opus",
     deep: "anthropic/claude-opus"
@@ -110842,11 +110922,11 @@ function ts() {
   return isDebugEnabled() ? `[${(/* @__PURE__ */ new Date()).toISOString()}] ` : "";
 }
 function formatArgs(args2) {
-  return args2.map((arg9) => {
-    if (typeof arg9 === "string") return arg9;
-    if (arg9 instanceof Error) return `${arg9.message}
-${arg9.stack}`;
-    return JSON.stringify(arg9);
+  return args2.map((arg10) => {
+    if (typeof arg10 === "string") return arg10;
+    if (arg10 instanceof Error) return `${arg10.message}
+${arg10.stack}`;
+    return JSON.stringify(arg10);
   }).join(" ");
 }
 function startGroup2(name) {
@@ -113437,6 +113517,7 @@ import { homedir as homedir2, userInfo } from "node:os";
 import { join as join6 } from "node:path";
 var CODEX_AUTH_ENV = "CODEX_AUTH_JSON";
 var XAI_AUTH_ENV = "GROK_AUTH_JSON";
+var installedSubscriptionPaths = /* @__PURE__ */ new Map();
 var PULLFROG_DATA_DIR = "/var/lib/pullfrog";
 function isRejectedChain(body) {
   if (!body.refresh_rejected_at) return false;
@@ -113472,6 +113553,7 @@ function installCodexAuth() {
   });
   process.env.XDG_DATA_HOME = xdgDataHome;
   log2.info(`\xBB installed Codex auth at ${authPath}`);
+  installedSubscriptionPaths.set(CODEX_AUTH_ENV, authPath);
   return {
     authPath,
     xdgDataHome,
@@ -113523,6 +113605,7 @@ function installXaiAuth() {
   });
   process.env.XDG_DATA_HOME = xdgDataHome;
   log2.info(`\xBB installed Grok auth at ${authPath}`);
+  installedSubscriptionPaths.set(XAI_AUTH_ENV, authPath);
   return { authPath, xdgDataHome, originalRefresh: body.tokens.refresh_token };
 }
 function isXaiRejectedChain(body) {
@@ -113764,14 +113847,18 @@ async function writeBackEntry(apiToken, entry) {
     return;
   }
   try {
+    const poolState = core2.getState("credential_receipts");
+    const receipts = external_exports.record(external_exports.string(), external_exports.string()).parse(JSON.parse(poolState || "{}"));
+    const receipt = receipts[entry.secretName];
+    if (poolState && !receipt) return;
     const response = await apiFetch({
-      path: "/api/runtime/secret",
+      path: receipt ? "/api/runtime/credentials" : "/api/runtime/secret",
       method: "PUT",
       headers: {
         authorization: `Bearer ${apiToken}`,
         "content-type": "application/json"
       },
-      body: JSON.stringify({ name: entry.secretName, value: refreshed }),
+      body: JSON.stringify({ name: entry.secretName, value: refreshed, receipt }),
       // the workflow is already finished; a hung write-back would hold the
       // runner open for nothing.
       signal: AbortSignal.timeout(3e4)
@@ -115265,7 +115352,7 @@ var buildClientParams = (args2, fields) => {
   };
   const map2 = buildKeyMap(fields);
   let config3;
-  for (const [index, arg9] of args2.entries()) {
+  for (const [index, arg10] of args2.entries()) {
     if (fields[index]) {
       config3 = fields[index];
     }
@@ -115278,13 +115365,13 @@ var buildClientParams = (args2, fields) => {
         const name = field.map || config3.key;
         if (field.in) {
           ;
-          params[field.in][name] = arg9;
+          params[field.in][name] = arg10;
         }
       } else {
-        params.body = arg9;
+        params.body = arg10;
       }
     } else {
-      for (const [key, value2] of Object.entries(arg9 ?? {})) {
+      for (const [key, value2] of Object.entries(arg10 ?? {})) {
         const field = map2.get(key);
         if (field) {
           if (field.in) {
@@ -121892,12 +121979,12 @@ var CompiledFunction = class extends CastableBase {
   constructor(...args2) {
     super();
     this.argNames = args2;
-    for (const arg9 of args2) {
-      if (arg9 in this) {
-        throw new Error(`Arg name '${arg9}' would overwrite an existing property on FunctionBody`);
+    for (const arg10 of args2) {
+      if (arg10 in this) {
+        throw new Error(`Arg name '${arg10}' would overwrite an existing property on FunctionBody`);
       }
       ;
-      this[arg9] = arg9;
+      this[arg10] = arg10;
     }
   }
   indentation = 0;
@@ -121982,12 +122069,12 @@ var NodeCompiler = class extends CompiledFunction {
     this.optimistic = ctx.optimistic === true;
   }
   invoke(node2, opts) {
-    const arg9 = opts?.arg ?? this.data;
+    const arg10 = opts?.arg ?? this.data;
     const requiresContext = typeof node2 === "string" ? true : this.requiresContextFor(node2);
     const id = typeof node2 === "string" ? node2 : node2.id;
     if (requiresContext)
-      return `${this.referenceToId(id, opts)}(${arg9}, ${this.ctx})`;
-    return `${this.referenceToId(id, opts)}(${arg9})`;
+      return `${this.referenceToId(id, opts)}(${arg10}, ${this.ctx})`;
+    return `${this.referenceToId(id, opts)}(${arg10})`;
   }
   referenceToId(id, opts) {
     const invokedKind = opts?.kind ?? this.traversalKind;
@@ -128152,11 +128239,11 @@ var Context = class {
     }
     return Object.fromEntries(this.#var);
   }
-  #newResponse(data, arg9, headers) {
+  #newResponse(data, arg10, headers) {
     let responseHeaders = this.#res ? new Headers(this.#res.headers) : this.#preparedHeaders;
-    if (typeof arg9 === "object" && arg9.headers) {
+    if (typeof arg10 === "object" && arg10.headers) {
       responseHeaders ??= new Headers();
-      for (const [key, value2] of new Headers(arg9.headers)) {
+      for (const [key, value2] of new Headers(arg10.headers)) {
         if (key === "set-cookie") {
           responseHeaders.append(key, value2);
         } else {
@@ -128188,7 +128275,7 @@ var Context = class {
         }
       }
     }
-    const status = typeof arg9 === "number" ? arg9 : arg9?.status ?? this.#status;
+    const status = typeof arg10 === "number" ? arg10 : arg10?.status ?? this.#status;
     return createResponseInstance(data, {
       status,
       headers: responseHeaders ?? headers
@@ -128216,7 +128303,7 @@ var Context = class {
    * })
    * ```
    */
-  body = (data, arg9, headers) => this.#newResponse(data, arg9, headers);
+  body = (data, arg10, headers) => this.#newResponse(data, arg10, headers);
   /**
    * `.text()` can render text as `Content-Type:text/plain`.
    *
@@ -128229,10 +128316,10 @@ var Context = class {
    * })
    * ```
    */
-  text = (text, arg9, headers) => {
-    return !this.#preparedHeaders && !this.#status && !arg9 && !headers && !this.finalized ? new Response(text) : this.#newResponse(
+  text = (text, arg10, headers) => {
+    return !this.#preparedHeaders && !this.#status && !arg10 && !headers && !this.finalized ? new Response(text) : this.#newResponse(
       text,
-      arg9,
+      arg10,
       setDefaultContentType(TEXT_PLAIN, headers)
     );
   };
@@ -128248,15 +128335,15 @@ var Context = class {
    * })
    * ```
    */
-  json = (object5, arg9, headers) => {
+  json = (object5, arg10, headers) => {
     return this.#newResponse(
       JSON.stringify(object5),
-      arg9,
+      arg10,
       setDefaultContentType("application/json", headers)
     );
   };
-  html = (html, arg9, headers) => {
-    const res = (html2) => this.#newResponse(html2, arg9, setDefaultContentType("text/html; charset=UTF-8", headers));
+  html = (html, arg10, headers) => {
+    const res = (html2) => this.#newResponse(html2, arg10, setDefaultContentType("text/html; charset=UTF-8", headers));
     return typeof html === "object" ? resolveCallback(html, HtmlEscapedCallbackPhase.Stringify, false, {}).then(res) : res(html);
   };
   /**
@@ -135228,10 +135315,10 @@ var require_code$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
     return new _Code(expr);
   }
   exports.str = str;
-  function addCodeArg(code, arg9) {
-    if (arg9 instanceof _Code) code.push(...arg9._items);
-    else if (arg9 instanceof Name) code.push(arg9);
-    else code.push(interpolate(arg9));
+  function addCodeArg(code, arg10) {
+    if (arg10 instanceof _Code) code.push(...arg10._items);
+    else if (arg10 instanceof Name) code.push(arg10);
+    else code.push(interpolate(arg10));
   }
   exports.addCodeArg = addCodeArg;
   function optimize(expr) {
@@ -149503,10 +149590,10 @@ var require_code$12 = /* @__PURE__ */ __commonJSMin2(((exports) => {
     return new _Code(expr);
   }
   exports.str = str;
-  function addCodeArg(code, arg9) {
-    if (arg9 instanceof _Code) code.push(...arg9._items);
-    else if (arg9 instanceof Name) code.push(arg9);
-    else code.push(interpolate(arg9));
+  function addCodeArg(code, arg10) {
+    if (arg10 instanceof _Code) code.push(...arg10._items);
+    else if (arg10 instanceof Name) code.push(arg10);
+    else code.push(interpolate(arg10));
   }
   exports.addCodeArg = addCodeArg;
   function optimize(expr) {
@@ -157699,13 +157786,13 @@ var Doc2 = class {
     fn2(this);
     this.indent -= 1;
   }
-  write(arg9) {
-    if (typeof arg9 === "function") {
-      arg9(this, { execution: "sync" });
-      arg9(this, { execution: "async" });
+  write(arg10) {
+    if (typeof arg10 === "function") {
+      arg10(this, { execution: "sync" });
+      arg10(this, { execution: "async" });
       return;
     }
-    const lines = arg9.split("\n").filter((x2) => x2);
+    const lines = arg10.split("\n").filter((x2) => x2);
     const minIndent = Math.min(...lines.map((x2) => x2.length - x2.trimStart().length));
     const dedented = lines.map((x2) => x2.slice(minIndent)).map((x2) => " ".repeat(this.indent * 2) + x2);
     for (const line of dedented) this.content.push(line);
@@ -160514,11 +160601,11 @@ var ZodType3 = /* @__PURE__ */ $constructor2("ZodType", (inst, def) => {
     array() {
       return array2(this);
     },
-    or(arg9) {
-      return union2([this, arg9]);
+    or(arg10) {
+      return union2([this, arg10]);
     },
-    and(arg9) {
-      return intersection2(this, arg9);
+    and(arg10) {
+      return intersection2(this, arg10);
     },
     transform(tx) {
       return pipe2(this, transform2(tx));
@@ -164203,14 +164290,14 @@ var require_http_errors = /* @__PURE__ */ __commonJSMin3(((exports, module) => {
     var status$1 = 500;
     var props = {};
     for (var i$3 = 0; i$3 < arguments.length; i$3++) {
-      var arg9 = arguments[i$3];
-      var type2 = typeof arg9;
-      if (type2 === "object" && arg9 instanceof Error) {
-        err = arg9;
+      var arg10 = arguments[i$3];
+      var type2 = typeof arg10;
+      if (type2 === "object" && arg10 instanceof Error) {
+        err = arg10;
         status$1 = err.status || err.statusCode || status$1;
-      } else if (type2 === "number" && i$3 === 0) status$1 = arg9;
-      else if (type2 === "string") msg = arg9;
-      else if (type2 === "object") props = arg9;
+      } else if (type2 === "number" && i$3 === 0) status$1 = arg10;
+      else if (type2 === "string") msg = arg10;
+      else if (type2 === "object") props = arg10;
       else throw new TypeError("argument #" + (i$3 + 1) + " unsupported type " + type2);
     }
     if (typeof status$1 === "number" && (status$1 < 400 || status$1 >= 600)) deprecate("non-error status code; use only 4xx or 5xx status codes");
@@ -174752,11 +174839,11 @@ ${error49 instanceof Error ? error49.stack : JSON.stringify(error49)}`
         );
       }
       const args2 = request2.params.arguments;
-      for (const arg9 of prompt.arguments ?? []) {
-        if (arg9.required && !(args2 && arg9.name in args2)) {
+      for (const arg10 of prompt.arguments ?? []) {
+        if (arg10.required && !(args2 && arg10.name in args2)) {
           throw new McpError(
             ErrorCode.InvalidRequest,
-            `Prompt '${request2.params.name}' requires argument '${arg9.name}': ${arg9.description || "No description provided"}`
+            `Prompt '${request2.params.name}' requires argument '${arg10.name}': ${arg10.description || "No description provided"}`
           );
         }
       }
@@ -175982,7 +176069,7 @@ var FastMCP = class extends FastMCPEventEmitter {
   #parseRuntimeConfig(overrides) {
     const args2 = process.argv.slice(2);
     const getArg = (name) => {
-      const index = args2.findIndex((arg9) => arg9 === `--${name}`);
+      const index = args2.findIndex((arg10) => arg10 === `--${name}`);
       return index !== -1 && index + 1 < args2.length ? args2[index + 1] : void 0;
     };
     const transportArg = getArg("transport");
@@ -177260,11 +177347,11 @@ var GenericRoot = class extends Callable {
   constructor(paramDefs, bodyDef, $2, arg$, hkt) {
     super((...args2) => {
       const argNodes = flatMorph(this.names, (i2, name) => {
-        const arg9 = this.arg$.parse(args2[i2]);
-        if (!arg9.extends(this.constraints[i2])) {
-          throwParseError(writeUnsatisfiedParameterConstraintMessage(name, this.constraints[i2].expression, arg9.expression));
+        const arg10 = this.arg$.parse(args2[i2]);
+        if (!arg10.extends(this.constraints[i2])) {
+          throwParseError(writeUnsatisfiedParameterConstraintMessage(name, this.constraints[i2].expression, arg10.expression));
         }
-        return [name, arg9];
+        return [name, arg10];
       });
       if (this.defIsLazy()) {
         const def = this.bodyDef(argNodes);
@@ -177312,7 +177399,7 @@ var GenericRoot = class extends Callable {
     return this.baseInstantiation.internal.references;
   }
 };
-var writeUnsatisfiedParameterConstraintMessage = (name, constraint, arg9) => `${name} must be assignable to ${constraint} (was ${arg9})`;
+var writeUnsatisfiedParameterConstraintMessage = (name, constraint, arg10) => `${name} must be assignable to ${constraint} (was ${arg10})`;
 
 // node_modules/.pnpm/@ark+schema@0.56.0/node_modules/@ark/schema/out/predicate.js
 var implementation = implementNode({
@@ -181810,7 +181897,7 @@ var _parseGenericArgs = (name, g, s, argNodes) => {
   argNodes.push(argState.root);
   if (argState.finalizer === ">") {
     if (argNodes.length !== g.params.length) {
-      return s.error(writeInvalidGenericArgCountMessage(name, g.names, argNodes.map((arg9) => arg9.expression)));
+      return s.error(writeInvalidGenericArgCountMessage(name, g.names, argNodes.map((arg10) => arg10.expression)));
     }
     return argNodes;
   }
@@ -181839,10 +181926,10 @@ var parseGenericInstantiation = (name, g, s) => {
 var unenclosedToNode = (s, token) => maybeParseReference(s, token) ?? maybeParseUnenclosedLiteral(s, token) ?? s.error(token === "" ? s.scanner.lookahead === "#" ? writePrefixedPrivateReferenceMessage(s.shiftedBy(1).scanner.shiftUntilLookahead(terminatingChars)) : writeMissingOperandMessage(s) : writeUnresolvableMessage(token));
 var maybeParseReference = (s, token) => {
   if (s.ctx.args?.[token]) {
-    const arg9 = s.ctx.args[token];
-    if (typeof arg9 !== "string")
-      return arg9;
-    return s.ctx.$.node("alias", { reference: arg9 }, { prereduced: true });
+    const arg10 = s.ctx.args[token];
+    if (typeof arg10 !== "string")
+      return arg10;
+    return s.ctx.$.node("alias", { reference: arg10 }, { prereduced: true });
   }
   const resolution = s.ctx.$.maybeResolve(token);
   if (hasArkKind(resolution, "root"))
@@ -192012,13 +192099,13 @@ function GitTool(ctx) {
         if (blocked) {
           throw new Error(blocked);
         }
-        for (const arg9 of args2) {
+        for (const arg10 of args2) {
           const isBlocked = NOSHELL_BLOCKED_ARGS.some(
-            (flag) => arg9 === flag || arg9.startsWith(flag + "=")
+            (flag) => arg10 === flag || arg10.startsWith(flag + "=")
           );
           if (isBlocked) {
             throw new Error(
-              `Blocked: '${arg9}' flag can execute arbitrary code and is not allowed.`
+              `Blocked: '${arg10}' flag can execute arbitrary code and is not allowed.`
             );
           }
         }
@@ -193473,14 +193560,29 @@ async function reportReviewNodeId(ctx, params) {
 
 // utils/setup.ts
 import { execFileSync as execFileSync7, execSync as execSync2 } from "node:child_process";
-import { mkdtempSync as mkdtempSync2, readdirSync, realpathSync as realpathSync2, unlinkSync as unlinkSync2 } from "node:fs";
+import { mkdtempSync as mkdtempSync2, readdirSync, realpathSync as realpathSync2, rmSync as rmSync3, unlinkSync as unlinkSync2 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join15 } from "node:path";
 function createTempDirectory() {
-  const sharedTempDir = mkdtempSync2(join15(tmpdir3(), "pullfrog-"));
-  process.env.PULLFROG_TEMP_DIR = sharedTempDir;
-  log2.info(`\xBB created temp dir at ${sharedTempDir}`);
-  return sharedTempDir;
+  const path4 = mkdtempSync2(join15(tmpdir3(), "pullfrog-"));
+  process.env.PULLFROG_TEMP_DIR = path4;
+  log2.info(`\xBB created temp dir at ${path4}`);
+  return { path: path4, [Symbol.dispose]: () => removeTempDirectory(path4) };
+}
+function removeTempDirectory(path4) {
+  try {
+    try {
+      rmSync3(path4, { recursive: true, force: true });
+    } catch {
+      execFileSync7("chmod", ["-R", "u+w", path4]);
+      rmSync3(path4, { recursive: true, force: true });
+    }
+    log2.debug(`\xBB removed temp dir at ${path4}`);
+  } catch (err) {
+    log2.warning(
+      `\xBB could not remove temp dir at ${path4}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
 }
 function wipeRunnerLeakSurface() {
   const runnerTemp = process.env.RUNNER_TEMP;
@@ -195226,8 +195328,8 @@ var GhParams = type({
     'gh arguments as an argv array, e.g. ["pr", "list", "--json", "number,title"] or ["api", "graphql", "-f", "query=..."]'
   )
 });
-function shellQuote(arg9) {
-  return `'${arg9.replace(/'/g, "'\\''")}'`;
+function shellQuote(arg10) {
+  return `'${arg10.replace(/'/g, "'\\''")}'`;
 }
 function GhTool(ctx) {
   const permissions = mirrorRolePermissions(ctx.payload.event.authorPermission);
@@ -196824,7 +196926,7 @@ function UploadFileTool(ctx) {
 }
 
 // mcp/xrepo.ts
-import { mkdirSync as mkdirSync10, rmSync as rmSync3 } from "node:fs";
+import { mkdirSync as mkdirSync10, rmSync as rmSync4 } from "node:fs";
 import { join as join24 } from "node:path";
 function assertValidRepoName(name) {
   if (!/^[A-Za-z0-9._-]+$/.test(name) || name.startsWith("-") || name.includes("..")) {
@@ -196936,7 +197038,7 @@ function CheckoutRepoTool(ctx) {
         return { path: dir, access, defaultBranch };
       } catch (err) {
         ctx.toolState.repos.delete(repoKey(owner, repo));
-        rmSync3(dir, { recursive: true, force: true });
+        rmSync4(dir, { recursive: true, force: true });
         throw err;
       }
     })
@@ -197789,35 +197891,25 @@ function billingConsoleUrl(owner) {
   return `https://pullfrog.com/console/${encodeURIComponent(owner)}#billing`;
 }
 function commercialPaywallBody(params) {
-  const pitch = "Pro is required on private organization repos like this one: a flat $30/month per organization for unlimited runs, members, and repos.";
+  let action;
   switch (params.reason) {
     case "commercial":
-      return [
-        `**${params.ownerLogin}'s Pullfrog trial has expired.**`,
-        "",
-        pitch,
-        "",
-        `[Upgrade now \u2192](${params.url})`
-      ].join("\n");
+      action = "upgrade";
+      break;
     case "subscription_ended":
-      return [
-        `**${params.ownerLogin}'s Pullfrog Pro subscription has ended.**`,
-        "",
-        pitch,
-        "",
-        `[Resubscribe \u2192](${params.url})`
-      ].join("\n");
+      action = "resubscribe";
+      break;
     case "subscription_unpaid":
-      return [
-        `**Pullfrog paused runs on ${params.ownerLogin}: the Pro renewal failed.**`,
-        "",
-        "Update the card on file to resume runs.",
-        "",
-        `[Update billing \u2192](${params.url})`
-      ].join("\n");
+      action = "update billing";
+      break;
     default:
       return params.reason;
   }
+  return [
+    `**Pullfrog is ${params.freshReply ? "still paused" : "paused"} for ${params.ownerLogin}.**`,
+    "",
+    `An org owner can [${action}](${params.url}) to resume private-repo runs.`
+  ].join("\n");
 }
 function formatCommercialGateSummary(params) {
   return commercialPaywallBody({
@@ -199806,6 +199898,7 @@ async function fetchRunContext(params) {
       plan: data.plan ?? "none",
       proxyModel: data.proxyModel,
       dbSecrets: data.dbSecrets,
+      credentialAccess: data.credentialAccess,
       secretsUnavailable: data.secretsUnavailable,
       routerUnfunded: data.routerUnfunded,
       trialFallback: data.trialFallback
@@ -199857,6 +199950,7 @@ async function resolveRunContextData(params) {
     plan: runContext.plan,
     proxyModel: runContext.proxyModel,
     dbSecrets: runContext.dbSecrets,
+    credentialAccess: runContext.credentialAccess,
     commercialRefused: runContext.commercialRefused,
     // a failed mint on a runner that should have been able to mint is the same
     // outcome as the server-side failure: the run never sees stored secrets.
@@ -201021,7 +201115,8 @@ async function main() {
         _promise2 && await _promise2;
       }
     }
-    const tmpdir4 = createTempDirectory();
+    const tempDir = __using(_stack3, createTempDirectory());
+    const tmpdir4 = tempDir.path;
     const repoDir = payload.cwd;
     const preIntrospectionDirty = repoDir ? await dirtyTrackedPaths({ cwd: repoDir }) : null;
     const opencodeCliPath = await agents.opencode.install();
@@ -201613,7 +201708,7 @@ function printGhaTokenUsage(params) {
   params.stream("  --post       revoke the previously-acquired token (post-step usage only)");
 }
 function parseGhaArgs(args2) {
-  return (0, import_arg5.default)(
+  return (0, import_arg6.default)(
     {
       "--help": Boolean,
       "--post": Boolean,
@@ -201626,7 +201721,7 @@ function parseGhaArgs(args2) {
   );
 }
 function parseGhaTokenArgs(args2) {
-  return (0, import_arg5.default)(
+  return (0, import_arg6.default)(
     {
       "--help": Boolean,
       "--post": Boolean,
@@ -201717,7 +201812,7 @@ async function run(args2) {
 
 // commands/init.ts
 import { execFileSync as execFileSync8 } from "node:child_process";
-var import_arg6 = __toESM(require_arg(), 1);
+var import_arg7 = __toESM(require_arg(), 1);
 var import_picocolors3 = __toESM(require_picocolors(), 1);
 function link(text, url4) {
   return `\x1B]8;;${url4}\x07${text}\x1B]8;;\x07`;
@@ -201923,7 +202018,7 @@ function printInitUsage(params) {
   params.stream("  -h, --help   show help");
 }
 function parseInitArgs(args2) {
-  return (0, import_arg6.default)(
+  return (0, import_arg7.default)(
     {
       "--help": Boolean,
       "-h": "--help"
@@ -202098,7 +202193,7 @@ function resolveTarget2(repo) {
   return { owner: match3[1], repo: match3[2] };
 }
 function cliVersion() {
-  const parts = /^(\d+)\.(\d+)\.(\d+)$/.exec("0.1.84");
+  const parts = /^(\d+)\.(\d+)\.(\d+)$/.exec("0.1.86");
   if (!parts) return "0.0.0";
   return `${Number(parts[1])}.${Number(parts[2])}.${Number(parts[3])}`;
 }
@@ -202155,10 +202250,10 @@ async function runCli7(input) {
 }
 
 // commands/watch.ts
-var import_arg7 = __toESM(require_arg(), 1);
+var import_arg8 = __toESM(require_arg(), 1);
 var import_picocolors4 = __toESM(require_picocolors(), 1);
 function parseWatchArgs(args2) {
-  return (0, import_arg7.default)(
+  return (0, import_arg8.default)(
     {
       "--pr": Number,
       "--pretty": Boolean,
@@ -202265,7 +202360,7 @@ async function runCli8(input) {
 }
 
 // cli.ts
-var VERSION10 = "0.1.84";
+var VERSION10 = "0.1.86";
 var bin = basename2(process.argv[1] || "");
 var PROG = bin === "pf" || bin === "pullfrog" ? bin : "pullfrog";
 var rawArgs = process.argv.slice(2);
@@ -202286,7 +202381,7 @@ function printMainUsage(stream) {
   stream("  -v, --version   show version");
 }
 function parseGlobalArgs(args2) {
-  return (0, import_arg8.default)(
+  return (0, import_arg9.default)(
     {
       "--help": Boolean,
       "--version": Boolean,