pullfrog 0.1.90 → 0.1.91

package/dist/internal.js

@@ -8,7 +8,7 @@ var __export = (target, all) => {
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.90",
+  version: "0.1.91",
   cliContractVersion: "1",
   type: "module",
   bin: {
@@ -16246,15 +16246,6 @@ function commercialPaywallBody(params) {
 // utils/buildPullfrogFooter.ts
 var PULLFROG_DIVIDER = "<!-- PULLFROG_DIVIDER_DO_NOT_REMOVE_PLZ -->";
 var FROG_LOGO = `<a href="https://pullfrog.com"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pullfrog.com/logos/frog-white-full-18px.png"><img src="https://pullfrog.com/logos/frog-green-full-18px.png" width="9px" height="9px" style="vertical-align: middle; " alt="Pullfrog"></picture></a>`;
-function providerDisplayName(slug) {
-  try {
-    const key = getModelProvider(slug);
-    const meta3 = providers[key];
-    return meta3?.displayName ?? key;
-  } catch {
-    return slug;
-  }
-}
 function formatModelLabel(params) {
   const alias = resolveDisplayAlias(params.model) ?? // reverse-lookup: when the caller passes an effective model (proxy or
   // resolved target like "openrouter/anthropic/claude-opus-4.7") instead of
@@ -16269,9 +16260,6 @@ function formatModelLabel(params) {
     return `${ossBase} (${configured} not used \u2014 pick one of the [funded models](https://docs.pullfrog.com/models#pullfrog-for-oss) or add a [provider key](https://docs.pullfrog.com/keys) to run your own)`;
   }
   const base = alias?.isFree ? `\`${displayName}\` (free)` : `\`${displayName}\``;
-  if (params.fallbackFrom) {
-    return `${base} (credentials for ${providerDisplayName(params.fallbackFrom)} were rejected by the provider)`;
-  }
   if (params.clamped?.reason === "trial") {
     return `${base} (model usage covered by Pullfrog)`;
   }
@@ -16312,7 +16300,6 @@ function buildPullfrogFooter(params) {
     parts.push(
       `Using ${formatModelLabel({
         model: params.model,
-        fallbackFrom: params.fallbackFrom,
         clamped: params.clamped,
         unselectedProxyDefault: params.unselectedProxyDefault,
         oss: params.oss
@@ -16480,10 +16467,12 @@ async function preflightClaudeSubscription(params) {
   if (res.status !== 401 && res.status !== 403 && res.status !== 429)
     return { usable: true, status: res.status };
   const body = await res.text().catch(() => "");
+  const reset = Number(res.headers.get("anthropic-ratelimit-unified-reset"));
   return {
     usable: false,
     status: res.status,
-    reason: `${res.status}: ${extractApiErrorMessage(body)}`
+    reason: `${res.status}: ${extractApiErrorMessage(body)}`,
+    resetAt: res.status === 429 && reset > 0 ? new Date(reset * 1e3) : void 0
   };
 }
 function extractApiErrorMessage(body) {
@@ -17090,7 +17079,10 @@ var subscriptionSchema = external_exports.object({
   owner: external_exports.string(),
   inherited: external_exports.boolean(),
   shared: external_exports.boolean(),
-  registeredAt: external_exports.string()
+  registeredAt: external_exports.string(),
+  /** the provider's last verdict on the current value; null = usable or never checked. */
+  status: external_exports.enum(["rejected", "exhausted"]).nullish(),
+  resetAt: external_exports.string().nullish()
 });
 var subscriptionListSchema = external_exports.object({
   subscriptions: external_exports.array(subscriptionSchema),
@@ -17190,9 +17182,16 @@ var identitySchema = external_exports.object({
   account_id: external_exports.string().optional(),
   email_verified: external_exports.boolean().optional()
 });
+var codexWindowSchema = external_exports.object({ used_percent: external_exports.number().optional(), reset_at: external_exports.number().optional() }).nullish();
 var codexUsageSchema = external_exports.object({
-  rate_limit: external_exports.object({ allowed: external_exports.boolean(), limit_reached: external_exports.boolean() }).optional()
+  rate_limit: external_exports.object({
+    allowed: external_exports.boolean(),
+    limit_reached: external_exports.boolean(),
+    primary_window: codexWindowSchema,
+    secondary_window: codexWindowSchema
+  }).optional()
 });
+var unknown2 = { status: "unknown" };
 var SubscriptionCredentialError = class extends Error {
 };
 async function subscriptionIdentity(input) {
@@ -17231,12 +17230,16 @@ async function readSubscriptionEndpoint(input) {
 async function probeSubscription(input) {
   if (input.name === "CLAUDE_CODE_OAUTH_TOKEN") {
     const result = await preflightClaudeSubscription({ token: input.value, model: input.model });
-    return result.usable ? "usable" : "rejected";
+    if (result.usable)
+      return result.status !== void 0 && result.status < 300 ? { status: "usable" } : unknown2;
+    return result.status === 429 ? { status: "exhausted", detail: result.reason, resetAt: result.resetAt } : { status: "rejected", detail: result.reason };
   }
   const codex = input.name === "CODEX_AUTH_JSON" ? parseCodexAuthBody(input.value) : null;
   const grok = input.name === "GROK_AUTH_JSON" ? parseXaiAuthBody(input.value) : null;
   const auth = codex ?? grok;
-  if (!auth || auth.refresh_rejected_at) return "rejected";
+  if (!auth) return { status: "rejected", detail: "the stored credential is malformed" };
+  if (auth.refresh_rejected_at)
+    return { status: "rejected", detail: `refresh rejected at ${auth.refresh_rejected_at}` };
   if (grok && input.model)
     return probeInference({
       name: "XAI_API_KEY",
@@ -17249,23 +17252,31 @@ async function probeSubscription(input) {
     accountId: codex?.tokens.account_id,
     grokBilling: !!grok
   });
-  if (response?.status === 401) return "rejected";
-  if (!response?.ok) return "unknown";
+  if (response?.status === 401) return { status: "rejected", detail: "rejected with 401" };
+  if (!response?.ok) return unknown2;
   const body = await response.json().catch(() => null);
-  if (codex) {
-    const parsed = codexUsageSchema.safeParse(body);
-    const limit = parsed.success ? parsed.data.rate_limit : void 0;
-    if (!limit) return "unknown";
-    return limit.allowed && !limit.limit_reached ? "usable" : "rejected";
-  }
-  return "unknown";
+  if (!codex) return unknown2;
+  const parsed = codexUsageSchema.safeParse(body);
+  const limit = parsed.success ? parsed.data.rate_limit : void 0;
+  if (!limit) return unknown2;
+  if (limit.allowed && !limit.limit_reached) return { status: "usable" };
+  const windows = [limit.primary_window, limit.secondary_window];
+  const full = windows.filter((window) => (window?.used_percent ?? 0) >= 100);
+  const resets = (full.length ? full : windows).flatMap(
+    (window) => window?.reset_at ? [window.reset_at] : []
+  );
+  return {
+    status: "exhausted",
+    detail: "the ChatGPT plan's usage limit is reached",
+    resetAt: resets.length ? new Date(Math.max(...resets) * 1e3) : void 0
+  };
 }
 async function probeInference(input) {
   const anthropic = input.name === "ANTHROPIC_API_KEY";
   const openai = input.name === "OPENAI_API_KEY";
   if (!anthropic && !openai && input.name !== "XAI_API_KEY") {
     const result = await verifyCredential({ envVar: input.name, value: input.value });
-    return result === "dead" ? "rejected" : result === "alive" ? "usable" : "unknown";
+    return result === "dead" ? { status: "rejected", detail: "rejected by its provider" } : result === "alive" ? { status: "usable" } : unknown2;
   }
   const headers = new Headers({ "content-type": "application/json" });
   if (anthropic) {
@@ -17290,12 +17301,20 @@ async function probeInference(input) {
   ).catch(() => null);
   if (response?.status === 400 && input.name === "XAI_API_KEY") {
     const error48 = external_exports.object({ error: external_exports.string() }).safeParse(await response.json().catch(() => null));
-    return error48.success && error48.data.error.startsWith("Incorrect API key provided.") ? "rejected" : "unknown";
+    return error48.success && error48.data.error.startsWith("Incorrect API key provided.") ? { status: "rejected", detail: "rejected with 400: incorrect API key" } : unknown2;
+  }
+  if (response?.status === 429 && openai) {
+    const error48 = external_exports.object({ error: external_exports.object({ code: external_exports.string() }) }).safeParse(await response.json().catch(() => null));
+    return error48.success && error48.data.error.code === "insufficient_quota" ? { status: "exhausted", detail: "refused with 429: insufficient quota", resetAt: void 0 } : unknown2;
   }
   await response?.body?.cancel();
-  if (!response) return "unknown";
-  if (response.ok) return "usable";
-  return [401, 402, 403, 429].includes(response.status) ? "rejected" : "unknown";
+  if (!response) return unknown2;
+  if (response.ok) return { status: "usable" };
+  if (response.status === 401 || response.status === 403)
+    return { status: "rejected", detail: `rejected with ${response.status}` };
+  if (response.status === 402)
+    return { status: "exhausted", detail: "refused with 402", resetAt: void 0 };
+  return unknown2;
 }
 
 // utils/time.ts

package/dist/toolState.d.ts

@@ -138,9 +138,6 @@ export interface ToolState {
     model?: string | undefined;
     agent?: string | undefined;
     credential?: AgentCredential | undefined;
-    modelFallback?: {
-        from: string;
-    } | undefined;
     unselectedProxyDefault?: boolean | undefined;
     modelClamped?: {
         from: string;

package/dist/utils/buildPullfrogFooter.d.ts

@@ -17,13 +17,6 @@ export interface BuildPullfrogFooterParams {
     customParts?: string[] | undefined;
     /** model slug from payload (e.g., "anthropic/claude-opus"). shown in footer as "Using `Model Name`" */
     model?: string | undefined;
-    /**
-     * When a credential was rejected and the run moved to another model, this is
-     * the slug the user had configured (e.g. "anthropic/claude-opus") — the footer
-     * renders `Using <model> (credentials for <configured> were rejected by the
-     * provider)` so the substitution is visible in PR comments + reviews.
-     */
-    fallbackFrom?: string | undefined;
     /**
      * When a Router account had a model (or the intelligent tier) selected that
      * the server clamped to the efficient default — custom picks are card-gated

package/dist/utils/claudeSubscription.d.ts

@@ -12,6 +12,7 @@ export type SubscriptionPreflight = {
     usable: false;
     status: number;
     reason: string;
+    resetAt: Date | undefined;
 };
 /**
  * preflight a Claude subscription OAuth token (`CLAUDE_CODE_OAUTH_TOKEN`)

package/dist/utils/credentialFallback.d.ts

@@ -1,20 +1,13 @@
 /**
  * `ok` covers "the credential works", "we couldn't tell", and "something else
  * on this model still works" — the run proceeds as it did before this check
- * existed. The other two are only reached when every credential the configured
- * model could use has been explicitly rejected by its own provider.
- *
- * `replacement` is a concrete model, never a "just auto-select something":
- * deciding an alternative exists and picking it have to be the SAME decision,
- * or the picker can land back on the provider that just failed.
+ * existed. `dead` is only reached when every credential the configured model
+ * could use has been explicitly rejected by its own provider. A run never moves
+ * to a different model: the pool of credentials for THIS provider is where a
+ * rejected one is routed around (see wiki/subscription-credentials.md).
  */
 export type CredentialOutcome = {
     kind: "ok";
-} | {
-    kind: "fellBack";
-    credential: string;
-    reason: string | undefined;
-    replacement: string;
 } | {
     kind: "dead";
     credential: string;
@@ -22,10 +15,10 @@ export type CredentialOutcome = {
 };
 /**
  * Ask the providers whether the credentials behind the configured model still
- * work, BEFORE the agent spawns — so a rejected one becomes either a run on a
- * model that does work or an accurate error, instead of the agent 401ing three
- * seconds in against a "rotate your GitHub Actions secret" CTA naming a place
- * the user never put a key.
+ * work, BEFORE the agent spawns — so a rejected one becomes either a run on
+ * another credential for the same model or an accurate error, instead of the
+ * agent 401ing three seconds in against a "rotate your GitHub Actions secret"
+ * CTA naming a place the user never put a key.
  *
  * Failed credentials are deleted from `process.env` only when this run can
  * still proceed without them. Nothing downstream infers anything from that
@@ -38,5 +31,4 @@ export type CredentialOutcome = {
  */
 export declare function checkConfiguredCredentials(params: {
     model: string | undefined;
-    authorized: Set<string>;
 }): Promise<CredentialOutcome>;

package/dist/utils/credentialPool.d.ts

@@ -0,0 +1,18 @@
+import type { RunContextData } from "./runContextData.ts";
+/**
+ * load one subscription per provider for model discovery; keep the pool unflattened. runs
+ * after the account secrets are injected: `injected` names the ones that came from storage,
+ * so everything else set here is a workflow credential.
+ */
+export declare function initializeCredentialPool(input: {
+    ctx: RunContextData;
+    slug: string | undefined;
+    injected: string[];
+}): Promise<void>;
+export declare function resolvePoolModel(input: {
+    codexAgent: boolean;
+}): string | undefined;
+export declare function selectConfiguredCredential(input: {
+    ctx: RunContextData;
+    model: string | undefined;
+}): Promise<boolean>;

package/dist/utils/openCodeModels.d.ts

@@ -14,6 +14,10 @@ export declare function captureBaselineModels(cliPath: string): void;
  * Codex auth.json are in place. Logs the diff against the baseline as
  * `» BYOK auth enabled N model(s): …`. */
 export declare function captureAuthorizedModels(cliPath: string): void;
+/** A model whose credential the pool just probed. Added directly: a second
+ * `opencode models` would run inside the checkout and load the repo's own
+ * `.opencode` plugins, which can outlast its timeout and empty the set. */
+export declare function authorizeModel(model: string): void;
 /** Authorized set captured after Pullfrog-stored auth is applied. Throws if
  * called before `captureAuthorizedModels` — the call sites (api-key
  * validation, auto-select) all run strictly after capture. */

package/dist/utils/subscriptionCredentials.d.ts

@@ -18,6 +18,11 @@ export declare const subscriptionSchema: z.ZodObject<{
     inherited: z.ZodBoolean;
     shared: z.ZodBoolean;
     registeredAt: z.ZodString;
+    status: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        rejected: "rejected";
+        exhausted: "exhausted";
+    }>>>;
+    resetAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>;
 export type Subscription = z.infer<typeof subscriptionSchema>;
 export declare const subscriptionListSchema: z.ZodObject<{
@@ -34,6 +39,11 @@ export declare const subscriptionListSchema: z.ZodObject<{
         inherited: z.ZodBoolean;
         shared: z.ZodBoolean;
         registeredAt: z.ZodString;
+        status: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            rejected: "rejected";
+            exhausted: "exhausted";
+        }>>>;
+        resetAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$strip>>;
     writable: z.ZodBoolean;
 }, z.core.$strip>;

package/dist/utils/subscriptionProbe.d.ts

@@ -1,4 +1,20 @@
 import type { SubscriptionName } from "./subscriptionCredentials.ts";
+/**
+ * the provider's answer about one credential. only `rejected` and `exhausted`
+ * advance the chain; `unknown` never changes who pays.
+ */
+export type ProbeVerdict = {
+    status: "usable";
+} | {
+    status: "unknown";
+} | {
+    status: "rejected";
+    detail: string;
+} | {
+    status: "exhausted";
+    detail: string;
+    resetAt: Date | undefined;
+};
 export declare class SubscriptionCredentialError extends Error {
 }
 export declare function subscriptionIdentity(input: {
@@ -13,10 +29,10 @@ export declare function probeSubscription(input: {
     name: SubscriptionName;
     value: string;
     model?: string | undefined;
-}): Promise<"usable" | "rejected" | "unknown">;
+}): Promise<ProbeVerdict>;
 /** probe the chosen model, not a models-list permission a restricted key may lack. */
 export declare function probeInference(input: {
     name: string;
     value: string;
     model: string;
-}): Promise<"usable" | "rejected" | "unknown">;
+}): Promise<ProbeVerdict>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.90",
+  "version": "0.1.91",
   "cliContractVersion": "1",
   "type": "module",
   "bin": {