pullfrog 0.1.95 → 0.1.97

package/dist/utils/openCodeModels.d.ts

@@ -1,3 +1,14 @@
+/**
+ * HOME and XDG dirs for every opencode subprocess, all inside this run. the runner user's own
+ * are shared by every run on a self-hosted host, and so is opencode's SQLite db in them (#1475).
+ */
+export declare function openCodeHomeEnv(tmpdir: string): {
+    HOME: string;
+    XDG_CONFIG_HOME: string;
+    XDG_DATA_HOME: string;
+    XDG_CACHE_HOME: string;
+    XDG_STATE_HOME: string;
+};
 /**
  * Why the last `opencode models` came back empty, in opencode's own words.
  *
@@ -9,11 +20,17 @@
 export declare function getModelsFailure(): string | undefined;
 /** Snapshot the set of models OpenCode can serve from the current env, BEFORE
  * Pullfrog-stored credentials are merged in. Call once early in `main.ts`. */
-export declare function captureBaselineModels(cliPath: string): void;
+export declare function captureBaselineModels(params: {
+    cliPath: string;
+    tmpdir: string;
+}): void;
 /** Snapshot the set of models OpenCode can serve AFTER dbSecrets +
  * Codex auth.json are in place. Logs the diff against the baseline as
  * `» BYOK auth enabled N model(s): …`. */
-export declare function captureAuthorizedModels(cliPath: string): void;
+export declare function captureAuthorizedModels(params: {
+    cliPath: string;
+    tmpdir: string;
+}): void;
 /** A model whose credential the pool just probed. Added directly: a second
  * `opencode models` would run inside the checkout and load the repo's own
  * `.opencode` plugins, which can outlast its timeout and empty the set. */

package/dist/utils/patchWorkflowRunFields.d.ts

@@ -9,6 +9,9 @@ import type { ToolContext } from "../mcp/server.ts";
  *    `Repo.model` slug), PATCHed once at end-of-run so per-model cost analytics
  *    don't parse the audit-only `payload`.
  * Keep in sync with `STRING_FIELDS` in `app/api/workflow-run/[runId]/route.ts`.
+ * `succeeded` and the usage fields below are this start's own report: a custom
+ * workflow can start the action several times in one run, and the server keeps
+ * one row per start, keyed by `START_KEY`, and sums them onto the run.
  */
 declare const STRING_KEYS: readonly ["prNodeId", "issueNodeId", "reviewNodeId", "planCommentNodeId", "summarySnapshot", "model", "agent", "credential"];
 /**
@@ -18,7 +21,11 @@ declare const STRING_KEYS: readonly ["prNodeId", "issueNodeId", "reviewNodeId",
  * amounts. Keep in sync with `INT_FIELDS` + `DECIMAL_FIELDS` in the server route.
  */
 declare const NUMBER_KEYS: readonly ["inputTokens", "outputTokens", "cacheReadTokens", "cacheWriteTokens", "costUsd"];
-export type WorkflowRunPatch = Partial<Record<(typeof STRING_KEYS)[number], string>> & Partial<Record<(typeof NUMBER_KEYS)[number], number>>;
+/** one-way flags, only ever sent as `true`. Keep in sync with `BOOLEAN_FIELDS` in the server route. */
+declare const FLAG_KEYS: readonly ["reviewSkipped"];
+export type WorkflowRunPatch = Partial<Record<(typeof STRING_KEYS)[number], string>> & Partial<Record<(typeof NUMBER_KEYS)[number], number>> & Partial<Record<(typeof FLAG_KEYS)[number], true>> & {
+    succeeded?: boolean;
+};
 /** PATCH workflow-run fields (Pullfrog JWT, not GitHub). */
 export declare function patchWorkflowRunFields(ctx: ToolContext, fields: WorkflowRunPatch): Promise<void>;
 /**

package/dist/utils/providerErrors.d.ts

@@ -7,7 +7,8 @@ export declare const PROVIDER_NO_ENDPOINTS_LABEL = "provider no routable endpoin
  * `PROVIDER_BILLING_EXHAUSTED_LABEL`: that label routes to a body whose CTA is
  * "Top up your provider balance", and a capped ChatGPT or Zen plan has no
  * balance to top up — it resets on its own. This label carries the cause into
- * the headline and lets the generic body stand.
+ * the hang headline and lets the generic body stand; a turn it ends directly
+ * gets its own wait-or-raise copy in `renderRunError` (#1474).
  */
 export declare const PROVIDER_USAGE_LIMIT_LABEL = "provider usage limit reached";
 export declare function findAnthropicSpendCap(text: string): {
@@ -35,6 +36,8 @@ export declare function isRouterKeylimitExhaustedError(text: string): boolean;
  * is the user's own provider account.
  */
 export declare function isProviderBillingExhausted(text: string): boolean;
+/** A capped subscription window or a configured usage limit — see `PROVIDER_USAGE_LIMIT_LABEL`. */
+export declare function isProviderUsageLimit(text: string): boolean;
 /**
  * OpenRouter accepted the request and found nowhere to send it: the account's
  * data policy or guardrail settings exclude every provider serving the picked

package/dist/utils/runContext.d.ts

@@ -3,6 +3,11 @@ import type { RouterTier } from "../models.ts";
 import type { CommercialRefusal } from "./billingErrors.ts";
 import type { RepoContext } from "./github.ts";
 import type { CredentialAccess } from "./subscriptionCredentials.ts";
+/**
+ * One per process, which is one start of the action within its GitHub run. Sent to run-context
+ * first, so a custom run's start is recorded before it reports, and then on each workflow-run PATCH.
+ */
+export declare const START_KEY: `${string}-${string}-${string}-${string}-${string}`;
 export interface Mode {
     id: string;
     name: string;
@@ -108,6 +113,9 @@ export declare function fetchRunContext(params: {
     /** `payload.type` — lets the server apply this repo's per-trigger model
      * override, which it cannot derive from owner/repo alone. */
     runType?: string | undefined;
+    /** a plain-text prompt, which no Pullfrog dispatch sends — so the server
+     * can record this run without waiting for a reservation to claim it. */
+    plainPrompt: boolean;
     /** `payload.routing.tier` — the model router's tier, which run-context
      * applies to the Router proxy mint the same way it applies `runType`. */
     routedTier?: RouterTier | undefined;

package/dist/utils/runContextData.d.ts

@@ -37,6 +37,8 @@ interface ResolveRunContextDataParams {
      * because run-context is fetched first and needs it to pick this trigger's
      * model override. */
     runType?: string | undefined;
+    /** the prompt is plain text, never a Pullfrog dispatch payload. */
+    plainPrompt: boolean;
     /** the model router's tier from the payload, forwarded so run-context applies it to the proxy mint. */
     routedTier?: RouterTier | undefined;
 }

package/dist/utils/runErrorRenderer.d.ts

@@ -13,19 +13,28 @@
  *      "key budget exhausted" string mid-run. Both render via
  *      `formatBillingErrorSummary` so the user sees actionable copy.
  *
+ *   1a. Pre-rendered bodies — a throw site that already built the markdown
+ *      (`MODEL_ACCESS_MARKER`, `SECRETS_UNAVAILABLE_MARKER`,
+ *      `ROUTER_UNFUNDED_MARKER`, `CREDENTIAL_REJECTED_MARKER`,
+ *      `CREDENTIAL_POOL_REFUSED_MARKER`) passes through verbatim on both surfaces.
+ *
  *   2. BYOK provider billing-exhausted (#835) — DeepSeek "Insufficient
  *      Balance", Anthropic "credit balance is too low", OpenCode Zen
  *      `CreditsError`, Gemini "spending cap". Checked before api-key auth
  *      because billing-exhausted responses often carry 401 status codes
  *      that `isApiKeyAuthError` would otherwise mis-classify.
  *
+ *   2a. Provider usage limit (#1474) — a capped subscription window or a
+ *      configured workspace limit; "wait or raise it", never "top up".
+ *
  *   3. API-key auth error — `isApiKeyAuthError` sniffs the raw error string
  *      (or the activity-timeout hang body when present, since that's where
  *      the underlying provider error often lands); `formatApiKeyErrorSummary`
  *      renders provider + console-link copy.
  *
- *   4. ProviderModelNotFoundError — configured model id no longer in the
- *      OpenCode catalog; renders a nudge to pick a different model.
+ *   4. ProviderModelNotFoundError — configured model id not in the OpenCode
+ *      catalog (opencode ≥1.18 words it `Model not found: <id>`, #1470);
+ *      renders a nudge to pick a different model.
  *
  *   4a. No-provider-available (#1077) — the model IS in the catalog but the
  *      provider declines to route it on this account's plan (OpenCode Zen's
@@ -60,17 +69,24 @@
  *      event counts and a benign stderr tail are operator-grade detail that
  *      only alarm the average user.
  *
- *   6. Default — the job summary gets a plain-English lead sentence plus the
+ *   6. Unclassified provider error (#1474) — `errorMessage` starts with
+ *      `provider error: `. opencode prefixes every provider-side turn failure
+ *      with the provider's text; claude-code (a zero-event exit) and codex (no
+ *      turn error, no stderr) prefix only our classifier label. Either names
+ *      something the user can act on, so both surfaces get a lead line plus the
+ *      raw text in a fenced block.
+ *
+ *   7. Default — the job summary gets a plain-English lead sentence plus the
  *      raw error in a fenced code block under the `### ❌ Pullfrog failed`
  *      banner; the PR comment collapses to the same one-line logs link as
  *      the hang case, since the raw internal string helps nobody on the PR.
  *
- * Net: the actionable classifications (billing, API-key, model-not-found,
- * no-provider-available, context-overflow, run time limit, transient-upstream)
- * render identical bodies on both surfaces; the non-actionable ones (unexplained hang,
- * generic) keep the forensics in the Actions job summary and show a calm
- * one-liner in the PR comment, whose footer already carries Pullfrog
- * branding + rerun links.
+ * Net: the actionable classifications (billing, usage limit, API-key,
+ * model-not-found, no-provider-available, context-overflow, run time limit,
+ * transient-upstream, unclassified provider error) render identical bodies on
+ * both surfaces; the non-actionable ones (unexplained hang, generic) keep the
+ * forensics in the Actions job summary and show a calm one-liner in the PR
+ * comment, whose footer already carries Pullfrog branding + rerun links.
  */
 import type { AgentDiagnostic } from "./agentHangReport.ts";
 export type RenderedRunError = {

package/dist/utils/runStatusCheck.d.ts

@@ -32,6 +32,14 @@
  * See wiki/review-approval.md.
  */
 export declare const RUN_STATUS_CHECK_NAME = "pullfrog";
+/**
+ * GitHub's own Actions app. It publishes a check run per job, named after the
+ * job — and the generated workflow's job is also called `pullfrog`, so the
+ * collision is structural rather than incidental. Renaming our check is not
+ * available: it was tried on 2026-08-02 and blocked merges on four customer
+ * repos (see above), so the reuse lookup filters instead. See #1196.
+ */
+export declare const GITHUB_ACTIONS_APP_SLUG = "github-actions";
 /** the review-verdict check. opt-in, terminal-only, and deliberately separate from the above. */
 export declare const APPROVAL_CHECK_NAME = "pullfrog-approval";
 /**
@@ -147,6 +155,8 @@ export declare function finalizeRunStatusCheck(params: {
     conclusion: RunStatusCheckConclusion;
     detailsUrl: string | undefined;
     reviewUrl?: string | undefined;
+    /** the run's own final report, shown on success when nothing else carries it. */
+    note?: string | undefined;
 }): Promise<void>;
 /**
  * Post an already-terminal check-run in one call.
@@ -163,6 +173,7 @@ export declare function createTerminalRunStatusCheck(params: {
     conclusion: RunStatusCheckConclusion;
     detailsUrl: string | undefined;
     reviewUrl?: string | undefined;
+    note?: string | undefined;
 }): Promise<void>;
 /**
  * Whether this check still needs finalizing.

package/dist/utils/statusChecks.d.ts

@@ -11,7 +11,8 @@ import type { ToolContext } from "../mcp/server.ts";
  *   - `pullfrog-approval` stays opt-in (`Repo.approvalCheck`, default off) and terminal-only:
  *     it asserts a review verdict, which only exists once a run produces one. anchored
  *     to the exact reviewed sha so a mid-run push leaves the new head unapproved until
- *     a follow-up re-review reports.
+ *     a follow-up re-review reports. a re-review that submits no review carries the
+ *     prior verdict forward instead (see `carriedApproval`).
  *
  * best-effort throughout: a check-post failure (transient 5xx, closed PR, revoked
  * permission) must never flip the run's own outcome. the `workflow_run.completed` webhook

package/dist/utils/subprocess.d.ts

@@ -12,6 +12,7 @@ export declare class SpawnTimeoutError extends Error {
 export type SignalHandler = (signal: NodeJS.Signals) => void;
 export declare function trackChild(options: TrackChildOptions): void;
 export declare function untrackChild(child: ChildProcess): void;
+export declare function isTrackedChild(child: ChildProcess): boolean;
 export declare function setSignalHandler(handler: SignalHandler | null): void;
 export declare function killTrackedChildren(): void;
 /**
@@ -50,6 +51,7 @@ export interface SpawnOptions {
     killGroup?: boolean;
     retain?: RetainMode;
     maxRetainedBytes?: number;
+    signal?: AbortSignal | undefined;
 }
 /**
  * Bounded string accumulator that keeps the tail of appended chunks.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.1.95",
+  "version": "0.1.97",
   "cliContractVersion": "1",
   "type": "module",
   "bin": {
@@ -66,7 +66,7 @@
     "undici": "^7.22.0",
     "vitest": "^4.0.17",
     "yaml": "^2.8.2",
-    "yes": "0.1.0",
+    "yes": "0.2.3",
     "zod": "4.3.6"
   },
   "repository": {