chore(deps): update fro-bot/agent to v0.107.3

[fro-bot]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
fro-bot/agent	action	patch	v0.107.1 → v0.107.3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

fro-bot/agent (fro-bot/agent)

v0.107.3

Compare Source

What's new

The OpenCode server binds its HTTP listener before per-directory instance bootstrap completes — config loading, plugin initialization, and service startup all run after the listener is up. Previously the harness treated the opencode server listening stdout line as a readiness signal, which meant it could declare the server ready while that serial bootstrap was still blocked. On 2026-09-04, a slow npm install during plugin initialization caused the harness to wait 181–370 seconds for a response, inheriting undici's 300-second headers timeout, and ultimately surface a bare fetch failed with no useful diagnostic.

bootstrapOpenCodeServer now issues a session.list probe against the workspace directory immediately after the listener binds, bounded by a 60-second timeout (DEFAULT_SERVER_READINESS_TIMEOUT_MS). That route is instance-scoped, so it cannot return until bootstrap has finished — global routes answer while instance bootstrap is still blocked and would prove nothing. A timeout now surfaces a named message ("did not answer an instance-scoped route within 60000ms — instance bootstrap is blocked") and triggers a clean shutdown rather than leaving the caller to inherit an unattributed connection failure five minutes later. The 60-second bound was sized to catch the observed stall class in a fraction of the time while sitting well above the healthy tail of 5–9 seconds across 60 surveyed runs.

#​1537

Full changelog

0.107.3 (2026-09-05)

Bug Fixes

• runtime: probe an instance-scoped route before reporting the server ready (#​1537) (f6c95a6)

Documentation

• solutions: record the bootstrap stall and the self-referential-check pattern (#​1535) (51a2f99)

Continuous Integration

• deps: update bfra-me/.github action to v4.24.0 (#​1526) (150c81a)

v0.107.2

Compare Source

Bug Fixes

• evals: keep the tail when truncating a diagnostic log (#​1531) (dcc12cb)
• setup: install the Systematic plugin during setup (#​1530) (2d28b1e)

Documentation

• resync living docs and warn consumers about the trigger constraint (#​1534) (6fcd8b9)
• say that mention flows need s3-backup (#​1527) (fccc156)

Continuous Integration

• deps: update step-security/harden-runner action to v2.21.1 (#​1518) (b1de3aa)

Miscellaneous Chores

• deps: update dependency step-security/harden-runner to v2.21.1 (#​1516) (4cbb748)
• dev: update dependency js-yaml to v5.4.1 (#​1501) (f291091)
• dev: update dependency lint-staged to v17.4.1 (#​1508) (11f1e6f)

---

Configuration

📅 Schedule: (in timezone America/Phoenix)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.