chore(deps): update fro-bot/agent to v0.109.0

[fro-bot]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
fro-bot/agent	action	minor	v0.108.1 → v0.109.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

fro-bot/agent (fro-bot/agent)

v0.109.0

Compare Source

What's new

This release overhauls how session persistence is observed and reported, fixing a chain of bugs where the cache and object-store backends could silently disagree about whether a save had happened.

Bug fixes

The cache layer's save result was previously a single boolean whose two values each carried several meanings — a real write and a skip-by-configuration both returned true, while a rejected write, empty content, a declined checkpoint, and a thrown error all returned false. The post-action hook read that bit, so a run where the object store persisted successfully but the Actions cache write was rejected would treat the outcome the same as a genuine failure: it repeated the entire save sequence, re-uploaded to the object store, and still surfaced the rejection as "no cache content to save."

saveCache now returns a CacheSaveResult with cachePersisted and storePersisted as independent axes and a named outcome (persisted, cache-rejected, cache-error, checkpoint-declined, skipped-empty, skipped-by-configuration). The CACHE_SAVED state variable becomes durable | store-only | skipped | not-persisted, derived by a single exhaustiveness-pinned mapper. The job summary gains a row naming the actual outcome and, on not-persisted, the cause and remedy — including that the Actions cache client returns the same -1 for a policy denial, a key collision, a 5xx, and an upload failure, so all three are listed as possible causes alongside the advice to enable s3-backup. #​1555

Two follow-on fixes tightened the result further. Empty-content saves now retry in the post hook instead of being treated as a permanent skip — whether a save directory is empty is a point-in-time filesystem observation, not a configuration constant, and a transient stat failure or not-yet-quiesced writer is indistinguishable from genuinely empty content; repeating a no-op costs nothing while a missed save costs the session. The cache key now includes the run attempt number: re-runs share the same GITHUB_RUN_ID, so attempt 2 was colliding with attempt 1's cache entry, reading the client's "already exists" response as a durable save, and discarding its own newer state. A third fix ensured the post hook's retry does not overwrite the run metadata that the main cleanup step had already written — the placeholder written during a retry was replacing token usage, timing, session ids, and error records with a nearly empty object at the same object-store key. Cleanup now sets a cleanupMetadataWritten marker only after its metadata upload succeeds; the post hook writes the placeholder only when that marker is absent. #​1556, #​1558

Continuous integration

The PR review prompt was instructing the agent to run build, type-check, and lint in every round, duplicating work already owned by the CI gate jobs. Across the preceding six PRs, build or type-check re-ran in four of six and full lint in two. A paragraph was added to the review prompt forbidding these commands by class — build, lint, and type-check at any scope; repository- or directory-wide test suite runs in any form — while preserving the one carve-out that has paid for itself: running a single named test file alongside a concrete finding to validate it. #​1549

Full changelog

0.109.0 (2026-09-05)

Features

• cache: report what session persistence actually happened (#​1555) (bd07dac)

Build System

• deps: update dependency @​fro.bot/systematic to v3.15.1 (#​1539) (192346a)
• deps: update dependency oh-my-opencode-slim to v2.2.18 (#​1540) (763323a)

Bug Fixes

• cache: retry on empty content, key saves by run attempt, name every cause of a rejected write (#​1556) (e81814f)
• deps: update dependency @​aws-sdk/client-s3 to v3.1122.0 (#​1529) (6d7c7a6)
• deps: update octokit packages (#​1548) (7a92594)
• post: keep cleanup's run metadata on a cache-save retry (#​1558) (44406b0)

Documentation

• restore the persistent-runner write-ahead-log reasoning and mark the example prompt's divergence (#​1553) (096faf1)
• solutions: record the cache version-hash regression and the parity test that guards it (#​1552) (eedda37)

Continuous Integration

• stop the PR review from re-running the gates other jobs already own (#​1549) (cec1fb9)

Miscellaneous Chores

• deps: update Bun to v1.4.0 (#​1550) (1df0d63)
• dev: update dependency simple-git-hooks to v2.14.0 (#​1523) (fd746a3)

---

Configuration

📅 Schedule: (in timezone America/Phoenix)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.