chore(deps): update fro-bot/agent to v0.108.1

[mrbro-bot]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
fro-bot/agent	action	minor	v0.107.3 → v0.108.1

---

Release Notes

fro-bot/agent (fro-bot/agent)

v0.108.1

Compare Source

What's new

Session continuity has been silently broken since 2026-09-02, with no visible error in any run. This release fixes the root cause.

PR #​1519 removed the SQLite write-ahead log files (opencode.db-wal, opencode.db-shm) from the save path list but left them in the restore path list. Because @actions/cache hashes the paths array into each entry's version, every save since 09-02 was written under a version that no restore could match. Restore walked the full key ladder — PR scope, branch scope, repo scope — and always landed on the last entry that had the old version: a main snapshot from 2026-09-01. Every run since then has "resumed" that stale snapshot, found no session for its PR, and reviewed from scratch as if it were a fresh start.

The fix consolidates restore and save into a single buildCachePaths function, deleting the two diverging helpers. Version identity is now guaranteed by construction rather than by two separate lists staying in sync. A new test in src/services/cache/paths.test.ts pins getCacheVersion(restorePaths) === getCacheVersion(savePaths) using the real @actions/cache hash, and is proven to fail against the pre-fix five-path restore list. The first run after this release on each PR or branch will restore nothing — every existing cache entry carries the old version — but that is a clean start from a state where nothing has genuinely resumed for three days. #​1546

Full changelog

0.108.1 (2026-09-05)

Build System

• deps: update dependency @​opencode-ai/sdk to v1.18.26 (#​1544) (11f6f69)

Bug Fixes

• cache: restore and save the same path list so cache entries are matchable (#​1546) (36cf199)

v0.108.0

Compare Source

What's new

Instance bootstrap could hang for three to six minutes when the npm install that initializes an OpenCode server stalled — observed on 2026-09-04 in issue #​1536. This release adds a timeout bound (defaulting to 300 000 ms, configurable via OPENCODE_NPM_INSTALL_TIMEOUT) to Npm.reify() inside the server so a stalled install surfaces as an InstallFailedError rather than blocking indefinitely. The upstream fix targets a file that does not exist on any release tag, so the carry was ported to the location where the install actually runs.

The base OpenCode version moves from 1.18.21 to 1.18.29, incorporating 169 upstream commits. All twelve existing harness carries remain intact — none have merged upstream — and the new npm-install-timeout carry is the thirteenth. Three upstream behavior changes were verified against harness contracts: continued execution after a configured permission denial, v1-config loading for v2-shaped content, and plugin readiness sequencing; all hold. Both the action default (DEFAULT_OPENCODE_VERSION) and the workspace Dockerfile ARG are updated to 1.18.29+harness.88b6b5fb so both surfaces run the same patched build. #​1542 #​1545

Full changelog

0.108.0 (2026-09-05)

Features

• default to OpenCode harness build 1.18.29+harness.88b6b5fb (#​1545) (7766565)

Bug Fixes

• deps: update dependency zod to v4.5.4 (#​1524) (26838e6)

Documentation

• solutions: record why a leftover write-ahead log must be left alone on cache restore (#​1541) (7a09b97)

Miscellaneous Chores

• harness: bump base OpenCode version to 1.18.29 and carry the npm install bound (#​1542) (cb4a142)

---

Configuration

📅 Schedule: (in timezone America/Phoenix)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.