chore(deps): update fro-bot/agent to v0.107.1

[mrbro-bot]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
fro-bot/agent	action	patch	v0.107.0 → v0.107.1

---

Release Notes

fro-bot/agent (fro-bot/agent)

v0.107.1

Compare Source

What's new

This patch fixes a self-perpetuating cache failure that could trap a repository in a state where no future run could recover without manual cache deletion, and closes two follow-on correctness gaps discovered during its review.

Bug fixes

A failed OpenCode server bootstrap was persisting poisoned session state that caused every subsequent run to fail the same way. The root cause was deeper than it appeared: the database was never checkpointed before being captured to cache — a hot write-ahead log was being transported instead of a stable snapshot — and a run that declined to save rather than repair the cache left the next run restoring the same bad entry, making non-saving a stable failure mode rather than a recovery path.

The fix repairs the cache on restore, between restoreCache and server bootstrap, so a stuck repository heals itself on its first run with session history intact. A WAL checkpoint using node:sqlite (available unflagged on Node 24) is now performed inside saveCache before any capture, so every path that persists state inherits the checkpoint structurally. The -shm wal-index file, which SQLite never syncs to disk, is no longer captured and any existing copy is deleted on restore. A configurable bootstrap budget (bounded at two minutes) is reported in the job summary, and session-retention now actually reaches the pruning logic it had been parsed, validated, logged, but never applied. #​1519

An @octokit/types 16→17 upgrade (pulled transitively by @octokit/auth-app and @octokit/core dependency updates) began modelling GitHub's Format: int64 fields as number | bigint, including the repository id. This broke CI because databaseId is used as a key in the operator redaction deny list, and Set<number>.has(bigint) is always false — meaning a redacted repository could silently stop being denied. Widening the type end-to-end was rejected because Number(id) above 2⁵³ is lossy and could collide with a different repository's key.

The fix introduces a single conversion boundary, toSafeRepositoryId, applied only where a repository id enters the system. An id that cannot round-trip exactly yields null and falls back to nodeId — which is the deny list's primary key, with the numeric id as secondary — so a binding keyed only by nodeId still denies. The backfill's skip-check and the redaction gate's usability check were also made consistent: previously a malformed stored id looked complete to one and unusable to the other, and was never repaired. #​1513

Two correctness gaps surfaced during the #​1519 review. The port-quiescence probe used a socket timeout to detect that the OpenCode child had exited — but a connect that neither completed nor was refused (the timeout case) resolved finish(false), the same value as a refused connection. "I don't know" was silently becoming "it's fine," suppressing the warning that a checkpoint may have raced a live writer. The probe now keeps polling on an inconclusive result, with only the real 5-second deadline producing quiesced: false. Separately, a mid-transfer failure in the S3 adapter left a partial opencode.db on disk; if that path also missed the Actions cache, the repair block was skipped entirely and a truncated database reached bootstrap unexamined. The fix unlinks the local path only when the pipeline itself throws — when a partial write actually occurred — leaving pre-existing files untouched on any rejection before the stream opened. #​1521

Full changelog

0.107.1 (2026-09-02)

Bug Fixes

• cache: break the session-cache bootstrap trap (#​1519) (9d795de), closes #​1407, references #​1407
• deps: update dependency @​aws-sdk/client-s3 to v3.1120.0 (#​1511) (48d8518)
• deps: update octokit monorepo (#​1467) (f733584)
• gateway: narrow int64 repository ids at the API boundary (#​1513) (e40c54e), references #​1467
• runtime: report an inconclusive port probe as unknown, not as exit (#​1521) (f30e9b1), references #​1519 #​1407

Documentation

• solutions: record why repair must precede capture (#​1522) (4970b06), references #​1407 #​1519 #​1407

Continuous Integration

• deps: update bfra-me/.github action to v4.23.0 (#​1510) (db83ab0)

---

Configuration

📅 Schedule: (in timezone America/Phoenix)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.