* router: fix unspendable signup credit on no-card private repos (#791)
The bug
-------
`run-context/route.ts` gated `proxyModel` minting on `isInfraCovered`,
which is `oss || hasCard`. So a no-card account with positive wallet
balance (signup credit, top-up, etc.) on a private repo would never
get a `proxyModel` set on the run context. The action runtime then
fell through to whatever provider keys happened to be in the workflow
env — using the user's BYOK keys without their knowledge if any were
configured, or failing the run entirely otherwise.
Meanwhile `proxy-token/route.ts` already gated correctly on
`oss || hasCard || balance > 0`. The two routes disagreed, with
run-context being strictly more restrictive, so the agent never even
attempted to call proxy-token for these accounts. The wiki at
`billing.md:1052` documented the *intended* behavior ("a Router usage
row can debit a wallet with no card on file"), aspirational against
the actual code.
The action side had a parallel bug at `action/utils/proxy.ts:151` —
it re-derived `isInfraCovered({ isOss, plan })` and short-circuited
mint even when the server set `proxyModel`. Belt-and-suspenders that
was strictly more restrictive than the server.
Production impact
-----------------
Queried 55 router-mode no-card accounts holding signup credit:
- ALL have wallet balance = exactly $10.00 (untouched)
- ALL have 0 router proxy keys ever minted, 0 hwm usage
- ~25 have successful runs (using BYOK env vars from their workflow,
unaware their credit isn't being touched)
- The rest have zero successes; some accumulated 25+ failures
(e.g. `onechannelpe`: 25 failures, 0 successes, no card, $10 credit).
The fix
-------
- `run-context/route.ts`: widen `useRouter` to match proxy-token's
gate. OSS short-circuits as before. Otherwise: router mode + card
on file → mint; router mode + no card + positive balance → fetch
balance, mint if > 0. Skip the balance read when a card is on file
(auto-reload covers it without needing pre-flight balance — keeps
the hot path single-query).
- `action/utils/proxy.ts`: drop the redundant `isInfraCovered` check.
`ctx.proxyModel` IS the signal — the server is the authority on
funding decisions; the action just trusts and mints.
- `wiki/pricing.md`: correct the Router proxy key minting gate row
+ add a paragraph explaining why this gate diverges from
`isInfraCovered`.
- `wiki/billing.md`: rewrite the misleading "proxy-token returns 402"
paragraph to describe what actually happens at both routes.
`isInfraCovered` is unchanged. It still gates Pullfrog-paid features
(learnings writes, indexing). The bug was in conflating "Pullfrog
pays for marginal infra" with "user can fund a Router run via wallet"
— different concerns, now untangled.
* action: drop dead isInfraCovered + plan param post-fix
Cleanup the action-side dead code introduced by the previous commit's
removal of the redundant `isInfraCovered` re-derivation in proxy.ts:
- delete `isInfraCovered` from action/utils/runContext.ts (was the only
callsite; mirror in server's utils/billing.ts is unchanged and still
load-bearing for learnings/indexing)
- drop unused `plan: AccountPlan` param from `resolveProxyModel` /
`runProxyResolution` (and the corresponding `AccountPlan` import +
the `plan: runContext.plan` arg at the main.ts call site)
- update the action/mcp/server.ts comment that pointed at the now-gone
action mirror to reference the server-side `utils/billing.ts` instead
`AccountPlan` itself is still load-bearing (mcp/server, runContextData,
run-context fetch), only `isInfraCovered` and the dead `plan` parameter
go away.
Colin McDonnell
8dff91ac49