[mrbro-bot]

This PR contains the following updates:

Package	Update	Change	OpenSSF
fro-bot/agent	patch	v0.125.2 → v0.125.3

---

Release Notes

fro-bot/agent

v0.125.3

Compare Source

What's new

The Action no longer writes reasoning-part deltas into its response-text log, and gateway runs now treat an owned child session’s terminal error as an unknown child outcome rather than failing the whole run. Root-session errors still fail as before, and the gateway continues to learn child outcomes from task-completion notices. #​1912

Gateway ownership reconciliation now has a 15-second bound on both periodic passes and the root-idle pass, so a stalled status request cannot prevent later reconciliation for the rest of a run. Late results are ignored after timeout or teardown, and early run failures now dispose of the reconciler interval. #​1907

When a gateway run encounters a dirty shared checkout, it can now preserve the old checkout as a backup, install a fresh default-branch clone, and retry the update automatically. Recovery proceeds only while the run holds the repository lock, enough time remains for the bounded recovery steps, and the workspace confirms it is quiescent; the preserved backups remain subject to the existing retention cap. #​1918

GitHub App installation-token requests in the gateway now have a shared 30-second deadline across installation discovery and token minting, preventing stalled requests from holding a repository lock or concurrency slot indefinitely. A late token result cannot trigger a workspace request after the bound, and timeout diagnostics avoid logging error messages or tokens. #​1919

Gateway and workspace-agent logs now identify checkout refusals and failures with run IDs, and record forwarded workspace teardown responses with their status and duration. The new log fields omit checkout paths, request bodies, headers, and workspace paths. #​1915

Full changelog

0.125.3 (2026-10-23)

Build System

• deps: update dependency @​fro.bot/systematic to v3.24.2 (#​1897) (831cae1)
• deps: update Systematic to v3.25.2 (#​1914) (8c956c9)
• lint apps/workspace-agent in the root lint script (#​1924) (f5f3b8d)

Bug Fixes

• align event-loop divergences (Action reasoning deltas, gateway child errors) (#​1912) (06116c7)
• deps: update dependency @​aws-sdk/client-s3 to v3.1153.0 (#​1910) (540f2dc)
• gateway: bound every installation-token mint (#​1919) (14b9822)
• gateway: bound live-path ledger reconcile passes (#​1907) (0ee3913)
• log checkout refusals and workspace teardown with run ids (#​1915) (08e1dee)
• recover a dirty shared checkout automatically before a gateway run (#​1918) (d1ce0c2)

Documentation

• close the event-stream and timeouts rungs and restate the consolidation end state (#​1913) (8eba598)
• record teardown learnings and mark the lease and abort/settle rungs delivered (#​1909) (f3bb75c)

---

Configuration

📅 Schedule: (in timezone America/Phoenix)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.