add file_read/file_write tools, sandbox tests, CI improvements (#239)

* migrate to flags

* init

* iterate on file write lockdown tests

* improve ci

* fix lockfile

* fix typecheck

* fix lint

* improve pushRestricted

* ok

* fix more

* ok

* remove process.env spreading rule

Co-authored-by: Cursor <cursoragent@cursor.com>

* enhanced fs rw tools

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Colin McDonnell <colinmcd94@gmail.com>

utils/docker.ts

@@ -119,6 +119,7 @@ const testEnvAllowList = new Set([
   "GEMINI_API_KEY",
   "GOOGLE_GENERATIVE_AI_API_KEY",
   "CURSOR_API_KEY",
+  "OPENCODE_MODEL", // override OpenCode model (e.g. google/gemini-3-flash-preview) for tests or user preference
   "LOG_LEVEL",
   "DEBUG",
   "NODE_ENV",

utils/instructions.ts

@@ -100,6 +100,15 @@ function getShellInstructions(bash: ResolvedPayload["bash"]): string {
   }
 }
 
+function getFileInstructions(): string {
+  return `**File operations**: Use the \`${ghPullfrogMcpName}\` MCP file tools for all file operations. Do NOT use any native file read/write/edit tools — they are disabled. Available tools:
+- \`file_read\` / \`file_write\` — read and write files
+- \`file_edit\` — targeted text replacement (prefer over read-then-write for existing files)
+- \`file_delete\` — remove files
+- \`list_directory\` — list directory contents
+All file tools enforce repository-scoped access and prevent modifications to .git/.`;
+}
+
 function getStandaloneModeInstructions(trigger: string): string {
   if (trigger !== "unknown") {
     return "";
@@ -201,6 +210,8 @@ Protected branches (default branch) are blocked from direct pushes in restricted
 
 ${getShellInstructions(ctx.payload.bash)}
 
+${getFileInstructions()}
+
 ${getStandaloneModeInstructions(ctx.payload.event.trigger)}
 
 **Command execution**: Never use \`sleep\` to wait for commands to complete. Commands run synchronously - when the bash tool returns, the command has finished.