Agent & model refactor (#478)
* agent & model refactor with ASKPASS git auth, UI restructure, clerk v7 Made-with: Cursor * fix stale agent/effort refs, add tests for askpass + model resolution - reviewCleanup.ts: payload.agent -> payload.model, remove effort - selectMode.ts PlanEdit: remove delegation/subagent/effort references - pullfrog.yml.ts: update env vars (drop GOOGLE_API_KEY/CURSOR_API_KEY, add GOOGLE_GENERATIVE_AI_API_KEY/XAI_API_KEY/MOONSHOT_API_KEY/OPENCODE_API_KEY) - FlagsSettings/RepoInstructionsSection: remove stale effort/timeout copy - new: gitAuthServer.test.ts (10 tests — lifecycle, token delivery, tamper detection, script gen) - new: agent.test.ts (4 tests — default opentoad, AGENT_OVERRIDE, invalid override) - new: models.test.ts (19 tests — parseModel, resolution, registry invariants) - update models.dev snapshot Made-with: Cursor * fix changed-agents.sh to filter legacy agent files from CI matrix legacy agent files (claude.ts, codex.ts, etc.) are @ts-nocheck and not exported from index.ts. changed-agents.sh now reads index.ts imports to build the active agent set and treats changes to inactive files as non-agent changes (opentoad canary only). Made-with: Cursor * remove MCP file tools, old agent harnesses, and obsolete security tests ASKPASS-based git auth makes the old MCP file tool security layer unnecessary: - token never in subprocess env, so symlink/gitattributes/hook attacks can't exfiltrate it - agents now use native file tools (OpenCode builtin read/edit) deleted: - action/mcp/file.ts (file_read, file_write, file_edit, file_delete, list_directory) - action/mcp/index.ts (dead re-export) - agent harnesses: claude.ts, codex.ts, cursor.ts, gemini.ts, opencode.ts - opencode-runner.ts (inlined into opentoad.ts) - security tests that validated MCP file tool restrictions - commented-out three-step review flow (~300 lines) - sanitizeSchema/wrapSchema dead code from mcp/shared.ts - OPENCODE_MODEL_MINI/MAX env vars (effort-level model overrides removed) updated test prompts to use generic file ops instead of MCP tool names. restored pkg-json-scripts + requirements-txt-attack (test --ignore-scripts defense). Made-with: Cursor * bump actions/checkout v4 → v6 (node 24) node 20 actions deprecated june 2, 2026. Made-with: Cursor * temporarily disable fail-fast on agnostic tests to debug checkout@v6 Made-with: Cursor * re-enable fail-fast on agnostic tests Made-with: Cursor * fix test token mismatch: mint OIDC tokens scoped to target repo CI tests override GITHUB_REPOSITORY to pullfrog/test-repo but inherit the runner's GITHUB_TOKEN (scoped to pullfrog/app), causing 401s on every run-context fetch. Clear GITHUB_TOKEN in the test subprocess so ensureGitHubToken() mints a properly scoped token via OIDC. Also centralizes the default GITHUB_REPOSITORY in runAgentStreaming instead of repeating it in every test file, and fixes preview-cleanup to remove workers from all queues (not just name-matching ones). Made-with: Cursor * fix ensureGitHubToken to try OIDC when app credentials are absent ensureGitHubToken only attempted token minting when GITHUB_APP_ID and GITHUB_PRIVATE_KEY were set. In CI, OIDC is available but app creds aren't exposed — so the guard prevented minting entirely. Made-with: Cursor * dead code cleanup: remove remnants of deleted agents, file tools, effort system remove unused @anthropic-ai/claude-agent-sdk and @openai/codex-sdk deps, orphaned file-tool security tests, dead GEMINI_MODEL passthrough, stale opencode-runner wiki refs, deleted test file references, and MCP file tool docs. rename docs/effort → docs/models. fix vitest setup: move dotenv to globalSetup (runs once before forks instead of per-file, 19s → 200ms). Made-with: Cursor * address review feedback: remove dead code, update stale references - remove AGENT_OVERRIDE (only opentoad exists) - remove shellToolName plumbing (always restricted shell) - bump action version to 0.0.179 - remove CURSOR_API_KEY from all workflows/configs - remove OPENCODE_MODEL_MINI/MAX from workflows/docs - delete wiki/effort.md, rewrite docs/effort.mdx as "Models" - rewrite wiki/modes.md: orchestrator/subagent → single agent - simplify flag system: drop builtin flag extraction (debug, effort, timeout, agent), keep custom flag replacement only - reserve all legacy flag names to prevent custom flag conflicts Made-with: Cursor * regenerate lockfile after removing claude-agent-sdk and codex-sdk Made-with: Cursor * fix import ordering, add lockfile check to pre-push hook Made-with: Cursor * remove dead debug payload field, stale packageExtensions Made-with: Cursor * merge proc-sandbox and token-exfil into a single test proc-sandbox and token-exfil were duplicative — both tested that SANDBOX_TEST_TOKEN couldn't be exfiltrated. consolidated into token-exfil with shell:restricted (which actually exercises filterEnv) and the /proc attack vector hints from proc-sandbox. Made-with: Cursor * fix wiki adversarial.md to match actual tokenExfil validator Made-with: Cursor
This commit is contained in:
Colin McDonnell
committed by
pullfrog[bot]
pullfrog[bot]
parent
5bcfae990a
commit
6d25adfd1a
+37
-126
@@ -2,12 +2,46 @@
|
||||
import "./arkConfig.ts";
|
||||
import { createServer } from "node:net";
|
||||
import { FastMCP, type Tool } from "fastmcp";
|
||||
import type { Agent, AgentUsage } from "../agents/index.ts";
|
||||
import type { AgentUsage } from "../agents/index.ts";
|
||||
import { ghPullfrogMcpName } from "../external.ts";
|
||||
import type { Mode } from "../modes.ts";
|
||||
import type { PrepResult } from "../prep/index.ts";
|
||||
import { log } from "../utils/cli.ts";
|
||||
import type { OctokitWithPlugins } from "../utils/github.ts";
|
||||
import type { ResolvedPayload } from "../utils/payload.ts";
|
||||
import type { RunContextData } from "../utils/runContextData.ts";
|
||||
import { CheckoutPrTool } from "./checkout.ts";
|
||||
import { GetCheckSuiteLogsTool } from "./checkSuite.ts";
|
||||
import {
|
||||
CreateCommentTool,
|
||||
EditCommentTool,
|
||||
ReplyToReviewCommentTool,
|
||||
ReportProgressTool,
|
||||
} from "./comment.ts";
|
||||
import { CommitInfoTool } from "./commitInfo.ts";
|
||||
import {
|
||||
AwaitDependencyInstallationTool,
|
||||
StartDependencyInstallationTool,
|
||||
} from "./dependencies.ts";
|
||||
import { DeleteBranchTool, GitFetchTool, GitTool, PushBranchTool, PushTagsTool } from "./git.ts";
|
||||
import { IssueTool } from "./issue.ts";
|
||||
import { GetIssueCommentsTool } from "./issueComments.ts";
|
||||
import { GetIssueEventsTool } from "./issueEvents.ts";
|
||||
import { IssueInfoTool } from "./issueInfo.ts";
|
||||
import { AddLabelsTool } from "./labels.ts";
|
||||
import { SetOutputTool } from "./output.ts";
|
||||
import { CreatePullRequestTool, UpdatePullRequestBodyTool } from "./pr.ts";
|
||||
import { PullRequestInfoTool } from "./prInfo.ts";
|
||||
import { CreatePullRequestReviewTool } from "./review.ts";
|
||||
import {
|
||||
GetReviewCommentsTool,
|
||||
ListPullRequestReviewsTool,
|
||||
ResolveReviewThreadTool,
|
||||
} from "./reviewComments.ts";
|
||||
import { SelectModeTool } from "./selectMode.ts";
|
||||
import { addTools } from "./shared.ts";
|
||||
import { KillBackgroundTool, ShellTool } from "./shell.ts";
|
||||
import { UploadFileTool } from "./upload.ts";
|
||||
|
||||
export type BackgroundProcess = {
|
||||
pid: number;
|
||||
@@ -21,20 +55,6 @@ export type StoredPushDest = {
|
||||
localBranch: string;
|
||||
};
|
||||
|
||||
export type SubagentStatus = "running" | "completed" | "failed";
|
||||
|
||||
export type SubagentState = {
|
||||
id: string;
|
||||
label: string;
|
||||
status: SubagentStatus;
|
||||
mode: string;
|
||||
stdoutFilePath: string;
|
||||
output: string | undefined;
|
||||
usage: AgentUsage | undefined;
|
||||
startedAt: number;
|
||||
keepAliveInterval: ReturnType<typeof setInterval> | undefined;
|
||||
};
|
||||
|
||||
export interface ToolState {
|
||||
// where we're allowed to push - base repo initially, fork URL for fork PRs
|
||||
// set by setupGit, updated by checkout_pr. always set before push validation.
|
||||
@@ -47,11 +67,6 @@ export interface ToolState {
|
||||
// PR HEAD sha at checkout time — used to detect new commits pushed during a review
|
||||
checkoutSha?: string;
|
||||
selectedMode?: string;
|
||||
// per-subagent lifecycle tracking (keyed by subagent uuid)
|
||||
subagents: Map<string, SubagentState>;
|
||||
// only set on subagent shallow copies — routes set_output to the owning subagent.
|
||||
// never set on the orchestrator's shared state.
|
||||
selfSubagentId: string | undefined;
|
||||
backgroundProcesses: Map<string, BackgroundProcess>;
|
||||
review?: {
|
||||
id: number;
|
||||
@@ -88,8 +103,6 @@ export function initToolState(params: InitToolStateParams): ToolState {
|
||||
|
||||
return {
|
||||
progressCommentId: resolvedId,
|
||||
subagents: new Map(),
|
||||
selfSubagentId: undefined,
|
||||
backgroundProcesses: new Map(),
|
||||
usageEntries: [],
|
||||
};
|
||||
@@ -102,7 +115,6 @@ export interface ToolContext {
|
||||
githubInstallationToken: string;
|
||||
gitToken: string;
|
||||
apiToken: string;
|
||||
agent: Agent;
|
||||
modes: Mode[];
|
||||
postCheckoutScript: string | null;
|
||||
prApproveEnabled: boolean;
|
||||
@@ -110,55 +122,10 @@ export interface ToolContext {
|
||||
toolState: ToolState;
|
||||
runId: number | undefined;
|
||||
jobId: string | undefined;
|
||||
// set after MCP server starts — used by delegate tool to pass URL to subagents
|
||||
mcpServerUrl: string;
|
||||
tmpdir: string;
|
||||
}
|
||||
|
||||
import { log } from "../utils/cli.ts";
|
||||
import type { RunContextData } from "../utils/runContextData.ts";
|
||||
import { AskQuestionTool } from "./askQuestion.ts";
|
||||
import { CheckoutPrTool } from "./checkout.ts";
|
||||
import { GetCheckSuiteLogsTool } from "./checkSuite.ts";
|
||||
import {
|
||||
CreateCommentTool,
|
||||
EditCommentTool,
|
||||
ReplyToReviewCommentTool,
|
||||
ReportProgressTool,
|
||||
} from "./comment.ts";
|
||||
import { CommitInfoTool } from "./commitInfo.ts";
|
||||
import { DelegateTool } from "./delegate.ts";
|
||||
import {
|
||||
AwaitDependencyInstallationTool,
|
||||
StartDependencyInstallationTool,
|
||||
} from "./dependencies.ts";
|
||||
import {
|
||||
FileDeleteTool,
|
||||
FileEditTool,
|
||||
FileReadTool,
|
||||
FileWriteTool,
|
||||
ListDirectoryTool,
|
||||
} from "./file.ts";
|
||||
import { DeleteBranchTool, GitFetchTool, GitTool, PushBranchTool, PushTagsTool } from "./git.ts";
|
||||
import { IssueTool } from "./issue.ts";
|
||||
import { GetIssueCommentsTool } from "./issueComments.ts";
|
||||
import { GetIssueEventsTool } from "./issueEvents.ts";
|
||||
import { IssueInfoTool } from "./issueInfo.ts";
|
||||
import { AddLabelsTool } from "./labels.ts";
|
||||
import { SetOutputTool } from "./output.ts";
|
||||
import { CreatePullRequestTool, UpdatePullRequestBodyTool } from "./pr.ts";
|
||||
import { PullRequestInfoTool } from "./prInfo.ts";
|
||||
import { CreatePullRequestReviewTool } from "./review.ts";
|
||||
import {
|
||||
GetReviewCommentsTool,
|
||||
ListPullRequestReviewsTool,
|
||||
ResolveReviewThreadTool,
|
||||
} from "./reviewComments.ts";
|
||||
import { SelectModeTool } from "./selectMode.ts";
|
||||
import { addTools } from "./shared.ts";
|
||||
import { KillBackgroundTool, ShellTool } from "./shell.ts";
|
||||
import { UploadFileTool } from "./upload.ts";
|
||||
|
||||
const mcpPortStart = 3764;
|
||||
const mcpPortAttempts = 100;
|
||||
const mcpHost = "127.0.0.1";
|
||||
@@ -198,7 +165,6 @@ function isAddressInUse(error: unknown): boolean {
|
||||
|
||||
type JsonSchema = Record<string, unknown>;
|
||||
|
||||
// tools shared by both orchestrator and subagent servers
|
||||
function buildCommonTools(ctx: ToolContext, outputSchema?: JsonSchema): Tool<any, any>[] {
|
||||
const tools: Tool<any, any>[] = [
|
||||
StartDependencyInstallationTool(ctx),
|
||||
@@ -223,17 +189,9 @@ function buildCommonTools(ctx: ToolContext, outputSchema?: JsonSchema): Tool<any
|
||||
GitFetchTool(ctx),
|
||||
UploadFileTool(ctx),
|
||||
SetOutputTool(ctx, outputSchema),
|
||||
FileReadTool(ctx),
|
||||
FileWriteTool(ctx),
|
||||
FileEditTool(ctx),
|
||||
FileDeleteTool(ctx),
|
||||
ListDirectoryTool(ctx),
|
||||
];
|
||||
|
||||
// only add ShellTool when shell is "restricted"
|
||||
// - "enabled": native shell only (no MCP shell needed)
|
||||
// - "restricted": MCP shell only (native blocked, env filtered)
|
||||
// - "disabled": no shell at all
|
||||
// MCP shell with filtered env (no secrets leaked to child processes)
|
||||
if (ctx.payload.shell === "restricted") {
|
||||
tools.push(ShellTool(ctx));
|
||||
tools.push(KillBackgroundTool(ctx));
|
||||
@@ -242,14 +200,11 @@ function buildCommonTools(ctx: ToolContext, outputSchema?: JsonSchema): Tool<any
|
||||
return tools;
|
||||
}
|
||||
|
||||
// orchestrator gets common tools + delegation + remote-mutating tools
|
||||
function buildOrchestratorTools(ctx: ToolContext, outputSchema?: JsonSchema): Tool<any, any>[] {
|
||||
return [
|
||||
...buildCommonTools(ctx, outputSchema),
|
||||
ReportProgressTool(ctx),
|
||||
SelectModeTool(ctx),
|
||||
DelegateTool(ctx),
|
||||
AskQuestionTool(ctx),
|
||||
PushBranchTool(ctx),
|
||||
PushTagsTool(ctx),
|
||||
DeleteBranchTool(ctx),
|
||||
@@ -258,11 +213,6 @@ function buildOrchestratorTools(ctx: ToolContext, outputSchema?: JsonSchema): To
|
||||
];
|
||||
}
|
||||
|
||||
// subagent gets only common tools (no delegation, no remote mutation)
|
||||
function buildSubagentTools(ctx: ToolContext): Tool<any, any>[] {
|
||||
return buildCommonTools(ctx);
|
||||
}
|
||||
|
||||
type McpStartResult = {
|
||||
server: FastMCP;
|
||||
url: string;
|
||||
@@ -367,7 +317,7 @@ type McpHttpServerOptions = {
|
||||
};
|
||||
|
||||
/**
|
||||
* Start the orchestrator MCP HTTP server (has all tools including push/PR/delegation).
|
||||
* Start the MCP HTTP server.
|
||||
*/
|
||||
export async function startMcpHttpServer(
|
||||
ctx: ToolContext,
|
||||
@@ -384,42 +334,3 @@ export async function startMcpHttpServer(
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
export type ManagedMcpServer = {
|
||||
url: string;
|
||||
stop: () => Promise<void>;
|
||||
toolState: ToolState;
|
||||
};
|
||||
|
||||
type StartSubagentMcpServerParams = {
|
||||
ctx: ToolContext;
|
||||
subagentId: string;
|
||||
};
|
||||
|
||||
/**
|
||||
* Start a per-subagent MCP server (common tools only — no push/PR/delegation).
|
||||
* Each subagent gets its own server; call stop() when the subagent completes.
|
||||
*
|
||||
* The subagent gets its own shallow copy of toolState so scalar writes
|
||||
* (pushUrl, pushDest, selectedMode, etc.) don't mutate the orchestrator's state.
|
||||
* selfSubagentId is set on the copy so set_output routes to the correct subagent.
|
||||
* Shared references (subagents Map, usageEntries array, dependencyInstallation)
|
||||
* are intentionally shared for coordination (set_output routing, usage tracking).
|
||||
*/
|
||||
export async function startSubagentMcpServer(
|
||||
params: StartSubagentMcpServerParams
|
||||
): Promise<ManagedMcpServer> {
|
||||
const subagentToolState: ToolState = {
|
||||
...params.ctx.toolState,
|
||||
selfSubagentId: params.subagentId,
|
||||
backgroundProcesses: new Map(),
|
||||
};
|
||||
const subagentCtx: ToolContext = { ...params.ctx, toolState: subagentToolState };
|
||||
const tools = buildSubagentTools(subagentCtx);
|
||||
const startResult = await selectMcpPort(subagentCtx, tools);
|
||||
return {
|
||||
url: startResult.url,
|
||||
stop: () => startResult.server.stop(),
|
||||
toolState: subagentToolState,
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user