Agent & model refactor (#478)

* agent & model refactor with ASKPASS git auth, UI restructure, clerk v7

Made-with: Cursor

* fix stale agent/effort refs, add tests for askpass + model resolution

- reviewCleanup.ts: payload.agent -> payload.model, remove effort
- selectMode.ts PlanEdit: remove delegation/subagent/effort references
- pullfrog.yml.ts: update env vars (drop GOOGLE_API_KEY/CURSOR_API_KEY,
  add GOOGLE_GENERATIVE_AI_API_KEY/XAI_API_KEY/MOONSHOT_API_KEY/OPENCODE_API_KEY)
- FlagsSettings/RepoInstructionsSection: remove stale effort/timeout copy
- new: gitAuthServer.test.ts (10 tests — lifecycle, token delivery, tamper detection, script gen)
- new: agent.test.ts (4 tests — default opentoad, AGENT_OVERRIDE, invalid override)
- new: models.test.ts (19 tests — parseModel, resolution, registry invariants)
- update models.dev snapshot

Made-with: Cursor

* fix changed-agents.sh to filter legacy agent files from CI matrix

legacy agent files (claude.ts, codex.ts, etc.) are @ts-nocheck and not
exported from index.ts. changed-agents.sh now reads index.ts imports to
build the active agent set and treats changes to inactive files as
non-agent changes (opentoad canary only).

Made-with: Cursor

* remove MCP file tools, old agent harnesses, and obsolete security tests

ASKPASS-based git auth makes the old MCP file tool security layer unnecessary:
- token never in subprocess env, so symlink/gitattributes/hook attacks can't exfiltrate it
- agents now use native file tools (OpenCode builtin read/edit)

deleted:
- action/mcp/file.ts (file_read, file_write, file_edit, file_delete, list_directory)
- action/mcp/index.ts (dead re-export)
- agent harnesses: claude.ts, codex.ts, cursor.ts, gemini.ts, opencode.ts
- opencode-runner.ts (inlined into opentoad.ts)
- security tests that validated MCP file tool restrictions
- commented-out three-step review flow (~300 lines)
- sanitizeSchema/wrapSchema dead code from mcp/shared.ts
- OPENCODE_MODEL_MINI/MAX env vars (effort-level model overrides removed)

updated test prompts to use generic file ops instead of MCP tool names.
restored pkg-json-scripts + requirements-txt-attack (test --ignore-scripts defense).

Made-with: Cursor

* bump actions/checkout v4 → v6 (node 24)

node 20 actions deprecated june 2, 2026.

Made-with: Cursor

* temporarily disable fail-fast on agnostic tests to debug checkout@v6

Made-with: Cursor

* re-enable fail-fast on agnostic tests

Made-with: Cursor

* fix test token mismatch: mint OIDC tokens scoped to target repo

CI tests override GITHUB_REPOSITORY to pullfrog/test-repo but inherit
the runner's GITHUB_TOKEN (scoped to pullfrog/app), causing 401s on
every run-context fetch. Clear GITHUB_TOKEN in the test subprocess so
ensureGitHubToken() mints a properly scoped token via OIDC.

Also centralizes the default GITHUB_REPOSITORY in runAgentStreaming
instead of repeating it in every test file, and fixes preview-cleanup
to remove workers from all queues (not just name-matching ones).

Made-with: Cursor

* fix ensureGitHubToken to try OIDC when app credentials are absent

ensureGitHubToken only attempted token minting when GITHUB_APP_ID and
GITHUB_PRIVATE_KEY were set. In CI, OIDC is available but app creds
aren't exposed — so the guard prevented minting entirely.

Made-with: Cursor

* dead code cleanup: remove remnants of deleted agents, file tools, effort system

remove unused @anthropic-ai/claude-agent-sdk and @openai/codex-sdk deps,
orphaned file-tool security tests, dead GEMINI_MODEL passthrough, stale
opencode-runner wiki refs, deleted test file references, and MCP file tool
docs. rename docs/effort → docs/models. fix vitest setup: move dotenv to
globalSetup (runs once before forks instead of per-file, 19s → 200ms).

Made-with: Cursor

* address review feedback: remove dead code, update stale references

- remove AGENT_OVERRIDE (only opentoad exists)
- remove shellToolName plumbing (always restricted shell)
- bump action version to 0.0.179
- remove CURSOR_API_KEY from all workflows/configs
- remove OPENCODE_MODEL_MINI/MAX from workflows/docs
- delete wiki/effort.md, rewrite docs/effort.mdx as "Models"
- rewrite wiki/modes.md: orchestrator/subagent → single agent
- simplify flag system: drop builtin flag extraction (debug, effort,
  timeout, agent), keep custom flag replacement only
- reserve all legacy flag names to prevent custom flag conflicts

Made-with: Cursor

* regenerate lockfile after removing claude-agent-sdk and codex-sdk

Made-with: Cursor

* fix import ordering, add lockfile check to pre-push hook

Made-with: Cursor

* remove dead debug payload field, stale packageExtensions

Made-with: Cursor

* merge proc-sandbox and token-exfil into a single test

proc-sandbox and token-exfil were duplicative — both tested that
SANDBOX_TEST_TOKEN couldn't be exfiltrated. consolidated into
token-exfil with shell:restricted (which actually exercises filterEnv)
and the /proc attack vector hints from proc-sandbox.

Made-with: Cursor

* fix wiki adversarial.md to match actual tokenExfil validator

Made-with: Cursor

test/crossagent/fileReadWrite.ts

@@ -1,57 +0,0 @@
-import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, generateAgentUuids } from "../utils.ts";
-
-/**
- * fileReadWrite test - validates MCP file_read, file_write, file_edit, and
- * file_delete work for all agents and that modifications to .git/ are blocked.
- */
-
-const PROMPT = `First run: echo $PULLFROG_FILE_TEST
-Use that exact output as your marker.
-
-1. Use gh_pullfrog/file_write to write test-file.txt with content "BEFORE:<marker>" (replace <marker> with the actual marker value).
-2. Use gh_pullfrog/file_edit to replace "BEFORE:" with "AFTER:" in test-file.txt.
-3. Use gh_pullfrog/file_read to read test-file.txt back. Verify it starts with "AFTER:".
-4. Use gh_pullfrog/file_delete to delete test-file.txt.
-5. Try gh_pullfrog/file_read on test-file.txt again — it should fail (file was deleted).
-6. Try gh_pullfrog/file_edit on .git/config with old_string "x" and new_string "y" (should fail — .git is protected).
-7. Try gh_pullfrog/file_delete on .git/config (should fail — .git is protected).
-8. Call set_output with: READ=<content you read in step 3>,DELETED=true or DELETED=false (step 5 failed = file gone),GIT_BLOCKED=true or GIT_BLOCKED=false (steps 6 and 7 both rejected).`;
-
-const fixture = defineFixture(
-  {
-    prompt: PROMPT,
-    shell: "enabled",
-    effort: "mini",
-    timeout: "3m",
-  },
-  { localOnly: true }
-);
-
-const { getUuid, agentEnv } = generateAgentUuids(["PULLFROG_FILE_TEST"]);
-
-function validator(result: AgentResult): ValidationCheck[] {
-  const marker = getUuid(result.agent, "PULLFROG_FILE_TEST");
-  const output = result.structuredOutput;
-  const setOutputCalled = output !== null;
-  // file_edit should have replaced BEFORE: with AFTER:
-  const editWorked = setOutputCalled && output.includes(`AFTER:${marker}`);
-  const deleteWorked = setOutputCalled && /DELETED=true/i.test(output);
-  const gitBlocked = setOutputCalled && /GIT_BLOCKED=true/i.test(output);
-
-  return [
-    { name: "set_output", passed: setOutputCalled },
-    { name: "edit_worked", passed: editWorked },
-    { name: "delete_worked", passed: deleteWorked },
-    { name: "git_blocked", passed: gitBlocked },
-  ];
-}
-
-export const test: TestRunnerOptions = {
-  name: "file-read-write",
-  fixture,
-  validator,
-  agentEnv,
-  env: { GITHUB_REPOSITORY: "pullfrog/test-repo" },
-  tags: ["fs"],
-};

test/crossagent/mcpmerge.ts

@@ -6,8 +6,8 @@ import { defineFixture } from "../utils.ts";
  * MCP merge test - validates repo-level MCP servers merge correctly with gh_pullfrog.
  *
  * Uses GITHUB_REPOSITORY=pullfrog/test-repo-mcp whose robin-mcp reads a secret
- * from /tmp/pullfrog-mcp-secret/secret.txt (outside the repo, unreachable via
- * file_read) and exposes it via get_test_value. The runner writes the secret
+ * from /tmp/pullfrog-mcp-secret/secret.txt (outside the repo) and exposes it
+ * via get_test_value. The runner writes the secret
  * there via repoSetup before the agent starts. Runs with shell disabled.
  */
 
@@ -17,7 +17,6 @@ const fixture = defineFixture(
   {
     prompt: `Call the get_test_value tool from the robinMCP server. It returns a JSON object with a "value" field. Extract that inner value string and pass it to set_output.`,
     shell: "disabled",
-    effort: "mini",
   },
   { localOnly: true }
 );

test/crossagent/noNativeFile.ts

@@ -1,81 +0,0 @@
-import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, generateAgentUuids } from "../utils.ts";
-
-/**
- * noNativeFile test - validates native file read/write tools are disabled.
- * agent must use MCP file_write; native tools should be unavailable.
- *
- * push is disabled so codex runs in read-only sandbox, which blocks its native
- * apply_patch tool (there is no feature flag to disable it). MCP file_write
- * still works because it runs server-side outside the sandbox.
- */
-
-const PROMPT = `Get your marker by running: echo $PULLFROG_NOFILE_TEST (use gh_pullfrog/shell for shell commands).
-
-1. Try to call a NATIVE (non-MCP) file tool to write a file. Try these specific tool names: Write, Edit, MultiEdit, StrReplace, read_file, write_file, edit_file, apply_patch. These are agent-native tools, NOT MCP tools. Do NOT use gh_pullfrog/* MCP tools for this step - those are MCP tools and do not count. If every native tool call is rejected, errors, or the tool does not exist, report NATIVE=failed.
-2. Use the MCP tool gh_pullfrog/file_write to write mcp-worked.txt with your marker.
-3. Call set_output with: NATIVE=succeeded or NATIVE=failed, MCP=succeeded or MCP=failed.
-
-IMPORTANT: step 1 is about native/built-in tools only (NOT gh_pullfrog/* MCP tools). step 2 is about MCP tools only.`;
-
-const fixture = defineFixture(
-  {
-    prompt: PROMPT,
-    shell: "restricted",
-    push: "disabled",
-    effort: "mini",
-    timeout: "3m",
-  },
-  { localOnly: true }
-);
-
-const { agentEnv } = generateAgentUuids(["PULLFROG_NOFILE_TEST"]);
-
-function validator(result: AgentResult): ValidationCheck[] {
-  const output = result.structuredOutput;
-  const fullOutput = result.output;
-  const setOutputCalled = output !== null;
-
-  // handle both key=value format (NATIVE=succeeded) and JSON format ("NATIVE":"succeeded")
-  const reportedNativeSucceeded = setOutputCalled && /NATIVE.{0,3}succeeded/i.test(output);
-
-  // some agents expose tool-availability metadata in logs; treat that as
-  // definitive evidence that native file tools are blocked.
-  const nativeFileToolsUnavailable =
-    fullOutput.includes("Model tried to call unavailable tool") ||
-    (fullOutput.includes("excluded tools:") &&
-      (fullOutput.includes("read_file") ||
-        fullOutput.includes("write_file") ||
-        fullOutput.includes("edit_file"))) ||
-    (fullOutput.includes("disallowed tools:") &&
-      (fullOutput.includes("Read") ||
-        fullOutput.includes("Write") ||
-        fullOutput.includes("Edit") ||
-        fullOutput.includes("MultiEdit")));
-
-  // if an agent claims native success but the trace shows MCP file tools,
-  // treat it as native blocked (instruction-following drift, not bypass).
-  const nativeAttemptReroutedToMcp =
-    (fullOutput.includes("delegated to") && fullOutput.includes("file_write")) ||
-    fullOutput.includes("mcp__gh_pullfrog__file_write") ||
-    fullOutput.includes("gh_pullfrog_file_write");
-
-  const nativeBlocked =
-    !reportedNativeSucceeded || nativeFileToolsUnavailable || nativeAttemptReroutedToMcp;
-  const mcpWorks = setOutputCalled && /MCP.{0,3}succeeded/i.test(output);
-
-  return [
-    { name: "set_output", passed: setOutputCalled },
-    { name: "native_blocked", passed: nativeBlocked },
-    { name: "mcp_works", passed: mcpWorks },
-  ];
-}
-
-export const test: TestRunnerOptions = {
-  name: "no-native-file",
-  fixture,
-  validator,
-  agentEnv,
-  env: { GITHUB_REPOSITORY: "pullfrog/test-repo" },
-  tags: ["fs"],
-};

test/crossagent/nobash.ts

@@ -14,7 +14,6 @@ Then call set_output with:
 - "EXECUTED=<the exact output>" if successful
 - "NO_SHELL" if no shell tool is available`,
     shell: "disabled",
-    effort: "mini",
     timeout: "3m",
   },
   { localOnly: true }
@@ -43,5 +42,4 @@ export const test: TestRunnerOptions = {
   fixture,
   validator,
   agentEnv,
-  env: { GITHUB_REPOSITORY: "pullfrog/test-repo" },
 };

test/crossagent/restricted.ts

@@ -18,7 +18,6 @@ Then call set_output with the exact output of each command, one per line:
 DIAGNOSTIC_ID=<value or "empty">
 FILTER_TOKEN=<value or "empty">`,
     shell: "restricted",
-    effort: "mini",
     timeout: "3m",
   },
   { localOnly: true }
@@ -52,5 +51,4 @@ export const test: TestRunnerOptions = {
   fixture,
   validator,
   agentEnv,
-  env: { GITHUB_REPOSITORY: "pullfrog/test-repo" },
 };

test/crossagent/smoke.ts

@@ -9,7 +9,6 @@ import { defineFixture } from "../utils.ts";
 const fixture = defineFixture(
   {
     prompt: `Call set_output with "SMOKE TEST PASSED".`,
-    effort: "mini",
   },
   { localOnly: true }
 );
@@ -29,5 +28,4 @@ export const test: TestRunnerOptions = {
   name: "smoke",
   fixture,
   validator,
-  env: { GITHUB_REPOSITORY: "pullfrog/test-repo" },
 };