Agent & model refactor (#478)
* agent & model refactor with ASKPASS git auth, UI restructure, clerk v7 Made-with: Cursor * fix stale agent/effort refs, add tests for askpass + model resolution - reviewCleanup.ts: payload.agent -> payload.model, remove effort - selectMode.ts PlanEdit: remove delegation/subagent/effort references - pullfrog.yml.ts: update env vars (drop GOOGLE_API_KEY/CURSOR_API_KEY, add GOOGLE_GENERATIVE_AI_API_KEY/XAI_API_KEY/MOONSHOT_API_KEY/OPENCODE_API_KEY) - FlagsSettings/RepoInstructionsSection: remove stale effort/timeout copy - new: gitAuthServer.test.ts (10 tests — lifecycle, token delivery, tamper detection, script gen) - new: agent.test.ts (4 tests — default opentoad, AGENT_OVERRIDE, invalid override) - new: models.test.ts (19 tests — parseModel, resolution, registry invariants) - update models.dev snapshot Made-with: Cursor * fix changed-agents.sh to filter legacy agent files from CI matrix legacy agent files (claude.ts, codex.ts, etc.) are @ts-nocheck and not exported from index.ts. changed-agents.sh now reads index.ts imports to build the active agent set and treats changes to inactive files as non-agent changes (opentoad canary only). Made-with: Cursor * remove MCP file tools, old agent harnesses, and obsolete security tests ASKPASS-based git auth makes the old MCP file tool security layer unnecessary: - token never in subprocess env, so symlink/gitattributes/hook attacks can't exfiltrate it - agents now use native file tools (OpenCode builtin read/edit) deleted: - action/mcp/file.ts (file_read, file_write, file_edit, file_delete, list_directory) - action/mcp/index.ts (dead re-export) - agent harnesses: claude.ts, codex.ts, cursor.ts, gemini.ts, opencode.ts - opencode-runner.ts (inlined into opentoad.ts) - security tests that validated MCP file tool restrictions - commented-out three-step review flow (~300 lines) - sanitizeSchema/wrapSchema dead code from mcp/shared.ts - OPENCODE_MODEL_MINI/MAX env vars (effort-level model overrides removed) updated test prompts to use generic file ops instead of MCP tool names. restored pkg-json-scripts + requirements-txt-attack (test --ignore-scripts defense). Made-with: Cursor * bump actions/checkout v4 → v6 (node 24) node 20 actions deprecated june 2, 2026. Made-with: Cursor * temporarily disable fail-fast on agnostic tests to debug checkout@v6 Made-with: Cursor * re-enable fail-fast on agnostic tests Made-with: Cursor * fix test token mismatch: mint OIDC tokens scoped to target repo CI tests override GITHUB_REPOSITORY to pullfrog/test-repo but inherit the runner's GITHUB_TOKEN (scoped to pullfrog/app), causing 401s on every run-context fetch. Clear GITHUB_TOKEN in the test subprocess so ensureGitHubToken() mints a properly scoped token via OIDC. Also centralizes the default GITHUB_REPOSITORY in runAgentStreaming instead of repeating it in every test file, and fixes preview-cleanup to remove workers from all queues (not just name-matching ones). Made-with: Cursor * fix ensureGitHubToken to try OIDC when app credentials are absent ensureGitHubToken only attempted token minting when GITHUB_APP_ID and GITHUB_PRIVATE_KEY were set. In CI, OIDC is available but app creds aren't exposed — so the guard prevented minting entirely. Made-with: Cursor * dead code cleanup: remove remnants of deleted agents, file tools, effort system remove unused @anthropic-ai/claude-agent-sdk and @openai/codex-sdk deps, orphaned file-tool security tests, dead GEMINI_MODEL passthrough, stale opencode-runner wiki refs, deleted test file references, and MCP file tool docs. rename docs/effort → docs/models. fix vitest setup: move dotenv to globalSetup (runs once before forks instead of per-file, 19s → 200ms). Made-with: Cursor * address review feedback: remove dead code, update stale references - remove AGENT_OVERRIDE (only opentoad exists) - remove shellToolName plumbing (always restricted shell) - bump action version to 0.0.179 - remove CURSOR_API_KEY from all workflows/configs - remove OPENCODE_MODEL_MINI/MAX from workflows/docs - delete wiki/effort.md, rewrite docs/effort.mdx as "Models" - rewrite wiki/modes.md: orchestrator/subagent → single agent - simplify flag system: drop builtin flag extraction (debug, effort, timeout, agent), keep custom flag replacement only - reserve all legacy flag names to prevent custom flag conflicts Made-with: Cursor * regenerate lockfile after removing claude-agent-sdk and codex-sdk Made-with: Cursor * fix import ordering, add lockfile check to pre-push hook Made-with: Cursor * remove dead debug payload field, stale packageExtensions Made-with: Cursor * merge proc-sandbox and token-exfil into a single test proc-sandbox and token-exfil were duplicative — both tested that SANDBOX_TEST_TOKEN couldn't be exfiltrated. consolidated into token-exfil with shell:restricted (which actually exercises filterEnv) and the /proc attack vector hints from proc-sandbox. Made-with: Cursor * fix wiki adversarial.md to match actual tokenExfil validator Made-with: Cursor
This commit is contained in:
Colin McDonnell
committed by
pullfrog[bot]
pullfrog[bot]
parent
5bcfae990a
commit
6d25adfd1a
@@ -0,0 +1,161 @@
|
||||
/**
|
||||
* ASKPASS-based git authentication server.
|
||||
*
|
||||
* serves tokens via a localhost HTTP server with single-use UUID codes.
|
||||
* each $git() call gets a unique askpass script with the port+code baked in.
|
||||
* the token never appears in subprocess env — only the script file path.
|
||||
*
|
||||
* tamper-evident: if a code is used twice, the second request triggers
|
||||
* immediate token revocation via the GitHub API as a precaution.
|
||||
*/
|
||||
|
||||
import { randomUUID } from "node:crypto";
|
||||
import { writeFileSync } from "node:fs";
|
||||
import { createServer } from "node:http";
|
||||
import { join } from "node:path";
|
||||
import { log } from "./cli.ts";
|
||||
|
||||
type CodeState = "pending" | "consumed";
|
||||
|
||||
type PendingCode = {
|
||||
token: string;
|
||||
state: CodeState;
|
||||
timeout: NodeJS.Timeout;
|
||||
};
|
||||
|
||||
const CODE_TTL_MS = 5 * 60 * 1000;
|
||||
const TAMPER_WINDOW_MS = 60_000;
|
||||
|
||||
export type GitAuthServer = {
|
||||
port: number;
|
||||
register: (token: string) => string;
|
||||
writeAskpassScript: (code: string) => string;
|
||||
close: () => Promise<void>;
|
||||
[Symbol.asyncDispose]: () => Promise<void>;
|
||||
};
|
||||
|
||||
function revokeGitHubToken(token: string): void {
|
||||
fetch("https://api.github.com/installation/token", {
|
||||
method: "DELETE",
|
||||
headers: {
|
||||
Authorization: `Bearer ${token}`,
|
||||
Accept: "application/vnd.github+json",
|
||||
"User-Agent": "pullfrog",
|
||||
},
|
||||
}).then(
|
||||
(r) => log.info(`token revocation response: ${r.status}`),
|
||||
() => log.warning("token revocation request failed")
|
||||
);
|
||||
}
|
||||
|
||||
export async function startGitAuthServer(tmpdir: string): Promise<GitAuthServer> {
|
||||
const codes = new Map<string, PendingCode>();
|
||||
|
||||
const server = createServer((req, res) => {
|
||||
if (req.method !== "GET") {
|
||||
res.writeHead(405).end();
|
||||
return;
|
||||
}
|
||||
|
||||
const code = req.url?.slice(1);
|
||||
if (!code) {
|
||||
res.writeHead(400).end();
|
||||
return;
|
||||
}
|
||||
|
||||
const entry = codes.get(code);
|
||||
if (!entry) {
|
||||
res.writeHead(404).end();
|
||||
return;
|
||||
}
|
||||
|
||||
if (entry.state === "pending") {
|
||||
// first use — return token, keep entry for tamper detection
|
||||
entry.state = "consumed";
|
||||
clearTimeout(entry.timeout);
|
||||
entry.timeout = setTimeout(() => codes.delete(code), TAMPER_WINDOW_MS);
|
||||
entry.timeout.unref();
|
||||
res.writeHead(200, { "Content-Type": "text/plain" });
|
||||
res.end(entry.token);
|
||||
return;
|
||||
}
|
||||
|
||||
// second request for same code — revoke token as a precaution
|
||||
log.info("askpass code used twice — revoking token");
|
||||
revokeGitHubToken(entry.token);
|
||||
clearTimeout(entry.timeout);
|
||||
codes.delete(code);
|
||||
res.writeHead(409, { "Content-Type": "text/plain" });
|
||||
res.end("compromised");
|
||||
});
|
||||
|
||||
await new Promise<void>((resolve, reject) => {
|
||||
server.on("error", reject);
|
||||
server.listen(0, "127.0.0.1", () => resolve());
|
||||
});
|
||||
|
||||
const rawAddr = server.address();
|
||||
if (!rawAddr || typeof rawAddr === "string") {
|
||||
throw new Error("git auth server failed to bind");
|
||||
}
|
||||
const port = rawAddr.port;
|
||||
|
||||
log.debug(`git auth server listening on 127.0.0.1:${port}`);
|
||||
|
||||
function register(token: string): string {
|
||||
const code = randomUUID();
|
||||
const timeout = setTimeout(() => {
|
||||
codes.delete(code);
|
||||
log.debug(`git auth code expired: ${code.slice(0, 8)}...`);
|
||||
}, CODE_TTL_MS);
|
||||
timeout.unref();
|
||||
codes.set(code, { token, state: "pending", timeout });
|
||||
return code;
|
||||
}
|
||||
|
||||
function writeAskpassScript(code: string): string {
|
||||
const scriptId = randomUUID();
|
||||
const scriptName = `askpass-${scriptId}.js`;
|
||||
const scriptPath = join(tmpdir, scriptName);
|
||||
|
||||
// standalone node script — no project dependencies.
|
||||
// git calls this twice: once for "Username for ..." and once for "Password for ...".
|
||||
// username: return "x-access-token" locally (no server call).
|
||||
// password: fetch token from auth server, self-delete, return token.
|
||||
// 409 = code was already consumed by another process (tamper detected).
|
||||
const content = [
|
||||
`#!/usr/bin/env node`,
|
||||
`var a=process.argv[2]||"";`,
|
||||
`if(/^Username/i.test(a)){process.stdout.write("x-access-token\\n")}`,
|
||||
`else{var h=require("http");`,
|
||||
`h.get("http://127.0.0.1:${port}/${code}",function(r){`,
|
||||
`if(r.statusCode===409){process.stderr.write("askpass-compromised\\n");process.exit(1)}`,
|
||||
`if(r.statusCode!==200){process.exit(1)}`,
|
||||
`var d="";r.on("data",function(c){d+=c});`,
|
||||
`r.on("end",function(){`,
|
||||
`process.stdout.write(d+"\\n");`,
|
||||
`try{require("fs").unlinkSync("${scriptPath.replace(/\\/g, "\\\\")}")}catch(e){}`,
|
||||
`})}).on("error",function(){process.exit(1)})}`,
|
||||
].join("\n");
|
||||
|
||||
writeFileSync(scriptPath, content, { mode: 0o700 });
|
||||
return scriptPath;
|
||||
}
|
||||
|
||||
async function close(): Promise<void> {
|
||||
for (const entry of codes.values()) {
|
||||
clearTimeout(entry.timeout);
|
||||
}
|
||||
codes.clear();
|
||||
await new Promise<void>((resolve) => server.close(() => resolve()));
|
||||
log.debug("git auth server closed");
|
||||
}
|
||||
|
||||
return {
|
||||
port,
|
||||
register,
|
||||
writeAskpassScript,
|
||||
close,
|
||||
[Symbol.asyncDispose]: close,
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user