Agent & model refactor (#478)

* agent & model refactor with ASKPASS git auth, UI restructure, clerk v7

Made-with: Cursor

* fix stale agent/effort refs, add tests for askpass + model resolution

- reviewCleanup.ts: payload.agent -> payload.model, remove effort
- selectMode.ts PlanEdit: remove delegation/subagent/effort references
- pullfrog.yml.ts: update env vars (drop GOOGLE_API_KEY/CURSOR_API_KEY,
  add GOOGLE_GENERATIVE_AI_API_KEY/XAI_API_KEY/MOONSHOT_API_KEY/OPENCODE_API_KEY)
- FlagsSettings/RepoInstructionsSection: remove stale effort/timeout copy
- new: gitAuthServer.test.ts (10 tests — lifecycle, token delivery, tamper detection, script gen)
- new: agent.test.ts (4 tests — default opentoad, AGENT_OVERRIDE, invalid override)
- new: models.test.ts (19 tests — parseModel, resolution, registry invariants)
- update models.dev snapshot

Made-with: Cursor

* fix changed-agents.sh to filter legacy agent files from CI matrix

legacy agent files (claude.ts, codex.ts, etc.) are @ts-nocheck and not
exported from index.ts. changed-agents.sh now reads index.ts imports to
build the active agent set and treats changes to inactive files as
non-agent changes (opentoad canary only).

Made-with: Cursor

* remove MCP file tools, old agent harnesses, and obsolete security tests

ASKPASS-based git auth makes the old MCP file tool security layer unnecessary:
- token never in subprocess env, so symlink/gitattributes/hook attacks can't exfiltrate it
- agents now use native file tools (OpenCode builtin read/edit)

deleted:
- action/mcp/file.ts (file_read, file_write, file_edit, file_delete, list_directory)
- action/mcp/index.ts (dead re-export)
- agent harnesses: claude.ts, codex.ts, cursor.ts, gemini.ts, opencode.ts
- opencode-runner.ts (inlined into opentoad.ts)
- security tests that validated MCP file tool restrictions
- commented-out three-step review flow (~300 lines)
- sanitizeSchema/wrapSchema dead code from mcp/shared.ts
- OPENCODE_MODEL_MINI/MAX env vars (effort-level model overrides removed)

updated test prompts to use generic file ops instead of MCP tool names.
restored pkg-json-scripts + requirements-txt-attack (test --ignore-scripts defense).

Made-with: Cursor

* bump actions/checkout v4 → v6 (node 24)

node 20 actions deprecated june 2, 2026.

Made-with: Cursor

* temporarily disable fail-fast on agnostic tests to debug checkout@v6

Made-with: Cursor

* re-enable fail-fast on agnostic tests

Made-with: Cursor

* fix test token mismatch: mint OIDC tokens scoped to target repo

CI tests override GITHUB_REPOSITORY to pullfrog/test-repo but inherit
the runner's GITHUB_TOKEN (scoped to pullfrog/app), causing 401s on
every run-context fetch. Clear GITHUB_TOKEN in the test subprocess so
ensureGitHubToken() mints a properly scoped token via OIDC.

Also centralizes the default GITHUB_REPOSITORY in runAgentStreaming
instead of repeating it in every test file, and fixes preview-cleanup
to remove workers from all queues (not just name-matching ones).

Made-with: Cursor

* fix ensureGitHubToken to try OIDC when app credentials are absent

ensureGitHubToken only attempted token minting when GITHUB_APP_ID and
GITHUB_PRIVATE_KEY were set. In CI, OIDC is available but app creds
aren't exposed — so the guard prevented minting entirely.

Made-with: Cursor

* dead code cleanup: remove remnants of deleted agents, file tools, effort system

remove unused @anthropic-ai/claude-agent-sdk and @openai/codex-sdk deps,
orphaned file-tool security tests, dead GEMINI_MODEL passthrough, stale
opencode-runner wiki refs, deleted test file references, and MCP file tool
docs. rename docs/effort → docs/models. fix vitest setup: move dotenv to
globalSetup (runs once before forks instead of per-file, 19s → 200ms).

Made-with: Cursor

* address review feedback: remove dead code, update stale references

- remove AGENT_OVERRIDE (only opentoad exists)
- remove shellToolName plumbing (always restricted shell)
- bump action version to 0.0.179
- remove CURSOR_API_KEY from all workflows/configs
- remove OPENCODE_MODEL_MINI/MAX from workflows/docs
- delete wiki/effort.md, rewrite docs/effort.mdx as "Models"
- rewrite wiki/modes.md: orchestrator/subagent → single agent
- simplify flag system: drop builtin flag extraction (debug, effort,
  timeout, agent), keep custom flag replacement only
- reserve all legacy flag names to prevent custom flag conflicts

Made-with: Cursor

* regenerate lockfile after removing claude-agent-sdk and codex-sdk

Made-with: Cursor

* fix import ordering, add lockfile check to pre-push hook

Made-with: Cursor

* remove dead debug payload field, stale packageExtensions

Made-with: Cursor

* merge proc-sandbox and token-exfil into a single test

proc-sandbox and token-exfil were duplicative — both tested that
SANDBOX_TEST_TOKEN couldn't be exfiltrated. consolidated into
token-exfil with shell:restricted (which actually exercises filterEnv)
and the /proc attack vector hints from proc-sandbox.

Made-with: Cursor

* fix wiki adversarial.md to match actual tokenExfil validator

Made-with: Cursor

utils/payload.ts

@@ -1,13 +1,12 @@
 import { isAbsolute, resolve } from "node:path";
 import * as core from "@actions/core";
 import { type } from "arktype";
-import { AgentName, type AuthorPermission, Effort, type PayloadEvent } from "../external.ts";
+import type { AuthorPermission, PayloadEvent } from "../external.ts";
 import packageJson from "../package.json" with { type: "json" };
 import type { RepoSettings } from "./runContext.ts";
 import { validateCompatibility } from "./versioning.ts";
 
 // tool permission enum types for inputs
-const ToolPermissionInput = type.enumerated("disabled", "enabled");
 const ShellPermissionInput = type.enumerated("disabled", "restricted", "enabled");
 const PushPermissionInput = type.enumerated("disabled", "restricted", "enabled");
 
@@ -17,16 +16,14 @@ const PushPermissionInput = type.enumerated("disabled", "restricted", "enabled")
 export const JsonPayload = type({
   "~pullfrog": "true",
   version: "string",
-  "agent?": AgentName.or("undefined"),
+  "model?": "string | undefined",
   prompt: "string",
   "triggerer?": "string | undefined",
 
   "eventInstructions?": "string",
   "event?": "object",
-  "effort?": Effort.or("undefined"),
   "timeout?": "string | undefined",
   "progressCommentId?": "string | undefined",
-  "debug?": "boolean | undefined",
 });
 
 // permission levels that indicate collaborator status (have push access)
@@ -45,11 +42,8 @@ function isCollaborator(event: PayloadEvent): boolean {
 // if included, must match the type - so we need to explicitly allow undefined.
 export const Inputs = type({
   prompt: "string",
-  "effort?": Effort.or("undefined"),
+  "model?": type.string.or("undefined"),
   "timeout?": type.string.or("undefined"),
-  "agent?": AgentName.or("undefined"),
-  "web?": ToolPermissionInput.or("undefined"),
-  "search?": ToolPermissionInput.or("undefined"),
   "push?": PushPermissionInput.or("undefined"),
   "shell?": ShellPermissionInput.or("undefined"),
   "cwd?": type.string.or("undefined"),
@@ -58,10 +52,6 @@ export const Inputs = type({
 
 export type Inputs = typeof Inputs.infer;
 
-function isAgentName(value: unknown): value is AgentName {
-  return typeof value === "string" && AgentName(value) instanceof type.errors === false;
-}
-
 function isPayloadEvent(value: unknown): value is PayloadEvent {
   return typeof value === "object" && value !== null && "trigger" in value;
 }
@@ -99,12 +89,9 @@ export function resolvePromptInput(): ResolvedPromptInput {
 
 function resolveNonPromptInputs() {
   return Inputs.omit("prompt").assert({
-    effort: core.getInput("effort") || undefined,
+    model: core.getInput("model") || undefined,
     timeout: core.getInput("timeout") || undefined,
-    agent: core.getInput("agent") || undefined,
     cwd: core.getInput("cwd") || undefined,
-    web: core.getInput("web") || undefined,
-    search: core.getInput("search") || undefined,
     push: core.getInput("push") || undefined,
     shell: core.getInput("shell") || undefined,
   });
@@ -126,18 +113,11 @@ export function resolvePayload(
 
   const inputs = resolveNonPromptInputs();
 
-  // validate agent name
-  const agent: AgentName | undefined =
-    inputs.agent !== undefined && isAgentName(inputs.agent) ? inputs.agent : undefined;
-
   // resolve event - use type guard for jsonPayload.event, fallback to unknown trigger
   const rawEvent = jsonPayload?.event;
   const event: PayloadEvent = isPayloadEvent(rawEvent) ? rawEvent : { trigger: "unknown" };
 
-  // resolve agent from jsonPayload with type guard
-  const jsonAgent = jsonPayload?.agent;
-  const resolvedAgent: AgentName | undefined =
-    agent ?? (jsonAgent !== undefined && isAgentName(jsonAgent) ? jsonAgent : undefined);
+  const model = jsonPayload?.model ?? inputs.model ?? repoSettings.model ?? undefined;
 
   // determine shell permission - strictest setting wins
   // precedence: disabled > restricted > enabled
@@ -166,7 +146,7 @@ export function resolvePayload(
   return {
     "~pullfrog": true as const,
     version: jsonPayload?.version ?? packageJson.version,
-    agent: resolvedAgent,
+    model,
     prompt,
     triggerer:
       jsonPayload?.triggerer ??
@@ -174,15 +154,11 @@ export function resolvePayload(
       (!isPullfrog(process.env.GITHUB_ACTOR) ? process.env.GITHUB_ACTOR : undefined),
     eventInstructions: jsonPayload?.eventInstructions,
     event,
-    effort: inputs.effort ?? jsonPayload?.effort ?? "auto",
     timeout: inputs.timeout ?? jsonPayload?.timeout,
     cwd: resolveCwd(inputs.cwd),
     progressCommentId: jsonPayload?.progressCommentId,
-    debug: jsonPayload?.debug,
 
     // permissions: inputs > repoSettings > fallbacks
-    web: inputs.web ?? repoSettings.web ?? "enabled",
-    search: inputs.search ?? repoSettings.search ?? "enabled",
     push: inputs.push ?? repoSettings.push ?? "restricted",
     shell: resolvedShell,
   };