Implement granular tool permissions (#82)

* Granular tool permissions

* Fix build

* Start on UI

* Fixes

* Fmt

* Go ham on UI

* Update migrations

* Considate wiki files

* Clean up

* More tweaks. Docs.

* Consolidate collab and noncollab

* Fix build

* Restrict for non-collaborators

action.yml

@@ -1,3 +1,5 @@
+# note: this file must remain identical to action/action.yml and action/run/action.yml
+# future agents: keep both files in sync manually
 name: "Pullfrog Action"
 description: "Execute coding agents with a prompt"
 author: "Pullfrog"
@@ -7,12 +9,27 @@ inputs:
     description: "Prompt to send to the agent"
     required: true
   effort:
-    description: "Effort level: mini (fast), auto (default), max (most capable)"
+    description: "Effort level: nothink (fast), think (default), max (most capable)"
+    required: false
+    default: "think"
+  agent:
+    description: "Agent to use: claude, codex, gemini, cursor, opencode"
     required: false
-    default: "auto"
   cwd:
     description: "Working directory for the agent (defaults to GITHUB_WORKSPACE)"
     required: false
+  web:
+    description: "Web fetch permission: disabled or enabled (default: enabled)"
+    required: false
+  search:
+    description: "Web search permission: disabled or enabled (default: enabled)"
+    required: false
+  write:
+    description: "File write permission: disabled or enabled (default: enabled)"
+    required: false
+  bash:
+    description: "Bash permission: disabled, restricted (filters secrets from env vars), or enabled. Public repos default to restricted for security; private repos default to enabled."
+    required: false
 
 runs:
   using: "node24"