Implement granular tool permissions (#82)

* Granular tool permissions

* Fix build

* Start on UI

* Fixes

* Fmt

* Go ham on UI

* Update migrations

* Considate wiki files

* Clean up

* More tweaks. Docs.

* Consolidate collab and noncollab

* Fix build

* Restrict for non-collaborators

run/action.yml

@@ -1,11 +1,7 @@
-
-
-# pullfrog/pullfrog/run
-# pullfrog/pullfrog (alias)
-
-# pullfrog/pullfrog/dispatch <- accepts json 
-name: "Pullfrog Action (Run)"
-description: "Execute coding agents with itemized inputs"
+# note: this file must remain identical to action/action.yml and action/run/action.yml
+# future agents: keep both files in sync manually
+name: "Pullfrog Action"
+description: "Execute coding agents with a prompt"
 author: "Pullfrog"
 
 inputs:
@@ -22,8 +18,17 @@ inputs:
   cwd:
     description: "Working directory for the agent (defaults to GITHUB_WORKSPACE)"
     required: false
-  sandbox:
-    description: "Sandbox mode: restricts agent to read-only operations"
+  web:
+    description: "Web fetch permission: disabled or enabled (default: enabled)"
+    required: false
+  search:
+    description: "Web search permission: disabled or enabled (default: enabled)"
+    required: false
+  write:
+    description: "File write permission: disabled or enabled (default: enabled)"
+    required: false
+  bash:
+    description: "Bash permission: disabled, restricted (filters secrets from env vars), or enabled. Public repos default to restricted for security; private repos default to enabled."
     required: false
 
 runs: