Colin McDonnell
6d25adfd1a
* agent & model refactor with ASKPASS git auth, UI restructure, clerk v7 Made-with: Cursor * fix stale agent/effort refs, add tests for askpass + model resolution - reviewCleanup.ts: payload.agent -> payload.model, remove effort - selectMode.ts PlanEdit: remove delegation/subagent/effort references - pullfrog.yml.ts: update env vars (drop GOOGLE_API_KEY/CURSOR_API_KEY, add GOOGLE_GENERATIVE_AI_API_KEY/XAI_API_KEY/MOONSHOT_API_KEY/OPENCODE_API_KEY) - FlagsSettings/RepoInstructionsSection: remove stale effort/timeout copy - new: gitAuthServer.test.ts (10 tests — lifecycle, token delivery, tamper detection, script gen) - new: agent.test.ts (4 tests — default opentoad, AGENT_OVERRIDE, invalid override) - new: models.test.ts (19 tests — parseModel, resolution, registry invariants) - update models.dev snapshot Made-with: Cursor * fix changed-agents.sh to filter legacy agent files from CI matrix legacy agent files (claude.ts, codex.ts, etc.) are @ts-nocheck and not exported from index.ts. changed-agents.sh now reads index.ts imports to build the active agent set and treats changes to inactive files as non-agent changes (opentoad canary only). Made-with: Cursor * remove MCP file tools, old agent harnesses, and obsolete security tests ASKPASS-based git auth makes the old MCP file tool security layer unnecessary: - token never in subprocess env, so symlink/gitattributes/hook attacks can't exfiltrate it - agents now use native file tools (OpenCode builtin read/edit) deleted: - action/mcp/file.ts (file_read, file_write, file_edit, file_delete, list_directory) - action/mcp/index.ts (dead re-export) - agent harnesses: claude.ts, codex.ts, cursor.ts, gemini.ts, opencode.ts - opencode-runner.ts (inlined into opentoad.ts) - security tests that validated MCP file tool restrictions - commented-out three-step review flow (~300 lines) - sanitizeSchema/wrapSchema dead code from mcp/shared.ts - OPENCODE_MODEL_MINI/MAX env vars (effort-level model overrides removed) updated test prompts to use generic file ops instead of MCP tool names. restored pkg-json-scripts + requirements-txt-attack (test --ignore-scripts defense). Made-with: Cursor * bump actions/checkout v4 → v6 (node 24) node 20 actions deprecated june 2, 2026. Made-with: Cursor * temporarily disable fail-fast on agnostic tests to debug checkout@v6 Made-with: Cursor * re-enable fail-fast on agnostic tests Made-with: Cursor * fix test token mismatch: mint OIDC tokens scoped to target repo CI tests override GITHUB_REPOSITORY to pullfrog/test-repo but inherit the runner's GITHUB_TOKEN (scoped to pullfrog/app), causing 401s on every run-context fetch. Clear GITHUB_TOKEN in the test subprocess so ensureGitHubToken() mints a properly scoped token via OIDC. Also centralizes the default GITHUB_REPOSITORY in runAgentStreaming instead of repeating it in every test file, and fixes preview-cleanup to remove workers from all queues (not just name-matching ones). Made-with: Cursor * fix ensureGitHubToken to try OIDC when app credentials are absent ensureGitHubToken only attempted token minting when GITHUB_APP_ID and GITHUB_PRIVATE_KEY were set. In CI, OIDC is available but app creds aren't exposed — so the guard prevented minting entirely. Made-with: Cursor * dead code cleanup: remove remnants of deleted agents, file tools, effort system remove unused @anthropic-ai/claude-agent-sdk and @openai/codex-sdk deps, orphaned file-tool security tests, dead GEMINI_MODEL passthrough, stale opencode-runner wiki refs, deleted test file references, and MCP file tool docs. rename docs/effort → docs/models. fix vitest setup: move dotenv to globalSetup (runs once before forks instead of per-file, 19s → 200ms). Made-with: Cursor * address review feedback: remove dead code, update stale references - remove AGENT_OVERRIDE (only opentoad exists) - remove shellToolName plumbing (always restricted shell) - bump action version to 0.0.179 - remove CURSOR_API_KEY from all workflows/configs - remove OPENCODE_MODEL_MINI/MAX from workflows/docs - delete wiki/effort.md, rewrite docs/effort.mdx as "Models" - rewrite wiki/modes.md: orchestrator/subagent → single agent - simplify flag system: drop builtin flag extraction (debug, effort, timeout, agent), keep custom flag replacement only - reserve all legacy flag names to prevent custom flag conflicts Made-with: Cursor * regenerate lockfile after removing claude-agent-sdk and codex-sdk Made-with: Cursor * fix import ordering, add lockfile check to pre-push hook Made-with: Cursor * remove dead debug payload field, stale packageExtensions Made-with: Cursor * merge proc-sandbox and token-exfil into a single test proc-sandbox and token-exfil were duplicative — both tested that SANDBOX_TEST_TOKEN couldn't be exfiltrated. consolidated into token-exfil with shell:restricted (which actually exercises filterEnv) and the /proc attack vector hints from proc-sandbox. Made-with: Cursor * fix wiki adversarial.md to match actual tokenExfil validator Made-with: Cursor
89 lines
2.3 KiB
JSON
89 lines
2.3 KiB
JSON
{
|
|
"name": "@pullfrog/pullfrog",
|
|
"version": "0.0.179",
|
|
"type": "module",
|
|
"files": [
|
|
"index.js",
|
|
"index.cjs",
|
|
"index.d.ts",
|
|
"index.d.cts",
|
|
"agents",
|
|
"utils",
|
|
"main.js",
|
|
"main.d.ts"
|
|
],
|
|
"scripts": {
|
|
"test": "vitest",
|
|
"typecheck": "tsc --noEmit",
|
|
"build": "node esbuild.config.js",
|
|
"play": "node play.ts",
|
|
"runtest": "node test/run.ts",
|
|
"scratch": "node scratch.ts",
|
|
"upDeps": "pnpm up --latest",
|
|
"lock": "pnpm install --no-frozen-lockfile",
|
|
"postinstall": "node scripts/generate-proxies.ts",
|
|
"prepare": "cd .. && husky action/.husky"
|
|
},
|
|
"dependencies": {
|
|
"@actions/core": "^1.11.1",
|
|
"@ark/fs": "0.56.0",
|
|
"@ark/util": "0.56.0",
|
|
"@octokit/plugin-throttling": "^11.0.3",
|
|
"@octokit/rest": "^22.0.0",
|
|
"@octokit/webhooks-types": "^7.6.1",
|
|
"@opencode-ai/sdk": "^1.0.143",
|
|
"@standard-schema/spec": "1.1.0",
|
|
"@toon-format/toon": "^1.0.0",
|
|
"ajv": "^8.18.0",
|
|
"arkregex": "0.0.5",
|
|
"arktype": "2.2.0",
|
|
"dotenv": "^17.2.3",
|
|
"execa": "^9.6.0",
|
|
"fastmcp": "^3.34.0",
|
|
"file-type": "^21.3.0",
|
|
"package-manager-detector": "^1.6.0",
|
|
"semver": "^7.7.3",
|
|
"table": "^6.9.0",
|
|
"turndown": "^7.2.0"
|
|
},
|
|
"devDependencies": {
|
|
"@modelcontextprotocol/sdk": "^1.26.0",
|
|
"@types/node": "^24.7.2",
|
|
"@types/semver": "^7.7.1",
|
|
"@types/turndown": "^5.0.5",
|
|
"arg": "^5.0.2",
|
|
"esbuild": "^0.25.9",
|
|
"husky": "^9.0.0",
|
|
"typescript": "^5.9.3",
|
|
"vitest": "^4.0.17",
|
|
"yaml": "^2.8.2"
|
|
},
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "git+https://github.com/pullfrog/pullfrog.git"
|
|
},
|
|
"keywords": [],
|
|
"author": "",
|
|
"license": "MIT",
|
|
"bugs": {
|
|
"url": "https://github.com/pullfrog/pullfrog/issues"
|
|
},
|
|
"homepage": "https://github.com/pullfrog/pullfrog#readme",
|
|
"zshy": {
|
|
"exports": "./index.ts"
|
|
},
|
|
"main": "./dist/index.cjs",
|
|
"module": "./dist/index.js",
|
|
"types": "./dist/index.d.cts",
|
|
"exports": {
|
|
".": {
|
|
"types": "./dist/index.d.cts",
|
|
"import": "./dist/index.js",
|
|
"require": "./dist/index.cjs"
|
|
},
|
|
"./internal": "./dist/internal.js",
|
|
"./package.json": "./package.json"
|
|
},
|
|
"packageManager": "pnpm@10.27.0+sha512.72d699da16b1179c14ba9e64dc71c9a40988cbdc65c264cb0e489db7de917f20dcf4d64d8723625f2969ba52d4b7e2a1170682d9ac2a5dcaeaab732b7e16f04a"
|
|
}
|