pullfrog 0.1.81 → 0.1.83
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/agents/claudePretoolGate.d.ts +6 -6
- package/dist/agents/opencodePlugin.d.ts +5 -0
- package/dist/cli.mjs +376 -214
- package/dist/index.js +361 -202
- package/dist/internal.js +156 -95
- package/dist/mcp/searchIssues.d.ts +8 -0
- package/dist/mcp/server.d.ts +1 -0
- package/dist/utils/normalizeEnv.d.ts +1 -1
- package/dist/utils/overrides.d.ts +1 -1
- package/dist/utils/runContext.d.ts +1 -0
- package/dist/utils/runErrorRenderer.d.ts +5 -0
- package/dist/utils/secretCommands.d.ts +20 -0
- package/package.json +3 -2
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* `@actions/core` workflow commands that carry a credential, gated on actually
|
|
3
|
+
* running under a runner.
|
|
4
|
+
*
|
|
5
|
+
* Off a runner nothing consumes these commands and `@actions/core` writes the
|
|
6
|
+
* raw value to stdout instead — `setSecret` always, `saveState` / `setOutput`
|
|
7
|
+
* whenever `GITHUB_STATE` / `GITHUB_OUTPUT` are unset. That is a plaintext
|
|
8
|
+
* credential on whatever terminal is running the action, which is how an OpenAI
|
|
9
|
+
* key reached local Codex transcripts and was disabled (2026-09).
|
|
10
|
+
*
|
|
11
|
+
* Route every credential-bearing call through here instead of calling `core`
|
|
12
|
+
* directly — `nub run check:secret-commands` enforces it. Non-credential output
|
|
13
|
+
* (the agent's own `result` text) stays ungated, because the test harness reads
|
|
14
|
+
* it back through `GITHUB_OUTPUT` on a host with no runner.
|
|
15
|
+
*/
|
|
16
|
+
export declare function maskSecret(value: string): void;
|
|
17
|
+
/** @see maskSecret — same gate, for state the `post:` hook reads back. */
|
|
18
|
+
export declare function saveSecretState(name: string, value: string): void;
|
|
19
|
+
/** @see maskSecret — same gate, for a step output carrying a credential. */
|
|
20
|
+
export declare function setSecretOutput(name: string, value: string): void;
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "pullfrog",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.83",
|
|
4
4
|
"cliContractVersion": "1",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
@@ -17,6 +17,7 @@
|
|
|
17
17
|
"typecheck": "tsc --noEmit",
|
|
18
18
|
"build": "node esbuild.config.js && tsc -p tsconfig.exports.json",
|
|
19
19
|
"check:entrypoints": "nub scripts/check-entrypoint-imports.ts",
|
|
20
|
+
"check:secret-commands": "nub scripts/check-secret-commands.ts",
|
|
20
21
|
"docker": "nub docker.ts",
|
|
21
22
|
"play": "nub play.ts",
|
|
22
23
|
"runtest": "nub test/run.ts",
|
|
@@ -27,7 +28,7 @@
|
|
|
27
28
|
},
|
|
28
29
|
"devDependencies": {
|
|
29
30
|
"@actions/core": "^1.11.1",
|
|
30
|
-
"@anthropic-ai/claude-code": "2.1.
|
|
31
|
+
"@anthropic-ai/claude-code": "2.1.280",
|
|
31
32
|
"@ark/fs": "0.56.0",
|
|
32
33
|
"@ark/util": "0.56.0",
|
|
33
34
|
"@clack/prompts": "^1.2.0",
|