fix: add concurrency protection to action sync workflows (#451)

* fix: add concurrency protection to action sync workflows

* style: fix formatting in action/modes.ts

---------

Co-authored-by: pullfrog[bot] <226033991+pullfrog[bot]@users.noreply.github.com>

entry

@@ -149592,7 +149592,7 @@ function ResolveReviewThreadTool(ctx) {
 // mcp/selectMode.ts
 var SelectModeParams = type({
   mode: type.string.describe(
-    "the name of the mode to select (e.g., 'Build', 'Plan', 'Review', 'IncrementalReview', 'Fix', 'AddressReviews', 'Task')"
+    "the name of the mode to select (e.g., 'Build', 'Plan', 'Review', 'IncrementalReview', 'Fix', 'AddressReviews', 'Task', 'ResolveConflicts')"
   )
 });
 function resolveMode(modes2, modeName) {
@@ -149629,6 +149629,36 @@ var modeGuidance = {
 For simple, well-defined tasks, a single build subagent is sufficient \u2014 skip the plan and review phases.
 
 Your subagent receives ONLY what you write. Include file paths, constraints, conventions, and any context from AGENTS.md or the codebase directly in the prompt. Subagents have file ops, shell, and read-only GitHub tools \u2014 but NO git/checkout, dependency, GitHub-write, or remote-mutating tools.`,
+  ResolveConflicts: `### Checklist
+
+1. **Setup**:
+   - Call \${ghPullfrogMcpName}/checkout_pr to get the PR branch.
+   - Call \${ghPullfrogMcpName}/get_pull_request to identify the base branch (e.g., 'main').
+   - Call \${ghPullfrogMcpName}/git_fetch to fetch the base branch.
+
+2. **Merge Attempt**:
+   - Run \`git merge origin/<base_branch>\` via shell.
+   - If it succeeds automatically: Great! Push via \${ghPullfrogMcpName}/push_branch and report success.
+   - If it fails (conflicts): You must resolve them.
+
+3. **Delegation (if conflicts exist)**:
+   - Run \`git status\` or parse the merge output to find the list of conflicting files.
+   - Delegate to a subagent (or multiple in parallel if many files) to resolve the conflicts.
+   - **Instructions for subagent**:
+     - "You are resolving merge conflicts in these files: [list]."
+     - "For each file: read it, find the conflict markers (<<<<<<<, =======, >>>>>>>), understand the code context, and rewrite the file with the correct resolution. Remove all markers."
+     - "After resolving, verify the file syntax is correct."
+     - "Call \${ghPullfrogMcpName}/set_output with a summary of what you resolved."
+   - Note: Subagents cannot run git commands. They only edit the files.
+
+4. **Finalize**:
+   - After subagents return:
+   - Run a final verification (build/test) to ensure the resolution works.
+   - \`git add .\`
+   - \`git commit -m "Resolve merge conflicts"\`
+   - \${ghPullfrogMcpName}/push_branch
+   - \${ghPullfrogMcpName}/report_progress
+`,
   AddressReviews: `### Checklist
 
 1. Before delegating, checkout the PR branch yourself via \`${ghPullfrogMcpName}/checkout_pr\` \u2014 subagents have no git/checkout tools.
@@ -150523,6 +150553,38 @@ ${permalinkTip}`
 10. **PROGRESS** - ${reportProgressInstruction}
 
 Your job is to fix issues THIS PR introduced, not to fix all CI failures. If in doubt about causation, abort and explain rather than making speculative changes.`
+    },
+    {
+      name: "ResolveConflicts",
+      description: "Resolve merge conflicts in a PR branch against the base branch",
+      prompt: `Follow these steps to resolve merge conflicts.
+
+1. **CHECKOUT** - Call ${ghPullfrogMcpName}/checkout_pr with the PR number. This fetches the PR branch.
+
+2. **FETCH BASE** - Identify the base branch (usually main or master) and fetch it using ${ghPullfrogMcpName}/git_fetch (e.g., ref: "main").
+
+3. **ATTEMPT MERGE** - Use ${ghPullfrogMcpName}/shell to run \`git merge origin/<base_branch>\`.
+   - If the merge succeeds (exit code 0), the branch is up to date. Push it and you're done.
+   - If the merge fails, you have conflicts to resolve.
+
+4. **IDENTIFY CONFLICTS** - Run \`git status\` to see which files are conflicting (modified by both).
+
+5. **RESOLVE** - For each conflicting file:
+   - Read the file to see the conflict markers (\`<<<<<<<\`, \`=======\`, \`>>>>>>>\`).
+   - Determine the correct content. You may need to keep changes from both sides, or choose one.
+   - Edit the file to apply the resolution and remove the markers.
+
+6. **VERIFY** - ${dependencyInstallationStep}
+   - Run tests/builds to ensure the resolution is correct.
+
+7. **COMMIT** - Once all conflicts are resolved:
+   - \`git add .\`
+   - \`git commit -m "Merge branch <base_branch> into <pr_branch>"\` (or similar).
+
+8. **PUSH** - Call ${ghPullfrogMcpName}/push_branch.
+
+9. **PROGRESS** - ${reportProgressInstruction}
+`
     },
     {
       name: "Task",
@@ -153659,17 +153721,13 @@ ${instructions.user}` : null,
         }
         await writeJobSummary(toolState);
         if (toolState.output) {
-          log.info(`::pullfrog-output::${Buffer.from(toolState.output).toString("base64")}`);
+          core5.setOutput("result", toolState.output);
         }
-        const mainResult = await handleAgentResult({
+        return await handleAgentResult({
           result,
           toolState,
           silent: payload.event.silent ?? false
         });
-        return {
-          ...mainResult,
-          result: toolState.output
-        };
       } catch (_) {
         var _error = _, _hasError = true;
       } finally {
@@ -153714,9 +153772,6 @@ async function run() {
     if (!result.success) {
       throw new Error(result.error || "Agent execution failed");
     }
-    if (result.result) {
-      core6.setOutput("result", result.result);
-    }
   } catch (error49) {
     const errorMessage = error49 instanceof Error ? error49.message : "Unknown error occurred";
     core6.setFailed(`Action failed: ${errorMessage}`);

entry.ts

@@ -20,10 +20,6 @@ async function run(): Promise<void> {
     if (!result.success) {
       throw new Error(result.error || "Agent execution failed");
     }
-
-    if (result.result) {
-      core.setOutput("result", result.result);
-    }
   } catch (error) {
     const errorMessage = error instanceof Error ? error.message : "Unknown error occurred";
     core.setFailed(`Action failed: ${errorMessage}`);

main.ts

@@ -1,4 +1,5 @@
 // changes to tool permissions should be reflected in wiki/granular-tools.md
+
 import * as core from "@actions/core";
 import { initToolState, startMcpHttpServer, type ToolState } from "./mcp/server.ts";
 import { computeModes } from "./modes.ts";
@@ -266,21 +267,15 @@ export async function main(): Promise<MainResult> {
 
     await writeJobSummary(toolState);
 
-    // emit structured output marker for test validation
     if (toolState.output) {
-      log.info(`::pullfrog-output::${Buffer.from(toolState.output).toString("base64")}`);
+      core.setOutput("result", toolState.output);
     }
 
-    const mainResult = await handleAgentResult({
+    return await handleAgentResult({
       result,
       toolState,
       silent: payload.event.silent ?? false,
     });
-
-    return {
-      ...mainResult,
-      result: toolState.output,
-    };
   } catch (error) {
     const errorMessage = error instanceof Error ? error.message : "unknown error occurred";
     killTrackedChildren();

mcp/selectMode.ts

@@ -6,7 +6,7 @@ import { execute, tool } from "./shared.ts";
 
 export const SelectModeParams = type({
   mode: type.string.describe(
-    "the name of the mode to select (e.g., 'Build', 'Plan', 'Review', 'IncrementalReview', 'Fix', 'AddressReviews', 'Task')"
+    "the name of the mode to select (e.g., 'Build', 'Plan', 'Review', 'IncrementalReview', 'Fix', 'AddressReviews', 'Task', 'ResolveConflicts')"
   ),
 });
 
@@ -46,6 +46,37 @@ For simple, well-defined tasks, a single build subagent is sufficient — skip t
 
 Your subagent receives ONLY what you write. Include file paths, constraints, conventions, and any context from AGENTS.md or the codebase directly in the prompt. Subagents have file ops, shell, and read-only GitHub tools — but NO git/checkout, dependency, GitHub-write, or remote-mutating tools.`,
 
+  ResolveConflicts: `### Checklist
+
+1. **Setup**:
+   - Call \${ghPullfrogMcpName}/checkout_pr to get the PR branch.
+   - Call \${ghPullfrogMcpName}/get_pull_request to identify the base branch (e.g., 'main').
+   - Call \${ghPullfrogMcpName}/git_fetch to fetch the base branch.
+
+2. **Merge Attempt**:
+   - Run \`git merge origin/<base_branch>\` via shell.
+   - If it succeeds automatically: Great! Push via \${ghPullfrogMcpName}/push_branch and report success.
+   - If it fails (conflicts): You must resolve them.
+
+3. **Delegation (if conflicts exist)**:
+   - Run \`git status\` or parse the merge output to find the list of conflicting files.
+   - Delegate to a subagent (or multiple in parallel if many files) to resolve the conflicts.
+   - **Instructions for subagent**:
+     - "You are resolving merge conflicts in these files: [list]."
+     - "For each file: read it, find the conflict markers (<<<<<<<, =======, >>>>>>>), understand the code context, and rewrite the file with the correct resolution. Remove all markers."
+     - "After resolving, verify the file syntax is correct."
+     - "Call \${ghPullfrogMcpName}/set_output with a summary of what you resolved."
+   - Note: Subagents cannot run git commands. They only edit the files.
+
+4. **Finalize**:
+   - After subagents return:
+   - Run a final verification (build/test) to ensure the resolution works.
+   - \`git add .\`
+   - \`git commit -m "Resolve merge conflicts"\`
+   - \${ghPullfrogMcpName}/push_branch
+   - \${ghPullfrogMcpName}/report_progress
+`,
+
   AddressReviews: `### Checklist
 
 1. Before delegating, checkout the PR branch yourself via \`${ghPullfrogMcpName}/checkout_pr\` — subagents have no git/checkout tools.

modes.ts

@@ -250,6 +250,38 @@ ${permalinkTip}`,
 10. **PROGRESS** - ${reportProgressInstruction}
 
 Your job is to fix issues THIS PR introduced, not to fix all CI failures. If in doubt about causation, abort and explain rather than making speculative changes.`,
+    },
+    {
+      name: "ResolveConflicts",
+      description: "Resolve merge conflicts in a PR branch against the base branch",
+      prompt: `Follow these steps to resolve merge conflicts.
+
+1. **CHECKOUT** - Call ${ghPullfrogMcpName}/checkout_pr with the PR number. This fetches the PR branch.
+
+2. **FETCH BASE** - Identify the base branch (usually main or master) and fetch it using ${ghPullfrogMcpName}/git_fetch (e.g., ref: "main").
+
+3. **ATTEMPT MERGE** - Use ${ghPullfrogMcpName}/shell to run \`git merge origin/<base_branch>\`.
+   - If the merge succeeds (exit code 0), the branch is up to date. Push it and you're done.
+   - If the merge fails, you have conflicts to resolve.
+
+4. **IDENTIFY CONFLICTS** - Run \`git status\` to see which files are conflicting (modified by both).
+
+5. **RESOLVE** - For each conflicting file:
+   - Read the file to see the conflict markers (\`<<<<<<<\`, \`=======\`, \`>>>>>>>\`).
+   - Determine the correct content. You may need to keep changes from both sides, or choose one.
+   - Edit the file to apply the resolution and remove the markers.
+
+6. **VERIFY** - ${dependencyInstallationStep}
+   - Run tests/builds to ensure the resolution is correct.
+
+7. **COMMIT** - Once all conflicts are resolved:
+   - \`git add .\`
+   - \`git commit -m "Merge branch <base_branch> into <pr_branch>"\` (or similar).
+
+8. **PUSH** - Call ${ghPullfrogMcpName}/push_branch.
+
+9. **PROGRESS** - ${reportProgressInstruction}
+`,
     },
     {
       name: "Task",

test/adhoc/delegateAskQuestion.ts

@@ -1,5 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getAgentOutput, getStructuredOutput } from "../utils.ts";
+import { defineFixture, getAgentOutput } from "../utils.ts";
 
 /**
  * delegate-ask-question — orchestrator uses ask_question to gather codebase
@@ -34,7 +34,7 @@ IMPORTANT: You MUST use ask_question BEFORE delegating. The subagent prompt must
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const agentOutput = getAgentOutput(result);
 
   const setOutputCalled = output !== null;

test/adhoc/delegateContextIsolation.ts

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getAgentOutput, getStructuredOutput } from "../utils.ts";
+import { defineFixture, getAgentOutput } from "../utils.ts";
 
 /**
  * delegate-context-isolation — verifies that the subagent's "clean room"
@@ -39,7 +39,7 @@ CRITICAL: Your final output MUST contain "SECRET=${SECRET}" exactly.`,
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const agentOutput = getAgentOutput(result);
 
   const setOutputCalled = output !== null;

test/adhoc/delegateErrorHandling.ts

@@ -1,5 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getAgentOutput, getStructuredOutput } from "../utils.ts";
+import { defineFixture, getAgentOutput } from "../utils.ts";
 
 /**
  * delegate-error-handling — orchestrator delegates a task that will fail,
@@ -33,7 +33,7 @@ The point of this test is that you handle the error gracefully and report it —
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const agentOutput = getAgentOutput(result);
 
   const setOutputCalled = output !== null;

test/adhoc/delegateFileRead.ts

@@ -1,5 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getAgentOutput, getStructuredOutput } from "../utils.ts";
+import { defineFixture, getAgentOutput } from "../utils.ts";
 
 /**
  * delegate-file-read — orchestrator delegates a subagent to read a real file
@@ -33,7 +33,7 @@ IMPORTANT: Your subagent prompt must include the exact MCP tool names (gh_pullfr
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const agentOutput = getAgentOutput(result);
 
   const setOutputCalled = output !== null;

test/adhoc/delegateSynthesis.ts

@@ -1,5 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getAgentOutput, getStructuredOutput } from "../utils.ts";
+import { defineFixture, getAgentOutput } from "../utils.ts";
 
 /**
  * delegate-synthesis — orchestrator delegates two research tasks to separate
@@ -40,7 +40,7 @@ Both pieces must come from the respective subagent results. Do NOT read the file
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const agentOutput = getAgentOutput(result);
 
   const setOutputCalled = output !== null;

test/adhoc/delegateTimeout.ts

@@ -1,5 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getAgentOutput, getStructuredOutput } from "../utils.ts";
+import { defineFixture, getAgentOutput } from "../utils.ts";
 
 /**
  * delegateTimeout test - validates that the activity timeout does NOT fire
@@ -32,7 +32,7 @@ After the delegation completes, call set_output yourself with the subagent's res
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const agentOutput = getAgentOutput(result);
 
   const setOutputCalled = output !== null;

test/adhoc/delegateTwoPhase.ts

@@ -1,10 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import {
+import { defineFixture, generateTestMarker, getAgentOutput } from "../utils.ts";
-  defineFixture,
-  generateTestMarker,
-  getAgentOutput,
-  getStructuredOutput,
-} from "../utils.ts";
 
 /**
  * delegate-two-phase — orchestrator runs two sequential delegations where
@@ -44,7 +39,7 @@ After both phases complete, call set_output with: "WRITTEN=<marker>,READ=<what_p
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const agentOutput = getAgentOutput(result);
   const secret = marker.value;
 

test/adhoc/fileWriteNobash.ts

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getAgentOutput, getStructuredOutput } from "../utils.ts";
+import { defineFixture, getAgentOutput } from "../utils.ts";
 
 /**
  * Adversarial sandbox escape test. Agent has no shell — only MCP file_read,
@@ -61,7 +61,7 @@ const repoSetup = [
 ].join(" && ");
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const setOutputCalled = output !== null;
 
   // marker must be read correctly (proves file_read works inside repo)

test/adhoc/gitConfigAttack.ts

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getAgentOutput, getStructuredOutput } from "../utils.ts";
+import { defineFixture, getAgentOutput } from "../utils.ts";
 
 /**
  * git config attack test - validates:
@@ -65,7 +65,7 @@ const fixture = defineFixture(
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const agentOutput = getAgentOutput(result);
   const setOutputCalled = output !== null;
 

test/adhoc/gitExecBypass.ts

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getAgentOutput, getStructuredOutput } from "../utils.ts";
+import { defineFixture, getAgentOutput } from "../utils.ts";
 
 /**
  * git --exec bypass test - validates:
@@ -61,7 +61,7 @@ const fixture = defineFixture(
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const agentOutput = getAgentOutput(result);
   const setOutputCalled = output !== null;
 

test/adhoc/gitFlagInjection.ts

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getAgentOutput, getStructuredOutput } from "../utils.ts";
+import { defineFixture, getAgentOutput } from "../utils.ts";
 
 /**
  * git flag injection test - validates:
@@ -53,7 +53,7 @@ Call the git tool with:
 Call set_output with:
 {
   "approach1_result": "exact output or error",
-  "approach2_result": "exact output or error", 
+  "approach2_result": "exact output or error",
   "approach3_result": "exact output or error",
   "approach4_result": "exact output or error",
   "approach5_result": "exact output or error",
@@ -71,7 +71,7 @@ const fixture = defineFixture(
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const agentOutput = getAgentOutput(result);
   const setOutputCalled = output !== null;
 

test/adhoc/gitattributesAttack.ts

@@ -1,5 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getStructuredOutput } from "../utils.ts";
+import { defineFixture } from "../utils.ts";
 
 /**
  * .gitattributes write blocking test - validates:
@@ -59,7 +59,7 @@ const fixture = defineFixture(
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const setOutputCalled = output !== null;
 
   let parsed: Record<string, unknown> = {};

test/adhoc/nobashEscapeComprehensive.ts

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getAgentOutput, getStructuredOutput } from "../utils.ts";
+import { defineFixture, getAgentOutput } from "../utils.ts";
 
 /**
  * comprehensive nobash escape test - validates:
@@ -80,7 +80,7 @@ const fixture = defineFixture(
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const agentOutput = getAgentOutput(result);
   const setOutputCalled = output !== null;
 

test/adhoc/nobashcreative.ts

@@ -1,5 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, generateAgentUuids, getStructuredOutput } from "../utils.ts";
+import { defineFixture, generateAgentUuids } from "../utils.ts";
 
 /**
  * nobashcreative test - exploratory test to see if agents can creatively bypass shell=disabled.
@@ -40,7 +40,7 @@ function validator(result: AgentResult): ValidationCheck[] {
   const marker = getUuid(result.agent, "PULLFROG_NOBASH_TEST");
 
   // require structured output from set_output tool
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const setOutputCalled = output !== null;
 
   // shell should NOT have executed - unique marker value should NOT appear in output

test/adhoc/requirementsTxtAttack.ts

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getAgentOutput, getStructuredOutput } from "../utils.ts";
+import { defineFixture, getAgentOutput } from "../utils.ts";
 
 /**
  * requirements.txt local path attack test - validates:
@@ -59,7 +59,7 @@ const fixture = defineFixture(
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const agentOutput = getAgentOutput(result);
   const setOutputCalled = output !== null;
 

test/agnostic/delegate.ts

@@ -1,5 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getAgentOutput, getStructuredOutput } from "../utils.ts";
+import { defineFixture, getAgentOutput } from "../utils.ts";
 
 /**
  * delegate test - validates core end-to-end delegation flow.
@@ -22,7 +22,7 @@ When all delegations are complete, call set_output with the final result. This m
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const agentOutput = getAgentOutput(result);
 
   const setOutputCalled = output !== null;

test/agnostic/delegateEffort.ts

@@ -1,5 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getAgentOutput, getStructuredOutput } from "../utils.ts";
+import { defineFixture, getAgentOutput } from "../utils.ts";
 
 /**
  * delegateEffort test - validates effort selection for delegation.
@@ -26,7 +26,7 @@ When all delegations are complete, call set_output with the final result. This m
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const agentOutput = getAgentOutput(result);
 
   const setOutputCalled = output !== null;

test/agnostic/delegateMulti.ts

@@ -1,5 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getAgentOutput, getStructuredOutput } from "../utils.ts";
+import { defineFixture, getAgentOutput } from "../utils.ts";
 
 /**
  * delegateMulti test - validates multi-phase delegation with context passing.
@@ -29,7 +29,7 @@ When all delegations are complete, call set_output with the final result. This m
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const agentOutput = getAgentOutput(result);
 
   const setOutputCalled = output !== null;

test/agnostic/fileTraversal.ts

@@ -1,5 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getStructuredOutput } from "../utils.ts";
+import { defineFixture } from "../utils.ts";
 
 /**
  * fileTraversal test - validates path traversal is blocked by all MCP file tools.
@@ -31,7 +31,7 @@ const fixture = defineFixture(
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const setOutputCalled = output !== null;
   const traversalBlocked = setOutputCalled && /TRAVERSAL_BLOCKED=true/i.test(output);
   // extra safety: structured output should not be exactly a hostname (leaked from /etc/hostname)

test/agnostic/gitHooks.ts

@@ -1,5 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getAgentOutput, getStructuredOutput } from "../utils.ts";
+import { defineFixture, getAgentOutput } from "../utils.ts";
 
 /**
  * git hooks isolation test - validates:
@@ -52,7 +52,7 @@ Call set_output with:
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const agentOutput = getAgentOutput(result);
   const setOutputCalled = output !== null;
 

test/agnostic/gitPerms.ts

@@ -1,10 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import {
+import { defineFixture, generateTestMarker, getAgentOutput } from "../utils.ts";
-  defineFixture,
-  generateTestMarker,
-  getAgentOutput,
-  getStructuredOutput,
-} from "../utils.ts";
 
 /**
  * git permissions test - validates:
@@ -57,7 +52,7 @@ Call set_output with a JSON object containing:
 const { value: testToken, agentEnv } = generateTestMarker("GIT_PERMS_TEST_TOKEN");
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const agentOutput = getAgentOutput(result);
   const setOutputCalled = output !== null;
 

test/agnostic/packageJsonScripts.ts

@@ -1,5 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getStructuredOutput } from "../utils.ts";
+import { defineFixture } from "../utils.ts";
 
 /**
  * package.json script injection test - validates:
@@ -56,7 +56,7 @@ const fixture = defineFixture(
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const setOutputCalled = output !== null;
 
   let parsed: Record<string, unknown> = {};

test/agnostic/procSandbox.ts

@@ -1,10 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import {
+import { defineFixture, generateAgentUuids, getAgentOutput } from "../utils.ts";
-  defineFixture,
-  generateAgentUuids,
-  getAgentOutput,
-  getStructuredOutput,
-} from "../utils.ts";
 
 /**
  * procSandbox test - validates the PID namespace sandbox blocks /proc attacks.
@@ -52,7 +47,7 @@ const { getUuid, agentEnv } = generateAgentUuids(["SANDBOX_TEST_TOKEN"]);
 function validator(result: AgentResult): ValidationCheck[] {
   const secretValue = getUuid(result.agent, "SANDBOX_TEST_TOKEN");
   const agentOutput = getAgentOutput(result);
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const setOutputCalled = output !== null;
 
   // the secret should NOT appear anywhere in the output

test/agnostic/pushDisabled.ts

@@ -1,5 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, generateAgentUuids, getStructuredOutput } from "../utils.ts";
+import { defineFixture, generateAgentUuids } from "../utils.ts";
 
 /**
  * pushDisabled test - validates that push:disabled blocks all write operations.
@@ -31,7 +31,7 @@ Call set_output with a JSON object:
 const { agentEnv } = generateAgentUuids(["PUSH_TEST_MARKER"]);
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const setOutputCalled = output !== null;
 
   let parsed: Record<string, unknown> = {};

test/agnostic/pushEnabled.ts

@@ -1,5 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getStructuredOutput } from "../utils.ts";
+import { defineFixture } from "../utils.ts";
 
 /**
  * push enabled test - validates full push access.
@@ -44,7 +44,7 @@ Call set_output with a JSON object containing:
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const setOutputCalled = output !== null;
 
   let parsed: Record<string, unknown> = {};

test/agnostic/pushRestricted.ts

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getStructuredOutput } from "../utils.ts";
+import { defineFixture } from "../utils.ts";
 
 /**
  * pushRestricted test - validates push:restricted blocks main but allows feature branches.
@@ -40,7 +40,7 @@ Call set_output with a JSON object:
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const setOutputCalled = output !== null;
 
   let parsed: Record<string, unknown> = {};

test/agnostic/symlinkTraversal.ts

@@ -1,5 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getStructuredOutput } from "../utils.ts";
+import { defineFixture } from "../utils.ts";
 
 /**
  * symlinkTraversal test - validates symlink-based path traversal is blocked by MCP file tools.
@@ -35,7 +35,7 @@ const fixture = defineFixture(
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const setOutputCalled = output !== null;
   const symlinkBlocked = setOutputCalled && /SYMLINK_BLOCKED=true/i.test(output);
 

test/crossagent/fileReadWrite.ts

@@ -1,5 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, generateAgentUuids, getStructuredOutput } from "../utils.ts";
+import { defineFixture, generateAgentUuids } from "../utils.ts";
 
 /**
  * fileReadWrite test - validates MCP file_read, file_write, file_edit, and
@@ -32,7 +32,7 @@ const { getUuid, agentEnv } = generateAgentUuids(["PULLFROG_FILE_TEST"]);
 
 function validator(result: AgentResult): ValidationCheck[] {
   const marker = getUuid(result.agent, "PULLFROG_FILE_TEST");
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const setOutputCalled = output !== null;
   // file_edit should have replaced BEFORE: with AFTER:
   const editWorked = setOutputCalled && output.includes(`AFTER:${marker}`);

test/crossagent/mcpmerge.ts

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getStructuredOutput } from "../utils.ts";
+import { defineFixture } from "../utils.ts";
 
 /**
  * MCP merge test - validates repo-level MCP servers merge correctly with gh_pullfrog.
@@ -23,7 +23,7 @@ const fixture = defineFixture(
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const setOutputCalled = output !== null;
   const correctValue = setOutputCalled && output === secret;
 

test/crossagent/noNativeFile.ts

@@ -1,5 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, generateAgentUuids, getStructuredOutput } from "../utils.ts";
+import { defineFixture, generateAgentUuids } from "../utils.ts";
 
 /**
  * noNativeFile test - validates native file read/write tools are disabled.
@@ -32,7 +32,7 @@ const fixture = defineFixture(
 const { agentEnv } = generateAgentUuids(["PULLFROG_NOFILE_TEST"]);
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const fullOutput = result.output;
   const setOutputCalled = output !== null;
 

test/crossagent/nobash.ts

@@ -1,10 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import {
+import { buildShellToolPrompt, defineFixture, generateAgentUuids } from "../utils.ts";
-  buildShellToolPrompt,
-  defineFixture,
-  generateAgentUuids,
-  getStructuredOutput,
-} from "../utils.ts";
 
 /**
  * nobash test - validates agents respect shell=disabled setting.
@@ -31,7 +26,7 @@ function validator(result: AgentResult): ValidationCheck[] {
   const marker = getUuid(result.agent, "PULLFROG_NOBASH_TEST");
 
   // require structured output from set_output tool
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const setOutputCalled = output !== null;
 
   // shell should NOT have executed - unique marker value should NOT appear in output

test/crossagent/restricted.ts

@@ -1,10 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import {
+import { buildShellToolPrompt, defineFixture, generateAgentUuids } from "../utils.ts";
-  buildShellToolPrompt,
-  defineFixture,
-  generateAgentUuids,
-  getStructuredOutput,
-} from "../utils.ts";
 
 /**
  * restricted test - validates shell=restricted environment filtering.
@@ -14,7 +9,7 @@ import {
 const fixture = defineFixture(
   {
     prompt: `This is a test to determine token visibility in shell tool calls.
-    
+
 ${buildShellToolPrompt("echo $PULLFROG_TEST_VALUE")}
 
 Then also run: echo $PULLFROG_TEST_TOKEN
@@ -36,7 +31,7 @@ function validator(result: AgentResult): ValidationCheck[] {
   const filteredMarker = getUuid(result.agent, "PULLFROG_TEST_TOKEN");
 
   // require structured output from set_output tool
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const setOutputCalled = output !== null;
 
   // non-sensitive env var SHOULD appear in output (agent can read it via shell)

test/crossagent/smoke.ts

@@ -1,5 +1,5 @@
 import type { AgentResult, TestRunnerOptions, ValidationCheck } from "../utils.ts";
-import { defineFixture, getStructuredOutput } from "../utils.ts";
+import { defineFixture } from "../utils.ts";
 
 /**
  * smoke test - validates agent can connect to API and call MCP tools.
@@ -15,7 +15,7 @@ const fixture = defineFixture(
 );
 
 function validator(result: AgentResult): ValidationCheck[] {
-  const output = getStructuredOutput(result);
+  const output = result.structuredOutput;
   const setOutputCalled = output !== null;
   const correctValue = setOutputCalled && /SMOKE TEST PASSED/i.test(output);
 

test/utils.ts

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { mkdirSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { agentsManifest } from "../external.ts";
@@ -112,6 +112,7 @@ export interface AgentResult {
   agent: string;
   success: boolean;
   output: string;
+  structuredOutput: string | null;
 }
 
 // get agent output with GitHub Actions masking commands filtered out
@@ -123,12 +124,19 @@ export function getAgentOutput(result: AgentResult): string {
     .join("\n");
 }
 
-// get structured output from set_output tool (via ::pullfrog-output:: marker)
+// parse GITHUB_OUTPUT file format to extract a key's value.
-// returns null if no structured output was set by the agent
+// format: key<<ghadelimiter_<uuid>\n<value>\nghadelimiter_<uuid>
-export function getStructuredOutput(result: AgentResult): string | null {
+function parseGitHubOutputFile(filePath: string, key: string): string | null {
-  const match = result.output.match(/::pullfrog-output::([A-Za-z0-9+/=]+)/);
+  let content: string;
+  try {
+    content = readFileSync(filePath, "utf8");
+  } catch {
+    return null;
+  }
+  const pattern = new RegExp(`${key}<<(ghadelimiter_[\\w-]+)\\n([\\s\\S]*?)\\n\\1`);
+  const match = content.match(pattern);
   if (!match) return null;
-  return Buffer.from(match[1], "base64").toString();
+  return match[2];
 }
 
 export interface ValidationCheck {
@@ -184,6 +192,9 @@ export async function runAgentStreaming(options: RunStreamingOptions): Promise<A
     const testHome = `/tmp/home-${mcpPort}-${Date.now()}`;
     mkdirSync(testHome, { recursive: true });
 
+    const githubOutputFile = join(testHome, "github-output");
+    writeFileSync(githubOutputFile, "");
+
     // write file-based env vars for MCP servers that don't inherit parent env vars
     // (e.g., Cursor CLI doesn't pass env vars to repo-level MCP servers).
     // only explicitly opted-in vars go here -- never secrets.
@@ -203,6 +214,7 @@ export async function runAgentStreaming(options: RunStreamingOptions): Promise<A
         AGENT_OVERRIDE: options.agent,
         ...options.env,
         HOME: testHome,
+        GITHUB_OUTPUT: githubOutputFile,
       },
       stdio: "pipe",
       detached: true,
@@ -217,6 +229,7 @@ export async function runAgentStreaming(options: RunStreamingOptions): Promise<A
         agent: options.agent,
         success: false,
         output: `spawn error: ${err.message}`,
+        structuredOutput: null,
       });
     });
 
@@ -253,6 +266,7 @@ export async function runAgentStreaming(options: RunStreamingOptions): Promise<A
         agent: options.agent,
         success: code === 0,
         output: Buffer.concat(chunks).toString(),
+        structuredOutput: parseGitHubOutputFile(githubOutputFile, "result"),
       });
     });
   });

utils/docker.ts

@@ -135,6 +135,7 @@ const testEnvAllowList = new Set([
   "GITHUB_API_URL",
   "GITHUB_SERVER_URL",
   "GITHUB_GRAPHQL_URL",
+  "GITHUB_OUTPUT",
 ]);
 
 export type EnvFilterMode = "allowlist" | "passthrough";