improve agent CI matrix, token permissions, and waitlist follower backfill (#313)

* add workflows permission to git token and waitlist improvements

- add `workflows` to `InstallationTokenPermissions` type in both action and API token routes
- include `workflows: write` in the git token so agents can push workflow file changes
- add `githubFollowers` field to WaitlistSignup schema with migration
- add script to populate waitlist followers from GitHub API
- add frog-green-square-border logo asset

Co-authored-by: Cursor <cursoragent@cursor.com>

* improve CI, agent logging, token permissions, and delegation guardrails

- add format check and build step to root CI job
- standardize agent model/effort log lines across all agents
- fix GitHub App permissions types to match OpenAPI schema (workflows is write-only)
- improve delegation error message to prevent subagent recursion
- demote noisy OpenCode stderr to debug level
- add subagent delegation rules to resolved instructions

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix graphql partial error handling, update delegation message, add workflow_run fixtures

Co-authored-by: Cursor <cursoragent@cursor.com>

* remove module-level env var throws that break CI build

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix logging bug and type hole from PR review

- use batch-local notFound counter so per-batch log doesn't undercount
- add workflows to WorkflowTokenPermissions so wire type matches what action sends

Co-authored-by: Cursor <cursoragent@cursor.com>

* lazy-init appOctokit to fix next build without env vars

Co-authored-by: Cursor <cursoragent@cursor.com>

* drop pnpm build from CI test workflow

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix delegate-effort test regex to match actual log format, disable fail-fast for agnostic tests

the test was matching `running \w+ with effort=auto` but the actual log
line from shared.ts is `» effort:  auto`. also temporarily set
fail-fast: false on action-agnostic so all failures surface at once.

Co-authored-by: Cursor <cursoragent@cursor.com>

* disable fail-fast in action workflow too, relax ci.test.ts to match

both workflow files now use fail-fast: false for agnostic tests so all
matrix jobs run to completion. the ci consistency test now checks that
the two workflows agree rather than requiring true.

Co-authored-by: Cursor <cursoragent@cursor.com>

* restore fail-fast: true now that all agnostic tests pass

Co-authored-by: Cursor <cursoragent@cursor.com>

* skip agent tests in CI when agent harness file didn't change

adds action/test/changed-agents.sh which reads the PR diff (via
dorny/paths-filter) and outputs only agents whose harness file was
modified. the action-agents matrix now uses this dynamic list instead
of a hardcoded array, so e.g. a PR touching only cursor.ts runs 6
jobs instead of 30.

Co-authored-by: Cursor <cursoragent@cursor.com>

* update ci.test.ts to validate dynamic agent matrix

the test now checks that the matrix references the changes job output
and that changed-agents.sh correctly discovers all agents.

Co-authored-by: Cursor <cursoragent@cursor.com>

* parallelize action jobs and use claude canary fallback for shared changes

runs action-agents in parallel with action-agnostic after root/changes, and updates changed-agents logic so shared or non-harness action runtime changes run only claude while harness-specific edits run only those changed agents.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

entry

@@ -139709,12 +139709,14 @@ async function resolveTokens(params) {
       }
     };
   }
-  const gitContents = params.push === "disabled" ? "read" : "write";
-  const gitToken = await acquireNewToken({ permissions: { contents: gitContents } });
+  const gitPermissions = params.push === "disabled" ? { contents: "read" } : { contents: "write", workflows: "write" };
+  const gitToken = await acquireNewToken({ permissions: gitPermissions });
   if (isGitHubActions) {
     core3.setSecret(gitToken);
   }
-  log.info(`\xBB acquired git token (contents:${gitContents})`);
+  log.info(
+    `\xBB acquired git token (${Object.entries(gitPermissions).map((e) => e.join(":")).join(", ")})`
+  );
   const mcpToken = await acquireNewToken();
   if (isGitHubActions) {
     core3.setSecret(mcpToken);
@@ -141892,7 +141894,13 @@ ${ctx.modes.map((m) => `- "${m.name}": ${m.description}`).join("\n")}`;
 }
 function resolveSubagentInstructions(ctx) {
   const inputs = buildCommonInputs(ctx);
-  const subagentTaskSection = `You are operating in **${ctx.mode.name}** mode.
+  const subagentTaskSection = `You are operating in **${ctx.mode.name}** mode as a delegated subagent. An orchestrator spawned you and will read your final output to decide what to do next.
+
+### Delegation rules
+
+- The \`delegate\` tool is NOT available to you \u2014 complete your task directly using the available tools.
+- When you finish, end with a clear, concise summary: what you did, what succeeded, what failed, and any blockers or next steps. The orchestrator uses this to decide whether to delegate again or report final results.
+- If you encounter an error you cannot resolve, report it clearly \u2014 do not attempt to delegate or re-run yourself.
 
 ${ctx.mode.prompt}`;
   const system = buildSystemPrompt({
@@ -141956,7 +141964,7 @@ function DelegateTool(ctx) {
     execute: execute(async (params) => {
       if (ctx.toolState.delegationActive) {
         return {
-          error: "delegation is not available inside a delegated subagent"
+          error: "delegation is not available inside a subagent. you are already running as a delegated subagent. complete the task directly using the available tools. do not attempt to delegate further. your last agent message will be passed to your supervisor and it will decide what to do next."
         };
       }
       const selectedMode = resolveMode(ctx.modes, params.mode);
@@ -144812,13 +144820,14 @@ var agent = (input) => {
   return {
     ...input,
     run: async (ctx) => {
-      const bash = ctx.payload.bash;
-      const web = ctx.payload.web;
-      const search2 = ctx.payload.search;
-      const push = ctx.payload.push;
-      log.info(
-        `\xBB running ${input.name} with effort=${ctx.payload.effort}, timeout=${ctx.payload.timeout}...`
-      );
+      log.info(`\xBB agent:   ${input.name}`);
+      log.info(`\xBB effort:  ${ctx.payload.effort}`);
+      if (ctx.payload.timeout) log.info(`\xBB timeout: ${ctx.payload.timeout}`);
+      log.info(`\xBB web:     ${ctx.payload.web}`);
+      log.info(`\xBB search:  ${ctx.payload.search}`);
+      log.info(`\xBB push:    ${ctx.payload.push}`);
+      log.info(`\xBB bash:    ${ctx.payload.bash}`);
+      log.debug(`\xBB payload: ${JSON.stringify(ctx.payload, null, 2)}`);
       const logParts = [
         ctx.instructions.eventInstructions ? `EVENT-LEVEL INSTRUCTIONS:
 ${ctx.instructions.eventInstructions}` : null,
@@ -144829,7 +144838,6 @@ ${ctx.instructions.user}` : null,
       log.box(logParts.join("\n\n---\n\n"), {
         title: "Instructions"
       });
-      log.info(`\xBB tool permissions: web=${web}, search=${search2}, push=${push}, bash=${bash}`);
       return input.run(ctx);
     },
     ...agentsManifest[input.name]
@@ -144885,7 +144893,7 @@ var claude = agent({
     const cliPath = await installClaude();
     const model = claudeEffortModels[ctx.payload.effort];
     const effortLevel = claudeEffortLevels[ctx.payload.effort];
-    log.info(`\xBB using model: ${model}${effortLevel ? ` (effort: ${effortLevel})` : ""}`);
+    log.info(`\xBB model: ${model}${effortLevel ? ` (effort: ${effortLevel})` : ""}`);
     const disallowedTools = buildDisallowedTools(ctx);
     if (disallowedTools.length > 0) {
       log.info(`\xBB disallowed tools: ${disallowedTools.join(", ")}`);
@@ -145160,10 +145168,9 @@ var codex = agent({
     const [cliPath, model] = await Promise.all([installCodex(), resolveModel(apiKey)]);
     const codexDir = writeCodexConfig(ctx);
     const effortConfig = getCodexEffortConfig(model)[ctx.payload.effort];
-    log.info(`\xBB using model: ${effortConfig.model} (effort: ${ctx.payload.effort})`);
-    if (effortConfig.reasoningEffort) {
-      log.info(`\xBB using modelReasoningEffort: ${effortConfig.reasoningEffort}`);
-    }
+    log.info(
+      `\xBB model: ${effortConfig.model}${effortConfig.reasoningEffort ? ` (reasoningEffort: ${effortConfig.reasoningEffort})` : ""}`
+    );
     const sandboxMode = ctx.payload.push === "disabled" ? "read-only" : "workspace-write";
     const networkAccessEnabled = ctx.payload.web !== "disabled";
     const webSearchEnabled = ctx.payload.search !== "disabled";
@@ -145381,7 +145388,7 @@ var cursor = agent({
       try {
         const projectConfig = JSON.parse(readFileSync5(projectCliConfigPath, "utf-8"));
         if (projectConfig.model) {
-          log.info(`\xBB using model from project .cursor/cli.json: ${projectConfig.model}`);
+          log.info(`\xBB model: ${projectConfig.model} (from .cursor/cli.json)`);
         } else {
           modelOverride = cursorEffortModels[ctx.payload.effort];
         }
@@ -145392,9 +145399,9 @@ var cursor = agent({
       modelOverride = cursorEffortModels[ctx.payload.effort];
     }
     if (modelOverride) {
-      log.info(`\xBB using model: ${modelOverride}, effort=${ctx.payload.effort}`);
+      log.info(`\xBB model: ${modelOverride}`);
     } else if (!existsSync6(projectCliConfigPath)) {
-      log.info(`\xBB using default model, effort=${ctx.payload.effort}`);
+      log.info(`\xBB model: default`);
     }
     const loggedModelCallIds = /* @__PURE__ */ new Set();
     const thinkingTimer = new ThinkingTimer();
@@ -145594,7 +145601,8 @@ function configureCursorTools(ctx) {
     };
   }
   writeFileSync9(cliConfigPath, JSON.stringify(config3, null, 2), "utf-8");
-  log.info(`\xBB CLI config written to ${cliConfigPath}`, JSON.stringify(config3, null, 2));
+  log.info(`\xBB CLI config written to ${cliConfigPath}`);
+  log.debug(`\xBB CLI config contents: ${JSON.stringify(config3, null, 2)}`);
 }
 
 // agents/gemini.ts
@@ -145813,7 +145821,7 @@ function configureGeminiSettings(ctx) {
   const effortConfig = geminiEffortConfig[ctx.payload.effort];
   const model = process.env.GEMINI_MODEL ?? effortConfig.model;
   const thinkingLevel = effortConfig.thinkingLevel;
-  log.info(`\xBB using model: ${model}, thinkingLevel: ${thinkingLevel}`);
+  log.info(`\xBB model: ${model} (thinkingLevel: ${thinkingLevel})`);
   const realHome = homedir2();
   const geminiConfigDir = join12(realHome, ".gemini");
   const settingsPath = join12(geminiConfigDir, "settings.json");
@@ -145904,7 +145912,9 @@ var opencode = agent({
     const modelOverride = process.env.OPENCODE_MODEL;
     if (modelOverride) {
       args2.push("--model", modelOverride);
-      log.info(`\xBB using model override: ${modelOverride}`);
+      log.info(`\xBB model: ${modelOverride} (override)`);
+    } else {
+      log.info(`\xBB model: auto-selected by OpenCode`);
     }
     process.env.HOME = tempHome;
     const env2 = {
@@ -145987,12 +145997,7 @@ var opencode = agent({
             lastProviderError = providerError;
             log.error(`\xBB provider error detected (${providerError}): ${trimmed.substring(0, 500)}`);
           } else {
-            try {
-              const parsed2 = JSON.parse(trimmed);
-              log.debug(JSON.stringify(parsed2, null, 2));
-            } catch {
-              log.warning(trimmed);
-            }
+            log.debug(trimmed);
           }
         }
       });
@@ -146091,7 +146096,7 @@ function configureOpenCode(ctx) {
     throw error49;
   }
   log.info(`\xBB OpenCode config written to ${configPath}`);
-  log.info(
+  log.debug(
     `\xBB OpenCode permissions: edit=${permission.edit}, bash=${permission.bash}, webfetch=${permission.webfetch}`
   );
   log.debug(`OpenCode config contents:
@@ -146170,20 +146175,21 @@ var messageHandlers4 = {
     const status = event.part?.state?.status;
     const output = event.part?.state?.output;
     if (!toolName || !toolId) {
-      log.debug(`\xBB tool_use event missing toolName or toolId: ${JSON.stringify(event)}`);
+      log.info(
+        `\xBB tool_use event missing toolName or toolId: ${JSON.stringify(event).substring(0, 500)}`
+      );
+      return;
     }
-    if (toolName && toolId) {
-      if (stepHistory.length > 0) {
-        stepHistory[stepHistory.length - 1].toolCalls.push(toolName);
-      }
-      thinkingTimer.markToolCall();
-      log.toolCall({
-        toolName,
-        input: parameters || {}
-      });
-      if (status === "completed" && output) {
-        log.debug(`  output: ${output}`);
-      }
+    if (stepHistory.length > 0) {
+      stepHistory[stepHistory.length - 1].toolCalls.push(toolName);
+    }
+    thinkingTimer.markToolCall();
+    log.toolCall({
+      toolName,
+      input: parameters || {}
+    });
+    if (status === "completed" && output) {
+      log.debug(`  output: ${output}`);
     }
   },
   tool_result: (event, thinkingTimer) => {