refactor delegation system, add PR summary comments, and improve code quality (#334)

* refactor delegation system and add PR summary comments

Delegation system:
- replace mode-based delegation with select_mode → delegate two-step flow
- orchestrator crafts self-contained subagent prompts (clean context — no system/repo/event instructions leak)
- add role-based tool filtering via FastMCP authenticate hook (?role=subagent hides orchestrator-only tools)
- add select_mode tool for orchestrator guidance per mode
- add ask_question tool for lightweight research subagents
- extract shared subagent lifecycle into subagent.ts (create, complete, stdout, instructions)
- route set_output to per-subagent state when activeSubagentId is set
- track per-subagent state (SubagentState Map) replacing boolean delegationActive flag
- capture and aggregate AgentUsage across all agents (claude, codex, gemini, opencode)
- write usage summary table to GitHub job summary
- block built-in subagent spawning (Task for Claude, Task(*) for Cursor)
- increase activity timeout from 60s to 300s (subagent thinking phases)
- fix gh CLI misguidance in system prompt — explicitly forbid usage

PR summary comments:
- add prSummaryComment trigger (DB schema + migrations + Zod + UI toggle)
- dispatch mini-effort summary job alongside PR review on pr.created
- add update_pull_request_body MCP tool
- add defaultEffort option to webhook dispatch

Hardening:
- rewrite delegate/selectMode tests with simulated state management
- add toolFiltering.test.ts for role extraction, canAccess, set_output routing
- remove non-null assertions for PULLFROG_TEMP_DIR (proper error throws)
- use fetchWithRetry for direct tarball downloads
- DRY fix for rate limit check in test runner

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: add type keyword to Effort import in handleWebhook.ts

Co-authored-by: Cursor <cursoragent@cursor.com>

* clean up delegation system, improve code quality across the codebase

- simplify delegate tool to instructions + effort params with subagent lifecycle in subagent.ts
- add select_mode and ask_question orchestrator-only tools with canAccess filtering
- replace delegate.test.ts/selectMode.test.ts with toolFiltering.test.ts (live MCP integration)
- add set_output routing for subagent context and AgentUsage tracking across all agents
- add PR summary comment trigger (schema, UI, webhook dispatch with silent flag)
- add update_pull_request_body MCP tool
- fix changed-agents.sh to always include claude canary for non-agent action changes
- fix cursor pagination bug in getSelectedInstallationReposPage
- remove destructuring patterns, inline type definitions, and unsafe type casts
- replace non-null assertions with explicit checks in install.ts
- convert multi-param functions to single param objects (postCleanup, runActionLocal, etc.)
- use isHttpError helper in API routes instead of catch-any patterns
- add adhoc test fixtures for delegation scenarios (context isolation, error handling, synthesis, etc.)

Co-authored-by: Cursor <cursoragent@cursor.com>

* no subagent mutation, one mcp per subagent

* address review feedback: parallel-safe usage tracking, subagent isolation, minor improvements

* fix subagent state isolation: replace Object.freeze with shallow copy

Object.freeze throws TypeErrors when subagent tools (checkout_pr,
report_progress) write scalar properties to toolState. A shallow copy
achieves the same isolation for scalar fields while allowing tools to
work normally. Shared references (subagents Map, usageEntries array)
remain shared for coordination.

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: pullfrog[bot] <226033991+pullfrog[bot]@users.noreply.github.com>

main.ts

@@ -1,5 +1,5 @@
 // changes to tool permissions should be reflected in wiki/granular-tools.md
-import { initToolState, startMcpHttpServer } from "./mcp/server.ts";
+import { initToolState, startMcpHttpServer, type ToolState } from "./mcp/server.ts";
 import { computeModes } from "./modes.ts";
 import {
   type ActivityTimeout,
@@ -10,7 +10,7 @@ import {
 import { resolveAgent } from "./utils/agent.ts";
 import { validateAgentApiKey } from "./utils/apiKeys.ts";
 import { resolveBody } from "./utils/body.ts";
-import { log, writeSummary } from "./utils/cli.ts";
+import { formatUsageSummary, log, writeSummary } from "./utils/cli.ts";
 import { reportErrorToComment } from "./utils/errorReport.ts";
 import { resolveGit } from "./utils/gitAuth.ts";
 import { createOctokit } from "./utils/github.ts";
@@ -36,6 +36,14 @@ export interface MainResult {
   result?: string | undefined;
 }
 
+async function writeJobSummary(toolState: ToolState): Promise<void> {
+  const usageSummary = formatUsageSummary(toolState.usageEntries);
+  const summaryParts = [toolState.lastProgressBody, usageSummary].filter(Boolean);
+  if (summaryParts.length > 0) {
+    await writeSummary(summaryParts.join("\n\n"));
+  }
+}
+
 export async function main(): Promise<MainResult> {
   // normalize env var names to uppercase (handles case-insensitive workflow files)
   normalizeEnv();
@@ -216,11 +224,13 @@ export async function main(): Promise<MainResult> {
       }
     }
 
-    // write last progress body to job summary
-    if (toolState.lastProgressBody) {
-      await writeSummary(toolState.lastProgressBody);
+    // accumulate top-level agent usage
+    if (result.usage) {
+      toolState.usageEntries.push(result.usage);
     }
 
+    await writeJobSummary(toolState);
+
     // emit structured output marker for test validation
     if (toolState.output) {
       log.info(`::pullfrog-output::${Buffer.from(toolState.output).toString("base64")}`);
@@ -234,6 +244,12 @@ export async function main(): Promise<MainResult> {
     const errorMessage = error instanceof Error ? error.message : "unknown error occurred";
     killTrackedChildren();
     log.error(errorMessage);
+
+    // best-effort summary — don't mask the original error
+    try {
+      await writeJobSummary(toolState);
+    } catch {}
+
     try {
       await reportErrorToComment({ toolState, error: errorMessage });
     } catch {