refactor delegation system, add PR summary comments, and improve code quality (#334)

* refactor delegation system and add PR summary comments

Delegation system:
- replace mode-based delegation with select_mode → delegate two-step flow
- orchestrator crafts self-contained subagent prompts (clean context — no system/repo/event instructions leak)
- add role-based tool filtering via FastMCP authenticate hook (?role=subagent hides orchestrator-only tools)
- add select_mode tool for orchestrator guidance per mode
- add ask_question tool for lightweight research subagents
- extract shared subagent lifecycle into subagent.ts (create, complete, stdout, instructions)
- route set_output to per-subagent state when activeSubagentId is set
- track per-subagent state (SubagentState Map) replacing boolean delegationActive flag
- capture and aggregate AgentUsage across all agents (claude, codex, gemini, opencode)
- write usage summary table to GitHub job summary
- block built-in subagent spawning (Task for Claude, Task(*) for Cursor)
- increase activity timeout from 60s to 300s (subagent thinking phases)
- fix gh CLI misguidance in system prompt — explicitly forbid usage

PR summary comments:
- add prSummaryComment trigger (DB schema + migrations + Zod + UI toggle)
- dispatch mini-effort summary job alongside PR review on pr.created
- add update_pull_request_body MCP tool
- add defaultEffort option to webhook dispatch

Hardening:
- rewrite delegate/selectMode tests with simulated state management
- add toolFiltering.test.ts for role extraction, canAccess, set_output routing
- remove non-null assertions for PULLFROG_TEMP_DIR (proper error throws)
- use fetchWithRetry for direct tarball downloads
- DRY fix for rate limit check in test runner

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: add type keyword to Effort import in handleWebhook.ts

Co-authored-by: Cursor <cursoragent@cursor.com>

* clean up delegation system, improve code quality across the codebase

- simplify delegate tool to instructions + effort params with subagent lifecycle in subagent.ts
- add select_mode and ask_question orchestrator-only tools with canAccess filtering
- replace delegate.test.ts/selectMode.test.ts with toolFiltering.test.ts (live MCP integration)
- add set_output routing for subagent context and AgentUsage tracking across all agents
- add PR summary comment trigger (schema, UI, webhook dispatch with silent flag)
- add update_pull_request_body MCP tool
- fix changed-agents.sh to always include claude canary for non-agent action changes
- fix cursor pagination bug in getSelectedInstallationReposPage
- remove destructuring patterns, inline type definitions, and unsafe type casts
- replace non-null assertions with explicit checks in install.ts
- convert multi-param functions to single param objects (postCleanup, runActionLocal, etc.)
- use isHttpError helper in API routes instead of catch-any patterns
- add adhoc test fixtures for delegation scenarios (context isolation, error handling, synthesis, etc.)

Co-authored-by: Cursor <cursoragent@cursor.com>

* no subagent mutation, one mcp per subagent

* address review feedback: parallel-safe usage tracking, subagent isolation, minor improvements

* fix subagent state isolation: replace Object.freeze with shallow copy

Object.freeze throws TypeErrors when subagent tools (checkout_pr,
report_progress) write scalar properties to toolState. A shallow copy
achieves the same isolation for scalar fields while allowing tools to
work normally. Shared references (subagents Map, usageEntries array)
remain shared for coordination.

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: pullfrog[bot] <226033991+pullfrog[bot]@users.noreply.github.com>

utils/install.ts

@@ -80,7 +80,9 @@ export async function installFromNpmTarball(params: InstallFromNpmTarballParams)
 
   log.debug(`» installing ${params.packageName}@${resolvedVersion}...`);
 
-  const tempDir = process.env.PULLFROG_TEMP_DIR!;
+  const tempDir = process.env.PULLFROG_TEMP_DIR;
+  if (!tempDir) throw new Error("PULLFROG_TEMP_DIR is not set");
+
   const tarballPath = join(tempDir, "package.tgz");
 
   // Download tarball from npm
@@ -302,7 +304,9 @@ export async function installFromGithubTarball(
 
   log.debug(`» downloading asset from ${assetUrl}...`);
 
-  const tempDir = process.env.PULLFROG_TEMP_DIR!;
+  const tempDir = process.env.PULLFROG_TEMP_DIR;
+  if (!tempDir) throw new Error("PULLFROG_TEMP_DIR is not set");
+
   const tarballPath = join(tempDir, assetName);
 
   // download the asset
@@ -349,13 +353,12 @@ export async function installFromDirectTarball(
 ): Promise<string> {
   log.info(`» downloading tarball from ${params.url}...`);
 
-  const tempDir = process.env.PULLFROG_TEMP_DIR!;
+  const tempDir = process.env.PULLFROG_TEMP_DIR;
+  if (!tempDir) throw new Error("PULLFROG_TEMP_DIR is not set");
+
   const tarballPath = join(tempDir, "direct-package.tgz");
 
-  const response = await fetch(params.url);
-  if (!response.ok) {
-    throw new Error(`failed to download tarball: ${response.status} ${response.statusText}`);
-  }
+  const response = await fetchWithRetry(params.url, {}, "failed to download tarball");
   if (!response.body) throw new Error("response body is null");
 
   const fileStream = createWriteStream(tarballPath);
@@ -367,8 +370,8 @@ export async function installFromDirectTarball(
   mkdirSync(extractDir, { recursive: true });
 
   const tarArgs = ["-xzf", tarballPath, "-C", extractDir];
-  if (params.stripComponents) {
-    tarArgs.push(`--strip-components=${params.stripComponents}`);
+  if (params.stripComponents !== undefined && params.stripComponents > 0) {
+    tarArgs.push(`--strip-components=${Math.floor(params.stripComponents)}`);
   }
 
   log.debug(`» extracting tarball...`);
@@ -401,7 +404,9 @@ export async function installFromDirectTarball(
 export async function installFromCurl(params: InstallFromCurlParams): Promise<string> {
   log.info(`» installing ${params.executableName}...`);
 
-  const tempDir = process.env.PULLFROG_TEMP_DIR!;
+  const tempDir = process.env.PULLFROG_TEMP_DIR;
+  if (!tempDir) throw new Error("PULLFROG_TEMP_DIR is not set");
+
   const installScriptPath = join(tempDir, "install.sh");
 
   // Download the install script