refactor delegation system, add PR summary comments, and improve code quality (#334)

* refactor delegation system and add PR summary comments

Delegation system:
- replace mode-based delegation with select_mode → delegate two-step flow
- orchestrator crafts self-contained subagent prompts (clean context — no system/repo/event instructions leak)
- add role-based tool filtering via FastMCP authenticate hook (?role=subagent hides orchestrator-only tools)
- add select_mode tool for orchestrator guidance per mode
- add ask_question tool for lightweight research subagents
- extract shared subagent lifecycle into subagent.ts (create, complete, stdout, instructions)
- route set_output to per-subagent state when activeSubagentId is set
- track per-subagent state (SubagentState Map) replacing boolean delegationActive flag
- capture and aggregate AgentUsage across all agents (claude, codex, gemini, opencode)
- write usage summary table to GitHub job summary
- block built-in subagent spawning (Task for Claude, Task(*) for Cursor)
- increase activity timeout from 60s to 300s (subagent thinking phases)
- fix gh CLI misguidance in system prompt — explicitly forbid usage

PR summary comments:
- add prSummaryComment trigger (DB schema + migrations + Zod + UI toggle)
- dispatch mini-effort summary job alongside PR review on pr.created
- add update_pull_request_body MCP tool
- add defaultEffort option to webhook dispatch

Hardening:
- rewrite delegate/selectMode tests with simulated state management
- add toolFiltering.test.ts for role extraction, canAccess, set_output routing
- remove non-null assertions for PULLFROG_TEMP_DIR (proper error throws)
- use fetchWithRetry for direct tarball downloads
- DRY fix for rate limit check in test runner

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: add type keyword to Effort import in handleWebhook.ts

Co-authored-by: Cursor <cursoragent@cursor.com>

* clean up delegation system, improve code quality across the codebase

- simplify delegate tool to instructions + effort params with subagent lifecycle in subagent.ts
- add select_mode and ask_question orchestrator-only tools with canAccess filtering
- replace delegate.test.ts/selectMode.test.ts with toolFiltering.test.ts (live MCP integration)
- add set_output routing for subagent context and AgentUsage tracking across all agents
- add PR summary comment trigger (schema, UI, webhook dispatch with silent flag)
- add update_pull_request_body MCP tool
- fix changed-agents.sh to always include claude canary for non-agent action changes
- fix cursor pagination bug in getSelectedInstallationReposPage
- remove destructuring patterns, inline type definitions, and unsafe type casts
- replace non-null assertions with explicit checks in install.ts
- convert multi-param functions to single param objects (postCleanup, runActionLocal, etc.)
- use isHttpError helper in API routes instead of catch-any patterns
- add adhoc test fixtures for delegation scenarios (context isolation, error handling, synthesis, etc.)

Co-authored-by: Cursor <cursoragent@cursor.com>

* no subagent mutation, one mcp per subagent

* address review feedback: parallel-safe usage tracking, subagent isolation, minor improvements

* fix subagent state isolation: replace Object.freeze with shallow copy

Object.freeze throws TypeErrors when subagent tools (checkout_pr,
report_progress) write scalar properties to toolState. A shallow copy
achieves the same isolation for scalar fields while allowing tools to
work normally. Shared references (subagents Map, usageEntries array)
remain shared for coordination.

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: pullfrog[bot] <226033991+pullfrog[bot]@users.noreply.github.com>

utils/log.ts

@@ -4,6 +4,7 @@
 
 import * as core from "@actions/core";
 import { table } from "table";
+import type { AgentUsage } from "../agents/shared.ts";
 import { isGitHubActions, isInsideDocker } from "./globals.ts";
 
 const isRunnerDebugEnabled = () => core.isDebug();
@@ -298,3 +299,58 @@ export function formatIndentedField(label: string, content: string): string {
   }
   return formatted;
 }
+
+/**
+ * format aggregated usage data as a markdown table for the GitHub step summary
+ */
+export function formatUsageSummary(entries: AgentUsage[]): string {
+  if (entries.length === 0) return "";
+
+  const hasCost = entries.some((e) => e.costUsd !== undefined);
+
+  const header = hasCost
+    ? "| Agent | Input | Output | Cache Read | Cache Write | Cost |"
+    : "| Agent | Input | Output | Cache Read | Cache Write |";
+
+  const fmt = (n: number) => n.toLocaleString("en-US");
+
+  const separatorRow = hasCost
+    ? "| --- | ---: | ---: | ---: | ---: | ---: |"
+    : "| --- | ---: | ---: | ---: | ---: |";
+
+  const rows = entries.map((e) => {
+    const base = `| ${e.agent} | ${fmt(e.inputTokens)} | ${fmt(e.outputTokens)} | ${fmt(e.cacheReadTokens ?? 0)} | ${fmt(e.cacheWriteTokens ?? 0)} |`;
+    return hasCost
+      ? `${base} ${e.costUsd !== undefined ? `$${e.costUsd.toFixed(4)}` : "-"} |`
+      : base;
+  });
+
+  // totals row (only useful when there are multiple entries)
+  const totalsRows: string[] = [];
+  if (entries.length > 1) {
+    const totalInput = entries.reduce((sum, e) => sum + e.inputTokens, 0);
+    const totalOutput = entries.reduce((sum, e) => sum + e.outputTokens, 0);
+    const totalCacheRead = entries.reduce((sum, e) => sum + (e.cacheReadTokens ?? 0), 0);
+    const totalCacheWrite = entries.reduce((sum, e) => sum + (e.cacheWriteTokens ?? 0), 0);
+    const totalBase = `| **Total** | **${fmt(totalInput)}** | **${fmt(totalOutput)}** | **${fmt(totalCacheRead)}** | **${fmt(totalCacheWrite)}** |`;
+
+    if (hasCost) {
+      const totalCost = entries.reduce((sum, e) => sum + (e.costUsd ?? 0), 0);
+      totalsRows.push(`${totalBase} **$${totalCost.toFixed(4)}** |`);
+    } else {
+      totalsRows.push(totalBase);
+    }
+  }
+
+  return [
+    "<details>",
+    "<summary>Usage</summary>",
+    "",
+    header,
+    separatorRow,
+    ...rows,
+    ...totalsRows,
+    "",
+    "</details>",
+  ].join("\n");
+}