cfd38d82fc
refactor delegation system, add PR summary comments, and improve code quality ( #334 )
...
* refactor delegation system and add PR summary comments
Delegation system:
- replace mode-based delegation with select_mode → delegate two-step flow
- orchestrator crafts self-contained subagent prompts (clean context — no system/repo/event instructions leak)
- add role-based tool filtering via FastMCP authenticate hook (?role=subagent hides orchestrator-only tools)
- add select_mode tool for orchestrator guidance per mode
- add ask_question tool for lightweight research subagents
- extract shared subagent lifecycle into subagent.ts (create, complete, stdout, instructions)
- route set_output to per-subagent state when activeSubagentId is set
- track per-subagent state (SubagentState Map) replacing boolean delegationActive flag
- capture and aggregate AgentUsage across all agents (claude, codex, gemini, opencode)
- write usage summary table to GitHub job summary
- block built-in subagent spawning (Task for Claude, Task(*) for Cursor)
- increase activity timeout from 60s to 300s (subagent thinking phases)
- fix gh CLI misguidance in system prompt — explicitly forbid usage
PR summary comments:
- add prSummaryComment trigger (DB schema + migrations + Zod + UI toggle)
- dispatch mini-effort summary job alongside PR review on pr.created
- add update_pull_request_body MCP tool
- add defaultEffort option to webhook dispatch
Hardening:
- rewrite delegate/selectMode tests with simulated state management
- add toolFiltering.test.ts for role extraction, canAccess, set_output routing
- remove non-null assertions for PULLFROG_TEMP_DIR (proper error throws)
- use fetchWithRetry for direct tarball downloads
- DRY fix for rate limit check in test runner
Co-authored-by: Cursor <cursoragent@cursor.com >
* fix: add type keyword to Effort import in handleWebhook.ts
Co-authored-by: Cursor <cursoragent@cursor.com >
* clean up delegation system, improve code quality across the codebase
- simplify delegate tool to instructions + effort params with subagent lifecycle in subagent.ts
- add select_mode and ask_question orchestrator-only tools with canAccess filtering
- replace delegate.test.ts/selectMode.test.ts with toolFiltering.test.ts (live MCP integration)
- add set_output routing for subagent context and AgentUsage tracking across all agents
- add PR summary comment trigger (schema, UI, webhook dispatch with silent flag)
- add update_pull_request_body MCP tool
- fix changed-agents.sh to always include claude canary for non-agent action changes
- fix cursor pagination bug in getSelectedInstallationReposPage
- remove destructuring patterns, inline type definitions, and unsafe type casts
- replace non-null assertions with explicit checks in install.ts
- convert multi-param functions to single param objects (postCleanup, runActionLocal, etc.)
- use isHttpError helper in API routes instead of catch-any patterns
- add adhoc test fixtures for delegation scenarios (context isolation, error handling, synthesis, etc.)
Co-authored-by: Cursor <cursoragent@cursor.com >
* no subagent mutation, one mcp per subagent
* address review feedback: parallel-safe usage tracking, subagent isolation, minor improvements
* fix subagent state isolation: replace Object.freeze with shallow copy
Object.freeze throws TypeErrors when subagent tools (checkout_pr,
report_progress) write scalar properties to toolState. A shallow copy
achieves the same isolation for scalar fields while allowing tools to
work normally. Shared references (subagents Map, usageEntries array)
remain shared for coordination.
---------
Co-authored-by: Cursor <cursoragent@cursor.com >
Co-authored-by: pullfrog[bot] <226033991+pullfrog[bot]@users.noreply.github.com>
2026-02-22 14:12:43 +00:00
a90743e9fe
0.0.167
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-02-20 19:19:25 +00:00
823fa3a39b
0.0.166
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-02-20 19:17:50 +00:00
caa3cf4d4b
0.0.165
2026-02-20 15:53:11 +00:00
185ca7a832
Avoid using --ignore-workspace ( #353 )
2026-02-19 14:41:21 +00:00
510f2c96f9
Fix the availability of some @anthropic-ai/claude-agent-sdk types ( #322 )
...
* Fix the availability of some `@anthropic-ai/claude-agent-sdk` types
* update it in the action too
* fix types
2026-02-18 12:12:40 +00:00
eb22433760
bump action patch version and sync queued waitlist updates
...
Increment @pullfrog/pullfrog from 0.0.163 to 0.0.164 and include current beta/docs/waitlist script changes.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-02-17 03:21:44 +00:00
37dcea86b9
0.0.163
2026-02-16 04:42:33 +00:00
30812435f9
Fix file upload 401 by conditionally signing content-disposition header ( #289 )
...
* Fix file upload 401 by conditionally signing content-disposition header
* Bump version to 0.0.162
---------
Co-authored-by: pullfrog[bot] <226033991+pullfrog[bot]@users.noreply.github.com>
2026-02-13 19:14:32 +00:00
bc28c658f2
harden sandbox escape vectors for bash disabled/restricted modes ( #257 )
...
* harden sandbox escape vectors for bash disabled/restricted modes
block git config injection (-c flag as subcommand), dangerous subcommands
(config, submodule, rebase, bisect), code-executing arg flags (--exec,
--extcmd), .gitattributes/.gitmodules writes, and package lifecycle scripts.
add retry logic to test runner for transient failures. add security unit
tests and adhoc attack tests.
Co-authored-by: Cursor <cursoragent@cursor.com >
* only filter subcommands in nobash, remove nobash from ui
* use regex matching
* iterate on tests
* simplify githooks
---------
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-02-11 02:02:41 +00:00
f37d02b292
upgrade Claude to Opus 4.6 with effort levels ( #256 )
...
* upgrade Claude to Opus 4.6 with --effort max for --max mode
- mini: haiku → sonnet
- auto: opusplan → opus (Opus 4.6)
- max: opus → opus + --effort max (Opus 4.6 max effort)
- bump @anthropic-ai/claude-agent-sdk 0.2.7 → 0.2.39
Co-authored-by: Cursor <cursoragent@cursor.com >
* update action lockfile for claude-agent-sdk 0.2.39
Co-authored-by: Cursor <cursoragent@cursor.com >
* add tool_use_summary handler for SDK 0.2.39
Co-authored-by: Cursor <cursoragent@cursor.com >
* integrate gpt-5.3-codex with runtime model availability detection
checks GET /v1/models at agent start to determine if gpt-5.3-codex is
available for the API key, falling back to gpt-5.2-codex when it isn't.
model resolution runs concurrently with CLI install for zero added latency.
also bumps @openai/codex-sdk from 0.80.0 to 0.98.0.
Co-authored-by: Cursor <cursoragent@cursor.com >
---------
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-02-10 23:34:13 +00:00
19df8372cd
add file_read/file_write tools, sandbox tests, CI improvements ( #239 )
...
* migrate to flags
* init
* iterate on file write lockdown tests
* improve ci
* fix lockfile
* fix typecheck
* fix lint
* improve pushRestricted
* ok
* fix more
* ok
* remove process.env spreading rule
Co-authored-by: Cursor <cursoragent@cursor.com >
* enhanced fs rw tools
---------
Co-authored-by: Cursor <cursoragent@cursor.com >
Co-authored-by: Colin McDonnell <colinmcd94@gmail.com >
2026-02-10 06:35:47 +00:00
943409c417
add #timeout, macro errors, refactor tests ( #191 )
2026-01-28 21:06:57 +00:00
f77fecc2a0
Update
2026-01-28 07:47:52 +00:00
071e885d63
Add upload tool and related APIs ( #187 )
...
* Add utils for r2 upload
* Add the tool and new routes
* fix auth issue
* sign headers
* add comment
* use our own API key to auth signed uploads
* Restructure things slightly
* tweak
* tweak
* add comments
* tweak
* revert a thing
* twaek
* drop mime type filtering
* new incarnation of mime type filtering
* jsut allow all octet-streams
* simplify further
* tweak
* update lockfile
---------
Co-authored-by: Colin McDonnell <colinmcd94@gmail.com >
2026-01-28 05:34:58 +00:00
d545a84027
0.0.159
2026-01-25 22:30:34 +00:00
9a8db3e07c
add restricted tests, refactor test infrastructure ( #150 )
2026-01-22 21:06:19 +00:00
41fb0e78be
remove duplicate
2026-01-22 06:17:13 +00:00
57895ae342
Update lock
2026-01-22 06:15:49 +00:00
cfd7f45db9
fix: Update lock file in the action dir due to #118 .
2026-01-20 06:47:27 +00:00
8f6912deda
Fix macros
2026-01-19 21:42:23 +00:00
f34379415e
add per-agent smoke tests ( #100 )
2026-01-16 08:00:16 +00:00
1daf1571cf
add macros ( #68 )
2026-01-14 22:52:54 +00:00
3fa309853b
Fix repo slug
2026-01-14 01:44:30 +00:00
5604cf1868
Clean up submodule stuff
2026-01-13 22:05:24 +00:00
900cf49871
fix(deps): Upgrading esbuild to 0.27.2 (deduplication).
2026-01-13 13:30:10 +01:00
b2735b2916
0.0.157
2026-01-13 06:09:13 +00:00
c89f1b9537
Establishing unit tests using vitest.
2026-01-12 15:05:30 +01:00
78c22085bf
0.0.156
2026-01-08 15:05:05 -08:00
879d33403c
Switch to custom Bash tool. Mask secrets from Bashsubprocs. Simplify security handling.
2026-01-08 14:09:08 -08:00
ff913feb3c
Upgrading fastmcp ad claude-agent-sdk for using Zod 4.
2026-01-08 13:29:19 +01:00
a483711fee
Auto-retry ratelimited octokit requests
2026-01-07 17:17:20 +01:00
0a7a38a9a5
155
2025-12-22 18:45:43 -08:00
17ad3bd0e7
0.0.154
2025-12-22 14:55:32 -08:00
25896559f0
Switch back to one-shot reviews
2025-12-22 14:55:19 -08:00
5353d80388
Retries on oidc. 152
2025-12-22 14:33:18 -08:00
04c695038f
151
2025-12-22 13:57:51 -08:00
e9a585ce47
Improve debug logging for reviews. v0.0.150
2025-12-22 13:50:39 -08:00
6d572f3ce8
0.0.149
2025-12-21 22:42:58 -08:00
b33deb1b5a
fix thumbs up message, sleep prompting
2025-12-19 16:54:13 -05:00
bd8fc8abdf
bump version
2025-12-17 18:00:52 -05:00
90ed2648be
refactor main
2025-12-17 16:28:17 -05:00
d074ece31b
iterate on prep
2025-12-16 17:47:37 -05:00
853746ba65
Clean up fork setup
2025-12-16 00:15:57 -08:00
efb4ad186f
Improve remote tracking
2025-12-15 23:56:47 -08:00
c2cedce1bc
0.0.142
2025-12-15 23:38:46 -08:00
b833cdd4af
0.0.141
2025-12-15 23:22:30 -08:00
333ad29965
0.0.140
2025-12-15 23:04:52 -08:00
b038fc574f
Get reviews with comments
2025-12-15 21:37:46 -08:00
316b6cb83c
0.0.138
2025-12-15 21:21:57 -08:00
David Blass