cfd38d82fc
refactor delegation system, add PR summary comments, and improve code quality ( #334 )
...
* refactor delegation system and add PR summary comments
Delegation system:
- replace mode-based delegation with select_mode → delegate two-step flow
- orchestrator crafts self-contained subagent prompts (clean context — no system/repo/event instructions leak)
- add role-based tool filtering via FastMCP authenticate hook (?role=subagent hides orchestrator-only tools)
- add select_mode tool for orchestrator guidance per mode
- add ask_question tool for lightweight research subagents
- extract shared subagent lifecycle into subagent.ts (create, complete, stdout, instructions)
- route set_output to per-subagent state when activeSubagentId is set
- track per-subagent state (SubagentState Map) replacing boolean delegationActive flag
- capture and aggregate AgentUsage across all agents (claude, codex, gemini, opencode)
- write usage summary table to GitHub job summary
- block built-in subagent spawning (Task for Claude, Task(*) for Cursor)
- increase activity timeout from 60s to 300s (subagent thinking phases)
- fix gh CLI misguidance in system prompt — explicitly forbid usage
PR summary comments:
- add prSummaryComment trigger (DB schema + migrations + Zod + UI toggle)
- dispatch mini-effort summary job alongside PR review on pr.created
- add update_pull_request_body MCP tool
- add defaultEffort option to webhook dispatch
Hardening:
- rewrite delegate/selectMode tests with simulated state management
- add toolFiltering.test.ts for role extraction, canAccess, set_output routing
- remove non-null assertions for PULLFROG_TEMP_DIR (proper error throws)
- use fetchWithRetry for direct tarball downloads
- DRY fix for rate limit check in test runner
Co-authored-by: Cursor <cursoragent@cursor.com >
* fix: add type keyword to Effort import in handleWebhook.ts
Co-authored-by: Cursor <cursoragent@cursor.com >
* clean up delegation system, improve code quality across the codebase
- simplify delegate tool to instructions + effort params with subagent lifecycle in subagent.ts
- add select_mode and ask_question orchestrator-only tools with canAccess filtering
- replace delegate.test.ts/selectMode.test.ts with toolFiltering.test.ts (live MCP integration)
- add set_output routing for subagent context and AgentUsage tracking across all agents
- add PR summary comment trigger (schema, UI, webhook dispatch with silent flag)
- add update_pull_request_body MCP tool
- fix changed-agents.sh to always include claude canary for non-agent action changes
- fix cursor pagination bug in getSelectedInstallationReposPage
- remove destructuring patterns, inline type definitions, and unsafe type casts
- replace non-null assertions with explicit checks in install.ts
- convert multi-param functions to single param objects (postCleanup, runActionLocal, etc.)
- use isHttpError helper in API routes instead of catch-any patterns
- add adhoc test fixtures for delegation scenarios (context isolation, error handling, synthesis, etc.)
Co-authored-by: Cursor <cursoragent@cursor.com >
* no subagent mutation, one mcp per subagent
* address review feedback: parallel-safe usage tracking, subagent isolation, minor improvements
* fix subagent state isolation: replace Object.freeze with shallow copy
Object.freeze throws TypeErrors when subagent tools (checkout_pr,
report_progress) write scalar properties to toolState. A shallow copy
achieves the same isolation for scalar fields while allowing tools to
work normally. Shared references (subagents Map, usageEntries array)
remain shared for coordination.
---------
Co-authored-by: Cursor <cursoragent@cursor.com >
Co-authored-by: pullfrog[bot] <226033991+pullfrog[bot]@users.noreply.github.com>
2026-02-22 14:12:43 +00:00
185ca7a832
Avoid using --ignore-workspace ( #353 )
2026-02-19 14:41:21 +00:00
510f2c96f9
Fix the availability of some @anthropic-ai/claude-agent-sdk types ( #322 )
...
* Fix the availability of some `@anthropic-ai/claude-agent-sdk` types
* update it in the action too
* fix types
2026-02-18 12:12:40 +00:00
bc28c658f2
harden sandbox escape vectors for bash disabled/restricted modes ( #257 )
...
* harden sandbox escape vectors for bash disabled/restricted modes
block git config injection (-c flag as subcommand), dangerous subcommands
(config, submodule, rebase, bisect), code-executing arg flags (--exec,
--extcmd), .gitattributes/.gitmodules writes, and package lifecycle scripts.
add retry logic to test runner for transient failures. add security unit
tests and adhoc attack tests.
Co-authored-by: Cursor <cursoragent@cursor.com >
* only filter subcommands in nobash, remove nobash from ui
* use regex matching
* iterate on tests
* simplify githooks
---------
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-02-11 02:02:41 +00:00
f37d02b292
upgrade Claude to Opus 4.6 with effort levels ( #256 )
...
* upgrade Claude to Opus 4.6 with --effort max for --max mode
- mini: haiku → sonnet
- auto: opusplan → opus (Opus 4.6)
- max: opus → opus + --effort max (Opus 4.6 max effort)
- bump @anthropic-ai/claude-agent-sdk 0.2.7 → 0.2.39
Co-authored-by: Cursor <cursoragent@cursor.com >
* update action lockfile for claude-agent-sdk 0.2.39
Co-authored-by: Cursor <cursoragent@cursor.com >
* add tool_use_summary handler for SDK 0.2.39
Co-authored-by: Cursor <cursoragent@cursor.com >
* integrate gpt-5.3-codex with runtime model availability detection
checks GET /v1/models at agent start to determine if gpt-5.3-codex is
available for the API key, falling back to gpt-5.2-codex when it isn't.
model resolution runs concurrently with CLI install for zero added latency.
also bumps @openai/codex-sdk from 0.80.0 to 0.98.0.
Co-authored-by: Cursor <cursoragent@cursor.com >
---------
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-02-10 23:34:13 +00:00
19df8372cd
add file_read/file_write tools, sandbox tests, CI improvements ( #239 )
...
* migrate to flags
* init
* iterate on file write lockdown tests
* improve ci
* fix lockfile
* fix typecheck
* fix lint
* improve pushRestricted
* ok
* fix more
* ok
* remove process.env spreading rule
Co-authored-by: Cursor <cursoragent@cursor.com >
* enhanced fs rw tools
---------
Co-authored-by: Cursor <cursoragent@cursor.com >
Co-authored-by: Colin McDonnell <colinmcd94@gmail.com >
2026-02-10 06:35:47 +00:00
f77fecc2a0
Update
2026-01-28 07:47:52 +00:00
071e885d63
Add upload tool and related APIs ( #187 )
...
* Add utils for r2 upload
* Add the tool and new routes
* fix auth issue
* sign headers
* add comment
* use our own API key to auth signed uploads
* Restructure things slightly
* tweak
* tweak
* add comments
* tweak
* revert a thing
* twaek
* drop mime type filtering
* new incarnation of mime type filtering
* jsut allow all octet-streams
* simplify further
* tweak
* update lockfile
---------
Co-authored-by: Colin McDonnell <colinmcd94@gmail.com >
2026-01-28 05:34:58 +00:00
57895ae342
Update lock
2026-01-22 06:15:49 +00:00
cfd7f45db9
fix: Update lock file in the action dir due to #118 .
2026-01-20 06:47:27 +00:00
1daf1571cf
add macros ( #68 )
2026-01-14 22:52:54 +00:00
5604cf1868
Clean up submodule stuff
2026-01-13 22:05:24 +00:00
900cf49871
fix(deps): Upgrading esbuild to 0.27.2 (deduplication).
2026-01-13 13:30:10 +01:00
c89f1b9537
Establishing unit tests using vitest.
2026-01-12 15:05:30 +01:00
ff913feb3c
Upgrading fastmcp ad claude-agent-sdk for using Zod 4.
2026-01-08 13:29:19 +01:00
a483711fee
Auto-retry ratelimited octokit requests
2026-01-07 17:17:20 +01:00
d074ece31b
iterate on prep
2025-12-16 17:47:37 -05:00
7959a51995
update deps
2025-12-11 15:08:10 -05:00
dcbac16663
Tweak
2025-12-10 15:02:15 -08:00
02ca5bbc71
improve missing api key logging
2025-12-05 14:57:48 -05:00
06a19567c0
Switch to payload
2025-11-18 23:15:44 -08:00
e90940e901
update lockfile from husky
2025-11-13 16:13:00 -05:00
b448787f24
update lock
2025-11-06 17:38:49 -05:00
acb06634be
rely primarily on inline pr feedback
2025-10-31 04:04:06 -04:00
434458a068
update lockfile
2025-10-31 01:07:36 -04:00
bb78e5f94b
update lockfile
2025-10-17 22:27:24 -04:00
7f1566d9c2
update lockfile
2025-10-15 17:25:54 -04:00
2c856e3337
remove husky
2025-10-13 17:04:59 -04:00
03810d574e
bump version
2025-10-13 14:14:52 -04:00
16e04e7152
bump version
2025-10-08 16:49:12 -04:00
d3d2dad025
no-frozen-lockfile
2025-10-08 16:46:52 -04:00
5c8b03a427
Lock
2025-09-10 00:56:50 -07:00
087709f4c7
Add lock
2025-09-09 16:55:45 -07:00
5fef548cee
Drop lock
2025-09-09 16:26:18 -07:00
9239b40372
Set up husky
2025-08-27 18:13:10 -07:00
3d47375b24
Update lockfile
2025-08-27 18:06:59 -07:00
f42dc28da8
chore: prepare action for v0.0.1 release
...
- Update action.yml to point to dist/index.js
- Add built distribution files
- Update package.json and build configuration
2025-08-27 17:47:25 -07:00
David Blass