pullfrog 0.1.29 → 0.1.31

package/dist/agents/claudePretoolGate.d.ts

@@ -39,7 +39,11 @@
  * `#!/usr/bin/env node` shebang and the executable bit set by the harness.
  */
 export declare const CLAUDE_PRETOOL_GATE_FILENAME: "pullfrog-pretool-gate.mjs";
-export declare const CLAUDE_PRETOOL_GATE_SOURCE: string;
+/**
+ * Build the gate script source, embedding the run's derived denied-tool set
+ * (see `subagentDeniedToolNames` in action/agents/subagentToolGates.ts).
+ */
+export declare function buildClaudePretoolGateSource(deniedTools: readonly string[]): string;
 /**
  * Settings JSON shape registered via `claude --settings <path>`. The
  * matcher `^mcp__pullfrog__` is treated as a regex by claude-code's

package/dist/agents/opencodePlugin.d.ts

@@ -31,7 +31,7 @@
  *
  * The subagent gate (the `tool.execute.before` hook that hard-blocks
  * state-mutating MCP tool calls from a subagent session) lives in a SEPARATE
- * plugin — `PULLFROG_OPENCODE_GATE_PLUGIN_SOURCE` below — because it's the
+ * plugin — `buildOpencodeSubagentGateSource` below — because it's the
  * load-bearing security fence and must ship into both opencode harnesses,
  * whereas this events re-emitter is only needed by the legacy `opencode.ts`
  * CLI-parsing path (the active `opencode_v2.ts` reads subagent events directly
@@ -82,4 +82,4 @@ export declare const PULLFROG_OPENCODE_PLUGIN_SOURCE: string;
  * PR #796 (action/mcp/checkout.ts, action/mcp/git.ts). Deny-list source of
  * truth: `action/agents/subagentToolGates.ts`.
  */
-export declare const PULLFROG_OPENCODE_GATE_PLUGIN_SOURCE: string;
+export declare function buildOpencodeSubagentGateSource(deniedTools: readonly string[]): string;

package/dist/agents/postRun.d.ts

@@ -67,39 +67,16 @@ export declare function finalizeAgentResult<R extends AgentResult>(params: {
     ctx: AgentRunContext;
     result: R;
 }): Promise<R>;
-export declare function shouldRunReflection(mode: string | undefined): boolean;
 /**
- * prompt for a dedicated post-run reflection turn nudging the agent to edit
- * the rolling learnings file if it discovered anything worth persisting.
- *
- * this exists because passive "if you learned something, write it down"
- * instructions baked into mode checklists are frequently ignored — the agent
- * stays focused on the task and the meta-ask falls through. delivering it
- * as its own resume turn, with nothing competing for attention, raises the
- * fire rate substantially.
- *
- * the file is the single source of truth — there is no separate MCP tool
- * call. the server reads the file at end-of-run and persists any edits to
- * `Repo.learnings`.
- *
- * the prompt copy is shaped by repo-wide audits of the actual content the
- * agent has been writing (issue #619 in pullfrog/app). recurring failure
- * modes the framing pushes back on:
- *  - massive multi-paragraph "bullets" that are really mini-articles
- *  - facts anchored to moving repo state (PR / review / commit / branch
- *    refs, dates, version pins, line numbers) that decay within weeks
- *  - sections growing into giant flat lists with no internal structure,
- *    forcing future runs to read kilobytes to find one fact
- *
- * single litmus delivered in the prompt: "would a future run on this repo
- * do its work better because this bullet exists?". tool-quirk workarounds
- * are explicitly allowed when the agent burned calls discovering the
- * quirk this run — recording the workaround prevents next run from
- * repeating the waste. tradeoff: the same quirk gets duplicated across
- * repos, so when a quirk is fixed upstream in tool descriptions the
- * per-repo bullets go stale and we have no batch-invalidation path.
+ * the combined post-run reflection nudge for a run: the repo-level learnings
+ * reflection, plus the org-level cross-repo reflection when this is an --xrepo
+ * run. each half is gated on its own seeded file — the two seeds are
+ * independent best-effort steps in main.ts, so a failed repo-learnings seed
+ * must not also suppress an org-level cross-repo reflection that did seed.
+ * returns undefined when reflection should be skipped (neither file seeded, or
+ * a reflection-skip mode like IncrementalReview).
  */
-export declare function buildLearningsReflectionPrompt(filePath: string): string;
+export declare function buildReflectionPrompt(toolState: ToolState): string | undefined;
 /**
  * shared post-run retry loop used by every agent harness.
  *

package/dist/agents/shared.d.ts

@@ -92,6 +92,12 @@ export interface AgentRunContext {
     tmpdir: string;
     /** harness-owned secret paths that agent filesystem tools must never read. */
     secretDenyPaths?: string[] | undefined;
+    /**
+     * canonical bare names of state-mutating MCP tools the subagent gate must
+     * deny (derived from each tool's `mutates` flag). embedded into the per-run
+     * gate scripts. see action/agents/subagentToolGates.ts.
+     */
+    subagentDeniedTools: readonly string[];
     instructions: ResolvedInstructions;
     todoTracker?: TodoTracker | undefined;
     /**

package/dist/agents/subagentToolGates.d.ts

@@ -1,5 +1,6 @@
 /**
- * Single source of truth for MCP tools subagents are forbidden from calling.
+ * Single source of truth for which MCP tools subagents are forbidden from
+ * calling — derived from each tool's `mutates` flag, not a hand-maintained list.
  *
  * Subagents share the orchestrator's in-process git working tree, `toolState`,
  * progress comment, and run-scoped pr/branch context. A subagent that calls
@@ -8,48 +9,29 @@
  * `zed-industries/cloud` incident hit exactly this: a `reviewfrog` lens
  * dispatched `checkout_pr({2582})` mid-review, the orchestrator's next push
  * clobbered an unrelated engineer's branch. PR #796 added runtime backstops
- * inside `checkout_pr`/`push_branch`; this list is the upstream gate that
- * stops the call from ever reaching MCP when it originates from a subagent.
+ * inside `checkout_pr`/`push_branch`; this gate stops the call from ever
+ * reaching MCP when it originates from a subagent.
  *
- * The gate is enforced at two pre-tool hooks:
+ * The denied set is whatever the run actually registers with `mutates: true`
+ * (see `action/mcp/shared.ts`). To deny a new state-changing MCP tool to
+ * subagents, mark it `mutates: true` at its definition — nothing to add here.
+ * Read-only tools (`get_*`, `list_*`, `git_fetch`, …) and the general-purpose
+ * `git`/`shell` execution tools are intentionally unmarked: denying them would
+ * make review impossible, and their mutations are gated by command-arg
+ * validation plus the reviewer system prompt (`action/agents/reviewer.ts`).
+ *
+ * The gate is enforced at two pre-tool hooks, each fed this derived list:
  *   - opencode: `tool.execute.before` (action/agents/opencodePlugin.ts)
  *   - claude:   `PreToolUse` settings hook (action/agents/claudePretoolGate.ts)
- *
- * Names are stored in their canonical bare form (the FastMCP tool `name`
- * field). Each runtime presents them with a different prefix:
- *   - claude:   `mcp__pullfrog__<name>`
- *   - opencode: `pullfrog_<name>`
- * The hooks strip those prefixes before comparing.
- *
- * Read-only MCP tools (`get_*`, `list_*`, `git_fetch`, `get_check_suite_logs`,
- * `await_dependency_installation`, etc.) and the `git`/`shell` tools stay off
- * this list — denying them would make review work impossible. The reviewer system prompt
- * (`action/agents/reviewer.ts`) already forbids state-changing shell/git
- * subcommands as a prose constraint; this list is the belt-and-suspenders
- * machine fence for the high-stakes mutations we can identify by name alone.
- *
- * When adding a state-changing MCP tool to `action/mcp/server.ts`, add its
- * canonical name here too. Inclusions justified inline.
- */
-export declare const SUBAGENT_DENIED_TOOLS: readonly ["checkout_pr", "push_branch", "push_tags", "delete_branch", "create_pull_request", "update_pull_request_body", "create_issue", "create_issue_comment", "edit_issue_comment", "reply_to_review_comment", "create_pull_request_review", "resolve_review_thread", "add_labels", "set_output", "report_progress", "select_mode", "start_dependency_installation", "kill_background", "upload_file"];
-export type SubagentDeniedTool = (typeof SUBAGENT_DENIED_TOOLS)[number];
-/**
- * Strip the runtime-specific MCP prefix from a tool name and return the
- * canonical bare name (matching FastMCP's `name:` field). Returns the input
- * unchanged if it doesn't carry a known prefix — keeping comparison simple
- * for native (non-MCP) tools, which never appear on the deny list anyway.
- */
-export declare function stripMcpPrefix(toolName: string): string;
-/**
- * Whether `toolName` (in any runtime's prefix style) names a tool that
- * subagents must not call.
+ * Names are the canonical bare form (the FastMCP tool `name`). Each runtime
+ * presents them with a different prefix (`mcp__pullfrog__<name>` for claude,
+ * `pullfrog_<name>` for opencode); the hooks strip the prefix before comparing.
  */
-export declare function isSubagentDeniedTool(toolName: string): boolean;
+import { type ToolContext } from "../mcp/server.ts";
 /**
- * Human-readable refusal surfaced to the model when a denied tool is gated.
- * Phrased so a halfway-attentive subagent realises (a) the tool is denied to
- * it specifically, (b) why (shared in-process state with the orchestrator),
- * and (c) what to do instead (report findings; the orchestrator can call the
- * tool directly).
+ * Canonical bare names of every state-mutating MCP tool registered for this
+ * run — the set subagents are denied. Derived from the `mutates` flag so it can
+ * never silently drift from the registered tool set. Throws if it derives empty
+ * (a sign the flag plumbing broke) rather than starting with the gate disabled.
  */
-export declare function buildSubagentDenyMessage(toolName: string): string;
+export declare function subagentDeniedToolNames(ctx: ToolContext, outputSchema?: Record<string, unknown>): string[];