delegation-layer 0.1.16 → 0.1.18

package/README.md

@@ -31,14 +31,56 @@ already use instead of replacing them.
 
 ## How it works
 
-1. Install the Agent Skill so your harness knows how to use Delegation Layer.
+1. Install the plugin so the skill and self-contained CLI are available together.
 2. The lead agent discovers the available provider capabilities.
 3. Delegation Layer admits one bounded provider turn through the supervisor.
 4. The lead agent collects the sealed result and evidence.
 
+## Ask naturally
+
+Try “Ask Codex to review this change”, “Get Antigravity’s opinion”, or
+“Have Claude investigate this failure”. The skill routes external collaboration
+through `delegate`, preserves a named destination, and collects task evidence.
+Ordinary native subagents remain available for work inside the current harness,
+even when you name that harness. Ask for a separate session when you want
+Delegate to launch another instance of the same CLI.
+
+Skill installation makes this workflow discoverable; it does not force a model
+to choose it over another plugin. Selection depends on the harness, model, and
+loaded instructions. No user rules, settings, or competing plugins are rewritten.
+If an agent bypasses Delegate, that is a selection failure, not proof the
+integration worked.
+
 ## Install
 
-### Install the Agent Skill
+### Recommended for Codex and Claude Code
+
+Install the plugin from this repository. It installs the provider-neutral skill
+and runs a trusted session-start bootstrap that reuses the checksum-verified
+Delegation Layer release installer when `delegate` is missing. The bootstrap
+installs the CLI and its bundled supervisor; it does not install provider CLIs,
+change provider authentication, or change provider configuration.
+
+For Codex:
+
+```sh
+codex plugin marketplace add hishamkaram/delegation-layer
+codex plugin add delegation-layer@delegation-layer
+```
+
+For Claude Code:
+
+```sh
+claude plugin marketplace add hishamkaram/delegation-layer
+claude plugin install delegation-layer@delegation-layer
+```
+
+Start a new harness session after installation. Plugin hooks require the
+harness trust review before they run. If the bootstrap reports that the
+install directory is not on `PATH`, add the reported directory to `PATH` and
+start a new session; the skill never falls back to a provider-native CLI.
+
+### Install the Agent Skill only
 
 The standard Agent Skills installer works across popular coding agents. From
 the project where you want the skill available, run:
@@ -68,8 +110,9 @@ npx --yes delegation-layer install \
   --yes
 ```
 
-The skill installer only installs guidance for your agent. It does not install
-the CLI, change provider logins, or run a task.
+This path installs guidance only. It does not install the CLI, change provider
+logins, or run a task. Use the plugin path above when you want the skill and
+CLI bootstrap together.
 
 ### Install the CLI
 

package/install.sh

@@ -10,13 +10,18 @@ fail() {
   exit 1
 }
 
-for command_name in awk curl grep install mktemp tar uname; do
+for command_name in awk curl grep install mkdir mktemp mv rm tar uname; do
   command -v "$command_name" >/dev/null 2>&1 || fail "required command not found: $command_name"
 done
 
+case "$INSTALL_DIR" in
+  /*) ;;
+  *) fail "install directory must be an absolute path: $INSTALL_DIR" ;;
+esac
+
 if [ "$REQUESTED_VERSION" = "latest" ]; then
   latest_url="https://github.com/${REPOSITORY}/releases/latest"
-  resolved_url="$(curl -fsSL -o /dev/null -w '%{url_effective}' "$latest_url")" || fail "could not resolve the latest release"
+  resolved_url="$(curl -fsSL --connect-timeout 5 --max-time 20 --retry 2 --retry-delay 1 --retry-max-time 30 -o /dev/null -w '%{url_effective}' "$latest_url")" || fail "could not resolve the latest release"
   VERSION="${resolved_url##*/}"
 else
   VERSION="$REQUESTED_VERSION"
@@ -44,11 +49,21 @@ esac
 ARCHIVE="delegation-layer_${VERSION#v}_${OS}_${ARCH}.tar.gz"
 RELEASE_URL="https://github.com/${REPOSITORY}/releases/download/${VERSION}"
 TEMP_DIR="$(mktemp -d)"
-trap 'rm -rf "$TEMP_DIR"' EXIT
+STAGE_DIR=""
 
-curl -fsSL --retry 3 -o "$TEMP_DIR/$ARCHIVE" "$RELEASE_URL/$ARCHIVE" || \
+cleanup() {
+  status=$?
+  trap - EXIT HUP INT TERM
+  set +e
+  [ -z "$STAGE_DIR" ] || rm -rf "$STAGE_DIR"
+  rm -rf "$TEMP_DIR"
+  exit "$status"
+}
+trap cleanup EXIT HUP INT TERM
+
+curl -fsSL --connect-timeout 5 --max-time 20 --retry 2 --retry-delay 1 --retry-max-time 30 -o "$TEMP_DIR/$ARCHIVE" "$RELEASE_URL/$ARCHIVE" || \
   fail "could not download $ARCHIVE"
-curl -fsSL --retry 3 -o "$TEMP_DIR/checksums.txt" "$RELEASE_URL/checksums.txt" || \
+curl -fsSL --connect-timeout 5 --max-time 20 --retry 2 --retry-delay 1 --retry-max-time 30 -o "$TEMP_DIR/checksums.txt" "$RELEASE_URL/checksums.txt" || \
   fail "could not download checksums.txt"
 
 CHECKSUM_LINE="$(awk -v archive="$ARCHIVE" '$2 == archive { print; exit }' "$TEMP_DIR/checksums.txt")"
@@ -65,10 +80,26 @@ fi
 
 tar -xzf "$ARCHIVE" -C "$TEMP_DIR" || fail "could not extract $ARCHIVE"
 mkdir -p "$INSTALL_DIR"
+STAGE_DIR="$(mktemp -d "$INSTALL_DIR/.delegation-layer-stage.XXXXXX")" || \
+  fail "could not create an installation staging directory"
 for binary in delegate delegate-run pueue pueued; do
   [ -f "$TEMP_DIR/$binary" ] || fail "release archive does not contain $binary"
-  install -m 0755 "$TEMP_DIR/$binary" "$INSTALL_DIR/$binary"
+  install -m 0755 "$TEMP_DIR/$binary" "$STAGE_DIR/$binary" || \
+    fail "could not stage $binary"
+done
+
+for binary in delegate delegate-run pueue pueued; do
+  [ -x "$STAGE_DIR/$binary" ] || fail "staged release bundle does not contain executable $binary"
+done
+
+# Rename staged files only after the complete bundle has been downloaded,
+# verified, extracted, and checked. Keep delegate last so a fresh install never
+# exposes the control command before its runner and supervisor are ready.
+for binary in delegate-run pueue pueued delegate; do
+  mv "$STAGE_DIR/$binary" "$INSTALL_DIR/$binary" || fail "could not publish $binary"
 done
+rm -rf "$STAGE_DIR"
+STAGE_DIR=""
 
 printf 'Installed delegation-layer CLI and bundled supervisor %s in %s\n' "$VERSION" "$INSTALL_DIR"
 case ":${PATH:-}:" in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "delegation-layer",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "description": "Multi-provider AI agent delegation CLI and Agent Skill for running bounded coding tasks across provider CLIs.",
   "keywords": [
     "ai-agents",
@@ -25,6 +25,7 @@
     "docs/assets/delegation-layer-hero.jpg",
     "install.sh",
     "skills/agent-integration/",
+    "plugins/delegation-layer/",
     "scripts/install-agent-integration.mjs",
     "scripts/install-cli.mjs"
   ],

package/plugins/delegation-layer/.claude-plugin/plugin.json

@@ -0,0 +1,22 @@
+{
+  "name": "delegation-layer",
+  "displayName": "Delegation Layer",
+  "version": "0.1.18",
+  "description": "Consult external AI harnesses for reviews, research, implementation, and debate through the bounded, resumable Delegate CLI.",
+  "author": {
+    "name": "Hesham Karam",
+    "url": "https://github.com/hishamkaram"
+  },
+  "homepage": "https://github.com/hishamkaram/delegation-layer",
+  "repository": "https://github.com/hishamkaram/delegation-layer",
+  "license": "MIT",
+  "keywords": [
+    "agent-delegation",
+    "agent-skills",
+    "coding-agents",
+    "orchestration",
+    "task-lifecycle"
+  ],
+  "defaultEnabled": true,
+  "skills": "./skills/"
+}

package/plugins/delegation-layer/.codex-plugin/plugin.json

@@ -0,0 +1,33 @@
+{
+  "name": "delegation-layer",
+  "version": "0.1.18",
+  "description": "Consult external AI harnesses for reviews, research, implementation, and debate through the bounded, resumable Delegate CLI.",
+  "author": {
+    "name": "Hesham Karam",
+    "url": "https://github.com/hishamkaram"
+  },
+  "homepage": "https://github.com/hishamkaram/delegation-layer",
+  "repository": "https://github.com/hishamkaram/delegation-layer",
+  "license": "MIT",
+  "keywords": [
+    "agent-delegation",
+    "agent-skills",
+    "coding-agents",
+    "orchestration",
+    "task-lifecycle"
+  ],
+  "skills": "./skills/",
+  "interface": {
+    "displayName": "Delegation Layer",
+    "shortDescription": "Consult external AI harnesses",
+    "longDescription": "Routes external agent work through a bounded, resumable CLI with durable evidence and provider-neutral capability handling.",
+    "developerName": "Hesham Karam",
+    "category": "Productivity",
+    "capabilities": [
+      "Agent delegation",
+      "Bounded execution",
+      "Resumable tasks"
+    ],
+    "defaultPrompt": "Use $agent-integration to consult another harness or model for review, research, implementation, testing, or debate."
+  }
+}

package/plugins/delegation-layer/hooks/hooks.json

@@ -0,0 +1,14 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "/bin/sh -c 'plugin_root=\"${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:?plugin root environment variable is missing}}\"; exec \"$plugin_root/scripts/ensure-delegate.sh\"'"
+          }
+        ]
+      }
+    ]
+  }
+}

package/plugins/delegation-layer/scripts/ensure-delegate.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env sh
+set -eu
+
+fail() {
+  printf 'delegation-layer plugin: %s\n' "$1" >&2
+  exit 1
+}
+
+plugin_root="${PLUGIN_ROOT:-${CLAUDE_PLUGIN_ROOT:-}}"
+[ -n "$plugin_root" ] || fail 'the plugin root environment variable is missing'
+
+installer="$plugin_root/scripts/install-cli.sh"
+[ -x "$installer" ] || fail "the bundled CLI installer is missing: $installer"
+
+resolve_command_path() {
+  path="$1"
+  case "$path" in
+    /*) ;;
+    *) path="$(cd -P "$(dirname "$path")" 2>/dev/null && pwd)/$(basename "$path")" || return 1 ;;
+  esac
+  while [ -L "$path" ]; do
+    link="$(readlink "$path")" || return 1
+    case "$link" in
+      /*) path="$link" ;;
+      *) path="$(dirname "$path")/$link" ;;
+    esac
+  done
+  path="$(cd -P "$(dirname "$path")" 2>/dev/null && pwd)/$(basename "$path")" || return 1
+  printf '%s\n' "$path"
+}
+
+valid_delegate() {
+  candidate="$1"
+  [ -f "$candidate" ] && [ -x "$candidate" ] || return 1
+  resolved_candidate="$(resolve_command_path "$candidate")" || return 1
+  resolved_bin_dir="$(dirname "$resolved_candidate")"
+  supervisor_dir="$resolved_bin_dir"
+  if [ ! -x "$supervisor_dir/pueue" ] || [ ! -x "$supervisor_dir/pueued" ]; then
+    supervisor_dir="$resolved_bin_dir/../libexec"
+  fi
+  delegate_run="$resolved_bin_dir/delegate-run"
+  pueue="$supervisor_dir/pueue"
+  pueued="$supervisor_dir/pueued"
+  [ -f "$delegate_run" ] && [ -x "$delegate_run" ] || return 1
+  [ -f "$pueue" ] && [ -x "$pueue" ] || return 1
+  [ -f "$pueued" ] && [ -x "$pueued" ] || return 1
+
+  delegate_version="$("$candidate" --version 2>/dev/null)" || return 1
+  case "$delegate_version" in
+    delegate\ *) ;;
+    *) return 1 ;;
+  esac
+  pueue_version="$("$pueue" --version 2>/dev/null)" || return 1
+  pueued_version="$("$pueued" --version 2>/dev/null)" || return 1
+  case "$pueue_version" in
+    pueue\ *) ;;
+    *) return 1 ;;
+  esac
+  case "$pueued_version" in
+    pueued\ *) ;;
+    *) return 1 ;;
+  esac
+  pueue_release="$(printf '%s\n' "$pueue_version" | awk 'NF { print $NF; exit }')"
+  pueued_release="$(printf '%s\n' "$pueued_version" | awk 'NF { print $NF; exit }')"
+  [ -n "$pueue_release" ] && [ "$pueue_release" = "$pueued_release" ]
+}
+
+path_points_to() {
+  expected="$1"
+  actual="$(command -v delegate 2>/dev/null || true)"
+  [ -n "$actual" ] || return 1
+  actual="$(resolve_command_path "$actual")" || return 1
+  expected="$(resolve_command_path "$expected")" || return 1
+  [ "$actual" = "$expected" ]
+}
+
+path_delegate="$(command -v delegate 2>/dev/null || true)"
+if [ -n "$path_delegate" ] && valid_delegate "$path_delegate"; then
+  exit 0
+fi
+
+existing_install_dir="${DELEGATION_LAYER_INSTALL_DIR:-$HOME/.local/bin}"
+existing_delegate="$existing_install_dir/delegate"
+if valid_delegate "$existing_delegate"; then
+  case ":${PATH:-}:" in
+    *:"$existing_install_dir":*)
+      path_points_to "$existing_delegate" && exit 0
+      shadowed_delegate="$(command -v delegate 2>/dev/null || true)"
+      fail "delegate is installed at $existing_install_dir but PATH resolves delegate to ${shadowed_delegate:-an unavailable command}; put $existing_install_dir before the shadowing entry and start a new harness session"
+      ;;
+    *)
+      fail "delegate is installed at $existing_install_dir but that directory is not on PATH; add it to PATH and start a new harness session"
+      ;;
+  esac
+fi
+
+install_dir="$existing_install_dir"
+case "$install_dir" in
+  /*) ;;
+  *) fail "the CLI install directory must be an absolute path: $install_dir" ;;
+esac
+
+if [ -e "$install_dir/delegate" ] || [ -L "$install_dir/delegate" ]; then
+  fail "refusing to overwrite an existing delegate at $install_dir/delegate; put a clean directory first in PATH or set DELEGATION_LAYER_INSTALL_DIR to a dedicated directory"
+fi
+
+DELEGATION_LAYER_INSTALL_DIR="$install_dir" sh "$installer" ||
+  fail 'the checksum-verified CLI installation failed'
+
+installed_delegate="$install_dir/delegate"
+valid_delegate "$installed_delegate" ||
+  fail "the installer completed but delegate is not usable at $installed_delegate"
+
+if path_points_to "$installed_delegate"; then
+  printf 'Delegation Layer CLI is ready at %s\n' "$installed_delegate"
+  exit 0
+fi
+
+path_delegate="$(command -v delegate 2>/dev/null || true)"
+if [ -n "$path_delegate" ]; then
+  fail "delegate was installed at $install_dir but PATH resolves delegate to $path_delegate; put $install_dir before the shadowing entry and start a new harness session"
+fi
+fail "delegate was installed at $install_dir but that directory is not on PATH; add it to PATH and start a new harness session"

package/plugins/delegation-layer/scripts/install-cli.sh

@@ -0,0 +1,108 @@
+#!/usr/bin/env sh
+set -eu
+
+REPOSITORY="hishamkaram/delegation-layer"
+REQUESTED_VERSION="${DELEGATION_LAYER_VERSION:-latest}"
+INSTALL_DIR="${DELEGATION_LAYER_INSTALL_DIR:-$HOME/.local/bin}"
+
+fail() {
+  printf 'delegation-layer: %s\n' "$1" >&2
+  exit 1
+}
+
+for command_name in awk curl grep install mkdir mktemp mv rm tar uname; do
+  command -v "$command_name" >/dev/null 2>&1 || fail "required command not found: $command_name"
+done
+
+case "$INSTALL_DIR" in
+  /*) ;;
+  *) fail "install directory must be an absolute path: $INSTALL_DIR" ;;
+esac
+
+if [ "$REQUESTED_VERSION" = "latest" ]; then
+  latest_url="https://github.com/${REPOSITORY}/releases/latest"
+  resolved_url="$(curl -fsSL --connect-timeout 5 --max-time 20 --retry 2 --retry-delay 1 --retry-max-time 30 -o /dev/null -w '%{url_effective}' "$latest_url")" || fail "could not resolve the latest release"
+  VERSION="${resolved_url##*/}"
+else
+  VERSION="$REQUESTED_VERSION"
+  case "$VERSION" in
+    v*) ;;
+    *) VERSION="v${VERSION}" ;;
+  esac
+fi
+
+printf '%s\n' "$VERSION" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$' || \
+  fail "invalid version: $VERSION"
+
+case "$(uname -s)" in
+  Linux) OS=Linux ;;
+  Darwin) OS=Darwin ;;
+  *) fail "unsupported operating system: $(uname -s)" ;;
+esac
+
+case "$(uname -m)" in
+  x86_64|amd64) ARCH=amd64 ;;
+  arm64|aarch64) ARCH=arm64 ;;
+  *) fail "unsupported architecture: $(uname -m)" ;;
+esac
+
+ARCHIVE="delegation-layer_${VERSION#v}_${OS}_${ARCH}.tar.gz"
+RELEASE_URL="https://github.com/${REPOSITORY}/releases/download/${VERSION}"
+TEMP_DIR="$(mktemp -d)"
+STAGE_DIR=""
+
+cleanup() {
+  status=$?
+  trap - EXIT HUP INT TERM
+  set +e
+  [ -z "$STAGE_DIR" ] || rm -rf "$STAGE_DIR"
+  rm -rf "$TEMP_DIR"
+  exit "$status"
+}
+trap cleanup EXIT HUP INT TERM
+
+curl -fsSL --connect-timeout 5 --max-time 20 --retry 2 --retry-delay 1 --retry-max-time 30 -o "$TEMP_DIR/$ARCHIVE" "$RELEASE_URL/$ARCHIVE" || \
+  fail "could not download $ARCHIVE"
+curl -fsSL --connect-timeout 5 --max-time 20 --retry 2 --retry-delay 1 --retry-max-time 30 -o "$TEMP_DIR/checksums.txt" "$RELEASE_URL/checksums.txt" || \
+  fail "could not download checksums.txt"
+
+CHECKSUM_LINE="$(awk -v archive="$ARCHIVE" '$2 == archive { print; exit }' "$TEMP_DIR/checksums.txt")"
+[ -n "$CHECKSUM_LINE" ] || fail "checksums.txt does not contain $ARCHIVE"
+
+cd "$TEMP_DIR"
+if command -v sha256sum >/dev/null 2>&1; then
+  printf '%s\n' "$CHECKSUM_LINE" | sha256sum -c - || fail "checksum verification failed"
+elif command -v shasum >/dev/null 2>&1; then
+  printf '%s\n' "$CHECKSUM_LINE" | shasum -a 256 -c - || fail "checksum verification failed"
+else
+  fail "sha256sum or shasum is required for checksum verification"
+fi
+
+tar -xzf "$ARCHIVE" -C "$TEMP_DIR" || fail "could not extract $ARCHIVE"
+mkdir -p "$INSTALL_DIR"
+STAGE_DIR="$(mktemp -d "$INSTALL_DIR/.delegation-layer-stage.XXXXXX")" || \
+  fail "could not create an installation staging directory"
+for binary in delegate delegate-run pueue pueued; do
+  [ -f "$TEMP_DIR/$binary" ] || fail "release archive does not contain $binary"
+  install -m 0755 "$TEMP_DIR/$binary" "$STAGE_DIR/$binary" || \
+    fail "could not stage $binary"
+done
+
+for binary in delegate delegate-run pueue pueued; do
+  [ -x "$STAGE_DIR/$binary" ] || fail "staged release bundle does not contain executable $binary"
+done
+
+# Rename staged files only after the complete bundle has been downloaded,
+# verified, extracted, and checked. Keep delegate last so a fresh install never
+# exposes the control command before its runner and supervisor are ready.
+for binary in delegate-run pueue pueued delegate; do
+  mv "$STAGE_DIR/$binary" "$INSTALL_DIR/$binary" || fail "could not publish $binary"
+done
+rm -rf "$STAGE_DIR"
+STAGE_DIR=""
+
+printf 'Installed delegation-layer CLI and bundled supervisor %s in %s\n' "$VERSION" "$INSTALL_DIR"
+case ":${PATH:-}:" in
+  *:"$INSTALL_DIR":*) ;;
+  *) printf 'Add %s to PATH if it is not already there.\n' "$INSTALL_DIR" ;;
+esac