pi-harness-delegate 0.4.1 → 0.6.0

package/extensions/index.ts

@@ -3,7 +3,7 @@
  *
  * Registers:
  *   - `delegate` tool (primary) + `claude_delegate` alias
- *   - `/delegate` command (primary) + `/claude`, `/codex`, `/opencode`, `/amp`, `/omp` aliases
+ *   - `/delegate` command (primary) + `/claude`, `/codex`, `/opencode`, `/amp`, `/omp`, `/devin` aliases
  *
  * Templates ship in ../templates/shared + ../templates/<harness>; users add custom ones in
  *   ~/.pi/agent/delegate/templates/<harness>/  (global)
@@ -29,6 +29,7 @@ import {
   truncateToWidth,
 } from '@earendil-works/pi-tui';
 import { Type } from 'typebox';
+import { acpView, runAcpHarness } from './acp-runner.ts';
 import {
   aggregateSpend,
   buildFanoutReport,
@@ -49,14 +50,26 @@ import {
   ToolCallIndex,
   type VerifyResult,
 } from './activity.ts';
-import { isFanoutSpec, parseDelegateCommand, resolveDefaults, resolveHarnessList } from './command.ts';
+import {
+  isFanoutSpec,
+  parseDelegateCommand,
+  resolveDefaults,
+  resolveHarnessFilter,
+  resolveHarnessList,
+} from './command.ts';
 import { acquireSlot, activeCount } from './concurrency.ts';
 import {
+  buildConfigReport,
   type DelegateConfig,
+  describeConfigSource,
+  getMaxConcurrent,
   outputsDir as getOutputsDir,
   legacyOutputsDir,
   loadConfig,
+  loadConfigWithSource,
   resolveModelForHarness,
+  resolveTransport,
+  writeDelegateConfig,
 } from './config.ts';
 import {
   ALIASES,
@@ -64,16 +77,16 @@ import {
   getHarness,
   HARNESS_NAMES,
   isKnownHarness,
+  isNativeDangerPermission,
   resolveHarnessName,
 } from './harnesses/registry.ts';
 import type { ActivityEvent, NormalizedPermission } from './harnesses/types.ts';
-
 import { delegationHint, stripMarker } from './hint.ts';
 import { NotifyBatcher } from './notify.ts';
 import { type FeedEntry, progressWindow } from './progress.ts';
 import { formatFanoutChip, multiProgressWindow, type RunRow } from './progress-multi.ts';
 import { runHarness } from './runner.ts';
-import { type DelegateTemplate, loadTemplates } from './templates.ts';
+import { type DelegateTemplate, loadTemplates, resolveNativePermission } from './templates.ts';
 import { mapClaudeUsage } from './usage.ts';
 
 /** Render a possibly-unknown cost — `null` means the harness didn't report one, not a measured $0. */
@@ -119,8 +132,9 @@ const FANOUT_LINGER_MS = 3000;
  * callers must not let this flip a run's `isError`.
  *
  * Trust model: a verify command can only come from two places — on-disk template frontmatter
- * (project-local templates are already behind `isTrusted()`) or a human typing `/delegate
- * --verify=<cmd>` at the CLI. It is deliberately **not** a `delegate` tool parameter: a tool
+ * (project-local templates are already gated by `isProjectTrusted(ctx)` — pi's own trust store,
+ * never anything inside the project itself) or a human typing `/delegate --verify=<cmd>` at the
+ * CLI. It is deliberately **not** a `delegate` tool parameter: a tool
  * param is set by the model, whose context includes repo content and delegated-harness output —
  * both attacker-influenceable, so a model-settable `verify` would be a prompt-injection ->
  * arbitrary-host-command path (e.g. injected text in a reviewed file steering the parent agent
@@ -168,6 +182,20 @@ function outputsDirFor(harness: string): string {
   return getOutputsDir(harness);
 }
 
+/**
+ * Whether pi's own trust store (`ctx.isProjectTrusted()`, backed by `~/.pi/agent/trust.json`,
+ * outside any project) considers `ctx.cwd` trusted. This is the sole source of truth for whether
+ * project-local delegate templates load — see the trust-tier comment on `loadTemplates`. Fails
+ * closed (untrusted) if the host is old enough not to expose the method, or if it throws.
+ */
+function isProjectTrusted(ctx: ExtensionContext): boolean {
+  try {
+    return typeof ctx.isProjectTrusted === 'function' && ctx.isProjectTrusted() === true;
+  } catch {
+    return false;
+  }
+}
+
 function formatTemplateRow(t: DelegateTemplate): string {
   const parts = [
     t.name,
@@ -181,15 +209,16 @@ function formatTemplateRow(t: DelegateTemplate): string {
 
 async function showModes(ctx: ExtensionContext, harnessFilter?: string): Promise<void> {
   const all = new Map<string, DelegateTemplate>();
+  const trusted = isProjectTrusted(ctx);
   // collect from all harnesses if no filter
   if (harnessFilter) {
-    for (const [k, v] of loadTemplates(ctx.cwd, harnessFilter)) all.set(k, v);
+    for (const [k, v] of loadTemplates(ctx.cwd, harnessFilter, trusted)) all.set(k, v);
   } else {
     for (const h of [...HARNESS_NAMES, 'shared']) {
-      for (const [k, v] of loadTemplates(ctx.cwd, h)) if (!all.has(k)) all.set(k, v);
+      for (const [k, v] of loadTemplates(ctx.cwd, h, trusted)) if (!all.has(k)) all.set(k, v);
     }
     // also load without harness param
-    for (const [k, v] of loadTemplates(ctx.cwd)) if (!all.has(k)) all.set(k, v);
+    for (const [k, v] of loadTemplates(ctx.cwd, undefined, trusted)) if (!all.has(k)) all.set(k, v);
   }
   const rows = [...all.values()].map(formatTemplateRow);
   if (!ctx.hasUI) {
@@ -356,6 +385,7 @@ async function showHistory(ctx: ExtensionContext, harnessFilter?: string): Promi
     return;
   }
   if (!ctx.hasUI) {
+    if (harnessFilter) process.stdout.write(`delegate — history (${harnessFilter})\n`);
     for (const e of entries)
       process.stdout.write(`${e.harness} ${e.mode} · ${formatCost(e.cost)} · ${e.sessionId ?? '-'}\n`);
     return;
@@ -376,7 +406,10 @@ async function showHistory(ctx: ExtensionContext, harnessFilter?: string): Promi
     list.onSelect = item => done(item.value);
     list.onCancel = () => done(undefined);
     return {
-      render: (w: number) => list.render(w),
+      render: (w: number) => {
+        const rows = list.render(w);
+        return harnessFilter ? [theme.fg('accent', `delegate — history (${harnessFilter})`), ...rows] : rows;
+      },
       invalidate: () => list.invalidate(),
       handleInput: (data: string) => {
         list.handleInput(data);
@@ -391,15 +424,22 @@ async function showHistory(ctx: ExtensionContext, harnessFilter?: string): Promi
 }
 
 async function showStatus(ctx: ExtensionContext, harnessFilter?: string): Promise<void> {
-  const cfg = loadConfig();
+  const { config: cfg, source } = loadConfigWithSource();
   const detection = await detectAll();
+  const trusted = isProjectTrusted(ctx);
   const allHarnesses = harnessFilter ? [harnessFilter].filter(h => isKnownHarness(h)) : HARNESS_NAMES;
   const lines: string[] = [];
   lines.push(`delegate — status${harnessFilter ? ` (${harnessFilter})` : ''}`);
+  lines.push(...describeConfigSource(source));
   lines.push(`defaultHarness: ${cfg.defaultHarness} · defaultMode: ${cfg.defaultMode} · model: ${cfg.model ?? '—'}`);
   lines.push(
     `maxConcurrent: ${typeof cfg.maxConcurrent === 'number' ? cfg.maxConcurrent : JSON.stringify(cfg.maxConcurrent)} · maxTranscripts: ${cfg.maxTranscripts}`,
   );
+  lines.push(
+    trusted
+      ? 'project trust: trusted — project-local templates (.pi/delegate/templates/) are loaded'
+      : "project trust: untrusted — project-local templates skipped (trust this project via pi's trust prompt, or set defaultProjectTrust, to load them)",
+  );
   lines.push('');
   lines.push('harness              binary   ok  version              outputs  templates  active');
   lines.push('─'.repeat(78));
@@ -415,13 +455,15 @@ async function showStatus(ctx: ExtensionContext, harnessFilter?: string): Promis
     } catch {}
     let templates = 0;
     try {
-      templates = loadTemplates(ctx.cwd, h).size;
+      templates = loadTemplates(ctx.cwd, h, trusted).size;
     } catch {}
     // cross-process count via the file registry, combined with the in-process counter as a fallback
     const active = activeCount(h);
+    const cap = getMaxConcurrent(cfg, h);
+    const activeCol = `${active}/${cap > 0 ? cap : '∞'}`;
     const hint = !det.ok && det.hint ? `  ← ${det.hint}` : '';
     lines.push(
-      `${h.padEnd(20)} ${bin.padEnd(8)} ${ok.padEnd(3)} ${ver.padEnd(20)} ${String(outputs).padEnd(8)} ${String(templates).padEnd(10)} ${active}${hint}`,
+      `${h.padEnd(20)} ${bin.padEnd(8)} ${ok.padEnd(3)} ${ver.padEnd(20)} ${String(outputs).padEnd(8)} ${String(templates).padEnd(10)} ${activeCol}${hint}`,
     );
   }
   const historyEntries = harnessFilter ? readAllHistory().filter(e => e.harness === harnessFilter) : readAllHistory();
@@ -434,9 +476,10 @@ async function showStatus(ctx: ExtensionContext, harnessFilter?: string): Promis
   }
   if (!harnessFilter) lines.push(`  total: ${formatSpend(spend.total)}`);
   if (!harnessFilter) {
+    const globalCap = getMaxConcurrent(cfg);
     lines.push('');
     lines.push(
-      `global active: ${activeCount()} · aliases: ${
+      `global active: ${activeCount()}/${globalCap > 0 ? globalCap : '∞'} · aliases: ${
         Object.entries(ALIASES)
           .map(([k, v]) => `${k}→${v}`)
           .join(', ') || '—'
@@ -474,6 +517,61 @@ async function showStatus(ctx: ExtensionContext, harnessFilter?: string): Promis
   });
 }
 
+/**
+ * `/delegate config` — the discoverability gap `/delegate status`'s provenance line only hints at:
+ * shows exactly what was read from `settings.json` (or why it wasn't) plus the effective config
+ * with defaults filled in, formatted as a paste-ready JSON block under the `delegate` key. Print-
+ * only — writing is a separate, explicit action (`/delegate config init`, below), never triggered
+ * from this default view.
+ */
+async function showConfig(ctx: ExtensionContext): Promise<void> {
+  const result = loadConfigWithSource();
+  const lines = ['delegate — config', '', ...buildConfigReport(result)];
+  if (!ctx.hasUI) {
+    process.stdout.write(`${lines.join('\n')}\n`);
+    return;
+  }
+  await ctx.ui.custom((tui, theme, _kb, done) => {
+    let offset = 0;
+    const height = 20;
+    return {
+      render(width: number): string[] {
+        const header = theme.fg('accent', `delegate config — ${result.source.file} (↑↓ scroll · any key to close)`);
+        const visible = lines.slice(offset, offset + height);
+        return [header, ...visible.map(l => theme.fg('muted', truncateToWidth(l, width)))];
+      },
+      handleInput(data: string): void {
+        if (matchesKey(data, Key.up) && offset > 0) {
+          offset--;
+          tui.requestRender();
+        } else if (matchesKey(data, Key.down) && offset < lines.length - 1) {
+          offset++;
+          tui.requestRender();
+        } else done(undefined);
+      },
+      invalidate() {},
+    };
+  });
+}
+
+/**
+ * `/delegate config init` — the one place this extension ever writes to `settings.json`, and only
+ * because a human explicitly typed this subcommand. Writes the current effective config (defaults
+ * merged with whatever was already on disk) into the `delegate` key via `writeDelegateConfig()`
+ * (read-modify-write, atomic, refuses on an unparseable file rather than clobbering it). This is
+ * also the practical fix for the legacy-`claudeDelegate`-only gap `describeConfigSource` warns
+ * about: writing an explicit `delegate` key (with the correctly-resolved values already folded
+ * in — the legacy migration already ran before this point) makes it win from then on, without
+ * this command ever touching or deleting the old `claudeDelegate` key itself.
+ */
+async function initConfig(ctx: ExtensionContext): Promise<void> {
+  const result = loadConfigWithSource();
+  const write = writeDelegateConfig(result.config);
+  const msg = write.ok ? `✓ ${write.message}` : `✗ ${write.message}`;
+  if (!ctx.hasUI) process.stdout.write(`${msg}\n`);
+  else ctx.ui.notify?.(msg, write.ok ? 'info' : 'warning');
+}
+
 function buildPrompt(
   template: DelegateTemplate,
   task: string,
@@ -513,7 +611,7 @@ async function delegate(
     throw new Error(
       `unknown harness "${harnessName}". Available: ${HARNESS_NAMES.join(', ')} (aliases: ${Object.keys(ALIASES).join(', ')})`,
     );
-  const templates = loadTemplates(ctx.cwd, harnessName);
+  const templates = loadTemplates(ctx.cwd, harnessName, isProjectTrusted(ctx));
   const mode = opts.mode || config.defaultMode;
   const template = templates.get(mode);
   if (!template)
@@ -523,6 +621,11 @@ async function delegate(
   const task = opts.task || template.defaultTask;
   if (!task) throw new Error(`delegate mode "${mode}" requires a task`);
 
+  // Fail-fast, before acquireSlot()/spawn — configuring e.g. transport:'acp' for a harness with no
+  // ACP surface (or 'stdout' for an ACP-only one) should error immediately with a clear message,
+  // not spawn the process and surface a cryptic native failure. See config.ts's resolveTransport.
+  const transport = resolveTransport(config, harnessName, harness);
+
   // concurrency guard — see concurrency.ts. Single runs (waitForSlot unset) fail fast at capacity,
   // exactly as before; fan-out passes waitForSlot:true to queue instead.
   const release = await acquireSlot({
@@ -551,7 +654,7 @@ async function delegate(
   // permission: normalized, danger requires explicit per-call allowDangerous:true
   let permission: NormalizedPermission = template.permission;
   const nativePerm = template.nativePermission;
-  const isNativeDanger = !!nativePerm && ['bypassPermissions', 'danger-full-access', 'danger'].includes(nativePerm);
+  const isNativeDanger = isNativeDangerPermission(harness, nativePerm);
   if (template.permission === 'danger' || isNativeDanger) {
     if (opts.allowDangerous !== true) {
       throw new Error(
@@ -564,6 +667,9 @@ async function delegate(
     permission = 'danger';
   }
   const permissionForDisplay = nativePerm ?? permission;
+  // Dropped when an explicit escalation moved us off the template's own tier — see
+  // resolveNativePermission(). Applies to both transports.
+  const nativePermissionForRun = resolveNativePermission(template.permission, permission, nativePerm);
 
   const model = resolveModelForHarness(config, harnessName, opts.model, template.model);
   const prompt = buildPrompt(template, task, scopeText, ctx.cwd, harnessName);
@@ -572,7 +678,7 @@ async function delegate(
   let streamedFull = '';
   let result: import('./runner.ts').HarnessResult;
   try {
-    result = await runHarness({
+    const baseRunOpts = {
       harness,
       prompt,
       cwd: ctx.cwd,
@@ -586,15 +692,20 @@ async function delegate(
       signal: opts.signal,
       timeoutMs: config.harnesses[harnessName]?.timeoutMs ?? config.timeoutMs,
       resumeSessionId: opts.sessionId,
-      onStream: t => {
+      onStream: (t: string) => {
         streamedFull += t;
         opts.onStream?.(t);
       },
-      onActivity: ev => {
+      onActivity: (ev: ActivityEvent) => {
         activityEvents.push(ev);
         opts.onActivity?.(ev);
       },
-    });
+      nativePermission: nativePermissionForRun,
+    };
+    result =
+      transport === 'acp'
+        ? await runAcpHarness({ ...baseRunOpts, harness: acpView(harness) })
+        : await runHarness(baseRunOpts);
   } catch (err) {
     release();
     if (streamedFull.length > 0) {
@@ -960,11 +1071,11 @@ export default function (pi: ExtensionAPI) {
     name: 'delegate',
     label: 'Delegate',
     description:
-      'Delegate a task to any harness (claude, codex, opencode, amp) running headless in the repo and return its streamed report (cost, token usage, context %, session id). harness selects the backend (default from config, fallback claude) — pass "all" or a comma list (e.g. "claude,codex") to fan out the same task to several harnesses and get back one comparison report. mode selects a template: review, plan, implement, security-audit, docs, general, or custom — some templates run a host-side check (e.g. "bun test") after the harness exits and report pass/fail as separate evidence; that is configured on the template, not a parameter here. scope restricts work: diff for current git diff, pr for PR diff, path list, or whole repo. sessionId continues a prior session.',
+      'Delegate a task to any harness (claude, codex, opencode, amp, devin) running headless in the repo and return its streamed report (cost, token usage, context %, session id). harness selects the backend (default from config, fallback claude) — pass "all" or a comma list (e.g. "claude,codex") to fan out the same task to several harnesses and get back one comparison report. mode selects a template: review, plan, implement, security-audit, docs, general, or custom — some templates run a host-side check (e.g. "bun test") after the harness exits and report pass/fail as separate evidence; that is configured on the template, not a parameter here. scope restricts work: diff for current git diff, pr for PR diff, path list, or whole repo. sessionId continues a prior session.',
     promptSnippet: 'Delegate a subtask to a harness and return its report',
     promptGuidelines: [
       'delegate runs a harness headless in the working directory and returns a streamed report with cost, token usage, and a session id for follow-ups.',
-      'Pass harness (claude|codex|opencode|amp) + focused task string + intent and constraints. Use scope: diff for current git diff, pr for PR diff, path list, or omit for whole repo.',
+      'Pass harness (claude|codex|opencode|amp|devin) + focused task string + intent and constraints. Use scope: diff for current git diff, pr for PR diff, path list, or omit for whole repo.',
       'mode selects the template and its permission level: review/plan/security-audit are readonly; implement/docs/general are edit. Custom template names also work. Some templates verify their own work (e.g. running tests) automatically after the harness finishes — that is not something you configure here.',
       'harness: "all" or a comma list (e.g. "codex,opencode") fans the same task out to each detected harness and returns one synthesized comparison report — costs multiply, so only use it when the user actually wants a multi-harness comparison.',
       'sessionId resumes a previous delegated session instead of starting fresh.',
@@ -974,7 +1085,7 @@ export default function (pi: ExtensionAPI) {
       harness: Type.Optional(
         Type.String({
           description:
-            'Harness to use: claude, codex, opencode, amp (aliases: omp). "all" or a comma list (e.g. "claude,codex") fans out to each detected harness. Defaults to config defaultHarness.',
+            'Harness to use: claude, codex, opencode, amp (aliases: omp), devin. "all" or a comma list (e.g. "claude,codex") fans out to each detected harness. Defaults to config defaultHarness.',
         }),
       ),
       task: Type.String({ description: 'The task/intent to delegate. Be specific.' }),
@@ -1512,8 +1623,9 @@ export default function (pi: ExtensionAPI) {
     // occupying a concurrency slot.
     const specs: FanoutSpec[] = [];
     const immediateFailures: FanoutRunSummary[] = [];
+    const trusted = isProjectTrusted(ctx);
     for (const h of resolved) {
-      const templates = loadTemplates(ctx.cwd, h);
+      const templates = loadTemplates(ctx.cwd, h, trusted);
       const resolvedTaskScope = resolveDefaults(parsed, templates);
       const template = parsed.mode ? templates.get(parsed.mode) : undefined;
       if (!resolvedTaskScope) {
@@ -1603,8 +1715,16 @@ export default function (pi: ExtensionAPI) {
       await showStatus(ctx, h);
       return;
     }
+    if (subLower === 'config init') {
+      await initConfig(ctx);
+      return;
+    }
+    if (subLower === 'config') {
+      await showConfig(ctx);
+      return;
+    }
     // extract --harness flag for list/history subcommands
-    const harnessFlag = sub.match(/--harness=([^\s]+)/)?.[1]?.toLowerCase();
+    const harnessFlag = sub.match(/--harness=([^\s]+)/)?.[1];
     if (sub === 'watch' || sub === 'show') {
       if (activeOverlay) {
         activeOverlay.show();
@@ -1614,44 +1734,45 @@ export default function (pi: ExtensionAPI) {
       }
       return;
     }
-    if (sub === 'list' || subLower.startsWith('list ')) {
-      const h =
-        forcedHarness ??
-        harnessFlag ??
-        (subLower.startsWith('list ') ? sub.slice(5).trim().split(/\s+/)[0]?.toLowerCase() : undefined);
-      if (h && isKnownHarness(h)) {
-        await showModes(ctx, h);
-        return;
-      }
-      if (sub === 'list' || subLower === `list --harness=${h}`) {
-        await showModes(ctx, forcedHarness ?? h);
-        return;
+    // Shared by list/history: resolve their (optional) harness filter to a canonical name via the
+    // same alias/case rules (`omp` -> `amp`, any case), and reject a word that matches nothing —
+    // rather than each falling back to silently showing an unfiltered or empty result.
+    const filterHarness = (bareWord: string | undefined): string | undefined | 'unknown' => {
+      if (forcedHarness) return forcedHarness;
+      const resolution = resolveHarnessFilter(harnessFlag ?? bareWord, {
+        isKnown: isKnownHarness,
+        aliasOf: resolveHarnessName,
+      });
+      if (resolution.kind === 'unknown') {
+        const msg = `unknown harness "${resolution.requested}". Available: ${HARNESS_NAMES.join(', ')} (aliases: ${Object.keys(ALIASES).join(', ')})`;
+        if (!ctx.hasUI) process.stdout.write(`${msg}\n`);
+        else ctx.ui.notify?.(msg, 'warning');
+        return 'unknown';
       }
-      // fallback: list without filter or with unknown word — show filtered if known, otherwise all
-      await showModes(ctx, forcedHarness);
+      return resolution.kind === 'known' ? resolution.harness : undefined;
+    };
+    if (sub === 'list' || subLower.startsWith('list ')) {
+      const h = filterHarness(subLower.startsWith('list ') ? sub.split(/\s+/)[1] : undefined);
+      if (h === 'unknown') return;
+      await showModes(ctx, h);
       return;
     }
     if (sub === 'history' || sub === 'logs' || subLower.startsWith('history ') || subLower.startsWith('logs ')) {
-      const h =
-        forcedHarness ??
-        harnessFlag ??
-        (subLower.startsWith('history ') || subLower.startsWith('logs ')
-          ? sub.split(/\s+/)[1]?.toLowerCase()
-          : undefined);
-      if (h && isKnownHarness(h)) {
-        await showHistory(ctx, h);
-        return;
-      }
-      await showHistory(ctx, forcedHarness);
+      const h = filterHarness(
+        subLower.startsWith('history ') || subLower.startsWith('logs ') ? sub.split(/\s+/)[1] : undefined,
+      );
+      if (h === 'unknown') return;
+      await showHistory(ctx, h);
       return;
     }
 
     // combine forced harness + args for parsing
     const rawForParse = forcedHarness ? `${forcedHarness} ${args}`.trim() : args;
     // gather known modes across all harnesses for parsing
+    const trusted = isProjectTrusted(ctx);
     const allModes = new Set<string>();
-    for (const h of HARNESS_NAMES) for (const k of loadTemplates(ctx.cwd, h).keys()) allModes.add(k);
-    for (const k of loadTemplates(ctx.cwd).keys()) allModes.add(k);
+    for (const h of HARNESS_NAMES) for (const k of loadTemplates(ctx.cwd, h, trusted).keys()) allModes.add(k);
+    for (const k of loadTemplates(ctx.cwd, undefined, trusted).keys()) allModes.add(k);
     const knownHarnessesSet = new Set([...HARNESS_NAMES, ...Object.keys(ALIASES)]);
     const parsed = parseDelegateCommand(rawForParse, allModes, knownHarnessesSet);
     // if forcedHarness provided, it wins
@@ -1665,7 +1786,7 @@ export default function (pi: ExtensionAPI) {
     }
 
     const harnessName = parsed.harness ?? loadConfig().defaultHarness ?? 'claude';
-    const templates = loadTemplates(ctx.cwd, harnessName);
+    const templates = loadTemplates(ctx.cwd, harnessName, trusted);
     const resolved = resolveDefaults(parsed, templates);
     const template = parsed.mode ? templates.get(parsed.mode) : undefined;
     const isDanger =
@@ -1682,7 +1803,7 @@ export default function (pi: ExtensionAPI) {
         );
       else
         ctx.ui.notify?.(
-          'Usage: /delegate [--harness=claude|codex|opencode|amp|all] [--mode=…] [--model=…] [--scope=…] [--verify=…] <prompt>',
+          'Usage: /delegate [--harness=claude|codex|opencode|amp|devin|all] [--mode=…] [--model=…] [--scope=…] [--verify=…] <prompt>',
           'warning',
         );
       return;
@@ -1752,7 +1873,7 @@ export default function (pi: ExtensionAPI) {
 
   pi.registerCommand('delegate', {
     description:
-      'Delegate a task to any harness. Usage: /delegate [--harness=claude|codex|opencode|amp|all] [--mode=review|plan|implement|security-audit|docs|general] [--model=...] [--scope=diff|pr|paths] [--verify=<cmd>] [--resume=<id>] <prompt> — or use harness as first word: /delegate codex review <prompt>. harness=all or a comma list (e.g. claude,codex) fans out to every detected harness and returns one comparison report.',
+      'Delegate a task to any harness. Usage: /delegate [--harness=claude|codex|opencode|amp|devin|all] [--mode=review|plan|implement|security-audit|docs|general] [--model=...] [--scope=diff|pr|paths] [--verify=<cmd>] [--resume=<id>] <prompt> — or use harness as first word: /delegate codex review <prompt>. harness=all or a comma list (e.g. claude,codex) fans out to every detected harness and returns one comparison report.',
     handler: makeHandler(),
   });
   pi.registerCommand('claude', {
@@ -1775,6 +1896,10 @@ export default function (pi: ExtensionAPI) {
     description: 'Alias for /delegate --harness=amp (omp compat). Usage: /omp [--mode=...] <prompt>',
     handler: makeHandler('amp'),
   });
+  pi.registerCommand('devin', {
+    description: 'Alias for /delegate --harness=devin. Usage: /devin [--mode=...] <prompt>',
+    handler: makeHandler('devin'),
+  });
 
   pi.on('input', async (event, _ctx) => {
     if (event.source === 'extension') return { action: 'continue' };

package/extensions/run-registry.ts

@@ -6,11 +6,15 @@
  * registry I/O failures never break a delegation — callers should combine this with their own
  * in-process counters as a fallback.
  *
- * Concurrency cap is best-effort, not a hard mutex: `countActiveRuns()` (read) and
- * `acquireRun()` (write) are two separate steps with no lock between them, so two pi
- * processes starting at the same instant can both observe a count under the limit and both
- * proceed — `maxConcurrent` can be exceeded by a small margin under a tight race. This is a
- * deliberate simplicity tradeoff (see AGENTS.md); do not rely on it for a hard cap.
+ * `acquireRun()` + `countActiveRuns()` alone are a plain check-then-act pair: read the count,
+ * decide, write — with no lock between the read and the write, so two pi processes starting at
+ * the same instant can both observe a count under the limit and both proceed, over-admitting for
+ * the full lifetime of both runs. `acquireRunWithinLimits()` below closes that specific window by
+ * re-verifying *after* writing: a write that turns out to push either count over its limit is
+ * undone immediately, so the cap can never be permanently exceeded — see its own doc comment for
+ * exactly what guarantee that is (and isn't). Callers that don't need the cap enforced — `/delegate
+ * status`'s display, or a caller happy with the plain best-effort behavior — can still use
+ * `acquireRun`/`countActiveRuns` directly.
  */
 
 import { mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
@@ -88,3 +92,44 @@ export function countActiveRuns(harness?: string): number {
   }
   return count;
 }
+
+export type AcquireWithinLimitsResult =
+  | { status: 'acquired'; handle: RunHandle }
+  /** Writing succeeded, but the run would push a limit over the top — undone, nothing held. */
+  | { status: 'full' }
+  /** Registry I/O failed — best-effort, same as `acquireRun` returning null: caller should fall
+   *  back to in-process-only accounting and proceed rather than block the run. */
+  | { status: 'unavailable' };
+
+/**
+ * Register an active run, then atomically-in-effect verify it's still within `maxGlobal` and
+ * `maxPerHarness` (either `<= 0` means "no limit" for that dimension) — undoing the registration
+ * if not. This turns the classic count-then-act race into a write-then-recheck one: because the
+ * recheck happens strictly *after* the write is committed to disk, whichever of two racing
+ * processes writes last is guaranteed to see both entries and correctly back off — over-admission
+ * (more than the limit standing at once) is impossible by construction, unlike plain
+ * `countActiveRuns()` + `acquireRun()`.
+ *
+ * This is not a perfect mutex, and doesn't try to be: in a tight enough multi-way race, more than
+ * one contender can each write, then each see the other's (or others') entry when it rechecks, and
+ * each concludes it's over the limit and backs off — even though exactly one of them could have
+ * fit. That's a transient *under*-admission (self-heals on the caller's next attempt, e.g. via
+ * `acquireSlot({wait: true})`'s poll loop) — the property this function actually guarantees is
+ * that the limit is never exceeded, not that it's always saturated.
+ */
+export function acquireRunWithinLimits(
+  harness: string,
+  mode: string,
+  maxGlobal: number,
+  maxPerHarness: number,
+): AcquireWithinLimitsResult {
+  const handle = acquireRun(harness, mode);
+  if (!handle) return { status: 'unavailable' };
+  const overGlobal = maxGlobal > 0 && countActiveRuns() > maxGlobal;
+  const overHarness = maxPerHarness > 0 && countActiveRuns(harness) > maxPerHarness;
+  if (overGlobal || overHarness) {
+    releaseRun(handle);
+    return { status: 'full' };
+  }
+  return { status: 'acquired', handle };
+}

package/extensions/templates.ts

@@ -43,11 +43,11 @@ export function normalizePermission(
     const lower = raw.trim().toLowerCase();
     if (lower === 'readonly' || lower === 'read-only' || lower === 'read_only')
       return { permission: 'readonly', permissionMode: 'plan' };
-    if (lower === 'edit' || lower === 'acceptEdits' || lower === 'accept-edits')
+    if (lower === 'edit' || lower === 'acceptedits' || lower === 'accept-edits')
       return { permission: 'edit', permissionMode: 'acceptEdits' };
     if (
       lower === 'danger' ||
-      lower === 'bypassPermissions' ||
+      lower === 'bypasspermissions' ||
       lower === 'danger-full-access' ||
       lower === 'danger_full_access'
     )
@@ -139,16 +139,6 @@ export function projectTemplatesDir(cwd: string, harness?: string): string {
   return join(cwd, '.pi', 'delegate', 'templates');
 }
 
-/** Minimal trust gate for project-local templates — untrusted clones must not override builtins. */
-function isTrusted(cwd: string): boolean {
-  if (process.env.PI_TRUSTED === '1' || process.env.PI_DELEGATE_TRUSTED === '1') return true;
-  try {
-    return readFileSync(join(cwd, '.pi', 'trusted'), 'utf8').trim() === '1';
-  } catch {
-    return false;
-  }
-}
-
 /** Legacy dirs for compat */
 function legacyUserTemplatesDir(): string {
   const dir = process.env.PI_CODING_AGENT_DIR ?? join(homedir(), '.pi', 'agent');
@@ -158,8 +148,17 @@ function legacyProjectTemplatesDir(cwd: string): string {
   return join(cwd, '.pi', 'claude-delegate', 'templates');
 }
 
-/** Legacy root < shared < harness builtins < legacyUser < user < user/harness < legacyProject < project < project/harness (later wins). */
-export function loadTemplates(cwd: string, harnessName?: string): Map<string, DelegateTemplate> {
+/**
+ * Legacy root < shared < harness builtins < legacyUser < user < user/harness < legacyProject <
+ * project < project/harness (later wins).
+ *
+ * `trusted` gates the project-local tiers only (global/user tiers always load — they're the
+ * operator's own files, not the project's). It must come from pi's own trust store
+ * (`ctx.isProjectTrusted()`), never from anything inside `cwd` itself: a trust anchor that lives
+ * in the content it's supposed to gate can simply declare itself trusted. Callers that fail to
+ * resolve trust should pass `false` — untrusted is the safe default.
+ */
+export function loadTemplates(cwd: string, harnessName?: string, trusted = false): Map<string, DelegateTemplate> {
   const out = new Map<string, DelegateTemplate>();
   const harness = harnessName ?? 'claude';
   // legacy root builtins (templates/*.md) lowest — for migration from pi-claude-delegate
@@ -173,7 +172,7 @@ export function loadTemplates(cwd: string, harnessName?: string): Map<string, De
   loadDir(userTemplatesDir(), out);
   loadDir(userTemplatesDir(harness), out);
   // project locals: legacy before new so new wins — only if trusted
-  if (isTrusted(cwd)) {
+  if (trusted) {
     loadDir(legacyProjectTemplatesDir(cwd), out);
     loadDir(projectTemplatesDir(cwd), out);
     loadDir(projectTemplatesDir(cwd, harness), out);
@@ -181,6 +180,24 @@ export function loadTemplates(cwd: string, harnessName?: string): Map<string, De
   return out;
 }
 
-export function loadAllTemplates(cwd: string): Map<string, DelegateTemplate> {
-  return loadTemplates(cwd);
+export function loadAllTemplates(cwd: string, trusted = false): Map<string, DelegateTemplate> {
+  return loadTemplates(cwd, undefined, trusted);
+}
+
+/**
+ * Which native permission string (if any) to hand the harness for this run.
+ *
+ * A template's native escape hatch (`permissionMode`/`sandbox`) applies only while the effective
+ * permission is still the template's own. Every harness's `buildArgs` prefers `nativePermission`
+ * over the normalized map, so passing it unconditionally would let a template's native mode
+ * silently override an explicit `allowDangerous` escalation — a per-call escalation would be
+ * quietly downgraded back to whatever the template declared.
+ */
+export function resolveNativePermission(
+  templatePermission: NormalizedPermission,
+  effectivePermission: NormalizedPermission,
+  nativePermission: string | undefined,
+): string | undefined {
+  if (!nativePermission) return undefined;
+  return effectivePermission === templatePermission ? nativePermission : undefined;
 }