pi-harness-delegate 0.5.0 → 0.6.0

package/extensions/harnesses/codex.ts

@@ -14,6 +14,11 @@ import type {
 // non-interactive; sandbox alone governs what's allowed) and resume is a subcommand
 // (`exec resume <id> <prompt>`), not a `--thread-id` flag — both confirmed via `codex exec
 // --help` / `codex exec resume --help`, not just the JSONL capture.
+//
+// Resume itself live-verified end-to-end against codex-cli 0.150.1 — see
+// tests/fixtures/codex-resume.jsonl: a first `codex exec` turn was taught a fact, then a second,
+// independent process ran `codex exec resume <id> <prompt>` and correctly recalled it, proving
+// resume genuinely restores prior context rather than just replaying/echoing the session id.
 
 const execFileAsync = promisify(execFile);
 function isRecord(v: unknown): v is Record<string, unknown> {
@@ -245,7 +250,10 @@ export const codexHarness: Harness = {
       ? ['exec', 'resume', opts.resumeSessionId, opts.prompt, '--json']
       : ['exec', '--json', opts.prompt, '--sandbox', sandbox];
     if (opts.model) args.push('--model', opts.model);
-    for (const dir of opts.addDirs ?? []) args.push('--add-dir', dir);
+    // `codex exec resume --help` has no `--sandbox`/`--add-dir` at all (confirmed live: passing
+    // --add-dir to resume is a hard CLI error, "unexpected argument '--add-dir' found") — only the
+    // fresh-turn branch above supports either flag.
+    if (!opts.resumeSessionId) for (const dir of opts.addDirs ?? []) args.push('--add-dir', dir);
     return args;
   },
   parseLine(line: string, state: ParseState): ParseOutcome {
@@ -275,4 +283,8 @@ export const codexHarness: Harness = {
     return null;
   },
   permissionMap: { readonly: ['read-only'], edit: ['workspace-write'], danger: ['danger-full-access'] },
+  // No `acp` subcommand exists; `app-server` is a different, codex-proprietary JSON-RPC protocol,
+  // not ACP (docs/acp-harness-assessment.md §2) — confirmed against the full `--help` output of
+  // `codex`, `codex mcp-server`, `codex app-server`, and `codex exec`.
+  supportsTransports: ['stdout'],
 };

package/extensions/harnesses/devin.ts

@@ -203,4 +203,6 @@ export const devinHarness: Harness = {
     edit: [PERMISSION_MAP.edit],
     danger: [PERMISSION_MAP.danger],
   },
+  // ACP-only — no stdout mode exists to select between, so there's nothing to configure.
+  supportsTransports: ['acp'],
 };

package/extensions/harnesses/opencode.ts

@@ -1,6 +1,7 @@
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import type {
+  ActivityEvent,
   BuildArgsOpts,
   Harness,
   NormalizedPermission,
@@ -13,6 +14,15 @@ import type {
 // `opencode run` in this version has no `--permission` or `--add-dir` flag at all (confirmed via
 // `opencode run --help`) — permission tiers map onto built-in agents instead (`opencode agent
 // list`: "plan" is the read-only-oriented primary agent, "build" is the full-access one).
+//
+// This harness also supports the ACP transport (`opencode acp`) — see the `parseOpencodeAcpLine`/
+// `buildAcpArgs`/`ACP_MODE_MAP` block below and tests/fixtures/opencode-acp*.jsonl. Live-verified
+// (docs/acp-harness-assessment.md §2/§4, closed by a second live run — see
+// tests/fixtures/opencode-acp-build-write.jsonl): a real write prompt under `build` mode produced
+// a `tool_call`/`tool_call_update` pair with `kind: "edit"` and no `session/request_permission`
+// request at all — this project's ACP client auto-declines that request when it arrives (see
+// acp-runner.ts's `handleServerRequest`), so its absence here means `edit`/`danger` genuinely
+// execute over ACP rather than silently no-op.
 
 const execFileAsync = promisify(execFile);
 function isRecord(v: unknown): v is Record<string, unknown> {
@@ -23,6 +33,14 @@ const AGENT_MAP: Record<NormalizedPermission, string> = {
   edit: 'build',
   danger: 'build',
 };
+// A distinct vocabulary from AGENT_MAP even though the values happen to coincide today (`plan`/
+// `build` are both the CLI agent name and the ACP `session/set_mode` modeId) — kept separate on
+// purpose, per docs/acp-harness-assessment.md §6, so the two never silently drift together.
+const ACP_MODE_MAP: Record<NormalizedPermission, string> = {
+  readonly: 'plan',
+  edit: 'build',
+  danger: 'build',
+};
 function extractOpencodeText(o: Record<string, unknown>): string | undefined {
   if (typeof o.text === 'string') return o.text;
   if (typeof o.output === 'string') return o.output;
@@ -165,6 +183,136 @@ export function parseOpencodeLine(line: string, state: ParseState): ParseOutcome
   }
   return { activities, streamedText };
 }
+
+interface OpencodeAcpHarnessState {
+  sessionId?: string;
+  contextWindow?: number;
+  costUsd?: number;
+}
+
+function acpHarnessState(state: ParseState): OpencodeAcpHarnessState {
+  const s = (state._harness ?? {}) as OpencodeAcpHarnessState;
+  state._harness = s as unknown as Record<string, unknown>;
+  return s;
+}
+
+/** Translate one `session/update` notification's `params.update` payload into ParseOutcome deltas.
+ *  Same wire dialect as devin.ts's `translateUpdate` (both are real ACP `session/update` payloads —
+ *  see docs/acp-harness-assessment.md §2's evidence that opencode/omp share an ACP implementation),
+ *  kept as an independent function rather than a shared import so devin.ts needs zero changes here. */
+function translateOpencodeAcpUpdate(update: Record<string, unknown>, state: ParseState): ParseOutcome {
+  const activities: ActivityEvent[] = [];
+  let streamedText: string | undefined;
+  const content = isRecord(update.content) ? update.content : undefined;
+  const text = content?.type === 'text' && typeof content.text === 'string' ? content.text : undefined;
+  const hs = acpHarnessState(state);
+
+  switch (update.sessionUpdate) {
+    case 'agent_message_chunk':
+      if (text !== undefined) streamedText = text;
+      break;
+    case 'agent_thought_chunk':
+      if (text !== undefined) activities.push({ kind: 'thinking', chars: text.length });
+      break;
+    case 'tool_call': {
+      if (typeof update.toolCallId !== 'string') break;
+      // real fixture: `title` is the tool name ("read", "glob", "write"), matching the stdout
+      // parser's `part.tool` convention — fall back to `kind` (the coarser category) if absent.
+      const name =
+        typeof update.title === 'string' ? update.title : typeof update.kind === 'string' ? update.kind : 'tool';
+      activities.push({
+        kind: 'tool_input',
+        name,
+        input: isRecord(update.rawInput) ? update.rawInput : {},
+        id: update.toolCallId,
+      });
+      break;
+    }
+    case 'tool_call_update': {
+      // Only a terminal status produces a tool_result — same reasoning as devin.ts: a call fires
+      // multiple `in_progress` updates before its `completed`/`failed`, and ToolCallIndex.resolve()
+      // consumes the pending entry on first match.
+      if (typeof update.toolCallId !== 'string') break;
+      if (update.status === 'completed' || update.status === 'failed') {
+        activities.push({ kind: 'tool_result', isError: update.status === 'failed', id: update.toolCallId });
+      }
+      break;
+    }
+    case 'usage_update':
+      // Both fields are genuinely real over ACP (unlike stdout's `null`s) — see
+      // docs/acp-harness-assessment.md §2 — and, per the same section, this is a running session
+      // total already, latched from the *last* usage_update seen, never summed across a series.
+      if (typeof update.size === 'number') hs.contextWindow = update.size;
+      if (isRecord(update.cost) && typeof update.cost.amount === 'number') hs.costUsd = update.cost.amount;
+      break;
+    default:
+      break;
+  }
+  return { streamedText, activities };
+}
+
+export function parseOpencodeAcpLine(line: string, state: ParseState): ParseOutcome {
+  let o: unknown;
+  try {
+    o = JSON.parse(line);
+  } catch {
+    return {};
+  }
+  if (!isRecord(o)) return {};
+
+  if (o.method === 'session/update' && isRecord(o.params) && isRecord(o.params.update)) {
+    return translateOpencodeAcpUpdate(o.params.update, state);
+  }
+
+  if (isRecord(o.result)) {
+    const r = o.result;
+    if (typeof r.stopReason === 'string') {
+      // session/prompt response — the turn is over, build the final result.
+      const u = isRecord(r.usage) ? r.usage : null;
+      const hs = acpHarnessState(state);
+      const result: StreamedResult = {
+        result: state.streamedText,
+        // opencode's ACP prompt response carries no error flag of its own — a genuine failure
+        // surfaces via acp-runner.ts's process-level fail() path, same as every other harness.
+        isError: false,
+        numTurns: null, // never observed populated over ACP (docs/acp-harness-assessment.md §2)
+        totalCostUsd: typeof hs.costUsd === 'number' ? hs.costUsd : null,
+        sessionId: typeof hs.sessionId === 'string' ? hs.sessionId : null,
+        stopReason: r.stopReason,
+        permissionDenials: [],
+        durationMs: null,
+        durationApiMs: null,
+        ttftMs: null,
+        // Only ever the *requested* configOptions value from session/new, never confirmed back
+        // the way Devin's agent_stopped event confirms what actually ran — null is the honest
+        // value, not a guess.
+        model: null,
+        contextWindow: typeof hs.contextWindow === 'number' ? hs.contextWindow : null,
+        maxOutputTokens: null,
+        usage: u
+          ? {
+              // Unlike Devin's inputTokens (which includes cachedReadTokens as a subset and needs
+              // subtracting), opencode's inputTokens already EXCLUDES it — verified against the
+              // real capture: inputTokens + cachedReadTokens === totalTokens - outputTokens exactly
+              // in both tests/fixtures/opencode-acp.jsonl and opencode-acp-build-write.jsonl.
+              inputTokens: typeof u.inputTokens === 'number' ? u.inputTokens : 0,
+              outputTokens: typeof u.outputTokens === 'number' ? u.outputTokens : 0,
+              cacheCreationInputTokens: 0, // not reported over ACP
+              cacheReadInputTokens: typeof u.cachedReadTokens === 'number' ? u.cachedReadTokens : 0,
+            }
+          : null,
+      };
+      return { result };
+    }
+    if (typeof r.sessionId === 'string') {
+      // session/new response — stash the id; session/load's response has none of its own
+      // (acp-runner.ts stashes it into state._harness.sessionId itself on a resume).
+      acpHarnessState(state).sessionId = r.sessionId;
+    }
+  }
+  return {};
+}
+
 export const opencodeHarness: Harness = {
   name: 'opencode',
   displayName: 'OpenCode',
@@ -212,4 +360,16 @@ export const opencodeHarness: Harness = {
     return null;
   },
   permissionMap: { readonly: ['plan'], edit: ['build'], danger: ['build', '--auto'] },
+  // ACP path — opt-in only (transport defaults to 'stdout'; see config.ts's resolveTransport).
+  // `--model` isn't wired here: `opencode acp --help` has no such flag, unlike `devin acp
+  // --model`; the ACP handshake's own `configOptions` "model" category is the real mechanism
+  // (session/set_config_option, unverified live — see ROADMAP.md), out of scope for this change.
+  buildAcpArgs(): string[] {
+    return ['acp'];
+  },
+  parseAcpLine(line: string, state: ParseState): ParseOutcome {
+    return parseOpencodeAcpLine(line, state);
+  },
+  acpPermissionMap: { readonly: [ACP_MODE_MAP.readonly], edit: [ACP_MODE_MAP.edit], danger: [ACP_MODE_MAP.danger] },
+  supportsTransports: ['stdout', 'acp'],
 };

package/extensions/harnesses/types.ts

@@ -86,19 +86,34 @@ export interface Harness {
   aliases?: string[];
   /** Check if binary is available. */
   detect(): Promise<DetectResult>;
-  /** Build CLI args (excluding binary). */
+  /** Build CLI args (excluding binary) for the 'stdout' transport. */
   buildArgs(opts: BuildArgsOpts): string[];
-  /** Parse a single stdout line. State is mutated by runner; return deltas. */
+  /** Parse a single stdout-transport line. State is mutated by runner; return deltas. */
   parseLine(line: string, state: ParseState): ParseOutcome;
   /** Extract final result after process exit (state.result may already be set). */
   extractResult(state: ParseState): StreamedResult | null;
-  /** Normalized -> native arg fragments. */
+  /** Normalized -> native CLI arg fragments, used by the 'stdout' transport's buildArgs/nativePermission. */
   permissionMap?: Record<NormalizedPermission, string[]>;
   permissionHint?: (permission: NormalizedPermission) => string[];
-  /** Runner selection. Omitted/'stdout' -> runner.ts (the four existing harnesses); 'acp' -> acp-runner.ts.
-   *  For 'acp', `permissionMap`'s first element per tier is the ACP session mode id (session/set_mode) —
-   *  the same field the stdout harnesses use for CLI arg fragments, reused rather than duplicated. */
+  /** Which transports this harness's binary actually supports — the ceiling `config.harnesses.<name>.transport`
+   *  is validated against (see config.ts's `resolveTransport`), independent of what a user configures.
+   *  Omitted -> `[transport ?? 'stdout']` (today's single-transport harnesses). A harness legally offering
+   *  both 'stdout' and 'acp' must also declare `buildAcpArgs`/`parseAcpLine`/`acpPermissionMap` below. */
+  supportsTransports?: Transport[];
+  /** Default transport when config doesn't override. Omitted -> 'stdout'. */
   transport?: Transport;
+  /** Build args to spawn the ACP server (e.g. ['acp']), for a harness whose `supportsTransports`
+   *  includes 'acp'. Devin (ACP-only) has no separate stdout buildArgs, so it reuses `buildArgs` for
+   *  this and doesn't need to declare `buildAcpArgs` — acp-runner.ts's caller falls back to `buildArgs`
+   *  when `buildAcpArgs` is absent (see acp-runner.ts's `acpView`). */
+  buildAcpArgs?(opts: BuildArgsOpts): string[];
+  /** Parse a single ACP JSON-RPC line (see acp-runner.ts). Falls back to `parseLine` when absent, same
+   *  reasoning as `buildAcpArgs`. */
+  parseAcpLine?(line: string, state: ParseState): ParseOutcome;
+  /** Normalized -> ACP session mode id (`session/set_mode`'s `modeId`) — a distinct vocabulary from
+   *  `permissionMap`'s CLI arg fragments even when a value happens to coincide (e.g. opencode's `build`
+   *  is both). Falls back to `permissionMap` when absent, same reasoning as `buildAcpArgs`. */
+  acpPermissionMap?: Record<NormalizedPermission, string[]>;
 }
 
 export const DEFAULT_TIMEOUT_MS = 600_000;

package/extensions/index.ts

@@ -29,7 +29,7 @@ import {
   truncateToWidth,
 } from '@earendil-works/pi-tui';
 import { Type } from 'typebox';
-import { runAcpHarness } from './acp-runner.ts';
+import { acpView, runAcpHarness } from './acp-runner.ts';
 import {
   aggregateSpend,
   buildFanoutReport,
@@ -50,14 +50,26 @@ import {
   ToolCallIndex,
   type VerifyResult,
 } from './activity.ts';
-import { isFanoutSpec, parseDelegateCommand, resolveDefaults, resolveHarnessList } from './command.ts';
+import {
+  isFanoutSpec,
+  parseDelegateCommand,
+  resolveDefaults,
+  resolveHarnessFilter,
+  resolveHarnessList,
+} from './command.ts';
 import { acquireSlot, activeCount } from './concurrency.ts';
 import {
+  buildConfigReport,
   type DelegateConfig,
+  describeConfigSource,
+  getMaxConcurrent,
   outputsDir as getOutputsDir,
   legacyOutputsDir,
   loadConfig,
+  loadConfigWithSource,
   resolveModelForHarness,
+  resolveTransport,
+  writeDelegateConfig,
 } from './config.ts';
 import {
   ALIASES,
@@ -120,8 +132,9 @@ const FANOUT_LINGER_MS = 3000;
  * callers must not let this flip a run's `isError`.
  *
  * Trust model: a verify command can only come from two places — on-disk template frontmatter
- * (project-local templates are already behind `isTrusted()`) or a human typing `/delegate
- * --verify=<cmd>` at the CLI. It is deliberately **not** a `delegate` tool parameter: a tool
+ * (project-local templates are already gated by `isProjectTrusted(ctx)` — pi's own trust store,
+ * never anything inside the project itself) or a human typing `/delegate --verify=<cmd>` at the
+ * CLI. It is deliberately **not** a `delegate` tool parameter: a tool
  * param is set by the model, whose context includes repo content and delegated-harness output —
  * both attacker-influenceable, so a model-settable `verify` would be a prompt-injection ->
  * arbitrary-host-command path (e.g. injected text in a reviewed file steering the parent agent
@@ -169,6 +182,20 @@ function outputsDirFor(harness: string): string {
   return getOutputsDir(harness);
 }
 
+/**
+ * Whether pi's own trust store (`ctx.isProjectTrusted()`, backed by `~/.pi/agent/trust.json`,
+ * outside any project) considers `ctx.cwd` trusted. This is the sole source of truth for whether
+ * project-local delegate templates load — see the trust-tier comment on `loadTemplates`. Fails
+ * closed (untrusted) if the host is old enough not to expose the method, or if it throws.
+ */
+function isProjectTrusted(ctx: ExtensionContext): boolean {
+  try {
+    return typeof ctx.isProjectTrusted === 'function' && ctx.isProjectTrusted() === true;
+  } catch {
+    return false;
+  }
+}
+
 function formatTemplateRow(t: DelegateTemplate): string {
   const parts = [
     t.name,
@@ -182,15 +209,16 @@ function formatTemplateRow(t: DelegateTemplate): string {
 
 async function showModes(ctx: ExtensionContext, harnessFilter?: string): Promise<void> {
   const all = new Map<string, DelegateTemplate>();
+  const trusted = isProjectTrusted(ctx);
   // collect from all harnesses if no filter
   if (harnessFilter) {
-    for (const [k, v] of loadTemplates(ctx.cwd, harnessFilter)) all.set(k, v);
+    for (const [k, v] of loadTemplates(ctx.cwd, harnessFilter, trusted)) all.set(k, v);
   } else {
     for (const h of [...HARNESS_NAMES, 'shared']) {
-      for (const [k, v] of loadTemplates(ctx.cwd, h)) if (!all.has(k)) all.set(k, v);
+      for (const [k, v] of loadTemplates(ctx.cwd, h, trusted)) if (!all.has(k)) all.set(k, v);
     }
     // also load without harness param
-    for (const [k, v] of loadTemplates(ctx.cwd)) if (!all.has(k)) all.set(k, v);
+    for (const [k, v] of loadTemplates(ctx.cwd, undefined, trusted)) if (!all.has(k)) all.set(k, v);
   }
   const rows = [...all.values()].map(formatTemplateRow);
   if (!ctx.hasUI) {
@@ -357,6 +385,7 @@ async function showHistory(ctx: ExtensionContext, harnessFilter?: string): Promi
     return;
   }
   if (!ctx.hasUI) {
+    if (harnessFilter) process.stdout.write(`delegate — history (${harnessFilter})\n`);
     for (const e of entries)
       process.stdout.write(`${e.harness} ${e.mode} · ${formatCost(e.cost)} · ${e.sessionId ?? '-'}\n`);
     return;
@@ -377,7 +406,10 @@ async function showHistory(ctx: ExtensionContext, harnessFilter?: string): Promi
     list.onSelect = item => done(item.value);
     list.onCancel = () => done(undefined);
     return {
-      render: (w: number) => list.render(w),
+      render: (w: number) => {
+        const rows = list.render(w);
+        return harnessFilter ? [theme.fg('accent', `delegate — history (${harnessFilter})`), ...rows] : rows;
+      },
       invalidate: () => list.invalidate(),
       handleInput: (data: string) => {
         list.handleInput(data);
@@ -392,15 +424,22 @@ async function showHistory(ctx: ExtensionContext, harnessFilter?: string): Promi
 }
 
 async function showStatus(ctx: ExtensionContext, harnessFilter?: string): Promise<void> {
-  const cfg = loadConfig();
+  const { config: cfg, source } = loadConfigWithSource();
   const detection = await detectAll();
+  const trusted = isProjectTrusted(ctx);
   const allHarnesses = harnessFilter ? [harnessFilter].filter(h => isKnownHarness(h)) : HARNESS_NAMES;
   const lines: string[] = [];
   lines.push(`delegate — status${harnessFilter ? ` (${harnessFilter})` : ''}`);
+  lines.push(...describeConfigSource(source));
   lines.push(`defaultHarness: ${cfg.defaultHarness} · defaultMode: ${cfg.defaultMode} · model: ${cfg.model ?? '—'}`);
   lines.push(
     `maxConcurrent: ${typeof cfg.maxConcurrent === 'number' ? cfg.maxConcurrent : JSON.stringify(cfg.maxConcurrent)} · maxTranscripts: ${cfg.maxTranscripts}`,
   );
+  lines.push(
+    trusted
+      ? 'project trust: trusted — project-local templates (.pi/delegate/templates/) are loaded'
+      : "project trust: untrusted — project-local templates skipped (trust this project via pi's trust prompt, or set defaultProjectTrust, to load them)",
+  );
   lines.push('');
   lines.push('harness              binary   ok  version              outputs  templates  active');
   lines.push('─'.repeat(78));
@@ -416,13 +455,15 @@ async function showStatus(ctx: ExtensionContext, harnessFilter?: string): Promis
     } catch {}
     let templates = 0;
     try {
-      templates = loadTemplates(ctx.cwd, h).size;
+      templates = loadTemplates(ctx.cwd, h, trusted).size;
     } catch {}
     // cross-process count via the file registry, combined with the in-process counter as a fallback
     const active = activeCount(h);
+    const cap = getMaxConcurrent(cfg, h);
+    const activeCol = `${active}/${cap > 0 ? cap : '∞'}`;
     const hint = !det.ok && det.hint ? `  ← ${det.hint}` : '';
     lines.push(
-      `${h.padEnd(20)} ${bin.padEnd(8)} ${ok.padEnd(3)} ${ver.padEnd(20)} ${String(outputs).padEnd(8)} ${String(templates).padEnd(10)} ${active}${hint}`,
+      `${h.padEnd(20)} ${bin.padEnd(8)} ${ok.padEnd(3)} ${ver.padEnd(20)} ${String(outputs).padEnd(8)} ${String(templates).padEnd(10)} ${activeCol}${hint}`,
     );
   }
   const historyEntries = harnessFilter ? readAllHistory().filter(e => e.harness === harnessFilter) : readAllHistory();
@@ -435,9 +476,10 @@ async function showStatus(ctx: ExtensionContext, harnessFilter?: string): Promis
   }
   if (!harnessFilter) lines.push(`  total: ${formatSpend(spend.total)}`);
   if (!harnessFilter) {
+    const globalCap = getMaxConcurrent(cfg);
     lines.push('');
     lines.push(
-      `global active: ${activeCount()} · aliases: ${
+      `global active: ${activeCount()}/${globalCap > 0 ? globalCap : '∞'} · aliases: ${
         Object.entries(ALIASES)
           .map(([k, v]) => `${k}→${v}`)
           .join(', ') || '—'
@@ -475,6 +517,61 @@ async function showStatus(ctx: ExtensionContext, harnessFilter?: string): Promis
   });
 }
 
+/**
+ * `/delegate config` — the discoverability gap `/delegate status`'s provenance line only hints at:
+ * shows exactly what was read from `settings.json` (or why it wasn't) plus the effective config
+ * with defaults filled in, formatted as a paste-ready JSON block under the `delegate` key. Print-
+ * only — writing is a separate, explicit action (`/delegate config init`, below), never triggered
+ * from this default view.
+ */
+async function showConfig(ctx: ExtensionContext): Promise<void> {
+  const result = loadConfigWithSource();
+  const lines = ['delegate — config', '', ...buildConfigReport(result)];
+  if (!ctx.hasUI) {
+    process.stdout.write(`${lines.join('\n')}\n`);
+    return;
+  }
+  await ctx.ui.custom((tui, theme, _kb, done) => {
+    let offset = 0;
+    const height = 20;
+    return {
+      render(width: number): string[] {
+        const header = theme.fg('accent', `delegate config — ${result.source.file} (↑↓ scroll · any key to close)`);
+        const visible = lines.slice(offset, offset + height);
+        return [header, ...visible.map(l => theme.fg('muted', truncateToWidth(l, width)))];
+      },
+      handleInput(data: string): void {
+        if (matchesKey(data, Key.up) && offset > 0) {
+          offset--;
+          tui.requestRender();
+        } else if (matchesKey(data, Key.down) && offset < lines.length - 1) {
+          offset++;
+          tui.requestRender();
+        } else done(undefined);
+      },
+      invalidate() {},
+    };
+  });
+}
+
+/**
+ * `/delegate config init` — the one place this extension ever writes to `settings.json`, and only
+ * because a human explicitly typed this subcommand. Writes the current effective config (defaults
+ * merged with whatever was already on disk) into the `delegate` key via `writeDelegateConfig()`
+ * (read-modify-write, atomic, refuses on an unparseable file rather than clobbering it). This is
+ * also the practical fix for the legacy-`claudeDelegate`-only gap `describeConfigSource` warns
+ * about: writing an explicit `delegate` key (with the correctly-resolved values already folded
+ * in — the legacy migration already ran before this point) makes it win from then on, without
+ * this command ever touching or deleting the old `claudeDelegate` key itself.
+ */
+async function initConfig(ctx: ExtensionContext): Promise<void> {
+  const result = loadConfigWithSource();
+  const write = writeDelegateConfig(result.config);
+  const msg = write.ok ? `✓ ${write.message}` : `✗ ${write.message}`;
+  if (!ctx.hasUI) process.stdout.write(`${msg}\n`);
+  else ctx.ui.notify?.(msg, write.ok ? 'info' : 'warning');
+}
+
 function buildPrompt(
   template: DelegateTemplate,
   task: string,
@@ -514,7 +611,7 @@ async function delegate(
     throw new Error(
       `unknown harness "${harnessName}". Available: ${HARNESS_NAMES.join(', ')} (aliases: ${Object.keys(ALIASES).join(', ')})`,
     );
-  const templates = loadTemplates(ctx.cwd, harnessName);
+  const templates = loadTemplates(ctx.cwd, harnessName, isProjectTrusted(ctx));
   const mode = opts.mode || config.defaultMode;
   const template = templates.get(mode);
   if (!template)
@@ -524,6 +621,11 @@ async function delegate(
   const task = opts.task || template.defaultTask;
   if (!task) throw new Error(`delegate mode "${mode}" requires a task`);
 
+  // Fail-fast, before acquireSlot()/spawn — configuring e.g. transport:'acp' for a harness with no
+  // ACP surface (or 'stdout' for an ACP-only one) should error immediately with a clear message,
+  // not spawn the process and surface a cryptic native failure. See config.ts's resolveTransport.
+  const transport = resolveTransport(config, harnessName, harness);
+
   // concurrency guard — see concurrency.ts. Single runs (waitForSlot unset) fail fast at capacity,
   // exactly as before; fan-out passes waitForSlot:true to queue instead.
   const release = await acquireSlot({
@@ -600,7 +702,10 @@ async function delegate(
       },
       nativePermission: nativePermissionForRun,
     };
-    result = harness.transport === 'acp' ? await runAcpHarness(baseRunOpts) : await runHarness(baseRunOpts);
+    result =
+      transport === 'acp'
+        ? await runAcpHarness({ ...baseRunOpts, harness: acpView(harness) })
+        : await runHarness(baseRunOpts);
   } catch (err) {
     release();
     if (streamedFull.length > 0) {
@@ -1518,8 +1623,9 @@ export default function (pi: ExtensionAPI) {
     // occupying a concurrency slot.
     const specs: FanoutSpec[] = [];
     const immediateFailures: FanoutRunSummary[] = [];
+    const trusted = isProjectTrusted(ctx);
     for (const h of resolved) {
-      const templates = loadTemplates(ctx.cwd, h);
+      const templates = loadTemplates(ctx.cwd, h, trusted);
       const resolvedTaskScope = resolveDefaults(parsed, templates);
       const template = parsed.mode ? templates.get(parsed.mode) : undefined;
       if (!resolvedTaskScope) {
@@ -1609,8 +1715,16 @@ export default function (pi: ExtensionAPI) {
       await showStatus(ctx, h);
       return;
     }
+    if (subLower === 'config init') {
+      await initConfig(ctx);
+      return;
+    }
+    if (subLower === 'config') {
+      await showConfig(ctx);
+      return;
+    }
     // extract --harness flag for list/history subcommands
-    const harnessFlag = sub.match(/--harness=([^\s]+)/)?.[1]?.toLowerCase();
+    const harnessFlag = sub.match(/--harness=([^\s]+)/)?.[1];
     if (sub === 'watch' || sub === 'show') {
       if (activeOverlay) {
         activeOverlay.show();
@@ -1620,44 +1734,45 @@ export default function (pi: ExtensionAPI) {
       }
       return;
     }
-    if (sub === 'list' || subLower.startsWith('list ')) {
-      const h =
-        forcedHarness ??
-        harnessFlag ??
-        (subLower.startsWith('list ') ? sub.slice(5).trim().split(/\s+/)[0]?.toLowerCase() : undefined);
-      if (h && isKnownHarness(h)) {
-        await showModes(ctx, h);
-        return;
-      }
-      if (sub === 'list' || subLower === `list --harness=${h}`) {
-        await showModes(ctx, forcedHarness ?? h);
-        return;
+    // Shared by list/history: resolve their (optional) harness filter to a canonical name via the
+    // same alias/case rules (`omp` -> `amp`, any case), and reject a word that matches nothing —
+    // rather than each falling back to silently showing an unfiltered or empty result.
+    const filterHarness = (bareWord: string | undefined): string | undefined | 'unknown' => {
+      if (forcedHarness) return forcedHarness;
+      const resolution = resolveHarnessFilter(harnessFlag ?? bareWord, {
+        isKnown: isKnownHarness,
+        aliasOf: resolveHarnessName,
+      });
+      if (resolution.kind === 'unknown') {
+        const msg = `unknown harness "${resolution.requested}". Available: ${HARNESS_NAMES.join(', ')} (aliases: ${Object.keys(ALIASES).join(', ')})`;
+        if (!ctx.hasUI) process.stdout.write(`${msg}\n`);
+        else ctx.ui.notify?.(msg, 'warning');
+        return 'unknown';
       }
-      // fallback: list without filter or with unknown word — show filtered if known, otherwise all
-      await showModes(ctx, forcedHarness);
+      return resolution.kind === 'known' ? resolution.harness : undefined;
+    };
+    if (sub === 'list' || subLower.startsWith('list ')) {
+      const h = filterHarness(subLower.startsWith('list ') ? sub.split(/\s+/)[1] : undefined);
+      if (h === 'unknown') return;
+      await showModes(ctx, h);
       return;
     }
     if (sub === 'history' || sub === 'logs' || subLower.startsWith('history ') || subLower.startsWith('logs ')) {
-      const h =
-        forcedHarness ??
-        harnessFlag ??
-        (subLower.startsWith('history ') || subLower.startsWith('logs ')
-          ? sub.split(/\s+/)[1]?.toLowerCase()
-          : undefined);
-      if (h && isKnownHarness(h)) {
-        await showHistory(ctx, h);
-        return;
-      }
-      await showHistory(ctx, forcedHarness);
+      const h = filterHarness(
+        subLower.startsWith('history ') || subLower.startsWith('logs ') ? sub.split(/\s+/)[1] : undefined,
+      );
+      if (h === 'unknown') return;
+      await showHistory(ctx, h);
       return;
     }
 
     // combine forced harness + args for parsing
     const rawForParse = forcedHarness ? `${forcedHarness} ${args}`.trim() : args;
     // gather known modes across all harnesses for parsing
+    const trusted = isProjectTrusted(ctx);
     const allModes = new Set<string>();
-    for (const h of HARNESS_NAMES) for (const k of loadTemplates(ctx.cwd, h).keys()) allModes.add(k);
-    for (const k of loadTemplates(ctx.cwd).keys()) allModes.add(k);
+    for (const h of HARNESS_NAMES) for (const k of loadTemplates(ctx.cwd, h, trusted).keys()) allModes.add(k);
+    for (const k of loadTemplates(ctx.cwd, undefined, trusted).keys()) allModes.add(k);
     const knownHarnessesSet = new Set([...HARNESS_NAMES, ...Object.keys(ALIASES)]);
     const parsed = parseDelegateCommand(rawForParse, allModes, knownHarnessesSet);
     // if forcedHarness provided, it wins
@@ -1671,7 +1786,7 @@ export default function (pi: ExtensionAPI) {
     }
 
     const harnessName = parsed.harness ?? loadConfig().defaultHarness ?? 'claude';
-    const templates = loadTemplates(ctx.cwd, harnessName);
+    const templates = loadTemplates(ctx.cwd, harnessName, trusted);
     const resolved = resolveDefaults(parsed, templates);
     const template = parsed.mode ? templates.get(parsed.mode) : undefined;
     const isDanger =