delegate-agent-cli 0.11.0__tar.gz → 0.12.0__tar.gz

{delegate_agent_cli-0.11.0 → delegate_agent_cli-0.12.0}/CHANGELOG.md

@@ -5,6 +5,48 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.12.0] - 2026-07-09
+
+Three features in one train: Delegate Workflows (multi-agent orchestration with durable resume), per-run model selection + discovery across all seven engines, and the Devin engine. Model selection was built as the inaugural Delegate Workflows dogfood: three implementation waves plus a twelve-round two-lane adversarial review loop driven through `workflow run --resume`.
+
+### Added
+
+- Per-run model selection: every engine accepts `--model <alias-or-id>` (alias
+  from `<engine>.models`, or a raw model ID passed through verbatim). Alias maps
+  are generalized beyond Droid to all engines; Droid keeps its optional
+  positional alias and gains optional `droid.defaultModel`. `delegate models
+  <engine>` merges bundled + config catalogs; `--live` probes cursor/droid/devin
+  when available. Non-droid aliases also appear in `models` / `models --summary`.
+- Delegate Workflows: a Python DSL supervisor for multi-agent fan-out, durable
+  journaling, nested workflow calls, schema-validated `agent()` results,
+  approval gates, resume, kill, saved workflows, and workflow discovery in
+  `describe`/help/docs. Status/list report `stalled` when a supervisor died
+  without finalizing (non-blocking lock probe; `wait`/`watch` exit instead of
+  hanging), and supervisor failures record a traceback tail in the journal,
+  result, and status.
+- Slash pass-through: launch prompts that intentionally start with a harness
+  slash command can be sent verbatim when the target mode's safety boundary does
+  not depend on Delegate's prompt preamble. `--pass-through` also suppresses the
+  skill preamble and completion-report suffix while preserving safe-mode
+  boundaries.
+- Added `devin` as a first-class engine for Cognition's Devin CLI across
+  `safe`, `work`, and `call` modes. Devin uses prompt-file transport,
+  config-driven model selection (`devin.defaultModel`, default `swe-1.7`),
+  read-only safe/call enforcement through a Delegate-generated
+  `--agent-config`, and `--permission-mode dangerous` for work/default-call
+  print-mode runs.
+
+### Changed
+
+- Config migration: a `<engine>.models` alias key named after a mode (`safe`,
+  `work`, or `call`) or after its own engine is now a config validation error —
+  rename the alias (aliases naming a *different* engine, like a `droid.models`
+  alias called `grok`, remain valid). Cursor input-JSON `"model"` values that differ from
+  `cursor.defaultModel` are now honored instead of rejected. Droid run-input
+  JSON `"model"` is now alias-or-id like `--model`: a `droid.models` key keeps
+  alias semantics, anything else passes through verbatim to the harness
+  (previously a hard `invalid_alias` error).
+
 ## [0.11.0] - 2026-07-05
 
 Profile-guard calibration fix for issue #9: a shell carrying `AI_PROFILE=work|personal` with no matching `~/.delegate/config.<profile>.json` no longer presents a half-configured install as a total CLI outage.
@@ -21,6 +63,11 @@ Profile-guard calibration fix for issue #9: a shell carrying `AI_PROFILE=work|pe
 
 - The fail-closed profile-crossover guarantee is now enforced inside the Python CLI (`delegate_agent.cli:main` via the new `delegate_agent.profile_guard`), classifying from the real parsed command rather than positional argv guessing. This closes a gap where the guarantee lived only in the optional shell shim: the pip console script, `python -m delegate_agent.cli`, and `bin/delegate.py` all reach `main` with no shim in front, and previously fell through to the base account on a missing overlay. The guard no-ops when `DELEGATE_CONFIG` is already exported (shim precedence) so the two layers compose without a double check. The tracked `bin/delegate-profile-shim` template applies the same check before Python starts, as an additional early gate; it scans all args for `capabilities refresh` so a mutation is never misclassified as a read-only probe.
 
+### Packaging
+
+- Published to PyPI as `delegate-agent-cli`: PyPI's separator-stripped name-similarity rule blocked the shorter `delegate-agent` (an existing `DelegateAgent` project collides). The installed console script is still `delegate`; only the `pip install` name changed.
+- Hardened two tests (`test_execution_argv_and_prompt.py`, `test_wait_cancel_commands.py`) that raced child-process teardown against the isolation and cleanup assertions they were checking, which showed up as intermittent failures on the publish gate.
+
 ## [0.10.0] - 2026-07-04
 
 Usage-audit fix wave: 82 sessions and 1,241 delegate invocations from one week of agent usage were mined for friction and failure modes, and the whole Tier 1–3 backlog was built across four decorrelated implementation waves plus live acceptance.

{delegate_agent_cli-0.11.0 → delegate_agent_cli-0.12.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: delegate-agent-cli
-Version: 0.11.0
+Version: 0.12.0
 Summary: A tiny CLI for delegating bounded agent tasks to Cursor, Droid, OpenAI Codex, Claude Code, Grok Build, or Kimi Code runtimes.
 Author: Trey Goff
 License-Expression: MIT
@@ -37,7 +37,7 @@ Dynamic: license-file
 
 # Delegate Agent
 
-Delegate Agent is a small CLI for handing a bounded task to another coding-agent runtime. It normalizes common calls to Cursor Agent, Factory Droid, OpenAI Codex, Claude Code, and Kimi Code so humans or other agents can launch review, investigation, and implementation jobs without remembering each tool's flags.
+Delegate Agent is a small CLI for handing a bounded task to another coding-agent runtime. It normalizes common calls to Cursor Agent, Factory Droid, OpenAI Codex, Claude Code, Grok Build, Devin, and Kimi Code so humans or other agents can launch review, investigation, and implementation jobs without remembering each tool's flags.
 
 Use it when you want a predictable wrapper around prompts like:
 
@@ -48,18 +48,30 @@ Use it when you want a predictable wrapper around prompts like:
 Delegate does **not** commit, push, merge, deploy, publish, or run a background service. It builds the child command, adds safety framing, launches the selected runtime, and records local run metadata for later inspection.
 
 Prompt handling is provider-specific: Codex and Claude prompts are delivered to the child
-runtime over stdin; Droid prompts are delivered through a private temporary
-prompt file using Droid's `--file` option; Cursor Agent and Kimi Code currently
+runtime over stdin; Droid, Grok, and Devin prompts are delivered through private
+temporary prompt files; Cursor Agent and Kimi Code currently
 require prompt argv. Delegate redacts Cursor and Kimi prompt argv in dry-run
 output and run manifests, but true process-argv hiding for those harnesses
 depends on the child CLIs exposing stdin or prompt-file transport.
 
-## Install from source
+## Install
 
-Delegate requires Python 3.11 or newer. It is currently documented as a GitHub-source install, not a PyPI package.
+Delegate requires Python 3.11 or newer. The PyPI package is named `delegate-agent-cli` (PyPI's name-similarity rule blocked the shorter `delegate-agent`), but it installs the same `delegate` command either way.
 
 ```bash
-python3 -m pip install "delegate-agent @ git+https://github.com/treygoff24/delegate-agent.git"
+uv tool install delegate-agent-cli
+# or
+pipx install delegate-agent-cli
+# or
+pip install delegate-agent-cli
+```
+
+### Install from source
+
+For the latest unreleased code, or to contribute:
+
+```bash
+python3 -m pip install "delegate-agent-cli @ git+https://github.com/treygoff24/delegate-agent.git"
 ```
 
 For local development or a checkout-only smoke test:
@@ -85,6 +97,7 @@ command -v droid   # Factory Droid CLI, used by delegate droid ...
 command -v codex   # OpenAI Codex CLI, used by delegate codex ...
 command -v claude  # Claude Code CLI, used by delegate claude ...
 command -v grok    # xAI Grok Build CLI, used by delegate grok ...
+command -v devin   # Cognition Devin CLI, used by delegate devin ...
 command -v kimi    # Kimi Code CLI, used by delegate kimi ...
 ```
 
@@ -110,6 +123,8 @@ delegate --json describe --summary
 delegate --json models --summary
 delegate --json describe
 delegate --json models
+delegate --json models codex          # per-engine advisory catalog
+delegate --json models cursor --live  # merge live harness probe when supported
 delegate --json capabilities
 ```
 
@@ -141,6 +156,7 @@ Run a read-only review in an isolated throwaway workspace:
 delegate codex safe "Review this repository for correctness risks. Do not edit files."
 delegate claude safe "Review this repository for correctness risks. Do not edit files."
 delegate grok safe "Review this repository for correctness risks. Do not edit files."
+delegate devin safe "Review this repository for correctness risks. Do not edit files."
 delegate cursor safe "Review the current diff for regressions. Do not edit files."
 delegate kimi safe "Review this repository for regressions. Do not edit files."
 ```
@@ -157,9 +173,20 @@ Run an edit-capable task in a workspace you trust:
 ```bash
 delegate cursor work "Fix the parser bug. Run python3 -m unittest tests.test_delegate_parser. Report changed files."
 delegate claude work "Implement the scoped change and run the named check. Report changed files."
+delegate devin work "Implement the scoped change and run the named check. Report changed files."
 delegate kimi work "Implement the scoped change and run the named check. Report changed files."
 ```
 
+Pin a model per run with `--model` (config alias from `<engine>.models`, or a
+raw model ID passed through verbatim). Droid still accepts a positional alias;
+`--model` works on every engine, including Droid:
+
+```bash
+delegate devin safe --model claude-fable-5 "Review this repository. Do not edit files."
+delegate droid work --model custom:my-model "Implement the scoped change."
+delegate --json dry-run codex safe --model fast "Review this repository. Do not edit files."
+```
+
 For long foreground runs, add `--progress` to emit bounded parent heartbeats to
 stderr while keeping final stdout machine-readable, or set `progress.enabled`
 to `true` in config. Use `--no-progress` to override config for one launch.
@@ -187,7 +214,20 @@ run, use stateless `call` mode:
 delegate --json codex call "Summarize this context in three bullets."
 ```
 
-Reasoning effort is provider-aware. Unsupported combinations fail before launch. It changes only the requested model thinking depth/cost/latency; it does not change safe/work/call mode, sandboxing, approvals, or edit capability. Codex/Droid validate effort against model capability metadata, Cursor maps effort to configured model selection, Claude maps to Claude Code `--effort`, and Grok maps to Grok `--effort` (`low`, `medium`, `high`, `xhigh`, `max`). Explicit Codex effort can target the harness default model even when `codex.defaultModel` is unset:
+For multi-step fan-out or gated review flows, use Delegate Workflows. A workflow
+is a Python script that launches normal Delegate child runs, journals progress,
+can pause on approval gates, and can resume from cached child results:
+
+```bash
+python3 bin/delegate.py workflow check review.py
+python3 bin/delegate.py --json workflow run review.py --args '{"files":["src/cli.py"]}' --budget 10
+python3 bin/delegate.py workflow approve wf_0123abcdef45
+```
+
+See [Delegate Workflows](docs/delegate-workflows.md) for the DSL, safety
+limits, config, and gate semantics.
+
+Reasoning effort is provider-aware. Unsupported combinations fail before launch. It changes only the requested model thinking depth/cost/latency; it does not change safe/work/call mode, sandboxing, approvals, or edit capability. Codex/Droid validate effort against model capability metadata, Cursor maps effort to configured model selection, Claude maps to Claude Code `--effort`, and Grok maps to Grok `--effort` (`low`, `medium`, `high`, `xhigh`, `max`). Devin and Kimi do not expose a Delegate reasoning-effort flag. Explicit Codex effort can target the harness default model even when `codex.defaultModel` is unset:
 
 ```bash
 delegate --json dry-run codex safe --reasoning-effort high "Review this repository. Do not edit files."
@@ -251,8 +291,9 @@ Delegate separates three ideas:
 
 Defaults are intentionally conservative for review paths:
 
-- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
+- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate devin safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
 - Grok safe mode uses Delegate isolated copy plus Grok read-only sandbox/permission controls (`--sandbox read-only`, `--permission-mode dontAsk` by default). It does not use Grok `plan` mode. Prompts are delivered via Grok `--prompt-file` from a Delegate temp file.
+- Devin safe mode uses Delegate isolated copy plus a Delegate-generated `--agent-config` deny-list for edit/write/exec and `mcp__*`, with Devin `--permission-mode auto`. Work mode uses Devin `--permission-mode dangerous` because Devin print mode rejects unapproved edit/exec tools.
 - Claude safe mode invokes `claude -p` with prompt text on stdin, `--permission-mode plan`, `--strict-mcp-config`, Read/Grep/Glob plus selected read-only Bash tools, and `--no-session-persistence` by default. Delegate does not currently prove that Claude Code hooks, plugins, user settings, or other non-MCP customization surfaces are disabled.
 - `work` mode can edit. By default it runs in the real workspace for backward compatibility.
 
@@ -279,7 +320,7 @@ To carry uncommitted local work into the worktree instead of stashing it, add
 the worktree through the same snapshot primitives as safe mode, and tears the
 worktree down before launching the child if that sync fails.
 
-Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
+Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/Devin/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
 
 Snapshots and `run-output` redact common credential shapes by default, including authorization headers, bearer/basic tokens, JWT-like strings, and common `token=` / `api_key=` / `password=` values. Use `--no-redact` only when exact output is necessary and safe to display.
 
@@ -311,6 +352,7 @@ AI_PROFILE delegate ...` uses the base config, or set
 - [Agent setup](docs/agent-setup.md): human and non-interactive setup flows.
 - [CLI reference](docs/cli-reference.md): commands, exit codes, and JSON contracts.
 - [Configuration](docs/configuration.md): config precedence, sections, and provider-neutral aliases.
+- [Delegate Workflows](docs/delegate-workflows.md): workflow DSL, caps, config, and gate semantics.
 - [Security model](docs/security-model.md): boundaries, limitations, and safe usage.
 - [Worktrees](docs/worktrees.md): persistent-worktree lifecycle and cleanup.
 - [Troubleshooting](docs/troubleshooting.md): common failures and checks.

{delegate_agent_cli-0.11.0 → delegate_agent_cli-0.12.0}/README.md

@@ -4,7 +4,7 @@
 
 # Delegate Agent
 
-Delegate Agent is a small CLI for handing a bounded task to another coding-agent runtime. It normalizes common calls to Cursor Agent, Factory Droid, OpenAI Codex, Claude Code, and Kimi Code so humans or other agents can launch review, investigation, and implementation jobs without remembering each tool's flags.
+Delegate Agent is a small CLI for handing a bounded task to another coding-agent runtime. It normalizes common calls to Cursor Agent, Factory Droid, OpenAI Codex, Claude Code, Grok Build, Devin, and Kimi Code so humans or other agents can launch review, investigation, and implementation jobs without remembering each tool's flags.
 
 Use it when you want a predictable wrapper around prompts like:
 
@@ -15,18 +15,30 @@ Use it when you want a predictable wrapper around prompts like:
 Delegate does **not** commit, push, merge, deploy, publish, or run a background service. It builds the child command, adds safety framing, launches the selected runtime, and records local run metadata for later inspection.
 
 Prompt handling is provider-specific: Codex and Claude prompts are delivered to the child
-runtime over stdin; Droid prompts are delivered through a private temporary
-prompt file using Droid's `--file` option; Cursor Agent and Kimi Code currently
+runtime over stdin; Droid, Grok, and Devin prompts are delivered through private
+temporary prompt files; Cursor Agent and Kimi Code currently
 require prompt argv. Delegate redacts Cursor and Kimi prompt argv in dry-run
 output and run manifests, but true process-argv hiding for those harnesses
 depends on the child CLIs exposing stdin or prompt-file transport.
 
-## Install from source
+## Install
 
-Delegate requires Python 3.11 or newer. It is currently documented as a GitHub-source install, not a PyPI package.
+Delegate requires Python 3.11 or newer. The PyPI package is named `delegate-agent-cli` (PyPI's name-similarity rule blocked the shorter `delegate-agent`), but it installs the same `delegate` command either way.
 
 ```bash
-python3 -m pip install "delegate-agent @ git+https://github.com/treygoff24/delegate-agent.git"
+uv tool install delegate-agent-cli
+# or
+pipx install delegate-agent-cli
+# or
+pip install delegate-agent-cli
+```
+
+### Install from source
+
+For the latest unreleased code, or to contribute:
+
+```bash
+python3 -m pip install "delegate-agent-cli @ git+https://github.com/treygoff24/delegate-agent.git"
 ```
 
 For local development or a checkout-only smoke test:
@@ -52,6 +64,7 @@ command -v droid   # Factory Droid CLI, used by delegate droid ...
 command -v codex   # OpenAI Codex CLI, used by delegate codex ...
 command -v claude  # Claude Code CLI, used by delegate claude ...
 command -v grok    # xAI Grok Build CLI, used by delegate grok ...
+command -v devin   # Cognition Devin CLI, used by delegate devin ...
 command -v kimi    # Kimi Code CLI, used by delegate kimi ...
 ```
 
@@ -77,6 +90,8 @@ delegate --json describe --summary
 delegate --json models --summary
 delegate --json describe
 delegate --json models
+delegate --json models codex          # per-engine advisory catalog
+delegate --json models cursor --live  # merge live harness probe when supported
 delegate --json capabilities
 ```
 
@@ -108,6 +123,7 @@ Run a read-only review in an isolated throwaway workspace:
 delegate codex safe "Review this repository for correctness risks. Do not edit files."
 delegate claude safe "Review this repository for correctness risks. Do not edit files."
 delegate grok safe "Review this repository for correctness risks. Do not edit files."
+delegate devin safe "Review this repository for correctness risks. Do not edit files."
 delegate cursor safe "Review the current diff for regressions. Do not edit files."
 delegate kimi safe "Review this repository for regressions. Do not edit files."
 ```
@@ -124,9 +140,20 @@ Run an edit-capable task in a workspace you trust:
 ```bash
 delegate cursor work "Fix the parser bug. Run python3 -m unittest tests.test_delegate_parser. Report changed files."
 delegate claude work "Implement the scoped change and run the named check. Report changed files."
+delegate devin work "Implement the scoped change and run the named check. Report changed files."
 delegate kimi work "Implement the scoped change and run the named check. Report changed files."
 ```
 
+Pin a model per run with `--model` (config alias from `<engine>.models`, or a
+raw model ID passed through verbatim). Droid still accepts a positional alias;
+`--model` works on every engine, including Droid:
+
+```bash
+delegate devin safe --model claude-fable-5 "Review this repository. Do not edit files."
+delegate droid work --model custom:my-model "Implement the scoped change."
+delegate --json dry-run codex safe --model fast "Review this repository. Do not edit files."
+```
+
 For long foreground runs, add `--progress` to emit bounded parent heartbeats to
 stderr while keeping final stdout machine-readable, or set `progress.enabled`
 to `true` in config. Use `--no-progress` to override config for one launch.
@@ -154,7 +181,20 @@ run, use stateless `call` mode:
 delegate --json codex call "Summarize this context in three bullets."
 ```
 
-Reasoning effort is provider-aware. Unsupported combinations fail before launch. It changes only the requested model thinking depth/cost/latency; it does not change safe/work/call mode, sandboxing, approvals, or edit capability. Codex/Droid validate effort against model capability metadata, Cursor maps effort to configured model selection, Claude maps to Claude Code `--effort`, and Grok maps to Grok `--effort` (`low`, `medium`, `high`, `xhigh`, `max`). Explicit Codex effort can target the harness default model even when `codex.defaultModel` is unset:
+For multi-step fan-out or gated review flows, use Delegate Workflows. A workflow
+is a Python script that launches normal Delegate child runs, journals progress,
+can pause on approval gates, and can resume from cached child results:
+
+```bash
+python3 bin/delegate.py workflow check review.py
+python3 bin/delegate.py --json workflow run review.py --args '{"files":["src/cli.py"]}' --budget 10
+python3 bin/delegate.py workflow approve wf_0123abcdef45
+```
+
+See [Delegate Workflows](docs/delegate-workflows.md) for the DSL, safety
+limits, config, and gate semantics.
+
+Reasoning effort is provider-aware. Unsupported combinations fail before launch. It changes only the requested model thinking depth/cost/latency; it does not change safe/work/call mode, sandboxing, approvals, or edit capability. Codex/Droid validate effort against model capability metadata, Cursor maps effort to configured model selection, Claude maps to Claude Code `--effort`, and Grok maps to Grok `--effort` (`low`, `medium`, `high`, `xhigh`, `max`). Devin and Kimi do not expose a Delegate reasoning-effort flag. Explicit Codex effort can target the harness default model even when `codex.defaultModel` is unset:
 
 ```bash
 delegate --json dry-run codex safe --reasoning-effort high "Review this repository. Do not edit files."
@@ -218,8 +258,9 @@ Delegate separates three ideas:
 
 Defaults are intentionally conservative for review paths:
 
-- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
+- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate devin safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
 - Grok safe mode uses Delegate isolated copy plus Grok read-only sandbox/permission controls (`--sandbox read-only`, `--permission-mode dontAsk` by default). It does not use Grok `plan` mode. Prompts are delivered via Grok `--prompt-file` from a Delegate temp file.
+- Devin safe mode uses Delegate isolated copy plus a Delegate-generated `--agent-config` deny-list for edit/write/exec and `mcp__*`, with Devin `--permission-mode auto`. Work mode uses Devin `--permission-mode dangerous` because Devin print mode rejects unapproved edit/exec tools.
 - Claude safe mode invokes `claude -p` with prompt text on stdin, `--permission-mode plan`, `--strict-mcp-config`, Read/Grep/Glob plus selected read-only Bash tools, and `--no-session-persistence` by default. Delegate does not currently prove that Claude Code hooks, plugins, user settings, or other non-MCP customization surfaces are disabled.
 - `work` mode can edit. By default it runs in the real workspace for backward compatibility.
 
@@ -246,7 +287,7 @@ To carry uncommitted local work into the worktree instead of stashing it, add
 the worktree through the same snapshot primitives as safe mode, and tears the
 worktree down before launching the child if that sync fails.
 
-Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
+Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/Devin/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
 
 Snapshots and `run-output` redact common credential shapes by default, including authorization headers, bearer/basic tokens, JWT-like strings, and common `token=` / `api_key=` / `password=` values. Use `--no-redact` only when exact output is necessary and safe to display.
 
@@ -278,6 +319,7 @@ AI_PROFILE delegate ...` uses the base config, or set
 - [Agent setup](docs/agent-setup.md): human and non-interactive setup flows.
 - [CLI reference](docs/cli-reference.md): commands, exit codes, and JSON contracts.
 - [Configuration](docs/configuration.md): config precedence, sections, and provider-neutral aliases.
+- [Delegate Workflows](docs/delegate-workflows.md): workflow DSL, caps, config, and gate semantics.
 - [Security model](docs/security-model.md): boundaries, limitations, and safe usage.
 - [Worktrees](docs/worktrees.md): persistent-worktree lifecycle and cleanup.
 - [Troubleshooting](docs/troubleshooting.md): common failures and checks.

{delegate_agent_cli-0.11.0 → delegate_agent_cli-0.12.0}/config.example.json

@@ -81,6 +81,11 @@
     "disableWebSearch": true,
     "noSubagents": false
   },
+  "devin": {
+    "binary": "devin",
+    "defaultModel": "swe-1.7",
+    "defaultReasoningEffort": null
+  },
   "kimi": {
     "binary": "kimi",
     "defaultModel": "kimi-code/kimi-for-coding",

{delegate_agent_cli-0.11.0 → delegate_agent_cli-0.12.0}/docs/cli-reference.md

@@ -20,29 +20,29 @@ Use `delegate --help` for the exact command list from the installed version. Glo
 ### Direct runtime commands
 
 ```bash
-delegate cursor safe [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate cursor work [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate cursor call [--read-only] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
+delegate cursor safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate cursor work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate cursor call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
 
-delegate droid MODEL_ALIAS safe [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate droid MODEL_ALIAS work [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate droid MODEL_ALIAS call [--read-only] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
+delegate droid [MODEL_ALIAS] safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate droid [MODEL_ALIAS] work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate droid [MODEL_ALIAS] call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
 
-delegate codex safe [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [--output-schema FILE] [prompt...]
-delegate codex work [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [--output-schema FILE] [prompt...]
-delegate codex call [--read-only] [--reasoning-effort LEVEL] [--prompt-file PATH] [--output-schema FILE] [prompt...]
+delegate codex safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [--output-schema FILE] [prompt...]
+delegate codex work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [--output-schema FILE] [prompt...]
+delegate codex call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [--output-schema FILE] [prompt...]
 
-delegate claude safe [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate claude work [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate claude call [--read-only] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
+delegate claude safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate claude work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate claude call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
 
-delegate grok safe [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate grok work [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate grok call [--read-only] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
+delegate grok safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate grok work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate grok call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
 
-delegate kimi safe [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate kimi work [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate kimi call [--read-only] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
+delegate kimi safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate kimi work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate kimi call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
 ```
 
 Prompt sources are direct arguments, `--prompt-file`, or Delegate stdin. Raw C0 control characters other than newline, carriage return, and tab are stripped before launch; a prompt that becomes empty fails fast. After
@@ -61,7 +61,17 @@ begins, a later `--json` or `--isolation` still fails with
 `misplaced_global_option`; use `--prompt-file` or stdin for literal flag-like
 prompt text.
 
-`--reasoning-effort LEVEL` is optional and parsed only before prompt text begins. Unsupported model/effort pairs fail closed before launch with `unsupported_reasoning_effort`. It affects only model reasoning depth, cost, or latency; it does not change `safe`/`work`/`call` permissions, sandboxing, approvals, network policy, or edit capability. Cursor effort is model-selection based and requires `cursor.reasoningEffortModels`; Droid emits `--reasoning-effort LEVEL`; Codex emits a `model_reasoning_effort` config override for the resolved model, or for the Codex harness default model when no `codex.defaultModel` is configured and the request was explicit; Claude emits Claude Code `--effort LEVEL`; Grok emits Grok `--effort LEVEL` (`low`, `medium`, `high`, `xhigh`, `max`). Kimi does not support reasoning effort in v1.
+`--model <alias-or-model>` is optional on every engine and is parsed only before
+prompt text begins. The value is resolved against `<engine>.models` when it
+matches an alias key; otherwise it is passed through verbatim as a raw model ID
+(the harness validates unknown IDs). Droid also accepts an optional positional
+`MODEL_ALIAS` (alias-only/strict); give either the positional or `--model`, not
+both. With neither, Droid uses `droid.defaultModel` when set. Discover aliases
+and advisory catalogs with `delegate models`, `delegate models <engine>`, and
+`delegate models <engine> --live` (live probes for cursor/droid/devin; other
+engines report live unsupported).
+
+`--reasoning-effort LEVEL` is optional and parsed only before prompt text begins. Unsupported model/effort pairs fail closed before launch with `unsupported_reasoning_effort`. It affects only model reasoning depth, cost, or latency; it does not change `safe`/`work`/`call` permissions, sandboxing, approvals, network policy, or edit capability. Cursor effort is model-selection based and requires `cursor.reasoningEffortModels`; an explicit `--model` wins over effort→model routing. Droid emits `--reasoning-effort LEVEL`; Codex emits a `model_reasoning_effort` config override for the resolved model, or for the Codex harness default model when no `codex.defaultModel` is configured and the request was explicit; Claude emits Claude Code `--effort LEVEL`; Grok emits Grok `--effort LEVEL` (`low`, `medium`, `high`, `xhigh`, `max`). Kimi does not support reasoning effort in v1.
 
 `--progress` enables parent progress heartbeats on stderr for tracked foreground
 runs. `--no-progress` disables them even when `progress.enabled` is true in
@@ -123,11 +133,12 @@ auth/env selection happens.
 Usage:
 
 ```bash
-delegate [--json] [--isolation auto|none|worktree] codex {safe,work,call} [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [--output-schema FILE] [prompt...]
+delegate [--json] [--isolation auto|none|worktree] codex {safe,work,call} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [--output-schema FILE] [prompt...]
 ```
 
 - Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff. Codex safe always uses `--sandbox read-only`. Under `--isolation auto`, Codex safe is the only safe harness that may opt out with `--isolation none`, because Codex still keeps its read-only sandbox active.
 - Prompt text is delivered on stdin to `codex exec`; dry-run argv and tracked run manifests do not contain the prompt.
+- Model selection uses `--model` (alias from `codex.models` or a raw model ID), the run-input JSON `model`, or `codex.defaultModel`.
 - `--reasoning-effort` maps to a Codex `model_reasoning_effort` config override after the model is resolved.
 - `--output-schema FILE` is **codex-only**. Cursor, Droid, Kimi, and Claude reject it. `FILE` is a path to a JSON Schema that OpenAI enforces on Codex's final message, for machine-parseable output in fan-outs and JSON run input. Relative paths resolve against the process launch cwd, the same rule as `--prompt-file`. When set, Delegate suppresses the completion-report prompt injection for that run so the schema owns the whole final message. Missing or unreadable files fail fast before launch.
 
@@ -135,6 +146,7 @@ Examples:
 
 ```bash
 delegate codex safe "Review this repo for regressions; report file/line/severity."
+delegate codex safe --model gpt-5.5 "Review this repo for regressions; report file/line/severity."
 delegate codex work "Implement the scoped task; report changed files and tests."
 delegate codex call "Summarize this context in three bullets."
 delegate --json codex safe --output-schema findings.schema.json "Return one record per finding."
@@ -146,7 +158,7 @@ delegate --isolation worktree codex work "Implement the feature in a persistent
 Usage:
 
 ```bash
-delegate [--json] [--isolation auto|none|worktree] claude {safe,work,call} [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] [--isolation auto|none|worktree] claude {safe,work,call} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
 ```
 
 - Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff. Under `--isolation auto`, Claude safe uses `--permission-mode plan`, `--strict-mcp-config`, Read/Grep/Glob, and selected read-only Bash tools such as `git diff`/`git status`.
@@ -154,13 +166,14 @@ delegate [--json] [--isolation auto|none|worktree] claude {safe,work,call} [--re
 - Prompt text is delivered on stdin to `claude -p`; dry-run argv and tracked run manifests do not contain the prompt.
 - JSON-streaming runs use `--output-format stream-json --input-format text`; pass-through runs use `--output-format text`.
 - Work mode uses `claude.workPermissionMode` from config, unless Delegate policy explicitly enables `policy.harness.claude.work.bypassApprovalsAndSandbox`, which maps to Claude `--permission-mode bypassPermissions`.
+- Model selection uses `--model` (alias from `claude.models` or a raw model ID), the run-input JSON `model`, or `claude.defaultModel`.
 - `--reasoning-effort` maps to Claude Code `--effort` and accepts `low`, `medium`, `high`, `xhigh`, or `max`.
 
 Examples:
 
 ```bash
 delegate claude safe "Review this repo for regressions; report file/line/severity."
-delegate claude work "Implement the scoped task; report changed files and tests."
+delegate claude work --model claude-opus-4-6 "Implement the scoped task; report changed files and tests."
 delegate claude call "Summarize this context in three bullets."
 delegate --isolation worktree claude work "Implement the feature in a persistent worktree."
 ```
@@ -170,12 +183,13 @@ delegate --isolation worktree claude work "Implement the feature in a persistent
 Usage:
 
 ```bash
-delegate [--json] [--isolation auto|none|worktree] grok {safe,work,call} [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] [--isolation auto|none|worktree] grok {safe,work,call} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
 ```
 
 - Safe mode reviews your **current working tree** in an isolated throwaway copy plus Grok read-only controls (`--sandbox read-only`, `--permission-mode dontAsk` by default). Delegate does not use Grok `plan` mode for safe review.
 - Prompt text is delivered via Grok `--prompt-file` from a Delegate temp file; dry-run argv and tracked run manifests do not contain the prompt.
 - Work mode uses `grok.workPermissionMode` and `grok.workSandbox` from config, unless Delegate policy explicitly enables `policy.harness.grok.work.bypassApprovalsAndSandbox`, which maps to Grok `--permission-mode bypassPermissions`.
+- Model selection uses `--model` (alias from `grok.models` or a raw model ID), the run-input JSON `model`, or `grok.defaultModel`.
 - `--reasoning-effort` maps to Grok `--effort` and accepts `low`, `medium`, `high`, `xhigh`, or `max`.
 - `--output-schema` is unsupported for Grok in v1 because Grok `--json-schema` forces final JSON output and weakens live snapshot parity.
 
@@ -193,12 +207,12 @@ delegate --isolation worktree grok work "Implement the feature in a persistent w
 Usage:
 
 ```bash
-delegate [--json] [--isolation auto|none|worktree] kimi {safe,work,call} [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] [--isolation auto|none|worktree] kimi {safe,work,call} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
 ```
 
 - Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff. Under `--isolation auto`, Kimi safe uses a read-only safety prompt. Delegate intentionally avoids Kimi `--plan` in safe mode. Kimi prompt mode auto-approves tool actions, so the isolation is the effective write boundary; the safety prompt is advisory.
 - Work mode uses Kimi prompt mode and runs in the real workspace unless you opt into worktree isolation. Delegate does not emit `--yolo` because Kimi rejects combining `--yolo` with `--prompt`.
-- Model selection comes from `kimi.defaultModel` config or the `model` key in JSON run input; there is no CLI model alias.
+- Model selection uses `--model` (alias from `kimi.models` or a raw model ID), the run-input JSON `model`, or `kimi.defaultModel`.
 - `--reasoning-effort` is unsupported for Kimi in v1.
 - Kimi prompt text is passed via argv.
 
@@ -211,6 +225,67 @@ delegate kimi call "Summarize this context in three bullets."
 delegate --isolation worktree kimi work "Implement the feature in a persistent worktree."
 ```
 
+### `delegate workflow`
+
+Workflows run a Python DSL supervisor that can fan out normal Delegate child
+runs, journal progress, pause on approval gates, and resume from cached child
+results. Workflow state lives under `.delegate/workflows/<wfId>/`; child runs
+are tagged with `--group <wfId>`.
+
+Usage:
+
+```bash
+delegate [--json] workflow check <script.py>
+delegate [--json] workflow run <script.py> [--args JSON] [--budget N] [--dry-run]
+delegate [--json] workflow run --resume <wfId> [--budget N]
+delegate [--json] workflow status <wfId>
+delegate [--json] workflow events <wfId> [--since SEQ]
+delegate [--json] workflow watch <wfId> [--since SEQ]
+delegate [--json] workflow wait <wfId> [--timeout SEC]
+delegate [--json] workflow result <wfId>
+delegate [--json] workflow approve <wfId>
+delegate [--json] workflow kill <wfId>
+delegate [--json] workflow list
+delegate [--json] workflow save <script.py> --name NAME
+```
+
+- `check` validates the workflow script, including literal preflight checks for
+  unsupported `agent()` combinations.
+- `run` launches a detached supervisor; `--dry-run` renders planned stubs
+  without launching child agents or consuming real budget.
+- `--resume` replays the journal, adopts matching child runs by workflow agent
+  key, and continues from missing work.
+- `approve` releases a paused gate (and resumes). Do not also run
+  `run --resume` for the same gate — approve already is that resume. `kill`
+  validates the supervisor process group before signaling and always attempts
+  child fan-out cancellation.
+- JSON-capable workflow commands return the normal `{ok: ...}` envelope. Invalid
+  scripts fail with `invalid_workflow_script`.
+
+#### Workflow error codes
+
+Codes raised as `DelegateError` from workflow commands (`workflows/commands.py`):
+
+| Code | Meaning |
+| --- | --- |
+| `invalid_workflow_args` | `--args` is not valid JSON. |
+| `invalid_workflow_id` | `wfId` is not `wf_` + 12 hex digits. |
+| `invalid_workflow_name` | Saved-workflow `--name` is not a simple file stem. |
+| `invalid_workflow_script` | Script failed `check` / load validation. |
+| `missing_workflow` | A verb that needs `<wfId>` was invoked without one. |
+| `missing_workflow_save_args` | `save` needs both `<script.py>` and `--name`. |
+| `missing_workflow_script` | `run`/`check` need `<script.py>` or `--name`. |
+| `unknown_workflow_action` | Unrecognized `workflow` subcommand. |
+| `workflow_execution_failed` | Dry-run (or in-process) execution raised before detach. |
+| `workflow_locked` | Another supervisor already holds the workflow flock. |
+| `workflow_not_found` | No workflow directory / status for that `wfId`. |
+| `workflow_not_gated` | `approve` on a workflow that is not paused on a gate. |
+| `workflow_result_missing` | `result` before `result.json` exists. |
+| `workflow_script_not_found` | Resolved script path is missing or not a file. |
+
+See [Delegate Workflows](delegate-workflows.md) for the DSL, caps, config, and
+gate semantics.
+
 ### Stateless `call` mode
 
 `call` is the one-hop model-call form of Delegate: "work mode minus a repo." It
@@ -383,9 +458,9 @@ Supported input keys:
 }
 ```
 
-- `engine`: `cursor`, `droid`, `codex`, `claude`, `grok`, or `kimi`.
+- `engine`: `cursor`, `droid`, `codex`, `claude`, `grok`, `devin`, or `kimi`.
 - `mode`: `safe`, `work`, or `call`.
-- `model`: Droid requires a configured local alias; Codex, Claude, and Kimi treat a non-empty string as a model override; Cursor does not accept per-run model aliases in v1.
+- `model`: optional alias-or-id for every engine. Resolved against `<engine>.models` when it matches an alias; otherwise passed through as a raw model ID. For Droid, a positional alias remains alias-only/strict; JSON/`--model` is alias-or-id. Cursor honors an explicit model even when it differs from `cursor.defaultModel`.
 - `cwd`: optional workspace path. Git directories resolve to the repo root. Omit it for `mode: "call"`, which always uses an empty temporary cwd.
 - `isolation`: optional `auto`, `none`, or `worktree`. `null` is invalid. `mode: "call"` rejects isolation. For Cursor, Claude, Grok, Droid, and Kimi safe mode, `none` is normalized to `auto` with a warning.
 - `reasoningEffort`: optional non-empty effort string. It overrides provider `defaultReasoningEffort` for that JSON run.
@@ -408,12 +483,14 @@ delegate --json describe --summary
 delegate --json models --summary
 delegate --json describe
 delegate --json models
+delegate --json models <engine>
+delegate --json models <engine> --live
 delegate --json capabilities
 delegate --json capabilities refresh
 delegate agent-help
 ```
 
-`describe` reports version, engines, modes, supported isolation values, prompt transforms, effective policy, top-level profile config metadata, and representative argv shapes. It also includes a `commands` catalog derived from the help registry; each full entry includes stable `name`/`command`, usage, arguments, options, and launchOptions fields. Full `describe` is a strict superset of `describe --summary`, so fields present in summary keep the same names in the full payload. `models` reports configured Cursor, Droid, Codex, Claude, Grok, and Kimi model settings. Discovery output applies best-effort credential scrubbing; model IDs and paths are shown verbatim. Agents should start with `--summary` for a compact inventory, then use raw output only when needed.
+`describe` reports version, engines, modes, supported isolation values, prompt transforms, effective policy, top-level profile config metadata, and representative argv shapes. It also includes a `commands` catalog derived from the help registry; each full entry includes stable `name`/`command`, usage, arguments, options, and launchOptions fields. Full `describe` is a strict superset of `describe --summary`, so fields present in summary keep the same names in the full payload. `models` reports configured Cursor, Droid, Codex, Claude, Grok, Devin, and Kimi model settings, including non-empty `<engine>.models` alias maps. `models <engine>` returns an advisory per-engine catalog (bundled + config); `--live` merges a harness probe for cursor, droid, and devin when available. Discovery output applies best-effort credential scrubbing, so secret-shaped values (including model IDs or paths that resemble credentials) are redacted — copy exact values from your config file rather than from scrubbed output. Agents should start with `--summary` for a compact inventory, then use raw output only when needed.
 
 Both `describe` and `models` include provenance fields useful for detecting installed-runtime drift: