delegate-agent-cli 0.11.0__tar.gz → 0.13.0__tar.gz

{delegate_agent_cli-0.11.0 → delegate_agent_cli-0.13.0}/CHANGELOG.md

@@ -5,6 +5,63 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.13.0] - 2026-07-09
+
+### Added
+
+- Added `opencode` as a first-class engine across `safe`, `work`, `call`, and
+  workflow runs. OpenCode drives any provider/model in the models.dev catalog
+  (75+ providers, plus custom/local providers) through one harness. Safe mode
+  and `call --read-only` enforce a deny-all-but-read permission lockdown via
+  `OPENCODE_CONFIG_CONTENT` (merges last, beating hostile repo config; verified
+  live against v1.17.17 including a git-worktree write-barrier test). Live
+  model discovery via `opencode models`, string or `{"model", "variant"}`
+  object aliases that can pin a reasoning variant, `--reasoning-effort` mapped
+  to OpenCode `--variant`, and per-run `--agent` selection with
+  `opencode.defaultAgent` fallback.
+
+## [0.12.0] - 2026-07-09
+
+Three features in one train: Delegate Workflows (multi-agent orchestration with durable resume), per-run model selection + discovery across all seven engines, and the Devin engine. Model selection was built as the inaugural Delegate Workflows dogfood: three implementation waves plus a twelve-round two-lane adversarial review loop driven through `workflow run --resume`.
+
+### Added
+
+- Per-run model selection: every engine accepts `--model <alias-or-id>` (alias
+  from `<engine>.models`, or a raw model ID passed through verbatim). Alias maps
+  are generalized beyond Droid to all engines; Droid keeps its optional
+  positional alias and gains optional `droid.defaultModel`. `delegate models
+  <engine>` merges bundled + config catalogs; `--live` probes cursor/droid/devin
+  when available. Non-droid aliases also appear in `models` / `models --summary`.
+- Delegate Workflows: a Python DSL supervisor for multi-agent fan-out, durable
+  journaling, nested workflow calls, schema-validated `agent()` results,
+  approval gates, resume, kill, saved workflows, and workflow discovery in
+  `describe`/help/docs. Status/list report `stalled` when a supervisor died
+  without finalizing (non-blocking lock probe; `wait`/`watch` exit instead of
+  hanging), and supervisor failures record a traceback tail in the journal,
+  result, and status.
+- Slash pass-through: launch prompts that intentionally start with a harness
+  slash command can be sent verbatim when the target mode's safety boundary does
+  not depend on Delegate's prompt preamble. `--pass-through` also suppresses the
+  skill preamble and completion-report suffix while preserving safe-mode
+  boundaries.
+- Added `devin` as a first-class engine for Cognition's Devin CLI across
+  `safe`, `work`, and `call` modes. Devin uses prompt-file transport,
+  config-driven model selection (`devin.defaultModel`, default `swe-1.7`),
+  read-only safe/call enforcement through a Delegate-generated
+  `--agent-config`, and `--permission-mode dangerous` for work/default-call
+  print-mode runs.
+
+### Changed
+
+- Config migration: a `<engine>.models` alias key named after a mode (`safe`,
+  `work`, or `call`) or after its own engine is now a config validation error —
+  rename the alias (aliases naming a *different* engine, like a `droid.models`
+  alias called `grok`, remain valid). Cursor input-JSON `"model"` values that differ from
+  `cursor.defaultModel` are now honored instead of rejected. Droid run-input
+  JSON `"model"` is now alias-or-id like `--model`: a `droid.models` key keeps
+  alias semantics, anything else passes through verbatim to the harness
+  (previously a hard `invalid_alias` error).
+
 ## [0.11.0] - 2026-07-05
 
 Profile-guard calibration fix for issue #9: a shell carrying `AI_PROFILE=work|personal` with no matching `~/.delegate/config.<profile>.json` no longer presents a half-configured install as a total CLI outage.
@@ -21,6 +78,11 @@ Profile-guard calibration fix for issue #9: a shell carrying `AI_PROFILE=work|pe
 
 - The fail-closed profile-crossover guarantee is now enforced inside the Python CLI (`delegate_agent.cli:main` via the new `delegate_agent.profile_guard`), classifying from the real parsed command rather than positional argv guessing. This closes a gap where the guarantee lived only in the optional shell shim: the pip console script, `python -m delegate_agent.cli`, and `bin/delegate.py` all reach `main` with no shim in front, and previously fell through to the base account on a missing overlay. The guard no-ops when `DELEGATE_CONFIG` is already exported (shim precedence) so the two layers compose without a double check. The tracked `bin/delegate-profile-shim` template applies the same check before Python starts, as an additional early gate; it scans all args for `capabilities refresh` so a mutation is never misclassified as a read-only probe.
 
+### Packaging
+
+- Published to PyPI as `delegate-agent-cli`: PyPI's separator-stripped name-similarity rule blocked the shorter `delegate-agent` (an existing `DelegateAgent` project collides). The installed console script is still `delegate`; only the `pip install` name changed.
+- Hardened two tests (`test_execution_argv_and_prompt.py`, `test_wait_cancel_commands.py`) that raced child-process teardown against the isolation and cleanup assertions they were checking, which showed up as intermittent failures on the publish gate.
+
 ## [0.10.0] - 2026-07-04
 
 Usage-audit fix wave: 82 sessions and 1,241 delegate invocations from one week of agent usage were mined for friction and failure modes, and the whole Tier 1–3 backlog was built across four decorrelated implementation waves plus live acceptance.
@@ -230,6 +292,8 @@ Usage-audit fix wave: 82 sessions and 1,241 delegate invocations from one week o
 
 - Releases before 0.1.3 predate this changelog.
 
+[0.13.0]: https://github.com/treygoff24/delegate-agent/compare/v0.12.0...v0.13.0
+[0.12.0]: https://github.com/treygoff24/delegate-agent/compare/v0.11.0...v0.12.0
 [0.11.0]: https://github.com/treygoff24/delegate-agent/compare/v0.10.0...v0.11.0
 [0.10.0]: https://github.com/treygoff24/delegate-agent/compare/v0.9.0...v0.10.0
 [0.9.0]: https://github.com/treygoff24/delegate-agent/compare/v0.8.1...v0.9.0

{delegate_agent_cli-0.11.0 → delegate_agent_cli-0.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: delegate-agent-cli
-Version: 0.11.0
+Version: 0.13.0
 Summary: A tiny CLI for delegating bounded agent tasks to Cursor, Droid, OpenAI Codex, Claude Code, Grok Build, or Kimi Code runtimes.
 Author: Trey Goff
 License-Expression: MIT
@@ -37,7 +37,7 @@ Dynamic: license-file
 
 # Delegate Agent
 
-Delegate Agent is a small CLI for handing a bounded task to another coding-agent runtime. It normalizes common calls to Cursor Agent, Factory Droid, OpenAI Codex, Claude Code, and Kimi Code so humans or other agents can launch review, investigation, and implementation jobs without remembering each tool's flags.
+Delegate Agent is a small CLI for handing a bounded task to another coding-agent runtime. It normalizes common calls to Cursor Agent, Factory Droid, OpenAI Codex, Claude Code, Grok Build, Devin, OpenCode, and Kimi Code so humans or other agents can launch review, investigation, and implementation jobs without remembering each tool's flags.
 
 Use it when you want a predictable wrapper around prompts like:
 
@@ -47,19 +47,31 @@ Use it when you want a predictable wrapper around prompts like:
 
 Delegate does **not** commit, push, merge, deploy, publish, or run a background service. It builds the child command, adds safety framing, launches the selected runtime, and records local run metadata for later inspection.
 
-Prompt handling is provider-specific: Codex and Claude prompts are delivered to the child
-runtime over stdin; Droid prompts are delivered through a private temporary
-prompt file using Droid's `--file` option; Cursor Agent and Kimi Code currently
+Prompt handling is provider-specific: Codex, Claude, and OpenCode prompts are delivered to the child
+runtime over stdin; Droid, Grok, and Devin prompts are delivered through private
+temporary prompt files; Cursor Agent and Kimi Code currently
 require prompt argv. Delegate redacts Cursor and Kimi prompt argv in dry-run
 output and run manifests, but true process-argv hiding for those harnesses
 depends on the child CLIs exposing stdin or prompt-file transport.
 
-## Install from source
+## Install
 
-Delegate requires Python 3.11 or newer. It is currently documented as a GitHub-source install, not a PyPI package.
+Delegate requires Python 3.11 or newer. The PyPI package is named `delegate-agent-cli` (PyPI's name-similarity rule blocked the shorter `delegate-agent`), but it installs the same `delegate` command either way.
 
 ```bash
-python3 -m pip install "delegate-agent @ git+https://github.com/treygoff24/delegate-agent.git"
+uv tool install delegate-agent-cli
+# or
+pipx install delegate-agent-cli
+# or
+pip install delegate-agent-cli
+```
+
+### Install from source
+
+For the latest unreleased code, or to contribute:
+
+```bash
+python3 -m pip install "delegate-agent-cli @ git+https://github.com/treygoff24/delegate-agent.git"
 ```
 
 For local development or a checkout-only smoke test:
@@ -85,11 +97,17 @@ command -v droid   # Factory Droid CLI, used by delegate droid ...
 command -v codex   # OpenAI Codex CLI, used by delegate codex ...
 command -v claude  # Claude Code CLI, used by delegate claude ...
 command -v grok    # xAI Grok Build CLI, used by delegate grok ...
+command -v devin   # Cognition Devin CLI, used by delegate devin ...
+command -v opencode # OpenCode CLI, used by delegate opencode ...
 command -v kimi    # Kimi Code CLI, used by delegate kimi ...
 ```
 
 Runtime authentication is owned by each child CLI. Delegate cannot log in for you. Dry-runs and CI tests do not require the real child binaries.
 
+Install OpenCode from [opencode.ai](https://opencode.ai). Its curl installer
+normally writes the binary to `~/.opencode/bin`, which may not be on `PATH`.
+Extend `PATH` or set `opencode.binary` to the absolute binary path.
+
 Initialize a starter config and replace placeholder Droid model IDs before real Droid runs:
 
 ```bash
@@ -110,6 +128,9 @@ delegate --json describe --summary
 delegate --json models --summary
 delegate --json describe
 delegate --json models
+delegate --json models codex          # per-engine advisory catalog
+delegate --json models cursor --live  # merge live harness probe when supported
+delegate --json models opencode --live # query every model visible to OpenCode
 delegate --json capabilities
 ```
 
@@ -133,6 +154,7 @@ Preview the command without launching a child runtime:
 ```bash
 delegate --json dry-run codex safe "Review this repository. Do not edit files."
 delegate --json dry-run claude safe "Review this repository. Do not edit files."
+delegate --json dry-run opencode safe "Review this repository. Do not edit files."
 ```
 
 Run a read-only review in an isolated throwaway workspace:
@@ -141,6 +163,8 @@ Run a read-only review in an isolated throwaway workspace:
 delegate codex safe "Review this repository for correctness risks. Do not edit files."
 delegate claude safe "Review this repository for correctness risks. Do not edit files."
 delegate grok safe "Review this repository for correctness risks. Do not edit files."
+delegate devin safe "Review this repository for correctness risks. Do not edit files."
+delegate opencode safe "Review this repository for correctness risks. Do not edit files."
 delegate cursor safe "Review the current diff for regressions. Do not edit files."
 delegate kimi safe "Review this repository for regressions. Do not edit files."
 ```
@@ -157,9 +181,21 @@ Run an edit-capable task in a workspace you trust:
 ```bash
 delegate cursor work "Fix the parser bug. Run python3 -m unittest tests.test_delegate_parser. Report changed files."
 delegate claude work "Implement the scoped change and run the named check. Report changed files."
+delegate devin work "Implement the scoped change and run the named check. Report changed files."
+delegate opencode work "Implement the scoped change and run the named check. Report changed files."
 delegate kimi work "Implement the scoped change and run the named check. Report changed files."
 ```
 
+Pin a model per run with `--model` (config alias from `<engine>.models`, or a
+raw model ID passed through verbatim). Droid still accepts a positional alias;
+`--model` works on every engine, including Droid:
+
+```bash
+delegate devin safe --model claude-fable-5 "Review this repository. Do not edit files."
+delegate droid work --model custom:my-model "Implement the scoped change."
+delegate --json dry-run codex safe --model fast "Review this repository. Do not edit files."
+```
+
 For long foreground runs, add `--progress` to emit bounded parent heartbeats to
 stderr while keeping final stdout machine-readable, or set `progress.enabled`
 to `true` in config. Use `--no-progress` to override config for one launch.
@@ -187,7 +223,20 @@ run, use stateless `call` mode:
 delegate --json codex call "Summarize this context in three bullets."
 ```
 
-Reasoning effort is provider-aware. Unsupported combinations fail before launch. It changes only the requested model thinking depth/cost/latency; it does not change safe/work/call mode, sandboxing, approvals, or edit capability. Codex/Droid validate effort against model capability metadata, Cursor maps effort to configured model selection, Claude maps to Claude Code `--effort`, and Grok maps to Grok `--effort` (`low`, `medium`, `high`, `xhigh`, `max`). Explicit Codex effort can target the harness default model even when `codex.defaultModel` is unset:
+For multi-step fan-out or gated review flows, use Delegate Workflows. A workflow
+is a Python script that launches normal Delegate child runs, journals progress,
+can pause on approval gates, and can resume from cached child results:
+
+```bash
+python3 bin/delegate.py workflow check review.py
+python3 bin/delegate.py --json workflow run review.py --args '{"files":["src/cli.py"]}' --budget 10
+python3 bin/delegate.py workflow approve wf_0123abcdef45
+```
+
+See [Delegate Workflows](docs/delegate-workflows.md) for the DSL, safety
+limits, config, and gate semantics.
+
+Reasoning effort is provider-aware. Unsupported combinations fail before launch. It changes only the requested model thinking depth/cost/latency; it does not change safe/work/call mode, sandboxing, approvals, or edit capability. Codex/Droid validate effort against model capability metadata, Cursor maps effort to configured model selection, Claude maps to Claude Code `--effort`, Grok maps to Grok `--effort` (`low`, `medium`, `high`, `xhigh`, `max`), and OpenCode passes it through as `--variant`. Devin and Kimi do not expose a Delegate reasoning-effort flag. Explicit Codex effort can target the harness default model even when `codex.defaultModel` is unset:
 
 ```bash
 delegate --json dry-run codex safe --reasoning-effort high "Review this repository. Do not edit files."
@@ -251,8 +300,10 @@ Delegate separates three ideas:
 
 Defaults are intentionally conservative for review paths:
 
-- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
+- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate devin safe`, `delegate opencode safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
 - Grok safe mode uses Delegate isolated copy plus Grok read-only sandbox/permission controls (`--sandbox read-only`, `--permission-mode dontAsk` by default). It does not use Grok `plan` mode. Prompts are delivered via Grok `--prompt-file` from a Delegate temp file.
+- Devin safe mode uses Delegate isolated copy plus a Delegate-generated `--agent-config` deny-list for edit/write/exec and `mcp__*`, with Devin `--permission-mode auto`. Work mode uses Devin `--permission-mode dangerous` because Devin print mode rejects unapproved edit/exec tools.
+- OpenCode safe mode uses Delegate's isolated copy plus an `OPENCODE_CONFIG_CONTENT` permission lockdown that allows only read, glob, and grep operations. OpenCode merges this override last, so repository configuration cannot restore write-capable tools. `opencode call --read-only` uses the same lockdown; plain `call` does not.
 - Claude safe mode invokes `claude -p` with prompt text on stdin, `--permission-mode plan`, `--strict-mcp-config`, Read/Grep/Glob plus selected read-only Bash tools, and `--no-session-persistence` by default. Delegate does not currently prove that Claude Code hooks, plugins, user settings, or other non-MCP customization surfaces are disabled.
 - `work` mode can edit. By default it runs in the real workspace for backward compatibility.
 
@@ -279,7 +330,7 @@ To carry uncommitted local work into the worktree instead of stashing it, add
 the worktree through the same snapshot primitives as safe mode, and tears the
 worktree down before launching the child if that sync fails.
 
-Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
+Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/Devin/OpenCode/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
 
 Snapshots and `run-output` redact common credential shapes by default, including authorization headers, bearer/basic tokens, JWT-like strings, and common `token=` / `api_key=` / `password=` values. Use `--no-redact` only when exact output is necessary and safe to display.
 
@@ -311,6 +362,7 @@ AI_PROFILE delegate ...` uses the base config, or set
 - [Agent setup](docs/agent-setup.md): human and non-interactive setup flows.
 - [CLI reference](docs/cli-reference.md): commands, exit codes, and JSON contracts.
 - [Configuration](docs/configuration.md): config precedence, sections, and provider-neutral aliases.
+- [Delegate Workflows](docs/delegate-workflows.md): workflow DSL, caps, config, and gate semantics.
 - [Security model](docs/security-model.md): boundaries, limitations, and safe usage.
 - [Worktrees](docs/worktrees.md): persistent-worktree lifecycle and cleanup.
 - [Troubleshooting](docs/troubleshooting.md): common failures and checks.

{delegate_agent_cli-0.11.0 → delegate_agent_cli-0.13.0}/README.md

@@ -4,7 +4,7 @@
 
 # Delegate Agent
 
-Delegate Agent is a small CLI for handing a bounded task to another coding-agent runtime. It normalizes common calls to Cursor Agent, Factory Droid, OpenAI Codex, Claude Code, and Kimi Code so humans or other agents can launch review, investigation, and implementation jobs without remembering each tool's flags.
+Delegate Agent is a small CLI for handing a bounded task to another coding-agent runtime. It normalizes common calls to Cursor Agent, Factory Droid, OpenAI Codex, Claude Code, Grok Build, Devin, OpenCode, and Kimi Code so humans or other agents can launch review, investigation, and implementation jobs without remembering each tool's flags.
 
 Use it when you want a predictable wrapper around prompts like:
 
@@ -14,19 +14,31 @@ Use it when you want a predictable wrapper around prompts like:
 
 Delegate does **not** commit, push, merge, deploy, publish, or run a background service. It builds the child command, adds safety framing, launches the selected runtime, and records local run metadata for later inspection.
 
-Prompt handling is provider-specific: Codex and Claude prompts are delivered to the child
-runtime over stdin; Droid prompts are delivered through a private temporary
-prompt file using Droid's `--file` option; Cursor Agent and Kimi Code currently
+Prompt handling is provider-specific: Codex, Claude, and OpenCode prompts are delivered to the child
+runtime over stdin; Droid, Grok, and Devin prompts are delivered through private
+temporary prompt files; Cursor Agent and Kimi Code currently
 require prompt argv. Delegate redacts Cursor and Kimi prompt argv in dry-run
 output and run manifests, but true process-argv hiding for those harnesses
 depends on the child CLIs exposing stdin or prompt-file transport.
 
-## Install from source
+## Install
 
-Delegate requires Python 3.11 or newer. It is currently documented as a GitHub-source install, not a PyPI package.
+Delegate requires Python 3.11 or newer. The PyPI package is named `delegate-agent-cli` (PyPI's name-similarity rule blocked the shorter `delegate-agent`), but it installs the same `delegate` command either way.
 
 ```bash
-python3 -m pip install "delegate-agent @ git+https://github.com/treygoff24/delegate-agent.git"
+uv tool install delegate-agent-cli
+# or
+pipx install delegate-agent-cli
+# or
+pip install delegate-agent-cli
+```
+
+### Install from source
+
+For the latest unreleased code, or to contribute:
+
+```bash
+python3 -m pip install "delegate-agent-cli @ git+https://github.com/treygoff24/delegate-agent.git"
 ```
 
 For local development or a checkout-only smoke test:
@@ -52,11 +64,17 @@ command -v droid   # Factory Droid CLI, used by delegate droid ...
 command -v codex   # OpenAI Codex CLI, used by delegate codex ...
 command -v claude  # Claude Code CLI, used by delegate claude ...
 command -v grok    # xAI Grok Build CLI, used by delegate grok ...
+command -v devin   # Cognition Devin CLI, used by delegate devin ...
+command -v opencode # OpenCode CLI, used by delegate opencode ...
 command -v kimi    # Kimi Code CLI, used by delegate kimi ...
 ```
 
 Runtime authentication is owned by each child CLI. Delegate cannot log in for you. Dry-runs and CI tests do not require the real child binaries.
 
+Install OpenCode from [opencode.ai](https://opencode.ai). Its curl installer
+normally writes the binary to `~/.opencode/bin`, which may not be on `PATH`.
+Extend `PATH` or set `opencode.binary` to the absolute binary path.
+
 Initialize a starter config and replace placeholder Droid model IDs before real Droid runs:
 
 ```bash
@@ -77,6 +95,9 @@ delegate --json describe --summary
 delegate --json models --summary
 delegate --json describe
 delegate --json models
+delegate --json models codex          # per-engine advisory catalog
+delegate --json models cursor --live  # merge live harness probe when supported
+delegate --json models opencode --live # query every model visible to OpenCode
 delegate --json capabilities
 ```
 
@@ -100,6 +121,7 @@ Preview the command without launching a child runtime:
 ```bash
 delegate --json dry-run codex safe "Review this repository. Do not edit files."
 delegate --json dry-run claude safe "Review this repository. Do not edit files."
+delegate --json dry-run opencode safe "Review this repository. Do not edit files."
 ```
 
 Run a read-only review in an isolated throwaway workspace:
@@ -108,6 +130,8 @@ Run a read-only review in an isolated throwaway workspace:
 delegate codex safe "Review this repository for correctness risks. Do not edit files."
 delegate claude safe "Review this repository for correctness risks. Do not edit files."
 delegate grok safe "Review this repository for correctness risks. Do not edit files."
+delegate devin safe "Review this repository for correctness risks. Do not edit files."
+delegate opencode safe "Review this repository for correctness risks. Do not edit files."
 delegate cursor safe "Review the current diff for regressions. Do not edit files."
 delegate kimi safe "Review this repository for regressions. Do not edit files."
 ```
@@ -124,9 +148,21 @@ Run an edit-capable task in a workspace you trust:
 ```bash
 delegate cursor work "Fix the parser bug. Run python3 -m unittest tests.test_delegate_parser. Report changed files."
 delegate claude work "Implement the scoped change and run the named check. Report changed files."
+delegate devin work "Implement the scoped change and run the named check. Report changed files."
+delegate opencode work "Implement the scoped change and run the named check. Report changed files."
 delegate kimi work "Implement the scoped change and run the named check. Report changed files."
 ```
 
+Pin a model per run with `--model` (config alias from `<engine>.models`, or a
+raw model ID passed through verbatim). Droid still accepts a positional alias;
+`--model` works on every engine, including Droid:
+
+```bash
+delegate devin safe --model claude-fable-5 "Review this repository. Do not edit files."
+delegate droid work --model custom:my-model "Implement the scoped change."
+delegate --json dry-run codex safe --model fast "Review this repository. Do not edit files."
+```
+
 For long foreground runs, add `--progress` to emit bounded parent heartbeats to
 stderr while keeping final stdout machine-readable, or set `progress.enabled`
 to `true` in config. Use `--no-progress` to override config for one launch.
@@ -154,7 +190,20 @@ run, use stateless `call` mode:
 delegate --json codex call "Summarize this context in three bullets."
 ```
 
-Reasoning effort is provider-aware. Unsupported combinations fail before launch. It changes only the requested model thinking depth/cost/latency; it does not change safe/work/call mode, sandboxing, approvals, or edit capability. Codex/Droid validate effort against model capability metadata, Cursor maps effort to configured model selection, Claude maps to Claude Code `--effort`, and Grok maps to Grok `--effort` (`low`, `medium`, `high`, `xhigh`, `max`). Explicit Codex effort can target the harness default model even when `codex.defaultModel` is unset:
+For multi-step fan-out or gated review flows, use Delegate Workflows. A workflow
+is a Python script that launches normal Delegate child runs, journals progress,
+can pause on approval gates, and can resume from cached child results:
+
+```bash
+python3 bin/delegate.py workflow check review.py
+python3 bin/delegate.py --json workflow run review.py --args '{"files":["src/cli.py"]}' --budget 10
+python3 bin/delegate.py workflow approve wf_0123abcdef45
+```
+
+See [Delegate Workflows](docs/delegate-workflows.md) for the DSL, safety
+limits, config, and gate semantics.
+
+Reasoning effort is provider-aware. Unsupported combinations fail before launch. It changes only the requested model thinking depth/cost/latency; it does not change safe/work/call mode, sandboxing, approvals, or edit capability. Codex/Droid validate effort against model capability metadata, Cursor maps effort to configured model selection, Claude maps to Claude Code `--effort`, Grok maps to Grok `--effort` (`low`, `medium`, `high`, `xhigh`, `max`), and OpenCode passes it through as `--variant`. Devin and Kimi do not expose a Delegate reasoning-effort flag. Explicit Codex effort can target the harness default model even when `codex.defaultModel` is unset:
 
 ```bash
 delegate --json dry-run codex safe --reasoning-effort high "Review this repository. Do not edit files."
@@ -218,8 +267,10 @@ Delegate separates three ideas:
 
 Defaults are intentionally conservative for review paths:
 
-- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
+- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate devin safe`, `delegate opencode safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
 - Grok safe mode uses Delegate isolated copy plus Grok read-only sandbox/permission controls (`--sandbox read-only`, `--permission-mode dontAsk` by default). It does not use Grok `plan` mode. Prompts are delivered via Grok `--prompt-file` from a Delegate temp file.
+- Devin safe mode uses Delegate isolated copy plus a Delegate-generated `--agent-config` deny-list for edit/write/exec and `mcp__*`, with Devin `--permission-mode auto`. Work mode uses Devin `--permission-mode dangerous` because Devin print mode rejects unapproved edit/exec tools.
+- OpenCode safe mode uses Delegate's isolated copy plus an `OPENCODE_CONFIG_CONTENT` permission lockdown that allows only read, glob, and grep operations. OpenCode merges this override last, so repository configuration cannot restore write-capable tools. `opencode call --read-only` uses the same lockdown; plain `call` does not.
 - Claude safe mode invokes `claude -p` with prompt text on stdin, `--permission-mode plan`, `--strict-mcp-config`, Read/Grep/Glob plus selected read-only Bash tools, and `--no-session-persistence` by default. Delegate does not currently prove that Claude Code hooks, plugins, user settings, or other non-MCP customization surfaces are disabled.
 - `work` mode can edit. By default it runs in the real workspace for backward compatibility.
 
@@ -246,7 +297,7 @@ To carry uncommitted local work into the worktree instead of stashing it, add
 the worktree through the same snapshot primitives as safe mode, and tears the
 worktree down before launching the child if that sync fails.
 
-Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
+Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/Devin/OpenCode/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
 
 Snapshots and `run-output` redact common credential shapes by default, including authorization headers, bearer/basic tokens, JWT-like strings, and common `token=` / `api_key=` / `password=` values. Use `--no-redact` only when exact output is necessary and safe to display.
 
@@ -278,6 +329,7 @@ AI_PROFILE delegate ...` uses the base config, or set
 - [Agent setup](docs/agent-setup.md): human and non-interactive setup flows.
 - [CLI reference](docs/cli-reference.md): commands, exit codes, and JSON contracts.
 - [Configuration](docs/configuration.md): config precedence, sections, and provider-neutral aliases.
+- [Delegate Workflows](docs/delegate-workflows.md): workflow DSL, caps, config, and gate semantics.
 - [Security model](docs/security-model.md): boundaries, limitations, and safe usage.
 - [Worktrees](docs/worktrees.md): persistent-worktree lifecycle and cleanup.
 - [Troubleshooting](docs/troubleshooting.md): common failures and checks.

{delegate_agent_cli-0.11.0 → delegate_agent_cli-0.13.0}/config.example.json

@@ -81,6 +81,18 @@
     "disableWebSearch": true,
     "noSubagents": false
   },
+  "devin": {
+    "binary": "devin",
+    "defaultModel": "swe-1.7",
+    "defaultReasoningEffort": null
+  },
+  "opencode": {
+    "binary": "opencode",
+    "defaultModel": null,
+    "defaultReasoningEffort": null,
+    "defaultAgent": null,
+    "models": {}
+  },
   "kimi": {
     "binary": "kimi",
     "defaultModel": "kimi-code/kimi-for-coding",

{delegate_agent_cli-0.11.0 → delegate_agent_cli-0.13.0}/docs/agent-setup.md

@@ -36,6 +36,8 @@ This guide covers both human setup and non-interactive setup for agents or CI jo
    command -v codex || echo "Codex CLI missing"
    command -v claude || echo "Claude Code CLI missing"
    command -v grok || echo "Grok Build CLI missing"
+   command -v devin || echo "Devin CLI missing"
+   command -v opencode || echo "OpenCode CLI missing"
    command -v kimi || echo "Kimi Code CLI missing"
    ```
 
@@ -94,12 +96,33 @@ When running on Windows through WSL, treat Delegate as a Linux CLI:
    delegate --json dry-run claude safe --reasoning-effort high "Review only. Do not edit files."
    delegate --json dry-run grok safe "Review only. Do not edit files."
    delegate --json dry-run grok safe --reasoning-effort high "Review only. Do not edit files."
+   delegate --json dry-run devin safe "Review only. Do not edit files."
+   delegate --json dry-run opencode safe "Review only. Do not edit files."
+   delegate --json dry-run opencode safe --reasoning-effort high "Review only. Do not edit files."
    delegate --json dry-run cursor safe "Review only. Do not edit files."
    delegate --json dry-run droid reviewer safe "Review only. Do not edit files."
    delegate --json dry-run kimi safe "Review only. Do not edit files."
    ```
 
-   The Codex, Claude, Grok, Cursor, and Kimi dry-runs succeed with the unedited example config when no reasoning effort is requested. Explicit Codex reasoning-effort dry-runs can target the harness default model when no default model is configured. Claude and Grok reasoning effort map to native `--effort` flags. The Droid dry-run validates the alias, so it returns `unconfigured_model` until you replace the `reviewer` placeholder in `config.json` with a real model ID.
+   The Codex, Claude, Grok, Devin, OpenCode, Cursor, and Kimi dry-runs succeed with the unedited example config when no reasoning effort is requested. Explicit Codex reasoning-effort dry-runs can target the harness default model when no default model is configured. Claude and Grok reasoning effort map to native `--effort` flags; OpenCode reasoning effort maps to `--variant` without model validation. The Droid dry-run validates the alias, so it returns `unconfigured_model` until you replace the `reviewer` placeholder in `config.json` with a real model ID.
+
+### OpenCode
+
+Install OpenCode with the curl installer from [opencode.ai](https://opencode.ai).
+The installer normally writes the binary to `~/.opencode/bin`, which is often
+not on `PATH` in non-interactive shells. Add that directory to `PATH`, or set an
+absolute path in Delegate config:
+
+```json
+{
+  "opencode": {
+    "binary": "/home/<user>/.opencode/bin/opencode"
+  }
+}
+```
+
+Run `opencode auth login` before the first real launch. Delegate uses OpenCode's
+existing global authentication state and does not manage login itself.
 
 ## Non-interactive agent setup
 
@@ -141,6 +164,8 @@ For an orchestrating agent, script, or CI job:
    command -v codex >/dev/null || exit 3
    command -v claude >/dev/null || exit 3
    command -v grok >/dev/null || exit 3
+   command -v devin >/dev/null || exit 3
+   command -v opencode >/dev/null || exit 3
    command -v kimi >/dev/null || exit 3
    ```
 
@@ -166,7 +191,9 @@ For an orchestrating agent, script, or CI job:
 
 ## CI expectations
 
-The required test suite does not need real Cursor, Droid, Codex, Claude, or Kimi binaries. Tests use dry-run paths and fake binaries where needed:
+The required test suite does not need real Cursor, Droid, Codex, Claude, Grok,
+Devin, OpenCode, or Kimi binaries. Tests use dry-run paths and fake binaries
+where needed:
 
 ```bash
 python3 -m compileall -q src tests bin