delegate-agent-cli 0.13.0__tar.gz → 0.14.0__tar.gz

{delegate_agent_cli-0.13.0 → delegate_agent_cli-0.14.0}/CHANGELOG.md

@@ -5,6 +5,64 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.14.0] - 2026-07-15
+
+### Added
+
+- `workflow result --field` for extracting a single field from a workflow
+  result, reliable latest-workflow selection, immutable creation ordering,
+  dry-run visibility, and orphan detection (PR #14).
+- Schema validation for `agent()` results supports `minLength` and
+  `minItems`, including in retries and dry-run placeholders (PR #14).
+- Grouped work runs sharing one non-isolated workspace now emit a warning
+  with guidance for commit boundaries and persistent worktrees (PR #13).
+
+### Changed
+
+- Focused call help (`delegate <engine> call --help`) now reflects
+  call-mode option boundaries and documents the grouped-call tracking
+  exception (`--cwd` accepted only with `--group`); explicit `agent` input
+  is rejected on engines that do not support it (PR #13).
+- Overview, dry-run, agent-help, README, CLI reference, and worktree docs
+  corrected from user feedback (PR #13).
+
+### Fixed
+
+- Structured Codex workflows consume the child-authored completion report
+  (including on resume) and fail closed when it is missing; workflow resume
+  transitions atomically to `starting`, hides stale results, rolls back
+  failed launches, and releases locks on preparation errors (PR #14).
+- Safe isolation re-roots exact source-workspace paths while preserving
+  slash-command payloads verbatim (PR #14).
+- `wait`: a run matched by both `--latest HARNESS` and `--group NAME`
+  was emitted twice in the resolved-target list; it now appears once, with
+  first-selection precedence and ordering preserved.
+- `git_root_for` degrades any `OSError` from the git probe (not just
+  `FileNotFoundError`) to the non-git fallback, so e.g. a `PermissionError`
+  spawning git no longer crashes workspace resolution.
+
+### Changed
+
+- Internal cleanup pass across `src/` and `tests/`: removed dead code (unused
+  protocol types, private helpers, stale fixtures), collapsed redundant
+  exception tuples into their `OSError` base, replaced a hand-rolled
+  path-containment helper with `Path.is_relative_to`, and stripped stale
+  review-artifact comments. Behavior-preserving; the workflow supervisor's
+  broad exception boundary around child-model output is now explicitly
+  commented and regression-tested.
+
+## [0.13.1] - 2026-07-09
+
+### Added
+
+- Codex-only `--fast` / `--no-fast` per-run service-tier overrides (and a
+  `fast` boolean in run-input JSON). `--fast` emits `service_tier="fast"` plus
+  `features.fast_mode=true` so the tier cannot be silently dropped by ambient
+  Codex config; `--no-fast` emits the explicit `service_tier="default"`
+  standard-routing sentinel; omitting both inherits Codex configuration. The
+  explicit choice is recorded as `requestedFast` in run metadata. The flag and
+  JSON key fail closed on every other engine, including a bare `"fast": null`.
+
 ## [0.13.0] - 2026-07-09
 
 ### Added
@@ -292,6 +350,8 @@ Usage-audit fix wave: 82 sessions and 1,241 delegate invocations from one week o
 
 - Releases before 0.1.3 predate this changelog.
 
+[0.14.0]: https://github.com/treygoff24/delegate-agent/compare/v0.13.1...v0.14.0
+[0.13.1]: https://github.com/treygoff24/delegate-agent/compare/v0.13.0...v0.13.1
 [0.13.0]: https://github.com/treygoff24/delegate-agent/compare/v0.12.0...v0.13.0
 [0.12.0]: https://github.com/treygoff24/delegate-agent/compare/v0.11.0...v0.12.0
 [0.11.0]: https://github.com/treygoff24/delegate-agent/compare/v0.10.0...v0.11.0

{delegate_agent_cli-0.13.0 → delegate_agent_cli-0.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: delegate-agent-cli
-Version: 0.13.0
+Version: 0.14.0
 Summary: A tiny CLI for delegating bounded agent tasks to Cursor, Droid, OpenAI Codex, Claude Code, Grok Build, or Kimi Code runtimes.
 Author: Trey Goff
 License-Expression: MIT
@@ -221,8 +221,17 @@ run, use stateless `call` mode:
 
 ```bash
 delegate --json codex call "Summarize this context in three bullets."
+delegate --json claude call --pure --timeout 60 --output-schema result.schema.json < prompt.txt
 ```
 
+`call --pure` is a hostile-input completion boundary available on Claude only.
+It uses an empty temporary cwd, an allowlisted child environment, no Delegate
+prompt framing, and no session persistence or tools according to the engine
+capability contract. Claude receives the prompt only on stdin and is
+schema-capable via `--output-schema`; `delegate --json describe` reports
+`pureCall`, `structuredOutput`, `noSessionPersistence`, `usageEvents`, and
+`promptStdin` per engine. `--timeout SECONDS` applies to every call-mode engine.
+
 For multi-step fan-out or gated review flows, use Delegate Workflows. A workflow
 is a Python script that launches normal Delegate child runs, journals progress,
 can pause on approval gates, and can resume from cached child results:
@@ -243,6 +252,21 @@ delegate --json dry-run codex safe --reasoning-effort high "Review this reposito
 delegate --json dry-run claude safe --reasoning-effort high "Review this repository. Do not edit files."
 ```
 
+Codex model routing is deliberately model-first rather than aliasing every
+model/effort pair: define model aliases in `codex.models`, then set effort per
+run with `--reasoning-effort`. Per-model effort menus (including any efforts
+newer than the bundled data) belong in the private `reasoning.capabilities`
+config block, which overrides the bundled defaults.
+
+Fast mode is an independent per-run serving choice. `--fast` requests Codex's
+Fast service tier, `--no-fast` explicitly requests Standard, and omitting both
+inherits the active Codex configuration:
+
+```bash
+delegate codex safe --model my-alias --reasoning-effort medium --fast "Explore likely causes."
+delegate codex work --model my-alias --reasoning-effort high --no-fast "Implement and verify."
+```
+
 Inspect tracked output by alias:
 
 ```bash
@@ -279,6 +303,9 @@ cancelled, and `124` on timeout. `cancel` signals the run's process group
 start-identity check against PID reuse; a cancelled run reports `cancelled`
 rather than a false success. Tag a batch of launches with `--group NAME` and
 `wait`, `runs`, and the worktree commands can select the whole group at once.
+Commit between grouped feature waves that edit the same workspace. If features
+need separate review or commits, give each a persistent worktree and integrate
+them separately; `wait --group` warns about shared non-isolated workspaces.
 
 ## Task design: cluster related work into fewer, richer delegations
 

{delegate_agent_cli-0.13.0 → delegate_agent_cli-0.14.0}/README.md

@@ -188,8 +188,17 @@ run, use stateless `call` mode:
 
 ```bash
 delegate --json codex call "Summarize this context in three bullets."
+delegate --json claude call --pure --timeout 60 --output-schema result.schema.json < prompt.txt
 ```
 
+`call --pure` is a hostile-input completion boundary available on Claude only.
+It uses an empty temporary cwd, an allowlisted child environment, no Delegate
+prompt framing, and no session persistence or tools according to the engine
+capability contract. Claude receives the prompt only on stdin and is
+schema-capable via `--output-schema`; `delegate --json describe` reports
+`pureCall`, `structuredOutput`, `noSessionPersistence`, `usageEvents`, and
+`promptStdin` per engine. `--timeout SECONDS` applies to every call-mode engine.
+
 For multi-step fan-out or gated review flows, use Delegate Workflows. A workflow
 is a Python script that launches normal Delegate child runs, journals progress,
 can pause on approval gates, and can resume from cached child results:
@@ -210,6 +219,21 @@ delegate --json dry-run codex safe --reasoning-effort high "Review this reposito
 delegate --json dry-run claude safe --reasoning-effort high "Review this repository. Do not edit files."
 ```
 
+Codex model routing is deliberately model-first rather than aliasing every
+model/effort pair: define model aliases in `codex.models`, then set effort per
+run with `--reasoning-effort`. Per-model effort menus (including any efforts
+newer than the bundled data) belong in the private `reasoning.capabilities`
+config block, which overrides the bundled defaults.
+
+Fast mode is an independent per-run serving choice. `--fast` requests Codex's
+Fast service tier, `--no-fast` explicitly requests Standard, and omitting both
+inherits the active Codex configuration:
+
+```bash
+delegate codex safe --model my-alias --reasoning-effort medium --fast "Explore likely causes."
+delegate codex work --model my-alias --reasoning-effort high --no-fast "Implement and verify."
+```
+
 Inspect tracked output by alias:
 
 ```bash
@@ -246,6 +270,9 @@ cancelled, and `124` on timeout. `cancel` signals the run's process group
 start-identity check against PID reuse; a cancelled run reports `cancelled`
 rather than a false success. Tag a batch of launches with `--group NAME` and
 `wait`, `runs`, and the worktree commands can select the whole group at once.
+Commit between grouped feature waves that edit the same workspace. If features
+need separate review or commits, give each a persistent worktree and integrate
+them separately; `wait --group` warns about shared non-isolated workspaces.
 
 ## Task design: cluster related work into fewer, richer delegations
 

{delegate_agent_cli-0.13.0 → delegate_agent_cli-0.14.0}/docs/cli-reference.md

@@ -28,9 +28,9 @@ delegate droid [MODEL_ALIAS] safe [--model <alias-or-model>] [--reasoning-effort
 delegate droid [MODEL_ALIAS] work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
 delegate droid [MODEL_ALIAS] call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
 
-delegate codex safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [--output-schema FILE] [prompt...]
-delegate codex work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [--output-schema FILE] [prompt...]
-delegate codex call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [--output-schema FILE] [prompt...]
+delegate codex safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--fast|--no-fast] [--progress] [--forbid-commit] [--prompt-file PATH] [--output-schema FILE] [prompt...]
+delegate codex work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--fast|--no-fast] [--progress] [--forbid-commit] [--prompt-file PATH] [--output-schema FILE] [prompt...]
+delegate codex call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--fast|--no-fast] [--prompt-file PATH] [--output-schema FILE] [prompt...]
 
 delegate claude safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
 delegate claude work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
@@ -57,6 +57,13 @@ positional prompt input, and Kimi Code prompt mode currently uses `--prompt`,
 so those launches still use argv transport; Delegate redacts Cursor and Kimi
 prompt argv in dry-run output and run manifests.
 
+Temporary safe isolation also re-roots absolute paths under the source workspace
+when it transports the prompt, so `/source/repo/src/app.py` becomes the matching
+path inside the isolated copy. Paths outside the workspace and prefix lookalikes
+are left unchanged. The safe prompt asks the child to cite workspace-relative
+paths in its report; consumers should not depend on temporary isolation paths.
+Verbatim slash pass-through prompts are not rewritten.
+
 For launch and `dry-run` commands, `--json` and `--isolation auto|none|worktree`
 are unambiguous before inline prompt text starts and may appear with launch
 options, such as `delegate codex work --prompt-file task.md --json` or
@@ -77,6 +84,8 @@ engines report live unsupported).
 
 `--reasoning-effort LEVEL` is optional and parsed only before prompt text begins. Engines with capability metadata reject unsupported model/effort pairs before launch with `unsupported_reasoning_effort`. It affects only model reasoning depth, cost, or latency; it does not change `safe`/`work`/`call` permissions, sandboxing, approvals, network policy, or edit capability. Cursor effort is model-selection based and requires `cursor.reasoningEffortModels`; an explicit `--model` wins over effort→model routing. Droid emits `--reasoning-effort LEVEL`; Codex emits a `model_reasoning_effort` config override for the resolved model, or for the Codex harness default model when no `codex.defaultModel` is configured and the request was explicit; Claude emits Claude Code `--effort LEVEL`; Grok emits Grok `--effort LEVEL` (`low`, `medium`, `high`, `xhigh`, `max`); OpenCode emits `--variant LEVEL` without validating it against the selected model. Kimi does not support reasoning effort in v1.
 
+`--fast` and `--no-fast` are Codex-only, mutually exclusive per-run service-tier overrides. `--fast` emits `service_tier="fast"` plus `features.fast_mode=true` (Codex silently drops a Fast tier when that feature flag is off in the ambient config, so Delegate enables it explicitly); `--no-fast` emits `service_tier="default"` so a globally enabled Fast setting can be turned off for one child. Omitting both emits no override and inherits Codex configuration. Fast is orthogonal to model selection, reasoning effort, and Delegate safety policy. Two upstream caveats: Codex strips the service tier when authenticated with an API key (Fast is a ChatGPT-plan feature), and neither Codex nor the API fails on a tier the model does not offer — Delegate's flag validation is the only fail-closed layer, so an unsupported combination degrades silently to standard routing rather than erroring.
+
 `--progress` enables parent progress heartbeats on stderr for tracked foreground
 runs. `--no-progress` disables them even when `progress.enabled` is true in
 config. When neither flag is set, config `progress.enabled` applies (default
@@ -123,6 +132,11 @@ A few boundaries are worth stating explicitly:
 create an orchestration manifest; it only enables selectors such as
 `delegate runs --group NAME`, `delegate wait --group NAME`, and worktree
 management filters. Group names must match `[A-Za-z0-9._-]{1,64}`.
+If grouped feature waves run in the same non-isolated workspace, commit between
+waves so later edits do not become interleaved with earlier work. When features
+need separate review or commits, launch each in a persistent worktree and
+integrate them separately; `wait --group` warns when it sees shared same-tree
+work runs.
 
 `--auth-profile NAME` selects a top-level `profiles.definitions` entry and
 injects that profile's flat env map into child processes. It overrides ambient
@@ -137,13 +151,15 @@ auth/env selection happens.
 Usage:
 
 ```bash
-delegate [--json] [--isolation auto|none|worktree] codex {safe,work,call} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [--output-schema FILE] [prompt...]
+delegate [--json] [--isolation auto|none|worktree] codex {safe,work} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--fast|--no-fast] [--progress] [--forbid-commit] [--prompt-file PATH] [--output-schema FILE] [prompt...]
+delegate [--json] codex call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--fast|--no-fast] [--prompt-file PATH] [--output-schema FILE] [prompt...]
 ```
 
 - Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff. Codex safe always uses `--sandbox read-only`. Under `--isolation auto`, Codex safe is the only safe harness that may opt out with `--isolation none`, because Codex still keeps its read-only sandbox active.
 - Prompt text is delivered on stdin to `codex exec`; dry-run argv and tracked run manifests do not contain the prompt.
 - Model selection uses `--model` (alias from `codex.models` or a raw model ID), the run-input JSON `model`, or `codex.defaultModel`.
 - `--reasoning-effort` maps to a Codex `model_reasoning_effort` config override after the model is resolved.
+- `--fast` requests Codex Fast for one run; `--no-fast` explicitly requests Standard; omission inherits Codex configuration. The selected tier is recorded as `requestedFast` when explicit.
 - `--output-schema FILE` is **codex-only**. Every other engine rejects it. `FILE` is a path to a JSON Schema that OpenAI enforces on Codex's final message, for machine-parseable output in fan-outs and JSON run input. Relative paths resolve against the process launch cwd, the same rule as `--prompt-file`. When set, Delegate suppresses the completion-report prompt injection for that run so the schema owns the whole final message. Missing or unreadable files fail fast before launch.
 
 Examples:
@@ -151,6 +167,7 @@ Examples:
 ```bash
 delegate codex safe "Review this repo for regressions; report file/line/severity."
 delegate codex safe --model gpt-5.5 "Review this repo for regressions; report file/line/severity."
+delegate codex safe --model my-alias --reasoning-effort medium --fast "Explore likely causes."
 delegate codex work "Implement the scoped task; report changed files and tests."
 delegate codex call "Summarize this context in three bullets."
 delegate --json codex safe --output-schema findings.schema.json "Return one record per finding."
@@ -162,7 +179,8 @@ delegate --isolation worktree codex work "Implement the feature in a persistent
 Usage:
 
 ```bash
-delegate [--json] [--isolation auto|none|worktree] claude {safe,work,call} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] [--isolation auto|none|worktree] claude {safe,work} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] claude call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
 ```
 
 - Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff. Under `--isolation auto`, Claude safe uses `--permission-mode plan`, `--strict-mcp-config`, Read/Grep/Glob, and selected read-only Bash tools such as `git diff`/`git status`.
@@ -187,7 +205,8 @@ delegate --isolation worktree claude work "Implement the feature in a persistent
 Usage:
 
 ```bash
-delegate [--json] [--isolation auto|none|worktree] grok {safe,work,call} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] [--isolation auto|none|worktree] grok {safe,work} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] grok call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
 ```
 
 - Safe mode reviews your **current working tree** in an isolated throwaway copy plus Grok read-only controls (`--sandbox read-only`, `--permission-mode dontAsk` by default). Delegate does not use Grok `plan` mode for safe review.
@@ -270,7 +289,8 @@ delegate --isolation worktree opencode work "Implement the feature in a persiste
 Usage:
 
 ```bash
-delegate [--json] [--isolation auto|none|worktree] kimi {safe,work,call} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] [--isolation auto|none|worktree] kimi {safe,work} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] kimi call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
 ```
 
 - Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff. Under `--isolation auto`, Kimi safe uses a read-only safety prompt. Delegate intentionally avoids Kimi `--plan` in safe mode. Kimi prompt mode auto-approves tool actions, so the isolation is the effective write boundary; the safety prompt is advisory.
@@ -304,8 +324,8 @@ delegate [--json] workflow run --resume <wfId> [--budget N]
 delegate [--json] workflow status <wfId>
 delegate [--json] workflow events <wfId> [--since SEQ]
 delegate [--json] workflow watch <wfId> [--since SEQ]
-delegate [--json] workflow wait <wfId> [--timeout SEC]
-delegate [--json] workflow result <wfId>
+delegate [--json] workflow wait [<wfId>] [--timeout SEC]
+delegate [--json] workflow result [<wfId>] [--field KEY]
 delegate [--json] workflow approve <wfId>
 delegate [--json] workflow kill <wfId>
 delegate [--json] workflow list
@@ -315,9 +335,18 @@ delegate [--json] workflow save <script.py> --name NAME
 - `check` validates the workflow script, including literal preflight checks for
   unsupported `agent()` combinations.
 - `run` launches a detached supervisor; `--dry-run` renders planned stubs
-  without launching child agents or consuming real budget.
+  without launching child agents or consuming real budget. Each entry in
+  `runTree.calls` includes the resolved `model`, `effort`, `fast`, `isolation`,
+  and UTF-8 `promptBytes`; Cursor/Kimi prompts over 102400 bytes add a warning
+  before their argv transport limit can fail a real run.
 - `--resume` replays the journal, adopts matching child runs by workflow agent
   key, and continues from missing work.
+- `wait` and `result` accept an explicit workflow ID or, when omitted, resolve
+  the latest eligible workflow. JSON output for implicit selection includes the
+  selected `wfId` and `resolutionKind: "latest"`.
+- `result --field KEY` extracts a top-level field from an object result. Text
+  mode prints strings directly and JSON-encodes other values; JSON mode returns
+  a field/value envelope.
 - `approve` releases a paused gate (and resumes). Do not also run
   `run --resume` for the same gate — approve already is that resume. `kill`
   validates the supervisor process group before signaling and always attempts
@@ -336,6 +365,7 @@ Codes raised as `DelegateError` from workflow commands (`workflows/commands.py`)
 | `invalid_workflow_name` | Saved-workflow `--name` is not a simple file stem. |
 | `invalid_workflow_script` | Script failed `check` / load validation. |
 | `missing_workflow` | A verb that needs `<wfId>` was invoked without one. |
+| `missing_workflow_result_field` | `result --field` was invoked without a key. |
 | `missing_workflow_save_args` | `save` needs both `<script.py>` and `--name`. |
 | `missing_workflow_script` | `run`/`check` need `<script.py>` or `--name`. |
 | `unknown_workflow_action` | Unrecognized `workflow` subcommand. |
@@ -344,6 +374,8 @@ Codes raised as `DelegateError` from workflow commands (`workflows/commands.py`)
 | `workflow_not_found` | No workflow directory / status for that `wfId`. |
 | `workflow_not_gated` | `approve` on a workflow that is not paused on a gate. |
 | `workflow_result_missing` | `result` before `result.json` exists. |
+| `workflow_result_field_missing` | The requested top-level result field does not exist. |
+| `workflow_result_not_object` | `--field` was requested for a non-object result. |
 | `workflow_script_not_found` | Resolved script path is missing or not a file. |
 
 See [Delegate Workflows](delegate-workflows.md) for the DSL, caps, config, and
@@ -352,24 +384,26 @@ gate semantics.
 ### Stateless `call` mode
 
 `call` is the one-hop model-call form of Delegate: "work mode minus a repo." It
-gives a child runtime a prompt with no project tree to resolve, captures the
-final assistant text, and exits without creating a tracked run — so you can call
-a model to *do something* (or to *judge something*) from anywhere, including a
-non-git directory.
+gives a child runtime a prompt with no project tree to resolve and captures the
+final assistant text, so you can call a model to *do something* (or to *judge
+something*) from anywhere, including a non-git directory. Calls are untracked
+by default; grouped calls are the narrow exception described below.
 
 ```bash
 delegate codex call "Write a Python script that finds the 500th prime and run it."
 delegate --json grok call --read-only --prompt-file rubric.md
 delegate --json codex call --read-only --output-schema verdict.json --prompt-file rubric.md
+delegate --json claude call --pure --timeout 60 --output-schema verdict.json < rubric.md
 ```
 
 Call mode uses an empty temporary cwd instead of resolving the current repo, and
-it deletes that cwd after the child exits. It does not write `.delegate/runs`,
-create snapshots, inject safe/work skill or completion-report framing, emit
-progress heartbeats, or honor persistent worktree/commit policy options. JSON
+it deletes that cwd after the child exits. It does not create snapshots, inject
+safe/work skill or completion-report framing, emit progress heartbeats, or honor
+persistent worktree/commit policy options. JSON
 output returns fields such as `ok`, `status`, `exitCode`, `engine`, `mode`,
-`model`, `text`, `textChars`, `textTruncated`, `stdoutBytes`, `stderrBytes`,
-reasoning metadata, and `warnings`. Failed calls include a redacted `stderrTail`.
+`model`, `pure`, `structuredOutput`, `modelRequested`, `modelResolved`, `usage`,
+`text`, `textChars`, `textTruncated`, `stdoutBytes`, `stderrBytes`, reasoning
+metadata, and `warnings`. Failed calls include a redacted `stderrTail`.
 `textTruncated` is `true` when the returned
 `text` was bounded (large outputs keep the head and tail); `textChars` is the
 full untruncated character count.
@@ -388,11 +422,38 @@ changed files…" on a repo-flavored prompt. Pair it with `--output-schema` (Cod
 for structured verdicts. Use `--read-only` for any LLM-as-judge, grader, or
 oracle use where the text is the product and the model must not act.
 
-`--read-only` applies only to `call`; passing it with `safe`/`work` is rejected.
-Because call mode is stateless, `--cwd`, `--isolation`, `--pass-through`,
+**`--pure` is the hostile-content completion boundary.** It is supported by
+Claude only; other engines fail before launch with `unsupported_pure_call`. Pure
+mode sends the prompt verbatim, drops ambient
+environment variables outside the documented allowlist, and cannot be combined
+with `--read-only`. Claude uses `--safe-mode`, disables every tool, ignores MCP
+and ambient customization, disables session persistence, and receives the prompt
+only on stdin. Use `--output-schema FILE` with Claude (schema contents inline)
+or with ordinary Codex call mode (schema path).
+
+`--timeout SECONDS` is a positive integer available on every call-mode engine.
+On expiry Delegate terminates the whole child process group and returns
+`call_timeout` with exit code 1.
+
+`--read-only`, `--pure`, and `--timeout` apply only to `call`; passing them with
+`safe`/`work` is rejected.
+Because the child call is stateless, `--isolation`, `--pass-through`,
 `--progress`, `--forbid-commit`, and markdown completion reports are rejected.
-Use `safe` or `work` when the child should see the project tree or when you need
-run registry inspection.
+An ordinary call also rejects `--cwd`.
+
+**Grouped calls preserve workflow tracking without exposing the workspace to the
+child.** `--group NAME` registers the call in the invocation workspace so
+workflow kill/adopt and group selectors can find it. In that one combination,
+`--cwd PATH` may select the registry/config workspace:
+
+```bash
+delegate --cwd /path/to/project --group wf_0123abcdef45 codex call "Summarize this input."
+```
+
+The child still executes in an empty temporary cwd; `--cwd` does not give it the
+project tree. Dry-run accepts the same combination for faithful planning but
+creates no run entry. Use `safe` or `work` when the child should see the project
+tree.
 
 ### Dry-run
 
@@ -513,6 +574,7 @@ Supported input keys:
   "cwd": "/path/to/workspace",
   "isolation": "worktree",
   "reasoningEffort": "high",
+  "fast": false,
   "progress": true,
   "forbidCommit": true,
   "includeDirty": true,
@@ -527,10 +589,11 @@ Supported input keys:
 - `cwd`: optional workspace path. Git directories resolve to the repo root. Omit it for `mode: "call"`, which always uses an empty temporary cwd.
 - `isolation`: optional `auto`, `none`, or `worktree`. `null` is invalid. `mode: "call"` rejects isolation. For Cursor, Claude, Grok, Devin, OpenCode, Droid, and Kimi safe mode, `none` is normalized to `auto` with a warning.
 - `reasoningEffort`: optional non-empty effort string. It overrides provider `defaultReasoningEffort` for that JSON run.
+- `fast`: optional Codex-only boolean or `null`. `true` requests Fast, `false` explicitly requests Standard, and `null`/omission inherits Codex configuration.
 - `progress`: optional boolean. `true` enables parent progress heartbeats on stderr; `false` disables them even when `progress.enabled` is true in config. When omitted, config `progress.enabled` applies (default `false`). `mode: "call"` rejects progress.
 - `forbidCommit`: optional boolean. `true` requires `mode: "work"` with persistent worktree isolation and fails the run if the child creates commits. `mode: "call"` rejects commit policy.
 - `includeDirty`: optional boolean. `true` requires `mode: "work"` with persistent worktree isolation and syncs tracked edits plus untracked non-ignored files into the new worktree before launch.
-- `outputSchema`: optional path to a JSON Schema for Codex's final message. Codex-only; same semantics as `--output-schema`. Other engines fail with `unsupported_output_schema`.
+- `outputSchema`: optional path to a JSON Schema for the final message. Supported for Codex and Claude call mode (same semantics as `--output-schema`). Other engines fail with `unsupported_output_schema`.
 - `prompt`: required task prompt.
 
 `profile` is not accepted in run input JSON. Configure the Codex CLI config
@@ -728,7 +791,8 @@ signals the recorded process group with SIGTERM, waits a 5s grace period, then
 uses SIGKILL if needed. It never signals pid/pgid `<= 1`. Legacy runs without a
 recorded pgid fall back to the recorded pid with a warning. Cancel marks the run
 `cancelled` with `failureReason: cancelled_by_user` and records current captured
-stdout/stderr byte counts. `call` mode is untracked and therefore not cancellable.
+stdout/stderr byte counts. Ungrouped `call` mode is untracked; grouped calls are
+registered and can be selected for cancellation.
 
 Before sending any signal, cancel stamps a `cancelRequested: true` marker (with
 a `cancelRequestedAt` timestamp) on the run state under the registry lock, so

{delegate_agent_cli-0.13.0 → delegate_agent_cli-0.14.0}/docs/configuration.md

@@ -138,6 +138,11 @@ layers. This is read-only observability; inspecting it does not modify
 
 Reasoning-effort settings are optional. A per-run `--reasoning-effort LEVEL` or JSON `reasoningEffort` overrides provider defaults. If no effort is requested or defaulted, Delegate emits no reasoning-effort argv and preserves current runtime behavior.
 
+Codex Fast is intentionally not a Delegate config default. Use per-run
+`--fast`, `--no-fast`, or JSON `fast`; omission inherits the active Codex CLI
+configuration. This keeps speed selection independent from model aliases and
+reasoning defaults.
+
 ## Sections
 
 ### `tracking`

{delegate_agent_cli-0.13.0 → delegate_agent_cli-0.14.0}/docs/security-model.md

@@ -100,6 +100,35 @@ you need registry inspection.
 OpenCode `call --read-only` uses the same protected environment settings and
 `--pure` plugin restriction as OpenCode safe mode.
 
+`call --pure` is a separate, stronger completion boundary. It is currently
+supported on **Claude only**. Delegate sends the prompt verbatim on stdin, starts
+the child in an empty temporary cwd, and builds the child environment from only
+`PATH`, `HOME`, `USER`, `LOGNAME`, `SHELL`, `TMPDIR`, `LANG`, `LC_ALL`, `LC_CTYPE`,
+and `TERM`, then applies trusted Delegate profile overrides. Claude additionally
+uses `--safe-mode --tools "" --strict-mcp-config --no-session-persistence`, and the
+result must carry an empty `permission_denials` list — a missing, null, or
+non-empty value fails the call closed (`pure_boundary_unverified` /
+`pure_boundary_violation`) rather than reporting success.
+
+Codex and OpenCode are **not** pure-eligible; `<engine> call --pure` is rejected
+before launch (`unsupported_pure_call`). They were disabled after review:
+
+- **Codex** would need external OS confinement (a macOS Seatbelt profile) because
+  it stays a tool-using agent. The prototype handed the child an ephemeral
+  `CODEX_HOME` holding the resolved `auth.json`, but a single inherited Seatbelt
+  profile cannot distinguish a read by the Codex parent from a read by a
+  model-driven subprocess, so the credential was reachable inside the boundary it
+  was meant to protect. A credential transport the parent can use but model tools
+  cannot read is required before Codex pure is re-enabled. `sandbox-exec` is also
+  deprecated on macOS and would never cover other platforms.
+- **OpenCode**'s native `--pure` only disables external plugins; it offers no
+  session non-persistence, no schema output, and no denial tripwire, so it does
+  not meet the hostile-input contract.
+
+Fail-closed eligibility is intentional: an engine without a verified boundary
+rejects `--pure` rather than presenting a weaker one under the same name. The
+supported pure matrix may contain only Claude for some time.
+
 ## Reasoning-effort boundary
 
 `--reasoning-effort LEVEL` and JSON `reasoningEffort` request model thinking depth only. They do not change:
@@ -118,6 +147,14 @@ combinations before launch. OpenCode is the exception: Delegate passes the value
 through as `--variant`, and OpenCode may silently ignore an unknown variant.
 Treat higher effort as a possible latency/cost change, not as a safety control.
 
+## Codex Fast boundary
+
+`--fast`, `--no-fast`, and JSON `fast` select a Codex service tier for one run.
+They do not change the selected model, reasoning effort, sandbox, approvals,
+isolation, network policy, credentials, or edit capability. Fast may consume
+plan usage at a different rate; treat it as a latency/usage choice, never a
+security control.
+
 ## Isolation boundaries
 
 ### Temporary safe isolation

{delegate_agent_cli-0.13.0 → delegate_agent_cli-0.14.0}/docs/worktrees.md

@@ -12,6 +12,10 @@ Use persistent worktree isolation when:
 
 Use the real workspace instead when the task depends on uncommitted local files that you do not want to commit or mirror into a worktree. If you do want a persistent worktree that starts from your current dirty checkout, use `--include-dirty`.
 
+For grouped feature waves, commit between waves when they share the real
+workspace. If each feature needs its own review or commit, use one persistent
+worktree per feature and integrate those worktrees separately.
+
 ## Launch
 
 ```bash

{delegate_agent_cli-0.13.0 → delegate_agent_cli-0.14.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "delegate-agent-cli"
-version = "0.13.0"
+version = "0.14.0"
 description = "A tiny CLI for delegating bounded agent tasks to Cursor, Droid, OpenAI Codex, Claude Code, Grok Build, or Kimi Code runtimes."
 readme = "README.md"
 requires-python = ">=3.11"

{delegate_agent_cli-0.13.0 → delegate_agent_cli-0.14.0}/src/delegate_agent/__init__.py

@@ -1,5 +1,5 @@
 """Delegate Agent CLI package."""
 
-VERSION = "0.13.0"
+VERSION = "0.14.0"
 
 __all__ = ["VERSION"]