delegate-agent-cli 0.13.1__tar.gz → 0.14.0__tar.gz

{delegate_agent_cli-0.13.1 → delegate_agent_cli-0.14.0}/CHANGELOG.md

@@ -5,6 +5,52 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.14.0] - 2026-07-15
+
+### Added
+
+- `workflow result --field` for extracting a single field from a workflow
+  result, reliable latest-workflow selection, immutable creation ordering,
+  dry-run visibility, and orphan detection (PR #14).
+- Schema validation for `agent()` results supports `minLength` and
+  `minItems`, including in retries and dry-run placeholders (PR #14).
+- Grouped work runs sharing one non-isolated workspace now emit a warning
+  with guidance for commit boundaries and persistent worktrees (PR #13).
+
+### Changed
+
+- Focused call help (`delegate <engine> call --help`) now reflects
+  call-mode option boundaries and documents the grouped-call tracking
+  exception (`--cwd` accepted only with `--group`); explicit `agent` input
+  is rejected on engines that do not support it (PR #13).
+- Overview, dry-run, agent-help, README, CLI reference, and worktree docs
+  corrected from user feedback (PR #13).
+
+### Fixed
+
+- Structured Codex workflows consume the child-authored completion report
+  (including on resume) and fail closed when it is missing; workflow resume
+  transitions atomically to `starting`, hides stale results, rolls back
+  failed launches, and releases locks on preparation errors (PR #14).
+- Safe isolation re-roots exact source-workspace paths while preserving
+  slash-command payloads verbatim (PR #14).
+- `wait`: a run matched by both `--latest HARNESS` and `--group NAME`
+  was emitted twice in the resolved-target list; it now appears once, with
+  first-selection precedence and ordering preserved.
+- `git_root_for` degrades any `OSError` from the git probe (not just
+  `FileNotFoundError`) to the non-git fallback, so e.g. a `PermissionError`
+  spawning git no longer crashes workspace resolution.
+
+### Changed
+
+- Internal cleanup pass across `src/` and `tests/`: removed dead code (unused
+  protocol types, private helpers, stale fixtures), collapsed redundant
+  exception tuples into their `OSError` base, replaced a hand-rolled
+  path-containment helper with `Path.is_relative_to`, and stripped stale
+  review-artifact comments. Behavior-preserving; the workflow supervisor's
+  broad exception boundary around child-model output is now explicitly
+  commented and regression-tested.
+
 ## [0.13.1] - 2026-07-09
 
 ### Added
@@ -304,6 +350,7 @@ Usage-audit fix wave: 82 sessions and 1,241 delegate invocations from one week o
 
 - Releases before 0.1.3 predate this changelog.
 
+[0.14.0]: https://github.com/treygoff24/delegate-agent/compare/v0.13.1...v0.14.0
 [0.13.1]: https://github.com/treygoff24/delegate-agent/compare/v0.13.0...v0.13.1
 [0.13.0]: https://github.com/treygoff24/delegate-agent/compare/v0.12.0...v0.13.0
 [0.12.0]: https://github.com/treygoff24/delegate-agent/compare/v0.11.0...v0.12.0

{delegate_agent_cli-0.13.1 → delegate_agent_cli-0.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: delegate-agent-cli
-Version: 0.13.1
+Version: 0.14.0
 Summary: A tiny CLI for delegating bounded agent tasks to Cursor, Droid, OpenAI Codex, Claude Code, Grok Build, or Kimi Code runtimes.
 Author: Trey Goff
 License-Expression: MIT
@@ -221,8 +221,17 @@ run, use stateless `call` mode:
 
 ```bash
 delegate --json codex call "Summarize this context in three bullets."
+delegate --json claude call --pure --timeout 60 --output-schema result.schema.json < prompt.txt
 ```
 
+`call --pure` is a hostile-input completion boundary available on Claude only.
+It uses an empty temporary cwd, an allowlisted child environment, no Delegate
+prompt framing, and no session persistence or tools according to the engine
+capability contract. Claude receives the prompt only on stdin and is
+schema-capable via `--output-schema`; `delegate --json describe` reports
+`pureCall`, `structuredOutput`, `noSessionPersistence`, `usageEvents`, and
+`promptStdin` per engine. `--timeout SECONDS` applies to every call-mode engine.
+
 For multi-step fan-out or gated review flows, use Delegate Workflows. A workflow
 is a Python script that launches normal Delegate child runs, journals progress,
 can pause on approval gates, and can resume from cached child results:
@@ -294,6 +303,9 @@ cancelled, and `124` on timeout. `cancel` signals the run's process group
 start-identity check against PID reuse; a cancelled run reports `cancelled`
 rather than a false success. Tag a batch of launches with `--group NAME` and
 `wait`, `runs`, and the worktree commands can select the whole group at once.
+Commit between grouped feature waves that edit the same workspace. If features
+need separate review or commits, give each a persistent worktree and integrate
+them separately; `wait --group` warns about shared non-isolated workspaces.
 
 ## Task design: cluster related work into fewer, richer delegations
 

{delegate_agent_cli-0.13.1 → delegate_agent_cli-0.14.0}/README.md

@@ -188,8 +188,17 @@ run, use stateless `call` mode:
 
 ```bash
 delegate --json codex call "Summarize this context in three bullets."
+delegate --json claude call --pure --timeout 60 --output-schema result.schema.json < prompt.txt
 ```
 
+`call --pure` is a hostile-input completion boundary available on Claude only.
+It uses an empty temporary cwd, an allowlisted child environment, no Delegate
+prompt framing, and no session persistence or tools according to the engine
+capability contract. Claude receives the prompt only on stdin and is
+schema-capable via `--output-schema`; `delegate --json describe` reports
+`pureCall`, `structuredOutput`, `noSessionPersistence`, `usageEvents`, and
+`promptStdin` per engine. `--timeout SECONDS` applies to every call-mode engine.
+
 For multi-step fan-out or gated review flows, use Delegate Workflows. A workflow
 is a Python script that launches normal Delegate child runs, journals progress,
 can pause on approval gates, and can resume from cached child results:
@@ -261,6 +270,9 @@ cancelled, and `124` on timeout. `cancel` signals the run's process group
 start-identity check against PID reuse; a cancelled run reports `cancelled`
 rather than a false success. Tag a batch of launches with `--group NAME` and
 `wait`, `runs`, and the worktree commands can select the whole group at once.
+Commit between grouped feature waves that edit the same workspace. If features
+need separate review or commits, give each a persistent worktree and integrate
+them separately; `wait --group` warns about shared non-isolated workspaces.
 
 ## Task design: cluster related work into fewer, richer delegations
 

{delegate_agent_cli-0.13.1 → delegate_agent_cli-0.14.0}/docs/cli-reference.md

@@ -57,6 +57,13 @@ positional prompt input, and Kimi Code prompt mode currently uses `--prompt`,
 so those launches still use argv transport; Delegate redacts Cursor and Kimi
 prompt argv in dry-run output and run manifests.
 
+Temporary safe isolation also re-roots absolute paths under the source workspace
+when it transports the prompt, so `/source/repo/src/app.py` becomes the matching
+path inside the isolated copy. Paths outside the workspace and prefix lookalikes
+are left unchanged. The safe prompt asks the child to cite workspace-relative
+paths in its report; consumers should not depend on temporary isolation paths.
+Verbatim slash pass-through prompts are not rewritten.
+
 For launch and `dry-run` commands, `--json` and `--isolation auto|none|worktree`
 are unambiguous before inline prompt text starts and may appear with launch
 options, such as `delegate codex work --prompt-file task.md --json` or
@@ -125,6 +132,11 @@ A few boundaries are worth stating explicitly:
 create an orchestration manifest; it only enables selectors such as
 `delegate runs --group NAME`, `delegate wait --group NAME`, and worktree
 management filters. Group names must match `[A-Za-z0-9._-]{1,64}`.
+If grouped feature waves run in the same non-isolated workspace, commit between
+waves so later edits do not become interleaved with earlier work. When features
+need separate review or commits, launch each in a persistent worktree and
+integrate them separately; `wait --group` warns when it sees shared same-tree
+work runs.
 
 `--auth-profile NAME` selects a top-level `profiles.definitions` entry and
 injects that profile's flat env map into child processes. It overrides ambient
@@ -139,7 +151,8 @@ auth/env selection happens.
 Usage:
 
 ```bash
-delegate [--json] [--isolation auto|none|worktree] codex {safe,work,call} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--fast|--no-fast] [--progress] [--forbid-commit] [--prompt-file PATH] [--output-schema FILE] [prompt...]
+delegate [--json] [--isolation auto|none|worktree] codex {safe,work} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--fast|--no-fast] [--progress] [--forbid-commit] [--prompt-file PATH] [--output-schema FILE] [prompt...]
+delegate [--json] codex call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--fast|--no-fast] [--prompt-file PATH] [--output-schema FILE] [prompt...]
 ```
 
 - Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff. Codex safe always uses `--sandbox read-only`. Under `--isolation auto`, Codex safe is the only safe harness that may opt out with `--isolation none`, because Codex still keeps its read-only sandbox active.
@@ -166,7 +179,8 @@ delegate --isolation worktree codex work "Implement the feature in a persistent
 Usage:
 
 ```bash
-delegate [--json] [--isolation auto|none|worktree] claude {safe,work,call} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] [--isolation auto|none|worktree] claude {safe,work} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] claude call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
 ```
 
 - Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff. Under `--isolation auto`, Claude safe uses `--permission-mode plan`, `--strict-mcp-config`, Read/Grep/Glob, and selected read-only Bash tools such as `git diff`/`git status`.
@@ -191,7 +205,8 @@ delegate --isolation worktree claude work "Implement the feature in a persistent
 Usage:
 
 ```bash
-delegate [--json] [--isolation auto|none|worktree] grok {safe,work,call} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] [--isolation auto|none|worktree] grok {safe,work} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] grok call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
 ```
 
 - Safe mode reviews your **current working tree** in an isolated throwaway copy plus Grok read-only controls (`--sandbox read-only`, `--permission-mode dontAsk` by default). Delegate does not use Grok `plan` mode for safe review.
@@ -274,7 +289,8 @@ delegate --isolation worktree opencode work "Implement the feature in a persiste
 Usage:
 
 ```bash
-delegate [--json] [--isolation auto|none|worktree] kimi {safe,work,call} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] [--isolation auto|none|worktree] kimi {safe,work} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] kimi call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
 ```
 
 - Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff. Under `--isolation auto`, Kimi safe uses a read-only safety prompt. Delegate intentionally avoids Kimi `--plan` in safe mode. Kimi prompt mode auto-approves tool actions, so the isolation is the effective write boundary; the safety prompt is advisory.
@@ -308,8 +324,8 @@ delegate [--json] workflow run --resume <wfId> [--budget N]
 delegate [--json] workflow status <wfId>
 delegate [--json] workflow events <wfId> [--since SEQ]
 delegate [--json] workflow watch <wfId> [--since SEQ]
-delegate [--json] workflow wait <wfId> [--timeout SEC]
-delegate [--json] workflow result <wfId>
+delegate [--json] workflow wait [<wfId>] [--timeout SEC]
+delegate [--json] workflow result [<wfId>] [--field KEY]
 delegate [--json] workflow approve <wfId>
 delegate [--json] workflow kill <wfId>
 delegate [--json] workflow list
@@ -319,9 +335,18 @@ delegate [--json] workflow save <script.py> --name NAME
 - `check` validates the workflow script, including literal preflight checks for
   unsupported `agent()` combinations.
 - `run` launches a detached supervisor; `--dry-run` renders planned stubs
-  without launching child agents or consuming real budget.
+  without launching child agents or consuming real budget. Each entry in
+  `runTree.calls` includes the resolved `model`, `effort`, `fast`, `isolation`,
+  and UTF-8 `promptBytes`; Cursor/Kimi prompts over 102400 bytes add a warning
+  before their argv transport limit can fail a real run.
 - `--resume` replays the journal, adopts matching child runs by workflow agent
   key, and continues from missing work.
+- `wait` and `result` accept an explicit workflow ID or, when omitted, resolve
+  the latest eligible workflow. JSON output for implicit selection includes the
+  selected `wfId` and `resolutionKind: "latest"`.
+- `result --field KEY` extracts a top-level field from an object result. Text
+  mode prints strings directly and JSON-encodes other values; JSON mode returns
+  a field/value envelope.
 - `approve` releases a paused gate (and resumes). Do not also run
   `run --resume` for the same gate — approve already is that resume. `kill`
   validates the supervisor process group before signaling and always attempts
@@ -340,6 +365,7 @@ Codes raised as `DelegateError` from workflow commands (`workflows/commands.py`)
 | `invalid_workflow_name` | Saved-workflow `--name` is not a simple file stem. |
 | `invalid_workflow_script` | Script failed `check` / load validation. |
 | `missing_workflow` | A verb that needs `<wfId>` was invoked without one. |
+| `missing_workflow_result_field` | `result --field` was invoked without a key. |
 | `missing_workflow_save_args` | `save` needs both `<script.py>` and `--name`. |
 | `missing_workflow_script` | `run`/`check` need `<script.py>` or `--name`. |
 | `unknown_workflow_action` | Unrecognized `workflow` subcommand. |
@@ -348,6 +374,8 @@ Codes raised as `DelegateError` from workflow commands (`workflows/commands.py`)
 | `workflow_not_found` | No workflow directory / status for that `wfId`. |
 | `workflow_not_gated` | `approve` on a workflow that is not paused on a gate. |
 | `workflow_result_missing` | `result` before `result.json` exists. |
+| `workflow_result_field_missing` | The requested top-level result field does not exist. |
+| `workflow_result_not_object` | `--field` was requested for a non-object result. |
 | `workflow_script_not_found` | Resolved script path is missing or not a file. |
 
 See [Delegate Workflows](delegate-workflows.md) for the DSL, caps, config, and
@@ -356,24 +384,26 @@ gate semantics.
 ### Stateless `call` mode
 
 `call` is the one-hop model-call form of Delegate: "work mode minus a repo." It
-gives a child runtime a prompt with no project tree to resolve, captures the
-final assistant text, and exits without creating a tracked run — so you can call
-a model to *do something* (or to *judge something*) from anywhere, including a
-non-git directory.
+gives a child runtime a prompt with no project tree to resolve and captures the
+final assistant text, so you can call a model to *do something* (or to *judge
+something*) from anywhere, including a non-git directory. Calls are untracked
+by default; grouped calls are the narrow exception described below.
 
 ```bash
 delegate codex call "Write a Python script that finds the 500th prime and run it."
 delegate --json grok call --read-only --prompt-file rubric.md
 delegate --json codex call --read-only --output-schema verdict.json --prompt-file rubric.md
+delegate --json claude call --pure --timeout 60 --output-schema verdict.json < rubric.md
 ```
 
 Call mode uses an empty temporary cwd instead of resolving the current repo, and
-it deletes that cwd after the child exits. It does not write `.delegate/runs`,
-create snapshots, inject safe/work skill or completion-report framing, emit
-progress heartbeats, or honor persistent worktree/commit policy options. JSON
+it deletes that cwd after the child exits. It does not create snapshots, inject
+safe/work skill or completion-report framing, emit progress heartbeats, or honor
+persistent worktree/commit policy options. JSON
 output returns fields such as `ok`, `status`, `exitCode`, `engine`, `mode`,
-`model`, `text`, `textChars`, `textTruncated`, `stdoutBytes`, `stderrBytes`,
-reasoning metadata, and `warnings`. Failed calls include a redacted `stderrTail`.
+`model`, `pure`, `structuredOutput`, `modelRequested`, `modelResolved`, `usage`,
+`text`, `textChars`, `textTruncated`, `stdoutBytes`, `stderrBytes`, reasoning
+metadata, and `warnings`. Failed calls include a redacted `stderrTail`.
 `textTruncated` is `true` when the returned
 `text` was bounded (large outputs keep the head and tail); `textChars` is the
 full untruncated character count.
@@ -392,11 +422,38 @@ changed files…" on a repo-flavored prompt. Pair it with `--output-schema` (Cod
 for structured verdicts. Use `--read-only` for any LLM-as-judge, grader, or
 oracle use where the text is the product and the model must not act.
 
-`--read-only` applies only to `call`; passing it with `safe`/`work` is rejected.
-Because call mode is stateless, `--cwd`, `--isolation`, `--pass-through`,
+**`--pure` is the hostile-content completion boundary.** It is supported by
+Claude only; other engines fail before launch with `unsupported_pure_call`. Pure
+mode sends the prompt verbatim, drops ambient
+environment variables outside the documented allowlist, and cannot be combined
+with `--read-only`. Claude uses `--safe-mode`, disables every tool, ignores MCP
+and ambient customization, disables session persistence, and receives the prompt
+only on stdin. Use `--output-schema FILE` with Claude (schema contents inline)
+or with ordinary Codex call mode (schema path).
+
+`--timeout SECONDS` is a positive integer available on every call-mode engine.
+On expiry Delegate terminates the whole child process group and returns
+`call_timeout` with exit code 1.
+
+`--read-only`, `--pure`, and `--timeout` apply only to `call`; passing them with
+`safe`/`work` is rejected.
+Because the child call is stateless, `--isolation`, `--pass-through`,
 `--progress`, `--forbid-commit`, and markdown completion reports are rejected.
-Use `safe` or `work` when the child should see the project tree or when you need
-run registry inspection.
+An ordinary call also rejects `--cwd`.
+
+**Grouped calls preserve workflow tracking without exposing the workspace to the
+child.** `--group NAME` registers the call in the invocation workspace so
+workflow kill/adopt and group selectors can find it. In that one combination,
+`--cwd PATH` may select the registry/config workspace:
+
+```bash
+delegate --cwd /path/to/project --group wf_0123abcdef45 codex call "Summarize this input."
+```
+
+The child still executes in an empty temporary cwd; `--cwd` does not give it the
+project tree. Dry-run accepts the same combination for faithful planning but
+creates no run entry. Use `safe` or `work` when the child should see the project
+tree.
 
 ### Dry-run
 
@@ -536,7 +593,7 @@ Supported input keys:
 - `progress`: optional boolean. `true` enables parent progress heartbeats on stderr; `false` disables them even when `progress.enabled` is true in config. When omitted, config `progress.enabled` applies (default `false`). `mode: "call"` rejects progress.
 - `forbidCommit`: optional boolean. `true` requires `mode: "work"` with persistent worktree isolation and fails the run if the child creates commits. `mode: "call"` rejects commit policy.
 - `includeDirty`: optional boolean. `true` requires `mode: "work"` with persistent worktree isolation and syncs tracked edits plus untracked non-ignored files into the new worktree before launch.
-- `outputSchema`: optional path to a JSON Schema for Codex's final message. Codex-only; same semantics as `--output-schema`. Other engines fail with `unsupported_output_schema`.
+- `outputSchema`: optional path to a JSON Schema for the final message. Supported for Codex and Claude call mode (same semantics as `--output-schema`). Other engines fail with `unsupported_output_schema`.
 - `prompt`: required task prompt.
 
 `profile` is not accepted in run input JSON. Configure the Codex CLI config
@@ -734,7 +791,8 @@ signals the recorded process group with SIGTERM, waits a 5s grace period, then
 uses SIGKILL if needed. It never signals pid/pgid `<= 1`. Legacy runs without a
 recorded pgid fall back to the recorded pid with a warning. Cancel marks the run
 `cancelled` with `failureReason: cancelled_by_user` and records current captured
-stdout/stderr byte counts. `call` mode is untracked and therefore not cancellable.
+stdout/stderr byte counts. Ungrouped `call` mode is untracked; grouped calls are
+registered and can be selected for cancellation.
 
 Before sending any signal, cancel stamps a `cancelRequested: true` marker (with
 a `cancelRequestedAt` timestamp) on the run state under the registry lock, so

{delegate_agent_cli-0.13.1 → delegate_agent_cli-0.14.0}/docs/security-model.md

@@ -100,6 +100,35 @@ you need registry inspection.
 OpenCode `call --read-only` uses the same protected environment settings and
 `--pure` plugin restriction as OpenCode safe mode.
 
+`call --pure` is a separate, stronger completion boundary. It is currently
+supported on **Claude only**. Delegate sends the prompt verbatim on stdin, starts
+the child in an empty temporary cwd, and builds the child environment from only
+`PATH`, `HOME`, `USER`, `LOGNAME`, `SHELL`, `TMPDIR`, `LANG`, `LC_ALL`, `LC_CTYPE`,
+and `TERM`, then applies trusted Delegate profile overrides. Claude additionally
+uses `--safe-mode --tools "" --strict-mcp-config --no-session-persistence`, and the
+result must carry an empty `permission_denials` list — a missing, null, or
+non-empty value fails the call closed (`pure_boundary_unverified` /
+`pure_boundary_violation`) rather than reporting success.
+
+Codex and OpenCode are **not** pure-eligible; `<engine> call --pure` is rejected
+before launch (`unsupported_pure_call`). They were disabled after review:
+
+- **Codex** would need external OS confinement (a macOS Seatbelt profile) because
+  it stays a tool-using agent. The prototype handed the child an ephemeral
+  `CODEX_HOME` holding the resolved `auth.json`, but a single inherited Seatbelt
+  profile cannot distinguish a read by the Codex parent from a read by a
+  model-driven subprocess, so the credential was reachable inside the boundary it
+  was meant to protect. A credential transport the parent can use but model tools
+  cannot read is required before Codex pure is re-enabled. `sandbox-exec` is also
+  deprecated on macOS and would never cover other platforms.
+- **OpenCode**'s native `--pure` only disables external plugins; it offers no
+  session non-persistence, no schema output, and no denial tripwire, so it does
+  not meet the hostile-input contract.
+
+Fail-closed eligibility is intentional: an engine without a verified boundary
+rejects `--pure` rather than presenting a weaker one under the same name. The
+supported pure matrix may contain only Claude for some time.
+
 ## Reasoning-effort boundary
 
 `--reasoning-effort LEVEL` and JSON `reasoningEffort` request model thinking depth only. They do not change:

{delegate_agent_cli-0.13.1 → delegate_agent_cli-0.14.0}/docs/worktrees.md

@@ -12,6 +12,10 @@ Use persistent worktree isolation when:
 
 Use the real workspace instead when the task depends on uncommitted local files that you do not want to commit or mirror into a worktree. If you do want a persistent worktree that starts from your current dirty checkout, use `--include-dirty`.
 
+For grouped feature waves, commit between waves when they share the real
+workspace. If each feature needs its own review or commit, use one persistent
+worktree per feature and integrate those worktrees separately.
+
 ## Launch
 
 ```bash

{delegate_agent_cli-0.13.1 → delegate_agent_cli-0.14.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "delegate-agent-cli"
-version = "0.13.1"
+version = "0.14.0"
 description = "A tiny CLI for delegating bounded agent tasks to Cursor, Droid, OpenAI Codex, Claude Code, Grok Build, or Kimi Code runtimes."
 readme = "README.md"
 requires-python = ">=3.11"

{delegate_agent_cli-0.13.1 → delegate_agent_cli-0.14.0}/src/delegate_agent/__init__.py

@@ -1,5 +1,5 @@
 """Delegate Agent CLI package."""
 
-VERSION = "0.13.1"
+VERSION = "0.14.0"
 
 __all__ = ["VERSION"]

{delegate_agent_cli-0.13.1 → delegate_agent_cli-0.14.0}/src/delegate_agent/argv_builders.py

@@ -125,6 +125,13 @@ def _grok_harness_bypass_enabled(config: JsonObject, mode: str) -> bool:
     return _harness_bypass_enabled(config, mode, "grok")
 
 
+def _reject_pure(engine: str, mode: str, pure: bool, *, supported: bool = False) -> None:
+    if not pure:
+        return
+    if mode != MODE_CALL or not supported:
+        raise DelegateError("unsupported_pure_call", f"{engine} does not support pure call mode.")
+
+
 def build_cursor_argv(
     prefix: list[str],
     mode: str,
@@ -134,7 +141,9 @@ def build_cursor_argv(
     *,
     stream_capture: bool = True,
     call_read_only: bool = False,
+    pure: bool = False,
 ) -> list[str]:
+    _reject_pure("cursor", mode, pure)
     argv = [*prefix, "--workspace", workspace, "-p", "--trust"]
     if mode == MODE_WORK:
         argv.extend(["--approve-mcps", "--force"])
@@ -165,7 +174,9 @@ def build_droid_argv(
     reasoning_capability: reasoning.ReasoningCapability | None = None,
     prompt_transport: str = PROMPT_TRANSPORT_ARGV,
     call_read_only: bool = False,
+    pure: bool = False,
 ) -> list[str]:
+    _reject_pure("droid", mode, pure)
     argv = [binary, "exec", "--cwd", workspace]
     if mode == MODE_WORK:
         argv.append("--skip-permissions-unsafe")
@@ -202,7 +213,9 @@ def build_kimi_argv(
     prompt: str,
     *,
     stream_capture: bool = True,
+    pure: bool = False,
 ) -> list[str]:
+    _reject_pure("kimi", mode, pure)
     argv = [str(kimi["binary"])]
     if mode == MODE_SAFE:
         prompt = prefix_kimi_safe_prompt(prompt)
@@ -226,16 +239,35 @@ def build_claude_argv(
     reasoning_effort: str | None = None,
     allow_bypass_permissions: bool = False,
     call_read_only: bool = False,
+    pure: bool = False,
+    output_schema: str | None = None,
 ) -> list[str]:
+    _reject_pure("claude", mode, pure, supported=True)
+    if pure or output_schema is not None:
+        output_format = "json"
+    elif stream_capture:
+        output_format = "stream-json"
+    else:
+        output_format = "text"
     argv = [
         str(claude["binary"]),
         "-p",
         "--output-format",
-        "stream-json" if stream_capture else "text",
+        output_format,
         "--input-format",
         "text",
     ]
-    if mode == MODE_SAFE:
+    if pure:
+        argv.extend(
+            [
+                "--safe-mode",
+                "--tools",
+                "",
+                "--strict-mcp-config",
+                "--no-session-persistence",
+            ]
+        )
+    elif mode == MODE_SAFE:
         argv.extend(
             [
                 "--permission-mode",
@@ -271,10 +303,12 @@ def build_claude_argv(
             argv.extend(["--permission-mode", str(claude.get("workPermissionMode", "auto"))])
     else:
         validate_mode(mode)
-    if claude.get("noSessionPersistence", True) is True:
+    if not pure and claude.get("noSessionPersistence", True) is True:
         argv.append("--no-session-persistence")
-    if claude.get("bare", False) is True:
+    if not pure and claude.get("bare", False) is True:
         argv.append("--bare")
+    if output_schema is not None:
+        argv.extend(["--json-schema", output_schema])
     if model:
         argv.extend(["--model", model])
     if reasoning_effort is not None:
@@ -294,7 +328,9 @@ def build_grok_argv(
     allow_bypass_permissions: bool = False,
     prompt_transport: str = PROMPT_TRANSPORT_FILE,
     call_read_only: bool = False,
+    pure: bool = False,
 ) -> list[str]:
+    _reject_pure("grok", mode, pure)
     argv = [str(grok["binary"]), "--cwd", workspace]
     if stream_capture:
         argv.extend(["--output-format", "streaming-json"])
@@ -358,7 +394,9 @@ def build_devin_argv(
     *,
     prompt_transport: str = PROMPT_TRANSPORT_FILE,
     call_read_only: bool = False,
+    pure: bool = False,
 ) -> list[str]:
+    _reject_pure("devin", mode, pure)
     argv = [str(devin["binary"])]
     if model:
         argv.extend(["--model", model])
@@ -394,8 +432,10 @@ def build_opencode_argv(
     variant: str | None,
     *,
     call_read_only: bool = False,
+    pure: bool = False,
 ) -> list[str]:
-    read_only = mode == MODE_SAFE or (mode == MODE_CALL and call_read_only)
+    _reject_pure("opencode", mode, pure)
+    read_only = mode == MODE_SAFE or (mode == MODE_CALL and (call_read_only or pure))
     argv = [str(opencode["binary"])]
     if read_only:
         argv.append("--pure")
@@ -428,8 +468,39 @@ def build_codex_argv(
     prompt_transport: str = PROMPT_TRANSPORT_ARGV,
     output_schema: str | None = None,
     call_read_only: bool = False,
+    pure: bool = False,
 ) -> list[str]:
+    _reject_pure("codex", mode, pure)
     binary = str(codex["binary"])
+    if pure:
+        argv = [binary]
+        if model:
+            argv.extend(["--model", model])
+        if reasoning_capability is not None:
+            argv.extend(["-c", f'model_reasoning_effort="{reasoning_capability.effort}"'])
+        if fast is not None:
+            service_tier = "fast" if fast else "default"
+            argv.extend(["-c", f'service_tier="{service_tier}"'])
+            if fast:
+                argv.extend(["-c", "features.fast_mode=true"])
+        argv.extend(
+            [
+                "exec",
+                "--ignore-user-config",
+                "--ignore-rules",
+                "--skip-git-repo-check",
+                "--sandbox",
+                "read-only",
+            ]
+        )
+        if output_schema is not None:
+            argv.extend(["--output-schema", output_schema])
+        if stream_capture:
+            argv.extend(["--color", "never", "--json"])
+            if codex.get("ephemeral", True) is True:
+                argv.append("--ephemeral")
+        argv.append("-")
+        return argv
     argv = [binary]
     # Safe mode is read-only by contract: never emit the dangerous bypass flags,
     # even if a policy block somehow carries them. Config validation rejects such

{delegate_agent_cli-0.13.1 → delegate_agent_cli-0.14.0}/src/delegate_agent/argv_utils.py

@@ -35,4 +35,12 @@ def replace_workspace_arg_in_argv(engine: str, argv: list[str], value: str) -> l
 
 def public_argv(request: Request) -> list[str]:
     """Return the display-safe argv for a request (redacted form when present)."""
-    return list(request.display_argv if request.display_argv is not None else request.argv)
+    argv = list(request.display_argv if request.display_argv is not None else request.argv)
+    output_schema = getattr(request, "output_schema", None)
+    if output_schema and request.engine == "claude" and "--json-schema" in argv:
+        redacted = list(argv)
+        idx = redacted.index("--json-schema")
+        if idx + 1 < len(redacted):
+            redacted[idx + 1] = f"<json-schema:{len(redacted[idx + 1])} bytes>"
+        return redacted
+    return argv