delegate-agent-cli 0.13.1__tar.gz → 0.15.0__tar.gz

{delegate_agent_cli-0.13.1 → delegate_agent_cli-0.15.0}/CHANGELOG.md

@@ -5,6 +5,92 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.15.0] - 2026-07-16
+
+### Added
+
+- Work-mode worktree isolation now automatically carries tracked edits and
+  untracked, non-ignored files into the new worktree, with tracked/untracked
+  counts in human and JSON warnings and fail-clean teardown on sync errors.
+- Child environments expose authoritative source/execution root metadata, and
+  Delegate-managed snapshot and worktree cleanup refuses targets that are or
+  contain the source workspace.
+- Empty successful safe and read-only call results retry once when the prompt
+  can be safely extended; tracked runs retain both attempts and envelopes report
+  `emptyRetry` only when a retry was attempted.
+- Bare Harness resolution in Snapshot, run-output, and wait now reports the
+  resolved Run, Alias, workspace, and age, with a stale-resolution warning after
+  24 hours.
+
+### Changed
+
+- `run-output --tail N` now selects stdout when no output stream or Completion
+  Report was requested; stderr remains opt-in.
+- Devin safe mode now fails during preflight with `unsupported_mode` rather than
+  launching without an enforceable read-only boundary.
+- Call children use their throwaway cwd as `DELEGATE_SOURCE_ROOT`; the
+  Registry/config workspace is not disclosed to a stateless call.
+
+### Fixed
+
+- Empty-result retries now preserve cumulative duration, byte counts, usage,
+  truncation, stdin diagnostics, timeout budgets, and tracked launch-failure
+  state across primary, authentication-fallback, and retry attempts.
+- Source-root cleanup guards now handle relative, symlinked, case-variant,
+  unresolved, and malformed paths conservatively without blocking safe cleanup
+  of source descendants.
+- Dirty worktree sync preserves arbitrary filename bytes, rejects unsyncable
+  dirty submodules with escaped diagnostics, and documents the same behavior
+  consistently across the CLI reference and worktree guidance.
+- Devin help and discovery surfaces now derive supported modes consistently and
+  reject unknown modes before constructing executable arguments.
+
+## [0.14.0] - 2026-07-15
+
+### Added
+
+- `workflow result --field` for extracting a single field from a workflow
+  result, reliable latest-workflow selection, immutable creation ordering,
+  dry-run visibility, and orphan detection (PR #14).
+- Schema validation for `agent()` results supports `minLength` and
+  `minItems`, including in retries and dry-run placeholders (PR #14).
+- Grouped work runs sharing one non-isolated workspace now emit a warning
+  with guidance for commit boundaries and persistent worktrees (PR #13).
+
+### Changed
+
+- Focused call help (`delegate <engine> call --help`) now reflects
+  call-mode option boundaries and documents the grouped-call tracking
+  exception (`--cwd` accepted only with `--group`); explicit `agent` input
+  is rejected on engines that do not support it (PR #13).
+- Overview, dry-run, agent-help, README, CLI reference, and worktree docs
+  corrected from user feedback (PR #13).
+
+### Fixed
+
+- Structured Codex workflows consume the child-authored completion report
+  (including on resume) and fail closed when it is missing; workflow resume
+  transitions atomically to `starting`, hides stale results, rolls back
+  failed launches, and releases locks on preparation errors (PR #14).
+- Safe isolation re-roots exact source-workspace paths while preserving
+  slash-command payloads verbatim (PR #14).
+- `wait`: a run matched by both `--latest HARNESS` and `--group NAME`
+  was emitted twice in the resolved-target list; it now appears once, with
+  first-selection precedence and ordering preserved.
+- `git_root_for` degrades any `OSError` from the git probe (not just
+  `FileNotFoundError`) to the non-git fallback, so e.g. a `PermissionError`
+  spawning git no longer crashes workspace resolution.
+
+### Changed
+
+- Internal cleanup pass across `src/` and `tests/`: removed dead code (unused
+  protocol types, private helpers, stale fixtures), collapsed redundant
+  exception tuples into their `OSError` base, replaced a hand-rolled
+  path-containment helper with `Path.is_relative_to`, and stripped stale
+  review-artifact comments. Behavior-preserving; the workflow supervisor's
+  broad exception boundary around child-model output is now explicitly
+  commented and regression-tested.
+
 ## [0.13.1] - 2026-07-09
 
 ### Added
@@ -304,6 +390,8 @@ Usage-audit fix wave: 82 sessions and 1,241 delegate invocations from one week o
 
 - Releases before 0.1.3 predate this changelog.
 
+[0.15.0]: https://github.com/treygoff24/delegate-agent/compare/v0.14.0...v0.15.0
+[0.14.0]: https://github.com/treygoff24/delegate-agent/compare/v0.13.1...v0.14.0
 [0.13.1]: https://github.com/treygoff24/delegate-agent/compare/v0.13.0...v0.13.1
 [0.13.0]: https://github.com/treygoff24/delegate-agent/compare/v0.12.0...v0.13.0
 [0.12.0]: https://github.com/treygoff24/delegate-agent/compare/v0.11.0...v0.12.0

{delegate_agent_cli-0.13.1 → delegate_agent_cli-0.15.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: delegate-agent-cli
-Version: 0.13.1
+Version: 0.15.0
 Summary: A tiny CLI for delegating bounded agent tasks to Cursor, Droid, OpenAI Codex, Claude Code, Grok Build, or Kimi Code runtimes.
 Author: Trey Goff
 License-Expression: MIT
@@ -163,7 +163,6 @@ Run a read-only review in an isolated throwaway workspace:
 delegate codex safe "Review this repository for correctness risks. Do not edit files."
 delegate claude safe "Review this repository for correctness risks. Do not edit files."
 delegate grok safe "Review this repository for correctness risks. Do not edit files."
-delegate devin safe "Review this repository for correctness risks. Do not edit files."
 delegate opencode safe "Review this repository for correctness risks. Do not edit files."
 delegate cursor safe "Review the current diff for regressions. Do not edit files."
 delegate kimi safe "Review this repository for regressions. Do not edit files."
@@ -191,7 +190,7 @@ raw model ID passed through verbatim). Droid still accepts a positional alias;
 `--model` works on every engine, including Droid:
 
 ```bash
-delegate devin safe --model claude-fable-5 "Review this repository. Do not edit files."
+delegate devin work --model implementer "Implement the scoped change and report it."
 delegate droid work --model custom:my-model "Implement the scoped change."
 delegate --json dry-run codex safe --model fast "Review this repository. Do not edit files."
 ```
@@ -221,8 +220,17 @@ run, use stateless `call` mode:
 
 ```bash
 delegate --json codex call "Summarize this context in three bullets."
+delegate --json claude call --pure --timeout 60 --output-schema result.schema.json < prompt.txt
 ```
 
+`call --pure` is a hostile-input completion boundary available on Claude only.
+It uses an empty temporary cwd, an allowlisted child environment, no Delegate
+prompt framing, and no session persistence or tools according to the engine
+capability contract. Claude receives the prompt only on stdin and is
+schema-capable via `--output-schema`; `delegate --json describe` reports
+`pureCall`, `structuredOutput`, `noSessionPersistence`, `usageEvents`, and
+`promptStdin` per engine. `--timeout SECONDS` applies to every call-mode engine.
+
 For multi-step fan-out or gated review flows, use Delegate Workflows. A workflow
 is a Python script that launches normal Delegate child runs, journals progress,
 can pause on approval gates, and can resume from cached child results:
@@ -294,6 +302,9 @@ cancelled, and `124` on timeout. `cancel` signals the run's process group
 start-identity check against PID reuse; a cancelled run reports `cancelled`
 rather than a false success. Tag a batch of launches with `--group NAME` and
 `wait`, `runs`, and the worktree commands can select the whole group at once.
+Commit between grouped feature waves that edit the same workspace. If features
+need separate review or commits, give each a persistent worktree and integrate
+them separately; `wait --group` warns about shared non-isolated workspaces.
 
 ## Task design: cluster related work into fewer, richer delegations
 
@@ -315,9 +326,9 @@ Delegate separates three ideas:
 
 Defaults are intentionally conservative for review paths:
 
-- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate devin safe`, `delegate opencode safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
+- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate opencode safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
 - Grok safe mode uses Delegate isolated copy plus Grok read-only sandbox/permission controls (`--sandbox read-only`, `--permission-mode dontAsk` by default). It does not use Grok `plan` mode. Prompts are delivered via Grok `--prompt-file` from a Delegate temp file.
-- Devin safe mode uses Delegate isolated copy plus a Delegate-generated `--agent-config` deny-list for edit/write/exec and `mcp__*`, with Devin `--permission-mode auto`. Work mode uses Devin `--permission-mode dangerous` because Devin print mode rejects unapproved edit/exec tools.
+- Devin safe mode is unsupported: Devin may implement filesystem surveys through the generic `exec` tool, which Delegate cannot permit without weakening the read-only boundary. Use another safe Harness for filesystem review. Devin work mode uses `--permission-mode dangerous` because Devin print mode rejects unapproved edit/exec tools.
 - OpenCode safe mode uses Delegate's isolated copy plus an `OPENCODE_CONFIG_CONTENT` permission lockdown that allows only read, glob, and grep operations. OpenCode merges this override last, so repository configuration cannot restore write-capable tools. `opencode call --read-only` uses the same lockdown; plain `call` does not.
 - Claude safe mode invokes `claude -p` with prompt text on stdin, `--permission-mode plan`, `--strict-mcp-config`, Read/Grep/Glob plus selected read-only Bash tools, and `--no-session-persistence` by default. Delegate does not currently prove that Claude Code hooks, plugins, user settings, or other non-MCP customization surfaces are disabled.
 - `work` mode can edit. By default it runs in the real workspace for backward compatibility.
@@ -340,12 +351,12 @@ child where that summary is available. `--forbid-commit` fails the run if
 commits remain ahead of the creation base when the child exits, and it now
 implies `--isolation worktree`.
 
-To carry uncommitted local work into the worktree instead of stashing it, add
-`--include-dirty`: it syncs tracked edits and untracked, non-ignored files into
-the worktree through the same snapshot primitives as safe mode, and tears the
-worktree down before launching the child if that sync fails.
+Work-mode worktree runs automatically sync tracked edits and untracked,
+non-ignored files from a dirty source checkout before launch, report the counts
+in a `dirty_source_auto_included` warning, and tear down the worktree if syncing
+fails. `--include-dirty` remains an explicit, harmless no-op on a clean source.
 
-Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/Devin/OpenCode/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
+Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/OpenCode/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
 
 Snapshots and `run-output` redact common credential shapes by default, including authorization headers, bearer/basic tokens, JWT-like strings, and common `token=` / `api_key=` / `password=` values. Use `--no-redact` only when exact output is necessary and safe to display.
 
@@ -387,6 +398,6 @@ AI_PROFILE delegate ...` uses the base config, or set
 
 - Delegate is an alpha CLI wrapper. Child runtimes can change their own flags or behavior.
 - Safe mode is a policy and isolation pattern, not a guarantee that a runtime cannot perform side effects outside its execution workspace.
-- Persistent worktrees require a Git repository with a valid `HEAD`; work-mode worktree runs require a clean source checkout.
+- Persistent worktrees require a Git repository with a valid `HEAD`.
 - `--pass-through` is incompatible with `--json` and with persistent worktree runs.
 - Delegate stores local run metadata under `.delegate/`; do not commit that directory.

{delegate_agent_cli-0.13.1 → delegate_agent_cli-0.15.0}/README.md

@@ -130,7 +130,6 @@ Run a read-only review in an isolated throwaway workspace:
 delegate codex safe "Review this repository for correctness risks. Do not edit files."
 delegate claude safe "Review this repository for correctness risks. Do not edit files."
 delegate grok safe "Review this repository for correctness risks. Do not edit files."
-delegate devin safe "Review this repository for correctness risks. Do not edit files."
 delegate opencode safe "Review this repository for correctness risks. Do not edit files."
 delegate cursor safe "Review the current diff for regressions. Do not edit files."
 delegate kimi safe "Review this repository for regressions. Do not edit files."
@@ -158,7 +157,7 @@ raw model ID passed through verbatim). Droid still accepts a positional alias;
 `--model` works on every engine, including Droid:
 
 ```bash
-delegate devin safe --model claude-fable-5 "Review this repository. Do not edit files."
+delegate devin work --model implementer "Implement the scoped change and report it."
 delegate droid work --model custom:my-model "Implement the scoped change."
 delegate --json dry-run codex safe --model fast "Review this repository. Do not edit files."
 ```
@@ -188,8 +187,17 @@ run, use stateless `call` mode:
 
 ```bash
 delegate --json codex call "Summarize this context in three bullets."
+delegate --json claude call --pure --timeout 60 --output-schema result.schema.json < prompt.txt
 ```
 
+`call --pure` is a hostile-input completion boundary available on Claude only.
+It uses an empty temporary cwd, an allowlisted child environment, no Delegate
+prompt framing, and no session persistence or tools according to the engine
+capability contract. Claude receives the prompt only on stdin and is
+schema-capable via `--output-schema`; `delegate --json describe` reports
+`pureCall`, `structuredOutput`, `noSessionPersistence`, `usageEvents`, and
+`promptStdin` per engine. `--timeout SECONDS` applies to every call-mode engine.
+
 For multi-step fan-out or gated review flows, use Delegate Workflows. A workflow
 is a Python script that launches normal Delegate child runs, journals progress,
 can pause on approval gates, and can resume from cached child results:
@@ -261,6 +269,9 @@ cancelled, and `124` on timeout. `cancel` signals the run's process group
 start-identity check against PID reuse; a cancelled run reports `cancelled`
 rather than a false success. Tag a batch of launches with `--group NAME` and
 `wait`, `runs`, and the worktree commands can select the whole group at once.
+Commit between grouped feature waves that edit the same workspace. If features
+need separate review or commits, give each a persistent worktree and integrate
+them separately; `wait --group` warns about shared non-isolated workspaces.
 
 ## Task design: cluster related work into fewer, richer delegations
 
@@ -282,9 +293,9 @@ Delegate separates three ideas:
 
 Defaults are intentionally conservative for review paths:
 
-- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate devin safe`, `delegate opencode safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
+- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate opencode safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
 - Grok safe mode uses Delegate isolated copy plus Grok read-only sandbox/permission controls (`--sandbox read-only`, `--permission-mode dontAsk` by default). It does not use Grok `plan` mode. Prompts are delivered via Grok `--prompt-file` from a Delegate temp file.
-- Devin safe mode uses Delegate isolated copy plus a Delegate-generated `--agent-config` deny-list for edit/write/exec and `mcp__*`, with Devin `--permission-mode auto`. Work mode uses Devin `--permission-mode dangerous` because Devin print mode rejects unapproved edit/exec tools.
+- Devin safe mode is unsupported: Devin may implement filesystem surveys through the generic `exec` tool, which Delegate cannot permit without weakening the read-only boundary. Use another safe Harness for filesystem review. Devin work mode uses `--permission-mode dangerous` because Devin print mode rejects unapproved edit/exec tools.
 - OpenCode safe mode uses Delegate's isolated copy plus an `OPENCODE_CONFIG_CONTENT` permission lockdown that allows only read, glob, and grep operations. OpenCode merges this override last, so repository configuration cannot restore write-capable tools. `opencode call --read-only` uses the same lockdown; plain `call` does not.
 - Claude safe mode invokes `claude -p` with prompt text on stdin, `--permission-mode plan`, `--strict-mcp-config`, Read/Grep/Glob plus selected read-only Bash tools, and `--no-session-persistence` by default. Delegate does not currently prove that Claude Code hooks, plugins, user settings, or other non-MCP customization surfaces are disabled.
 - `work` mode can edit. By default it runs in the real workspace for backward compatibility.
@@ -307,12 +318,12 @@ child where that summary is available. `--forbid-commit` fails the run if
 commits remain ahead of the creation base when the child exits, and it now
 implies `--isolation worktree`.
 
-To carry uncommitted local work into the worktree instead of stashing it, add
-`--include-dirty`: it syncs tracked edits and untracked, non-ignored files into
-the worktree through the same snapshot primitives as safe mode, and tears the
-worktree down before launching the child if that sync fails.
+Work-mode worktree runs automatically sync tracked edits and untracked,
+non-ignored files from a dirty source checkout before launch, report the counts
+in a `dirty_source_auto_included` warning, and tear down the worktree if syncing
+fails. `--include-dirty` remains an explicit, harmless no-op on a clean source.
 
-Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/Devin/OpenCode/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
+Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/OpenCode/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
 
 Snapshots and `run-output` redact common credential shapes by default, including authorization headers, bearer/basic tokens, JWT-like strings, and common `token=` / `api_key=` / `password=` values. Use `--no-redact` only when exact output is necessary and safe to display.
 
@@ -354,6 +365,6 @@ AI_PROFILE delegate ...` uses the base config, or set
 
 - Delegate is an alpha CLI wrapper. Child runtimes can change their own flags or behavior.
 - Safe mode is a policy and isolation pattern, not a guarantee that a runtime cannot perform side effects outside its execution workspace.
-- Persistent worktrees require a Git repository with a valid `HEAD`; work-mode worktree runs require a clean source checkout.
+- Persistent worktrees require a Git repository with a valid `HEAD`.
 - `--pass-through` is incompatible with `--json` and with persistent worktree runs.
 - Delegate stores local run metadata under `.delegate/`; do not commit that directory.

{delegate_agent_cli-0.13.1 → delegate_agent_cli-0.15.0}/docs/agent-setup.md

@@ -96,7 +96,7 @@ When running on Windows through WSL, treat Delegate as a Linux CLI:
    delegate --json dry-run claude safe --reasoning-effort high "Review only. Do not edit files."
    delegate --json dry-run grok safe "Review only. Do not edit files."
    delegate --json dry-run grok safe --reasoning-effort high "Review only. Do not edit files."
-   delegate --json dry-run devin safe "Review only. Do not edit files."
+   delegate --json dry-run devin work "Describe the planned work invocation."
    delegate --json dry-run opencode safe "Review only. Do not edit files."
    delegate --json dry-run opencode safe --reasoning-effort high "Review only. Do not edit files."
    delegate --json dry-run cursor safe "Review only. Do not edit files."
@@ -104,7 +104,7 @@ When running on Windows through WSL, treat Delegate as a Linux CLI:
    delegate --json dry-run kimi safe "Review only. Do not edit files."
    ```
 
-   The Codex, Claude, Grok, Devin, OpenCode, Cursor, and Kimi dry-runs succeed with the unedited example config when no reasoning effort is requested. Explicit Codex reasoning-effort dry-runs can target the harness default model when no default model is configured. Claude and Grok reasoning effort map to native `--effort` flags; OpenCode reasoning effort maps to `--variant` without model validation. The Droid dry-run validates the alias, so it returns `unconfigured_model` until you replace the `reviewer` placeholder in `config.json` with a real model ID.
+   The Codex, Claude, Grok, Devin work, OpenCode, Cursor, and Kimi dry-runs succeed with the unedited example config when no reasoning effort is requested. Devin safe mode is intentionally rejected because filesystem surveys may require generic `exec`, which cannot be allowed without weakening the read-only boundary. Explicit Codex reasoning-effort dry-runs can target the harness default model when no default model is configured. Claude and Grok reasoning effort map to native `--effort` flags; OpenCode reasoning effort maps to `--variant` without model validation. The Droid dry-run validates the alias, so it returns `unconfigured_model` until you replace the `reviewer` placeholder in `config.json` with a real model ID.
 
 ### OpenCode