delegate-agent-cli 0.14.0__tar.gz → 0.15.0__tar.gz

{delegate_agent_cli-0.14.0 → delegate_agent_cli-0.15.0}/CHANGELOG.md

@@ -5,6 +5,46 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.15.0] - 2026-07-16
+
+### Added
+
+- Work-mode worktree isolation now automatically carries tracked edits and
+  untracked, non-ignored files into the new worktree, with tracked/untracked
+  counts in human and JSON warnings and fail-clean teardown on sync errors.
+- Child environments expose authoritative source/execution root metadata, and
+  Delegate-managed snapshot and worktree cleanup refuses targets that are or
+  contain the source workspace.
+- Empty successful safe and read-only call results retry once when the prompt
+  can be safely extended; tracked runs retain both attempts and envelopes report
+  `emptyRetry` only when a retry was attempted.
+- Bare Harness resolution in Snapshot, run-output, and wait now reports the
+  resolved Run, Alias, workspace, and age, with a stale-resolution warning after
+  24 hours.
+
+### Changed
+
+- `run-output --tail N` now selects stdout when no output stream or Completion
+  Report was requested; stderr remains opt-in.
+- Devin safe mode now fails during preflight with `unsupported_mode` rather than
+  launching without an enforceable read-only boundary.
+- Call children use their throwaway cwd as `DELEGATE_SOURCE_ROOT`; the
+  Registry/config workspace is not disclosed to a stateless call.
+
+### Fixed
+
+- Empty-result retries now preserve cumulative duration, byte counts, usage,
+  truncation, stdin diagnostics, timeout budgets, and tracked launch-failure
+  state across primary, authentication-fallback, and retry attempts.
+- Source-root cleanup guards now handle relative, symlinked, case-variant,
+  unresolved, and malformed paths conservatively without blocking safe cleanup
+  of source descendants.
+- Dirty worktree sync preserves arbitrary filename bytes, rejects unsyncable
+  dirty submodules with escaped diagnostics, and documents the same behavior
+  consistently across the CLI reference and worktree guidance.
+- Devin help and discovery surfaces now derive supported modes consistently and
+  reject unknown modes before constructing executable arguments.
+
 ## [0.14.0] - 2026-07-15
 
 ### Added
@@ -350,6 +390,7 @@ Usage-audit fix wave: 82 sessions and 1,241 delegate invocations from one week o
 
 - Releases before 0.1.3 predate this changelog.
 
+[0.15.0]: https://github.com/treygoff24/delegate-agent/compare/v0.14.0...v0.15.0
 [0.14.0]: https://github.com/treygoff24/delegate-agent/compare/v0.13.1...v0.14.0
 [0.13.1]: https://github.com/treygoff24/delegate-agent/compare/v0.13.0...v0.13.1
 [0.13.0]: https://github.com/treygoff24/delegate-agent/compare/v0.12.0...v0.13.0

{delegate_agent_cli-0.14.0 → delegate_agent_cli-0.15.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: delegate-agent-cli
-Version: 0.14.0
+Version: 0.15.0
 Summary: A tiny CLI for delegating bounded agent tasks to Cursor, Droid, OpenAI Codex, Claude Code, Grok Build, or Kimi Code runtimes.
 Author: Trey Goff
 License-Expression: MIT
@@ -163,7 +163,6 @@ Run a read-only review in an isolated throwaway workspace:
 delegate codex safe "Review this repository for correctness risks. Do not edit files."
 delegate claude safe "Review this repository for correctness risks. Do not edit files."
 delegate grok safe "Review this repository for correctness risks. Do not edit files."
-delegate devin safe "Review this repository for correctness risks. Do not edit files."
 delegate opencode safe "Review this repository for correctness risks. Do not edit files."
 delegate cursor safe "Review the current diff for regressions. Do not edit files."
 delegate kimi safe "Review this repository for regressions. Do not edit files."
@@ -191,7 +190,7 @@ raw model ID passed through verbatim). Droid still accepts a positional alias;
 `--model` works on every engine, including Droid:
 
 ```bash
-delegate devin safe --model claude-fable-5 "Review this repository. Do not edit files."
+delegate devin work --model implementer "Implement the scoped change and report it."
 delegate droid work --model custom:my-model "Implement the scoped change."
 delegate --json dry-run codex safe --model fast "Review this repository. Do not edit files."
 ```
@@ -327,9 +326,9 @@ Delegate separates three ideas:
 
 Defaults are intentionally conservative for review paths:
 
-- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate devin safe`, `delegate opencode safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
+- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate opencode safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
 - Grok safe mode uses Delegate isolated copy plus Grok read-only sandbox/permission controls (`--sandbox read-only`, `--permission-mode dontAsk` by default). It does not use Grok `plan` mode. Prompts are delivered via Grok `--prompt-file` from a Delegate temp file.
-- Devin safe mode uses Delegate isolated copy plus a Delegate-generated `--agent-config` deny-list for edit/write/exec and `mcp__*`, with Devin `--permission-mode auto`. Work mode uses Devin `--permission-mode dangerous` because Devin print mode rejects unapproved edit/exec tools.
+- Devin safe mode is unsupported: Devin may implement filesystem surveys through the generic `exec` tool, which Delegate cannot permit without weakening the read-only boundary. Use another safe Harness for filesystem review. Devin work mode uses `--permission-mode dangerous` because Devin print mode rejects unapproved edit/exec tools.
 - OpenCode safe mode uses Delegate's isolated copy plus an `OPENCODE_CONFIG_CONTENT` permission lockdown that allows only read, glob, and grep operations. OpenCode merges this override last, so repository configuration cannot restore write-capable tools. `opencode call --read-only` uses the same lockdown; plain `call` does not.
 - Claude safe mode invokes `claude -p` with prompt text on stdin, `--permission-mode plan`, `--strict-mcp-config`, Read/Grep/Glob plus selected read-only Bash tools, and `--no-session-persistence` by default. Delegate does not currently prove that Claude Code hooks, plugins, user settings, or other non-MCP customization surfaces are disabled.
 - `work` mode can edit. By default it runs in the real workspace for backward compatibility.
@@ -352,12 +351,12 @@ child where that summary is available. `--forbid-commit` fails the run if
 commits remain ahead of the creation base when the child exits, and it now
 implies `--isolation worktree`.
 
-To carry uncommitted local work into the worktree instead of stashing it, add
-`--include-dirty`: it syncs tracked edits and untracked, non-ignored files into
-the worktree through the same snapshot primitives as safe mode, and tears the
-worktree down before launching the child if that sync fails.
+Work-mode worktree runs automatically sync tracked edits and untracked,
+non-ignored files from a dirty source checkout before launch, report the counts
+in a `dirty_source_auto_included` warning, and tear down the worktree if syncing
+fails. `--include-dirty` remains an explicit, harmless no-op on a clean source.
 
-Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/Devin/OpenCode/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
+Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/OpenCode/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
 
 Snapshots and `run-output` redact common credential shapes by default, including authorization headers, bearer/basic tokens, JWT-like strings, and common `token=` / `api_key=` / `password=` values. Use `--no-redact` only when exact output is necessary and safe to display.
 
@@ -399,6 +398,6 @@ AI_PROFILE delegate ...` uses the base config, or set
 
 - Delegate is an alpha CLI wrapper. Child runtimes can change their own flags or behavior.
 - Safe mode is a policy and isolation pattern, not a guarantee that a runtime cannot perform side effects outside its execution workspace.
-- Persistent worktrees require a Git repository with a valid `HEAD`; work-mode worktree runs require a clean source checkout.
+- Persistent worktrees require a Git repository with a valid `HEAD`.
 - `--pass-through` is incompatible with `--json` and with persistent worktree runs.
 - Delegate stores local run metadata under `.delegate/`; do not commit that directory.

{delegate_agent_cli-0.14.0 → delegate_agent_cli-0.15.0}/README.md

@@ -130,7 +130,6 @@ Run a read-only review in an isolated throwaway workspace:
 delegate codex safe "Review this repository for correctness risks. Do not edit files."
 delegate claude safe "Review this repository for correctness risks. Do not edit files."
 delegate grok safe "Review this repository for correctness risks. Do not edit files."
-delegate devin safe "Review this repository for correctness risks. Do not edit files."
 delegate opencode safe "Review this repository for correctness risks. Do not edit files."
 delegate cursor safe "Review the current diff for regressions. Do not edit files."
 delegate kimi safe "Review this repository for regressions. Do not edit files."
@@ -158,7 +157,7 @@ raw model ID passed through verbatim). Droid still accepts a positional alias;
 `--model` works on every engine, including Droid:
 
 ```bash
-delegate devin safe --model claude-fable-5 "Review this repository. Do not edit files."
+delegate devin work --model implementer "Implement the scoped change and report it."
 delegate droid work --model custom:my-model "Implement the scoped change."
 delegate --json dry-run codex safe --model fast "Review this repository. Do not edit files."
 ```
@@ -294,9 +293,9 @@ Delegate separates three ideas:
 
 Defaults are intentionally conservative for review paths:
 
-- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate devin safe`, `delegate opencode safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
+- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate opencode safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
 - Grok safe mode uses Delegate isolated copy plus Grok read-only sandbox/permission controls (`--sandbox read-only`, `--permission-mode dontAsk` by default). It does not use Grok `plan` mode. Prompts are delivered via Grok `--prompt-file` from a Delegate temp file.
-- Devin safe mode uses Delegate isolated copy plus a Delegate-generated `--agent-config` deny-list for edit/write/exec and `mcp__*`, with Devin `--permission-mode auto`. Work mode uses Devin `--permission-mode dangerous` because Devin print mode rejects unapproved edit/exec tools.
+- Devin safe mode is unsupported: Devin may implement filesystem surveys through the generic `exec` tool, which Delegate cannot permit without weakening the read-only boundary. Use another safe Harness for filesystem review. Devin work mode uses `--permission-mode dangerous` because Devin print mode rejects unapproved edit/exec tools.
 - OpenCode safe mode uses Delegate's isolated copy plus an `OPENCODE_CONFIG_CONTENT` permission lockdown that allows only read, glob, and grep operations. OpenCode merges this override last, so repository configuration cannot restore write-capable tools. `opencode call --read-only` uses the same lockdown; plain `call` does not.
 - Claude safe mode invokes `claude -p` with prompt text on stdin, `--permission-mode plan`, `--strict-mcp-config`, Read/Grep/Glob plus selected read-only Bash tools, and `--no-session-persistence` by default. Delegate does not currently prove that Claude Code hooks, plugins, user settings, or other non-MCP customization surfaces are disabled.
 - `work` mode can edit. By default it runs in the real workspace for backward compatibility.
@@ -319,12 +318,12 @@ child where that summary is available. `--forbid-commit` fails the run if
 commits remain ahead of the creation base when the child exits, and it now
 implies `--isolation worktree`.
 
-To carry uncommitted local work into the worktree instead of stashing it, add
-`--include-dirty`: it syncs tracked edits and untracked, non-ignored files into
-the worktree through the same snapshot primitives as safe mode, and tears the
-worktree down before launching the child if that sync fails.
+Work-mode worktree runs automatically sync tracked edits and untracked,
+non-ignored files from a dirty source checkout before launch, report the counts
+in a `dirty_source_auto_included` warning, and tear down the worktree if syncing
+fails. `--include-dirty` remains an explicit, harmless no-op on a clean source.
 
-Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/Devin/OpenCode/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
+Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/OpenCode/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
 
 Snapshots and `run-output` redact common credential shapes by default, including authorization headers, bearer/basic tokens, JWT-like strings, and common `token=` / `api_key=` / `password=` values. Use `--no-redact` only when exact output is necessary and safe to display.
 
@@ -366,6 +365,6 @@ AI_PROFILE delegate ...` uses the base config, or set
 
 - Delegate is an alpha CLI wrapper. Child runtimes can change their own flags or behavior.
 - Safe mode is a policy and isolation pattern, not a guarantee that a runtime cannot perform side effects outside its execution workspace.
-- Persistent worktrees require a Git repository with a valid `HEAD`; work-mode worktree runs require a clean source checkout.
+- Persistent worktrees require a Git repository with a valid `HEAD`.
 - `--pass-through` is incompatible with `--json` and with persistent worktree runs.
 - Delegate stores local run metadata under `.delegate/`; do not commit that directory.

{delegate_agent_cli-0.14.0 → delegate_agent_cli-0.15.0}/docs/agent-setup.md

@@ -96,7 +96,7 @@ When running on Windows through WSL, treat Delegate as a Linux CLI:
    delegate --json dry-run claude safe --reasoning-effort high "Review only. Do not edit files."
    delegate --json dry-run grok safe "Review only. Do not edit files."
    delegate --json dry-run grok safe --reasoning-effort high "Review only. Do not edit files."
-   delegate --json dry-run devin safe "Review only. Do not edit files."
+   delegate --json dry-run devin work "Describe the planned work invocation."
    delegate --json dry-run opencode safe "Review only. Do not edit files."
    delegate --json dry-run opencode safe --reasoning-effort high "Review only. Do not edit files."
    delegate --json dry-run cursor safe "Review only. Do not edit files."
@@ -104,7 +104,7 @@ When running on Windows through WSL, treat Delegate as a Linux CLI:
    delegate --json dry-run kimi safe "Review only. Do not edit files."
    ```
 
-   The Codex, Claude, Grok, Devin, OpenCode, Cursor, and Kimi dry-runs succeed with the unedited example config when no reasoning effort is requested. Explicit Codex reasoning-effort dry-runs can target the harness default model when no default model is configured. Claude and Grok reasoning effort map to native `--effort` flags; OpenCode reasoning effort maps to `--variant` without model validation. The Droid dry-run validates the alias, so it returns `unconfigured_model` until you replace the `reviewer` placeholder in `config.json` with a real model ID.
+   The Codex, Claude, Grok, Devin work, OpenCode, Cursor, and Kimi dry-runs succeed with the unedited example config when no reasoning effort is requested. Devin safe mode is intentionally rejected because filesystem surveys may require generic `exec`, which cannot be allowed without weakening the read-only boundary. Explicit Codex reasoning-effort dry-runs can target the harness default model when no default model is configured. Claude and Grok reasoning effort map to native `--effort` flags; OpenCode reasoning effort maps to `--variant` without model validation. The Droid dry-run validates the alias, so it returns `unconfigured_model` until you replace the `reviewer` placeholder in `config.json` with a real model ID.
 
 ### OpenCode
 

{delegate_agent_cli-0.14.0 → delegate_agent_cli-0.15.0}/docs/cli-reference.md

@@ -103,12 +103,13 @@ warning plus suggested review commands, but does not fail solely because commits
 exist. Validation rejects `--forbid-commit` outside `work` mode, and explicit
 `--isolation none --forbid-commit` remains invalid.
 
-`--include-dirty` is an opt-in launch flag for `work` mode with persistent
-worktree isolation. It copies uncommitted tracked changes and untracked
-non-ignored files from the source checkout into the new persistent worktree
-before the child starts. Gitignored files remain excluded, and external symlinks
-are blocked with the same protections used by safe-mode workspace sync. Without
-the flag, persistent worktree launches still require a clean source checkout.
+Work-mode persistent worktrees automatically copy uncommitted tracked changes
+and untracked non-ignored files from a dirty source checkout before the child
+starts. Gitignored files remain excluded, and external symlinks are blocked with
+the same protections used by safe-mode workspace sync. Automatic sync emits a
+`dirty_source_auto_included` warning with tracked-modified and untracked counts.
+`--include-dirty` remains an explicit launch flag and is a no-op when the source
+is already clean.
 JSON and text completion output report `includeDirty: true` / `syncedFiles`.
 `run --input-json` accepts the equivalent boolean field `includeDirty`.
 
@@ -118,11 +119,9 @@ A few boundaries are worth stating explicitly:
   repo history but also matched by a `.gitignore` rule is part of the repository
   and is synced like any other tracked file; `--include-dirty` excludes only
   untracked gitignored paths, not tracked ones.
-- **`--include-dirty` skips the submodule-cleanliness portion of the clean
-  check.** Without the flag, the preflight requires a clean source checkout
-  including submodule state; with the flag, the entire clean-source check is
-  skipped, so dirty submodules do not block the launch and submodule
-  working-tree state is not mirrored.
+- **Dirty submodules fail preflight.** Delegate auto-syncs ordinary tracked and
+  untracked non-ignored source changes, but cannot safely reproduce dirty
+  submodule state, so it refuses the launch until that submodule is clean.
 - **Keep secrets out of hardlinks.** A hardlink at a non-ignored path to
   gitignored content is indistinguishable from a regular file and will sync by
   content; `--include-dirty` trusts every non-ignored path. Path-based exclusion
@@ -166,7 +165,7 @@ Examples:
 
 ```bash
 delegate codex safe "Review this repo for regressions; report file/line/severity."
-delegate codex safe --model gpt-5.5 "Review this repo for regressions; report file/line/severity."
+delegate codex safe --model reviewer "Review this repo for regressions; report file/line/severity."
 delegate codex safe --model my-alias --reasoning-effort medium --fast "Explore likely causes."
 delegate codex work "Implement the scoped task; report changed files and tests."
 delegate codex call "Summarize this context in three bullets."
@@ -195,7 +194,7 @@ Examples:
 
 ```bash
 delegate claude safe "Review this repo for regressions; report file/line/severity."
-delegate claude work --model claude-opus-4-6 "Implement the scoped task; report changed files and tests."
+delegate claude work --model implementer "Implement the scoped task; report changed files and tests."
 delegate claude call "Summarize this context in three bullets."
 delegate --isolation worktree claude work "Implement the feature in a persistent worktree."
 ```
@@ -251,9 +250,9 @@ delegate [--json] opencode call [--read-only] [--model <alias-or-model>] [--reas
   {
     "opencode": {
       "models": {
-        "sonnet": "anthropic/claude-sonnet-4-5",
-        "sonnet-high": {
-          "model": "anthropic/claude-sonnet-4-5",
+        "reviewer": "provider/model",
+        "reviewer-high": {
+          "model": "provider/model",
           "variant": "high"
         }
       }
@@ -280,7 +279,7 @@ Examples:
 ```bash
 delegate opencode safe "Review this repo for regressions; report file/line/severity."
 delegate opencode work --agent build "Implement the scoped task; report changed files and tests."
-delegate opencode call --read-only --model anthropic/claude-sonnet-4-5 --prompt-file rubric.md
+delegate opencode call --read-only --model reviewer --prompt-file rubric.md
 delegate --isolation worktree opencode work "Implement the feature in a persistent worktree."
 ```
 
@@ -436,7 +435,9 @@ On expiry Delegate terminates the whole child process group and returns
 `call_timeout` with exit code 1.
 
 `--read-only`, `--pure`, and `--timeout` apply only to `call`; passing them with
-`safe`/`work` is rejected.
+`safe`/`work` is rejected. Empty-result retry applies to safe runs and read-only
+calls when the prompt can be safely extended; write-capable, pure, and verbatim
+calls are not retried.
 Because the child call is stateless, `--isolation`, `--pass-through`,
 `--progress`, `--forbid-commit`, and markdown completion reports are rejected.
 An ordinary call also rejects `--cwd`.
@@ -451,7 +452,7 @@ delegate --cwd /path/to/project --group wf_0123abcdef45 codex call "Summarize th
 ```
 
 The child still executes in an empty temporary cwd; `--cwd` does not give it the
-project tree. Dry-run accepts the same combination for faithful planning but
+project tree or leak it through Delegate root metadata. Dry-run accepts the same combination for faithful planning but
 creates no run entry. Use `safe` or `work` when the child should see the project
 tree.
 
@@ -499,7 +500,7 @@ Typical dry-run JSON fields:
 
 When a profile is active, dry-run and completion payloads add `authProfile` (the resolved profile name) and, when a Codex fallback profile is configured, `fallbackProfile`. Dry-run also adds `profileEnv` (the injected env map, with values redacted). These keys are omitted when no profile is active.
 
-For Cursor, Claude, Grok, Devin, OpenCode, Droid, and Kimi safe mode, an explicit `--isolation none`
+For Cursor, Claude, Grok, OpenCode, Droid, and Kimi safe mode, an explicit `--isolation none`
 is normalized to `auto` with a warning because those safe contracts depend on
 the temporary workspace/config boundary. Codex safe can use `none` because Codex
 still runs with its read-only sandbox.
@@ -585,9 +586,10 @@ Supported input keys:
 
 - `engine`: `cursor`, `droid`, `codex`, `claude`, `grok`, `devin`, `opencode`, or `kimi`.
 - `mode`: `safe`, `work`, or `call`.
+- The `devin` engine rejects `safe` with `unsupported_mode` during preflight. Devin filesystem surveys may require generic `exec`, which Delegate cannot allow without weakening the read-only boundary; use another safe Harness for filesystem review.
 - `model`: optional alias-or-id for every engine. Resolved against `<engine>.models` when it matches an alias; otherwise passed through as a raw model ID. For Droid, a positional alias remains alias-only/strict; JSON/`--model` is alias-or-id. Cursor honors an explicit model even when it differs from `cursor.defaultModel`.
 - `cwd`: optional workspace path. Git directories resolve to the repo root. Omit it for `mode: "call"`, which always uses an empty temporary cwd.
-- `isolation`: optional `auto`, `none`, or `worktree`. `null` is invalid. `mode: "call"` rejects isolation. For Cursor, Claude, Grok, Devin, OpenCode, Droid, and Kimi safe mode, `none` is normalized to `auto` with a warning.
+- `isolation`: optional `auto`, `none`, or `worktree`. `null` is invalid. `mode: "call"` rejects isolation. For Cursor, Claude, Grok, OpenCode, Droid, and Kimi safe mode, `none` is normalized to `auto` with a warning.
 - `reasoningEffort`: optional non-empty effort string. It overrides provider `defaultReasoningEffort` for that JSON run.
 - `fast`: optional Codex-only boolean or `null`. `true` requests Fast, `false` explicitly requests Standard, and `null`/omission inherits Codex configuration.
 - `progress`: optional boolean. `true` enables parent progress heartbeats on stderr; `false` disables them even when `progress.enabled` is true in config. When omitted, config `progress.enabled` applies (default `false`). `mode: "call"` rejects progress.
@@ -763,7 +765,7 @@ Codex usage-limit fallback fires, the completion payload also includes
 `codexAuthFallback` metadata (reason, the primary and fallback profile names,
 both exit codes, and a redacted primary stderr tail).
 
-Snapshot JSON uses schema `delegate.snapshot.v1` and includes fields such as `alias`, `runId`, `harness`, `status`, `rawStatus`, `effectiveStatus`, `staleReason`, `nextActions`, `cwd`, `executionCwd`, `assistantText`, `recentEvents`, `warnings`, `exitCode`, reasoning metadata, terminal metadata, and isolation/worktree metadata when applicable. Inspection commands do not rewrite a stale run's recorded state; they expose the raw recorded status plus the effective status computed from the current PID check. Run-output and worktree show output include `requestedHandle`, `resolvedHandle`, and `resolutionKind` (`literal`, `latest`, or `latest_model`) when a handle resolves indirectly.
+Snapshot JSON uses schema `delegate.snapshot.v1` and includes fields such as `alias`, `runId`, `harness`, `status`, `rawStatus`, `effectiveStatus`, `staleReason`, `nextActions`, `cwd`, `executionCwd`, `assistantText`, `recentEvents`, `warnings`, `exitCode`, reasoning metadata, terminal metadata, and isolation/worktree metadata when applicable. Inspection commands do not rewrite a stale run's recorded state; they expose the raw recorded status plus the effective status computed from the current PID check. Run-output and worktree show output include `requestedHandle`, `resolvedHandle`, and `resolutionKind` (`literal`, `latest`, or `latest_model`) when a handle resolves indirectly. For bare harness handles, snapshot, run-output, and wait also report `resolvedRunId`, `resolvedAlias`, `resolvedWorkspace`, `resolvedAge`, and `resolvedAgeSeconds`. Resolutions older than 24 hours add a `bare_handle_stale` warning suggesting `--cwd` or an explicit handle.
 
 Tracked run envelopes include `completionReportWritten`, `completionReportSource`
 (`child`, `delegate_synthesized`, `stdout_recovery`, or `null`), and
@@ -773,6 +775,15 @@ exit-code-derived status.
 
 Run-output JSON uses schema `delegate.run-output.v1` and returns selected completion report, stdout, and/or stderr content. By default, secret-like strings are redacted unless `--no-redact` is supplied. Tracked runs finish in one of the terminal statuses `succeeded`, `failed`, or `cancelled`; explicit harness cancellation/error terminal events override an exit-zero child status.
 
+Safe runs and read-only call runs that exit successfully with `resultQuality=empty`
+retry once with the original prompt plus a plain-text final-answer instruction.
+Pure and slash pass-through prompts, and write-capable calls, do not retry. Retried
+envelopes add `emptyRetry: {attempted, resolved}`; runs that do not retry omit the
+field. If the second attempt is also empty, the run remains successful and honest
+with `resultQuality=empty`, and emits an
+`empty_success_retry` warning. Tracked safe runs retain both attempts in their
+stdout/stderr logs.
+
 `delegate wait` blocks until every selected run reaches terminal state. Defaults:
 `--interval 3`, minimum interval `1`, and `--timeout 3600`. Exit codes are `0`
 when all runs succeeded, `1` when any run failed or was cancelled, and `124` on
@@ -819,9 +830,10 @@ selectors are preserved. `--stdout` or `--stderr` without `--tail` or `--raw`
 defaults to a bounded `--tail 80` and a character cap (default 60000); use
 `--max-chars N` to override the cap. `--raw` returns the full stream with no
 line or character bounds, includes `rawOutputBytes` in JSON metadata, and cannot
-be combined with `--tail` or `--max-chars`. `--tail` and `--max-chars` require
-`--stdout` or `--stderr`; Delegate rejects them when only `--completion-report`
-is selected.
+be combined with `--tail` or `--max-chars`. A bare `--tail N` implies
+`--stdout` when no output selector is supplied; it never includes stderr.
+`--max-chars` still requires `--stdout` or `--stderr`, and Delegate rejects
+either bound when only `--completion-report` is selected.
 
 When `completion-report.md` is absent, `run-output --completion-report` makes a
 bounded best-effort attempt to recover an explicit final response from the

{delegate_agent_cli-0.14.0 → delegate_agent_cli-0.15.0}/docs/configuration.md

@@ -386,6 +386,7 @@ Controls local run recording.
 - `models`: optional map of local aliases to Devin model IDs for `--model` / JSON `model`. Alias keys must not collide with mode names, equal the engine's own name, or start with `-`.
 - `defaultReasoningEffort`: not supported in v1; must be `null`.
 - Discover live Devin model IDs with `delegate models devin --live`.
+- Devin safe mode is rejected during preflight because filesystem surveys may require generic `exec`, which Delegate cannot permit without weakening the read-only boundary. Use another safe Harness for filesystem review.
 
 ### `opencode`
 
@@ -491,7 +492,7 @@ Supported boolean policy keys: `networkAccess`, `webSearch`, `bypassApprovalsAnd
 ```
 
 Allowed values are `auto`, `none`, and `worktree`. For Cursor, Claude, Grok,
-Devin, OpenCode, Droid, and Kimi safe mode, an effective value of `none` is normalized to `auto`
+OpenCode, Droid, and Kimi safe mode, an effective value of `none` is normalized to `auto`
 because those safe contracts depend on Delegate's temporary workspace/config
 boundary. Explicit per-run CLI/JSON `none` requests also emit a warning; a
 config default is normalized without a separate per-run warning. Codex safe can
@@ -499,7 +500,7 @@ use `none` because the Codex read-only sandbox remains active.
 
 Embedded defaults:
 
-- `safe`: `auto`. Cursor, Claude, Grok, Devin, OpenCode, Droid, Codex, and Kimi safe use temporary workspace isolation by default.
+- `safe`: `auto`. Cursor, Claude, Grok, OpenCode, Droid, Codex, and Kimi safe use temporary workspace isolation by default. Devin safe is unsupported.
 - `work`: `none`. Work mode runs in the real workspace unless you opt into worktree isolation.
 
 ### `worktrees`

{delegate_agent_cli-0.14.0 → delegate_agent_cli-0.15.0}/docs/security-model.md

@@ -27,15 +27,16 @@ Delegate does not control:
 
 Safe mode is for review and investigation.
 
-- Cursor safe, Droid safe, Codex safe, Claude safe, Grok safe, Devin safe, OpenCode safe, and Kimi safe run in an isolated throwaway workspace by default, with your current working tree mirrored into that copy (see [What safe review can and cannot see](#what-safe-review-can-and-cannot-see) below).
+- Cursor safe, Droid safe, Codex safe, Claude safe, Grok safe, OpenCode safe, and Kimi safe run in an isolated throwaway workspace by default, with your current working tree mirrored into that copy (see [What safe review can and cannot see](#what-safe-review-can-and-cannot-see) below).
 - Cursor safe also writes a read-oriented `.cursor/cli.json` in the isolated workspace only.
 - Codex safe uses `--ask-for-approval never exec --sandbox read-only`.
 - Claude safe uses `claude -p` with stdin prompt transport, `--permission-mode plan`, `--strict-mcp-config`, Read/Grep/Glob, and selected read-only Bash tools. Delegate does not currently prove that Claude Code hooks, plugins, user settings, or other non-MCP customization surfaces are disabled.
 - Droid safe uses Delegate's read-only safety prompt, does not add Droid work-mode unsafe flags, and uses the isolated temporary workspace as a defense-in-depth boundary.
 - Kimi safe uses Delegate's read-only safety prompt and does not enable Kimi `--plan`. Kimi prompt mode auto-approves tool actions, so there is no runtime read-only enforcement for Kimi safe; the isolated temporary workspace is the effective boundary and the safety prompt is advisory.
 - Grok safe uses Delegate's read-only safety prompt plus Grok `--sandbox read-only` and `--permission-mode dontAsk`. Delegate does not use Grok `plan` mode for safe review. Prompts are delivered via Grok `--prompt-file`.
+- Devin safe is rejected during preflight. Devin may implement filesystem surveys through generic `exec`, which Delegate cannot permit without weakening the read-only boundary; use another safe Harness for filesystem review.
 - OpenCode safe uses `--pure` plus environment-injected runtime enforcement. `OPENCODE_CONFIG_CONTENT` merges after repository config, disables sharing and autoupdate, applies deny-all-but-read/glob/grep permissions globally and to the selected agent, and creates a synthetic `delegate-read-only` agent when none is selected. `OPENCODE_PERMISSION` applies the same tool policy. Delegate re-applies these protected settings after profile resolution. `--pure` also disables repository-local plugins that could otherwise execute code during a safe run.
-- Explicit `--isolation none` is normalized to `auto` with a warning for Cursor, Claude, Grok, Devin, OpenCode, Droid, and Kimi safe mode because it would remove the isolation/config boundary those safe contracts rely on. Codex safe may opt out of Delegate workspace isolation because the Codex read-only sandbox remains active.
+- Explicit `--isolation none` is normalized to `auto` with a warning for Cursor, Claude, Grok, OpenCode, Droid, and Kimi safe mode because it would remove the isolation/config boundary those safe contracts rely on. Codex safe may opt out of Delegate workspace isolation because the Codex read-only sandbox remains active.
 
 Safe mode is not a proof of zero side effects. Treat it as a defensive default plus prompt/runtime policy. A runtime could still read available files, use configured credentials, load its own customizations, or perform actions allowed by its own permissions.
 
@@ -159,7 +160,7 @@ security control.
 
 ### Temporary safe isolation
 
-Cursor safe, Droid safe, Codex safe, Claude safe, Grok safe, Devin safe, OpenCode safe, and Kimi safe normally run in a temporary Git worktree or directory copy, with uncommitted tracked edits and untracked, non-ignored files synced from the source working tree (gitignored paths excluded). This protects the source checkout from ordinary relative-path edits made inside the execution workspace. Delegate may still write `.delegate/` metadata in the source workspace for tracked runs.
+Cursor safe, Droid safe, Codex safe, Claude safe, Grok safe, OpenCode safe, and Kimi safe normally run in a temporary Git worktree or directory copy, with uncommitted tracked edits and untracked, non-ignored files synced from the source working tree (gitignored paths excluded). This protects the source checkout from ordinary relative-path edits made inside the execution workspace. Delegate may still write `.delegate/` metadata in the source workspace for tracked runs.
 
 Git repositories with commits use a detached temporary Git worktree. Non-Git directories use a temporary directory copy. Git repositories with no commits fall back to a temporary directory copy because Git cannot create a detached worktree from an unborn `HEAD`; Delegate reports that fallback in run metadata.
 
@@ -171,6 +172,15 @@ This closes a leak where an untracked symlink whose absolute target pointed at t
 
 `--isolation worktree` with `work` mode creates a preserved Git worktree and local branch. The child edits that worktree, not the source checkout. The orchestrator can inspect and integrate the diff later.
 
+Workspace-backed children receive `DELEGATE_SOURCE_ROOT` with the resolved source
+workspace root. Isolated children also receive `DELEGATE_EXECUTION_ROOT`. Call
+mode has no source checkout: its throwaway cwd is `DELEGATE_SOURCE_ROOT`, and the
+Registry/config workspace is not exposed to the child. Delegate's own worktree
+removal, pruning, and temporary snapshot teardown paths refuse a target that is
+or contains the source root, including through relative or symlinked paths.
+Harness-side hook enforcement is separate machine configuration and is not
+provided by this repository.
+
 Persistent worktree isolation is not a security sandbox. It does not prevent:
 
 - Use of secrets available in environment variables, config files, credential stores, or runtime sessions.

{delegate_agent_cli-0.14.0 → delegate_agent_cli-0.15.0}/docs/troubleshooting.md

@@ -240,9 +240,17 @@ delegate --json droid reviewer call --prompt-file prompt.md
 Call mode returns captured assistant text in JSON `text` when available. Use
 `safe` or `work` for project-aware review/implementation and tracked output.
 
+## Devin safe reports `unsupported_mode`
+
+Devin may implement a read-only filesystem survey through the generic `exec`
+tool. Delegate cannot permit that tool in safe mode without weakening the
+read-only boundary, so `delegate devin safe` is rejected before launch. Use
+another safe Harness for filesystem review; Devin work and call modes remain
+available.
+
 ## Safe-mode isolation fails
 
-Cursor, Droid, Codex, Claude, Grok, Devin, OpenCode, and Kimi safe create an
+Cursor, Droid, Codex, Claude, Grok, OpenCode, and Kimi safe create an
 isolated throwaway workspace by default. Safe mode reviews your **current working tree**,
 uncommitted tracked edits and untracked, non-ignored files are mirrored into
 that copy (only gitignored paths are excluded), so you do **not** need to
@@ -250,7 +258,7 @@ commit or stash before a safe review. In Git repositories, Delegate first tries
 a detached worktree and syncs the dirty tree into it; for non-Git directories
 and some Git fallback cases, it uses a directory copy. Codex safe is the only
 safe harness that may opt out with `--isolation none`, because Codex still
-keeps its read-only sandbox active. Cursor, Droid, Claude, Grok, Devin,
+keeps its read-only sandbox active. Cursor, Droid, Claude, Grok,
 OpenCode, and Kimi safe
 normalize `--isolation none` back to `auto` with a warning because their safe
 contracts depend on Delegate's temporary workspace boundary.
@@ -270,7 +278,9 @@ python3 bin/delegate.py codex safe "Review my uncommitted changes. Do not edit."
 
 ## Persistent worktree run refused
 
-Work-mode persistent worktrees require a Git repository with a valid `HEAD` and a clean source checkout.
+Work-mode persistent worktrees require a Git repository with a valid `HEAD`.
+Dirty tracked and untracked non-ignored files are synced automatically; sync
+failures abort and tear down the new worktree before child launch.
 
 ```bash
 git status --short
@@ -279,9 +289,9 @@ delegate --json --isolation worktree dry-run cursor work "Implement only."
 ```
 
 Detached `HEAD` is valid; an unborn repository with no commit is not. Dry-run
-shows the planned branch/path but does not run the full launch preflight. If the
-source checkout is dirty, commit, stash, or choose a different isolation mode
-before launching.
+shows the planned branch/path but does not run the full launch preflight. Ordinary
+tracked and untracked source changes auto-sync; commit or stash dirty submodules,
+or choose a different isolation mode, before launching.
 
 ## Persistent worktree run failed with `commit_policy_violated`
 

{delegate_agent_cli-0.14.0 → delegate_agent_cli-0.15.0}/docs/worktrees.md

@@ -10,7 +10,7 @@ Use persistent worktree isolation when:
 - You want to review, cherry-pick, or merge the child work later.
 - You want Delegate to keep run metadata tied to a branch and worktree path.
 
-Use the real workspace instead when the task depends on uncommitted local files that you do not want to commit or mirror into a worktree. If you do want a persistent worktree that starts from your current dirty checkout, use `--include-dirty`.
+Use the real workspace instead when the task depends on uncommitted local files that you do not want mirrored into a worktree. Work-mode worktree runs automatically mirror a dirty checkout.
 
 For grouped feature waves, commit between waves when they share the real
 workspace. If each feature needs its own review or commit, use one persistent
@@ -29,8 +29,10 @@ delegate --isolation worktree droid implementer work "Implement the scoped chang
 delegate --isolation worktree kimi work "Implement the scoped change and report changed files."
 ```
 
-Add `--include-dirty` when the new persistent worktree should start with the
-source checkout's uncommitted tracked edits and untracked non-ignored files:
+Dirty source checkouts automatically seed the new persistent worktree with
+uncommitted tracked edits and untracked non-ignored files. Delegate emits a
+`dirty_source_auto_included` warning with both counts. `--include-dirty` remains
+available as an explicit request and is a no-op when the source is clean:
 
 ```bash
 delegate --isolation worktree cursor work --include-dirty "Implement using my local edits."
@@ -47,13 +49,9 @@ A few boundaries are worth stating explicitly:
   was committed before being added to `.gitignore`) is part of the repository
   and is synced like any other tracked file. `--include-dirty` excludes only
   untracked gitignored paths, not tracked ones.
-- **`--include-dirty` skips the submodule-cleanliness portion of the clean
-  check.** Without the flag, the preflight requires a clean source checkout
-  including submodule state (`git status --ignore-submodules=none`). With the
-  flag, the entire clean-source check is skipped, so dirty submodules do not
-  block the launch and submodule working-tree state is not mirrored into the
-  new worktree (only the source checkout's tracked diff and untracked
-  non-ignored files are).
+- **Dirty submodules fail preflight.** Delegate auto-syncs ordinary tracked and
+  untracked non-ignored source changes, but cannot safely reproduce dirty
+  submodule state, so it refuses the launch until that submodule is clean.
 - **Keep secrets out of hardlinks.** A hardlink at a non-ignored path to
   gitignored content is indistinguishable from a regular file to Delegate's
   path-based sync: it is a non-ignored path, so `--include-dirty` syncs it by
@@ -91,7 +89,7 @@ Persistent worktree work-mode runs require:
 
 - A Git workspace.
 - A valid `HEAD` commit.
-- A clean source checkout: no staged, unstaged, or untracked files, unless the launch uses `--include-dirty`.
+- A source checkout whose tracked edits and untracked non-ignored files can be synced.
 - No `--pass-through`.
 
 Dry-run previews the plan without creating anything:

{delegate_agent_cli-0.14.0 → delegate_agent_cli-0.15.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "delegate-agent-cli"
-version = "0.14.0"
+version = "0.15.0"
 description = "A tiny CLI for delegating bounded agent tasks to Cursor, Droid, OpenAI Codex, Claude Code, Grok Build, or Kimi Code runtimes."
 readme = "README.md"
 requires-python = ">=3.11"

{delegate_agent_cli-0.14.0 → delegate_agent_cli-0.15.0}/src/delegate_agent/__init__.py

@@ -1,5 +1,5 @@
 """Delegate Agent CLI package."""
 
-VERSION = "0.14.0"
+VERSION = "0.15.0"
 
 __all__ = ["VERSION"]

{delegate_agent_cli-0.14.0 → delegate_agent_cli-0.15.0}/src/delegate_agent/argv_builders.py

@@ -397,10 +397,20 @@ def build_devin_argv(
     pure: bool = False,
 ) -> list[str]:
     _reject_pure("devin", mode, pure)
+    if mode == MODE_SAFE:
+        raise DelegateError(
+            "unsupported_mode",
+            "Devin safe mode is unsupported: Devin may perform read-only filesystem "
+            "surveys through the generic exec tool, which Delegate cannot allow without "
+            "weakening the read-only boundary. Use another harness in safe mode for "
+            "filesystem review.",
+        )
+    if mode not in (MODE_WORK, MODE_CALL):
+        validate_mode(mode)
     argv = [str(devin["binary"])]
     if model:
         argv.extend(["--model", model])
-    read_only = mode == MODE_SAFE or (mode == MODE_CALL and call_read_only)
+    read_only = mode == MODE_CALL and call_read_only
     if read_only:
         argv.extend(
             [
@@ -410,10 +420,8 @@ def build_devin_argv(
                 "auto",
             ]
         )
-    elif mode in (MODE_WORK, MODE_CALL):
-        argv.extend(["--permission-mode", "dangerous"])
     else:
-        validate_mode(mode)
+        argv.extend(["--permission-mode", "dangerous"])
     if prompt_transport != PROMPT_TRANSPORT_FILE:
         raise DelegateError(
             "invalid_prompt_transport",