delegate-agent-cli 0.14.0__tar.gz → 0.16.0__tar.gz

{delegate_agent_cli-0.14.0 → delegate_agent_cli-0.16.0}/CHANGELOG.md

@@ -5,6 +5,81 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.16.0] - 2026-07-16
+
+### Added
+
+- `--timeout` is now accepted and enforced on tracked `safe` and `work` runs
+  across engines. It remains rejected with `--pass-through`, and deadline
+  failures keep the historical `call_timeout` error code.
+- Kimi tool-call activity is normalized into `tool.started`/`tool.completed`
+  events with id correlation; `status` stays unset because Kimi tool results
+  carry no result-status signal.
+
+### Changed
+
+- Persistent-worktree runs that fail after the worktree is realized
+  (child-launch errors, timeouts) now keep `worktreeStatus: present`,
+  `executionCwd`, `branch`, and `worktreeCleanupCommands` in the failed-run
+  record, so the preserved worktree stays inspectable and removable via
+  `delegate worktree show|remove` instead of being orphaned.
+- The Kimi default model is now `kimi-code/k3`, and the bundled Kimi catalog
+  lists exactly the three real model IDs (`kimi-code/k3`,
+  `kimi-code/kimi-for-coding`, `kimi-code/kimi-for-coding-highspeed`); the
+  stale `kimi-k2.7` entry was removed.
+- Docs clarifications: Kimi reasoning-effort wording now states that the Kimi
+  CLI exposes no effort flag (k3 supports effort internally via
+  `~/.kimi-code/config.toml`) and that Delegate rejects `--reasoning-effort`
+  for Kimi; the CLI reference notes that `usage: unavailable` in Kimi run JSON
+  is expected because the Kimi CLI emits no usage/token lines in stream-json
+  output.
+- Kimi work-mode docs restate current behavior: Delegate emits no `--yolo` —
+  Kimi prompt mode auto-approves tool actions, and work mode edits the real
+  workspace by default. Temporary safe isolation or explicit worktree
+  isolation provides a workspace boundary, not a complete host sandbox.
+
+## [0.15.0] - 2026-07-16
+
+### Added
+
+- Work-mode worktree isolation now automatically carries tracked edits and
+  untracked, non-ignored files into the new worktree, with tracked/untracked
+  counts in human and JSON warnings and fail-clean teardown on sync errors.
+- Child environments expose authoritative source/execution root metadata, and
+  Delegate-managed snapshot and worktree cleanup refuses targets that are or
+  contain the source workspace.
+- Empty successful safe and read-only call results retry once when the prompt
+  can be safely extended; tracked runs retain both attempts and envelopes report
+  `emptyRetry` only when a retry was attempted.
+- Bare Harness resolution in Snapshot, run-output, and wait now reports the
+  resolved Run, Alias, workspace, and age, with a stale-resolution warning after
+  24 hours.
+
+### Changed
+
+- `run-output --tail N` now selects stdout when no output stream or Completion
+  Report was requested; stderr remains opt-in.
+- Devin safe mode now fails during preflight with `unsupported_mode` rather than
+  launching without an enforceable read-only boundary.
+- Call children use their throwaway cwd as `DELEGATE_SOURCE_ROOT`; the
+  Registry/config workspace is not disclosed to a stateless call.
+
+### Fixed
+
+- Empty-result retries now preserve cumulative duration, byte counts, usage,
+  truncation, stdin diagnostics, timeout budgets, and tracked launch-failure
+  state across primary, authentication-fallback, and retry attempts.
+- Source-root cleanup guards now handle relative, symlinked, case-variant,
+  unresolved, and malformed paths conservatively without blocking safe cleanup
+  of source descendants.
+- Dirty worktree sync preserves arbitrary filename bytes, rejects unsyncable
+  dirty submodules with escaped diagnostics, and documents the same behavior
+  consistently across the CLI reference and worktree guidance.
+- Devin help and discovery surfaces now derive supported modes consistently and
+  reject unknown modes before constructing executable arguments.
+
 ## [0.14.0] - 2026-07-15
 
 ### Added
@@ -350,6 +425,8 @@ Usage-audit fix wave: 82 sessions and 1,241 delegate invocations from one week o
 
 - Releases before 0.1.3 predate this changelog.
 
+[0.16.0]: https://github.com/treygoff24/delegate-agent/compare/v0.15.0...v0.16.0
+[0.15.0]: https://github.com/treygoff24/delegate-agent/compare/v0.14.0...v0.15.0
 [0.14.0]: https://github.com/treygoff24/delegate-agent/compare/v0.13.1...v0.14.0
 [0.13.1]: https://github.com/treygoff24/delegate-agent/compare/v0.13.0...v0.13.1
 [0.13.0]: https://github.com/treygoff24/delegate-agent/compare/v0.12.0...v0.13.0

{delegate_agent_cli-0.14.0 → delegate_agent_cli-0.16.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: delegate-agent-cli
-Version: 0.14.0
+Version: 0.16.0
 Summary: A tiny CLI for delegating bounded agent tasks to Cursor, Droid, OpenAI Codex, Claude Code, Grok Build, or Kimi Code runtimes.
 Author: Trey Goff
 License-Expression: MIT
@@ -163,7 +163,6 @@ Run a read-only review in an isolated throwaway workspace:
 delegate codex safe "Review this repository for correctness risks. Do not edit files."
 delegate claude safe "Review this repository for correctness risks. Do not edit files."
 delegate grok safe "Review this repository for correctness risks. Do not edit files."
-delegate devin safe "Review this repository for correctness risks. Do not edit files."
 delegate opencode safe "Review this repository for correctness risks. Do not edit files."
 delegate cursor safe "Review the current diff for regressions. Do not edit files."
 delegate kimi safe "Review this repository for regressions. Do not edit files."
@@ -191,7 +190,7 @@ raw model ID passed through verbatim). Droid still accepts a positional alias;
 `--model` works on every engine, including Droid:
 
 ```bash
-delegate devin safe --model claude-fable-5 "Review this repository. Do not edit files."
+delegate devin work --model implementer "Implement the scoped change and report it."
 delegate droid work --model custom:my-model "Implement the scoped change."
 delegate --json dry-run codex safe --model fast "Review this repository. Do not edit files."
 ```
@@ -230,7 +229,7 @@ prompt framing, and no session persistence or tools according to the engine
 capability contract. Claude receives the prompt only on stdin and is
 schema-capable via `--output-schema`; `delegate --json describe` reports
 `pureCall`, `structuredOutput`, `noSessionPersistence`, `usageEvents`, and
-`promptStdin` per engine. `--timeout SECONDS` applies to every call-mode engine.
+`promptStdin` per engine. `--timeout SECONDS` applies to every engine in any mode (calls and tracked safe/work runs, but not `--pass-through`).
 
 For multi-step fan-out or gated review flows, use Delegate Workflows. A workflow
 is a Python script that launches normal Delegate child runs, journals progress,
@@ -327,9 +326,9 @@ Delegate separates three ideas:
 
 Defaults are intentionally conservative for review paths:
 
-- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate devin safe`, `delegate opencode safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
+- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate opencode safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
 - Grok safe mode uses Delegate isolated copy plus Grok read-only sandbox/permission controls (`--sandbox read-only`, `--permission-mode dontAsk` by default). It does not use Grok `plan` mode. Prompts are delivered via Grok `--prompt-file` from a Delegate temp file.
-- Devin safe mode uses Delegate isolated copy plus a Delegate-generated `--agent-config` deny-list for edit/write/exec and `mcp__*`, with Devin `--permission-mode auto`. Work mode uses Devin `--permission-mode dangerous` because Devin print mode rejects unapproved edit/exec tools.
+- Devin safe mode is unsupported: Devin may implement filesystem surveys through the generic `exec` tool, which Delegate cannot permit without weakening the read-only boundary. Use another safe Harness for filesystem review. Devin work mode uses `--permission-mode dangerous` because Devin print mode rejects unapproved edit/exec tools.
 - OpenCode safe mode uses Delegate's isolated copy plus an `OPENCODE_CONFIG_CONTENT` permission lockdown that allows only read, glob, and grep operations. OpenCode merges this override last, so repository configuration cannot restore write-capable tools. `opencode call --read-only` uses the same lockdown; plain `call` does not.
 - Claude safe mode invokes `claude -p` with prompt text on stdin, `--permission-mode plan`, `--strict-mcp-config`, Read/Grep/Glob plus selected read-only Bash tools, and `--no-session-persistence` by default. Delegate does not currently prove that Claude Code hooks, plugins, user settings, or other non-MCP customization surfaces are disabled.
 - `work` mode can edit. By default it runs in the real workspace for backward compatibility.
@@ -352,12 +351,12 @@ child where that summary is available. `--forbid-commit` fails the run if
 commits remain ahead of the creation base when the child exits, and it now
 implies `--isolation worktree`.
 
-To carry uncommitted local work into the worktree instead of stashing it, add
-`--include-dirty`: it syncs tracked edits and untracked, non-ignored files into
-the worktree through the same snapshot primitives as safe mode, and tears the
-worktree down before launching the child if that sync fails.
+Work-mode worktree runs automatically sync tracked edits and untracked,
+non-ignored files from a dirty source checkout before launch, report the counts
+in a `dirty_source_auto_included` warning, and tear down the worktree if syncing
+fails. `--include-dirty` remains an explicit, harmless no-op on a clean source.
 
-Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/Devin/OpenCode/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
+Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/OpenCode/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
 
 Snapshots and `run-output` redact common credential shapes by default, including authorization headers, bearer/basic tokens, JWT-like strings, and common `token=` / `api_key=` / `password=` values. Use `--no-redact` only when exact output is necessary and safe to display.
 
@@ -399,6 +398,6 @@ AI_PROFILE delegate ...` uses the base config, or set
 
 - Delegate is an alpha CLI wrapper. Child runtimes can change their own flags or behavior.
 - Safe mode is a policy and isolation pattern, not a guarantee that a runtime cannot perform side effects outside its execution workspace.
-- Persistent worktrees require a Git repository with a valid `HEAD`; work-mode worktree runs require a clean source checkout.
+- Persistent worktrees require a Git repository with a valid `HEAD`.
 - `--pass-through` is incompatible with `--json` and with persistent worktree runs.
 - Delegate stores local run metadata under `.delegate/`; do not commit that directory.

{delegate_agent_cli-0.14.0 → delegate_agent_cli-0.16.0}/README.md

@@ -130,7 +130,6 @@ Run a read-only review in an isolated throwaway workspace:
 delegate codex safe "Review this repository for correctness risks. Do not edit files."
 delegate claude safe "Review this repository for correctness risks. Do not edit files."
 delegate grok safe "Review this repository for correctness risks. Do not edit files."
-delegate devin safe "Review this repository for correctness risks. Do not edit files."
 delegate opencode safe "Review this repository for correctness risks. Do not edit files."
 delegate cursor safe "Review the current diff for regressions. Do not edit files."
 delegate kimi safe "Review this repository for regressions. Do not edit files."
@@ -158,7 +157,7 @@ raw model ID passed through verbatim). Droid still accepts a positional alias;
 `--model` works on every engine, including Droid:
 
 ```bash
-delegate devin safe --model claude-fable-5 "Review this repository. Do not edit files."
+delegate devin work --model implementer "Implement the scoped change and report it."
 delegate droid work --model custom:my-model "Implement the scoped change."
 delegate --json dry-run codex safe --model fast "Review this repository. Do not edit files."
 ```
@@ -197,7 +196,7 @@ prompt framing, and no session persistence or tools according to the engine
 capability contract. Claude receives the prompt only on stdin and is
 schema-capable via `--output-schema`; `delegate --json describe` reports
 `pureCall`, `structuredOutput`, `noSessionPersistence`, `usageEvents`, and
-`promptStdin` per engine. `--timeout SECONDS` applies to every call-mode engine.
+`promptStdin` per engine. `--timeout SECONDS` applies to every engine in any mode (calls and tracked safe/work runs, but not `--pass-through`).
 
 For multi-step fan-out or gated review flows, use Delegate Workflows. A workflow
 is a Python script that launches normal Delegate child runs, journals progress,
@@ -294,9 +293,9 @@ Delegate separates three ideas:
 
 Defaults are intentionally conservative for review paths:
 
-- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate devin safe`, `delegate opencode safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
+- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate opencode safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
 - Grok safe mode uses Delegate isolated copy plus Grok read-only sandbox/permission controls (`--sandbox read-only`, `--permission-mode dontAsk` by default). It does not use Grok `plan` mode. Prompts are delivered via Grok `--prompt-file` from a Delegate temp file.
-- Devin safe mode uses Delegate isolated copy plus a Delegate-generated `--agent-config` deny-list for edit/write/exec and `mcp__*`, with Devin `--permission-mode auto`. Work mode uses Devin `--permission-mode dangerous` because Devin print mode rejects unapproved edit/exec tools.
+- Devin safe mode is unsupported: Devin may implement filesystem surveys through the generic `exec` tool, which Delegate cannot permit without weakening the read-only boundary. Use another safe Harness for filesystem review. Devin work mode uses `--permission-mode dangerous` because Devin print mode rejects unapproved edit/exec tools.
 - OpenCode safe mode uses Delegate's isolated copy plus an `OPENCODE_CONFIG_CONTENT` permission lockdown that allows only read, glob, and grep operations. OpenCode merges this override last, so repository configuration cannot restore write-capable tools. `opencode call --read-only` uses the same lockdown; plain `call` does not.
 - Claude safe mode invokes `claude -p` with prompt text on stdin, `--permission-mode plan`, `--strict-mcp-config`, Read/Grep/Glob plus selected read-only Bash tools, and `--no-session-persistence` by default. Delegate does not currently prove that Claude Code hooks, plugins, user settings, or other non-MCP customization surfaces are disabled.
 - `work` mode can edit. By default it runs in the real workspace for backward compatibility.
@@ -319,12 +318,12 @@ child where that summary is available. `--forbid-commit` fails the run if
 commits remain ahead of the creation base when the child exits, and it now
 implies `--isolation worktree`.
 
-To carry uncommitted local work into the worktree instead of stashing it, add
-`--include-dirty`: it syncs tracked edits and untracked, non-ignored files into
-the worktree through the same snapshot primitives as safe mode, and tears the
-worktree down before launching the child if that sync fails.
+Work-mode worktree runs automatically sync tracked edits and untracked,
+non-ignored files from a dirty source checkout before launch, report the counts
+in a `dirty_source_auto_included` warning, and tear down the worktree if syncing
+fails. `--include-dirty` remains an explicit, harmless no-op on a clean source.
 
-Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/Devin/OpenCode/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
+Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/OpenCode/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
 
 Snapshots and `run-output` redact common credential shapes by default, including authorization headers, bearer/basic tokens, JWT-like strings, and common `token=` / `api_key=` / `password=` values. Use `--no-redact` only when exact output is necessary and safe to display.
 
@@ -366,6 +365,6 @@ AI_PROFILE delegate ...` uses the base config, or set
 
 - Delegate is an alpha CLI wrapper. Child runtimes can change their own flags or behavior.
 - Safe mode is a policy and isolation pattern, not a guarantee that a runtime cannot perform side effects outside its execution workspace.
-- Persistent worktrees require a Git repository with a valid `HEAD`; work-mode worktree runs require a clean source checkout.
+- Persistent worktrees require a Git repository with a valid `HEAD`.
 - `--pass-through` is incompatible with `--json` and with persistent worktree runs.
 - Delegate stores local run metadata under `.delegate/`; do not commit that directory.

{delegate_agent_cli-0.14.0 → delegate_agent_cli-0.16.0}/config.example.json

@@ -95,7 +95,7 @@
   },
   "kimi": {
     "binary": "kimi",
-    "defaultModel": "kimi-code/kimi-for-coding",
+    "defaultModel": "kimi-code/k3",
     "defaultReasoningEffort": null
   },
   "isolation": {

{delegate_agent_cli-0.14.0 → delegate_agent_cli-0.16.0}/docs/agent-setup.md

@@ -96,7 +96,7 @@ When running on Windows through WSL, treat Delegate as a Linux CLI:
    delegate --json dry-run claude safe --reasoning-effort high "Review only. Do not edit files."
    delegate --json dry-run grok safe "Review only. Do not edit files."
    delegate --json dry-run grok safe --reasoning-effort high "Review only. Do not edit files."
-   delegate --json dry-run devin safe "Review only. Do not edit files."
+   delegate --json dry-run devin work "Describe the planned work invocation."
    delegate --json dry-run opencode safe "Review only. Do not edit files."
    delegate --json dry-run opencode safe --reasoning-effort high "Review only. Do not edit files."
    delegate --json dry-run cursor safe "Review only. Do not edit files."
@@ -104,7 +104,7 @@ When running on Windows through WSL, treat Delegate as a Linux CLI:
    delegate --json dry-run kimi safe "Review only. Do not edit files."
    ```
 
-   The Codex, Claude, Grok, Devin, OpenCode, Cursor, and Kimi dry-runs succeed with the unedited example config when no reasoning effort is requested. Explicit Codex reasoning-effort dry-runs can target the harness default model when no default model is configured. Claude and Grok reasoning effort map to native `--effort` flags; OpenCode reasoning effort maps to `--variant` without model validation. The Droid dry-run validates the alias, so it returns `unconfigured_model` until you replace the `reviewer` placeholder in `config.json` with a real model ID.
+   The Codex, Claude, Grok, Devin work, OpenCode, Cursor, and Kimi dry-runs succeed with the unedited example config when no reasoning effort is requested. Devin safe mode is intentionally rejected because filesystem surveys may require generic `exec`, which cannot be allowed without weakening the read-only boundary. Explicit Codex reasoning-effort dry-runs can target the harness default model when no default model is configured. Claude and Grok reasoning effort map to native `--effort` flags; OpenCode reasoning effort maps to `--variant` without model validation. The Droid dry-run validates the alias, so it returns `unconfigured_model` until you replace the `reviewer` placeholder in `config.json` with a real model ID.
 
 ### OpenCode
 

{delegate_agent_cli-0.14.0 → delegate_agent_cli-0.16.0}/docs/cli-reference.md

@@ -20,33 +20,33 @@ Use `delegate --help` for the exact command list from the installed version. Glo
 ### Direct runtime commands
 
 ```bash
-delegate cursor safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate cursor work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate cursor call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
+delegate cursor safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate cursor work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate cursor call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
 
-delegate droid [MODEL_ALIAS] safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate droid [MODEL_ALIAS] work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate droid [MODEL_ALIAS] call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
+delegate droid [MODEL_ALIAS] safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate droid [MODEL_ALIAS] work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate droid [MODEL_ALIAS] call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
 
-delegate codex safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--fast|--no-fast] [--progress] [--forbid-commit] [--prompt-file PATH] [--output-schema FILE] [prompt...]
-delegate codex work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--fast|--no-fast] [--progress] [--forbid-commit] [--prompt-file PATH] [--output-schema FILE] [prompt...]
-delegate codex call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--fast|--no-fast] [--prompt-file PATH] [--output-schema FILE] [prompt...]
+delegate codex safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--fast|--no-fast] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [--output-schema FILE] [prompt...]
+delegate codex work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--fast|--no-fast] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [--output-schema FILE] [prompt...]
+delegate codex call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--fast|--no-fast] [--prompt-file PATH] [--output-schema FILE] [prompt...]
 
-delegate claude safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate claude work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate claude call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
+delegate claude safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate claude work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate claude call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
 
-delegate grok safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate grok work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate grok call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
+delegate grok safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate grok work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate grok call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
 
-delegate opencode safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--agent NAME] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate opencode work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--agent NAME] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate opencode call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--agent NAME] [--prompt-file PATH] [prompt...]
+delegate opencode safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--agent NAME] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate opencode work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--agent NAME] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate opencode call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--agent NAME] [--prompt-file PATH] [prompt...]
 
-delegate kimi safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate kimi work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate kimi call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
+delegate kimi safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate kimi work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate kimi call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
 ```
 
 Prompt sources are direct arguments, `--prompt-file`, or Delegate stdin. Raw C0 control characters other than newline, carriage return, and tab are stripped before launch; a prompt that becomes empty fails fast. After
@@ -82,7 +82,7 @@ and advisory catalogs with `delegate models`, `delegate models <engine>`, and
 `delegate models <engine> --live` (live probes for cursor/droid/devin/opencode; other
 engines report live unsupported).
 
-`--reasoning-effort LEVEL` is optional and parsed only before prompt text begins. Engines with capability metadata reject unsupported model/effort pairs before launch with `unsupported_reasoning_effort`. It affects only model reasoning depth, cost, or latency; it does not change `safe`/`work`/`call` permissions, sandboxing, approvals, network policy, or edit capability. Cursor effort is model-selection based and requires `cursor.reasoningEffortModels`; an explicit `--model` wins over effort→model routing. Droid emits `--reasoning-effort LEVEL`; Codex emits a `model_reasoning_effort` config override for the resolved model, or for the Codex harness default model when no `codex.defaultModel` is configured and the request was explicit; Claude emits Claude Code `--effort LEVEL`; Grok emits Grok `--effort LEVEL` (`low`, `medium`, `high`, `xhigh`, `max`); OpenCode emits `--variant LEVEL` without validating it against the selected model. Kimi does not support reasoning effort in v1.
+`--reasoning-effort LEVEL` is optional and parsed only before prompt text begins. Engines with capability metadata reject unsupported model/effort pairs before launch with `unsupported_reasoning_effort`. It affects only model reasoning depth, cost, or latency; it does not change `safe`/`work`/`call` permissions, sandboxing, approvals, network policy, or edit capability. Cursor effort is model-selection based and requires `cursor.reasoningEffortModels`; an explicit `--model` wins over effort→model routing. Droid emits `--reasoning-effort LEVEL`; Codex emits a `model_reasoning_effort` config override for the resolved model, or for the Codex harness default model when no `codex.defaultModel` is configured and the request was explicit; Claude emits Claude Code `--effort LEVEL`; Grok emits Grok `--effort LEVEL` (`low`, `medium`, `high`, `xhigh`, `max`); OpenCode emits `--variant LEVEL` without validating it against the selected model. The Kimi CLI exposes no effort flag; k3 supports effort internally via `~/.kimi-code/config.toml`, so Delegate rejects `--reasoning-effort` for Kimi.
 
 `--fast` and `--no-fast` are Codex-only, mutually exclusive per-run service-tier overrides. `--fast` emits `service_tier="fast"` plus `features.fast_mode=true` (Codex silently drops a Fast tier when that feature flag is off in the ambient config, so Delegate enables it explicitly); `--no-fast` emits `service_tier="default"` so a globally enabled Fast setting can be turned off for one child. Omitting both emits no override and inherits Codex configuration. Fast is orthogonal to model selection, reasoning effort, and Delegate safety policy. Two upstream caveats: Codex strips the service tier when authenticated with an API key (Fast is a ChatGPT-plan feature), and neither Codex nor the API fails on a tier the model does not offer — Delegate's flag validation is the only fail-closed layer, so an unsupported combination degrades silently to standard routing rather than erroring.
 
@@ -103,12 +103,13 @@ warning plus suggested review commands, but does not fail solely because commits
 exist. Validation rejects `--forbid-commit` outside `work` mode, and explicit
 `--isolation none --forbid-commit` remains invalid.
 
-`--include-dirty` is an opt-in launch flag for `work` mode with persistent
-worktree isolation. It copies uncommitted tracked changes and untracked
-non-ignored files from the source checkout into the new persistent worktree
-before the child starts. Gitignored files remain excluded, and external symlinks
-are blocked with the same protections used by safe-mode workspace sync. Without
-the flag, persistent worktree launches still require a clean source checkout.
+Work-mode persistent worktrees automatically copy uncommitted tracked changes
+and untracked non-ignored files from a dirty source checkout before the child
+starts. Gitignored files remain excluded, and external symlinks are blocked with
+the same protections used by safe-mode workspace sync. Automatic sync emits a
+`dirty_source_auto_included` warning with tracked-modified and untracked counts.
+`--include-dirty` remains an explicit launch flag and is a no-op when the source
+is already clean.
 JSON and text completion output report `includeDirty: true` / `syncedFiles`.
 `run --input-json` accepts the equivalent boolean field `includeDirty`.
 
@@ -118,11 +119,9 @@ A few boundaries are worth stating explicitly:
   repo history but also matched by a `.gitignore` rule is part of the repository
   and is synced like any other tracked file; `--include-dirty` excludes only
   untracked gitignored paths, not tracked ones.
-- **`--include-dirty` skips the submodule-cleanliness portion of the clean
-  check.** Without the flag, the preflight requires a clean source checkout
-  including submodule state; with the flag, the entire clean-source check is
-  skipped, so dirty submodules do not block the launch and submodule
-  working-tree state is not mirrored.
+- **Dirty submodules fail preflight.** Delegate auto-syncs ordinary tracked and
+  untracked non-ignored source changes, but cannot safely reproduce dirty
+  submodule state, so it refuses the launch until that submodule is clean.
 - **Keep secrets out of hardlinks.** A hardlink at a non-ignored path to
   gitignored content is indistinguishable from a regular file and will sync by
   content; `--include-dirty` trusts every non-ignored path. Path-based exclusion
@@ -151,8 +150,8 @@ auth/env selection happens.
 Usage:
 
 ```bash
-delegate [--json] [--isolation auto|none|worktree] codex {safe,work} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--fast|--no-fast] [--progress] [--forbid-commit] [--prompt-file PATH] [--output-schema FILE] [prompt...]
-delegate [--json] codex call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--fast|--no-fast] [--prompt-file PATH] [--output-schema FILE] [prompt...]
+delegate [--json] [--isolation auto|none|worktree] codex {safe,work} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--fast|--no-fast] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [--output-schema FILE] [prompt...]
+delegate [--json] codex call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--fast|--no-fast] [--prompt-file PATH] [--output-schema FILE] [prompt...]
 ```
 
 - Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff. Codex safe always uses `--sandbox read-only`. Under `--isolation auto`, Codex safe is the only safe harness that may opt out with `--isolation none`, because Codex still keeps its read-only sandbox active.
@@ -166,7 +165,7 @@ Examples:
 
 ```bash
 delegate codex safe "Review this repo for regressions; report file/line/severity."
-delegate codex safe --model gpt-5.5 "Review this repo for regressions; report file/line/severity."
+delegate codex safe --model reviewer "Review this repo for regressions; report file/line/severity."
 delegate codex safe --model my-alias --reasoning-effort medium --fast "Explore likely causes."
 delegate codex work "Implement the scoped task; report changed files and tests."
 delegate codex call "Summarize this context in three bullets."
@@ -179,8 +178,8 @@ delegate --isolation worktree codex work "Implement the feature in a persistent
 Usage:
 
 ```bash
-delegate [--json] [--isolation auto|none|worktree] claude {safe,work} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate [--json] claude call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
+delegate [--json] [--isolation auto|none|worktree] claude {safe,work} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] claude call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
 ```
 
 - Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff. Under `--isolation auto`, Claude safe uses `--permission-mode plan`, `--strict-mcp-config`, Read/Grep/Glob, and selected read-only Bash tools such as `git diff`/`git status`.
@@ -195,7 +194,7 @@ Examples:
 
 ```bash
 delegate claude safe "Review this repo for regressions; report file/line/severity."
-delegate claude work --model claude-opus-4-6 "Implement the scoped task; report changed files and tests."
+delegate claude work --model implementer "Implement the scoped task; report changed files and tests."
 delegate claude call "Summarize this context in three bullets."
 delegate --isolation worktree claude work "Implement the feature in a persistent worktree."
 ```
@@ -205,8 +204,8 @@ delegate --isolation worktree claude work "Implement the feature in a persistent
 Usage:
 
 ```bash
-delegate [--json] [--isolation auto|none|worktree] grok {safe,work} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate [--json] grok call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
+delegate [--json] [--isolation auto|none|worktree] grok {safe,work} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] grok call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
 ```
 
 - Safe mode reviews your **current working tree** in an isolated throwaway copy plus Grok read-only controls (`--sandbox read-only`, `--permission-mode dontAsk` by default). Delegate does not use Grok `plan` mode for safe review.
@@ -230,8 +229,8 @@ delegate --isolation worktree grok work "Implement the feature in a persistent w
 Wraps OpenCode's non-interactive `run` command.
 
 ```bash
-delegate [--json] [--isolation auto|none|worktree] opencode {safe,work} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--agent NAME] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate [--json] opencode call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--agent NAME] [--prompt-file PATH] [prompt...]
+delegate [--json] [--isolation auto|none|worktree] opencode {safe,work} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--agent NAME] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] opencode call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--agent NAME] [--prompt-file PATH] [prompt...]
 ```
 
 - Safe mode reviews the current working tree in an isolated throwaway copy. It
@@ -251,9 +250,9 @@ delegate [--json] opencode call [--read-only] [--model <alias-or-model>] [--reas
   {
     "opencode": {
       "models": {
-        "sonnet": "anthropic/claude-sonnet-4-5",
-        "sonnet-high": {
-          "model": "anthropic/claude-sonnet-4-5",
+        "reviewer": "provider/model",
+        "reviewer-high": {
+          "model": "provider/model",
           "variant": "high"
         }
       }
@@ -273,14 +272,15 @@ delegate [--json] opencode call [--read-only] [--model <alias-or-model>] [--reas
   `workflows.engineCaps` like other engines.
 - OpenCode currently buffers stdout until completion, so progress can remain
   silent even though `--print-logs` stderr is visible. Sessions accumulate in
-  the user's global OpenCode state. Call mode has no Delegate timeout.
+  the user's global OpenCode state. Call mode has no Delegate timeout unless
+  `--timeout` is set.
 
 Examples:
 
 ```bash
 delegate opencode safe "Review this repo for regressions; report file/line/severity."
 delegate opencode work --agent build "Implement the scoped task; report changed files and tests."
-delegate opencode call --read-only --model anthropic/claude-sonnet-4-5 --prompt-file rubric.md
+delegate opencode call --read-only --model reviewer --prompt-file rubric.md
 delegate --isolation worktree opencode work "Implement the feature in a persistent worktree."
 ```
 
@@ -289,15 +289,16 @@ delegate --isolation worktree opencode work "Implement the feature in a persiste
 Usage:
 
 ```bash
-delegate [--json] [--isolation auto|none|worktree] kimi {safe,work} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--forbid-commit] [--prompt-file PATH] [prompt...]
-delegate [--json] kimi call [--read-only] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
+delegate [--json] [--isolation auto|none|worktree] kimi {safe,work} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] kimi call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
 ```
 
 - Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff. Under `--isolation auto`, Kimi safe uses a read-only safety prompt. Delegate intentionally avoids Kimi `--plan` in safe mode. Kimi prompt mode auto-approves tool actions, so the isolation is the effective write boundary; the safety prompt is advisory.
 - Work mode uses Kimi prompt mode and runs in the real workspace unless you opt into worktree isolation. Delegate does not emit `--yolo` because Kimi rejects combining `--yolo` with `--prompt`.
 - Model selection uses `--model` (alias from `kimi.models` or a raw model ID), the run-input JSON `model`, or `kimi.defaultModel`.
-- `--reasoning-effort` is unsupported for Kimi in v1.
+- `--reasoning-effort` is rejected for Kimi: the Kimi CLI exposes no effort flag, and k3 supports effort internally via `~/.kimi-code/config.toml`.
 - Kimi prompt text is passed via argv.
+- Run JSON reports `usage: unavailable` for Kimi — expected: the Kimi CLI (verified 0.26.0) emits no usage/token lines in stream-json output, so there is nothing to parse.
 
 Examples:
 
@@ -431,12 +432,16 @@ and ambient customization, disables session persistence, and receives the prompt
 only on stdin. Use `--output-schema FILE` with Claude (schema contents inline)
 or with ordinary Codex call mode (schema path).
 
-`--timeout SECONDS` is a positive integer available on every call-mode engine.
-On expiry Delegate terminates the whole child process group and returns
-`call_timeout` with exit code 1.
+`--timeout SECONDS` is a positive integer accepted in every mode. It bounds
+calls and tracked `safe`/`work` runs alike: on expiry Delegate terminates the
+whole child process group and returns `call_timeout` (a historical error-code
+name kept for API stability) with exit code 1. `--timeout` is not supported
+with `--pass-through`, which streams the child without a tracked deadline.
 
-`--read-only`, `--pure`, and `--timeout` apply only to `call`; passing them with
-`safe`/`work` is rejected.
+`--read-only` and `--pure` apply only to `call`; passing them with
+`safe`/`work` is rejected. Empty-result retry applies to safe runs and read-only
+calls when the prompt can be safely extended; write-capable, pure, and verbatim
+calls are not retried.
 Because the child call is stateless, `--isolation`, `--pass-through`,
 `--progress`, `--forbid-commit`, and markdown completion reports are rejected.
 An ordinary call also rejects `--cwd`.
@@ -451,7 +456,7 @@ delegate --cwd /path/to/project --group wf_0123abcdef45 codex call "Summarize th
 ```
 
 The child still executes in an empty temporary cwd; `--cwd` does not give it the
-project tree. Dry-run accepts the same combination for faithful planning but
+project tree or leak it through Delegate root metadata. Dry-run accepts the same combination for faithful planning but
 creates no run entry. Use `safe` or `work` when the child should see the project
 tree.
 
@@ -499,7 +504,7 @@ Typical dry-run JSON fields:
 
 When a profile is active, dry-run and completion payloads add `authProfile` (the resolved profile name) and, when a Codex fallback profile is configured, `fallbackProfile`. Dry-run also adds `profileEnv` (the injected env map, with values redacted). These keys are omitted when no profile is active.
 
-For Cursor, Claude, Grok, Devin, OpenCode, Droid, and Kimi safe mode, an explicit `--isolation none`
+For Cursor, Claude, Grok, OpenCode, Droid, and Kimi safe mode, an explicit `--isolation none`
 is normalized to `auto` with a warning because those safe contracts depend on
 the temporary workspace/config boundary. Codex safe can use `none` because Codex
 still runs with its read-only sandbox.
@@ -578,6 +583,7 @@ Supported input keys:
   "progress": true,
   "forbidCommit": true,
   "includeDirty": true,
+  "timeout": 30,
   "outputSchema": "/path/to/schema.json",
   "prompt": "Implement the scoped task and report changed files."
 }
@@ -585,14 +591,16 @@ Supported input keys:
 
 - `engine`: `cursor`, `droid`, `codex`, `claude`, `grok`, `devin`, `opencode`, or `kimi`.
 - `mode`: `safe`, `work`, or `call`.
+- The `devin` engine rejects `safe` with `unsupported_mode` during preflight. Devin filesystem surveys may require generic `exec`, which Delegate cannot allow without weakening the read-only boundary; use another safe Harness for filesystem review.
 - `model`: optional alias-or-id for every engine. Resolved against `<engine>.models` when it matches an alias; otherwise passed through as a raw model ID. For Droid, a positional alias remains alias-only/strict; JSON/`--model` is alias-or-id. Cursor honors an explicit model even when it differs from `cursor.defaultModel`.
 - `cwd`: optional workspace path. Git directories resolve to the repo root. Omit it for `mode: "call"`, which always uses an empty temporary cwd.
-- `isolation`: optional `auto`, `none`, or `worktree`. `null` is invalid. `mode: "call"` rejects isolation. For Cursor, Claude, Grok, Devin, OpenCode, Droid, and Kimi safe mode, `none` is normalized to `auto` with a warning.
+- `isolation`: optional `auto`, `none`, or `worktree`. `null` is invalid. `mode: "call"` rejects isolation. For Cursor, Claude, Grok, OpenCode, Droid, and Kimi safe mode, `none` is normalized to `auto` with a warning.
 - `reasoningEffort`: optional non-empty effort string. It overrides provider `defaultReasoningEffort` for that JSON run.
 - `fast`: optional Codex-only boolean or `null`. `true` requests Fast, `false` explicitly requests Standard, and `null`/omission inherits Codex configuration.
 - `progress`: optional boolean. `true` enables parent progress heartbeats on stderr; `false` disables them even when `progress.enabled` is true in config. When omitted, config `progress.enabled` applies (default `false`). `mode: "call"` rejects progress.
 - `forbidCommit`: optional boolean. `true` requires `mode: "work"` with persistent worktree isolation and fails the run if the child creates commits. `mode: "call"` rejects commit policy.
 - `includeDirty`: optional boolean. `true` requires `mode: "work"` with persistent worktree isolation and syncs tracked edits plus untracked non-ignored files into the new worktree before launch.
+- `timeout`: optional positive integer seconds, with the same semantics as `--timeout`. Non-integer, boolean, or non-positive values fail with `invalid_timeout`; combining it with pass-through is rejected.
 - `outputSchema`: optional path to a JSON Schema for the final message. Supported for Codex and Claude call mode (same semantics as `--output-schema`). Other engines fail with `unsupported_output_schema`.
 - `prompt`: required task prompt.
 
@@ -763,7 +771,7 @@ Codex usage-limit fallback fires, the completion payload also includes
 `codexAuthFallback` metadata (reason, the primary and fallback profile names,
 both exit codes, and a redacted primary stderr tail).
 
-Snapshot JSON uses schema `delegate.snapshot.v1` and includes fields such as `alias`, `runId`, `harness`, `status`, `rawStatus`, `effectiveStatus`, `staleReason`, `nextActions`, `cwd`, `executionCwd`, `assistantText`, `recentEvents`, `warnings`, `exitCode`, reasoning metadata, terminal metadata, and isolation/worktree metadata when applicable. Inspection commands do not rewrite a stale run's recorded state; they expose the raw recorded status plus the effective status computed from the current PID check. Run-output and worktree show output include `requestedHandle`, `resolvedHandle`, and `resolutionKind` (`literal`, `latest`, or `latest_model`) when a handle resolves indirectly.
+Snapshot JSON uses schema `delegate.snapshot.v1` and includes fields such as `alias`, `runId`, `harness`, `status`, `rawStatus`, `effectiveStatus`, `staleReason`, `nextActions`, `cwd`, `executionCwd`, `assistantText`, `recentEvents`, `warnings`, `exitCode`, reasoning metadata, terminal metadata, and isolation/worktree metadata when applicable. Inspection commands do not rewrite a stale run's recorded state; they expose the raw recorded status plus the effective status computed from the current PID check. Run-output and worktree show output include `requestedHandle`, `resolvedHandle`, and `resolutionKind` (`literal`, `latest`, or `latest_model`) when a handle resolves indirectly. For bare harness handles, snapshot, run-output, and wait also report `resolvedRunId`, `resolvedAlias`, `resolvedWorkspace`, `resolvedAge`, and `resolvedAgeSeconds`. Resolutions older than 24 hours add a `bare_handle_stale` warning suggesting `--cwd` or an explicit handle.
 
 Tracked run envelopes include `completionReportWritten`, `completionReportSource`
 (`child`, `delegate_synthesized`, `stdout_recovery`, or `null`), and
@@ -773,6 +781,15 @@ exit-code-derived status.
 
 Run-output JSON uses schema `delegate.run-output.v1` and returns selected completion report, stdout, and/or stderr content. By default, secret-like strings are redacted unless `--no-redact` is supplied. Tracked runs finish in one of the terminal statuses `succeeded`, `failed`, or `cancelled`; explicit harness cancellation/error terminal events override an exit-zero child status.
 
+Safe runs and read-only call runs that exit successfully with `resultQuality=empty`
+retry once with the original prompt plus a plain-text final-answer instruction.
+Pure and slash pass-through prompts, and write-capable calls, do not retry. Retried
+envelopes add `emptyRetry: {attempted, resolved}`; runs that do not retry omit the
+field. If the second attempt is also empty, the run remains successful and honest
+with `resultQuality=empty`, and emits an
+`empty_success_retry` warning. Tracked safe runs retain both attempts in their
+stdout/stderr logs.
+
 `delegate wait` blocks until every selected run reaches terminal state. Defaults:
 `--interval 3`, minimum interval `1`, and `--timeout 3600`. Exit codes are `0`
 when all runs succeeded, `1` when any run failed or was cancelled, and `124` on
@@ -819,9 +836,10 @@ selectors are preserved. `--stdout` or `--stderr` without `--tail` or `--raw`
 defaults to a bounded `--tail 80` and a character cap (default 60000); use
 `--max-chars N` to override the cap. `--raw` returns the full stream with no
 line or character bounds, includes `rawOutputBytes` in JSON metadata, and cannot
-be combined with `--tail` or `--max-chars`. `--tail` and `--max-chars` require
-`--stdout` or `--stderr`; Delegate rejects them when only `--completion-report`
-is selected.
+be combined with `--tail` or `--max-chars`. A bare `--tail N` implies
+`--stdout` when no output selector is supplied; it never includes stderr.
+`--max-chars` still requires `--stdout` or `--stderr`, and Delegate rejects
+either bound when only `--completion-report` is selected.
 
 When `completion-report.md` is absent, `run-output --completion-report` makes a
 bounded best-effort attempt to recover an explicit final response from the