delegate-agent-cli 0.16.0__tar.gz → 0.17.0__tar.gz

{delegate_agent_cli-0.16.0 → delegate_agent_cli-0.17.0}/CHANGELOG.md

@@ -5,7 +5,45 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.17.0] - 2026-07-18
+
+### Added
+
+- Pi is now a first-class `safe`/`work`/`call` engine with stateless JSON
+  execution, stdin prompt transport, model aliases, reasoning-effort mapping,
+  live model discovery, normalized JSON events, and a native read-only policy
+  for safe mode and `call --read-only`.
+- Oh My Pi is now a first-class `omp` engine with matching mode, model alias,
+  reasoning, discovery, and event support. Its verified 17.0.4 prompt path uses
+  a redacted positional argument because piped stdin exits without processing.
+- Child processes now receive an authoritative `WORKSPACE_ROOT`; run metadata
+  exposes the same path as `workspaceRoot`, with source and isolated execution
+  roots available through `DELEGATE_SOURCE_ROOT` and
+  `DELEGATE_EXECUTION_ROOT` where applicable.
+
+### Changed
+
+- Repository-local `.delegate/config.json` is no longer loaded automatically.
+  Delegate reports it as an unapplied layer; operators must explicitly select
+  a trusted file with `DELEGATE_CONFIG`.
+- Stateless calls now preserve child-created files under
+  `.delegate/artifacts/<runId>/` instead of deleting successful deliverables,
+  and report `artifactsPath` plus `preservedArtifacts` in the response.
+- Unknown launch flags now fail as `unknown_option` before they can be absorbed
+  as prompt text, and corrected-command suggestions are emitted only after the
+  real parser validates them.
+
+### Security
+
+- Oh My Pi safe mode and `omp call --read-only` now add
+  `--approval-mode always-ask`, which denies write and exec tools in headless
+  mode even when project config requests `yolo`. A gated real-binary behavioral
+  test verifies writes and shell commands are denied while reads remain
+  available, and positional prompt guards reject flag- and include-shaped
+  injection prefixes.
+- Private `.delegate` run, workflow, and cache state I/O now traverses from the
+  workspace anchor with descriptor-relative, no-follow opens, rejecting
+  symlinked path components to prevent symlink-swap races.
 
 ## [0.16.0] - 2026-07-16
 
@@ -425,6 +463,7 @@ Usage-audit fix wave: 82 sessions and 1,241 delegate invocations from one week o
 
 - Releases before 0.1.3 predate this changelog.
 
+[0.17.0]: https://github.com/treygoff24/delegate-agent/compare/v0.16.0...v0.17.0
 [0.16.0]: https://github.com/treygoff24/delegate-agent/compare/v0.15.0...v0.16.0
 [0.15.0]: https://github.com/treygoff24/delegate-agent/compare/v0.14.0...v0.15.0
 [0.14.0]: https://github.com/treygoff24/delegate-agent/compare/v0.13.1...v0.14.0

{delegate_agent_cli-0.16.0 → delegate_agent_cli-0.17.0}/MANIFEST.in

@@ -9,6 +9,7 @@ include bin/delegate-profile-shim
 include docs/agent-setup.md
 include docs/cli-reference.md
 include docs/configuration.md
+include docs/delegate-workflows.md
 include docs/development.md
 include docs/live-runtime.md
 include docs/publishing-checklist.md

{delegate_agent_cli-0.16.0 → delegate_agent_cli-0.17.0}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: delegate-agent-cli
-Version: 0.16.0
-Summary: A tiny CLI for delegating bounded agent tasks to Cursor, Droid, OpenAI Codex, Claude Code, Grok Build, or Kimi Code runtimes.
+Version: 0.17.0
+Summary: A tiny CLI for delegating bounded agent tasks across coding-agent runtimes.
 Author: Trey Goff
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/treygoff24/delegate-agent
@@ -9,7 +9,7 @@ Project-URL: Repository, https://github.com/treygoff24/delegate-agent
 Project-URL: Issues, https://github.com/treygoff24/delegate-agent/issues
 Project-URL: Documentation, https://github.com/treygoff24/delegate-agent/tree/main/docs
 Project-URL: Security, https://github.com/treygoff24/delegate-agent/security/policy
-Keywords: agents,cli,claude,codex,delegation,cursor,droid,kimi
+Keywords: agents,cli,claude,codex,delegation,cursor,droid,kimi,omp,pi
 Classifier: Development Status :: 3 - Alpha
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
@@ -37,7 +37,7 @@ Dynamic: license-file
 
 # Delegate Agent
 
-Delegate Agent is a small CLI for handing a bounded task to another coding-agent runtime. It normalizes common calls to Cursor Agent, Factory Droid, OpenAI Codex, Claude Code, Grok Build, Devin, OpenCode, and Kimi Code so humans or other agents can launch review, investigation, and implementation jobs without remembering each tool's flags.
+Delegate Agent is a small CLI for handing a bounded task to another coding-agent runtime. It normalizes common calls to Cursor Agent, Factory Droid, OpenAI Codex, Claude Code, Grok Build, Devin, OpenCode, Pi, Oh My Pi, and Kimi Code so humans or other agents can launch review, investigation, and implementation jobs without remembering each tool's flags.
 
 Use it when you want a predictable wrapper around prompts like:
 
@@ -47,11 +47,11 @@ Use it when you want a predictable wrapper around prompts like:
 
 Delegate does **not** commit, push, merge, deploy, publish, or run a background service. It builds the child command, adds safety framing, launches the selected runtime, and records local run metadata for later inspection.
 
-Prompt handling is provider-specific: Codex, Claude, and OpenCode prompts are delivered to the child
+Prompt handling is provider-specific: Codex, Claude, OpenCode, and Pi prompts are delivered to the child
 runtime over stdin; Droid, Grok, and Devin prompts are delivered through private
-temporary prompt files; Cursor Agent and Kimi Code currently
-require prompt argv. Delegate redacts Cursor and Kimi prompt argv in dry-run
-output and run manifests, but true process-argv hiding for those harnesses
+temporary prompt files; Cursor Agent, Oh My Pi, and Kimi Code currently
+require prompt argv. Delegate redacts Cursor, Oh My Pi, and Kimi prompt argv in
+dry-run output and run manifests, but true process-argv hiding for those Harnesses
 depends on the child CLIs exposing stdin or prompt-file transport.
 
 ## Install
@@ -99,9 +99,31 @@ command -v claude  # Claude Code CLI, used by delegate claude ...
 command -v grok    # xAI Grok Build CLI, used by delegate grok ...
 command -v devin   # Cognition Devin CLI, used by delegate devin ...
 command -v opencode # OpenCode CLI, used by delegate opencode ...
+command -v pi      # Pi coding agent, used by delegate pi ...
+command -v omp     # Oh My Pi, used by delegate omp ...
 command -v kimi    # Kimi Code CLI, used by delegate kimi ...
 ```
 
+Supported modes:
+
+| Harness | Command | `safe` | `work` | `call` |
+| --- | --- | --- | --- | --- |
+| Cursor Agent | `cursor` | Yes | Yes | Yes |
+| Factory Droid | `droid` | Yes | Yes | Yes |
+| OpenAI Codex | `codex` | Yes | Yes | Yes |
+| Claude Code | `claude` | Yes | Yes | Yes |
+| Grok Build | `grok` | Yes | Yes | Yes |
+| Devin | `devin` | No | Yes | Yes |
+| OpenCode | `opencode` | Yes | Yes | Yes |
+| Pi | `pi` | Yes | Yes | Yes |
+| Oh My Pi | `omp` | Yes | Yes | Yes |
+| Kimi Code | `kimi` | Yes | Yes | Yes |
+
+Devin `safe` is rejected because Delegate cannot enforce a read-only filesystem
+survey through Devin's generic execution tool. See the
+[security model](docs/security-model.md) for the strength and limits of each
+Harness's `safe` and `call --read-only` boundary.
+
 Runtime authentication is owned by each child CLI. Delegate cannot log in for you. Dry-runs and CI tests do not require the real child binaries.
 
 Install OpenCode from [opencode.ai](https://opencode.ai). Its curl installer
@@ -131,6 +153,8 @@ delegate --json models
 delegate --json models codex          # per-engine advisory catalog
 delegate --json models cursor --live  # merge live harness probe when supported
 delegate --json models opencode --live # query every model visible to OpenCode
+delegate --json models pi --live       # query every model visible to Pi
+delegate --json models omp --live      # query every model visible to Oh My Pi
 delegate --json capabilities
 ```
 
@@ -155,6 +179,8 @@ Preview the command without launching a child runtime:
 delegate --json dry-run codex safe "Review this repository. Do not edit files."
 delegate --json dry-run claude safe "Review this repository. Do not edit files."
 delegate --json dry-run opencode safe "Review this repository. Do not edit files."
+delegate --json dry-run pi safe "Review this repository. Do not edit files."
+delegate --json dry-run omp safe "Review this repository. Do not edit files."
 ```
 
 Run a read-only review in an isolated throwaway workspace:
@@ -164,6 +190,8 @@ delegate codex safe "Review this repository for correctness risks. Do not edit f
 delegate claude safe "Review this repository for correctness risks. Do not edit files."
 delegate grok safe "Review this repository for correctness risks. Do not edit files."
 delegate opencode safe "Review this repository for correctness risks. Do not edit files."
+delegate pi safe "Review this repository for correctness risks. Do not edit files."
+delegate omp safe "Review this repository for correctness risks. Do not edit files."
 delegate cursor safe "Review the current diff for regressions. Do not edit files."
 delegate kimi safe "Review this repository for regressions. Do not edit files."
 ```
@@ -182,6 +210,8 @@ delegate cursor work "Fix the parser bug. Run python3 -m unittest tests.test_del
 delegate claude work "Implement the scoped change and run the named check. Report changed files."
 delegate devin work "Implement the scoped change and run the named check. Report changed files."
 delegate opencode work "Implement the scoped change and run the named check. Report changed files."
+delegate pi work "Implement the scoped change and run the named check. Report changed files."
+delegate omp work "Implement the scoped change and run the named check. Report changed files."
 delegate kimi work "Implement the scoped change and run the named check. Report changed files."
 ```
 
@@ -223,6 +253,12 @@ delegate --json codex call "Summarize this context in three bullets."
 delegate --json claude call --pure --timeout 60 --output-schema result.schema.json < prompt.txt
 ```
 
+Use `delegate --cwd /path/to/workspace <engine> work ...` when the deliverable
+is a file; `call` is optimized for text results. If a call creates files in its throwaway cwd,
+Delegate preserves that cwd under `.delegate/artifacts/<runId>/` and reports
+`preservedArtifacts` in the JSON result instead of deleting the files. Artifact
+cleanup is manual.
+
 `call --pure` is a hostile-input completion boundary available on Claude only.
 It uses an empty temporary cwd, an allowlisted child environment, no Delegate
 prompt framing, and no session persistence or tools according to the engine
@@ -244,7 +280,7 @@ python3 bin/delegate.py workflow approve wf_0123abcdef45
 See [Delegate Workflows](docs/delegate-workflows.md) for the DSL, safety
 limits, config, and gate semantics.
 
-Reasoning effort is provider-aware. Unsupported combinations fail before launch. It changes only the requested model thinking depth/cost/latency; it does not change safe/work/call mode, sandboxing, approvals, or edit capability. Codex/Droid validate effort against model capability metadata, Cursor maps effort to configured model selection, Claude maps to Claude Code `--effort`, Grok maps to Grok `--effort` (`low`, `medium`, `high`, `xhigh`, `max`), and OpenCode passes it through as `--variant`. Devin and Kimi do not expose a Delegate reasoning-effort flag. Explicit Codex effort can target the harness default model even when `codex.defaultModel` is unset:
+Reasoning effort is provider-aware. Unsupported combinations fail before launch. It changes only the requested model thinking depth/cost/latency; it does not change safe/work/call mode, sandboxing, approvals, or edit capability. Codex/Droid validate effort against model capability metadata, Cursor maps effort to configured model selection, Claude and Grok map to native `--effort`, OpenCode passes it through as `--variant`, and Pi/Oh My Pi map `low|medium|high|xhigh|max` directly to `--thinking`. Devin and Kimi do not expose a Delegate reasoning-effort flag. Explicit Codex effort can target the harness default model even when `codex.defaultModel` is unset:
 
 ```bash
 delegate --json dry-run codex safe --reasoning-effort high "Review this repository. Do not edit files."
@@ -324,12 +360,19 @@ Delegate separates three ideas:
 | Isolation | The child runtime can run in the source workspace, a temporary copy/worktree, or a persistent Git worktree. |
 | Runtime policy | Extra flags passed to the child runtime, such as Codex `--sandbox read-only`. |
 
+Every child receives `WORKSPACE_ROOT`, the resolved execution workspace shown as
+`workspaceRoot` in run metadata. Use it to anchor workspace-relative commands
+after changing into a toolchain directory. Source-backed runs also expose
+`DELEGATE_SOURCE_ROOT`; isolated runs expose `DELEGATE_EXECUTION_ROOT`.
+
 Defaults are intentionally conservative for review paths:
 
-- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate opencode safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
+- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate opencode safe`, `delegate pi safe`, `delegate omp safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
 - Grok safe mode uses Delegate isolated copy plus Grok read-only sandbox/permission controls (`--sandbox read-only`, `--permission-mode dontAsk` by default). It does not use Grok `plan` mode. Prompts are delivered via Grok `--prompt-file` from a Delegate temp file.
 - Devin safe mode is unsupported: Devin may implement filesystem surveys through the generic `exec` tool, which Delegate cannot permit without weakening the read-only boundary. Use another safe Harness for filesystem review. Devin work mode uses `--permission-mode dangerous` because Devin print mode rejects unapproved edit/exec tools.
 - OpenCode safe mode uses Delegate's isolated copy plus an `OPENCODE_CONFIG_CONTENT` permission lockdown that allows only read, glob, and grep operations. OpenCode merges this override last, so repository configuration cannot restore write-capable tools. `opencode call --read-only` uses the same lockdown; plain `call` does not.
+- Pi safe mode and `pi call --read-only` use only the built-in `read` tool and disable extension, skill, prompt-template, and project-approval discovery. All Pi modes use `--no-session`; Delegate's run registry is the durable record.
+- Oh My Pi safe mode and `omp call --read-only` use only `read`, disable extension, skill, rules, and LSP discovery, and enforce `--approval-mode always-ask` so headless write and exec requests are denied. All Oh My Pi modes use `--no-session`; Delegate passes prompts as positional arguments because the verified 17.0.4 stdin path exited without processing piped input.
 - Claude safe mode invokes `claude -p` with prompt text on stdin, `--permission-mode plan`, `--strict-mcp-config`, Read/Grep/Glob plus selected read-only Bash tools, and `--no-session-persistence` by default. Delegate does not currently prove that Claude Code hooks, plugins, user settings, or other non-MCP customization surfaces are disabled.
 - `work` mode can edit. By default it runs in the real workspace for backward compatibility.
 
@@ -356,7 +399,7 @@ non-ignored files from a dirty source checkout before launch, report the counts
 in a `dirty_source_auto_included` warning, and tear down the worktree if syncing
 fails. `--include-dirty` remains an explicit, harmless no-op on a clean source.
 
-Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/OpenCode/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
+Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/OpenCode/Pi/Oh My Pi/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
 
 Snapshots and `run-output` redact common credential shapes by default, including authorization headers, bearer/basic tokens, JWT-like strings, and common `token=` / `api_key=` / `password=` values. Use `--no-redact` only when exact output is necessary and safe to display.
 

{delegate_agent_cli-0.16.0 → delegate_agent_cli-0.17.0}/README.md

@@ -4,7 +4,7 @@
 
 # Delegate Agent
 
-Delegate Agent is a small CLI for handing a bounded task to another coding-agent runtime. It normalizes common calls to Cursor Agent, Factory Droid, OpenAI Codex, Claude Code, Grok Build, Devin, OpenCode, and Kimi Code so humans or other agents can launch review, investigation, and implementation jobs without remembering each tool's flags.
+Delegate Agent is a small CLI for handing a bounded task to another coding-agent runtime. It normalizes common calls to Cursor Agent, Factory Droid, OpenAI Codex, Claude Code, Grok Build, Devin, OpenCode, Pi, Oh My Pi, and Kimi Code so humans or other agents can launch review, investigation, and implementation jobs without remembering each tool's flags.
 
 Use it when you want a predictable wrapper around prompts like:
 
@@ -14,11 +14,11 @@ Use it when you want a predictable wrapper around prompts like:
 
 Delegate does **not** commit, push, merge, deploy, publish, or run a background service. It builds the child command, adds safety framing, launches the selected runtime, and records local run metadata for later inspection.
 
-Prompt handling is provider-specific: Codex, Claude, and OpenCode prompts are delivered to the child
+Prompt handling is provider-specific: Codex, Claude, OpenCode, and Pi prompts are delivered to the child
 runtime over stdin; Droid, Grok, and Devin prompts are delivered through private
-temporary prompt files; Cursor Agent and Kimi Code currently
-require prompt argv. Delegate redacts Cursor and Kimi prompt argv in dry-run
-output and run manifests, but true process-argv hiding for those harnesses
+temporary prompt files; Cursor Agent, Oh My Pi, and Kimi Code currently
+require prompt argv. Delegate redacts Cursor, Oh My Pi, and Kimi prompt argv in
+dry-run output and run manifests, but true process-argv hiding for those Harnesses
 depends on the child CLIs exposing stdin or prompt-file transport.
 
 ## Install
@@ -66,9 +66,31 @@ command -v claude  # Claude Code CLI, used by delegate claude ...
 command -v grok    # xAI Grok Build CLI, used by delegate grok ...
 command -v devin   # Cognition Devin CLI, used by delegate devin ...
 command -v opencode # OpenCode CLI, used by delegate opencode ...
+command -v pi      # Pi coding agent, used by delegate pi ...
+command -v omp     # Oh My Pi, used by delegate omp ...
 command -v kimi    # Kimi Code CLI, used by delegate kimi ...
 ```
 
+Supported modes:
+
+| Harness | Command | `safe` | `work` | `call` |
+| --- | --- | --- | --- | --- |
+| Cursor Agent | `cursor` | Yes | Yes | Yes |
+| Factory Droid | `droid` | Yes | Yes | Yes |
+| OpenAI Codex | `codex` | Yes | Yes | Yes |
+| Claude Code | `claude` | Yes | Yes | Yes |
+| Grok Build | `grok` | Yes | Yes | Yes |
+| Devin | `devin` | No | Yes | Yes |
+| OpenCode | `opencode` | Yes | Yes | Yes |
+| Pi | `pi` | Yes | Yes | Yes |
+| Oh My Pi | `omp` | Yes | Yes | Yes |
+| Kimi Code | `kimi` | Yes | Yes | Yes |
+
+Devin `safe` is rejected because Delegate cannot enforce a read-only filesystem
+survey through Devin's generic execution tool. See the
+[security model](docs/security-model.md) for the strength and limits of each
+Harness's `safe` and `call --read-only` boundary.
+
 Runtime authentication is owned by each child CLI. Delegate cannot log in for you. Dry-runs and CI tests do not require the real child binaries.
 
 Install OpenCode from [opencode.ai](https://opencode.ai). Its curl installer
@@ -98,6 +120,8 @@ delegate --json models
 delegate --json models codex          # per-engine advisory catalog
 delegate --json models cursor --live  # merge live harness probe when supported
 delegate --json models opencode --live # query every model visible to OpenCode
+delegate --json models pi --live       # query every model visible to Pi
+delegate --json models omp --live      # query every model visible to Oh My Pi
 delegate --json capabilities
 ```
 
@@ -122,6 +146,8 @@ Preview the command without launching a child runtime:
 delegate --json dry-run codex safe "Review this repository. Do not edit files."
 delegate --json dry-run claude safe "Review this repository. Do not edit files."
 delegate --json dry-run opencode safe "Review this repository. Do not edit files."
+delegate --json dry-run pi safe "Review this repository. Do not edit files."
+delegate --json dry-run omp safe "Review this repository. Do not edit files."
 ```
 
 Run a read-only review in an isolated throwaway workspace:
@@ -131,6 +157,8 @@ delegate codex safe "Review this repository for correctness risks. Do not edit f
 delegate claude safe "Review this repository for correctness risks. Do not edit files."
 delegate grok safe "Review this repository for correctness risks. Do not edit files."
 delegate opencode safe "Review this repository for correctness risks. Do not edit files."
+delegate pi safe "Review this repository for correctness risks. Do not edit files."
+delegate omp safe "Review this repository for correctness risks. Do not edit files."
 delegate cursor safe "Review the current diff for regressions. Do not edit files."
 delegate kimi safe "Review this repository for regressions. Do not edit files."
 ```
@@ -149,6 +177,8 @@ delegate cursor work "Fix the parser bug. Run python3 -m unittest tests.test_del
 delegate claude work "Implement the scoped change and run the named check. Report changed files."
 delegate devin work "Implement the scoped change and run the named check. Report changed files."
 delegate opencode work "Implement the scoped change and run the named check. Report changed files."
+delegate pi work "Implement the scoped change and run the named check. Report changed files."
+delegate omp work "Implement the scoped change and run the named check. Report changed files."
 delegate kimi work "Implement the scoped change and run the named check. Report changed files."
 ```
 
@@ -190,6 +220,12 @@ delegate --json codex call "Summarize this context in three bullets."
 delegate --json claude call --pure --timeout 60 --output-schema result.schema.json < prompt.txt
 ```
 
+Use `delegate --cwd /path/to/workspace <engine> work ...` when the deliverable
+is a file; `call` is optimized for text results. If a call creates files in its throwaway cwd,
+Delegate preserves that cwd under `.delegate/artifacts/<runId>/` and reports
+`preservedArtifacts` in the JSON result instead of deleting the files. Artifact
+cleanup is manual.
+
 `call --pure` is a hostile-input completion boundary available on Claude only.
 It uses an empty temporary cwd, an allowlisted child environment, no Delegate
 prompt framing, and no session persistence or tools according to the engine
@@ -211,7 +247,7 @@ python3 bin/delegate.py workflow approve wf_0123abcdef45
 See [Delegate Workflows](docs/delegate-workflows.md) for the DSL, safety
 limits, config, and gate semantics.
 
-Reasoning effort is provider-aware. Unsupported combinations fail before launch. It changes only the requested model thinking depth/cost/latency; it does not change safe/work/call mode, sandboxing, approvals, or edit capability. Codex/Droid validate effort against model capability metadata, Cursor maps effort to configured model selection, Claude maps to Claude Code `--effort`, Grok maps to Grok `--effort` (`low`, `medium`, `high`, `xhigh`, `max`), and OpenCode passes it through as `--variant`. Devin and Kimi do not expose a Delegate reasoning-effort flag. Explicit Codex effort can target the harness default model even when `codex.defaultModel` is unset:
+Reasoning effort is provider-aware. Unsupported combinations fail before launch. It changes only the requested model thinking depth/cost/latency; it does not change safe/work/call mode, sandboxing, approvals, or edit capability. Codex/Droid validate effort against model capability metadata, Cursor maps effort to configured model selection, Claude and Grok map to native `--effort`, OpenCode passes it through as `--variant`, and Pi/Oh My Pi map `low|medium|high|xhigh|max` directly to `--thinking`. Devin and Kimi do not expose a Delegate reasoning-effort flag. Explicit Codex effort can target the harness default model even when `codex.defaultModel` is unset:
 
 ```bash
 delegate --json dry-run codex safe --reasoning-effort high "Review this repository. Do not edit files."
@@ -291,12 +327,19 @@ Delegate separates three ideas:
 | Isolation | The child runtime can run in the source workspace, a temporary copy/worktree, or a persistent Git worktree. |
 | Runtime policy | Extra flags passed to the child runtime, such as Codex `--sandbox read-only`. |
 
+Every child receives `WORKSPACE_ROOT`, the resolved execution workspace shown as
+`workspaceRoot` in run metadata. Use it to anchor workspace-relative commands
+after changing into a toolchain directory. Source-backed runs also expose
+`DELEGATE_SOURCE_ROOT`; isolated runs expose `DELEGATE_EXECUTION_ROOT`.
+
 Defaults are intentionally conservative for review paths:
 
-- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate opencode safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
+- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate opencode safe`, `delegate pi safe`, `delegate omp safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
 - Grok safe mode uses Delegate isolated copy plus Grok read-only sandbox/permission controls (`--sandbox read-only`, `--permission-mode dontAsk` by default). It does not use Grok `plan` mode. Prompts are delivered via Grok `--prompt-file` from a Delegate temp file.
 - Devin safe mode is unsupported: Devin may implement filesystem surveys through the generic `exec` tool, which Delegate cannot permit without weakening the read-only boundary. Use another safe Harness for filesystem review. Devin work mode uses `--permission-mode dangerous` because Devin print mode rejects unapproved edit/exec tools.
 - OpenCode safe mode uses Delegate's isolated copy plus an `OPENCODE_CONFIG_CONTENT` permission lockdown that allows only read, glob, and grep operations. OpenCode merges this override last, so repository configuration cannot restore write-capable tools. `opencode call --read-only` uses the same lockdown; plain `call` does not.
+- Pi safe mode and `pi call --read-only` use only the built-in `read` tool and disable extension, skill, prompt-template, and project-approval discovery. All Pi modes use `--no-session`; Delegate's run registry is the durable record.
+- Oh My Pi safe mode and `omp call --read-only` use only `read`, disable extension, skill, rules, and LSP discovery, and enforce `--approval-mode always-ask` so headless write and exec requests are denied. All Oh My Pi modes use `--no-session`; Delegate passes prompts as positional arguments because the verified 17.0.4 stdin path exited without processing piped input.
 - Claude safe mode invokes `claude -p` with prompt text on stdin, `--permission-mode plan`, `--strict-mcp-config`, Read/Grep/Glob plus selected read-only Bash tools, and `--no-session-persistence` by default. Delegate does not currently prove that Claude Code hooks, plugins, user settings, or other non-MCP customization surfaces are disabled.
 - `work` mode can edit. By default it runs in the real workspace for backward compatibility.
 
@@ -323,7 +366,7 @@ non-ignored files from a dirty source checkout before launch, report the counts
 in a `dirty_source_auto_included` warning, and tear down the worktree if syncing
 fails. `--include-dirty` remains an explicit, harmless no-op on a clean source.
 
-Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/OpenCode/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
+Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/OpenCode/Pi/Oh My Pi/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
 
 Snapshots and `run-output` redact common credential shapes by default, including authorization headers, bearer/basic tokens, JWT-like strings, and common `token=` / `api_key=` / `password=` values. Use `--no-redact` only when exact output is necessary and safe to display.
 

{delegate_agent_cli-0.16.0 → delegate_agent_cli-0.17.0}/config.example.json

@@ -93,6 +93,18 @@
     "defaultAgent": null,
     "models": {}
   },
+  "pi": {
+    "binary": "pi",
+    "defaultModel": null,
+    "defaultReasoningEffort": null,
+    "models": {}
+  },
+  "omp": {
+    "binary": "omp",
+    "defaultModel": null,
+    "defaultReasoningEffort": null,
+    "models": {}
+  },
   "kimi": {
     "binary": "kimi",
     "defaultModel": "kimi-code/k3",

{delegate_agent_cli-0.16.0 → delegate_agent_cli-0.17.0}/docs/agent-setup.md

@@ -38,6 +38,8 @@ This guide covers both human setup and non-interactive setup for agents or CI jo
    command -v grok || echo "Grok Build CLI missing"
    command -v devin || echo "Devin CLI missing"
    command -v opencode || echo "OpenCode CLI missing"
+   command -v pi || echo "Pi coding agent missing"
+   command -v omp || echo "Oh My Pi missing"
    command -v kimi || echo "Kimi Code CLI missing"
    ```
 
@@ -99,12 +101,14 @@ When running on Windows through WSL, treat Delegate as a Linux CLI:
    delegate --json dry-run devin work "Describe the planned work invocation."
    delegate --json dry-run opencode safe "Review only. Do not edit files."
    delegate --json dry-run opencode safe --reasoning-effort high "Review only. Do not edit files."
+   delegate --json dry-run pi safe --reasoning-effort high "Review only. Do not edit files."
+   delegate --json dry-run omp safe --reasoning-effort high "Review only. Do not edit files."
    delegate --json dry-run cursor safe "Review only. Do not edit files."
    delegate --json dry-run droid reviewer safe "Review only. Do not edit files."
    delegate --json dry-run kimi safe "Review only. Do not edit files."
    ```
 
-   The Codex, Claude, Grok, Devin work, OpenCode, Cursor, and Kimi dry-runs succeed with the unedited example config when no reasoning effort is requested. Devin safe mode is intentionally rejected because filesystem surveys may require generic `exec`, which cannot be allowed without weakening the read-only boundary. Explicit Codex reasoning-effort dry-runs can target the harness default model when no default model is configured. Claude and Grok reasoning effort map to native `--effort` flags; OpenCode reasoning effort maps to `--variant` without model validation. The Droid dry-run validates the alias, so it returns `unconfigured_model` until you replace the `reviewer` placeholder in `config.json` with a real model ID.
+   The Codex, Claude, Grok, Devin work, OpenCode, Pi, Oh My Pi, Cursor, and Kimi dry-runs succeed with the unedited example config when no reasoning effort is requested. Devin safe mode is intentionally rejected because filesystem surveys may require generic `exec`, which cannot be allowed without weakening the read-only boundary. Explicit Codex reasoning-effort dry-runs can target the harness default model when no default model is configured. Claude and Grok reasoning effort map to native `--effort` flags; OpenCode maps to `--variant`; Pi and Oh My Pi map to `--thinking`. The Droid dry-run validates the alias, so it returns `unconfigured_model` until you replace the `reviewer` placeholder in `config.json` with a real model ID.
 
 ### OpenCode
 
@@ -124,6 +128,20 @@ absolute path in Delegate config:
 Run `opencode auth login` before the first real launch. Delegate uses OpenCode's
 existing global authentication state and does not manage login itself.
 
+### Pi
+
+Install [Pi](https://github.com/badlogic/pi-mono) and authenticate its selected
+provider. Delegate uses Pi's existing `~/.pi/agent/auth.json`; it never reads,
+prints, or forwards that file and never emits Pi's `--api-key` flag. Configure
+an absolute `pi.binary` when `pi` is not on the non-interactive `PATH`.
+
+### Oh My Pi setup
+
+Install Oh My Pi and authenticate its selected provider. Delegate uses the
+runtime's existing profile without reading or forwarding credentials and never
+emits `--api-key` or Oh My Pi's role flags. Configure an absolute `omp.binary`
+when `omp` is not on the non-interactive `PATH`.
+
 ## Non-interactive agent setup
 
 For an orchestrating agent, script, or CI job:
@@ -166,6 +184,8 @@ For an orchestrating agent, script, or CI job:
    command -v grok >/dev/null || exit 3
    command -v devin >/dev/null || exit 3
    command -v opencode >/dev/null || exit 3
+   command -v pi >/dev/null || exit 3
+   command -v omp >/dev/null || exit 3
    command -v kimi >/dev/null || exit 3
    ```
 
@@ -192,7 +212,7 @@ For an orchestrating agent, script, or CI job:
 ## CI expectations
 
 The required test suite does not need real Cursor, Droid, Codex, Claude, Grok,
-Devin, OpenCode, or Kimi binaries. Tests use dry-run paths and fake binaries
+Devin, OpenCode, Pi, Oh My Pi, or Kimi binaries. Tests use dry-run paths and fake binaries
 where needed:
 
 ```bash

{delegate_agent_cli-0.16.0 → delegate_agent_cli-0.17.0}/docs/cli-reference.md

@@ -44,17 +44,26 @@ delegate opencode safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--
 delegate opencode work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--agent NAME] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
 delegate opencode call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--agent NAME] [--prompt-file PATH] [prompt...]
 
+delegate pi safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate pi work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate pi call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
+
+delegate omp safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate omp work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate omp call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
+
 delegate kimi safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
 delegate kimi work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
 delegate kimi call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
 ```
 
 Prompt sources are direct arguments, `--prompt-file`, or Delegate stdin. Raw C0 control characters other than newline, carriage return, and tab are stripped before launch; a prompt that becomes empty fails fast. After
-Delegate resolves the prompt, Codex, Claude, and OpenCode prompts are passed to the child runtime over
-stdin. Droid and Grok prompts are written to a private temporary prompt file and passed
+Delegate resolves the prompt, Codex, Claude, OpenCode, and Pi prompts are passed to the child runtime over
+stdin. Oh My Pi receives a positional prompt because 17.0.4 did not consume piped stdin in the verified
+non-interactive invocation. Droid and Grok prompts are written to a private temporary prompt file and passed
 with Droid's documented `--file` option or Grok's `--prompt-file`. Cursor Agent currently only exposes
 positional prompt input, and Kimi Code prompt mode currently uses `--prompt`,
-so those launches still use argv transport; Delegate redacts Cursor and Kimi
+so those Harnesses also use argv transport; Delegate redacts Cursor, Oh My Pi, and Kimi
 prompt argv in dry-run output and run manifests.
 
 Temporary safe isolation also re-roots absolute paths under the source workspace
@@ -79,10 +88,10 @@ matches an alias key; otherwise it is passed through verbatim as a raw model ID
 `MODEL_ALIAS` (alias-only/strict); give either the positional or `--model`, not
 both. With neither, Droid uses `droid.defaultModel` when set. Discover aliases
 and advisory catalogs with `delegate models`, `delegate models <engine>`, and
-`delegate models <engine> --live` (live probes for cursor/droid/devin/opencode; other
+`delegate models <engine> --live` (live probes for cursor/droid/devin/opencode/pi/omp; other
 engines report live unsupported).
 
-`--reasoning-effort LEVEL` is optional and parsed only before prompt text begins. Engines with capability metadata reject unsupported model/effort pairs before launch with `unsupported_reasoning_effort`. It affects only model reasoning depth, cost, or latency; it does not change `safe`/`work`/`call` permissions, sandboxing, approvals, network policy, or edit capability. Cursor effort is model-selection based and requires `cursor.reasoningEffortModels`; an explicit `--model` wins over effort→model routing. Droid emits `--reasoning-effort LEVEL`; Codex emits a `model_reasoning_effort` config override for the resolved model, or for the Codex harness default model when no `codex.defaultModel` is configured and the request was explicit; Claude emits Claude Code `--effort LEVEL`; Grok emits Grok `--effort LEVEL` (`low`, `medium`, `high`, `xhigh`, `max`); OpenCode emits `--variant LEVEL` without validating it against the selected model. The Kimi CLI exposes no effort flag; k3 supports effort internally via `~/.kimi-code/config.toml`, so Delegate rejects `--reasoning-effort` for Kimi.
+`--reasoning-effort LEVEL` is optional and parsed only before prompt text begins. Engines with capability metadata reject unsupported model/effort pairs before launch with `unsupported_reasoning_effort`. It affects only model reasoning depth, cost, or latency; it does not change `safe`/`work`/`call` permissions, sandboxing, approvals, network policy, or edit capability. Cursor effort is model-selection based and requires `cursor.reasoningEffortModels`; an explicit `--model` wins over effort→model routing. Droid emits `--reasoning-effort LEVEL`; Codex emits a `model_reasoning_effort` config override for the resolved model, or for the Codex harness default model when no `codex.defaultModel` is configured and the request was explicit; Claude emits Claude Code `--effort LEVEL`; Grok emits Grok `--effort LEVEL` (`low`, `medium`, `high`, `xhigh`, `max`); OpenCode emits `--variant LEVEL` without validating it against the selected model; Pi and Oh My Pi emit `--thinking LEVEL` and accept the same five Delegate levels. The Kimi CLI exposes no effort flag; k3 supports effort internally via `~/.kimi-code/config.toml`, so Delegate rejects `--reasoning-effort` for Kimi.
 
 `--fast` and `--no-fast` are Codex-only, mutually exclusive per-run service-tier overrides. `--fast` emits `service_tier="fast"` plus `features.fast_mode=true` (Codex silently drops a Fast tier when that feature flag is off in the ambient config, so Delegate enables it explicitly); `--no-fast` emits `service_tier="default"` so a globally enabled Fast setting can be turned off for one child. Omitting both emits no override and inherits Codex configuration. Fast is orthogonal to model selection, reasoning effort, and Delegate safety policy. Two upstream caveats: Codex strips the service tier when authenticated with an API key (Fast is a ChatGPT-plan feature), and neither Codex nor the API fails on a tier the model does not offer — Delegate's flag validation is the only fail-closed layer, so an unsupported combination degrades silently to standard routing rather than erroring.
 
@@ -284,6 +293,55 @@ delegate opencode call --read-only --model reviewer --prompt-file rubric.md
 delegate --isolation worktree opencode work "Implement the feature in a persistent worktree."
 ```
 
+### `delegate pi`
+
+Wraps Pi's headless print mode.
+
+```bash
+delegate [--json] [--isolation auto|none|worktree] pi {safe,work} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] pi call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
+```
+
+- Delegate launches `pi -p --no-session --mode json` and sends the resolved prompt over stdin.
+- Safe mode and `call --read-only` add `--tools read --no-extensions --no-skills --no-prompt-templates --no-approve`; safe mode also uses Delegate's isolated throwaway workspace.
+- Model aliases accept either a Pi `provider/model` string or `{ "model": "provider/model", "thinking": "LEVEL" }`.
+- `--reasoning-effort` maps directly to `--thinking` for `low`, `medium`, `high`, `xhigh`, and `max`. Structured aliases may select Pi's additional `off` or `minimal` levels.
+- All modes are stateless at Pi's session layer; Delegate's run registry remains the durable record.
+- JSON call responses retain the standard `text` field and also populate `assistantText`, matching tracked safe/work envelopes.
+- `delegate models pi --live` queries Pi's visible provider/model catalog.
+
+Examples:
+
+```bash
+delegate pi safe --reasoning-effort high "Review this repo for regressions."
+delegate pi work --model reviewer "Implement the scoped task and run its checks."
+delegate pi call --read-only --prompt-file rubric.md
+```
+
+### `delegate omp`
+
+Wraps Oh My Pi's headless print mode.
+
+```bash
+delegate [--json] [--isolation auto|none|worktree] omp {safe,work} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] omp call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--prompt-file PATH] [prompt...]
+```
+
+- Delegate launches `omp -p --no-session --mode json` and passes the resolved prompt as a positional argument.
+- Safe mode and `call --read-only` add `--tools read --no-extensions --no-skills --no-rules --no-lsp --approval-mode always-ask`; the approval mode is the load-bearing write/exec denial in headless mode, and safe mode also uses Delegate's isolated throwaway workspace.
+- Model aliases accept either a `provider/model` string or `{ "model": "provider/model", "thinking": "LEVEL" }`.
+- `--reasoning-effort` maps directly to `--thinking` for `low`, `medium`, `high`, `xhigh`, and `max`. Structured aliases may select `off` or `minimal`.
+- Delegate never emits Oh My Pi's `--smol`, `--slow`, `--plan`, `--prewalk*`, or `--plan-yolo*` role flags.
+- `delegate models omp --live` uses `omp models --json --no-extensions`.
+
+Examples:
+
+```bash
+delegate omp safe --reasoning-effort high "Review this repo for regressions."
+delegate omp work --model reviewer "Implement the scoped task and run its checks."
+delegate omp call --read-only --prompt-file rubric.md
+```
+
 ### `delegate kimi`
 
 Usage:
@@ -446,6 +504,12 @@ Because the child call is stateless, `--isolation`, `--pass-through`,
 `--progress`, `--forbid-commit`, and markdown completion reports are rejected.
 An ordinary call also rejects `--cwd`.
 
+Use `delegate --cwd /path/to/workspace <engine> work ...` for file deliverables;
+`call` is intended for text results. If a child nevertheless creates files in the call cwd,
+Delegate moves the cwd to `.delegate/artifacts/<runId>/` at teardown and lists
+the retained files in `preservedArtifacts`. The artifacts directory has manual,
+bounded-by-operator retention; Delegate does not run artifact GC.
+
 **Grouped calls preserve workflow tracking without exposing the workspace to the
 child.** `--group NAME` registers the call in the invocation workspace so
 workflow kill/adopt and group selectors can find it. In that one combination,
@@ -504,7 +568,7 @@ Typical dry-run JSON fields:
 
 When a profile is active, dry-run and completion payloads add `authProfile` (the resolved profile name) and, when a Codex fallback profile is configured, `fallbackProfile`. Dry-run also adds `profileEnv` (the injected env map, with values redacted). These keys are omitted when no profile is active.
 
-For Cursor, Claude, Grok, OpenCode, Droid, and Kimi safe mode, an explicit `--isolation none`
+For Cursor, Claude, Grok, OpenCode, Pi, Oh My Pi, Droid, and Kimi safe mode, an explicit `--isolation none`
 is normalized to `auto` with a warning because those safe contracts depend on
 the temporary workspace/config boundary. Codex safe can use `none` because Codex
 still runs with its read-only sandbox.
@@ -589,12 +653,12 @@ Supported input keys:
 }
 ```
 
-- `engine`: `cursor`, `droid`, `codex`, `claude`, `grok`, `devin`, `opencode`, or `kimi`.
+- `engine`: `cursor`, `droid`, `codex`, `claude`, `grok`, `devin`, `opencode`, `pi`, `omp`, or `kimi`.
 - `mode`: `safe`, `work`, or `call`.
 - The `devin` engine rejects `safe` with `unsupported_mode` during preflight. Devin filesystem surveys may require generic `exec`, which Delegate cannot allow without weakening the read-only boundary; use another safe Harness for filesystem review.
 - `model`: optional alias-or-id for every engine. Resolved against `<engine>.models` when it matches an alias; otherwise passed through as a raw model ID. For Droid, a positional alias remains alias-only/strict; JSON/`--model` is alias-or-id. Cursor honors an explicit model even when it differs from `cursor.defaultModel`.
 - `cwd`: optional workspace path. Git directories resolve to the repo root. Omit it for `mode: "call"`, which always uses an empty temporary cwd.
-- `isolation`: optional `auto`, `none`, or `worktree`. `null` is invalid. `mode: "call"` rejects isolation. For Cursor, Claude, Grok, OpenCode, Droid, and Kimi safe mode, `none` is normalized to `auto` with a warning.
+- `isolation`: optional `auto`, `none`, or `worktree`. `null` is invalid. `mode: "call"` rejects isolation. For Cursor, Claude, Grok, OpenCode, Pi, Oh My Pi, Droid, and Kimi safe mode, `none` is normalized to `auto` with a warning.
 - `reasoningEffort`: optional non-empty effort string. It overrides provider `defaultReasoningEffort` for that JSON run.
 - `fast`: optional Codex-only boolean or `null`. `true` requests Fast, `false` explicitly requests Standard, and `null`/omission inherits Codex configuration.
 - `progress`: optional boolean. `true` enables parent progress heartbeats on stderr; `false` disables them even when `progress.enabled` is true in config. When omitted, config `progress.enabled` applies (default `false`). `mode: "call"` rejects progress.
@@ -624,7 +688,7 @@ delegate --json capabilities refresh
 delegate agent-help
 ```
 
-`describe` reports version, engines, modes, supported isolation values, prompt transforms, effective policy, top-level profile config metadata, and representative argv shapes. It also includes a `commands` catalog derived from the help registry; each full entry includes stable `name`/`command`, usage, arguments, options, and launchOptions fields. Full `describe` is a strict superset of `describe --summary`, so fields present in summary keep the same names in the full payload. `models` reports configured Cursor, Droid, Codex, Claude, Grok, Devin, OpenCode, and Kimi model settings, including non-empty `<engine>.models` alias maps. `models <engine>` returns an advisory per-engine catalog (bundled + config); `--live` merges a harness probe for cursor, droid, devin, and opencode when available. Discovery output applies best-effort credential scrubbing, so secret-shaped values (including model IDs or paths that resemble credentials) are redacted; copy exact values from your config file rather than from scrubbed output. Agents should start with `--summary` for a compact inventory, then use raw output only when needed.
+`describe` reports version, engines, modes, supported isolation values, prompt transforms, effective policy, top-level profile config metadata, and representative argv shapes. It also includes a `commands` catalog derived from the help registry; each full entry includes stable `name`/`command`, usage, arguments, options, and launchOptions fields. Full `describe` is a strict superset of `describe --summary`, so fields present in summary keep the same names in the full payload. `models` reports configured Cursor, Droid, Codex, Claude, Grok, Devin, OpenCode, Pi, Oh My Pi, and Kimi model settings, including non-empty `<engine>.models` alias maps. `models <engine>` returns an advisory per-engine catalog (bundled + config); `--live` merges a harness probe for cursor, droid, devin, opencode, pi, and omp when available. Discovery output applies best-effort credential scrubbing, so secret-shaped values (including model IDs or paths that resemble credentials) are redacted; copy exact values from your config file rather than from scrubbed output. Agents should start with `--summary` for a compact inventory, then use raw output only when needed.
 
 Both `describe` and `models` include provenance fields useful for detecting installed-runtime drift:
 
@@ -771,7 +835,7 @@ Codex usage-limit fallback fires, the completion payload also includes
 `codexAuthFallback` metadata (reason, the primary and fallback profile names,
 both exit codes, and a redacted primary stderr tail).
 
-Snapshot JSON uses schema `delegate.snapshot.v1` and includes fields such as `alias`, `runId`, `harness`, `status`, `rawStatus`, `effectiveStatus`, `staleReason`, `nextActions`, `cwd`, `executionCwd`, `assistantText`, `recentEvents`, `warnings`, `exitCode`, reasoning metadata, terminal metadata, and isolation/worktree metadata when applicable. Inspection commands do not rewrite a stale run's recorded state; they expose the raw recorded status plus the effective status computed from the current PID check. Run-output and worktree show output include `requestedHandle`, `resolvedHandle`, and `resolutionKind` (`literal`, `latest`, or `latest_model`) when a handle resolves indirectly. For bare harness handles, snapshot, run-output, and wait also report `resolvedRunId`, `resolvedAlias`, `resolvedWorkspace`, `resolvedAge`, and `resolvedAgeSeconds`. Resolutions older than 24 hours add a `bare_handle_stale` warning suggesting `--cwd` or an explicit handle.
+Snapshot JSON uses schema `delegate.snapshot.v1` and includes fields such as `alias`, `runId`, `harness`, `status`, `rawStatus`, `effectiveStatus`, `staleReason`, `nextActions`, `cwd`, `executionCwd`, `workspaceRoot`, `assistantText`, `recentEvents`, `warnings`, `exitCode`, reasoning metadata, terminal metadata, and isolation/worktree metadata when applicable. `workspaceRoot` is also exported to the child as `WORKSPACE_ROOT`, so commands can anchor workspace-relative paths after changing directories. Inspection commands do not rewrite a stale run's recorded state; they expose the raw recorded status plus the effective status computed from the current PID check. Run-output and worktree show output include `requestedHandle`, `resolvedHandle`, and `resolutionKind` (`literal`, `latest`, or `latest_model`) when a handle resolves indirectly. For bare harness handles, snapshot, run-output, and wait also report `resolvedRunId`, `resolvedAlias`, `resolvedWorkspace`, `resolvedAge`, and `resolvedAgeSeconds`. Resolutions older than 24 hours add a `bare_handle_stale` warning suggesting `--cwd` or an explicit handle.
 
 Tracked run envelopes include `completionReportWritten`, `completionReportSource`
 (`child`, `delegate_synthesized`, `stdout_recovery`, or `null`), and