delegate-agent-cli 0.16.0__tar.gz → 0.18.0__tar.gz

{delegate_agent_cli-0.16.0 → delegate_agent_cli-0.18.0}/CHANGELOG.md

@@ -5,7 +5,65 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.18.0] - 2026-07-19
+
+### Added
+
+- `worktree gc --dry-run` now reports `wouldPruneSourceRoots` and classifies
+  un-prunable worktrees with structured orphan reasons (`source_root_missing`,
+  `worktree_metadata_missing`, `branch_missing`, `detached_backlink`), each
+  with a `safeAction`. GC remains non-destructive and never deletes worktree
+  directories.
+- New `worktrees.poolWarnCount` config knob (default 20): persistent
+  work-mode launches emit a stderr warning when the shared worktree pool
+  holds more worktrees than the threshold. Warn-only; nothing is blocked or
+  deleted.
+
+### Changed
+
+- Text rendering for `worktree gc --dry-run` prints
+  `would prune source roots` instead of a constant zero, and orphan lines now
+  include the worktree path alongside the reason.
+
+## [0.17.0] - 2026-07-18
+
+### Added
+
+- Pi is now a first-class `safe`/`work`/`call` engine with stateless JSON
+  execution, stdin prompt transport, model aliases, reasoning-effort mapping,
+  live model discovery, normalized JSON events, and a native read-only policy
+  for safe mode and `call --read-only`.
+- Oh My Pi is now a first-class `omp` engine with matching mode, model alias,
+  reasoning, discovery, and event support. Its verified 17.0.4 prompt path uses
+  a redacted positional argument because piped stdin exits without processing.
+- Child processes now receive an authoritative `WORKSPACE_ROOT`; run metadata
+  exposes the same path as `workspaceRoot`, with source and isolated execution
+  roots available through `DELEGATE_SOURCE_ROOT` and
+  `DELEGATE_EXECUTION_ROOT` where applicable.
+
+### Changed
+
+- Repository-local `.delegate/config.json` is no longer loaded automatically.
+  Delegate reports it as an unapplied layer; operators must explicitly select
+  a trusted file with `DELEGATE_CONFIG`.
+- Stateless calls now preserve child-created files under
+  `.delegate/artifacts/<runId>/` instead of deleting successful deliverables,
+  and report `artifactsPath` plus `preservedArtifacts` in the response.
+- Unknown launch flags now fail as `unknown_option` before they can be absorbed
+  as prompt text, and corrected-command suggestions are emitted only after the
+  real parser validates them.
+
+### Security
+
+- Oh My Pi safe mode and `omp call --read-only` now add
+  `--approval-mode always-ask`, which denies write and exec tools in headless
+  mode even when project config requests `yolo`. A gated real-binary behavioral
+  test verifies writes and shell commands are denied while reads remain
+  available, and positional prompt guards reject flag- and include-shaped
+  injection prefixes.
+- Private `.delegate` run, workflow, and cache state I/O now traverses from the
+  workspace anchor with descriptor-relative, no-follow opens, rejecting
+  symlinked path components to prevent symlink-swap races.
 
 ## [0.16.0] - 2026-07-16
 
@@ -425,6 +483,8 @@ Usage-audit fix wave: 82 sessions and 1,241 delegate invocations from one week o
 
 - Releases before 0.1.3 predate this changelog.
 
+[0.18.0]: https://github.com/treygoff24/delegate-agent/compare/v0.17.0...v0.18.0
+[0.17.0]: https://github.com/treygoff24/delegate-agent/compare/v0.16.0...v0.17.0
 [0.16.0]: https://github.com/treygoff24/delegate-agent/compare/v0.15.0...v0.16.0
 [0.15.0]: https://github.com/treygoff24/delegate-agent/compare/v0.14.0...v0.15.0
 [0.14.0]: https://github.com/treygoff24/delegate-agent/compare/v0.13.1...v0.14.0

{delegate_agent_cli-0.16.0 → delegate_agent_cli-0.18.0}/MANIFEST.in

@@ -9,6 +9,7 @@ include bin/delegate-profile-shim
 include docs/agent-setup.md
 include docs/cli-reference.md
 include docs/configuration.md
+include docs/delegate-workflows.md
 include docs/development.md
 include docs/live-runtime.md
 include docs/publishing-checklist.md

{delegate_agent_cli-0.16.0 → delegate_agent_cli-0.18.0}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: delegate-agent-cli
-Version: 0.16.0
-Summary: A tiny CLI for delegating bounded agent tasks to Cursor, Droid, OpenAI Codex, Claude Code, Grok Build, or Kimi Code runtimes.
+Version: 0.18.0
+Summary: A tiny CLI for delegating bounded agent tasks across coding-agent runtimes.
 Author: Trey Goff
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/treygoff24/delegate-agent
@@ -9,7 +9,7 @@ Project-URL: Repository, https://github.com/treygoff24/delegate-agent
 Project-URL: Issues, https://github.com/treygoff24/delegate-agent/issues
 Project-URL: Documentation, https://github.com/treygoff24/delegate-agent/tree/main/docs
 Project-URL: Security, https://github.com/treygoff24/delegate-agent/security/policy
-Keywords: agents,cli,claude,codex,delegation,cursor,droid,kimi
+Keywords: agents,cli,claude,codex,delegation,cursor,droid,kimi,omp,pi
 Classifier: Development Status :: 3 - Alpha
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
@@ -37,7 +37,7 @@ Dynamic: license-file
 
 # Delegate Agent
 
-Delegate Agent is a small CLI for handing a bounded task to another coding-agent runtime. It normalizes common calls to Cursor Agent, Factory Droid, OpenAI Codex, Claude Code, Grok Build, Devin, OpenCode, and Kimi Code so humans or other agents can launch review, investigation, and implementation jobs without remembering each tool's flags.
+Delegate Agent is a small CLI for handing a bounded task to another coding-agent runtime. It normalizes common calls to Cursor Agent, Factory Droid, OpenAI Codex, Claude Code, Grok Build, Devin, OpenCode, Pi, Oh My Pi, and Kimi Code so humans or other agents can launch review, investigation, and implementation jobs without remembering each tool's flags.
 
 Use it when you want a predictable wrapper around prompts like:
 
@@ -47,11 +47,11 @@ Use it when you want a predictable wrapper around prompts like:
 
 Delegate does **not** commit, push, merge, deploy, publish, or run a background service. It builds the child command, adds safety framing, launches the selected runtime, and records local run metadata for later inspection.
 
-Prompt handling is provider-specific: Codex, Claude, and OpenCode prompts are delivered to the child
+Prompt handling is provider-specific: Codex, Claude, OpenCode, and Pi prompts are delivered to the child
 runtime over stdin; Droid, Grok, and Devin prompts are delivered through private
-temporary prompt files; Cursor Agent and Kimi Code currently
-require prompt argv. Delegate redacts Cursor and Kimi prompt argv in dry-run
-output and run manifests, but true process-argv hiding for those harnesses
+temporary prompt files; Cursor Agent, Oh My Pi, and Kimi Code currently
+require prompt argv. Delegate redacts Cursor, Oh My Pi, and Kimi prompt argv in
+dry-run output and run manifests, but true process-argv hiding for those Harnesses
 depends on the child CLIs exposing stdin or prompt-file transport.
 
 ## Install
@@ -99,9 +99,31 @@ command -v claude  # Claude Code CLI, used by delegate claude ...
 command -v grok    # xAI Grok Build CLI, used by delegate grok ...
 command -v devin   # Cognition Devin CLI, used by delegate devin ...
 command -v opencode # OpenCode CLI, used by delegate opencode ...
+command -v pi      # Pi coding agent, used by delegate pi ...
+command -v omp     # Oh My Pi, used by delegate omp ...
 command -v kimi    # Kimi Code CLI, used by delegate kimi ...
 ```
 
+Supported modes:
+
+| Harness | Command | `safe` | `work` | `call` |
+| --- | --- | --- | --- | --- |
+| Cursor Agent | `cursor` | Yes | Yes | Yes |
+| Factory Droid | `droid` | Yes | Yes | Yes |
+| OpenAI Codex | `codex` | Yes | Yes | Yes |
+| Claude Code | `claude` | Yes | Yes | Yes |
+| Grok Build | `grok` | Yes | Yes | Yes |
+| Devin | `devin` | No | Yes | Yes |
+| OpenCode | `opencode` | Yes | Yes | Yes |
+| Pi | `pi` | Yes | Yes | Yes |
+| Oh My Pi | `omp` | Yes | Yes | Yes |
+| Kimi Code | `kimi` | Yes | Yes | Yes |
+
+Devin `safe` is rejected because Delegate cannot enforce a read-only filesystem
+survey through Devin's generic execution tool. See the
+[security model](docs/security-model.md) for the strength and limits of each
+Harness's `safe` and `call --read-only` boundary.
+
 Runtime authentication is owned by each child CLI. Delegate cannot log in for you. Dry-runs and CI tests do not require the real child binaries.
 
 Install OpenCode from [opencode.ai](https://opencode.ai). Its curl installer
@@ -131,6 +153,8 @@ delegate --json models
 delegate --json models codex          # per-engine advisory catalog
 delegate --json models cursor --live  # merge live harness probe when supported
 delegate --json models opencode --live # query every model visible to OpenCode
+delegate --json models pi --live       # query every model visible to Pi
+delegate --json models omp --live      # query every model visible to Oh My Pi
 delegate --json capabilities
 ```
 
@@ -155,6 +179,8 @@ Preview the command without launching a child runtime:
 delegate --json dry-run codex safe "Review this repository. Do not edit files."
 delegate --json dry-run claude safe "Review this repository. Do not edit files."
 delegate --json dry-run opencode safe "Review this repository. Do not edit files."
+delegate --json dry-run pi safe "Review this repository. Do not edit files."
+delegate --json dry-run omp safe "Review this repository. Do not edit files."
 ```
 
 Run a read-only review in an isolated throwaway workspace:
@@ -164,6 +190,8 @@ delegate codex safe "Review this repository for correctness risks. Do not edit f
 delegate claude safe "Review this repository for correctness risks. Do not edit files."
 delegate grok safe "Review this repository for correctness risks. Do not edit files."
 delegate opencode safe "Review this repository for correctness risks. Do not edit files."
+delegate pi safe "Review this repository for correctness risks. Do not edit files."
+delegate omp safe "Review this repository for correctness risks. Do not edit files."
 delegate cursor safe "Review the current diff for regressions. Do not edit files."
 delegate kimi safe "Review this repository for regressions. Do not edit files."
 ```
@@ -182,6 +210,8 @@ delegate cursor work "Fix the parser bug. Run python3 -m unittest tests.test_del
 delegate claude work "Implement the scoped change and run the named check. Report changed files."
 delegate devin work "Implement the scoped change and run the named check. Report changed files."
 delegate opencode work "Implement the scoped change and run the named check. Report changed files."
+delegate pi work "Implement the scoped change and run the named check. Report changed files."
+delegate omp work "Implement the scoped change and run the named check. Report changed files."
 delegate kimi work "Implement the scoped change and run the named check. Report changed files."
 ```
 
@@ -223,6 +253,12 @@ delegate --json codex call "Summarize this context in three bullets."
 delegate --json claude call --pure --timeout 60 --output-schema result.schema.json < prompt.txt
 ```
 
+Use `delegate --cwd /path/to/workspace <engine> work ...` when the deliverable
+is a file; `call` is optimized for text results. If a call creates files in its throwaway cwd,
+Delegate preserves that cwd under `.delegate/artifacts/<runId>/` and reports
+`preservedArtifacts` in the JSON result instead of deleting the files. Artifact
+cleanup is manual.
+
 `call --pure` is a hostile-input completion boundary available on Claude only.
 It uses an empty temporary cwd, an allowlisted child environment, no Delegate
 prompt framing, and no session persistence or tools according to the engine
@@ -244,7 +280,7 @@ python3 bin/delegate.py workflow approve wf_0123abcdef45
 See [Delegate Workflows](docs/delegate-workflows.md) for the DSL, safety
 limits, config, and gate semantics.
 
-Reasoning effort is provider-aware. Unsupported combinations fail before launch. It changes only the requested model thinking depth/cost/latency; it does not change safe/work/call mode, sandboxing, approvals, or edit capability. Codex/Droid validate effort against model capability metadata, Cursor maps effort to configured model selection, Claude maps to Claude Code `--effort`, Grok maps to Grok `--effort` (`low`, `medium`, `high`, `xhigh`, `max`), and OpenCode passes it through as `--variant`. Devin and Kimi do not expose a Delegate reasoning-effort flag. Explicit Codex effort can target the harness default model even when `codex.defaultModel` is unset:
+Reasoning effort is provider-aware. Unsupported combinations fail before launch. It changes only the requested model thinking depth/cost/latency; it does not change safe/work/call mode, sandboxing, approvals, or edit capability. Codex/Droid validate effort against model capability metadata, Cursor maps effort to configured model selection, Claude and Grok map to native `--effort`, OpenCode passes it through as `--variant`, and Pi/Oh My Pi map `low|medium|high|xhigh|max` directly to `--thinking`. Devin and Kimi do not expose a Delegate reasoning-effort flag. Explicit Codex effort can target the harness default model even when `codex.defaultModel` is unset:
 
 ```bash
 delegate --json dry-run codex safe --reasoning-effort high "Review this repository. Do not edit files."
@@ -324,12 +360,19 @@ Delegate separates three ideas:
 | Isolation | The child runtime can run in the source workspace, a temporary copy/worktree, or a persistent Git worktree. |
 | Runtime policy | Extra flags passed to the child runtime, such as Codex `--sandbox read-only`. |
 
+Every child receives `WORKSPACE_ROOT`, the resolved execution workspace shown as
+`workspaceRoot` in run metadata. Use it to anchor workspace-relative commands
+after changing into a toolchain directory. Source-backed runs also expose
+`DELEGATE_SOURCE_ROOT`; isolated runs expose `DELEGATE_EXECUTION_ROOT`.
+
 Defaults are intentionally conservative for review paths:
 
-- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate opencode safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
+- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate opencode safe`, `delegate pi safe`, `delegate omp safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
 - Grok safe mode uses Delegate isolated copy plus Grok read-only sandbox/permission controls (`--sandbox read-only`, `--permission-mode dontAsk` by default). It does not use Grok `plan` mode. Prompts are delivered via Grok `--prompt-file` from a Delegate temp file.
 - Devin safe mode is unsupported: Devin may implement filesystem surveys through the generic `exec` tool, which Delegate cannot permit without weakening the read-only boundary. Use another safe Harness for filesystem review. Devin work mode uses `--permission-mode dangerous` because Devin print mode rejects unapproved edit/exec tools.
 - OpenCode safe mode uses Delegate's isolated copy plus an `OPENCODE_CONFIG_CONTENT` permission lockdown that allows only read, glob, and grep operations. OpenCode merges this override last, so repository configuration cannot restore write-capable tools. `opencode call --read-only` uses the same lockdown; plain `call` does not.
+- Pi safe mode and `pi call --read-only` use only the built-in `read` tool and disable extension, skill, prompt-template, and project-approval discovery. All Pi modes use `--no-session`; Delegate's run registry is the durable record.
+- Oh My Pi safe mode and `omp call --read-only` use only `read`, disable extension, skill, rules, and LSP discovery, and enforce `--approval-mode always-ask` so headless write and exec requests are denied. All Oh My Pi modes use `--no-session`; Delegate passes prompts as positional arguments because the verified 17.0.4 stdin path exited without processing piped input.
 - Claude safe mode invokes `claude -p` with prompt text on stdin, `--permission-mode plan`, `--strict-mcp-config`, Read/Grep/Glob plus selected read-only Bash tools, and `--no-session-persistence` by default. Delegate does not currently prove that Claude Code hooks, plugins, user settings, or other non-MCP customization surfaces are disabled.
 - `work` mode can edit. By default it runs in the real workspace for backward compatibility.
 
@@ -356,7 +399,7 @@ non-ignored files from a dirty source checkout before launch, report the counts
 in a `dirty_source_auto_included` warning, and tear down the worktree if syncing
 fails. `--include-dirty` remains an explicit, harmless no-op on a clean source.
 
-Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/OpenCode/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
+Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/OpenCode/Pi/Oh My Pi/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
 
 Snapshots and `run-output` redact common credential shapes by default, including authorization headers, bearer/basic tokens, JWT-like strings, and common `token=` / `api_key=` / `password=` values. Use `--no-redact` only when exact output is necessary and safe to display.
 

{delegate_agent_cli-0.16.0 → delegate_agent_cli-0.18.0}/README.md

@@ -4,7 +4,7 @@
 
 # Delegate Agent
 
-Delegate Agent is a small CLI for handing a bounded task to another coding-agent runtime. It normalizes common calls to Cursor Agent, Factory Droid, OpenAI Codex, Claude Code, Grok Build, Devin, OpenCode, and Kimi Code so humans or other agents can launch review, investigation, and implementation jobs without remembering each tool's flags.
+Delegate Agent is a small CLI for handing a bounded task to another coding-agent runtime. It normalizes common calls to Cursor Agent, Factory Droid, OpenAI Codex, Claude Code, Grok Build, Devin, OpenCode, Pi, Oh My Pi, and Kimi Code so humans or other agents can launch review, investigation, and implementation jobs without remembering each tool's flags.
 
 Use it when you want a predictable wrapper around prompts like:
 
@@ -14,11 +14,11 @@ Use it when you want a predictable wrapper around prompts like:
 
 Delegate does **not** commit, push, merge, deploy, publish, or run a background service. It builds the child command, adds safety framing, launches the selected runtime, and records local run metadata for later inspection.
 
-Prompt handling is provider-specific: Codex, Claude, and OpenCode prompts are delivered to the child
+Prompt handling is provider-specific: Codex, Claude, OpenCode, and Pi prompts are delivered to the child
 runtime over stdin; Droid, Grok, and Devin prompts are delivered through private
-temporary prompt files; Cursor Agent and Kimi Code currently
-require prompt argv. Delegate redacts Cursor and Kimi prompt argv in dry-run
-output and run manifests, but true process-argv hiding for those harnesses
+temporary prompt files; Cursor Agent, Oh My Pi, and Kimi Code currently
+require prompt argv. Delegate redacts Cursor, Oh My Pi, and Kimi prompt argv in
+dry-run output and run manifests, but true process-argv hiding for those Harnesses
 depends on the child CLIs exposing stdin or prompt-file transport.
 
 ## Install
@@ -66,9 +66,31 @@ command -v claude  # Claude Code CLI, used by delegate claude ...
 command -v grok    # xAI Grok Build CLI, used by delegate grok ...
 command -v devin   # Cognition Devin CLI, used by delegate devin ...
 command -v opencode # OpenCode CLI, used by delegate opencode ...
+command -v pi      # Pi coding agent, used by delegate pi ...
+command -v omp     # Oh My Pi, used by delegate omp ...
 command -v kimi    # Kimi Code CLI, used by delegate kimi ...
 ```
 
+Supported modes:
+
+| Harness | Command | `safe` | `work` | `call` |
+| --- | --- | --- | --- | --- |
+| Cursor Agent | `cursor` | Yes | Yes | Yes |
+| Factory Droid | `droid` | Yes | Yes | Yes |
+| OpenAI Codex | `codex` | Yes | Yes | Yes |
+| Claude Code | `claude` | Yes | Yes | Yes |
+| Grok Build | `grok` | Yes | Yes | Yes |
+| Devin | `devin` | No | Yes | Yes |
+| OpenCode | `opencode` | Yes | Yes | Yes |
+| Pi | `pi` | Yes | Yes | Yes |
+| Oh My Pi | `omp` | Yes | Yes | Yes |
+| Kimi Code | `kimi` | Yes | Yes | Yes |
+
+Devin `safe` is rejected because Delegate cannot enforce a read-only filesystem
+survey through Devin's generic execution tool. See the
+[security model](docs/security-model.md) for the strength and limits of each
+Harness's `safe` and `call --read-only` boundary.
+
 Runtime authentication is owned by each child CLI. Delegate cannot log in for you. Dry-runs and CI tests do not require the real child binaries.
 
 Install OpenCode from [opencode.ai](https://opencode.ai). Its curl installer
@@ -98,6 +120,8 @@ delegate --json models
 delegate --json models codex          # per-engine advisory catalog
 delegate --json models cursor --live  # merge live harness probe when supported
 delegate --json models opencode --live # query every model visible to OpenCode
+delegate --json models pi --live       # query every model visible to Pi
+delegate --json models omp --live      # query every model visible to Oh My Pi
 delegate --json capabilities
 ```
 
@@ -122,6 +146,8 @@ Preview the command without launching a child runtime:
 delegate --json dry-run codex safe "Review this repository. Do not edit files."
 delegate --json dry-run claude safe "Review this repository. Do not edit files."
 delegate --json dry-run opencode safe "Review this repository. Do not edit files."
+delegate --json dry-run pi safe "Review this repository. Do not edit files."
+delegate --json dry-run omp safe "Review this repository. Do not edit files."
 ```
 
 Run a read-only review in an isolated throwaway workspace:
@@ -131,6 +157,8 @@ delegate codex safe "Review this repository for correctness risks. Do not edit f
 delegate claude safe "Review this repository for correctness risks. Do not edit files."
 delegate grok safe "Review this repository for correctness risks. Do not edit files."
 delegate opencode safe "Review this repository for correctness risks. Do not edit files."
+delegate pi safe "Review this repository for correctness risks. Do not edit files."
+delegate omp safe "Review this repository for correctness risks. Do not edit files."
 delegate cursor safe "Review the current diff for regressions. Do not edit files."
 delegate kimi safe "Review this repository for regressions. Do not edit files."
 ```
@@ -149,6 +177,8 @@ delegate cursor work "Fix the parser bug. Run python3 -m unittest tests.test_del
 delegate claude work "Implement the scoped change and run the named check. Report changed files."
 delegate devin work "Implement the scoped change and run the named check. Report changed files."
 delegate opencode work "Implement the scoped change and run the named check. Report changed files."
+delegate pi work "Implement the scoped change and run the named check. Report changed files."
+delegate omp work "Implement the scoped change and run the named check. Report changed files."
 delegate kimi work "Implement the scoped change and run the named check. Report changed files."
 ```
 
@@ -190,6 +220,12 @@ delegate --json codex call "Summarize this context in three bullets."
 delegate --json claude call --pure --timeout 60 --output-schema result.schema.json < prompt.txt
 ```
 
+Use `delegate --cwd /path/to/workspace <engine> work ...` when the deliverable
+is a file; `call` is optimized for text results. If a call creates files in its throwaway cwd,
+Delegate preserves that cwd under `.delegate/artifacts/<runId>/` and reports
+`preservedArtifacts` in the JSON result instead of deleting the files. Artifact
+cleanup is manual.
+
 `call --pure` is a hostile-input completion boundary available on Claude only.
 It uses an empty temporary cwd, an allowlisted child environment, no Delegate
 prompt framing, and no session persistence or tools according to the engine
@@ -211,7 +247,7 @@ python3 bin/delegate.py workflow approve wf_0123abcdef45
 See [Delegate Workflows](docs/delegate-workflows.md) for the DSL, safety
 limits, config, and gate semantics.
 
-Reasoning effort is provider-aware. Unsupported combinations fail before launch. It changes only the requested model thinking depth/cost/latency; it does not change safe/work/call mode, sandboxing, approvals, or edit capability. Codex/Droid validate effort against model capability metadata, Cursor maps effort to configured model selection, Claude maps to Claude Code `--effort`, Grok maps to Grok `--effort` (`low`, `medium`, `high`, `xhigh`, `max`), and OpenCode passes it through as `--variant`. Devin and Kimi do not expose a Delegate reasoning-effort flag. Explicit Codex effort can target the harness default model even when `codex.defaultModel` is unset:
+Reasoning effort is provider-aware. Unsupported combinations fail before launch. It changes only the requested model thinking depth/cost/latency; it does not change safe/work/call mode, sandboxing, approvals, or edit capability. Codex/Droid validate effort against model capability metadata, Cursor maps effort to configured model selection, Claude and Grok map to native `--effort`, OpenCode passes it through as `--variant`, and Pi/Oh My Pi map `low|medium|high|xhigh|max` directly to `--thinking`. Devin and Kimi do not expose a Delegate reasoning-effort flag. Explicit Codex effort can target the harness default model even when `codex.defaultModel` is unset:
 
 ```bash
 delegate --json dry-run codex safe --reasoning-effort high "Review this repository. Do not edit files."
@@ -291,12 +327,19 @@ Delegate separates three ideas:
 | Isolation | The child runtime can run in the source workspace, a temporary copy/worktree, or a persistent Git worktree. |
 | Runtime policy | Extra flags passed to the child runtime, such as Codex `--sandbox read-only`. |
 
+Every child receives `WORKSPACE_ROOT`, the resolved execution workspace shown as
+`workspaceRoot` in run metadata. Use it to anchor workspace-relative commands
+after changing into a toolchain directory. Source-backed runs also expose
+`DELEGATE_SOURCE_ROOT`; isolated runs expose `DELEGATE_EXECUTION_ROOT`.
+
 Defaults are intentionally conservative for review paths:
 
-- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate opencode safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
+- `delegate cursor safe`, `delegate codex safe`, `delegate claude safe`, `delegate grok safe`, `delegate opencode safe`, `delegate pi safe`, `delegate omp safe`, `delegate droid ALIAS safe`, and `delegate kimi safe` run in an isolated throwaway workspace. Safe mode reviews your **current working tree** — uncommitted tracked edits and untracked, non-ignored files are mirrored into an isolated throwaway copy (only gitignored paths are excluded), so you can review local changes without committing first or pasting a diff.
 - Grok safe mode uses Delegate isolated copy plus Grok read-only sandbox/permission controls (`--sandbox read-only`, `--permission-mode dontAsk` by default). It does not use Grok `plan` mode. Prompts are delivered via Grok `--prompt-file` from a Delegate temp file.
 - Devin safe mode is unsupported: Devin may implement filesystem surveys through the generic `exec` tool, which Delegate cannot permit without weakening the read-only boundary. Use another safe Harness for filesystem review. Devin work mode uses `--permission-mode dangerous` because Devin print mode rejects unapproved edit/exec tools.
 - OpenCode safe mode uses Delegate's isolated copy plus an `OPENCODE_CONFIG_CONTENT` permission lockdown that allows only read, glob, and grep operations. OpenCode merges this override last, so repository configuration cannot restore write-capable tools. `opencode call --read-only` uses the same lockdown; plain `call` does not.
+- Pi safe mode and `pi call --read-only` use only the built-in `read` tool and disable extension, skill, prompt-template, and project-approval discovery. All Pi modes use `--no-session`; Delegate's run registry is the durable record.
+- Oh My Pi safe mode and `omp call --read-only` use only `read`, disable extension, skill, rules, and LSP discovery, and enforce `--approval-mode always-ask` so headless write and exec requests are denied. All Oh My Pi modes use `--no-session`; Delegate passes prompts as positional arguments because the verified 17.0.4 stdin path exited without processing piped input.
 - Claude safe mode invokes `claude -p` with prompt text on stdin, `--permission-mode plan`, `--strict-mcp-config`, Read/Grep/Glob plus selected read-only Bash tools, and `--no-session-persistence` by default. Delegate does not currently prove that Claude Code hooks, plugins, user settings, or other non-MCP customization surfaces are disabled.
 - `work` mode can edit. By default it runs in the real workspace for backward compatibility.
 
@@ -323,7 +366,7 @@ non-ignored files from a dirty source checkout before launch, report the counts
 in a `dirty_source_auto_included` warning, and tear down the worktree if syncing
 fails. `--include-dirty` remains an explicit, harmless no-op on a clean source.
 
-Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/OpenCode/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
+Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/OpenCode/Pi/Oh My Pi/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
 
 Snapshots and `run-output` redact common credential shapes by default, including authorization headers, bearer/basic tokens, JWT-like strings, and common `token=` / `api_key=` / `password=` values. Use `--no-redact` only when exact output is necessary and safe to display.
 

{delegate_agent_cli-0.16.0 → delegate_agent_cli-0.18.0}/config.example.json

@@ -93,6 +93,18 @@
     "defaultAgent": null,
     "models": {}
   },
+  "pi": {
+    "binary": "pi",
+    "defaultModel": null,
+    "defaultReasoningEffort": null,
+    "models": {}
+  },
+  "omp": {
+    "binary": "omp",
+    "defaultModel": null,
+    "defaultReasoningEffort": null,
+    "models": {}
+  },
   "kimi": {
     "binary": "kimi",
     "defaultModel": "kimi-code/k3",
@@ -104,6 +116,7 @@
   },
   "worktrees": {
     "dataHome": null,
+    "poolWarnCount": 20,
     "autoPrune": {
       "enabled": false,
       "mergedOlderThanDays": 7

{delegate_agent_cli-0.16.0 → delegate_agent_cli-0.18.0}/docs/agent-setup.md

@@ -38,6 +38,8 @@ This guide covers both human setup and non-interactive setup for agents or CI jo
    command -v grok || echo "Grok Build CLI missing"
    command -v devin || echo "Devin CLI missing"
    command -v opencode || echo "OpenCode CLI missing"
+   command -v pi || echo "Pi coding agent missing"
+   command -v omp || echo "Oh My Pi missing"
    command -v kimi || echo "Kimi Code CLI missing"
    ```
 
@@ -99,12 +101,14 @@ When running on Windows through WSL, treat Delegate as a Linux CLI:
    delegate --json dry-run devin work "Describe the planned work invocation."
    delegate --json dry-run opencode safe "Review only. Do not edit files."
    delegate --json dry-run opencode safe --reasoning-effort high "Review only. Do not edit files."
+   delegate --json dry-run pi safe --reasoning-effort high "Review only. Do not edit files."
+   delegate --json dry-run omp safe --reasoning-effort high "Review only. Do not edit files."
    delegate --json dry-run cursor safe "Review only. Do not edit files."
    delegate --json dry-run droid reviewer safe "Review only. Do not edit files."
    delegate --json dry-run kimi safe "Review only. Do not edit files."
    ```
 
-   The Codex, Claude, Grok, Devin work, OpenCode, Cursor, and Kimi dry-runs succeed with the unedited example config when no reasoning effort is requested. Devin safe mode is intentionally rejected because filesystem surveys may require generic `exec`, which cannot be allowed without weakening the read-only boundary. Explicit Codex reasoning-effort dry-runs can target the harness default model when no default model is configured. Claude and Grok reasoning effort map to native `--effort` flags; OpenCode reasoning effort maps to `--variant` without model validation. The Droid dry-run validates the alias, so it returns `unconfigured_model` until you replace the `reviewer` placeholder in `config.json` with a real model ID.
+   The Codex, Claude, Grok, Devin work, OpenCode, Pi, Oh My Pi, Cursor, and Kimi dry-runs succeed with the unedited example config when no reasoning effort is requested. Devin safe mode is intentionally rejected because filesystem surveys may require generic `exec`, which cannot be allowed without weakening the read-only boundary. Explicit Codex reasoning-effort dry-runs can target the harness default model when no default model is configured. Claude and Grok reasoning effort map to native `--effort` flags; OpenCode maps to `--variant`; Pi and Oh My Pi map to `--thinking`. The Droid dry-run validates the alias, so it returns `unconfigured_model` until you replace the `reviewer` placeholder in `config.json` with a real model ID.
 
 ### OpenCode
 
@@ -124,6 +128,20 @@ absolute path in Delegate config:
 Run `opencode auth login` before the first real launch. Delegate uses OpenCode's
 existing global authentication state and does not manage login itself.
 
+### Pi
+
+Install [Pi](https://github.com/badlogic/pi-mono) and authenticate its selected
+provider. Delegate uses Pi's existing `~/.pi/agent/auth.json`; it never reads,
+prints, or forwards that file and never emits Pi's `--api-key` flag. Configure
+an absolute `pi.binary` when `pi` is not on the non-interactive `PATH`.
+
+### Oh My Pi setup
+
+Install Oh My Pi and authenticate its selected provider. Delegate uses the
+runtime's existing profile without reading or forwarding credentials and never
+emits `--api-key` or Oh My Pi's role flags. Configure an absolute `omp.binary`
+when `omp` is not on the non-interactive `PATH`.
+
 ## Non-interactive agent setup
 
 For an orchestrating agent, script, or CI job:
@@ -166,6 +184,8 @@ For an orchestrating agent, script, or CI job:
    command -v grok >/dev/null || exit 3
    command -v devin >/dev/null || exit 3
    command -v opencode >/dev/null || exit 3
+   command -v pi >/dev/null || exit 3
+   command -v omp >/dev/null || exit 3
    command -v kimi >/dev/null || exit 3
    ```
 
@@ -192,7 +212,7 @@ For an orchestrating agent, script, or CI job:
 ## CI expectations
 
 The required test suite does not need real Cursor, Droid, Codex, Claude, Grok,
-Devin, OpenCode, or Kimi binaries. Tests use dry-run paths and fake binaries
+Devin, OpenCode, Pi, Oh My Pi, or Kimi binaries. Tests use dry-run paths and fake binaries
 where needed:
 
 ```bash