delegate-agent-cli 0.22.0__tar.gz → 0.24.0__tar.gz

{delegate_agent_cli-0.22.0 → delegate_agent_cli-0.24.0}/CHANGELOG.md

@@ -5,6 +5,30 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.24.0] - 2026-07-31
+
+### Added
+
+- Added `delegate resume` for relaunching terminal Runs with a bounded,
+  untrusted continuation built from the original prompt and prior result.
+  Resume preserves compatible launch settings, supports explicit cross-engine
+  resumes, and attaches to an existing persistent worktree with a live cleanup
+  lease rather than creating a second worktree.
+- Added private `prompt.txt` capture for new tracked Runs so their original
+  prompts can be resumed without placing prompt text in the Manifest or
+  Snapshot. Legacy records without that capture fail closed with a clear
+  `resume_prompt_unavailable` error.
+
+## [0.23.0] - 2026-07-30
+
+### Added
+
+- Added `delegate runs prune` with a 30-day default age threshold, an explicit `--older-than` override, and `--dry-run` preview output. It prunes terminal Run records and their associated Registry artifacts (per-Run directory, logs, Completion Report, retained raw-log archive) without touching genuinely running Runs. Persistent-worktree Runs are skipped unless their worktree is recorded as removed or missing — unknown or unrecorded worktree status is treated as possibly present, mirroring `worktree gc` — so live worktrees never lose their Registry records. The ambient retention pass is bypassed on the prune command path so a dry run never mutates state.
+
+### Fixed
+
+- Focused unittest invocations (`python3 -m unittest tests.<module>`) no longer fail on the src layout import: `tests/__init__.py` now puts `src` on `sys.path` before any test module import runs.
+
 ## [0.22.0] - 2026-07-26
 
 ### Changed
@@ -759,6 +783,8 @@ Usage-audit fix wave: 82 sessions and 1,241 delegate invocations from one week o
 
 - Releases before 0.1.3 predate this changelog.
 
+[0.24.0]: https://github.com/treygoff24/delegate-agent/compare/v0.23.0...v0.24.0
+[0.23.0]: https://github.com/treygoff24/delegate-agent/compare/v0.22.0...v0.23.0
 [0.22.0]: https://github.com/treygoff24/delegate-agent/compare/v0.21.0...v0.22.0
 [0.21.0]: https://github.com/treygoff24/delegate-agent/compare/v0.20.0...v0.21.0
 [0.20.0]: https://github.com/treygoff24/delegate-agent/compare/v0.19.0...v0.20.0

{delegate_agent_cli-0.22.0 → delegate_agent_cli-0.24.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: delegate-agent-cli
-Version: 0.22.0
+Version: 0.24.0
 Summary: A tiny CLI for delegating bounded agent tasks across coding-agent runtimes.
 Author: Trey Goff
 License-Expression: MIT
@@ -332,6 +332,8 @@ delegate runs --recent
 delegate ps                   # active and stale tracked runs
 delegate snapshot <alias-or-runId>
 delegate run-output <alias-or-runId>
+delegate resume <alias-or-runId> "Continue from the previous result and run the tests."
+delegate runs prune --dry-run # preview GC of terminal run records older than 30 days
 ```
 
 Aliases are always numbered (`codex-1`, `cursor-2`); a **bare harness name
@@ -340,6 +342,12 @@ newest codex run and `delegate run-output codex:glm` the newest matching
 model. Envelopes echo `requestedHandle`/`resolvedHandle`/`resolutionKind` so you
 can confirm which run you addressed.
 
+`resume` creates a new Run from a terminal source Run. It carries forward the
+source mode and compatible launch settings, places the prior prompt and bounded
+result before your new instructions, and attaches to an existing persistent
+worktree instead of creating another one. Use `--dry-run` to inspect the
+resolved launch without creating a Run.
+
 `run-output` defaults to the best available parent-facing output: a completion
 report when present, a recovered final assistant message when possible, or
 bounded stdout/stderr diagnostics. Use `--completion-report` when you want that

{delegate_agent_cli-0.22.0 → delegate_agent_cli-0.24.0}/README.md

@@ -299,6 +299,8 @@ delegate runs --recent
 delegate ps                   # active and stale tracked runs
 delegate snapshot <alias-or-runId>
 delegate run-output <alias-or-runId>
+delegate resume <alias-or-runId> "Continue from the previous result and run the tests."
+delegate runs prune --dry-run # preview GC of terminal run records older than 30 days
 ```
 
 Aliases are always numbered (`codex-1`, `cursor-2`); a **bare harness name
@@ -307,6 +309,12 @@ newest codex run and `delegate run-output codex:glm` the newest matching
 model. Envelopes echo `requestedHandle`/`resolvedHandle`/`resolutionKind` so you
 can confirm which run you addressed.
 
+`resume` creates a new Run from a terminal source Run. It carries forward the
+source mode and compatible launch settings, places the prior prompt and bounded
+result before your new instructions, and attaches to an existing persistent
+worktree instead of creating another one. Use `--dry-run` to inspect the
+resolved launch without creating a Run.
+
 `run-output` defaults to the best available parent-facing output: a completion
 report when present, a recovered final assistant message when possible, or
 bounded stdout/stderr diagnostics. Use `--completion-report` when you want that

{delegate_agent_cli-0.22.0 → delegate_agent_cli-0.24.0}/docs/cli-reference.md

@@ -931,17 +931,57 @@ Tracked runs return bounded parent-facing output and store local metadata under
 
 ```bash
 delegate runs [--active|--running|--stale|--recent] [--harness HARNESS] [--group NAME] [--limit N]
+delegate runs prune [--older-than DAYS] [--dry-run]
 delegate ps [--harness HARNESS] [--group NAME] [--limit N]
 delegate snapshot [--latest HARNESS] [--no-redact] <handle>
 delegate run-output [--latest HARNESS] <handle> [--completion-report] [--stdout] [--stderr] [--tail N] [--max-chars N] [--raw] [--no-redact]
+delegate resume [--engine ENGINE] [--model MODEL] [--reasoning-effort LEVEL] [--timeout SEC] [--dry-run] <handle> [extra instructions...]
 delegate wait <handle>... [--latest HARNESS] [--group NAME] [--timeout SEC] [--interval SEC] [--completion-report]
 delegate cancel <handle>...
 ```
 
+`delegate resume` relaunches a terminal Run as a new Run. It accepts
+`succeeded`, `failed`, `cancelled`, and stale Runs; an effectively running Run
+is refused. A successful source requires extra instructions. The continuation
+contains the original prompt, then a bounded prior-run Completion Report (or a
+Snapshot digest), then the new instructions last. Prior-run content is framed
+as untrusted data and is disclosed to the target Harness, including on a
+cross-engine resume. Resume options must appear before the handle; trailing
+tokens are continuation instructions.
+
+The new Run inherits source settings according to this table. `--engine` and
+the listed resume flags must precede the handle; `--group` and
+`--auth-profile` are global flags and therefore precede `resume`. A persistent
+worktree source is resumed by attaching to its existing worktree rather than
+creating a second one. The attachment is a live lease: `worktree remove`,
+`worktree prune`, and `worktree gc` refuse or skip the worktree while the
+attached Run may still be active. `--dry-run` resolves the continuation without
+creating a Run or writing a prompt record.
+
+| Field | Source manifest key | Override flag | Absent or legacy behavior | Cross-engine rule |
+| --- | --- | --- | --- | --- |
+| Engine | `engine`, falling back to `harness` | `--engine` | A missing or unknown source engine refuses resume. | The selected engine becomes the target; engine-scoped fields below may drop. |
+| Mode | `mode` | None; v1 does not override mode. | A missing or invalid mode refuses resume. | Retained unchanged. |
+| Model selection | `modelAlias`, then `modelRequested`, `modelResolved`, then `model` | `--model` | No usable key uses the target engine configuration default and emits a note. | Source model selection drops; pass `--model` to pin a target model. |
+| Reasoning effort | `requestedReasoningEffort`, then `resolvedReasoningEffort`, together with `reasoningEffortSource` | `--reasoning-effort` | Missing effort uses the target default and emits a note. A source value from configuration is re-resolved through target capability/configuration; only `cli` and `input-json` source intent is inherited directly. | Source effort drops with a note; an explicit override remains valid. |
+| Fast tier | `requestedFast` | `--fast` or `--no-fast` | Omitted leaves fast unspecified. | Inherited only for a same-engine Codex resume. Other targets drop it; non-Codex targets emit a drop note when a source value is present. |
+| Progress intent | `progressRequested` (`on`, `off`, or omitted) | `--progress` or `--no-progress` | Omitted uses target progress configuration and emits a note; only `on` and `off` are inherited. | Retained; progress intent is not engine-specific. |
+| Timeout | `timeoutSeconds` | `--timeout` | Omitted uses the target timeout default and emits a note. A present value must be a positive integer (an integral JSON float is accepted). | Retained. |
+| Output schema | Inline `outputSchema` text | `--output-schema PATH` or `--no-output-schema` | Omitted means no schema. Stored text is re-materialized privately only during normal launch. | Only Codex inherits inline schema text. Other engines soft-drop it with a note before output-schema validation. |
+| OpenCode agent | `agent` | None | Omitted means no agent selection. | Inherited only for a same-engine OpenCode resume; otherwise dropped with a note. |
+| Workspace cwd / execution cwd | `cwd`; persistent records also derive `executionCwd`, branch, and source Git root | None (`--cwd` selects the registry workspace and must match recorded `cwd`) | Missing `cwd` falls back to the selected registry workspace; missing persistent-worktree metadata causes attachment validation to refuse. | Retained as workspace context; an attach uses the validated existing worktree rather than copying `executionCwd` into a new worktree. |
+| Isolation / lifecycle | `isolationMode`; persistent detection also reads `isolationLifecycle`, `preservedWorkspace`, `worktreeStatus`, and `worktreeAttachment` | None; `--isolation` is rejected for resume. | Missing ordinary `isolationMode` uses target isolation configuration and emits a note. | Retained. Persistent or attached sources become an `attached` execution lifecycle. |
+| Group | `group` | Global `--group` | Omitted uses the ungrouped target default and emits a note. | Retained. |
+| Auth profile | `authProfile` | Global `--auth-profile` | Omitted uses target profile detection/default and emits a note. | Retained. |
+| Forbid commit | `commitPolicy.forbidCommit` when exactly `true` | None | Omitted or any other value leaves commit prohibition off. | Retained. |
+| Include dirty | `includeDirty` | `--include-dirty` | Source and explicit values are creation-only and are dropped for ordinary resume with a note. | Retained only as a drop decision; on a persistent/attached source, explicit `--include-dirty` is rejected because attachment does not create or sync a worktree. |
+
 `delegate runs` defaults to recent runs. `--active` preserves the legacy active view and includes both live `running` runs and `stale` runs. Use `--running` for only live tracked processes and `--stale` for runs recorded as running whose PID is missing or dead. `--active`, `--running`, `--stale`, and `--recent` are mutually exclusive. `--group NAME` filters by launch group and the runs table shows a `group` column when any visible run has one.
 `delegate ps` is the shorter first-class form of `delegate runs --active` and
 accepts the same harness, group, and limit selectors.
 
+`delegate runs prune` removes old terminal Run records from the workspace Registry so they stop accumulating forever. Only runs whose effective status is terminal (`succeeded`, `failed`, `cancelled`, or `stale` from a dead child) and whose last Registry activity is older than the threshold (default 30 days; override with `--older-than DAYS`) are eligible. Effectively running runs are always skipped, and persistent-worktree runs are skipped unless their worktree is recorded as removed or missing — pruning the record of a live worktree would orphan it from `worktree list`/`show`/`remove`. Pruning deletes the per-Run directory (Snapshot, Manifest, logs, events, Completion Report) and the retained raw-log archive; worktree paths on disk are never touched. `--dry-run` reports what would be removed without changing anything. JSON output uses schema `delegate.runs-prune.v1` with `planned`, `removed`, `skipped` (each entry carries a `reason`), and `errors` sections.
+
 Run-scoped handles (`snapshot`, `run-output`, `wait`, and `cancel`)
 resolve exact run IDs and numbered aliases first. A bare harness name such as
 `codex` resolves to that harness's latest run, and `harness:modelAlias` (for

{delegate_agent_cli-0.22.0 → delegate_agent_cli-0.24.0}/docs/delegate-workflows.md

@@ -175,6 +175,7 @@ engines = args.get("engines", ["codex", "claude", "cursor"])
 models = args.get("models", {})
 prompt = args["prompt"]
 
+
 def reviewer(engine):
     return lambda: agent(
         prompt,
@@ -184,6 +185,7 @@ def reviewer(engine):
         phase=f"Review ({engine})",
     )
 
+
 reviews = parallel([reviewer(engine) for engine in engines])
 return {"reviews": dict(zip(engines, reviews))}
 ```

{delegate_agent_cli-0.22.0 → delegate_agent_cli-0.24.0}/docs/security-model.md

@@ -200,6 +200,19 @@ Persistent worktree isolation is not a security sandbox. It does not prevent:
 - Writes to absolute paths outside the worktree.
 - Actions taken through authenticated tools, MCP servers, browser sessions, or external CLIs.
 
+`delegate resume` reads the initial manifest and `prompt.txt` outside the Registry
+lock with bounded, no-follow, single-link readers. It re-checks status and reads
+the report or snapshot history inside the lock using those same readers.
+Completion Reports are used only when the source Run is terminal under the lock;
+otherwise resume falls back to an atomic Snapshot digest. Prompt and report text are untrusted data, not
+Delegate instructions, and are disclosed to the target Harness as part of the
+continuation. `prompt.txt` is verbatim, unredacted, child-tamperable, retained
+until `delegate runs prune`, and an `--engine` override can disclose it to a
+different provider. A persistent-worktree resume attaches to the existing path
+by deriving and validating its Registry record; it does not weaken
+safe/worktree path checks or create a replacement worktree when the original
+has moved.
+
 ## Config and secret hygiene
 
 - Keep real config in `~/.delegate/config.json` or a private `DELEGATE_CONFIG` path. Repository-local `.delegate/config.json` is not loaded implicitly.

{delegate_agent_cli-0.22.0 → delegate_agent_cli-0.24.0}/docs/worktrees.md

@@ -83,6 +83,25 @@ Delegate also creates a local branch named like:
 delegate/<label>-<short-run-id>
 ```
 
+### Resume attachment
+
+To continue a terminal Run that used a persistent worktree, use the Run handle
+rather than launching a second persistent worktree:
+
+```bash
+delegate resume <alias-or-runId> "Continue the implementation and run the tests."
+```
+
+The resumed Run attaches to the existing execution path and records an
+attachment lease. It does not create a new branch, copy dirty files, or derive
+a second persistent-worktree record. The lease is released when the attached
+Run reaches a terminal state. Worktree removal, pruning, and registry repair
+refuse or skip a path with a live attached Run; inspect or wait for that Run
+before cleanup. A missing, moved, symlinked, unregistered, or branch-mismatched
+source worktree is refused rather than recreated implicitly. `--include-dirty`
+is rejected on attached resume because it only controls creation-time
+synchronization; ordinary resume drops the flag with a note.
+
 ## Preflight requirements
 
 Persistent worktree work-mode runs require:

{delegate_agent_cli-0.22.0 → delegate_agent_cli-0.24.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "delegate-agent-cli"
-version = "0.22.0"
+version = "0.24.0"
 description = "A tiny CLI for delegating bounded agent tasks across coding-agent runtimes."
 readme = "README.md"
 requires-python = ">=3.11"

{delegate_agent_cli-0.22.0 → delegate_agent_cli-0.24.0}/src/delegate_agent/__init__.py

@@ -1,5 +1,5 @@
 """Delegate Agent CLI package."""
 
-VERSION = "0.22.0"
+VERSION = "0.24.0"
 
 __all__ = ["VERSION"]

{delegate_agent_cli-0.22.0 → delegate_agent_cli-0.24.0}/src/delegate_agent/cli.py

@@ -23,6 +23,7 @@ from delegate_agent import (
     profiles,
     reasoning,
     redaction,
+    resume_command,
     run_metadata,
     run_output_commands,
     run_registry,
@@ -79,7 +80,7 @@ from delegate_agent.errors import (
     EXIT_USAGE,
     DelegateError,
 )
-from delegate_agent.git_utils import capture_git_metadata  # noqa: F401  # re-exported for tests
+from delegate_agent.git_utils import capture_git_metadata  # re-exported for tests
 from delegate_agent.isolation import (  # noqa: F401  # re-exported for tests
     IsolationContext,
     build_isolation_context,
@@ -100,6 +101,7 @@ from delegate_agent.prompt_transport import (  # noqa: F401  # CURSOR_PROMPT_RED
 )
 from delegate_agent.request_build import (  # noqa: F401  # re-exported for tests / back-compat
     CALL_TEMP_CWD_PLACEHOLDER,
+    INLINE_OUTPUT_SCHEMA_PLACEHOLDER,
     RUN_INPUT_KEYS,
     _load_input_json_object,
     build_request,
@@ -306,16 +308,28 @@ def dry_run_payload(request: Request) -> JsonObject:
     run_metadata.add_model_payload_fields(payload, request)
     reasoning.add_reasoning_payload_fields(payload, request)
     run_metadata.add_speed_payload_fields(payload, request)
+    if request.output_schema_text is not None:
+        payload["outputSchemaInline"] = True
+        payload["argv"] = [
+            "<inline output schema>" if value == INLINE_OUTPUT_SCHEMA_PLACEHOLDER else value
+            for value in payload["argv"]
+        ]
     if request.warnings:
         payload["warnings"] = list(request.warnings)
     if request.progress:
         payload["progressRequested"] = True
+    if request.timeout is not None:
+        payload["timeoutSeconds"] = request.timeout
     if request.forbid_commit:
         payload["commitPolicy"] = {"forbidCommit": True}
     if request.include_dirty:
         payload["includeDirty"] = True
     if request.group is not None:
         payload["group"] = request.group
+    if request.agent is not None:
+        payload["agent"] = request.agent
+    if request.resumed_from is not None:
+        payload["resumedFrom"] = request.resumed_from
     if request.auth_profile is not None:
         payload["authProfile"] = request.auth_profile
     if request.fallback_auth_profile is not None:
@@ -329,6 +343,8 @@ def dry_run_payload(request: Request) -> JsonObject:
         # Keep the existing human-readable `isolation` note for legacy use.
         if ctx.effective_isolation == "worktree" and ctx.isolation_lifecycle == "persistent":
             payload["isolation"] = "worktree persistent"
+        elif ctx.effective_isolation == "worktree" and ctx.isolation_lifecycle == "attached":
+            payload["isolation"] = "worktree attached (resume)"
         elif ctx.effective_isolation == "worktree":
             payload["isolation"] = "worktree temporary"
         elif ctx.effective_isolation == "none":
@@ -344,7 +360,7 @@ def dry_run_payload(request: Request) -> JsonObject:
         # Only persistent worktree isolation has a planned Delegate-managed
         # branch/path. Temporary safe-mode isolation is created ephemerally at
         # execution time and must not claim a persistent worktree plan.
-        if ctx.isolation_lifecycle == "persistent":
+        if ctx.isolation_lifecycle in ("persistent", "attached"):
             planned_cwd = ctx.planned_execution_cwd or "<planned-worktree-path>"
             planned_branch = ctx.planned_branch or "<planned-branch>"
             payload["plannedExecutionCwd"] = planned_cwd
@@ -356,7 +372,11 @@ def dry_run_payload(request: Request) -> JsonObject:
             payload["plannedBranch"] = None
 
         # Always emit isolatedWorkspace as explicit boolean (mirrors preservedWorkspace).
-        payload["isolatedWorkspace"] = ctx.isolation_lifecycle in ("temporary", "persistent")
+        payload["isolatedWorkspace"] = ctx.isolation_lifecycle in (
+            "temporary",
+            "persistent",
+            "attached",
+        )
     else:
         # Fallback when no isolation context is provided (e.g. direct build_request calls in tests).
         # Use embedded-default logic: safe local harnesses -> worktree temporary, others -> none.
@@ -498,10 +518,11 @@ def make_run_context(
     )
     execution_cwd = request.workspace
     # isolated_workspace must reflect the EFFECTIVE behavior, not the
-    # mere presence of an isolation_context object.  Only "temporary" or
-    # "persistent" lifecycle means a physically separate execution workspace.
+    # mere presence of an isolation_context object.  Only "temporary",
+    # "persistent", or "attached" lifecycle means a physically separate
+    # execution workspace.
     isolated_workspace = (
-        request.isolation_context.isolation_lifecycle in ("temporary", "persistent")
+        request.isolation_context.isolation_lifecycle in ("temporary", "persistent", "attached")
         if request.isolation_context is not None
         else False
     )
@@ -575,6 +596,12 @@ def make_run_context(
         call_read_only=request.call_read_only or request.pure,
         pure=request.pure,
         prompt_instruction_mode=request.prompt_instruction_mode,
+        source_prompt=request.source_prompt,
+        progress_requested=request.progress_requested,
+        timeout_seconds=request.timeout,
+        output_schema_text=request.output_schema_record_text,
+        agent=request.agent,
+        resumed_from=request.resumed_from,
     )
 
 
@@ -626,6 +653,173 @@ def _preserve_call_artifacts(
         )
 
 
+def _execute_attached_worktree(
+    request: Request,
+    json_mode: bool,
+    *,
+    config: JsonObject,
+    config_source: str | None,
+    completion_report_mode: str,
+    source_workspace: ResolvedWorkspace,
+    stdout: TextIO,
+    stderr: TextIO,
+) -> tuple[int, JsonObject | None]:
+    """Launch a resumed child inside the source run's existing worktree.
+
+    Lease-by-derivation: the attachment is recorded in this run's manifest
+    (``worktreeAttachment``) and removal paths refuse while the run is
+    effectively running. No worktree record is derived for attached runs.
+    """
+    from dataclasses import replace as dc_replace
+
+    iso = request.isolation_context
+    assert iso is not None and iso.isolation_lifecycle == "attached"
+    worktree_path = iso.planned_execution_cwd
+    if not worktree_path:
+        raise DelegateError("worktree_missing", "Attached execution has no worktree path.")
+    wt = Path(worktree_path)
+    if wt.is_symlink() or not wt.is_dir():
+        raise DelegateError(
+            "worktree_missing",
+            f"The source run's worktree path is no longer a directory: {worktree_path}",
+        )
+
+    head_probe = capture_git_metadata(worktree_path)
+    start_head_oid = head_probe[2]
+    if not start_head_oid:
+        raise DelegateError(
+            "worktree_missing",
+            f"Could not resolve HEAD in the attached worktree: {worktree_path}",
+        )
+
+    execution_request = worktree_execution._request_for_execution_workspace(request, worktree_path)
+    # Re-check the actual argv payload now that the worktree note (and any
+    # forbid-commit note) has been prepended.
+    resume_command.enforce_resume_prompt_size(
+        request.engine,
+        execution_request.argv[-1],
+    )
+    ensure_binary(
+        execution_request.argv,
+        engine=request.engine,
+        config_source=config_source,
+        env_overrides=request.env_overrides,
+    )
+    if request.engine == "codex":
+        profiles.preflight_codex_request(request, config.get("codex", {}))
+
+    registry_root = run_registry.ensure_registry(
+        Path(source_workspace.path),
+        workspace_kind=source_workspace.kind,
+    )
+    maybe_run_retention_pass(registry_root, config)
+    run_id, alias = run_registry.register_run(
+        registry_root,
+        harness=request.engine,
+        metadata={
+            "mode": request.mode,
+            "model": request.model,
+            "modelAlias": request.model_alias,
+            "modelResolved": request.model,
+            "group": request.group,
+            "workflowAgentKey": request.workflow_agent_key,
+            "cwd": source_workspace.path,
+            "worktreeAttachment": {
+                **(iso.attachment or {}),
+                "startHeadOid": start_head_oid,
+            },
+        },
+    )
+    ctx_runner = make_run_context(
+        registry_root,
+        request,
+        run_id=run_id,
+        alias=alias,
+        source_workspace=source_workspace,
+    )
+    attachment = {
+        **(iso.attachment or {}),
+        "startHeadOid": start_head_oid,
+    }
+    ctx_runner = dc_replace(
+        ctx_runner,
+        execution_cwd=worktree_path,
+        isolated_workspace=True,
+        branch=iso.planned_branch,
+        source_git_root=iso.source_git_root,
+        creation_context={"sourceHeadOid": start_head_oid},
+        worktree_attachment=attachment,
+    )
+    try:
+        resume_command.revalidate_attached_target(
+            registry_root, attachment, expected_branch=iso.planned_branch
+        )
+    except DelegateError as exc:
+        run_path = run_registry.run_directory(registry_root, run_id)
+        if ctx_runner.source_prompt is not None:
+            run_registry.write_private_text(
+                run_path / run_registry.PROMPT_TXT_FILE, ctx_runner.source_prompt
+            )
+        delegate_runner.write_manifest(
+            run_path,
+            delegate_runner.build_manifest(ctx_runner, execution_request.display_argv),
+        )
+        delegate_runner.write_state(
+            run_path,
+            delegate_runner.build_state(
+                ctx_runner,
+                status=run_registry.STATUS_FAILED,
+                exit_code=1,
+                extra={
+                    "error": "worktree_missing",
+                    "message": exc.message,
+                    "failureReason": "worktree_missing",
+                },
+            ),
+        )
+        raise DelegateError("worktree_missing", exc.message) from exc
+    execution_root = str(Path(worktree_path).resolve(strict=False))
+    source_root = str(Path(source_workspace.path).resolve(strict=False))
+    child_env = {
+        **(request.env_overrides or {}),
+        "DELEGATE_SOURCE_ROOT": source_root,
+        "DELEGATE_EXECUTION_ROOT": execution_root,
+        "WORKSPACE_ROOT": execution_root,
+    }
+    ctx_runner = dc_replace(
+        ctx_runner,
+        env_overrides=child_env,
+        fallback_env_overrides=profiles.codex_fallback_child_env_overrides(
+            request.profile_resolution,
+            child_env,
+        ),
+    )
+    try:
+        return delegate_runner.execute_tracked(
+            execution_request.argv,
+            worktree_path,
+            ctx_runner,
+            json_mode=json_mode,
+            stdout=stdout,
+            stderr=stderr,
+            completion_report_mode=completion_report_mode,
+            stdin_text=execution_request.stdin_text,
+            prompt_file_text=execution_request.prompt_file_text,
+            prompt_file_placeholder=PROMPT_FILE_ARG_PLACEHOLDER,
+            agent_config_text=execution_request.agent_config_text,
+            agent_config_placeholder=DEVIN_AGENT_CONFIG_ARG_PLACEHOLDER,
+            output_schema_text=request.output_schema_text,
+            output_schema_path=request.output_schema,
+            manifest_argv=execution_request.display_argv,
+            progress=request.progress,
+            progress_initial_delay_sec=request.progress_initial_delay_sec,
+            progress_interval_sec=request.progress_interval_sec,
+            timeout=request.timeout,
+        )
+    except delegate_runner.RunnerLaunchError as exc:
+        raise DelegateError(exc.error, exc.message, exc.exit_code) from exc
+
+
 def execute_request(
     request: Request,
     json_mode: bool,
@@ -849,6 +1043,21 @@ def execute_request(
         profiles.preflight_codex_request(request, config.get("codex", {}))
     ctx = request.isolation_context
 
+    # Attached resume runs execute inside an existing persistent worktree:
+    # never plan, create, or sync a worktree — short-circuit before the
+    # persistent branch.
+    if ctx is not None and ctx.isolation_lifecycle == "attached":
+        return _execute_attached_worktree(
+            request,
+            json_mode,
+            config=config,
+            config_source=config_source,
+            completion_report_mode=completion_report_mode,
+            source_workspace=source_workspace,
+            stdout=stdout,
+            stderr=stderr,
+        )
+
     # Persistent worktree runs (work + worktree) hand off to worktree_execution.
     if ctx is not None and ctx.isolation_lifecycle == "persistent":
         try:
@@ -875,6 +1084,10 @@ def execute_request(
 
     with safe_isolated_request(request) as isolated_request:
         _set_child_root_env(isolated_request, source_workspace)
+        if isolated_request.resumed_from is not None and isolated_request.argv:
+            resume_command.enforce_resume_prompt_size(
+                isolated_request.engine, isolated_request.argv[-1]
+            )
         ensure_binary(
             isolated_request.argv,
             engine=isolated_request.engine,
@@ -1180,7 +1393,12 @@ def main(
             "workflow",
         }:
             existing_registry = run_registry.registry_root_if_exists(Path(workspace.path))
-            if existing_registry is not None:
+            pruning_runs = (
+                parsed.subcommand == "runs"
+                and parsed.runs is not None
+                and parsed.runs.action == "prune"
+            )
+            if existing_registry is not None and not pruning_runs:
                 maybe_run_retention_pass(existing_registry, config)
         if parsed.subcommand == "snapshot":
             return emit_snapshot(parsed, workspace, stdout)
@@ -1200,7 +1418,16 @@ def main(
         if parsed.subcommand == "profiles":
             return emit_profiles_command(parsed, config, source, stdout)
 
+        resume_plan: resume_command.ResumePlan | None = None
+        if parsed.subcommand == "resume":
+            resume_plan = resume_command.build_resume_plan(parsed, workspace, config, stderr=stderr)
+            # The plan is a fully ordinary launch; from here on the resume flows
+            # through the normal request build and execution path.
+            parsed = resume_plan.parsed
+            global_options = parsed.global_options
         request = request_from_parsed(parsed, config, stdin)
+        if resume_plan is not None:
+            request = resume_command.apply_resume_to_request(request, resume_plan)
         if request.dry_run:
             payload = dry_run_payload(request)
             if global_options.json_mode: