delegate-agent-cli 0.23.0__tar.gz → 0.25.0__tar.gz

{delegate_agent_cli-0.23.0 → delegate_agent_cli-0.25.0}/CHANGELOG.md

@@ -5,6 +5,69 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.25.0] - 2026-08-01
+
+### Added
+
+- Named personas: `--persona` / `--no-persona` / `--allow-repo-persona` on
+  every engine's safe/work launch (and dry-run), input-json `persona` /
+  `allowRepoPersona` keys, and workflow `agent(persona=...)` with the resolved
+  persona digest pinned into the structural cache key so an edited persona is
+  a cache miss by design.
+- `delegate personas [--json]` listing (schema `delegate.personas.v1`) with
+  workspace-shadowing metadata and per-file invalid rows; read-only allowlisted
+  in both the profile guard and the shell shim.
+- Persona transports: claude work uses `--append-system-prompt-file` with a
+  private 0600 file when discovery positively proves current support (probe
+  recognizes both the long and the collapsed `--append-system-prompt[-file]`
+  help spellings); opencode merges a synthetic `delegate-persona` agent into
+  the effective config without clobbering profile keys; every other engine
+  prepends. Safe mode always prepends, with the persona placed before the
+  safe policy so the safety text keeps recency.
+- `persona.txt` as a private durable run artifact with manifest, snapshot,
+  and runs-summary projection; resume replays recorded persona bytes through
+  the target engine's transport, `--persona` re-resolves, `--no-persona`
+  drops.
+
+### Changed
+
+- The central framer is now the sole prompt composer: cursor/droid/kimi argv
+  builders no longer self-prefix safe policy text, user and persona bytes are
+  joined verbatim, and persistent/attached worktree notes are tracked
+  structurally on the request rather than inferred from prompt content.
+- Slash-passthrough prompts on persistent or attached worktree runs carry the
+  Delegate-owned worktree and forbid-commit notes ahead of the slash command,
+  matching v0.24.0 behavior; all other slash payloads remain byte-verbatim.
+
+### Security
+
+- Persona resolution walks `.delegate/personas` component-by-component over
+  `O_NOFOLLOW` descriptors anchored at the source workspace or home, refusing
+  symlinked parents and leaves; strict UTF-8, C0 refusal, and a 64 KiB cap.
+- Resume persona replay reads only the fixed `persona.txt` artifact with a
+  required, verified sha256 digest; manifest data cannot redirect the read.
+- The claude native persona gate fails closed: probe errors, timeouts, and
+  unrecognized banners fall back to prepend so an older binary never receives
+  an unknown flag. Dry-run never probes.
+- Workflow persona digests travel across the child seam and both sides fail
+  closed on mismatch without caching.
+
+## [0.24.0] - 2026-07-31
+
+### Added
+
+- Added `delegate resume` for relaunching terminal Runs with a bounded,
+  untrusted continuation built from the original prompt and prior result.
+  Resume preserves compatible launch settings, supports explicit cross-engine
+  resumes, and attaches to an existing persistent worktree with a live cleanup
+  lease rather than creating a second worktree.
+- Added private `prompt.txt` capture for new tracked Runs so their original
+  prompts can be resumed without placing prompt text in the Manifest or
+  Snapshot. Legacy records without that capture fail closed with a clear
+  `resume_prompt_unavailable` error.
+
 ## [0.23.0] - 2026-07-30
 
 ### Added
@@ -769,6 +832,8 @@ Usage-audit fix wave: 82 sessions and 1,241 delegate invocations from one week o
 
 - Releases before 0.1.3 predate this changelog.
 
+[0.25.0]: https://github.com/treygoff24/delegate-agent/compare/v0.24.0...v0.25.0
+[0.24.0]: https://github.com/treygoff24/delegate-agent/compare/v0.23.0...v0.24.0
 [0.23.0]: https://github.com/treygoff24/delegate-agent/compare/v0.22.0...v0.23.0
 [0.22.0]: https://github.com/treygoff24/delegate-agent/compare/v0.21.0...v0.22.0
 [0.21.0]: https://github.com/treygoff24/delegate-agent/compare/v0.20.0...v0.21.0

{delegate_agent_cli-0.23.0 → delegate_agent_cli-0.25.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: delegate-agent-cli
-Version: 0.23.0
+Version: 0.25.0
 Summary: A tiny CLI for delegating bounded agent tasks across coding-agent runtimes.
 Author: Trey Goff
 License-Expression: MIT
@@ -332,6 +332,7 @@ delegate runs --recent
 delegate ps                   # active and stale tracked runs
 delegate snapshot <alias-or-runId>
 delegate run-output <alias-or-runId>
+delegate resume <alias-or-runId> "Continue from the previous result and run the tests."
 delegate runs prune --dry-run # preview GC of terminal run records older than 30 days
 ```
 
@@ -341,6 +342,12 @@ newest codex run and `delegate run-output codex:glm` the newest matching
 model. Envelopes echo `requestedHandle`/`resolvedHandle`/`resolutionKind` so you
 can confirm which run you addressed.
 
+`resume` creates a new Run from a terminal source Run. It carries forward the
+source mode and compatible launch settings, places the prior prompt and bounded
+result before your new instructions, and attaches to an existing persistent
+worktree instead of creating another one. Use `--dry-run` to inspect the
+resolved launch without creating a Run.
+
 `run-output` defaults to the best available parent-facing output: a completion
 report when present, a recovered final assistant message when possible, or
 bounded stdout/stderr diagnostics. Use `--completion-report` when you want that

{delegate_agent_cli-0.23.0 → delegate_agent_cli-0.25.0}/README.md

@@ -299,6 +299,7 @@ delegate runs --recent
 delegate ps                   # active and stale tracked runs
 delegate snapshot <alias-or-runId>
 delegate run-output <alias-or-runId>
+delegate resume <alias-or-runId> "Continue from the previous result and run the tests."
 delegate runs prune --dry-run # preview GC of terminal run records older than 30 days
 ```
 
@@ -308,6 +309,12 @@ newest codex run and `delegate run-output codex:glm` the newest matching
 model. Envelopes echo `requestedHandle`/`resolvedHandle`/`resolutionKind` so you
 can confirm which run you addressed.
 
+`resume` creates a new Run from a terminal source Run. It carries forward the
+source mode and compatible launch settings, places the prior prompt and bounded
+result before your new instructions, and attaches to an existing persistent
+worktree instead of creating another one. Use `--dry-run` to inspect the
+resolved launch without creating a Run.
+
 `run-output` defaults to the best available parent-facing output: a completion
 report when present, a recovered final assistant message when possible, or
 bounded stdout/stderr diagnostics. Use `--completion-report` when you want that

{delegate_agent_cli-0.23.0 → delegate_agent_cli-0.25.0}/bin/delegate-profile-shim

@@ -134,7 +134,7 @@ _delegate_is_readonly_request() {
     esac
   done
   case "$_cmd" in
-    profiles|runs|ps|run-output|describe|snapshot|agent-help|help|--help|-h|--version)
+    profiles|runs|ps|run-output|describe|snapshot|agent-help|personas|help|--help|-h|--version)
       return 0
       ;;
     models)

{delegate_agent_cli-0.23.0 → delegate_agent_cli-0.25.0}/config.example.json

@@ -8,6 +8,9 @@
       "rawLogDays": 7
     }
   },
+  "personas": {
+    "forceTransport": null
+  },
   "cursor": {
     "argvPrefix": [
       "agent"

{delegate_agent_cli-0.23.0 → delegate_agent_cli-0.25.0}/docs/cli-reference.md

@@ -15,6 +15,46 @@ Use `delegate --help` for the exact command list from the installed version. Glo
 --group NAME                  Tag a launch/run-input request with a lightweight group ([A-Za-z0-9._-]{1,64}).
 ```
 
+## Personas
+
+Named personas are UTF-8 Markdown files resolved from the source workspace:
+`.delegate/personas/<name>.md` shadows `~/.delegate/personas/<name>.md`. Names
+must match `[A-Za-z0-9][A-Za-z0-9._-]{0,63}`; files are regular, non-symlink
+files no larger than 64 KiB and are rejected on invalid UTF-8 or disallowed C0
+controls. The workspace-local directory is not VCS-shared by default; teams
+that intentionally version a persona must force-add that individual file.
+
+```bash
+delegate personas
+delegate --json personas
+delegate claude work --persona editor "Review chapter 3"
+delegate codex safe --persona editor --allow-repo-persona "Review the diff"
+delegate resume --persona editor <handle> "Continue with the requested fixes"
+delegate resume --no-persona <handle> "Continue without the recorded persona"
+```
+
+`--persona NAME`, `--no-persona`, and `--allow-repo-persona` are shared launch
+options. A workspace-local persona is refused in safe mode unless explicitly
+allowed. Resolution logs `persona: NAME (workspace|global)` to stderr. Personas
+are not accepted for call, read-only call, `--pass-through`, or slash-passthrough
+prompts. Input JSON uses `persona` (string or null) and `allowRepoPersona`
+(boolean).
+
+`delegate --json personas` returns schema `delegate.personas.v1` with sorted rows
+containing `name`, `source`, `sizeBytes`, and an escaped bounded `preview`.
+Invalid files remain visible with an `invalid` reason; a workspace row that
+shadows a global row also includes `shadowsGlobal: true`.
+
+Work-mode transport is prepend for most engines, Claude native-file only when
+the discovery cache proves `--append-system-prompt-file` (otherwise prepend
+with a warning), and OpenCode agent-config merge. OpenCode preserves existing
+root keys, agent keys, and prompts, appending the persona after an existing
+agent prompt. Safe mode always prepends. Claude native-file keeps the persona
+body out of argv, dry-run JSON, and the manifest; prepend engines using argv
+transport (Cursor, Kimi, and Oh My Pi) expose it in the live process argv.
+Tracked runs retain it only in the private
+`persona.txt` artifact.
+
 ## Commands
 
 ### Direct runtime commands
@@ -420,7 +460,7 @@ delegate [--json] workflow save <script.py> --name NAME
 - `run` launches a detached supervisor; `--dry-run` renders planned stubs
   without launching child agents or consuming real budget. Each entry in
   `runTree.calls` includes the resolved `model`, `effort`, `fast`, `isolation`,
-  and UTF-8 `promptBytes`; Cursor/Kimi prompts over 102400 bytes add a warning
+  and UTF-8 `promptBytes`; Cursor/Kimi/OMP prompts over 102400 bytes add a warning
   before their argv transport limit can fail a real run.
 - `--resume` replays the journal, adopts matching child runs by workflow agent
   key, and continues from missing work.
@@ -935,10 +975,47 @@ delegate runs prune [--older-than DAYS] [--dry-run]
 delegate ps [--harness HARNESS] [--group NAME] [--limit N]
 delegate snapshot [--latest HARNESS] [--no-redact] <handle>
 delegate run-output [--latest HARNESS] <handle> [--completion-report] [--stdout] [--stderr] [--tail N] [--max-chars N] [--raw] [--no-redact]
+delegate resume [--engine ENGINE] [--model MODEL] [--reasoning-effort LEVEL] [--timeout SEC] [--dry-run] <handle> [extra instructions...]
 delegate wait <handle>... [--latest HARNESS] [--group NAME] [--timeout SEC] [--interval SEC] [--completion-report]
 delegate cancel <handle>...
 ```
 
+`delegate resume` relaunches a terminal Run as a new Run. It accepts
+`succeeded`, `failed`, `cancelled`, and stale Runs; an effectively running Run
+is refused. A successful source requires extra instructions. The continuation
+contains the original prompt, then a bounded prior-run Completion Report (or a
+Snapshot digest), then the new instructions last. Prior-run content is framed
+as untrusted data and is disclosed to the target Harness, including on a
+cross-engine resume. Resume options must appear before the handle; trailing
+tokens are continuation instructions.
+
+The new Run inherits source settings according to this table. `--engine` and
+the listed resume flags must precede the handle; `--group` and
+`--auth-profile` are global flags and therefore precede `resume`. A persistent
+worktree source is resumed by attaching to its existing worktree rather than
+creating a second one. The attachment is a live lease: `worktree remove`,
+`worktree prune`, and `worktree gc` refuse or skip the worktree while the
+attached Run may still be active. `--dry-run` resolves the continuation without
+creating a Run or writing a prompt record.
+
+| Field | Source manifest key | Override flag | Absent or legacy behavior | Cross-engine rule |
+| --- | --- | --- | --- | --- |
+| Engine | `engine`, falling back to `harness` | `--engine` | A missing or unknown source engine refuses resume. | The selected engine becomes the target; engine-scoped fields below may drop. |
+| Mode | `mode` | None; v1 does not override mode. | A missing or invalid mode refuses resume. | Retained unchanged. |
+| Model selection | `modelAlias`, then `modelRequested`, `modelResolved`, then `model` | `--model` | No usable key uses the target engine configuration default and emits a note. | Source model selection drops; pass `--model` to pin a target model. |
+| Reasoning effort | `requestedReasoningEffort`, then `resolvedReasoningEffort`, together with `reasoningEffortSource` | `--reasoning-effort` | Missing effort uses the target default and emits a note. A source value from configuration is re-resolved through target capability/configuration; only `cli` and `input-json` source intent is inherited directly. | Source effort drops with a note; an explicit override remains valid. |
+| Fast tier | `requestedFast` | `--fast` or `--no-fast` | Omitted leaves fast unspecified. | Inherited only for a same-engine Codex resume. Other targets drop it; non-Codex targets emit a drop note when a source value is present. |
+| Progress intent | `progressRequested` (`on`, `off`, or omitted) | `--progress` or `--no-progress` | Omitted uses target progress configuration and emits a note; only `on` and `off` are inherited. | Retained; progress intent is not engine-specific. |
+| Timeout | `timeoutSeconds` | `--timeout` | Omitted uses the target timeout default and emits a note. A present value must be a positive integer (an integral JSON float is accepted). | Retained. |
+| Output schema | Inline `outputSchema` text | `--output-schema PATH` or `--no-output-schema` | Omitted means no schema. Stored text is re-materialized privately only during normal launch. | Only Codex inherits inline schema text. Other engines soft-drop it with a note before output-schema validation. |
+| OpenCode agent | `agent` | None | Omitted means no agent selection. | Inherited only for a same-engine OpenCode resume; otherwise dropped with a note. |
+| Workspace cwd / execution cwd | `cwd`; persistent records also derive `executionCwd`, branch, and source Git root | None (`--cwd` selects the registry workspace and must match recorded `cwd`) | Missing `cwd` falls back to the selected registry workspace; missing persistent-worktree metadata causes attachment validation to refuse. | Retained as workspace context; an attach uses the validated existing worktree rather than copying `executionCwd` into a new worktree. |
+| Isolation / lifecycle | `isolationMode`; persistent detection also reads `isolationLifecycle`, `preservedWorkspace`, `worktreeStatus`, and `worktreeAttachment` | None; `--isolation` is rejected for resume. | Missing ordinary `isolationMode` uses target isolation configuration and emits a note. | Retained. Persistent or attached sources become an `attached` execution lifecycle. |
+| Group | `group` | Global `--group` | Omitted uses the ungrouped target default and emits a note. | Retained. |
+| Auth profile | `authProfile` | Global `--auth-profile` | Omitted uses target profile detection/default and emits a note. | Retained. |
+| Forbid commit | `commitPolicy.forbidCommit` when exactly `true` | None | Omitted or any other value leaves commit prohibition off. | Retained. |
+| Include dirty | `includeDirty` | `--include-dirty` | Source and explicit values are creation-only and are dropped for ordinary resume with a note. | Retained only as a drop decision; on a persistent/attached source, explicit `--include-dirty` is rejected because attachment does not create or sync a worktree. |
+
 `delegate runs` defaults to recent runs. `--active` preserves the legacy active view and includes both live `running` runs and `stale` runs. Use `--running` for only live tracked processes and `--stale` for runs recorded as running whose PID is missing or dead. `--active`, `--running`, `--stale`, and `--recent` are mutually exclusive. `--group NAME` filters by launch group and the runs table shows a `group` column when any visible run has one.
 `delegate ps` is the shorter first-class form of `delegate runs --active` and
 accepts the same harness, group, and limit selectors.

{delegate_agent_cli-0.23.0 → delegate_agent_cli-0.25.0}/docs/configuration.md

@@ -201,6 +201,30 @@ reasoning defaults.
 
 ## Sections
 
+### `personas`
+
+Persona files are workspace-local by design, not VCS-shared configuration:
+`.delegate/personas/*.md` shadows the same name under
+`~/.delegate/personas/`. The `delegate personas` command lists both scopes
+without exposing persona bodies in JSON previews. Because `.delegate` is
+normally excluded, teams that intentionally version a persona must force-add
+the individual file; the resolution scope remains workspace-local.
+
+```json
+{
+  "personas": {
+    "forceTransport": null
+  }
+}
+```
+
+`forceTransport` is optional and accepts `null`, `prepend`, `native-file`, or
+`agent-config`. It is an explicit transport pin, not a capability probe;
+`native-file` is appropriate only when the configured Claude binary supports
+`--append-system-prompt-file`, and `agent-config` is meaningful for OpenCode.
+Safe mode never uses native persona channels. A workspace-local persona is
+refused in safe mode unless the launch includes `--allow-repo-persona`.
+
 ### `tracking`
 
 Controls local run recording.

{delegate_agent_cli-0.23.0 → delegate_agent_cli-0.25.0}/docs/delegate-workflows.md

@@ -64,7 +64,7 @@ workflow result in `result.json`. Injected globals are `agent`, `pipeline`,
 
 ## Core DSL
 
-- `agent(prompt, engine=None, mode=None, model=None, effort=None, schema=None, label=None, phase=None, isolation=None, passthrough=False, timeout=None, retries=None, fast=None)` launches a real Delegate child run and returns parent-facing output, a validated schema object, or `None`. `fast=True` requests Codex Fast, `fast=False` requests Standard, and `None` inherits; non-Codex fallback candidates ignore this Codex-only preference. `fast` is appended to preserve positional compatibility with existing workflow scripts.
+- `agent(prompt, engine=None, mode=None, model=None, effort=None, schema=None, label=None, phase=None, isolation=None, passthrough=False, timeout=None, retries=None, fast=None, persona=None, allow_repo_persona=False)` launches a real Delegate child run and returns parent-facing output, a validated schema object, or `None`. `fast=True` requests Codex Fast, `fast=False` requests Standard, and `None` inherits; non-Codex fallback candidates ignore this Codex-only preference. `persona` resolves one named persona from the source workspace; `allow_repo_persona=True` opts into workspace-local personas in safe mode.
 - `pipeline(items, stage1, ...)` runs per-item stage chains with no inter-stage barrier. A throwing stage drops that item to `None` and skips later stages for that item.
 - `parallel([lambda: ...])` is a barrier and preserves order. Ordinary item failures become `None` slots; gate checkpoints propagate to the supervisor.
 - `phase(title)` emits a progress event.
@@ -76,6 +76,17 @@ Workflow `engine` values and `workflows.engineCaps` keys accept `cursor`,
 `droid`, `codex`, `claude`, `grok`, `devin`, `opencode`, `pi`, `omp`, and
 `kimi`.
 
+### Persona digest pinning
+
+When `agent(persona="editor")` first resolves `editor.md`, the workflow
+structural key and `agent_started` journal event include the resolved bytes'
+SHA-256 digest. Replay therefore returns the result only for the same persona
+version: editing the file creates a cache miss instead of mixing two versions
+under the same name. Dry-runs expose persona name/source/digest/byte count but
+never write the persona body. Child input JSON carries `persona` and
+`allowRepoPersona`; the normal run manifest and inspection projections expose
+non-sensitive persona metadata only.
+
 ## Gates and resume
 
 A workflow gate checkpoints the whole workflow tree, not just the nested child
@@ -200,9 +211,10 @@ python3 bin/delegate.py --json workflow run review.py \
 ```
 
 The preview's `runTree.calls` records each call's resolved `model`, `effort`,
-`fast`, `isolation`, and UTF-8 `promptBytes`. Cursor and Kimi calls whose prompts
-exceed 102400 bytes also carry a warning because those harnesses transport the
-prompt in argv.
+`fast`, `isolation`, and UTF-8 `promptBytes` (the raw user prompt plus resolved
+persona text). Cursor, Kimi, and OMP calls whose user-plus-resolved-persona input
+exceeds 102400 bytes carry a warning; the final materialized prompt is checked
+again before exec.
 
 ## CLI
 

{delegate_agent_cli-0.23.0 → delegate_agent_cli-0.25.0}/docs/security-model.md

@@ -13,6 +13,31 @@ Delegate controls:
 - Prompt framing that tells sub-agents to review available skills and, in safe mode, avoid edits.
 - Local run metadata under `.delegate/` for tracked runs.
 
+### Persona boundary
+
+Personas are untrusted prompt text, not policy. Delegate validates the name,
+path containment, file type, UTF-8, byte limit, and C0 controls, but does not
+trust persona instructions. Safe-mode framing deliberately places the safe
+advisory after the persona (`skill -> persona -> safe`) so a persona cannot
+replace the safety text by recency. Native persona channels are work-only;
+safe mode always prepends.
+
+Workspace-local personas live under `.delegate/personas/`, which is local state
+and is not VCS-shared. Safe mode refuses them by default; use
+`--allow-repo-persona` only when the source workspace is trusted. Global
+personas are resolved from `~/.delegate/personas/` when no workspace file
+shadows the name. Call, read-only call, pass-through, and slash-passthrough
+surfaces refuse personas rather than silently changing their prompt contract.
+
+Claude native-file transport is discovery-gated and writes a private 0600 file;
+an absent, stale, or unproven capability falls back to prepend. OpenCode merges
+into the effective config without destroying existing root keys, agent fields,
+or prompt text; malformed config falls back to prepend with a warning. Claude
+native-file keeps persona bodies out of argv, dry-run output, and manifests;
+prepend engines using argv transport expose them in the live process argv.
+Tracked runs retain
+the resolved bytes only in private `persona.txt`, which is removed with the run.
+
 Delegate does not control:
 
 - The child runtime's implementation.
@@ -200,6 +225,19 @@ Persistent worktree isolation is not a security sandbox. It does not prevent:
 - Writes to absolute paths outside the worktree.
 - Actions taken through authenticated tools, MCP servers, browser sessions, or external CLIs.
 
+`delegate resume` reads the initial manifest and `prompt.txt` outside the Registry
+lock with bounded, no-follow, single-link readers. It re-checks status and reads
+the report or snapshot history inside the lock using those same readers.
+Completion Reports are used only when the source Run is terminal under the lock;
+otherwise resume falls back to an atomic Snapshot digest. Prompt and report text are untrusted data, not
+Delegate instructions, and are disclosed to the target Harness as part of the
+continuation. `prompt.txt` is verbatim, unredacted, child-tamperable, retained
+until `delegate runs prune`, and an `--engine` override can disclose it to a
+different provider. A persistent-worktree resume attaches to the existing path
+by deriving and validating its Registry record; it does not weaken
+safe/worktree path checks or create a replacement worktree when the original
+has moved.
+
 ## Config and secret hygiene
 
 - Keep real config in `~/.delegate/config.json` or a private `DELEGATE_CONFIG` path. Repository-local `.delegate/config.json` is not loaded implicitly.

{delegate_agent_cli-0.23.0 → delegate_agent_cli-0.25.0}/docs/worktrees.md

@@ -83,6 +83,25 @@ Delegate also creates a local branch named like:
 delegate/<label>-<short-run-id>
 ```
 
+### Resume attachment
+
+To continue a terminal Run that used a persistent worktree, use the Run handle
+rather than launching a second persistent worktree:
+
+```bash
+delegate resume <alias-or-runId> "Continue the implementation and run the tests."
+```
+
+The resumed Run attaches to the existing execution path and records an
+attachment lease. It does not create a new branch, copy dirty files, or derive
+a second persistent-worktree record. The lease is released when the attached
+Run reaches a terminal state. Worktree removal, pruning, and registry repair
+refuse or skip a path with a live attached Run; inspect or wait for that Run
+before cleanup. A missing, moved, symlinked, unregistered, or branch-mismatched
+source worktree is refused rather than recreated implicitly. `--include-dirty`
+is rejected on attached resume because it only controls creation-time
+synchronization; ordinary resume drops the flag with a note.
+
 ## Preflight requirements
 
 Persistent worktree work-mode runs require:

{delegate_agent_cli-0.23.0 → delegate_agent_cli-0.25.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "delegate-agent-cli"
-version = "0.23.0"
+version = "0.25.0"
 description = "A tiny CLI for delegating bounded agent tasks across coding-agent runtimes."
 readme = "README.md"
 requires-python = ">=3.11"

{delegate_agent_cli-0.23.0 → delegate_agent_cli-0.25.0}/src/delegate_agent/__init__.py

@@ -1,5 +1,5 @@
 """Delegate Agent CLI package."""
 
-VERSION = "0.23.0"
+VERSION = "0.25.0"
 
 __all__ = ["VERSION"]

{delegate_agent_cli-0.23.0 → delegate_agent_cli-0.25.0}/src/delegate_agent/argv_builders.py

@@ -20,6 +20,7 @@ from delegate_agent.prompt_transport import (
     CURSOR_PROMPT_REDACTION,
     DEVIN_AGENT_CONFIG_ARG_PLACEHOLDER,
     DROID_PROMPT_FILE_ARG_PLACEHOLDER,
+    PERSONA_FILE_ARG_PLACEHOLDER,
     PROMPT_FILE_ARG_PLACEHOLDER,
     PROMPT_TRANSPORT_ARGV,
     PROMPT_TRANSPORT_FILE,
@@ -176,8 +177,6 @@ def build_cursor_argv(
     argv = [*prefix, "--workspace", workspace, "-p", "--trust"]
     if mode == MODE_WORK:
         argv.extend(["--approve-mcps", "--force"])
-    elif mode == MODE_SAFE:
-        prompt = prefix_cursor_safe_prompt(prompt)
     elif mode == MODE_CALL:
         # Call defaults to work-level capability ("work minus a repo"); --read-only
         # drops the write flags for the stateless judge/completion contract.
@@ -209,8 +208,6 @@ def build_droid_argv(
     argv = [binary, "exec", "--cwd", workspace]
     if mode == MODE_WORK:
         argv.append("--skip-permissions-unsafe")
-    elif mode == MODE_SAFE:
-        prompt = prefix_droid_safe_prompt(prompt)
     elif mode == MODE_CALL:
         if not call_read_only:
             argv.append("--skip-permissions-unsafe")
@@ -246,9 +243,7 @@ def build_kimi_argv(
 ) -> list[str]:
     _reject_pure("kimi", mode, pure)
     argv = [str(kimi["binary"])]
-    if mode == MODE_SAFE:
-        prompt = prefix_kimi_safe_prompt(prompt)
-    elif mode not in (MODE_WORK, MODE_CALL):
+    if mode not in (MODE_SAFE, MODE_WORK, MODE_CALL):
         validate_mode(mode)
     if model:
         argv.extend(["--model", model])
@@ -270,6 +265,7 @@ def build_claude_argv(
     call_read_only: bool = False,
     pure: bool = False,
     output_schema: str | None = None,
+    persona_file: bool = False,
 ) -> list[str]:
     _reject_pure("claude", mode, pure, supported=True)
     if pure or output_schema is not None:
@@ -342,6 +338,8 @@ def build_claude_argv(
         argv.extend(["--model", model])
     if reasoning_effort is not None:
         argv.extend(["--effort", reasoning_effort])
+    if persona_file:
+        argv.extend(["--append-system-prompt-file", PERSONA_FILE_ARG_PLACEHOLDER])
     return argv