delegate-agent-cli 0.24.0__tar.gz → 0.25.0__tar.gz

{delegate_agent_cli-0.24.0 → delegate_agent_cli-0.25.0}/CHANGELOG.md

@@ -5,6 +5,55 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.25.0] - 2026-08-01
+
+### Added
+
+- Named personas: `--persona` / `--no-persona` / `--allow-repo-persona` on
+  every engine's safe/work launch (and dry-run), input-json `persona` /
+  `allowRepoPersona` keys, and workflow `agent(persona=...)` with the resolved
+  persona digest pinned into the structural cache key so an edited persona is
+  a cache miss by design.
+- `delegate personas [--json]` listing (schema `delegate.personas.v1`) with
+  workspace-shadowing metadata and per-file invalid rows; read-only allowlisted
+  in both the profile guard and the shell shim.
+- Persona transports: claude work uses `--append-system-prompt-file` with a
+  private 0600 file when discovery positively proves current support (probe
+  recognizes both the long and the collapsed `--append-system-prompt[-file]`
+  help spellings); opencode merges a synthetic `delegate-persona` agent into
+  the effective config without clobbering profile keys; every other engine
+  prepends. Safe mode always prepends, with the persona placed before the
+  safe policy so the safety text keeps recency.
+- `persona.txt` as a private durable run artifact with manifest, snapshot,
+  and runs-summary projection; resume replays recorded persona bytes through
+  the target engine's transport, `--persona` re-resolves, `--no-persona`
+  drops.
+
+### Changed
+
+- The central framer is now the sole prompt composer: cursor/droid/kimi argv
+  builders no longer self-prefix safe policy text, user and persona bytes are
+  joined verbatim, and persistent/attached worktree notes are tracked
+  structurally on the request rather than inferred from prompt content.
+- Slash-passthrough prompts on persistent or attached worktree runs carry the
+  Delegate-owned worktree and forbid-commit notes ahead of the slash command,
+  matching v0.24.0 behavior; all other slash payloads remain byte-verbatim.
+
+### Security
+
+- Persona resolution walks `.delegate/personas` component-by-component over
+  `O_NOFOLLOW` descriptors anchored at the source workspace or home, refusing
+  symlinked parents and leaves; strict UTF-8, C0 refusal, and a 64 KiB cap.
+- Resume persona replay reads only the fixed `persona.txt` artifact with a
+  required, verified sha256 digest; manifest data cannot redirect the read.
+- The claude native persona gate fails closed: probe errors, timeouts, and
+  unrecognized banners fall back to prepend so an older binary never receives
+  an unknown flag. Dry-run never probes.
+- Workflow persona digests travel across the child seam and both sides fail
+  closed on mismatch without caching.
+
 ## [0.24.0] - 2026-07-31
 
 ### Added
@@ -783,6 +832,7 @@ Usage-audit fix wave: 82 sessions and 1,241 delegate invocations from one week o
 
 - Releases before 0.1.3 predate this changelog.
 
+[0.25.0]: https://github.com/treygoff24/delegate-agent/compare/v0.24.0...v0.25.0
 [0.24.0]: https://github.com/treygoff24/delegate-agent/compare/v0.23.0...v0.24.0
 [0.23.0]: https://github.com/treygoff24/delegate-agent/compare/v0.22.0...v0.23.0
 [0.22.0]: https://github.com/treygoff24/delegate-agent/compare/v0.21.0...v0.22.0

{delegate_agent_cli-0.24.0 → delegate_agent_cli-0.25.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: delegate-agent-cli
-Version: 0.24.0
+Version: 0.25.0
 Summary: A tiny CLI for delegating bounded agent tasks across coding-agent runtimes.
 Author: Trey Goff
 License-Expression: MIT

{delegate_agent_cli-0.24.0 → delegate_agent_cli-0.25.0}/bin/delegate-profile-shim

@@ -134,7 +134,7 @@ _delegate_is_readonly_request() {
     esac
   done
   case "$_cmd" in
-    profiles|runs|ps|run-output|describe|snapshot|agent-help|help|--help|-h|--version)
+    profiles|runs|ps|run-output|describe|snapshot|agent-help|personas|help|--help|-h|--version)
       return 0
       ;;
     models)

{delegate_agent_cli-0.24.0 → delegate_agent_cli-0.25.0}/config.example.json

@@ -8,6 +8,9 @@
       "rawLogDays": 7
     }
   },
+  "personas": {
+    "forceTransport": null
+  },
   "cursor": {
     "argvPrefix": [
       "agent"

{delegate_agent_cli-0.24.0 → delegate_agent_cli-0.25.0}/docs/cli-reference.md

@@ -15,6 +15,46 @@ Use `delegate --help` for the exact command list from the installed version. Glo
 --group NAME                  Tag a launch/run-input request with a lightweight group ([A-Za-z0-9._-]{1,64}).
 ```
 
+## Personas
+
+Named personas are UTF-8 Markdown files resolved from the source workspace:
+`.delegate/personas/<name>.md` shadows `~/.delegate/personas/<name>.md`. Names
+must match `[A-Za-z0-9][A-Za-z0-9._-]{0,63}`; files are regular, non-symlink
+files no larger than 64 KiB and are rejected on invalid UTF-8 or disallowed C0
+controls. The workspace-local directory is not VCS-shared by default; teams
+that intentionally version a persona must force-add that individual file.
+
+```bash
+delegate personas
+delegate --json personas
+delegate claude work --persona editor "Review chapter 3"
+delegate codex safe --persona editor --allow-repo-persona "Review the diff"
+delegate resume --persona editor <handle> "Continue with the requested fixes"
+delegate resume --no-persona <handle> "Continue without the recorded persona"
+```
+
+`--persona NAME`, `--no-persona`, and `--allow-repo-persona` are shared launch
+options. A workspace-local persona is refused in safe mode unless explicitly
+allowed. Resolution logs `persona: NAME (workspace|global)` to stderr. Personas
+are not accepted for call, read-only call, `--pass-through`, or slash-passthrough
+prompts. Input JSON uses `persona` (string or null) and `allowRepoPersona`
+(boolean).
+
+`delegate --json personas` returns schema `delegate.personas.v1` with sorted rows
+containing `name`, `source`, `sizeBytes`, and an escaped bounded `preview`.
+Invalid files remain visible with an `invalid` reason; a workspace row that
+shadows a global row also includes `shadowsGlobal: true`.
+
+Work-mode transport is prepend for most engines, Claude native-file only when
+the discovery cache proves `--append-system-prompt-file` (otherwise prepend
+with a warning), and OpenCode agent-config merge. OpenCode preserves existing
+root keys, agent keys, and prompts, appending the persona after an existing
+agent prompt. Safe mode always prepends. Claude native-file keeps the persona
+body out of argv, dry-run JSON, and the manifest; prepend engines using argv
+transport (Cursor, Kimi, and Oh My Pi) expose it in the live process argv.
+Tracked runs retain it only in the private
+`persona.txt` artifact.
+
 ## Commands
 
 ### Direct runtime commands
@@ -420,7 +460,7 @@ delegate [--json] workflow save <script.py> --name NAME
 - `run` launches a detached supervisor; `--dry-run` renders planned stubs
   without launching child agents or consuming real budget. Each entry in
   `runTree.calls` includes the resolved `model`, `effort`, `fast`, `isolation`,
-  and UTF-8 `promptBytes`; Cursor/Kimi prompts over 102400 bytes add a warning
+  and UTF-8 `promptBytes`; Cursor/Kimi/OMP prompts over 102400 bytes add a warning
   before their argv transport limit can fail a real run.
 - `--resume` replays the journal, adopts matching child runs by workflow agent
   key, and continues from missing work.

{delegate_agent_cli-0.24.0 → delegate_agent_cli-0.25.0}/docs/configuration.md

@@ -201,6 +201,30 @@ reasoning defaults.
 
 ## Sections
 
+### `personas`
+
+Persona files are workspace-local by design, not VCS-shared configuration:
+`.delegate/personas/*.md` shadows the same name under
+`~/.delegate/personas/`. The `delegate personas` command lists both scopes
+without exposing persona bodies in JSON previews. Because `.delegate` is
+normally excluded, teams that intentionally version a persona must force-add
+the individual file; the resolution scope remains workspace-local.
+
+```json
+{
+  "personas": {
+    "forceTransport": null
+  }
+}
+```
+
+`forceTransport` is optional and accepts `null`, `prepend`, `native-file`, or
+`agent-config`. It is an explicit transport pin, not a capability probe;
+`native-file` is appropriate only when the configured Claude binary supports
+`--append-system-prompt-file`, and `agent-config` is meaningful for OpenCode.
+Safe mode never uses native persona channels. A workspace-local persona is
+refused in safe mode unless the launch includes `--allow-repo-persona`.
+
 ### `tracking`
 
 Controls local run recording.

{delegate_agent_cli-0.24.0 → delegate_agent_cli-0.25.0}/docs/delegate-workflows.md

@@ -64,7 +64,7 @@ workflow result in `result.json`. Injected globals are `agent`, `pipeline`,
 
 ## Core DSL
 
-- `agent(prompt, engine=None, mode=None, model=None, effort=None, schema=None, label=None, phase=None, isolation=None, passthrough=False, timeout=None, retries=None, fast=None)` launches a real Delegate child run and returns parent-facing output, a validated schema object, or `None`. `fast=True` requests Codex Fast, `fast=False` requests Standard, and `None` inherits; non-Codex fallback candidates ignore this Codex-only preference. `fast` is appended to preserve positional compatibility with existing workflow scripts.
+- `agent(prompt, engine=None, mode=None, model=None, effort=None, schema=None, label=None, phase=None, isolation=None, passthrough=False, timeout=None, retries=None, fast=None, persona=None, allow_repo_persona=False)` launches a real Delegate child run and returns parent-facing output, a validated schema object, or `None`. `fast=True` requests Codex Fast, `fast=False` requests Standard, and `None` inherits; non-Codex fallback candidates ignore this Codex-only preference. `persona` resolves one named persona from the source workspace; `allow_repo_persona=True` opts into workspace-local personas in safe mode.
 - `pipeline(items, stage1, ...)` runs per-item stage chains with no inter-stage barrier. A throwing stage drops that item to `None` and skips later stages for that item.
 - `parallel([lambda: ...])` is a barrier and preserves order. Ordinary item failures become `None` slots; gate checkpoints propagate to the supervisor.
 - `phase(title)` emits a progress event.
@@ -76,6 +76,17 @@ Workflow `engine` values and `workflows.engineCaps` keys accept `cursor`,
 `droid`, `codex`, `claude`, `grok`, `devin`, `opencode`, `pi`, `omp`, and
 `kimi`.
 
+### Persona digest pinning
+
+When `agent(persona="editor")` first resolves `editor.md`, the workflow
+structural key and `agent_started` journal event include the resolved bytes'
+SHA-256 digest. Replay therefore returns the result only for the same persona
+version: editing the file creates a cache miss instead of mixing two versions
+under the same name. Dry-runs expose persona name/source/digest/byte count but
+never write the persona body. Child input JSON carries `persona` and
+`allowRepoPersona`; the normal run manifest and inspection projections expose
+non-sensitive persona metadata only.
+
 ## Gates and resume
 
 A workflow gate checkpoints the whole workflow tree, not just the nested child
@@ -200,9 +211,10 @@ python3 bin/delegate.py --json workflow run review.py \
 ```
 
 The preview's `runTree.calls` records each call's resolved `model`, `effort`,
-`fast`, `isolation`, and UTF-8 `promptBytes`. Cursor and Kimi calls whose prompts
-exceed 102400 bytes also carry a warning because those harnesses transport the
-prompt in argv.
+`fast`, `isolation`, and UTF-8 `promptBytes` (the raw user prompt plus resolved
+persona text). Cursor, Kimi, and OMP calls whose user-plus-resolved-persona input
+exceeds 102400 bytes carry a warning; the final materialized prompt is checked
+again before exec.
 
 ## CLI
 

{delegate_agent_cli-0.24.0 → delegate_agent_cli-0.25.0}/docs/security-model.md

@@ -13,6 +13,31 @@ Delegate controls:
 - Prompt framing that tells sub-agents to review available skills and, in safe mode, avoid edits.
 - Local run metadata under `.delegate/` for tracked runs.
 
+### Persona boundary
+
+Personas are untrusted prompt text, not policy. Delegate validates the name,
+path containment, file type, UTF-8, byte limit, and C0 controls, but does not
+trust persona instructions. Safe-mode framing deliberately places the safe
+advisory after the persona (`skill -> persona -> safe`) so a persona cannot
+replace the safety text by recency. Native persona channels are work-only;
+safe mode always prepends.
+
+Workspace-local personas live under `.delegate/personas/`, which is local state
+and is not VCS-shared. Safe mode refuses them by default; use
+`--allow-repo-persona` only when the source workspace is trusted. Global
+personas are resolved from `~/.delegate/personas/` when no workspace file
+shadows the name. Call, read-only call, pass-through, and slash-passthrough
+surfaces refuse personas rather than silently changing their prompt contract.
+
+Claude native-file transport is discovery-gated and writes a private 0600 file;
+an absent, stale, or unproven capability falls back to prepend. OpenCode merges
+into the effective config without destroying existing root keys, agent fields,
+or prompt text; malformed config falls back to prepend with a warning. Claude
+native-file keeps persona bodies out of argv, dry-run output, and manifests;
+prepend engines using argv transport expose them in the live process argv.
+Tracked runs retain
+the resolved bytes only in private `persona.txt`, which is removed with the run.
+
 Delegate does not control:
 
 - The child runtime's implementation.

{delegate_agent_cli-0.24.0 → delegate_agent_cli-0.25.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "delegate-agent-cli"
-version = "0.24.0"
+version = "0.25.0"
 description = "A tiny CLI for delegating bounded agent tasks across coding-agent runtimes."
 readme = "README.md"
 requires-python = ">=3.11"

{delegate_agent_cli-0.24.0 → delegate_agent_cli-0.25.0}/src/delegate_agent/__init__.py

@@ -1,5 +1,5 @@
 """Delegate Agent CLI package."""
 
-VERSION = "0.24.0"
+VERSION = "0.25.0"
 
 __all__ = ["VERSION"]

{delegate_agent_cli-0.24.0 → delegate_agent_cli-0.25.0}/src/delegate_agent/argv_builders.py

@@ -20,6 +20,7 @@ from delegate_agent.prompt_transport import (
     CURSOR_PROMPT_REDACTION,
     DEVIN_AGENT_CONFIG_ARG_PLACEHOLDER,
     DROID_PROMPT_FILE_ARG_PLACEHOLDER,
+    PERSONA_FILE_ARG_PLACEHOLDER,
     PROMPT_FILE_ARG_PLACEHOLDER,
     PROMPT_TRANSPORT_ARGV,
     PROMPT_TRANSPORT_FILE,
@@ -176,8 +177,6 @@ def build_cursor_argv(
     argv = [*prefix, "--workspace", workspace, "-p", "--trust"]
     if mode == MODE_WORK:
         argv.extend(["--approve-mcps", "--force"])
-    elif mode == MODE_SAFE:
-        prompt = prefix_cursor_safe_prompt(prompt)
     elif mode == MODE_CALL:
         # Call defaults to work-level capability ("work minus a repo"); --read-only
         # drops the write flags for the stateless judge/completion contract.
@@ -209,8 +208,6 @@ def build_droid_argv(
     argv = [binary, "exec", "--cwd", workspace]
     if mode == MODE_WORK:
         argv.append("--skip-permissions-unsafe")
-    elif mode == MODE_SAFE:
-        prompt = prefix_droid_safe_prompt(prompt)
     elif mode == MODE_CALL:
         if not call_read_only:
             argv.append("--skip-permissions-unsafe")
@@ -246,9 +243,7 @@ def build_kimi_argv(
 ) -> list[str]:
     _reject_pure("kimi", mode, pure)
     argv = [str(kimi["binary"])]
-    if mode == MODE_SAFE:
-        prompt = prefix_kimi_safe_prompt(prompt)
-    elif mode not in (MODE_WORK, MODE_CALL):
+    if mode not in (MODE_SAFE, MODE_WORK, MODE_CALL):
         validate_mode(mode)
     if model:
         argv.extend(["--model", model])
@@ -270,6 +265,7 @@ def build_claude_argv(
     call_read_only: bool = False,
     pure: bool = False,
     output_schema: str | None = None,
+    persona_file: bool = False,
 ) -> list[str]:
     _reject_pure("claude", mode, pure, supported=True)
     if pure or output_schema is not None:
@@ -342,6 +338,8 @@ def build_claude_argv(
         argv.extend(["--model", model])
     if reasoning_effort is not None:
         argv.extend(["--effort", reasoning_effort])
+    if persona_file:
+        argv.extend(["--append-system-prompt-file", PERSONA_FILE_ARG_PLACEHOLDER])
     return argv
 
 

{delegate_agent_cli-0.24.0 → delegate_agent_cli-0.25.0}/src/delegate_agent/cli.py

@@ -18,6 +18,7 @@ from delegate_agent import (
     config_commands,
     harness_discovery,
     inspection_commands,
+    personas,
     profile_commands,
     profile_guard,
     profiles,
@@ -93,6 +94,7 @@ from delegate_agent.prompt_transport import (  # noqa: F401  # CURSOR_PROMPT_RED
     DEVIN_AGENT_CONFIG_DISPLAY,
     DROID_PROMPT_FILE_ARG_PLACEHOLDER,
     DROID_PROMPT_FILE_DISPLAY,
+    PERSONA_FILE_ARG_PLACEHOLDER,
     PROMPT_FILE_ARG_PLACEHOLDER,
     PROMPT_FILE_DISPLAY,
     PROMPT_TRANSPORT_ARGV,
@@ -291,6 +293,25 @@ def emit_config_command(parsed: ParsedCommand, stdout: TextIO) -> int:
     return config_commands.emit(command, stdout)
 
 
+def emit_personas(workspace: ResolvedWorkspace, *, json_mode: bool, stdout: TextIO) -> int:
+    rows = personas.list_personas(workspace.path)
+    if json_mode:
+        delegate_rendering.print_json({"schema": "delegate.personas.v1", "personas": rows}, stdout)
+        return EXIT_OK
+    if not rows:
+        print("No personas found.", file=stdout)
+        return EXIT_OK
+    for row in rows:
+        name = row.get("name", "")
+        source = row.get("source", "")
+        if "invalid" in row:
+            print(f"{name} ({source}): invalid: {row['invalid']}", file=stdout)
+            continue
+        shadow = " [shadows global]" if row.get("shadowsGlobal") else ""
+        print(f"{name} ({source}, {row.get('sizeBytes', 0)} bytes){shadow}", file=stdout)
+    return EXIT_OK
+
+
 def dry_run_payload(request: Request) -> JsonObject:
     payload: JsonObject = {
         "ok": True,
@@ -328,6 +349,12 @@ def dry_run_payload(request: Request) -> JsonObject:
         payload["group"] = request.group
     if request.agent is not None:
         payload["agent"] = request.agent
+    if request.persona_name is not None:
+        payload["personaName"] = request.persona_name
+        payload["personaSource"] = request.persona_source
+        payload["personaTransport"] = request.persona_transport
+        payload["personaDigest"] = request.persona_digest
+        payload["personaFile"] = request.persona_file
     if request.resumed_from is not None:
         payload["resumedFrom"] = request.resumed_from
     if request.auth_profile is not None:
@@ -602,6 +629,12 @@ def make_run_context(
         output_schema_text=request.output_schema_record_text,
         agent=request.agent,
         resumed_from=request.resumed_from,
+        persona_name=request.persona_name,
+        persona_source=request.persona_source,
+        persona_transport=request.persona_transport,
+        persona_digest=request.persona_digest,
+        persona_file=request.persona_file,
+        persona_text=request.persona_text,
     )
 
 
@@ -760,6 +793,10 @@ def _execute_attached_worktree(
             run_registry.write_private_text(
                 run_path / run_registry.PROMPT_TXT_FILE, ctx_runner.source_prompt
             )
+        if ctx_runner.persona_text is not None:
+            run_registry.write_private_text(
+                run_path / run_registry.PERSONA_TXT_FILE, ctx_runner.persona_text
+            )
         delegate_runner.write_manifest(
             run_path,
             delegate_runner.build_manifest(ctx_runner, execution_request.display_argv),
@@ -808,6 +845,8 @@ def _execute_attached_worktree(
             prompt_file_placeholder=PROMPT_FILE_ARG_PLACEHOLDER,
             agent_config_text=execution_request.agent_config_text,
             agent_config_placeholder=DEVIN_AGENT_CONFIG_ARG_PLACEHOLDER,
+            persona_file_text=execution_request.persona_file_text,
+            persona_file_placeholder=PERSONA_FILE_ARG_PLACEHOLDER,
             output_schema_text=request.output_schema_text,
             output_schema_path=request.output_schema,
             manifest_argv=execution_request.display_argv,
@@ -894,6 +933,12 @@ def execute_request(
                         prompt_file_placeholder=PROMPT_FILE_ARG_PLACEHOLDER,
                         agent_config_text=request.agent_config_text,
                         agent_config_placeholder=DEVIN_AGENT_CONFIG_ARG_PLACEHOLDER,
+                        persona_file_text=(
+                            request.persona_text
+                            if request.persona_transport == "native-file"
+                            else None
+                        ),
+                        persona_file_placeholder=PERSONA_FILE_ARG_PLACEHOLDER,
                         output_schema_text=request.output_schema_text,
                         output_schema_path=request.output_schema,
                         manifest_argv=public_argv(request),
@@ -1157,6 +1202,12 @@ def execute_request(
                 prompt_file_placeholder=PROMPT_FILE_ARG_PLACEHOLDER,
                 agent_config_text=isolated_request.agent_config_text,
                 agent_config_placeholder=DEVIN_AGENT_CONFIG_ARG_PLACEHOLDER,
+                persona_file_text=(
+                    isolated_request.persona_text
+                    if isolated_request.persona_transport == "native-file"
+                    else None
+                ),
+                persona_file_placeholder=PERSONA_FILE_ARG_PLACEHOLDER,
                 output_schema_text=isolated_request.output_schema_text,
                 output_schema_path=isolated_request.output_schema,
                 manifest_argv=public_argv(isolated_request),
@@ -1320,6 +1371,10 @@ def main(
             config, source = load_config(workspace=config_workspace)
             validate_config(config)
 
+        if parsed.subcommand == "personas":
+            workspace = resolve_workspace(global_options.cwd)
+            return emit_personas(workspace, json_mode=global_options.json_mode, stdout=stdout)
+
         discovery_profile: profiles.ProfileResolution | None = None
         discovery_snapshot: JsonObject | None = None
         if parsed.subcommand in {"models", "capabilities"}:
@@ -1425,7 +1480,7 @@ def main(
             # through the normal request build and execution path.
             parsed = resume_plan.parsed
             global_options = parsed.global_options
-        request = request_from_parsed(parsed, config, stdin)
+        request = request_from_parsed(parsed, config, stdin, stderr)
         if resume_plan is not None:
             request = resume_command.apply_resume_to_request(request, resume_plan)
         if request.dry_run:

{delegate_agent_cli-0.24.0 → delegate_agent_cli-0.25.0}/src/delegate_agent/cli_parser.py

@@ -160,7 +160,7 @@ def parse_help_subcommand(rest: list[str], json_mode: bool) -> ParsedCommand:
     return help_command(json_mode, topic)
 
 
-SIMPLE_INSPECTION_SUBCOMMANDS = frozenset({"models", "describe", "agent-help"})
+SIMPLE_INSPECTION_SUBCOMMANDS = frozenset({"models", "describe", "agent-help", "personas"})
 INSPECTION_OPTION_SUBCOMMANDS = frozenset({"models", "describe"})
 
 
@@ -791,6 +791,9 @@ def parse_modeless_engine(
         include_dirty,
         model,
         agent,
+        persona,
+        no_persona,
+        allow_repo_persona,
     ) = parse_prompt_tail(rest[1:], json_mode, isolation, command_prefix=[engine, mode])
     if agent is not None and engine != "opencode":
         raise DelegateError("unsupported_agent", "--agent is only supported by opencode.")
@@ -844,6 +847,9 @@ def parse_modeless_engine(
             dry_run=dry_run,
             model=model,
             agent=agent,
+            persona=persona,
+            no_persona=no_persona,
+            allow_repo_persona=allow_repo_persona,
         ),
     )
 
@@ -918,6 +924,9 @@ def parse_droid(
         include_dirty,
         model,
         agent,
+        persona,
+        no_persona,
+        allow_repo_persona,
     ) = parse_prompt_tail(tail, json_mode, isolation, command_prefix=command_prefix)
     if agent is not None:
         raise DelegateError("unsupported_agent", "--agent is only supported by opencode.")
@@ -973,6 +982,9 @@ def parse_droid(
             dry_run=dry_run,
             model=model,
             agent=agent,
+            persona=persona,
+            no_persona=no_persona,
+            allow_repo_persona=allow_repo_persona,
         ),
     )
 
@@ -1060,6 +1072,9 @@ def parse_resume(
     drop_output_schema = False
     include_dirty = False
     dry_run = False
+    persona: str | None = None
+    no_persona = False
+    allow_repo_persona = False
     handle: str | None = None
     extra_parts: list[str] = []
     i = 0
@@ -1140,6 +1155,38 @@ def parse_resume(
                 include_dirty = True
                 i += 1
                 continue
+            if token == "--persona":
+                if i + 1 >= len(rest):
+                    raise DelegateError("missing_persona", "--persona requires a non-empty name.")
+                value = rest[i + 1]
+                if not value.strip() or value.startswith("-") or command_help.is_help_token(value):
+                    raise DelegateError("missing_persona", "--persona requires a non-empty name.")
+                if persona is not None or no_persona:
+                    raise DelegateError(
+                        "invalid_option_combination",
+                        "--persona and --no-persona cannot be combined.",
+                    )
+                persona = value
+                i += 2
+                continue
+            if token == "--no-persona":
+                if persona is not None or no_persona:
+                    raise DelegateError(
+                        "invalid_option_combination",
+                        "--persona and --no-persona cannot be combined.",
+                    )
+                no_persona = True
+                i += 1
+                continue
+            if token == "--allow-repo-persona":
+                if allow_repo_persona:
+                    raise DelegateError(
+                        "invalid_option_combination",
+                        "Only one --allow-repo-persona flag is allowed.",
+                    )
+                allow_repo_persona = True
+                i += 1
+                continue
             if token == "--dry-run":
                 dry_run = True
                 i += 1
@@ -1183,6 +1230,9 @@ def parse_resume(
             drop_output_schema=drop_output_schema,
             include_dirty=include_dirty,
             dry_run=dry_run,
+            persona=persona,
+            no_persona=no_persona,
+            allow_repo_persona=allow_repo_persona,
         ),
     )
 
@@ -1209,6 +1259,9 @@ def parse_prompt_tail(
     bool,
     str | None,
     str | None,
+    str | None,
+    bool,
+    bool,
 ]:
     prompt_file: str | None = None
     output_schema: str | None = None
@@ -1222,6 +1275,9 @@ def parse_prompt_tail(
     timeout: int | None = None
     model: str | None = None
     agent: str | None = None
+    persona: str | None = None
+    no_persona = False
+    allow_repo_persona = False
     prompt_parts: list[str] = []
     i = 0
     while i < len(rest):
@@ -1354,6 +1410,49 @@ def parse_prompt_tail(
             agent = value
             i += 2
             continue
+        if token == "--persona":
+            if prompt_parts:
+                raise DelegateError(
+                    "ambiguous_persona_source", "--persona must appear before direct prompt text."
+                )
+            if i + 1 >= len(rest):
+                raise DelegateError("missing_persona", "--persona requires a non-empty name.")
+            value = rest[i + 1]
+            if not value.strip() or value.startswith("-") or command_help.is_help_token(value):
+                raise DelegateError("missing_persona", "--persona requires a non-empty name.")
+            if persona is not None or no_persona:
+                raise DelegateError(
+                    "invalid_option_combination", "--persona and --no-persona cannot be combined."
+                )
+            persona = value
+            i += 2
+            continue
+        if token == "--no-persona":
+            if prompt_parts:
+                raise DelegateError(
+                    "ambiguous_persona_source",
+                    "--no-persona must appear before direct prompt text.",
+                )
+            if persona is not None or no_persona:
+                raise DelegateError(
+                    "invalid_option_combination", "--persona and --no-persona cannot be combined."
+                )
+            no_persona = True
+            i += 1
+            continue
+        if token == "--allow-repo-persona":
+            if prompt_parts:
+                raise DelegateError(
+                    "ambiguous_persona_source",
+                    "--allow-repo-persona must appear before direct prompt text.",
+                )
+            if allow_repo_persona:
+                raise DelegateError(
+                    "invalid_option_combination", "Only one --allow-repo-persona flag is allowed."
+                )
+            allow_repo_persona = True
+            i += 1
+            continue
         if token == "--progress":
             if progress_intent == "on":
                 raise DelegateError(
@@ -1476,6 +1575,9 @@ def parse_prompt_tail(
         include_dirty,
         model,
         agent,
+        persona,
+        no_persona,
+        allow_repo_persona,
     )