delegate-agent-cli 0.26.0__tar.gz → 0.28.0__tar.gz

{delegate_agent_cli-0.26.0 → delegate_agent_cli-0.28.0}/CHANGELOG.md

@@ -5,7 +5,62 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.28.0] - 2026-08-05
+
+### Added
+
+- Added `delegate runs --structural` and `delegate ps --structural` for
+  content-free local status collection, including lifecycle, model, group,
+  status, timestamp, and root initiator provenance.
+- Tracked runs now retain a validated root initiator across nested Delegate
+  launches and persistent-worktree execution.
+
+### Changed
+
+- Codex quota fallback is now explicitly configured with
+  `codex.fallbackProfile`, supports arbitrary profile definitions, and keeps
+  temporary blocks by resolved credential identity rather than profile alias.
+  Default work/personal credential homes continue to interoperate with legacy
+  profile launchers without allowing remapped aliases to share state.
+- Codex-only failover no longer depends on private Claude shim names or hidden
+  runtime controls. Retry and persistent-worktree paths retain the account
+  that is actually serving the run.
+
+### Fixed
+
+- Structural run listings now exclude raw terminal/provider events and apply
+  normal secret redaction to retained fields.
+- Fallback failures persist the correct account block and provider-reported
+  reset time; a blocked fallback is skipped, and retries no longer return to a
+  blocked primary after a preflight swap.
+- Failover tests isolate their state from the user's home directory, and
+  `delegate ps --help` now advertises its supported structural view.
+
+## [0.27.0] - 2026-08-01
+
+### Changed
+
+- Split the mail module into `mail_core` (mailbox) and `mail_push` (hook
+  protocol) behind a stable `mail` facade; extracted the runner's mail
+  sentinel capture and push finalization; unified the three launch seams'
+  mail preparation in one helper with ownership transfer kept at the seams;
+  `parse_prompt_tail` returns a named, tuple-compatible `PromptTail`.
+- Mail-disabled launches no longer touch the filesystem for mail (lanes keep
+  their identity and storage materializes lazily on first send); workspace
+  resolution runs once per launch; the discovery cache is memoized per
+  process; the directory retry baseline is captured only when a codex
+  fallback profile is configured; watch sleeps are bounded by the remaining
+  deadline; non-once watches dedupe emitted messages and skip unchanged
+  inboxes; mail bodies stream with a bounded read.
+- All mail subcommands render prose in human mode (watch keeps its
+  documented NDJSON contract); JSON output is byte-unchanged.
+
+### Removed
+
+- Dead code from the framer migration and mail rounds: unused safe-prefix
+  helpers, the write-only `prompt_framed` field, and unreferenced mail
+  helpers; development-history comments replaced with durable behavior
+  statements.
 
 ## [0.26.0] - 2026-08-01
 
@@ -862,6 +917,8 @@ Usage-audit fix wave: 82 sessions and 1,241 delegate invocations from one week o
 
 - Releases before 0.1.3 predate this changelog.
 
+[0.28.0]: https://github.com/treygoff24/delegate-agent/compare/v0.27.0...v0.28.0
+[0.27.0]: https://github.com/treygoff24/delegate-agent/compare/v0.26.0...v0.27.0
 [0.26.0]: https://github.com/treygoff24/delegate-agent/compare/v0.25.0...v0.26.0
 [0.25.0]: https://github.com/treygoff24/delegate-agent/compare/v0.24.0...v0.25.0
 [0.24.0]: https://github.com/treygoff24/delegate-agent/compare/v0.23.0...v0.24.0

{delegate_agent_cli-0.26.0 → delegate_agent_cli-0.28.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: delegate-agent-cli
-Version: 0.26.0
+Version: 0.28.0
 Summary: A tiny CLI for delegating bounded agent tasks across coding-agent runtimes.
 Author: Trey Goff
 License-Expression: MIT
@@ -167,6 +167,8 @@ delegate --json capabilities refresh   # refresh the active profile's discovery
 
 Discover commands as you go: `delegate <command> --help` prints focused help for any command path, and `delegate --json <command> --help` returns an agent-friendly spec of its usage, arguments, and options. For launch and `dry-run` commands, `--json` and `--isolation` may also appear before inline prompt text begins, for example `delegate codex work --prompt-file task.md --json`. `delegate --json describe` includes a `commands` catalog of the whole surface. Cached `models` and `capabilities` reads launch no child process. `models <engine> --live` performs a one-off probe without updating the cache; rerun `delegate setup` or `delegate capabilities refresh` when ordinary launches should consume newly discovered models or effort levels.
 
+Codex tracked runs can opt into a one-run quota fallback with `codex.fallbackProfile`; hashed credential namespace is canonical, while default work/personal credential homes also mirror compatible legacy alias keys so existing launchers share blocks. Remapped aliases remain isolated. See [Configuration](docs/configuration.md).
+
 From this development checkout, use `python3 bin/delegate.py ...` instead of an installed `delegate` shim.
 
 ### WSL setup notes

{delegate_agent_cli-0.26.0 → delegate_agent_cli-0.28.0}/README.md

@@ -134,6 +134,8 @@ delegate --json capabilities refresh   # refresh the active profile's discovery
 
 Discover commands as you go: `delegate <command> --help` prints focused help for any command path, and `delegate --json <command> --help` returns an agent-friendly spec of its usage, arguments, and options. For launch and `dry-run` commands, `--json` and `--isolation` may also appear before inline prompt text begins, for example `delegate codex work --prompt-file task.md --json`. `delegate --json describe` includes a `commands` catalog of the whole surface. Cached `models` and `capabilities` reads launch no child process. `models <engine> --live` performs a one-off probe without updating the cache; rerun `delegate setup` or `delegate capabilities refresh` when ordinary launches should consume newly discovered models or effort levels.
 
+Codex tracked runs can opt into a one-run quota fallback with `codex.fallbackProfile`; hashed credential namespace is canonical, while default work/personal credential homes also mirror compatible legacy alias keys so existing launchers share blocks. Remapped aliases remain isolated. See [Configuration](docs/configuration.md).
+
 From this development checkout, use `python3 bin/delegate.py ...` instead of an installed `delegate` shim.
 
 ### WSL setup notes

{delegate_agent_cli-0.26.0 → delegate_agent_cli-0.28.0}/docs/agent-setup.md

@@ -7,7 +7,7 @@ This guide covers both human setup and non-interactive setup for agents or CI jo
 1. Install Delegate from the source repository:
 
    ```bash
-   python3 -m pip install "delegate-agent @ git+https://github.com/treygoff24/delegate-agent.git"
+   python3 -m pip install "delegate-agent-cli @ git+https://github.com/treygoff24/delegate-agent.git"
    ```
 
    For a development checkout, prefer:

{delegate_agent_cli-0.26.0 → delegate_agent_cli-0.28.0}/docs/cli-reference.md

@@ -1008,12 +1008,12 @@ repo copy or persistent worktree itself.
 Tracked runs return bounded parent-facing output and store local metadata under `.delegate/` in the source workspace.
 
 ```bash
-delegate runs [--active|--running|--stale|--recent] [--harness HARNESS] [--group NAME] [--limit N]
+delegate runs [--active|--running|--stale|--recent] [--harness HARNESS] [--group NAME] [--limit N] [--structural]
 delegate runs prune [--older-than DAYS] [--dry-run]
 delegate ps [--harness HARNESS] [--group NAME] [--limit N]
 delegate snapshot [--latest HARNESS] [--no-redact] <handle>
 delegate run-output [--latest HARNESS] <handle> [--completion-report] [--stdout] [--stderr] [--tail N] [--max-chars N] [--raw] [--no-redact]
-delegate resume [--engine ENGINE] [--model MODEL] [--reasoning-effort LEVEL] [--timeout SEC] [--dry-run] <handle> [extra instructions...]
+delegate resume [--engine ENGINE] [--model MODEL] [--reasoning-effort LEVEL] [--fast|--no-fast] [--progress|--no-progress] [--timeout SEC] [--output-schema PATH|--no-output-schema] [--include-dirty] [--persona NAME|--no-persona] [--allow-repo-persona] [--mail-push] [--dry-run] <handle> [extra instructions...]
 delegate wait <handle>... [--latest HARNESS] [--group NAME] [--timeout SEC] [--interval SEC] [--completion-report]
 delegate cancel <handle>...
 ```
@@ -1055,8 +1055,10 @@ creating a Run or writing a prompt record.
 | Include dirty | `includeDirty` | `--include-dirty` | Source and explicit values are creation-only and are dropped for ordinary resume with a note. | Retained only as a drop decision; on a persistent/attached source, explicit `--include-dirty` is rejected because attachment does not create or sync a worktree. |
 
 `delegate runs` defaults to recent runs. `--active` preserves the legacy active view and includes both live `running` runs and `stale` runs. Use `--running` for only live tracked processes and `--stale` for runs recorded as running whose PID is missing or dead. `--active`, `--running`, `--stale`, and `--recent` are mutually exclusive. `--group NAME` filters by launch group and the runs table shows a `group` column when any visible run has one.
+`--structural` omits content-bearing run fields and emits only identity, lifecycle, model,
+timestamp, group/mode, and `initiatorRoot` metadata. It is intended for local status collectors.
 `delegate ps` is the shorter first-class form of `delegate runs --active` and
-accepts the same harness, group, and limit selectors.
+accepts the same harness, group, limit, and structural selectors.
 
 `delegate runs prune` removes old terminal Run records from the workspace Registry so they stop accumulating forever. Only runs whose effective status is terminal (`succeeded`, `failed`, `cancelled`, or `stale` from a dead child) and whose last Registry activity is older than the threshold (default 30 days; override with `--older-than DAYS`) are eligible. Effectively running runs are always skipped, and persistent-worktree runs are skipped unless their worktree is recorded as removed or missing — pruning the record of a live worktree would orphan it from `worktree list`/`show`/`remove`. Pruning deletes the per-Run directory (Snapshot, Manifest, logs, events, Completion Report) and the retained raw-log archive; worktree paths on disk are never touched. `--dry-run` reports what would be removed without changing anything. JSON output uses schema `delegate.runs-prune.v1` with `planned`, `removed`, `skipped` (each entry carries a `reason`), and `errors` sections.
 
@@ -1114,7 +1116,12 @@ Persistent worktree completions also include `branch`, `worktree`, a
 state, changed file count, diff stat, and commits created by the child. When a
 Codex usage-limit fallback fires, the completion payload also includes
 `codexAuthFallback` metadata (reason, the primary and fallback profile names,
-both exit codes, and a redacted primary stderr tail).
+both exit codes, and a redacted primary stderr tail). The fallback is Codex-only
+and is enabled only by `codex.fallbackProfile`; Delegate remembers temporary
+blocks by hashed credential namespace (`CODEX_HOME/auth.json` plus
+`codex.profile`) as canonical state. Default work/personal credential homes
+also mirror compatible legacy alias keys so existing launchers share blocks;
+remapped aliases remain isolated.
 
 Snapshot JSON uses schema `delegate.snapshot.v1` and includes fields such as `alias`, `runId`, `harness`, `status`, `rawStatus`, `effectiveStatus`, `staleReason`, `nextActions`, `cwd`, `executionCwd`, `workspaceRoot`, `assistantText`, `recentEvents`, `warnings`, `exitCode`, reasoning metadata, terminal metadata, and isolation/worktree metadata when applicable. `workspaceRoot` is also exported to the child as `WORKSPACE_ROOT`, so commands can anchor workspace-relative paths after changing directories. Inspection commands do not rewrite a stale run's recorded state; they expose the raw recorded status plus the effective status computed from the current PID check. Run-output and worktree show output include `requestedHandle`, `resolvedHandle`, and `resolutionKind` (`literal`, `latest`, or `latest_model`) when a handle resolves indirectly. For bare harness handles, snapshot, run-output, and wait also report `resolvedRunId`, `resolvedAlias`, `resolvedWorkspace`, `resolvedAge`, and `resolvedAgeSeconds`. Resolutions older than 24 hours add a `bare_handle_stale` warning suggesting `--cwd` or an explicit handle.
 

{delegate_agent_cli-0.26.0 → delegate_agent_cli-0.28.0}/docs/configuration.md

@@ -336,7 +336,7 @@ Controls local run recording.
 - `models`: optional map of local aliases to Codex model IDs for `--model` / JSON `model`. Alias keys must not collide with mode names, equal the engine's own name, or start with `-`.
 - `defaultReasoningEffort`: optional non-empty effort string. When a Codex model resolves (run input or `codex.defaultModel`) and supports the level, Delegate emits a Codex config override; otherwise the run proceeds without reasoning effort and records a warning. An explicit `--reasoning-effort` flag fails closed for unsupported levels, but can target the Codex harness default model when no model is configured.
 - `profile`: optional Codex CLI config overlay name. It is config-only; JSON run input cannot set it.
-- `fallbackProfile`: optional top-level `profiles.definitions` name for one quota-limit retry on tracked Codex runs. The fallback profile must define `env.CODEX_HOME`.
+- `fallbackProfile`: optional top-level `profiles.definitions` name for Codex-only quota fallback. The fallback profile must define `env.CODEX_HOME`. Tracked Codex runs persist temporary usage-limit blocks under `~/.ai-profiles/runtime/failover/`; hashed credential namespace (`CODEX_HOME/auth.json` plus `codex.profile`) is canonical, while default work/personal credential homes also mirror compatible legacy alias keys so existing launchers share blocks. Remapped aliases remain isolated. If both the primary and fallback credential namespaces are blocked, Delegate keeps the primary attempt and does not launch the known-blocked fallback.
 - `workSandbox`: `read-only`, `workspace-write`, or `danger-full-access` for Codex work mode when full bypass is not enabled.
 - `ephemeral`: include Codex `--ephemeral` in JSON-streaming runs.
 - `ignoreUserConfig`: include Codex `--ignore-user-config`.

{delegate_agent_cli-0.26.0 → delegate_agent_cli-0.28.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "delegate-agent-cli"
-version = "0.26.0"
+version = "0.28.0"
 description = "A tiny CLI for delegating bounded agent tasks across coding-agent runtimes."
 readme = "README.md"
 requires-python = ">=3.11"

{delegate_agent_cli-0.26.0 → delegate_agent_cli-0.28.0}/src/delegate_agent/__init__.py

@@ -1,5 +1,5 @@
 """Delegate Agent CLI package."""
 
-VERSION = "0.26.0"
+VERSION = "0.28.0"
 
 __all__ = ["VERSION"]

{delegate_agent_cli-0.26.0 → delegate_agent_cli-0.28.0}/src/delegate_agent/argv_builders.py

@@ -15,7 +15,6 @@ from delegate_agent import reasoning
 from delegate_agent.constants import MODE_CALL, MODE_SAFE, MODE_WORK, validate_mode
 from delegate_agent.errors import DelegateError
 from delegate_agent.json_types import JsonObject
-from delegate_agent.prompt_instructions import SKILL_REVIEW_PREFIX
 from delegate_agent.prompt_transport import (
     CURSOR_PROMPT_REDACTION,
     DEVIN_AGENT_CONFIG_ARG_PLACEHOLDER,
@@ -108,23 +107,6 @@ def prefix_cursor_safe_prompt(prompt: str) -> str:
     return _prefix_safe_prompt(prompt, "cursor")
 
 
-def prefix_kimi_safe_prompt(prompt: str) -> str:
-    return _prefix_safe_prompt(prompt, "kimi")
-
-
-def prefix_droid_safe_prompt(prompt: str) -> str:
-    safe_prefix = SAFE_REVIEW_PREFIX_BY_ENGINE["droid"]
-    if prompt.startswith(safe_prefix):
-        return prompt
-    skill_prefix = SKILL_REVIEW_PREFIX
-    if prompt.startswith(skill_prefix):
-        insert_at = len(skill_prefix)
-        if prompt[insert_at:].startswith(safe_prefix):
-            return prompt
-        return prompt[:insert_at] + safe_prefix + prompt[insert_at:]
-    return f"{safe_prefix}{prompt}"
-
-
 def _harness_bypass_enabled(config: JsonObject, mode: str, engine: str) -> bool:
     """Return true only for explicit harness-scoped bypass policy.
 

{delegate_agent_cli-0.26.0 → delegate_agent_cli-0.28.0}/src/delegate_agent/cli.py

@@ -635,6 +635,8 @@ def make_run_context(
         ),
         auth_profile=request.auth_profile,
         fallback_auth_profile=request.fallback_auth_profile,
+        codex_failover_identity=request.codex_failover_identity,
+        codex_fallback_failover_identity=request.codex_fallback_failover_identity,
         include_dirty=request.include_dirty,
         mail_push=request.mail_push,
         group=request.group,
@@ -675,6 +677,12 @@ def _set_child_root_env(request: Request, source_workspace: ResolvedWorkspace) -
     request.env_overrides = env
 
 
+def _apply_initiator_root(request: Request) -> str | None:
+    initiator_root, env = run_metadata.apply_initiator_root_env(request.env_overrides)
+    request.env_overrides = env
+    return initiator_root
+
+
 def _artifact_files(root: Path) -> list[str]:
     return sorted(str(item) for item in root.rglob("*") if item.is_file() or item.is_symlink())
 
@@ -783,63 +791,55 @@ def _execute_attached_worktree(
         workspace_kind=source_workspace.kind,
     )
     maybe_run_retention_pass(registry_root, config)
-    if request.mode == MODE_WORK:
+    if request.mode == MODE_WORK and delegate_config.mail_enabled(config):
         mail.prepare_mail_storage(registry_root)
     mail.sanitize_inherited_mail_identity(request.env_overrides)
+    metadata = {
+        "mode": request.mode,
+        "model": request.model,
+        "modelAlias": request.model_alias,
+        "modelResolved": request.model,
+        "group": request.group,
+        "workflowAgentKey": request.workflow_agent_key,
+        "cwd": source_workspace.path,
+        "worktreeAttachment": {
+            **(iso.attachment or {}),
+            "startHeadOid": start_head_oid,
+        },
+    }
+    run_metadata.add_initiator_metadata(
+        metadata, run_metadata.resolve_initiator_root(request.env_overrides or {})
+    )
     run_id, alias = run_registry.register_run(
         registry_root,
         harness=request.engine,
-        metadata={
-            "mode": request.mode,
-            "model": request.model,
-            "modelAlias": request.model_alias,
-            "modelResolved": request.model,
-            "group": request.group,
-            "workflowAgentKey": request.workflow_agent_key,
-            "cwd": source_workspace.path,
-            "worktreeAttachment": {
-                **(iso.attachment or {}),
-                "startHeadOid": start_head_oid,
-            },
-        },
+        metadata=metadata,
     )
     child_env = request.env_overrides or {}
     if request.mode == MODE_WORK:
         mail.bind_mail_identity(child_env, run_id, alias)
     request.env_overrides = child_env
-    provision: mail.MailPushProvision | None = None
-    if request.mode == MODE_WORK:
-        wired_argv, wired_display_argv = mail.wire_work_mail_launch(
-            request.engine,
-            execution_request.argv,
-            execution_request.display_argv,
-            registry_root,
-            prompt=request.prompt,
-            prompt_transport=request.prompt_transport,
-            stderr=stderr,
-            isolated_workspace=True,
-        )
-        execution_request = dc_replace(
-            execution_request, argv=wired_argv, display_argv=wired_display_argv
-        )
-        if request.mail_push:
-            provision = mail.provision_mail_push(
-                request.engine,
-                execution_request.argv,
-                execution_request.display_argv,
-                registry_root,
-                run_id,
-                request.env_overrides or {},
-                profiles.codex_fallback_child_env_overrides(
-                    request.profile_resolution, request.env_overrides or {}
-                ),
-            )
-            if provision.warning is not None:
-                request.warnings = (*request.warnings, provision.warning)
-                print(f"delegate mail: WARNING: {provision.warning}", file=stderr)
-            execution_request = dc_replace(
-                execution_request, argv=provision.argv, display_argv=provision.display_argv
-            )
+    mail_launch = mail.prepare_work_mail_launch(
+        enabled=request.mode == MODE_WORK and delegate_config.mail_enabled(config),
+        mail_push=request.mail_push,
+        engine=request.engine,
+        argv=execution_request.argv,
+        display_argv=execution_request.display_argv,
+        registry_root=registry_root,
+        run_id=run_id,
+        env_overrides=request.env_overrides,
+        profile_resolution=request.profile_resolution,
+        prompt=request.prompt,
+        prompt_transport=request.prompt_transport,
+        stderr=stderr,
+        isolated_workspace=True,
+        warnings=request.warnings,
+    )
+    execution_request = dc_replace(
+        execution_request, argv=mail_launch.argv, display_argv=mail_launch.display_argv
+    )
+    request.warnings = mail_launch.request_warnings
+    provision = mail_launch.provision
     ctx_runner = make_run_context(
         registry_root,
         request,
@@ -850,22 +850,10 @@ def _execute_attached_worktree(
     if provision is not None:
         ctx_runner = dc_replace(
             ctx_runner,
-            env_overrides=(
-                dict(provision.env)
-                if provision.warning is not None and provision.env is not None
-                else ctx_runner.env_overrides
-            ),
-            fallback_env_overrides=mail.mail_push_fallback_env_overrides(
-                provision, ctx_runner.fallback_env_overrides, registry_root, run_id
-            ),
-            warnings=tuple(
-                dict.fromkeys(
-                    (*ctx_runner.warnings, *((provision.warning,) if provision.warning else ()))
-                )
+            **mail_launch.context_updates(
+                ctx_runner.env_overrides, ctx_runner.fallback_env_overrides, ctx_runner.warnings
             ),
         )
-        if provision.warning is not None and provision.env is not None:
-            ctx_runner = dc_replace(ctx_runner, env_overrides=dict(provision.env))
     attachment = {
         **(iso.attachment or {}),
         "startHeadOid": start_head_oid,
@@ -1010,6 +998,7 @@ def execute_request(
     stderr: TextIO,
 ) -> tuple[int, JsonObject | None]:
     _set_child_root_env(request, source_workspace)
+    initiator_root = _apply_initiator_root(request)
     profiles.strip_mail_identity(request.env_overrides)
     if request.mode == MODE_CALL:
         call_response: tuple[int, JsonObject | None] | None = None
@@ -1037,18 +1026,20 @@ def execute_request(
                     workspace_kind=source_workspace.kind,
                 )
                 maybe_run_retention_pass(registry_root, config)
+                metadata = {
+                    "mode": request.mode,
+                    "model": request.model,
+                    "modelAlias": request.model_alias,
+                    "modelResolved": request.model,
+                    "group": request.group,
+                    "workflowAgentKey": request.workflow_agent_key,
+                    "cwd": source_workspace.path,
+                }
+                run_metadata.add_initiator_metadata(metadata, initiator_root)
                 run_id, alias = run_registry.register_run(
                     registry_root,
                     harness=request.engine,
-                    metadata={
-                        "mode": request.mode,
-                        "model": request.model,
-                        "modelAlias": request.model_alias,
-                        "modelResolved": request.model,
-                        "group": request.group,
-                        "workflowAgentKey": request.workflow_agent_key,
-                        "cwd": source_workspace.path,
-                    },
+                    metadata=metadata,
                 )
                 artifact_id = run_id
                 ctx_runner = make_run_context(
@@ -1303,25 +1294,27 @@ def execute_request(
             workspace_kind=source_workspace.kind,
         )
         maybe_run_retention_pass(registry_root, config)
-        if isolated_request.mode == MODE_WORK:
+        if isolated_request.mode == MODE_WORK and delegate_config.mail_enabled(config):
             mail.prepare_mail_storage(registry_root)
         mail.sanitize_inherited_mail_identity(isolated_request.env_overrides)
+        metadata = {
+            "mode": isolated_request.mode,
+            "model": isolated_request.model,
+            "modelAlias": isolated_request.model_alias,
+            "modelResolved": isolated_request.model,
+            "group": isolated_request.group,
+            "workflowAgentKey": isolated_request.workflow_agent_key,
+            "cwd": (
+                isolated_request.isolation_context.source_workspace
+                if isolated_request.isolation_context is not None
+                else source_workspace.path
+            ),
+        }
+        run_metadata.add_initiator_metadata(metadata, initiator_root)
         run_id, alias = run_registry.register_run(
             registry_root,
             harness=isolated_request.engine,
-            metadata={
-                "mode": isolated_request.mode,
-                "model": isolated_request.model,
-                "modelAlias": isolated_request.model_alias,
-                "modelResolved": isolated_request.model,
-                "group": isolated_request.group,
-                "workflowAgentKey": isolated_request.workflow_agent_key,
-                "cwd": (
-                    isolated_request.isolation_context.source_workspace
-                    if isolated_request.isolation_context is not None
-                    else source_workspace.path
-                ),
-            },
+            metadata=metadata,
         )
         child_env = isolated_request.env_overrides or {}
         if isolated_request.mode == MODE_WORK:
@@ -1330,41 +1323,32 @@ def execute_request(
         provision: mail.MailPushProvision | None = None
         mail_push_cleanup_transferred = False
         try:
-            if isolated_request.mode == MODE_WORK:
-                isolated_request.argv, isolated_request.display_argv = mail.wire_work_mail_launch(
-                    isolated_request.engine,
-                    isolated_request.argv,
-                    isolated_request.display_argv,
-                    registry_root,
-                    prompt=isolated_request.prompt,
-                    prompt_transport=isolated_request.prompt_transport,
-                    stderr=stderr,
-                    isolated_workspace=bool(
-                        isolated_request.isolation_context
-                        and isolated_request.isolation_context.isolation_lifecycle
-                        in ("temporary", "persistent", "attached")
-                    ),
-                )
-                if isolated_request.mail_push:
-                    provision = mail.provision_mail_push(
-                        isolated_request.engine,
-                        isolated_request.argv,
-                        isolated_request.display_argv,
-                        registry_root,
-                        run_id,
-                        isolated_request.env_overrides or {},
-                        profiles.codex_fallback_child_env_overrides(
-                            isolated_request.profile_resolution,
-                            isolated_request.env_overrides or {},
-                        ),
-                    )
-                    if provision.warning is not None:
-                        isolated_request.warnings = (*isolated_request.warnings, provision.warning)
-                        print(f"delegate mail: WARNING: {provision.warning}", file=stderr)
-                    isolated_request.argv, isolated_request.display_argv = (
-                        provision.argv,
-                        provision.display_argv,
-                    )
+            mail_launch = mail.prepare_work_mail_launch(
+                enabled=isolated_request.mode == MODE_WORK and delegate_config.mail_enabled(config),
+                mail_push=isolated_request.mail_push,
+                engine=isolated_request.engine,
+                argv=isolated_request.argv,
+                display_argv=isolated_request.display_argv,
+                registry_root=registry_root,
+                run_id=run_id,
+                env_overrides=isolated_request.env_overrides,
+                profile_resolution=isolated_request.profile_resolution,
+                prompt=isolated_request.prompt,
+                prompt_transport=isolated_request.prompt_transport,
+                stderr=stderr,
+                isolated_workspace=bool(
+                    isolated_request.isolation_context
+                    and isolated_request.isolation_context.isolation_lifecycle
+                    in ("temporary", "persistent", "attached")
+                ),
+                warnings=isolated_request.warnings,
+            )
+            isolated_request.argv, isolated_request.display_argv = (
+                mail_launch.argv,
+                mail_launch.display_argv,
+            )
+            isolated_request.warnings = mail_launch.request_warnings
+            provision = mail_launch.provision
             ctx_runner = make_run_context(
                 registry_root,
                 isolated_request,
@@ -1375,25 +1359,12 @@ def execute_request(
             if provision is not None:
                 ctx_runner = dc_replace(
                     ctx_runner,
-                    env_overrides=(
-                        dict(provision.env)
-                        if provision.warning is not None and provision.env is not None
-                        else ctx_runner.env_overrides
-                    ),
-                    fallback_env_overrides=mail.mail_push_fallback_env_overrides(
-                        provision, ctx_runner.fallback_env_overrides, registry_root, run_id
-                    ),
-                    warnings=tuple(
-                        dict.fromkeys(
-                            (
-                                *ctx_runner.warnings,
-                                *((provision.warning,) if provision.warning else ()),
-                            )
-                        )
+                    **mail_launch.context_updates(
+                        ctx_runner.env_overrides,
+                        ctx_runner.fallback_env_overrides,
+                        ctx_runner.warnings,
                     ),
                 )
-                if provision.warning is not None and provision.env is not None:
-                    ctx_runner = dc_replace(ctx_runner, env_overrides=dict(provision.env))
             # Evaluate every argument expression BEFORE marking ownership
             # transferred: a raise inside an argument (public_argv below) would
             # otherwise skip both the CLI cleanup and the runner's guard.
@@ -1543,6 +1514,7 @@ def main(
     try:
         parsed = parse_cli(argv)
         global_options = parsed.global_options
+        workspace: ResolvedWorkspace | None = None
         json_mode = global_options.json_mode
         profile_guard.enforce_profile_guard(parsed, stderr=stderr)
         if parsed.subcommand == "help":
@@ -1581,16 +1553,18 @@ def main(
                         "call mode does not use --cwd.",
                     )
                 if global_options.group is not None:
-                    config_workspace = workspace_path_for_config(global_options.cwd)
+                    workspace = resolve_workspace(global_options.cwd)
+                    config_workspace = Path(workspace.path)
                 else:
                     config_workspace = None
             else:
-                config_workspace = workspace_path_for_config(global_options.cwd)
+                workspace = resolve_workspace(global_options.cwd)
+                config_workspace = Path(workspace.path)
             config, source = load_config(workspace=config_workspace)
             validate_config(config)
 
         if parsed.subcommand == "personas":
-            workspace = resolve_workspace(global_options.cwd)
+            workspace = workspace or resolve_workspace(global_options.cwd)
             return emit_personas(workspace, json_mode=global_options.json_mode, stdout=stdout)
 
         discovery_profile: profiles.ProfileResolution | None = None
@@ -1641,7 +1615,7 @@ def main(
                 mail_workspace = mail.resolve_mail_workspace(global_options.cwd)
                 workspace = resolve_workspace(str(mail_workspace))
             else:
-                workspace = resolve_workspace(global_options.cwd)
+                workspace = workspace or resolve_workspace(global_options.cwd)
 
         if parsed.subcommand == "capabilities":
             command = parsed.capabilities
@@ -1714,7 +1688,7 @@ def main(
             # through the normal request build and execution path.
             parsed = resume_plan.parsed
             global_options = parsed.global_options
-        request = request_from_parsed(parsed, config, stdin, stderr)
+        request = request_from_parsed(parsed, config, stdin, stderr, workspace=workspace)
         if resume_plan is not None:
             request = resume_command.apply_resume_to_request(request, resume_plan)
         if request.dry_run: