delegate-agent-cli 0.28.0__tar.gz → 0.29.1__tar.gz

{delegate_agent_cli-0.28.0 → delegate_agent_cli-0.29.1}/CHANGELOG.md

@@ -5,6 +5,83 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.29.1] - 2026-08-11
+
+### Changed
+
+- The PyPI artifact handoff now uses the official Node 24 upload and download
+  actions, removing the deprecation warnings emitted during the 0.29.0 publish.
+
+### Fixed
+
+- `workflow run --resume` now turns a completed workflow dry-run into live
+  execution under the same workflow ID. Simulated agent and budget events stay
+  in the journal for audit but never satisfy replay or consume live budget.
+
+## [0.29.0] - 2026-08-11
+
+### Added
+
+- `delegate runs` and `delegate ps` now report listing honesty: the JSON
+  payload gains `total` (pre-limit match count) and `truncated`, text mode
+  prints `showing N of M runs (raise --limit to see more)`, and a zero-row
+  result under `--group`/`--harness` explains itself — naming the status
+  filter to drop when `--running`/`--stale`/`--active` emptied the result, or
+  noting the run Registry is workspace-scoped otherwise.
+- Retained event text now carries truncation metadata on both surfaces: raw
+  `events.jsonl` `stream.line` records and normalized Snapshot `recentEvents`
+  add `truncated: true` plus `textChars` (original length) only when the
+  500-character bound actually clipped, and the final unterminated child
+  stdout line is now written to `events.jsonl` instead of silently dropped.
+  All child-controlled normalized-event strings (including tool targets,
+  `error`, and `run.completed`) are bounded through the same helper.
+- The tracked launcher shim template (`bin/delegate-profile-shim`) passes
+  through the read-only workflow actions
+  (`check|status|watch|events|result|wait|list`) without a selected profile,
+  mirroring the Python CLI's guard; a parity test fails on drift.
+- Tracked Cursor completion JSON now includes the CLI-reported token `usage`
+  object when present.
+
+### Changed
+
+- Devin model discovery now uses the prompt-free, fingerprinted
+  `devin models list --format json` catalog for setup, capability refresh, and
+  one-off live queries. Older or unauthenticated CLIs degrade to a version-only
+  record instead of receiving a prompt-like invalid-model probe.
+- Child-launch failures with `EPERM` now hint that sandboxed parent shells can
+  forbid launching harness binaries; `prompt_too_large` names the engines
+  whose prompt rides a file/stdin transport, derived from the transport table.
+- The test suite hardens hermeticity against ambient delegate-lane
+  environment (`DELEGATE_RUN_ID`, mail identity, root-provenance and profile
+  variables), and the documented discovery command is
+  `python3 -m unittest discover -s tests -t .` everywhere, including CI and
+  the contributor wiki.
+- CI and publishing now use the official Node 24 GitHub Action releases, and
+  the public publishing checklist builds exported source in isolated temporary
+  environments instead of modifying the maintainer's ambient Python install.
+
+### Fixed
+
+- An explicit `DELEGATE_CONFIG` now survives profile selection: the profile
+  shim and profile env resolution load the selected profile's credentials but
+  keep the incoming `DELEGATE_CONFIG` as the runtime-policy config instead of
+  replacing it, and codex quota fallback no longer forwards `DELEGATE_CONFIG`
+  into the fallback child environment.
+- Tracked runs now stop after an explicit harness terminal event and fail closed
+  when either raw output stream exceeds 16 MiB, preventing a completed or
+  runaway child from filling disk with cumulative stream payloads.
+- Tracked stream decoding preserves UTF-8 characters split across read chunks;
+  normalized events retain a bounded head/tail with an exact total, and raw
+  `events.jsonl` mirrors at most 500 stdout lines plus a truncation marker so
+  many short lines cannot amplify a bounded child stream into an unbounded
+  event journal or in-memory event list.
+- Tracked Cursor retries now report cumulative token usage, transient Devin
+  catalog failures retain the last-known-good catalog, and Devin help no longer
+  advertises unsupported reasoning effort.
+- Slow raw-log archival no longer holds the Registry mutation lock, concurrent
+  ambient retention passes skip instead of waiting, and transient Registry-lock
+  contention can no longer crash a tracked run's stdout drain thread.
+
 ## [0.28.0] - 2026-08-05
 
 ### Added
@@ -917,6 +994,8 @@ Usage-audit fix wave: 82 sessions and 1,241 delegate invocations from one week o
 
 - Releases before 0.1.3 predate this changelog.
 
+[0.29.1]: https://github.com/treygoff24/delegate-agent/compare/v0.29.0...v0.29.1
+[0.29.0]: https://github.com/treygoff24/delegate-agent/compare/v0.28.0...v0.29.0
 [0.28.0]: https://github.com/treygoff24/delegate-agent/compare/v0.27.0...v0.28.0
 [0.27.0]: https://github.com/treygoff24/delegate-agent/compare/v0.26.0...v0.27.0
 [0.26.0]: https://github.com/treygoff24/delegate-agent/compare/v0.25.0...v0.26.0

{delegate_agent_cli-0.28.0 → delegate_agent_cli-0.29.1}/CONTRIBUTING.md

@@ -7,9 +7,9 @@ Thanks for your interest in Delegate Agent. The project is early, so small, well
 ```bash
 python3 -m venv .venv
 . .venv/bin/activate
-python -m pip install -e ".[dev]"
+python3 -m pip install -e ".[dev]"
 python3 bin/delegate.py --json describe
-python3 -m unittest discover -s tests
+python3 -m unittest discover -s tests -t .
 ```
 
 Use `python3 bin/delegate.py` from this repository when validating development changes. Do not overwrite an installed `delegate` shim, `~/.delegate/config.json`, or any live runtime unless an operator explicitly asks for promotion.
@@ -35,7 +35,7 @@ Run the narrowest useful checks for your change, then the full suite before prop
 ```bash
 python3 -m compileall -q src tests bin
 git diff --check
-python3 -m unittest discover -s tests
+python3 -m unittest discover -s tests -t .
 ruff check .
 ruff format --check .
 ```

{delegate_agent_cli-0.28.0 → delegate_agent_cli-0.29.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: delegate-agent-cli
-Version: 0.28.0
+Version: 0.29.1
 Summary: A tiny CLI for delegating bounded agent tasks across coding-agent runtimes.
 Author: Trey Goff
 License-Expression: MIT
@@ -81,7 +81,7 @@ git clone https://github.com/treygoff24/delegate-agent.git
 cd delegate-agent
 python3 -m venv .venv
 . .venv/bin/activate
-python -m pip install -e .
+python3 -m pip install -e .
 python3 bin/delegate.py --json describe
 ```
 
@@ -158,6 +158,7 @@ delegate --json describe
 delegate --json models
 delegate --json models codex          # per-engine advisory catalog
 delegate --json models cursor --live  # merge live harness probe when supported
+delegate --json models devin --live   # query Devin's prompt-free account catalog
 delegate --json models opencode --live # query every model visible to OpenCode
 delegate --json models pi --live       # query every model visible to Pi
 delegate --json models omp --live      # query every model visible to Oh My Pi
@@ -357,6 +358,9 @@ selector explicitly. Tracked runs also carry a `resultQuality` classification
 (`ok` / `housekeeping_noop` / `empty` / `suspect_short` / `no_assistant_text`),
 and failed or cancelled runs always get a completion report — synthesized when
 the child produced none — so `--completion-report` never dead-ends.
+Each tracked raw stream is capped at 16 MiB. A child that exceeds the cap is
+terminated with `output_limit_exceeded`; a child that lingers after an explicit
+harness terminal event receives a short exit grace and is then stopped.
 
 Block on background runs instead of polling, and cancel them cleanly:
 
@@ -451,8 +455,9 @@ Delegate resolves the profile once per request and injects its env into every sp
 If `AI_PROFILE=work|personal` points at a missing profile overlay, Delegate
 blocks launch and mutation commands, but lets read-only diagnostics
 (`profiles`, `runs`, `run-output`, `snapshot`, cached `capabilities`,
-`worktree show`, `worktree list`, `describe`, `models`) continue with a
-warning. This guarantee is enforced in the Python CLI itself (`delegate_agent.cli:main`), so it holds no matter how you invoke Delegate: the
+`worktree show`, `worktree list`,
+`workflow check|status|watch|events|result|wait|list`, `describe`, `models`)
+continue with a warning. This guarantee is enforced in the Python CLI itself (`delegate_agent.cli:main`), so it holds no matter how you invoke Delegate: the
 pip console script, `python -m delegate_agent.cli`, `bin/delegate.py`, or a
 shell shim in front of any of those. The tracked launcher shim template,
 `bin/delegate-profile-shim`, applies the same check earlier, before Python

{delegate_agent_cli-0.28.0 → delegate_agent_cli-0.29.1}/README.md

@@ -48,7 +48,7 @@ git clone https://github.com/treygoff24/delegate-agent.git
 cd delegate-agent
 python3 -m venv .venv
 . .venv/bin/activate
-python -m pip install -e .
+python3 -m pip install -e .
 python3 bin/delegate.py --json describe
 ```
 
@@ -125,6 +125,7 @@ delegate --json describe
 delegate --json models
 delegate --json models codex          # per-engine advisory catalog
 delegate --json models cursor --live  # merge live harness probe when supported
+delegate --json models devin --live   # query Devin's prompt-free account catalog
 delegate --json models opencode --live # query every model visible to OpenCode
 delegate --json models pi --live       # query every model visible to Pi
 delegate --json models omp --live      # query every model visible to Oh My Pi
@@ -324,6 +325,9 @@ selector explicitly. Tracked runs also carry a `resultQuality` classification
 (`ok` / `housekeeping_noop` / `empty` / `suspect_short` / `no_assistant_text`),
 and failed or cancelled runs always get a completion report — synthesized when
 the child produced none — so `--completion-report` never dead-ends.
+Each tracked raw stream is capped at 16 MiB. A child that exceeds the cap is
+terminated with `output_limit_exceeded`; a child that lingers after an explicit
+harness terminal event receives a short exit grace and is then stopped.
 
 Block on background runs instead of polling, and cancel them cleanly:
 
@@ -418,8 +422,9 @@ Delegate resolves the profile once per request and injects its env into every sp
 If `AI_PROFILE=work|personal` points at a missing profile overlay, Delegate
 blocks launch and mutation commands, but lets read-only diagnostics
 (`profiles`, `runs`, `run-output`, `snapshot`, cached `capabilities`,
-`worktree show`, `worktree list`, `describe`, `models`) continue with a
-warning. This guarantee is enforced in the Python CLI itself (`delegate_agent.cli:main`), so it holds no matter how you invoke Delegate: the
+`worktree show`, `worktree list`,
+`workflow check|status|watch|events|result|wait|list`, `describe`, `models`)
+continue with a warning. This guarantee is enforced in the Python CLI itself (`delegate_agent.cli:main`), so it holds no matter how you invoke Delegate: the
 pip console script, `python -m delegate_agent.cli`, `bin/delegate.py`, or a
 shell shim in front of any of those. The tracked launcher shim template,
 `bin/delegate-profile-shim`, applies the same check earlier, before Python

{delegate_agent_cli-0.28.0 → delegate_agent_cli-0.29.1}/bin/delegate-profile-shim

@@ -5,6 +5,7 @@
 # AI_PROFILE shells to matching ~/.delegate/config.<profile>.json files, while
 # letting known read-only diagnostics run when the profile config is missing.
 
+_delegate_incoming_config="${DELEGATE_CONFIG-}"
 _delegate_profile_config="${HOME}/.delegate/config.${AI_PROFILE:-}.json"
 
 _delegate_subcommand() {
@@ -198,6 +199,31 @@ _delegate_is_readonly_request() {
           ;;
       esac
       ;;
+    workflow)
+      # The parser consumes --json tokens before the action, so the action is
+      # the first non-option token after `workflow`; trailing flags/paths
+      # never decide classification.
+      while [ "$#" -gt 0 ]; do
+        case "$1" in
+          --json)
+            shift
+            ;;
+          *)
+            break
+            ;;
+        esac
+      done
+      # Parity with profile_guard.READ_ONLY_WORKFLOW_ACTIONS is enforced by
+      # tests; update both together.
+      case "${1:-}" in
+        check|status|watch|events|result|wait|list)
+          return 0
+          ;;
+        *)
+          return 1
+          ;;
+      esac
+      ;;
     *)
       return 1
       ;;
@@ -208,11 +234,11 @@ _delegate_profile_fix_message() {
   cat >&2 <<EOF
 delegate: AI_PROFILE=${AI_PROFILE} but ${_delegate_profile_config} is missing/unreadable; refusing to run a launch or mutation command on the wrong account.
 Fix: create the profile config from config.example.json, or run 'env -u AI_PROFILE delegate config sync-profiles' to materialize missing profile overlays.
-Temporary bypasses: 'env -u AI_PROFILE delegate ...' uses the base config (work Claude, ambient Codex), or set 'DELEGATE_CONFIG=/path/to/config.json delegate ...'.
+Temporary bypass: 'env -u AI_PROFILE delegate ...' uses the base config (work Claude, ambient Codex).
 EOF
 }
 
-if [ -z "${DELEGATE_CONFIG:-}" ] && [ -n "${AI_PROFILE:-}" ]; then
+if [ -n "${AI_PROFILE:-}" ]; then
   case "${AI_PROFILE}" in
     personal|work)
       if [ ! -r "$_delegate_profile_config" ]; then
@@ -229,6 +255,9 @@ if [ -z "${DELEGATE_CONFIG:-}" ] && [ -n "${AI_PROFILE:-}" ]; then
         # ponytail: current keys.zsh files are plain exports; switch to parsing if
         # they ever need zsh-only syntax.
         [ -f "$_delegate_keys" ] && . "$_delegate_keys"
+        if [ -n "$_delegate_incoming_config" ]; then
+          export DELEGATE_CONFIG="$_delegate_incoming_config"
+        fi
       fi
       ;;
     *)

{delegate_agent_cli-0.28.0 → delegate_agent_cli-0.29.1}/docs/agent-setup.md

@@ -15,7 +15,7 @@ This guide covers both human setup and non-interactive setup for agents or CI jo
    ```bash
    python3 -m venv .venv
    . .venv/bin/activate
-   python -m pip install -e .
+   python3 -m pip install -e .
    python3 bin/delegate.py --json describe
    ```
 
@@ -243,7 +243,7 @@ where needed:
 
 ```bash
 python3 -m compileall -q src tests bin
-python3 -m unittest discover -s tests
+python3 -m unittest discover -s tests -t .
 ```
 
 Real runtime authentication is only required for integration smoke tests that intentionally launch a child agent.

{delegate_agent_cli-0.28.0 → delegate_agent_cli-0.29.1}/docs/cli-reference.md

@@ -169,7 +169,7 @@ matches an alias key; otherwise it is passed through verbatim as a raw model ID
 both. With neither, Droid uses `droid.defaultModel` when set. Discover aliases
 and advisory catalogs with `delegate models`, `delegate models <engine>`, and
 `delegate models <engine> --live`. Every harness except Claude exposes a live
-model probe; see [Discovery](#discovery) for the evidence and Devin caveats.
+model probe; see [Discovery](#discovery) for the evidence each probe records.
 
 `--reasoning-effort LEVEL` is optional and parsed only before prompt text begins.
 Engines with exact capability metadata reject unsupported model/effort pairs
@@ -334,6 +334,39 @@ delegate grok call "Summarize this context in three bullets."
 delegate --isolation worktree grok work "Implement the feature in a persistent worktree."
 ```
 
+### `delegate devin`
+
+Wraps Devin CLI print mode. Safe mode is unsupported because Devin may perform
+filesystem surveys through its generic `exec` tool, which Delegate cannot allow
+without weakening the read-only boundary.
+
+```bash
+delegate [--json] [--isolation auto|none|worktree] devin work [--model <alias-or-model>] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH] [prompt...]
+delegate [--json] devin call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--prompt-file PATH] [prompt...]
+```
+
+- `call --read-only` passes a Delegate-generated `--agent-config` deny-list for
+  edit, write, exec, and `mcp__*`, plus `--permission-mode auto`. Work and
+  default call use `--permission-mode dangerous` because non-interactive Devin
+  rejects unapproved edit/exec tools.
+- Prompt text is materialized in a private temporary file and passed with
+  Devin `--prompt-file` plus `-p`; dry-run argv and tracked manifests do not
+  contain the prompt.
+- Model selection uses `--model` (an alias from `devin.models` or a raw model
+  ID), the run-input JSON `model`, or `devin.defaultModel`. Unknown names are
+  left to Devin validation. `--reasoning-effort` is unsupported.
+- Setup, capability refresh, and `models devin --live` use the prompt-free
+  `devin models list --format json` catalog. Catalog failures degrade to
+  version-only metadata without prompting Devin.
+
+Examples:
+
+```bash
+delegate devin work "Implement the scoped task; report changed files and tests."
+delegate devin call --read-only "Score this answer against the rubric."
+delegate --isolation worktree devin work "Implement the feature in a persistent worktree."
+```
+
 ### `delegate opencode`
 
 Wraps OpenCode's non-interactive `run` command.
@@ -500,7 +533,9 @@ delegate [--json] workflow save <script.py> --name NAME
   and UTF-8 `promptBytes`; Cursor/Kimi/OMP prompts over 102400 bytes add a warning
   before their argv transport limit can fail a real run.
 - `--resume` replays the journal, adopts matching child runs by workflow agent
-  key, and continues from missing work.
+  key, and continues from missing work. Resuming a completed `--dry-run` starts
+  its planned agents live under the same workflow ID; simulated journal events
+  remain visible for audit but are excluded from replay and live budget.
 - `wait` and `result` accept an explicit workflow ID or, when omitted, resolve
   the latest eligible workflow. JSON output for implicit selection includes the
   selected `wfId` and `resolutionKind: "latest"`.
@@ -671,7 +706,11 @@ Typical dry-run JSON fields:
 
 `isolation` is a human-readable summary combining `effectiveIsolation` and `isolationLifecycle` (e.g. `"worktree temporary"`, `"worktree persistent"`, `"none"`). Depend on the structured fields rather than parsing it. A push dry-run also includes `mailPushAdapter` with the audit status and the internal hook command; unverified harnesses include the pull-degradation warning.
 
-When a profile is active, dry-run and completion payloads add `authProfile` (the resolved profile name) and, when a Codex fallback profile is configured, `fallbackProfile`. Dry-run also adds `profileEnv` (the injected env map, with values redacted). These keys are omitted when no profile is active.
+When a profile is active, dry-run and completion payloads add `authProfile`
+(the resolved profile name). Codex dry-runs also always add `fallbackProfile`
+(the configured profile name or `null`); completion payloads add it only when
+a fallback is configured. Dry-run also adds `profileEnv` (the injected env map,
+with values redacted). Profile metadata is omitted when no profile is active.
 
 For Cursor, Claude, Grok, OpenCode, Pi, Oh My Pi, Droid, and Kimi safe mode, an explicit `--isolation none`
 is normalized to `auto` with a warning because those safe contracts depend on
@@ -849,7 +888,7 @@ Automatic setup and refresh use these evidence sources:
 | Kimi | Models in the active Kimi configuration | Provider metadata may advertise efforts, but Delegate has no Kimi effort transport and still rejects `--reasoning-effort`. |
 | Claude | No model enumeration | The native effort enum is harness-wide evidence. |
 | Grok | Models visible to the active account | Exact config, discovery, or bundled declarations win; otherwise the native effort enum is harness-wide compatibility evidence and model-specific support remains unknown. |
-| Devin | No prompt-free model enumeration | Automatic discovery records only installation/version; Delegate has no Devin effort transport. |
+| Devin | Family slugs, aliases, and concrete variants visible to the active account | The prompt-free JSON catalog carries display names; Delegate has no Devin effort transport. |
 | OpenCode | Harness catalog | Listed variants are `exact` for that model; models without exact variant evidence retain the documented unvalidated pass-through path. |
 | Pi | Harness catalog | Thinking support is model-specific, but available labels come from a harness-wide enum and are reported as partial model evidence. |
 | Oh My Pi | Harness catalog | A model's explicit `thinking` array is exact; missing arrays use harness-partial compatibility rather than fabricated model evidence. |
@@ -884,6 +923,8 @@ stale and ordinary launches ignore only that harness's record until refresh.
 Cached reads never run `--version` merely to test staleness, and neither does an
 ordinary launch: a cached record can only be short of what the harness now
 supports, never claim more, so one that satisfies the run is used as-is.
+Existing Devin version-only cache records therefore remain valid but contain no
+live catalog until `delegate capabilities refresh devin` is run.
 
 A launch re-probes `--version` for its own harness only when the cached record
 has already cost the run something: it refused an explicit `--reasoning-effort`,
@@ -909,11 +950,9 @@ policy to another. Dry runs never probe at all.
 
 All automatic probes run with `shell=False`, stdin closed, a neutral temporary
 working directory, bounded output, and a timeout. They pass the active profile
-environment but do not carry a task prompt. Devin is the explicit exception on
-the opt-in one-off surface: `models devin --live` uses a bounded invalid-model,
-prompt-like invocation to make Devin print its available-model error. Setup and
-`capabilities refresh` never use that Devin invocation; they run `--version`
-only.
+environment but do not carry a task prompt. Devin uses the same prompt-free
+`models list --format json` metadata command for setup, capability refresh, and
+`models devin --live`; failures degrade to a version-only partial record.
 
 Discovery output applies best-effort credential scrubbing, so secret-shaped
 model IDs or diagnostic values may appear as `***`. Exact values should come
@@ -1057,8 +1096,16 @@ creating a Run or writing a prompt record.
 `delegate runs` defaults to recent runs. `--active` preserves the legacy active view and includes both live `running` runs and `stale` runs. Use `--running` for only live tracked processes and `--stale` for runs recorded as running whose PID is missing or dead. `--active`, `--running`, `--stale`, and `--recent` are mutually exclusive. `--group NAME` filters by launch group and the runs table shows a `group` column when any visible run has one.
 `--structural` omits content-bearing run fields and emits only identity, lifecycle, model,
 timestamp, group/mode, and `initiatorRoot` metadata. It is intended for local status collectors.
+JSON output (`delegate.runs.v1`) includes `total` (post-filter match count before `--limit`)
+and `truncated` (`true` when `total` exceeds the returned `runs` length). Text mode appends
+`showing N of M runs (raise --limit to see more)` when truncated. A zero-row result with
+`--group` or `--harness` adds a `warnings` entry (and a matching text `warning:` line): when
+the scope filters match Runs that `--active`/`--running`/`--stale` then excluded, it names
+the status flag to drop; otherwise it notes the Registry is workspace-scoped and `--cwd PATH`
+targets another workspace's Registry — it does not claim the filter matches elsewhere.
 `delegate ps` is the shorter first-class form of `delegate runs --active` and
-accepts the same harness, group, limit, and structural selectors.
+accepts the same harness, group, limit, and structural selectors (including `total`,
+`truncated`, and the empty-filter workspace-scope warning).
 
 `delegate runs prune` removes old terminal Run records from the workspace Registry so they stop accumulating forever. Only runs whose effective status is terminal (`succeeded`, `failed`, `cancelled`, or `stale` from a dead child) and whose last Registry activity is older than the threshold (default 30 days; override with `--older-than DAYS`) are eligible. Effectively running runs are always skipped, and persistent-worktree runs are skipped unless their worktree is recorded as removed or missing — pruning the record of a live worktree would orphan it from `worktree list`/`show`/`remove`. Pruning deletes the per-Run directory (Snapshot, Manifest, logs, events, Completion Report) and the retained raw-log archive; worktree paths on disk are never touched. `--dry-run` reports what would be removed without changing anything. JSON output uses schema `delegate.runs-prune.v1` with `planned`, `removed`, `skipped` (each entry carries a `reason`), and `errors` sections.
 
@@ -1113,12 +1160,14 @@ Common JSON fields for tracked run completion:
 
 Persistent worktree completions also include `branch`, `worktree`, a
 `workSummary`, and (when requested) `commitPolicy`. `workSummary` reports dirty
-state, changed file count, diff stat, and commits created by the child. When a
-Codex usage-limit fallback fires, the completion payload also includes
-`codexAuthFallback` metadata (reason, the primary and fallback profile names,
-both exit codes, and a redacted primary stderr tail). The fallback is Codex-only
-and is enabled only by `codex.fallbackProfile`; Delegate remembers temporary
-blocks by hashed credential namespace (`CODEX_HOME/auth.json` plus
+state, changed file count, diff stat, and commits created by the child. Tracked
+Cursor completions include `usage` when the Cursor CLI reports it, using
+`basis: "reported"` and camel-case token fields such as `inputTokens` and
+`outputTokens`. When a Codex usage-limit fallback fires, the completion payload
+also includes `codexAuthFallback` metadata (reason, the primary and fallback
+profile names, both exit codes, and a redacted primary stderr tail). The
+fallback is Codex-only and is enabled only by `codex.fallbackProfile`; Delegate
+remembers temporary blocks by hashed credential namespace (`CODEX_HOME/auth.json` plus
 `codex.profile`) as canonical state. Default work/personal credential homes
 also mirror compatible legacy alias keys so existing launchers share blocks;
 remapped aliases remain isolated.
@@ -1143,6 +1192,28 @@ Work-mode attempts are never replayed after tool activity or a workspace change.
 
 Run-output JSON uses schema `delegate.run-output.v1` and returns selected completion report, stdout, and/or stderr content. By default, secret-like strings are redacted unless `--no-redact` is supplied. Tracked runs finish in one of the terminal statuses `succeeded`, `failed`, or `cancelled`; explicit harness cancellation/error terminal events override an exit-zero child status.
 
+Tracked stdout and stderr logs are capped independently at 16 MiB. Exceeding a
+cap terminates the child and records `output_limit_exceeded` plus an
+`outputLimit` object naming the stream and byte limit. After an explicit
+terminal-success event, Delegate gives the harness one second to exit and then
+stops a lingering process; successful envelopes disclose this as
+`stoppedAfterCompletion: true`. Harnesses must emit that terminal event only
+after flushing their final payload.
+
+Each tracked Run also keeps `events.jsonl`, an append-only raw diagnostic mirror
+of child stdout lines as `{"kind":"stream.line","stream":"stdout","text":...}`
+records (including a final unterminated line when the child exits mid-line).
+The mirror retains at most 500 stdout-line records, followed by one
+`stream.lines_truncated` marker when additional lines are omitted. Normalized
+progress events also appear in Snapshot `recentEvents`; it retains the first
+100 and latest 400 events while reporting the full `eventsTotal`. Both surfaces
+bound child-controlled event strings to 500 characters, including the `…`
+sentinel when clipped. Truncated `message`/raw-line text adds `textChars`; other
+normalized fields add `<field>Chars` (for example `targetChars`). Short fields
+omit truncation metadata.
+Retained event text is not redacted — treat `events.jsonl` and `recentEvents`
+as sensitive diagnostic artifacts.
+
 Safe runs and read-only call runs that exit successfully with `resultQuality=empty`
 retry once with the original prompt plus a plain-text final-answer instruction.
 Pure and slash pass-through prompts, and write-capable calls, do not retry. Retried

{delegate_agent_cli-0.28.0 → delegate_agent_cli-0.29.1}/docs/configuration.md

@@ -265,6 +265,11 @@ Controls local run recording.
 - `retention.enabled`: whether raw logs are eligible for archive-only retention.
 - `retention.rawLogDays`: non-negative number of days before bulky raw logs may be archived.
 
+Ambient retention is best-effort. Archive I/O is serialized separately from
+Registry mutations, so a slow archive cannot block run progress, inspection,
+or cancellation; if another retention pass is already active, a concurrent
+ambient pass returns immediately.
+
 ### `cursor`
 
 ```json

{delegate_agent_cli-0.28.0 → delegate_agent_cli-0.29.1}/docs/delegate-workflows.md

@@ -110,6 +110,16 @@ resume against the first and fails with `workflow_locked`. Pick one.
 This preserves in-flight sibling results for replay while preventing unrelated
 siblings from starting after a human checkpoint has requested control.
 
+A completed dry-run can also become a live run without creating a second
+workflow record:
+
+```bash
+python3 bin/delegate.py workflow run --resume wf_0123abcdef45
+```
+
+Its simulated events remain in `journal.jsonl` for audit, but resume ignores
+them as cached results and resets simulated budget before launching live agents.
+
 ## Limits
 
 Workflow scripts are intentionally capped:

{delegate_agent_cli-0.28.0 → delegate_agent_cli-0.29.1}/docs/development.md

@@ -59,8 +59,12 @@ Run focused tests first, then the broader checks before handoff:
 ```bash
 python3 -m compileall -q src tests bin
 git diff --check
-python3 -m unittest discover -s tests
+python3 -m unittest discover -s tests -t .
 ```
 
+`-t .` makes discovery import `tests/__init__.py`, which shims `src` onto
+`sys.path` and strips ambient env. Unittest prints its `Ran N tests / OK`
+summary to stderr — pipe with `2>&1` when capturing output.
+
 Required CI does not need real Cursor, Droid, Codex, Claude, Grok, Devin,
 OpenCode, Pi, Oh My Pi, or Kimi binaries.

{delegate_agent_cli-0.28.0 → delegate_agent_cli-0.29.1}/docs/live-runtime.md

@@ -28,7 +28,8 @@ When `AI_PROFILE=work|personal` is set and the matching
 `~/.delegate/config.<profile>.json` overlay is missing, Delegate blocks launch
 and mutation commands but allows read-only diagnostics (`profiles`, `runs`,
 `run-output`, `snapshot`, cached `capabilities`, `worktree show`,
-`worktree list`, `describe`, `models`) with a warning. This check runs inside
+`worktree list`, `workflow check|status|watch|events|result|wait|list`,
+`describe`, `models`) with a warning. This check runs inside
 `delegate_agent.cli:main` (`src/delegate_agent/profile_guard.py`), so it applies
 regardless of entrypoint: the installed pip console script, `python -m
 delegate_agent.cli`, or `bin/delegate.py`. Some local installs additionally put
@@ -38,8 +39,11 @@ check even earlier, before Python starts. `AI_PROFILE` values other than
 `work`/`personal` are not recognized profiles; Delegate warns and runs on the
 base account rather than failing closed, since there is no config filename
 convention to check against. Fix a half-configured install with
-`env -u AI_PROFILE delegate config sync-profiles`, or bypass once with
-`env -u AI_PROFILE delegate ...` or an explicit `DELEGATE_CONFIG=...`.
+`env -u AI_PROFILE delegate config sync-profiles`, or bypass profile selection
+once with `env -u AI_PROFILE delegate ...`.
+In profile-aware shell installs, profile selection loads credentials; an
+incoming explicit `DELEGATE_CONFIG` remains the runtime-policy config only
+after the selected profile overlay passes validation.
 
 ## Do not promote implicitly
 

delegate_agent_cli-0.29.1/docs/publishing-checklist.md

@@ -0,0 +1,111 @@
+# Publishing checklist
+
+Use this before making a public source release, GitHub release, or package artifact.
+
+PyPI packaging is validated and live: `delegate-agent-cli` published 2026-07-06 (PyPI's name-similarity rule blocked the shorter `delegate-agent`; the installed console script is still `delegate`). Re-run the full checklist below for every subsequent release — publishing once does not exempt future versions from these checks.
+
+## Required checks
+
+- [ ] Start from a clean checkout: `git status --short --branch`.
+- [ ] Confirm the public README links only public docs.
+- [ ] Confirm `config.example.json` contains placeholders only.
+- [ ] Confirm internal plans/prompts are excluded from package artifacts.
+- [ ] Run the release private-path and private-alias scan across public docs,
+      examples, config, metadata, and packaging rules. Treat any hit as either
+      something to remove or something to explicitly justify before release.
+
+- [ ] Run Python compile check:
+
+  ```bash
+  python3 -m compileall -q src tests bin
+  ```
+
+- [ ] Run tests:
+
+  ```bash
+  python3 -m unittest discover -s tests -t .
+  ```
+
+- [ ] Run whitespace check:
+
+  ```bash
+  git diff --check
+  ```
+
+- [ ] Run the same lint and format checks as CI:
+
+  ```bash
+  ruff check .
+  ruff format --check .
+  ```
+
+- [ ] Run Gitleaks and TruffleHog against both Git history and the exact source
+      tree that will be packaged:
+
+  ```bash
+  gitleaks detect --source . --redact --no-banner
+  trufflehog git file://. --only-verified --fail --fail-on-scan-errors \
+    --exclude-detectors Lob --no-update
+  LOB_SCAN_RC=0
+  git grep -nIE '(^|[^[:alnum:]_])(live|test)_[a-f0-9]{35}([^[:alnum:]_]|$)' \
+    $(git rev-list HEAD) || LOB_SCAN_RC=$?
+  test "$LOB_SCAN_RC" -eq 1
+  SCAN_ROOT="$(mktemp -d)"
+  mkdir "$SCAN_ROOT/source"
+  git archive HEAD | tar -x -C "$SCAN_ROOT/source"
+  trufflehog filesystem "$SCAN_ROOT/source" --only-verified --fail \
+    --fail-on-scan-errors --exclude-detectors Lob --no-update
+  ```
+
+  TruffleHog 3.96.0's Lob detector accepts ordinary 35-character Python
+  `test_*` identifiers as verified credentials because its verification request
+  treats every HTTP 422 response as valid. The direct Lob-key grep above uses
+  the provider's lowercase hexadecimal key shape while the other detectors
+  remain fail-closed.
+
+## Package artifact checks
+
+- [ ] Export `HEAD`, build it with tools installed only in a temporary virtual
+      environment, and validate both artifacts:
+
+  ```bash
+  BUILD_ROOT="$(mktemp -d)"
+  mkdir "$BUILD_ROOT/source"
+  git archive HEAD | tar -x -C "$BUILD_ROOT/source"
+  python3 -m venv "$BUILD_ROOT/build-venv"
+  "$BUILD_ROOT/build-venv/bin/python" -m pip install --upgrade pip build twine
+  (cd "$BUILD_ROOT/source" && "$BUILD_ROOT/build-venv/bin/python" -m build)
+  "$BUILD_ROOT/build-venv/bin/python" -m twine check "$BUILD_ROOT"/source/dist/*
+  ```
+
+- [ ] Inspect sdist contents and confirm no internal plans, prompts, local run logs, or private config are included.
+- [ ] Install the built wheel in a second temporary environment and run:
+
+  ```bash
+  python3 -m venv "$BUILD_ROOT/smoke-venv"
+  "$BUILD_ROOT/smoke-venv/bin/python" -m pip install "$BUILD_ROOT"/source/dist/*.whl
+  DELEGATE="$BUILD_ROOT/smoke-venv/bin/delegate"
+  "$DELEGATE" --version
+  "$DELEGATE" --json describe
+  "$DELEGATE" --json dry-run codex safe "Review only."
+  "$DELEGATE" --json dry-run claude safe "Review only."
+  "$DELEGATE" --json dry-run grok safe "Review only."
+  "$DELEGATE" --json dry-run opencode safe "Review only."
+  "$DELEGATE" --json dry-run pi safe "Review only."
+  "$DELEGATE" --json dry-run omp safe "Review only."
+  "$DELEGATE" --json dry-run kimi safe "Review only."
+  ```
+
+## GitHub surface
+
+- [ ] License is present.
+- [ ] `CONTRIBUTING.md` and `SECURITY.md` are present.
+- [ ] Issue and PR templates are present.
+- [ ] GitHub Security Advisories are enabled for private vulnerability reports.
+- [ ] CI passes without real child-agent binaries.
+
+## Release decision
+
+- [ ] Decide whether this release is source-only, GitHub release, PyPI, or another distribution path.
+- [ ] If PyPI is chosen, confirm the release workflow still passes before publishing (PyPI itself is already validated as a distribution path as of the 2026-07-06 `delegate-agent-cli` publish).
+- [ ] Tag only after docs, package metadata, and artifact checks agree.