delegate-agent-cli 0.32.0__tar.gz → 0.33.0__tar.gz

{delegate_agent_cli-0.32.0 → delegate_agent_cli-0.33.0}/CHANGELOG.md

@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.33.0] - 2026-10-12
+
+This release adds Muse (Meta's Muse family) as the eleventh harness, at parity with the best-supported engines: safe/work/call modes, structured output, native session followup, and the full effort enum.
+
+### Added
+- **Muse is a Delegate harness.** `delegate muse safe|work|call` wraps
+  Meta's Muse (`muse exec --json`) with Muse family models: prompt-file
+  delivery, a flag-enforced safe lockdown (`--disable-write --disable-shell
+  --disable-web-tools`, sandbox on, workspace untrusted), work mode with the
+  sandbox kept on, native `--output-schema` enforcement, session followup and
+  auto-resume, and the full static effort enum through `ultra`. The `muse`
+  binary accepts unknown model IDs silently, so Delegate records no
+  served-model claim for Muse runs.
+
+### Fixed
+- The test runner (`scripts/test.py`) no longer aborts on hosts where
+  lowering its own priority with `os.nice` is not permitted (sandboxed
+  agent harnesses); it warns and continues under the worker caps.
+
 ## [0.32.0] - 2026-10-01
 
 This release adds controls for launching and managing agents and resuming
@@ -2570,7 +2589,8 @@ Usage-audit fix wave: 82 sessions and 1,241 delegate invocations from one week o
 
 - Releases before 0.1.3 predate this changelog.
 
-[Unreleased]: https://github.com/treygoff24/delegate-agent/compare/v0.32.0...HEAD
+[Unreleased]: https://github.com/treygoff24/delegate-agent/compare/v0.33.0...HEAD
+[0.33.0]: https://github.com/treygoff24/delegate-agent/compare/v0.32.0...v0.33.0
 [0.32.0]: https://github.com/treygoff24/delegate-agent/compare/v0.31.0...v0.32.0
 [0.31.0]: https://github.com/treygoff24/delegate-agent/compare/v0.29.1...v0.31.0
 [0.30.0]: https://github.com/treygoff24/delegate-agent/compare/v0.29.1...v0.30.0

{delegate_agent_cli-0.32.0 → delegate_agent_cli-0.33.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: delegate-agent-cli
-Version: 0.32.0
+Version: 0.33.0
 Summary: A tiny CLI for delegating bounded agent tasks across coding-agent runtimes.
 Author: Trey Goff
 License-Expression: MIT
@@ -41,7 +41,7 @@ Dynamic: license-file
 
 # Delegate Agent
 
-Delegate Agent is a small CLI for handing a bounded task to another coding-agent runtime. It normalizes common calls to Cursor Agent, Factory Droid, OpenAI Codex, Claude Code, Grok Build, Devin, OpenCode, Pi, Oh My Pi, and Kimi Code so humans or other agents can launch review, investigation, and implementation jobs without remembering each tool's flags.
+Delegate Agent is a small CLI for handing a bounded task to another coding-agent runtime. It normalizes common calls to Cursor Agent, Factory Droid, OpenAI Codex, Claude Code, Grok Build, Devin, OpenCode, Pi, Oh My Pi, Kimi Code, and Muse so humans or other agents can launch review, investigation, and implementation jobs without remembering each tool's flags.
 
 Use it when you want a predictable wrapper around prompts like:
 
@@ -52,7 +52,7 @@ Use it when you want a predictable wrapper around prompts like:
 Delegate does **not** commit, push, merge, deploy, publish, or run a background service. It builds the child command, adds safety framing, launches the selected runtime, and records local run metadata for later inspection.
 
 Prompt handling is provider-specific: Codex, Claude, OpenCode, Pi, Cursor Agent, and Oh My Pi
-prompts are delivered to the child runtime over stdin; Droid, Grok, and Devin prompts
+prompts are delivered to the child runtime over stdin; Droid, Grok, Devin, and Muse prompts
 are delivered through private temporary prompt files; Kimi Code is the only Harness
 that still requires prompt argv, and the only one whose prompt Delegate redacts in
 dry-run output and run manifests. Redaction hides the prompt from Delegate's own
@@ -129,6 +129,7 @@ command -v opencode # OpenCode CLI, used by delegate opencode ...
 command -v pi      # Pi coding agent, used by delegate pi ...
 command -v omp     # Oh My Pi, used by delegate omp ...
 command -v kimi    # Kimi Code CLI, used by delegate kimi ...
+command -v muse    # Muse (Meta), used by delegate muse ...
 ```
 
 Supported modes:
@@ -145,6 +146,7 @@ Supported modes:
 | Pi | `pi` | Yes | Yes | Yes |
 | Oh My Pi | `omp` | Yes | Yes | Yes |
 | Kimi Code | `kimi` | Yes | Yes | Yes |
+| Muse | `muse` | Yes | Yes | Yes |
 
 Devin `safe` is rejected because Delegate cannot enforce a read-only filesystem
 survey through Devin's generic execution tool. See the
@@ -218,6 +220,7 @@ delegate --json dry-run claude safe "Review this repository. Do not edit files."
 delegate --json dry-run opencode safe "Review this repository. Do not edit files."
 delegate --json dry-run pi safe "Review this repository. Do not edit files."
 delegate --json dry-run omp safe "Review this repository. Do not edit files."
+delegate --json dry-run muse safe "Review this repository. Do not edit files."
 ```
 
 Run a read-only review in an isolated throwaway workspace:
@@ -280,12 +283,12 @@ $EDITOR /tmp/delegate-task.json
 delegate --json run --input-json /tmp/delegate-task.json
 ```
 
-For Codex or Claude fan-outs that must return machine-parseable records, add
+For Codex, Claude, or Muse fan-outs that must return machine-parseable records, add
 `--output-schema` (or JSON `outputSchema`); Delegate suppresses completion-report
 injection so the schema owns the final message. Codex schemas are
 strict-preflighted recursively: every property must be required, and a missing
 `additionalProperties: false` is supplied in a warned temporary copy without
-changing the source file.
+changing the source file. Muse schemas are enforced natively and the root object must set `additionalProperties: false`.
 
 For a one-hop prompt that should not see the current repo or create a tracked
 run, use stateless `call` mode:
@@ -327,7 +330,7 @@ It changes only the requested model thinking depth/cost/latency; it does not
 change safe/work/call mode, sandboxing, approvals, or edit capability.
 Codex/Droid validate exact model metadata, Cursor selects an explicit configured
 or corroborated discovered effort route, Claude and Grok map to native
-`--effort`, OpenCode validates discovered exact variants when present and
+`--effort`, Muse maps to `--reasoning-effort` (`none`…`ultra`), OpenCode validates discovered exact variants when present and
 otherwise warns on pass-through, and Pi/Oh My Pi map to `--thinking` with
 evidence-aware validation. Devin and Kimi do not expose a Delegate
 reasoning-effort flag. Explicit Codex effort can target the harness default model
@@ -490,7 +493,7 @@ non-ignored files from a dirty source checkout before launch, report the counts
 in a `dirty_source_auto_included` warning, and tear down the worktree if syncing
 fails. `--include-dirty` remains an explicit, harmless no-op on a clean source.
 
-Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/OpenCode/Pi/Oh My Pi/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
+Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/OpenCode/Pi/Oh My Pi/Kimi/Muse safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
 
 Snapshots and `run-output` redact common credential shapes by default, including authorization headers, bearer/basic tokens, JWT-like strings, and common `token=` / `api_key=` / `password=` values. Use `--no-redact` only when exact output is necessary and safe to display.
 

{delegate_agent_cli-0.32.0 → delegate_agent_cli-0.33.0}/README.md

@@ -4,7 +4,7 @@
 
 # Delegate Agent
 
-Delegate Agent is a small CLI for handing a bounded task to another coding-agent runtime. It normalizes common calls to Cursor Agent, Factory Droid, OpenAI Codex, Claude Code, Grok Build, Devin, OpenCode, Pi, Oh My Pi, and Kimi Code so humans or other agents can launch review, investigation, and implementation jobs without remembering each tool's flags.
+Delegate Agent is a small CLI for handing a bounded task to another coding-agent runtime. It normalizes common calls to Cursor Agent, Factory Droid, OpenAI Codex, Claude Code, Grok Build, Devin, OpenCode, Pi, Oh My Pi, Kimi Code, and Muse so humans or other agents can launch review, investigation, and implementation jobs without remembering each tool's flags.
 
 Use it when you want a predictable wrapper around prompts like:
 
@@ -15,7 +15,7 @@ Use it when you want a predictable wrapper around prompts like:
 Delegate does **not** commit, push, merge, deploy, publish, or run a background service. It builds the child command, adds safety framing, launches the selected runtime, and records local run metadata for later inspection.
 
 Prompt handling is provider-specific: Codex, Claude, OpenCode, Pi, Cursor Agent, and Oh My Pi
-prompts are delivered to the child runtime over stdin; Droid, Grok, and Devin prompts
+prompts are delivered to the child runtime over stdin; Droid, Grok, Devin, and Muse prompts
 are delivered through private temporary prompt files; Kimi Code is the only Harness
 that still requires prompt argv, and the only one whose prompt Delegate redacts in
 dry-run output and run manifests. Redaction hides the prompt from Delegate's own
@@ -92,6 +92,7 @@ command -v opencode # OpenCode CLI, used by delegate opencode ...
 command -v pi      # Pi coding agent, used by delegate pi ...
 command -v omp     # Oh My Pi, used by delegate omp ...
 command -v kimi    # Kimi Code CLI, used by delegate kimi ...
+command -v muse    # Muse (Meta), used by delegate muse ...
 ```
 
 Supported modes:
@@ -108,6 +109,7 @@ Supported modes:
 | Pi | `pi` | Yes | Yes | Yes |
 | Oh My Pi | `omp` | Yes | Yes | Yes |
 | Kimi Code | `kimi` | Yes | Yes | Yes |
+| Muse | `muse` | Yes | Yes | Yes |
 
 Devin `safe` is rejected because Delegate cannot enforce a read-only filesystem
 survey through Devin's generic execution tool. See the
@@ -181,6 +183,7 @@ delegate --json dry-run claude safe "Review this repository. Do not edit files."
 delegate --json dry-run opencode safe "Review this repository. Do not edit files."
 delegate --json dry-run pi safe "Review this repository. Do not edit files."
 delegate --json dry-run omp safe "Review this repository. Do not edit files."
+delegate --json dry-run muse safe "Review this repository. Do not edit files."
 ```
 
 Run a read-only review in an isolated throwaway workspace:
@@ -243,12 +246,12 @@ $EDITOR /tmp/delegate-task.json
 delegate --json run --input-json /tmp/delegate-task.json
 ```
 
-For Codex or Claude fan-outs that must return machine-parseable records, add
+For Codex, Claude, or Muse fan-outs that must return machine-parseable records, add
 `--output-schema` (or JSON `outputSchema`); Delegate suppresses completion-report
 injection so the schema owns the final message. Codex schemas are
 strict-preflighted recursively: every property must be required, and a missing
 `additionalProperties: false` is supplied in a warned temporary copy without
-changing the source file.
+changing the source file. Muse schemas are enforced natively and the root object must set `additionalProperties: false`.
 
 For a one-hop prompt that should not see the current repo or create a tracked
 run, use stateless `call` mode:
@@ -290,7 +293,7 @@ It changes only the requested model thinking depth/cost/latency; it does not
 change safe/work/call mode, sandboxing, approvals, or edit capability.
 Codex/Droid validate exact model metadata, Cursor selects an explicit configured
 or corroborated discovered effort route, Claude and Grok map to native
-`--effort`, OpenCode validates discovered exact variants when present and
+`--effort`, Muse maps to `--reasoning-effort` (`none`…`ultra`), OpenCode validates discovered exact variants when present and
 otherwise warns on pass-through, and Pi/Oh My Pi map to `--thinking` with
 evidence-aware validation. Devin and Kimi do not expose a Delegate
 reasoning-effort flag. Explicit Codex effort can target the harness default model
@@ -453,7 +456,7 @@ non-ignored files from a dirty source checkout before launch, report the counts
 in a `dirty_source_auto_included` warning, and tear down the worktree if syncing
 fails. `--include-dirty` remains an explicit, harmless no-op on a clean source.
 
-Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/OpenCode/Pi/Oh My Pi/Kimi safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
+Safe isolation and `--include-dirty` recreate an untracked symlink only when it is relative, resolves inside the source workspace, and its target is not gitignored; any symlink that fails those checks — an absolute target, an escape out of the tree, or a target that is itself a gitignored secret — is replaced with an inert placeholder file, failing closed on any ambiguity. Delegate reports a warning listing the symlink paths it blocked. In Git repositories with no commits yet, Cursor/Codex/Claude/Droid/Grok/OpenCode/Pi/Oh My Pi/Kimi/Muse safe isolation falls back to a directory copy because Git cannot create a detached worktree from an unborn `HEAD`.
 
 Snapshots and `run-output` redact common credential shapes by default, including authorization headers, bearer/basic tokens, JWT-like strings, and common `token=` / `api_key=` / `password=` values. Use `--no-redact` only when exact output is necessary and safe to display.
 

{delegate_agent_cli-0.32.0 → delegate_agent_cli-0.33.0}/config.example.json

@@ -121,6 +121,13 @@
     "defaultModel": "kimi-code/k3",
     "defaultReasoningEffort": null
   },
+  "muse": {
+    "binary": "muse",
+    "defaultModel": null,
+    "defaultReasoningEffort": null,
+    "resumable": true,
+    "models": {}
+  },
   "isolation": {
     "safe": "auto",
     "work": "none"

{delegate_agent_cli-0.32.0 → delegate_agent_cli-0.33.0}/docs/agent-setup.md

@@ -41,6 +41,7 @@ This guide covers both human setup and non-interactive setup for agents or CI jo
    command -v pi || echo "Pi coding agent missing"
    command -v omp || echo "Oh My Pi missing"
    command -v kimi || echo "Kimi Code CLI missing"
+   command -v muse || echo "Muse missing"
    ```
 
    Delegate does not manage runtime login. Run each runtime's own login/status command before real launches. A missing child binary causes Delegate to fail with exit code `3` for real runs.
@@ -140,7 +141,7 @@ and the [security model](security-model.md#zero-copy-safe-isolation-linux-isolat
    delegate --json dry-run kimi safe "Review only. Do not edit files."
    ```
 
-   The Codex, Claude, Grok, Devin work, OpenCode, Pi, Oh My Pi, Cursor, and Kimi dry-runs succeed with the unedited example config when no reasoning effort is requested. Devin safe mode is intentionally rejected because filesystem surveys may require generic `exec`, which cannot be allowed without weakening the read-only boundary. Explicit Codex reasoning-effort dry-runs can target the harness default model when no default model is configured. Claude and Grok reasoning effort map to native `--effort` flags; OpenCode maps to `--variant`; Pi and Oh My Pi map to `--thinking`. The Droid dry-run validates the alias, so it returns `unconfigured_model` until you replace the `reviewer` placeholder in `config.json` with a real model ID.
+   The Codex, Claude, Grok, Devin work, OpenCode, Pi, Oh My Pi, Cursor, Kimi, and Muse dry-runs succeed with the unedited example config when no reasoning effort is requested. Devin safe mode is intentionally rejected because filesystem surveys may require generic `exec`, which cannot be allowed without weakening the read-only boundary. Explicit Codex reasoning-effort dry-runs can target the harness default model when no default model is configured. Claude and Grok reasoning effort map to native `--effort` flags; Muse maps to `--reasoning-effort`; OpenCode maps to `--variant`; Pi and Oh My Pi map to `--thinking`. The Droid dry-run validates the alias, so it returns `unconfigured_model` until you replace the `reviewer` placeholder in `config.json` with a real model ID.
 
 ### OpenCode
 
@@ -223,6 +224,7 @@ For an orchestrating agent, script, or CI job:
    command -v pi >/dev/null || exit 3
    command -v omp >/dev/null || exit 3
    command -v kimi >/dev/null || exit 3
+   command -v muse >/dev/null || exit 3
    ```
 
 6. Keep prompts bounded and machine-readable where possible. For long tasks, use `--prompt-file` or `delegate --json run --input-json FILE`.
@@ -248,7 +250,7 @@ For an orchestrating agent, script, or CI job:
 ## CI expectations
 
 The required test suite does not need real Cursor, Droid, Codex, Claude, Grok,
-Devin, OpenCode, Pi, Oh My Pi, or Kimi binaries. Tests use dry-run paths and fake binaries
+Devin, OpenCode, Pi, Oh My Pi, Kimi, or Muse binaries. Tests use dry-run paths and fake binaries
 where needed:
 
 ```bash

{delegate_agent_cli-0.32.0 → delegate_agent_cli-0.33.0}/docs/cli-reference.md

@@ -227,13 +227,17 @@ delegate omp call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [
 delegate kimi safe [--model <alias-or-model>] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH | prompt...]
 delegate kimi work [--model <alias-or-model>] [--progress] [--timeout SECONDS] [--forbid-commit] [--prompt-file PATH | prompt...]
 delegate kimi call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--prompt-file PATH | prompt...]
+
+delegate muse safe [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--output-schema FILE] [--prompt-file PATH | prompt...]
+delegate muse work [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--output-schema FILE] [--prompt-file PATH | prompt...]
+delegate muse call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--output-schema FILE] [--prompt-file PATH | prompt...]
 ```
 
 Prompt sources are direct arguments, `--prompt-file`, or Delegate stdin; give exactly one (combining them fails with `ambiguous_prompt_source`). A relative `--prompt-file` resolves against the shell cwd first; if that file does not exist but one exists under `--cwd DIR`, that one is used and a warning says so. When neither exists the `prompt_file_not_found` error names both absolute paths tried. Raw C0 control characters other than newline, carriage return, and tab are stripped before launch; a prompt that becomes empty fails fast. After
 Delegate resolves the prompt, Codex, Claude, OpenCode, Pi, Cursor Agent, and Oh My Pi prompts are passed to
 the child runtime over stdin; Cursor Agent 2026.09.02-c22c1a3 and Oh My Pi 18.1.13 both consume a piped
-prompt in the verified non-interactive invocation. Droid and Grok prompts are written to a private temporary
-prompt file and passed with Droid's documented `--file` option or Grok's `--prompt-file`. Kimi Code prompt
+prompt in the verified non-interactive invocation. Droid, Grok, Devin, and Muse prompts are written to a private temporary
+prompt file and passed with Droid's documented `--file` option or the `--prompt-file` option Grok, Devin, and Muse accept. Kimi Code prompt
 mode still takes `--prompt`, so Kimi alone uses argv transport; Delegate redacts Kimi prompt argv in dry-run
 output and run manifests, which keeps the prompt out of Delegate's own records but not out of the child's
 `/proc/<pid>/cmdline`.
@@ -270,7 +274,7 @@ by hyphens and the index is the entry's position in Factory's settings. The
 older id-based selectors no longer resolve, so re-read `delegate models droid`
 and update any `droid.models` alias that pinned one. Discover aliases
 and advisory catalogs with `delegate models`, `delegate models <engine>`, and
-`delegate models <engine> --live`. Every harness except Claude exposes a live
+`delegate models <engine> --live`. Every harness except Claude and Muse exposes a live
 model probe; see [Discovery](#discovery) for the evidence each probe records.
 Each engine row carries `binaryMissing`, true when the configured binary does
 not resolve from the Delegate process; the text view prints `(missing)` after
@@ -292,7 +296,7 @@ same-family effort selector and records a warning. Without that exact family,
 an explicit effort fails closed; a configured default instead degrades with a
 warning and preserves the pinned selector. Droid emits
 `--reasoning-effort LEVEL`; Codex emits a `model_reasoning_effort` config
-override; Claude and Grok emit native `--effort`; OpenCode emits `--variant`
+override; Claude and Grok emit native `--effort`; Muse emits native `--reasoning-effort`; OpenCode emits `--variant`
 and validates it when exact discovered variants exist; Pi and Oh My Pi emit
 `--thinking`. Devin and Kimi expose no Delegate effort transport.
 
@@ -683,6 +687,31 @@ delegate kimi call "Summarize this context in three bullets."
 delegate --isolation worktree kimi work "Implement the feature in a persistent worktree."
 ```
 
+### `delegate muse`
+
+Wraps Muse's headless mode (Meta's Muse family models).
+
+```bash
+delegate [--json] [--isolation auto|none|worktree] muse {safe,work} [--model <alias-or-model>] [--reasoning-effort LEVEL] [--progress] [--timeout SECONDS] [--forbid-commit] [--output-schema FILE] [--prompt-file PATH | prompt...]
+delegate [--json] muse call [--read-only] [--timeout SECONDS] [--model <alias-or-model>] [--reasoning-effort LEVEL] [--output-schema FILE] [--prompt-file PATH | prompt...]
+```
+
+- Delegate launches `muse exec --json --workspace <dir>` and delivers the prompt with `--prompt-file`, so the prompt never appears in argv.
+- Safe mode and `call --read-only` add `--disable-write --disable-shell --disable-web-tools`, keep Muse's sandbox on, and leave the workspace untrusted (repo-local Muse skills do not load; verified against Muse 1.4.6). Safe reviewers use Muse's native read/search tools and have no shell, so they cannot run git or tests. User-level Muse configuration still loads; a user-configured MCP server's behavior under the safe flags is not yet probed.
+- Work mode adds `--trust-workspace` and keeps the sandbox on unless `policy.harness.muse.work.bypassApprovalsAndSandbox` is explicitly enabled. Delegate never emits `--yolo`.
+- `--reasoning-effort` maps directly to `--reasoning-effort`: `none`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`, `ultra`.
+- `--output-schema` uses Muse's native enforcement; the schema's root object must set `additionalProperties: false` or the launch is refused before the child starts.
+- The `muse` binary accepts unknown model IDs without error, so Delegate makes no served-model claim for Muse runs and a pinned run ends unverified. `delegate models muse` reports the bundled advisory list; there is no live enumeration.
+- Work runs keep their Muse session log by default, so `delegate followup` re-enters the session; `--no-resumable` or `muse.resumable: false` opts out. Run JSON reports usage as unavailable: the Muse exec stream carries no token-usage events.
+
+Examples:
+
+```bash
+delegate muse safe "Review this repo for regressions; report file/line/severity."
+delegate muse work --model muse-spark-1.3 "Implement the scoped task; report changed files and tests."
+delegate muse call --read-only --output-schema verdict.json --prompt-file rubric.md
+```
+
 ### `delegate workflow`
 
 Workflows run a Python DSL supervisor that can fan out normal Delegate child
@@ -995,7 +1024,7 @@ When a profile is active, dry-run and completion payloads add `authProfile`
 a fallback is configured. Dry-run also adds `profileEnv` (the injected env map,
 with values redacted). Profile metadata is omitted when no profile is active.
 
-For Cursor, Claude, Grok, OpenCode, Pi, Oh My Pi, Droid, and Kimi safe mode, an explicit `--isolation none`
+For Cursor, Claude, Grok, OpenCode, Pi, Oh My Pi, Droid, Kimi, and Muse safe mode, an explicit `--isolation none`
 is normalized to `auto` with a warning because those safe contracts depend on
 the temporary workspace/config boundary. Codex safe can use `none` because Codex
 still runs with its read-only sandbox.
@@ -1173,22 +1202,28 @@ Supported input keys:
 }
 ```
 
-- `engine`: `cursor`, `droid`, `codex`, `claude`, `grok`, `devin`, `opencode`, `pi`, `omp`, or `kimi`.
+- `engine`: `cursor`, `droid`, `codex`, `claude`, `grok`, `devin`, `opencode`, `pi`, `omp`, `kimi`, or `muse`.
 - `mode`: `safe`, `work`, or `call`.
 - The `devin` engine rejects `safe` with `unsupported_mode` during preflight. Devin filesystem surveys may require generic `exec`, which Delegate cannot allow without weakening the read-only boundary; use another safe Harness for filesystem review.
 - `model`: optional alias-or-id for every engine, resolved exactly like `--model`. A matching `<engine>.models` alias is expanded; other values pass through as raw model IDs.
 - `cwd`: optional workspace path. Git directories resolve to the repo root. Omit it for `mode: "call"`, which always uses an empty temporary cwd.
-- `isolation`: optional `auto`, `none`, or `worktree`. `null` is invalid. `mode: "call"` rejects isolation. For Cursor, Claude, Grok, OpenCode, Pi, Oh My Pi, Droid, and Kimi safe mode, `none` is normalized to `auto` with a warning.
+- `isolation`: optional `auto`, `none`, or `worktree`. `null` is invalid. `mode: "call"` rejects isolation. For Cursor, Claude, Grok, OpenCode, Pi, Oh My Pi, Droid, Kimi, and Muse safe mode, `none` is normalized to `auto` with a warning.
 - `reasoningEffort`: optional non-empty effort string. It overrides provider `defaultReasoningEffort` for that JSON run.
 - `fast`: optional Codex-only boolean or `null`. `true` requests Fast, `false` explicitly requests Standard, and `null`/omission inherits Codex configuration.
 - `progress`: optional boolean. `true` enables parent progress heartbeats on stderr; `false` disables them even when `progress.enabled` is true in config. When omitted, config `progress.enabled` applies (default `false`). `mode: "call"` rejects progress.
 - `forbidCommit`: optional boolean. `true` requires `mode: "work"`, makes commits fail inside the child through run-owned git hooks, and fails the run if the child creates commits (any isolation, including `none`; with isolation omitted it implies `worktree`). `mode: "call"` rejects commit policy.
 - `includeDirty`: optional boolean. `true` requires `mode: "work"` with persistent worktree isolation and syncs tracked edits plus untracked non-ignored files into the new worktree before launch.
 - `timeout`: optional positive integer seconds, with the same semantics as `--timeout`. Non-integer, boolean, or non-positive values fail with `invalid_timeout`; combining it with pass-through is rejected.
-- `outputSchema`: optional path to a JSON Schema for the final message. Supported for Codex and Claude in every mode (same semantics as `--output-schema`). Other engines fail with `unsupported_output_schema`.
+- `outputSchema`: optional path to a JSON Schema for the final message. Supported for Codex, Claude, and Muse in every mode (same semantics as `--output-schema`). Other engines fail with `unsupported_output_schema`.
 - `base`, `env`, `setup`: optional workspace spec for `mode: "work"` with `isolation: "worktree"`, the same as `--base`, `--env`, and `--setup`. `env` is an object of names to strings. See [Workspace spec](worktrees.md#workspace-spec-base-env-setup).
+- `mcpServers`: optional list of extra MCP servers mounted for this run only: `[{"name": "report", "command": "/path/to/server", "args": ["--stdio"], "env": {"KEY": "value"}}]`. `name` is letters, digits, `_` or `-` and unique; `args` and `env` are optional. Codex receives them as global `-c mcp_servers.<name>.command/args/env_vars` overrides right after the executable; these show in dry-run and manifest argv. `env` values never go into process arguments: they are set in the run's environment and listed by name in the server's `env_vars` allowlist. Env names must be valid variable names, and a name given in two servers must have the same value. Other engines have no per-invocation MCP config: the run proceeds without them and its result carries a `mcpServers not mounted` warning.
 - `prompt`: required task prompt.
 
+Every engine process runs non-interactively: Delegate sets `GIT_EDITOR`,
+`GIT_SEQUENCE_EDITOR`, `EDITOR` and `VISUAL` to `true`, `GIT_TERMINAL_PROMPT=0`,
+and `PAGER`/`GIT_PAGER` to `cat`, over profile and ambient values, so a
+`git commit` without `-m` or a pager cannot hang a run whose stdin is closed.
+
 `profile` is not accepted in run input JSON. Configure the Codex CLI config
 overlay in `codex.profile` instead. That is separate from the top-level
 `profiles` block, which Delegate resolves once per request and injects as
@@ -1221,13 +1256,13 @@ argv shapes, and expanded command options. Use `help <command>` when only one
 command's contract is needed.
 
 `models` reports configured settings and cached discovery for Cursor, Droid,
-Codex, Kimi, Claude, Grok, Devin, OpenCode, Pi, and Oh My Pi. A per-engine
+Codex, Kimi, Claude, Grok, Devin, OpenCode, Pi, Oh My Pi, and Muse. A per-engine
 catalog merges sources in this order: explicit config, current live or
 profile-scoped discovery, the legacy workspace reasoning cache, then bundled
 advisory IDs. `models <engine> --live` runs one fresh probe in the selected
 profile environment, but does not update Delegate config or cache. Use setup or
 `capabilities refresh` when ordinary launches should consume the new record.
-Claude is the only harness without a non-interactive live model catalog.
+Claude and Muse are the only harnesses without a non-interactive live model catalog.
 
 A harness with `<engine>.enabled: false` in config (for example
 `"cursor": {"enabled": false}`) is omitted from `models`, `describe`,
@@ -1261,6 +1296,7 @@ Automatic setup and refresh use these evidence sources:
 | Devin | Family slugs, aliases, and concrete variants visible to the active account | The prompt-free JSON catalog carries display names; Delegate has no Devin effort transport. |
 | OpenCode | Harness catalog | Listed variants are `exact` for that model; models without exact variant evidence retain the documented unvalidated pass-through path. |
 | Pi | Harness catalog | Thinking support is model-specific, but available labels come from a harness-wide enum and are reported as partial model evidence. |
+| Muse | Bundled advisory list; no live enumeration | Static `--reasoning-effort` enum (`none`…`ultra`) from the binary's documented values. |
 | Oh My Pi | Harness catalog | A model's explicit `thinking` array is exact; missing arrays use harness-partial compatibility rather than fabricated model evidence. |
 
 `modelScope`/`catalogScope` describes where a list came from, not whether a real
@@ -1494,7 +1530,7 @@ creating a Run or writing a prompt record.
 | --- | --- | --- | --- | --- |
 | Engine | `engine`, falling back to `harness` | `--engine` | A missing or unknown source engine refuses resume. | The selected engine becomes the target; engine-scoped fields below may drop. |
 | Mode | `mode` | None; v1 does not override mode. | A missing or invalid mode refuses resume. | Retained unchanged. |
-| Native session | `resumable` | `--no-resumable` | A source recorded as exactly `true` keeps it. Any other source takes the launch default: Codex and Claude work Runs save their session unless `--no-resumable` or `codex.resumable` / `claude.resumable: false` opts out. | Kept only for Codex or Claude work Runs; otherwise dropped with a note advising continuation with `delegate resume`. |
+| Native session | `resumable` | `--no-resumable` | A source recorded as exactly `true` keeps it. Any other source takes the launch default: Codex, Claude, and Muse work Runs save their session unless `--no-resumable` or `codex.resumable` / `claude.resumable` / `muse.resumable: false` opts out. | Kept only for Codex, Claude, or Muse work Runs; otherwise dropped with a note advising continuation with `delegate resume`. |
 | Model selection | `modelAlias`, then `modelRequested`, `modelResolved`, then `model` | `--model` | No usable key uses the target engine configuration default and emits a note. | Source model selection drops; pass `--model` to pin a target model. |
 | Reasoning effort | `requestedReasoningEffort`, then `resolvedReasoningEffort`, together with `reasoningEffortSource` | `--reasoning-effort` | Missing effort uses the target default and emits a note. A source value from configuration is re-resolved through target capability/configuration; only `cli` and `input-json` source intent is inherited directly. | Source effort drops with a note; an explicit override remains valid. |
 | Fast tier | `requestedFast` | `--fast` or `--no-fast` | Omitted leaves fast unspecified. | Inherited only for a same-engine Codex resume. Other targets drop it; non-Codex targets emit a drop note when a source value is present. |
@@ -1502,7 +1538,7 @@ creating a Run or writing a prompt record.
 | Timeout | `timeoutSeconds` | `--timeout` | Omitted uses the target timeout default and emits a note. A present value must be a positive integer (an integral JSON float is accepted). | Retained. |
 | Stall threshold | `stallMinutes`, written only when the source launch passed `--stall-minutes` | None | Omitted means the source ran on the configured default, so the resumed Run re-resolves `stallMinutes` config, `DELEGATE_STALL_MINUTES`, and the engine default with no note. A present value must be a finite number >= 0 (0 disables); anything else refuses resume. `delegate followup` inherits it the same way and ignores an invalid value. | Retained; an inherited value is an explicit operator threshold, honored on every engine. |
 | Tracked stream limit | `trackedStreamMaxBytes` (`null` when uncapped, the default) | None | Launch provenance only: the resumed Run re-resolves the limit from the target engine configuration and does not inherit the recorded value. | Not inherited. |
-| Output schema | Inline `outputSchema` text | `--output-schema PATH` or `--no-output-schema` | Omitted means no schema. Stored text is re-materialized privately only during normal launch. | Codex and Claude inherit inline schema text. Other engines soft-drop it with a note before output-schema validation. |
+| Output schema | Inline `outputSchema` text | `--output-schema PATH` or `--no-output-schema` | Omitted means no schema. Stored text is re-materialized privately only during normal launch. | Codex, Claude, and Muse inherit inline schema text. Other engines soft-drop it with a note before output-schema validation. |
 | OpenCode agent | `agent` | None | Omitted means no agent selection. | Inherited only for a same-engine OpenCode resume; otherwise dropped with a note. |
 | Workspace cwd / execution cwd | `cwd`; persistent records also derive `executionCwd`, branch, and source Git root | None (`--cwd` selects the registry workspace and must match recorded `cwd`) | Missing `cwd` falls back to the selected registry workspace; missing persistent-worktree metadata causes attachment validation to refuse. | Retained as workspace context; an attach uses the validated existing worktree rather than copying `executionCwd` into a new worktree. |
 | Isolation / lifecycle | `isolationMode`; persistent detection also reads `isolationLifecycle`, `preservedWorkspace`, `worktreeStatus`, and `worktreeAttachment` | None; `--isolation` is rejected for resume. | Missing ordinary `isolationMode` uses target isolation configuration and emits a note. | Retained. Persistent or attached sources become an `attached` execution lifecycle. |
@@ -1518,16 +1554,16 @@ creating a Run or writing a prompt record.
 delegate followup [--timeout SEC] [--prompt-file PATH] [--mail-push|--no-mail-push] [--dry-run] <alias|runId> [prompt...]
 ```
 
-`delegate followup` continues a Codex or Claude Run by resuming its saved native
+`delegate followup` continues a Codex, Claude, or Muse Run by resuming its saved native
 session, so the child keeps its own conversation context. (`resume` instead
 relaunches from the original prompt and a report digest, and works across
 engines.)
 
-- **Launch default.** Codex and Claude work Runs save their native session by
+- **Launch default.** Codex, Claude, and Muse work Runs save their native session by
   default, so `followup` works without `--resumable` at launch. Launch with
   `--no-resumable` (JSON `resumable: false`), or set `codex.resumable` /
-  `claude.resumable` to `false`, to skip it; `--resumable` on a launch beats the
-  config key. Safe Runs, call Runs, and engines other than Codex and Claude never
+  `claude.resumable` / `muse.resumable` to `false`, to skip it; `--resumable` on a launch beats the
+  config key. Safe Runs, call Runs, and engines other than Codex, Claude, and Muse never
   save a session. See [Configuration](configuration.md#native-session-files-and-the-resumable-default)
   for the storage consequence.
 - **No session recorded.** A source with no recorded session (launched with

{delegate_agent_cli-0.32.0 → delegate_agent_cli-0.33.0}/docs/configuration.md

@@ -252,6 +252,12 @@ is absent.
     "defaultModel": "kimi-code/k3",
     "defaultReasoningEffort": null
   },
+  "muse": {
+    "binary": "muse",
+    "defaultModel": null,
+    "defaultReasoningEffort": null,
+    "models": {}
+  },
   "workflows": {
     "engineCaps": {},
     "itemThreads": 64,
@@ -556,13 +562,14 @@ different. Delegate warns when:
 
 #### Native session files and the resumable default
 
-Codex and Claude **work** Runs are resumable by default. A resumable Run leaves
+Codex, Claude, and Muse **work** Runs are resumable by default. A resumable Run leaves
 the harness's own session on disk (Codex's rollout under `CODEX_HOME/sessions`,
-Claude Code's transcript under its `projects` directory) and records the session
+Claude Code's transcript under its `projects` directory, Muse's session log under
+`~/.local/share/muse/sessions`) and records the session
 id in the Run's manifest, which is what `delegate followup` resumes. What that
 means in practice:
 
-- **Storage.** Native session files now persist for every Codex and Claude work
+- **Storage.** Native session files now persist for every Codex, Claude, and Muse work
   Run, not only Runs launched with `--resumable`. They hold the prompt, the
   child's output, and its tool results in the harness's own store, outside
   `.delegate/` and outside Delegate's redaction and `runs prune`. Delegate does
@@ -574,7 +581,7 @@ means in practice:
 - **Precedence.** The default beats `codex.ephemeral: true` and
   `claude.noSessionPersistence: true`. Those keys only apply to Runs that are not
   resumable. Opt out per launch with `--no-resumable` (JSON `resumable: false`),
-  or per engine with `codex.resumable: false` / `claude.resumable: false`. A launch
+  or per engine with `codex.resumable: false` / `claude.resumable: false` / `muse.resumable: false`. A launch
   that says `--resumable` beats the engine key.
 - **Unchanged.** Safe and call Runs, `--pass-through` Runs, and every other
   engine stay ephemeral, and `--no-resumable` is a quiet no-op there.
@@ -733,7 +740,7 @@ provider, including configured custom or local providers.
 { "droid": { "enabled": false } }
 ```
 
-- Every engine block (`cursor`, `droid`, `codex`, `kimi`, `claude`, `grok`, `devin`, `opencode`, `pi`, `omp`) accepts an optional boolean `enabled`, default `true`. A non-boolean value fails config load with `invalid_<engine>_config`.
+- Every engine block (`cursor`, `droid`, `codex`, `kimi`, `claude`, `grok`, `devin`, `opencode`, `pi`, `omp`, `muse`) accepts an optional boolean `enabled`, default `true`. A non-boolean value fails config load with `invalid_<engine>_config`.
 - `enabled: false` removes the harness from `delegate models`, `describe`, and `capabilities` listings (JSON and text), skips it in `capabilities refresh`, and makes every launch of it (and `delegate models <name>`) fail fast with `harness_disabled` naming `<engine>.enabled`. Static help text and the `describe` overview still mention the harness. Use it to retire a harness whose binary is still on `PATH`.
 
 ### `omp`
@@ -761,26 +768,28 @@ provider, including configured custom or local providers.
 - Every mode uses `--no-session`. Safe mode and `call --read-only` allow only `read`, disable extensions, skills, rules, and LSP discovery, and add `--approval-mode always-ask` as the load-bearing write/exec denial in headless mode.
 - Delegate does not consume `modelRoles` and never emits `--smol`, `--slow`, `--plan`, `--prewalk*`, or `--plan-yolo*`.
 - `delegate models omp --live` probes `omp models --json --no-extensions` without reading or printing provider credentials.
+- Delegate launches every OMP run with a private `--config` overlay that sets
+  `tools.outputMaxColumns` to `8000`. The overlay beats your `config.yml`;
+  dry-run and full describe argv show it as `--config <omp config overlay>`.
 - A `provider/model-id` you type yourself (`--model`, input-JSON `model`, or a
   literal `agent(model=...)` in a workflow) is pinned by default: the run behaves
   as `--continuity-mode pinned`. A delegate alias (a key of `omp.models`) and
   `defaultModel` stay `fungible` even though their targets name a provider, so
   aliases keep multi-subscription failover; the run still records and warns
   about which provider answered, and `--continuity-mode pinned` on an alias pins
-  it. Delegate launches a pinned OMP run with a private `--config` overlay that sets
+  it. For pinned runs, the overlay also sets
   `retry.modelFallback` and `retry.usageAwareFallback` to `false`, so OMP's own
   retry chains (`retry.fallbackChains`) cannot move the run to another model or
-  provider. Retrying the same model is unaffected. The overlay beats your
-  `config.yml`; the dry-run argv shows it as `--config <omp config overlay>`.
+  provider. Retrying the same model is unaffected.
   If a different provider or model is served anyway, the run fails
   (`model_continuity_paused`) with a message naming what OMP tried to serve,
   for example `requested opencode-go/glm-5.3, but omp tried to serve
   fireworks/glm-5p3`.
 - Naming `--continuity-mode fungible` or `panel` is the opt-in to failover: the
-  overlay is not sent, OMP may fail over, and a served model that differs from
-  the request is recorded as a `model_substitution` warning that names the
-  served provider. A run with no model, or with a bare model ID, is `fungible`
-  unless you name a mode.
+  overlay omits the pinned-only retry settings, so OMP may fail over. A served
+  model that differs from the request is recorded as a `model_substitution`
+  warning that names the served provider. A run with no model, or with a bare
+  model ID, is `fungible` unless you name a mode.
 - Use the full `provider/model-id` selector, including the provider even when the
   model ID itself contains `/`. OMP reports provider and model separately;
   Delegate compares their exact combined identity. A slash-free bare model ID
@@ -797,6 +806,30 @@ provider, including configured custom or local providers.
   selectors. With no catalog the run proceeds with a warning; run
   `delegate capabilities refresh` so bare names can be checked.
 
+### `muse`
+
+```json
+{
+  "muse": {
+    "binary": "muse",
+    "defaultModel": null,
+    "defaultReasoningEffort": null,
+    "resumable": true,
+    "models": {
+      "reviewer": "replace-with-muse-model-id"
+    }
+  }
+}
+```
+
+- `binary`: path to the Muse executable.
+- `defaultModel`: optional Muse model ID (for example a `muse-spark` or `muse-wonder` ID from `delegate models muse`). `null` preserves Muse's configured default. The binary accepts unknown IDs without error, so Delegate cannot verify which model served a run.
+- `defaultReasoningEffort`: optional `none`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`, or `ultra` default, emitted as `--reasoning-effort`.
+- `resumable`: work Runs keep their Muse session log so `delegate followup` works; `false` (or per-run `--no-resumable`) launches with `--no-session-log`.
+- `trackedStreamMaxBytes`: retained-stream byte cap for tracked runs. Off by default (`null`): nothing is truncated, hidden from the parser, or killed for being verbose, and `stdout.log` keeps the whole stream. Set a positive integer to opt in; a Run that then exceeds it is stopped as `output_limit_exceeded` with its partial output kept in the completion report. Only an opted-in cap applies the OMP 256 MiB transport and 16 MiB per-record ceilings, which are not configurable.
+- `models`: optional alias map from local names to Muse model IDs.
+- Safe mode and `call --read-only` pass `--disable-write --disable-shell --disable-web-tools` with Muse's sandbox on and the workspace untrusted. Work mode trusts the workspace; `--disable-sandbox` is emitted only under the explicit harness policy bypass.
+
 ### `reasoning`
 
 ```json
@@ -875,7 +908,7 @@ Supported boolean policy keys: `networkAccess`, `webSearch`, `bypassApprovalsAnd
 ```
 
 Allowed values are `auto`, `none`, and `worktree`. For Cursor, Claude, Grok,
-OpenCode, Pi, Oh My Pi, Droid, and Kimi safe mode, an effective value of `none` is normalized to `auto`
+OpenCode, Pi, Oh My Pi, Droid, Kimi, and Muse safe mode, an effective value of `none` is normalized to `auto`
 because those safe contracts depend on Delegate's temporary workspace/config
 boundary. Explicit per-run CLI/JSON `none` requests also emit a warning; a
 config default is normalized without a separate per-run warning. Codex safe can
@@ -883,7 +916,7 @@ use `none` because the Codex read-only sandbox remains active.
 
 Embedded defaults:
 
-- `safe`: `auto`. Cursor, Claude, Grok, OpenCode, Pi, Oh My Pi, Droid, Codex, and Kimi safe use temporary workspace isolation by default. Devin safe is unsupported.
+- `safe`: `auto`. Cursor, Claude, Grok, OpenCode, Pi, Oh My Pi, Droid, Codex, Kimi, and Muse safe use temporary workspace isolation by default. Devin safe is unsupported.
 - `work`: `none`. Work mode runs in the real workspace unless you opt into worktree isolation.
 
 #### `isolation.safeBackend` and `isolation.bwrapBinds` (Linux)

{delegate_agent_cli-0.32.0 → delegate_agent_cli-0.33.0}/docs/development.md

@@ -51,7 +51,7 @@ HOME="$clean_home" DELEGATE_CONFIG="$PWD/config.example.json" python3 bin/delega
 ```
 
 Droid real runs require non-placeholder model IDs. Dry-runs for Cursor, Droid,
-Codex, Claude, Grok, Devin, OpenCode, Pi, Oh My Pi, and Kimi do not require
+Codex, Claude, Grok, Devin, OpenCode, Pi, Oh My Pi, Kimi, and Muse do not require
 child binaries. Engine event tests use captured fixtures under
 `tests/fixtures/`.
 
@@ -101,4 +101,4 @@ installs a private HOME/temp environment, and strips ambient env.
 `tests/` is never collected and never runs.
 
 Required CI does not need real Cursor, Droid, Codex, Claude, Grok, Devin,
-OpenCode, Pi, Oh My Pi, or Kimi binaries.
+OpenCode, Pi, Oh My Pi, Kimi, or Muse binaries.