---
name: cli-delegation
description: "Delegate work to an external CLI coding agent — have Codex, Claude Code, or Cursor implement, refactor, analyze, research, or review something on its own. Triggers: 'have Codex/Claude Code/Cursor implement X', 'delegate this to a CLI agent', 'ask another agent to review my changes', 'get a second opinion from a different model', 'fan out these subtasks to parallel agents', 'Codex/cursor-agent auth or setup is failing'. Covers claude -p, codex exec/review, and cursor-agent: scope the task, pick the CLI and model (cursor-agent for cross-provider second opinions), run read-only by default, verify the output before trusting it. Do NOT use for auditing a codebase or a CLI's UX yourself, hardening a repo for coding agents, designing a new CLI/SDK, or ordinary in-session coding with no delegation or different-model signal."
license: MIT
---

# CLI Delegation

Hand well-scoped tasks to an external CLI agent — Claude Code (`claude -p`),
Codex (`codex exec` / `codex review`), or Cursor (`cursor-agent -p`) — and
treat every result as a proposal, not truth. Delegation is encouraged: fan out
parallel invocations for independent subtasks, then verify each return
yourself.

## Workflow

1. **Scope.** One objective per invocation: inputs, constraints, and the exact
   output wanted (a diff, findings, an answer). Brief it like a new hire — no
   context carries over.
2. **Pick the CLI + model.** Claude Code for depth (`--effort high` on hard
   reasoning); Codex for native diff review (`codex review`); Cursor for model
   diversity — its multi-provider `--model` (gpt-5, sonnet-4, …) puts a second
   opinion on a *different* model than wrote the code. Fast/cheap models for
   mechanical subtasks. Gotchas:
   [`references/claude-code.md`](./references/claude-code.md),
   [`references/codex.md`](./references/codex.md),
   [`references/cursor.md`](./references/cursor.md).
3. **Execute read-only.** `claude --permission-mode plan` /
   `codex --sandbox read-only` / `cursor-agent --mode plan`. Widen write access
   only when the task must edit, explicitly and scoped; never pass a
   `--dangerously-*` / `--yolo` / force bypass without the user's explicit
   approval. To fan out, run N invocations concurrently (`&` + `wait`), one
   objective each.
4. **Verify.** Reconcile every claim against local files, run tests,
   spot-check diffs; discard findings that contradict the actual code.

## Invariants

- **Verify-before-trust:** never trust unreviewed delegated work — a delegated
  result gets used or relayed only after it's checked against local evidence.
- **Volatile flags:** CLI flags drift between releases — verify against
  `--help` at run time; the references carry gotchas, not flag tables.
- **Secrets:** scan diffs/files for credentials before piping them out; if risk
  is unclear, don't pipe — surface the path and why it's suspected (never the raw
  value) and get explicit sign-off.
- **Bound every run:** turn caps (e.g. `--max-turns` 3–10), timeouts, fan-out
  width of a handful, not hundreds.

## Stop conditions

- Done when delegated output is verified and reconciled — report what you
  accepted, rejected, or left open.
- Delegate CLI missing, unauthenticated, or untrusted: report the exact
  blocker (`codex doctor` / `scripts/codex-doctor-check.sh` for Codex); never
  silently fall back to another provider.
- Two failed attempts on one invocation blocker → stop; report the failing
  command and its last error, and ask how to proceed — don't retry blind.
- Run to completion; ask only on genuine blockers (missing scope, secret risk,
  write access needed).