feat: v4.45.0 — xagent skill: delegate subtasks to external agentic CLIs (opencode/GLM, Codex, custom)

[sadewadee]

Summary

Adds skills/xagent/ — a manual-invoke skill (/dev-squad:xagent) that delegates a self-contained subtask to an external agentic CLI instead of a Claude subagent.

Two uses:

• review mode (read-only) — cross-model second opinion / fresh-eyes debugging. Different model (GLM, Codex) catches blind-spot bugs.
• implement mode (write in isolated worktree) — offload mechanical grunt work to cheaper GLM quota via opencode, saving Anthropic subscription budget.

Backends (config-driven): opencode + GLM (already authed on the maintainer's machine via Z.AI/Zhipu), OpenAI Codex (codex exec), and a custom command slot for any other CLI. No config = auto-detect (opencode > codex).

Safety model (the reason worktrees are mandatory)

dev-squad's protections — guard-dangerous-ops, guard-unsafe-code, auto-lint, check-component-reuse, observe-learning — are all PreToolUse/PostToolUse hooks, blind to an external subprocess. So the worker is never pointed at the live tree:

• Always runs inside an isolated git worktree.
• review discards the worktree (any stray edits die with it — live tree untouched).
• implement keeps the worktree, prints the diff + branch + merge steps; the in-session agent reviews and re-applies/merges (where the hooks do fire). No blind-merge.

Adversarial verification (per feedback_adversarial_verify_safety_hooks)

Tested in a scratch git repo. Found + fixed one real bug: custom-command placeholder substitution was not space-safe (worktree path contains a space). Now both {DIR} and {PROMPT} substitute as quoted env-var references — injection-safe (task text stays data, never re-parsed as shell) and space-safe. Verified:

• Command injection via --task (;, \$(...), backticks) — task reaches worker as literal data, no execution
• Command injection via custom template — env-var isolation holds
• Space-in-path worktree — worker runs correctly
• Not a git repo / bad mode / missing task — refuses with clear error
• Worker non-zero exit — worktree + branch cleaned up
• review mode — worktree discarded even when worker writes
• Live tree never modified in any mode
• Empty result / profile-not-found / malformed config JSON — clear errors, no crash

Files

• skills/xagent/SKILL.md — entrypoint, flow, when-not-to-use
• skills/xagent/scripts/xagent.sh — runner (tool resolution, worktree isolation, diff, cleanup)
• skills/xagent/xagent.example.json — GLM/opencode + codex + custom profiles
• CLAUDE.md skills section; version 4.43.0 → 4.45.0

Note on versioning

Branched off main. Open PR #30 (auto-intent-routing) claims 4.44.0, so this claims 4.45.0 to avoid a tag collision — assumes #30 merges first. If #30 is abandoned, re-tag this as 4.44.0 before tagging. Both PRs edit the version line in plugin.json/marketplace.json, so whichever merges second needs a trivial rebase.

Test plan (live)

• Install into a Claude Code session, run /dev-squad:xagent --mode review against a real file with the glm profile and confirm findings stream back + worktree is discarded
• Run --mode implement and confirm the diff prints and the worktree/branch are created for review

[sadewadee]

Update: User Consent Gate Added (Commit c61df43)

Per user request ("xagent wajib askquestion ya, jadi biar user decide"), added mandatory Step 0 to skills/xagent/SKILL.md:

Before running xagent.sh for ANY task, the agent MUST ask the user via AskUserQuestion which tool profile to use (or cancel).

• Interactive mode: User chooses GLM (opencode), Codex, Custom, or Cancel
• Auto-mode: Agent infers default (opencode if available, else codex, else custom, else cancel) and logs assumption to .dev-squad/assumption-ledger.md

This ensures the user always decides whether to delegate to an external worker — the agent does not unilaterally dispatch it. Safety backstop: auto-guard.sh blocks AskUserQuestion in auto-mode anyway, forcing inference + ledger logging.