mixdog 0.9.149 → 0.9.150

package/README.md

@@ -152,14 +152,13 @@ npm run dev
 
 Controlled single-model runs on the same 89 tasks produced:
 
-- **78/89** with Claude Opus 5 vs Claude Code's **77/89**
-- **75/89** with GPT-5.6 Sol xhigh, matching Codex CLI
-- **1.43×** faster vs Claude Code and **1.27×** faster vs Codex CLI
-- **40–47%** smaller median final context
-- **29%** lower priced cost vs Claude Code and at least **39.7%** lower vs
-  Codex CLI
-
-These are self-reported single runs (`k=1`, 2026-08), not leaderboard
+- **82/89** with Claude Opus 5 vs Claude Code's **77/89**
+- **79/89** with GPT-5.6 Sol xhigh vs Codex CLI's **75/89**
+- **1.21×** faster vs Claude Code and **1.15×** faster vs Codex CLI
+- **31–47%** smaller median final context
+- **16%** lower priced cost vs Claude Code and **41%** lower vs Codex CLI
+
+These are self-reported single runs (`k=1`, 2026-08-23), not leaderboard
 submissions. Raw artifacts, commands, comparison charts, and metric scripts
 live under [`benchmarks/terminal-bench-2.1/`](benchmarks/terminal-bench-2.1/).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.149",
+  "version": "0.9.150",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",

package/src/headless-exec.mjs

@@ -672,7 +672,10 @@ export async function runHeadlessExec({
       approvalMode: 'implicit',
       disallowDelegation: true,
       autoWakeCompletions: false,
-      initialConfig: boundary.loadConfig(),
+      initialConfig: {
+        ...boundary.loadConfig(),
+        workflow: { active: 'headless' },
+      },
     });
     if (lifecycle && !clean(runtime?.id) && typeof runtime?.reserveSessionId === 'function') {
       runtime.reserveSessionId(lifecycle.threadId);
@@ -689,6 +692,25 @@ export async function runHeadlessExec({
         },
       );
     }
+    // Rewrite the usage snapshot after every model response, not only on the
+    // way out. A session killed mid-run — agent timeout, SIGKILL — never
+    // reaches the exit path, and used to leave no usage document at all while
+    // its token spend was already real. The file is a few hundred bytes and
+    // the write is atomic, so the cost is negligible and a live run stays
+    // readable from outside.
+    const flushUsageDocument = () => {
+      try {
+        writeUsageDocument(
+          usageLogPath,
+          stats,
+          runtime,
+          lifecycle?.toolCallCount || 0,
+          observedModels,
+        );
+      } catch {
+        // Telemetry must never break the session; the exit path reports.
+      }
+    };
     const askOptions = {
       onTextReset: () => true,
       onUsageDelta: (delta) => {
@@ -696,6 +718,7 @@ export async function runHeadlessExec({
         if (observedModel) observedModels.add(observedModel);
         applyUsageDelta(stats, delta);
         lifecycle?.onUsageDelta(delta);
+        flushUsageDocument();
       },
       ...(lifecycle ? {
         onProviderSendStarted: () => lifecycle.onProviderSendStarted(),

package/src/headless-exec.test.mjs

@@ -119,6 +119,7 @@ test('headless exec runs one implicit-approval session and waits for tracked tas
     assert.deepEqual(errors, []);
     assert.equal(runtimeOptions[0].approvalMode, 'implicit');
     assert.equal(runtimeOptions[0].disallowDelegation, true);
+    assert.deepEqual(runtimeOptions[0].initialConfig.workflow, { active: 'headless' });
     assert.equal(runtimeOptions[0].autoWakeCompletions, false);
     assert.equal(runtimeOptions[0].toolMode, 'full');
     assert.deepEqual(activeScopes[0], {
@@ -142,6 +143,65 @@ test('headless exec runs one implicit-approval session and waits for tracked tas
   }
 });
 
+test('headless exec flushes the usage snapshot mid-session, before any exit path', async () => {
+  const root = mkdtempSync(join(tmpdir(), 'mixdog-headless-usage-flush-test-'));
+  const usageLogPath = join(root, 'usage.json');
+  // What a killed run would have left behind: read the file while `ask` is
+  // still running. Before the per-response flush this was always absent, so
+  // an agent-timeout trial reported no token spend at all.
+  let midSession = null;
+  try {
+    const code = await runHeadlessExec({
+      message: 'fix it',
+      provider: 'openai-oauth',
+      model: 'gpt-test',
+      effort: 'high',
+      fast: true,
+      usageLogPath,
+      idlePollMs: 1,
+      write: () => {},
+      writeErr: () => {},
+      boundaryFactory: () => ({
+        loadConfig: () => ({ providers: { 'openai-oauth': { enabled: true } } }),
+        cleanup: () => {},
+      }),
+      runtimeFactory: async () => ({
+        id: 'sess_flush_test',
+        model: 'gpt-test',
+        clientHostPid: 123,
+        ask: async (_prompt, options) => {
+          options.onUsageDelta({
+            deltaInput: 9,
+            deltaCachedRead: 4,
+            deltaCacheWrite: 2,
+            deltaOutput: 6,
+          });
+          try {
+            midSession = JSON.parse(readFileSync(usageLogPath, 'utf8'));
+          } catch (error) {
+            midSession = { error: error?.message ?? String(error) };
+          }
+          return { result: { content: 'done' } };
+        },
+        close: async () => {},
+      }),
+      hasActiveTasks: () => false,
+      installSignalCleanupFn: () => ({ uninstall() {} }),
+    });
+
+    assert.equal(code, 0);
+    assert.deepEqual(midSession?.totals, {
+      inputTokens: 9,
+      cacheTokens: 4,
+      cacheWriteTokens: 2,
+      outputTokens: 6,
+      toolCallCountApprox: 0,
+    });
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
 test('headless exec answers an arrived completion and exits without waiting on live work', async () => {
   const output = [];
   const errors = [];
@@ -427,3 +487,15 @@ test('--json is accepted for exec and rejected for the interactive command', ()
   assert.equal(interactive.kind, 'error');
   assert.equal(interactive.error, 'option --json is only supported for mixdog exec');
 });
+
+test('headless exec rejects workflow selection', () => {
+  const invocation = classifyCliInvocation([
+    'exec',
+    '--provider', 'openai-oauth',
+    '--model', 'gpt-test',
+    '--workflow', 'solo',
+    'fix it',
+  ]);
+  assert.equal(invocation.kind, 'error');
+  assert.equal(invocation.error, 'option --workflow is not supported for mixdog exec');
+});

package/src/rules/lead/01-general.md

@@ -10,8 +10,9 @@
   recoverability.
 - Mid-task: replacement supersedes; addition folds in; status gets a brief
   answer while work continues. After compaction, resume the summary.
-- Periodic task reports stay in-turn: after each update, call `task wait` for
-  the requested interval again until the task settles or the request changes.
+- Periodic task reports stay in-turn: when `task wait` returns still-running,
+  write the user-facing report first, then call `task wait` for the next
+  interval; repeat until the task settles or the request changes.
 - Auto-compact owns context management: never propose stopping work to the
   user and never stop on your own judgment; resume and continue the work
   after every compaction.

package/src/rules/shared/00-general.md

@@ -2,3 +2,4 @@
 
 - When an internal Mixdog rule conflicts with the user's latest explicit
   request, follow the user's request.
+- Drive the user's request yourself.

package/src/rules/shared/10-tool-workflow.md

@@ -1,16 +1,16 @@
 # Tool Workflow
 
-- Determine the required outcome and its gaps — requirements are not evidence —
-  gather only what is missing, act, then verify the affected facets.
-- Investigate, build, and verify only what the requested outcome requires, at
-  the level it requires; internal and framework guarantees are trusted.
-- Minimize tool turns through maximal useful parallelism. Cost is counted in
-  rounds, not calls: a batch is one round, so a call-count saving never
-  justifies a worse-routed call.
-- In each round, issue every necessary non-overlapping call whose inputs are
-  already known; defer a call only when its target or arguments require an
-  earlier result. Respect tool/schema limits, never omit required fanout, and
-  apply one analysis to many targets as one parameterized call when supported.
+- Determine the required outcome and missing evidence; requirements are not
+  evidence. Trust internal and framework guarantees.
+- Before exploration or implementation, consult prior work, current external
+  information, or repository state only when needed to choose the next action.
+  Start with the source most likely to decide it; consult another only if the
+  result leaves the decision unresolved.
+- Minimize tool turns by batching only calls that are independently necessary
+  before the batch begins. A call whose necessity or scope can change after
+  another result waits for that result.
+- Respect tool/schema limits, never omit required fanout, and apply one analysis
+  to many targets as one parameterized call when supported.
 - Route each evidence facet once to its primary owner, preferring the operation
   that directly returns the evidence needed for the next decision. A summary,
   overview, or enumeration is not a prerequisite to an operation whose complete
@@ -26,7 +26,6 @@
 - Mine each returned result fully before opening the next round; a follow-up is
   valid only for evidence a result omitted, invalidated, or newly made
   necessary.
-- Evidence that determines the answer, edit, or deliverable ends retrieval.
 - Treat failure as new evidence and re-enter that loop only for the affected
   facets. Do not abandon a viable approach after one failure or leave the
   required deliverable half-finished. Report a blocker when no deterministic

package/src/rules/shared/30-exploration.md

@@ -2,6 +2,8 @@
 
 - Use read-only means for inspection; never mutate to clear an obstacle or
   unexpected state. Preserve evidence before a required mutation can destroy it.
+- Stop exploring once sufficient evidence determines the next action required
+  by the request.
 - Ownership is exclusive: each evidence type has one owner;
   a successful owner result closes that facet.
 - Route the missing evidence to its primary owner:
@@ -19,15 +21,13 @@
 - Use a path locator only when the owner's required target is unknown. Paths
   reachable by expanding an environment variable or the home directory are
   resolved locations, not unknowns.
-- Enumerate sibling directories or same-kind files with one wildcard call
-  (`glob`, or `read` with a glob for content sampling), never a
-  directory-by-directory `list` walk or one `read` per file.
+- Enumerate sibling directories or same-kind files with one `glob` call, never
+  a directory-by-directory `list` walk or one `read` per file.
 - Treat supplied target locations as resolved; access them directly without
   locator searches. Within the current project, pass project-relative paths and
   omit optional scopes equal to its root; explicit paths may be outside cwd
   only for targets outside the project.
-- Before deciding how to parse, count, transform, or summarize files whose
-  format has not been inspected, inspect the original content itself.
+- Inspect source content only when its format is required and unknown.
 - Returned declarations, bodies, usages, relations, and contextual spans from
   any tool — not only `read` — are source context; `read` covers only omitted
   lines or missing anchored ranges.

package/src/rules/shared/60-verification.md

@@ -1,9 +1,10 @@
 # Verification
 
 - Enter Verification only after all planned work is complete.
-- Run only checks that directly cover the changed behavior or essential
-  invariants; use an umbrella suite only when the user explicitly requests it
-  or a documented project or release process requires it.
+- Verify the essential behaviors and invariants required to complete the
+  requested work.
+- Use an umbrella suite only when explicitly requested or required by the
+  documented project or release process.
 - Blocking checks cover only essential integrity, security, compatibility, and
   buildability invariants. Treat mutable behavior, UX, exact text, snapshots,
   and implementation shape as advisory specifications; update them when the

package/src/runtime/agent/orchestrator/providers/openai-codex-identity.test.mjs

@@ -90,7 +90,6 @@ test('Codex cache key and every wire session identity use the same UUIDv7', () =
         poolKey: session.id,
         model: 'gpt-5.6-sol',
         handshake: true,
-        useResponsesLite: true,
         sendOpts: {
             codexSessionId: sessionId,
             codexThreadId: sessionId,
@@ -102,7 +101,6 @@ test('Codex cache key and every wire session identity use the same UUIDv7', () =
     assert.equal(prewarmHeaders['thread-id'], sessionId);
     assert.equal(prewarmHeaders['x-client-request-id'], sessionId);
     assert.equal('x-codex-installation-id' in prewarmHeaders, false);
-    assert.equal('x-openai-internal-codex-responses-lite' in prewarmHeaders, false);
     const prewarmMetadata = JSON.parse(prewarmHeaders['x-codex-turn-metadata']);
     assert.equal(prewarmMetadata.request_kind, 'prewarm');
     assert.equal(prewarmMetadata.turn_id, '');

package/src/runtime/agent/orchestrator/providers/openai-codex-metadata.mjs

@@ -172,7 +172,7 @@ export function _metadataTrace(metadata) {
 }
 
 // The WebSocket handshake carries compatibility identity and routing fields.
-// Installation and Responses Lite data stay in per-request client_metadata.
+// Installation data stays in per-request client_metadata.
 export function _codexWsCompatibilityHeaders(context = {}) {
     const metadata = _codexMetadataBase(null, context);
     const headers = {};
@@ -211,9 +211,6 @@ export function _withCodexWsClientMetadata(frame, entry, enabled, context = {})
     const metadata = {
         ...base,
         ...(frame.client_metadata && typeof frame.client_metadata === 'object' ? frame.client_metadata : {}),
-        ...(context?.useResponsesLite === true
-            ? { ws_request_header_x_openai_internal_codex_responses_lite: 'true' }
-            : {}),
         'x-codex-ws-stream-request-start-ms': String(Date.now()),
     };
     if (entry && typeof entry === 'object') {

package/src/runtime/agent/orchestrator/providers/openai-codex-model.mjs

@@ -7,23 +7,6 @@
  * _displayCodexModel for existing importers.
  */
 
-const CODEX_RESPONSES_LITE_CAPABILITY = Object.freeze({
-    'gpt-5.6-sol': true,
-    'gpt-5.6-terra': true,
-    'gpt-5.6-luna': true,
-    'gpt-5.5': false,
-    'gpt-5.4': false,
-    'gpt-5.4-mini': false,
-    'gpt-5.2': false,
-    'codex-auto-review': false,
-});
-
-export function _codexUsesResponsesLite(id, modelInfo = null) {
-    const explicit = modelInfo?.useResponsesLite ?? modelInfo?.use_responses_lite;
-    if (typeof explicit === 'boolean') return explicit;
-    return CODEX_RESPONSES_LITE_CAPABILITY[String(id || '').trim()] === true;
-}
-
 // OAuth catalog returns dated ids (gpt-5.4-mini-2026-03-17). Strip the trailing
 // -YYYY-MM-DD to get the version alias (gpt-5.4-mini). Unknown shapes pass
 // through unchanged.
@@ -101,7 +84,6 @@ export function _normalizeCodexModel(m) {
         reasoningLevels: (m?.supported_reasoning_levels || []).map(r => r.effort),
         supportVerbosity: m?.support_verbosity === true,
         defaultVerbosity: m?.default_verbosity || null,
-        useResponsesLite: m?.use_responses_lite === true,
         supportsReasoningSummaries: m?.supports_reasoning_summaries === true,
         serviceTiers,
         defaultServiceTier: m?.default_service_tier || null,

package/src/runtime/agent/orchestrator/providers/openai-oauth-http-sse.mjs

@@ -251,9 +251,6 @@ export async function sendViaHttpSse({
     const statelessConversation = opts?.statelessConversation === true
         || _envFlag('MIXDOG_OAI_STATELESS_HTTP', false);
     const headers = _buildOpenAIHttpFallbackHeaders({ auth, cacheKey, statelessConversation });
-    if (auth?.type !== 'openai-direct' && body?.input?.[0]?.type === 'additional_tools') {
-        headers['x-openai-internal-codex-responses-lite'] = 'true';
-    }
     const fetchStartedAt = Date.now();
     const responsesUrl = auth?.type === 'openai-direct'
         ? OPENAI_DIRECT_RESPONSES_URL

package/src/runtime/agent/orchestrator/providers/openai-oauth-ws.mjs

@@ -584,7 +584,6 @@ export async function sendViaWebSocket({
         sendOpts,
         model: useModel,
         serviceTier: body?.service_tier || '',
-        useResponsesLite: body?.input?.[0]?.type === 'additional_tools',
     };
     const codexHandshakeHeaders = useCodexWsClientMetadata
         ? _codexWsCompatibilityHeaders({ ...codexMetadataContext, handshake: true })

package/src/runtime/agent/orchestrator/providers/openai-responses-payload.mjs

@@ -71,7 +71,6 @@ import {
     _compareVersion,
     _isMainCodexFamily,
     _markLatestCodex,
-    _codexUsesResponsesLite,
 } from './openai-codex-model.mjs';
 
 // Public test/integration entry retained alongside the transport module export.
@@ -253,53 +252,8 @@ function _codexModelSupportsReasoningSummaries(id) {
     return true;
 }
 
-function _codexModelUsesResponsesLite(id, opts = {}) {
-    if (typeof opts.useResponsesLite === 'boolean') return opts.useResponsesLite;
-    const override = String(process.env.MIXDOG_OAI_RESPONSES_LITE || '').trim().toLowerCase();
-    if (['1', 'true', 'yes', 'on'].includes(override)) return true;
-    if (['0', 'false', 'no', 'off'].includes(override)) return false;
-    const info = _findCachedCodexModel(id);
-    return _codexUsesResponsesLite(id, info);
-}
-
-function _responsesLiteTools(tools) {
-    const out = [];
-    const functions = [];
-    let functionsIndex = null;
-    for (const tool of Array.isArray(tools) ? tools : []) {
-        if (tool?.type === 'function' || tool?.type === 'custom') {
-            if (functionsIndex == null) functionsIndex = out.length;
-            functions.push(tool);
-            continue;
-        }
-        if (tool?.type === 'namespace' && tool?.name === 'functions') {
-            if (functionsIndex == null) functionsIndex = out.length;
-            if (Array.isArray(tool.tools)) functions.push(...tool.tools);
-            continue;
-        }
-        out.push(tool);
-    }
-    if (functions.length) {
-        out.splice(functionsIndex, 0, {
-            type: 'namespace',
-            name: 'functions',
-            description: '',
-            tools: functions,
-        });
-    }
-    return out;
-}
-
 export function buildCodexStartupPrewarmBody(body) {
-    const input = Array.isArray(body?.input) ? body.input : [];
-    const stableInput = [];
-    if (input[0]?.type === 'additional_tools' && input[0]?.role === 'developer') {
-        stableInput.push(input[0]);
-        if (input[1]?.type === 'message' && input[1]?.role === 'developer') {
-            stableInput.push(input[1]);
-        }
-    }
-    return { ...body, input: stableInput, generate: false };
+    return { ...body, input: [], generate: false };
 }
 
 // Effort normalization: `ultra` collapses to
@@ -340,8 +294,6 @@ export function buildRequestBody(messages, model, tools, sendOpts) {
         .join('\n\n---\n\n');
     const opts = sendOpts || {};
     const promptCacheProvider = opts.promptCacheProvider || 'openai-oauth';
-    const useResponsesLite = promptCacheProvider === 'openai-oauth'
-        && _codexModelUsesResponsesLite(model, opts);
     // Recovery-only encrypted-reasoning replay is DEFAULT ON for the OAuth
     // backend (validated 2026-08-11: smoke wire parity on normal chains +
     // live full-frame acceptance + full-run A/B). The per-socket policy in
@@ -421,7 +373,6 @@ export function buildRequestBody(messages, model, tools, sendOpts) {
         reasoning: {
             effort: _normalizeReasoningEffort(opts.effort),
             ...(supportsReasoningSummary ? { summary: 'auto' } : {}),
-            ...(useResponsesLite ? { context: 'all_turns' } : {}),
         },
         store: process.env.MIXDOG_OAI_STORE === 'true' ? true : false,
         stream: true,
@@ -461,25 +412,6 @@ export function buildRequestBody(messages, model, tools, sendOpts) {
     const toolsList = (functionTools.length || nativeTools.length)
         ? [...nativeTools, ...functionTools]
         : null;
-    const liteTools = useResponsesLite ? _responsesLiteTools(toolsList || []) : null;
-    const wireInput = useResponsesLite
-        ? [
-            {
-                type: 'additional_tools',
-                role: 'developer',
-                tools: liteTools,
-            },
-            ...(instructions
-                ? [{
-                    type: 'message',
-                    role: 'developer',
-                    content: [{ type: 'input_text', text: instructions }],
-                }]
-                : []),
-            ...input,
-        ]
-        : input;
-    if (useResponsesLite) body.parallel_tool_calls = false;
     const promptCacheLane = opts.promptCacheLane || resolveProviderPromptCacheLane(promptCacheProvider, opts);
     const promptCacheKey = buildStableProviderPromptCacheKey(promptCacheProvider, opts, {
         model,
@@ -506,9 +438,9 @@ export function buildRequestBody(messages, model, tools, sendOpts) {
     // fast set it.
     const ordered = {
         model: body.model,
-        ...(!useResponsesLite ? { instructions: body.instructions } : {}),
-        input: wireInput,
-        ...(!useResponsesLite && toolsList ? { tools: toolsList } : {}),
+        instructions: body.instructions,
+        input: body.input,
+        ...(toolsList ? { tools: toolsList } : {}),
         tool_choice: body.tool_choice,
         parallel_tool_calls: body.parallel_tool_calls,
         reasoning: body.reasoning,

package/src/runtime/agent/orchestrator/session/approval-mode.mjs

@@ -1,9 +1 @@
 export const IMPLICIT_APPROVAL_MODE = 'implicit';
-export const IMPLICIT_APPROVAL_CONTEXT =
-    'Non-interactive execution: treat the initial user request as the approved plan and proceed without requesting approval.';
-
-export function workflowContextForApprovalMode(workflowContext, approvalMode) {
-    if (approvalMode !== IMPLICIT_APPROVAL_MODE) return workflowContext || null;
-    const workflow = typeof workflowContext === 'string' ? workflowContext.trim() : '';
-    return [workflow, IMPLICIT_APPROVAL_CONTEXT].filter(Boolean).join('\n\n');
-}

package/src/runtime/agent/orchestrator/session/manager/session-lifecycle.mjs

@@ -40,11 +40,12 @@ import { getAgentRuntimeSync, warnAgentRuntimeResolveFailureOnce } from './agent
 import { ensureCodexWireSessionId, mintSessionId, mintUuidV7 } from './session-id.mjs';
 import { providerCacheKey } from './provider-cache-key.mjs';
 import { clearTurnCheckpoint, recoverTurnCheckpoint } from './turn-checkpoint.mjs';
+import { IMPLICIT_APPROVAL_MODE } from '../approval-mode.mjs';
 import {
-    IMPLICIT_APPROVAL_MODE,
-    workflowContextForApprovalMode,
-} from '../approval-mode.mjs';
-import { describeShellStartupPolicy } from '../../tools/builtin/runtime-capabilities.mjs';
+    describeGitStartupState,
+    describeShellStartupPolicy,
+    detectPathCapabilities,
+} from '../../tools/builtin/runtime-capabilities.mjs';
 import { captureOriginalUserCwd } from '../../../../shared/user-cwd.mjs';
 import { refreshSessionBp3Environment } from './prompt-utils.mjs';
 
@@ -314,6 +315,12 @@ export function createSession(opts) {
     // resolves explicit session signals first and never leaks the daemon's
     // install root (user-cwd.mjs safe fallback chain).
     const sessionCwdLine = opts.cwd || captureOriginalUserCwd();
+    const wantsShellStartupLine = toolsForRouting.some((tool) => tool?.name === 'shell');
+    const wantsGitStartupLine = toolsForRouting.some((tool) => tool?.name === 'git');
+    // One PATH walk feeds every startup line below.
+    const startupCapabilities = wantsShellStartupLine || wantsGitStartupLine
+        ? detectPathCapabilities()
+        : null;
     const shellEnvironmentContext = [
         sessionCwdLine
             ? `- Cwd: ${sessionCwdLine} — the active Project root; relative paths and shell commands resolve here.`
@@ -321,8 +328,18 @@ export function createSession(opts) {
         !ownerIsAgent
             ? `- Shell: ${process.platform === 'win32' ? 'PowerShell' : 'Bash'}. Use ${process.platform === 'win32' ? 'PowerShell' : 'Bash'} syntax unless the user specifies otherwise.`
             : '',
-        toolsForRouting.some((tool) => tool?.name === 'shell')
-            ? describeShellStartupPolicy()
+        wantsShellStartupLine
+            ? describeShellStartupPolicy({ capabilities: startupCapabilities })
+            : '',
+        // Whether the cwd is inside a repository is the fact the git tool
+        // needs and cannot infer: a PATH listing only says the binary exists.
+        // Without it a session spends a call discovering `exited 128`, and
+        // repeats it per candidate path.
+        wantsGitStartupLine
+            ? describeGitStartupState({
+                capabilities: startupCapabilities,
+                ...(sessionCwdLine ? { cwd: sessionCwdLine } : {}),
+            })
             : '',
     ].filter(Boolean).join('\n');
     const { baseRules, stableSystemContext, sessionMarkerCore, sessionEnvironment } = composeSystemPrompt({
@@ -333,7 +350,7 @@ export function createSession(opts) {
         skipRoleCatalog: !ownerIsAgent,
         profile: profile || undefined,
         agent: resolvedAgent,
-        workflowContext: workflowContextForApprovalMode(opts.workflowContext, opts.approvalMode),
+        workflowContext: opts.workflowContext || null,
         coreMemoryContext: opts.coreMemoryContext || null,
         skillManifest: buildSkillManifest(skills),
         environmentContext: shellEnvironmentContext,
@@ -493,6 +510,36 @@ export function contextSeedForRouteUpdate(session, routeChanged, selectedContext
         : {};
 }
 
+// The shared-rules block (BP1) renders tool-conditional variants against the
+// edit dialect the model actually receives (edit vs apply_patch). An
+// empty-session route change swaps the tool surface, so this block must
+// re-render too — otherwise a session created on a GPT default route and
+// switched to Claude keeps apply_patch placement guidance for a tool it can
+// no longer call (and vice versa). The block is identified by EXACT previous
+// content: the old variant is rebuilt from the same inputs and matched, so
+// only the true BP1 block is ever replaced; custom-prompt or agent layouts
+// without that block are left untouched, and a same-dialect switch is a no-op.
+export function _refreshSessionRuleVariantsForModel(session, previousModel) {
+    const deny = [
+        ...(Array.isArray(session?.disallowedTools) ? session.disallowedTools : []),
+        ...(getHiddenAgent(session?.agent || null) ? ['Skill'] : []),
+        ...(!isAgentOwner(session) && workflowDisallowsAgentTool(session?.workflow) ? ['agent'] : []),
+    ];
+    const previousRules = _buildSharedRules({ omitTools: [...deny, unusedModelEditToolName(previousModel)] });
+    const nextRules = _buildSharedRules({ omitTools: [...deny, unusedModelEditToolName(session?.model)] });
+    if (!previousRules || previousRules === nextRules) return false;
+    const messages = Array.isArray(session?.messages) ? session.messages : [];
+    const index = messages.findIndex((message) => (
+        message?.role === 'system' && !message.cacheTier && message.content === previousRules
+    ));
+    if (index < 0) return false;
+    // Replace, never mutate: session-store delta saves treat stable message
+    // references as an append-only prefix, so a fresh object forces the full
+    // snapshot that keeps the persisted transcript in sync.
+    messages[index] = { ...messages[index], content: nextRules };
+    return true;
+}
+
 export function updateSessionRoute(id, route = {}) {
     if (!id) return null;
     const session = loadSession(id);
@@ -576,8 +623,15 @@ export function updateSessionRoute(id, route = {}) {
         for (const key of ['deferredSelectedTools', 'deferredCallableTools', 'deferredDefaultTools', 'deferredDiscoveredTools']) {
             if (Array.isArray(session[key])) session[key] = filterModelEditToolNames(session[key], session.model);
         }
+        _refreshSessionRuleVariantsForModel(session, previousModel);
         _preparedResumes.delete(id);
     }
+    // Route fields feed the `# Session` prompt block (Model: … · EFFORT · FAST).
+    // Rebuild it here: createSession stamped the block with the creation-time
+    // route and set sessionStartMetaInjected, so the ask-time refresh guard
+    // skips it and an empty-session route change would otherwise keep the old
+    // model line in the system prompt (model self-identity confusion).
+    refreshSessionBp3Environment(session, session.cwd);
     session.updatedAt = Date.now();
     setLiveSession(session);
     void saveSessionAsync(session, { expectedGeneration: session.generation })

package/src/runtime/agent/orchestrator/session/manager/session-lifecycle.test.mjs

@@ -1,7 +1,8 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { resolveSessionContextMeta } from './context-meta.mjs';
-import { contextSeedForRouteUpdate } from './session-lifecycle.mjs';
+import { contextSeedForRouteUpdate, _refreshSessionRuleVariantsForModel } from './session-lifecycle.mjs';
+import { _buildSharedRules } from './rules-cache.mjs';
 
 test('a cold Cursor route uses 200k instead of inheriting another model window', () => {
     const seed = contextSeedForRouteUpdate({
@@ -38,3 +39,32 @@ test('an explicitly selected context window survives a route update', () => {
         selectedContextWindow: 300_000,
     });
 });
+
+test('an empty-session route change re-renders the edit-dialect rule variants', () => {
+    const gptRules = _buildSharedRules({ omitTools: ['edit'] });
+    const claudeRules = _buildSharedRules({ omitTools: ['apply_patch'] });
+    assert.notEqual(gptRules, claudeRules);
+    const session = {
+        model: 'claude-fable-5',
+        messages: [
+            { role: 'system', content: gptRules },
+            { role: 'system', content: 'profile block' },
+            { role: 'system', content: 'core block', cacheTier: 'tier3' },
+        ],
+    };
+    // GPT-created session switched to Claude: BP1 flips to the edit variant.
+    assert.equal(_refreshSessionRuleVariantsForModel(session, 'gpt-5.6-sol'), true);
+    assert.equal(session.messages[0].content, claudeRules);
+    assert.match(session.messages[0].content, /`edit`/);
+    assert.doesNotMatch(session.messages[0].content, /apply_patch/);
+    // Untouched blocks keep their identity and content.
+    assert.equal(session.messages[1].content, 'profile block');
+    assert.equal(session.messages[2].cacheTier, 'tier3');
+    // Same edit dialect on both sides is a no-op.
+    assert.equal(_refreshSessionRuleVariantsForModel(session, 'claude-opus-5'), false);
+    // A layout without the expected BP1 content is left untouched.
+    assert.equal(_refreshSessionRuleVariantsForModel({
+        model: 'claude-fable-5',
+        messages: [{ role: 'system', content: 'custom prompt' }],
+    }, 'gpt-5.6-sol'), false);
+});