mixdog 1.2.6 → 1.3.0

package/src/runtime/agent/orchestrator/session/loop/tool-helpers.mjs

@@ -2,6 +2,7 @@
 // message-array change detect, tool-kind classification, skills, hook overrides,
 // native tool-search payload parsing, bash-session routing, and approval.
 import { isMcpTool } from '../../mcp/client.mjs';
+import { unattendedApprovalPort } from '../human-gate/gate.mjs';
 import { isBuiltinTool } from '../../tools/builtin.mjs';
 import { isInternalTool } from '../../internal-tools.mjs';
 import { loadSkillToolDependencies } from '../../runtime-core/skill-tool-loading.mjs';
@@ -207,15 +208,24 @@ export async function resolvePreToolAskApproval({
   toolCallId,
   askReason,
   toolApprovalHook,
+  request = null,
 }) {
   const name = String(toolName || 'tool');
   const reason = String(askReason || 'approval requested by hook').trim();
-  if (typeof toolApprovalHook !== 'function') {
+  // Unattended runs never auto-approve and have no card: a schedule or webhook
+  // run always holds the request for its owner; a room member does when no
+  // approval UI is attached (session-runtime/held-requests.mjs).
+  const unattended = unattendedApprovalPort();
+  const run = unattended?.runOf?.(sessionId) || null;
+  const held = run && (run.kind !== 'room' || typeof toolApprovalHook !== 'function');
+  const ask = held ? unattended.hold : toolApprovalHook;
+  if (typeof ask !== 'function') {
     return { denial: formatMissingToolApprovalUiDenial(name, reason) };
   }
   let approval;
   try {
-    approval = await toolApprovalHook({
+    approval = await ask({
+      ...(request || {}),
       name,
       args,
       cwd,
@@ -229,7 +239,7 @@ export async function resolvePreToolAskApproval({
   }
   if (!approvalGranted(approval)) {
     const detail = approvalReason(approval, reason || 'not approved');
-    return { denial: `Error: tool "${name}" denied by hook: ${detail}` };
+    return { denial: `Error: tool "${name}" denied by hook: ${detail}`, approval };
   }
   return { approval };
 }

package/src/runtime/agent/orchestrator/session/loop/usage.mjs

@@ -41,6 +41,7 @@ export function usageDeltaEvent({
   usage,
   sendTools,
   toolCalls = 0,
+  generationMs = 0,
 }) {
   return {
     sessionId,
@@ -56,6 +57,12 @@ export function usageDeltaEvent({
     deltaToolCalls: toolCalls,
     ...reasoningUsage(usage),
     deltaPrompt: usage.promptTokens || 0,
+    // First visible token → end of this response; 0 when the call was not
+    // timed (nothing visible streamed). Only timed output enters speed figures.
+    generationMs,
+    // A provider that cannot measure the prompt or its cache split says so;
+    // its zeros are unknowns, not readings (no cache hit can be derived).
+    promptKnown: usage.inputTokensKnown !== false && usage.cacheTokensKnown !== false,
     // Cache delta carried alongside input/output so live metrics reflect
     // the same token classes the terminal aggregate adds; additive —
     // callers that ignore these fields keep working.

package/src/runtime/agent/orchestrator/session/manager/ask-turn-execute.mjs

@@ -186,6 +186,7 @@ export async function prepareAskTurn({ sessionId, opened, input, cwdOverride, tr
     beforeCount: historyMessages.length + 1,
     deferredToolDelta: userTurn.deferredToolDelta,
     goalReminder: userTurn.goalReminder,
+    workflowNotice: userTurn.workflowNotice,
     workspaceNotice: userTurn.workspaceNotice,
     setupNotice: userTurn.setupNotice,
   };

package/src/runtime/agent/orchestrator/session/manager/ask-turn-loop-options.mjs

@@ -8,6 +8,7 @@ import { createAskSteeringDrain } from './ask-turn-steering-drain.mjs';
 import { updateSessionStage, markSessionStreamDelta } from './runtime-liveness.mjs';
 import { codexWireSendOpts } from './session-id.mjs';
 import { persistIterationMetrics } from './usage-metrics.mjs';
+import { isAgentModeSession } from '../agent-mode.mjs';
 
 const optionalFn = (value) => (typeof value === 'function' ? value : undefined);
 const relay = (fn, ...args) => {
@@ -184,7 +185,8 @@ export function buildAgentLoopOptions({
     onCompactEvent: (event) => {
       checkpoint.refreshContextState();
       checkpoint.schedule(true);
-      relay(askOpts?.onCompactEvent, event);
+      // Agent mode compacts silently: no compaction notice reaches the host.
+      if (!isAgentModeSession(session)) relay(askOpts?.onCompactEvent, event);
     },
     // Pre-send gauge sync. Defined only when a host listens so the loop
     // never computes a display number nobody reads.

package/src/runtime/agent/orchestrator/session/manager/ask-turn-prepare.mjs

@@ -19,6 +19,7 @@ import {
   snapshotPendingWorkspaceNotice,
   snapshotPendingSetupNotice,
 } from './prompt-utils.mjs';
+import { snapshotPendingWorkflowNotice } from './workflow-switch-notice.mjs';
 import { codexWireSendOpts } from './session-id.mjs';
 import { _tryBridgeExplicitPrefetch } from './prefetch-bridge.mjs';
 import { filterModelVisibleSessionMessages } from './message-sanitize.mjs';
@@ -180,7 +181,11 @@ export async function buildUserTurn({
   const workspaceNotice = snapshotPendingWorkspaceNotice(session);
   // What preparing a new worktree linked, installed, ran, failed or skipped.
   const setupNotice = snapshotPendingSetupNotice(session);
+  // A mid-conversation workflow switch: the prompt and tools were rebuilt
+  // for the new workflow; this turn tells the model once.
+  const workflowNotice = snapshotPendingWorkflowNotice(session);
   const reminderBlock = [
+    workflowNotice?.content || '',
     workspaceNotice?.content || '',
     setupNotice?.content || '',
     currentTimeBlock ? `<system-reminder>\n# Current Time\n${currentTimeBlock}\n</system-reminder>` : '',
@@ -209,6 +214,7 @@ export async function buildUserTurn({
     historyMessages,
     deferredToolDelta,
     goalReminder,
+    workflowNotice,
     workspaceNotice,
     setupNotice,
     userTurnMessage,

package/src/runtime/agent/orchestrator/session/manager/ask-turn-settle.mjs

@@ -9,6 +9,7 @@ import { persistedAssistantTranscriptMetadata } from '../../../../shared/transcr
 import { acknowledgePendingDeferredToolDelta } from '../../runtime-core/deferred-tool-delta.mjs';
 import { acknowledgePendingGoalReminder } from '../../runtime-core/goal-reminder.mjs';
 import { acknowledgePendingSetupNotice, acknowledgePendingWorkspaceNotice } from './prompt-utils.mjs';
+import { acknowledgePendingWorkflowNotice } from './workflow-switch-notice.mjs';
 import {
   finalizePendingMessageDelivery,
   drainPendingMessages,
@@ -139,6 +140,7 @@ export async function commitAskTurn({ sessionId, opened, prepared, result, rawTr
   if (prepared.goalReminder) {
     acknowledgePendingGoalReminder(session, prepared.goalReminder.revision);
   }
+  if (prepared.workflowNotice) acknowledgePendingWorkflowNotice(session, prepared.workflowNotice.revision);
   if (prepared.workspaceNotice) {
     acknowledgePendingWorkspaceNotice(session, prepared.workspaceNotice.revision);
   }

package/src/runtime/agent/orchestrator/session/manager/pending-lifecycle-epoch.mjs

@@ -40,14 +40,6 @@ export function currentPendingLifecycleToken(sessionId) {
   return pendingLifecycleToken(pendingSessionLifecycle(sessionId));
 }
 
-// Refusal verdict of the lifecycle a token was minted from (tombstoned or
-// unreadable) — exactly pendingLifecycleInvalidated(sessionId) for that same
-// read, so a caller holding a fresh token needs no second durable read.
-export function lifecycleTokenClosed(token) {
-  const { source } = parseLifecycleToken(token);
-  return source === 'closed' || source === 'unreadable';
-}
-
 // Parses a `source:generation` epoch token.
 function parseLifecycleToken(token) {
   const text = String(token);

package/src/runtime/agent/orchestrator/session/manager/prompt-utils.mjs

@@ -207,29 +207,46 @@ function bp3SliceAt(text, heading) {
 
 /**
  * Replace the workspace-scoped tail of a BP3 core (composeSystemPrompt order:
- * …, `# Core Memory`, `# Instruction Files`). The instruction-files slice is
- * always last and may itself contain separators, so it is cut by position;
- * the core-memory slice is one separator-free part. `undefined` keeps a slice,
- * an empty string drops it.
+ * …, `# Instruction Files`, `# Core Memory`). Core memory is the last,
+ * separator-free part; the instruction-files slice before it may itself
+ * contain separators, so both are cut by position. A core from before that
+ * order (memory, then instruction files) is read too and written in the
+ * current order. `undefined` keeps a slice, an empty string drops it.
  * @param {string} core
  * @param {{ coreMemoryContext?: string, instructionFilesContext?: string }} slices
  */
 export function replaceWorkspaceCoreSlices(core, { coreMemoryContext, instructionFilesContext } = {}) {
+  let { head, instructionFiles, memory } = splitWorkspaceCoreSlices(core);
+  if (coreMemoryContext !== undefined) {
+    const value = trimmedSlice(coreMemoryContext);
+    memory = value ? `${CORE_MEMORY_HEADING}${value}` : '';
+  }
+  if (instructionFilesContext !== undefined) instructionFiles = trimmedSlice(instructionFilesContext);
+  return [head, instructionFiles, memory].filter((part) => part?.trim()).join(BP3_PART_SEPARATOR);
+}
+
+/** A BP3 core's `{ head, instructionFiles, memory }` (each '' when absent). */
+function splitWorkspaceCoreSlices(core) {
   let head = String(core || '');
+  let memory = '';
+  const memoryAt = bp3SliceAt(head, CORE_MEMORY_HEADING);
+  if (memoryAt) {
+    memory = head.slice(memoryAt.start);
+    head = head.slice(0, memoryAt.cut);
+    const legacy = memory.indexOf(`${BP3_PART_SEPARATOR}${INSTRUCTION_FILES_HEADING}`);
+    if (legacy >= 0) {
+      const instructions = memory.slice(legacy + BP3_PART_SEPARATOR.length);
+      memory = memory.slice(0, legacy);
+      head = head ? `${head}${BP3_PART_SEPARATOR}${instructions}` : instructions;
+    }
+  }
   let instructionFiles = '';
   const instructionAt = bp3SliceAt(head, INSTRUCTION_FILES_HEADING);
   if (instructionAt) {
     instructionFiles = head.slice(instructionAt.start);
     head = head.slice(0, instructionAt.cut);
   }
-  let parts = head ? head.split(BP3_PART_SEPARATOR) : [];
-  if (coreMemoryContext !== undefined) {
-    parts = parts.filter((part) => !part.startsWith(CORE_MEMORY_HEADING));
-    const memory = trimmedSlice(coreMemoryContext);
-    if (memory) parts.push(`${CORE_MEMORY_HEADING}${memory}`);
-  }
-  if (instructionFilesContext !== undefined) instructionFiles = trimmedSlice(instructionFilesContext);
-  return [...parts, instructionFiles].filter((part) => part?.trim()).join(BP3_PART_SEPARATOR);
+  return { head, instructionFiles, memory };
 }
 
 /**
@@ -286,9 +303,7 @@ function textOf(message) {
  */
 function presentedWorkspace(session) {
   const core = session.bp3EnvSplit === true ? textOf(bp3SystemMessage(session)) : String(session.bp3CoreContext || '');
-  const instructionAt = bp3SliceAt(core, INSTRUCTION_FILES_HEADING);
-  const head = instructionAt ? core.slice(0, instructionAt.cut) : core;
-  const memory = (head ? head.split(BP3_PART_SEPARATOR) : []).find((part) => part.startsWith(CORE_MEMORY_HEADING));
+  const { instructionFiles, memory } = splitWorkspaceCoreSlices(core);
   const tail = typeof session.bp3EnvironmentContext === 'string' ? session.bp3EnvironmentContext : '';
   const facts = tail.split(BP3_PART_SEPARATOR)[0] || '';
   const promptText = [textOf(bpEnvSystemMessage(session)), textOf(bp3SystemMessage(session))].join('\n');
@@ -297,10 +312,23 @@ function presentedWorkspace(session) {
     cwd: cwd ? cwd.trim() : null,
     environmentContext: facts.startsWith('- ') ? facts.trim() : '',
     coreMemoryContext: memory ? memory.slice(CORE_MEMORY_HEADING.length).trim() : '',
-    instructionFilesContext: instructionAt ? core.slice(instructionAt.start).trim() : '',
+    instructionFilesContext: instructionFiles.trim(),
   };
 }
 
+/**
+ * A rebuilt BP3 core head (composed without workspace slices) followed by the
+ * instruction-files and core-memory slices the session's prompt presents now,
+ * so a rebuild of the rest of the core (a mid-conversation workflow switch)
+ * leaves what the model was told about its workspace — and any staged
+ * workspaceReroot — as it was.
+ */
+export function withPresentedWorkspaceSlices(session, nextHead) {
+  const core = session.bp3EnvSplit === true ? textOf(bp3SystemMessage(session)) : String(session.bp3CoreContext || '');
+  const { instructionFiles, memory } = splitWorkspaceCoreSlices(core);
+  return [nextHead, instructionFiles, memory].filter((part) => part?.trim()).join(BP3_PART_SEPARATOR);
+}
+
 const WORKSPACE_SLICES = ['environmentContext', 'coreMemoryContext', 'instructionFilesContext'];
 
 /**

package/src/runtime/agent/orchestrator/session/manager/rules-cache.mjs

@@ -112,20 +112,36 @@ export function _buildAgentRules(profile = 'full') {
   );
 }
 
-export function _buildLeadRules({ includeLeadBrief = true } = {}) {
+// One `part` of LEAD.md (rules-builder buildLeadRoleContent): 'common' (the
+// lines every Lead shares), 'coding' / 'agent' (the mode-variant passages),
+// 'identity' (the coding identity sentence).
+export function _buildLeadRules({ includeLeadBrief = true, part = 'common' } = {}) {
   const PLUGIN_ROOT = mixdogRoot();
   const DATA_DIR = resolvePluginData();
   const RULES_DIR = join(PLUGIN_ROOT, 'rules');
+  const variant = includeLeadBrief ? 'delegating' : 'delegation-free';
   return buildCachedRules(
     'buildLeadRoleContent',
     'lead role rules',
     [join(RULES_DIR, 'lead'), join(DATA_DIR, 'mixdog-config.json')],
-    { PLUGIN_ROOT, DATA_DIR, includeLeadBrief },
-    includeLeadBrief ? 'delegating' : 'delegation-free'
+    { PLUGIN_ROOT, DATA_DIR, includeLeadBrief, part },
+    `${variant}\n${part}`
   );
 }
 
-export function _buildLeadMetaContext() {
+// One agent-mode rule file (rules/agent-mode): 'conduct', 'mixy' or 'routine'.
+export function _buildAgentModeRules({ part = 'conduct' } = {}) {
+  const PLUGIN_ROOT = mixdogRoot();
+  return buildCachedRules(
+    'buildAgentModeContent',
+    'agent mode rules',
+    [join(PLUGIN_ROOT, 'rules', 'agent-mode')],
+    { PLUGIN_ROOT, part },
+    part
+  );
+}
+
+export function _buildLeadMetaContext({ includeOutputStyle = true } = {}) {
   const PLUGIN_ROOT = mixdogRoot();
   const DATA_DIR = resolvePluginData();
   const RULES_DIR = join(PLUGIN_ROOT, 'rules');
@@ -138,7 +154,8 @@ export function _buildLeadMetaContext() {
       join(PLUGIN_ROOT, 'output-styles'),
       join(DATA_DIR, 'output-styles'),
     ],
-    { PLUGIN_ROOT, DATA_DIR }
+    { PLUGIN_ROOT, DATA_DIR, includeOutputStyle },
+    includeOutputStyle ? 'style' : 'no-style'
   );
 }
 

package/src/runtime/agent/orchestrator/session/manager/session-crud.mjs

@@ -28,6 +28,7 @@ import { mintSessionId } from './session-id.mjs';
 import { hideCompactionArchive } from '../compaction-archive-capture.mjs';
 import { writeStderrBestEffort } from '../../../../shared/best-effort-stderr.mjs';
 import { forgetSideQuestion } from '../side-question-store.mjs';
+import { isAgentHomeSessionId } from '../agent-home.mjs';
 
 /** Force-flush session metrics to disk. */
 export async function flushSessionMetrics(sessionId) {
@@ -207,9 +208,12 @@ function clearTokenAccounting(session, messages, keep, beforeMessageTokens) {
 // Fork the outgoing transcript to a separate resumable session BEFORE the wipe,
 // so the conversation about to be discarded stays reachable via /resume under a
 // fresh id. Best-effort: any failure here must never block the clear itself.
-function forkOutgoingTranscript(session, messages, now) {
+// `archiveAs` names the fork (an agent home's "대화 새로 시작": the host
+// archives that id before the clear) and makes it durable first: the returned
+// promise settles once the copy is on disk, and the wipe waits on it.
+function forkOutgoingTranscript(session, messages, now, archiveAs = '') {
   try {
-    const forkId = mintSessionId();
+    const forkId = archiveAs || mintSessionId();
     const fork = {
       ...session,
       id: forkId,
@@ -234,6 +238,15 @@ function forkOutgoingTranscript(session, messages, now) {
       delete fork.compaction.archive;
     }
     setLiveSession(fork);
+    if (archiveAs) {
+      return saveSessionAsync(fork).then(
+        () => evictLiveSession(forkId),
+        (err) => {
+          evictLiveSession(forkId);
+          throw err;
+        }
+      );
+    }
     void saveSessionAsync(fork)
       .then(() => {
         // The fork is a cold snapshot kept for /resume. Once durable on
@@ -247,17 +260,33 @@ function forkOutgoingTranscript(session, messages, now) {
         writeStderrBestEffort(`[session] clear-fork save failed (sess=${forkId}): ${err?.message || err}\n`);
       });
   } catch (err) {
+    if (archiveAs) throw err;
     writeStderrBestEffort(`[session] clear-fork failed (sess=${session.id}): ${err?.message || err}\n`);
   }
 }
 
+const ARCHIVE_ID = /^sess_[A-Za-z0-9_-]{8,200}$/;
+
+/** The fork id a clear was asked to archive under, '' when none. */
+function clearArchiveId(value, sessionId) {
+  if (value === undefined || value === null || value === '') return '';
+  const id = String(value);
+  if (!ARCHIVE_ID.test(id) || id === sessionId || isAgentHomeSessionId(id)) {
+    throw new Error('clear: archiveAs must be a fresh session id');
+  }
+  if (loadSession(id)) throw new Error(`clear: session ${id} already exists`);
+  return id;
+}
+
 export async function clearSessionMessages(sessionId, options = {}) {
   const session = loadSession(sessionId);
   if (!session) return false;
   // Don't resurrect a closed session just to clear its messages.
   if (session.closed === true) return false;
   const clearOptions = options && typeof options === 'object' ? options : {};
-  const compact = clearOptions.compact === true;
+  const archiveAs = clearArchiveId(clearOptions.archiveAs, sessionId);
+  // An archived reset keeps the whole transcript: never compacted first.
+  const compact = clearOptions.compact === true && !archiveAs;
   const currentMessages = Array.isArray(session.messages) ? session.messages : [];
   const beforeMessageTokens = estimateMessagesTokens(currentMessages);
   const { messages, clearCompactError } = compact
@@ -275,8 +304,14 @@ export async function clearSessionMessages(sessionId, options = {}) {
   // content the live session retains via the summary, so the fork duplicated
   // it as a confusing extra Recent row ("Re-attached after compaction…" —
   // user report). Plain /clear (no summary kept) still forks.
+  // `fork: false` (a room member's reset: the room's own log keeps the
+  // conversation) skips the copy; an `archiveAs` clear always keeps one.
   const summaryCarriedForward = keep.some(isCompactSummaryMessage);
-  if (hasUserConversationMessage(messages) && !summaryCarriedForward) forkOutgoingTranscript(session, messages, now);
+  const keepCopy = clearOptions.fork !== false || Boolean(archiveAs);
+  if (keepCopy && hasUserConversationMessage(messages) && !summaryCarriedForward) {
+    const fork = forkOutgoingTranscript(session, messages, now, archiveAs);
+    if (archiveAs) await fork;
+  }
 
   session.messages = keep;
   // Clear truncates the transcript wholesale; drop the provider prefix

package/src/runtime/agent/orchestrator/session/manager/session-lifecycle.mjs

@@ -9,6 +9,7 @@ import { saveSession, saveSessionAsync, saveSessionAsyncDeferred, loadSession, s
 import { _liveSessions } from '../store/live-state.mjs';
 import { _recoverTurnCheckpointDurably } from './turn-checkpoint-recovery.mjs';
 import { isAgentOwner } from '../../agent-owner.mjs';
+import { AGENT_MODE, resolveSessionMode, sessionModeOf } from '../agent-mode.mjs';
 import { getHiddenAgent } from '../../internal-agents.mjs';
 import { loadConfig } from '../../config.mjs';
 import {
@@ -19,6 +20,7 @@ import {
 import { normalizeAutoClearConfig, resolveAutoClearIdleMs } from '../../runtime-core/config-helpers.mjs';
 import { _buildBaseRules } from './rules-cache.mjs';
 import { composeSessionSystem, seedSessionMessages } from './session-prompt-composition.mjs';
+import { agentProfileRevision, leadRosterRevision } from '../../context/role-instructions.mjs';
 import {
   _prepareResumeTools,
   delegationDisabled,
@@ -206,12 +208,22 @@ function logSessionSurface({ resolvedAgent, toolPermission, tools }) {
   }
 }
 
-export function createSession(opts) {
-  const presetObj = opts.preset && typeof opts.preset === 'object' ? opts.preset : null;
-  const resolved = resolveAgentRuntimeProfile(opts, presetObj);
+export function createSession(createOpts) {
+  const presetObj = createOpts.preset && typeof createOpts.preset === 'object' ? createOpts.preset : null;
+  const resolved = resolveAgentRuntimeProfile(createOpts, presetObj);
   const { profile } = resolved;
-  const route = resolveSessionRoute(opts, presetObj, profile);
+  const route = resolveSessionRoute(createOpts, presetObj, profile);
   const { providerName, modelName, provider, toolPreset, id } = route;
+  // Agent or coding mode (agent-mode.mjs), resolved once and persisted. An
+  // agent-mode Lead acts as its agent: a schedule/webhook run that names only
+  // its `ownerAgentId` gets that agent's role, persona and connector policy
+  // (all keyed by `session.agent`), as its home thread does.
+  const sessionMode = sessionModeOf({ ...createOpts, id });
+  const actingAgent = resolveSessionMode({ session: { ...createOpts, id } }).agentId;
+  const opts =
+    sessionMode === AGENT_MODE && !createOpts.agent && actingAgent
+      ? { ...createOpts, agent: actingAgent, sessionMode }
+      : { ...createOpts, sessionMode };
   const routeFallbacks = normalizeWorkflowRoute({
     provider: providerName,
     model: modelName,
@@ -227,7 +239,10 @@ export function createSession(opts) {
   // Scoped to explicit-breakpoint (Anthropic-family) providers only.
   const providerCacheOpts = resolved.providerCacheOpts || buildSessionProviderCacheOpts(providerName, id, opts.agent);
   const surface = resolveSessionToolSurface(opts, { profile, toolPreset, modelName });
-  const prompt = composeSessionSystem(opts, { profile, providerName, modelName, surface });
+  // The agent profile the prompt is composed from, read first: an edit landing
+  // during composition leaves the stamp behind, never ahead (refreshAgentProfile).
+  const agentProfile = surface.ownerIsAgent ? '' : agentProfileRevision(surface.resolvedAgent);
+  const prompt = composeSessionSystem(opts, { profile, providerName, modelName, surface, sessionMode });
   const messages = seedSessionMessages(prompt, opts.files);
   logSessionSurface(surface);
   const contextMeta = resolveSessionContextMeta(provider, modelName, {
@@ -246,6 +261,11 @@ export function createSession(opts) {
     origin: sessionOriginFields(opts, { profile, presetObj, providerCacheOpts, surface }),
   });
   session.providerCacheOptsOverride = Boolean(resolved.providerCacheOpts);
+  if (agentProfile) {
+    session.agentProfileRevision = agentProfile;
+    // The bot roster its prompt lists (a Lead's catalog slices).
+    session.agentRosterRevision = leadRosterRevision(opts.leadWorkflowParts);
+  }
   if (routeFallbacks?.length) session.routeFallbacks = routeFallbacks;
   // A non-native agent sends core + bridge, built from its filtered tools.
   applyAgentToolExposure(session);
@@ -532,6 +552,8 @@ export async function resumeSession(sessionId, preset, options = {}) {
   ensureCodexWireSessionId(session);
   if (!_applyDesktopResumeScope(session, options)) return null;
   if (!session.owner) session.owner = 'user';
+  // Records from before the mode existed get it resolved and stamped.
+  session.sessionMode = sessionModeOf(session);
   if (Object.hasOwn(options, 'mcpScopeId')) {
     session.mcpScopeId = String(options.mcpScopeId || '').trim() || null;
   }

package/src/runtime/agent/orchestrator/session/manager/session-prompt-composition.mjs

@@ -4,9 +4,13 @@
 // carry all four to the provider with their cache tiers.
 import { buildSkillManifest, composeSystemPrompt } from '../../context/collect.mjs';
 import { configuredInstructionFilesMode, loadInstructionFilesContext } from '../../context/instruction-files.mjs';
+import { agentModeIdentityLine } from '../../context/role-instructions.mjs';
+import { AGENT_MODE, isRoutineSource, sessionModeOf } from '../agent-mode.mjs';
+import { MIXY_AGENT_ID } from '../agent-home.mjs';
 import {
   _buildBaseRules,
   _buildAgentRules,
+  _buildAgentModeRules,
   _buildLeadRules,
   _buildLeadMetaContext,
   _buildLeadLanguageContext,
@@ -81,8 +85,9 @@ export function buildWorkspacePromptContext(session, cwd) {
   ];
   return {
     environmentContext: buildShellEnvironmentContext({ cwd }, ownerIsAgent, tools),
+    // Agent mode never carries project instruction files.
     instructionFilesContext:
-      session?.skipInstructionFiles === true
+      session?.skipInstructionFiles === true || sessionModeOf(session) === AGENT_MODE
         ? undefined
         : loadInstructionFilesContext({ mode: configuredInstructionFilesMode(), cwd }),
   };
@@ -90,24 +95,57 @@ export function buildWorkspacePromptContext(session, cwd) {
 
 // BP1/BP2/BP3 rule blocks plus the volatile environment, composed into the
 // four system blocks; environmentTailContext is the persisted env tail.
-export function sessionRolePromptFields(identity, { ownerIsAgent, toolFreeRole, delegationFree }) {
+// A Lead's BP3 rule slices, ordered for prefix sharing (composeSystemPrompt):
+// LEAD.md's common lines first; then the mode block (coding: LEAD.md's two
+// passages; agent mode: their conversational variants and AGENT_MODE.md);
+// then Mixy's MIXY.md; last the per-session tail — routine line, identity.
+// Agent mode is a Lead created as an agent (agent-mode.mjs).
+export function sessionRolePromptFields(
+  identity,
+  { ownerIsAgent, toolFreeRole, delegationFree, sessionMode, routine = false }
+) {
   const skipRules = identity.skipAgentRules || toolFreeRole;
+  const lead = !ownerIsAgent && !skipRules;
+  const agentMode = lead && sessionMode === AGENT_MODE;
+  const mixy = (identity.agent || MIXY_AGENT_ID) === MIXY_AGENT_ID;
   let roleRules = '';
   if (!skipRules) {
     roleRules = ownerIsAgent
       ? _buildAgentRules(identity.agentRulesProfile)
       : _buildLeadRules({ includeLeadBrief: !delegationFree });
   }
+  const identityLine = agentMode
+    ? agentModeIdentityLine(identity.agent || MIXY_AGENT_ID)
+    : lead
+      ? _buildLeadRules({ includeLeadBrief: !delegationFree, part: 'identity' })
+      : '';
   return {
     roleRules,
+    ...(lead
+      ? {
+          leadModeRules: _buildLeadRules({ includeLeadBrief: !delegationFree, part: agentMode ? 'agent' : 'coding' }),
+          identityContext: identityLine ? `# Identity\n\n${identityLine}` : '',
+        }
+      : {}),
+    ...(agentMode
+      ? {
+          agentModeRules: _buildAgentModeRules({ part: 'conduct' }),
+          ...(mixy ? { mixyRules: _buildAgentModeRules({ part: 'mixy' }) } : {}),
+          ...(routine ? { routineRules: _buildAgentModeRules({ part: 'routine' }) } : {}),
+        }
+      : {}),
     userPrompt: identity.systemPrompt,
-    skipRoleCatalog: !ownerIsAgent,
+    // A coding Lead carries no role section; an agent's home thread (a user
+    // session running as that agent) carries its own AGENT.md role, and Mixy
+    // in agent mode its optional agents/lead/AGENT.md.
+    skipRoleCatalog: !ownerIsAgent && (!identity.agent || identity.agent === 'lead') && !(agentMode && mixy),
     agent: identity.agent,
     profile: { skip: identity.profileSkip },
   };
 }
 
-export function composeSessionSystem(opts, { profile, providerName, modelName, surface }) {
+export function composeSessionSystem(opts, { profile, providerName, modelName, surface, sessionMode }) {
+  const agentMode = sessionMode === AGENT_MODE;
   const { ownerIsAgent, resolvedAgent, skills } = surface;
   // A tool-free hidden role (a one-shot classifier or title writer) carries
   // only its own role rules: the shared tool policy and the worker conduct
@@ -130,9 +168,15 @@ export function composeSessionSystem(opts, { profile, providerName, modelName, s
     agent: resolvedAgent,
     agentRulesProfile: surface.agentRulesProfile,
   };
-  const roleFields = sessionRolePromptFields(promptIdentity, { ownerIsAgent, toolFreeRole, delegationFree });
+  const roleFields = sessionRolePromptFields(promptIdentity, {
+    ownerIsAgent,
+    toolFreeRole,
+    delegationFree,
+    sessionMode,
+    routine: isRoutineSource(opts.sourceType),
+  });
   const leadOnly = !skipAgentRules && !ownerIsAgent;
-  const metaContext = leadOnly ? _buildLeadMetaContext() : '';
+  const metaContext = leadOnly ? _buildLeadMetaContext({ includeOutputStyle: !agentMode }) : '';
   // Lead-only response language; closes the environment block so no English
   // system text (session/shell/git lines) follows it.
   const languageContext = leadOnly ? _buildLeadLanguageContext() : '';
@@ -146,9 +190,10 @@ export function composeSessionSystem(opts, { profile, providerName, modelName, s
   // already sit at the end of this string to stay last after a refresh.
   const environmentTailContext = [shellEnvironmentContext, languageContext].filter(Boolean).join('\n\n---\n\n');
   // User instruction files (AGENTS.md / CLAUDE.md, global then the project
-  // root's); a tool-free role and a profile skipping `claudemd` get none.
+  // root's); a tool-free role, a profile skipping `claudemd` and agent mode
+  // get none.
   const instructionFilesContext =
-    toolFreeRole || profile?.skip?.claudemd
+    toolFreeRole || profile?.skip?.claudemd || agentMode
       ? ''
       : loadInstructionFilesContext({ mode: configuredInstructionFilesMode(), cwd: opts.cwd });
   const composed = composeSystemPrompt({
@@ -157,6 +202,8 @@ export function composeSessionSystem(opts, { profile, providerName, modelName, s
     metaContext: metaContext || undefined,
     languageContext: languageContext || undefined,
     workflowContext: opts.workflowContext || null,
+    // The workflow's orchestration and agent-catalog slices (workflow/context.mjs leadPromptParts).
+    ...(ownerIsAgent ? {} : opts.leadWorkflowParts),
     coreMemoryContext: opts.coreMemoryContext || null,
     instructionFilesContext: instructionFilesContext || null,
     skillManifest: buildSkillManifest(skills),

package/src/runtime/agent/orchestrator/session/manager/session-record.mjs

@@ -70,6 +70,20 @@ export function sessionOriginFields(opts, { profile, presetObj, providerCacheOpt
     // scheduler/daily-standup, webhook/github-push, lead/worker.
     sourceType: opts.sourceType || null,
     sourceName: opts.sourceName || null,
+    // The agent a schedule/webhook run acts for: whose memory it may write
+    // (session-runtime/services/memory-access.mjs). Absent on other sessions.
+    ...(opts.ownerAgentId ? { ownerAgentId: String(opts.ownerAgentId) } : {}),
+    // A coding task session an agent created (session create): who asked, from
+    // which thread, the request, and the title it was given.
+    ...(opts.taskOrigin
+      ? {
+          taskOrigin: opts.taskOrigin,
+          title: opts.taskOrigin.title,
+          titleLocked: true,
+          titleSource: 'ai',
+          titleUpdatedAt: Date.now(),
+        }
+      : {}),
     // Provider-scoped unified cache key — one shard per provider,
     // shared across all roles / sources (agent/maintenance/mcp/
     // scheduler/webhook). Role or source-specific context must be
@@ -137,6 +151,8 @@ export function buildSessionRecord({ opts, route, presetObj, surface, prompt, me
     selectedContextWindow: opts.selectedContextWindow || null,
     agent: opts.agent,
     owner: opts.owner || 'user',
+    // 'agent' | 'coding' (session/agent-mode.mjs), resolved at creation.
+    sessionMode: opts.sessionMode,
     bp3CoreContext: prompt.sessionMarkerCore,
     promptIdentity: prompt.promptIdentity,
     callerDisallowedTools: [...(opts.callerDisallowedTools ?? opts.disallowedTools ?? [])],

package/src/runtime/agent/orchestrator/session/manager/tool-resolution.mjs

@@ -22,8 +22,9 @@ import { ROUTE_TOOL_ORDER } from '../../runtime-core/tool-catalog-data.mjs';
 // the sort overhead on ~30 tools is negligible.
 function _getMcpTools(mcpScopeId = null, cwd = null) {
   // Project scope: servers limited to other project roots stay connected
-  // but leave this session's schema (session-runtime/extension-scopes).
-  const mcp = filterMcpToolsForSession(getMcpTools(mcpScopeId) || [], cwd);
+  // but leave this session's schema (session-runtime/extension-scopes). An
+  // agent's connectors apply at dispatch, never here.
+  const mcp = filterMcpToolsForSession(getMcpTools(mcpScopeId) || [], cwd, null);
   // `public:false` tools stay registered in internal-tools for runtime
   // rewrites/dispatch, but must never enter any model-visible schema (Lead
   // full/mcp included). Filter before mapping because the projection below