mixdog 1.2.6 → 1.3.0

package/src/session-runtime/services/channel-admin.mjs

@@ -23,13 +23,14 @@ import {
   setEndpointEnabled as dbSetEndpointEnabled,
 } from '../../runtime/channels/lib/webhooks-db.mjs';
 import { normalizeAutomationAttachments } from '../../runtime/shared/automation-attachments.mjs';
-import { migrateCodexModelRef } from '../../runtime/agent/orchestrator/providers/openai-oauth-catalog-store.mjs';
+import { assertRoutineOwner, routineOwnerProblem } from '../routine-owner.mjs';
 import { hasEnabledAutomation } from '../../runtime/shared/automation-presence.mjs';
 import { resolveScheduleTimezone, validateScheduleCron } from '../../runtime/shared/schedule-time.mjs';
 import { pgClusterExists } from '../../runtime/memory/lib/pg/adapter.mjs';
 import { resolvePluginData } from '../../runtime/shared/plugin-paths.mjs';
 import { readHookPublicBase } from '../../runtime/channels/lib/webhook/relay-tunnel.mjs';
 import { WEBHOOK_TEST_FIELD, WEBHOOK_TEST_HEADER } from '../../runtime/channels/lib/webhook/request-handler.mjs';
+import { MIXY_AGENT_ID, agentHomeSessionId } from '../../runtime/agent/orchestrator/session/agent-home.mjs';
 
 const NAME_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
 
@@ -187,7 +188,7 @@ function parseAtDatetime(at) {
 // Map the store's def shape onto the flat display shape every schedule reader
 // (channelSetup, renderChannelStatus, TUI pickers) consumes: `.time` renders
 // the cron or the one-shot datetime, `.route` the channel/session target.
-function scheduleToDisplay(s) {
+function scheduleToDisplay(s, ownerProblem = '') {
   return {
     name: s.name,
     description: s.description || '',
@@ -195,26 +196,85 @@ function scheduleToDisplay(s) {
     whenAt: s.whenAt || undefined,
     whenCron: s.whenCron || undefined,
     timezone: s.timezone || undefined,
-    // Shown (and re-saved by the editor) on the catalog successor of a superseded model.
-    model: s.model ? migrateCodexModelRef(s.model) : undefined,
     cwd: s.cwd || undefined,
-    workflow: s.workflow || undefined,
     attachments: s.attachments || undefined,
     enabled: s.enabled !== false,
     instructions: s.prompt,
     route: 'session',
+    // The bot it belongs to: each run is a turn in that bot's chat.
+    owner: s.ownerAgentId || MIXY_AGENT_ID,
+    // Why it is paused for its owner (routine-owner.mjs); absent when it runs.
+    ...(ownerProblem ? { ownerProblem } : {}),
+    nextFireAt: isoOrUndefined(s.nextFireAt),
+    lastSuccessAt: isoOrUndefined(s.lastSuccessAt),
+    lastFailedAt: isoOrUndefined(s.lastFailedAt),
+    lastSkippedAt: isoOrUndefined(s.lastSkippedAt),
+    ...routineHealth(s),
+  };
+}
+
+// Failures in a row (the routine pauses itself at the limit) and the results
+// of finished runs still not queued for the owner: `{ count, failed, error }`,
+// `failed` when the queue refused one (the app offers a retry).
+function routineHealth(row) {
+  const entries = Object.values(row.resultDelivery || {}).filter(Boolean);
+  const refused = entries.filter((entry) => entry.state === 'failed').at(-1);
+  return {
+    consecutiveFailures: Number(row.consecutiveFailures) || 0,
+    ...(entries.length
+      ? {
+          undelivered: {
+            count: entries.length,
+            failed: Boolean(refused),
+            ...(refused?.error ? { error: String(refused.error) } : {}),
+          },
+        }
+      : {}),
+  };
+}
+
+function isoOrUndefined(value) {
+  if (!value) return undefined;
+  const at = new Date(value);
+  return Number.isNaN(at.getTime()) ? undefined : at.toISOString();
+}
+
+// A schedule's or webhook's owner: an explicit agent id, else the saved owner
+// on an overwrite, else Mixy.
+function scheduleOwner(owner, existing) {
+  const value = String(owner ?? '').trim();
+  if (value) {
+    if (!agentHomeSessionId(value)) throw new Error(`schedule owner "${value}" is not a valid agent id`);
+    return value;
+  }
+  return existing?.ownerAgentId || MIXY_AGENT_ID;
+}
+
+/** Each owner's problem (routine-owner.mjs), probed once per owner. */
+function ownerProblems() {
+  const seen = new Map();
+  return (ownerAgentId) => {
+    const owner = ownerAgentId || MIXY_AGENT_ID;
+    if (!seen.has(owner))
+      seen.set(
+        owner,
+        routineOwnerProblem(owner).catch(() => '')
+      );
+    return seen.get(owner);
   };
 }
 
 export async function listSchedules() {
   const rows = await dbListSchedules();
-  return rows.map(scheduleToDisplay);
+  const problemOf = ownerProblems();
+  return Promise.all(rows.map(async (row) => scheduleToDisplay(row, await problemOf(row.ownerAgentId))));
 }
 
 // Register or update a schedule in the PG store. Recurring input maps `time`
 // (+ optional `days`) to a cron; one-shot input maps an `at` datetime; the two
 // are mutually exclusive (also enforced by the store's when_at/when_cron XOR).
-// Every schedule runs as a visible app session and requires a model.
+// Every schedule runs as a turn in its owner bot's chat; a bot that does not
+// exist (no representative bot yet, an archived bot) cannot own one.
 export async function saveSchedule({
   name,
   description = '',
@@ -222,26 +282,26 @@ export async function saveSchedule({
   at,
   timezone,
   days,
-  model,
   cwd,
-  workflow,
   attachments,
   enabled,
   instructions,
+  owner,
   overwrite = false,
 } = {}) {
   const id = assertScheduleName(name);
   const body = String(instructions || '').trim();
   if (!body) throw new Error('schedule instructions are required');
-  const scheduleModel = String(model || '').trim();
-  if (!scheduleModel) throw new Error('schedule model is required — choose a model before saving');
   const hasTime = time != null && String(time).trim() !== '';
   const hasAt = at != null && String(at).trim() !== '';
   if (hasTime && hasAt) throw new Error('provide either `time` (recurring) or `at` (one-shot), not both');
   if (!hasTime && !hasAt) throw new Error('either `time` (recurring cron) or `at` (one-shot datetime) is required');
-  if (overwrite !== true && (await dbGetSchedule(id))) {
+  const existing = await dbGetSchedule(id);
+  if (overwrite !== true && existing) {
     throw new Error(`schedule "${id}" already exists`);
   }
+  const ownerAgentId = scheduleOwner(owner, existing);
+  await assertRoutineOwner(ownerAgentId);
   const whenCron = hasTime ? validateScheduleCron(foldDaysIntoCron(normalizeCron(time), days)) : null;
   const whenAt = hasAt ? parseAtDatetime(at) : null;
   const scheduleTimezone = hasTime ? resolveScheduleTimezone(timezone) : null;
@@ -253,14 +313,13 @@ export async function saveSchedule({
     timezone: scheduleTimezone,
     target: 'session',
     channelId: null,
-    model: scheduleModel,
     cwd: cwd ? String(cwd).trim() : null,
-    workflow: workflow ? String(workflow).trim() : null,
     attachments: normalizeAutomationAttachments(attachments),
     delivery: 'app',
     prompt: body,
     enabled: enabled !== false,
     nextFireAt: whenAt,
+    ownerAgentId,
   });
   automationProbe.invalidate();
   return scheduleToDisplay(saved);
@@ -287,13 +346,13 @@ export async function setScheduleEnabled(name, enabled) {
 // store's migration hook.
 async function listWebhooks() {
   const endpoints = await dbListEndpoints();
-  return endpoints.map((ep) => ({
+  const problemOf = ownerProblems();
+  const problems = await Promise.all(endpoints.map((ep) => problemOf(ep.ownerAgentId)));
+  return endpoints.map((ep, index) => ({
     name: ep.name,
     description: ep.description || '',
     parser: ep.parser || 'github',
-    ...(ep.model ? { model: migrateCodexModelRef(ep.model) } : {}),
     ...(ep.cwd ? { cwd: ep.cwd } : {}),
-    ...(ep.workflow ? { workflow: ep.workflow } : {}),
     ...(ep.attachments ? { attachments: ep.attachments } : {}),
     enabled: ep.enabled,
     // The store never projects the plaintext secret through list paths; it
@@ -302,6 +361,16 @@ async function listWebhooks() {
     secret: undefined,
     instructions: ep.instructions,
     route: 'session',
+    // The bot it belongs to: each run is a turn in that bot's chat.
+    owner: ep.ownerAgentId || MIXY_AGENT_ID,
+    ...(problems[index] ? { ownerProblem: problems[index] } : {}),
+    lastEventAt: isoOrUndefined(ep.lastEventAt),
+    lastSuccessAt: isoOrUndefined(ep.lastSuccessAt),
+    lastFailedAt: isoOrUndefined(ep.lastFailedAt),
+    lastSkippedAt: isoOrUndefined(ep.lastSkippedAt),
+    // Whether "Run now" has a received payload to re-run (never the payload).
+    hasLastPayload: ep.hasLastPayload === true,
+    ...routineHealth(ep),
   }));
 }
 
@@ -310,12 +379,11 @@ export async function saveWebhook({
   description = '',
   parser = 'github',
   secret,
-  model,
   cwd,
-  workflow,
   attachments,
   enabled,
   instructions,
+  owner,
   overwrite = false,
 } = {}) {
   const id = assertName(name, 'webhook name');
@@ -327,9 +395,12 @@ export async function saveWebhook({
   }
   const body = String(instructions || '').trim();
   if (!body) throw new Error('webhook instructions are required');
-  if (overwrite !== true && (await dbLoadEndpoint(id))) {
+  const existing = await dbLoadEndpoint(id);
+  if (overwrite !== true && existing) {
     throw new Error(`webhook "${id}" already exists`);
   }
+  const ownerAgentId = scheduleOwner(owner, existing);
+  await assertRoutineOwner(ownerAgentId);
   // Secret semantics: an explicit value always wins; an EMPTY value on an
   // overwrite PRESERVES the stored secret (editing instructions must not
   // silently rotate the key the external service was configured with); only
@@ -343,23 +414,21 @@ export async function saveWebhook({
     description: String(description || '').trim(),
     parser: nextParser,
     channelId: null,
-    model: model ? String(model).trim() : null,
     cwd: cwd ? String(cwd).trim() : null,
-    workflow: workflow ? String(workflow).trim() : null,
     attachments: normalizeAutomationAttachments(attachments),
     delivery: 'app',
     secret: secretValue,
     instructions: body,
     enabled: enabled !== false,
+    ownerAgentId,
   });
   automationProbe.invalidate();
   return {
     name: id,
+    owner: saved.ownerAgentId || ownerAgentId,
     description: saved.description,
     parser: saved.parser,
-    ...(saved.model ? { model: saved.model } : {}),
     ...(saved.cwd ? { cwd: saved.cwd } : {}),
-    ...(saved.workflow ? { workflow: saved.workflow } : {}),
     ...(saved.attachments ? { attachments: saved.attachments } : {}),
     ...(enabled === false ? { enabled: false } : {}),
     secret: secretValue,

package/src/session-runtime/services/memory-access.mjs

@@ -0,0 +1,37 @@
+// Whose memory a session reads and writes (runtime/memory/lib/
+// core-memory-access.mjs enforces it). Mixy is the Lead configuration, so the
+// user's own sessions (an ordinary Lead session, Mixy's home) act as Mixy; an
+// agent's home thread and its room member sessions act as that agent; a
+// schedule or webhook run acts for its owning agent (`ownerAgentId`, stamped
+// at creation); a delegated agent as its own agent id.
+import { MIXY_AGENT_ID, agentHomeSessionId } from '../../runtime/agent/orchestrator/session/agent-home.mjs';
+import { resolveSessionMode } from '../../runtime/agent/orchestrator/session/agent-mode.mjs';
+import { isAgentOwner } from '../../runtime/agent/orchestrator/agent-owner.mjs';
+import { scheduleCallerScope } from './schedule-access.mjs';
+
+const validAgentId = (value) => {
+  const id = typeof value === 'string' ? value.trim() : '';
+  return id && agentHomeSessionId(id) ? id : '';
+};
+
+/** The `memory_caller` `{ kind, agentId }` of a calling session record:
+ *  'human' and 'agent' are conversations with the user, 'room-member' and
+ *  'headless' unattended runs. */
+export function memoryCallerScope(session) {
+  const scope = scheduleCallerScope(session);
+  if (scope.kind === 'human') return { kind: 'human', agentId: MIXY_AGENT_ID };
+  if (scope.kind !== 'headless') return scope;
+  const delegated = isAgentOwner(session) || Boolean(session?.parentSessionId);
+  return {
+    kind: 'headless',
+    agentId: validAgentId(session?.ownerAgentId) || (delegated ? validAgentId(session?.agent) : ''),
+  };
+}
+
+/** The agent whose own memory a session's prompt carries: its home thread's,
+ *  room member's or run owner's agent, Mixy for the user's Lead sessions, and
+ *  none for a delegated agent. `session` is the live record when there is
+ *  one, else the reserved id and creation profile. */
+export function injectedMemoryAgentId({ session = null, sessionId = '', profile = null } = {}) {
+  return resolveSessionMode({ session, sessionId, profile }).agentId;
+}

package/src/session-runtime/services/provider-admin.mjs

@@ -367,6 +367,7 @@ function oauthAuthFields(p, auth) {
     status: auth.status || (authenticated ? 'Set' : 'Not Set'),
     detail: auth.detail || p.desc,
     expiresAt: auth.expiresAt || null,
+    plan: auth.plan || null,
     usable: auth.usable === true || (auth.usable == null && authenticated),
     refreshable: auth.refreshable === true,
     reauthRequired: auth.reauthRequired === true,
@@ -958,8 +959,8 @@ async function withTimeout(run, ms, label) {
   }
 }
 
-function existingCustomEntry(cfgMod, id) {
-  const entry = cfgMod.loadConfig().providers?.[id];
+function existingCustomEntry(config, id) {
+  const entry = config.providers?.[id];
   if (!isCustomProviderId(id) || !isCustomProviderConfig(entry)) throw new Error(`unknown custom provider "${id}"`);
   return entry;
 }
@@ -1021,16 +1022,15 @@ function withStoredSettings(input, entry) {
   return out;
 }
 
-// Validated, secret-free config for `input`; the key (typed, else stored for an
-// existing provider) is resolved separately and never enters the config.
-async function resolveCustomInput(cfgMod, rawInput, options) {
-  let input = inputObject(rawInput);
-  validateCustomTransportFields(input);
+// Validated, secret-free config for `input` over one config snapshot (the
+// stored entry supplies an edit's omitted settings); the key (typed, else
+// stored for an existing provider) is resolved separately and never enters
+// the config. Synchronous, so a caller can merge and commit one snapshot.
+function customInputAt(snapshot, input, normalizeCustomProviderConfig, options) {
   const id = input.id === undefined ? null : input.id;
-  if (id) input = withStoredSettings(input, existingCustomEntry(cfgMod, id));
-  const { normalizeCustomProviderConfig } = await loadCustomProviderModule();
-  const config = normalizeCustomProviderConfig(input, options);
-  const typed = typeof input.apiKey === 'string' ? input.apiKey.trim() : '';
+  const merged = id ? withStoredSettings(input, existingCustomEntry(snapshot, id)) : input;
+  const config = normalizeCustomProviderConfig(merged, options);
+  const typed = typeof merged.apiKey === 'string' ? merged.apiKey.trim() : '';
   const keyless = config.auth === 'none';
   const envName = keyless ? '' : config.apiKeyEnv || '';
   let apiKey = '';
@@ -1039,36 +1039,71 @@ async function resolveCustomInput(cfgMod, rawInput, options) {
   return { id, config, typed: keyless || envName ? '' : typed, apiKey, keyless, envName };
 }
 
+async function resolveCustomInput(cfgMod, rawInput, options) {
+  const input = inputObject(rawInput);
+  validateCustomTransportFields(input);
+  const { normalizeCustomProviderConfig } = await loadCustomProviderModule();
+  return customInputAt(cfgMod.loadConfig(), input, normalizeCustomProviderConfig, options);
+}
+
+function requireCustomKey({ apiKey, keyless, envName }) {
+  if (!keyless && !envName && !apiKey) throw new Error('API key is required');
+}
+
+// One key transaction per provider, from reading the rollback key to the
+// config commit or rollback: a failed save restores the key the preceding
+// save committed and never one a newer save wrote. Settings-only saves and
+// other providers never wait.
+const customKeySaves = new Map();
+
+function serializeCustomKeySave(id, run) {
+  const result = (customKeySaves.get(id) || Promise.resolve()).then(run);
+  const settled = result.then(
+    () => {},
+    () => {}
+  );
+  customKeySaves.set(id, settled);
+  settled.then(() => {
+    if (customKeySaves.get(id) === settled) customKeySaves.delete(id);
+  });
+  return result;
+}
+
 export async function saveCustomProvider(cfgMod, rawInput) {
   requireLocalProviderManagement();
-  const {
-    id: existingId,
-    config,
-    typed,
-    apiKey,
-    keyless,
-    envName,
-  } = await resolveCustomInput(cfgMod, rawInput, { requireModels: false });
-  if (!keyless && !envName && !apiKey) throw new Error('API key is required');
+  // Early verdict: an invalid save never touches the keychain.
+  const resolved = await resolveCustomInput(cfgMod, rawInput, { requireModels: false });
+  requireCustomKey(resolved);
+  const { id: existingId, typed } = resolved;
   const id = existingId || `custom-${randomUUID()}`;
-  const entry = { ...config, type: 'custom', enabled: config.enabled !== false };
-  const account = SECRET_ACCOUNTS.agentApiKey(id);
-  const previousKey = typed && existingId ? getAgentApiKey(id) : null;
-  if (typed) await saveSecretAsync(account, typed);
-  try {
-    const current = cfgMod.loadConfig();
-    cfgMod.saveConfig(
-      { ...current, providers: { ...(current.providers || {}), [id]: entry } },
-      { baseConfig: current }
-    );
-  } catch (error) {
-    if (typed) {
-      if (previousKey) await saveSecretAsync(account, previousKey);
-      else await deleteSecretAsync(account);
+  const { normalizeCustomProviderConfig } = await loadCustomProviderModule();
+  const commit = async () => {
+    const account = SECRET_ACCOUNTS.agentApiKey(id);
+    const previousKey = typed && existingId ? getAgentApiKey(id) : null;
+    if (typed) await saveSecretAsync(account, typed);
+    let entry;
+    try {
+      // Synchronous from here: omitted settings come from the config this
+      // save commits over, so an edit that landed during the awaits above (a
+      // model's visibility, a peer save, a removal) is never reverted.
+      const current = cfgMod.loadConfig();
+      const latest = customInputAt(current, rawInput, normalizeCustomProviderConfig, { requireModels: false });
+      requireCustomKey(latest);
+      entry = { ...latest.config, type: 'custom', enabled: latest.config.enabled !== false };
+      cfgMod.saveConfig(
+        { ...current, providers: { ...(current.providers || {}), [id]: entry } },
+        { baseConfig: current }
+      );
+    } catch (error) {
+      if (typed) {
+        if (previousKey) await saveSecretAsync(account, previousKey);
+        else await deleteSecretAsync(account);
+      }
+      throw error;
     }
-    throw error;
-  }
-  return customProviderRow(id, entry);
+    return customProviderRow(id, entry);
+  };
+  return typed ? serializeCustomKeySave(id, commit) : commit();
 }
 
 const MODEL_PATCH_KEYS = new Set(['manual', 'hidden', 'name', 'contextWindow', 'maxOutputTokens', 'reasoning']);
@@ -1104,7 +1139,7 @@ export async function updateCustomProviderModel(cfgMod, rawId, rawModelId, patch
   // Everything below is synchronous: the provider is read, patched and saved
   // without yielding, so a concurrent update can never be overwritten by a
   // provider object read before the await above.
-  const entry = existingCustomEntry(cfgMod, id);
+  const entry = existingCustomEntry(cfgMod.loadConfig(), id);
   const current = normalizeCustomProviderConfig(entry, { requireModels: false });
   const overrides = new Map(Object.entries(current.modelOverrides || {}));
   if (patch === null) {
@@ -1241,7 +1276,7 @@ function withoutProviderReferences(config, id) {
 export async function removeCustomProvider(cfgMod, rawId) {
   requireLocalProviderManagement();
   const id = String(rawId || '').trim();
-  existingCustomEntry(cfgMod, id);
+  existingCustomEntry(cfgMod.loadConfig(), id);
   // Secret first: a real keychain failure (locked, permission) leaves the
   // provider registered so the removal can be retried. A missing secret
   // (keyless provider) is not an error.

package/src/session-runtime/services/schedule-access.mjs

@@ -0,0 +1,91 @@
+// Who may manage automations (schedules and webhooks) from a chat, by the
+// calling session's provenance. Enforced by every setup automation action
+// (setup-tool/extended-actions.mjs), the chat-facing door of channel-admin:
+// - the human's own sessions (an ordinary Lead session, Mixy's home) manage
+//   every automation and may move one to an agent that exists;
+// - another agent's home thread manages only the automations it owns and can
+//   never give one away;
+// - a headless run (schedule, webhook, delegated agent, or a session that
+//   cannot be resolved) manages none — nor does it change any other setting
+//   (setup-tool/executor.mjs refuses every mutating setup action for it).
+// - a group-room member session is no background run, but it speaks for the
+//   room, not for the user: it creates or changes no agent, automation or
+//   other setting either.
+// The app's own panels call channel-admin directly and act for the human.
+import { MIXY_AGENT_ID, agentIdOfHomeSession } from '../../runtime/agent/orchestrator/session/agent-home.mjs';
+import { roomMemberOfSession } from '../../runtime/agent/orchestrator/session/agent-room.mjs';
+import { mixyDisplayName } from '../../runtime/agent/orchestrator/session/mixy-name.mjs';
+import { isAgentOwner } from '../../runtime/agent/orchestrator/agent-owner.mjs';
+
+const INTERACTIVE_SOURCE_TYPES = new Set(['', 'lead', 'cli']);
+
+/** `{ kind: 'human' | 'agent' | 'room-member' | 'headless', agentId? }` of a session record. */
+export function scheduleCallerScope(session) {
+  const id = String(session?.id || '');
+  const member = roomMemberOfSession(id);
+  if (member) return { kind: 'room-member', agentId: member.agentId };
+  const homeAgent = agentIdOfHomeSession(id);
+  if (homeAgent) return homeAgent === MIXY_AGENT_ID ? { kind: 'human' } : { kind: 'agent', agentId: homeAgent };
+  const headless =
+    !id ||
+    isAgentOwner(session) ||
+    Boolean(session.parentSessionId) ||
+    Boolean(session.ownerSessionId && session.ownerSessionId !== id) ||
+    !INTERACTIVE_SOURCE_TYPES.has(String(session.sourceType || '').toLowerCase());
+  return headless ? { kind: 'headless' } : { kind: 'human' };
+}
+
+/** Throws unless `scope` may `action` the `kind` ('schedule' | 'webhook')
+ *  automation `current` (null when creating) with `owner` the requested owner
+ *  ('' keeps the saved one). `agentIds` are the agents a transfer may name;
+ *  Mixy always counts. */
+export function assertAutomationAccess(
+  scope,
+  { kind = 'schedule', action, current = null, owner = '', agentIds = [] }
+) {
+  if (scope?.kind === 'room-member') throw new Error(`A group-room member cannot ${action} ${kind}s`);
+  if (scope?.kind !== 'human' && scope?.kind !== 'agent') {
+    throw new Error(`A background run cannot ${action} ${kind}s`);
+  }
+  const requested = String(owner ?? '').trim();
+  const saved = current ? current.owner || MIXY_AGENT_ID : '';
+  if (scope.kind === 'agent') {
+    if (current && saved !== scope.agentId) {
+      throw new Error(
+        `${kind === 'webhook' ? 'Webhook' : 'Schedule'} "${current.name}" belongs to another agent; this thread manages only its own ${kind}s`
+      );
+    }
+    if (requested && requested !== scope.agentId) throw new Error(`This thread cannot give a ${kind} to another agent`);
+    return;
+  }
+  if (requested && requested !== saved && requested !== MIXY_AGENT_ID && !agentIds.includes(requested)) {
+    throw new Error(`Agent "${requested}" does not exist`);
+  }
+}
+
+/** Throws unless `caller` (scope `scope`) is Mixy — its home thread or an
+ *  ordinary Lead session acting as 'lead': only Mixy creates, edits or
+ *  deletes agent definitions from a chat. The app's own panels call the agent
+ *  editor directly and act for the human. */
+export function assertAgentEditorAccess(scope, caller, action) {
+  const acting = String(caller?.agent || '').trim();
+  if (scope?.kind === 'human' && (!acting || acting === MIXY_AGENT_ID)) return;
+  const name = mixyDisplayName();
+  throw new Error(
+    `Only ${name} (the representative agent) can create, edit or delete agents (setup ${action}); ask the user to do it with ${name} or in the Agents settings`
+  );
+}
+
+/** Throws when an agent's home thread changes another agent's settings. */
+export function assertOwnAgentSettings(scope, agentId, action) {
+  if (scope?.kind === 'agent' && String(agentId || '').trim() !== scope.agentId) {
+    throw new Error(`This thread manages only its own agent's settings (setup ${action})`);
+  }
+}
+
+/** Throws when `scope` is a headless run: it reads settings, never changes them. */
+export function assertInteractiveCaller(scope, action) {
+  if (scope?.kind === 'human' || scope?.kind === 'agent') return;
+  if (scope?.kind === 'room-member') throw new Error(`A group-room member cannot change settings (setup ${action})`);
+  throw new Error(`A background run cannot change settings (setup ${action})`);
+}

package/src/session-runtime/session-create/session-options.mjs

@@ -2,11 +2,14 @@
 // the current runtime state: route, tool spec, ownership/lane, workflow pack,
 // memory context and compaction.
 import { normalizeCompactionConfig } from '../../runtime/agent/orchestrator/runtime-core/config-helpers.mjs';
-import { hasOwn } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
+import { clean, hasOwn } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 import { toolSpecForMode } from '../../runtime/agent/orchestrator/runtime-core/effort.mjs';
-import { pluginDataDir } from '../runtime-paths.mjs';
+import { STANDALONE_ROOT, pluginDataDir } from '../runtime-paths.mjs';
+import { readAgentFrontmatterPermission } from '../services/agent-tool/helpers.mjs';
 import { LEAD_DISALLOWED_TOOLS } from '../../runtime/agent/orchestrator/runtime-core/tool-defs.mjs';
 import { HEADLESS_TOOL_PROFILE } from '../../runtime/agent/orchestrator/runtime-core/tool-profile.mjs';
+import { AGENT_MODE, resolveSessionMode } from '../../runtime/agent/orchestrator/session/agent-mode.mjs';
+import { MIXY_AGENT_ID } from '../../runtime/agent/orchestrator/session/agent-home.mjs';
 
 // Ownership and permission fields an agent-owned session inherits from its profile.
 function agentOwnedSessionFields(sessionProfile) {
@@ -31,14 +34,30 @@ export function sessionOptions(deps, coreMemoryContext) {
   // Load the active WORKFLOW.md pack once for both summary + context block.
   const {
     summary: workflow,
-    context: leadWorkflowContext,
+    leadPromptParts,
     packContext,
     orchestrationMode,
   } = activeWorkflowContext(rt.config, dataDir);
   const sessionProfile = rt.sessionProfile && typeof rt.sessionProfile === 'object' ? rt.sessionProfile : null;
   const agentOwned = sessionProfile?.owner === 'agent' || sessionProfile?.visibility === 'agent-only';
-  // Agent-owned sessions keep the Active Workflow block only.
-  const workflowContext = agentOwned ? packContext : leadWorkflowContext;
+  // Agent or coding mode, from the one resolver (agent-mode.mjs).
+  const { mode: sessionMode, agentId: actingAgent } = resolveSessionMode({
+    sessionId: rt.reservedSessionId,
+    profile: sessionProfile,
+  });
+  // An agent's home thread: a user conversation that runs AS that agent (its
+  // AGENT.md role and permission); route comes with the create call.
+  const homeAgent = agentOwned ? '' : clean(sessionProfile?.homeAgent);
+  const homePermission = homeAgent ? readAgentFrontmatterPermission(homeAgent, dataDir, STANDALONE_ROOT) : null;
+  // A coding task session an agent created (session create): the user's own
+  // Lead, tagged with its origin; `sourceName` lets the Agents list file it.
+  const taskOrigin = agentOwned ? null : sessionProfile?.taskOrigin || null;
+  // Every session leads BP3 with the Active Workflow block; a Lead adds its
+  // orchestration and catalog slices (coding, agent mode or Mixy's).
+  const workflowContext = packContext;
+  const leadWorkflowParts = agentOwned
+    ? undefined
+    : leadPromptParts({ agentMode: sessionMode === AGENT_MODE, mixy: actingAgent === MIXY_AGENT_ID });
   const callerDisallowedTools = [
     ...(agentOwned ? [] : LEAD_DISALLOWED_TOOLS),
     ...(!agentOwned && rt.disallowDelegation ? ['agent'] : []),
@@ -51,7 +70,8 @@ export function sessionOptions(deps, coreMemoryContext) {
     tools: toolSpecForMode(rt.mode),
     ...(Array.isArray(schemaAllowedTools) ? { schemaAllowedTools } : {}),
     owner: agentOwned ? 'agent' : 'cli',
-    agent: agentOwned ? sessionProfile?.agent || 'worker' : 'lead',
+    agent: agentOwned ? sessionProfile?.agent || 'worker' : homeAgent || 'lead',
+    ...(homePermission ? { permission: homePermission } : {}),
     lane: agentOwned ? 'agent' : 'cli',
     // One-shot `mixdog exec` runs carry their own source so session catalogs
     // can keep them out of the user's resumable list.
@@ -60,7 +80,12 @@ export function sessionOptions(deps, coreMemoryContext) {
       : rt.toolProfile === HEADLESS_TOOL_PROFILE
         ? 'exec'
         : 'lead',
-    sourceName: agentOwned ? sessionProfile?.sourceName || sessionProfile?.agent || 'agent' : 'main',
+    sourceName: agentOwned
+      ? sessionProfile?.sourceName || sessionProfile?.agent || 'agent'
+      : taskOrigin
+        ? `agent:${taskOrigin.agentId}`
+        : 'main',
+    ...(taskOrigin ? { taskOrigin } : {}),
     ...(rt.approvalMode ? { approvalMode: rt.approvalMode } : {}),
     clientHostPid: sessionProfile?.clientHostPid || process.pid,
     mcpScopeId: rt.mcpScopeId,
@@ -71,6 +96,8 @@ export function sessionOptions(deps, coreMemoryContext) {
     coreMemoryContext,
     workflow,
     workflowContext,
+    ...(leadWorkflowParts ? { leadWorkflowParts } : {}),
+    sessionMode,
     orchestrationMode,
     fast: rt.route.fast === true,
     autoEffort: rt.route.autoEffort !== false,