mixdog 1.2.6 → 1.3.1

package/src/runtime/agent/orchestrator/session/loop/tool-exec/before-hook.mjs

@@ -6,10 +6,16 @@ import { resolvePreToolAskApproval } from '../tool-helpers.mjs';
 import { runAbortable, throwIfAborted } from '../../../../../shared/abort-race.mjs';
 import { evaluateExecPolicy } from '../../../tools/bash-policy-scan.mjs';
 import { beginSessionApprovalWait } from '../../manager/runtime-liveness.mjs';
+import { agentMcpToolPermission } from '../../../mcp/agent-connectors.mjs';
+import { humanGateDecision, recordHumanDecision } from '../../human-gate/gate.mjs';
+import { applyEditedArgs } from '../../human-gate/requests.mjs';
 
 const isArgsObject = (value) => value && typeof value === 'object' && !Array.isArray(value);
 
-async function askApproval(call, { callerSessionId, executeOpts, toolApprovalHook, decision }) {
+async function askApproval(
+  call,
+  { callerSessionId, executeOpts, toolApprovalHook, decision, request = null, gate = null }
+) {
   const askReason = String(decision?.reason || 'approval requested by hook').trim();
   // While the user decides, the session is waiting on them, not working.
   const releaseApprovalWait = beginSessionApprovalWait(callerSessionId);
@@ -24,17 +30,45 @@ async function askApproval(call, { callerSessionId, executeOpts, toolApprovalHoo
         toolCallId: executeOpts.toolCallId || null,
         askReason,
         toolApprovalHook,
+        request,
       })
     );
   } finally {
     releaseApprovalWait();
   }
-  if (askOutcome.denial) return { denial: askOutcome.denial };
   const approval = askOutcome.approval;
+  await recordHumanDecision(gate, approval);
+  if (askOutcome.denial) return { denial: askOutcome.denial };
   if (approval && typeof approval === 'object' && isArgsObject(approval.args)) call.args = approval.args;
+  // The card's edited text replaces the model's before the call runs.
+  if (request?.kind === 'outbound' && approval?.editedArgs) {
+    call.args = applyEditedArgs(call.args, approval.editedArgs, request.outbound?.editable);
+  }
+  // The user approved this very call on the richer outbound card.
+  if (request?.kind === 'outbound') call.outboundApproved = true;
   return null;
 }
 
+export const CONNECTOR_APPROVAL_REASON = 'This connector tool is set to ask before it runs for this agent.';
+
+/**
+ * A connector tool the running agent set to `needs_approval` asks through the
+ * ordinary approval hook, whatever the PreToolUse hooks decided. Run after
+ * them, on the final call: a renamed call is judged under its final name.
+ * A call the outbound card already got approved is not asked a second time.
+ * @returns {Promise<{ denial: string } | null>} the denial, or null to run
+ */
+export function applyConnectorApproval(call, { agentId, callerSessionId, executeOpts, toolApprovalHook }) {
+  if (call.outboundApproved) return null;
+  if (agentMcpToolPermission(agentId, call.name) !== 'needs_approval') return null;
+  return askApproval(call, {
+    callerSessionId,
+    executeOpts,
+    toolApprovalHook,
+    decision: { reason: CONNECTOR_APPROVAL_REASON },
+  });
+}
+
 /**
  * Elevation pass for a shell call (or a terminal `run`) whose exec policy
  * decision is 'ask' (elevated launch). Runs after the final call is known.
@@ -62,22 +96,40 @@ export async function applyBeforeToolHook({
   executeOpts,
   beforeToolHook,
   toolApprovalHook,
+  mcpScopeId = null,
 }) {
   const call = { name, args, cwd };
   // ask_user is itself the user prompt; it never goes through the ordinary approval gate.
-  if (!beforeToolHook || name === 'ask_user') return call;
+  if (name === 'ask_user') return call;
   try {
-    const decision = await runAbortable(executeOpts.signal, () =>
-      beforeToolHook(
-        {
-          name,
-          args,
-          cwd,
-          sessionId: callerSessionId,
-          toolCallId: executeOpts.toolCallId || null,
-        },
-        { signal: executeOpts.signal }
-      )
+    const hookDecision = beforeToolHook
+      ? await runAbortable(executeOpts.signal, () =>
+          beforeToolHook(
+            {
+              name,
+              args,
+              cwd,
+              sessionId: callerSessionId,
+              toolCallId: executeOpts.toolCallId || null,
+            },
+            { signal: executeOpts.signal }
+          )
+        )
+      : null;
+    // Outbound sends ask the user whatever the hooks allowed (human-gate/gate.mjs).
+    // Judged as the call will run: only a rewriting decision changes name/args.
+    const hookAction = String(hookDecision?.action || hookDecision?.decision || '').toLowerCase();
+    const rewritten = hookAction === 'ask' || hookAction === 'modify' || hookAction === 'rewrite';
+    const { decision, request, gate } = await humanGateDecision(
+      {
+        name:
+          rewritten && typeof hookDecision?.name === 'string' && hookDecision.name.trim()
+            ? hookDecision.name.trim()
+            : name,
+        args: rewritten && isArgsObject(hookDecision?.args) ? hookDecision.args : args,
+      },
+      hookDecision,
+      { sessionId: callerSessionId, mcpScopeId }
     );
     const action = String(decision?.action || decision?.decision || '').toLowerCase();
     if (action === 'deny' || action === 'block') {
@@ -89,7 +141,14 @@ export async function applyBeforeToolHook({
       if (typeof decision?.name === 'string' && decision.name.trim()) call.name = decision.name.trim();
     }
     if (action === 'ask') {
-      const denied = await askApproval(call, { callerSessionId, executeOpts, toolApprovalHook, decision });
+      const denied = await askApproval(call, {
+        callerSessionId,
+        executeOpts,
+        toolApprovalHook,
+        decision,
+        request,
+        gate,
+      });
       if (denied) return denied;
     }
   } catch (error) {

package/src/runtime/agent/orchestrator/session/loop/tool-exec.mjs

@@ -14,7 +14,7 @@ import { runWithToolExecutionOwner } from '../../../../shared/tool-execution-own
 import { runWithLocalSearchTelemetry } from '../../tools/builtin/local-search-telemetry.mjs';
 import { throwIfAborted } from '../../../../shared/abort-race.mjs';
 import { prepareToolCall } from './tool-exec/call-prep.mjs';
-import { applyBeforeToolHook, applyShellElevationGate } from './tool-exec/before-hook.mjs';
+import { applyBeforeToolHook, applyConnectorApproval, applyShellElevationGate } from './tool-exec/before-hook.mjs';
 import { dispatchToolCall } from './tool-exec/dispatch.mjs';
 import { applyAfterToolHook } from './tool-exec/after-hook.mjs';
 import { runReadOnlyIoWithDeadline } from './tool-exec/read-only-deadline.mjs';
@@ -50,8 +50,16 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
     executeOpts,
     beforeToolHook: hookFrom(executeOpts, sessionRef, 'beforeToolHook'),
     toolApprovalHook,
+    mcpScopeId: sessionRef?.mcpScopeId || null,
   });
   if (hooked.denial) return hooked.denial;
+  const connectorDenied = await applyConnectorApproval(hooked, {
+    agentId: sessionRef?.agent,
+    callerSessionId,
+    executeOpts,
+    toolApprovalHook,
+  });
+  if (connectorDenied) return connectorDenied.denial;
   // A decision can settle after its turn was cancelled. It must never
   // authorize a new mutation, even if the hook ignores the abort signal.
   throwIfAborted(executeOpts.signal);

package/src/runtime/agent/orchestrator/session/loop/tool-exposure-migration.mjs

@@ -27,12 +27,13 @@ function invalidateForToolSurfaceMigration(session) {
 }
 
 /**
- * After a surface re-apply outside a request (resume, provider switch)
- * migrated the exposure: the first send of the next turn carries the tag.
+ * After a surface re-apply outside a request (resume, provider switch, a
+ * workflow switch: `intent`) changed the request prefix: the first send of the
+ * next turn carries the tag.
  */
-export function markToolSurfaceMigrated(session) {
+export function markToolSurfaceMigrated(session, intent = TOOL_SURFACE_MIGRATION_INTENT) {
   invalidateForToolSurfaceMigration(session);
-  session.pendingCacheBreakIntent = TOOL_SURFACE_MIGRATION_INTENT;
+  session.pendingCacheBreakIntent = intent;
 }
 
 /** Provider switch: rebuild the surface for `provider`, migrating bridge ↔ native. */

package/src/runtime/agent/orchestrator/session/loop/tool-helpers.mjs

@@ -2,6 +2,7 @@
 // message-array change detect, tool-kind classification, skills, hook overrides,
 // native tool-search payload parsing, bash-session routing, and approval.
 import { isMcpTool } from '../../mcp/client.mjs';
+import { unattendedApprovalPort } from '../human-gate/gate.mjs';
 import { isBuiltinTool } from '../../tools/builtin.mjs';
 import { isInternalTool } from '../../internal-tools.mjs';
 import { loadSkillToolDependencies } from '../../runtime-core/skill-tool-loading.mjs';
@@ -207,15 +208,24 @@ export async function resolvePreToolAskApproval({
   toolCallId,
   askReason,
   toolApprovalHook,
+  request = null,
 }) {
   const name = String(toolName || 'tool');
   const reason = String(askReason || 'approval requested by hook').trim();
-  if (typeof toolApprovalHook !== 'function') {
+  // Unattended runs never auto-approve and have no card: a schedule or webhook
+  // run always holds the request for its owner; a room member does when no
+  // approval UI is attached (session-runtime/held-requests.mjs).
+  const unattended = unattendedApprovalPort();
+  const run = unattended?.runOf?.(sessionId) || null;
+  const held = run && (run.kind !== 'room' || typeof toolApprovalHook !== 'function');
+  const ask = held ? unattended.hold : toolApprovalHook;
+  if (typeof ask !== 'function') {
     return { denial: formatMissingToolApprovalUiDenial(name, reason) };
   }
   let approval;
   try {
-    approval = await toolApprovalHook({
+    approval = await ask({
+      ...(request || {}),
       name,
       args,
       cwd,
@@ -229,7 +239,7 @@ export async function resolvePreToolAskApproval({
   }
   if (!approvalGranted(approval)) {
     const detail = approvalReason(approval, reason || 'not approved');
-    return { denial: `Error: tool "${name}" denied by hook: ${detail}` };
+    return { denial: `Error: tool "${name}" denied by hook: ${detail}`, approval };
   }
   return { approval };
 }

package/src/runtime/agent/orchestrator/session/loop/usage.mjs

@@ -41,6 +41,7 @@ export function usageDeltaEvent({
   usage,
   sendTools,
   toolCalls = 0,
+  requestMs = 0,
 }) {
   return {
     sessionId,
@@ -56,6 +57,13 @@ export function usageDeltaEvent({
     deltaToolCalls: toolCalls,
     ...reasoningUsage(usage),
     deltaPrompt: usage.promptTokens || 0,
+    // Request start → end of this response (first-token wait included, as the
+    // ledger's duration_ms); 0 when the call was not timed. Only timed output
+    // enters speed figures.
+    requestMs,
+    // A provider that cannot measure the prompt or its cache split says so;
+    // its zeros are unknowns, not readings (no cache hit can be derived).
+    promptKnown: usage.inputTokensKnown !== false && usage.cacheTokensKnown !== false,
     // Cache delta carried alongside input/output so live metrics reflect
     // the same token classes the terminal aggregate adds; additive —
     // callers that ignore these fields keep working.
@@ -72,6 +80,47 @@ export function usageDeltaEvent({
   };
 }
 
+const SUMMED_USAGE_FIELDS = [
+  'inputTokens',
+  'outputTokens',
+  'cachedTokens',
+  'cacheWriteTokens',
+  'cacheWrite1hTokens',
+  'promptTokens',
+];
+
+/** What `total` added after the running total `earlier` (both from addUsage); null when nothing. */
+export function usageSince(total, earlier) {
+  if (!total) return null;
+  if (!earlier) return { ...total };
+  const delta = {};
+  for (const field of SUMMED_USAGE_FIELDS) delta[field] = Math.max(0, (total[field] || 0) - (earlier[field] || 0));
+  if (total.reasoningTokens != null) {
+    delta.reasoningTokens = Math.max(0, total.reasoningTokens - (earlier.reasoningTokens ?? 0));
+    delta.reasoningTokensComplete = total.reasoningTokensComplete === true;
+  }
+  if (total.costUsd != null) delta.costUsd = Math.max(0, total.costUsd - (earlier.costUsd || 0));
+  if (total.contextTokens) delta.contextTokens = total.contextTokens;
+  return Object.values(delta).some((value) => typeof value === 'number' && value > 0) ? delta : null;
+}
+
+/**
+ * The turn's usage split per model when the route switched mid-turn:
+ * `hops` holds, per left model, the running total when it was left. Each
+ * segment carries only its own tokens so it is priced at its own rates.
+ */
+export function routeUsageSegments(hops, total, current) {
+  if (!Array.isArray(hops) || !hops.length) return null;
+  const boundaries = [...hops, { ...current, usage: total }];
+  return boundaries
+    .map((segment, index) => ({
+      provider: segment.provider,
+      model: segment.model,
+      usage: usageSince(segment.usage, index ? boundaries[index - 1].usage : null),
+    }))
+    .filter((segment) => segment.usage);
+}
+
 export function addUsage(total, usage) {
   const delta = normalizeUsage(usage);
   if (!delta) return total;

package/src/runtime/agent/orchestrator/session/manager/ask-turn-commit.mjs

@@ -120,14 +120,24 @@ function recordAgentRuntimeCall(session, result) {
 export async function recordAskUsage({ session, result, askStartedAt, turnSignal }) {
   const prefixHashForLog = recordAgentRuntimeCall(session, result);
   if (!result.usage) return;
-  await logSessionLlmUsage({
-    session,
-    usage: result.usage,
-    startedAt: askStartedAt,
-    signal: turnSignal,
-    prefixHash: prefixHashForLog,
-    transportTiming: result.transportTiming || null,
-  });
+  // A turn that switched models mid-way books one row per model, each priced
+  // at that model's rates; otherwise one row for the whole turn.
+  const segments = result.usageSegments?.length
+    ? result.usageSegments
+    : [{ provider: session.provider, model: session.model, usage: result.usage }];
+  for (const segment of segments) {
+    await logSessionLlmUsage({
+      session:
+        segment.provider === session.provider && segment.model === session.model
+          ? session
+          : { ...session, provider: segment.provider, model: segment.model },
+      usage: segment.usage,
+      startedAt: askStartedAt,
+      signal: turnSignal,
+      prefixHash: prefixHashForLog,
+      transportTiming: result.transportTiming || null,
+    });
+  }
   recordStandaloneStatusTelemetry(session, result, Date.now() - askStartedAt);
 }
 

package/src/runtime/agent/orchestrator/session/manager/ask-turn-execute.mjs

@@ -186,6 +186,7 @@ export async function prepareAskTurn({ sessionId, opened, input, cwdOverride, tr
     beforeCount: historyMessages.length + 1,
     deferredToolDelta: userTurn.deferredToolDelta,
     goalReminder: userTurn.goalReminder,
+    workflowNotice: userTurn.workflowNotice,
     workspaceNotice: userTurn.workspaceNotice,
     setupNotice: userTurn.setupNotice,
   };

package/src/runtime/agent/orchestrator/session/manager/ask-turn-loop-options.mjs

@@ -8,6 +8,7 @@ import { createAskSteeringDrain } from './ask-turn-steering-drain.mjs';
 import { updateSessionStage, markSessionStreamDelta } from './runtime-liveness.mjs';
 import { codexWireSendOpts } from './session-id.mjs';
 import { persistIterationMetrics } from './usage-metrics.mjs';
+import { isAgentModeSession } from '../agent-mode.mjs';
 
 const optionalFn = (value) => (typeof value === 'function' ? value : undefined);
 const relay = (fn, ...args) => {
@@ -184,7 +185,8 @@ export function buildAgentLoopOptions({
     onCompactEvent: (event) => {
       checkpoint.refreshContextState();
       checkpoint.schedule(true);
-      relay(askOpts?.onCompactEvent, event);
+      // Agent mode compacts silently: no compaction notice reaches the host.
+      if (!isAgentModeSession(session)) relay(askOpts?.onCompactEvent, event);
     },
     // Pre-send gauge sync. Defined only when a host listens so the loop
     // never computes a display number nobody reads.

package/src/runtime/agent/orchestrator/session/manager/ask-turn-prepare.mjs

@@ -19,6 +19,7 @@ import {
   snapshotPendingWorkspaceNotice,
   snapshotPendingSetupNotice,
 } from './prompt-utils.mjs';
+import { snapshotPendingWorkflowNotice } from './workflow-switch-notice.mjs';
 import { codexWireSendOpts } from './session-id.mjs';
 import { _tryBridgeExplicitPrefetch } from './prefetch-bridge.mjs';
 import { filterModelVisibleSessionMessages } from './message-sanitize.mjs';
@@ -180,7 +181,11 @@ export async function buildUserTurn({
   const workspaceNotice = snapshotPendingWorkspaceNotice(session);
   // What preparing a new worktree linked, installed, ran, failed or skipped.
   const setupNotice = snapshotPendingSetupNotice(session);
+  // A mid-conversation workflow switch: the prompt and tools were rebuilt
+  // for the new workflow; this turn tells the model once.
+  const workflowNotice = snapshotPendingWorkflowNotice(session);
   const reminderBlock = [
+    workflowNotice?.content || '',
     workspaceNotice?.content || '',
     setupNotice?.content || '',
     currentTimeBlock ? `<system-reminder>\n# Current Time\n${currentTimeBlock}\n</system-reminder>` : '',
@@ -209,6 +214,7 @@ export async function buildUserTurn({
     historyMessages,
     deferredToolDelta,
     goalReminder,
+    workflowNotice,
     workspaceNotice,
     setupNotice,
     userTurnMessage,

package/src/runtime/agent/orchestrator/session/manager/ask-turn-settle.mjs

@@ -9,6 +9,7 @@ import { persistedAssistantTranscriptMetadata } from '../../../../shared/transcr
 import { acknowledgePendingDeferredToolDelta } from '../../runtime-core/deferred-tool-delta.mjs';
 import { acknowledgePendingGoalReminder } from '../../runtime-core/goal-reminder.mjs';
 import { acknowledgePendingSetupNotice, acknowledgePendingWorkspaceNotice } from './prompt-utils.mjs';
+import { acknowledgePendingWorkflowNotice } from './workflow-switch-notice.mjs';
 import {
   finalizePendingMessageDelivery,
   drainPendingMessages,
@@ -139,6 +140,7 @@ export async function commitAskTurn({ sessionId, opened, prepared, result, rawTr
   if (prepared.goalReminder) {
     acknowledgePendingGoalReminder(session, prepared.goalReminder.revision);
   }
+  if (prepared.workflowNotice) acknowledgePendingWorkflowNotice(session, prepared.workflowNotice.revision);
   if (prepared.workspaceNotice) {
     acknowledgePendingWorkspaceNotice(session, prepared.workspaceNotice.revision);
   }

package/src/runtime/agent/orchestrator/session/manager/pending-lifecycle-epoch.mjs

@@ -40,14 +40,6 @@ export function currentPendingLifecycleToken(sessionId) {
   return pendingLifecycleToken(pendingSessionLifecycle(sessionId));
 }
 
-// Refusal verdict of the lifecycle a token was minted from (tombstoned or
-// unreadable) — exactly pendingLifecycleInvalidated(sessionId) for that same
-// read, so a caller holding a fresh token needs no second durable read.
-export function lifecycleTokenClosed(token) {
-  const { source } = parseLifecycleToken(token);
-  return source === 'closed' || source === 'unreadable';
-}
-
 // Parses a `source:generation` epoch token.
 function parseLifecycleToken(token) {
   const text = String(token);

package/src/runtime/agent/orchestrator/session/manager/prompt-utils.mjs

@@ -207,29 +207,46 @@ function bp3SliceAt(text, heading) {
 
 /**
  * Replace the workspace-scoped tail of a BP3 core (composeSystemPrompt order:
- * …, `# Core Memory`, `# Instruction Files`). The instruction-files slice is
- * always last and may itself contain separators, so it is cut by position;
- * the core-memory slice is one separator-free part. `undefined` keeps a slice,
- * an empty string drops it.
+ * …, `# Instruction Files`, `# Core Memory`). Core memory is the last,
+ * separator-free part; the instruction-files slice before it may itself
+ * contain separators, so both are cut by position. A core from before that
+ * order (memory, then instruction files) is read too and written in the
+ * current order. `undefined` keeps a slice, an empty string drops it.
  * @param {string} core
  * @param {{ coreMemoryContext?: string, instructionFilesContext?: string }} slices
  */
 export function replaceWorkspaceCoreSlices(core, { coreMemoryContext, instructionFilesContext } = {}) {
+  let { head, instructionFiles, memory } = splitWorkspaceCoreSlices(core);
+  if (coreMemoryContext !== undefined) {
+    const value = trimmedSlice(coreMemoryContext);
+    memory = value ? `${CORE_MEMORY_HEADING}${value}` : '';
+  }
+  if (instructionFilesContext !== undefined) instructionFiles = trimmedSlice(instructionFilesContext);
+  return [head, instructionFiles, memory].filter((part) => part?.trim()).join(BP3_PART_SEPARATOR);
+}
+
+/** A BP3 core's `{ head, instructionFiles, memory }` (each '' when absent). */
+function splitWorkspaceCoreSlices(core) {
   let head = String(core || '');
+  let memory = '';
+  const memoryAt = bp3SliceAt(head, CORE_MEMORY_HEADING);
+  if (memoryAt) {
+    memory = head.slice(memoryAt.start);
+    head = head.slice(0, memoryAt.cut);
+    const legacy = memory.indexOf(`${BP3_PART_SEPARATOR}${INSTRUCTION_FILES_HEADING}`);
+    if (legacy >= 0) {
+      const instructions = memory.slice(legacy + BP3_PART_SEPARATOR.length);
+      memory = memory.slice(0, legacy);
+      head = head ? `${head}${BP3_PART_SEPARATOR}${instructions}` : instructions;
+    }
+  }
   let instructionFiles = '';
   const instructionAt = bp3SliceAt(head, INSTRUCTION_FILES_HEADING);
   if (instructionAt) {
     instructionFiles = head.slice(instructionAt.start);
     head = head.slice(0, instructionAt.cut);
   }
-  let parts = head ? head.split(BP3_PART_SEPARATOR) : [];
-  if (coreMemoryContext !== undefined) {
-    parts = parts.filter((part) => !part.startsWith(CORE_MEMORY_HEADING));
-    const memory = trimmedSlice(coreMemoryContext);
-    if (memory) parts.push(`${CORE_MEMORY_HEADING}${memory}`);
-  }
-  if (instructionFilesContext !== undefined) instructionFiles = trimmedSlice(instructionFilesContext);
-  return [...parts, instructionFiles].filter((part) => part?.trim()).join(BP3_PART_SEPARATOR);
+  return { head, instructionFiles, memory };
 }
 
 /**
@@ -286,9 +303,7 @@ function textOf(message) {
  */
 function presentedWorkspace(session) {
   const core = session.bp3EnvSplit === true ? textOf(bp3SystemMessage(session)) : String(session.bp3CoreContext || '');
-  const instructionAt = bp3SliceAt(core, INSTRUCTION_FILES_HEADING);
-  const head = instructionAt ? core.slice(0, instructionAt.cut) : core;
-  const memory = (head ? head.split(BP3_PART_SEPARATOR) : []).find((part) => part.startsWith(CORE_MEMORY_HEADING));
+  const { instructionFiles, memory } = splitWorkspaceCoreSlices(core);
   const tail = typeof session.bp3EnvironmentContext === 'string' ? session.bp3EnvironmentContext : '';
   const facts = tail.split(BP3_PART_SEPARATOR)[0] || '';
   const promptText = [textOf(bpEnvSystemMessage(session)), textOf(bp3SystemMessage(session))].join('\n');
@@ -297,10 +312,23 @@ function presentedWorkspace(session) {
     cwd: cwd ? cwd.trim() : null,
     environmentContext: facts.startsWith('- ') ? facts.trim() : '',
     coreMemoryContext: memory ? memory.slice(CORE_MEMORY_HEADING.length).trim() : '',
-    instructionFilesContext: instructionAt ? core.slice(instructionAt.start).trim() : '',
+    instructionFilesContext: instructionFiles.trim(),
   };
 }
 
+/**
+ * A rebuilt BP3 core head (composed without workspace slices) followed by the
+ * instruction-files and core-memory slices the session's prompt presents now,
+ * so a rebuild of the rest of the core (a mid-conversation workflow switch)
+ * leaves what the model was told about its workspace — and any staged
+ * workspaceReroot — as it was.
+ */
+export function withPresentedWorkspaceSlices(session, nextHead) {
+  const core = session.bp3EnvSplit === true ? textOf(bp3SystemMessage(session)) : String(session.bp3CoreContext || '');
+  const { instructionFiles, memory } = splitWorkspaceCoreSlices(core);
+  return [nextHead, instructionFiles, memory].filter((part) => part?.trim()).join(BP3_PART_SEPARATOR);
+}
+
 const WORKSPACE_SLICES = ['environmentContext', 'coreMemoryContext', 'instructionFilesContext'];
 
 /**

package/src/runtime/agent/orchestrator/session/manager/provider-replay.mjs

@@ -0,0 +1,50 @@
+// Provider-native replay state on transcript messages: reasoning items,
+// thinking blocks with their signatures, ordered native blocks, Gemini thought
+// signatures on tool calls. It belongs to the provider (and the account) that
+// produced it — another provider rejects it or, worse, a gateway of the same
+// family validates it against its own key. A route change drops it; what the
+// next provider needs (text, tool calls and their results, in order) stays,
+// and each adapter rebuilds its own wire shape from that.
+
+// Every message field a provider adapter replays or re-reads as native state.
+const PROVIDER_REPLAY_FIELDS = [
+  'providerReplay',
+  'reasoning',
+  'thinkingBlocks',
+  'assistantBlocks',
+  'reasoningItems',
+  'reasoningContent',
+  'providerMetadata',
+];
+// Opaque provider tokens a tool call may carry (Gemini thought signatures).
+const TOOL_CALL_SIGNATURE_FIELDS = ['thoughtSignature', 'thought_signature'];
+
+const hasAny = (value, fields) => fields.some((field) => field in value);
+
+function plainToolCalls(toolCalls) {
+  if (!Array.isArray(toolCalls) || !toolCalls.some((call) => call && hasAny(call, TOOL_CALL_SIGNATURE_FIELDS))) {
+    return toolCalls;
+  }
+  return toolCalls.map((call) => {
+    if (!call || !hasAny(call, TOOL_CALL_SIGNATURE_FIELDS)) return call;
+    const plain = { ...call };
+    for (const field of TOOL_CALL_SIGNATURE_FIELDS) delete plain[field];
+    return plain;
+  });
+}
+
+/** `message` without provider-native replay state; the same object when it carries none. */
+export function stripProviderReplayMessage(message) {
+  if (!message || typeof message !== 'object') return message;
+  const toolCalls = plainToolCalls(message.toolCalls);
+  if (!hasAny(message, PROVIDER_REPLAY_FIELDS) && toolCalls === message.toolCalls) return message;
+  const plain = { ...message };
+  for (const field of PROVIDER_REPLAY_FIELDS) delete plain[field];
+  if (toolCalls !== message.toolCalls) plain.toolCalls = toolCalls;
+  return plain;
+}
+
+/** Replace, never mutate: delta saves see rewritten messages as changed. */
+export function stripProviderReplayMessages(messages) {
+  return Array.isArray(messages) ? messages.map(stripProviderReplayMessage) : messages;
+}

package/src/runtime/agent/orchestrator/session/manager/rules-cache.mjs

@@ -112,20 +112,36 @@ export function _buildAgentRules(profile = 'full') {
   );
 }
 
-export function _buildLeadRules({ includeLeadBrief = true } = {}) {
+// One `part` of LEAD.md (rules-builder buildLeadRoleContent): 'common' (the
+// lines every Lead shares), 'coding' / 'agent' (the mode-variant passages),
+// 'identity' (the coding identity sentence).
+export function _buildLeadRules({ includeLeadBrief = true, part = 'common' } = {}) {
   const PLUGIN_ROOT = mixdogRoot();
   const DATA_DIR = resolvePluginData();
   const RULES_DIR = join(PLUGIN_ROOT, 'rules');
+  const variant = includeLeadBrief ? 'delegating' : 'delegation-free';
   return buildCachedRules(
     'buildLeadRoleContent',
     'lead role rules',
     [join(RULES_DIR, 'lead'), join(DATA_DIR, 'mixdog-config.json')],
-    { PLUGIN_ROOT, DATA_DIR, includeLeadBrief },
-    includeLeadBrief ? 'delegating' : 'delegation-free'
+    { PLUGIN_ROOT, DATA_DIR, includeLeadBrief, part },
+    `${variant}\n${part}`
   );
 }
 
-export function _buildLeadMetaContext() {
+// One agent-mode rule file (rules/agent-mode): 'conduct', 'mixy' or 'routine'.
+export function _buildAgentModeRules({ part = 'conduct' } = {}) {
+  const PLUGIN_ROOT = mixdogRoot();
+  return buildCachedRules(
+    'buildAgentModeContent',
+    'agent mode rules',
+    [join(PLUGIN_ROOT, 'rules', 'agent-mode')],
+    { PLUGIN_ROOT, part },
+    part
+  );
+}
+
+export function _buildLeadMetaContext({ includeOutputStyle = true } = {}) {
   const PLUGIN_ROOT = mixdogRoot();
   const DATA_DIR = resolvePluginData();
   const RULES_DIR = join(PLUGIN_ROOT, 'rules');
@@ -138,7 +154,8 @@ export function _buildLeadMetaContext() {
       join(PLUGIN_ROOT, 'output-styles'),
       join(DATA_DIR, 'output-styles'),
     ],
-    { PLUGIN_ROOT, DATA_DIR }
+    { PLUGIN_ROOT, DATA_DIR, includeOutputStyle },
+    includeOutputStyle ? 'style' : 'no-style'
   );
 }