mixdog 1.2.6 → 1.3.1

package/src/session-runtime/setup-tool/extended-actions.mjs

@@ -1,6 +1,10 @@
 import { SETUP_EXTENDED_PROPERTIES, SETUP_DESKTOP_ACTIONS } from './settings-contract.mjs';
 import { MEDIA_KINDS } from '../../runtime/media/tool-defs.mjs';
 import { OPENAI_COMPAT_PRESETS } from '../../runtime/agent/orchestrator/providers/openai-compat-presets.mjs';
+import { MIXY_AGENT_ID, agentIdOfHomeSession } from '../../runtime/agent/orchestrator/session/agent-home.mjs';
+import { AGENT_MODE, resolveSessionMode } from '../../runtime/agent/orchestrator/session/agent-mode.mjs';
+import { BOT_AGENT_KIND, WORKFLOW_AGENT_KIND } from '../../runtime/shared/agent-route-config.mjs';
+import { assertAutomationAccess, scheduleCallerScope } from '../services/schedule-access.mjs';
 
 const own = (value, key) => Object.hasOwn(value || {}, key);
 const pick = (value, keys) => Object.fromEntries(keys.filter((key) => own(value, key)).map((key) => [key, value[key]]));
@@ -162,13 +166,20 @@ async function readDefinition(rt, kind, name) {
   };
 }
 
-async function saveDefinition(rt, args) {
+// A created agent's explicit marker: the one given, else a bot when Mixy's
+// agent-mode chat creates it (Mixy creates bots), else a workflow agent.
+function createdAgentKind(input, caller) {
+  if (own(input, 'kind')) return input.kind;
+  const { mode, agentId } = resolveSessionMode({ session: caller });
+  return mode === AGENT_MODE && agentId === MIXY_AGENT_ID ? BOT_AGENT_KIND : WORKFLOW_AGENT_KIND;
+}
+
+async function saveDefinition(rt, args, context = {}) {
   const kind = args.definitionKind;
   const input = args.definition;
-  const allowed =
-    kind === 'skill'
-      ? ['originalName', 'name', 'description', 'body', 'whenToUse', 'toolDependencies']
-      : ['id', 'name', 'description', 'body'];
+  let allowed = ['id', 'name', 'description', 'body'];
+  if (kind === 'skill') allowed = ['originalName', 'name', 'description', 'body', 'whenToUse', 'toolDependencies'];
+  else if (kind === 'agent') allowed = [...allowed, 'kind'];
   const unexpected = Object.keys(input).find((key) => !allowed.includes(key));
   if (unexpected) throw new Error(`${unexpected} is not a ${kind} definition field`);
   const creating = args.action === 'create_definition';
@@ -198,11 +209,34 @@ async function saveDefinition(rt, args) {
       const agents = await rt.listAgents();
       if (agents.some((agent) => agent.id === input.id)) throw new Error(`agent "${input.id}" already exists`);
     }
-    return rt.saveAgentDefinition(creating ? next : { ...next, id: current.id });
+    if (creating) return rt.saveAgentDefinition({ ...next, kind: createdAgentKind(input, context.caller) });
+    // The stored kind is kept as it is; an edit naming one is refused by the editor.
+    const { kind: _storedKind, ...edit } = { ...pick(current, definitionKeys), ...input };
+    return rt.saveAgentDefinition({ ...edit, ...(own(input, 'kind') ? { kind: input.kind } : {}), id: current.id });
   }
   return creating ? rt.addSkill(next) : rt.saveSkill({ ...next, originalName: current.originalName });
 }
 
+async function automationRow(rt, kind, name) {
+  const status = await rt.getChannelSetup();
+  return status[kind === 'schedule' ? 'schedules' : 'webhooks'].find((row) => row.name === name) || null;
+}
+
+/** Authorize one automation action for the calling session (`context.caller`,
+ *  its session record; null when it could not be resolved) — schedule-access.mjs. */
+async function authorizeAutomation(rt, context, { kind, action, current, owner = '' }) {
+  const scope = scheduleCallerScope(context.caller);
+  const transfer = String(owner ?? '').trim();
+  const agents = transfer && scope.kind === 'human' ? await rt.listAgents() : [];
+  assertAutomationAccess(scope, {
+    kind,
+    action,
+    current,
+    owner: transfer,
+    agentIds: (Array.isArray(agents) ? agents : []).map((agent) => agent?.id).filter(Boolean),
+  });
+}
+
 export const EXTENDED_SETUP_HANDLERS = Object.freeze({
   set_local_context: (rt, args) => rt.setLocalProviderContext(args.modelId, args.localContextWindow),
   async list_models(rt, args) {
@@ -238,22 +272,29 @@ export const EXTENDED_SETUP_HANDLERS = Object.freeze({
     return {
       ...result,
       recovery:
-        'User-authored definition files are deleted. A built-in override may revert to its built-in definition.',
+        args.definitionKind === 'workflow'
+          ? 'User-authored definition files are deleted. A built-in override may revert to its built-in definition.'
+          : 'A custom agent or bot is archived with its chat and its routines are switched off; the user can restore it from Sessions → Archived, or delete it there for good. A built-in override reverts to its built-in definition.',
     };
   },
-  async save_automation(rt, args) {
+  async save_automation(rt, args, context = {}) {
     const kind = args.automationKind;
     const input = args.entry;
     if (kind === 'webhook' && ['time', 'at', 'timezone', 'days'].some((key) => own(input, key))) {
-      throw new Error('Schedule timing fields are not accepted for webhooks');
+      throw new Error('Schedule fields (timing) are not accepted for webhooks');
     }
     if (kind === 'schedule' && own(input, 'parser')) throw new Error('parser is a webhook-only field');
     let previous = {};
     if (input.overwrite) {
-      const status = await rt.getChannelSetup();
-      previous = status[kind === 'schedule' ? 'schedules' : 'webhooks'].find((row) => row.name === input.name);
+      previous = await automationRow(rt, kind, input.name);
       if (!previous) throw new Error(`${kind} "${input.name}" does not exist`);
     }
+    await authorizeAutomation(rt, context, {
+      kind,
+      action: input.overwrite ? 'edit' : 'create',
+      current: input.overwrite ? previous : null,
+      owner: input.owner,
+    });
     const next = { ...pick(previous, entryKeys), ...input };
     if (kind === 'schedule') {
       if (previous.whenAt && !own(input, 'time') && !own(input, 'at')) {
@@ -263,6 +304,11 @@ export const EXTENDED_SETUP_HANDLERS = Object.freeze({
       if (own(input, 'time') && !own(input, 'at')) delete next.at;
       if (own(input, 'at') && !own(input, 'time')) delete next.time;
     }
+    // An automation created from an agent's home thread belongs to that agent.
+    if (!input.overwrite && !own(input, 'owner')) {
+      const homeAgent = agentIdOfHomeSession(context.sessionId);
+      if (homeAgent) next.owner = homeAgent;
+    }
     const result = kind === 'schedule' ? await rt.saveSchedule(next) : await rt.saveWebhook(next);
     return {
       ...publicAutomation(result),
@@ -275,18 +321,42 @@ export const EXTENDED_SETUP_HANDLERS = Object.freeze({
         : {}),
     };
   },
-  async delete_automation(rt, args) {
-    const status = await rt.getChannelSetup();
-    const rows = status[args.automationKind === 'schedule' ? 'schedules' : 'webhooks'];
-    if (!rows.some((row) => row.name === args.name)) throw new Error('Automation entry not found');
+  async delete_automation(rt, args, context = {}) {
+    const current = await automationRow(rt, args.automationKind, args.name);
+    if (!current) throw new Error('Automation entry not found');
+    await authorizeAutomation(rt, context, { kind: args.automationKind, action: 'delete', current });
     const result =
       args.automationKind === 'schedule' ? await rt.deleteSchedule(args.name) : await rt.deleteWebhook(args.name);
     return { ...result, recovery: 'The automation record is deleted; recreating it requires its definition.' };
   },
-  set_automation_enabled: (rt, args) =>
-    args.automationKind === 'schedule'
+  async set_automation_enabled(rt, args, context = {}) {
+    const current = await automationRow(rt, args.automationKind, args.name);
+    if (!current) throw new Error('Automation entry not found');
+    const action = args.enabled === false ? 'pause' : 'resume';
+    await authorizeAutomation(rt, context, { kind: args.automationKind, action, current });
+    return args.automationKind === 'schedule'
       ? rt.setScheduleEnabled(args.name, args.enabled)
-      : rt.setWebhookEnabled(args.name, args.enabled),
+      : rt.setWebhookEnabled(args.name, args.enabled);
+  },
+  // Starts the run and returns at once: the run is its own session, and its
+  // result posts into the owning agent's thread when it ends. A webhook
+  // re-runs on its latest received payload.
+  async run_automation(rt, args, context = {}) {
+    const kind = args.automationKind;
+    const current = await automationRow(rt, kind, args.name);
+    if (!current) throw new Error('Automation entry not found');
+    await authorizeAutomation(rt, context, { kind, action: 'run', current });
+    if (kind === 'webhook' && current.hasLastPayload !== true) {
+      throw new Error(`webhook "${args.name}" has not received a payload yet`);
+    }
+    const run = kind === 'webhook' ? rt.runWebhookNow(args.name) : rt.runScheduleNow(args.name);
+    void Promise.resolve(run).catch(() => {});
+    return {
+      name: args.name,
+      started: true,
+      note: "The run is its own session; its result posts into the owning agent's thread when it finishes.",
+    };
+  },
   async set_developer_option(rt, args) {
     const option = rt
       .getDeveloperSettings()
@@ -360,9 +430,9 @@ function hookRuleAt(rt, index) {
   return publicHookRule(rule);
 }
 
-export async function executeExtendedSetupAction(rt, args, requestDesktop) {
+export async function executeExtendedSetupAction(rt, args, requestDesktop, context = {}) {
   if (SETUP_DESKTOP_ACTIONS.includes(args.action)) return requestDesktop(args);
   const handler = EXTENDED_SETUP_HANDLERS[args.action];
   if (!handler) throw new Error(`setup: unhandled action "${args.action}"`);
-  return handler(rt, args);
+  return handler(rt, args, context);
 }

package/src/session-runtime/setup-tool/settings-contract.mjs

@@ -26,6 +26,7 @@ export const SETUP_EXTENDED_ACTION_FIELDS = Object.freeze({
   save_automation: 'automationKind entry',
   delete_automation: 'automationKind name',
   set_automation_enabled: 'automationKind name enabled',
+  run_automation: 'automationKind name',
   set_webhook_config: 'webhook',
   set_desktop_settings: 'desktop',
   set_appearance: 'appearance',
@@ -51,6 +52,7 @@ export const SETUP_ACTIVITY_RAIL_PIN_IDS = Object.freeze([
   'workflows',
   'projects',
   'extensions',
+  'skills',
   'source-control',
   'search',
   'webhooks',
@@ -155,6 +157,12 @@ export const SETUP_EXTENDED_PROPERTIES = Object.freeze({
     name: text,
     description: text,
     body: text,
+    kind: {
+      type: 'string',
+      enum: ['bot', 'agent'],
+      description:
+        'Agent create only: "bot" (a contact the user chats with) or "agent" (a workflow sub-agent). Omitted: a bot when created from the representative bot\'s chat, else a workflow agent. Fixed after creation.',
+    },
     whenToUse: text,
     toolDependencies: {
       type: ['array', 'null'],
@@ -172,13 +180,7 @@ export const SETUP_EXTENDED_PROPERTIES = Object.freeze({
       timezone: text,
       days: { ...text, description: 'Schedule day selector, e.g. weekdays or mon,wed,fri.' },
       parser: { type: 'string', enum: ['github', 'generic', 'stripe', 'sentry'] },
-      model: {
-        ...text,
-        description:
-          'Required for new schedules; no default-model fallback. Use provider/model[@effort][+fast][+noauto][?parameter=value] (+noauto: Auto reasoning off; absent = on) or an existing preset name. On overwrite, omission preserves the saved model, which must be non-empty.',
-      },
       cwd: text,
-      workflow: text,
       attachments: {
         type: 'array',
         maxItems: 8,
@@ -197,6 +199,11 @@ export const SETUP_EXTENDED_PROPERTIES = Object.freeze({
         ),
       },
       enabled: boolean,
+      owner: {
+        ...text,
+        description:
+          "The bot id that owns the schedule or webhook; each run is a turn in that bot's chat, where it replies with the result. The bot must exist (no representative bot yet = refused). New entries default to the bot of the calling thread (the representative bot = lead); on overwrite, omission keeps the owner.",
+      },
       overwrite: { ...boolean, description: 'Explicitly update an existing entry; omitted fields are preserved.' },
     },
     ['name']
@@ -213,6 +220,7 @@ export const SETUP_EXTENDED_PROPERTIES = Object.freeze({
     usagePinned: boolean,
     usageRailShortLong: boolean,
     computerObserveOnly: boolean,
+    browserAutoSignIn: boolean,
     notificationVolume: {
       type: 'integer',
       minimum: 0,

package/src/session-runtime/setup-tool/tool-defs.mjs

@@ -7,6 +7,7 @@ import {
 import { MEDIA_KINDS } from '../../runtime/media/tool-defs.mjs';
 import { INSTRUCTION_FILES_MODES } from '../../runtime/shared/instruction-files-mode.mjs';
 import { WORKTREE_NEW_TASK_DEFAULTS } from '../../runtime/shared/worktrees/settings.mjs';
+import { CONNECTOR_IDS } from '../../runtime/shared/connector-catalog.mjs';
 
 /** Built-in `setup` tool: the model's handle on a Mixdog user's persisted
  *  configuration. The description is a contract only; how to use each action
@@ -110,6 +111,7 @@ export const SETUP_ACTION_FIELDS = Object.freeze({
   set_plugin_enabled: 'name enabled',
   remove_plugin: 'name',
   enable_plugin_mcp: 'name',
+  connect_connector: 'connector',
   set_worktree_settings: 'worktree',
   ...SETUP_EXTENDED_ACTION_FIELDS,
 });
@@ -345,6 +347,12 @@ export const SETUP_TOOL_DEFS = Object.freeze([
           description: 'set_disabled_skills: full list of disabled skill names.',
         },
         source: { type: 'string', description: 'add_plugin: Git URL, owner/repo, or local path.' },
+        connector: {
+          type: 'string',
+          enum: [...CONNECTOR_IDS],
+          description:
+            'connect_connector: catalog service to connect. Shows the user a connect card in this conversation (one-click sign-in or a key sheet in Desktop); it never connects by itself.',
+        },
         kind: {
           type: 'string',
           enum: ['skills', 'mcp', 'plugins', ...MEDIA_KINDS],

package/src/session-runtime/skills-api.mjs

@@ -1,7 +1,7 @@
 // Skill surface (status listing, resource load, tool envelope, global skill
 // creation/editing). The runtime facade only wires the mutable cwd and the
 // context module into it.
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { resolvePluginData } from '../runtime/shared/plugin-paths.mjs';
 import {
@@ -193,6 +193,20 @@ export function createSkillsApi({ contextMod, getCwd, getTools = () => [] }) {
     return { originalName, name, filePath };
   }
 
+  function removeGlobalSkill(input = {}) {
+    const name = validateSkillName(input.name);
+    const resource = contextMod.loadSkillResource?.(name, getCwd());
+    if (!resource?.filePath) throw new Error(`skill not found: ${name}`);
+    const dir = dirname(resolve(resource.filePath));
+    const rel = relative(globalSkillsRoot(), dir);
+    if (!rel || rel.startsWith('..') || isAbsolute(rel) || basename(dir) !== name) {
+      throw new Error(`only your own skills can be removed: ${name}`);
+    }
+    rmSync(dir, { recursive: true, force: true });
+    invalidateSkills();
+    return { name };
+  }
+
   function invalidateSkills() {
     contextMod.invalidateSkillsCache?.(getCwd());
   }
@@ -203,6 +217,7 @@ export function createSkillsApi({ contextMod, getCwd, getTools = () => [] }) {
     skillToolContent,
     addGlobalSkill,
     saveSkillDocument,
+    removeGlobalSkill,
     invalidateSkills,
   };
 }

package/src/session-runtime/tool-policy-refresh.mjs

@@ -1,7 +1,8 @@
 // Refresh the empty Lead session's model-facing tool surface and BP1/BP3
 // layers after workflow or search/memory settings change. Conversation
 // sessions keep their frozen schema; the next new session picks up the
-// updated policy.
+// updated policy. The one exception is a workflow switch made in the session
+// itself (switchSessionWorkflow), which rebuilds that conversation's policy.
 import { sessionHasConversationMessages } from '../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 import { toSessionWorkflowMeta } from '../runtime/agent/orchestrator/runtime-core/workflow.mjs';
 import {
@@ -21,7 +22,25 @@ import {
 } from '../runtime/agent/orchestrator/session/manager/session-tool-surface.mjs';
 import { finalizeSessionToolList } from '../runtime/agent/orchestrator/session/manager/tool-resolution.mjs';
 import { isAgentOwner } from '../runtime/agent/orchestrator/agent-owner.mjs';
+import {
+  AGENT_MODE,
+  isRoutineSource,
+  resolveSessionMode,
+  sessionModeOf,
+} from '../runtime/agent/orchestrator/session/agent-mode.mjs';
 import { unusedModelEditToolName } from '../runtime/shared/edit-tool-dialect.mjs';
+import { MIXY_AGENT_ID } from '../runtime/agent/orchestrator/session/agent-home.mjs';
+import {
+  refreshSessionBp3Environment,
+  withPresentedWorkspaceSlices,
+} from '../runtime/agent/orchestrator/session/manager/prompt-utils.mjs';
+import { stageWorkflowSwitchNotice } from '../runtime/agent/orchestrator/session/manager/workflow-switch-notice.mjs';
+import { markToolSurfaceMigrated } from '../runtime/agent/orchestrator/session/loop/tool-exposure-migration.mjs';
+import { agentProfileRevision, leadRosterRevision } from '../runtime/agent/orchestrator/context/role-instructions.mjs';
+import { recordTranscriptBoundary } from './model-route/set-route.mjs';
+
+const WORKFLOW_SWITCH_BUSY = 'The session is running a turn; wait for it to finish.';
+const AGENT_PROFILE_INTENT = 'agent_profile';
 
 function toolNames(list) {
   return (Array.isArray(list) ? list : [])
@@ -46,16 +65,28 @@ function rewriteSystemHeading(session, heading, nextContent) {
   if (target) replaceMessageContent(messages, target, nextContent);
 }
 
-function rewriteBp3Core(session, nextCore) {
+function bp3Message(session) {
   const messages = Array.isArray(session.messages) ? session.messages : [];
-  const bp3 =
+  return (
     messages.find((message) => message?.role === 'system' && message.cacheTier === 'tier3') ||
     messages.find(
       (message) =>
         message?.role === 'system' &&
         typeof message.content === 'string' &&
         message.content.startsWith('# Active Workflow:')
-    );
+    )
+  );
+}
+
+// The BP3 core the session's prompt carries now (split layout: the whole
+// tier3 block; combined: the stored core beside the environment).
+function presentedBp3Core(session) {
+  return session.bp3EnvSplit === true ? bp3Message(session)?.content : session.bp3CoreContext;
+}
+
+function rewriteBp3Core(session, nextCore) {
+  const messages = Array.isArray(session.messages) ? session.messages : [];
+  const bp3 = bp3Message(session);
   if (!bp3 || typeof bp3.content !== 'string') return;
   if (session.bp3EnvSplit === true) {
     // Split layout: the environment lives in its own cacheTier:'env' system
@@ -69,6 +100,27 @@ function rewriteBp3Core(session, nextCore) {
   session.bp3CoreContext = nextCore || '';
 }
 
+// A Lead's workflow slices (orchestration, agent and contact catalogs) for its
+// mode, Mixy's with the contacts.
+function leadPartsFor(session, leadPromptParts) {
+  return leadPromptParts({
+    agentMode: sessionModeOf(session) === AGENT_MODE,
+    mixy: resolveSessionMode({ session }).agentId === MIXY_AGENT_ID,
+  });
+}
+
+// A conversation keeps its `# Session` block: the legacy combined layout
+// rebuilds the tier3 block from the new core (rooted where it was).
+function rewriteConversationBp3Core(session, nextCore) {
+  if (session.bp3EnvSplit !== true && typeof session.bp3CoreContext === 'string') {
+    const previous = session.bp3CoreContext;
+    session.bp3CoreContext = nextCore;
+    if (refreshSessionBp3Environment(session, session.cwd)) return;
+    session.bp3CoreContext = previous;
+  }
+  rewriteBp3Core(session, nextCore);
+}
+
 export function createToolPolicyRefresh({
   getSession,
   getRoute,
@@ -137,15 +189,11 @@ export function createToolPolicyRefresh({
     );
   }
 
-  async function refreshEmptySessionToolPolicy() {
-    invalidatePreSessionToolSurface?.();
-    const session = getSession?.();
-    if (!session?.id) return { appliedToCurrentSession: true };
-    if (!admitsRefresh(session)) return { appliedToCurrentSession: false };
-    // Older records contain only compiled prompt text; rebuilding would guess
-    // away custom instructions. Keep that immutable material for every owner.
-    const identity = session.promptIdentity;
-    if (!identity) return { appliedToCurrentSession: false, reason: 'missing-prompt-identity' };
+  // The policy `config` gives `session`, computed without touching the
+  // session, so a turn that starts during the async rebuild cannot lose tools
+  // to it. `conversation`: the rebuilt BP3 core keeps the instruction files
+  // and core memory the prompt presents now (withPresentedWorkspaceSlices).
+  async function stagePolicy(session, identity, config, { conversation = false } = {}) {
     const ownerIsAgent = isAgentOwner(session);
     const schemaAllowedTools = honoredSchemaAllowlist(session.schemaAllowedTools, {
       ownerIsAgent,
@@ -155,11 +203,13 @@ export function createToolPolicyRefresh({
 
     const {
       summary: workflow,
-      context: leadWorkflowContext,
-      packContext,
+      leadPromptParts,
+      packContext: workflowContext,
       orchestrationMode,
-    } = activeWorkflowContext(getConfig(), getDataDir());
-    const workflowContext = ownerIsAgent ? packContext : leadWorkflowContext;
+    } = activeWorkflowContext(config, getDataDir());
+    const sessionMode = sessionModeOf(session);
+    const agentMode = sessionMode === AGENT_MODE;
+    const leadWorkflowParts = ownerIsAgent ? {} : leadPartsFor(session, leadPromptParts);
     const denied = [
       ...session.callerDisallowedTools,
       ...featureDisallowedTools(),
@@ -168,8 +218,6 @@ export function createToolPolicyRefresh({
       .map((name) => String(name || ''))
       .filter(Boolean);
 
-    // Stage: everything below is computed without touching the session, so a
-    // turn that starts during the async rebuild cannot lose tools to it.
     const baseRules =
       identity.skipAgentRules || toolFreeRole
         ? ''
@@ -179,29 +227,201 @@ export function createToolPolicyRefresh({
             provider: getRoute()?.provider,
             model: getRoute()?.model,
           });
-    const coreMemoryContext = await leadCoreMemoryContext();
+    const coreMemoryContext = conversation ? '' : await leadCoreMemoryContext();
     const { sessionMarkerCore } = composeSystemPrompt({
       ...sessionRolePromptFields(identity, {
         ownerIsAgent,
         toolFreeRole,
         delegationFree: delegationDisabled(session, ownerIsAgent),
+        sessionMode,
+        routine: isRoutineSource(session.sourceType),
       }),
       provider: getRoute()?.provider,
       workflowContext,
+      ...leadWorkflowParts,
       coreMemoryContext,
-      // The rebuilt core keeps (or newly applies) the instruction-files setting.
-      instructionFilesContext: toolFreeRole ? null : loadInstructionFilesContext?.(session) || null,
+      // The rebuilt core keeps (or newly applies) the instruction-files
+      // setting; agent mode carries none.
+      instructionFilesContext:
+        conversation || toolFreeRole || agentMode ? null : loadInstructionFilesContext?.(session) || null,
     });
+    return {
+      workflow,
+      orchestrationMode,
+      sessionMode,
+      denied,
+      schemaAllowedTools,
+      ownerIsAgent,
+      baseRules,
+      core: conversation ? withPresentedWorkspaceSlices(session, sessionMarkerCore) : sessionMarkerCore,
+    };
+  }
+
+  // Apply a staged policy synchronously; the BP3 core is the caller's.
+  function applyPolicy(session, staged) {
+    session.workflow = toSessionWorkflowMeta(staged.workflow);
+    session.orchestrationMode = staged.orchestrationMode;
+    session.sessionMode = staged.sessionMode;
+    applyToolDenials(session, staged.denied, staged.schemaAllowedTools, staged.ownerIsAgent);
+    rewriteSystemHeading(session, '# Tool Use', staged.baseRules);
+    session.updatedAt = Date.now();
+  }
+
+  async function refreshEmptySessionToolPolicy() {
+    invalidatePreSessionToolSurface?.();
+    const session = getSession?.();
+    if (!session?.id) return { appliedToCurrentSession: true };
+    if (!admitsRefresh(session)) return { appliedToCurrentSession: false };
+    // Older records contain only compiled prompt text; rebuilding would guess
+    // away custom instructions. Keep that immutable material for every owner.
+    const identity = session.promptIdentity;
+    if (!identity) return { appliedToCurrentSession: false, reason: 'missing-prompt-identity' };
+    const staged = await stagePolicy(session, identity, getConfig());
     // Apply: re-check admission after the await, then mutate synchronously.
     if (!admitsRefresh(session)) return { appliedToCurrentSession: false };
-    session.workflow = toSessionWorkflowMeta(workflow);
-    session.orchestrationMode = orchestrationMode;
-    applyToolDenials(session, denied, schemaAllowedTools, ownerIsAgent);
-    rewriteSystemHeading(session, '# Tool Use', baseRules);
-    rewriteBp3Core(session, sessionMarkerCore);
-    session.updatedAt = Date.now();
+    applyPolicy(session, staged);
+    rewriteBp3Core(session, staged.core);
     return { appliedToCurrentSession: true };
   }
 
-  return { refreshEmptySessionToolPolicy };
+  /**
+   * Switch the current coding session's workflow mid-conversation (the
+   * composer's workflow selector): its prompt (BP3 core and `# Tool Use`) and
+   * tool/delegation surface are rebuilt now for `workflowId` with the current
+   * orchestration mode and agents, so its next turn runs on them, and that
+   * turn carries a one-time notice (manager/workflow-switch-notice.mjs). The
+   * provider prompt cache is rebuilt once. Refused while a turn runs, like a
+   * working-folder change. The configured workflow (the default for new
+   * sessions) is the caller's and stays as it is.
+   *
+   * Running work is untouched: agents and workers the session started under
+   * the old workflow are separate sessions with their own prompts and tools,
+   * so they keep running as they are (unlike a working-folder change, running
+   * agents never refuse this); only delegation made from the next turn on
+   * uses the new surface.
+   *
+   * Returns null when the session has no conversation (the caller applies the
+   * configured workflow to an empty session as before), else
+   * `{ appliedToCurrentSession: true, workflow, workflowSwitch }` where
+   * `workflowSwitch` is the transcript boundary (null when unchanged).
+   */
+  async function switchSessionWorkflow(workflowId) {
+    const session = getSession?.();
+    if (!session?.id) return null;
+    const conversation = () =>
+      sessionHasConversationMessages(session) || sessionHasConversationMessages({ messages: session.liveTurnMessages });
+    if (!conversation()) return null;
+    if (isAgentOwner(session) || sessionModeOf(session) === AGENT_MODE) {
+      throw new Error('Only a coding session has a workflow.');
+    }
+    const identity = session.promptIdentity;
+    if (!identity) throw new Error('This session is too old to switch its workflow; start a new task.');
+    const busy = () => getSession?.() !== session || turnInFlight(session);
+    if (busy()) throw new Error(WORKFLOW_SWITCH_BUSY);
+    const config = getConfig();
+    const staged = await stagePolicy(
+      session,
+      identity,
+      { ...config, workflow: { ...(config?.workflow || {}), active: workflowId } },
+      { conversation: true }
+    );
+    if (busy()) throw new Error(WORKFLOW_SWITCH_BUSY);
+    const before = session.workflow;
+    const from = before?.id ? before : null;
+    applyPolicy(session, staged);
+    rewriteConversationBp3Core(session, staged.core);
+    // The request prefix changed: drop provider replay state and the context
+    // baseline, and tag the next send's expected cache break.
+    markToolSurfaceMigrated(session, 'workflow_switch');
+    stageWorkflowSwitchNotice(session, from, session.workflow);
+    let workflowSwitch = null;
+    if (from?.id !== session.workflow.id) {
+      workflowSwitch = {
+        fromId: from?.id || '',
+        from: from?.name || from?.id || '',
+        toId: session.workflow.id,
+        to: session.workflow.name,
+        at: Date.now(),
+      };
+      // Two switches can land in the same millisecond (A→B→A): the same
+      // switch is a repeat only when its direction matches too.
+      recordTranscriptBoundary(
+        session,
+        'workflowSwitches',
+        workflowSwitch,
+        (entry) =>
+          entry?.at === workflowSwitch.at &&
+          entry?.fromId === workflowSwitch.fromId &&
+          entry?.toId === workflowSwitch.toId
+      );
+    }
+    return { appliedToCurrentSession: true, workflow: session.workflow, workflowSwitch };
+  }
+
+  // An agent profile edit that met a running turn: the next turn applies it.
+  let agentProfilePending = false;
+
+  /**
+   * Bring a Lead session's prompt to the saved bots — its own agent's
+   * persona, AGENT.md and name, and the bot roster its catalogs list — after
+   * a bot was saved, created, renamed, archived or restored
+   * (agent-profile-changes.mjs), on resume, or at the start of the turn after
+   * one that ran through the change (`trigger`: 'save' | 'resume' | 'turn').
+   * Two stamps (agentProfileRevision, agentRosterRevision) tell whether
+   * anything it embeds changed; a delegated worker keeps its prompt. The core
+   * is rebuilt like a workflow switch's (the session's own workflow, the
+   * workspace slices the model was told) and replaces the stored one, so the
+   * next turn sends it with one provider cache break; nothing is re-read per
+   * turn. Tools are untouched. Returns true when the prompt changed.
+   */
+  async function refreshAgentProfile({ trigger = 'save' } = {}) {
+    const session = getSession?.();
+    const identity = session?.promptIdentity;
+    const agent = identity?.agent;
+    if (!session?.id || !agent || isAgentOwner(session)) return false;
+    // Only Mixy's own (agent-mode) thread embeds Mixy's profile.
+    const revision = agentProfileRevision(agent, { mixy: sessionModeOf(session) === AGENT_MODE });
+    const config = getConfig();
+    const workflowId = session.workflow?.id;
+    const workflowConfig = workflowId
+      ? { ...config, workflow: { ...(config?.workflow || {}), active: workflowId } }
+      : config;
+    const roster = leadRosterRevision(
+      leadPartsFor(session, activeWorkflowContext(workflowConfig, getDataDir()).leadPromptParts)
+    );
+    if (session.agentProfileRevision === revision && session.agentRosterRevision === roster) return false;
+    // A coding session from before profile stamps keeps its prompt when it
+    // is reopened; a saved edit still reaches it.
+    if (session.agentProfileRevision === undefined && trigger === 'resume' && sessionModeOf(session) !== AGENT_MODE) {
+      return false;
+    }
+    // At a turn's start its own turn is the one counted; nothing runs yet.
+    const busy = () => getSession?.() !== session || (trigger !== 'turn' && turnInFlight(session));
+    if (busy()) {
+      agentProfilePending = true;
+      return false;
+    }
+    const staged = await stagePolicy(session, identity, workflowConfig, { conversation: true });
+    if (busy()) {
+      agentProfilePending = true;
+      return false;
+    }
+    session.agentProfileRevision = revision;
+    session.agentRosterRevision = roster;
+    session.updatedAt = Date.now();
+    if (staged.core === presentedBp3Core(session)) return false;
+    rewriteConversationBp3Core(session, staged.core);
+    // The request prefix changed: one cache break, tagged on the next send.
+    markToolSurfaceMigrated(session, AGENT_PROFILE_INTENT);
+    return true;
+  }
+
+  /** Turn start: apply an edit that arrived while the previous turn ran. */
+  async function applyPendingAgentProfile() {
+    if (!agentProfilePending) return false;
+    agentProfilePending = false;
+    return refreshAgentProfile({ trigger: 'turn' });
+  }
+
+  return { refreshEmptySessionToolPolicy, switchSessionWorkflow, refreshAgentProfile, applyPendingAgentProfile };
 }