feat(config): mid-session edit tool, advisor, and auto preference

crates/rho/src/app/automation.rs

@@ -504,7 +504,7 @@ async fn run_session_with_output(
                 workspace,
                 workspace_policy: AppPolicy::for_mode(startup.config.permission_mode),
                 approval_session: startup.approval_session.clone(),
-                system_prompt: system_prompt.for_advisor_mode(tool_set.advisor_registered()),
+                system_prompt,
                 reasoning: sdk_options.runtime.reasoning,
                 service_tier: sdk_options.runtime.service_tier,
                 compaction,

crates/rho/src/app/interactive_runtime.rs

@@ -15,6 +15,8 @@ use {
 
 #[path = "interactive_runtime_advisor.rs"]
 mod advisor;
+#[path = "interactive_runtime_edit_tool.rs"]
+pub(crate) mod edit_tool;
 #[path = "interactive_runtime_hooks.rs"]
 mod session_hooks;
 #[path = "interactive_runtime_startup.rs"]
@@ -29,7 +31,6 @@ use super::{
     policy::AppPolicy,
     provider_controller::ProviderController,
     runtime_builder::{build_compaction, build_runtime, RuntimeBuildOptions},
-    tools_prompt::SystemPromptVariants,
 };
 
 pub(crate) use super::interactive_run_controller::{
@@ -72,7 +73,7 @@ pub(crate) struct InteractiveRuntime {
     mcp_report: crate::tools::mcp::McpSessionReport,
     plugins_report: crate::plugins::PluginLoadReport,
     workspace: Workspace,
-    system_prompt: SystemPromptVariants,
+    system_prompt: rho_sdk::SystemPrompt,
     compaction: CompactionConfig,
     context_window: Option<u64>,
     usage_recording: rho_sdk::ProviderRequestUsageRecording,
@@ -889,3 +890,11 @@ impl InteractiveRuntime {
 #[cfg(test)]
 #[path = "interactive_runtime_tests.rs"]
 mod tests;
+
+/// Test factory for TUI seams that need a live edit-capable runtime.
+#[cfg(test)]
+pub(crate) async fn test_edit_tool_runtime(
+    edit_tool: crate::config::EditTool,
+) -> InteractiveRuntime {
+    tests::edit_tool_runtime(edit_tool).await
+}

crates/rho/src/app/interactive_runtime_advisor.rs

@@ -1,10 +1,13 @@
 //! Advisor mode as a runtime state transition.
 //!
-//! Advisor mode changes the tool list and the system prompt, neither of which
-//! the SDK can swap on a live runtime. Turning it on or off therefore rebuilds
-//! the runtime and rebinds the session, the same move a permission-mode change
-//! makes, so the change lands on the next turn and the session ID and history
-//! survive it.
+//! Advisor mode changes the advertised tool list, which the SDK cannot swap on
+//! a live runtime. Turning it on or off therefore rebuilds the runtime and
+//! rebinds the session so the change lands on the next turn. The session ID and
+//! history survive it.
+//!
+//! The system prompt stays fixed for prompt-cache stability. The model learns
+//! about the tool list change from an appended context notice (with the tool
+//! schema when enabling) rather than a rewritten system prompt.
 
 use std::sync::Arc;
 
@@ -19,56 +22,108 @@ use super::super::{
 
 use super::InteractiveRuntime;
 
+#[cfg(test)]
+thread_local! {
+    static FAIL_NEXT_ADVISOR_NOTICE: std::cell::Cell<bool> = const { std::cell::Cell::new(false) };
+}
+
+#[cfg(test)]
+pub(crate) fn fail_next_advisor_switch_notice_for_tests() {
+    FAIL_NEXT_ADVISOR_NOTICE.with(|flag| flag.set(true));
+}
+
 impl InteractiveRuntime {
-    /// The system prompt for the tools this run currently offers.
+    /// Fixed system prompt for this session.
+    ///
+    /// Mid-session tool list changes keep this value stable and tell the model
+    /// through appended context instead.
     pub(super) fn active_system_prompt(&self) -> SystemPrompt {
-        self.system_prompt
-            .for_advisor_mode(self.tools.advisor_registered())
+        self.system_prompt.clone()
     }
 
     /// Applies an advisor mode or advisor model change to the next turn.
     ///
     /// `model` is the advisor model to use, or `None` when advisor mode is off
     /// or has no model yet; those are the same thing to the executor. The live
     /// tool reads the new model at once. Registering or removing the `advisor`
-    /// tool also changes the tool list and the system prompt, so it needs the
-    /// same runtime rebuild as a permission-mode change; the session ID and
-    /// history survive it.
+    /// tool rebuilds the runtime without rewriting the system prompt, then
+    /// appends a context notice. Returns display text for a transcript notice
+    /// when the tool list changed.
     pub(crate) async fn set_advisor(
         &mut self,
         model: Option<InternalAgentModelConfig>,
-    ) -> anyhow::Result<()> {
+    ) -> anyhow::Result<Option<String>> {
         let Some(store) = self.tools.advisor().cloned() else {
-            return Ok(());
+            return Ok(None);
         };
         let registered = model.is_some();
         if registered == self.tools.advisor_registered() {
             store.set_model(model);
-            return Ok(());
+            return Ok(None);
         }
         if self.runs.is_active() {
             anyhow::bail!("advisor mode cannot change while a run is active");
         }
 
         // The model lands only after the rebuild succeeds, so a failed
         // transition leaves both the tool list and the store untouched.
+        let previous_registered = self.tools.advisor_registered();
+        let previous_model = store.model();
         self.tools.set_advisor_registered(registered);
         match self.rebind_current_session().await {
             Ok(()) => {
                 store.set_model(model);
-                Ok(())
+                match self.append_advisor_switch_notice(registered) {
+                    Ok(display) => Ok(Some(display)),
+                    Err(error) => {
+                        // Mirror edit-tool: a notice failure must not leave the
+                        // session advertising a tool list the model was never
+                        // told about.
+                        store.set_model(previous_model);
+                        self.tools.set_advisor_registered(previous_registered);
+                        let _ = self.rebind_current_session().await;
+                        Err(error)
+                    }
+                }
             }
             Err(error) => {
-                self.tools.set_advisor_registered(!registered);
+                self.tools.set_advisor_registered(previous_registered);
                 Err(error)
             }
         }
     }
 
+    fn append_advisor_switch_notice(&mut self, enabled: bool) -> anyhow::Result<String> {
+        #[cfg(test)]
+        if FAIL_NEXT_ADVISOR_NOTICE.with(std::cell::Cell::get) {
+            FAIL_NEXT_ADVISOR_NOTICE.with(|flag| flag.set(false));
+            anyhow::bail!("injected advisor switch notice failure");
+        }
+        let (model, display) = if enabled {
+            let spec = self
+                .tools
+                .specs()
+                .into_iter()
+                .find(|spec| spec.name == crate::tools::advisor::TOOL_NAME)
+                .ok_or_else(|| {
+                    anyhow::anyhow!("advisor tool is missing after it was registered")
+                })?;
+            crate::prompt::advisor_enabled_context(&spec)
+        } else {
+            crate::prompt::advisor_disabled_context()
+        };
+        self.append_user_context_with_display(model, display.clone())?;
+        Ok(display)
+    }
+
     /// Rebuilds the SDK runtime around the current tools and prompt, then
     /// rebinds the live session onto it. The live runtime is replaced only
     /// after the replacement is ready, so a failure leaves the session intact.
-    async fn rebind_current_session(&mut self) -> anyhow::Result<()> {
+    ///
+    /// Callers that change the advertised tool list should keep the system
+    /// prompt fixed for prompt-cache stability and tell the model about the
+    /// change with an appended context message instead.
+    pub(super) async fn rebind_current_session(&mut self) -> anyhow::Result<()> {
         let snapshot = self.sessions.session().snapshot();
         let replacement_runtime = build_runtime(RuntimeBuildOptions {
             provider: Arc::clone(self.provider.provider()),

crates/rho/src/app/interactive_runtime_edit_tool.rs

@@ -0,0 +1,78 @@
+//! File edit tool as a runtime state transition.
+//!
+//! Swapping the advertised edit surface changes the tool list, which the SDK
+//! cannot hot-swap on a live runtime. The change rebuilds the runtime and
+//! rebinds the session so it lands on the next turn. Session ID and history
+//! survive it.
+//!
+//! The system prompt stays fixed and format-agnostic. The model learns about the
+//! new surface from an appended context notice that carries the live schema.
+
+use super::InteractiveRuntime;
+
+/// Result of a successful mid-session edit-tool switch.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct EditToolChange {
+    pub(crate) previous: rho_tools::EditFormat,
+    pub(crate) display: String,
+}
+
+impl InteractiveRuntime {
+    /// Swaps the advertised file edit tool for the next turn.
+    ///
+    /// Keeps the system prompt fixed for prompt-cache stability, rebuilds the
+    /// runtime tool list, and appends a model-facing schema notice when the
+    /// surface actually changes. Returns [`None`] when this run has no edit tool
+    /// or the selection is already active.
+    pub(crate) async fn set_edit_tool(
+        &mut self,
+        edit_tool: rho_tools::EditFormat,
+        max_output_bytes: usize,
+    ) -> anyhow::Result<Option<EditToolChange>> {
+        if self.runs.is_active() {
+            anyhow::bail!("edit tool cannot change while a run is active");
+        }
+        let Some(previous) = self.tools.set_edit_tool(edit_tool, max_output_bytes) else {
+            return Ok(None);
+        };
+        if let Err(error) = self.rebind_current_session().await {
+            let _ = self.tools.set_edit_tool(previous, max_output_bytes);
+            return Err(error);
+        }
+        match self.append_edit_tool_switch_notice(previous, edit_tool) {
+            Ok(display) => Ok(Some(EditToolChange { previous, display })),
+            Err(error) => {
+                // Best-effort restore so a notice failure does not leave the
+                // session advertising a tool the model was never told about.
+                let _ = self.tools.set_edit_tool(previous, max_output_bytes);
+                let _ = self.rebind_current_session().await;
+                Err(error)
+            }
+        }
+    }
+
+    fn append_edit_tool_switch_notice(
+        &mut self,
+        previous: rho_tools::EditFormat,
+        current: rho_tools::EditFormat,
+    ) -> anyhow::Result<String> {
+        let spec = self
+            .tools
+            .specs()
+            .into_iter()
+            .find(|spec| spec.name == current.tool_name())
+            .ok_or_else(|| {
+                anyhow::anyhow!(
+                    "edit tool `{}` is missing after the mid-session switch",
+                    current.tool_name()
+                )
+            })?;
+        let (model, display) = crate::prompt::edit_tool_switch_context(previous, current, &spec);
+        self.append_user_context_with_display(model, display.clone())?;
+        Ok(display)
+    }
+
+    pub(crate) fn tool_specs(&self) -> Vec<rho_sdk::model::ToolSpec> {
+        self.tools.specs()
+    }
+}

crates/rho/src/app/interactive_runtime_startup.rs

@@ -101,7 +101,7 @@ pub(super) async fn initialize(
             approval_session: approval_handler
                 .clone()
                 .map(rho_sdk::ApprovalSession::from_shared),
-            system_prompt: system_prompt.for_advisor_mode(tools.advisor_registered()),
+            system_prompt: system_prompt.clone(),
             reasoning: sdk_options.runtime.reasoning,
             service_tier: sdk_options.runtime.service_tier,
             compaction: compaction.clone(),