Improve Galaxy permissions, computer-use routing, and agent UX

crates/galaxy_agent_core/src/provider_run.rs

@@ -867,6 +867,18 @@ impl ProviderRun {
         matches!(self.state, ProviderRunState::ReadyToCallModel).then(|| self.current_work_id())
     }
 
+    /// Selects the runtime for the next turn after a tool batch has been committed.
+    pub fn set_ready_profile(
+        &mut self,
+        profile: impl Into<ProviderRequestProfile>,
+    ) -> Result<(), ProviderRunProtocolError> {
+        if !matches!(self.state, ProviderRunState::ReadyToCallModel) {
+            return Err(self.unexpected_state(ProviderRunPhase::ReadyToCallModel));
+        }
+        self.profile = profile.into();
+        Ok(())
+    }
+
     fn model_turn_limit_reached(&self) -> bool {
         self.limits
             .max_model_turns

crates/galaxy_agent_core/src/provider_run_tests.rs

@@ -18,6 +18,18 @@ fn run() -> ProviderRun {
     run_with_limits(ProviderRunLimits::default())
 }
 
+#[test]
+fn ready_profile_can_change_without_replaying_or_adding_history() {
+    let mut run = run();
+    let original_transcript = run.transcript().to_vec();
+    run.set_ready_profile("computer-use").unwrap();
+
+    assert_eq!(run.profile().as_str(), "computer-use");
+    assert_eq!(run.transcript(), original_transcript);
+    assert_eq!(next_model_call(&mut run).profile.as_str(), "computer-use");
+    assert!(run.set_ready_profile("base").is_err());
+}
+
 fn next_model_call(run: &mut ProviderRun) -> ProviderModelCall {
     let Some(ProviderRunStep::CallModel(call)) = run.next_step().unwrap() else {
         panic!("expected model call");