@dotdrelle/wiki-manager 0.12.0 → 0.12.7

package/src/agent/graph.js

@@ -5,7 +5,8 @@ import {
   callMcpTool,
   formatMcpToolResult,
   formatMcpToolsForAgent,
-  parseToolCallName,
+  resolveToolCallName,
+  truncateToolResult,
 } from '../core/mcp.js';
 import { formatSkillsForAgent, readOptionalText } from '../core/skills.js';
 import { handleSlashCommand } from '../commands/slash.js';
@@ -13,11 +14,22 @@ import { extractActivity, formatActivitySummary, parseJsonText, sessionActivitie
 import { createAgentEvent, dispatchAgentEvent } from '../core/agentEvents.js';
 import { enqueueProductionJob, ensureJobQueue, formatQueue, productionLockBusy } from '../core/jobQueue.js';
 import { updateWorkspaceProfilePreference } from '../core/profile.js';
+import { createCapabilityRegistry } from '../orchestrator/capabilityRegistry.js';
+import { fetchRuntimeState, postRuntimeCancel, postRuntimeControl, postRuntimeKill } from '../runtime/client.js';
 
 const MAX_TOOL_ITERATIONS = 80;
 const MAX_SPINNER_ARG_LENGTH = 96;
 const MAX_PROFILE_CHARS = 4000;
 
+// Pseudo-servers handled directly by the tool executor (not present in
+// session.mcp). Listed so unqualified names like "plan_set" resolve the same
+// way as MCP tools in resolveToolCallName.
+const INTERNAL_TOOL_SERVERS = {
+  wiki: ['plan_set', 'plan_done'],
+  shell: ['run_command', 'read_command', 'profile_update'],
+  runtime: ['kill', 'cancel', 'status', 'approve', 'enqueue'],
+};
+
 const AGENT_SLASH_COMMANDS = new Set([
   'help',
   'version',
@@ -100,6 +112,59 @@ const SHELL_PROFILE_UPDATE_TOOL = {
   },
 };
 
+// Runtime control tools: Donna interprets the user's intent ("supprime le
+// job et la queue", "arrête tout", "où en est le run") and ACTS through
+// these, instead of a hardcoded regex classifier answering with canned text.
+const RUNTIME_KILL_TOOL = {
+  type: 'function',
+  function: {
+    name: 'runtime__kill',
+    description: 'Hard-stop the workspace runtime: abort the active run, cancel its agent jobs, mark persisted runs interrupted and purge the control queue. Use when the user asks to remove/kill/clean the current run, its jobs or the queue.',
+    parameters: { type: 'object', additionalProperties: false, properties: { runId: { type: 'string', description: 'Optional specific run id; omit to kill everything active in the workspace.' } } },
+  },
+};
+
+const RUNTIME_CANCEL_TOOL = {
+  type: 'function',
+  function: {
+    name: 'runtime__cancel',
+    description: 'Soft-cancel the active runtime run (graceful abort, no queue purge). Use for "annule le run" when the user does not ask to clean everything.',
+    parameters: { type: 'object', additionalProperties: false, properties: {} },
+  },
+};
+
+const RUNTIME_STATUS_TOOL = {
+  type: 'function',
+  function: {
+    name: 'runtime__status',
+    description: 'Read the runtime state: active run, plan steps, queue items, approvals. Use to answer questions about what is currently running or queued.',
+    parameters: { type: 'object', additionalProperties: false, properties: {} },
+  },
+};
+
+const RUNTIME_APPROVE_TOOL = {
+  type: 'function',
+  function: {
+    name: 'runtime__approve',
+    description: 'Grant the pending approval of the active runtime run (mutating tasks wait on it). Use when the user consents in ANY phrasing: "vas-y", "ok pour l\'export", "approuve", "valide". Confirm what was approved.',
+    parameters: { type: 'object', additionalProperties: false, properties: {} },
+  },
+};
+
+const RUNTIME_ENQUEUE_TOOL = {
+  type: 'function',
+  function: {
+    name: 'runtime__enqueue',
+    description: 'Queue a request to run AFTER the currently active runtime run finishes. Use when the user asks for a new action while a run is active and wants it done afterwards.',
+    parameters: {
+      type: 'object',
+      additionalProperties: false,
+      properties: { input: { type: 'string', description: 'The request to execute after the current run, phrased as a complete instruction.' } },
+      required: ['input'],
+    },
+  },
+};
+
 const WIKI_PLAN_SET_TOOL = {
   type: 'function',
   function: {
@@ -128,6 +193,8 @@ const WIKI_PLAN_SET_TOOL = {
                   status: { type: 'string', enum: ['pending', 'queued', 'running', 'waiting', 'pending_approval', 'done', 'failed', 'cancelled', 'stalled', 'added_during_run'] },
                   dependsOn: { type: 'array', items: { type: 'string' } },
                   outputRefs: { type: 'array', items: { type: 'string' } },
+                  operation: { type: ['string', 'null'], description: 'Operation for the capability provider (e.g. ingest_plan, build).' },
+                  arguments: { type: 'object', description: 'Arguments passed to the provider agent_execute for this step.' },
                 },
                 required: ['description'],
               },
@@ -440,9 +507,87 @@ function emitAgentEvent(session, type, origin, payload = {}) {
   dispatchAgentEvent(session, createAgentEvent(type, { origin, payload }));
 }
 
+// Capability ids currently provided by discovered, orchestrable, healthy
+// agents. This is the live registry the dispatcher will resolve against —
+// a plan declaring anything outside this set can only stall forever.
+export function knownCapabilityIds(session) {
+  const registry = session?.capabilityRegistry ?? createCapabilityRegistry({
+    agents: session?.agentRegistrySnapshot ?? session?.agents ?? [],
+  });
+  const snapshot = typeof registry.snapshot === 'function' ? registry.snapshot() : registry;
+  return [...new Set(Object.keys(snapshot ?? {}).map((key) => {
+    const index = key.lastIndexOf('@');
+    return index > 0 ? key.slice(0, index) : key;
+  }))].sort();
+}
+
+async function handleRuntimeControlTool(session, tool, args = {}) {
+  const url = session.runtime?.url ?? null;
+  if (!url) return 'Runtime not connected: no runtime URL available in this session.';
+  const workspace = session.workspace ?? null;
+  try {
+    if (tool === 'kill') {
+      const result = await postRuntimeKill({ url, workspace, runId: args.runId ?? null });
+      return `Runtime killed: ${result.runs ?? 0} run(s) interrupted, ${result.tasks ?? 0} task(s) cancelled, ${result.queued ?? 0} queued control request(s) purged.`;
+    }
+    if (tool === 'cancel') {
+      const result = await postRuntimeCancel({ url, workspace });
+      return result.cancelled ? 'Runtime run cancellation requested.' : `No active run to cancel${result.reason ? ` (${result.reason})` : ''}.`;
+    }
+    if (tool === 'approve') {
+      const result = await postRuntimeControl('message', { url, workspace, input: 'approve', intent: 'approve' });
+      return String(result?.explanation ?? (result?.accepted ? 'Approval granted.' : 'No pending approval found.'));
+    }
+    if (tool === 'enqueue') {
+      const result = await postRuntimeControl('message', { url, workspace, input: String(args.input ?? ''), intent: 'enqueue' });
+      return String(result?.explanation ?? 'Request queued for after the current run.');
+    }
+    if (tool === 'status') {
+      const state = await fetchRuntimeState({ url, workspace });
+      const plan = Array.isArray(state?.plan) ? state.plan : [];
+      const queue = Array.isArray(state?.queue) ? state.queue : [];
+      const controlQueue = Array.isArray(state?.controlQueue) ? state.controlQueue : [];
+      return JSON.stringify({
+        status: state?.status ?? 'unknown',
+        running: Boolean(state?.running),
+        runId: state?.runId ?? null,
+        plan: plan.map((step) => ({ id: step.id ?? step.step, description: step.description, status: step.status })),
+        queue: queue.map((item) => ({ id: item.id, status: item.status, tool: item.tool ?? item.type ?? null })),
+        controlQueue: controlQueue.filter((item) => item.status === 'queued').map((item) => ({ id: item.id, input: item.input })),
+        pendingApprovals: (Array.isArray(state?.approvals) ? state.approvals : [])
+          .filter((approval) => approval.status === 'pending_approval')
+          .map((approval) => ({ id: approval.id, reason: approval.reason ?? null })),
+      }, null, 2);
+    }
+    return `Unknown runtime tool: ${tool}`;
+  } catch (err) {
+    return `Runtime control error (${tool}): ${err instanceof Error ? err.message : String(err)}`;
+  }
+}
+
 function handleWikiTool(session, tool, args) {
   if (tool === 'plan_set') {
     const steps = Array.isArray(args.steps) ? args.steps : [];
+    // Reject fantasy capabilities BEFORE the plan exists: once registered,
+    // unresolvable steps become tasks that wait forever and flood the queue.
+    // A tool-level error (not an exception) lets the LLM correct itself in
+    // the same turn. An empty registry (discovery not done yet) skips the
+    // check rather than blocking legitimate early plans.
+    const known = knownCapabilityIds(session);
+    if (known.length > 0) {
+      const unknown = [...new Set(steps
+        .map((step) => (step && typeof step === 'object' ? step.requiredCapability : null))
+        .filter(Boolean)
+        .map(String)
+        .filter((capability) => !known.includes(capability.includes('@') ? capability.slice(0, capability.lastIndexOf('@')) : capability)))];
+      if (unknown.length > 0) {
+        return `Plan rejected: unknown capabilities [${unknown.join(', ')}]. `
+          + `Available capabilities: ${known.join(', ')}. `
+          + 'Redeclare the plan using only available capabilities, or use requiredCapability: null for a step you execute yourself.';
+      }
+    } else if (steps.some((step) => step && typeof step === 'object' && step.requiredCapability)) {
+      session._onStep?.('plan_set: capability registry empty, validation skipped');
+    }
     emitAgentEvent(session, 'plan_set', 'tool', {
       steps: steps.map((raw, i) => normalizeDeclaredPlanStep(raw, i, session)),
     });
@@ -475,6 +620,21 @@ function normalizeDeclaredPlanStep(raw, index) {
     executor: null,
     executorQuery: null,
     outputRefs: Array.isArray(item.outputRefs) ? item.outputRefs.map(String) : [],
+    // Execution fields the deterministic dispatcher consumes (agent_execute):
+    // without them a capability step cannot actually run.
+    ...(item.operation != null ? { operation: String(item.operation) } : {}),
+    ...(item.arguments && typeof item.arguments === 'object' ? { arguments: item.arguments } : {}),
+    ...(item.groupId != null ? { groupId: String(item.groupId) } : {}),
+    ...(item.dependsOnGroup != null ? { dependsOnGroup: String(item.dependsOnGroup) } : {}),
+    ...(item.parallelizable != null ? { parallelizable: Boolean(item.parallelizable) } : {}),
+    ...(item.barrier ? { barrier: true } : {}),
+    ...(item.locks ? { locks: item.locks } : {}),
+    ...(item.requiresApproval != null ? { requiresApproval: Boolean(item.requiresApproval) } : {}),
+    ...(item.approvalClass ? { approvalClass: String(item.approvalClass) } : {}),
+    ...(item.approvalSummary ? { approvalSummary: String(item.approvalSummary) } : {}),
+    ...(item.idempotencyKey ? { idempotencyKey: String(item.idempotencyKey) } : {}),
+    ...(item.progressWeight != null ? { progressWeight: Number(item.progressWeight) } : {}),
+    ...(item.recommendedConcurrency != null ? { recommendedConcurrency: Number(item.recommendedConcurrency) } : {}),
   };
 }
 
@@ -539,9 +699,16 @@ export function buildAgentSystemPrompt(state) {
       'Prefer MCP tools that declare their own plan via _activity.plan.steps — when such a tool returns _activity, the shell creates and tracks the plan automatically without requiring wiki__plan_set.',
       'Use wiki__plan_set when the MCP tool cannot declare its own plan or when the task spans multiple independent tools (e.g. CME export then email report). For a single self-describing async job, wiki__plan_set is optional.',
       '',
+      (() => {
+        const capabilityIds = knownCapabilityIds(state.session);
+        return capabilityIds.length > 0
+          ? `Known orchestration capabilities — the ONLY values allowed in requiredCapability: ${capabilityIds.join(', ')}. Never invent capability names; a plan declaring an unknown capability will be rejected. A step you execute yourself directly takes requiredCapability: null.`
+          : 'No orchestration capabilities discovered yet: declare plan steps with requiredCapability: null and execute them yourself with the connected MCP tools.';
+      })(),
+      '',
       'Task startup:',
       '  1. If the next MCP tool returns _activity.plan.steps, call that tool directly; the shell will create the visible plan from the returned activity.',
-      '  2. If the tool cannot declare its own plan, call wiki__plan_set before executing the first step. Prefer structured steps: {id, description, requiredCapability, dependsOn, outputRefs}; a legacy list of strings is still accepted.',
+      '  2. If the tool cannot declare its own plan, call wiki__plan_set before executing the first step. Prefer structured steps: {id, description, requiredCapability, operation, arguments, dependsOn, outputRefs}; capability steps need operation+arguments for the dispatcher to execute them; a legacy list of strings is still accepted.',
       '     Multi-tool example: wiki__plan_set(steps=[{id:"cme-export",description:"CME export",requiredCapability:"external-source.export",dependsOn:[],outputRefs:["raw/untracked"]},{id:"production",description:"Production pipeline",requiredCapability:"knowledge.pipeline",dependsOn:["cme-export"],outputRefs:["deliverables"]}])',
       '  3. Immediately execute the first step using the appropriate MCP tool. Do not start step 2 in the same turn unless one async pipeline tool owns and declares the whole sequence.',
       '  For synchronous steps (result is immediate, no _activity polling), call wiki__plan_done(step=1) after confirming success.',
@@ -561,17 +728,21 @@ export function buildAgentSystemPrompt(state) {
       'On failure: if a completed activity is failed/error/cancelled, call wiki__plan_done(step=N, status="failed") then stop with a clear error report.',
     ].filter(Boolean).join('\n'),
     'For service actions, recommend only available service primitives from Available primitives, with the exact service name when the primitive supports one.',
+    'Scope discipline: execute ONLY the action(s) the user explicitly requested. Never chain additional mutating operations (ingest, build, export, polish, delete, send…) that the user did not ask for — even when diagnostics or recommendations suggest them. Finish the requested work, then list the suggested follow-ups in your final answer and stop. Example: "applique les recommandations de config" means apply the config; it does NOT authorize launching the ingest those recommendations mention.',
     'Disambiguate export requests carefully.',
-    'Confluence/CME/source export means exporting external Confluence sources into raw/untracked: use cme MCP tools (`cme_export_run`, then `cme_export_status`). Never use production `type=export` for Confluence source export.',
-    'Wiki/deliverable/publication export means exporting generated deliverables from the wiki: use production MCP tools (`production_start_job` with `type:"export"` or pipeline steps). Require the deliverable path when exporting deliverables.',
-    'For ingest/build/export/polish/pipeline workflows, use production MCP tools. Do not route these through direct /wiki shortcuts. To chain multiple sequential steps (e.g. build then polish), always use a single production_start_job call with type="pipeline" and steps=["build","polish"] — never start them as separate jobs: the first job is asynchronous and the second would run before it completes. For existing deliverables where content stability matters, pass stabilize:true so the build step preserves unchanged sections; keep polish in the pipeline when publication output is requested. Do not ask the user to confirm between steps; start the pipeline call directly.',
+    'Confluence/CME/source export means exporting external Confluence sources into raw/untracked: use cme MCP tools (`cme__cme_export_run`, then `cme__cme_export_status`). Never use production `type=export` for Confluence source export.',
+    'Wiki/deliverable/publication export means exporting generated deliverables from the wiki: use production MCP tools (`production__production_start_job` with `type:"export"` or pipeline steps). Require the deliverable path when exporting deliverables.',
+    'For ingest/build/export/polish/pipeline workflows, use production MCP tools. Do not route these through direct /wiki shortcuts.',
+    'MULTI-DOCUMENT ingest (more than 2 files, or "ingest everything pending"): call production__agent_plan first, e.g. {capability:"knowledge.update", operation:"ingest", constraints:{maxConcurrency:3, requireApprovalForMutations:true}}. The shell integrates the returned task graph as the plan automatically and the orchestrator dispatches the per-document tasks IN PARALLEL with an approval gate. Do not call production__production_start_job for multi-document ingest — that creates one monolithic sequential job.',
+    'Single-document ingest or one-off jobs (doctor, one build, one export): production__production_start_job is fine. To chain sequential steps (e.g. build then polish) use ONE call with type="pipeline" and steps=["build","polish"] — never separate jobs (the first is asynchronous). For existing deliverables where content stability matters, pass stabilize:true. Do not ask the user to confirm between steps.',
     'Long-running MCP jobs: do not call the same status tool more than once consecutively. When chaining jobs sequentially: (1) start the job, report job/activity id and status; (2) check status once — if done, proceed to the next step immediately; (3) if still running, report status, list the remaining steps, and return control; (4) when re-invoked, check status first, then proceed. Do not spin-poll (status → status → status with no new action between). The shell activity panel monitors non-terminal jobs automatically.',
-    'If production_start_job is returned as queued/waiting by the manager, report that it is waiting in the local queue and return control. Do not continue as if the production job has started.',
-    'For diagnostics, use /wiki run doctor when the user asks for doctor. Use /workspace init <name> [path] for low-level non-interactive workspace creation. In the interactive TUI, /new <name> opens the setup wizard. Use /wiki for index, or /wiki run index through the explicit backup hatch. Use /wiki run init only for explicit current-workspace llm-wiki init.',
+    'If production__production_start_job is returned as queued/waiting by the manager, report that it is waiting in the local queue and return control. Do not continue as if the production job has started.',
+    'For diagnostics (doctor), use production__production_start_job with type="doctor" like any other production job; /wiki run doctor is only the fallback when the production MCP is not connected. Use /workspace init <name> [path] for low-level non-interactive workspace creation. In the interactive TUI, /new <name> opens the setup wizard. Use /wiki for index, or /wiki run index through the explicit backup hatch. Use /wiki run init only for explicit current-workspace llm-wiki init.',
     'If an action requires tools or skills not available yet, explain the limitation and name the expected primitive.',
     workspaceProfile
       ? `Workspace profile (.wiki/profile.md) — durable user preferences, apply these to every reply (tone, tutoiement/vouvoiement, formatting, etc.):\n${workspaceProfile}`
       : null,
+    'Runtime control: you have runtime__status, runtime__cancel, runtime__kill, runtime__approve and runtime__enqueue. When the user asks to stop, remove, clean or kill the current run, its jobs or the queue ("supprime le job et la queue", "arr\u00eate tout"), call runtime__kill (or runtime__cancel for a soft stop of just the run) and confirm what was stopped. For questions about what is running or queued, call runtime__status and answer from its data. When the user consents to a pending approval in any phrasing ("vas-y", "ok pour l\'export"), call runtime__approve. When the user asks for a NEW action while a run is active, do not execute it: propose runtime__enqueue (run it after) or, if they insist it replaces the current work, runtime__kill then the new action.',
     'When the user explicitly asks you to remember, persist, or update durable preference/profile information, call wiki__profile_update when it is available; otherwise call shell__profile_update. Do not just acknowledge in text without calling a profile update tool.',
   ].filter(Boolean).join('\n');
 
@@ -602,20 +773,35 @@ export function formatLlmUnavailableMessage(reason) {
   return `⚠ LLM injoignable : ${clean || 'raison inconnue'}`;
 }
 
-function classifyAgentInput(input, session) {
+// Verbs that clearly request work (a runtime run), in French and English.
+// "configure/configurer" is an action; the nouns "config/configuration" are
+// NOT matched here — asking for a config is an observe request.
+const ACTION_REQUEST_PATTERN = /\b(lance|relance|d[eé]marre|start|ex[eé]cute|execute|g[eé]n[eè]re|generate|build|construis|exporte?|ingest\w*|ing[eè]re|importe?|convert(?:is|it|s)?|cr[eé]e|create|polish|publie|publish|d[eé]ploie|deploy|envoie|send|configure[rsz]?|setup|installe|update|mets? [aà] jour|supprime|delete|efface|nettoie|clean|r[eé]pare|fix|corrige)\b/i;
+
+// Explicit explanation/question markers dominate action verbs: "explique le
+// build" is a question about the build, not a request to build.
+const EXPLANATION_REQUEST_PATTERN = /\b(explique|explain|pourquoi|why|comment|how|c'est quoi|qu'est[- ]ce)\b/i;
+
+export function classifyAgentInput(input, session) {
   const lower = String(input ?? '').toLowerCase();
   const hasActiveRun = session?.agentProjection?.status === 'running'
     || sessionActivities(session).some((activity) => !activity.terminal);
   if (/\b(valide tout|approve all|approve|approuve|valid[eé]|ok pour tout|go pour tout)\b/i.test(lower)) {
     return { kind: 'approve', confidence: 0.86, reason: 'approval_request', activeRun: hasActiveRun };
   }
-  if (/\b(cancel|annule|stop|arr[eê]te|interromps|abort)\b/i.test(lower)) {
+  if (/\b(cancel|annule|stop|arr[eê]te|interromps|abort|supprime|kill|tue|purge|vide la (file|queue)|nettoie la (file|queue))\b/i.test(lower)) {
     return { kind: 'cancel', confidence: 0.86, reason: 'cancel_request', activeRun: hasActiveRun };
   }
   if (/\b(plus tard|later|ensuite|apr[eè]s ce run|enqueue|mets en file|met en file|futur|next run|future run)\b/i.test(lower)) {
     return { kind: 'enqueue_run', confidence: 0.8, reason: 'future_run_request', activeRun: hasActiveRun };
   }
-  if (/\b(o[uù] en es[t-]|status|statut|progress|progression|run|job|queue|logs?|explique|explain|inspect|show|montre|quoi de neuf)\b/i.test(lower)) {
+  if (EXPLANATION_REQUEST_PATTERN.test(lower)) {
+    return { kind: 'observe', confidence: 0.86, reason: 'explanation_request', activeRun: hasActiveRun };
+  }
+  // Observe markers only win when no action verb is present: "où en est le
+  // run" is observe, "lance le run" is an action request.
+  if (/\b(o[uù] en es[t-]|status|statut|progress|progression|run|job|queue|logs?|inspect|show|montre|affiche|donne|liste|list|quel(?:le)?s?|combien|config(?:uration)?|quoi de neuf)\b/i.test(lower)
+    && !ACTION_REQUEST_PATTERN.test(lower)) {
     return { kind: 'observe', confidence: 0.86, reason: 'status_or_explanation_request', activeRun: hasActiveRun };
   }
   if (hasActiveRun && /\b(ajoute|add|change|modifie|modify|remplace|replace|retire|remove|skip|ignore|plan|step|t[aâ]che)\b/i.test(lower)) {
@@ -624,12 +810,24 @@ function classifyAgentInput(input, session) {
   if (hasActiveRun && /\b(lance|run|g[eé]n[eè]re|build|export|cr[eé]e|create|send|envoie|ingest|convert|importe|import)\b/i.test(lower)) {
     return { kind: 'ambiguous', confidence: 0.45, reason: 'active_run_action_is_ambiguous', activeRun: hasActiveRun };
   }
+  if (ACTION_REQUEST_PATTERN.test(lower)) {
+    return { kind: 'start_run', confidence: 0.8, reason: 'action_request', activeRun: hasActiveRun };
+  }
   return { kind: 'converse', confidence: 0.62, reason: 'plain_conversation', activeRun: hasActiveRun };
 }
 
-function toolsForClassification(classification, writeTools) {
-  if (classification.activeRun && ['converse', 'observe'].includes(classification.kind)) return [SHELL_READ_COMMAND_TOOL];
-  return [SHELL_READ_COMMAND_TOOL, ...writeTools];
+function toolsForClassification(classification, writeTools, session = null) {
+  const controlTools = session?.runtime?.url
+    ? [RUNTIME_STATUS_TOOL, RUNTIME_CANCEL_TOOL, RUNTIME_KILL_TOOL, RUNTIME_APPROVE_TOOL, RUNTIME_ENQUEUE_TOOL]
+    : [];
+  if (classification.activeRun && ['converse', 'observe', 'ambiguous', 'approve', 'cancel', 'enqueue_run'].includes(classification.kind)) {
+    // During an active run Donna gets read + profile + the runtime control
+    // suite: she can answer, approve, enqueue for later, soft-cancel or
+    // kill — but she must not fire new MCP jobs alongside the run (that is
+    // what runtime__enqueue is for). No canned regex answers anywhere.
+    return [SHELL_READ_COMMAND_TOOL, SHELL_PROFILE_UPDATE_TOOL, ...controlTools];
+  }
+  return [SHELL_READ_COMMAND_TOOL, ...controlTools, ...writeTools];
 }
 
 export function createAgentGraph(options = {}) {
@@ -655,8 +853,17 @@ export function createAgentGraph(options = {}) {
       state.session._onStep?.('Agent: planning next action…');
     }
 
+    // Inside a runtime run the input IS the task to execute (the runtime
+    // already accepted it as a run): the interactive control-message
+    // classifier must not apply. Without this, agentProjection.status is
+    // 'running' during every run, so any action verb ("lance l'ingestion")
+    // matched the active-run 'ambiguous' branch and returned a canned
+    // clarification instead of executing — the run ended silently.
+    const runtimeExecution = Boolean(state.session._currentRunIdentity);
     const classification = iterations === 0
-      ? classifyAgentInput(state.input, state.session)
+      ? (runtimeExecution
+        ? { kind: 'execute_run', confidence: 1, reason: 'runtime_run_execution', activeRun: true }
+        : classifyAgentInput(state.input, state.session))
       : (state.inputClassification ?? { kind: 'modify_run', confidence: 1, reason: 'tool_iteration' });
     if (iterations === 0) {
       state.session._onStep?.(`Agent: classified input as ${classification.kind}`);
@@ -665,14 +872,6 @@ export function createAgentGraph(options = {}) {
         classification,
       });
     }
-    if (iterations === 0 && classification.kind === 'ambiguous') {
-      return {
-        response: 'Je peux répondre sur le run en cours, modifier ce run, mettre une nouvelle demande en file, approuver, ou annuler. Peux-tu préciser ce que tu veux faire ?',
-        pendingToolCalls: null,
-        readyToStream: false,
-        inputClassification: classification,
-      };
-    }
 
     const writeTools = [
       SHELL_RUN_COMMAND_TOOL,
@@ -681,7 +880,7 @@ export function createAgentGraph(options = {}) {
       WIKI_PLAN_DONE_TOOL,
       ...buildLlmTools(state.session.mcp),
     ];
-    const tools = toolsForClassification(classification, writeTools);
+    const tools = toolsForClassification(classification, writeTools, state.session);
     const system = buildAgentSystemPrompt(state);
 
     // On iteration 0: prior history is in state.messages, user input must be appended.
@@ -713,6 +912,13 @@ export function createAgentGraph(options = {}) {
 
       if (result.tool_calls?.length > 0) {
         state.session._onStreamReset?.();
+        // Close the streaming conversation entry now: the text streamed so
+        // far is this iteration's narration. Without this, the next
+        // iteration's deltas append to the SAME entry with no separator and
+        // the chat becomes one glued wall of text ("…de la config.Voyons…").
+        // An empty finalize keeps the accumulated content and just drops the
+        // streaming flag; it is a no-op when nothing was streamed.
+        emitAgentEvent(state.session, 'assistant_message', 'llm', { content: '' });
         state.session._onStep?.(`[${iterations + 1}/${MAX_TOOL_ITERATIONS}] ${result.tool_calls.length} MCP action${result.tool_calls.length > 1 ? 's' : ''} queued…`);
         // On iteration 0 persist the user message too so it survives the loop.
         const newMessages = iterations === 0
@@ -771,11 +977,19 @@ export function createAgentGraph(options = {}) {
     const toolResultMessages = [];
 
     for (const call of toolCalls) {
-      const { server, tool } = parseToolCallName(call.function.name);
+      const resolved = resolveToolCallName(state.session.mcp, call.function.name, INTERNAL_TOOL_SERVERS);
+      const { server, tool } = resolved;
       const argsSummary = summarizeToolArguments(call.function.arguments);
       const isInternalWikiTool = server === 'wiki' && (tool === 'plan_set' || tool === 'plan_done');
       const serverLabel = server === 'shell' ? 'Shell' : isInternalWikiTool ? 'Plan' : 'MCP';
-      const toolName = `${server}.${tool}`;
+      const toolName = server ? `${server}.${tool}` : call.function.name;
+      if (resolved.normalized) {
+        // Keep normalizations visible: the defensive routing must not hide
+        // prompt/skill regressions that reintroduce unqualified names.
+        state.session._onStep?.(
+          `tool name normalized: ${call.function.name} -> ${server}__${tool}`,
+        );
+      }
       state.session._onStep?.(
         `[${state.toolIterations}/${MAX_TOOL_ITERATIONS}] ${serverLabel} ${toolName}${argsSummary ? ` (${argsSummary})` : ''}`,
       );
@@ -796,6 +1010,18 @@ export function createAgentGraph(options = {}) {
       let resultText;
       let ok = true;
       try {
+        if (!server) {
+          if (resolved.candidates.length > 1) {
+            throw new Error(
+              `Ambiguous unqualified tool name "${call.function.name}": several connected servers expose it. `
+              + `Use the <server>__<tool> form: ${resolved.candidates.map((s) => `${s}__${tool}`).join(', ')}.`,
+            );
+          }
+          throw new Error(
+            `Unqualified tool call name "${call.function.name}". Tool calls must use the <server>__<tool> `
+            + `naming convention (e.g. production__production_start_job); no connected server exposes a tool named "${tool}".`,
+          );
+        }
         let args = JSON.parse(call.function.arguments ?? '{}');
         if (server === 'production' && tool === 'production_start_job' && state.session.workspace && !args.callerLabel) {
           args = { ...args, callerLabel: `${state.session.workspace}/wiki-manager` };
@@ -811,6 +1037,8 @@ export function createAgentGraph(options = {}) {
         } else if (server === 'shell' && tool === 'profile_update') {
           const result = await updateWorkspaceProfilePreference(state.session, args.preference);
           resultText = JSON.stringify(result, null, 2);
+        } else if (server === 'runtime') {
+          resultText = await handleRuntimeControlTool(state.session, tool, args);
         } else if (server !== 'shell') {
           await awaitRunApproval(state.session, { runId, tool: toolName });
           await awaitToolApproval(state.session, {
@@ -833,6 +1061,41 @@ export function createAgentGraph(options = {}) {
             resultText = formatMcpToolResult(result);
           }
         }
+        {
+          const payload = parseJsonText(resultText);
+          // agent_plan (any provider) returned a task-graph fragment: declare it as
+          // the plan DETERMINISTICALLY. Asking the LLM to copy N tasks into
+          // wiki__plan_set would lose fields (a small local model dropped
+          // arguments/operations in testing) — the shell does the mapping.
+          if (/(^|__)agent_plan$/.test(tool) && Array.isArray(payload?.tasks) && payload.tasks.length > 0) {
+            const steps = payload.tasks.map((task, index) => normalizeDeclaredPlanStep({
+              id: task.id,
+              description: task.label ?? task.id ?? `Task ${index + 1}`,
+              requiredCapability: task.requiredCapability ?? payload.capability ?? null,
+              operation: task.operation ?? null,
+              arguments: task.arguments ?? {},
+              dependsOn: task.dependsOn ?? [],
+              outputRefs: (task.expectedOutputRefs ?? []).map((ref) => (ref && typeof ref === 'object' ? String(ref.ref ?? '') : String(ref))).filter(Boolean),
+              groupId: task.groupId ?? null,
+              dependsOnGroup: task.dependsOnGroup ?? null,
+              parallelizable: task.parallelizable,
+              barrier: task.barrier,
+              locks: task.locks,
+              requiresApproval: task.requiresApproval,
+              approvalClass: task.approvalClass,
+              approvalSummary: task.approvalSummary,
+              idempotencyKey: task.idempotencyKey,
+              progressWeight: task.progressWeight,
+              recommendedConcurrency: task.recommendedConcurrency,
+            }, index, state.session));
+            emitAgentEvent(state.session, 'plan_set', 'tool', { steps });
+            state.session._onStep?.(`Plan: ${steps.length} task(s) declared from ${server} fragment`);
+            resultText = `Task-graph fragment integrated as the current plan (${steps.length} task(s), groups: ${[...new Set(payload.tasks.map((task) => task.groupId).filter(Boolean))].join(', ') || 'none'}). The orchestrator will dispatch these tasks — do NOT call production tools for them yourself. Reply with a short summary and wait.`;
+          }
+          if (/(^|__)agent_plan$/.test(tool) && Array.isArray(payload?.tasks) && payload.tasks.length > 0) {
+            minimalPlanActive = false;
+          }
+        }
         if (server === 'production') {
           let payload = parseJsonText(resultText);
           if (tool === 'production_start_job' && payload?.ok === false && payload?.error === 'workspace_busy') {
@@ -869,22 +1132,26 @@ export function createAgentGraph(options = {}) {
           err.name === 'ApprovalError'
         ) throw err;
         ok = false;
-        resultText = `Error [${server}.${tool}]: ${err instanceof Error ? err.message : String(err)}`;
+        resultText = `Error [${toolName}]: ${err instanceof Error ? err.message : String(err)}`;
         if (minimalPlanActive && state.session.headlessPlan?.[0]?._activityKey === null) {
           emitAgentEvent(state.session, 'plan_step_updated', 'tool', { step: 1, status: 'failed' });
         }
       }
+      // Bound the result at its two exit points only (LLM context + display).
+      // The full resultText above was already used for payload parsing and
+      // _activity extraction, which must never see a truncated document.
+      const boundedResult = truncateToolResult(resultText);
       emitAgentEvent(state.session, 'tool_call_result', 'tool', {
         callId: call.id,
         name: toolName,
         ok,
-        result: resultText,
+        result: boundedResult,
         summary: ok ? 'done' : 'failed',
       });
       toolResultMessages.push({
         role: 'tool',
         tool_call_id: call.id,
-        content: resultText,
+        content: boundedResult,
       });
     }
 
@@ -899,11 +1166,22 @@ export function createAgentGraph(options = {}) {
     return END;
   }
 
-  return new StateGraph(AgentState)
+  const compiled = new StateGraph(AgentState)
     .addNode('orchestrator', orchestratorNode)
     .addNode('tool_executor', toolExecutorNode)
     .addEdge(START, 'orchestrator')
     .addConditionalEdges('orchestrator', routeOrchestrator)
     .addEdge('tool_executor', 'orchestrator')
     .compile();
+
+  // LangGraph's default recursionLimit is 25 super-steps. Each tool round
+  // costs two of them (orchestrator + tool_executor), so runs died with
+  // GRAPH_RECURSION_LIMIT around iteration 12 — far below the intended
+  // MAX_TOOL_ITERATIONS budget — before finishing their work (observed as
+  // `knowledge.update — error 0%` with no production job ever created).
+  // Bake a limit matching the iteration budget into every invocation.
+  const recursionLimit = MAX_TOOL_ITERATIONS * 2 + 10;
+  return {
+    invoke: (state, config = {}) => compiled.invoke(state, { recursionLimit, ...config }),
+  };
 }