@dotdrelle/wiki-manager 0.12.11 → 0.14.0

package/src/cli/wiki-manager.js

@@ -15,6 +15,8 @@ import { extractActivity, parseJsonText, sessionActivities, terminalFailures } f
 import { syncActivitiesToPlan, formatPlanStatus } from '../core/plan.js';
 import { createAgentEvent, dispatchAgentEvent } from '../core/agentEvents.js';
 import { runAgentTurn, runAgenticLoop } from '../core/agentLoop.js';
+import { resolveCapabilityConcurrency } from '../orchestrator/scheduler.js';
+import { capabilityRegistryForSession } from '../orchestrator/capabilityRegistry.js';
 // Runtime modules use node:sqlite (Node.js built-in unavailable in Bun).
 // They are imported dynamically so the shell / TUI path never loads them.
 
@@ -55,6 +57,11 @@ function createSession() {
   };
 }
 
+export async function forwardRuntimeApproval(getWorkspaceContext, request = {}) {
+  const context = await getWorkspaceContext(request.workspace ?? null);
+  return context.approvalManager?.approve(request) ?? { approved: false };
+}
+
 function timestampForFile() {
   return new Date().toISOString().replace(/[:.]/g, '-');
 }
@@ -197,6 +204,109 @@ async function runHeadlessAgenticLoop(agent, session, initialInput, log, { timeo
   return { exitCode: result.ok ? 0 : (result.waitResult?.exitCode ?? 1) };
 }
 
+// Observe a runtime-delegated run from headless: the run executes server-side,
+// so poll /state and mirror status transitions, new logs and the final plan
+// into the headless log until the run reaches a terminal state.
+async function waitForRuntimeRun(session, log, { timeoutMs, pollMs = 1500, autoApprove = false, priorRunIds = [] } = {}) {
+  const { fetchRuntimeState, postRuntimeApprove } = await import('../runtime/client.js');
+  const url = session.runtime?.url;
+  const workspace = session.workspace ?? null;
+  if (!url) return { exitCode: 0 };
+  // Scope strictly to the run this turn created: any run already present before
+  // the turn (including a stuck/zombie run) must be ignored, or the wait would
+  // observe/approve the wrong run and never finish.
+  const priorSet = new Set((priorRunIds ?? []).map(String));
+  const terminal = new Set(['succeeded', 'success', 'done', 'complete', 'completed', 'failed', 'error', 'cancelled', 'canceled']);
+  const deadline = Date.now() + timeoutMs;
+  const graceDeadline = Date.now() + 8000;
+  let lastStatus = null;
+  let lastLogCount = 0;
+  let sawRun = false;
+  const approvedRevisions = new Set();
+  while (Date.now() < deadline) {
+    let state;
+    try {
+      state = await fetchRuntimeState({ url, workspace });
+    } catch (err) {
+      const line = `runtime-wait: state fetch failed (${err instanceof Error ? err.message : String(err)})`;
+      log.push(line); console.error(line);
+      return { exitCode: 1 };
+    }
+    const logs = Array.isArray(state?.logs) ? state.logs : [];
+    for (const entry of logs.slice(lastLogCount)) {
+      const text = typeof entry === 'string' ? entry : String(entry?.message ?? JSON.stringify(entry));
+      log.push(`runtime: ${text}`); console.log(`[runtime] ${text}`);
+    }
+    lastLogCount = logs.length;
+    const runs = Array.isArray(state?.runs) ? state.runs : [];
+    const currentRun = runs.find((run) => run?.id && !priorSet.has(String(run.id)));
+    if (!currentRun) {
+      if (sawRun) return { exitCode: 0 };
+      if (Date.now() >= graceDeadline) {
+        const line = 'runtime-wait: no run was delegated this turn (Donna answered without starting a run).';
+        log.push(line); console.log(line);
+        return { exitCode: 0 };
+      }
+      await new Promise((resolve) => setTimeout(resolve, pollMs));
+      continue;
+    }
+    sawRun = true;
+    const status = String(currentRun.status ?? 'running').toLowerCase();
+    if (status !== lastStatus) {
+      log.push(`runtime-status: ${status} (run ${currentRun.id})`); console.log(`[runtime] status=${status}`);
+      lastStatus = status;
+    }
+    // Approval is granted per task, so the run status stays "running" while a
+    // task waits — detect the block via state.approvals, scoped to this run.
+    const pendingApprovals = (Array.isArray(state?.approvals) ? state.approvals : [])
+      .filter((approval) => approval.status === 'pending_approval'
+        && (approval.runId == null || String(approval.runId) === String(currentRun.id)));
+    if (pendingApprovals.length > 0) {
+      if (!autoApprove) {
+        const line = `runtime-wait: run ${currentRun.id} waiting for approval (${pendingApprovals.length} task(s)); re-run with --auto-approve to drive it through.`;
+        log.push(line); console.log(line);
+        return { exitCode: 0 };
+      }
+      const planRevision = state?.planRevision ?? currentRun.planRevision ?? 0;
+      if (!approvedRevisions.has(planRevision)) {
+        approvedRevisions.add(planRevision);
+        const approvalClasses = [...new Set(pendingApprovals.flatMap((approval) => {
+          const value = approval.approvalClasses ?? approval.approvalClass ?? [];
+          return Array.isArray(value) ? value : [value];
+        }).map(String).filter(Boolean))];
+        try {
+          const result = await postRuntimeApprove({
+            url,
+            workspace,
+            runId: currentRun.id,
+            scope: 'run',
+            planRevision,
+            approvalClasses: approvalClasses.length > 0 ? approvalClasses : ['default'],
+          });
+          const line = `runtime-wait: auto-approved run ${currentRun.id} (revision ${planRevision})${result?.approved ? '' : ' [no pending approval matched]'}`;
+          log.push(line); console.log(line);
+        } catch (err) {
+          const line = `runtime-wait: auto-approve failed (${err instanceof Error ? err.message : String(err)})`;
+          log.push(line); console.error(line);
+          return { exitCode: 1 };
+        }
+      }
+    }
+    if (terminal.has(status)) {
+      const plan = Array.isArray(currentRun.plan) ? currentRun.plan
+        : (Array.isArray(state?.plan) ? state.plan : []);
+      if (plan.length > 0) {
+        log.push(`runtime-plan:\n${plan.map((planStep) => `  - ${planStep.description ?? planStep.id ?? planStep.step ?? ''}: ${planStep.status ?? ''}`).join('\n')}`);
+      }
+      return { exitCode: status === 'failed' || status === 'error' ? 1 : 0 };
+    }
+    await new Promise((resolve) => setTimeout(resolve, pollMs));
+  }
+  const line = 'runtime-wait: timeout waiting for the delegated run to finish.';
+  log.push(line); console.error(line);
+  return { exitCode: 1 };
+}
+
 async function runHeadless(argv, agent) {
   const workspaceName = valueAfter(argv, '--workspace');
   const skillName = valueAfter(argv, '--skill');
@@ -228,6 +338,37 @@ async function runHeadless(argv, agent) {
     if (!session.workspacePath) throw new Error(useResult.output || `Workspace not loaded: ${workspaceName}`);
     if (!session.llm) throw new Error(`Workspace ${workspaceName} has no usable LLM config.`);
 
+    // Agent-mode parity: the interactive TUI runs every turn against the
+    // runtime (delegation + run control) with MCP connected. Without a
+    // runtime, the graph exposes no runtime__delegate tool, so any action
+    // request degrades to a chat-like text answer instead of a real delegated
+    // run — which is exactly why headless "looked like chat mode". Connect the
+    // same way the TUI does. Use --no-runtime for the legacy direct-MCP path.
+    if (!argv.includes('--no-runtime')) {
+      try {
+        const { ensureRuntime } = await import('../runtime/lifecycle.js');
+        const runtime = await ensureRuntime();
+        session.runtime = runtime?.url ? { url: runtime.url, started: Boolean(runtime.started) } : null;
+        step(`runtime: ${session.runtime ? `connected ${session.runtime.url}` : 'unavailable'}`);
+      } catch (err) {
+        session.runtime = null;
+        step(`runtime: unavailable (${err instanceof Error ? err.message : String(err)})`);
+      }
+    }
+    await refreshMcpRuntimeStatus(session);
+    step(`mcp: ${Object.values(session.mcp ?? {}).filter((value) => value.status === 'connected').length} connected`);
+    // Surface which tools Donna is actually offered this turn: if a factual
+    // question is answered without the matching read tool appearing here, the
+    // problem is discovery/connection, not the model.
+    for (const [name, value] of Object.entries(session.mcp ?? {})) {
+      if (value?.status !== 'connected') continue;
+      const toolNames = (value.tools ?? []).map((tool) => tool.name).join(', ');
+      step(`mcp-tools ${name}: ${toolNames || '(none discovered)'}`);
+    }
+    // Wire the graph's step trace (classification, tool calls, retries) into
+    // the headless log so the agent-mode decision is observable.
+    session._onStep = step;
+
     let input = prompt;
     if (skillName) {
       const skillResult = await handleSlashCommand(`/skills run ${skillName}`, { packageJson, session, onStep: step });
@@ -259,11 +400,26 @@ async function runHeadless(argv, agent) {
     if (useAgenticLoop) {
       ({ exitCode } = await runHeadlessAgenticLoop(agent, session, input, log, { timeoutMs, maxTurns }));
     } else {
+      // Snapshot existing runs so the wait scopes strictly to the run this turn
+      // creates and never observes a pre-existing / zombie run.
+      let priorRunIds = [];
+      if (session.runtime?.url && wait) {
+        try {
+          const { fetchRuntimeState } = await import('../runtime/client.js');
+          const before = await fetchRuntimeState({ url: session.runtime.url, workspace: session.workspace ?? null });
+          priorRunIds = (Array.isArray(before?.runs) ? before.runs : []).map((run) => run?.id).filter(Boolean);
+        } catch { priorRunIds = []; }
+      }
       const response = await runAgentTurn(agent, session, input);
       log.push('response:');
       log.push(response);
       console.log(response);
-      ({ exitCode } = await runHeadlessActivityLoop(session, log, { wait, timeoutMs }));
+      // When connected to the runtime, an action turn delegates a run that
+      // executes server-side — its progress lives in runtime state, not in the
+      // local session. Poll it so the headless log shows the real outcome.
+      ({ exitCode } = session.runtime?.url && wait
+        ? await waitForRuntimeRun(session, log, { timeoutMs, autoApprove: argv.includes('--auto-approve'), priorRunIds })
+        : await runHeadlessActivityLoop(session, log, { wait, timeoutMs }));
     }
     const saved = await writeHeadlessLog(session, log, logFile);
     console.log(`Headless log: ${saved}`);
@@ -590,6 +746,55 @@ async function runRuntime(argv, agent) {
     };
   }
 
+  async function prepareDelegation(context, { objective }) {
+    const { resolveObjective } = await import('../orchestrator/objectiveResolver.js');
+    const { validateFragment } = await import('../orchestrator/planValidator.js');
+    const session = context.session;
+    const selection = await resolveObjective(objective, session);
+    const provider = selection.provider;
+    const fragment = parseJsonText(formatMcpToolResult(await callMcpTool(
+      session.mcp,
+      provider.serverName,
+      'agent_plan',
+      {
+        capability: selection.capability,
+        operation: selection.operation,
+        objective,
+        workspace: { revision: String(Date.now()) },
+        constraints: {
+          maxConcurrency: resolveCapabilityConcurrency(
+            provider,
+            undefined,
+            process.env.WIKI_MANAGER_CAPABILITY_CONCURRENCY,
+          ),
+          requireApprovalForMutations: true,
+        },
+      },
+    )));
+    if (!Array.isArray(fragment?.tasks) || fragment.tasks.length === 0) {
+      throw new Error(fragment?.summary?.initialSynthesis?.[0] ?? `No task was planned for ${selection.capability}/${selection.operation}.`);
+    }
+    const validation = validateFragment(fragment, {
+      registry: capabilityRegistryForSession(session),
+      run: { plannerAgentInstanceId: provider.agentInstanceId ?? provider.serverName },
+    });
+    if (!validation.ok) {
+      throw new Error(`Delegated plan rejected: ${validation.errors.map((error) => error.message ?? error.code ?? String(error)).join('; ')}`);
+    }
+    return {
+      capability: selection.capability,
+      operation: selection.operation,
+      provider: { serverName: provider.serverName, agentInstanceId: provider.agentInstanceId ?? provider.serverName },
+      fragment: validation.normalizedFragment,
+      summary: {
+        capability: selection.capability,
+        operation: selection.operation,
+        agent: provider.agentInstanceId ?? provider.serverName,
+        tasks: validation.normalizedFragment.tasks.length,
+      },
+    };
+  }
+
   async function executeRun(context, body, { signal } = {}) {
     const session = context.session;
     const supervisor = context.supervisor;
@@ -628,6 +833,87 @@ async function runRuntime(argv, agent) {
         : undefined;
       supervisor?.setRunSignal(signal);
       session._onStep = (message) => emitRuntimeLog(session, message);
+      if (body.preparedDelegation?.fragment) {
+        const { integrate } = await import('../orchestrator/planIntegrator.js');
+        const prepared = body.preparedDelegation;
+        const integrated = integrate(runId, prepared.fragment, {
+          registry: capabilityRegistryForSession(session),
+          session,
+          store,
+          workspace: session.workspace ?? null,
+          enforceApprovalCoverage: true,
+        });
+        if (!integrated.ok) {
+          throw new Error(`Delegated plan integration failed: ${(integrated.errors ?? []).map((error) => error.message ?? error.code ?? String(error)).join('; ')}`);
+        }
+        emitRuntimeLog(session, `delegation: ${prepared.fragment.tasks.length} validated task(s) integrated from ${prepared.provider.serverName}.agent_plan (${prepared.capability}/${prepared.operation})`);
+        body._planReady?.resolve?.({ runId, planRevision: session.agentProjection?.planRevision ?? 0 });
+      }
+      // Deterministic capability run (/ingest): ask the capable agent for its
+      // task-graph fragment and integrate it as the plan BEFORE any LLM turn.
+      // The parallel path must not depend on a small model deciding to call
+      // agent_plan by itself.
+      if (body.capabilityPlan?.capability) {
+        const { validateFragment } = await import('../orchestrator/planValidator.js');
+        const { integrate } = await import('../orchestrator/planIntegrator.js');
+        const registry = capabilityRegistryForSession(session);
+        const agents = session.agentRegistry?.snapshot?.() ?? session.agentRegistrySnapshot ?? [];
+        const provider = agents.find((item) => (item.description?.capabilities ?? [])
+          .some((capability) => capability.id === body.capabilityPlan.capability));
+        if (!provider?.serverName) {
+          throw new Error(`No agent provides capability ${body.capabilityPlan.capability}.`);
+        }
+        const fragment = parseJsonText(formatMcpToolResult(await callMcpTool(session.mcp, provider.serverName, 'agent_plan', {
+          capability: body.capabilityPlan.capability,
+          operation: body.capabilityPlan.operation ?? undefined,
+          workspace: { revision: String(Date.now()) },
+          constraints: {
+            // The agent declares its capacity. Request/env values are only
+            // constraints: they may lower that capacity, never raise it.
+            maxConcurrency: resolveCapabilityConcurrency(
+              provider,
+              body.capabilityPlan.maxConcurrency,
+              process.env.WIKI_MANAGER_CAPABILITY_CONCURRENCY,
+            ),
+            requireApprovalForMutations: body.capabilityPlan.requireApproval !== false,
+          },
+          ...(Array.isArray(body.capabilityPlan.inputs) && body.capabilityPlan.inputs.length > 0
+            ? { arguments: { inputs: body.capabilityPlan.inputs } }
+            : {}),
+        })));
+        if (!Array.isArray(fragment?.tasks) || fragment.tasks.length === 0) {
+          dispatchAgentEvent(session, createAgentEvent('assistant_message', {
+            origin: 'runtime',
+            runId,
+            payload: { content: `Aucune tâche à planifier pour ${body.capabilityPlan.capability} (${fragment?.summary?.initialSynthesis?.[0] ?? 'fragment vide'}).` },
+          }));
+          dispatchAgentEvent(session, createAgentEvent('run_done', { origin: 'runtime', runId, payload: { runId } }));
+          return;
+        }
+        // Full official integration path — NOT a bare plan_set: integrate()
+        // validates the fragment, persists the tasks, and CREATES the
+        // approval requests the scheduler's approvalCovered() filter waits
+        // for. A bare plan_set left requiresApproval tasks unreachable
+        // forever (stalled as no_ready_plan_task with nothing to approve).
+        const validation = validateFragment(fragment, {
+          registry,
+          run: { plannerAgentInstanceId: provider.agentInstanceId ?? provider.serverName },
+        });
+        if (!validation.ok) {
+          throw new Error(`Capability plan rejected: ${validation.errors.map((error) => error.message ?? error.code ?? String(error)).join('; ')}`);
+        }
+        const integrated = integrate(runId, validation.normalizedFragment, {
+          registry,
+          session,
+          store,
+          workspace: session.workspace ?? null,
+          enforceApprovalCoverage: true,
+        });
+        if (!integrated.ok) {
+          throw new Error(`Capability plan integration failed: ${(integrated.errors ?? []).map((error) => error.message ?? error.code ?? String(error)).join('; ')}`);
+        }
+        emitRuntimeLog(session, `capability-plan: ${fragment.tasks.length} task(s) integrated from ${provider.serverName}.agent_plan (${body.capabilityPlan.capability}); approvals: ${(session.agentProjection?.approvals ?? []).filter((approval) => approval.status === 'pending_approval').length} pending`);
+      }
       await runRuntimeAgenticWorkflow(agent, session, input, {
         signal,
         timeoutMs,
@@ -638,6 +924,7 @@ async function runRuntime(argv, agent) {
         ...(maxReplans === undefined ? {} : { maxReplans }),
       });
     } catch (err) {
+      body._planReady?.reject?.(err);
       if (err?.name === 'AbortError') {
         // Cancel the asynchronous agent jobs the run started: aborting only
         // the manager loop left ingest subprocesses running for minutes with
@@ -681,12 +968,10 @@ async function runRuntime(argv, agent) {
       .filter((context) => context?.running)
       .map((context) => ({ workspace: context.workspace ?? null, runId: context.currentRunId ?? null })),
     run: executeRun,
+    delegate: prepareDelegation,
     cancel: (context) => emitRuntimeLog(context.session, 'runtime: cancel requested'),
     resume: ({ workspace }) => recoverRuntime({ workspace, manual: true }),
-    approve: async ({ workspace, runId, itemId, approvalId }) => {
-      const context = await getWorkspaceContext(workspace);
-      return context.approvalManager?.approve({ runId, itemId, approvalId }) ?? { approved: false };
-    },
+    approve: (request) => forwardRuntimeApproval(getWorkspaceContext, request),
     configProfiles: async (context) => {
       const profiles = listWikircProfiles(context.session.workspacePath);
       return {
@@ -811,11 +1096,11 @@ export async function runCli(argv) {
       runtime = unavailableRuntime(err);
       console.error(`Runtime unavailable: ${runtime.error}`);
     }
+    // The owned-runtime shutdown happens inside the TUI's own exit paths
+    // (see tui.tsx onShellExit): render() resolves at MOUNT, so anything
+    // after this await would run while the shell is still on screen —
+    // 0.12.9 shipped exactly that bug and killed the runtime under the user.
     await runOpenTuiShell({ agent, packageJson, runtime });
-    if (runtime?.url) {
-      const { shutdownOwnedRuntime } = await import('../runtime/lifecycle.js');
-      await shutdownOwnedRuntime(runtime, { log: (message) => console.log(`[wiki-manager] ${message}`) });
-    }
     return;
   }
 

package/src/cli/wiki-manager.test.js

@@ -0,0 +1,28 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { forwardRuntimeApproval } from './wiki-manager.js';
+
+test('runtime approval bridge preserves the complete run-scoped grant', async () => {
+  let forwarded = null;
+  const request = {
+    workspace: 'test4',
+    workspaceId: 'test4',
+    runId: 'run-1',
+    scope: 'run',
+    planRevision: 3,
+    approvalClasses: ['mutation'],
+  };
+
+  const result = await forwardRuntimeApproval(async (workspace) => ({
+    approvalManager: {
+      approve(value) {
+        assert.equal(workspace, 'test4');
+        forwarded = value;
+        return { approved: true };
+      },
+    },
+  }), request);
+
+  assert.deepEqual(forwarded, request);
+  assert.deepEqual(result, { approved: true });
+});

package/src/commands/slash.js

@@ -43,7 +43,7 @@ import {
   listDocumentUploads,
   storeAndMaybeConvertDocument,
 } from '../core/documentIntake.js';
-import { fetchRuntimeState, postRuntimeCancel, postRuntimeKill } from '../runtime/client.js';
+import { fetchRuntimeState, postRuntimeCancel, postRuntimeControl, postRuntimeKill, postRuntimeRun } from '../runtime/client.js';
 import { versionWithBuild } from '../core/buildInfo.js';
 
 export function printVersion(packageJson) {
@@ -629,6 +629,8 @@ ${helpPair('/wiki', 'Run wiki index', '/wiki run <args>', 'Raw wiki CLI')}
 ${helpPair('/chat', 'Chat mode', '/agent', 'Agent mode')}
 ${helpPair('/openui', 'Open web UI in browser', '', '')}
 ${helpPair('/run status', 'Runtime status', '/run kill', 'Kill runtime run(s)')}
+${helpPair('/run capability <id>', 'Deterministic capability run', '/approve', 'Grant pending approval')}
+${helpPair('/cancel', 'Cancel active run', '', '')}
 ${helpPair('/run cancel', 'Cancel active run', '', '')}
 ${helpPair('/queue', 'MCP job queue', '/queue clear', 'Clear finished')}
 ${helpPair('/queue cancel <id>', 'Cancel queued/running', '', '')}
@@ -674,6 +676,20 @@ function rawCommandResult(command, output) {
   };
 }
 
+export function localizedOperationResult({ operation, target, status = 'succeeded' }) {
+  const facts = JSON.stringify({ operation, target, status });
+  return {
+    output: facts,
+    rawOutput: true,
+    agentTrigger: [
+      'Formule le résultat structuré suivant dans la langue et le ton demandés par le profil du workspace.',
+      'Réponds par une seule phrase humaine et naturelle.',
+      'Ne mentionne aucune commande, syntaxe shell, étape suivante ou détail technique.',
+      `Résultat: ${facts}`,
+    ].join('\n'),
+  };
+}
+
 function formatRuntimeRunStatus(state) {
   const status = state?.status ?? 'unknown';
   const runId = state?.runId ? ` run=${state.runId}` : '';
@@ -709,13 +725,14 @@ export async function handleSlashCommand(line, context) {
   const args = line.slice(1).trim().split(/\s+/).filter(Boolean);
   const [command] = args;
   const step = context.onStep ?? (() => {});
-  const runAgentCommand = async (fn, verb, commandLabel) => {
+  const runAgentCommand = async (fn, verb) => {
     try {
       step(`Agents: ${verb}ing external agents…`);
-      const output = await fn();
-      return output
-        ? rawCommandResult(commandLabel, output)
-        : { output: `Agents ${verb}ed.` };
+      await fn();
+      return localizedOperationResult({
+        operation: verb,
+        target: 'agents',
+      });
     } catch (err) {
       step(formatActivityError('agents', verb, err));
       return { output: err instanceof Error ? err.message : String(err) };
@@ -874,13 +891,16 @@ export async function handleSlashCommand(line, context) {
       // do not remap it to undefined, that bypasses any custom "all" target list and always
       // falls back to the hardcoded COMPOSE_SERVICES constant instead.
       const service = args[1];
-      if (service === 'agents') return runAgentCommand(startAgents, 'start', '/start agents');
+      if (service === 'agents') return runAgentCommand(startAgents, 'start');
       try {
         step(`Services: starting ${service ?? 'workspace services'}…`);
-        const output = await startService(context.session, service);
+        await startService(context.session, service);
         step('Services: refreshing MCP runtime…');
         await refreshMcpRuntimeStatus(context.session);
-        return rawCommandResult(`/start${service ? ` ${service}` : ''}`, output);
+        return localizedOperationResult({
+          operation: 'start',
+          target: service || 'workspace-services',
+        });
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         step(formatActivityError('services', 'stop', err));
@@ -889,13 +909,16 @@ export async function handleSlashCommand(line, context) {
     }
     case 'stop': {
       const service = args[1];
-      if (service === 'agents') return runAgentCommand(stopAgents, 'stop', '/stop agents');
+      if (service === 'agents') return runAgentCommand(stopAgents, 'stop');
       try {
         step(`Services: stopping ${service ?? 'workspace services'}…`);
-        const output = await stopService(context.session, service);
+        await stopService(context.session, service);
         step('Services: refreshing MCP runtime…');
         await refreshMcpRuntimeStatus(context.session);
-        return rawCommandResult(`/stop${service ? ` ${service}` : ''}`, output);
+        return localizedOperationResult({
+          operation: 'stop',
+          target: service || 'workspace-services',
+        });
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         step(formatActivityError('services', 'logs', err));
@@ -966,6 +989,27 @@ export async function handleSlashCommand(line, context) {
       }
       return { output: 'Usage: /mcp <status|endpoints|tools|call> [mcp]' };
     }
+    case 'cancel': {
+      // Alias of /run cancel — people type /cancel when they want out.
+      const runtime = context.runtime ?? {};
+      if (!runtime.url) return { output: 'Runtime unavailable. Start/connect the runtime before using /cancel.' };
+      const result = await postRuntimeCancel({ url: runtime.url, workspace: context.session.workspace ?? null });
+      return { output: result.cancelled ? 'Runtime cancel requested.' : `Nothing to cancel${result.reason ? ` (${result.reason})` : ''} — use /run kill to purge everything.` };
+    }
+    case 'approve': {
+      // /approve was only wired in the legacy REPL — in the opentui TUI it
+      // returned "Unknown command", which made every approval time out and
+      // every requiresApproval plan stall forever.
+      const runtime = context.runtime ?? {};
+      if (!runtime.url) return { output: 'Runtime unavailable. Start/connect the runtime before using /approve.' };
+      const result = await postRuntimeControl('message', {
+        url: runtime.url,
+        workspace: context.session.workspace ?? null,
+        input: args.slice(1).join(' ') || 'approve',
+        intent: 'approve',
+      });
+      return { output: String(result?.explanation ?? (result?.accepted ? 'Approval granted.' : 'No pending approval found.')) };
+    }
     case 'run': {
       const subcommand = args[1] ?? 'status';
       const runtime = context.runtime ?? {};
@@ -979,11 +1023,34 @@ export async function handleSlashCommand(line, context) {
         const result = await postRuntimeCancel({ url, workspace: context.session.workspace ?? null });
         return { output: result.cancelled ? 'Runtime cancel requested.' : `Runtime cancel skipped: ${result.reason ?? 'no active run'}` };
       }
+      if (subcommand === 'capability') {
+        // Business-agnostic deterministic run: mirrors the capability
+        // registry instead of hardcoding an application verb. The agent's
+        // task graph is validated/integrated server-side before any LLM turn.
+        const capability = args[2];
+        if (!capability) return { output: 'Usage: /run capability <capability-id> [operation] [files…]' };
+        if (!context.session.workspace) return { output: 'No workspace loaded. Use /use <workspace> first.' };
+        const operation = args[3] && !args[3].includes('.') && !args[3].includes('/') ? args[3] : undefined;
+        const inputs = args.slice(operation ? 4 : 3);
+        const result = await postRuntimeRun(`Run de capability ${capability}${operation ? ` (${operation})` : ''} demandé via /run capability.`, {
+          url,
+          workspace: context.session.workspace,
+          capabilityPlan: {
+            capability,
+            ...(operation ? { operation } : {}),
+            ...(inputs.length > 0 ? { inputs } : {}),
+          },
+        });
+        if (result?.runId) {
+          return { output: `▶ Run de capability accepté (${String(result.runId).slice(0, 8)}) — le plan de l'agent sera intégré et dispatché en parallèle ; approbation demandée avant les mutations (« valide tout » ou /approve).` };
+        }
+        return { output: `Run non démarré: ${result?.explanation ?? result?.error ?? JSON.stringify(result)}` };
+      }
       if (subcommand === 'kill') {
         const result = await postRuntimeKill({ url, workspace: context.session.workspace ?? null, runId: args[2] ?? null });
         return { output: `Runtime kill requested: ${result.runs ?? 0} run${result.runs === 1 ? '' : 's'}, ${result.tasks ?? 0} task${result.tasks === 1 ? '' : 's'} cancelled.` };
       }
-      return { output: 'Usage: /run [status|cancel|kill [runId]]' };
+      return { output: 'Usage: /run [status|cancel|kill [runId]|capability <id> [operation] [files…]]' };
     }
     case 'queue': {
       const subcommand = args[1] ?? 'list';

package/src/commands/slash.test.js

@@ -4,9 +4,17 @@ import { mkdtemp } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import test from 'node:test';
-import { handleSlashCommand } from './slash.js';
+import { handleSlashCommand, localizedOperationResult } from './slash.js';
 import { completionContext } from '../shell/repl.js';
 
+test('deterministic operation results ask Donna to localize compact facts without leaking commands', () => {
+  const result = localizedOperationResult({ operation: 'start', target: 'agents' });
+  assert.equal(result.rawOutput, true);
+  assert.deepEqual(JSON.parse(result.output), { operation: 'start', target: 'agents', status: 'succeeded' });
+  assert.match(result.agentTrigger, /une seule phrase humaine et naturelle/);
+  assert.doesNotMatch(result.agentTrigger, /\/start|Docker|compose/);
+});
+
 test('/workspace delete removes files and clears current session context after confirmation', async () => {
   const root = await mkdtemp(join(tmpdir(), 'wiki-manager-delete-workspace-'));
   const registryRoot = join(root, 'registry');

package/src/contracts/schemas.js

@@ -131,6 +131,38 @@ const agentDescriptionSchema = {
   },
 };
 
+const pendingInputSchema = {
+  $id: 'https://dotdrelle.dev/wiki-manager/contracts/pending-input/v1',
+  title: 'PendingInput',
+  schemaVersion: '1',
+  type: 'object',
+  required: ['type', 'ref'],
+  additionalProperties: true,
+  properties: {
+    type: { type: 'string', minLength: 1 },
+    ref: { type: 'string', minLength: 1 },
+    label: nullableString,
+    mediaType: nullableString,
+  },
+};
+
+const capabilityStatusSchema = {
+  $id: 'https://dotdrelle.dev/wiki-manager/contracts/capability-status/v1',
+  title: 'CapabilityStatus',
+  schemaVersion: '1',
+  type: 'object',
+  required: ['contractVersion', 'agentInstanceId', 'capability', 'operation', 'available', 'pendingInputs'],
+  additionalProperties: true,
+  properties: {
+    contractVersion: { type: 'string', minLength: 1 },
+    agentInstanceId: { type: 'string', minLength: 1 },
+    capability: { type: 'string', minLength: 1 },
+    operation: { type: 'string', minLength: 1 },
+    available: { type: 'boolean' },
+    pendingInputs: { type: 'array', items: pendingInputSchema },
+  },
+};
+
 const taskGroupSchema = {
   $id: 'https://dotdrelle.dev/wiki-manager/contracts/task-group/v1',
   title: 'TaskGroup',
@@ -424,6 +456,7 @@ export const contractSchemas = {
   outputReference: outputReferenceSchema,
   capabilityDescription: capabilityDescriptionSchema,
   agentDescription: agentDescriptionSchema,
+  capabilityStatus: capabilityStatusSchema,
   retryPolicy: retryPolicySchema,
   taskGroup: taskGroupSchema,
   plannedTask: plannedTaskSchema,

package/src/contracts/schemas.test.js

@@ -236,3 +236,17 @@ test('agent description contract validates orchestrable agent capabilities', ()
   assert.equal(validateContract('capabilityDescription', description.capabilities[0]).ok, true);
   assert.equal(validateContract('agentDescription', { ...description, health: { status: 'offline' } }).ok, false);
 });
+
+test('capability status contract carries dynamic pending inputs without prescribing storage paths', () => {
+  const status = {
+    contractVersion: '1',
+    agentInstanceId: 'production-main',
+    capability: 'knowledge.update',
+    operation: 'ingest',
+    available: true,
+    pendingInputs: [{ type: 'file', ref: 'provider-owned/source-a', label: 'source-a.md', mediaType: 'text/markdown' }],
+  };
+
+  assert.equal(validateContract('capabilityStatus', status).ok, true);
+  assert.equal(validateContract('capabilityStatus', { ...status, pendingInputs: [{ type: 'file' }] }).ok, false);
+});

package/src/core/agentEvents.js

@@ -490,6 +490,12 @@ function applyEvent(state, event) {
     case 'run_error':
       state.status = 'error';
       state.logs.push(String(event.payload?.message ?? 'Agent run failed.'));
+      // A dead run must not leave "pending" plan steps and spinning
+      // activities in the persisted projection: they reappeared as ghosts
+      // at every relaunch ("des trucs dans le plan qui n'existent pas") and
+      // /kill honestly reported 0 because nothing was actually running.
+      cancelPendingPlanSteps(state.plan);
+      cancelActiveActivities(state.activities, event.ts);
       finishControlByRun(state.controlQueue, event.runId ?? event.payload?.runId ?? null, 'failed', event.ts);
       return;
     case 'control_enqueued':