@dotdrelle/wiki-manager 0.12.12 → 0.14.1

package/src/agent/graph.js

@@ -14,8 +14,8 @@ import { extractActivity, formatActivitySummary, parseJsonText, sessionActivitie
 import { createAgentEvent, dispatchAgentEvent } from '../core/agentEvents.js';
 import { enqueueProductionJob, ensureJobQueue, formatQueue, productionLockBusy } from '../core/jobQueue.js';
 import { updateWorkspaceProfilePreference } from '../core/profile.js';
-import { createCapabilityRegistry } from '../orchestrator/capabilityRegistry.js';
-import { fetchRuntimeState, postRuntimeCancel, postRuntimeControl, postRuntimeKill } from '../runtime/client.js';
+import { capabilityRegistryForSession } from '../orchestrator/capabilityRegistry.js';
+import { fetchRuntimeState, postRuntimeApprove, postRuntimeCancel, postRuntimeControl, postRuntimeDelegate, postRuntimeKill } from '../runtime/client.js';
 
 const MAX_TOOL_ITERATIONS = 80;
 const MAX_SPINNER_ARG_LENGTH = 96;
@@ -27,7 +27,7 @@ const MAX_PROFILE_CHARS = 4000;
 const INTERNAL_TOOL_SERVERS = {
   wiki: ['plan_set', 'plan_done'],
   shell: ['run_command', 'read_command', 'profile_update'],
-  runtime: ['kill', 'cancel', 'status', 'approve', 'enqueue', 'start_capability_run'],
+  runtime: ['kill', 'cancel', 'status', 'approve', 'enqueue', 'delegate'],
 };
 
 const AGENT_SLASH_COMMANDS = new Set([
@@ -40,8 +40,8 @@ const AGENT_SLASH_COMMANDS = new Set([
   'services',
   'skills',
   'upload',
-  'uploads',
   'queue',
+  'openui',
 ]);
 
 const SHELL_RUN_COMMAND_TOOL = {
@@ -50,7 +50,7 @@ const SHELL_RUN_COMMAND_TOOL = {
     name: 'shell__run_command',
     description: [
       'Run a deterministic wiki-manager slash command inside the current shell session.',
-      'Allowed commands: /workspace list, /workspace init <name> [path], /use <workspace>, /config, /status, /services, /skills, /skills show <name>, /skills run <name>, /upload <path>, /upload convert <id|pending>, /uploads.',
+      'Allowed commands: /workspace list, /workspace init <name> [path], /use <workspace>, /config, /status, /services, /skills, /skills show <name>, /skills run <name>, /upload <path>, /upload convert <id|pending>.',
       'Do not use for arbitrary system shell commands, /workspace delete, /mcp call, /wiki run, /start, /stop, /logs, or /exit.',
     ].join(' '),
     parameters: {
@@ -73,7 +73,7 @@ const SHELL_READ_COMMAND_TOOL = {
     name: 'shell__read_command',
     description: [
       'Run a read-only deterministic wiki-manager slash command inside the current shell session.',
-      'Allowed commands: /help, /version, /config, /config list, /config status, /status, /services, /skills, /skills list, /skills show <name>, /uploads, /uploads list, /queue.',
+      'Allowed commands: /help, /version, /config, /config list, /config status, /status, /services, /skills, /skills list, /skills show <name>, /queue.',
       'Do not use for workspace creation/deletion, uploads conversion, service start/stop, MCP calls, wiki runs, or any mutation.',
     ].join(' '),
     parameters: {
@@ -165,20 +165,18 @@ const RUNTIME_ENQUEUE_TOOL = {
   },
 };
 
-const RUNTIME_CAPABILITY_RUN_TOOL = {
+const RUNTIME_DELEGATE_TOOL = {
   type: 'function',
   function: {
-    name: 'runtime__start_capability_run',
-    description: 'Start a DETERMINISTIC orchestrated run for a discovered capability: the runtime asks the capable agent for its task graph (agent_plan), validates and integrates it, creates the approval requests, and dispatches the tasks in parallel. Use this whenever the user asks for multi-document or multi-step work covered by a known capability (e.g. ingest everything pending → capability "knowledge.update", operation "ingest"). Do NOT call production tools directly for such requests.',
+    name: 'runtime__delegate',
+    description: 'Delegate the user objective to the runtime. Pass the objective in natural language without choosing a capability, operation, agent, plan, file list, or implementation. The runtime resolves the agent, obtains and validates the real plan before accepting the run.',
     parameters: {
       type: 'object',
       additionalProperties: false,
       properties: {
-        capability: { type: 'string', description: 'Capability id from the known list (e.g. knowledge.update).' },
-        operation: { type: 'string', description: 'Operation supported by the capability (e.g. ingest, build).' },
-        inputs: { type: 'array', items: { type: 'string' }, description: 'Optional file subset; omit to cover everything pending.' },
+        objective: { type: 'string', description: 'The complete user objective, preserving scope and constraints but containing no invented technical identifiers.' },
       },
-      required: ['capability'],
+      required: ['objective'],
     },
   },
 };
@@ -264,15 +262,124 @@ const AgentState = Annotation.Root({
   }),
   toolIterations: Annotation({ default: () => 0 }),
   pendingToolCalls: Annotation(),
+  allowedToolNames: Annotation(),
   inputClassification: Annotation(),
   readyToStream: Annotation(),
   streamContext: Annotation(),
   streamedInline: Annotation(),
   retryWithoutTool: Annotation({ default: () => false }),
+  invalidResponseRetries: Annotation({ default: () => 0 }),
+  invalidToolCallRetries: Annotation({ default: () => 0 }),
+  forceDelegation: Annotation({ default: () => false }),
 });
 
+function invalidToolCalls(toolCalls) {
+  if (!Array.isArray(toolCalls)) return [];
+  return toolCalls.filter((call) => {
+    if (!call?.id || !call?.function?.name) return true;
+    try {
+      const args = JSON.parse(call.function.arguments || '{}');
+      return !args || typeof args !== 'object' || Array.isArray(args);
+    } catch {
+      return true;
+    }
+  });
+}
+
+export function normalizeToolArgumentsFromSchema(args, parameters) {
+  if (!args || typeof args !== 'object' || Array.isArray(args)) return args;
+  const schema = parameters && typeof parameters === 'object' ? parameters : {};
+  const properties = schema.properties && typeof schema.properties === 'object' ? schema.properties : {};
+  const required = Array.isArray(schema.required) ? schema.required.filter((key) => typeof key === 'string') : [];
+  const missing = required.filter((key) => args[key] === undefined);
+  const unknown = Object.keys(args).filter((key) => properties[key] === undefined);
+  if (missing.length !== 1 || unknown.length !== 1) return args;
+  const target = missing[0];
+  const source = unknown[0];
+  if (!schemaValueMatches(args[source], properties[target])) return args;
+  const normalized = { ...args, [target]: args[source] };
+  delete normalized[source];
+  return normalized;
+}
+
+function schemaValueMatches(value, propertySchema) {
+  const types = Array.isArray(propertySchema?.type) ? propertySchema.type : [propertySchema?.type];
+  if (types.includes(undefined) || types.includes(null)) return true;
+  return types.some((type) => {
+    if (type === 'array') return Array.isArray(value);
+    if (type === 'object') return value !== null && typeof value === 'object' && !Array.isArray(value);
+    if (type === 'integer') return Number.isInteger(value);
+    if (type === 'number') return typeof value === 'number' && Number.isFinite(value);
+    if (type === 'null') return value === null;
+    return typeof value === type;
+  });
+}
+
+function toolDefinitionForCall(session, callName) {
+  const internal = [
+    SHELL_RUN_COMMAND_TOOL,
+    SHELL_READ_COMMAND_TOOL,
+    SHELL_PROFILE_UPDATE_TOOL,
+    RUNTIME_STATUS_TOOL,
+    RUNTIME_CANCEL_TOOL,
+    RUNTIME_KILL_TOOL,
+    RUNTIME_APPROVE_TOOL,
+    RUNTIME_ENQUEUE_TOOL,
+    RUNTIME_DELEGATE_TOOL,
+    WIKI_PLAN_SET_TOOL,
+    WIKI_PLAN_DONE_TOOL,
+  ];
+  return [...internal, ...buildLlmTools(session?.mcp)]
+    .find((item) => item?.function?.name === callName) ?? null;
+}
+
 function commandList(session) {
-  return session.commands.map((command) => `/${command}`).join(', ');
+  return session.commands
+    .filter((command) => AGENT_SLASH_COMMANDS.has(command))
+    .map((command) => `/${command}`)
+    .join(', ');
+}
+
+export function invalidSuggestedSlashCommands(content, session) {
+  const allowed = new Set((session?.commands ?? []).filter((command) => AGENT_SLASH_COMMANDS.has(command)));
+  const candidates = new Set();
+  for (const line of String(content ?? '').split(/\r?\n/)) {
+    const trimmed = line.trim();
+    const standalone = trimmed.match(/^\/([a-z][\w-]*)\b/i);
+    if (standalone) candidates.add(standalone[1].toLowerCase());
+    for (const match of line.matchAll(/`\/([a-z][\w-]*)\b/gi)) candidates.add(match[1].toLowerCase());
+  }
+  return [...candidates].filter((command) => !allowed.has(command)).sort();
+}
+
+export function invalidUserFacingToolNames(content, session) {
+  const text = String(content ?? '');
+  const connected = buildLlmTools(session?.mcp)
+    .map((item) => item?.function?.name)
+    .filter(Boolean)
+    .filter((name) => text.includes(name));
+  const syntactic = [...text.matchAll(/\b[a-z][a-z0-9_-]*__[a-z][a-z0-9_-]*\b/gi)].map((match) => match[0]);
+  return [...new Set([...connected, ...syntactic])].sort();
+}
+
+async function classifyRequestedAction(llm, input, signal) {
+  try {
+    const result = await llm.completeWithTools({
+      system: [
+        'Classify whether the user explicitly requests a real state-changing action now.',
+        'Actions include starting, stopping, importing, ingesting, building, exporting, configuring, writing, deleting, or sending.',
+        'Questions, explanations, status questions, greetings, and hypothetical discussions are not actions.',
+        'Return JSON only: {"action":true} or {"action":false}.',
+      ].join('\n'),
+      tools: [],
+      messages: [{ role: 'user', content: String(input ?? '') }],
+      signal,
+    });
+    const text = String(result?.content ?? '').trim().replace(/^```(?:json)?\s*/i, '').replace(/\s*```$/, '');
+    return JSON.parse(text)?.action === true;
+  } catch {
+    return false;
+  }
 }
 
 function summarizeToolArguments(rawArguments) {
@@ -384,8 +491,7 @@ function assertAgentReadSlashCommandAllowed(commandLine) {
     command === 'services' ||
     command === 'queue' ||
     (command === 'config' && ['', 'list', 'status'].includes(subcommand)) ||
-    (command === 'skills' && ['', 'list', 'show'].includes(subcommand)) ||
-    (command === 'uploads' && ['', 'list'].includes(subcommand));
+    (command === 'skills' && ['', 'list', 'show'].includes(subcommand));
   if (!allowed) {
     throw new Error(`Read-only command is not available to the agent: /${parts.join(' ')}`);
   }
@@ -530,9 +636,7 @@ function emitAgentEvent(session, type, origin, payload = {}) {
 // agents. This is the live registry the dispatcher will resolve against —
 // a plan declaring anything outside this set can only stall forever.
 export function knownCapabilityIds(session) {
-  const registry = session?.capabilityRegistry ?? createCapabilityRegistry({
-    agents: session?.agentRegistrySnapshot ?? session?.agents ?? [],
-  });
+  const registry = capabilityRegistryForSession(session);
   const snapshot = typeof registry.snapshot === 'function' ? registry.snapshot() : registry;
   return [...new Set(Object.keys(snapshot ?? {}).map((key) => {
     const index = key.lastIndexOf('@');
@@ -581,25 +685,34 @@ async function handleRuntimeControlTool(session, tool, args = {}) {
       return result.cancelled ? 'Runtime run cancellation requested.' : `No active run to cancel${result.reason ? ` (${result.reason})` : ''}.`;
     }
     if (tool === 'approve') {
-      const result = await postRuntimeControl('message', { url, workspace, input: 'approve', intent: 'approve' });
-      return String(result?.explanation ?? (result?.accepted ? 'Approval granted.' : 'No pending approval found.'));
-    }
-    if (tool === 'start_capability_run') {
-      const { postRuntimeRun } = await import('../runtime/client.js');
-      const result = await postRuntimeRun(`Run de capability ${args.capability}${args.operation ? ` (${args.operation})` : ''} demandé par Donna.`, {
+      const state = await fetchRuntimeState({ url, workspace });
+      const pending = (Array.isArray(state?.approvals) ? state.approvals : [])
+        .filter((approval) => approval.status === 'pending_approval');
+      const runId = state?.runId
+        ?? state?.runs?.find((run) => ['running', 'pending_approval'].includes(run.status))?.id
+        ?? null;
+      if (!runId || pending.length === 0) return 'No pending approval found.';
+      const approvalClasses = [...new Set(pending.flatMap((approval) => {
+        const value = approval.approvalClasses ?? approval.approvalClass ?? [];
+        return Array.isArray(value) ? value : [value];
+      }).map(String).filter(Boolean))];
+      const result = await postRuntimeApprove({
         url,
         workspace,
-        capabilityPlan: {
-          capability: String(args.capability ?? ''),
-          ...(args.operation ? { operation: String(args.operation) } : {}),
-          ...(Array.isArray(args.inputs) && args.inputs.length > 0 ? { inputs: args.inputs.map(String) } : {}),
-          // No concurrency dictated here: the runtime reads the provider's
-          // own declared capacity (agent_describe limits).
-        },
+        runId,
+        scope: 'run',
+        planRevision: state?.planRevision ?? null,
+        approvalClasses: approvalClasses.length > 0 ? approvalClasses : ['default'],
       });
+      return result?.approved ? 'Current validated plan approved.' : 'No pending approval found.';
+    }
+    if (tool === 'delegate') {
+      const objective = String(args.objective ?? '').trim();
+      if (!objective) return 'Delegation rejected: missing objective.';
+      const result = await postRuntimeDelegate(objective, { url, workspace });
       return result?.runId
-        ? `Run de capability accepté (${String(result.runId).slice(0, 8)}) : le plan sera intégré et dispatché en parallèle ; une approbation sera demandée avant les mutations (l'utilisateur peut dire « valide tout » ou taper /approve). Suis la progression dans Activity.`
-        : `Run non démarré : ${result?.explanation ?? result?.error ?? JSON.stringify(result)}`;
+        ? `Action lancée (${String(result.runId).slice(0, 8)}) après validation du plan réel : ${result.delegation?.tasks ?? 0} tâche(s), ${result.delegation?.agent ?? 'agent résolu'}. Exécution en cours.`
+        : `Délégation refusée : ${result?.error ?? JSON.stringify(result)}`;
     }
     if (tool === 'enqueue') {
       const result = await postRuntimeControl('message', { url, workspace, input: String(args.input ?? ''), intent: 'enqueue' });
@@ -728,7 +841,12 @@ export function buildAgentSystemPrompt(state) {
   const workspace = state.session.workspace ?? 'no workspace selected';
   const wikirc = state.session.wikirc?.profile ?? 'no profile loaded';
   const language = state.session.language ?? 'en-US';
-  const mcpTools = formatMcpToolsForAgent(state.session.mcp);
+  // Advertise only the read-only tools Donna may call directly. Listing
+  // mutating provider tools (e.g. production__production_start_job) here teaches
+  // a capable model to invoke them directly and bypass runtime__delegate.
+  const mcpTools = formatMcpToolsForAgent(state.session.mcp, {
+    include: (qualifiedName) => !isOrchestrationBypassTool(qualifiedName),
+  });
   const skills = formatSkillsForAgent(state.session);
   const customPrompt = state.session.systemPrompt ?? null;
   const workspaceProfile = loadWorkspaceProfile(state.session.workspacePath);
@@ -743,74 +861,40 @@ export function buildAgentSystemPrompt(state) {
     `Current wikirc profile: ${wikirc}.`,
     `Available primitives: ${commandList(state.session)}.`,
     'Only announce or call slash commands that appear exactly in Available primitives. Do not invent command names, subcommands, or arguments.',
-    'Connected MCP tools (use the server__tool naming convention for tool calls):',
+    'Connected MCP tools you may call directly (server__tool naming convention) — reads AND single-step actions like configuring or adding a connector source, converting a document, sending, or searching. Only the heavy multi-step operations (ingest, build, export, polish, pipeline) go through runtime__delegate to get their parallel plan. Everything listed below is directly callable:',
     mcpTools,
     'Current local MCP job queue:',
     formatQueue(state.session),
     'Available skills:',
     skills,
-    'You can call MCP tools directly using the provided tool functions.',
+    'In interactive agent mode you may call only the read-only tools and runtime control/delegation tools actually provided to you.',
     'When the user asks for an action that can be performed with connected MCP tools or safe primitives, do not answer with future intent such as "I will call...", "I am going to run...", or "launching..." unless you also call the tool in the same turn. Either call the tool now, ask for the exact missing required arguments, or explain the concrete blocker.',
     'Execution truthfulness: never invent a job id, status, percentage, duration, generated file, file content, URL, command, or tool result. An action is executed only when you call an available tool and receive its result. Examples and placeholders are forbidden in execution reports.',
     'After any completed action, give a short factual summary based only on the tool result: outcome and concrete outputs or references actually returned. Mention a viewing primitive only when it exists in Available primitives and is relevant. Do not interpret generated content, propose verification checklists, invent next steps, or suggest commands unless the user explicitly asks.',
+    'Never add a "Next steps", "Prochaines étapes", "À suivre", options, or suggestions section unless the user explicitly asks what to do next. End after the requested result or the concrete error.',
     'When calling a tool, emit no preliminary narration. Call it directly; the PLAN and Activity panels show progress. After completion, keep the final response concise and proportional to the result.',
-    'For connector configuration/setup/update requests, if a matching setup/configuration tool is connected and the required arguments are known, call it immediately. If the connector or tool is not connected, say which concrete capability is missing and recommend the exact service/status primitive to inspect it. Do not invent a pending connector action in plain text.',
-    'For workspace-scoped external MCP tools, the orchestrator enforces workspace injection. Use the active workspace for configuration, source, import, export, conversion, and generation tools unless a tool is explicitly job-scoped and only requires a job id.',
-    'Dynamic capability inputs are owned by the agent that provides the capability. To answer which inputs are pending or available, call the qualified `<provider>__agent_status` tool with {capability, operation} and report only its pendingInputs. Never infer this state from /uploads or a hardcoded workspace directory. If no capable agent/status tool is connected, say that the pending inputs cannot be determined.',
-    'You can call shell__run_command for safe manager slash commands such as /workspace list, /workspace init <name> [path], /use <workspace>, /config, /status, /services, /skills, /skills show <name>, and /skills run <name>.',
-    'Skills are workflow instructions, not executable code. When a user asks to run a skill, inspect it, propose the concrete primitive/tool plan, and ask for confirmation before costly or mutating actions.',
-    [
-      state.session.headless ? 'HEADLESS MODE ACTIVE. Execute the requested skill or task autonomously using available safe primitives and MCP tools. Do not ask for interactive confirmation unless the request is genuinely ambiguous or outside the loaded workspace.' : null,
-      '',
-      'You have two internal planning tools: wiki__plan_set and wiki__plan_done.',
-      'Prefer MCP tools that declare their own plan via _activity.plan.steps — when such a tool returns _activity, the shell creates and tracks the plan automatically without requiring wiki__plan_set.',
-      'Use wiki__plan_set when the MCP tool cannot declare its own plan or when the task spans multiple independent tools (e.g. CME export then email report). For a single self-describing async job, wiki__plan_set is optional.',
-      '',
-      (() => {
-        const capabilityIds = knownCapabilityIds(state.session);
-        return capabilityIds.length > 0
-          ? `Known orchestration capabilities — the ONLY values allowed in requiredCapability: ${capabilityIds.join(', ')}. Never invent capability names; a plan declaring an unknown capability will be rejected. A step you execute yourself directly takes requiredCapability: null.`
-          : 'No orchestration capabilities discovered yet: declare plan steps with requiredCapability: null and execute them yourself with the connected MCP tools.';
-      })(),
-      '',
-      'Task startup:',
-      '  1. If the next MCP tool returns _activity.plan.steps, call that tool directly; the shell will create the visible plan from the returned activity.',
-      '  2. If the tool cannot declare its own plan, call wiki__plan_set before executing the first step. Prefer structured steps: {id, description, requiredCapability, operation, arguments, dependsOn, outputRefs}; capability steps need operation+arguments for the dispatcher to execute them; a legacy list of strings is still accepted.',
-      '     Multi-tool example: wiki__plan_set(steps=[{id:"cme-export",description:"CME export",requiredCapability:"external-source.export",dependsOn:[],outputRefs:["raw/untracked"]},{id:"production",description:"Production pipeline",requiredCapability:"knowledge.pipeline",dependsOn:["cme-export"],outputRefs:["deliverables"]}])',
-      '  3. Immediately execute the first step using the appropriate MCP tool. Do not start step 2 in the same turn unless one async pipeline tool owns and declares the whole sequence.',
-      '  For synchronous steps (result is immediate, no _activity polling), call wiki__plan_done(step=1) after confirming success.',
-      '  For async MCP jobs (returns _activity with poll), the orchestrator tracks completion automatically.',
-      '',
-      state.session.headless ? [
-        'Headless follow-up turns — the orchestrator re-invokes you with:',
-        '  (a) the original task,',
-        '  (b) the current plan status — [✓] done / [✗] failed / [ ] pending,',
-        '  (c) the just-completed activities.',
-        '  Read the plan status. Find the first [ ] pending step. Execute it only.',
-        '  Never re-execute a [✓] or [✗] step. Never skip a [ ] step.',
-        '',
-        'Final turn — when all steps are [✓] or [✗]: respond with a concise summary. Do not start new actions.',
-      ].join('\n') : null,
-      '',
-      'On failure: if a completed activity is failed/error/cancelled, call wiki__plan_done(step=N, status="failed") then stop with a clear error report.',
-    ].filter(Boolean).join('\n'),
+    'Keep every response synthetic and information-dense. Use only the lines needed, and never exceed roughly 15 to 20 short lines even for a detailed answer. Never expose internal reasoning, repeated checks, tool-selection commentary, or a chronological diary. Prioritize the result, essential facts, concrete errors, and actual outputs.',
+    'Only the heavy multi-step operations — ingest, build, export, polish, pipeline — are delegated via runtime__delegate (for their DAG and parallelism). Single-step actions — configuring or adding a connector source, converting a document, sending, searching — are called directly on the connected tool. Never call an agent orchestration-contract or plan tool directly.',
+    'For any question about the current workspace inventory or what is waiting there, call wiki__wiki_workspace_status first and answer only from its result. This is the canonical read-only workspace state; do not reconstruct it from upload, connector, or production tools.',
+    'Tool identifiers are private implementation details. Never print MCP tool names such as server__tool in a user-facing answer. Describe the human result instead.',
+    'Never suggest a manual filesystem command or implementation workaround unless the user explicitly asks for manual instructions. For an action request, delegate the objective and let the specialized agent determine paths and operations from its live contract.',
+    'Skills are documentation only in this stabilized version. Never execute a skill from conversation; delegate the user objective.',
     'For service actions, recommend only available service primitives from Available primitives, with the exact service name when the primitive supports one.',
-    'Scope discipline: execute ONLY the action(s) the user explicitly requested. Never chain additional mutating operations (ingest, build, export, polish, delete, send…) that the user did not ask for — even when diagnostics or recommendations suggest them. Finish the requested work, then list the suggested follow-ups in your final answer and stop. Example: "applique les recommandations de config" means apply the config; it does NOT authorize launching the ingest those recommendations mention.',
-    'Disambiguate export requests carefully.',
-    'Confluence/CME/source export means exporting external Confluence sources into raw/untracked: use cme MCP tools (`cme__cme_export_run`, then `cme__cme_export_status`). Never use production `type=export` for Confluence source export.',
-    'Wiki/deliverable/publication export means exporting generated deliverables from the wiki: use production MCP tools (`production__production_start_job` with `type:"export"` or pipeline steps). Require the deliverable path when exporting deliverables.',
-    'For ingest/build/export/polish/pipeline workflows, use production MCP tools. Do not route these through direct /wiki shortcuts.',
-    'MULTI-DOCUMENT ingest (more than 2 files, or "ingest everything pending") and any multi-step capability work: when runtime__start_capability_run is available, call it (e.g. {capability:"knowledge.update", operation:"ingest"}) — the runtime integrates the agent task graph deterministically and dispatches IN PARALLEL with an approval gate. Inside a runtime run (no runtime tools), call production__agent_plan instead; the shell integrates the fragment automatically. Never call production__production_start_job for multi-document ingest — that creates one monolithic sequential job.',
-    'Single-document ingest or one-off jobs (doctor, one build, one export): production__production_start_job is fine. To chain sequential steps (e.g. build then polish) use ONE call with type="pipeline" and steps=["build","polish"] — never separate jobs (the first is asynchronous). For existing deliverables where content stability matters, pass stabilize:true. Do not ask the user to confirm between steps.',
-    'Long-running MCP jobs: do not call the same status tool more than once consecutively. When chaining jobs sequentially: (1) start the job, report job/activity id and status; (2) check status once — if done, proceed to the next step immediately; (3) if still running, report status, list the remaining steps, and return control; (4) when re-invoked, check status first, then proceed. Do not spin-poll (status → status → status with no new action between). The shell activity panel monitors non-terminal jobs automatically.',
-    'If production__production_start_job is returned as queued/waiting by the manager, report that it is waiting in the local queue and return control. Do not continue as if the production job has started.',
-    'For diagnostics (doctor), use production__production_start_job with type="doctor" like any other production job; /wiki run doctor is only the fallback when the production MCP is not connected. Use /workspace init <name> [path] for low-level non-interactive workspace creation. In the interactive TUI, /new <name> opens the setup wizard. Use /wiki for index, or /wiki run index through the explicit backup hatch. Use /wiki run init only for explicit current-workspace llm-wiki init.',
+    'Scope discipline: execute ONLY the action(s) the user explicitly requested. Never chain additional mutating operations (ingest, build, export, polish, delete, send…) that the user did not ask for — even when diagnostics or recommendations suggest them. Finish with the requested result and stop. Example: "applique les recommandations de config" means apply the config; it does NOT authorize launching the ingest those recommendations mention.',
+    state.session.runtime?.url
+      ? 'The runtime is connected and runtime__delegate is bound and available to you right now — it is a tool you call directly, not a slash command or a missing primitive. It is the ONLY way to execute an action (ingest, build, export, configure, send…). Never tell the user that delegation or the runtime is unavailable while it is connected; call runtime__delegate instead.'
+      : 'No runtime is connected, so you cannot execute actions. State that plainly and name the runtime connection as the missing capability — do not invent a workaround.',
+    'If the connector or service needed for a requested read or action is absent from the Connected MCP tools above (its service is not running — e.g. CME, documents, or production), say plainly that this service is not connected and name it as the missing capability. Never redirect a simple read (e.g. "give me the CME config") to an "agent action", never invent its result, and never propose a workaround. Only requests you can actually serve with a listed tool are answered with data.',
+    'For any requested action, call runtime__delegate with the user objective only. Never choose a capability, operation, agent, plan, or implementation yourself. The runtime resolves the registry and validates the provider plan before accepting. Never call <provider>__agent_plan, <provider>__agent_execute, legacy production__production_start_job, wiki__plan_set, or wiki__plan_done from interactive chat.',
+    'Do not ask the user which sources, files, connectors, or templates to use for an ingest, build, or export: the specialized agent discovers them from the workspace. When the objective is clear (e.g. "lance une ingestion"), delegate it as stated, without a clarifying question.',
+    'If runtime__delegate returns a blocker or no specialized provider is available, report only that concrete blocker concisely. Never replace the missing execution path with a suggested slash command, skill, MCP tool name, manual file move, administrator escalation, or alternative workflow unless the user explicitly asks for alternatives.',
+    'For workspace inventory and page listings, use the connected wiki MCP read tools. Never invent or call a /wiki shell command through shell__run_command. Use /workspace init <name> [path] for low-level non-interactive workspace creation; in the interactive TUI, /new <name> opens the setup wizard.',
     'If an action requires tools or skills not available yet, explain the limitation and name the expected primitive.',
     workspaceProfile
       ? `Workspace profile (.wiki/profile.md) — durable user preferences, apply these to every reply (tone, tutoiement/vouvoiement, formatting, etc.):\n${workspaceProfile}`
       : null,
     'Runtime control: you have runtime__status, runtime__cancel, runtime__kill, runtime__approve and runtime__enqueue. When the user asks to stop, remove, clean or kill the current run, its jobs or the queue ("supprime le job et la queue", "arr\u00eate tout"), call runtime__kill (or runtime__cancel for a soft stop of just the run) and confirm what was stopped. For questions about what is running or queued, call runtime__status and answer from its data. When the user consents to a pending approval in any phrasing ("vas-y", "ok pour l\'export"), call runtime__approve. When the user asks for a NEW action while a run is active, do not execute it: propose runtime__enqueue (run it after) or, if they insist it replaces the current work, runtime__kill then the new action.',
-    'When the user explicitly asks you to remember, persist, or update durable preference/profile information, call wiki__profile_update when it is available; otherwise call shell__profile_update. Do not just acknowledge in text without calling a profile update tool.',
+    'Durable profile updates are actions in this stabilized version: delegate them instead of writing directly.',
   ].filter(Boolean).join('\n');
 
   return customPrompt ? `${customPrompt}\n\n${agentContext}` : agentContext;
@@ -840,66 +924,75 @@ export function formatLlmUnavailableMessage(reason) {
   return `⚠ LLM injoignable : ${clean || 'raison inconnue'}`;
 }
 
-// Verbs that clearly request work (a runtime run), in French and English.
-// "configure/configurer" is an action; the nouns "config/configuration" are
-// NOT matched here — asking for a config is an observe request.
-const ACTION_REQUEST_PATTERN = /\b(lance|relance|d[eé]marre|start|ex[eé]cute|execute|g[eé]n[eè]re|generate|build|construis|exporte?|ingest\w*|ing[eè]re|importe?|convert(?:is|it|s)?|cr[eé]e|create|polish|publie|publish|d[eé]ploie|deploy|envoie|send|configure[rsz]?|setup|installe|update|mets? [aà] jour|supprime|delete|efface|nettoie|clean|r[eé]pare|fix|corrige)\b/i;
-
-// Explicit explanation/question markers dominate action verbs: "explique le
-// build" is a question about the build, not a request to build.
-const EXPLANATION_REQUEST_PATTERN = /\b(explique|explain|pourquoi|why|comment|how|c'est quoi|qu'est[- ]ce)\b/i;
-
-export function classifyAgentInput(input, session) {
-  const lower = String(input ?? '').toLowerCase();
-  const hasActiveRun = session?.agentProjection?.status === 'running'
-    || sessionActivities(session).some((activity) => !activity.terminal);
-  if (/\b(valide tout|approve all|approve|approuve|valid[eé]|ok pour tout|go pour tout)\b/i.test(lower)) {
-    return { kind: 'approve', confidence: 0.86, reason: 'approval_request', activeRun: hasActiveRun };
-  }
-  if (/\b(cancel|annule|stop|arr[eê]te|interromps|abort|supprime|kill|tue|purge|vide la (file|queue)|nettoie la (file|queue))\b/i.test(lower)) {
-    return { kind: 'cancel', confidence: 0.86, reason: 'cancel_request', activeRun: hasActiveRun };
-  }
-  if (/\b(plus tard|later|ensuite|apr[eè]s ce run|enqueue|mets en file|met en file|futur|next run|future run)\b/i.test(lower)) {
-    return { kind: 'enqueue_run', confidence: 0.8, reason: 'future_run_request', activeRun: hasActiveRun };
-  }
-  if (EXPLANATION_REQUEST_PATTERN.test(lower)) {
-    return { kind: 'observe', confidence: 0.86, reason: 'explanation_request', activeRun: hasActiveRun };
-  }
-  // Observe markers only win when no action verb is present: "où en est le
-  // run" is observe, "lance le run" is an action request.
-  if (/\b(o[uù] en es[t-]|status|statut|progress|progression|run|job|queue|logs?|inspect|show|montre|affiche|donne|liste|list|quel(?:le)?s?|combien|config(?:uration)?|quoi de neuf)\b/i.test(lower)
-    && !ACTION_REQUEST_PATTERN.test(lower)) {
-    return { kind: 'observe', confidence: 0.86, reason: 'status_or_explanation_request', activeRun: hasActiveRun };
-  }
-  if (hasActiveRun && /\b(ajoute|add|change|modifie|modify|remplace|replace|retire|remove|skip|ignore|plan|step|t[aâ]che)\b/i.test(lower)) {
-    return { kind: 'modify_run', confidence: 0.78, reason: 'active_run_change_request', activeRun: hasActiveRun };
-  }
-  if (hasActiveRun && /\b(lance|run|g[eé]n[eè]re|build|export|cr[eé]e|create|send|envoie|ingest|convert|importe|import)\b/i.test(lower)) {
-    return { kind: 'ambiguous', confidence: 0.45, reason: 'active_run_action_is_ambiguous', activeRun: hasActiveRun };
-  }
-  if (ACTION_REQUEST_PATTERN.test(lower)) {
-    return { kind: 'start_run', confidence: 0.8, reason: 'action_request', activeRun: hasActiveRun };
-  }
-  return { kind: 'converse', confidence: 0.62, reason: 'plain_conversation', activeRun: hasActiveRun };
-}
-
 function toolsForClassification(classification, writeTools, session = null) {
   const controlTools = session?.runtime?.url
     ? [RUNTIME_STATUS_TOOL, RUNTIME_CANCEL_TOOL, RUNTIME_KILL_TOOL, RUNTIME_APPROVE_TOOL, RUNTIME_ENQUEUE_TOOL]
     : [];
+  // Provider discovery and validation belong to the runtime. Hiding
+  // delegation while the shell snapshot is temporarily empty forced Donna
+  // to invent commands instead of submitting the objective.
   const capabilityRunTools = session?.runtime?.url && !classification.activeRun
-    ? [RUNTIME_CAPABILITY_RUN_TOOL]
+    ? [RUNTIME_DELEGATE_TOOL]
     : [];
-  if (classification.activeRun && ['converse', 'observe', 'ambiguous', 'approve', 'cancel', 'enqueue_run'].includes(classification.kind)) {
+  if (classification.activeRun) {
     // During an active run Donna gets read + profile + the runtime control
     // suite: she can answer, approve, enqueue for later, soft-cancel or
     // kill — but she must not fire new MCP jobs alongside the run (that is
     // what runtime__enqueue is for). No canned regex answers anywhere.
-    return [SHELL_READ_COMMAND_TOOL, SHELL_PROFILE_UPDATE_TOOL, ...controlTools];
+    return [SHELL_READ_COMMAND_TOOL, ...controlTools];
+  }
+  if (session?.runtime?.url) {
+    // Offer every connected tool directly EXCEPT orchestration-bypass tools
+    // and raw shell write/profile mutation. Reads, configuration, connector
+    // setup — and any newly added MCP's tools — stay directly callable.
+    const directTools = writeTools.filter((item) => {
+      const name = item?.function?.name;
+      if (!name || name === 'shell__run_command' || name === 'shell__profile_update') return false;
+      return !isOrchestrationBypassTool(name);
+    });
+    return [SHELL_READ_COMMAND_TOOL, ...controlTools, ...capabilityRunTools, ...directTools];
   }
   return [SHELL_READ_COMMAND_TOOL, ...controlTools, ...capabilityRunTools, ...writeTools];
 }
 
+export function isDonnaReadTool(item) {
+  const name = String(item?.function?.name ?? '');
+  if (!name || name.startsWith('shell__') || name === 'wiki__plan_set' || name === 'wiki__plan_done') return false;
+  if (item?.readOnly === true) return true;
+  const tool = name.includes('__') ? name.slice(name.indexOf('__') + 2) : name;
+  return tool === 'wiki_workspace_status'
+    || tool === 'agent_describe'
+    || tool === 'agent_status'
+    || /(?:^|_)(?:status|list|search|read|get)$/.test(tool);
+}
+
+// Two-tier tool policy. Donna may call any connected MCP tool directly
+// (reads AND plain writes: cme_setup, connector setup, document conversion,
+// send, search, and anything a newly added MCP exposes) EXCEPT the small set
+// that must go through the runtime's orchestration: the universal five-tool
+// contract executors (agent_plan/agent_execute), the legacy job starter, and
+// direct plan mutation. Heavy multi-step work (ingest/build/export via the
+// production agent) is delegated for its DAG/parallelism; plain single-step
+// tools are called directly. This is a blocklist, not a whitelist, so adding a
+// new MCP never silently disables its tools.
+function isOrchestrationBypassTool(name) {
+  const full = String(name ?? '');
+  if (!full) return true;
+  if (full === 'wiki__plan_set' || full === 'wiki__plan_done') return true;
+  const sep = full.indexOf('__');
+  const tool = sep === -1 ? full : full.slice(sep + 2);
+  return tool === 'agent_plan' || tool === 'agent_execute' || tool === 'production_start_job';
+}
+
+function isReadOnlyMcpCall(session, server, tool) {
+  const descriptor = (session?.mcp?.[server]?.tools ?? [])
+    .find((item) => String(item?.name ?? '') === tool || String(item?.name ?? '').endsWith(`__${tool}`));
+  return isDonnaReadTool({
+    function: { name: `${server}__${tool}` },
+    readOnly: descriptor?.readOnly === true,
+  });
+}
+
 export function createAgentGraph(options = {}) {
   async function orchestratorNode(state) {
     const llm = state.session.llm ?? options.llm ?? null;
@@ -933,7 +1026,13 @@ export function createAgentGraph(options = {}) {
     const classification = iterations === 0
       ? (runtimeExecution
         ? { kind: 'execute_run', confidence: 1, reason: 'runtime_run_execution', activeRun: true }
-        : classifyAgentInput(state.input, state.session))
+        : {
+            kind: 'agent_turn',
+            confidence: 1,
+            reason: 'agent_mode_llm_decision',
+            activeRun: state.session?.agentProjection?.status === 'running'
+              || sessionActivities(state.session).some((activity) => !activity.terminal),
+          })
       : (state.inputClassification ?? { kind: 'modify_run', confidence: 1, reason: 'tool_iteration' });
     if (iterations === 0) {
       state.session._onStep?.(`Agent: classified input as ${classification.kind}`);
@@ -962,28 +1061,54 @@ export function createAgentGraph(options = {}) {
 
     try {
       const useStreamWithTools = typeof llm.streamWithTools === 'function';
-      const suppressExecutionNarration = runtimeExecution && (iterations === 0 || state.retryWithoutTool);
+      const toolChoice = state.forceDelegation
+        ? { type: 'function', function: { name: 'runtime__delegate' } }
+        : 'auto';
       const result = useStreamWithTools
         ? await llm.streamWithTools({
             system,
             tools,
             messages: conversationMessages,
-            onTextDelta: (delta) => {
-              if (suppressExecutionNarration) return;
-              emitAgentEvent(state.session, 'assistant_delta', 'llm', { delta });
-              state.session._onStream?.(delta);
-            },
+            toolChoice,
+            // Buffer until validation. Invalid commands and malformed tool
+            // calls must never flash hundreds of lines before disappearing.
+            onTextDelta: () => {},
             signal: state.session._abortSignal,
           })
         : await llm.completeWithTools({
             system,
             tools,
             messages: conversationMessages,
+            toolChoice,
             signal: state.session._abortSignal,
           });
 
       if (result.tool_calls?.length > 0) {
         state.session._onStreamReset?.();
+        const malformed = invalidToolCalls(result.tool_calls);
+        if (malformed.length > 0) {
+          const retries = Number(state.invalidToolCallRetries ?? 0);
+          if (retries < 2) {
+            state.session._onStep?.('Agent: malformed tool call rejected; retrying…');
+            return {
+              pendingToolCalls: null,
+              messages: [
+                ...(iterations === 0 ? [{ role: 'user', content: state.input }] : []),
+                {
+                  role: 'user',
+                  content: 'Your previous tool call was incomplete or contained invalid JSON arguments. Call the appropriate available tool again with one complete valid JSON object. Do not narrate or reproduce the broken call.',
+                },
+              ],
+              toolIterations: iterations + 1,
+              readyToStream: false,
+              inputClassification: classification,
+              invalidToolCallRetries: retries + 1,
+            };
+          }
+          const failure = 'Action non exécutée : l’appel d’outil généré par le modèle était incomplet.';
+          emitAgentEvent(state.session, 'assistant_message', 'agent_guard', { content: failure });
+          return { response: failure, pendingToolCalls: null, readyToStream: false };
+        }
         // Close the streaming conversation entry now: the text streamed so
         // far is this iteration's narration. Without this, the next
         // iteration's deltas append to the SAME entry with no separator and
@@ -998,6 +1123,7 @@ export function createAgentGraph(options = {}) {
           : [result.message];
         return {
           pendingToolCalls: result.tool_calls,
+          allowedToolNames: tools.map((item) => item?.function?.name).filter(Boolean),
           messages: newMessages,
           toolIterations: iterations + 1,
           readyToStream: false,
@@ -1026,6 +1152,26 @@ export function createAgentGraph(options = {}) {
         };
       }
 
+      const canDelegate = tools.some((item) => item?.function?.name === 'runtime__delegate');
+      if (!runtimeExecution && iterations === 0 && canDelegate && !state.retryWithoutTool
+        && await classifyRequestedAction(llm, state.input, state.session._abortSignal)) {
+        state.session._onStreamReset?.();
+        state.session._onStep?.('Agent: action response rejected — delegation required; retrying…');
+        return {
+          pendingToolCalls: null,
+          messages: [
+            { role: 'user', content: state.input },
+            result.message ?? { role: 'assistant', content: result.content ?? '' },
+            { role: 'user', content: 'This is an action request. Call runtime__delegate now with the original objective only. Do not provide instructions or narration.' },
+          ],
+          toolIterations: 1,
+          readyToStream: false,
+          inputClassification: classification,
+          retryWithoutTool: true,
+          forceDelegation: true,
+        };
+      }
+
       if (runtimeExecution && state.retryWithoutTool) {
         state.session._onStreamReset?.();
         const failure = 'Action non exécutée : Donna n’a appelé aucun outil disponible. Aucun job ni résultat n’a été créé.';
@@ -1038,7 +1184,43 @@ export function createAgentGraph(options = {}) {
         };
       }
 
+      const invalidCommands = invalidSuggestedSlashCommands(result.content, state.session);
+      const leakedTools = invalidUserFacingToolNames(result.content, state.session);
+      if (invalidCommands.length > 0 || leakedTools.length > 0) {
+        state.session._onStreamReset?.();
+        const retries = Number(state.invalidResponseRetries ?? 0);
+        if (retries < 2) {
+          const canDelegate = tools.some((item) => item?.function?.name === 'runtime__delegate');
+          state.session._onStep?.('Agent: invalid user-facing implementation detail rejected; retrying…');
+          return {
+            pendingToolCalls: null,
+            messages: [
+              ...(iterations === 0 ? [{ role: 'user', content: state.input }] : []),
+              result.message ?? { role: 'assistant', content: result.content ?? '' },
+              {
+                role: 'user',
+                content: [
+                  'Rewrite the answer for the end user without internal MCP tool identifiers or unsolicited shell commands.',
+                  invalidCommands.length > 0 ? `Unavailable slash commands: /${invalidCommands.join(', /')}.` : null,
+                  leakedTools.length > 0 ? 'Do not print tool names; use them internally if needed.' : null,
+                  'If the user requested an action and runtime delegation is available, call runtime__delegate instead of giving manual instructions.',
+                ].filter(Boolean).join(' '),
+              },
+            ],
+            toolIterations: iterations + 1,
+            readyToStream: false,
+            inputClassification: classification,
+            invalidResponseRetries: retries + 1,
+            forceDelegation: canDelegate,
+          };
+        }
+        const failure = 'Réponse rejetée : Donna a exposé une instruction interne ou une procédure manuelle incorrecte.';
+        emitAgentEvent(state.session, 'assistant_message', 'agent_guard', { content: failure });
+        return { response: failure, pendingToolCalls: null, readyToStream: false };
+      }
+
       if (useStreamWithTools) {
+        if (result.content) state.session._onStream?.(result.content);
         emitAgentEvent(state.session, 'assistant_message', 'llm', { content: result.content ?? '' });
         // Text was streamed inline via session._onStream — no second LLM call needed.
         const newMessages = iterations === 0
@@ -1088,6 +1270,26 @@ export function createAgentGraph(options = {}) {
       const isInternalWikiTool = server === 'wiki' && (tool === 'plan_set' || tool === 'plan_done');
       const serverLabel = server === 'shell' ? 'Shell' : isInternalWikiTool ? 'Plan' : 'MCP';
       const toolName = server ? `${server}.${tool}` : call.function.name;
+      // Hard guardrail: only execute tools that were actually offered this turn
+      // (read-only tools + runtime controls + delegate). A capable model that
+      // spots a mutating provider tool in the prompt and calls it directly must
+      // be refused and steered back to runtime__delegate — this is what keeps
+      // the orchestration capability-driven regardless of model strength.
+      // Only interactive turns are constrained. Inside a runtime run
+      // (_currentRunIdentity set) the graph legitimately executes the
+      // already-validated, already-approved delegated task via provider tools.
+      const runtimeExecutionTurn = Boolean(state.session._currentRunIdentity);
+      const allowedNames = !runtimeExecutionTurn && Array.isArray(state.allowedToolNames) ? state.allowedToolNames : null;
+      const isInternalCall = server === 'shell' || server === 'runtime' || isInternalWikiTool;
+      if (allowedNames && server && !isInternalCall && !allowedNames.includes(`${server}__${tool}`)) {
+        const refusal = `${server}__${tool} is not available in interactive mode. Do not call provider tools directly. For any action or mutation, call runtime__delegate with the user objective; only read-only tools and runtime controls may be called directly.`;
+        state.session._onStep?.(`tool call refused (not offered): ${server}__${tool}`);
+        emitAgentEvent(state.session, 'tool_call_result', 'tool', {
+          callId: call.id, name: toolName, ok: false, result: refusal, summary: 'refused',
+        });
+        toolResultMessages.push({ role: 'tool', tool_call_id: call.id, content: refusal });
+        continue;
+      }
       if (resolved.normalized) {
         // Keep normalizations visible: the defensive routing must not hide
         // prompt/skill regressions that reintroduce unqualified names.
@@ -1104,9 +1306,11 @@ export function createAgentGraph(options = {}) {
         args: call.function.arguments ?? '{}',
         summary: argsSummary || 'calling...',
       });
-      // Immediate visible plan for any MCP call that doesn't yet have an _activity plan.
+      // A plan represents work, never observation. Read-only inventory/status
+      // calls stay out of Plan even when Donna uses them to answer a question.
       let minimalPlanActive = false;
-      if (!isInternalWikiTool && server !== 'shell' && !state.session.headlessPlan) {
+      if (!isInternalWikiTool && server !== 'shell' && server !== 'runtime'
+        && !isReadOnlyMcpCall(state.session, server, tool) && !state.session.headlessPlan) {
         minimalPlanActive = true;
         emitAgentEvent(state.session, 'plan_set', 'tool', {
           steps: [{ step: 1, id: null, description: toolName, status: 'running', _activityKey: null }],
@@ -1128,6 +1332,8 @@ export function createAgentGraph(options = {}) {
           );
         }
         let args = JSON.parse(call.function.arguments ?? '{}');
+        const definition = toolDefinitionForCall(state.session, call.function.name);
+        args = normalizeToolArgumentsFromSchema(args, definition?.function?.parameters);
         if (server === 'production' && tool === 'production_start_job' && state.session.workspace && !args.callerLabel) {
           args = { ...args, callerLabel: `${state.session.workspace}/wiki-manager` };
         }
@@ -1244,12 +1450,17 @@ export function createAgentGraph(options = {}) {
     return {
       messages: toolResultMessages,
       pendingToolCalls: null,
+      forceDelegation: false,
+      invalidToolCallRetries: 0,
+      invalidResponseRetries: 0,
     };
   }
 
   function routeOrchestrator(state) {
     if (state.pendingToolCalls?.length > 0) return 'tool_executor';
     if (state.retryWithoutTool) return 'orchestrator';
+    if (state.invalidToolCallRetries > 0 && state.response == null && !state.streamedInline) return 'orchestrator';
+    if (state.invalidResponseRetries > 0 && state.response == null && !state.streamedInline) return 'orchestrator';
     return END;
   }