@dotdrelle/wiki-manager 0.12.12 → 0.14.1

package/src/agent/llm.js

@@ -55,7 +55,7 @@ export function createLlmClientFromWikiConfig(config) {
       }
       return content;
     },
-    async completeWithTools({ system, tools = [], messages = [], signal }) {
+    async completeWithTools({ system, tools = [], messages = [], toolChoice = 'auto', signal }) {
       const allMessages = [
         { role: 'system', content: system },
         ...messages,
@@ -67,7 +67,7 @@ export function createLlmClientFromWikiConfig(config) {
       };
       if (tools.length > 0) {
         body.tools = tools;
-        body.tool_choice = 'auto';
+        body.tool_choice = toolChoice;
       }
       const response = await fetch(`${baseUrl}/chat/completions`, {
         method: 'POST',
@@ -90,7 +90,7 @@ export function createLlmClientFromWikiConfig(config) {
         message: { role: 'assistant', content: msg?.content ?? null, tool_calls: msg?.tool_calls },
       };
     },
-    async streamWithTools({ system, tools = [], messages = [], onTextDelta, signal }) {
+    async streamWithTools({ system, tools = [], messages = [], toolChoice = 'auto', onTextDelta, signal }) {
       const allMessages = [
         { role: 'system', content: system },
         ...messages,
@@ -103,7 +103,7 @@ export function createLlmClientFromWikiConfig(config) {
       };
       if (tools.length > 0) {
         body.tools = tools;
-        body.tool_choice = 'auto';
+        body.tool_choice = toolChoice;
       }
       const response = await fetch(`${baseUrl}/chat/completions`, {
         method: 'POST',
@@ -119,7 +119,7 @@ export function createLlmClientFromWikiConfig(config) {
         throw new Error(`HTTP ${response.status} ${text.slice(0, 240)}`);
       }
       if (!response.body) {
-        const result = await this.completeWithTools({ system, tools, messages, signal });
+        const result = await this.completeWithTools({ system, tools, messages, toolChoice, signal });
         if (result.content) onTextDelta?.(result.content);
         return result;
       }

package/src/cli/wiki-manager.js

@@ -16,6 +16,7 @@ import { syncActivitiesToPlan, formatPlanStatus } from '../core/plan.js';
 import { createAgentEvent, dispatchAgentEvent } from '../core/agentEvents.js';
 import { runAgentTurn, runAgenticLoop } from '../core/agentLoop.js';
 import { resolveCapabilityConcurrency } from '../orchestrator/scheduler.js';
+import { capabilityRegistryForSession } from '../orchestrator/capabilityRegistry.js';
 // Runtime modules use node:sqlite (Node.js built-in unavailable in Bun).
 // They are imported dynamically so the shell / TUI path never loads them.
 
@@ -56,6 +57,11 @@ function createSession() {
   };
 }
 
+export async function forwardRuntimeApproval(getWorkspaceContext, request = {}) {
+  const context = await getWorkspaceContext(request.workspace ?? null);
+  return context.approvalManager?.approve(request) ?? { approved: false };
+}
+
 function timestampForFile() {
   return new Date().toISOString().replace(/[:.]/g, '-');
 }
@@ -198,6 +204,109 @@ async function runHeadlessAgenticLoop(agent, session, initialInput, log, { timeo
   return { exitCode: result.ok ? 0 : (result.waitResult?.exitCode ?? 1) };
 }
 
+// Observe a runtime-delegated run from headless: the run executes server-side,
+// so poll /state and mirror status transitions, new logs and the final plan
+// into the headless log until the run reaches a terminal state.
+async function waitForRuntimeRun(session, log, { timeoutMs, pollMs = 1500, autoApprove = false, priorRunIds = [] } = {}) {
+  const { fetchRuntimeState, postRuntimeApprove } = await import('../runtime/client.js');
+  const url = session.runtime?.url;
+  const workspace = session.workspace ?? null;
+  if (!url) return { exitCode: 0 };
+  // Scope strictly to the run this turn created: any run already present before
+  // the turn (including a stuck/zombie run) must be ignored, or the wait would
+  // observe/approve the wrong run and never finish.
+  const priorSet = new Set((priorRunIds ?? []).map(String));
+  const terminal = new Set(['succeeded', 'success', 'done', 'complete', 'completed', 'failed', 'error', 'cancelled', 'canceled']);
+  const deadline = Date.now() + timeoutMs;
+  const graceDeadline = Date.now() + 8000;
+  let lastStatus = null;
+  let lastLogCount = 0;
+  let sawRun = false;
+  const approvedRevisions = new Set();
+  while (Date.now() < deadline) {
+    let state;
+    try {
+      state = await fetchRuntimeState({ url, workspace });
+    } catch (err) {
+      const line = `runtime-wait: state fetch failed (${err instanceof Error ? err.message : String(err)})`;
+      log.push(line); console.error(line);
+      return { exitCode: 1 };
+    }
+    const logs = Array.isArray(state?.logs) ? state.logs : [];
+    for (const entry of logs.slice(lastLogCount)) {
+      const text = typeof entry === 'string' ? entry : String(entry?.message ?? JSON.stringify(entry));
+      log.push(`runtime: ${text}`); console.log(`[runtime] ${text}`);
+    }
+    lastLogCount = logs.length;
+    const runs = Array.isArray(state?.runs) ? state.runs : [];
+    const currentRun = runs.find((run) => run?.id && !priorSet.has(String(run.id)));
+    if (!currentRun) {
+      if (sawRun) return { exitCode: 0 };
+      if (Date.now() >= graceDeadline) {
+        const line = 'runtime-wait: no run was delegated this turn (Donna answered without starting a run).';
+        log.push(line); console.log(line);
+        return { exitCode: 0 };
+      }
+      await new Promise((resolve) => setTimeout(resolve, pollMs));
+      continue;
+    }
+    sawRun = true;
+    const status = String(currentRun.status ?? 'running').toLowerCase();
+    if (status !== lastStatus) {
+      log.push(`runtime-status: ${status} (run ${currentRun.id})`); console.log(`[runtime] status=${status}`);
+      lastStatus = status;
+    }
+    // Approval is granted per task, so the run status stays "running" while a
+    // task waits — detect the block via state.approvals, scoped to this run.
+    const pendingApprovals = (Array.isArray(state?.approvals) ? state.approvals : [])
+      .filter((approval) => approval.status === 'pending_approval'
+        && (approval.runId == null || String(approval.runId) === String(currentRun.id)));
+    if (pendingApprovals.length > 0) {
+      if (!autoApprove) {
+        const line = `runtime-wait: run ${currentRun.id} waiting for approval (${pendingApprovals.length} task(s)); re-run with --auto-approve to drive it through.`;
+        log.push(line); console.log(line);
+        return { exitCode: 0 };
+      }
+      const planRevision = state?.planRevision ?? currentRun.planRevision ?? 0;
+      if (!approvedRevisions.has(planRevision)) {
+        approvedRevisions.add(planRevision);
+        const approvalClasses = [...new Set(pendingApprovals.flatMap((approval) => {
+          const value = approval.approvalClasses ?? approval.approvalClass ?? [];
+          return Array.isArray(value) ? value : [value];
+        }).map(String).filter(Boolean))];
+        try {
+          const result = await postRuntimeApprove({
+            url,
+            workspace,
+            runId: currentRun.id,
+            scope: 'run',
+            planRevision,
+            approvalClasses: approvalClasses.length > 0 ? approvalClasses : ['default'],
+          });
+          const line = `runtime-wait: auto-approved run ${currentRun.id} (revision ${planRevision})${result?.approved ? '' : ' [no pending approval matched]'}`;
+          log.push(line); console.log(line);
+        } catch (err) {
+          const line = `runtime-wait: auto-approve failed (${err instanceof Error ? err.message : String(err)})`;
+          log.push(line); console.error(line);
+          return { exitCode: 1 };
+        }
+      }
+    }
+    if (terminal.has(status)) {
+      const plan = Array.isArray(currentRun.plan) ? currentRun.plan
+        : (Array.isArray(state?.plan) ? state.plan : []);
+      if (plan.length > 0) {
+        log.push(`runtime-plan:\n${plan.map((planStep) => `  - ${planStep.description ?? planStep.id ?? planStep.step ?? ''}: ${planStep.status ?? ''}`).join('\n')}`);
+      }
+      return { exitCode: status === 'failed' || status === 'error' ? 1 : 0 };
+    }
+    await new Promise((resolve) => setTimeout(resolve, pollMs));
+  }
+  const line = 'runtime-wait: timeout waiting for the delegated run to finish.';
+  log.push(line); console.error(line);
+  return { exitCode: 1 };
+}
+
 async function runHeadless(argv, agent) {
   const workspaceName = valueAfter(argv, '--workspace');
   const skillName = valueAfter(argv, '--skill');
@@ -229,6 +338,37 @@ async function runHeadless(argv, agent) {
     if (!session.workspacePath) throw new Error(useResult.output || `Workspace not loaded: ${workspaceName}`);
     if (!session.llm) throw new Error(`Workspace ${workspaceName} has no usable LLM config.`);
 
+    // Agent-mode parity: the interactive TUI runs every turn against the
+    // runtime (delegation + run control) with MCP connected. Without a
+    // runtime, the graph exposes no runtime__delegate tool, so any action
+    // request degrades to a chat-like text answer instead of a real delegated
+    // run — which is exactly why headless "looked like chat mode". Connect the
+    // same way the TUI does. Use --no-runtime for the legacy direct-MCP path.
+    if (!argv.includes('--no-runtime')) {
+      try {
+        const { ensureRuntime } = await import('../runtime/lifecycle.js');
+        const runtime = await ensureRuntime();
+        session.runtime = runtime?.url ? { url: runtime.url, started: Boolean(runtime.started) } : null;
+        step(`runtime: ${session.runtime ? `connected ${session.runtime.url}` : 'unavailable'}`);
+      } catch (err) {
+        session.runtime = null;
+        step(`runtime: unavailable (${err instanceof Error ? err.message : String(err)})`);
+      }
+    }
+    await refreshMcpRuntimeStatus(session);
+    step(`mcp: ${Object.values(session.mcp ?? {}).filter((value) => value.status === 'connected').length} connected`);
+    // Surface which tools Donna is actually offered this turn: if a factual
+    // question is answered without the matching read tool appearing here, the
+    // problem is discovery/connection, not the model.
+    for (const [name, value] of Object.entries(session.mcp ?? {})) {
+      if (value?.status !== 'connected') continue;
+      const toolNames = (value.tools ?? []).map((tool) => tool.name).join(', ');
+      step(`mcp-tools ${name}: ${toolNames || '(none discovered)'}`);
+    }
+    // Wire the graph's step trace (classification, tool calls, retries) into
+    // the headless log so the agent-mode decision is observable.
+    session._onStep = step;
+
     let input = prompt;
     if (skillName) {
       const skillResult = await handleSlashCommand(`/skills run ${skillName}`, { packageJson, session, onStep: step });
@@ -260,11 +400,26 @@ async function runHeadless(argv, agent) {
     if (useAgenticLoop) {
       ({ exitCode } = await runHeadlessAgenticLoop(agent, session, input, log, { timeoutMs, maxTurns }));
     } else {
+      // Snapshot existing runs so the wait scopes strictly to the run this turn
+      // creates and never observes a pre-existing / zombie run.
+      let priorRunIds = [];
+      if (session.runtime?.url && wait) {
+        try {
+          const { fetchRuntimeState } = await import('../runtime/client.js');
+          const before = await fetchRuntimeState({ url: session.runtime.url, workspace: session.workspace ?? null });
+          priorRunIds = (Array.isArray(before?.runs) ? before.runs : []).map((run) => run?.id).filter(Boolean);
+        } catch { priorRunIds = []; }
+      }
       const response = await runAgentTurn(agent, session, input);
       log.push('response:');
       log.push(response);
       console.log(response);
-      ({ exitCode } = await runHeadlessActivityLoop(session, log, { wait, timeoutMs }));
+      // When connected to the runtime, an action turn delegates a run that
+      // executes server-side — its progress lives in runtime state, not in the
+      // local session. Poll it so the headless log shows the real outcome.
+      ({ exitCode } = session.runtime?.url && wait
+        ? await waitForRuntimeRun(session, log, { timeoutMs, autoApprove: argv.includes('--auto-approve'), priorRunIds })
+        : await runHeadlessActivityLoop(session, log, { wait, timeoutMs }));
     }
     const saved = await writeHeadlessLog(session, log, logFile);
     console.log(`Headless log: ${saved}`);
@@ -591,6 +746,55 @@ async function runRuntime(argv, agent) {
     };
   }
 
+  async function prepareDelegation(context, { objective }) {
+    const { resolveObjective } = await import('../orchestrator/objectiveResolver.js');
+    const { validateFragment } = await import('../orchestrator/planValidator.js');
+    const session = context.session;
+    const selection = await resolveObjective(objective, session);
+    const provider = selection.provider;
+    const fragment = parseJsonText(formatMcpToolResult(await callMcpTool(
+      session.mcp,
+      provider.serverName,
+      'agent_plan',
+      {
+        capability: selection.capability,
+        operation: selection.operation,
+        objective,
+        workspace: { revision: String(Date.now()) },
+        constraints: {
+          maxConcurrency: resolveCapabilityConcurrency(
+            provider,
+            undefined,
+            process.env.WIKI_MANAGER_CAPABILITY_CONCURRENCY,
+          ),
+          requireApprovalForMutations: true,
+        },
+      },
+    )));
+    if (!Array.isArray(fragment?.tasks) || fragment.tasks.length === 0) {
+      throw new Error(fragment?.summary?.initialSynthesis?.[0] ?? `No task was planned for ${selection.capability}/${selection.operation}.`);
+    }
+    const validation = validateFragment(fragment, {
+      registry: capabilityRegistryForSession(session),
+      run: { plannerAgentInstanceId: provider.agentInstanceId ?? provider.serverName },
+    });
+    if (!validation.ok) {
+      throw new Error(`Delegated plan rejected: ${validation.errors.map((error) => error.message ?? error.code ?? String(error)).join('; ')}`);
+    }
+    return {
+      capability: selection.capability,
+      operation: selection.operation,
+      provider: { serverName: provider.serverName, agentInstanceId: provider.agentInstanceId ?? provider.serverName },
+      fragment: validation.normalizedFragment,
+      summary: {
+        capability: selection.capability,
+        operation: selection.operation,
+        agent: provider.agentInstanceId ?? provider.serverName,
+        tasks: validation.normalizedFragment.tasks.length,
+      },
+    };
+  }
+
   async function executeRun(context, body, { signal } = {}) {
     const session = context.session;
     const supervisor = context.supervisor;
@@ -629,6 +833,31 @@ async function runRuntime(argv, agent) {
         : undefined;
       supervisor?.setRunSignal(signal);
       session._onStep = (message) => emitRuntimeLog(session, message);
+      if (body.preparedDelegation?.fragment) {
+        const { integrate } = await import('../orchestrator/planIntegrator.js');
+        const prepared = body.preparedDelegation;
+        const integrated = integrate(runId, prepared.fragment, {
+          registry: capabilityRegistryForSession(session),
+          session,
+          store,
+          workspace: session.workspace ?? null,
+          enforceApprovalCoverage: true,
+        });
+        if (!integrated.ok) {
+          throw new Error(`Delegated plan integration failed: ${(integrated.errors ?? []).map((error) => error.message ?? error.code ?? String(error)).join('; ')}`);
+        }
+        emitRuntimeLog(session, `delegation: ${prepared.fragment.tasks.length} validated task(s) integrated from ${prepared.provider.serverName}.agent_plan (${prepared.capability}/${prepared.operation})`);
+        // Demandé = consenti: a directly-delegated run carries the user's
+        // explicit consent, so auto-approve its initial plan. Persisting a
+        // run-scope grant (via the approval manager) makes the scheduler's
+        // readyTasks approval check pass, so the tasks run without re-prompting.
+        // Replanned tasks are integrated later without a fresh grant.
+        if (context.approvalManager?.approve) {
+          context.approvalManager.approve({ scope: 'run', runId });
+          emitRuntimeLog(session, `approval: run ${runId} auto-approved (user-requested action)`);
+        }
+        body._planReady?.resolve?.({ runId, planRevision: session.agentProjection?.planRevision ?? 0 });
+      }
       // Deterministic capability run (/ingest): ask the capable agent for its
       // task-graph fragment and integrate it as the plan BEFORE any LLM turn.
       // The parallel path must not depend on a small model deciding to call
@@ -636,7 +865,7 @@ async function runRuntime(argv, agent) {
       if (body.capabilityPlan?.capability) {
         const { validateFragment } = await import('../orchestrator/planValidator.js');
         const { integrate } = await import('../orchestrator/planIntegrator.js');
-        const registry = session.capabilityRegistry ?? null;
+        const registry = capabilityRegistryForSession(session);
         const agents = session.agentRegistry?.snapshot?.() ?? session.agentRegistrySnapshot ?? [];
         const provider = agents.find((item) => (item.description?.capabilities ?? [])
           .some((capability) => capability.id === body.capabilityPlan.capability));
@@ -704,6 +933,7 @@ async function runRuntime(argv, agent) {
         ...(maxReplans === undefined ? {} : { maxReplans }),
       });
     } catch (err) {
+      body._planReady?.reject?.(err);
       if (err?.name === 'AbortError') {
         // Cancel the asynchronous agent jobs the run started: aborting only
         // the manager loop left ingest subprocesses running for minutes with
@@ -747,12 +977,10 @@ async function runRuntime(argv, agent) {
       .filter((context) => context?.running)
       .map((context) => ({ workspace: context.workspace ?? null, runId: context.currentRunId ?? null })),
     run: executeRun,
+    delegate: prepareDelegation,
     cancel: (context) => emitRuntimeLog(context.session, 'runtime: cancel requested'),
     resume: ({ workspace }) => recoverRuntime({ workspace, manual: true }),
-    approve: async ({ workspace, runId, itemId, approvalId }) => {
-      const context = await getWorkspaceContext(workspace);
-      return context.approvalManager?.approve({ runId, itemId, approvalId }) ?? { approved: false };
-    },
+    approve: (request) => forwardRuntimeApproval(getWorkspaceContext, request),
     configProfiles: async (context) => {
       const profiles = listWikircProfiles(context.session.workspacePath);
       return {

package/src/cli/wiki-manager.test.js

@@ -0,0 +1,28 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { forwardRuntimeApproval } from './wiki-manager.js';
+
+test('runtime approval bridge preserves the complete run-scoped grant', async () => {
+  let forwarded = null;
+  const request = {
+    workspace: 'test4',
+    workspaceId: 'test4',
+    runId: 'run-1',
+    scope: 'run',
+    planRevision: 3,
+    approvalClasses: ['mutation'],
+  };
+
+  const result = await forwardRuntimeApproval(async (workspace) => ({
+    approvalManager: {
+      approve(value) {
+        assert.equal(workspace, 'test4');
+        forwarded = value;
+        return { approved: true };
+      },
+    },
+  }), request);
+
+  assert.deepEqual(forwarded, request);
+  assert.deepEqual(result, { approved: true });
+});

package/src/commands/slash.js

@@ -676,6 +676,20 @@ function rawCommandResult(command, output) {
   };
 }
 
+export function localizedOperationResult({ operation, target, status = 'succeeded' }) {
+  const facts = JSON.stringify({ operation, target, status });
+  return {
+    output: facts,
+    rawOutput: true,
+    agentTrigger: [
+      'Formule le résultat structuré suivant dans la langue et le ton demandés par le profil du workspace.',
+      'Réponds par une seule phrase humaine et naturelle.',
+      'Ne mentionne aucune commande, syntaxe shell, étape suivante ou détail technique.',
+      `Résultat: ${facts}`,
+    ].join('\n'),
+  };
+}
+
 function formatRuntimeRunStatus(state) {
   const status = state?.status ?? 'unknown';
   const runId = state?.runId ? ` run=${state.runId}` : '';
@@ -711,13 +725,14 @@ export async function handleSlashCommand(line, context) {
   const args = line.slice(1).trim().split(/\s+/).filter(Boolean);
   const [command] = args;
   const step = context.onStep ?? (() => {});
-  const runAgentCommand = async (fn, verb, commandLabel) => {
+  const runAgentCommand = async (fn, verb) => {
     try {
       step(`Agents: ${verb}ing external agents…`);
-      const output = await fn();
-      return output
-        ? rawCommandResult(commandLabel, output)
-        : { output: `Agents ${verb}ed.` };
+      await fn();
+      return localizedOperationResult({
+        operation: verb,
+        target: 'agents',
+      });
     } catch (err) {
       step(formatActivityError('agents', verb, err));
       return { output: err instanceof Error ? err.message : String(err) };
@@ -876,13 +891,16 @@ export async function handleSlashCommand(line, context) {
       // do not remap it to undefined, that bypasses any custom "all" target list and always
       // falls back to the hardcoded COMPOSE_SERVICES constant instead.
       const service = args[1];
-      if (service === 'agents') return runAgentCommand(startAgents, 'start', '/start agents');
+      if (service === 'agents') return runAgentCommand(startAgents, 'start');
       try {
         step(`Services: starting ${service ?? 'workspace services'}…`);
-        const output = await startService(context.session, service);
+        await startService(context.session, service);
         step('Services: refreshing MCP runtime…');
         await refreshMcpRuntimeStatus(context.session);
-        return rawCommandResult(`/start${service ? ` ${service}` : ''}`, output);
+        return localizedOperationResult({
+          operation: 'start',
+          target: service || 'workspace-services',
+        });
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         step(formatActivityError('services', 'stop', err));
@@ -891,13 +909,16 @@ export async function handleSlashCommand(line, context) {
     }
     case 'stop': {
       const service = args[1];
-      if (service === 'agents') return runAgentCommand(stopAgents, 'stop', '/stop agents');
+      if (service === 'agents') return runAgentCommand(stopAgents, 'stop');
       try {
         step(`Services: stopping ${service ?? 'workspace services'}…`);
-        const output = await stopService(context.session, service);
+        await stopService(context.session, service);
         step('Services: refreshing MCP runtime…');
         await refreshMcpRuntimeStatus(context.session);
-        return rawCommandResult(`/stop${service ? ` ${service}` : ''}`, output);
+        return localizedOperationResult({
+          operation: 'stop',
+          target: service || 'workspace-services',
+        });
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         step(formatActivityError('services', 'logs', err));

package/src/commands/slash.test.js

@@ -4,9 +4,17 @@ import { mkdtemp } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import test from 'node:test';
-import { handleSlashCommand } from './slash.js';
+import { handleSlashCommand, localizedOperationResult } from './slash.js';
 import { completionContext } from '../shell/repl.js';
 
+test('deterministic operation results ask Donna to localize compact facts without leaking commands', () => {
+  const result = localizedOperationResult({ operation: 'start', target: 'agents' });
+  assert.equal(result.rawOutput, true);
+  assert.deepEqual(JSON.parse(result.output), { operation: 'start', target: 'agents', status: 'succeeded' });
+  assert.match(result.agentTrigger, /une seule phrase humaine et naturelle/);
+  assert.doesNotMatch(result.agentTrigger, /\/start|Docker|compose/);
+});
+
 test('/workspace delete removes files and clears current session context after confirmation', async () => {
   const root = await mkdtemp(join(tmpdir(), 'wiki-manager-delete-workspace-'));
   const registryRoot = join(root, 'registry');

package/src/core/agentEvents.js

@@ -196,7 +196,13 @@ export function applyAgentProjectionToSession(session, projection) {
 function applyEvent(state, event) {
   switch (event.type) {
     case 'run_started':
-      state.status = 'running';
+      // Only a real runtime run (origin 'runtime') marks the projection
+      // 'running'. An interactive turn (origin 'user') is NOT a run: forcing
+      // 'running' here made the graph classify activeRun=true and hide Donna's
+      // MCP read tools (cme_status, wiki_workspace_status…), so questions about
+      // MCP state failed. Preserve the existing status (idle, or a genuinely
+      // active runtime run synced from the runtime) for interactive turns.
+      if (event.origin === 'runtime') state.status = 'running';
       state.plan = null;
       state.chain = [];
       state.activities = {};

package/src/core/agentEvents.test.js

@@ -20,13 +20,25 @@ test('reduceAgentEvents: run_started clears stale plan', () => {
       origin: 'tool',
       payload: { steps: ['Old action'] },
     }),
-    createAgentEvent('run_started', { origin: 'user' }),
+    createAgentEvent('run_started', { origin: 'runtime' }),
   ]);
   assert.equal(projection.plan, null);
   assert.equal(projection.activities.length, 0);
   assert.equal(projection.status, 'running');
 });
 
+test('reduceAgentEvents: interactive (user) run_started clears state but is not a running run', () => {
+  const projection = reduceAgentEvents([
+    createAgentEvent('plan_set', { origin: 'tool', payload: { steps: ['Old action'] } }),
+    createAgentEvent('run_started', { origin: 'user' }),
+  ]);
+  // An interactive turn clears stale plan/activities but must NOT mark the
+  // projection 'running' — otherwise the graph classifies activeRun=true and
+  // hides Donna's MCP read tools.
+  assert.equal(projection.plan, null);
+  assert.notEqual(projection.status, 'running');
+});
+
 test('reduceAgentEvents: tracks manual plan and step updates', () => {
   const projection = reduceAgentEvents([
     createAgentEvent('plan_set', {

package/src/core/buildInfo.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.12.12",
-  "commit": "e1e43ae"
+  "version": "0.14.1",
+  "commit": "f6e95e4"
 }

package/src/core/mcp.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { managerEnvFile, managerMcpEndpointsFile, readEnvFile } from './env.js';
 
-const WIKI_MANAGER_VERSION = '0.12.12';
+const WIKI_MANAGER_VERSION = '0.14.1';
 
 function envValue(key) {
   const filePath = managerEnvFile();
@@ -43,6 +43,29 @@ function normalizeExternalUrlForRuntime(url) {
   return url;
 }
 
+// Config-driven policy for the /chat read-only toolset — NOT /agent, which has
+// the full toolset and ignores this. The endpoints file's "chatAccess" block
+// declares, per server, which tools /chat may call ("*" or a list), plus a
+// maxToolIterations budget. Operator-owned, agnostic allow-list. Returns null
+// when not configured — then /chat stays a plain, tool-less conversation.
+export function readChatAccessConfig() {
+  const filePath = managerMcpEndpointsFile();
+  if (!existsSync(filePath)) return null;
+  let raw;
+  try { raw = JSON.parse(readFileSync(filePath, 'utf8')); } catch { return null; }
+  const chatAccess = raw?.chatAccess;
+  if (!chatAccess || typeof chatAccess !== 'object' || Array.isArray(chatAccess)) return null;
+  const servers = {};
+  for (const [name, entry] of Object.entries(chatAccess.servers ?? {})) {
+    if (entry?.allow === '*') servers[name] = { allow: '*' };
+    else if (Array.isArray(entry?.allow)) servers[name] = { allow: entry.allow.map(String).filter(Boolean) };
+  }
+  const maxToolIterations = Number.isFinite(Number(chatAccess.maxToolIterations)) && Number(chatAccess.maxToolIterations) > 0
+    ? Math.floor(Number(chatAccess.maxToolIterations))
+    : null;
+  return { maxToolIterations, servers };
+}
+
 function readExternalMcpEndpoints() {
   const filePath = managerMcpEndpointsFile();
   if (!existsSync(filePath)) return {};
@@ -59,6 +82,14 @@ function readExternalMcpEndpoints() {
           url: normalizeExternalUrlForRuntime(interpolateEnv(String(endpoint.url))),
           configuredUrl: interpolateEnv(String(endpoint.url)),
           headers: normalizeHeaders(endpoint.headers),
+          // Tools the endpoint marks approval-gated: Donna may still call them
+          // directly (they are single-step tools), but toolRequiresApproval
+          // makes the call wait for the user's confirmation first (e.g. a
+          // destructive cme_export_run). Agent/operator owned — no hard-coded
+          // business name in the manager.
+          requireApproval: Array.isArray(endpoint.requireApproval)
+            ? endpoint.requireApproval.map(String).filter(Boolean)
+            : undefined,
           external: true,
         },
       ]),
@@ -95,6 +126,9 @@ const DEFAULT_MCP_RETRY_POLICY = {
 };
 
 export function buildMcpStatus(session) {
+  // Attach the /chat read-tool policy to the session alongside MCP status.
+  // Only /chat (repl.js) reads session.chatAccess; /agent ignores it.
+  if (session) session.chatAccess = readChatAccessConfig();
   const workspaceEnv = session.workspaceEnv ?? {};
   const wikiMcpToken = session.wikircConfig?.mcp?.accessKey;
   const wikiMcpDetail = workspaceEnv.WIKI_MCP_PORT
@@ -479,15 +513,22 @@ export function formatMcpToolSummary(mcpStatus) {
   return lines.length > 0 ? lines.join('\n') : 'No connected MCP tools discovered.';
 }
 
-export function formatMcpToolsForAgent(mcpStatus) {
+export function formatMcpToolsForAgent(mcpStatus, { include } = {}) {
   const sections = [];
   for (const [name, value] of Object.entries(mcpStatus ?? {})) {
     if (value.status !== 'connected') continue;
-    const tools = value.tools ?? [];
-    if (tools.length === 0) {
+    const allTools = value.tools ?? [];
+    if (allTools.length === 0) {
       sections.push(`${name}: connected, tools not discovered yet`);
       continue;
     }
+    // Optional filter: callers (e.g. the interactive prompt) advertise only
+    // the tools Donna is actually allowed to call, so a capable model is not
+    // tempted to invoke a mutating provider tool directly instead of delegating.
+    const tools = typeof include === 'function'
+      ? allTools.filter((tool) => include(`${name}__${tool.name}`, tool, name))
+      : allTools;
+    if (tools.length === 0) continue;
     // Always advertise the qualified call name (server__tool): showing bare
     // tool names here is what teaches the model to emit unqualified calls.
     sections.push(`${name}: ${tools.map((tool) => `${name}__${tool.name}`).join(', ')}`);
@@ -502,6 +543,7 @@ export function buildLlmTools(mcpStatus) {
     for (const tool of value.tools ?? []) {
       tools.push({
         type: 'function',
+        readOnly: tool.annotations?.readOnlyHint === true,
         function: {
           name: `${serverName}__${tool.name}`,
           description: clarifyToolDescription(serverName, tool.name, tool.description),