@dotdrelle/wiki-manager 0.12.12 → 0.14.1

package/src/shell/repl.js

@@ -5,12 +5,13 @@ import { execFileSync } from 'node:child_process';
 import { stdin as input, stdout as output } from 'node:process';
 import { marked } from 'marked';
 import { markedTerminal } from 'marked-terminal';
-import { buildAgentSystemPrompt, classifyAgentInput, formatLlmUnavailableMessage } from '../agent/graph.js';
+import { buildAgentSystemPrompt, formatLlmUnavailableMessage, isDonnaReadTool } from '../agent/graph.js';
 import { handleSlashCommand } from '../commands/slash.js';
 import { serviceDescription, serviceNames as composeServiceNames } from '../core/compose.js';
 import { extractActivity, parseJsonText, sessionActivities } from '../core/activity.js';
 import { syncActivitiesToPlan } from '../core/plan.js';
-import { callMcpTool, formatMcpToolResult } from '../core/mcp.js';
+import { buildLlmTools, callMcpTool, formatMcpToolResult, parseToolCallName, resolveToolCallName } from '../core/mcp.js';
+import { runBoundedToolLoop } from '../core/toolLoop.js';
 import { createAgentEvent, dispatchAgentEvent } from '../core/agentEvents.js';
 import { listSkills } from '../core/skills.js';
 import { listWikircProfiles } from '../core/wikirc.js';
@@ -285,14 +286,37 @@ function isDonnaRole(role) {
   return role === 'donna' || role === LEGACY_DONNA_ROLE;
 }
 
+// Read-only MCP tools exposed to /chat. The operator declares which tools per
+// server in the `chatAccess` config (mcp.endpoints.json). /chat is extended to
+// those tools ONLY, filtered through the same read-only test Donna's /agent
+// mode uses (isDonnaReadTool), and only when their server is connected — so
+// /chat can answer live state questions ("le CME est-il configuré ?") but can
+// never mutate or delegate. Actions still belong to /agent, which has all tools.
+export function chatReadTools(session) {
+  const servers = session?.chatAccess?.servers;
+  if (!servers) return [];
+  const scopedMcp = Object.fromEntries(
+    Object.entries(session.mcp ?? {}).filter(([name]) => Object.hasOwn(servers, name)),
+  );
+  return buildLlmTools(scopedMcp).filter((item) => {
+    const { server, tool } = parseToolCallName(item.function.name);
+    const entry = servers[server];
+    const declared = entry.allow === '*' ? true : (Array.isArray(entry.allow) && entry.allow.includes(tool));
+    return declared && isDonnaReadTool(item);
+  });
+}
+
 function buildDirectChatSystemPrompt(session) {
   const workspace = session.workspace ?? 'no workspace selected';
   const wikirc = session.wikirc?.profile ?? 'no profile loaded';
   const language = session.language ?? 'en-US';
   return [
     'You are Donna, the llm-wiki-manager chat assistant.',
-    'Answer directly and concisely. Do not claim to have called tools or changed files.',
-    'If the user asks for an action that needs workspace commands, MCP tools, services, files, or mutations, say to ask as an agent action instead of pretending to execute it.',
+    'You have a small READ-ONLY toolset — the tools provided to you for this turn, which may be none. Use them to answer questions about live state (e.g. "le CME est-il configuré", "quelles pages sont en attente"), and answer only from their results.',
+    'If no provided tool covers the request — or the request is an action or mutation (ingest, build, export, configure, send, delete…), or needs a service that is not connected — say plainly you cannot do it in chat mode and to switch to agent mode (/agent). Do not pretend to execute it and never guess.',
+    'Answer directly and concisely. Do not claim to have called tools or changed files beyond the tools actually provided.',
+    'Never add a "Next steps", "Prochaines étapes", "À suivre", options, or suggestions section unless the user explicitly asks what to do next. End after answering the question.',
+    'Never invent a tool name, command, job id, status, or result (e.g. do not fabricate names like "check_cme_configuration"). If you cannot know something with the tools you were given, say so.',
     `Reply language: ${language}.`,
     `Current workspace: ${workspace}.`,
     `Current wikirc profile: ${wikirc}.`,
@@ -774,18 +798,21 @@ function rememberProductionActivity(session, payload) {
 
 export function applyRuntimeStateToShellSession(session, state) {
   if (!state || typeof state !== 'object') return false;
+  const displayState = sanitizeRuntimeStateForDisplay(state);
   session.agentProjection = {
-    conversation: Array.isArray(state.conversation) ? state.conversation.map((message) => ({ ...message })) : [],
-    chain: Array.isArray(state.chain) ? state.chain.map((step) => ({ ...step })) : [],
-    plan: Array.isArray(state.plan) ? state.plan.map((step) => ({ ...step })) : null,
-    activities: Array.isArray(state.activities) ? state.activities.map((activity) => ({ ...activity })) : [],
-    logs: Array.isArray(state.logs) ? [...state.logs] : [],
-    summary: state.summary ?? null,
-    status: state.status ?? 'idle',
-    planRevision: state.planRevision ?? 0,
-    planPatches: Array.isArray(state.planPatches) ? state.planPatches.map((patch) => ({ ...patch })) : [],
+    conversation: Array.isArray(displayState.conversation) ? displayState.conversation.map((message) => ({ ...message })) : [],
+    chain: Array.isArray(displayState.chain) ? displayState.chain.map((step) => ({ ...step })) : [],
+    plan: Array.isArray(displayState.plan) && displayState.plan.length > 0
+      ? displayState.plan.map((step) => ({ ...step }))
+      : null,
+    activities: Array.isArray(displayState.activities) ? displayState.activities.map((activity) => ({ ...activity })) : [],
+    logs: Array.isArray(displayState.logs) ? [...displayState.logs] : [],
+    summary: displayState.summary ?? null,
+    status: displayState.status ?? 'idle',
+    planRevision: displayState.planRevision ?? 0,
+    planPatches: Array.isArray(displayState.planPatches) ? displayState.planPatches.map((patch) => ({ ...patch })) : [],
   };
-  session.workflow = state.workflow && typeof state.workflow === 'object'
+  session.workflow = displayState.workflow && typeof displayState.workflow === 'object'
     ? {
         ...state.workflow,
         nodes: Array.isArray(state.workflow.nodes) ? state.workflow.nodes.map((node) => ({ ...node })) : [],
@@ -803,7 +830,7 @@ export function applyRuntimeStateToShellSession(session, state) {
   // Runtime queue items replace the local jobQueue wholesale on every sync.
   // Tag their origin so /queue cancel can refuse to fake-cancel them locally
   // (a local status flip would be silently reverted by the next SSE sync).
-  if (Array.isArray(state.queue)) session.jobQueue = state.queue.map((item) => ({ ...item, origin: 'runtime' }));
+  if (Array.isArray(displayState.queue)) session.jobQueue = displayState.queue.map((item) => ({ ...item, origin: 'runtime' }));
   const production = session.agentProjection.activities.filter((activity) => activity.source === 'production').at(-1);
   if (production) {
     session.productionActivity = {
@@ -817,21 +844,29 @@ export function applyRuntimeStateToShellSession(session, state) {
   return true;
 }
 
-// Submits a prompt to the shared runtime. If the workspace is already busy
-// (HTTP 409 from POST /run), route the input through the runtime control lane
-// so status questions and plan-change proposals do not become future runs.
-// A plain question or small talk must never start a runtime run (nor be
-// enqueued as a future one): it only needs an answer. Route converse/observe
-// to the local agent EVEN during an active run — the chat is supposed to stay
-// available, and the graph already restricts tools to read-only in that case.
-// Actions/cancels/approvals still go to the runtime.
-export function shouldHandleFreeTextLocally(line, session, { llmAvailable = Boolean(session?.llm) } = {}) {
-  const classification = classifyAgentInput(line, session);
-  // cancel intents included: Donna interprets "supprime le job et la queue"
-  // and calls runtime__kill / runtime__cancel herself — no hardcoded regex
-  // deciding between soft and hard stop. The control lane remains the
-  // deterministic fallback when the local LLM is down.
-  if (!['converse', 'observe', 'cancel', 'approve', 'enqueue_run', 'ambiguous'].includes(classification.kind)) return { local: false, classification };
+export function sanitizeRuntimeStateForDisplay(state) {
+  if (!state || typeof state !== 'object') return state;
+  const status = String(state.status ?? 'idle').toLowerCase();
+  const visible = ['running', 'queued', 'pending', 'waiting', 'pending_approval', 'error', 'failed']
+    .includes(status);
+  if (visible) return state;
+  return {
+    ...state,
+    conversation: [],
+    chain: [],
+    plan: [],
+    activities: [],
+    workflow: null,
+    logs: [],
+    summary: null,
+    planPatches: [],
+  };
+}
+
+// In agent mode, Donna receives every free-text turn and decides whether to
+// answer or call an exposed tool. Slash commands remain the deterministic UI.
+export function shouldHandleFreeTextLocally(_line, session, { llmAvailable = Boolean(session?.llm) } = {}) {
+  const classification = { kind: 'agent_turn', confidence: 1, reason: 'agent_mode_llm_decision' };
   if (!llmAvailable) return { local: false, classification, fallbackReason: 'local LLM unavailable' };
   return { local: true, classification };
 }
@@ -1049,17 +1084,12 @@ async function runAgentTurn(input, { agent, session, onUpdate, onStep, displayIn
   };
   session._onStreamReset = () => {
     if (!donnaMessage) return;
-    if (donnaMessage.content.trim()) {
-      // Intermediate streamed text before tool calls: keep it, add separator.
-      donnaMessage.content += '\n\n';
-      onUpdate?.();
-    } else {
-      // Still empty ("Thinking…"): remove it cleanly.
-      const index = messages.indexOf(donnaMessage);
-      if (index !== -1) messages.splice(index, 1);
-      donnaMessage = null;
-      onUpdate?.();
-    }
+    // Text emitted before a tool call is provisional narration, not an answer.
+    // Remove it; the post-tool result gets a fresh Donna bubble.
+    const index = messages.indexOf(donnaMessage);
+    if (index !== -1) messages.splice(index, 1);
+    donnaMessage = null;
+    onUpdate?.();
   };
 
   let agentResult;
@@ -1157,6 +1187,49 @@ async function runAgentTurn(input, { agent, session, onUpdate, onStep, displayIn
   return {};
 }
 
+// Bounded read-only tool loop for /chat. Only the tools declared in chatAccess
+// (and read-only) are offered; every call goes through callMcpTool, and any
+// tool the model names outside the offered set is refused — /chat can never
+// mutate or delegate. maxToolIterations caps the loop.
+async function runChatReadToolLoop({ input, session, history, donnaMessage, onUpdate, onStep, readTools }) {
+  const allowed = new Set(readTools.map((item) => item.function.name));
+  // /chat only supplies the policy; the loop mechanic lives in runBoundedToolLoop.
+  // executeCall enforces the allow-list and turns each call into a text result;
+  // it never mutates and refuses anything outside the offered read set.
+  const executeCall = async (call) => {
+    const rawName = call.function?.name ?? '';
+    const { server, tool } = resolveToolCallName(session.mcp, rawName);
+    const qualified = server ? `${server}__${tool}` : null;
+    if (!qualified || !allowed.has(qualified)) {
+      return `Refused: "${rawName}" is not an available read-only tool in chat mode. Actions and other tools live in agent mode (/agent).`;
+    }
+    let args = {};
+    try { args = call.function?.arguments ? JSON.parse(call.function.arguments) : {}; } catch { args = {}; }
+    try {
+      onStep?.(`Chat: read ${server} ${tool}…`);
+      const res = await callMcpTool(session.mcp, server, tool, args, session._abortSignal);
+      return formatMcpToolResult(res);
+    } catch (err) {
+      if (err.name === 'AbortError' && session._abortSignal?.aborted) throw err;
+      return `Error [${qualified}]: ${err instanceof Error ? err.message : String(err)}`;
+    }
+  };
+  const { content, capped } = await runBoundedToolLoop({
+    llm: session.llm,
+    system: buildDirectChatSystemPrompt(session),
+    messages: [...history, { role: 'user', content: input }],
+    tools: readTools,
+    executeCall,
+    maxIterations: Math.min(8, Number(session?.chatAccess?.maxToolIterations) || 4),
+    signal: session._abortSignal,
+    onStep: (i, cap) => onStep?.(`Chat: consulting… [${i}/${cap}]`),
+  });
+  donnaMessage.content = capped
+    ? 'Je n’ai pas pu conclure dans la limite d’itérations du mode chat. Passe en /agent si besoin.'
+    : (stripDsmlArtifacts(content).trimEnd() || formatLlmUnavailableMessage('reponse vide'));
+  onUpdate?.();
+}
+
 async function runDirectChatTurn(input, { session, onUpdate, onStep }) {
   if (!session.llm?.stream) {
     conversationMessages(session).push({ role: 'command', content: directChatUnavailableText(session) });
@@ -1169,24 +1242,30 @@ async function runDirectChatTurn(input, { session, onUpdate, onStep }) {
   const donnaMessage = { role: 'donna', content: '' };
   messages.push(donnaMessage);
   onUpdate?.();
+  const readTools = chatReadTools(session);
+  const canUseReadTools = readTools.length > 0 && typeof session.llm.completeWithTools === 'function';
   try {
-    onStep?.('Chat: streaming direct answer…');
-    for await (const delta of session.llm.stream({
-      system: buildDirectChatSystemPrompt(session),
-      messages: [...history, { role: 'user', content: input }],
-      signal: session._abortSignal,
-    })) {
-      const cleanDelta = stripDsmlArtifacts(delta);
-      if (cleanDelta) {
-        donnaMessage.content += cleanDelta;
+    if (canUseReadTools) {
+      await runChatReadToolLoop({ input, session, history, donnaMessage, onUpdate, onStep, readTools });
+    } else {
+      onStep?.('Chat: streaming direct answer…');
+      for await (const delta of session.llm.stream({
+        system: buildDirectChatSystemPrompt(session),
+        messages: [...history, { role: 'user', content: input }],
+        signal: session._abortSignal,
+      })) {
+        const cleanDelta = stripDsmlArtifacts(delta);
+        if (cleanDelta) {
+          donnaMessage.content += cleanDelta;
+          onUpdate?.();
+        }
+      }
+      donnaMessage.content = stripDsmlArtifacts(donnaMessage.content).trimEnd();
+      if (!donnaMessage.content.trim()) {
+        donnaMessage.content = formatLlmUnavailableMessage('flux vide');
         onUpdate?.();
       }
     }
-    donnaMessage.content = stripDsmlArtifacts(donnaMessage.content).trimEnd();
-    if (!donnaMessage.content.trim()) {
-      donnaMessage.content = formatLlmUnavailableMessage('flux vide');
-      onUpdate?.();
-    }
   } catch (err) {
     if (err.name === 'AbortError') {
       messages.pop();

package/src/shell/repl.test.js

@@ -5,16 +5,45 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import {
   applyRuntimeStateToShellSession,
+  chatReadTools,
   createSession,
   conversationMessages,
   recordRuntimeUnavailableAgentInput,
   runLine,
+  sanitizeRuntimeStateForDisplay,
   runtimeStatusLine,
   runtimeUnavailableAgentMessage,
   shouldHandleFreeTextLocally,
   submitRuntimeRun,
 } from './repl.js';
 
+test('runtime display preserves a failed plan and its diagnostic evidence', () => {
+  const state = {
+    status: 'error',
+    plan: [{ id: 'apply', status: 'failed' }],
+    activities: [{ id: 'job-1', status: 'failed', error: 'exitCode=1' }],
+    logs: ['run_error: ingest_apply exitCode=1'],
+    conversation: [{ role: 'assistant', content: 'Échec de l’ingestion.' }],
+  };
+
+  assert.equal(sanitizeRuntimeStateForDisplay(state), state);
+});
+
+test('runtime display still clears completed historical execution state', () => {
+  const display = sanitizeRuntimeStateForDisplay({
+    status: 'done',
+    plan: [{ id: 'old', status: 'done' }],
+    activities: [{ id: 'old-job', status: 'done' }],
+    logs: ['old log'],
+    conversation: [{ role: 'assistant', content: 'Old run.' }],
+  });
+
+  assert.deepEqual(display.plan, []);
+  assert.deepEqual(display.activities, []);
+  assert.deepEqual(display.logs, []);
+  assert.deepEqual(display.conversation, []);
+});
+
 function stubFetch(handler) {
   const original = globalThis.fetch;
   globalThis.fetch = handler;
@@ -74,6 +103,50 @@ test('applyRuntimeStateToShellSession projects runtime state into shell session'
   assert.deepEqual(conversationMessages(session), []);
 });
 
+test('applyRuntimeStateToShellSession clears terminal plan and activities when runtime is idle', () => {
+  const session = createSession();
+  session.headlessPlan = [{ step: 1, description: 'Old read', status: 'failed' }];
+  session.activities = { old: { key: 'old', status: 'failed', terminal: true } };
+
+  applyRuntimeStateToShellSession(session, {
+    status: 'idle',
+    conversation: [{ role: 'assistant', content: 'Old failed answer' }],
+    chain: [{ id: 'old-step' }],
+    plan: [{ step: 1, description: 'Old read', status: 'failed' }],
+    activities: [{ key: 'old', status: 'failed', terminal: true }],
+    workflow: { nodes: [{ id: 'task:old' }], relations: [] },
+    logs: ['Runtime evaluator rejected the old run'],
+    summary: 'Old run failed',
+    planPatches: [{ id: 'old-patch' }],
+  });
+
+  assert.equal(session.headlessPlan, null);
+  assert.deepEqual(session.activities, {});
+  assert.equal(session.workflow, null);
+  assert.deepEqual(session.agentProjection.logs, []);
+  assert.equal(session.agentProjection.summary, null);
+  assert.deepEqual(session.agentProjection.conversation, []);
+  assert.deepEqual(session.agentProjection.chain, []);
+  assert.deepEqual(session.agentProjection.planPatches, []);
+});
+
+test('direct chat system prompt forbids unsolicited next steps', async () => {
+  const session = createSession();
+  let systemPrompt = '';
+  session.llm = {
+    async *stream({ system }) {
+      systemPrompt = system;
+      yield 'Réponse concise.';
+    },
+  };
+
+  await runLine('bonjour', { agent: null, packageJson: { version: 'test' }, session, chatMode: true });
+
+  assert.match(systemPrompt, /Never add a "Next steps", "Prochaines étapes", "À suivre"/);
+  assert.match(systemPrompt, /unless the user explicitly asks what to do next/);
+  assert.equal(conversationMessages(session).at(-1).content, 'Réponse concise.');
+});
+
 test('submitRuntimeRun reports acceptance without throwing', async () => {
   const restore = stubFetch(async (url) => {
     assert.equal(pathOf(url), '/run');
@@ -241,37 +314,34 @@ test('/queue cancel on a runtime workflow id points to run cancellation commands
   assert.match(conversationMessages(session).at(-1).content, /\/run kill/);
 });
 
-test('free text routing keeps questions local and sends actions to the runtime', () => {
+test('agent mode sends every free-text turn to Donna', () => {
   const session = createSession();
   session.llm = { completeWithTools: () => {} };
 
-  // The original incident: a config question must never start a run.
   const question = shouldHandleFreeTextLocally('donne moi la config du cme', session);
   assert.equal(question.local, true);
-  assert.equal(question.classification.kind, 'observe');
+  assert.equal(question.classification.kind, 'agent_turn');
 
   const smallTalk = shouldHandleFreeTextLocally('bonjour', session);
   assert.equal(smallTalk.local, true);
 
   const action = shouldHandleFreeTextLocally('lance le pipeline complet', session);
-  assert.equal(action.local, false);
-  assert.equal(action.classification.kind, 'start_run');
+  assert.equal(action.local, true);
+  assert.equal(action.classification.kind, 'agent_turn');
+
+  const pending = shouldHandleFreeTextLocally('as ton des fichier en attente d ingestion', session);
+  assert.equal(pending.local, true);
+  assert.equal(pending.classification.kind, 'agent_turn');
 });
 
-test('free text routing keeps questions local even during an active run', () => {
-  // The chat must stay available during a run: a status question or small
-  // talk answered locally (read-only tools) — never enqueued as a future run.
+test('Donna keeps receiving free text during an active run', () => {
   const session = createSession();
   session.llm = { completeWithTools: () => {} };
   session.agentProjection = { status: 'running', activities: [], conversation: [] };
   assert.equal(shouldHandleFreeTextLocally('où en est le run', session).local, true);
   assert.equal(shouldHandleFreeTextLocally('salut', session).local, true);
-  // Cancel intents are handled by Donna locally (runtime__kill/cancel tools);
-  // approvals stay on the deterministic control lane.
   assert.equal(shouldHandleFreeTextLocally('stop le job', session).local, true);
   assert.equal(shouldHandleFreeTextLocally('supprime le job et la queue', session).local, true);
-  // Approvals and "later" requests too: Donna owns runtime__approve and
-  // runtime__enqueue. Only plan modifications and new runs bypass her.
   assert.equal(shouldHandleFreeTextLocally('approuve le run', session).local, true);
   assert.equal(shouldHandleFreeTextLocally('fais le build plus tard', session).local, true);
 
@@ -304,3 +374,72 @@ test('submitRuntimeRun sends a control message instead of /run while a run is ac
     restore();
   }
 });
+
+test('chatReadTools exposes only declared, read-only MCP tools to /chat', () => {
+  const session = {
+    chatAccess: {
+      servers: {
+        cme: { allow: ['cme_status', 'cme_sources_list', 'cme_export_run'] },
+      },
+    },
+    mcp: {
+      cme: {
+        status: 'connected',
+        tools: [
+          { name: 'cme_status', inputSchema: { type: 'object', properties: {} } },
+          { name: 'cme_sources_list', inputSchema: { type: 'object', properties: {} } },
+          { name: 'cme_setup', inputSchema: { type: 'object', properties: {} } },
+          { name: 'cme_export_run', inputSchema: { type: 'object', properties: {} } },
+        ],
+      },
+      documents: {
+        status: 'connected',
+        tools: [{ name: 'documents_status', inputSchema: { type: 'object', properties: {} } }],
+      },
+    },
+  };
+  const names = chatReadTools(session).map((item) => item.function.name).sort();
+  // cme_setup: not declared. cme_export_run: declared but a write (excluded by
+  // the read-only guard). documents_status: server absent from chatAccess.
+  assert.deepEqual(names, ['cme__cme_sources_list', 'cme__cme_status']);
+});
+
+test('chatReadTools is empty when no chatAccess is configured', () => {
+  const session = { mcp: { cme: { status: 'connected', tools: [{ name: 'cme_status', inputSchema: {} }] } } };
+  assert.deepEqual(chatReadTools(session), []);
+});
+
+test('/chat uses the tool-capable path when read tools are declared', async () => {
+  const session = createSession();
+  session.chatMode = true;
+  session.chatAccess = { maxToolIterations: 4, servers: { cme: { allow: ['cme_status'] } } };
+  session.mcp = { cme: { status: 'connected', tools: [{ name: 'cme_status', inputSchema: { type: 'object', properties: {} } }] } };
+  let usedComplete = false;
+  session.llm = {
+    async *stream() { yield 'STREAM_FALLBACK'; },
+    async completeWithTools() {
+      usedComplete = true;
+      return { tool_calls: [], content: 'Réponse via outils.', message: { role: 'assistant', content: 'Réponse via outils.' } };
+    },
+  };
+  await runLine('le cme est-il configuré', { session, chatMode: true });
+  const last = conversationMessages(session).at(-1);
+  assert.ok(usedComplete, 'completeWithTools path was taken');
+  assert.match(last.content, /Réponse via outils/);
+  assert.doesNotMatch(last.content, /STREAM_FALLBACK/);
+});
+
+test('/chat falls back to the plain stream when no read tools are declared', async () => {
+  const session = createSession();
+  session.chatMode = true;
+  session.chatAccess = null;
+  session.mcp = {};
+  session.llm = {
+    async *stream() { yield 'PLAIN_STREAM'; },
+    async completeWithTools() { return { tool_calls: [], content: 'SHOULD_NOT_APPEAR' }; },
+  };
+  await runLine('bonjour', { session, chatMode: true });
+  const last = conversationMessages(session).at(-1);
+  assert.match(last.content, /PLAIN_STREAM/);
+  assert.doesNotMatch(last.content, /SHOULD_NOT_APPEAR/);
+});

package/src/shell/useSession.ts

@@ -17,6 +17,7 @@ import {
   conversationMessages,
   createSession,
   runtimeUnavailableAgentMessage,
+  sanitizeRuntimeStateForDisplay,
 } from './repl.js';
 import { useAgent } from './useAgent';
 
@@ -340,10 +341,20 @@ export function useSession(props: { agent: unknown; packageJson: Record<string,
   function mergeRuntimeConversation(state: any) {
     const workspace = (session as any).workspace || '__global__';
     const runtimeConversation = Array.isArray(state?.conversation) ? state.conversation : [];
-    if (runtimeConversation.length === 0) return;
     const target = conversationMessages(session);
     const backed = runtimeConversationRefsByWorkspace.get(workspace) ?? [];
     runtimeConversationRefsByWorkspace.set(workspace, backed);
+    if (runtimeConversation.length === 0) {
+      // Idle runtime display state deliberately has no historical run
+      // conversation. Remove only entries previously merged from that
+      // runtime; preserve local slash-command output and the current input.
+      for (const entry of backed) {
+        const index = target.indexOf(entry);
+        if (index !== -1) target.splice(index, 1);
+      }
+      backed.length = 0;
+      return;
+    }
     // The merge is index-aligned with the runtime conversation array. If that
     // array got SHORTER (runtime restart, projection reset), keeping stale
     // refs would make every new runtime entry silently overwrite an old
@@ -388,8 +399,9 @@ export function useSession(props: { agent: unknown; packageJson: Record<string,
   function syncRuntimeState() {
     void fetchRuntimeState({ url: props.runtime.url, workspace: (session as any).workspace ?? null })
       .then((state) => {
-        setRuntimeState(state);
-        mergeRuntimeConversation(state);
+        const displayState = sanitizeRuntimeStateForDisplay(state);
+        setRuntimeState(displayState);
+        mergeRuntimeConversation(displayState);
         setRuntimeStatus('connected');
         refresh();
       })