@dotdrelle/wiki-manager 0.14.0 → 0.14.1

package/mcp.endpoints.example.json

@@ -25,5 +25,12 @@
         "Authorization": "Bearer ${DOCUMENTS_MCP_AUTH_TOKEN}"
       }
     }
+  },
+  "chatAccess": {
+    "maxToolIterations": 6,
+    "servers": {
+      "production": { "allow": ["production_job_status", "production_jobs_list"] },
+      "cme":        { "allow": ["cme_status", "cme_sources_list", "cme_export_status"] }
+    }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotdrelle/wiki-manager",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "Agentic shell and orchestration cockpit for llm-wiki workspaces.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "author": "dotrelle",
@@ -11,7 +11,7 @@
   },
   "scripts": {
     "start": "bun ./bin/wiki-manager.js",
-    "test": "node --test src/agent/graph.test.js src/contracts/schemas.test.js src/core/activity.test.js src/core/buildInfo.test.js src/core/agentEvents.test.js src/core/runtimeLog.test.js src/activity/activityAggregator.test.js src/graph/runGraphProjector.test.js src/core/workflow.test.js src/core/planPatch.test.js src/core/agentLoop.test.js src/core/plan.test.js src/core/mcp.test.js src/core/documentIntake.test.js src/core/dockerCompose.test.js src/core/wikiWorkspace.test.js src/core/wikirc.test.js src/core/modelFetch.test.js src/core/startupCheck.test.js src/core/queueStore.test.js src/orchestrator/agentRegistry.test.js src/orchestrator/capabilityRegistry.test.js src/orchestrator/capabilityResolver.test.js src/orchestrator/planValidator.test.js src/orchestrator/planIntegrator.test.js src/orchestrator/scheduler.test.js src/orchestrator/attemptManager.test.js src/orchestrator/resultAggregator.test.js src/orchestrator/approvalPolicy.test.js src/commands/slash.test.js src/shell/repl.test.js src/runtime/store.test.js src/runtime/controlMessages.test.js src/runtime/recoveryManager.test.js src/runtime/server.test.js src/runtime/supervisor.test.js src/runtime/runner.test.js src/runtime/runner.e2e.test.js src/runtime/donna-contract.test.js src/runtime/auth.test.js",
+    "test": "node --test src/agent/graph.test.js src/contracts/schemas.test.js src/core/activity.test.js src/core/buildInfo.test.js src/core/agentEvents.test.js src/core/runtimeLog.test.js src/activity/activityAggregator.test.js src/graph/runGraphProjector.test.js src/core/workflow.test.js src/core/planPatch.test.js src/core/agentLoop.test.js src/core/plan.test.js src/core/mcp.test.js src/core/toolLoop.test.js src/core/documentIntake.test.js src/core/dockerCompose.test.js src/core/wikiWorkspace.test.js src/core/wikirc.test.js src/core/modelFetch.test.js src/core/startupCheck.test.js src/core/queueStore.test.js src/orchestrator/agentRegistry.test.js src/orchestrator/capabilityRegistry.test.js src/orchestrator/capabilityResolver.test.js src/orchestrator/planValidator.test.js src/orchestrator/planIntegrator.test.js src/orchestrator/scheduler.test.js src/orchestrator/attemptManager.test.js src/orchestrator/resultAggregator.test.js src/orchestrator/approvalPolicy.test.js src/commands/slash.test.js src/shell/repl.test.js src/runtime/store.test.js src/runtime/controlMessages.test.js src/runtime/recoveryManager.test.js src/runtime/server.test.js src/runtime/supervisor.test.js src/runtime/runner.test.js src/runtime/runner.e2e.test.js src/runtime/donna-contract.test.js src/runtime/auth.test.js",
     "check-versions": "node scripts/check-versions.js",
     "prepack": "node scripts/check-versions.js",
     "prepublishOnly": "node scripts/check-versions.js",

package/src/agent/graph.js

@@ -711,7 +711,7 @@ async function handleRuntimeControlTool(session, tool, args = {}) {
       if (!objective) return 'Delegation rejected: missing objective.';
       const result = await postRuntimeDelegate(objective, { url, workspace });
       return result?.runId
-        ? `Délégation acceptée (${String(result.runId).slice(0, 8)}) après validation du plan réel : ${result.delegation?.tasks ?? 0} tâche(s), ${result.delegation?.agent ?? 'agent résolu'}. L'approbation porte sur ce plan.`
+        ? `Action lancée (${String(result.runId).slice(0, 8)}) après validation du plan réel : ${result.delegation?.tasks ?? 0} tâche(s), ${result.delegation?.agent ?? 'agent résolu'}. Exécution en cours.`
         : `Délégation refusée : ${result?.error ?? JSON.stringify(result)}`;
     }
     if (tool === 'enqueue') {
@@ -845,10 +845,7 @@ export function buildAgentSystemPrompt(state) {
   // mutating provider tools (e.g. production__production_start_job) here teaches
   // a capable model to invoke them directly and bypass runtime__delegate.
   const mcpTools = formatMcpToolsForAgent(state.session.mcp, {
-    include: (qualifiedName, tool) => isDonnaReadTool({
-      function: { name: qualifiedName },
-      readOnly: tool?.annotations?.readOnlyHint === true,
-    }),
+    include: (qualifiedName) => !isOrchestrationBypassTool(qualifiedName),
   });
   const skills = formatSkillsForAgent(state.session);
   const customPrompt = state.session.systemPrompt ?? null;
@@ -864,7 +861,7 @@ export function buildAgentSystemPrompt(state) {
     `Current wikirc profile: ${wikirc}.`,
     `Available primitives: ${commandList(state.session)}.`,
     'Only announce or call slash commands that appear exactly in Available primitives. Do not invent command names, subcommands, or arguments.',
-    'Connected read-only MCP tools you may call directly to answer questions (server__tool naming convention). Every mutation or action — ingest, build, export, configure, send, write — goes through runtime__delegate, never a direct provider tool call:',
+    'Connected MCP tools you may call directly (server__tool naming convention) — reads AND single-step actions like configuring or adding a connector source, converting a document, sending, or searching. Only the heavy multi-step operations (ingest, build, export, polish, pipeline) go through runtime__delegate to get their parallel plan. Everything listed below is directly callable:',
     mcpTools,
     'Current local MCP job queue:',
     formatQueue(state.session),
@@ -877,7 +874,7 @@ export function buildAgentSystemPrompt(state) {
     'Never add a "Next steps", "Prochaines étapes", "À suivre", options, or suggestions section unless the user explicitly asks what to do next. End after the requested result or the concrete error.',
     'When calling a tool, emit no preliminary narration. Call it directly; the PLAN and Activity panels show progress. After completion, keep the final response concise and proportional to the result.',
     'Keep every response synthetic and information-dense. Use only the lines needed, and never exceed roughly 15 to 20 short lines even for a detailed answer. Never expose internal reasoning, repeated checks, tool-selection commentary, or a chronological diary. Prioritize the result, essential facts, concrete errors, and actual outputs.',
-    'Configuration, connector, import, export, conversion, generation, and every other mutation are actions: delegate the objective to the runtime instead of calling an external tool directly.',
+    'Only the heavy multi-step operations — ingest, build, export, polish, pipeline — are delegated via runtime__delegate (for their DAG and parallelism). Single-step actions — configuring or adding a connector source, converting a document, sending, searching — are called directly on the connected tool. Never call an agent orchestration-contract or plan tool directly.',
     'For any question about the current workspace inventory or what is waiting there, call wiki__wiki_workspace_status first and answer only from its result. This is the canonical read-only workspace state; do not reconstruct it from upload, connector, or production tools.',
     'Tool identifiers are private implementation details. Never print MCP tool names such as server__tool in a user-facing answer. Describe the human result instead.',
     'Never suggest a manual filesystem command or implementation workaround unless the user explicitly asks for manual instructions. For an action request, delegate the objective and let the specialized agent determine paths and operations from its live contract.',
@@ -887,6 +884,7 @@ export function buildAgentSystemPrompt(state) {
     state.session.runtime?.url
       ? 'The runtime is connected and runtime__delegate is bound and available to you right now — it is a tool you call directly, not a slash command or a missing primitive. It is the ONLY way to execute an action (ingest, build, export, configure, send…). Never tell the user that delegation or the runtime is unavailable while it is connected; call runtime__delegate instead.'
       : 'No runtime is connected, so you cannot execute actions. State that plainly and name the runtime connection as the missing capability — do not invent a workaround.',
+    'If the connector or service needed for a requested read or action is absent from the Connected MCP tools above (its service is not running — e.g. CME, documents, or production), say plainly that this service is not connected and name it as the missing capability. Never redirect a simple read (e.g. "give me the CME config") to an "agent action", never invent its result, and never propose a workaround. Only requests you can actually serve with a listed tool are answered with data.',
     'For any requested action, call runtime__delegate with the user objective only. Never choose a capability, operation, agent, plan, or implementation yourself. The runtime resolves the registry and validates the provider plan before accepting. Never call <provider>__agent_plan, <provider>__agent_execute, legacy production__production_start_job, wiki__plan_set, or wiki__plan_done from interactive chat.',
     'Do not ask the user which sources, files, connectors, or templates to use for an ingest, build, or export: the specialized agent discovers them from the workspace. When the objective is clear (e.g. "lance une ingestion"), delegate it as stated, without a clarifying question.',
     'If runtime__delegate returns a blocker or no specialized provider is available, report only that concrete blocker concisely. Never replace the missing execution path with a suggested slash command, skill, MCP tool name, manual file move, administrator escalation, or alternative workflow unless the user explicitly asks for alternatives.',
@@ -944,13 +942,20 @@ function toolsForClassification(classification, writeTools, session = null) {
     return [SHELL_READ_COMMAND_TOOL, ...controlTools];
   }
   if (session?.runtime?.url) {
-    const readTools = writeTools.filter(isDonnaReadTool);
-    return [SHELL_READ_COMMAND_TOOL, ...controlTools, ...capabilityRunTools, ...readTools];
+    // Offer every connected tool directly EXCEPT orchestration-bypass tools
+    // and raw shell write/profile mutation. Reads, configuration, connector
+    // setup — and any newly added MCP's tools — stay directly callable.
+    const directTools = writeTools.filter((item) => {
+      const name = item?.function?.name;
+      if (!name || name === 'shell__run_command' || name === 'shell__profile_update') return false;
+      return !isOrchestrationBypassTool(name);
+    });
+    return [SHELL_READ_COMMAND_TOOL, ...controlTools, ...capabilityRunTools, ...directTools];
   }
   return [SHELL_READ_COMMAND_TOOL, ...controlTools, ...capabilityRunTools, ...writeTools];
 }
 
-function isDonnaReadTool(item) {
+export function isDonnaReadTool(item) {
   const name = String(item?.function?.name ?? '');
   if (!name || name.startsWith('shell__') || name === 'wiki__plan_set' || name === 'wiki__plan_done') return false;
   if (item?.readOnly === true) return true;
@@ -961,6 +966,24 @@ function isDonnaReadTool(item) {
     || /(?:^|_)(?:status|list|search|read|get)$/.test(tool);
 }
 
+// Two-tier tool policy. Donna may call any connected MCP tool directly
+// (reads AND plain writes: cme_setup, connector setup, document conversion,
+// send, search, and anything a newly added MCP exposes) EXCEPT the small set
+// that must go through the runtime's orchestration: the universal five-tool
+// contract executors (agent_plan/agent_execute), the legacy job starter, and
+// direct plan mutation. Heavy multi-step work (ingest/build/export via the
+// production agent) is delegated for its DAG/parallelism; plain single-step
+// tools are called directly. This is a blocklist, not a whitelist, so adding a
+// new MCP never silently disables its tools.
+function isOrchestrationBypassTool(name) {
+  const full = String(name ?? '');
+  if (!full) return true;
+  if (full === 'wiki__plan_set' || full === 'wiki__plan_done') return true;
+  const sep = full.indexOf('__');
+  const tool = sep === -1 ? full : full.slice(sep + 2);
+  return tool === 'agent_plan' || tool === 'agent_execute' || tool === 'production_start_job';
+}
+
 function isReadOnlyMcpCall(session, server, tool) {
   const descriptor = (session?.mcp?.[server]?.tools ?? [])
     .find((item) => String(item?.name ?? '') === tool || String(item?.name ?? '').endsWith(`__${tool}`));

package/src/cli/wiki-manager.js

@@ -847,6 +847,15 @@ async function runRuntime(argv, agent) {
           throw new Error(`Delegated plan integration failed: ${(integrated.errors ?? []).map((error) => error.message ?? error.code ?? String(error)).join('; ')}`);
         }
         emitRuntimeLog(session, `delegation: ${prepared.fragment.tasks.length} validated task(s) integrated from ${prepared.provider.serverName}.agent_plan (${prepared.capability}/${prepared.operation})`);
+        // Demandé = consenti: a directly-delegated run carries the user's
+        // explicit consent, so auto-approve its initial plan. Persisting a
+        // run-scope grant (via the approval manager) makes the scheduler's
+        // readyTasks approval check pass, so the tasks run without re-prompting.
+        // Replanned tasks are integrated later without a fresh grant.
+        if (context.approvalManager?.approve) {
+          context.approvalManager.approve({ scope: 'run', runId });
+          emitRuntimeLog(session, `approval: run ${runId} auto-approved (user-requested action)`);
+        }
         body._planReady?.resolve?.({ runId, planRevision: session.agentProjection?.planRevision ?? 0 });
       }
       // Deterministic capability run (/ingest): ask the capable agent for its

package/src/core/agentEvents.js

@@ -196,7 +196,13 @@ export function applyAgentProjectionToSession(session, projection) {
 function applyEvent(state, event) {
   switch (event.type) {
     case 'run_started':
-      state.status = 'running';
+      // Only a real runtime run (origin 'runtime') marks the projection
+      // 'running'. An interactive turn (origin 'user') is NOT a run: forcing
+      // 'running' here made the graph classify activeRun=true and hide Donna's
+      // MCP read tools (cme_status, wiki_workspace_status…), so questions about
+      // MCP state failed. Preserve the existing status (idle, or a genuinely
+      // active runtime run synced from the runtime) for interactive turns.
+      if (event.origin === 'runtime') state.status = 'running';
       state.plan = null;
       state.chain = [];
       state.activities = {};

package/src/core/agentEvents.test.js

@@ -20,13 +20,25 @@ test('reduceAgentEvents: run_started clears stale plan', () => {
       origin: 'tool',
       payload: { steps: ['Old action'] },
     }),
-    createAgentEvent('run_started', { origin: 'user' }),
+    createAgentEvent('run_started', { origin: 'runtime' }),
   ]);
   assert.equal(projection.plan, null);
   assert.equal(projection.activities.length, 0);
   assert.equal(projection.status, 'running');
 });
 
+test('reduceAgentEvents: interactive (user) run_started clears state but is not a running run', () => {
+  const projection = reduceAgentEvents([
+    createAgentEvent('plan_set', { origin: 'tool', payload: { steps: ['Old action'] } }),
+    createAgentEvent('run_started', { origin: 'user' }),
+  ]);
+  // An interactive turn clears stale plan/activities but must NOT mark the
+  // projection 'running' — otherwise the graph classifies activeRun=true and
+  // hides Donna's MCP read tools.
+  assert.equal(projection.plan, null);
+  assert.notEqual(projection.status, 'running');
+});
+
 test('reduceAgentEvents: tracks manual plan and step updates', () => {
   const projection = reduceAgentEvents([
     createAgentEvent('plan_set', {

package/src/core/buildInfo.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.14.0",
-  "commit": "fb0b915"
+  "version": "0.14.1",
+  "commit": "f6e95e4"
 }

package/src/core/mcp.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { managerEnvFile, managerMcpEndpointsFile, readEnvFile } from './env.js';
 
-const WIKI_MANAGER_VERSION = '0.14.0';
+const WIKI_MANAGER_VERSION = '0.14.1';
 
 function envValue(key) {
   const filePath = managerEnvFile();
@@ -43,6 +43,29 @@ function normalizeExternalUrlForRuntime(url) {
   return url;
 }
 
+// Config-driven policy for the /chat read-only toolset — NOT /agent, which has
+// the full toolset and ignores this. The endpoints file's "chatAccess" block
+// declares, per server, which tools /chat may call ("*" or a list), plus a
+// maxToolIterations budget. Operator-owned, agnostic allow-list. Returns null
+// when not configured — then /chat stays a plain, tool-less conversation.
+export function readChatAccessConfig() {
+  const filePath = managerMcpEndpointsFile();
+  if (!existsSync(filePath)) return null;
+  let raw;
+  try { raw = JSON.parse(readFileSync(filePath, 'utf8')); } catch { return null; }
+  const chatAccess = raw?.chatAccess;
+  if (!chatAccess || typeof chatAccess !== 'object' || Array.isArray(chatAccess)) return null;
+  const servers = {};
+  for (const [name, entry] of Object.entries(chatAccess.servers ?? {})) {
+    if (entry?.allow === '*') servers[name] = { allow: '*' };
+    else if (Array.isArray(entry?.allow)) servers[name] = { allow: entry.allow.map(String).filter(Boolean) };
+  }
+  const maxToolIterations = Number.isFinite(Number(chatAccess.maxToolIterations)) && Number(chatAccess.maxToolIterations) > 0
+    ? Math.floor(Number(chatAccess.maxToolIterations))
+    : null;
+  return { maxToolIterations, servers };
+}
+
 function readExternalMcpEndpoints() {
   const filePath = managerMcpEndpointsFile();
   if (!existsSync(filePath)) return {};
@@ -59,6 +82,14 @@ function readExternalMcpEndpoints() {
           url: normalizeExternalUrlForRuntime(interpolateEnv(String(endpoint.url))),
           configuredUrl: interpolateEnv(String(endpoint.url)),
           headers: normalizeHeaders(endpoint.headers),
+          // Tools the endpoint marks approval-gated: Donna may still call them
+          // directly (they are single-step tools), but toolRequiresApproval
+          // makes the call wait for the user's confirmation first (e.g. a
+          // destructive cme_export_run). Agent/operator owned — no hard-coded
+          // business name in the manager.
+          requireApproval: Array.isArray(endpoint.requireApproval)
+            ? endpoint.requireApproval.map(String).filter(Boolean)
+            : undefined,
           external: true,
         },
       ]),
@@ -95,6 +126,9 @@ const DEFAULT_MCP_RETRY_POLICY = {
 };
 
 export function buildMcpStatus(session) {
+  // Attach the /chat read-tool policy to the session alongside MCP status.
+  // Only /chat (repl.js) reads session.chatAccess; /agent ignores it.
+  if (session) session.chatAccess = readChatAccessConfig();
   const workspaceEnv = session.workspaceEnv ?? {};
   const wikiMcpToken = session.wikircConfig?.mcp?.accessKey;
   const wikiMcpDetail = workspaceEnv.WIKI_MCP_PORT

package/src/core/toolLoop.js

@@ -0,0 +1,56 @@
+// Minimal, side-effect-free bounded tool-use loop.
+//
+// This is the shared mechanic of "ask the LLM with a tool set, run the tool
+// calls it emits, feed results back, repeat up to a cap". The caller injects
+// the ONLY policy that varies: `executeCall(call) -> string` decides whether a
+// requested tool is allowed and produces its textual result (allow-list check,
+// MCP dispatch, error formatting). The loop itself owns no plan, no delegation,
+// no run identity and no agent events — deliberately unlike the /agent
+// orchestration loop in createAgentGraph, which is a stateful LangGraph node
+// graph and stays separate. Use this for stateless tool-answer turns (e.g.
+// /chat read-only questions).
+//
+// `executeCall` may throw to abort the whole loop (e.g. an AbortError on
+// cancel); anything it returns is treated as the tool result for that call.
+export async function runBoundedToolLoop({
+  llm,
+  system,
+  messages,
+  tools,
+  executeCall,
+  maxIterations = 4,
+  signal,
+  onStep,
+} = {}) {
+  const cap = Math.max(1, Math.floor(maxIterations) || 1);
+  const convo = [...(messages ?? [])];
+  for (let i = 0; i < cap; i += 1) {
+    onStep?.(i + 1, cap);
+    const result = await llm.completeWithTools({
+      system,
+      tools,
+      messages: convo,
+      toolChoice: 'auto',
+      signal,
+    });
+    const calls = result?.tool_calls ?? [];
+    if (calls.length === 0) {
+      return {
+        content: result?.content ?? result?.message?.content ?? '',
+        iterations: i + 1,
+        capped: false,
+      };
+    }
+    convo.push(result.message ?? { role: 'assistant', content: result.content ?? '', tool_calls: calls });
+    // Tool calls within one turn are independent: dispatch concurrently, then
+    // replay results in the model's call order so the transcript stays stable.
+    const outcomes = await Promise.all(calls.map(async (call) => ({
+      tool_call_id: call.id,
+      content: await executeCall(call),
+    })));
+    for (const outcome of outcomes) {
+      convo.push({ role: 'tool', tool_call_id: outcome.tool_call_id, content: outcome.content });
+    }
+  }
+  return { content: '', iterations: cap, capped: true };
+}

package/src/core/toolLoop.test.js

@@ -0,0 +1,88 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { runBoundedToolLoop } from './toolLoop.js';
+
+function toolCall(id, name, args = '{}') {
+  return { id, function: { name, arguments: args } };
+}
+
+test('returns the model answer directly when no tool is called', async () => {
+  const llm = {
+    async completeWithTools() {
+      return { content: 'plain answer', tool_calls: [] };
+    },
+  };
+  const out = await runBoundedToolLoop({ llm, tools: [], executeCall: async () => 'unused' });
+  assert.deepEqual(out, { content: 'plain answer', iterations: 1, capped: false });
+});
+
+test('dispatches a tool call, feeds the result back, then returns the final answer', async () => {
+  let round = 0;
+  const seen = [];
+  const llm = {
+    async completeWithTools({ messages }) {
+      round += 1;
+      if (round === 1) return { message: { role: 'assistant', content: '', tool_calls: [toolCall('c1', 'cme__cme_status')] }, tool_calls: [toolCall('c1', 'cme__cme_status')] };
+      seen.push(messages.find((m) => m.role === 'tool')?.content);
+      return { content: 'configured', tool_calls: [] };
+    },
+  };
+  const out = await runBoundedToolLoop({
+    llm,
+    tools: [{ function: { name: 'cme__cme_status' } }],
+    executeCall: async (call) => `RESULT(${call.function.name})`,
+  });
+  assert.equal(out.content, 'configured');
+  assert.equal(out.iterations, 2);
+  assert.equal(out.capped, false);
+  assert.deepEqual(seen, ['RESULT(cme__cme_status)']);
+});
+
+test('runs concurrent tool calls and replays results in call order', async () => {
+  let round = 0;
+  const order = [];
+  const llm = {
+    async completeWithTools({ messages }) {
+      round += 1;
+      if (round === 1) {
+        const calls = [toolCall('a', 's__list'), toolCall('b', 's__status')];
+        return { message: { role: 'assistant', content: '', tool_calls: calls }, tool_calls: calls };
+      }
+      order.push(...messages.filter((m) => m.role === 'tool').map((m) => m.tool_call_id));
+      return { content: 'done', tool_calls: [] };
+    },
+  };
+  const out = await runBoundedToolLoop({
+    llm,
+    tools: [],
+    executeCall: async (call) => call.id,
+  });
+  assert.equal(out.content, 'done');
+  assert.deepEqual(order, ['a', 'b']); // preserved model call order
+});
+
+test('reports capped when the model keeps calling tools past the cap', async () => {
+  const llm = {
+    async completeWithTools() {
+      const calls = [toolCall('x', 's__status')];
+      return { message: { role: 'assistant', content: '', tool_calls: calls }, tool_calls: calls };
+    },
+  };
+  const out = await runBoundedToolLoop({ llm, tools: [], executeCall: async () => 'r', maxIterations: 3 });
+  assert.equal(out.capped, true);
+  assert.equal(out.iterations, 3);
+});
+
+test('propagates an abort thrown by executeCall', async () => {
+  const llm = {
+    async completeWithTools() {
+      const calls = [toolCall('x', 's__status')];
+      return { message: { role: 'assistant', content: '', tool_calls: calls }, tool_calls: calls };
+    },
+  };
+  const abort = Object.assign(new Error('aborted'), { name: 'AbortError' });
+  await assert.rejects(
+    runBoundedToolLoop({ llm, tools: [], executeCall: async () => { throw abort; } }),
+    /aborted/,
+  );
+});

package/src/runtime/lifecycle.js

@@ -1,5 +1,6 @@
 import { execFile, spawn } from 'node:child_process';
-import { dirname, resolve } from 'node:path';
+import { readdirSync, statSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { activeCacertPath } from '../core/cacert.js';
 import { checkRuntimeHealth, postRuntimeShutdown, runtimeUrlFromEnv } from './client.js';
@@ -10,6 +11,26 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const managerRoot = resolve(__dirname, '../..');
 const binPath = resolve(managerRoot, 'bin/wiki-manager.js');
 
+// Newest mtime (ms) of the manager's own source tree. Used to detect that the
+// code was edited after a reused runtime started, so ensureRuntime can restart
+// it instead of serving stale code. Returns 0 if the source tree is unreadable
+// (e.g. running from a packed install) — in that case staleness is not checked.
+function newestManagerSourceMtimeMs() {
+  const srcDir = join(managerRoot, 'src');
+  let newest = 0;
+  try {
+    for (const entry of readdirSync(srcDir, { recursive: true })) {
+      const name = String(entry);
+      if (!(name.endsWith('.js') || name.endsWith('.ts') || name.endsWith('.tsx'))) continue;
+      try {
+        const mtime = statSync(join(srcDir, name)).mtimeMs;
+        if (mtime > newest) newest = mtime;
+      } catch { /* file vanished mid-scan */ }
+    }
+  } catch { return 0; }
+  return newest;
+}
+
 export function runtimeNodeExecutable() {
   return process.versions.bun
     ? (process.env.WIKI_MANAGER_NODE_BIN ?? 'node')
@@ -47,13 +68,22 @@ export async function ensureRuntime({
   if (existing) {
     const expectedCacertPath = activeCacertPath();
     const actualCacertPath = existing.cacertPath ? resolve(existing.cacertPath) : null;
+    // Dev staleness: if the manager source was edited after this runtime
+    // started, the reused process would keep serving old code (the recurring
+    // "my change is not taking effect" trap). Treat it as stale and restart.
+    // Packed installs report mtime 0 (unreadable src) → never flagged stale.
+    // Opt out with WIKI_MANAGER_RUNTIME_NO_STALE_CHECK=1.
+    const startedAtMs = Number(existing.startedAtMs) || 0;
+    const sourceMtimeMs = process.env.WIKI_MANAGER_RUNTIME_NO_STALE_CHECK === '1' ? 0 : newestManagerSourceMtimeMs();
+    const stale = startedAtMs > 0 && sourceMtimeMs > startedAtMs;
     // forceRestart: the caller knows the manager configuration just changed
     // (e.g. mcp.endpoints.json scaffolded on first run) — a runtime started
     // BEFORE that only knows the old endpoints and would keep answering
     // without the agents until manually restarted.
-    if (!forceRestart && actualCacertPath === expectedCacertPath) {
+    if (!forceRestart && !stale && actualCacertPath === expectedCacertPath) {
       return { url, started: false, health: existing, token: auth.token, tokenPath: auth.tokenPath };
     }
+    if (stale) console.error('runtime: source changed since start — restarting for fresh code.');
     await postRuntimeShutdown({ url, token: auth.token });
     await waitForRuntimeShutdown(url, auth.token, 2500);
   }

package/src/runtime/server.js

@@ -25,6 +25,9 @@ export function startRuntimeServer({
   exitOnShutdown = process.env.WIKI_MANAGER_RUNTIME_CHILD === '1',
 } = {}) {
   const clients = new Set();
+  // When this runtime process started — used by ensureRuntime to detect that
+  // the manager source has been edited since (dev staleness) and auto-restart.
+  const runtimeStartedAtMs = Date.now();
   const defaultContext = { workspace: null, session, running: false, currentAbortController: null, currentRunId: null };
   const resolvedGetContext = getContext ?? (() => defaultContext);
 
@@ -62,6 +65,7 @@ export function startRuntimeServer({
           status: context?.running ? 'running' : 'idle',
           workspace: context?.workspace ?? workspace ?? null,
           activeRuns,
+          startedAtMs: runtimeStartedAtMs,
           dbPath: store.dbPath,
           cacertPath: activeCacertPath(),
           nodeExtraCaCerts: process.env.NODE_EXTRA_CA_CERTS ?? null,

package/src/shell/repl.js

@@ -5,12 +5,13 @@ import { execFileSync } from 'node:child_process';
 import { stdin as input, stdout as output } from 'node:process';
 import { marked } from 'marked';
 import { markedTerminal } from 'marked-terminal';
-import { buildAgentSystemPrompt, formatLlmUnavailableMessage } from '../agent/graph.js';
+import { buildAgentSystemPrompt, formatLlmUnavailableMessage, isDonnaReadTool } from '../agent/graph.js';
 import { handleSlashCommand } from '../commands/slash.js';
 import { serviceDescription, serviceNames as composeServiceNames } from '../core/compose.js';
 import { extractActivity, parseJsonText, sessionActivities } from '../core/activity.js';
 import { syncActivitiesToPlan } from '../core/plan.js';
-import { callMcpTool, formatMcpToolResult } from '../core/mcp.js';
+import { buildLlmTools, callMcpTool, formatMcpToolResult, parseToolCallName, resolveToolCallName } from '../core/mcp.js';
+import { runBoundedToolLoop } from '../core/toolLoop.js';
 import { createAgentEvent, dispatchAgentEvent } from '../core/agentEvents.js';
 import { listSkills } from '../core/skills.js';
 import { listWikircProfiles } from '../core/wikirc.js';
@@ -285,15 +286,37 @@ function isDonnaRole(role) {
   return role === 'donna' || role === LEGACY_DONNA_ROLE;
 }
 
+// Read-only MCP tools exposed to /chat. The operator declares which tools per
+// server in the `chatAccess` config (mcp.endpoints.json). /chat is extended to
+// those tools ONLY, filtered through the same read-only test Donna's /agent
+// mode uses (isDonnaReadTool), and only when their server is connected — so
+// /chat can answer live state questions ("le CME est-il configuré ?") but can
+// never mutate or delegate. Actions still belong to /agent, which has all tools.
+export function chatReadTools(session) {
+  const servers = session?.chatAccess?.servers;
+  if (!servers) return [];
+  const scopedMcp = Object.fromEntries(
+    Object.entries(session.mcp ?? {}).filter(([name]) => Object.hasOwn(servers, name)),
+  );
+  return buildLlmTools(scopedMcp).filter((item) => {
+    const { server, tool } = parseToolCallName(item.function.name);
+    const entry = servers[server];
+    const declared = entry.allow === '*' ? true : (Array.isArray(entry.allow) && entry.allow.includes(tool));
+    return declared && isDonnaReadTool(item);
+  });
+}
+
 function buildDirectChatSystemPrompt(session) {
   const workspace = session.workspace ?? 'no workspace selected';
   const wikirc = session.wikirc?.profile ?? 'no profile loaded';
   const language = session.language ?? 'en-US';
   return [
     'You are Donna, the llm-wiki-manager chat assistant.',
-    'Answer directly and concisely. Do not claim to have called tools or changed files.',
+    'You have a small READ-ONLY toolset — the tools provided to you for this turn, which may be none. Use them to answer questions about live state (e.g. "le CME est-il configuré", "quelles pages sont en attente"), and answer only from their results.',
+    'If no provided tool covers the request — or the request is an action or mutation (ingest, build, export, configure, send, delete…), or needs a service that is not connected — say plainly you cannot do it in chat mode and to switch to agent mode (/agent). Do not pretend to execute it and never guess.',
+    'Answer directly and concisely. Do not claim to have called tools or changed files beyond the tools actually provided.',
     'Never add a "Next steps", "Prochaines étapes", "À suivre", options, or suggestions section unless the user explicitly asks what to do next. End after answering the question.',
-    'If the user asks for an action that needs workspace commands, MCP tools, services, files, or mutations, say to ask as an agent action instead of pretending to execute it.',
+    'Never invent a tool name, command, job id, status, or result (e.g. do not fabricate names like "check_cme_configuration"). If you cannot know something with the tools you were given, say so.',
     `Reply language: ${language}.`,
     `Current workspace: ${workspace}.`,
     `Current wikirc profile: ${wikirc}.`,
@@ -1164,6 +1187,49 @@ async function runAgentTurn(input, { agent, session, onUpdate, onStep, displayIn
   return {};
 }
 
+// Bounded read-only tool loop for /chat. Only the tools declared in chatAccess
+// (and read-only) are offered; every call goes through callMcpTool, and any
+// tool the model names outside the offered set is refused — /chat can never
+// mutate or delegate. maxToolIterations caps the loop.
+async function runChatReadToolLoop({ input, session, history, donnaMessage, onUpdate, onStep, readTools }) {
+  const allowed = new Set(readTools.map((item) => item.function.name));
+  // /chat only supplies the policy; the loop mechanic lives in runBoundedToolLoop.
+  // executeCall enforces the allow-list and turns each call into a text result;
+  // it never mutates and refuses anything outside the offered read set.
+  const executeCall = async (call) => {
+    const rawName = call.function?.name ?? '';
+    const { server, tool } = resolveToolCallName(session.mcp, rawName);
+    const qualified = server ? `${server}__${tool}` : null;
+    if (!qualified || !allowed.has(qualified)) {
+      return `Refused: "${rawName}" is not an available read-only tool in chat mode. Actions and other tools live in agent mode (/agent).`;
+    }
+    let args = {};
+    try { args = call.function?.arguments ? JSON.parse(call.function.arguments) : {}; } catch { args = {}; }
+    try {
+      onStep?.(`Chat: read ${server} ${tool}…`);
+      const res = await callMcpTool(session.mcp, server, tool, args, session._abortSignal);
+      return formatMcpToolResult(res);
+    } catch (err) {
+      if (err.name === 'AbortError' && session._abortSignal?.aborted) throw err;
+      return `Error [${qualified}]: ${err instanceof Error ? err.message : String(err)}`;
+    }
+  };
+  const { content, capped } = await runBoundedToolLoop({
+    llm: session.llm,
+    system: buildDirectChatSystemPrompt(session),
+    messages: [...history, { role: 'user', content: input }],
+    tools: readTools,
+    executeCall,
+    maxIterations: Math.min(8, Number(session?.chatAccess?.maxToolIterations) || 4),
+    signal: session._abortSignal,
+    onStep: (i, cap) => onStep?.(`Chat: consulting… [${i}/${cap}]`),
+  });
+  donnaMessage.content = capped
+    ? 'Je n’ai pas pu conclure dans la limite d’itérations du mode chat. Passe en /agent si besoin.'
+    : (stripDsmlArtifacts(content).trimEnd() || formatLlmUnavailableMessage('reponse vide'));
+  onUpdate?.();
+}
+
 async function runDirectChatTurn(input, { session, onUpdate, onStep }) {
   if (!session.llm?.stream) {
     conversationMessages(session).push({ role: 'command', content: directChatUnavailableText(session) });
@@ -1176,24 +1242,30 @@ async function runDirectChatTurn(input, { session, onUpdate, onStep }) {
   const donnaMessage = { role: 'donna', content: '' };
   messages.push(donnaMessage);
   onUpdate?.();
+  const readTools = chatReadTools(session);
+  const canUseReadTools = readTools.length > 0 && typeof session.llm.completeWithTools === 'function';
   try {
-    onStep?.('Chat: streaming direct answer…');
-    for await (const delta of session.llm.stream({
-      system: buildDirectChatSystemPrompt(session),
-      messages: [...history, { role: 'user', content: input }],
-      signal: session._abortSignal,
-    })) {
-      const cleanDelta = stripDsmlArtifacts(delta);
-      if (cleanDelta) {
-        donnaMessage.content += cleanDelta;
+    if (canUseReadTools) {
+      await runChatReadToolLoop({ input, session, history, donnaMessage, onUpdate, onStep, readTools });
+    } else {
+      onStep?.('Chat: streaming direct answer…');
+      for await (const delta of session.llm.stream({
+        system: buildDirectChatSystemPrompt(session),
+        messages: [...history, { role: 'user', content: input }],
+        signal: session._abortSignal,
+      })) {
+        const cleanDelta = stripDsmlArtifacts(delta);
+        if (cleanDelta) {
+          donnaMessage.content += cleanDelta;
+          onUpdate?.();
+        }
+      }
+      donnaMessage.content = stripDsmlArtifacts(donnaMessage.content).trimEnd();
+      if (!donnaMessage.content.trim()) {
+        donnaMessage.content = formatLlmUnavailableMessage('flux vide');
         onUpdate?.();
       }
     }
-    donnaMessage.content = stripDsmlArtifacts(donnaMessage.content).trimEnd();
-    if (!donnaMessage.content.trim()) {
-      donnaMessage.content = formatLlmUnavailableMessage('flux vide');
-      onUpdate?.();
-    }
   } catch (err) {
     if (err.name === 'AbortError') {
       messages.pop();

package/src/shell/repl.test.js

@@ -5,6 +5,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import {
   applyRuntimeStateToShellSession,
+  chatReadTools,
   createSession,
   conversationMessages,
   recordRuntimeUnavailableAgentInput,
@@ -373,3 +374,72 @@ test('submitRuntimeRun sends a control message instead of /run while a run is ac
     restore();
   }
 });
+
+test('chatReadTools exposes only declared, read-only MCP tools to /chat', () => {
+  const session = {
+    chatAccess: {
+      servers: {
+        cme: { allow: ['cme_status', 'cme_sources_list', 'cme_export_run'] },
+      },
+    },
+    mcp: {
+      cme: {
+        status: 'connected',
+        tools: [
+          { name: 'cme_status', inputSchema: { type: 'object', properties: {} } },
+          { name: 'cme_sources_list', inputSchema: { type: 'object', properties: {} } },
+          { name: 'cme_setup', inputSchema: { type: 'object', properties: {} } },
+          { name: 'cme_export_run', inputSchema: { type: 'object', properties: {} } },
+        ],
+      },
+      documents: {
+        status: 'connected',
+        tools: [{ name: 'documents_status', inputSchema: { type: 'object', properties: {} } }],
+      },
+    },
+  };
+  const names = chatReadTools(session).map((item) => item.function.name).sort();
+  // cme_setup: not declared. cme_export_run: declared but a write (excluded by
+  // the read-only guard). documents_status: server absent from chatAccess.
+  assert.deepEqual(names, ['cme__cme_sources_list', 'cme__cme_status']);
+});
+
+test('chatReadTools is empty when no chatAccess is configured', () => {
+  const session = { mcp: { cme: { status: 'connected', tools: [{ name: 'cme_status', inputSchema: {} }] } } };
+  assert.deepEqual(chatReadTools(session), []);
+});
+
+test('/chat uses the tool-capable path when read tools are declared', async () => {
+  const session = createSession();
+  session.chatMode = true;
+  session.chatAccess = { maxToolIterations: 4, servers: { cme: { allow: ['cme_status'] } } };
+  session.mcp = { cme: { status: 'connected', tools: [{ name: 'cme_status', inputSchema: { type: 'object', properties: {} } }] } };
+  let usedComplete = false;
+  session.llm = {
+    async *stream() { yield 'STREAM_FALLBACK'; },
+    async completeWithTools() {
+      usedComplete = true;
+      return { tool_calls: [], content: 'Réponse via outils.', message: { role: 'assistant', content: 'Réponse via outils.' } };
+    },
+  };
+  await runLine('le cme est-il configuré', { session, chatMode: true });
+  const last = conversationMessages(session).at(-1);
+  assert.ok(usedComplete, 'completeWithTools path was taken');
+  assert.match(last.content, /Réponse via outils/);
+  assert.doesNotMatch(last.content, /STREAM_FALLBACK/);
+});
+
+test('/chat falls back to the plain stream when no read tools are declared', async () => {
+  const session = createSession();
+  session.chatMode = true;
+  session.chatAccess = null;
+  session.mcp = {};
+  session.llm = {
+    async *stream() { yield 'PLAIN_STREAM'; },
+    async completeWithTools() { return { tool_calls: [], content: 'SHOULD_NOT_APPEAR' }; },
+  };
+  await runLine('bonjour', { session, chatMode: true });
+  const last = conversationMessages(session).at(-1);
+  assert.match(last.content, /PLAIN_STREAM/);
+  assert.doesNotMatch(last.content, /SHOULD_NOT_APPEAR/);
+});