@dotdrelle/wiki-manager 0.14.0 → 0.14.2

package/mcp.endpoints.example.json

@@ -25,5 +25,12 @@
         "Authorization": "Bearer ${DOCUMENTS_MCP_AUTH_TOKEN}"
       }
     }
+  },
+  "chatAccess": {
+    "maxToolIterations": 6,
+    "servers": {
+      "production": { "allow": ["production_job_status", "production_jobs_list"] },
+      "cme":        { "allow": ["cme_status", "cme_sources_list", "cme_export_status"] }
+    }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotdrelle/wiki-manager",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "Agentic shell and orchestration cockpit for llm-wiki workspaces.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "author": "dotrelle",
@@ -11,7 +11,7 @@
   },
   "scripts": {
     "start": "bun ./bin/wiki-manager.js",
-    "test": "node --test src/agent/graph.test.js src/contracts/schemas.test.js src/core/activity.test.js src/core/buildInfo.test.js src/core/agentEvents.test.js src/core/runtimeLog.test.js src/activity/activityAggregator.test.js src/graph/runGraphProjector.test.js src/core/workflow.test.js src/core/planPatch.test.js src/core/agentLoop.test.js src/core/plan.test.js src/core/mcp.test.js src/core/documentIntake.test.js src/core/dockerCompose.test.js src/core/wikiWorkspace.test.js src/core/wikirc.test.js src/core/modelFetch.test.js src/core/startupCheck.test.js src/core/queueStore.test.js src/orchestrator/agentRegistry.test.js src/orchestrator/capabilityRegistry.test.js src/orchestrator/capabilityResolver.test.js src/orchestrator/planValidator.test.js src/orchestrator/planIntegrator.test.js src/orchestrator/scheduler.test.js src/orchestrator/attemptManager.test.js src/orchestrator/resultAggregator.test.js src/orchestrator/approvalPolicy.test.js src/commands/slash.test.js src/shell/repl.test.js src/runtime/store.test.js src/runtime/controlMessages.test.js src/runtime/recoveryManager.test.js src/runtime/server.test.js src/runtime/supervisor.test.js src/runtime/runner.test.js src/runtime/runner.e2e.test.js src/runtime/donna-contract.test.js src/runtime/auth.test.js",
+    "test": "node --test src/agent/graph.test.js src/contracts/schemas.test.js src/core/activity.test.js src/core/buildInfo.test.js src/core/agentEvents.test.js src/core/runtimeLog.test.js src/activity/activityAggregator.test.js src/graph/runGraphProjector.test.js src/core/workflow.test.js src/core/planPatch.test.js src/core/agentLoop.test.js src/core/plan.test.js src/core/mcp.test.js src/core/toolLoop.test.js src/core/documentIntake.test.js src/core/dockerCompose.test.js src/core/wikiWorkspace.test.js src/core/wikirc.test.js src/core/modelFetch.test.js src/core/startupCheck.test.js src/core/queueStore.test.js src/orchestrator/agentRegistry.test.js src/orchestrator/capabilityRegistry.test.js src/orchestrator/capabilityResolver.test.js src/orchestrator/planValidator.test.js src/orchestrator/planIntegrator.test.js src/orchestrator/scheduler.test.js src/orchestrator/attemptManager.test.js src/orchestrator/resultAggregator.test.js src/orchestrator/approvalPolicy.test.js src/commands/slash.test.js src/shell/repl.test.js src/runtime/store.test.js src/runtime/controlMessages.test.js src/runtime/recoveryManager.test.js src/runtime/server.test.js src/runtime/supervisor.test.js src/runtime/runner.test.js src/runtime/runner.e2e.test.js src/runtime/donna-contract.test.js src/runtime/auth.test.js",
     "check-versions": "node scripts/check-versions.js",
     "prepack": "node scripts/check-versions.js",
     "prepublishOnly": "node scripts/check-versions.js",

package/src/agent/graph.js

@@ -711,7 +711,7 @@ async function handleRuntimeControlTool(session, tool, args = {}) {
       if (!objective) return 'Delegation rejected: missing objective.';
       const result = await postRuntimeDelegate(objective, { url, workspace });
       return result?.runId
-        ? `Délégation acceptée (${String(result.runId).slice(0, 8)}) après validation du plan réel : ${result.delegation?.tasks ?? 0} tâche(s), ${result.delegation?.agent ?? 'agent résolu'}. L'approbation porte sur ce plan.`
+        ? `Action lancée (${String(result.runId).slice(0, 8)}) après validation du plan réel : ${result.delegation?.tasks ?? 0} tâche(s), ${result.delegation?.agent ?? 'agent résolu'}. Exécution en cours.`
         : `Délégation refusée : ${result?.error ?? JSON.stringify(result)}`;
     }
     if (tool === 'enqueue') {
@@ -845,17 +845,14 @@ export function buildAgentSystemPrompt(state) {
   // mutating provider tools (e.g. production__production_start_job) here teaches
   // a capable model to invoke them directly and bypass runtime__delegate.
   const mcpTools = formatMcpToolsForAgent(state.session.mcp, {
-    include: (qualifiedName, tool) => isDonnaReadTool({
-      function: { name: qualifiedName },
-      readOnly: tool?.annotations?.readOnlyHint === true,
-    }),
+    include: (qualifiedName) => !isOrchestrationBypassTool(qualifiedName),
   });
   const skills = formatSkillsForAgent(state.session);
   const customPrompt = state.session.systemPrompt ?? null;
   const workspaceProfile = loadWorkspaceProfile(state.session.workspacePath);
 
   const agentContext = [
-    'You are Donna, the terminal orchestrator agent for llm-wiki-manager.',
+    'You are Donna: first and foremost a warm, helpful assistant for the llm-wiki-manager team, who also happens to orchestrate the workspace behind the scenes. Orchestration is how you help — it is not your personality. Speak like an attentive human colleague: natural, friendly, plain-spoken. Never sound like a raw status dump or a machine reciting fields.',
     'The shell is agent-first: every input without a leading slash is routed to you.',
     'Default to a plain conversational reply with no tool call. Only call a tool, create a plan, or start a job when the user\'s message clearly requests an action (ingest, build, export, configure, run a skill, check a concrete status, etc.). Greetings, small talk, thanks, and general questions do not warrant starting a job or calling a tool — just answer in text.',
     'Commands starting with / are deterministic primitives. You may run a safe subset through shell__run_command.',
@@ -864,7 +861,7 @@ export function buildAgentSystemPrompt(state) {
     `Current wikirc profile: ${wikirc}.`,
     `Available primitives: ${commandList(state.session)}.`,
     'Only announce or call slash commands that appear exactly in Available primitives. Do not invent command names, subcommands, or arguments.',
-    'Connected read-only MCP tools you may call directly to answer questions (server__tool naming convention). Every mutation or action — ingest, build, export, configure, send, write — goes through runtime__delegate, never a direct provider tool call:',
+    'Connected MCP tools you may call directly (server__tool naming convention) — reads AND single-step actions like configuring or adding a connector source, converting a document, sending, or searching. Only the heavy multi-step operations (ingest, build, export, polish, pipeline) go through runtime__delegate to get their parallel plan. Everything listed below is directly callable:',
     mcpTools,
     'Current local MCP job queue:',
     formatQueue(state.session),
@@ -873,13 +870,14 @@ export function buildAgentSystemPrompt(state) {
     'In interactive agent mode you may call only the read-only tools and runtime control/delegation tools actually provided to you.',
     'When the user asks for an action that can be performed with connected MCP tools or safe primitives, do not answer with future intent such as "I will call...", "I am going to run...", or "launching..." unless you also call the tool in the same turn. Either call the tool now, ask for the exact missing required arguments, or explain the concrete blocker.',
     'Execution truthfulness: never invent a job id, status, percentage, duration, generated file, file content, URL, command, or tool result. An action is executed only when you call an available tool and receive its result. Examples and placeholders are forbidden in execution reports.',
-    'After any completed action, give a short factual summary based only on the tool result: outcome and concrete outputs or references actually returned. Mention a viewing primitive only when it exists in Available primitives and is relevant. Do not interpret generated content, propose verification checklists, invent next steps, or suggest commands unless the user explicitly asks.',
-    'Never add a "Next steps", "Prochaines étapes", "À suivre", options, or suggestions section unless the user explicitly asks what to do next. End after the requested result or the concrete error.',
+    'After any completed action, give a short factual summary based only on the tool result: outcome and concrete outputs or references actually returned. Mention a viewing primitive only when it exists in Available primitives and is relevant. Never invent results, interpret generated content beyond what the tool returned, or fabricate a verification checklist.',
+    'You are in AGENT mode, so you can actually act. You MAY close with ONE short, natural follow-up — a single sentence phrased as an offer, and only when it genuinely helps and is an action you can perform right here (delegate it or call a tool), e.g. "Want me to start ingesting these pages?" (phrased in the reply language). This is what makes you feel like an assistant rather than a readout. Only offer what you can truly do in agent mode — never an offer that would require another mode. Keep it to that one line: never produce a "Next steps"/"Prochaines étapes"/"À suivre" list, a checklist, an options menu, or commands for the user to type. If nothing useful naturally follows, simply stop after the answer — do not pad.',
     'When calling a tool, emit no preliminary narration. Call it directly; the PLAN and Activity panels show progress. After completion, keep the final response concise and proportional to the result.',
-    'Keep every response synthetic and information-dense. Use only the lines needed, and never exceed roughly 15 to 20 short lines even for a detailed answer. Never expose internal reasoning, repeated checks, tool-selection commentary, or a chronological diary. Prioritize the result, essential facts, concrete errors, and actual outputs.',
-    'Configuration, connector, import, export, conversion, generation, and every other mutation are actions: delegate the objective to the runtime instead of calling an external tool directly.',
+    'Write the way a thoughtful colleague speaks: warm, plain, and to the point. For a simple factual question, 1 to 3 sentences is the sweet spot. Stay synthetic and information-dense — use only the lines needed, and never exceed roughly 15 to 20 short lines even for a detailed answer. Never expose internal reasoning, repeated checks, tool-selection commentary, or a chronological diary. Prioritize the result, essential facts, concrete errors, and actual outputs — but say them in human language, not as a field dump.',
+    'Only the heavy multi-step operations — ingest, build, export, polish, pipeline — are delegated via runtime__delegate (for their DAG and parallelism). Single-step actions — configuring or adding a connector source, converting a document, sending, searching — are called directly on the connected tool. Never call an agent orchestration-contract or plan tool directly.',
     'For any question about the current workspace inventory or what is waiting there, call wiki__wiki_workspace_status first and answer only from its result. This is the canonical read-only workspace state; do not reconstruct it from upload, connector, or production tools.',
     'Tool identifiers are private implementation details. Never print MCP tool names such as server__tool in a user-facing answer. Describe the human result instead.',
+    'Internal data shapes are private too. Never quote raw JSON field names (e.g. pendingSources.files), internal directory paths (e.g. raw/untracked/), or config keys in a user-facing answer — translate them into plain language. Say "36 pages sources sont en attente d\'ingestion", not the field or path they came from.',
     'Never suggest a manual filesystem command or implementation workaround unless the user explicitly asks for manual instructions. For an action request, delegate the objective and let the specialized agent determine paths and operations from its live contract.',
     'Skills are documentation only in this stabilized version. Never execute a skill from conversation; delegate the user objective.',
     'For service actions, recommend only available service primitives from Available primitives, with the exact service name when the primitive supports one.',
@@ -887,8 +885,10 @@ export function buildAgentSystemPrompt(state) {
     state.session.runtime?.url
       ? 'The runtime is connected and runtime__delegate is bound and available to you right now — it is a tool you call directly, not a slash command or a missing primitive. It is the ONLY way to execute an action (ingest, build, export, configure, send…). Never tell the user that delegation or the runtime is unavailable while it is connected; call runtime__delegate instead.'
       : 'No runtime is connected, so you cannot execute actions. State that plainly and name the runtime connection as the missing capability — do not invent a workaround.',
+    'If the connector or service needed for a requested read or action is absent from the Connected MCP tools above (its service is not running — e.g. CME, documents, or production), say plainly that this service is not connected and name it as the missing capability. Never redirect a simple read (e.g. "give me the CME config") to an "agent action", never invent its result, and never propose a workaround. Only requests you can actually serve with a listed tool are answered with data.',
     'For any requested action, call runtime__delegate with the user objective only. Never choose a capability, operation, agent, plan, or implementation yourself. The runtime resolves the registry and validates the provider plan before accepting. Never call <provider>__agent_plan, <provider>__agent_execute, legacy production__production_start_job, wiki__plan_set, or wiki__plan_done from interactive chat.',
     'Do not ask the user which sources, files, connectors, or templates to use for an ingest, build, or export: the specialized agent discovers them from the workspace. When the objective is clear (e.g. "lance une ingestion"), delegate it as stated, without a clarifying question.',
+    'Promise only what the resolved capability actually exposes in its declared contract (the input schema the specialized agent publishes for that capability). When the user requests an execution parameter — a batch or chunk size, a count "N at a time", concurrency, ordering, priority, or any tuning knob — apply it only if that parameter exists in the target capability\'s published input schema. Otherwise do not confirm or promise it: delegate the objective, and if the user explicitly asked for that parameter, say plainly in one line that you started the work but do not control that aspect (the runtime and the specialized agent decide it). Never state or imply a parameter was applied when the agent contract cannot enforce it.',
     'If runtime__delegate returns a blocker or no specialized provider is available, report only that concrete blocker concisely. Never replace the missing execution path with a suggested slash command, skill, MCP tool name, manual file move, administrator escalation, or alternative workflow unless the user explicitly asks for alternatives.',
     'For workspace inventory and page listings, use the connected wiki MCP read tools. Never invent or call a /wiki shell command through shell__run_command. Use /workspace init <name> [path] for low-level non-interactive workspace creation; in the interactive TUI, /new <name> opens the setup wizard.',
     'If an action requires tools or skills not available yet, explain the limitation and name the expected primitive.',
@@ -896,6 +896,7 @@ export function buildAgentSystemPrompt(state) {
       ? `Workspace profile (.wiki/profile.md) — durable user preferences, apply these to every reply (tone, tutoiement/vouvoiement, formatting, etc.):\n${workspaceProfile}`
       : null,
     'Runtime control: you have runtime__status, runtime__cancel, runtime__kill, runtime__approve and runtime__enqueue. When the user asks to stop, remove, clean or kill the current run, its jobs or the queue ("supprime le job et la queue", "arr\u00eate tout"), call runtime__kill (or runtime__cancel for a soft stop of just the run) and confirm what was stopped. For questions about what is running or queued, call runtime__status and answer from its data. When the user consents to a pending approval in any phrasing ("vas-y", "ok pour l\'export"), call runtime__approve. When the user asks for a NEW action while a run is active, do not execute it: propose runtime__enqueue (run it after) or, if they insist it replaces the current work, runtime__kill then the new action.',
+    'Report every runtime control outcome exactly as the tool returned it \u2014 never embellish. If runtime__kill reports 0 run(s)/0 task(s)/0 purged, say there was nothing active to stop or purge; do NOT claim a run, plan, pending approval or queue item was removed. If runtime__status returns an error or could not be read, say the runtime state could not be retrieved and do not describe a state you never obtained. Never assert that something was cleaned, cancelled, approved or purged unless that specific tool result confirms it.',
     'Durable profile updates are actions in this stabilized version: delegate them instead of writing directly.',
   ].filter(Boolean).join('\n');
 
@@ -944,13 +945,20 @@ function toolsForClassification(classification, writeTools, session = null) {
     return [SHELL_READ_COMMAND_TOOL, ...controlTools];
   }
   if (session?.runtime?.url) {
-    const readTools = writeTools.filter(isDonnaReadTool);
-    return [SHELL_READ_COMMAND_TOOL, ...controlTools, ...capabilityRunTools, ...readTools];
+    // Offer every connected tool directly EXCEPT orchestration-bypass tools
+    // and raw shell write/profile mutation. Reads, configuration, connector
+    // setup — and any newly added MCP's tools — stay directly callable.
+    const directTools = writeTools.filter((item) => {
+      const name = item?.function?.name;
+      if (!name || name === 'shell__run_command' || name === 'shell__profile_update') return false;
+      return !isOrchestrationBypassTool(name);
+    });
+    return [SHELL_READ_COMMAND_TOOL, ...controlTools, ...capabilityRunTools, ...directTools];
   }
   return [SHELL_READ_COMMAND_TOOL, ...controlTools, ...capabilityRunTools, ...writeTools];
 }
 
-function isDonnaReadTool(item) {
+export function isDonnaReadTool(item) {
   const name = String(item?.function?.name ?? '');
   if (!name || name.startsWith('shell__') || name === 'wiki__plan_set' || name === 'wiki__plan_done') return false;
   if (item?.readOnly === true) return true;
@@ -961,6 +969,24 @@ function isDonnaReadTool(item) {
     || /(?:^|_)(?:status|list|search|read|get)$/.test(tool);
 }
 
+// Two-tier tool policy. Donna may call any connected MCP tool directly
+// (reads AND plain writes: cme_setup, connector setup, document conversion,
+// send, search, and anything a newly added MCP exposes) EXCEPT the small set
+// that must go through the runtime's orchestration: the universal five-tool
+// contract executors (agent_plan/agent_execute), the legacy job starter, and
+// direct plan mutation. Heavy multi-step work (ingest/build/export via the
+// production agent) is delegated for its DAG/parallelism; plain single-step
+// tools are called directly. This is a blocklist, not a whitelist, so adding a
+// new MCP never silently disables its tools.
+function isOrchestrationBypassTool(name) {
+  const full = String(name ?? '');
+  if (!full) return true;
+  if (full === 'wiki__plan_set' || full === 'wiki__plan_done') return true;
+  const sep = full.indexOf('__');
+  const tool = sep === -1 ? full : full.slice(sep + 2);
+  return tool === 'agent_plan' || tool === 'agent_execute' || tool === 'production_start_job';
+}
+
 function isReadOnlyMcpCall(session, server, tool) {
   const descriptor = (session?.mcp?.[server]?.tools ?? [])
     .find((item) => String(item?.name ?? '') === tool || String(item?.name ?? '').endsWith(`__${tool}`));

package/src/agent/graph.test.js

@@ -716,10 +716,12 @@ test('workspace package manifest is not exposed as an executable skill', () => {
   }
 });
 
-test('system prompt forbids unsolicited next-step sections', () => {
+test('system prompt allows one follow-up line but forbids next-step sections', () => {
   const prompt = buildAgentSystemPrompt({ session: sessionBase() });
-  assert.match(prompt, /Never add a "Next steps", "Prochaines étapes", "À suivre"/);
-  assert.match(prompt, /unless the user explicitly asks what to do next/);
+  // A single natural follow-up offer is allowed (assistant feel), ...
+  assert.match(prompt, /ONE short, natural follow-up/);
+  // ... but multi-item next-step sections / checklists / option menus stay banned.
+  assert.match(prompt, /never produce a "Next steps"\/"Prochaines étapes"\/"À suivre" list/);
   assert.doesNotMatch(prompt, /list the suggested follow-ups/);
 });
 

package/src/cli/wiki-manager.js

@@ -847,6 +847,15 @@ async function runRuntime(argv, agent) {
           throw new Error(`Delegated plan integration failed: ${(integrated.errors ?? []).map((error) => error.message ?? error.code ?? String(error)).join('; ')}`);
         }
         emitRuntimeLog(session, `delegation: ${prepared.fragment.tasks.length} validated task(s) integrated from ${prepared.provider.serverName}.agent_plan (${prepared.capability}/${prepared.operation})`);
+        // Demandé = consenti: a directly-delegated run carries the user's
+        // explicit consent, so auto-approve its initial plan. Persisting a
+        // run-scope grant (via the approval manager) makes the scheduler's
+        // readyTasks approval check pass, so the tasks run without re-prompting.
+        // Replanned tasks are integrated later without a fresh grant.
+        if (context.approvalManager?.approve) {
+          context.approvalManager.approve({ scope: 'run', runId });
+          emitRuntimeLog(session, `approval: run ${runId} auto-approved (user-requested action)`);
+        }
         body._planReady?.resolve?.({ runId, planRevision: session.agentProjection?.planRevision ?? 0 });
       }
       // Deterministic capability run (/ingest): ask the capable agent for its

package/src/commands/slash.js

@@ -634,7 +634,8 @@ ${helpPair('/cancel', 'Cancel active run', '', '')}
 ${helpPair('/run cancel', 'Cancel active run', '', '')}
 ${helpPair('/queue', 'MCP job queue', '/queue clear', 'Clear finished')}
 ${helpPair('/queue cancel <id>', 'Cancel queued/running', '', '')}
-${helpPair('/clear', 'Clear screen', '/exit', 'Exit')}
+${helpPair('/clear', 'Clear screen', '/clear --all', 'Reset run+plan+queue+logs')}
+${helpPair('/exit', 'Exit', '', '')}
 ${helpPair('Ctrl+Y', 'Copy last reply', '', '')}
 ${helpPair('PgUp/PgDn', 'Scroll thread', 'Ctrl+C Ctrl+C', 'Exit')}
 
@@ -1279,7 +1280,52 @@ export async function handleSlashCommand(line, context) {
     case 'clear': {
       const key = context.session.workspace || '__global__';
       context.session.conversations[key] = [];
-      return { output: null };
+      const wantsAll = args.slice(1).some((arg) => /^--?all$/i.test(String(arg)));
+      if (!wantsAll) return { output: null };
+
+      // /clear --all is a full reset, not just a screen wipe: it purges the
+      // persisted runtime runs (interrupted runs are terminal and never
+      // recovered at reboot, so this is what actually removes a zombie run),
+      // clears the local MCP job queue, and empties the local projection
+      // (plan, activities, logs, workflow) so the UI clears immediately
+      // instead of waiting for the next SSE sync.
+      const runtime = context.runtime ?? {};
+      const workspace = context.session.workspace ?? null;
+      const parts = [];
+      if (runtime.url) {
+        try {
+          const killed = await postRuntimeKill({ url: runtime.url, workspace, runId: null, purge: true });
+          const purged = killed.purged ?? { runs: 0, events: 0, queue: 0 };
+          parts.push(`runtime : ${killed.runs ?? 0} run(s) interrompu(s), ${killed.tasks ?? 0} tâche(s), ${killed.queued ?? 0} requête(s)`);
+          parts.push(`store purgé : ${purged.runs ?? 0} run(s), ${purged.events ?? 0} événement(s), ${purged.queue ?? 0} item(s) de file`);
+        } catch (err) {
+          parts.push(`runtime kill échoué : ${err instanceof Error ? err.message : String(err)}`);
+        }
+      } else {
+        parts.push('runtime non connecté (rien à purger côté serveur)');
+      }
+
+      const clearedQueue = clearFinishedQueueItems(context.session);
+      context.session.agentProjection = {
+        conversation: [],
+        chain: [],
+        plan: null,
+        activities: [],
+        logs: [],
+        summary: null,
+        status: 'idle',
+        planRevision: 0,
+        planPatches: [],
+      };
+      context.session.headlessPlan = null;
+      context.session.activities = {};
+      context.session.controlQueue = [];
+      context.session.workflow = null;
+      context.session.jobQueue = [];
+      context.session.productionActivity = null;
+      parts.push(`file locale : ${clearedQueue} item(s) terminés nettoyés`);
+
+      return { output: `Interface réinitialisée (--all) — ${parts.join(' · ')}.` };
     }
     case 'exit':
     case 'quit':

package/src/core/agentEvents.js

@@ -105,6 +105,21 @@ export function dispatchAgentEvent(session, event) {
   return normalized;
 }
 
+// Full in-memory projection reset for a session. The runtime keeps the live
+// projection in memory (session.agentProjection) and serves it from /state, so
+// interrupting runs is not enough to clear the PLAN/ACTIVITY/LOGS panels — the
+// projection has to be emptied here too. Pair with store.clearWorkspaceState so
+// the reset also survives a reboot (otherwise hydrateSession replays it back).
+export function resetSessionProjection(session) {
+  if (!session || typeof session !== 'object') return;
+  session.agentEvents = [];
+  session._agentProjectionState = createProjectionState();
+  session.agentProjection = publicProjection(session._agentProjectionState);
+  applyAgentProjectionToSession(session, session.agentProjection);
+  session.jobQueue = [];
+  session._onPlanUpdate?.();
+}
+
 function withSessionRunIdentity(event, session) {
   const identity = session?._currentRunIdentity;
   if (!identity) return event;
@@ -196,7 +211,13 @@ export function applyAgentProjectionToSession(session, projection) {
 function applyEvent(state, event) {
   switch (event.type) {
     case 'run_started':
-      state.status = 'running';
+      // Only a real runtime run (origin 'runtime') marks the projection
+      // 'running'. An interactive turn (origin 'user') is NOT a run: forcing
+      // 'running' here made the graph classify activeRun=true and hide Donna's
+      // MCP read tools (cme_status, wiki_workspace_status…), so questions about
+      // MCP state failed. Preserve the existing status (idle, or a genuinely
+      // active runtime run synced from the runtime) for interactive turns.
+      if (event.origin === 'runtime') state.status = 'running';
       state.plan = null;
       state.chain = [];
       state.activities = {};

package/src/core/agentEvents.test.js

@@ -20,13 +20,25 @@ test('reduceAgentEvents: run_started clears stale plan', () => {
       origin: 'tool',
       payload: { steps: ['Old action'] },
     }),
-    createAgentEvent('run_started', { origin: 'user' }),
+    createAgentEvent('run_started', { origin: 'runtime' }),
   ]);
   assert.equal(projection.plan, null);
   assert.equal(projection.activities.length, 0);
   assert.equal(projection.status, 'running');
 });
 
+test('reduceAgentEvents: interactive (user) run_started clears state but is not a running run', () => {
+  const projection = reduceAgentEvents([
+    createAgentEvent('plan_set', { origin: 'tool', payload: { steps: ['Old action'] } }),
+    createAgentEvent('run_started', { origin: 'user' }),
+  ]);
+  // An interactive turn clears stale plan/activities but must NOT mark the
+  // projection 'running' — otherwise the graph classifies activeRun=true and
+  // hides Donna's MCP read tools.
+  assert.equal(projection.plan, null);
+  assert.notEqual(projection.status, 'running');
+});
+
 test('reduceAgentEvents: tracks manual plan and step updates', () => {
   const projection = reduceAgentEvents([
     createAgentEvent('plan_set', {

package/src/core/buildInfo.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.14.0",
-  "commit": "fb0b915"
+  "version": "0.14.2",
+  "commit": "91a7753"
 }

package/src/core/mcp.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { managerEnvFile, managerMcpEndpointsFile, readEnvFile } from './env.js';
 
-const WIKI_MANAGER_VERSION = '0.14.0';
+const WIKI_MANAGER_VERSION = '0.14.2';
 
 function envValue(key) {
   const filePath = managerEnvFile();
@@ -43,6 +43,29 @@ function normalizeExternalUrlForRuntime(url) {
   return url;
 }
 
+// Config-driven policy for the /chat read-only toolset — NOT /agent, which has
+// the full toolset and ignores this. The endpoints file's "chatAccess" block
+// declares, per server, which tools /chat may call ("*" or a list), plus a
+// maxToolIterations budget. Operator-owned, agnostic allow-list. Returns null
+// when not configured — then /chat stays a plain, tool-less conversation.
+export function readChatAccessConfig() {
+  const filePath = managerMcpEndpointsFile();
+  if (!existsSync(filePath)) return null;
+  let raw;
+  try { raw = JSON.parse(readFileSync(filePath, 'utf8')); } catch { return null; }
+  const chatAccess = raw?.chatAccess;
+  if (!chatAccess || typeof chatAccess !== 'object' || Array.isArray(chatAccess)) return null;
+  const servers = {};
+  for (const [name, entry] of Object.entries(chatAccess.servers ?? {})) {
+    if (entry?.allow === '*') servers[name] = { allow: '*' };
+    else if (Array.isArray(entry?.allow)) servers[name] = { allow: entry.allow.map(String).filter(Boolean) };
+  }
+  const maxToolIterations = Number.isFinite(Number(chatAccess.maxToolIterations)) && Number(chatAccess.maxToolIterations) > 0
+    ? Math.floor(Number(chatAccess.maxToolIterations))
+    : null;
+  return { maxToolIterations, servers };
+}
+
 function readExternalMcpEndpoints() {
   const filePath = managerMcpEndpointsFile();
   if (!existsSync(filePath)) return {};
@@ -59,6 +82,14 @@ function readExternalMcpEndpoints() {
           url: normalizeExternalUrlForRuntime(interpolateEnv(String(endpoint.url))),
           configuredUrl: interpolateEnv(String(endpoint.url)),
           headers: normalizeHeaders(endpoint.headers),
+          // Tools the endpoint marks approval-gated: Donna may still call them
+          // directly (they are single-step tools), but toolRequiresApproval
+          // makes the call wait for the user's confirmation first (e.g. a
+          // destructive cme_export_run). Agent/operator owned — no hard-coded
+          // business name in the manager.
+          requireApproval: Array.isArray(endpoint.requireApproval)
+            ? endpoint.requireApproval.map(String).filter(Boolean)
+            : undefined,
           external: true,
         },
       ]),
@@ -95,6 +126,9 @@ const DEFAULT_MCP_RETRY_POLICY = {
 };
 
 export function buildMcpStatus(session) {
+  // Attach the /chat read-tool policy to the session alongside MCP status.
+  // Only /chat (repl.js) reads session.chatAccess; /agent ignores it.
+  if (session) session.chatAccess = readChatAccessConfig();
   const workspaceEnv = session.workspaceEnv ?? {};
   const wikiMcpToken = session.wikircConfig?.mcp?.accessKey;
   const wikiMcpDetail = workspaceEnv.WIKI_MCP_PORT
@@ -163,21 +197,14 @@ function compactDescription(value) {
   return text.length > 420 ? `${text.slice(0, 417)}...` : text;
 }
 
-function clarifyToolDescription(serverName, toolName, description) {
-  const base = compactDescription(description ?? '');
-  if (serverName === 'cme' && toolName.startsWith('cme_export')) {
-    return compactDescription([
-      base,
-      'Use only for Confluence/CME/source export into raw/untracked. Not for wiki deliverable export.',
-    ].filter(Boolean).join(' '));
-  }
-  if (serverName === 'production' && toolName === 'production_start_job') {
-    return compactDescription([
-      base,
-      'Production export means wiki deliverable/publication export only. Do not use type=export for Confluence/CME/source export; use cme__cme_export_run instead.',
-    ].filter(Boolean).join(' '));
-  }
-  return base;
+function clarifyToolDescription(_serverName, _toolName, description) {
+  // Agnostic by design: the orchestrator does NOT inject per-agent knowledge
+  // here. Tool meaning — including disambiguation like "this export publishes a
+  // wiki deliverable, not a Confluence source export" — must live in each
+  // agent's own MCP tool description, so any operator (our orchestrator or a
+  // third-party host such as Claude) gets the same self-sufficient contract.
+  // We only normalize whitespace; we never rewrite what the agent published.
+  return compactDescription(description ?? '');
 }
 
 async function listMcpTools(endpoint) {

package/src/core/toolLoop.js

@@ -0,0 +1,56 @@
+// Minimal, side-effect-free bounded tool-use loop.
+//
+// This is the shared mechanic of "ask the LLM with a tool set, run the tool
+// calls it emits, feed results back, repeat up to a cap". The caller injects
+// the ONLY policy that varies: `executeCall(call) -> string` decides whether a
+// requested tool is allowed and produces its textual result (allow-list check,
+// MCP dispatch, error formatting). The loop itself owns no plan, no delegation,
+// no run identity and no agent events — deliberately unlike the /agent
+// orchestration loop in createAgentGraph, which is a stateful LangGraph node
+// graph and stays separate. Use this for stateless tool-answer turns (e.g.
+// /chat read-only questions).
+//
+// `executeCall` may throw to abort the whole loop (e.g. an AbortError on
+// cancel); anything it returns is treated as the tool result for that call.
+export async function runBoundedToolLoop({
+  llm,
+  system,
+  messages,
+  tools,
+  executeCall,
+  maxIterations = 4,
+  signal,
+  onStep,
+} = {}) {
+  const cap = Math.max(1, Math.floor(maxIterations) || 1);
+  const convo = [...(messages ?? [])];
+  for (let i = 0; i < cap; i += 1) {
+    onStep?.(i + 1, cap);
+    const result = await llm.completeWithTools({
+      system,
+      tools,
+      messages: convo,
+      toolChoice: 'auto',
+      signal,
+    });
+    const calls = result?.tool_calls ?? [];
+    if (calls.length === 0) {
+      return {
+        content: result?.content ?? result?.message?.content ?? '',
+        iterations: i + 1,
+        capped: false,
+      };
+    }
+    convo.push(result.message ?? { role: 'assistant', content: result.content ?? '', tool_calls: calls });
+    // Tool calls within one turn are independent: dispatch concurrently, then
+    // replay results in the model's call order so the transcript stays stable.
+    const outcomes = await Promise.all(calls.map(async (call) => ({
+      tool_call_id: call.id,
+      content: await executeCall(call),
+    })));
+    for (const outcome of outcomes) {
+      convo.push({ role: 'tool', tool_call_id: outcome.tool_call_id, content: outcome.content });
+    }
+  }
+  return { content: '', iterations: cap, capped: true };
+}

package/src/core/toolLoop.test.js

@@ -0,0 +1,88 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { runBoundedToolLoop } from './toolLoop.js';
+
+function toolCall(id, name, args = '{}') {
+  return { id, function: { name, arguments: args } };
+}
+
+test('returns the model answer directly when no tool is called', async () => {
+  const llm = {
+    async completeWithTools() {
+      return { content: 'plain answer', tool_calls: [] };
+    },
+  };
+  const out = await runBoundedToolLoop({ llm, tools: [], executeCall: async () => 'unused' });
+  assert.deepEqual(out, { content: 'plain answer', iterations: 1, capped: false });
+});
+
+test('dispatches a tool call, feeds the result back, then returns the final answer', async () => {
+  let round = 0;
+  const seen = [];
+  const llm = {
+    async completeWithTools({ messages }) {
+      round += 1;
+      if (round === 1) return { message: { role: 'assistant', content: '', tool_calls: [toolCall('c1', 'cme__cme_status')] }, tool_calls: [toolCall('c1', 'cme__cme_status')] };
+      seen.push(messages.find((m) => m.role === 'tool')?.content);
+      return { content: 'configured', tool_calls: [] };
+    },
+  };
+  const out = await runBoundedToolLoop({
+    llm,
+    tools: [{ function: { name: 'cme__cme_status' } }],
+    executeCall: async (call) => `RESULT(${call.function.name})`,
+  });
+  assert.equal(out.content, 'configured');
+  assert.equal(out.iterations, 2);
+  assert.equal(out.capped, false);
+  assert.deepEqual(seen, ['RESULT(cme__cme_status)']);
+});
+
+test('runs concurrent tool calls and replays results in call order', async () => {
+  let round = 0;
+  const order = [];
+  const llm = {
+    async completeWithTools({ messages }) {
+      round += 1;
+      if (round === 1) {
+        const calls = [toolCall('a', 's__list'), toolCall('b', 's__status')];
+        return { message: { role: 'assistant', content: '', tool_calls: calls }, tool_calls: calls };
+      }
+      order.push(...messages.filter((m) => m.role === 'tool').map((m) => m.tool_call_id));
+      return { content: 'done', tool_calls: [] };
+    },
+  };
+  const out = await runBoundedToolLoop({
+    llm,
+    tools: [],
+    executeCall: async (call) => call.id,
+  });
+  assert.equal(out.content, 'done');
+  assert.deepEqual(order, ['a', 'b']); // preserved model call order
+});
+
+test('reports capped when the model keeps calling tools past the cap', async () => {
+  const llm = {
+    async completeWithTools() {
+      const calls = [toolCall('x', 's__status')];
+      return { message: { role: 'assistant', content: '', tool_calls: calls }, tool_calls: calls };
+    },
+  };
+  const out = await runBoundedToolLoop({ llm, tools: [], executeCall: async () => 'r', maxIterations: 3 });
+  assert.equal(out.capped, true);
+  assert.equal(out.iterations, 3);
+});
+
+test('propagates an abort thrown by executeCall', async () => {
+  const llm = {
+    async completeWithTools() {
+      const calls = [toolCall('x', 's__status')];
+      return { message: { role: 'assistant', content: '', tool_calls: calls }, tool_calls: calls };
+    },
+  };
+  const abort = Object.assign(new Error('aborted'), { name: 'AbortError' });
+  await assert.rejects(
+    runBoundedToolLoop({ llm, tools: [], executeCall: async () => { throw abort; } }),
+    /aborted/,
+  );
+});

package/src/runtime/client.js

@@ -130,8 +130,9 @@ export async function postRuntimeKill({
   token = runtimeToken(),
   workspace = null,
   runId = null,
+  purge = false,
 } = {}) {
-  const response = await fetch(runtimeEndpointWithParams(url, '/kill', { workspace, runId }), {
+  const response = await fetch(runtimeEndpointWithParams(url, '/kill', { workspace, runId, ...(purge ? { purge: 'true' } : {}) }), {
     method: 'POST',
     headers: runtimeHeaders(token),
   });

package/src/runtime/donna-contract.test.js

@@ -227,6 +227,9 @@ test('CME export is dispatched only from an approved DAG task', async () => {
   let executeCalls = 0;
   const session = baseSession({
     workspace: 'demo-workspace',
+    // Production runs wait indefinitely for a human approval. This contract
+    // test is headless, so give the scheduler an explicit bounded deadline.
+    _approvalTimeoutMs: 10,
     mcp: {
       cme: {
         status: 'connected',

package/src/runtime/lifecycle.js

@@ -1,5 +1,6 @@
 import { execFile, spawn } from 'node:child_process';
-import { dirname, resolve } from 'node:path';
+import { readdirSync, statSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { activeCacertPath } from '../core/cacert.js';
 import { checkRuntimeHealth, postRuntimeShutdown, runtimeUrlFromEnv } from './client.js';
@@ -10,6 +11,26 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const managerRoot = resolve(__dirname, '../..');
 const binPath = resolve(managerRoot, 'bin/wiki-manager.js');
 
+// Newest mtime (ms) of the manager's own source tree. Used to detect that the
+// code was edited after a reused runtime started, so ensureRuntime can restart
+// it instead of serving stale code. Returns 0 if the source tree is unreadable
+// (e.g. running from a packed install) — in that case staleness is not checked.
+function newestManagerSourceMtimeMs() {
+  const srcDir = join(managerRoot, 'src');
+  let newest = 0;
+  try {
+    for (const entry of readdirSync(srcDir, { recursive: true })) {
+      const name = String(entry);
+      if (!(name.endsWith('.js') || name.endsWith('.ts') || name.endsWith('.tsx'))) continue;
+      try {
+        const mtime = statSync(join(srcDir, name)).mtimeMs;
+        if (mtime > newest) newest = mtime;
+      } catch { /* file vanished mid-scan */ }
+    }
+  } catch { return 0; }
+  return newest;
+}
+
 export function runtimeNodeExecutable() {
   return process.versions.bun
     ? (process.env.WIKI_MANAGER_NODE_BIN ?? 'node')
@@ -47,13 +68,22 @@ export async function ensureRuntime({
   if (existing) {
     const expectedCacertPath = activeCacertPath();
     const actualCacertPath = existing.cacertPath ? resolve(existing.cacertPath) : null;
+    // Dev staleness: if the manager source was edited after this runtime
+    // started, the reused process would keep serving old code (the recurring
+    // "my change is not taking effect" trap). Treat it as stale and restart.
+    // Packed installs report mtime 0 (unreadable src) → never flagged stale.
+    // Opt out with WIKI_MANAGER_RUNTIME_NO_STALE_CHECK=1.
+    const startedAtMs = Number(existing.startedAtMs) || 0;
+    const sourceMtimeMs = process.env.WIKI_MANAGER_RUNTIME_NO_STALE_CHECK === '1' ? 0 : newestManagerSourceMtimeMs();
+    const stale = startedAtMs > 0 && sourceMtimeMs > startedAtMs;
     // forceRestart: the caller knows the manager configuration just changed
     // (e.g. mcp.endpoints.json scaffolded on first run) — a runtime started
     // BEFORE that only knows the old endpoints and would keep answering
     // without the agents until manually restarted.
-    if (!forceRestart && actualCacertPath === expectedCacertPath) {
+    if (!forceRestart && !stale && actualCacertPath === expectedCacertPath) {
       return { url, started: false, health: existing, token: auth.token, tokenPath: auth.tokenPath };
     }
+    if (stale) console.error('runtime: source changed since start — restarting for fresh code.');
     await postRuntimeShutdown({ url, token: auth.token });
     await waitForRuntimeShutdown(url, auth.token, 2500);
   }

package/src/runtime/runner.js

@@ -214,7 +214,7 @@ export async function runRuntimeAgenticWorkflow(agent, session, input, {
         },
       }));
       if (!evaluation.ok) {
-        if (isUndefinedObjectiveEvaluation(evaluation)) {
+        if (isAwaitingUserInputEvaluation(evaluation)) {
           dispatchAgentEvent(session, createAgentEvent('assistant_message', {
             origin: 'runtime',
             runId,
@@ -820,7 +820,7 @@ export async function finishRuntimeRun(session, input, {
       },
     }));
     if (!evaluation.ok) {
-      if (isUndefinedObjectiveEvaluation(evaluation)) {
+      if (isAwaitingUserInputEvaluation(evaluation)) {
         dispatchAgentEvent(session, createAgentEvent('assistant_message', {
           origin: 'runtime',
           runId,
@@ -874,8 +874,10 @@ export async function evaluateRuntimeRun(session, input, {
       system: [
         'You are a strict evaluator for an agentic runtime run.',
         'Inspect whether the original task was accomplished using the final plan and recent conversation.',
-        'Return only JSON with this exact shape: {"ok":boolean,"reason":"...","suggestedAction":string|null}.',
+        'Return only JSON with this exact shape: {"ok":boolean,"awaitingUserInput":boolean,"reason":"...","suggestedAction":string|null}.',
         'Use ok=false only when a concrete missing action, failed requirement, or wrong result is visible.',
+        'Set awaitingUserInput=true when the run correctly stopped to obtain information or a decision only the user can provide (e.g. credentials, choosing between options, an explicit confirmation) — this is expected behaviour, NOT a failure or a missing action. In that case still set ok=false, put the pending question in reason, and do not treat the unasked configuration as a failed requirement.',
+        'Otherwise set awaitingUserInput=false.',
       ].join('\n'),
       tools: [],
       messages: [{ role: 'user', content: buildEvaluationPrompt(input, session, { runId }) }],
@@ -956,6 +958,7 @@ function parseJsonFenced(content, label = 'JSON response') {
 function normalizeEvaluation(value) {
   return {
     ok: value?.ok === true,
+    awaitingUserInput: value?.awaitingUserInput === true,
     reason: String(value?.reason ?? '').trim() || (value?.ok === true ? 'Task completed.' : 'Evaluator rejected the run.'),
     suggestedAction: value?.suggestedAction == null ? null : String(value.suggestedAction),
   };
@@ -969,6 +972,22 @@ function isUndefinedObjectiveEvaluation(evaluation) {
   return /\b(vague|undefined|indefini|unclear|clarif|ambiguous|missing objective|no objective)\b/.test(text);
 }
 
+// A run that correctly hands back to the user for required input/decision is
+// NOT a failed run \u2014 it is the expected end of an interactive turn. Treat it
+// like the undefined-objective case: surface the pending question in chat and
+// close the run cleanly (ok, run_done), never replan or emit run_error. The
+// explicit evaluator field is authoritative; the keyword fallback covers models
+// that answer in prose without emitting the flag.
+function isAwaitingUserInputEvaluation(evaluation) {
+  if (evaluation?.awaitingUserInput === true) return true;
+  if (isUndefinedObjectiveEvaluation(evaluation)) return true;
+  const text = `${evaluation?.reason ?? ''} ${evaluation?.suggestedAction ?? ''}`
+    .toLowerCase()
+    .normalize('NFD')
+    .replace(/[\u0300-\u036f]/g, '');
+  return /\b(awaiting user|await user|user input|user decision|user confirmation|needs? (?:the )?user|requires? (?:the )?user|what to modify|which .* (?:to|should)|ask(?:ed|ing)? the user|attend .* utilisateur|demande .* utilisateur)\b/.test(text);
+}
+
 function clarificationMessageForEvaluation(evaluation) {
   const reason = String(evaluation?.reason ?? '').trim();
   return reason

package/src/runtime/server.js

@@ -1,6 +1,6 @@
 import { createServer } from 'node:http';
 import { randomUUID, timingSafeEqual } from 'node:crypto';
-import { createAgentEvent, dispatchAgentEvent } from '../core/agentEvents.js';
+import { createAgentEvent, dispatchAgentEvent, resetSessionProjection } from '../core/agentEvents.js';
 import { activeCacertPath } from '../core/cacert.js';
 import { normalizePlanPatch, rebasePlanPatch } from '../core/planPatch.js';
 import { validateContractInDev } from '../contracts/schemas.js';
@@ -25,6 +25,9 @@ export function startRuntimeServer({
   exitOnShutdown = process.env.WIKI_MANAGER_RUNTIME_CHILD === '1',
 } = {}) {
   const clients = new Set();
+  // When this runtime process started — used by ensureRuntime to detect that
+  // the manager source has been edited since (dev staleness) and auto-restart.
+  const runtimeStartedAtMs = Date.now();
   const defaultContext = { workspace: null, session, running: false, currentAbortController: null, currentRunId: null };
   const resolvedGetContext = getContext ?? (() => defaultContext);
 
@@ -62,6 +65,7 @@ export function startRuntimeServer({
           status: context?.running ? 'running' : 'idle',
           workspace: context?.workspace ?? workspace ?? null,
           activeRuns,
+          startedAtMs: runtimeStartedAtMs,
           dbPath: store.dbPath,
           cacertPath: activeCacertPath(),
           nodeExtraCaCerts: process.env.NODE_EXTRA_CA_CERTS ?? null,
@@ -318,8 +322,9 @@ export function startRuntimeServer({
         const body = await readJson(request);
         const workspace = workspaceFromBody(body) ?? workspaceFromUrl(url);
         const runId = url.searchParams.get('runId') ?? body.runId ?? null;
+        const purge = body.purge === true || url.searchParams.get('purge') === 'true';
         const context = await resolveContext({ workspace });
-        const result = await killRuntimeRuns(context, { workspace, runId });
+        const result = await killRuntimeRuns(context, { workspace, runId, purge });
         publishState(context.workspace ?? workspace ?? null, context);
         sendJson(response, 202, result);
         return;
@@ -405,7 +410,7 @@ export function startRuntimeServer({
     return { body, workspace, context };
   }
 
-  async function killRuntimeRuns(context, { workspace = null, runId = null } = {}) {
+  async function killRuntimeRuns(context, { workspace = null, runId = null, purge = false } = {}) {
     const targetWorkspace = context?.workspace ?? workspace ?? null;
     const targetRunId = runId ? String(runId) : null;
     if (!targetRunId || targetRunId === context?.currentRunId) {
@@ -419,7 +424,18 @@ export function startRuntimeServer({
       ? store.cancelActiveTasksForInterruptedRuns({ workspace: targetWorkspace, runId: targetRunId })
       : 0;
     const queued = cancelQueuedControlItems(context?.session, targetWorkspace);
-    return { killed: true, workspace: targetWorkspace, runId: targetRunId, runs, tasks, queued };
+    // Purge (/clear --all): interrupting recoverable runs does not clear a
+    // terminal 'error' run still projected in memory, nor the persisted event
+    // log. Empty both so PLAN/ACTIVITY/LOGS disappear and stay gone after a
+    // reboot. runId-scoped kills never purge (too coarse — it is workspace-wide).
+    let purged = null;
+    if (purge && !targetRunId) {
+      resetSessionProjection(context?.session);
+      purged = typeof store.clearWorkspaceState === 'function'
+        ? store.clearWorkspaceState({ workspace: targetWorkspace })
+        : { runs: 0, events: 0, queue: 0 };
+    }
+    return { killed: true, workspace: targetWorkspace, runId: targetRunId, runs, tasks, queued, ...(purged !== null ? { purged } : {}) };
   }
 
   function startRuntimeRun(context, body, { controlItemId = null, waitForPlan = false } = {}) {

package/src/runtime/store.js

@@ -670,6 +670,45 @@ export function openRuntimeStore({ stateDir = defaultRuntimeStateDir(), fileName
     return tasks.length;
   }
 
+  // Full wipe of a workspace's persisted runtime state: runs (and, via the
+  // ON DELETE CASCADE foreign keys, their task_groups/tasks/task_dependencies/
+  // plan_revisions/approval_grants), the event log, and the queue. The
+  // non-cascading task_* side tables are cleared explicitly. This is what makes
+  // /clear --all survive a reboot: without it, hydrateSession replays the events
+  // and the PLAN/ACTIVITY/LOGS come straight back. Destructive by design — only
+  // reached on an explicit purge.
+  function clearWorkspaceState({ workspace = null } = {}) {
+    const runIds = (workspace
+      ? db.prepare('SELECT id FROM runs WHERE workspace = ?').all(workspace)
+      : db.prepare('SELECT id FROM runs').all()
+    ).map((row) => row.id);
+    db.exec('BEGIN');
+    try {
+      const delResults = db.prepare('DELETE FROM task_results WHERE task_id IN (SELECT id FROM tasks WHERE run_id = ?)');
+      const delAssignments = db.prepare('DELETE FROM task_assignments WHERE task_id IN (SELECT id FROM tasks WHERE run_id = ?)');
+      const delAttempts = db.prepare('DELETE FROM task_attempts WHERE run_id = ?');
+      for (const runId of runIds) {
+        delResults.run(runId);
+        delAssignments.run(runId);
+        delAttempts.run(runId);
+      }
+      const events = (workspace
+        ? db.prepare('DELETE FROM events WHERE workspace = ?').run(workspace)
+        : db.prepare('DELETE FROM events').run()).changes ?? 0;
+      const queue = (workspace
+        ? db.prepare('DELETE FROM queue_items WHERE workspace = ?').run(workspace)
+        : db.prepare('DELETE FROM queue_items').run()).changes ?? 0;
+      const runs = (workspace
+        ? db.prepare('DELETE FROM runs WHERE workspace = ?').run(workspace)
+        : db.prepare('DELETE FROM runs').run()).changes ?? 0;
+      db.exec('COMMIT');
+      return { runs, events, queue };
+    } catch (error) {
+      db.exec('ROLLBACK');
+      throw error;
+    }
+  }
+
   function saveQueue(queue = [], { workspace = null } = {}) {
     const items = Array.isArray(queue) ? queue : [];
     const now = new Date().toISOString();
@@ -1166,6 +1205,7 @@ export function openRuntimeStore({ stateDir = defaultRuntimeStateDir(), fileName
     listRecoverableWorkspaces,
     interruptRuns,
     cancelActiveTasksForInterruptedRuns,
+    clearWorkspaceState,
     saveQueue,
     listQueue,
     listTasks,

package/src/shell/repl.js

@@ -5,12 +5,13 @@ import { execFileSync } from 'node:child_process';
 import { stdin as input, stdout as output } from 'node:process';
 import { marked } from 'marked';
 import { markedTerminal } from 'marked-terminal';
-import { buildAgentSystemPrompt, formatLlmUnavailableMessage } from '../agent/graph.js';
+import { buildAgentSystemPrompt, formatLlmUnavailableMessage, isDonnaReadTool } from '../agent/graph.js';
 import { handleSlashCommand } from '../commands/slash.js';
 import { serviceDescription, serviceNames as composeServiceNames } from '../core/compose.js';
 import { extractActivity, parseJsonText, sessionActivities } from '../core/activity.js';
 import { syncActivitiesToPlan } from '../core/plan.js';
-import { callMcpTool, formatMcpToolResult } from '../core/mcp.js';
+import { buildLlmTools, callMcpTool, formatMcpToolResult, parseToolCallName, resolveToolCallName } from '../core/mcp.js';
+import { runBoundedToolLoop } from '../core/toolLoop.js';
 import { createAgentEvent, dispatchAgentEvent } from '../core/agentEvents.js';
 import { listSkills } from '../core/skills.js';
 import { listWikircProfiles } from '../core/wikirc.js';
@@ -285,15 +286,38 @@ function isDonnaRole(role) {
   return role === 'donna' || role === LEGACY_DONNA_ROLE;
 }
 
+// Read-only MCP tools exposed to /chat. The operator declares which tools per
+// server in the `chatAccess` config (mcp.endpoints.json). /chat is extended to
+// those tools ONLY, filtered through the same read-only test Donna's /agent
+// mode uses (isDonnaReadTool), and only when their server is connected — so
+// /chat can answer live state questions ("le CME est-il configuré ?") but can
+// never mutate or delegate. Actions still belong to /agent, which has all tools.
+export function chatReadTools(session) {
+  const servers = session?.chatAccess?.servers;
+  if (!servers) return [];
+  const scopedMcp = Object.fromEntries(
+    Object.entries(session.mcp ?? {}).filter(([name]) => Object.hasOwn(servers, name)),
+  );
+  return buildLlmTools(scopedMcp).filter((item) => {
+    const { server, tool } = parseToolCallName(item.function.name);
+    const entry = servers[server];
+    const declared = entry.allow === '*' ? true : (Array.isArray(entry.allow) && entry.allow.includes(tool));
+    return declared && isDonnaReadTool(item);
+  });
+}
+
 function buildDirectChatSystemPrompt(session) {
   const workspace = session.workspace ?? 'no workspace selected';
   const wikirc = session.wikirc?.profile ?? 'no profile loaded';
   const language = session.language ?? 'en-US';
   return [
-    'You are Donna, the llm-wiki-manager chat assistant.',
-    'Answer directly and concisely. Do not claim to have called tools or changed files.',
+    'You are Donna, the llm-wiki-manager chat assistant: warm, plain-spoken, and helpful — like an attentive colleague, never a raw status dump.',
+    'You have a small READ-ONLY toolset — the tools provided to you for this turn, which may be none. Use them to answer questions about live state (e.g. "le CME est-il configuré", "quelles pages sont en attente"), and answer only from their results.',
+    'If no provided tool covers the request — or the request is an action or mutation (ingest, build, export, configure, send, delete…), or needs a service that is not connected — say plainly you cannot do it in chat mode and to switch to agent mode (/agent). Do not pretend to execute it and never guess.',
+    'Answer directly and concisely. Do not claim to have called tools or changed files beyond the tools actually provided.',
+    'Chat mode is READ-ONLY, so never offer to perform an action yourself here — do NOT say "want me to start the ingestion?", because you cannot. That offer belongs to agent mode. When a natural next step is an action, you may warmly hand off instead, in one short line (in the reply language): e.g. "If you want to run the ingestion, switch to agent mode with /agent." Point the way; never promise to do it.',
     'Never add a "Next steps", "Prochaines étapes", "À suivre", options, or suggestions section unless the user explicitly asks what to do next. End after answering the question.',
-    'If the user asks for an action that needs workspace commands, MCP tools, services, files, or mutations, say to ask as an agent action instead of pretending to execute it.',
+    'Never invent a tool name, command, job id, status, or result (e.g. do not fabricate names like "check_cme_configuration"). If you cannot know something with the tools you were given, say so.',
     `Reply language: ${language}.`,
     `Current workspace: ${workspace}.`,
     `Current wikirc profile: ${wikirc}.`,
@@ -1164,6 +1188,49 @@ async function runAgentTurn(input, { agent, session, onUpdate, onStep, displayIn
   return {};
 }
 
+// Bounded read-only tool loop for /chat. Only the tools declared in chatAccess
+// (and read-only) are offered; every call goes through callMcpTool, and any
+// tool the model names outside the offered set is refused — /chat can never
+// mutate or delegate. maxToolIterations caps the loop.
+async function runChatReadToolLoop({ input, session, history, donnaMessage, onUpdate, onStep, readTools }) {
+  const allowed = new Set(readTools.map((item) => item.function.name));
+  // /chat only supplies the policy; the loop mechanic lives in runBoundedToolLoop.
+  // executeCall enforces the allow-list and turns each call into a text result;
+  // it never mutates and refuses anything outside the offered read set.
+  const executeCall = async (call) => {
+    const rawName = call.function?.name ?? '';
+    const { server, tool } = resolveToolCallName(session.mcp, rawName);
+    const qualified = server ? `${server}__${tool}` : null;
+    if (!qualified || !allowed.has(qualified)) {
+      return `Refused: "${rawName}" is not an available read-only tool in chat mode. Actions and other tools live in agent mode (/agent).`;
+    }
+    let args = {};
+    try { args = call.function?.arguments ? JSON.parse(call.function.arguments) : {}; } catch { args = {}; }
+    try {
+      onStep?.(`Chat: read ${server} ${tool}…`);
+      const res = await callMcpTool(session.mcp, server, tool, args, session._abortSignal);
+      return formatMcpToolResult(res);
+    } catch (err) {
+      if (err.name === 'AbortError' && session._abortSignal?.aborted) throw err;
+      return `Error [${qualified}]: ${err instanceof Error ? err.message : String(err)}`;
+    }
+  };
+  const { content, capped } = await runBoundedToolLoop({
+    llm: session.llm,
+    system: buildDirectChatSystemPrompt(session),
+    messages: [...history, { role: 'user', content: input }],
+    tools: readTools,
+    executeCall,
+    maxIterations: Math.min(8, Number(session?.chatAccess?.maxToolIterations) || 4),
+    signal: session._abortSignal,
+    onStep: (i, cap) => onStep?.(`Chat: consulting… [${i}/${cap}]`),
+  });
+  donnaMessage.content = capped
+    ? 'Je n’ai pas pu conclure dans la limite d’itérations du mode chat. Passe en /agent si besoin.'
+    : (stripDsmlArtifacts(content).trimEnd() || formatLlmUnavailableMessage('reponse vide'));
+  onUpdate?.();
+}
+
 async function runDirectChatTurn(input, { session, onUpdate, onStep }) {
   if (!session.llm?.stream) {
     conversationMessages(session).push({ role: 'command', content: directChatUnavailableText(session) });
@@ -1176,24 +1243,30 @@ async function runDirectChatTurn(input, { session, onUpdate, onStep }) {
   const donnaMessage = { role: 'donna', content: '' };
   messages.push(donnaMessage);
   onUpdate?.();
+  const readTools = chatReadTools(session);
+  const canUseReadTools = readTools.length > 0 && typeof session.llm.completeWithTools === 'function';
   try {
-    onStep?.('Chat: streaming direct answer…');
-    for await (const delta of session.llm.stream({
-      system: buildDirectChatSystemPrompt(session),
-      messages: [...history, { role: 'user', content: input }],
-      signal: session._abortSignal,
-    })) {
-      const cleanDelta = stripDsmlArtifacts(delta);
-      if (cleanDelta) {
-        donnaMessage.content += cleanDelta;
+    if (canUseReadTools) {
+      await runChatReadToolLoop({ input, session, history, donnaMessage, onUpdate, onStep, readTools });
+    } else {
+      onStep?.('Chat: streaming direct answer…');
+      for await (const delta of session.llm.stream({
+        system: buildDirectChatSystemPrompt(session),
+        messages: [...history, { role: 'user', content: input }],
+        signal: session._abortSignal,
+      })) {
+        const cleanDelta = stripDsmlArtifacts(delta);
+        if (cleanDelta) {
+          donnaMessage.content += cleanDelta;
+          onUpdate?.();
+        }
+      }
+      donnaMessage.content = stripDsmlArtifacts(donnaMessage.content).trimEnd();
+      if (!donnaMessage.content.trim()) {
+        donnaMessage.content = formatLlmUnavailableMessage('flux vide');
         onUpdate?.();
       }
     }
-    donnaMessage.content = stripDsmlArtifacts(donnaMessage.content).trimEnd();
-    if (!donnaMessage.content.trim()) {
-      donnaMessage.content = formatLlmUnavailableMessage('flux vide');
-      onUpdate?.();
-    }
   } catch (err) {
     if (err.name === 'AbortError') {
       messages.pop();

package/src/shell/repl.test.js

@@ -5,6 +5,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import {
   applyRuntimeStateToShellSession,
+  chatReadTools,
   createSession,
   conversationMessages,
   recordRuntimeUnavailableAgentInput,
@@ -373,3 +374,72 @@ test('submitRuntimeRun sends a control message instead of /run while a run is ac
     restore();
   }
 });
+
+test('chatReadTools exposes only declared, read-only MCP tools to /chat', () => {
+  const session = {
+    chatAccess: {
+      servers: {
+        cme: { allow: ['cme_status', 'cme_sources_list', 'cme_export_run'] },
+      },
+    },
+    mcp: {
+      cme: {
+        status: 'connected',
+        tools: [
+          { name: 'cme_status', inputSchema: { type: 'object', properties: {} } },
+          { name: 'cme_sources_list', inputSchema: { type: 'object', properties: {} } },
+          { name: 'cme_setup', inputSchema: { type: 'object', properties: {} } },
+          { name: 'cme_export_run', inputSchema: { type: 'object', properties: {} } },
+        ],
+      },
+      documents: {
+        status: 'connected',
+        tools: [{ name: 'documents_status', inputSchema: { type: 'object', properties: {} } }],
+      },
+    },
+  };
+  const names = chatReadTools(session).map((item) => item.function.name).sort();
+  // cme_setup: not declared. cme_export_run: declared but a write (excluded by
+  // the read-only guard). documents_status: server absent from chatAccess.
+  assert.deepEqual(names, ['cme__cme_sources_list', 'cme__cme_status']);
+});
+
+test('chatReadTools is empty when no chatAccess is configured', () => {
+  const session = { mcp: { cme: { status: 'connected', tools: [{ name: 'cme_status', inputSchema: {} }] } } };
+  assert.deepEqual(chatReadTools(session), []);
+});
+
+test('/chat uses the tool-capable path when read tools are declared', async () => {
+  const session = createSession();
+  session.chatMode = true;
+  session.chatAccess = { maxToolIterations: 4, servers: { cme: { allow: ['cme_status'] } } };
+  session.mcp = { cme: { status: 'connected', tools: [{ name: 'cme_status', inputSchema: { type: 'object', properties: {} } }] } };
+  let usedComplete = false;
+  session.llm = {
+    async *stream() { yield 'STREAM_FALLBACK'; },
+    async completeWithTools() {
+      usedComplete = true;
+      return { tool_calls: [], content: 'Réponse via outils.', message: { role: 'assistant', content: 'Réponse via outils.' } };
+    },
+  };
+  await runLine('le cme est-il configuré', { session, chatMode: true });
+  const last = conversationMessages(session).at(-1);
+  assert.ok(usedComplete, 'completeWithTools path was taken');
+  assert.match(last.content, /Réponse via outils/);
+  assert.doesNotMatch(last.content, /STREAM_FALLBACK/);
+});
+
+test('/chat falls back to the plain stream when no read tools are declared', async () => {
+  const session = createSession();
+  session.chatMode = true;
+  session.chatAccess = null;
+  session.mcp = {};
+  session.llm = {
+    async *stream() { yield 'PLAIN_STREAM'; },
+    async completeWithTools() { return { tool_calls: [], content: 'SHOULD_NOT_APPEAR' }; },
+  };
+  await runLine('bonjour', { session, chatMode: true });
+  const last = conversationMessages(session).at(-1);
+  assert.match(last.content, /PLAIN_STREAM/);
+  assert.doesNotMatch(last.content, /SHOULD_NOT_APPEAR/);
+});