@dotdrelle/wiki-manager 0.14.1 → 0.14.5

package/README.md

@@ -8,6 +8,10 @@ endpoints, and provides the `donna` shell: an agent-first terminal UI that can
 inspect workspaces, run safe manager commands, call MCP tools, guide production
 jobs, and run one-shot headless tasks.
 
+Current coordinated release: **0.14.5**. Managed `llm-wiki` services expose
+the Wiki Graph v2 browser and APIs; rebuild the `llm-wiki` image when deploying
+this release through Docker.
+
 The manager does not implement the wiki engine or the external agents. It
 **orchestrates** them — generically. Since 0.12.0 the Donna core is
 business-agnostic: agents declare their capabilities through a standard

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotdrelle/wiki-manager",
-  "version": "0.14.1",
+  "version": "0.14.5",
   "description": "Agentic shell and orchestration cockpit for llm-wiki workspaces.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "author": "dotrelle",

package/src/agent/graph.js

@@ -852,7 +852,7 @@ export function buildAgentSystemPrompt(state) {
   const workspaceProfile = loadWorkspaceProfile(state.session.workspacePath);
 
   const agentContext = [
-    'You are Donna, the terminal orchestrator agent for llm-wiki-manager.',
+    'You are Donna: first and foremost a warm, helpful assistant for the llm-wiki-manager team, who also happens to orchestrate the workspace behind the scenes. Orchestration is how you help — it is not your personality. Speak like an attentive human colleague: natural, friendly, plain-spoken. Never sound like a raw status dump or a machine reciting fields.',
     'The shell is agent-first: every input without a leading slash is routed to you.',
     'Default to a plain conversational reply with no tool call. Only call a tool, create a plan, or start a job when the user\'s message clearly requests an action (ingest, build, export, configure, run a skill, check a concrete status, etc.). Greetings, small talk, thanks, and general questions do not warrant starting a job or calling a tool — just answer in text.',
     'Commands starting with / are deterministic primitives. You may run a safe subset through shell__run_command.',
@@ -870,13 +870,14 @@ export function buildAgentSystemPrompt(state) {
     'In interactive agent mode you may call only the read-only tools and runtime control/delegation tools actually provided to you.',
     'When the user asks for an action that can be performed with connected MCP tools or safe primitives, do not answer with future intent such as "I will call...", "I am going to run...", or "launching..." unless you also call the tool in the same turn. Either call the tool now, ask for the exact missing required arguments, or explain the concrete blocker.',
     'Execution truthfulness: never invent a job id, status, percentage, duration, generated file, file content, URL, command, or tool result. An action is executed only when you call an available tool and receive its result. Examples and placeholders are forbidden in execution reports.',
-    'After any completed action, give a short factual summary based only on the tool result: outcome and concrete outputs or references actually returned. Mention a viewing primitive only when it exists in Available primitives and is relevant. Do not interpret generated content, propose verification checklists, invent next steps, or suggest commands unless the user explicitly asks.',
-    'Never add a "Next steps", "Prochaines étapes", "À suivre", options, or suggestions section unless the user explicitly asks what to do next. End after the requested result or the concrete error.',
+    'After any completed action, give a short factual summary based only on the tool result: outcome and concrete outputs or references actually returned. Mention a viewing primitive only when it exists in Available primitives and is relevant. Never invent results, interpret generated content beyond what the tool returned, or fabricate a verification checklist.',
+    'You are in AGENT mode, so you can actually act. You MAY close with ONE short, natural follow-up — a single sentence phrased as an offer, and only when it genuinely helps and is an action you can perform right here (delegate it or call a tool), e.g. "Want me to start ingesting these pages?" (phrased in the reply language). This is what makes you feel like an assistant rather than a readout. Only offer what you can truly do in agent mode — never an offer that would require another mode. Keep it to that one line: never produce a "Next steps"/"Prochaines étapes"/"À suivre" list, a checklist, an options menu, or commands for the user to type. If nothing useful naturally follows, simply stop after the answer — do not pad.',
     'When calling a tool, emit no preliminary narration. Call it directly; the PLAN and Activity panels show progress. After completion, keep the final response concise and proportional to the result.',
-    'Keep every response synthetic and information-dense. Use only the lines needed, and never exceed roughly 15 to 20 short lines even for a detailed answer. Never expose internal reasoning, repeated checks, tool-selection commentary, or a chronological diary. Prioritize the result, essential facts, concrete errors, and actual outputs.',
+    'Write the way a thoughtful colleague speaks: warm, plain, and to the point. For a simple factual question, 1 to 3 sentences is the sweet spot. Stay synthetic and information-dense — use only the lines needed, and never exceed roughly 15 to 20 short lines even for a detailed answer. Never expose internal reasoning, repeated checks, tool-selection commentary, or a chronological diary. Prioritize the result, essential facts, concrete errors, and actual outputs — but say them in human language, not as a field dump.',
     'Only the heavy multi-step operations — ingest, build, export, polish, pipeline — are delegated via runtime__delegate (for their DAG and parallelism). Single-step actions — configuring or adding a connector source, converting a document, sending, searching — are called directly on the connected tool. Never call an agent orchestration-contract or plan tool directly.',
     'For any question about the current workspace inventory or what is waiting there, call wiki__wiki_workspace_status first and answer only from its result. This is the canonical read-only workspace state; do not reconstruct it from upload, connector, or production tools.',
     'Tool identifiers are private implementation details. Never print MCP tool names such as server__tool in a user-facing answer. Describe the human result instead.',
+    'Internal data shapes are private too. Never quote raw JSON field names (e.g. pendingSources.files), internal directory paths (e.g. raw/untracked/), or config keys in a user-facing answer — translate them into plain language. Say "36 pages sources sont en attente d\'ingestion", not the field or path they came from.',
     'Never suggest a manual filesystem command or implementation workaround unless the user explicitly asks for manual instructions. For an action request, delegate the objective and let the specialized agent determine paths and operations from its live contract.',
     'Skills are documentation only in this stabilized version. Never execute a skill from conversation; delegate the user objective.',
     'For service actions, recommend only available service primitives from Available primitives, with the exact service name when the primitive supports one.',
@@ -887,6 +888,7 @@ export function buildAgentSystemPrompt(state) {
     'If the connector or service needed for a requested read or action is absent from the Connected MCP tools above (its service is not running — e.g. CME, documents, or production), say plainly that this service is not connected and name it as the missing capability. Never redirect a simple read (e.g. "give me the CME config") to an "agent action", never invent its result, and never propose a workaround. Only requests you can actually serve with a listed tool are answered with data.',
     'For any requested action, call runtime__delegate with the user objective only. Never choose a capability, operation, agent, plan, or implementation yourself. The runtime resolves the registry and validates the provider plan before accepting. Never call <provider>__agent_plan, <provider>__agent_execute, legacy production__production_start_job, wiki__plan_set, or wiki__plan_done from interactive chat.',
     'Do not ask the user which sources, files, connectors, or templates to use for an ingest, build, or export: the specialized agent discovers them from the workspace. When the objective is clear (e.g. "lance une ingestion"), delegate it as stated, without a clarifying question.',
+    'Promise only what the resolved capability actually exposes in its declared contract (the input schema the specialized agent publishes for that capability). When the user requests an execution parameter — a batch or chunk size, a count "N at a time", concurrency, ordering, priority, or any tuning knob — apply it only if that parameter exists in the target capability\'s published input schema. Otherwise do not confirm or promise it: delegate the objective, and if the user explicitly asked for that parameter, say plainly in one line that you started the work but do not control that aspect (the runtime and the specialized agent decide it). Never state or imply a parameter was applied when the agent contract cannot enforce it.',
     'If runtime__delegate returns a blocker or no specialized provider is available, report only that concrete blocker concisely. Never replace the missing execution path with a suggested slash command, skill, MCP tool name, manual file move, administrator escalation, or alternative workflow unless the user explicitly asks for alternatives.',
     'For workspace inventory and page listings, use the connected wiki MCP read tools. Never invent or call a /wiki shell command through shell__run_command. Use /workspace init <name> [path] for low-level non-interactive workspace creation; in the interactive TUI, /new <name> opens the setup wizard.',
     'If an action requires tools or skills not available yet, explain the limitation and name the expected primitive.',
@@ -894,6 +896,7 @@ export function buildAgentSystemPrompt(state) {
       ? `Workspace profile (.wiki/profile.md) — durable user preferences, apply these to every reply (tone, tutoiement/vouvoiement, formatting, etc.):\n${workspaceProfile}`
       : null,
     'Runtime control: you have runtime__status, runtime__cancel, runtime__kill, runtime__approve and runtime__enqueue. When the user asks to stop, remove, clean or kill the current run, its jobs or the queue ("supprime le job et la queue", "arr\u00eate tout"), call runtime__kill (or runtime__cancel for a soft stop of just the run) and confirm what was stopped. For questions about what is running or queued, call runtime__status and answer from its data. When the user consents to a pending approval in any phrasing ("vas-y", "ok pour l\'export"), call runtime__approve. When the user asks for a NEW action while a run is active, do not execute it: propose runtime__enqueue (run it after) or, if they insist it replaces the current work, runtime__kill then the new action.',
+    'Report every runtime control outcome exactly as the tool returned it \u2014 never embellish. If runtime__kill reports 0 run(s)/0 task(s)/0 purged, say there was nothing active to stop or purge; do NOT claim a run, plan, pending approval or queue item was removed. If runtime__status returns an error or could not be read, say the runtime state could not be retrieved and do not describe a state you never obtained. Never assert that something was cleaned, cancelled, approved or purged unless that specific tool result confirms it.',
     'Durable profile updates are actions in this stabilized version: delegate them instead of writing directly.',
   ].filter(Boolean).join('\n');
 

package/src/agent/graph.test.js

@@ -716,10 +716,12 @@ test('workspace package manifest is not exposed as an executable skill', () => {
   }
 });
 
-test('system prompt forbids unsolicited next-step sections', () => {
+test('system prompt allows one follow-up line but forbids next-step sections', () => {
   const prompt = buildAgentSystemPrompt({ session: sessionBase() });
-  assert.match(prompt, /Never add a "Next steps", "Prochaines étapes", "À suivre"/);
-  assert.match(prompt, /unless the user explicitly asks what to do next/);
+  // A single natural follow-up offer is allowed (assistant feel), ...
+  assert.match(prompt, /ONE short, natural follow-up/);
+  // ... but multi-item next-step sections / checklists / option menus stay banned.
+  assert.match(prompt, /never produce a "Next steps"\/"Prochaines étapes"\/"À suivre" list/);
   assert.doesNotMatch(prompt, /list the suggested follow-ups/);
 });
 

package/src/commands/slash.js

@@ -634,7 +634,8 @@ ${helpPair('/cancel', 'Cancel active run', '', '')}
 ${helpPair('/run cancel', 'Cancel active run', '', '')}
 ${helpPair('/queue', 'MCP job queue', '/queue clear', 'Clear finished')}
 ${helpPair('/queue cancel <id>', 'Cancel queued/running', '', '')}
-${helpPair('/clear', 'Clear screen', '/exit', 'Exit')}
+${helpPair('/clear', 'Clear screen', '/clear --all', 'Reset run+plan+queue+logs')}
+${helpPair('/exit', 'Exit', '', '')}
 ${helpPair('Ctrl+Y', 'Copy last reply', '', '')}
 ${helpPair('PgUp/PgDn', 'Scroll thread', 'Ctrl+C Ctrl+C', 'Exit')}
 
@@ -1279,7 +1280,52 @@ export async function handleSlashCommand(line, context) {
     case 'clear': {
       const key = context.session.workspace || '__global__';
       context.session.conversations[key] = [];
-      return { output: null };
+      const wantsAll = args.slice(1).some((arg) => /^--?all$/i.test(String(arg)));
+      if (!wantsAll) return { output: null };
+
+      // /clear --all is a full reset, not just a screen wipe: it purges the
+      // persisted runtime runs (interrupted runs are terminal and never
+      // recovered at reboot, so this is what actually removes a zombie run),
+      // clears the local MCP job queue, and empties the local projection
+      // (plan, activities, logs, workflow) so the UI clears immediately
+      // instead of waiting for the next SSE sync.
+      const runtime = context.runtime ?? {};
+      const workspace = context.session.workspace ?? null;
+      const parts = [];
+      if (runtime.url) {
+        try {
+          const killed = await postRuntimeKill({ url: runtime.url, workspace, runId: null, purge: true });
+          const purged = killed.purged ?? { runs: 0, events: 0, queue: 0 };
+          parts.push(`runtime : ${killed.runs ?? 0} run(s) interrompu(s), ${killed.tasks ?? 0} tâche(s), ${killed.queued ?? 0} requête(s)`);
+          parts.push(`store purgé : ${purged.runs ?? 0} run(s), ${purged.events ?? 0} événement(s), ${purged.queue ?? 0} item(s) de file`);
+        } catch (err) {
+          parts.push(`runtime kill échoué : ${err instanceof Error ? err.message : String(err)}`);
+        }
+      } else {
+        parts.push('runtime non connecté (rien à purger côté serveur)');
+      }
+
+      const clearedQueue = clearFinishedQueueItems(context.session);
+      context.session.agentProjection = {
+        conversation: [],
+        chain: [],
+        plan: null,
+        activities: [],
+        logs: [],
+        summary: null,
+        status: 'idle',
+        planRevision: 0,
+        planPatches: [],
+      };
+      context.session.headlessPlan = null;
+      context.session.activities = {};
+      context.session.controlQueue = [];
+      context.session.workflow = null;
+      context.session.jobQueue = [];
+      context.session.productionActivity = null;
+      parts.push(`file locale : ${clearedQueue} item(s) terminés nettoyés`);
+
+      return { output: `Interface réinitialisée (--all) — ${parts.join(' · ')}.` };
     }
     case 'exit':
     case 'quit':

package/src/core/agentEvents.js

@@ -105,6 +105,21 @@ export function dispatchAgentEvent(session, event) {
   return normalized;
 }
 
+// Full in-memory projection reset for a session. The runtime keeps the live
+// projection in memory (session.agentProjection) and serves it from /state, so
+// interrupting runs is not enough to clear the PLAN/ACTIVITY/LOGS panels — the
+// projection has to be emptied here too. Pair with store.clearWorkspaceState so
+// the reset also survives a reboot (otherwise hydrateSession replays it back).
+export function resetSessionProjection(session) {
+  if (!session || typeof session !== 'object') return;
+  session.agentEvents = [];
+  session._agentProjectionState = createProjectionState();
+  session.agentProjection = publicProjection(session._agentProjectionState);
+  applyAgentProjectionToSession(session, session.agentProjection);
+  session.jobQueue = [];
+  session._onPlanUpdate?.();
+}
+
 function withSessionRunIdentity(event, session) {
   const identity = session?._currentRunIdentity;
   if (!identity) return event;

package/src/core/buildInfo.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.14.1",
-  "commit": "f6e95e4"
+  "version": "0.14.5",
+  "commit": "cc90bd3"
 }

package/src/core/mcp.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { managerEnvFile, managerMcpEndpointsFile, readEnvFile } from './env.js';
 
-const WIKI_MANAGER_VERSION = '0.14.1';
+const WIKI_MANAGER_VERSION = '0.14.5';
 
 function envValue(key) {
   const filePath = managerEnvFile();
@@ -197,21 +197,14 @@ function compactDescription(value) {
   return text.length > 420 ? `${text.slice(0, 417)}...` : text;
 }
 
-function clarifyToolDescription(serverName, toolName, description) {
-  const base = compactDescription(description ?? '');
-  if (serverName === 'cme' && toolName.startsWith('cme_export')) {
-    return compactDescription([
-      base,
-      'Use only for Confluence/CME/source export into raw/untracked. Not for wiki deliverable export.',
-    ].filter(Boolean).join(' '));
-  }
-  if (serverName === 'production' && toolName === 'production_start_job') {
-    return compactDescription([
-      base,
-      'Production export means wiki deliverable/publication export only. Do not use type=export for Confluence/CME/source export; use cme__cme_export_run instead.',
-    ].filter(Boolean).join(' '));
-  }
-  return base;
+function clarifyToolDescription(_serverName, _toolName, description) {
+  // Agnostic by design: the orchestrator does NOT inject per-agent knowledge
+  // here. Tool meaning — including disambiguation like "this export publishes a
+  // wiki deliverable, not a Confluence source export" — must live in each
+  // agent's own MCP tool description, so any operator (our orchestrator or a
+  // third-party host such as Claude) gets the same self-sufficient contract.
+  // We only normalize whitespace; we never rewrite what the agent published.
+  return compactDescription(description ?? '');
 }
 
 async function listMcpTools(endpoint) {

package/src/runtime/client.js

@@ -130,8 +130,9 @@ export async function postRuntimeKill({
   token = runtimeToken(),
   workspace = null,
   runId = null,
+  purge = false,
 } = {}) {
-  const response = await fetch(runtimeEndpointWithParams(url, '/kill', { workspace, runId }), {
+  const response = await fetch(runtimeEndpointWithParams(url, '/kill', { workspace, runId, ...(purge ? { purge: 'true' } : {}) }), {
     method: 'POST',
     headers: runtimeHeaders(token),
   });

package/src/runtime/donna-contract.test.js

@@ -227,6 +227,9 @@ test('CME export is dispatched only from an approved DAG task', async () => {
   let executeCalls = 0;
   const session = baseSession({
     workspace: 'demo-workspace',
+    // Production runs wait indefinitely for a human approval. This contract
+    // test is headless, so give the scheduler an explicit bounded deadline.
+    _approvalTimeoutMs: 10,
     mcp: {
       cme: {
         status: 'connected',

package/src/runtime/runner.js

@@ -214,7 +214,7 @@ export async function runRuntimeAgenticWorkflow(agent, session, input, {
         },
       }));
       if (!evaluation.ok) {
-        if (isUndefinedObjectiveEvaluation(evaluation)) {
+        if (isAwaitingUserInputEvaluation(evaluation)) {
           dispatchAgentEvent(session, createAgentEvent('assistant_message', {
             origin: 'runtime',
             runId,
@@ -820,7 +820,7 @@ export async function finishRuntimeRun(session, input, {
       },
     }));
     if (!evaluation.ok) {
-      if (isUndefinedObjectiveEvaluation(evaluation)) {
+      if (isAwaitingUserInputEvaluation(evaluation)) {
         dispatchAgentEvent(session, createAgentEvent('assistant_message', {
           origin: 'runtime',
           runId,
@@ -874,8 +874,10 @@ export async function evaluateRuntimeRun(session, input, {
       system: [
         'You are a strict evaluator for an agentic runtime run.',
         'Inspect whether the original task was accomplished using the final plan and recent conversation.',
-        'Return only JSON with this exact shape: {"ok":boolean,"reason":"...","suggestedAction":string|null}.',
+        'Return only JSON with this exact shape: {"ok":boolean,"awaitingUserInput":boolean,"reason":"...","suggestedAction":string|null}.',
         'Use ok=false only when a concrete missing action, failed requirement, or wrong result is visible.',
+        'Set awaitingUserInput=true when the run correctly stopped to obtain information or a decision only the user can provide (e.g. credentials, choosing between options, an explicit confirmation) — this is expected behaviour, NOT a failure or a missing action. In that case still set ok=false, put the pending question in reason, and do not treat the unasked configuration as a failed requirement.',
+        'Otherwise set awaitingUserInput=false.',
       ].join('\n'),
       tools: [],
       messages: [{ role: 'user', content: buildEvaluationPrompt(input, session, { runId }) }],
@@ -956,6 +958,7 @@ function parseJsonFenced(content, label = 'JSON response') {
 function normalizeEvaluation(value) {
   return {
     ok: value?.ok === true,
+    awaitingUserInput: value?.awaitingUserInput === true,
     reason: String(value?.reason ?? '').trim() || (value?.ok === true ? 'Task completed.' : 'Evaluator rejected the run.'),
     suggestedAction: value?.suggestedAction == null ? null : String(value.suggestedAction),
   };
@@ -969,6 +972,22 @@ function isUndefinedObjectiveEvaluation(evaluation) {
   return /\b(vague|undefined|indefini|unclear|clarif|ambiguous|missing objective|no objective)\b/.test(text);
 }
 
+// A run that correctly hands back to the user for required input/decision is
+// NOT a failed run \u2014 it is the expected end of an interactive turn. Treat it
+// like the undefined-objective case: surface the pending question in chat and
+// close the run cleanly (ok, run_done), never replan or emit run_error. The
+// explicit evaluator field is authoritative; the keyword fallback covers models
+// that answer in prose without emitting the flag.
+function isAwaitingUserInputEvaluation(evaluation) {
+  if (evaluation?.awaitingUserInput === true) return true;
+  if (isUndefinedObjectiveEvaluation(evaluation)) return true;
+  const text = `${evaluation?.reason ?? ''} ${evaluation?.suggestedAction ?? ''}`
+    .toLowerCase()
+    .normalize('NFD')
+    .replace(/[\u0300-\u036f]/g, '');
+  return /\b(awaiting user|await user|user input|user decision|user confirmation|needs? (?:the )?user|requires? (?:the )?user|what to modify|which .* (?:to|should)|ask(?:ed|ing)? the user|attend .* utilisateur|demande .* utilisateur)\b/.test(text);
+}
+
 function clarificationMessageForEvaluation(evaluation) {
   const reason = String(evaluation?.reason ?? '').trim();
   return reason

package/src/runtime/server.js

@@ -1,6 +1,6 @@
 import { createServer } from 'node:http';
 import { randomUUID, timingSafeEqual } from 'node:crypto';
-import { createAgentEvent, dispatchAgentEvent } from '../core/agentEvents.js';
+import { createAgentEvent, dispatchAgentEvent, resetSessionProjection } from '../core/agentEvents.js';
 import { activeCacertPath } from '../core/cacert.js';
 import { normalizePlanPatch, rebasePlanPatch } from '../core/planPatch.js';
 import { validateContractInDev } from '../contracts/schemas.js';
@@ -322,8 +322,9 @@ export function startRuntimeServer({
         const body = await readJson(request);
         const workspace = workspaceFromBody(body) ?? workspaceFromUrl(url);
         const runId = url.searchParams.get('runId') ?? body.runId ?? null;
+        const purge = body.purge === true || url.searchParams.get('purge') === 'true';
         const context = await resolveContext({ workspace });
-        const result = await killRuntimeRuns(context, { workspace, runId });
+        const result = await killRuntimeRuns(context, { workspace, runId, purge });
         publishState(context.workspace ?? workspace ?? null, context);
         sendJson(response, 202, result);
         return;
@@ -409,7 +410,7 @@ export function startRuntimeServer({
     return { body, workspace, context };
   }
 
-  async function killRuntimeRuns(context, { workspace = null, runId = null } = {}) {
+  async function killRuntimeRuns(context, { workspace = null, runId = null, purge = false } = {}) {
     const targetWorkspace = context?.workspace ?? workspace ?? null;
     const targetRunId = runId ? String(runId) : null;
     if (!targetRunId || targetRunId === context?.currentRunId) {
@@ -423,7 +424,18 @@ export function startRuntimeServer({
       ? store.cancelActiveTasksForInterruptedRuns({ workspace: targetWorkspace, runId: targetRunId })
       : 0;
     const queued = cancelQueuedControlItems(context?.session, targetWorkspace);
-    return { killed: true, workspace: targetWorkspace, runId: targetRunId, runs, tasks, queued };
+    // Purge (/clear --all): interrupting recoverable runs does not clear a
+    // terminal 'error' run still projected in memory, nor the persisted event
+    // log. Empty both so PLAN/ACTIVITY/LOGS disappear and stay gone after a
+    // reboot. runId-scoped kills never purge (too coarse — it is workspace-wide).
+    let purged = null;
+    if (purge && !targetRunId) {
+      resetSessionProjection(context?.session);
+      purged = typeof store.clearWorkspaceState === 'function'
+        ? store.clearWorkspaceState({ workspace: targetWorkspace })
+        : { runs: 0, events: 0, queue: 0 };
+    }
+    return { killed: true, workspace: targetWorkspace, runId: targetRunId, runs, tasks, queued, ...(purged !== null ? { purged } : {}) };
   }
 
   function startRuntimeRun(context, body, { controlItemId = null, waitForPlan = false } = {}) {

package/src/runtime/store.js

@@ -670,6 +670,45 @@ export function openRuntimeStore({ stateDir = defaultRuntimeStateDir(), fileName
     return tasks.length;
   }
 
+  // Full wipe of a workspace's persisted runtime state: runs (and, via the
+  // ON DELETE CASCADE foreign keys, their task_groups/tasks/task_dependencies/
+  // plan_revisions/approval_grants), the event log, and the queue. The
+  // non-cascading task_* side tables are cleared explicitly. This is what makes
+  // /clear --all survive a reboot: without it, hydrateSession replays the events
+  // and the PLAN/ACTIVITY/LOGS come straight back. Destructive by design — only
+  // reached on an explicit purge.
+  function clearWorkspaceState({ workspace = null } = {}) {
+    const runIds = (workspace
+      ? db.prepare('SELECT id FROM runs WHERE workspace = ?').all(workspace)
+      : db.prepare('SELECT id FROM runs').all()
+    ).map((row) => row.id);
+    db.exec('BEGIN');
+    try {
+      const delResults = db.prepare('DELETE FROM task_results WHERE task_id IN (SELECT id FROM tasks WHERE run_id = ?)');
+      const delAssignments = db.prepare('DELETE FROM task_assignments WHERE task_id IN (SELECT id FROM tasks WHERE run_id = ?)');
+      const delAttempts = db.prepare('DELETE FROM task_attempts WHERE run_id = ?');
+      for (const runId of runIds) {
+        delResults.run(runId);
+        delAssignments.run(runId);
+        delAttempts.run(runId);
+      }
+      const events = (workspace
+        ? db.prepare('DELETE FROM events WHERE workspace = ?').run(workspace)
+        : db.prepare('DELETE FROM events').run()).changes ?? 0;
+      const queue = (workspace
+        ? db.prepare('DELETE FROM queue_items WHERE workspace = ?').run(workspace)
+        : db.prepare('DELETE FROM queue_items').run()).changes ?? 0;
+      const runs = (workspace
+        ? db.prepare('DELETE FROM runs WHERE workspace = ?').run(workspace)
+        : db.prepare('DELETE FROM runs').run()).changes ?? 0;
+      db.exec('COMMIT');
+      return { runs, events, queue };
+    } catch (error) {
+      db.exec('ROLLBACK');
+      throw error;
+    }
+  }
+
   function saveQueue(queue = [], { workspace = null } = {}) {
     const items = Array.isArray(queue) ? queue : [];
     const now = new Date().toISOString();
@@ -1166,6 +1205,7 @@ export function openRuntimeStore({ stateDir = defaultRuntimeStateDir(), fileName
     listRecoverableWorkspaces,
     interruptRuns,
     cancelActiveTasksForInterruptedRuns,
+    clearWorkspaceState,
     saveQueue,
     listQueue,
     listTasks,

package/src/shell/repl.js

@@ -311,10 +311,11 @@ function buildDirectChatSystemPrompt(session) {
   const wikirc = session.wikirc?.profile ?? 'no profile loaded';
   const language = session.language ?? 'en-US';
   return [
-    'You are Donna, the llm-wiki-manager chat assistant.',
+    'You are Donna, the llm-wiki-manager chat assistant: warm, plain-spoken, and helpful — like an attentive colleague, never a raw status dump.',
     'You have a small READ-ONLY toolset — the tools provided to you for this turn, which may be none. Use them to answer questions about live state (e.g. "le CME est-il configuré", "quelles pages sont en attente"), and answer only from their results.',
     'If no provided tool covers the request — or the request is an action or mutation (ingest, build, export, configure, send, delete…), or needs a service that is not connected — say plainly you cannot do it in chat mode and to switch to agent mode (/agent). Do not pretend to execute it and never guess.',
     'Answer directly and concisely. Do not claim to have called tools or changed files beyond the tools actually provided.',
+    'Chat mode is READ-ONLY, so never offer to perform an action yourself here — do NOT say "want me to start the ingestion?", because you cannot. That offer belongs to agent mode. When a natural next step is an action, you may warmly hand off instead, in one short line (in the reply language): e.g. "If you want to run the ingestion, switch to agent mode with /agent." Point the way; never promise to do it.',
     'Never add a "Next steps", "Prochaines étapes", "À suivre", options, or suggestions section unless the user explicitly asks what to do next. End after answering the question.',
     'Never invent a tool name, command, job id, status, or result (e.g. do not fabricate names like "check_cme_configuration"). If you cannot know something with the tools you were given, say so.',
     `Reply language: ${language}.`,