@dotdrelle/wiki-manager 0.14.13 → 0.14.16

package/.env.example

@@ -63,6 +63,17 @@ DOCUMENTS_MCP_AUTH_TOKEN=
 # Add your own entries when you declare additional endpoints.
 
 # ── Orchestration (optional) ───────────────────────────────────────────────────
+# The runtime runs on the host while `llm-wiki serve` runs in Docker and
+# reaches it through host.docker.internal. Listen on all host interfaces so
+# the container can connect; exposed runtimes are protected by the generated
+# WIKI_MANAGER_RUNTIME_TOKEN.
+#
+# WIKI_MANAGER_RUNTIME_PORT=7788
+# Set to 0 to skip pulling and renewing already-running containers at startup.
+# WIKI_MANAGER_AUTO_UPDATE=1
+# WIKI_MANAGER_RUNTIME_HOST=0.0.0.0
+
+
 # Parallel tasks dispatched at once for capability runs. Defaults to what the
 # agent itself declares (agent_describe limits); set only to constrain it.
 # Example constraint (never raises an agent's declared capacity):

package/docker-compose.yml

@@ -59,7 +59,7 @@ services:
       - DOCUMENT_MAX_UPLOAD_BYTES=${DOCUMENT_MAX_UPLOAD_BYTES:-52428800}
       - WIKI_MCP_PROXY_URL=http://host.docker.internal:${WIKI_MCP_PORT:-3101}/mcp
       - PRODUCTION_MCP_PROXY_URL=http://host.docker.internal:${PRODUCTION_MCP_PORT:-3102}/mcp/
-      - WIKI_MANAGER_RUNTIME_URL=http://host.docker.internal:7788
+      - WIKI_MANAGER_RUNTIME_URL=http://host.docker.internal:${WIKI_MANAGER_RUNTIME_PORT:-7788}
       - WIKI_MANAGER_RUNTIME_TOKEN=${WIKI_MANAGER_RUNTIME_TOKEN:-}
       # HTTPS — set paths inside the container (e.g. /certs/server.crt) and uncomment the volume above
       #- WIKI_SERVE_TLS_CERT_PATH=/certs/server.crt

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotdrelle/wiki-manager",
-  "version": "0.14.13",
+  "version": "0.14.16",
   "description": "Agentic shell and orchestration cockpit for llm-wiki workspaces.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "author": "dotrelle",

package/src/activity/activityAggregator.js

@@ -71,21 +71,37 @@ function groupLine(group, activities) {
   const running = group.tasks.filter((task) => ACTIVE.has(statusOf(task)));
   const failed = group.tasks.find((task) => statusOf(task) === 'failed');
   const waitingApproval = group.tasks.some((task) => ['pending_approval', 'waiting_approval'].includes(statusOf(task)));
-  const activeAgents = new Set(running.map((task) => task.agentInstanceId).filter(Boolean)).size;
-  const activeProgress = running
-    .map((task) => progressForTask(task, activities))
-    .find((value) => value != null);
+  // Activity polling can advance before the persisted task projection catches
+  // up. Treat a live, linked activity as authoritative instead of rendering
+  // the whole group as "validation 0%" while a worker visibly runs at 35%.
+  const activePair = group.tasks
+    .map((task) => ({ task, activity: activityForTask(task, activities) }))
+    .find(({ activity }) => activity && !activity.terminal && !DONE.has(statusOf(activity)));
+  const activeTask = activePair?.task ?? running[0] ?? null;
+  const activeActivity = activePair?.activity
+    ?? running.map((task) => activityForTask(task, activities)).find(Boolean);
+  const activeAgents = new Set([
+    ...running.map((task) => task.agentInstanceId),
+    activeTask?.agentInstanceId,
+  ].filter(Boolean)).size;
+  const activeProgress = Number.isFinite(Number(activeActivity?.progress?.percent))
+    ? Number(activeActivity.progress.percent)
+    : running.map((task) => Number(task?.progress?.percent)).find(Number.isFinite);
   let icon = '[ ]';
   let status = 'en attente';
-  if (failed) {
+  // A group may contain an earlier failure while another independent task is
+  // still progressing. Show the live worker as running; surface the group
+  // failure once no work remains. Otherwise its business label was rendered
+  // red even though that exact task was healthy and advancing.
+  if (running.length > 0 || activeActivity) {
+    icon = '[...]';
+    status = activeProgress != null ? `${Math.round(activeProgress)} %` : `${done}/${total}`;
+  } else if (failed) {
     icon = '[!]';
     status = 'error';
   } else if (done === total) {
     icon = '[x]';
     status = 'done';
-  } else if (running.length > 0) {
-    icon = '[...]';
-    status = activeProgress != null ? `${Math.round(activeProgress)} %` : `${done}/${total}`;
   } else if (waitingApproval) {
     icon = '[!]';
     status = 'validation';
@@ -100,12 +116,28 @@ function groupLine(group, activities) {
   // text. Fall back to the task-completion ratio when nothing is running.
   const percent = running.length > 0 && activeProgress != null
     ? Math.round(activeProgress)
+    : activeActivity && activeProgress != null
+      ? Math.round(activeProgress)
     : (total > 0 ? Math.round((done / total) * 100) : null);
+  const phaseTasks = activeTask
+    ? group.tasks.filter((task) => String(task.operation ?? '') === String(activeTask.operation ?? ''))
+    : [];
+  const taskIndex = activeTask ? phaseTasks.indexOf(activeTask) + 1 : null;
+  const taskTotal = phaseTasks.length || null;
   return {
     id: `group:${group.id}`,
     label: `${icon} ${group.label} - ${status}${agents}`,
     status,
-    progress: { done, total, percent },
+    // Preserve the active worker's business progress (source/template/
+    // deliverable, phase and detail). ShellUI can then show the same useful
+    // information as the direct wiki CLI instead of only "knowledge.update".
+    progress: {
+      ...(activeActivity?.progress ?? {}),
+      done,
+      total,
+      percent,
+      ...(taskIndex ? { taskIndex, taskTotal, taskOperation: activeTask?.operation ?? null } : {}),
+    },
     activeAgents,
   };
 }
@@ -121,15 +153,13 @@ function activityLine(activity) {
   };
 }
 
-function progressForTask(task, activities) {
+function activityForTask(task, activities) {
   const taskId = String(task.id ?? task.step ?? '');
   const activityKey = task.activityKey ?? task.ownerActivityKey ?? null;
-  const match = activities.find((activity) =>
+  return activities.find((activity) =>
     (activityKey && (activity.key === activityKey || activity.id === activityKey))
     || String(activity?.progress?.stepId ?? '') === taskId,
   );
-  const value = Number(match?.progress?.percent ?? task.progress?.percent);
-  return Number.isFinite(value) ? value : null;
 }
 
 function statusOf(task) {

package/src/activity/activityAggregator.test.js

@@ -37,10 +37,10 @@ test('aggregateActivity exposes initial synthesis and grouped display lines', ()
   const activity = aggregateActivity({
     plan: [
       { id: 'collect', label: 'Collecte externe', groupId: 'collect', status: 'done', progressWeight: 1 },
-      { id: 'enrich', label: 'Enrichissement commercial', groupId: 'enrich', requiredCapability: 'customer-data.enrich', status: 'running', progressWeight: 1, activityKey: 'activity-enrich' },
+      { id: 'enrich', label: 'Enrichissement commercial', groupId: 'enrich', requiredCapability: 'customer-data.enrich', operation: 'export', status: 'running', progressWeight: 1, activityKey: 'activity-enrich' },
       { id: 'publish', label: 'Publication', groupId: 'publish', status: 'pending', progressWeight: 1 },
     ],
-    activities: [{ key: 'activity-enrich', label: 'Enrichissement commercial', status: 'running', progress: { percent: 63, stepId: 'enrich' } }],
+    activities: [{ key: 'activity-enrich', label: 'Enrichissement commercial', status: 'running', progress: { percent: 63, stepId: 'enrich', label: 'Export rapport.md', detail: 'Rendering PDF', currentStep: 'export' } }],
   }, [{
     type: 'plan.received',
     payload: {
@@ -56,6 +56,13 @@ test('aggregateActivity exposes initial synthesis and grouped display lines', ()
   assert.equal(activity.progress.percent, 54);
   assert.ok(activity.lines.some((line) => /\[x\] collect - done/.test(line.label)));
   assert.ok(activity.lines.some((line) => /\[\.\.\.\] customer-data\.enrich - 63 %/.test(line.label)));
+  const enrichLine = activity.lines.find((line) => /customer-data\.enrich/.test(line.label));
+  assert.equal(enrichLine.progress.label, 'Export rapport.md');
+  assert.equal(enrichLine.progress.detail, 'Rendering PDF');
+  assert.equal(enrichLine.progress.currentStep, 'export');
+  assert.equal(enrichLine.progress.taskIndex, 1);
+  assert.equal(enrichLine.progress.taskTotal, 1);
+  assert.equal(enrichLine.progress.taskOperation, 'export');
   assert.ok(activity.lines.some((line) => /\[ \] publish - en attente/.test(line.label)));
 });
 
@@ -90,3 +97,45 @@ test('aggregateActivity keeps activities not attached to any plan task visible',
   const ingestLine = aggregated.lines.find((line) => /Ingest/.test(line.label));
   assert.equal(ingestLine.status, 'running');
 });
+
+test('aggregateActivity trusts live worker progress while the task projection lags', () => {
+  const aggregated = aggregateActivity({
+    plan: [
+      { id: 'plan-a', groupId: 'knowledge.update', operation: 'ingest_plan', status: 'pending_approval', activityKey: 'activity-plan-a' },
+      { id: 'plan-b', groupId: 'knowledge.update', operation: 'ingest_plan', status: 'pending' },
+    ],
+    activities: [{
+      key: 'activity-plan-a',
+      status: 'running',
+      terminal: false,
+      progress: { percent: 35, stepId: 'plan-a', label: 'Ingest source-a.md', stepIndex: 1, stepTotal: 1 },
+    }],
+  }, []);
+
+  const line = aggregated.lines.find((item) => /knowledge\.update/.test(item.label));
+  assert.match(line.label, /35 %/);
+  assert.equal(line.progress.percent, 35);
+  assert.equal(line.progress.label, 'Ingest source-a.md');
+  assert.equal(line.progress.taskIndex, 1);
+  assert.equal(line.progress.taskTotal, 2);
+});
+
+test('aggregateActivity keeps a healthy active task out of the error color when a sibling failed', () => {
+  const aggregated = aggregateActivity({
+    plan: [
+      { id: 'failed-a', groupId: 'ingest', operation: 'ingest_plan', status: 'failed' },
+      { id: 'running-b', groupId: 'ingest', operation: 'ingest_plan', status: 'running', activityKey: 'activity-b' },
+    ],
+    activities: [{
+      key: 'activity-b',
+      status: 'running',
+      terminal: false,
+      progress: { percent: 35, stepId: 'running-b', label: 'Ingest application-orea.md', detail: 'LLM running' },
+    }],
+  }, []);
+
+  const line = aggregated.lines[0];
+  assert.equal(line.status, '35 %');
+  assert.match(line.label, /^\[\.\.\.\]/);
+  assert.equal(line.progress.label, 'Ingest application-orea.md');
+});

package/src/agent/graph.js

@@ -274,6 +274,7 @@ const AgentState = Annotation.Root({
   invalidResponseRetries: Annotation({ default: () => 0 }),
   invalidToolCallRetries: Annotation({ default: () => 0 }),
   forceDelegation: Annotation({ default: () => false }),
+  terminalToolFailure: Annotation({ default: () => false }),
 });
 
 function invalidToolCalls(toolCalls) {
@@ -365,21 +366,62 @@ export function invalidUserFacingToolNames(content, session) {
   return [...new Set([...connected, ...syntactic])].sort();
 }
 
+function parseActionJson(text) {
+  const cleaned = String(text ?? '').trim().replace(/^```(?:json)?\s*/i, '').replace(/\s*```$/, '');
+  if (!cleaned) return null;
+  return JSON.parse(cleaned)?.action === true;
+}
+
 async function classifyRequestedAction(llm, input, signal) {
+  const system = [
+    'Classify whether the user explicitly requests a real state-changing action now.',
+    'Actions include starting, stopping, importing, ingesting, building, exporting, configuring, writing, deleting, or sending.',
+    'Questions, explanations, status questions, greetings, and hypothetical discussions are not actions.',
+    'Return JSON only: {"action":true} or {"action":false}.',
+  ].join('\n');
+  const messages = [{ role: 'user', content: String(input ?? '') }];
+
+  // Preferred path: a forced structured tool call, reliable on providers that
+  // honour tool_choice. But an OpenAI-compatible gateway (e.g. Albert / gpt-oss)
+  // may reject a forced tool_choice or return neither tool_calls nor parsable
+  // content. Without a fallback that made EVERY request classify as a non-action
+  // (catch → false), so Donna silently stopped delegating in agent mode. Fall
+  // back to a plain JSON-text completion, and only give up if both paths fail.
   try {
+    const classifier = {
+      type: 'function',
+      function: {
+        name: 'classify_action_request',
+        description: 'Classify whether the user explicitly requests a real state-changing action now.',
+        parameters: {
+          type: 'object',
+          additionalProperties: false,
+          properties: { action: { type: 'boolean' } },
+          required: ['action'],
+        },
+      },
+    };
     const result = await llm.completeWithTools({
-      system: [
-        'Classify whether the user explicitly requests a real state-changing action now.',
-        'Actions include starting, stopping, importing, ingesting, building, exporting, configuring, writing, deleting, or sending.',
-        'Questions, explanations, status questions, greetings, and hypothetical discussions are not actions.',
-        'Return JSON only: {"action":true} or {"action":false}.',
-      ].join('\n'),
-      tools: [],
-      messages: [{ role: 'user', content: String(input ?? '') }],
+      system,
+      tools: [classifier],
+      toolChoice: { type: 'function', function: { name: 'classify_action_request' } },
+      messages,
       signal,
     });
-    const text = String(result?.content ?? '').trim().replace(/^```(?:json)?\s*/i, '').replace(/\s*```$/, '');
-    return JSON.parse(text)?.action === true;
+    const call = (result?.tool_calls ?? []).find((item) => item?.function?.name === 'classify_action_request');
+    if (call) {
+      const parsed = JSON.parse(call.function.arguments ?? '{}')?.action;
+      if (typeof parsed === 'boolean') return parsed;
+    }
+    const fromText = parseActionJson(result?.content);
+    if (fromText !== null) return fromText;
+  } catch {
+    // Fall through to the toolless path below.
+  }
+
+  try {
+    const result = await llm.completeWithTools({ system, tools: [], messages, signal });
+    return parseActionJson(result?.content) === true;
   } catch {
     return false;
   }
@@ -1327,6 +1369,7 @@ export function createAgentGraph(options = {}) {
   async function toolExecutorNode(state) {
     const toolCalls = state.pendingToolCalls ?? [];
     const toolResultMessages = [];
+    let terminalFailure = null;
 
     for (const call of toolCalls) {
       const resolved = resolveToolCallName(state.session.mcp, call.function.name, INTERNAL_TOOL_SERVERS);
@@ -1415,6 +1458,12 @@ export function createAgentGraph(options = {}) {
           resultText = JSON.stringify(result, null, 2);
         } else if (server === 'runtime') {
           resultText = await handleRuntimeControlTool(state.session, tool, args);
+          if (tool === 'delegate' && /^Runtime control error \(delegate\):/i.test(resultText)) {
+            terminalFailure = resultText
+              .replace(/^Runtime control error \(delegate\):\s*/i, '')
+              .replace(/^Delegation failed during objective_resolution:\s*/i, '');
+            ok = false;
+          }
         } else if (server !== 'shell') {
           await awaitRunApproval(state.session, { runId, tool: toolName });
           await awaitToolApproval(state.session, {
@@ -1510,17 +1559,36 @@ export function createAgentGraph(options = {}) {
         tool_call_id: call.id,
         content: boundedResult,
       });
+      if (terminalFailure) break;
     }
 
+    if (terminalFailure) {
+      const response = `Action non lancée : ${terminalFailure}`;
+      emitAgentEvent(state.session, 'assistant_message', 'agent_guard', { content: response });
+      return {
+        response,
+        messages: toolResultMessages,
+        pendingToolCalls: null,
+        forceDelegation: false,
+        terminalToolFailure: true,
+        invalidToolCallRetries: 0,
+        invalidResponseRetries: 0,
+      };
+    }
     return {
       messages: toolResultMessages,
       pendingToolCalls: null,
       forceDelegation: false,
       invalidToolCallRetries: 0,
       invalidResponseRetries: 0,
+      terminalToolFailure: false,
     };
   }
 
+  function routeToolExecutor(state) {
+    return state.terminalToolFailure ? END : 'orchestrator';
+  }
+
   function routeOrchestrator(state) {
     if (state.pendingToolCalls?.length > 0) return 'tool_executor';
     if (state.retryWithoutTool) return 'orchestrator';
@@ -1534,7 +1602,7 @@ export function createAgentGraph(options = {}) {
     .addNode('tool_executor', toolExecutorNode)
     .addEdge(START, 'orchestrator')
     .addConditionalEdges('orchestrator', routeOrchestrator)
-    .addEdge('tool_executor', 'orchestrator')
+    .addConditionalEdges('tool_executor', routeToolExecutor)
     .compile();
 
   // LangGraph's default recursionLimit is 25 super-steps. Each tool round

package/src/agent/graph.test.js

@@ -25,7 +25,9 @@ test('Donna cannot answer an explicit action with manual instructions instead of
     runtime: { url: 'http://runtime.test' },
     llm: {
       async completeWithTools({ tools }) {
-        if (tools.length === 0) return { content: '{"action":true}', message: { role: 'assistant', content: '{"action":true}' }, tool_calls: null };
+        if (tools.some((tool) => tool.function?.name === 'classify_action_request')) {
+          return { content: null, message: { role: 'assistant', content: null }, tool_calls: [{ id: 'classify', type: 'function', function: { name: 'classify_action_request', arguments: '{"action":true}' } }] };
+        }
         mainCalls += 1;
         if (mainCalls === 1) {
           return {
@@ -910,8 +912,8 @@ test('forced delegation is cleared after one valid tool call and does not loop',
     commands: ['status'],
     llm: {
       async completeWithTools({ toolChoice, tools }) {
-        if (tools.length === 0) {
-          return { content: '{"action":true}', message: { role: 'assistant', content: '{"action":true}' }, tool_calls: null };
+        if (tools.some((tool) => tool.function?.name === 'classify_action_request')) {
+          return { content: null, message: { role: 'assistant', content: null }, tool_calls: [{ id: 'classify', type: 'function', function: { name: 'classify_action_request', arguments: '{"action":true}' } }] };
         }
         calls += 1;
         choices.push(toolChoice);
@@ -946,6 +948,44 @@ test('forced delegation is cleared after one valid tool call and does not loop',
   }
 });
 
+test('a rejected runtime delegation is terminal and never loops', async () => {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async () => ({
+    ok: false,
+    status: 422,
+    json: async () => ({
+      error: 'Delegation failed during objective_resolution: No orchestrable capability is currently available.',
+    }),
+  });
+  let calls = 0;
+  const session = sessionBase({
+    runtime: { url: 'http://runtime.test' },
+    llm: {
+      async completeWithTools() {
+        calls += 1;
+        return {
+          content: null,
+          message: { role: 'assistant', content: null },
+          tool_calls: [{
+            id: 'delegate-failure',
+            type: 'function',
+            function: { name: 'runtime__delegate', arguments: '{"objective":"Lance ingestion"}' },
+          }],
+        };
+      },
+    },
+  });
+
+  try {
+    const result = await createAgentGraph().invoke({ input: 'lance ingestion', session });
+    assert.equal(calls, 1);
+    assert.equal(result.response, 'Action non lancée : No orchestrable capability is currently available.');
+    assert.equal(result.terminalToolFailure, true);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
 // Guard: the system prompt must never show a connected tool's bare name
 // outside its qualified server__tool form. Bare mentions are what teach the
 // model to emit unqualified tool calls (the cme_status incident). The bare

package/src/cli/wiki-manager.js

@@ -8,6 +8,7 @@ import { createAgentGraph } from '../agent/graph.js';
 import { handleSlashCommand, printHelp, printVersion, refreshMcpRuntimeStatus } from '../commands/slash.js';
 import { runShell, runHeadlessChatTurn } from '../shell/repl.js';
 import { runPreflightChecks, withRuntimePreflight } from '../core/startupCheck.js';
+import { refreshRunningContainers } from '../core/wikiSetup.js';
 import { applySessionWikircProfile } from '../core/sessionConfig.js';
 import { listWikircProfiles } from '../core/wikirc.js';
 import { callMcpTool, formatMcpToolResult, readChatAccessConfig } from '../core/mcp.js';
@@ -17,6 +18,7 @@ import { createAgentEvent, dispatchAgentEvent, reduceAgentEvents } from '../core
 import { runAgentTurn, runAgenticLoop } from '../core/agentLoop.js';
 import { resolveCapabilityConcurrency } from '../orchestrator/scheduler.js';
 import { capabilityRegistryForSession } from '../orchestrator/capabilityRegistry.js';
+import { listWorkspaces } from '../core/workspaces.js';
 // Runtime modules use node:sqlite (Node.js built-in unavailable in Bun).
 // They are imported dynamically so the shell / TUI path never loads them.
 
@@ -422,7 +424,7 @@ async function runHeadless(argv, agent) {
     let input = prompt;
     if (skillName) {
       const skillResult = await handleSlashCommand(`/skills run ${skillName}`, { packageJson, session, onStep: step });
-      if (skillResult.output) log.push(skillResult.output);
+      if (skillResult.output && !skillResult.rawOutput) log.push(skillResult.output);
       if (String(skillResult.output ?? '').startsWith('Skill not found')) throw new Error(`Skill not found: ${skillName}`);
       input = skillResult.agentTrigger
         ? [
@@ -501,7 +503,7 @@ async function runRuntime(argv, agent) {
   const { defaultRuntimeStateDir, openRuntimeStore, RECOVERABLE_QUEUE_STATUSES } = await import('../runtime/store.js');
   const { startRuntimeServer } = await import('../runtime/server.js');
   const { recoverActiveRuns } = await import('../runtime/recoveryManager.js');
-  const { emitRuntimeLog, startActivitySupervisor, cancelActiveActivityJobs } = await import('../runtime/supervisor.js');
+  const { emitRuntimeLog, startActivitySupervisor, cancelActiveActivityJobs, discoverAgentsOnce } = await import('../runtime/supervisor.js');
   const { resolveRuntimeAuthToken } = await import('../runtime/auth.js');
   const { createSqliteQueueStore } = await import('../runtime/queueStore.js');
   const { createApprovalManager } = await import('../runtime/approvals.js');
@@ -803,6 +805,12 @@ async function runRuntime(argv, agent) {
     const { resolveObjective } = await import('../orchestrator/objectiveResolver.js');
     const { validateFragment } = await import('../orchestrator/planValidator.js');
     const session = context.session;
+    // The supervisor starts discovery asynchronously. A delegation submitted
+    // immediately after opening ShellUI must not observe the transient empty
+    // registry and fail while the provider is already healthy. Refresh the
+    // live endpoints and await one discovery pass before resolving.
+    await refreshMcpRuntimeStatus(session);
+    await discoverAgentsOnce(session, { registry: session.agentRegistry });
     let selection;
     try {
       selection = await resolveObjective(objective, session);
@@ -1162,10 +1170,22 @@ async function runRuntime(argv, agent) {
   await new Promise(() => {});
 }
 
+// One place for the skipped-image-update warnings so the runtime and TUI
+// startup paths report refresh failures identically.
+function logImageRefreshErrors(imageRefresh) {
+  for (const error of imageRefresh?.errors ?? []) {
+    console.warn(`[wiki-manager] image update skipped: ${error}`);
+  }
+}
+
 export async function runCli(argv) {
   if (argv[0] === 'runtime') {
     const scaffolded = ensureManagerScaffold({ log: (message) => console.log(`[wiki-manager] ${message}`) });
     if (scaffolded.length > 0) loadManagerEnv();
+    const imageRefresh = await refreshRunningContainers({
+      onStep: (message) => console.log(`[wiki-manager] ${message}`),
+    });
+    logImageRefreshErrors(imageRefresh);
     const agent = createAgentGraph();
     await runRuntime(argv.slice(1), agent);
     return;
@@ -1218,6 +1238,10 @@ export async function runCli(argv) {
     if (!process.versions.bun) {
       throw new Error('Interactive TUI requires Bun. Run: bun ./bin/wiki-manager.js');
     }
+    const initialWorkspaceName = valueAfter(argv, '--workspace');
+    if (initialWorkspaceName && !listWorkspaces().some((workspace) => workspace.name === initialWorkspaceName)) {
+      throw new Error(`Workspace not found: ${initialWorkspaceName}`);
+    }
     const { runOpenTuiShell, runStartupWizard } = await import('../shell/tui.tsx');
     // Fresh directory → copy mcp.endpoints.json/.env from the packaged
     // examples so external agents (cme, mailer, documents) connect out of
@@ -1242,6 +1266,17 @@ export async function runCli(argv) {
       // configuration. Re-read everything before drawing the home screen.
       preflight = await runPreflightChecks();
     }
+    const dockerReady = preflight.checks.some((check) => check.kind === 'docker' && check.ok);
+    const internetReady = preflight.checks.some((check) => check.kind === 'internet' && check.ok);
+    if (dockerReady && internetReady) {
+      void refreshRunningContainers({
+        onStep: (message) => console.log(`[wiki-manager] ${message}`),
+      }).then((imageRefresh) => {
+        logImageRefreshErrors(imageRefresh);
+      }).catch((error) => {
+        console.warn(`[wiki-manager] image update skipped: ${error instanceof Error ? error.message : String(error)}`);
+      });
+    }
     let runtime = null;
     try {
       const { ensureRuntime } = await import('../runtime/lifecycle.js');
@@ -1257,7 +1292,13 @@ export async function runCli(argv) {
     // (see tui.tsx onShellExit): render() resolves at MOUNT, so anything
     // after this await would run while the shell is still on screen —
     // 0.12.9 shipped exactly that bug and killed the runtime under the user.
-    await runOpenTuiShell({ agent, packageJson, runtime, preflight });
+    await runOpenTuiShell({
+      agent,
+      packageJson,
+      runtime,
+      preflight,
+      initialWorkspaceName,
+    });
     return;
   }
 

package/src/commands/slash.js

@@ -391,7 +391,10 @@ function skillDetailText(skill) {
 
 function buildSkillRunPrompt(skill) {
   return [
-    `Execute the "${skill.name}" skill for the current workspace.`,
+    `The user asked to run the "${skill.name}" skill for the current workspace.`,
+    'First explain concisely, in the user language, what will be launched and its intended outcome.',
+    'Do not quote, reproduce, or display the raw skill content.',
+    'Then execute the workflow, using the available tools when required.',
     'Follow the workflow steps below. Call MCP tools and shell commands as needed for each step.',
     'Report progress as you go. Ask for confirmation before irreversible or costly actions not already defined in the skill.',
     '',
@@ -413,7 +416,11 @@ function skillActionCommand(session, action, name) {
     return { output: `Skill not found: ${name}.${hint}` };
   }
   if (action === 'run') {
-    return { output: `Skill: ${skill.name} — launching…`, agentTrigger: buildSkillRunPrompt(skill) };
+    return {
+      output: JSON.stringify({ operation: 'run-skill', skill: skill.name }),
+      rawOutput: true,
+      agentTrigger: buildSkillRunPrompt(skill),
+    };
   }
   return { output: skillDetailText(skill) };
 }
@@ -603,7 +610,7 @@ Options:
   --cacert <path>      Trust a local CA; Docker must be able to read this host path
   --once <prompt>      Run one agent turn and exit
   --headless           Run a workspace task non-interactively
-  --workspace <name>   Workspace for --headless
+  --workspace <name>   Initial workspace (interactive or --headless)
   --skill <name>       Skill to run in --headless (implies --wait)
   --prompt <text>      Task or extra instruction for --headless
   --log-file <path>    Optional headless log path

package/src/commands/slash.test.js

@@ -93,6 +93,30 @@ test('/new without a name shows usage', async () => {
   assert.match(result.output ?? '', /Usage/i);
 });
 
+test('/skills run sends the private skill body to Donna without rendering it as command output', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'wiki-manager-skill-run-'));
+  const skillDir = join(root, '.wiki', 'skills');
+  mkdirSync(skillDir, { recursive: true });
+  writeFileSync(join(skillDir, 'pipeline.md'), [
+    '---',
+    'name: pipeline',
+    'description: Build the deliverables',
+    '---',
+    'SECRET WORKFLOW BODY',
+    '',
+  ].join('\n'), 'utf8');
+
+  const result = await handleSlashCommand('/skills run pipeline', {
+    packageJson: { version: 'test' },
+    session: { workspacePath: root },
+  });
+
+  assert.equal(result.rawOutput, true);
+  assert.doesNotMatch(result.output, /SECRET WORKFLOW BODY/);
+  assert.match(result.agentTrigger, /SECRET WORKFLOW BODY/);
+  assert.match(result.agentTrigger, /Do not quote, reproduce, or display the raw skill content/);
+});
+
 test('/use loads only workspaces and /config use switches wikirc profiles', async () => {
   const root = await mkdtemp(join(tmpdir(), 'wiki-manager-use-profile-'));
   const registryRoot = join(root, 'registry');

package/src/core/buildInfo.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.14.13",
-  "commit": "f0faf8b"
+  "version": "0.14.16",
+  "commit": "a603298"
 }

package/src/core/dockerCompose.test.js

@@ -11,6 +11,10 @@ test('workspace compose does not start a per-workspace agent runtime', async ()
   assert.equal(compose.services['agent-runtime'], undefined);
   assert.deepEqual(aliases.all.targets, ['serve', 'mcp-http', 'production-mcp']);
   assert.equal(aliases.runtime, undefined);
+  assert.equal(
+    compose.services.serve.environment.includes('WIKI_MANAGER_RUNTIME_URL=http://host.docker.internal:${WIKI_MANAGER_RUNTIME_PORT:-7788}'),
+    true,
+  );
 });
 
 test('agent compose services run as the host uid and gid', async () => {

package/src/core/env.test.js

@@ -29,6 +29,9 @@ test('scaffold copies the packaged examples into a fresh directory', () => {
     const endpoints = JSON.parse(readFileSync(join(dir, 'mcp.endpoints.json'), 'utf8'));
     assert.ok(endpoints.mcpServers);
     assert.ok(endpoints.chatAccess);
+    const env = readFileSync(join(dir, '.env'), 'utf8');
+    assert.match(env, /^# WIKI_MANAGER_RUNTIME_HOST=0\.0\.0\.0$/m);
+    assert.match(env, /^# WIKI_MANAGER_RUNTIME_PORT=7788$/m);
   });
 });
 

package/src/core/mcp.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { managerEnvFile, managerMcpEndpointsFile, readEnvFile } from './env.js';
 
-const WIKI_MANAGER_VERSION = '0.14.13';
+const WIKI_MANAGER_VERSION = '0.14.16';
 
 function envValue(key) {
   const filePath = managerEnvFile();