@dotdrelle/wiki-manager 0.14.23 → 0.15.26

package/README.md

@@ -517,6 +517,45 @@ process environment (including the `.env` loaded at startup):
 Copy `mcp.endpoints.example.json` to `mcp.endpoints.json` and set the matching
 token variables in `.env`.
 
+### `chatAccess`: which tools chat may use
+
+Declaring a server above makes its tools available to **`/agent`** — no further
+declaration, ever. Plug in a new MCP and Donna discovers and uses its tools
+immediately.
+
+The optional `chatAccess` block is the authorization layer for **`/chat`**,
+which is closed by default. It decides which tools chat may use, and nothing
+else:
+
+```json
+"chatAccess": {
+  "maxToolIterations": 8,
+  "servers": {
+    "cme":  { "allow": ["cme_status", "cme_sources_list", "cme_export_status"] },
+    "exa":  { "allow": ["*"] }
+  }
+}
+```
+
+| entry | effect in `/chat` |
+| --- | --- |
+| server absent | none of its tools — agent-only |
+| `"allow": ["*"]` | every tool the server exposes |
+| `"allow": [names]` | exactly those tools |
+
+Every server uses this one shape. The list is authoritative: naming a tool is
+the decision, whatever the tool is called. No name heuristic filters it — a
+tool name is not a contract, and a third-party MCP is free to name its tools
+however it likes.
+
+`/chat` carries no plan: it performs direct unitary actions only. The
+orchestration entry points (`agent_plan`, `agent_execute`,
+`production_start_job`, and plan mutation) are therefore never offered to it,
+including under `"*"`. Multi-step work belongs to `/agent`.
+
+An `allowActions` key written by an older manager is folded into `allow` on
+read and removed on the next `agents up`.
+
 MCP `tools/call` requests retry transient HTTP/MCP failures before the run fails.
 They also share a per-endpoint outbound control budget (45 RPM by default,
 configurable with `WIKI_MANAGER_MCP_REQUESTS_PER_MINUTE`). This budget is
@@ -642,10 +681,11 @@ start/state secrets when missing. It adds a regular, standard MCP `connectors`
 entry to `mcp.endpoints.json`. Setting `CONNECTORS_ENABLED=false` and running
 `agents up` removes that entry again, so disabled services are not probed. No
 non-standard `enabled` property is written to MCP configuration files.
-The matching `chatAccess.connectors` policy is managed at the same time. Its
-read-only `allow` list exposes `connectors_google_status`, while the explicit
-`allowActions` list exposes only `connectors_google_oauth_start`. Orchestration
-tools such as `agent_execute` are never exposed directly to served chat.
+The matching `chatAccess.connectors` policy is managed at the same time, in the
+same shape as every other server — a single `allow` list holding
+`connectors_google_status` and `connectors_google_oauth_start`, so chat can
+report the authorization state and start it. See
+[`chatAccess`](#chataccess-which-tools-chat-may-use).
 
 Connector authorization is also available without asking the LLM. These two
 commands work in both the Shell UI and the `llm-wiki serve` chat:

package/agents.docker-compose.yml

@@ -19,6 +19,8 @@
 #   GOOGLE_OAUTH_CLIENT_ID / GOOGLE_OAUTH_CLIENT_SECRET — OAuth application
 #   GOOGLE_OAUTH_CALLBACK_URL — exact public post-proxy callback URL
 #   OAUTH_STATE_SECRET / OAUTH_START_TOKEN — distinct 32+ byte secrets
+#   CONNECTORS_SEND_ENABLED — true; set to false to disable outbound email entirely
+#   CONNECTORS_SEND_ALLOWED_RECIPIENTS — comma-separated addresses or @domain suffixes
 #   DOCUMENT_LLM_BASE_URL  — https://albert.api.etalab.gouv.fr/v1
 #   DOCUMENT_LLM_MODEL     — lightonai/LightOnOCR-2-1B
 #   DOCUMENT_LLM_API_KEY   — OpenAI/OpenAI-compatible API key for document OCR
@@ -109,6 +111,10 @@ services:
       - OAUTH_STATE_TTL_SECONDS=${OAUTH_STATE_TTL_SECONDS:-600}
       - CONNECTORS_RECOMMENDED_CONCURRENCY=${CONNECTORS_RECOMMENDED_CONCURRENCY:-2}
       - CONNECTORS_MAX_CONCURRENCY=${CONNECTORS_MAX_CONCURRENCY:-4}
+      - CONNECTORS_SEND_ENABLED=${CONNECTORS_SEND_ENABLED:-true}
+      - CONNECTORS_SEND_ALLOWED_RECIPIENTS=${CONNECTORS_SEND_ALLOWED_RECIPIENTS:-}
+      - CONNECTORS_SEND_MAX_RECIPIENTS=${CONNECTORS_SEND_MAX_RECIPIENTS:-25}
+      - CONNECTORS_SEND_MAX_BODY_BYTES=${CONNECTORS_SEND_MAX_BODY_BYTES:-262144}
       - NODE_USE_ENV_PROXY=${NODE_USE_ENV_PROXY:-}
       - HTTPS_PROXY=${HTTPS_PROXY:-}
       - HTTP_PROXY=${HTTP_PROXY:-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotdrelle/wiki-manager",
-  "version": "0.14.23",
+  "version": "0.15.26",
   "description": "Agentic shell and orchestration cockpit for llm-wiki workspaces.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "author": "dotrelle",
@@ -11,7 +11,7 @@
   },
   "scripts": {
     "start": "bun ./bin/wiki-manager.js",
-    "test": "node --test src/agent/graph.test.js src/contracts/schemas.test.js src/core/activity.test.js src/core/env.test.js src/core/buildInfo.test.js src/core/agentEvents.test.js src/core/runtimeLog.test.js src/activity/activityAggregator.test.js src/graph/runGraphProjector.test.js src/core/workflow.test.js src/core/planPatch.test.js src/core/agentLoop.test.js src/core/plan.test.js src/core/mcp.test.js src/core/toolLoop.test.js src/core/documentIntake.test.js src/core/dockerCompose.test.js src/core/wikiWorkspace.test.js src/core/wikirc.test.js src/core/cacert.test.js src/core/modelFetch.test.js src/core/startupCheck.test.js src/core/queueStore.test.js src/orchestrator/agentRegistry.test.js src/orchestrator/capabilityRegistry.test.js src/orchestrator/capabilityResolver.test.js src/orchestrator/planValidator.test.js src/orchestrator/planIntegrator.test.js src/orchestrator/scheduler.test.js src/orchestrator/attemptManager.test.js src/orchestrator/resultAggregator.test.js src/orchestrator/approvalPolicy.test.js src/commands/slash.test.js src/shell/repl.test.js src/runtime/store.test.js src/runtime/controlMessages.test.js src/runtime/recoveryManager.test.js src/runtime/server.test.js src/runtime/supervisor.test.js src/runtime/runner.test.js src/runtime/runner.e2e.test.js src/runtime/donna-contract.test.js src/runtime/auth.test.js",
+    "test": "node --test src/cli/runtimeStartup.test.js src/cli/wiki-manager.test.js src/agent/graph.test.js src/contracts/schemas.test.js src/core/activity.test.js src/core/env.test.js src/core/buildInfo.test.js src/core/agentEvents.test.js src/core/runtimeLog.test.js src/activity/activityAggregator.test.js src/graph/runGraphProjector.test.js src/core/workflow.test.js src/core/planPatch.test.js src/core/agentLoop.test.js src/core/plan.test.js src/core/mcp.test.js src/core/toolLoop.test.js src/core/documentIntake.test.js src/core/dockerCompose.test.js src/core/wikiWorkspace.test.js src/core/wikirc.test.js src/core/cacert.test.js src/core/modelFetch.test.js src/core/startupCheck.test.js src/core/queueStore.test.js src/orchestrator/agentRegistry.test.js src/orchestrator/capabilityRegistry.test.js src/orchestrator/capabilityResolver.test.js src/orchestrator/planValidator.test.js src/orchestrator/planIntegrator.test.js src/orchestrator/scheduler.test.js src/orchestrator/attemptManager.test.js src/orchestrator/resultAggregator.test.js src/orchestrator/approvalPolicy.test.js src/orchestrator/dispatcher.test.js src/orchestrator/objectiveResolver.test.js src/commands/slash.test.js src/shell/repl.test.js src/runtime/store.test.js src/runtime/controlMessages.test.js src/runtime/recoveryManager.test.js src/runtime/server.test.js src/runtime/supervisor.test.js src/runtime/runner.test.js src/runtime/runner.e2e.test.js src/runtime/donna-contract.test.js src/runtime/auth.test.js",
     "check-versions": "node scripts/check-versions.js",
     "prepack": "node scripts/check-versions.js",
     "prepublishOnly": "node scripts/check-versions.js",

package/src/agent/graph.js

@@ -1083,7 +1083,7 @@ export function isDonnaReadTool(item) {
 // production agent) is delegated for its DAG/parallelism; plain single-step
 // tools are called directly. This is a blocklist, not a whitelist, so adding a
 // new MCP never silently disables its tools.
-function isOrchestrationBypassTool(name) {
+export function isOrchestrationBypassTool(name) {
   const full = String(name ?? '');
   if (!full) return true;
   if (full === 'wiki__plan_set' || full === 'wiki__plan_done') return true;

package/src/core/buildInfo.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.14.23",
-  "commit": "f0519ef"
+  "version": "0.15.26",
+  "commit": "1af3dea"
 }

package/src/core/mcp.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { managerEnvFile, managerMcpEndpointsFile, readEnvFile } from './env.js';
 
-const WIKI_MANAGER_VERSION = '0.14.23';
+const WIKI_MANAGER_VERSION = '0.15.26';
 
 function envValue(key) {
   const filePath = managerEnvFile();
@@ -64,11 +64,18 @@ function normalizeExternalUrlForRuntime(url) {
   return url;
 }
 
-// Config-driven policy for the /chat read-only toolset — NOT /agent, which has
-// the full toolset and ignores this. The endpoints file's "chatAccess" block
-// declares, per server, which tools /chat may call ("*" or a list), plus a
-// maxToolIterations budget. Operator-owned, agnostic allow-list. Returns null
-// when not configured — then /chat stays a plain, tool-less conversation.
+// Config-driven policy for the /chat toolset — NOT /agent, which has the full
+// toolset and ignores this. The endpoints file's "chatAccess" block declares,
+// per server, which tools /chat may call ("*" or a list), plus a
+// maxToolIterations budget. Every server uses the SAME shape: one `allow` key.
+// Operator-owned, agnostic allow-list. Returns null when not configured — then
+// /chat stays a plain, tool-less conversation.
+//
+// `allowActions` is a legacy key from the connectors work: it carved out a
+// second list for tools the read-verb heuristic rejected, which made one
+// server's entry shaped differently from every other. It is folded into
+// `allow` on read so existing installs keep working without regenerating
+// their endpoints file, but nothing writes it any more.
 export function readChatAccessConfig() {
   const filePath = managerMcpEndpointsFile();
   if (!existsSync(filePath)) return null;
@@ -81,14 +88,15 @@ export function readChatAccessConfig() {
     // "*" is also commonly written as a one-element array (["*"]) since every
     // other "allow" example in this config is an array of tool names — treat
     // both forms as the same wildcard rather than silently allowing nothing.
+    const legacyActions = Array.isArray(entry?.allowActions)
+      ? entry.allowActions.map(String).filter(Boolean)
+      : [];
     if (entry?.allow === '*' || (Array.isArray(entry?.allow) && entry.allow.length === 1 && entry.allow[0] === '*')) {
       servers[name] = { allow: '*' };
     } else if (Array.isArray(entry?.allow)) {
-      servers[name] = { allow: entry.allow.map(String).filter(Boolean) };
-    }
-    if (Array.isArray(entry?.allowActions)) {
-      servers[name] ??= { allow: [] };
-      servers[name].allowActions = entry.allowActions.map(String).filter(Boolean);
+      servers[name] = { allow: [...new Set([...entry.allow.map(String).filter(Boolean), ...legacyActions])] };
+    } else if (legacyActions.length > 0) {
+      servers[name] = { allow: legacyActions };
     }
   }
   const maxToolIterations = Number.isFinite(Number(chatAccess.maxToolIterations)) && Number(chatAccess.maxToolIterations) > 0

package/src/orchestrator/dispatcher.js

@@ -115,7 +115,7 @@ export async function execute(task, assignment, {
           jobId,
           status: lastStatus?.result?.status ?? lastStatus?.status,
           outputs: lastStatus?.result?.outputRefs ?? [],
-          error: lastStatus?.result?.error?.code ?? lastStatus?.result?.error?.message ?? null,
+          error: normalizeTaskError(lastStatus?.result?.error)?.code ?? null,
           detail: 'terminal status',
         }));
         return taskResultFromStatus(task, assignment, jobId, lastStatus, attempt);
@@ -135,7 +135,7 @@ export async function execute(task, assignment, {
           jobId,
           status: lastStatus?.result?.status ?? lastStatus?.status,
           outputs: lastStatus?.result?.outputRefs ?? [],
-          error: lastStatus?.result?.error?.code ?? lastStatus?.result?.error?.message ?? null,
+          error: normalizeTaskError(lastStatus?.result?.error)?.code ?? null,
           detail: 'terminal status',
         }));
         return taskResultFromStatus(task, assignment, jobId, lastStatus, attempt);
@@ -213,20 +213,49 @@ function taskResultFromStatus(task, assignment, jobId, statusPayload, attempt =
     status: result.status ?? statusPayload?.status,
     outputRefs: Array.isArray(result.outputRefs) ? result.outputRefs : [],
     metrics: result.metrics ?? {},
-    error: result.error ?? null,
+    error: normalizeTaskError(result.error),
     rawStatus: statusPayload,
   };
 }
 
+// An agent may report a terminal failure either as an object ({code, message})
+// or as a bare reason string — the contract mandates neither, and the
+// executor-only agents report the latter. Consumers (runner logs, the UIs)
+// only ever read `.code`/`.message`, so an unnormalized string silently
+// became `null` and every failure surfaced as a bare "failed" with no reason.
+// Normalize once, here, so the shape is uniform for every downstream reader.
+export function normalizeTaskError(rawError, { fallbackCode = null, fallbackMessage = null } = {}) {
+  if (rawError && typeof rawError === 'object') {
+    const code = String(rawError.code ?? rawError.message ?? fallbackCode ?? 'failed');
+    return {
+      code,
+      message: String(rawError.message ?? rawError.code ?? fallbackMessage ?? code),
+      retryable: rawError.retryable === true
+        || transientError(rawError.code)
+        || transientError(rawError.message),
+    };
+  }
+  if (rawError === null || rawError === undefined || String(rawError).trim() === '') {
+    if (!fallbackCode) return null;
+    return {
+      code: String(fallbackCode),
+      message: String(fallbackMessage ?? fallbackCode),
+      retryable: transientError(fallbackCode),
+    };
+  }
+  const code = String(rawError);
+  return {
+    code,
+    message: String(fallbackMessage ?? code),
+    retryable: transientError(code),
+  };
+}
+
 function rejectedTaskResult(task, assignment, payload, attempt = null) {
-  const rawError = payload?.error;
-  const error = rawError && typeof rawError === 'object'
-    ? { ...rawError }
-    : {
-        code: String(rawError ?? 'execution_rejected'),
-        message: String(payload?.message ?? rawError ?? 'agent_execute rejected task'),
-        retryable: transientError(rawError ?? payload?.message),
-      };
+  const error = normalizeTaskError(payload?.error, {
+    fallbackCode: 'execution_rejected',
+    fallbackMessage: payload?.message ?? 'agent_execute rejected task',
+  });
   return {
     ok: false,
     taskId: String(task.id ?? task.step),
@@ -236,11 +265,7 @@ function rejectedTaskResult(task, assignment, payload, attempt = null) {
     status: 'failed',
     outputRefs: [],
     metrics: {},
-    error: {
-      code: String(error.code ?? 'execution_rejected'),
-      message: String(error.message ?? error.code ?? 'agent_execute rejected task'),
-      retryable: error.retryable === true || transientError(error.code) || transientError(error.message),
-    },
+    error,
     rawStatus: payload,
   };
 }

package/src/orchestrator/dispatcher.test.js

@@ -80,3 +80,82 @@ test('dispatcher completes when an executor-only agent reports succeeded', async
   assert.equal(result.status, 'succeeded');
   assert.equal(result.jobId, 'job-connectors');
 });
+
+test('dispatcher normalizes a bare string error reported on a terminal agent_status', async () => {
+  const session = {
+    workspace: 'test',
+    mcp: {
+      connectors: {
+        status: 'connected',
+        tools: [
+          { name: 'agent_execute' },
+          { name: 'agent_status' },
+          { name: 'agent_cancel' },
+        ],
+      },
+    },
+    activities: {},
+  };
+  const dispatcher = createDispatcher({
+    session,
+    pollIntervalMs: 1,
+    callTool: async (_mcp, _server, tool) => {
+      if (tool === 'agent_execute') {
+        return { accepted: true, jobId: 'job-connectors', status: 'queued' };
+      }
+      return {
+        jobId: 'job-connectors',
+        status: 'failed',
+        terminal: true,
+        // Executor-only agents report the reason as a bare string, which the
+        // contract permits; it must not be swallowed into a bare "failed".
+        result: { status: 'failed', error: 'authentication_required' },
+      };
+    },
+  });
+
+  const result = await dispatcher.execute(
+    {
+      id: 'collect-mail',
+      requiredCapability: 'external-source.collect',
+      operation: 'collect',
+      arguments: {},
+    },
+    { serverName: 'connectors', agentInstanceId: 'connectors' },
+    { attempt: { attemptId: 'collect-mail:attempt-1', locks: [], release() {} } },
+  );
+
+  assert.equal(result.ok, false);
+  assert.equal(result.error.code, 'authentication_required');
+  assert.equal(result.error.message, 'authentication_required');
+  assert.equal(result.error.retryable, false);
+});
+
+test('dispatcher keeps a null error when a terminal status reports none', async () => {
+  const session = {
+    workspace: 'test',
+    mcp: {
+      connectors: {
+        status: 'connected',
+        tools: [{ name: 'agent_execute' }, { name: 'agent_status' }, { name: 'agent_cancel' }],
+      },
+    },
+    activities: {},
+  };
+  const dispatcher = createDispatcher({
+    session,
+    pollIntervalMs: 1,
+    callTool: async (_mcp, _server, tool) => (tool === 'agent_execute'
+      ? { accepted: true, jobId: 'job-connectors', status: 'queued' }
+      : { jobId: 'job-connectors', status: 'succeeded', terminal: true, result: { status: 'succeeded' } }),
+  });
+
+  const result = await dispatcher.execute(
+    { id: 'collect-mail', requiredCapability: 'external-source.collect', operation: 'collect', arguments: {} },
+    { serverName: 'connectors', agentInstanceId: 'connectors' },
+    { attempt: { attemptId: 'collect-mail:attempt-1', locks: [], release() {} } },
+  );
+
+  assert.equal(result.ok, true);
+  assert.equal(result.error, null);
+});

package/src/runtime/runner.js

@@ -841,7 +841,9 @@ async function runDispatchedTask(task, {
         assignment,
         jobId: result?.jobId,
         error: result?.error?.code ?? result?.error?.message ?? result?.status ?? 'failed',
-        detail: 'task terminal',
+        // Carry the agent's own reason instead of a constant: "task terminal"
+        // told the operator nothing about WHY the task ended.
+        detail: result?.error?.message ?? result?.error?.code ?? 'task terminal',
       }));
       return { ok: false, taskId, result, assignment };
     }

package/src/shell/repl.js

@@ -7,7 +7,7 @@ import path from 'node:path';
 import { stdin as input, stdout as output } from 'node:process';
 import { marked } from 'marked';
 import { markedTerminal } from 'marked-terminal';
-import { buildAgentSystemPrompt, formatLlmUnavailableMessage, isDonnaReadTool } from '../agent/graph.js';
+import { buildAgentSystemPrompt, formatLlmUnavailableMessage, isOrchestrationBypassTool } from '../agent/graph.js';
 import { handleSlashCommand } from '../commands/slash.js';
 import { serviceDescription, serviceNames as composeServiceNames } from '../core/compose.js';
 import { extractActivity, parseJsonText, sessionActivities } from '../core/activity.js';
@@ -291,24 +291,43 @@ function isDonnaRole(role) {
   return role === 'donna' || role === LEGACY_DONNA_ROLE;
 }
 
-// Read-only MCP tools exposed to /chat. The operator declares which tools per
-// server in the `chatAccess` config (mcp.endpoints.json). /chat is extended to
-// those tools ONLY, filtered through the same read-only test Donna's /agent
-// mode uses (isDonnaReadTool), and only when their server is connected — so
-// /chat can answer live state questions ("le CME est-il configuré ?") but can
-// never mutate or delegate. Actions still belong to /agent, which has all tools.
-export function chatReadTools(session) {
+// MCP tools exposed to /chat. `chatAccess` (mcp.endpoints.json) is a per-mode
+// authorization layer deciding which tools /chat may use — nothing else. It is
+// the operator's declaration and it is AUTHORITATIVE:
+//
+//   - server absent      → none of its tools exist in /chat. Closed by default.
+//   - "allow": ["*"]     → every tool the server exposes.
+//   - "allow": [names]   → exactly those. Taking the time to name a tool IS the
+//                          decision, whatever the name looks like.
+//
+// /agent is unaffected: it uses every discovered, connected server with no
+// chatAccess declaration at all, so plugging in a new MCP makes it work with
+// Donna immediately.
+//
+// This used to be double-gated by a read-verb name heuristic (isDonnaReadTool),
+// which silently dropped an explicitly allow-listed tool that did not look
+// read-only — the reason a second `allowActions` key had to be invented for
+// connectors_google_oauth_start. A tool name is not a contract: the heuristic
+// also classified `collect` as a read while external-source.collect writes to
+// the workspace, and it would mis-sort any third-party MCP naming its tools
+// differently. Gone.
+//
+// isOrchestrationBypassTool stays: /chat carries no plan, only direct unitary
+// actions. agent_plan/agent_execute/production_start_job and plan mutation
+// would start work outside the plan and its approval gate.
+export function chatAllowedTools(session) {
   const servers = session?.chatAccess?.servers;
   if (!servers) return [];
   const scopedMcp = Object.fromEntries(
     Object.entries(session.mcp ?? {}).filter(([name]) => Object.hasOwn(servers, name)),
   );
   return buildLlmTools(scopedMcp).filter((item) => {
-    const { server, tool } = parseToolCallName(item.function.name);
+    const name = item.function.name;
+    if (isOrchestrationBypassTool(name)) return false;
+    const { server, tool } = parseToolCallName(name);
     const entry = servers[server];
-    const declared = entry.allow === '*' ? true : (Array.isArray(entry.allow) && entry.allow.includes(tool));
-    const declaredAction = Array.isArray(entry.allowActions) && entry.allowActions.includes(tool);
-    return (declared && isDonnaReadTool(item)) || declaredAction;
+    if (entry.allow === '*') return true;
+    return Array.isArray(entry.allow) && entry.allow.includes(tool);
   });
 }
 
@@ -1300,15 +1319,17 @@ async function runAgentTurn(input, { agent, session, onUpdate, onStep, displayIn
   return {};
 }
 
-// Bounded read-only tool loop for /chat. Only the tools declared in chatAccess
-// (and read-only) are offered; every call goes through callMcpTool, and any
-// tool the model names outside the offered set is refused — /chat can never
-// mutate or delegate. maxToolIterations caps the loop.
-async function runChatReadToolLoop({ input, session, history, donnaMessage, onUpdate, onStep, readTools, openWikiPages, contextMessages = [] }) {
-  const allowed = new Set(readTools.map((item) => item.function.name));
+// Bounded tool loop for /chat. Only the tools chatAccess authorizes for this
+// server are offered; every call goes through callMcpTool, and any tool the
+// model names outside the offered set is refused. /chat performs direct
+// unitary actions only — it never plans or delegates, which is why the
+// orchestration tools are filtered out upstream. maxToolIterations caps the
+// loop.
+async function runChatToolLoop({ input, session, history, donnaMessage, onUpdate, onStep, allowedTools, openWikiPages, contextMessages = [] }) {
+  const allowed = new Set(allowedTools.map((item) => item.function.name));
   // /chat only supplies the policy; the loop mechanic lives in runBoundedToolLoop.
   // executeCall enforces the allow-list and turns each call into a text result;
-  // it never mutates and refuses anything outside the offered read set.
+  // it refuses anything outside the offered set.
   const executeCall = async (call) => {
     const rawName = call.function?.name ?? '';
     const { server, tool } = resolveToolCallName(session.mcp, rawName);
@@ -1331,7 +1352,7 @@ async function runChatReadToolLoop({ input, session, history, donnaMessage, onUp
     llm: session.llm,
     system: buildDirectChatSystemPrompt(session, openWikiPages),
     messages: [...history, ...contextMessages, { role: 'user', content: input }],
-    tools: readTools,
+    tools: allowedTools,
     executeCall,
     maxIterations: Math.min(8, Number(session?.chatAccess?.maxToolIterations) || 4),
     signal: session._abortSignal,
@@ -1355,11 +1376,11 @@ async function runDirectChatTurn(input, { session, onUpdate, onStep }) {
   const donnaMessage = { role: 'donna', content: '' };
   messages.push(donnaMessage);
   onUpdate?.();
-  const readTools = chatReadTools(session);
-  const canUseReadTools = readTools.length > 0 && typeof session.llm.completeWithTools === 'function';
+  const allowedTools = chatAllowedTools(session);
+  const canUseTools = allowedTools.length > 0 && typeof session.llm.completeWithTools === 'function';
   try {
-    if (canUseReadTools) {
-      await runChatReadToolLoop({ input, session, history, donnaMessage, onUpdate, onStep, readTools });
+    if (canUseTools) {
+      await runChatToolLoop({ input, session, history, donnaMessage, onUpdate, onStep, allowedTools });
     } else {
       onStep?.('Chat: streaming direct answer…');
       for await (const delta of session.llm.stream({
@@ -1392,14 +1413,14 @@ async function runDirectChatTurn(input, { session, onUpdate, onStep }) {
 }
 
 // Headless equivalent of runDirectChatTurn for HTTP callers (the runtime /turn
-// in chat mode). Reuses the exact same read-only policy — chatReadTools +
-// runChatReadToolLoop + buildDirectChatSystemPrompt — so there is no second
+// in chat mode). Reuses the exact same authorization policy — chatAllowedTools
+// + runChatToolLoop + buildDirectChatSystemPrompt — so there is no second
 // implementation of chat access; it just returns the final text instead of
 // driving a live repl bubble. The caller must have seeded session.chatAccess
-// (and session.mcp) so chatReadTools can resolve the allow-listed read tools.
+// (and session.mcp) so chatAllowedTools can resolve the allow-listed tools.
 export async function runHeadlessChatTurn(session, input, { history = [], onStep, openWikiPages, openWikiPage } = {}) {
   const donnaMessage = { role: 'donna', content: '' };
-  const readTools = chatReadTools(session);
+  const allowedTools = chatAllowedTools(session);
   // Keep the singular option as a compatibility input for older serve builds.
   // Only paths enter the prompt; reading remains the model's generic tool call.
   const selectedPages = sanitizeOpenWikiPages(openWikiPages ?? openWikiPage);
@@ -1408,9 +1429,9 @@ export async function runHeadlessChatTurn(session, input, { history = [], onStep
   // (up to five) are each folded in as their own delimited block.
   const attachedDocs = await readSelectedPageDocuments(session, selectedPages);
   const contextMessages = buildAttachedDocMessages(attachedDocs);
-  const canUseReadTools = readTools.length > 0 && typeof session.llm?.completeWithTools === 'function';
-  if (canUseReadTools) {
-    await runChatReadToolLoop({ input, session, history, donnaMessage, onStep, readTools, openWikiPages: selectedPages, contextMessages });
+  const canUseTools = allowedTools.length > 0 && typeof session.llm?.completeWithTools === 'function';
+  if (canUseTools) {
+    await runChatToolLoop({ input, session, history, donnaMessage, onStep, allowedTools, openWikiPages: selectedPages, contextMessages });
     return donnaMessage.content;
   }
   if (typeof session.llm?.stream === 'function') {

package/src/shell/repl.test.js

@@ -5,7 +5,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import {
   applyRuntimeStateToShellSession,
-  chatReadTools,
+  chatAllowedTools,
   createSession,
   runHeadlessChatTurn,
   sanitizeOpenWikiPage,
@@ -622,7 +622,7 @@ test('submitRuntimeRun sends a control message instead of /run while a run is ac
   }
 });
 
-test('chatReadTools exposes only declared, read-only MCP tools to /chat', () => {
+test('chatAllowedTools exposes exactly the declared MCP tools to /chat', () => {
   const session = {
     chatAccess: {
       servers: {
@@ -645,13 +645,14 @@ test('chatReadTools exposes only declared, read-only MCP tools to /chat', () =>
       },
     },
   };
-  const names = chatReadTools(session).map((item) => item.function.name).sort();
-  // cme_setup: not declared. cme_export_run: declared but a write (excluded by
-  // the read-only guard). documents_status: server absent from chatAccess.
-  assert.deepEqual(names, ['cme__cme_sources_list', 'cme__cme_status']);
+  const names = chatAllowedTools(session).map((item) => item.function.name).sort();
+  // cme_setup: not declared. documents_status: server absent from chatAccess.
+  // cme_export_run: declared, so it is offered — the allow-list is the
+  // operator's explicit decision, not a suggestion filtered by a heuristic.
+  assert.deepEqual(names, ['cme__cme_export_run', 'cme__cme_sources_list', 'cme__cme_status']);
 });
 
-test('chatReadTools accepts wiki_collect_context ("collect" is a read verb)', () => {
+test('chatAllowedTools offers every declared tool, reads and writes alike', () => {
   const session = {
     chatAccess: {
       servers: {
@@ -669,39 +670,122 @@ test('chatReadTools accepts wiki_collect_context ("collect" is a read verb)', ()
       },
     },
   };
-  const names = chatReadTools(session).map((item) => item.function.name).sort();
-  // wiki_write_page: declared but a write — excluded by the read-only guard
-  // even if an operator allow-lists it by mistake.
-  assert.deepEqual(names, ['wiki__wiki_collect_context', 'wiki__wiki_search_context']);
+  const names = chatAllowedTools(session).map((item) => item.function.name).sort();
+  assert.deepEqual(
+    names,
+    ['wiki__wiki_collect_context', 'wiki__wiki_search_context', 'wiki__wiki_write_page'],
+  );
+});
+
+test('chatAllowedTools "*" offers every tool of the server, writes included', () => {
+  const session = {
+    chatAccess: { servers: { exa: { allow: '*' } } },
+    mcp: {
+      exa: {
+        status: 'connected',
+        tools: [
+          { name: 'web_search_exa', inputSchema: { type: 'object', properties: {} } },
+          { name: 'crawling_exa', inputSchema: { type: 'object', properties: {} } },
+          { name: 'deep_researcher_start', inputSchema: { type: 'object', properties: {} } },
+        ],
+      },
+      documents: {
+        status: 'connected',
+        tools: [{ name: 'documents_status', inputSchema: { type: 'object', properties: {} } }],
+      },
+    },
+  };
+  // No name is inspected: "*" is the operator saying "this whole server".
+  // documents stays out — it is absent from chatAccess, so it is agent-only.
+  assert.deepEqual(
+    chatAllowedTools(session).map((item) => item.function.name).sort(),
+    ['exa__crawling_exa', 'exa__deep_researcher_start', 'exa__web_search_exa'],
+  );
 });
 
-test('chatReadTools accepts only actions explicitly declared in allowActions', () => {
+test('chatAllowedTools offers an action no read-verb heuristic would accept', () => {
   const session = {
     chatAccess: {
       servers: {
-        connectors: { allow: [], allowActions: ['connectors_google_oauth_start'] },
+        connectors: {
+          allow: ['connectors_google_status', 'connectors_google_oauth_start'],
+        },
+      },
+    },
+    mcp: {
+      connectors: {
+        status: 'connected',
+        tools: [
+          { name: 'connectors_google_status', inputSchema: { type: 'object', properties: {} } },
+          { name: 'connectors_google_oauth_start', inputSchema: { type: 'object', properties: {} } },
+        ],
       },
     },
+  };
+
+  assert.deepEqual(
+    chatAllowedTools(session).map((item) => item.function.name).sort(),
+    ['connectors__connectors_google_oauth_start', 'connectors__connectors_google_status'],
+  );
+});
+
+// /chat carries no plan: it performs direct unitary actions only. The
+// orchestration entry points stay out of it whichever way they are declared.
+test('chatAllowedTools never offers orchestration tools, even when allow-listed', () => {
+  const session = {
+    chatAccess: {
+      servers: {
+        connectors: { allow: ['agent_execute', 'agent_plan', 'connectors_google_status'] },
+      },
+    },
+    mcp: {
+      connectors: {
+        status: 'connected',
+        tools: [
+          { name: 'agent_execute', inputSchema: { type: 'object', properties: {} } },
+          { name: 'agent_plan', inputSchema: { type: 'object', properties: {} } },
+          { name: 'connectors_google_status', inputSchema: { type: 'object', properties: {} } },
+        ],
+      },
+    },
+  };
+
+  assert.deepEqual(
+    chatAllowedTools(session).map((item) => item.function.name),
+    ['connectors__connectors_google_status'],
+  );
+
+  const wildcard = { ...session, chatAccess: { servers: { connectors: { allow: '*' } } } };
+  assert.deepEqual(
+    chatAllowedTools(wildcard).map((item) => item.function.name),
+    ['connectors__connectors_google_status'],
+  );
+});
+
+test('chatAllowedTools folds a legacy allowActions entry into allow', () => {
+  const session = {
+    chatAccess: {
+      // Shape produced by readChatAccessConfig for a file written by an older
+      // manager: the legacy key is already merged, so chat keeps working.
+      servers: { connectors: { allow: ['connectors_google_oauth_start'] } },
+    },
     mcp: {
       connectors: {
         status: 'connected',
-        tools: [{
-          name: 'connectors_google_oauth_start',
-          inputSchema: { type: 'object', properties: {} },
-        }],
+        tools: [{ name: 'connectors_google_oauth_start', inputSchema: { type: 'object', properties: {} } }],
       },
     },
   };
 
   assert.deepEqual(
-    chatReadTools(session).map((item) => item.function.name),
+    chatAllowedTools(session).map((item) => item.function.name),
     ['connectors__connectors_google_oauth_start'],
   );
 });
 
-test('chatReadTools is empty when no chatAccess is configured', () => {
+test('chatAllowedTools is empty when no chatAccess is configured', () => {
   const session = { mcp: { cme: { status: 'connected', tools: [{ name: 'cme_status', inputSchema: {} }] } } };
-  assert.deepEqual(chatReadTools(session), []);
+  assert.deepEqual(chatAllowedTools(session), []);
 });
 
 test('/chat uses the tool-capable path when read tools are declared', async () => {

package/wiki-workspace

@@ -487,18 +487,18 @@ if (enabled === 'true') {
   };
   config.chatAccess.servers.connectors ??= {};
   const connectorAccess = config.chatAccess.servers.connectors;
+  // One shape for every server: a single `allow` list. The legacy
+  // `allowActions` split is folded back in and removed, so a file written by
+  // an older manager converges to the common shape on the next `agents up`.
   connectorAccess.allow = [
     ...new Set([
       ...(Array.isArray(connectorAccess.allow) ? connectorAccess.allow : []),
-      'connectors_google_status',
-    ].filter((tool) => tool !== 'connectors_google_oauth_start')),
-  ];
-  connectorAccess.allowActions = [
-    ...new Set([
       ...(Array.isArray(connectorAccess.allowActions) ? connectorAccess.allowActions : []),
+      'connectors_google_status',
       'connectors_google_oauth_start',
     ]),
   ];
+  delete connectorAccess.allowActions;
 } else {
   delete config.mcpServers.connectors;
   delete config.chatAccess.servers.connectors;