@dotdrelle/wiki-manager 0.14.6 → 0.14.8

package/.env.example

@@ -59,6 +59,9 @@ DOCUMENTS_MCP_AUTH_TOKEN=
 # Tool calls are retried on transient HTTP/MCP errors before the run fails.
 # WIKI_MANAGER_MCP_RETRY_MAX_ATTEMPTS=2
 # WIKI_MANAGER_MCP_RETRY_BACKOFF_MS=500
+# Outbound MCP control budget, separate from .wikirc LLM requestsPerMinute.
+# Default: 45 RPM (headroom for MCP servers limited to 50 RPM).
+# WIKI_MANAGER_MCP_REQUESTS_PER_MINUTE=45
 
 # ── Runtime evaluator (optional) ───────────────────────────────────────────────
 

package/README.md

@@ -498,6 +498,10 @@ Copy `mcp.endpoints.example.json` to `mcp.endpoints.json` and set the matching
 token variables in `.env`.
 
 MCP `tools/call` requests retry transient HTTP/MCP failures before the run fails.
+They also share a per-endpoint outbound control budget (45 RPM by default,
+configurable with `WIKI_MANAGER_MCP_REQUESTS_PER_MINUTE`). This budget is
+independent from `.wikirc` `requestsPerMinute`, which remains reserved for LLM,
+embedding, and reranking provider calls.
 Set global defaults with `WIKI_MANAGER_MCP_RETRY_MAX_ATTEMPTS` and
 `WIKI_MANAGER_MCP_RETRY_BACKOFF_MS`, or override them per endpoint with `retry`
 and per tool with `toolRetries`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotdrelle/wiki-manager",
-  "version": "0.14.6",
+  "version": "0.14.8",
   "description": "Agentic shell and orchestration cockpit for llm-wiki workspaces.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "author": "dotrelle",
@@ -46,6 +46,11 @@
     "cli"
   ],
   "packageManager": "pnpm@10.29.2",
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "bun"
+    ]
+  },
   "dependencies": {
     "@langchain/langgraph": "^1.3.2",
     "@opentui/core": "^0.3.2",

package/src/agent/graph.js

@@ -403,6 +403,23 @@ function summarizeToolArguments(rawArguments) {
   }
 }
 
+function googleOAuthUrlFromMessages(messages) {
+  for (const message of [...(messages ?? [])].reverse()) {
+    if (message?.role !== 'tool') continue;
+    const match = String(message.content ?? '').match(/https:\/\/accounts\.google\.com\/[^\s<>"')\]]+/i);
+    if (match) return match[0];
+  }
+  return null;
+}
+
+function preserveRequiredOAuthUrl(content, messages) {
+  const text = String(content ?? '');
+  const url = googleOAuthUrlFromMessages(messages);
+  if (!url || text.includes(url)) return text;
+  const prefix = text.trimEnd();
+  return `${prefix}${prefix ? '\n\n' : ''}Lien d’autorisation Google : ${url}`;
+}
+
 function buildQueuedResult(session, item, activeJobId = null) {
   const message = activeJobId != null
     ? `Production job queued as ${item.id}; waiting for ${activeJobId}.`
@@ -709,9 +726,21 @@ async function handleRuntimeControlTool(session, tool, args = {}) {
     if (tool === 'delegate') {
       const objective = String(args.objective ?? '').trim();
       if (!objective) return 'Delegation rejected: missing objective.';
+      const connectorConfig = connectorConfigurationTarget(session, objective);
+      if (connectorConfig?.setupTool) {
+        return `Delegation rejected: configuring or authenticating ${connectorConfig.serverName} is not an orchestrated export. Call the offered ${connectorConfig.serverName}__${connectorConfig.setupTool} tool directly and present its authorization instructions or URL to the user.`;
+      }
+      if (connectorConfig) {
+        return `Delegation rejected: ${connectorConfig.serverName} advertises no setup or authentication tool. Do not call an unrelated data tool and do not delegate to export. Explain conversationally that authentication must be completed outside MCP, using only configuration instructions already available in the current context.`;
+      }
       const result = await postRuntimeDelegate(objective, { url, workspace });
       return result?.runId
-        ? `Action lancée (${String(result.runId).slice(0, 8)}) après validation du plan réel : ${result.delegation?.tasks ?? 0} tâche(s), ${result.delegation?.agent ?? 'agent résolu'}. Exécution en cours.`
+        ? JSON.stringify({
+            delegated: true,
+            runId: result.runId,
+            summary: result.delegation ?? null,
+            message: `Action lancée (${String(result.runId).slice(0, 8)}) après validation du plan réel : ${result.delegation?.tasks ?? 0} tâche(s), ${result.delegation?.agent ?? 'agent résolu'}. Exécution en cours.`,
+          })
         : `Délégation refusée : ${result?.error ?? JSON.stringify(result)}`;
     }
     if (tool === 'enqueue') {
@@ -741,6 +770,24 @@ async function handleRuntimeControlTool(session, tool, args = {}) {
   }
 }
 
+function connectorConfigurationTarget(session, objective) {
+  const text = String(objective ?? '').toLowerCase();
+  if (!/(?:configur|connect|authent|oauth|setup|sign[ -]?in)/i.test(text)) return null;
+  for (const [serverName, server] of Object.entries(session?.mcp ?? {})) {
+    if (server?.status !== 'connected' || !Array.isArray(server.tools) || server.tools.length === 0) continue;
+    const aliases = String(serverName).toLowerCase().split(/[^a-z0-9]+/).filter((part) => part.length >= 3);
+    if (!aliases.some((alias) => text.includes(alias))) continue;
+    const setupTool = server.tools.find((tool) => {
+      const name = String(tool?.name ?? '').toLowerCase();
+      const description = String(tool?.description ?? '').toLowerCase();
+      return /(?:^|_)(?:setup|config|configure|auth|authenticate|oauth|connect)(?:_|$)/.test(name)
+        || /(?:initiat|start|configure|authenticate).{0,30}(?:oauth|authentication)/.test(description);
+    })?.name ?? null;
+    return { serverName, setupTool };
+  }
+  return null;
+}
+
 function handleWikiTool(session, tool, args) {
   if (tool === 'plan_set') {
     const steps = Array.isArray(args.steps) ? args.steps : [];
@@ -883,10 +930,10 @@ export function buildAgentSystemPrompt(state) {
     'For service actions, recommend only available service primitives from Available primitives, with the exact service name when the primitive supports one.',
     'Scope discipline: execute ONLY the action(s) the user explicitly requested. Never chain additional mutating operations (ingest, build, export, polish, delete, send…) that the user did not ask for — even when diagnostics or recommendations suggest them. Finish with the requested result and stop. Example: "applique les recommandations de config" means apply the config; it does NOT authorize launching the ingest those recommendations mention.',
     state.session.runtime?.url
-      ? 'The runtime is connected and runtime__delegate is bound and available to you right now — it is a tool you call directly, not a slash command or a missing primitive. It is the ONLY way to execute an action (ingest, build, export, configure, send…). Never tell the user that delegation or the runtime is unavailable while it is connected; call runtime__delegate instead.'
+      ? 'The runtime is connected and runtime__delegate is bound and available for heavy orchestrated operations (ingest, build, export, polish, pipeline). Single-step connector actions such as configure, authenticate, add a source, convert, search, or send use the connected MCP tool directly. Never delegate connector configuration to an export capability.'
       : 'No runtime is connected, so you cannot execute actions. State that plainly and name the runtime connection as the missing capability — do not invent a workaround.',
     'If the connector or service needed for a requested read or action is absent from the Connected MCP tools above (its service is not running — e.g. CME, documents, or production), say plainly that this service is not connected and name it as the missing capability. Never redirect a simple read (e.g. "give me the CME config") to an "agent action", never invent its result, and never propose a workaround. Only requests you can actually serve with a listed tool are answered with data.',
-    'For any requested action, call runtime__delegate with the user objective only. Never choose a capability, operation, agent, plan, or implementation yourself. The runtime resolves the registry and validates the provider plan before accepting. Never call <provider>__agent_plan, <provider>__agent_execute, legacy production__production_start_job, wiki__plan_set, or wiki__plan_done from interactive chat.',
+    'For heavy orchestrated operations only (ingest, build, export, polish, pipeline), call runtime__delegate with the user objective only. For a single-step connector action, call the offered connector tool directly. Never choose a capability, operation, agent, plan, or implementation yourself. Never call <provider>__agent_plan, <provider>__agent_execute, legacy production__production_start_job, wiki__plan_set, or wiki__plan_done from interactive chat.',
     'Do not ask the user which sources, files, connectors, or templates to use for an ingest, build, or export: the specialized agent discovers them from the workspace. When the objective is clear (e.g. "lance une ingestion"), delegate it as stated, without a clarifying question.',
     'Promise only what the resolved capability actually exposes in its declared contract (the input schema the specialized agent publishes for that capability). When the user requests an execution parameter — a batch or chunk size, a count "N at a time", concurrency, ordering, priority, or any tuning knob — apply it only if that parameter exists in the target capability\'s published input schema. Otherwise do not confirm or promise it: delegate the objective, and if the user explicitly asked for that parameter, say plainly in one line that you started the work but do not control that aspect (the runtime and the specialized agent decide it). Never state or imply a parameter was applied when the agent contract cannot enforce it.',
     'If runtime__delegate returns a blocker or no specialized provider is available, report only that concrete blocker concisely. Never replace the missing execution path with a suggested slash command, skill, MCP tool name, manual file move, administrator escalation, or alternative workflow unless the user explicitly asks for alternatives.',
@@ -958,15 +1005,18 @@ function toolsForClassification(classification, writeTools, session = null) {
   return [SHELL_READ_COMMAND_TOOL, ...controlTools, ...capabilityRunTools, ...writeTools];
 }
 
+const DONNA_READ_VERBS = new Set(['status', 'list', 'search', 'read', 'get', 'fetch']);
+
 export function isDonnaReadTool(item) {
   const name = String(item?.function?.name ?? '');
   if (!name || name.startsWith('shell__') || name === 'wiki__plan_set' || name === 'wiki__plan_done') return false;
   if (item?.readOnly === true) return true;
   const tool = name.includes('__') ? name.slice(name.indexOf('__') + 2) : name;
-  return tool === 'wiki_workspace_status'
-    || tool === 'agent_describe'
-    || tool === 'agent_status'
-    || /(?:^|_)(?:status|list|search|read|get)$/.test(tool);
+  if (tool === 'wiki_workspace_status' || tool === 'agent_describe' || tool === 'agent_status') return true;
+  // Match a read verb anywhere in the underscore-tokenized name, not just as
+  // a trailing suffix — third-party MCPs don't all name tools verb-last
+  // (e.g. exa's "web_search_exa"/"web_fetch_exa" put the verb in the middle).
+  return tool.split('_').some((segment) => DONNA_READ_VERBS.has(segment));
 }
 
 // Two-tier tool policy. Donna may call any connected MCP tool directly
@@ -1187,6 +1237,15 @@ export function createAgentGraph(options = {}) {
         };
       }
 
+      // Authentication URLs are execution outputs, not optional prose. Small
+      // models sometimes summarize an OAuth tool result as "open the supplied
+      // link" while dropping the link itself, leaving ShellUI unusable even
+      // though the MCP call succeeded. Preserve that exact URL deterministically.
+      const finalContent = preserveRequiredOAuthUrl(result.content, conversationMessages);
+      if (finalContent !== String(result.content ?? '')) {
+        result.content = finalContent;
+        result.message = { ...(result.message ?? { role: 'assistant' }), content: finalContent };
+      }
       const invalidCommands = invalidSuggestedSlashCommands(result.content, state.session);
       const leakedTools = invalidUserFacingToolNames(result.content, state.session);
       if (invalidCommands.length > 0 || leakedTools.length > 0) {
@@ -1241,7 +1300,7 @@ export function createAgentGraph(options = {}) {
 
       // Fallback path (streamWithTools unavailable): hand off to runLine for streaming.
       state.session._onStep?.('Agent: streaming final answer…');
-      if (typeof llm.stream === 'function') {
+      if (typeof llm.stream === 'function' && !googleOAuthUrlFromMessages(conversationMessages)) {
         return {
           response: null,
           pendingToolCalls: null,

package/src/agent/graph.test.js

@@ -372,17 +372,128 @@ test('Donna delegates the objective without choosing technical identifiers', asy
             }],
           };
         }
+        const delegateResult = (messages ?? []).filter((message) => message.role === 'tool').at(-1);
+        const parsedDelegateResult = JSON.parse(String(delegateResult?.content ?? '{}'));
+        assert.equal(parsedDelegateResult.delegated, true);
+        assert.equal(parsedDelegateResult.runId, 'run-1');
+        assert.equal(parsedDelegateResult.summary.tasks, 5);
         return { content: 'Plan validé.', message: { role: 'assistant', content: 'Plan validé.' }, tool_calls: null };
       },
     },
   });
 
   try {
-    await createAgentGraph().invoke({ input: 'ingère tout', session });
+    const result = await createAgentGraph().invoke({ input: 'ingère tout', session });
     assert.match(request.url, /\/delegate/);
     assert.deepEqual(request.body, { objective: 'Ingérer tous les fichiers en attente', workspace: 'docs' });
     assert.equal('capability' in request.body, false);
     assert.equal('operation' in request.body, false);
+    assert.equal(result.response, 'Plan validé.');
+    assert.doesNotMatch(result.response, /delegated|run-1|production/);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test('Donna refuses to delegate connector authentication to an export capability', async () => {
+  const originalFetch = globalThis.fetch;
+  const fetchedUrls = [];
+  globalThis.fetch = async (url, options = {}) => {
+    fetchedUrls.push(String(url));
+    const body = JSON.parse(String(options.body ?? '{}'));
+    assert.equal(body.params?.name, 'start_google_auth');
+    return {
+      ok: true,
+      status: 200,
+      headers: { get: () => null },
+      text: async () => JSON.stringify({ result: { content: [{ type: 'text', text: 'ACTION REQUIRED: authorize at https://accounts.google.com/o/oauth2/auth?client_id=test&state=abc' }] } }),
+    };
+  };
+  let turn = 0;
+  const session = sessionBase({
+    runtime: { url: 'http://runtime.test' },
+    mcp: {
+      'google-workspace': {
+        status: 'connected',
+        url: 'http://google.test/mcp',
+        tools: [
+          {
+            name: 'start_google_auth',
+            description: 'Manually initiate Google OAuth authentication flow.',
+            inputSchema: { type: 'object', additionalProperties: true },
+          },
+          { name: 'search_gmail_messages', inputSchema: { type: 'object', additionalProperties: true } },
+        ],
+      },
+    },
+    llm: {
+      async completeWithTools() {
+        turn += 1;
+        if (turn === 1) return {
+          content: null,
+          message: { role: 'assistant', content: null },
+          tool_calls: [{ id: 'wrong-delegate', type: 'function', function: { name: 'runtime__delegate', arguments: '{"objective":"je veux configurer google"}' } }],
+        };
+        if (turn === 2) return {
+          content: null,
+          message: { role: 'assistant', content: null },
+          tool_calls: [{ id: 'google-auth', type: 'function', function: { name: 'google-workspace__start_google_auth', arguments: '{}' } }],
+        };
+        return {
+          content: 'J’ai lancé l’authentification. Ouvre le lien fourni.',
+          message: { role: 'assistant', content: 'J’ai lancé l’authentification. Ouvre le lien fourni.' },
+          tool_calls: null,
+        };
+      },
+    },
+  });
+
+  try {
+    const result = await createAgentGraph().invoke({ input: 'je veux configurer google', session });
+    assert.match(result.response, /J’ai lancé l’authentification/);
+    assert.match(result.response, /https:\/\/accounts\.google\.com\/o\/oauth2\/auth\?client_id=test&state=abc/);
+    assert.equal(fetchedUrls.some((url) => url.includes('runtime.test')), false);
+    assert.equal(fetchedUrls.some((url) => url.includes('google.test')), true);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test('Donna does not invent a setup tool when a connector advertises data tools only', async () => {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async () => assert.fail('neither runtime delegation nor an unrelated data tool should be called');
+  let turn = 0;
+  const session = sessionBase({
+    runtime: { url: 'http://runtime.test' },
+    mcp: {
+      acme: {
+        status: 'connected',
+        url: 'http://acme.test/mcp',
+        tools: [{ name: 'list_records', description: 'List records.', inputSchema: { type: 'object' } }],
+      },
+    },
+    llm: {
+      async completeWithTools({ messages }) {
+        turn += 1;
+        if (turn === 1) return {
+          content: null,
+          message: { role: 'assistant', content: null },
+          tool_calls: [{ id: 'wrong-delegate', type: 'function', function: { name: 'runtime__delegate', arguments: '{"objective":"configure acme"}' } }],
+        };
+        const refusal = (messages ?? []).filter((message) => message.role === 'tool').at(-1)?.content;
+        assert.match(String(refusal), /advertises no setup or authentication tool/);
+        return {
+          content: 'ACME doit être authentifié hors de cette interface.',
+          message: { role: 'assistant', content: 'ACME doit être authentifié hors de cette interface.' },
+          tool_calls: null,
+        };
+      },
+    },
+  });
+
+  try {
+    const result = await createAgentGraph().invoke({ input: 'configure acme', session });
+    assert.equal(result.response, 'ACME doit être authentifié hors de cette interface.');
   } finally {
     globalThis.fetch = originalFetch;
   }

package/src/cli/wiki-manager.js

@@ -6,14 +6,14 @@ import { ensureManagerScaffold, loadManagerEnv } from '../core/env.js';
 loadManagerEnv();
 import { createAgentGraph } from '../agent/graph.js';
 import { handleSlashCommand, printHelp, printVersion, refreshMcpRuntimeStatus } from '../commands/slash.js';
-import { runShell } from '../shell/repl.js';
+import { runShell, runHeadlessChatTurn } from '../shell/repl.js';
 import { runChecks } from '../core/startupCheck.js';
 import { applySessionWikircProfile } from '../core/sessionConfig.js';
 import { listWikircProfiles } from '../core/wikirc.js';
-import { callMcpTool, formatMcpToolResult } from '../core/mcp.js';
+import { callMcpTool, formatMcpToolResult, readChatAccessConfig } from '../core/mcp.js';
 import { extractActivity, parseJsonText, sessionActivities, terminalFailures } from '../core/activity.js';
 import { syncActivitiesToPlan, formatPlanStatus } from '../core/plan.js';
-import { createAgentEvent, dispatchAgentEvent } from '../core/agentEvents.js';
+import { createAgentEvent, dispatchAgentEvent, reduceAgentEvents } from '../core/agentEvents.js';
 import { runAgentTurn, runAgenticLoop } from '../core/agentLoop.js';
 import { resolveCapabilityConcurrency } from '../orchestrator/scheduler.js';
 import { capabilityRegistryForSession } from '../orchestrator/capabilityRegistry.js';
@@ -57,6 +57,40 @@ function createSession() {
   };
 }
 
+export function createInteractiveSession(context, { runtimeUrl, turnId, signal = null } = {}) {
+  const source = context.session;
+  const session = createSession();
+  for (const key of [
+    'workspace', 'workspacePath', 'workspaceEnvFile', 'workspaceEnv',
+    'wikirc', 'wikircConfig', 'language', 'llm', 'mcp', 'commands',
+    'packageJson', 'queueStore', 'systemPrompt',
+  ]) {
+    if (source[key] !== undefined) session[key] = source[key];
+  }
+  session.runtime = runtimeUrl ? { url: runtimeUrl } : null;
+  session.headless = true;
+  session.chatMode = false;
+  session.chatAccess = null;
+  session.conversations = { [session.workspace || '__global__']: [] };
+  session.agentEvents = [];
+  session.activities = {};
+  session.productionActivity = null;
+  session.jobQueue = [];
+  session.headlessPlan = null;
+  session.turnId = turnId ?? null;
+  session._abortSignal = signal;
+  return session;
+}
+
+export function ensureInteractiveAssistantMessage(session, response, { turnId, workspace } = {}) {
+  const content = String(response ?? '').trim();
+  if (!content || session.agentEvents.some((event) => event.type === 'assistant_message')) return false;
+  dispatchAgentEvent(session, createAgentEvent('assistant_message', {
+    origin: 'runtime_turn', turnId, workspace, payload: { content: String(response) },
+  }));
+  return true;
+}
+
 export async function forwardRuntimeApproval(getWorkspaceContext, request = {}) {
   const context = await getWorkspaceContext(request.workspace ?? null);
   return context.approvalManager?.approve(request) ?? { approved: false };
@@ -455,7 +489,7 @@ async function runRuntime(argv, agent) {
   const { resolveRuntimeAuthToken } = await import('../runtime/auth.js');
   const { createSqliteQueueStore } = await import('../runtime/queueStore.js');
   const { createApprovalManager } = await import('../runtime/approvals.js');
-  const { runRuntimeAgenticWorkflow } = await import('../runtime/runner.js');
+  const { conversationSeed, runRuntimeAgenticWorkflow } = await import('../runtime/runner.js');
 
   const host = valueAfter(argv, '--host') ?? process.env.WIKI_MANAGER_RUNTIME_HOST ?? '127.0.0.1';
   const port = Number(valueAfter(argv, '--port') ?? process.env.WIKI_MANAGER_RUNTIME_PORT ?? 7788);
@@ -465,6 +499,8 @@ async function runRuntime(argv, agent) {
   if (!Number.isInteger(port) || port <= 0 || port > 65535) {
     throw new Error(`Invalid runtime port: ${port}`);
   }
+  const selfRuntimeUrl = process.env.WIKI_MANAGER_RUNTIME_URL
+    ?? `http://${host === '0.0.0.0' ? '127.0.0.1' : host}:${port}`;
 
   const store = openRuntimeStore({ stateDir });
   let serverHandle = null;
@@ -480,6 +516,7 @@ async function runRuntime(argv, agent) {
       session.headless = true;
       session.chatMode = false;
       session.packageJson = packageJson;
+      session.runtime = { url: selfRuntimeUrl };
 
       if (requestedWorkspace) {
         const result = await handleSlashCommand(`/use ${requestedWorkspace}`, { packageJson, session });
@@ -968,6 +1005,66 @@ async function runRuntime(argv, agent) {
     }
   }
 
+  async function executeInteractiveTurn(context, body, { signal, turnId } = {}) {
+    const input = String(body.input ?? body.prompt ?? '').trim();
+    if (!input) throw new Error('Missing input.');
+    const ephemeral = createInteractiveSession(context, { runtimeUrl: selfRuntimeUrl, turnId, signal });
+    // Seed from a freshly reduced COPY of persisted events. Interactive turn
+    // events deliberately do not mutate the canonical run projection, so the
+    // canonical session alone is not a reliable conversation-history source.
+    const persistedProjection = reduceAgentEvents(store.listEvents({
+      workspace: context.workspace ?? ephemeral.workspace ?? null,
+    }));
+    const messages = conversationSeed({ agentProjection: persistedProjection }, input);
+    ephemeral._onAgentEvent = (event) => {
+      const interactiveEvent = {
+        ...event,
+        origin: 'runtime_turn',
+        turnId,
+        runId: null,
+        workspace: context.workspace ?? ephemeral.workspace ?? null,
+      };
+      store.persistEvent(interactiveEvent);
+      serverHandle?.publish(interactiveEvent);
+    };
+    ephemeral._onStep = (message) => dispatchAgentEvent(ephemeral, createAgentEvent('runtime_log', {
+      origin: 'runtime_turn',
+      turnId,
+      workspace: context.workspace ?? null,
+      payload: { message },
+    }));
+    dispatchAgentEvent(ephemeral, createAgentEvent('user_message', {
+      origin: 'runtime_turn',
+      turnId,
+      workspace: context.workspace ?? null,
+      payload: { content: input },
+    }));
+    // Read-only chat turn: same chatAccess policy as the Shell UI's /chat, now
+    // reachable over HTTP so `wiki serve` chat mode gets read tools without
+    // duplicating the loop. Anything other than mode === 'chat' stays the full
+    // unrestricted agent turn.
+    const chatMode = String(body.mode ?? '').toLowerCase() === 'chat';
+    let response;
+    if (chatMode) {
+      ephemeral.chatMode = true;
+      ephemeral.chatAccess = readChatAccessConfig();
+      const history = messages.length && messages[messages.length - 1]?.role === 'user'
+        ? messages.slice(0, -1)
+        : messages;
+      response = await runHeadlessChatTurn(ephemeral, input, {
+        history,
+        onStep: ephemeral._onStep,
+      });
+    } else {
+      response = await runAgentTurn(agent, ephemeral, input, { messages, signal });
+    }
+    ensureInteractiveAssistantMessage(ephemeral, response, {
+      turnId,
+      workspace: context.workspace ?? null,
+    });
+    return response;
+  }
+
   serverHandle = await startRuntimeServer({
     host,
     port,
@@ -977,6 +1074,7 @@ async function runRuntime(argv, agent) {
       .filter((context) => context?.running)
       .map((context) => ({ workspace: context.workspace ?? null, runId: context.currentRunId ?? null })),
     run: executeRun,
+    turn: executeInteractiveTurn,
     delegate: prepareDelegation,
     cancel: (context) => emitRuntimeLog(context.session, 'runtime: cancel requested'),
     resume: ({ workspace }) => recoverRuntime({ workspace, manual: true }),

package/src/commands/slash.js

@@ -232,8 +232,8 @@ function statLine(label, stat) {
   return `${label}: ${stat.count} (${formatBytes(stat.totalBytes)})`;
 }
 
-function workspaceStatsText(stats) {
-  if (!stats) return 'No workspace loaded.';
+function workspaceStatsColumns(stats) {
+  if (!stats) return { left: 'No workspace loaded.', right: '' };
   const hints = [];
   if (stats.untracked.count > 0) {
     hints.push(`${stats.untracked.count} raw/untracked document(s) are waiting for ingest.`);
@@ -280,11 +280,10 @@ function workspaceStatsText(stats) {
   ]);
   const hintsColumn = sectionBlock('Hints', hints.length > 0 ? hints : ['No immediate content action detected.']);
 
-  return [
-    twoColumns(wikiColumn, rawColumn),
-    '',
-    twoColumns(deliveryColumn, `${internalColumn}\n\n${hintsColumn}`),
-  ].join('\n');
+  return {
+    left: [wikiColumn, deliveryColumn].join('\n\n'),
+    right: [rawColumn, internalColumn, hintsColumn].join('\n\n'),
+  };
 }
 
 function workspaceLoadedText(workspace, summary, session) {
@@ -530,16 +529,18 @@ async function statusText(session) {
   const runtimeColumn = sectionBlock('Runtime', (states ? serviceStatesText(states) : 'Docker runtime not available or no workspace loaded.').split('\n'));
   const mcpColumn = sectionBlock('MCP', formatMcpStatus(session.mcp).split('\n'));
   const mcpToolsColumn = sectionBlock('MCP tool summary', formatMcpToolSummary(session.mcp).split('\n'));
-
-  return [
-    twoColumns(workspaceColumn, configColumn),
-    '',
-    workspaceStatsText(workspaceStats),
-    '',
-    runtimeColumn,
-    '',
-    twoColumns(mcpColumn, mcpToolsColumn),
-  ].join('\n');
+  const stats = workspaceStatsColumns(workspaceStats);
+
+  const leftColumn = [workspaceColumn, stats.left, runtimeColumn, mcpColumn].filter(Boolean).join('\n\n');
+  const rightColumn = [configColumn, stats.right, mcpToolsColumn].filter(Boolean).join('\n\n');
+
+  // Leading/trailing padding row on *both* columns so the boxed pair doesn't
+  // butt directly against the pane border when the view is scrolled to show
+  // the tail. A single space on each side (not '') keeps the row tab-joined,
+  // so both the left and right box render — an empty string on either side
+  // of the tab makes twoColumns drop the pairing and only the left box shows.
+  const pad = ' \t ';
+  return [pad, twoColumns(leftColumn, rightColumn), pad].join('\n');
 }
 
 function loadWorkspaceSystemPrompt(workspacePath) {

package/src/core/buildInfo.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.14.6",
-  "commit": "d1163a1"
+  "version": "0.14.8",
+  "commit": "d3995e0"
 }

package/src/core/mcp.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { managerEnvFile, managerMcpEndpointsFile, readEnvFile } from './env.js';
 
-const WIKI_MANAGER_VERSION = '0.14.6';
+const WIKI_MANAGER_VERSION = '0.14.8';
 
 function envValue(key) {
   const filePath = managerEnvFile();
@@ -29,6 +29,27 @@ function normalizeHeaders(headers) {
   );
 }
 
+// An endpoint's url/headers may reference `${VAR}` placeholders with no
+// `:-default`. If that env var is unset, the placeholder interpolates to ''
+// (see interpolateEnv) and the endpoint would otherwise look "configured"
+// with a blank credential — then discoverMcpTools happily probes the live
+// endpoint and can report it "connected" even though it has no real auth.
+function hasMissingRequiredEnv(value) {
+  if (typeof value !== 'string') return false;
+  let missing = false;
+  value.replace(/\$\{([^}]+)\}/g, (_, expr) => {
+    const sep = expr.indexOf(':-');
+    if (sep === -1 && !envValue(expr)) missing = true;
+    return '';
+  });
+  return missing;
+}
+
+function endpointHasMissingCredentials(endpoint) {
+  const headerValues = Object.values(endpoint?.headers ?? {}).filter((value) => typeof value === 'string');
+  return [String(endpoint?.url ?? ''), ...headerValues].some(hasMissingRequiredEnv);
+}
+
 function normalizeExternalUrlForRuntime(url) {
   if (process.env.WIKI_MANAGER_KEEP_DOCKER_HOST === '1') return url;
   try {
@@ -57,8 +78,14 @@ export function readChatAccessConfig() {
   if (!chatAccess || typeof chatAccess !== 'object' || Array.isArray(chatAccess)) return null;
   const servers = {};
   for (const [name, entry] of Object.entries(chatAccess.servers ?? {})) {
-    if (entry?.allow === '*') servers[name] = { allow: '*' };
-    else if (Array.isArray(entry?.allow)) servers[name] = { allow: entry.allow.map(String).filter(Boolean) };
+    // "*" is also commonly written as a one-element array (["*"]) since every
+    // other "allow" example in this config is an array of tool names — treat
+    // both forms as the same wildcard rather than silently allowing nothing.
+    if (entry?.allow === '*' || (Array.isArray(entry?.allow) && entry.allow.length === 1 && entry.allow[0] === '*')) {
+      servers[name] = { allow: '*' };
+    } else if (Array.isArray(entry?.allow)) {
+      servers[name] = { allow: entry.allow.map(String).filter(Boolean) };
+    }
   }
   const maxToolIterations = Number.isFinite(Number(chatAccess.maxToolIterations)) && Number(chatAccess.maxToolIterations) > 0
     ? Math.floor(Number(chatAccess.maxToolIterations))
@@ -75,24 +102,27 @@ function readExternalMcpEndpoints() {
   return Object.fromEntries(
     Object.entries(servers)
       .filter(([, endpoint]) => endpoint?.url)
-      .map(([name, endpoint]) => [
-        name,
-        {
-          ...endpointStatus(true),
-          url: normalizeExternalUrlForRuntime(interpolateEnv(String(endpoint.url))),
-          configuredUrl: interpolateEnv(String(endpoint.url)),
-          headers: normalizeHeaders(endpoint.headers),
-          // Tools the endpoint marks approval-gated: Donna may still call them
-          // directly (they are single-step tools), but toolRequiresApproval
-          // makes the call wait for the user's confirmation first (e.g. a
-          // destructive cme_export_run). Agent/operator owned — no hard-coded
-          // business name in the manager.
-          requireApproval: Array.isArray(endpoint.requireApproval)
-            ? endpoint.requireApproval.map(String).filter(Boolean)
-            : undefined,
-          external: true,
-        },
-      ]),
+      .map(([name, endpoint]) => {
+        const missingCredentials = endpointHasMissingCredentials(endpoint);
+        return [
+          name,
+          {
+            ...endpointStatus(!missingCredentials, missingCredentials ? 'credential not set' : ''),
+            url: normalizeExternalUrlForRuntime(interpolateEnv(String(endpoint.url))),
+            configuredUrl: interpolateEnv(String(endpoint.url)),
+            headers: normalizeHeaders(endpoint.headers),
+            // Tools the endpoint marks approval-gated: Donna may still call them
+            // directly (they are single-step tools), but toolRequiresApproval
+            // makes the call wait for the user's confirmation first (e.g. a
+            // destructive cme_export_run). Agent/operator owned — no hard-coded
+            // business name in the manager.
+            requireApproval: Array.isArray(endpoint.requireApproval)
+              ? endpoint.requireApproval.map(String).filter(Boolean)
+              : undefined,
+            external: true,
+          },
+        ];
+      }),
   );
 }
 
@@ -125,6 +155,14 @@ const DEFAULT_MCP_RETRY_POLICY = {
   backoffMs: 500,
 };
 
+// MCP control traffic has its own budget. It must never consume or reduce the
+// provider RPM configured in .wikirc, which is reserved for LLM/vector calls.
+// Keep a little headroom below the commonly deployed 50 RPM MCP limit for
+// initialize/list-tools and other non-tool-call requests.
+const DEFAULT_MCP_REQUESTS_PER_MINUTE = 45;
+const mcpThrottleQueues = new Map();
+const mcpThrottleStarts = new Map();
+
 export function buildMcpStatus(session) {
   // Attach the /chat read-tool policy to the session alongside MCP status.
   // Only /chat (repl.js) reads session.chatAccess; /agent ignores it.
@@ -304,6 +342,7 @@ export async function callMcpTool(mcpStatus, serverName, toolName, args = {}, si
   const timeoutMs = serverName === 'documents' && toolName === 'documents_convert_to_markdown' ? 600_000 : 8000;
   const retry = resolveRetryPolicy(endpoint, toolName, options.retry);
   return withRetry(async () => {
+    await throttleMcpRequestStart(endpoint, signal);
     const payload = await mcpRequest(endpoint, 'tools/call', {
       name: toolName,
       arguments: toolArgs,
@@ -315,6 +354,47 @@ export async function callMcpTool(mcpStatus, serverName, toolName, args = {}, si
   }, retry, { signal, onRetry: options.onRetry });
 }
 
+async function throttleMcpRequestStart(endpoint, signal) {
+  const configured = Number(
+    endpoint.requestsPerMinute
+      ?? endpoint.rateLimit?.requestsPerMinute
+      ?? envValue('WIKI_MANAGER_MCP_REQUESTS_PER_MINUTE'),
+  );
+  const requestsPerMinute = Number.isFinite(configured) && configured > 0
+    ? Math.floor(configured)
+    : DEFAULT_MCP_REQUESTS_PER_MINUTE;
+  const configuredWindowMs = Number(envValue('WIKI_MANAGER_MCP_RATE_LIMIT_WINDOW_MS'));
+  const windowMs = Number.isFinite(configuredWindowMs) && configuredWindowMs > 0
+    ? configuredWindowMs
+    : 60_000;
+  const key = String(endpoint.url ?? endpoint.name ?? 'mcp');
+  const previous = mcpThrottleQueues.get(key) ?? Promise.resolve();
+  const next = previous.catch(() => {}).then(async () => {
+    while (true) {
+      if (signal?.aborted) throw signal.reason ?? new Error('MCP request aborted.');
+      const now = Date.now();
+      const starts = (mcpThrottleStarts.get(key) ?? []).filter((at) => now - at < windowMs);
+      if (starts.length < requestsPerMinute) {
+        starts.push(now);
+        mcpThrottleStarts.set(key, starts);
+        return;
+      }
+      await retryDelay(Math.max(1, windowMs - (now - starts[0])), signal);
+    }
+  });
+  mcpThrottleQueues.set(key, next);
+  try {
+    await next;
+  } finally {
+    if (mcpThrottleQueues.get(key) === next) mcpThrottleQueues.delete(key);
+  }
+}
+
+export function resetMcpThrottleForTests() {
+  mcpThrottleQueues.clear();
+  mcpThrottleStarts.clear();
+}
+
 export function formatMcpToolResult(result) {
   if (!result) return 'No result.';
   const content = result.content;

package/src/core/mcp.test.js

@@ -8,6 +8,7 @@ import {
   callMcpTool,
   discoverMcpTools,
   formatMcpToolsForAgent,
+  resetMcpThrottleForTests,
   resolveRetryPolicy,
   resolveToolCallName,
   truncateToolResult,
@@ -361,6 +362,44 @@ test('callMcpTool sends configured endpoint headers', async () => {
   }
 });
 
+test('callMcpTool throttles MCP traffic independently per endpoint', async () => {
+  const originalFetch = globalThis.fetch;
+  const originalWindow = process.env.WIKI_MANAGER_MCP_RATE_LIMIT_WINDOW_MS;
+  const starts = [];
+  globalThis.fetch = async () => {
+    starts.push(Date.now());
+    return {
+      ok: true,
+      status: 200,
+      headers: { get: () => null },
+      text: async () => JSON.stringify({ result: { content: [{ type: 'text', text: '{"ok":true}' }] } }),
+    };
+  };
+  process.env.WIKI_MANAGER_MCP_RATE_LIMIT_WINDOW_MS = '30';
+  resetMcpThrottleForTests();
+
+  try {
+    const status = {
+      production: {
+        status: 'connected',
+        url: 'http://127.0.0.1:3000/mcp/',
+        requestsPerMinute: 1,
+      },
+    };
+    await Promise.all([
+      callMcpTool(status, 'production', 'agent_status', { jobId: 'a' }),
+      callMcpTool(status, 'production', 'agent_status', { jobId: 'b' }),
+    ]);
+    assert.equal(starts.length, 2);
+    assert.ok(starts[1] - starts[0] >= 20, `expected throttling delay, got ${starts[1] - starts[0]}ms`);
+  } finally {
+    globalThis.fetch = originalFetch;
+    if (originalWindow == null) delete process.env.WIKI_MANAGER_MCP_RATE_LIMIT_WINDOW_MS;
+    else process.env.WIKI_MANAGER_MCP_RATE_LIMIT_WINDOW_MS = originalWindow;
+    resetMcpThrottleForTests();
+  }
+});
+
 test('callMcpTool retries transient MCP failures', async () => {
   const originalFetch = globalThis.fetch;
   let attempts = 0;
@@ -528,4 +567,3 @@ test('truncateToolResult keeps short results intact and bounds long ones head+ta
   assert.match(bounded, /-END$/);
   assert.match(bounded, /caractères tronqués/);
 });
-

package/src/runtime/server.js

@@ -1,6 +1,6 @@
 import { createServer } from 'node:http';
 import { randomUUID, timingSafeEqual } from 'node:crypto';
-import { createAgentEvent, dispatchAgentEvent, resetSessionProjection } from '../core/agentEvents.js';
+import { createAgentEvent, dispatchAgentEvent, resetSessionProjection, reduceAgentEvents } from '../core/agentEvents.js';
 import { activeCacertPath } from '../core/cacert.js';
 import { normalizePlanPatch, rebasePlanPatch } from '../core/planPatch.js';
 import { validateContractInDev } from '../contracts/schemas.js';
@@ -15,6 +15,7 @@ export function startRuntimeServer({
   session = null,
   getContext,
   run,
+  turn,
   delegate,
   cancel,
   resume,
@@ -276,6 +277,77 @@ export function startRuntimeServer({
         }
         return;
       }
+      if (request.method === 'POST' && url.pathname === '/turn') {
+        const { body, context } = await resolveBodyContext(request, url);
+        const input = String(body.input ?? body.prompt ?? '').trim();
+        if (!input) {
+          sendJson(response, 400, { error: 'Missing input.' });
+          return;
+        }
+        // Read-only chat turns intentionally remain available while an agent
+        // run is active. Other interactive turns still become control
+        // messages so they cannot start a competing agent decision.
+        const readOnlyChat = String(body.mode ?? '').toLowerCase() === 'chat';
+        if (context.running && !readOnlyChat) {
+          const result = await handleControlMessage(context, store, input, {
+            intent: body.intent,
+            startNextControlRequest,
+            cancel,
+            approve,
+          });
+          sendJson(response, result.statusCode, result.body);
+          return;
+        }
+        if (typeof turn !== 'function') {
+          sendJson(response, 501, { error: 'Runtime interactive turns are unavailable.' });
+          return;
+        }
+        const turnId = `turn-${randomUUID()}`;
+        const controller = new AbortController();
+        const previous = context.interactiveTurn ?? Promise.resolve();
+        const current = previous.catch(() => {}).then(async () => {
+          // A preceding serialized turn may have delegated and started a run
+          // after this request was accepted. Reclassify against the fresh
+          // state instead of starting another interactive decision in parallel.
+          if (context.running && !readOnlyChat) {
+            const result = await handleControlMessage(context, store, input, {
+              intent: body.intent,
+              startNextControlRequest,
+              cancel,
+              approve,
+            });
+            publish(createAgentEvent('assistant_message', {
+              origin: 'runtime_turn',
+              turnId,
+              workspace: context.workspace ?? null,
+              payload: { content: result.body?.explanation ?? 'Runtime control request processed.' },
+            }));
+            return result.body;
+          }
+          return turn(context, { ...body, input }, {
+            signal: controller.signal,
+            turnId,
+          });
+        });
+        context.interactiveTurn = current;
+        void current.catch((err) => {
+          publish(createAgentEvent('assistant_message', {
+            origin: 'runtime_turn',
+            turnId,
+            workspace: context.workspace ?? null,
+            payload: { content: `Runtime turn failed: ${err instanceof Error ? err.message : String(err)}` },
+          }));
+        }).finally(() => {
+          if (context.interactiveTurn === current) context.interactiveTurn = null;
+        });
+        sendJson(response, 202, {
+          accepted: true,
+          kind: 'turn',
+          turnId,
+          workspace: context.workspace ?? null,
+        });
+        return;
+      }
       if (request.method === 'POST' && url.pathname === '/delegate') {
         const { body, context } = await resolveBodyContext(request, url);
         const objective = String(body.objective ?? '').trim();
@@ -527,10 +599,18 @@ function controlStatus(context, store) {
   };
 }
 
-function runtimeState(context, store, { workspace = null, session = null } = {}) {
+export function runtimeState(context, store, { workspace = null, session = null } = {}) {
   const state = store.getState(context?.session ?? session ?? null, { workspace });
   return {
     ...state,
+    // Interactive (runtime_turn) replies are persisted as events but never
+    // merged into the canonical in-memory projection, so a state built from
+    // that projection omits them — chat mode and conversational agent turns
+    // then show no reply at all. Rebuild the conversation from the full
+    // persisted event log (the same source interactive turns use to seed their
+    // own history) so those replies surface. The log is a superset of the
+    // canonical run conversation, so run rendering is unaffected.
+    conversation: reduceAgentEvents(store.listEvents({ workspace })).conversation,
     status: context?.running ? 'running' : state.status ?? 'idle',
     running: Boolean(context?.running),
     runId: context?.currentRunId ?? state.runId ?? null,

package/src/runtime/server.test.js

@@ -1,7 +1,80 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
 import { createAgentEvent, dispatchAgentEvent } from '../core/agentEvents.js';
-import { startRuntimeServer } from './server.js';
+import { createInteractiveSession, ensureInteractiveAssistantMessage } from '../cli/wiki-manager.js';
+import { runtimeState, startRuntimeServer as startRuntimeServerImpl } from './server.js';
+
+// Most server tests exercise endpoint behavior rather than authentication. Keep
+// them independent from a developer's WIKI_MANAGER_RUNTIME_TOKEN environment;
+// auth-specific tests can still override this default explicitly.
+function startRuntimeServer(options) {
+  return startRuntimeServerImpl({ token: '', ...options });
+}
+
+test('interactive runtime sessions isolate canonical run state', () => {
+  const mcp = { wiki: { status: 'connected' } };
+  const session = createInteractiveSession({ session: {
+    workspace: 'demo', workspacePath: '/workspace/demo', mcp,
+    llm: { invoke() {} }, commands: ['status'], packageJson: {}, queueStore: {},
+    _currentRunIdentity: { runId: 'run-1' }, headlessPlan: [{ id: 'task-1' }],
+    agentProjection: { status: 'running' }, _agentProjectionState: {},
+    controlQueue: [{}], planPatches: [{}], _requestApproval() {}, agents: [{}], agentRegistry: {},
+  } }, { runtimeUrl: 'http://127.0.0.1:7788', turnId: 'turn-1' });
+
+  assert.equal(session.mcp, mcp);
+  assert.deepEqual(session.runtime, { url: 'http://127.0.0.1:7788' });
+  assert.equal(session.headlessPlan, null);
+  assert.deepEqual(session.activities, {});
+  assert.deepEqual(session.jobQueue, []);
+  for (const key of [
+    '_currentRunIdentity', 'agentProjection', '_agentProjectionState', 'controlQueue',
+    'planPatches', '_requestApproval', 'agents', 'agentRegistry',
+  ]) assert.equal(Object.hasOwn(session, key), false, `${key} must not leak`);
+});
+
+test('interactive turns publish a fallback assistant message exactly once', () => {
+  const published = [];
+  const session = { agentEvents: [], _onAgentEvent: (event) => published.push(event) };
+  assert.equal(ensureInteractiveAssistantMessage(session, 'Réponse concise.', {
+    turnId: 'turn-1', workspace: 'demo',
+  }), true);
+  assert.equal(ensureInteractiveAssistantMessage(session, 'Réponse dupliquée.', {
+    turnId: 'turn-1', workspace: 'demo',
+  }), false);
+  assert.equal(published.length, 1);
+  assert.equal(published[0].type, 'assistant_message');
+  assert.equal(published[0].origin, 'runtime_turn');
+  assert.equal(published[0].payload.content, 'Réponse concise.');
+});
+
+test('runtime state rebuilds interactive conversation from persisted events', () => {
+  const user = {
+    ...createAgentEvent('user_message', { origin: 'runtime_turn', turnId: 'turn-1', workspace: 'demo', payload: { content: 'Bonjour' } }),
+    origin: 'runtime_turn', turnId: 'turn-1', workspace: 'demo',
+  };
+  const assistant = {
+    ...createAgentEvent('assistant_message', { origin: 'runtime_turn', turnId: 'turn-1', workspace: 'demo', payload: { content: 'Salut !' } }),
+    origin: 'runtime_turn', turnId: 'turn-1', workspace: 'demo',
+  };
+  const session = { agentProjection: { conversation: [] } };
+  const store = {
+    getState: (receivedSession) => {
+      assert.equal(receivedSession, session);
+      return { status: 'idle', conversation: [] };
+    },
+    listEvents: ({ workspace }) => {
+      assert.equal(workspace, 'demo');
+      return [user, assistant];
+    },
+  };
+
+  const state = runtimeState({ workspace: 'demo', session, running: false }, store, { workspace: 'demo' });
+
+  assert.deepEqual(state.conversation.map(({ role, content }) => ({ role, content })), [
+    { role: 'user', content: 'Bonjour' },
+    { role: 'assistant', content: 'Salut !' },
+  ]);
+});
 
 test('runtime server checks bearer and x-runtime-token credentials', async (t) => {
   let handle;
@@ -1397,6 +1470,94 @@ test('runtime server answers control messages posted to /run during an active ru
   }
 });
 
+test('runtime server accepts an interactive turn without starting a run', async (t) => {
+  const context = { workspace: 'demo', session: {}, running: false };
+  let received = null;
+  let handle;
+  try {
+    handle = await startRuntimeServer({
+      host: '127.0.0.1',
+      port: 0,
+      token: 'runtime-secret',
+      store: {
+        dbPath: ':memory:',
+        getState: () => ({ status: 'idle' }),
+        listEvents: () => [],
+      },
+      getContext: async () => context,
+      run: async () => assert.fail('/turn must not start a runtime run'),
+      turn: async (_context, body, meta) => { received = { body, meta }; },
+    });
+  } catch (err) {
+    if (err?.code === 'EPERM') {
+      t.skip('network listen is not permitted in this sandbox');
+      return;
+    }
+    throw err;
+  }
+  try {
+    const response = await fetch(`http://127.0.0.1:${handle.port}/turn`, {
+      method: 'POST',
+      headers: { authorization: 'Bearer runtime-secret', 'content-type': 'application/json' },
+      body: JSON.stringify({ input: 'Quels documents sont en attente ?', workspace: 'demo' }),
+    });
+    assert.equal(response.status, 202);
+    const body = await response.json();
+    assert.equal(body.kind, 'turn');
+    assert.match(body.turnId, /^turn-/);
+    await context.interactiveTurn;
+    assert.equal(received.body.input, 'Quels documents sont en attente ?');
+    assert.equal(received.meta.turnId, body.turnId);
+    assert.equal(context.running, false);
+  } finally {
+    await handle.close();
+  }
+});
+
+test('runtime server keeps read-only chat turns available during an active run', async (t) => {
+  const context = { workspace: 'demo', session: {}, running: true };
+  let received = null;
+  let handle;
+  try {
+    handle = await startRuntimeServer({
+      host: '127.0.0.1',
+      port: 0,
+      token: 'runtime-secret',
+      store: {
+        dbPath: ':memory:',
+        getState: () => ({ status: 'running' }),
+        listEvents: () => [],
+      },
+      getContext: async () => context,
+      run: async () => assert.fail('/turn must not start another runtime run'),
+      turn: async (_context, body, meta) => { received = { body, meta }; },
+    });
+  } catch (err) {
+    if (err?.code === 'EPERM') {
+      t.skip('network listen is not permitted in this sandbox');
+      return;
+    }
+    throw err;
+  }
+  try {
+    const response = await fetch(`http://127.0.0.1:${handle.port}/turn`, {
+      method: 'POST',
+      headers: { authorization: 'Bearer runtime-secret', 'content-type': 'application/json' },
+      body: JSON.stringify({ input: 'Quel est le statut CME ?', mode: 'chat', workspace: 'demo' }),
+    });
+    assert.equal(response.status, 202);
+    const body = await response.json();
+    assert.equal(body.kind, 'turn');
+    await context.interactiveTurn;
+    assert.equal(received.body.mode, 'chat');
+    assert.equal(received.body.input, 'Quel est le statut CME ?');
+    assert.equal(received.meta.turnId, body.turnId);
+    assert.equal(context.running, true);
+  } finally {
+    await handle.close();
+  }
+});
+
 test('runtime health reports active runs across workspaces', async (t) => {
   let handle;
   try {

package/src/shell/LeftPane.tsx

@@ -312,7 +312,7 @@ function renderMarkdownLines(lines: Array<{ text: string; isCode: boolean }>, ro
 function isStatusOutput(message: { role: string; content: string }) {
   const content = String(message.content ?? '');
   return message.role === 'command'
-    && content.startsWith('Workspace')
+    && content.trimStart().startsWith('Workspace')
     && content.includes('Config')
     && content.includes('MCP');
 }

package/src/shell/repl.js

@@ -1279,6 +1279,35 @@ async function runDirectChatTurn(input, { session, onUpdate, onStep }) {
   return { exit: false };
 }
 
+// Headless equivalent of runDirectChatTurn for HTTP callers (the runtime /turn
+// in chat mode). Reuses the exact same read-only policy — chatReadTools +
+// runChatReadToolLoop + buildDirectChatSystemPrompt — so there is no second
+// implementation of chat access; it just returns the final text instead of
+// driving a live repl bubble. The caller must have seeded session.chatAccess
+// (and session.mcp) so chatReadTools can resolve the allow-listed read tools.
+export async function runHeadlessChatTurn(session, input, { history = [], onStep } = {}) {
+  const donnaMessage = { role: 'donna', content: '' };
+  const readTools = chatReadTools(session);
+  const canUseReadTools = readTools.length > 0 && typeof session.llm?.completeWithTools === 'function';
+  if (canUseReadTools) {
+    await runChatReadToolLoop({ input, session, history, donnaMessage, onStep, readTools });
+    return donnaMessage.content;
+  }
+  if (typeof session.llm?.stream === 'function') {
+    let content = '';
+    for await (const delta of session.llm.stream({
+      system: buildDirectChatSystemPrompt(session),
+      messages: [...history, { role: 'user', content: input }],
+      signal: session._abortSignal,
+    })) {
+      const clean = stripDsmlArtifacts(delta);
+      if (clean) content += clean;
+    }
+    return stripDsmlArtifacts(content).trimEnd() || formatLlmUnavailableMessage('flux vide');
+  }
+  return directChatUnavailableText(session);
+}
+
 function directChatUnavailableText(session) {
   if (!session.workspacePath) {
     return 'Direct chat unavailable: no workspace loaded. Use /use <workspace>.';

package/src/shell/repl.test.js

@@ -7,6 +7,7 @@ import {
   applyRuntimeStateToShellSession,
   chatReadTools,
   createSession,
+  runHeadlessChatTurn,
   conversationMessages,
   recordRuntimeUnavailableAgentInput,
   runLine,
@@ -443,3 +444,36 @@ test('/chat falls back to the plain stream when no read tools are declared', asy
   assert.match(last.content, /PLAIN_STREAM/);
   assert.doesNotMatch(last.content, /SHOULD_NOT_APPEAR/);
 });
+
+test('runHeadlessChatTurn (HTTP /chat) uses the read-tool path and returns text', async () => {
+  const session = createSession();
+  session.chatMode = true;
+  session.chatAccess = { maxToolIterations: 4, servers: { cme: { allow: ['cme_status'] } } };
+  session.mcp = { cme: { status: 'connected', tools: [{ name: 'cme_status', inputSchema: { type: 'object', properties: {} } }] } };
+  let usedComplete = false;
+  session.llm = {
+    async *stream() { yield 'STREAM_FALLBACK'; },
+    async completeWithTools() {
+      usedComplete = true;
+      return { tool_calls: [], content: 'CME est configuré.', message: { role: 'assistant', content: 'CME est configuré.' } };
+    },
+  };
+  const reply = await runHeadlessChatTurn(session, 'le cme est-il configuré', { history: [] });
+  assert.ok(usedComplete, 'completeWithTools path was taken');
+  assert.match(reply, /CME est configuré/);
+  assert.doesNotMatch(reply, /STREAM_FALLBACK/);
+});
+
+test('runHeadlessChatTurn falls back to the plain stream without read tools', async () => {
+  const session = createSession();
+  session.chatMode = true;
+  session.chatAccess = null;
+  session.mcp = {};
+  session.llm = {
+    async *stream() { yield 'PLAIN_STREAM'; },
+    async completeWithTools() { return { tool_calls: [], content: 'SHOULD_NOT_APPEAR' }; },
+  };
+  const reply = await runHeadlessChatTurn(session, 'bonjour', { history: [] });
+  assert.match(reply, /PLAIN_STREAM/);
+  assert.doesNotMatch(reply, /SHOULD_NOT_APPEAR/);
+});