@dotdrelle/wiki-manager 0.15.28 → 0.15.32

package/.env.example

@@ -56,8 +56,11 @@ CONNECTORS_MCP_AUTH_TOKEN=
 # Enable the opt-in agent-connectors service:
 CONNECTORS_ENABLED=false
 #
-# The public wikiLLM Desktop/PKCE Client ID is built into agent-connectors.
-# Optional advanced/self-hosted override:
+# The wikiLLM Google OAuth application is baked into the agent-connectors image
+# at build time, from agent-external/agent-connectors/.env.build.local. When you
+# build the image locally, that file must exist — otherwise the container starts
+# with empty credentials.
+# Optional runtime override (no rebuild needed):
 # GOOGLE_OAUTH_CLIENT_ID=
 # Optional confidential-client compatibility override:
 # GOOGLE_OAUTH_CLIENT_SECRET=

package/README.md

@@ -731,16 +731,17 @@ capabilityRouting:
 
 #### Compose overrides — optional agents, proxies, local fixes
 
-Two override files sit **next to your `.env`**, one per stack:
+Two override files sit under **`.wiki/compose/`**, one per stack:
 
 | File | Applies to |
 | --- | --- |
-| `docker-compose.override.yml` | workspace stack (`serve`, `mcp-http`, `production-mcp`, `wiki`) |
-| `agents.docker-compose.override.yml` | agents stack (`cme`, `documents`, `connectors`) |
+| `.wiki/compose/docker-compose.override.yml` | workspace stack (`serve`, `mcp-http`, `production-mcp`, `wiki`) |
+| `.wiki/compose/agents.docker-compose.override.yml` | agents stack (`cme`, `documents`, `connectors`) |
 
 Both are created for you on first use, from packaged templates full of
 ready-to-uncomment examples, and are **never rewritten afterwards** — your edits
-survive package updates. Do not confuse them with `.wiki/runtime/*.compose.yml`,
+survive package updates. Existing root-level files are migrated automatically.
+Do not confuse them with `.wiki/runtime/*.compose.yml`,
 which the manager regenerates on every Compose command; editing those is always
 lost.
 

package/agents.docker-compose.override.example.yml

@@ -1,4 +1,4 @@
-# agents.docker-compose.override.yml — user-owned overrides for the agents stack
+# .wiki/compose/agents.docker-compose.override.yml — user-owned agent overrides
 #
 # Copied here once by wiki-manager when absent, then NEVER touched again:
 # your edits survive every package update. Do not confuse it with

package/agents.docker-compose.yml

@@ -100,6 +100,16 @@ services:
     build:
       context: ../agent-external/agent-connectors
       dockerfile: Dockerfile
+      args:
+        # Without these the ARGs stay unset and the image ships empty
+        # WIKILLM_GOOGLE_OAUTH_* values, so the container ends up with no Google
+        # client at all. `wiki-workspace agents up` exports them from the
+        # connectors repo's .env.build.local before invoking Compose.
+        # Deliberately value-less: Compose then forwards each host variable only
+        # when it is defined. Never write `${VAR:-}` here — an empty
+        # --build-arg pins the ARG to the empty string.
+        WIKILLM_GOOGLE_OAUTH_CLIENT_ID:
+        WIKILLM_GOOGLE_OAUTH_CLIENT_SECRET:
     image: dotdrelle/agent-connectors:latest
     user: "${UID:-1000}:${GID:-1000}"
     ports:

package/bin/wiki-manager.js

@@ -80,7 +80,7 @@ async function main() {
   // Fallback for already-bootstrapped direct invocations; the shell wrapper
   // exports these before Bun starts.
   if (parsed.cacert) Object.assign(process.env, cacertEnvVars(parsed.cacert));
-  const interactive = process.stdout.isTTY && process.stdin.isTTY && argv[0] !== 'runtime' && !argv.includes('--setup-wizard') && !argv.includes('--headless') && !argv.includes('--once') && !argv.includes('--version') && !argv.includes('-v') && !argv.includes('--help') && !argv.includes('-h');
+  const interactive = process.stdout.isTTY && process.stdin.isTTY && argv[0] !== 'runtime' && !argv.includes('--refresh') && !argv.includes('--setup-wizard') && !argv.includes('--headless') && !argv.includes('--once') && !argv.includes('--version') && !argv.includes('-v') && !argv.includes('--help') && !argv.includes('-h');
   if (interactive || argv.includes('--setup-wizard')) await import('@opentui/solid/preload');
   if (interactive) process.stdout.write('Starting wiki-manager…\r');
   const { runCli } = await import('../src/cli/wiki-manager.js');

package/docker-compose.override.example.yml

@@ -1,11 +1,11 @@
-# docker-compose.override.yml — user-owned overrides for the workspace stack
+# .wiki/compose/docker-compose.override.yml — user-owned workspace overrides
 #
 # Copied here once by wiki-manager when absent, then NEVER touched again:
 # your edits survive every package update. Do not confuse it with
 # .wiki/runtime/cacert.compose.yml, which is generated state and is rewritten
 # on every compose command — editing that one is always lost.
 #
-# This file is GLOBAL: it lives next to the manager .env and applies to every
+# This file is GLOBAL: it lives under .wiki/compose and applies to every
 # workspace stack (`wiki-workspace up <workspace>`, `/start` in the shell). A
 # proxy or a private registry is a property of the machine, not of a workspace,
 # so there is deliberately no per-workspace variant. For values that really do
@@ -40,6 +40,7 @@
 #     services:
 #       serve:
 #         environment:
+#           - NODE_USE_ENV_PROXY=${NODE_USE_ENV_PROXY:-1}
 #           - HTTP_PROXY=${HTTP_PROXY:-}
 #           - HTTPS_PROXY=${HTTPS_PROXY:-}
 #           - http_proxy=${HTTP_PROXY:-}

package/mcp.endpoints.example.json

@@ -29,7 +29,7 @@
   "chatAccess": {
     "maxToolIterations": 8,
     "servers": {
-      "llm-wiki":         { "allow": ["help_list", "help_read", "wiki_workspace_status", "wiki_list_pages", "wiki_read_page", "wiki_read_pages", "wiki_search_context", "wiki_collect_context", "wiki_read_ingested_source"] },
+      "llm-wiki":         { "allow": ["help_list", "help_read", "help_search", "wiki_workspace_status", "wiki_list_pages", "wiki_read_page", "wiki_read_pages", "wiki_search_context", "wiki_collect_context", "wiki_read_ingested_source"] },
       "wiki-production":  { "allow": ["production_job_status", "production_jobs_list"] },
       "cme":              { "allow": ["cme_status", "cme_sources_list", "cme_export_status"] }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotdrelle/wiki-manager",
-  "version": "0.15.28",
+  "version": "0.15.32",
   "description": "Agentic shell and orchestration cockpit for llm-wiki workspaces.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "author": "dotrelle",
@@ -11,7 +11,7 @@
   },
   "scripts": {
     "start": "bun ./bin/wiki-manager.js",
-    "test": "node --test src/cli/runtimeStartup.test.js src/cli/wiki-manager.test.js src/agent/graph.test.js src/contracts/schemas.test.js src/core/activity.test.js src/core/env.test.js src/core/buildInfo.test.js src/core/agentEvents.test.js src/core/runtimeLog.test.js src/activity/activityAggregator.test.js src/graph/runGraphProjector.test.js src/core/workflow.test.js src/core/planPatch.test.js src/core/agentLoop.test.js src/core/plan.test.js src/core/mcp.test.js src/core/toolLoop.test.js src/core/documentIntake.test.js src/core/dockerCompose.test.js src/core/wikiWorkspace.test.js src/core/wikirc.test.js src/core/cacert.test.js src/core/composeOverrides.test.js src/core/setEnvValue.test.js src/core/commandFailure.test.js src/core/modelFetch.test.js src/core/startupCheck.test.js src/core/queueStore.test.js src/orchestrator/agentRegistry.test.js src/orchestrator/capabilityRegistry.test.js src/orchestrator/capabilityResolver.test.js src/orchestrator/planValidator.test.js src/orchestrator/planIntegrator.test.js src/orchestrator/scheduler.test.js src/orchestrator/attemptManager.test.js src/orchestrator/resultAggregator.test.js src/orchestrator/approvalPolicy.test.js src/orchestrator/dispatcher.test.js src/orchestrator/objectiveResolver.test.js src/commands/slash.test.js src/shell/repl.test.js src/shell/setupWizardPlaceholders.test.js src/runtime/store.test.js src/runtime/controlMessages.test.js src/runtime/recoveryManager.test.js src/runtime/server.test.js src/runtime/supervisor.test.js src/runtime/runner.test.js src/runtime/runner.e2e.test.js src/runtime/donna-contract.test.js src/runtime/auth.test.js",
+    "test": "node --test src/cli/runtimeStartup.test.js src/cli/wiki-manager.test.js src/agent/graph.test.js src/contracts/schemas.test.js src/core/activity.test.js src/core/env.test.js src/core/agentsCompose.test.js src/core/buildInfo.test.js src/core/agentEvents.test.js src/core/runtimeLog.test.js src/activity/activityAggregator.test.js src/graph/runGraphProjector.test.js src/core/workflow.test.js src/core/planPatch.test.js src/core/agentLoop.test.js src/core/plan.test.js src/core/mcp.test.js src/core/toolLoop.test.js src/core/documentIntake.test.js src/core/dockerCompose.test.js src/core/wikiSetup.test.js src/core/wikiWorkspace.test.js src/core/wikirc.test.js src/core/cacert.test.js src/core/composeOverrides.test.js src/core/setEnvValue.test.js src/core/commandFailure.test.js src/core/modelFetch.test.js src/core/startupCheck.test.js src/core/queueStore.test.js src/orchestrator/agentRegistry.test.js src/orchestrator/capabilityRegistry.test.js src/orchestrator/capabilityResolver.test.js src/orchestrator/planValidator.test.js src/orchestrator/planIntegrator.test.js src/orchestrator/scheduler.test.js src/orchestrator/attemptManager.test.js src/orchestrator/resultAggregator.test.js src/orchestrator/approvalPolicy.test.js src/orchestrator/dispatcher.test.js src/orchestrator/objectiveResolver.test.js src/commands/slash.test.js src/shell/repl.test.js src/shell/setupWizardPlaceholders.test.js src/runtime/store.test.js src/runtime/controlMessages.test.js src/runtime/recoveryManager.test.js src/runtime/server.test.js src/runtime/supervisor.test.js src/runtime/runner.test.js src/runtime/runner.e2e.test.js src/runtime/donna-contract.test.js src/runtime/auth.test.js",
     "check-versions": "node scripts/check-versions.js",
     "prepack": "node scripts/check-versions.js",
     "prepublishOnly": "node scripts/check-versions.js",

package/src/agent/graph.js

@@ -376,7 +376,10 @@ async function classifyRequestedAction(llm, input, signal) {
   const system = [
     'Classify whether the user explicitly requests a real state-changing action now.',
     'Actions include starting, stopping, importing, ingesting, building, exporting, configuring, writing, deleting, or sending.',
-    'Questions, explanations, status questions, greetings, and hypothetical discussions are not actions.',
+    'Questions, explanations, status questions, greetings, hypothetical discussions, and bare capability questions are not actions.',
+    'Requests to refresh, show, or update the displayed plan/status are status reads, not state-changing actions.',
+    'A bare capability question such as "can you send an email?" or "peux-tu envoyer un mail ?" asks what the assistant can do; it does not request execution.',
+    'A concrete imperative or polite request such as "send this email to Alice" or "peux-tu envoyer ce message à Alice ?" is an action.',
     'Return JSON only: {"action":true} or {"action":false}.',
   ].join('\n');
   const messages = [{ role: 'user', content: String(input ?? '') }];
@@ -427,6 +430,28 @@ async function classifyRequestedAction(llm, input, signal) {
   }
 }
 
+function looksLikeCapabilityQuestion(input) {
+  return /^(?:can|could|would)\s+you\b|^are\s+you\s+able\b|^do\s+you\s+(?:know\s+how|support)\b|^tu\s+peux\b|^vous\s+pouvez\b|^peux[\s-]*tu\b|^pouvez[\s-]*vous\b|^est[\s-]*ce\s+que\s+tu\s+peux\b/i
+    .test(String(input ?? '').trim());
+}
+
+function delegationBlockerForDonna(rawFailure) {
+  const cleaned = String(rawFailure ?? '')
+    .replace(/^[A-Za-z][A-Za-z0-9_]*Error\s*:?\s*/i, '')
+    .replace(/\s*Available capabilities:\s*[\s\S]*$/i, '')
+    .trim();
+  const reason = /No connected agent can do that|No orchestrable capability/i.test(cleaned)
+    ? 'No connected agent currently supports the requested action.'
+    : 'The requested action could not be assigned to a connected agent.';
+  return JSON.stringify({
+    delegated: false,
+    blocker: 'unsupported_action',
+    reason,
+    instruction:
+      'Answer the user naturally in their language. Explain the concrete limitation briefly. Do not expose exception names, capability identifiers, tool names, UUIDs, or internal routing details. Do not retry or claim that an action started.',
+  });
+}
+
 function summarizeToolArguments(rawArguments) {
   if (!rawArguments || rawArguments === '{}') return '';
   try {
@@ -816,9 +841,14 @@ async function handleRuntimeControlTool(session, tool, args = {}) {
   }
 }
 
-function connectorConfigurationTarget(session, objective) {
-  const text = String(objective ?? '').toLowerCase();
-  if (!/(?:configur|connect|authent|oauth|setup|sign[ -]?in)/i.test(text)) return null;
+export function connectorConfigurationTarget(session, objective) {
+  const recentContext = (session?.agentProjection?.conversation ?? [])
+    .slice(-6)
+    .filter((message) => message?.role === 'user')
+    .map((message) => String(message?.content ?? ''))
+    .join(' ');
+  const text = `${recentContext} ${String(objective ?? '')}`.trim().toLowerCase();
+  if (!/(?:configur|connect|authent|oauth|setup|sign[ -]?in|\bpat\b|api[ _-]?token|credential|identifiant|mot de passe|password)/i.test(text)) return null;
   for (const [serverName, server] of Object.entries(session?.mcp ?? {})) {
     if (server?.status !== 'connected' || !Array.isArray(server.tools) || server.tools.length === 0) continue;
     const genericAliasParts = new Set([
@@ -977,6 +1007,7 @@ export function buildAgentSystemPrompt(state) {
     'When calling a tool, emit no preliminary narration. Call it directly; the PLAN and Activity panels show progress. After completion, keep the final response concise and proportional to the result.',
     'Write the way a thoughtful colleague speaks: warm, plain, and to the point. For a simple factual question, 1 to 3 sentences is the sweet spot. Stay synthetic and information-dense — use only the lines needed, and never exceed roughly 15 to 20 short lines even for a detailed answer. Never expose internal reasoning, repeated checks, tool-selection commentary, or a chronological diary. Prioritize the result, essential facts, concrete errors, and actual outputs — but say them in human language, not as a field dump.',
     'Call a matching direct tool when one is offered. Otherwise, for an action backed by a discovered agent capability, call runtime__delegate with the original objective. This applies to both planner agents and executor-only single-task agents. Never call an agent orchestration-contract or plan tool directly.',
+    'Configuration is not a business run. When a connected server offers a setup or configuration tool, use it directly; never delegate configuration to an export, collect, send, build, or ingest capability. Read that server status first when existing non-secret values are needed, then ask only for required values that are still missing.',
     'For any question about the current workspace inventory or what is waiting there, call wiki__wiki_workspace_status first and answer only from its result. This is the canonical read-only workspace state; do not reconstruct it from upload, connector, or production tools.',
     'Tool identifiers are private implementation details. Never print MCP tool names such as server__tool in a user-facing answer. Describe the human result instead.',
     'Internal data shapes are private too. Never quote raw JSON field names (e.g. pendingSources.files), internal directory paths (e.g. raw/untracked/), or config keys in a user-facing answer — translate them into plain language. Say "36 pages sources sont en attente d\'ingestion", not the field or path they came from.',
@@ -998,6 +1029,7 @@ export function buildAgentSystemPrompt(state) {
       ? `Workspace profile (.wiki/profile.md) — durable user preferences, apply these to every reply (tone, tutoiement/vouvoiement, formatting, etc.):\n${workspaceProfile}`
       : null,
     'Runtime control: you have runtime__status, runtime__cancel, runtime__kill, runtime__approve and runtime__enqueue. When the user asks to stop, remove, clean or kill the current run, its jobs or the queue ("supprime le job et la queue", "arr\u00eate tout"), call runtime__kill (or runtime__cancel for a soft stop of just the run) and confirm what was stopped. When the user explicitly asks to delete, reset, abandon or replace the current plan, call runtime__kill with purge=true; never set purge=true for a simple stop. For questions about what is running or queued, call runtime__status and answer from its data. When the user consents to a pending approval in any phrasing ("vas-y", "ok pour l\'export"), call runtime__approve. When the user asks for a NEW action while a run is active, do not execute it: propose runtime__enqueue (run it after) or, if they insist it replaces the current work, runtime__kill then the new action.',
+    'When the user asks to refresh, show, or update the displayed plan or status, call runtime__status. This is a state refresh request, not a new business capability, and must never be delegated.',
     'Report every runtime control outcome exactly as the tool returned it \u2014 never embellish. If runtime__kill reports 0 run(s)/0 task(s)/0 purged, say there was nothing active to stop or purge; do NOT claim a run, plan, pending approval or queue item was removed. If runtime__status returns an error or could not be read, say the runtime state could not be retrieved and do not describe a state you never obtained. Never assert that something was cleaned, cancelled, approved or purged unless that specific tool result confirms it.',
     'Durable profile updates are actions in this stabilized version: delegate them instead of writing directly.',
   ].filter(Boolean).join('\n');
@@ -1089,7 +1121,10 @@ export function isOrchestrationBypassTool(name) {
   if (full === 'wiki__plan_set' || full === 'wiki__plan_done') return true;
   const sep = full.indexOf('__');
   const tool = sep === -1 ? full : full.slice(sep + 2);
-  return tool === 'agent_plan' || tool === 'agent_execute' || tool === 'production_start_job';
+  return tool === 'agent_plan'
+    || tool === 'agent_execute'
+    || tool === 'production_start_job'
+    || tool === 'cme_export_run';
 }
 
 function isReadOnlyMcpCall(session, server, tool) {
@@ -1195,7 +1230,9 @@ export function createAgentGraph(options = {}) {
       WIKI_PLAN_DONE_TOOL,
       ...buildLlmTools(state.session.mcp),
     ];
-    const tools = toolsForClassification(classification, writeTools, state.session);
+    const tools = state.terminalToolFailure || state.session._responseSynthesisOnly
+      ? []
+      : toolsForClassification(classification, writeTools, state.session);
     const system = buildAgentSystemPrompt(state);
 
     // On iteration 0: prior history is in state.messages, user input must be appended.
@@ -1445,6 +1482,7 @@ export function createAgentGraph(options = {}) {
   }
 
   async function toolExecutorNode(state) {
+    const llm = state.session.llm ?? options.llm ?? null;
     const toolCalls = state.pendingToolCalls ?? [];
     const toolResultMessages = [];
     let terminalFailure = null;
@@ -1535,12 +1573,41 @@ export function createAgentGraph(options = {}) {
           const result = await updateWorkspaceProfilePreference(state.session, args.preference);
           resultText = JSON.stringify(result, null, 2);
         } else if (server === 'runtime') {
-          resultText = await handleRuntimeControlTool(state.session, tool, args);
+          const isCapabilityQuestion = tool === 'delegate'
+            && !state.session._currentRunIdentity
+            && looksLikeCapabilityQuestion(String(args.objective ?? state.input ?? ''))
+            && !await classifyRequestedAction(
+              llm,
+              String(args.objective ?? state.input ?? ''),
+              state.session._abortSignal,
+            );
+          resultText = isCapabilityQuestion
+            ? JSON.stringify({
+                delegated: false,
+                capabilityQuestion: true,
+                instruction: 'Answer the user conversationally about whether this action is supported. Do not create a plan or claim that execution started.',
+              })
+            : await handleRuntimeControlTool(state.session, tool, args);
           if (tool === 'delegate' && /^Runtime control error \(delegate\):/i.test(resultText)) {
-            terminalFailure = resultText
+            const delegationFailure = resultText
               .replace(/^Runtime control error \(delegate\):\s*/i, '')
               .replace(/^Delegation failed during objective_resolution:\s*/i, '');
-            ok = false;
+            const needsInput = delegationFailure.match(/^Delegation requires input:\s*(.+)$/i);
+            if (needsInput) {
+              // Missing provider-required fields are a conversational blocker,
+              // not an execution failure. Feed the generic field list back to
+              // Donna so she can ask naturally in the workspace language.
+              resultText = JSON.stringify({
+                delegated: false,
+                needsInput: true,
+                missingRequiredFields: needsInput[1].split(',').map((item) => item.trim()).filter(Boolean),
+                instruction: 'Ask the user for the missing required information. Do not expose internal validation details.',
+              });
+            } else {
+              terminalFailure = delegationFailure;
+              resultText = delegationBlockerForDonna(delegationFailure);
+              ok = false;
+            }
           }
         } else if (server !== 'shell') {
           await awaitRunApproval(state.session, { runId, tool: toolName });
@@ -1641,10 +1708,7 @@ export function createAgentGraph(options = {}) {
     }
 
     if (terminalFailure) {
-      const response = `Action non lancée : ${terminalFailure}`;
-      emitAgentEvent(state.session, 'assistant_message', 'agent_guard', { content: response });
       return {
-        response,
         messages: toolResultMessages,
         pendingToolCalls: null,
         forceDelegation: false,
@@ -1666,7 +1730,7 @@ export function createAgentGraph(options = {}) {
   }
 
   function routeToolExecutor(state) {
-    return state.terminalToolFailure ? END : 'orchestrator';
+    return 'orchestrator';
   }
 
   function routeOrchestrator(state) {

package/src/agent/graph.test.js

@@ -3,7 +3,7 @@ import test from 'node:test';
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { buildAgentSystemPrompt, createAgentGraph, invalidSuggestedSlashCommands, invalidUserFacingToolNames, knownCapabilityIds, normalizeToolArgumentsFromSchema } from './graph.js';
+import { buildAgentSystemPrompt, connectorConfigurationTarget, createAgentGraph, invalidSuggestedSlashCommands, invalidUserFacingToolNames, isOrchestrationBypassTool, knownCapabilityIds, normalizeToolArgumentsFromSchema } from './graph.js';
 
 test('user-facing response guard hides MCP identifiers generically', () => {
   const session = sessionBase();
@@ -13,6 +13,29 @@ test('user-facing response guard hides MCP identifiers generically', () => {
   );
 });
 
+test('CME setup stays direct while CME export execution stays orchestrated', () => {
+  assert.equal(isOrchestrationBypassTool('cme__cme_export_run'), true);
+  assert.equal(isOrchestrationBypassTool('cme__cme_setup'), false);
+});
+
+test('configuration routing retains the recent CME conversation context', () => {
+  const target = connectorConfigurationTarget({
+    agentProjection: {
+      conversation: [{ role: 'user', content: 'je veux configurer le CME' }],
+    },
+    mcp: {
+      cme: {
+        status: 'connected',
+        tools: [
+          { name: 'cme_setup', description: 'Configure Confluence credentials.' },
+          { name: 'cme_export_run', description: 'Run export.' },
+        ],
+      },
+    },
+  }, 'configurer l’agent wiki');
+  assert.deepEqual(target, { serverName: 'cme', setupTool: 'cme_setup' });
+});
+
 test('Donna cannot answer an explicit action with manual instructions instead of delegating', async () => {
   const originalFetch = globalThis.fetch;
   let delegated = false;
@@ -57,6 +80,68 @@ test('Donna cannot answer an explicit action with manual instructions instead of
   }
 });
 
+test('a bare capability question returns to Donna without runtime delegation', async () => {
+  const originalFetch = globalThis.fetch;
+  let delegated = false;
+  globalThis.fetch = async (url) => {
+    delegated ||= String(url).includes('/delegate');
+    if (String(url).includes('/delegate')) throw new Error(`Unexpected runtime request: ${url}`);
+    return { ok: true, status: 200, json: async () => ({ status: 'idle', running: false }) };
+  };
+  let mainCalls = 0;
+  const session = sessionBase({
+    runtime: { url: 'http://runtime.test' },
+    llm: {
+      async completeWithTools({ tools, messages }) {
+        if (tools.some((tool) => tool.function?.name === 'classify_action_request')) {
+          return {
+            content: null,
+            message: { role: 'assistant', content: null },
+            tool_calls: [{
+              id: 'classify-capability-question',
+              type: 'function',
+              function: { name: 'classify_action_request', arguments: '{"action":false}' },
+            }],
+          };
+        }
+        mainCalls += 1;
+        if (mainCalls === 1) {
+          return {
+            content: null,
+            message: { role: 'assistant', content: null },
+            tool_calls: [{
+              id: 'wrong-delegate',
+              type: 'function',
+              function: { name: 'runtime__delegate', arguments: '{"objective":"tu peux envoyer un mail ?"}' },
+            }],
+          };
+        }
+        const result = JSON.parse(
+          String((messages ?? []).filter((message) => message.role === 'tool').at(-1)?.content ?? '{}'),
+        );
+        assert.equal(result.capabilityQuestion, true);
+        return {
+          content: 'Oui, je peux envoyer un mail si tu me donnes le destinataire, le sujet et le contenu.',
+          message: {
+            role: 'assistant',
+            content: 'Oui, je peux envoyer un mail si tu me donnes le destinataire, le sujet et le contenu.',
+          },
+          tool_calls: null,
+        };
+      },
+    },
+  });
+
+  try {
+    const result = await createAgentGraph().invoke({ input: 'tu peux envoyer un mail ?', session });
+    assert.equal(delegated, false);
+    assert.equal(mainCalls, 2);
+    assert.match(result.response, /Oui, je peux envoyer un mail/);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
 function sessionBase(overrides = {}) {
   return {
     commands: ['status'],
@@ -118,8 +203,10 @@ function toolCallingLlm() {
 test('agent graph waits for run-level approval before first MCP action', async () => {
   const originalFetch = globalThis.fetch;
   let fetchCalls = 0;
-  globalThis.fetch = async () => {
-    fetchCalls += 1;
+  globalThis.fetch = async (_url, init) => {
+    // Count tool traffic only: the MCP session handshake is transport
+    // plumbing, not an action the user needs to approve or observe.
+    if (JSON.parse(init.body).method === 'tools/call') fetchCalls += 1;
     return {
       ok: true,
       status: 200,
@@ -403,6 +490,15 @@ test('Donna refuses to delegate connector authentication to an export capability
   globalThis.fetch = async (url, options = {}) => {
     fetchedUrls.push(String(url));
     const body = JSON.parse(String(options.body ?? '{}'));
+    // MCP session handshake: answer it, then assert on the real tool call.
+    if (body.method === 'initialize') {
+      return {
+        ok: true,
+        status: 200,
+        headers: { get: () => null },
+        text: async () => '{"jsonrpc":"2.0","id":0,"result":{"protocolVersion":"2025-06-18"}}',
+      };
+    }
     assert.equal(body.params?.name, 'connectors_google_oauth_start');
     assert.deepEqual(body.params?.arguments, { workspace: 'docs' });
     return {
@@ -949,7 +1045,7 @@ test('forced delegation is cleared after one valid tool call and does not loop',
   }
 });
 
-test('a rejected runtime delegation is terminal and never loops', async () => {
+test('a rejected runtime delegation returns to Donna once without leaking technical details', async () => {
   const originalFetch = globalThis.fetch;
   globalThis.fetch = async () => ({
     ok: false,
@@ -964,6 +1060,16 @@ test('a rejected runtime delegation is terminal and never loops', async () => {
     llm: {
       async completeWithTools() {
         calls += 1;
+        if (calls === 2) {
+          return {
+            content: 'Je ne peux pas lancer cette action : aucun agent connecté ne la prend actuellement en charge.',
+            message: {
+              role: 'assistant',
+              content: 'Je ne peux pas lancer cette action : aucun agent connecté ne la prend actuellement en charge.',
+            },
+            tool_calls: [],
+          };
+        }
         return {
           content: null,
           message: { role: 'assistant', content: null },
@@ -979,14 +1085,63 @@ test('a rejected runtime delegation is terminal and never loops', async () => {
 
   try {
     const result = await createAgentGraph().invoke({ input: 'lance ingestion', session });
-    assert.equal(calls, 1);
-    assert.equal(result.response, 'Action non lancée : No orchestrable capability is currently available.');
+    assert.equal(calls, 2);
+    assert.equal(
+      result.response,
+      'Je ne peux pas lancer cette action : aucun agent connecté ne la prend actuellement en charge.',
+    );
+    assert.doesNotMatch(result.response, /ObjectiveNotOrchestrableError|capabilit|runtime__|[0-9a-f]{8}-/i);
     assert.equal(result.terminalToolFailure, true);
   } finally {
     globalThis.fetch = originalFetch;
   }
 });
 
+test('a delegation missing required provider inputs returns to Donna for clarification', async () => {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async () => ({
+    ok: false,
+    status: 422,
+    json: async () => ({
+      error: 'Delegation requires input: to, subject, body',
+    }),
+  });
+  let calls = 0;
+  const session = sessionBase({
+    runtime: { url: 'http://runtime.test' },
+    llm: {
+      async completeWithTools() {
+        calls += 1;
+        if (calls === 1) {
+          return {
+            content: null,
+            message: { role: 'assistant', content: null },
+            tool_calls: [{
+              id: 'delegate-needs-input',
+              type: 'function',
+              function: { name: 'runtime__delegate', arguments: '{"objective":"envoie un mail"}' },
+            }],
+          };
+        }
+        return {
+          content: 'Oui. À qui dois-je écrire, avec quel objet et quel message ?',
+          message: { role: 'assistant', content: 'Oui. À qui dois-je écrire, avec quel objet et quel message ?' },
+          tool_calls: [],
+        };
+      },
+    },
+  });
+
+  try {
+    const result = await createAgentGraph().invoke({ input: 'envoie un mail', session });
+    assert.equal(calls, 2);
+    assert.equal(result.response, 'Oui. À qui dois-je écrire, avec quel objet et quel message ?');
+    assert.equal(result.terminalToolFailure, false);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
 // Guard: the system prompt must never show a connected tool's bare name
 // outside its qualified server__tool form. Bare mentions are what teach the
 // model to emit unqualified tool calls (the cme_status incident). The bare
@@ -1158,8 +1313,10 @@ test('agent graph executes action inputs inside a runtime run instead of asking
   // returned a canned clarification — "lance l'ingestion" did nothing.
   const originalFetch = globalThis.fetch;
   let fetchCalls = 0;
-  globalThis.fetch = async () => {
-    fetchCalls += 1;
+  globalThis.fetch = async (_url, init) => {
+    // Count tool traffic only: the MCP session handshake is transport
+    // plumbing, not an action the user needs to approve or observe.
+    if (JSON.parse(init.body).method === 'tools/call') fetchCalls += 1;
     return {
       ok: true,
       status: 200,

package/src/cli/runtimeStartup.test.js

@@ -12,3 +12,17 @@ test('runtime startup is not blocked by optional Docker image maintenance', asyn
   assert.match(runtimeBranch, /await runRuntime\(argv\.slice\(1\), agent\)/);
   assert.doesNotMatch(runtimeBranch, /refreshRunningContainers/);
 });
+
+test('shell exit leaves the shared runtime alive and refresh is explicit', async () => {
+  const cli = await readFile(new URL('./wiki-manager.js', import.meta.url), 'utf8');
+  const tui = await readFile(new URL('../shell/tui.tsx', import.meta.url), 'utf8');
+  const bin = await readFile(new URL('../../bin/wiki-manager.js', import.meta.url), 'utf8');
+
+  assert.doesNotMatch(cli, /await shutdownOwnedRuntime\(runtime/);
+  assert.doesNotMatch(tui, /shutdownOwnedRuntime/);
+  assert.match(tui, /shell closed; shared runtime left running/);
+  assert.match(tui, /process\.exit\(0\)/);
+  assert.match(cli, /argv\.includes\('--refresh'\)/);
+  assert.match(cli, /spawnSync\(workspaceCliPath, \['refresh'\]/);
+  assert.match(bin, /!argv\.includes\('--refresh'\)/);
+});