@dotdrelle/wiki-manager 0.15.38 → 0.15.41

package/README.md

@@ -771,6 +771,11 @@ capabilityRouting:
     allowedAgents: [connectors]
 ```
 
+The production agent also advertises `workspace.restore` for Git-backed
+rollback. It is workspace-scoped and remains subject to the normal runtime
+approval and lock checks; it can be pinned in the same way when several agents
+provide that capability.
+
 #### Compose overrides — optional agents, proxies, local fixes
 
 Two override files sit under **`.wiki/compose/`**, one per stack:

package/docker-compose.yml

@@ -124,7 +124,7 @@ services:
       - WORKSPACE_NAME=${WORKSPACE_NAME:-workspace}
       - WIKI_WORKSPACE_PATH=/workspace
       - WIKI_CONFIG_PATH=${WIKI_CONFIG_PATH:-}
-      - PRODUCTION_ALLOWED_STEPS=${PRODUCTION_ALLOWED_STEPS:-doctor,ingest,ingest_plan,ingest_apply,build,export,polish,pipeline}
+      - PRODUCTION_ALLOWED_STEPS=${PRODUCTION_ALLOWED_STEPS:-doctor,ingest,ingest_plan,ingest_apply,build,export,polish,restore,pipeline}
       - PRODUCTION_REQUIRE_CONFIRMATION=${PRODUCTION_REQUIRE_CONFIRMATION:-false}
       # Parallelism levers — effective concurrency ≈ recommendedConcurrency.
       # Intermediate defaults (4/8). Low profile 2/4, high profile 8/16.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotdrelle/wiki-manager",
-  "version": "0.15.38",
+  "version": "0.15.41",
   "description": "Agentic shell and orchestration cockpit for llm-wiki workspaces.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "author": "dotrelle",
@@ -11,7 +11,7 @@
   },
   "scripts": {
     "start": "bun ./bin/wiki-manager.js",
-    "test": "node --test src/cli/runtimeStartup.test.js src/cli/wiki-manager.test.js src/agent/graph.test.js src/contracts/schemas.test.js src/core/activity.test.js src/core/env.test.js src/core/agentsCompose.test.js src/core/profileServiceStatus.test.js src/core/buildInfo.test.js src/core/agentEvents.test.js src/core/runtimeLog.test.js src/activity/activityAggregator.test.js src/graph/runGraphProjector.test.js src/core/workflow.test.js src/core/planPatch.test.js src/core/agentLoop.test.js src/core/plan.test.js src/core/mcp.test.js src/core/toolLoop.test.js src/core/documentIntake.test.js src/core/dockerCompose.test.js src/core/wikiSetup.test.js src/core/wikiWorkspace.test.js src/core/wikirc.test.js src/core/cacert.test.js src/core/composeOverrides.test.js src/core/setEnvValue.test.js src/core/commandFailure.test.js src/core/googleGrants.test.js src/core/modelFetch.test.js src/core/startupCheck.test.js src/core/queueStore.test.js src/orchestrator/agentRegistry.test.js src/orchestrator/capabilityRegistry.test.js src/orchestrator/capabilityResolver.test.js src/orchestrator/planValidator.test.js src/orchestrator/planIntegrator.test.js src/orchestrator/scheduler.test.js src/orchestrator/attemptManager.test.js src/orchestrator/resultAggregator.test.js src/orchestrator/approvalPolicy.test.js src/orchestrator/dispatcher.test.js src/orchestrator/objectiveResolver.test.js src/commands/slash.test.js src/shell/repl.test.js src/shell/setupWizardPlaceholders.test.js src/shell/setupWizardSuggestions.test.js src/shell/setupWizardDiscovery.test.js src/shell/wrapText.test.js src/runtime/lifecycle.test.js src/runtime/store.test.js src/runtime/controlMessages.test.js src/runtime/recoveryManager.test.js src/runtime/server.test.js src/runtime/supervisor.test.js src/runtime/runner.test.js src/runtime/runner.e2e.test.js src/runtime/donna-contract.test.js src/runtime/auth.test.js",
+    "test": "node --test src/cli/runtimeStartup.test.js src/cli/wiki-manager.test.js src/agent/graph.test.js src/contracts/schemas.test.js src/core/activity.test.js src/core/env.test.js src/core/agentsCompose.test.js src/core/profileServiceStatus.test.js src/core/buildInfo.test.js src/core/agentEvents.test.js src/core/runtimeLog.test.js src/activity/activityAggregator.test.js src/graph/runGraphProjector.test.js src/core/workflow.test.js src/core/planPatch.test.js src/core/agentLoop.test.js src/core/plan.test.js src/core/mcp.test.js src/core/toolLoop.test.js src/core/documentIntake.test.js src/core/dockerCompose.test.js src/core/wikiSetup.test.js src/core/wikiWorkspace.test.js src/core/wikirc.test.js src/core/cacert.test.js src/core/composeOverrides.test.js src/core/setEnvValue.test.js src/core/commandFailure.test.js src/core/googleGrants.test.js src/core/modelFetch.test.js src/core/startupCheck.test.js src/core/queueStore.test.js src/orchestrator/agentRegistry.test.js src/orchestrator/capabilityRegistry.test.js src/orchestrator/capabilityResolver.test.js src/orchestrator/planValidator.test.js src/orchestrator/planIntegrator.test.js src/orchestrator/taskStatuses.test.js src/orchestrator/scheduler.test.js src/orchestrator/attemptManager.test.js src/orchestrator/resultAggregator.test.js src/orchestrator/approvalPolicy.test.js src/orchestrator/dispatcher.test.js src/orchestrator/objectiveResolver.test.js src/commands/slash.test.js src/shell/repl.test.js src/shell/setupWizardPlaceholders.test.js src/shell/setupWizardSuggestions.test.js src/shell/setupWizardDiscovery.test.js src/shell/wrapText.test.js src/runtime/lifecycle.test.js src/runtime/store.test.js src/runtime/controlMessages.test.js src/runtime/recoveryManager.test.js src/runtime/server.test.js src/runtime/supervisor.test.js src/runtime/delegation.test.js src/runtime/runner.test.js src/runtime/runner.e2e.test.js src/runtime/donna-contract.test.js src/runtime/auth.test.js",
     "check-versions": "node scripts/check-versions.js",
     "prepack": "node scripts/check-versions.js",
     "prepublishOnly": "node scripts/check-versions.js",

package/src/activity/activityAggregator.js

@@ -1,8 +1,8 @@
 import { calculateWeightedProgress } from './progressCalculator.js';
 import { deduplicateActivities } from './activityDeduplicator.js';
 import { initialSynthesisFromState } from './runSynthesis.js';
+import { isSuccessful } from '../orchestrator/taskStatuses.js';
 
-const DONE = new Set(['done', 'complete', 'completed', 'success', 'succeeded']);
 const ACTIVE = new Set(['running', 'starting', 'queued']);
 
 export function aggregateActivity(state = {}, events = []) {
@@ -67,7 +67,7 @@ function groupLabel(task) {
 
 function groupLine(group, activities) {
   const total = group.tasks.length;
-  const done = group.tasks.filter((task) => DONE.has(statusOf(task))).length;
+  const done = group.tasks.filter((task) => isSuccessful(statusOf(task))).length;
   const running = group.tasks.filter((task) => ACTIVE.has(statusOf(task)));
   const failed = group.tasks.find((task) => statusOf(task) === 'failed');
   const waitingApproval = group.tasks.some((task) => ['pending_approval', 'waiting_approval'].includes(statusOf(task)));
@@ -76,7 +76,7 @@ function groupLine(group, activities) {
   // the whole group as "validation 0%" while a worker visibly runs at 35%.
   const activePair = group.tasks
     .map((task) => ({ task, activity: activityForTask(task, activities) }))
-    .find(({ activity }) => activity && !activity.terminal && !DONE.has(statusOf(activity)));
+    .find(({ activity }) => activity && !activity.terminal && !isSuccessful(statusOf(activity)));
   const activeTask = activePair?.task ?? running[0] ?? null;
   const activeActivity = activePair?.activity
     ?? running.map((task) => activityForTask(task, activities)).find(Boolean);

package/src/activity/progressCalculator.js

@@ -1,5 +1,4 @@
-const TERMINAL_DONE = new Set(['done', 'complete', 'completed', 'success', 'succeeded']);
-const TERMINAL_ANY = new Set([...TERMINAL_DONE, 'failed', 'cancelled', 'canceled', 'error']);
+import { isSuccessful, isTerminal } from '../orchestrator/taskStatuses.js';
 
 export function calculateWeightedProgress(tasks = [], activities = []) {
   const items = Array.isArray(tasks) ? tasks : [];
@@ -10,10 +9,10 @@ export function calculateWeightedProgress(tasks = [], activities = []) {
   for (const task of items) {
     const weight = taskWeight(task);
     const status = normalizeStatus(task.status);
-    if (TERMINAL_DONE.has(status)) {
+    if (isSuccessful(status)) {
       completedWeight += weight;
       done += 1;
-    } else if (!TERMINAL_ANY.has(status)) {
+    } else if (!isTerminal(status)) {
       completedWeight += weight * taskProgressRatio(task, activities);
     }
   }

package/src/agent/graph.js

@@ -1,3 +1,13 @@
+/**
+ * @statuses-vocabulary
+ *
+ * JSON schema enumeration exposed to models. A schema declares what it
+ * accepts, including values the orchestrator no longer produces.
+ *
+ * Declared here rather than in a central exception list so the waiver
+ * travels with the code it excuses (see orchestrator/taskStatuses.test.js).
+ */
+import { isTerminal } from '../orchestrator/taskStatuses.js';
 import { join } from 'node:path';
 import { Annotation, END, START, StateGraph } from '@langchain/langgraph';
 import {
@@ -640,7 +650,7 @@ function rememberProductionProgress(session, payload, label) {
     jobId: jobId ?? session.productionActivity?.jobId ?? null,
     status,
     label: label ?? `Production: ${status}`,
-    terminal: ['done', 'failed', 'cancelled'].includes(String(status)),
+    terminal: isTerminal(status),
     updatedAt: new Date().toISOString(),
   };
 }
@@ -804,6 +814,35 @@ async function handleRuntimeControlTool(session, tool, args = {}) {
       if (connectorConfig) {
         return `Delegation rejected: ${connectorConfig.serverName} advertises no setup or authentication tool. Do not call an unrelated data tool and do not delegate to export. Explain conversationally that authentication must be completed outside MCP, using only configuration instructions already available in the current context.`;
       }
+      /*
+       Un run ne passe pas par le réseau pour se déléguer à lui-même.
+
+       Donna délègue DEPUIS l'intérieur du run conversationnel qui vient d'être
+       marqué actif. Passer par POST /delegate revenait à demander au runtime
+       l'autorisation de démarrer un run alors qu'un run tourne déjà — le sien —
+       et l'endpoint répondait 409, à juste titre de son point de vue. Le run
+       refusait sa propre délégation.
+
+       Déléguer n'est pas démarrer un second run : c'est faire passer celui-ci
+       de la décision à l'exécution. Quand ce chemin interne existe (agent
+       exécuté dans le processus du runtime), on l'emprunte : même `runId`,
+       aucun run concurrent, aucun 409. Le chemin HTTP reste pour les appelants
+       réellement extérieurs — le Shell, un client tiers —, et c'est là que le
+       409 garde tout son sens.
+      */
+      if (typeof session?._delegateWithinRun === 'function') {
+        try {
+          const inRun = await session._delegateWithinRun(objective);
+          return JSON.stringify({
+            delegated: true,
+            runId: inRun.runId,
+            summary: inRun.summary ?? null,
+            message: `Action lancée (${String(inRun.runId).slice(0, 8)}) après validation du plan réel : ${inRun.summary?.tasks ?? 0} tâche(s), ${inRun.summary?.agent ?? 'agent résolu'}. Exécution en cours.`,
+          });
+        } catch (err) {
+          return `Délégation refusée : ${err instanceof Error ? err.message : String(err)}`;
+        }
+      }
       const result = await postRuntimeDelegate(objective, { url, workspace });
       return result?.runId
         ? JSON.stringify({

package/src/cli/wiki-manager.js

@@ -1,3 +1,12 @@
+/**
+ * @statuses-vocabulary
+ *
+ * JOB statuses as reported by headless polling, mapped to a process exit
+ * code — a different contract from the orchestrator's task vocabulary.
+ *
+ * Declared here rather than in a central exception list so the waiver
+ * travels with the code it excuses (see orchestrator/taskStatuses.test.js).
+ */
 import { randomUUID } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
@@ -317,17 +326,7 @@ export async function forwardRuntimeApproval(getWorkspaceContext, request = {})
   return context.approvalManager?.approve(request) ?? { approved: false };
 }
 
-export function resolvePreparedDelegationApproval({
-  autoApprove = false,
-  approvalManager = null,
-  runId,
-} = {}) {
-  if (autoApprove !== true || typeof approvalManager?.approve !== 'function') {
-    return { approved: false, awaitingApproval: true };
-  }
-  const result = approvalManager.approve({ scope: 'run', runId });
-  return { approved: true, awaitingApproval: false, result };
-}
+export { resolvePreparedDelegationApproval } from '../runtime/delegation.js';
 
 function timestampForFile() {
   return new Date().toISOString().replace(/[:.]/g, '-');
@@ -1168,39 +1167,33 @@ async function runRuntime(argv, agent) {
         : undefined;
       supervisor?.setRunSignal(signal);
       session._onStep = (message) => emitRuntimeLog(session, message);
-      if (body.preparedDelegation?.fragment) {
-        const { integrate } = await import('../orchestrator/planIntegrator.js');
-        const prepared = body.preparedDelegation;
-        const integrated = integrate(runId, prepared.fragment, {
+      session._delegateWithinRun = async (objective) => {
+        const { delegateWithinRun } = await import('../runtime/delegation.js');
+        return delegateWithinRun(session, objective, {
+          prepare: ({ objective: goal }) => prepareDelegation(context, { objective: goal }),
           registry: capabilityRegistryForSession(session),
-          session,
           store,
-          workspace: session.workspace ?? null,
-          enforceApprovalCoverage: true,
+          approvalManager: context.approvalManager,
+          autoApprove: body.autoApprove === true,
         });
-        if (!integrated.ok) {
-          throw new Error(`Delegated plan integration failed: ${(integrated.errors ?? []).map((error) => error.message ?? error.code ?? String(error)).join('; ')}`);
-        }
-        emitRuntimeLog(session, `delegation: ${prepared.fragment.tasks.length} validated task(s) integrated from ${prepared.provider.serverName}.agent_plan (${prepared.capability}/${prepared.operation})`);
+      };
+      if (body.preparedDelegation?.fragment) {
+        const { integratePreparedDelegation } = await import('../runtime/delegation.js');
+        const prepared = body.preparedDelegation;
         // Real approval gate (opt-out): a directly-delegated run only skips the
         // human approval step when the caller explicitly opts in via
         // `autoApprove` (e.g. headless/CI, or a future "trust this run" toggle).
-        // By default the run WAITS: integrate() above created the per-task
-        // approval requests, and the scheduler's approvalCovered() filter blocks
-        // the mutating tasks until a run-scope grant arrives (/approve or
-        // "valide tout"). This keeps a visible pending_approval window instead of
-        // resolving it programmatically ~30ms after launch, which no polled UI
-        // could ever render.
-        const approval = resolvePreparedDelegationApproval({
-          autoApprove: body.autoApprove,
-          approvalManager: context.approvalManager,
+        // By default the run WAITS, so the pending_approval window stays
+        // visible instead of being resolved ~30ms after launch.
+        integratePreparedDelegation({
+          session,
+          store,
           runId,
+          prepared,
+          registry: capabilityRegistryForSession(session),
+          approvalManager: context.approvalManager,
+          autoApprove: body.autoApprove === true,
         });
-        if (approval.approved) {
-          emitRuntimeLog(session, `approval: run ${runId} auto-approved (autoApprove opt-in)`);
-        } else {
-          emitRuntimeLog(session, `approval: run ${runId} awaiting explicit approval before mutations (/approve or « valide tout »)`);
-        }
         body._planReady?.resolve?.({ runId, planRevision: session.agentProjection?.planRevision ?? 0 });
       }
       // Deterministic capability run (/ingest): ask the capable agent for its
@@ -1231,9 +1224,11 @@ async function runRuntime(argv, agent) {
             ),
             requireApprovalForMutations: body.capabilityPlan.requireApproval !== false,
           },
-          ...(Array.isArray(body.capabilityPlan.inputs) && body.capabilityPlan.inputs.length > 0
-            ? { arguments: { inputs: body.capabilityPlan.inputs } }
-            : {}),
+          ...(body.capabilityPlan.arguments && typeof body.capabilityPlan.arguments === 'object'
+            ? { arguments: body.capabilityPlan.arguments }
+            : Array.isArray(body.capabilityPlan.inputs) && body.capabilityPlan.inputs.length > 0
+              ? { arguments: { inputs: body.capabilityPlan.inputs } }
+              : {}),
         })));
         if (!Array.isArray(fragment?.tasks) || fragment.tasks.length === 0) {
           dispatchAgentEvent(session, createAgentEvent('assistant_message', {

package/src/commands/slash.js

@@ -1,3 +1,13 @@
+/**
+ * @statuses-vocabulary
+ *
+ * CONTROL QUEUE item statuses, which include `expired`. A control request
+ * is not a task and does not share its lifecycle.
+ *
+ * Declared here rather than in a central exception list so the waiver
+ * travels with the code it excuses (see orchestrator/taskStatuses.test.js).
+ */
+import { isTerminal } from '../orchestrator/taskStatuses.js';
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import { openExternalUrl } from '../shell/openExternal.js';
 import { classifyCommandFailure, failureHint, rawFailureText } from '../core/commandFailure.js';
@@ -850,7 +860,7 @@ function formatRuntimeRunStatus(state) {
     ? state.controlQueue.filter((item) => item.status === 'queued').length
     : 0;
   const tasks = Array.isArray(state?.workflow?.nodes)
-    ? state.workflow.nodes.filter((node) => node.type === 'task' && !['done', 'failed', 'cancelled'].includes(String(node.status))).length
+    ? state.workflow.nodes.filter((node) => node.type === 'task' && !isTerminal(node.status)).length
     : 0;
   return `runtime: ${status}${runId} · queued=${queued} · activeTasks=${tasks}`;
 }

package/src/core/activity.js

@@ -1,4 +1,5 @@
 import { validateContractInDev } from '../contracts/schemas.js';
+import { isTerminal, isUnsuccessfulTerminal } from '../orchestrator/taskStatuses.js';
 
 export function parseJsonText(text) {
   try {
@@ -13,7 +14,7 @@ function basename(value) {
 }
 
 function terminalStatus(status) {
-  return ['done', 'failed', 'cancelled', 'canceled', 'complete', 'completed', 'success', 'succeeded', 'error'].includes(String(status ?? '').toLowerCase());
+  return isTerminal(status);
 }
 
 export function activityKey(activity) {
@@ -251,7 +252,7 @@ export function newNonTerminalActivities(snapshotBefore, session) {
 
 export function terminalFailures(activities) {
   return activities.filter(
-    (a) => a.terminal && ['failed', 'error', 'cancelled', 'canceled'].includes(String(a.status).toLowerCase()),
+    (a) => a.terminal && isUnsuccessfulTerminal(a.status),
   );
 }
 

package/src/core/agentEvents.js

@@ -4,6 +4,7 @@ import { applyPlanPatch, normalizePlanPatch, normalizePlanRevision, rebasePlanPa
 import { formatRuntimeLogPayload } from './runtimeLog.js';
 import { projectWorkflow } from './workflow.js';
 import { validateContractInDev } from '../contracts/schemas.js';
+import { isTerminal, isSuccessful, isUnknownStatus, normalizeTaskStatus } from '../orchestrator/taskStatuses.js';
 
 const SESSION_PROJECTION_EVENTS = new Set([
   'run_started',
@@ -343,7 +344,13 @@ function applyEvent(state, event) {
       state.planRevision = normalizePlanRevision(event.payload?.planRevision ?? state.planRevision + 1);
       return;
     case 'plan_step_updated':
-      updatePlanStep(state.plan, event.payload ?? {});
+      {
+        // L'anomalie remonte par la valeur de retour plutôt que par une
+        // référence au state : `updatePlanStep` reste une fonction sur un
+        // plan, et le journal reste la responsabilité de l'appelant.
+        const anomaly = updatePlanStep(state.plan, event.payload ?? {});
+        if (anomaly) state.logs.push(anomaly);
+      }
       return;
     case 'control_message_received':
       state.logs.push(`Control message: ${String(event.payload?.input ?? '')}`);
@@ -556,6 +563,7 @@ function applyEvent(state, event) {
         status: 'queued',
         createdAt: event.payload?.createdAt ?? event.ts,
         updatedAt: event.ts,
+        ...(event.payload?.capabilityPlan !== undefined ? { capabilityPlan: event.payload.capabilityPlan } : {}),
       });
       return;
     case 'control_started':
@@ -724,7 +732,7 @@ function markCoveredApprovalsApproved(approvals, grant, ts) {
 
 function cancelPendingPlanSteps(plan) {
   for (const step of plan ?? []) {
-    if (!['done', 'failed', 'cancelled'].includes(String(step.status ?? ''))) step.status = 'cancelled';
+    if (!isTerminal(step.status)) step.status = 'cancelled';
   }
 }
 
@@ -851,24 +859,51 @@ function normalizePlanTask(raw, index, { owner = 'orchestrator', ownerActivityKe
 }
 
 function updatePlanStep(plan, payload) {
-  if (!plan) return;
+  let anomaly = null;
+  if (!plan) return anomaly;
   const requestedTaskId = payload.taskId ?? payload.id ?? payload.targetTaskId;
   const step = requestedTaskId != null
     ? plan.find((item) => String(item.id ?? item.step) === String(requestedTaskId))
     : plan.find((item) => item.step === Number(payload.step));
-  if (!step) return;
-  if (payload.status === 'failed') step.status = 'failed';
-  else if (payload.status === 'running') step.status = 'running';
-  else if (payload.status === 'pending') step.status = 'pending';
-  else if (payload.status === 'pending_approval') step.status = 'pending_approval';
-  else if (payload.status === 'waiting_approval') step.status = 'waiting_approval';
-  else if (payload.status === 'cancelled') step.status = 'cancelled';
-  else step.status = 'done';
+  if (!step) return anomaly;
+  /*
+   Un statut inconnu ne vaut pas « réussi ».
+
+   La cascade se terminait par `else step.status = 'done'` : tout statut non
+   énuméré — `skipped`, par exemple — était projeté en succès. Le runner
+   marquait bien une tâche ignorée, la projection la déclarait faite, et le
+   résumé de run comptait une réussite qui n'a jamais eu lieu. Le défaut le
+   plus dangereux est celui qui transforme une inconnue en bonne nouvelle.
+
+   Trois cas, et un seul mène à `done` :
+
+   - un statut reconnu par le vocabulaire commun est repris tel quel, alias
+     compris (`succeeded` → `done`, `error` → `failed`) ;
+   - l'ABSENCE de statut garde le contrat historique — un événement de fin
+     sans précision signifie « terminé » ;
+   - un statut présent mais incompréhensible laisse l'étape dans l'état où
+     elle était, et signale une anomalie de projection. On ne sait pas ce qui
+     s'est passé : le dire est plus utile que d'inventer une réponse.
+  */
+  const canonical = normalizeTaskStatus(payload.status);
+  if (canonical) {
+    step.status = canonical;
+  } else if (isUnknownStatus(payload.status)) {
+    anomaly = `projection: unknown status "${String(payload.status)}" for plan step ${String(requestedTaskId ?? payload.step ?? '?')} — kept "${String(step.status ?? 'pending')}"`;
+  } else {
+    step.status = 'done';
+  }
+  // Le motif d'un abandon est la seule chose qui le rende actionnable :
+  // « ignorée » sans « parce que » n'apprend rien à qui relance.
+  if (step.status === 'skipped' && payload.reason && !step.error) {
+    step.error = { code: 'dependency_failed', message: String(payload.reason) };
+  }
   if (payload.activityKey) step.activityKey = payload.activityKey;
   if (Array.isArray(payload.outputRefs)) step.outputRefs = payload.outputRefs.map(cloneRef);
   if (payload.result) step.result = cloneJson(payload.result);
   if (payload.retryState) step.retryState = cloneJson(payload.retryState);
   if (payload.retryAssignment) step.retryAssignment = cloneJson(payload.retryAssignment);
+  return anomaly;
 }
 
 function formatPlanErrors(errors) {

package/src/core/agentEvents.test.js

@@ -364,6 +364,38 @@ test('reduceAgentEvents: control queue is event sourced and follows run status',
   assert.equal(projection.controlQueue[1].status, 'cancelled');
 });
 
+test('reduceAgentEvents: control_enqueued preserves a structured capabilityPlan across replay', () => {
+  const capabilityPlan = {
+    capability: 'workspace.restore',
+    operation: 'restore',
+    arguments: { run: 'abc123' },
+    requireApproval: true,
+  };
+  const projection = reduceAgentEvents([
+    createAgentEvent('control_enqueued', {
+      origin: 'runtime',
+      workspace: 'docs',
+      payload: {
+        id: 'control-restore',
+        workspace: 'docs',
+        input: 'restore',
+        createdAt: '2026-01-01T00:00:00.000Z',
+        capabilityPlan,
+      },
+    }),
+    createAgentEvent('control_started', {
+      origin: 'runtime',
+      runId: 'run-control-restore',
+      workspace: 'docs',
+      payload: { id: 'control-restore', runId: 'run-control-restore' },
+    }),
+  ]);
+
+  const item = projection.controlQueue.find((entry) => entry.id === 'control-restore');
+  assert.deepEqual(item.capabilityPlan, capabilityPlan);
+  assert.equal(item.status, 'running');
+});
+
 test('reduceAgentEvents: activity-owned plan is used when no orchestrator plan exists', () => {
   const projection = reduceAgentEvents([
     createAgentEvent('activity_upserted', {
@@ -515,3 +547,47 @@ test('run_error cancels pending plan steps and active activities (no ghosts at r
   assert.equal(activity.status, 'cancelled');
   assert.equal(activity.terminal, true);
 });
+
+/*
+ La cascade de statuts se terminait par `else step.status = 'done'` : un statut
+ non énuméré était projeté en succès. Le runner marquait une tâche `skipped`
+ faute de dépendance, la projection la déclarait faite, et le résumé comptait
+ une réussite qui n'avait jamais eu lieu — le pire des défauts, celui qui
+ transforme une inconnue en bonne nouvelle.
+*/
+test('reduceAgentEvents: un statut de plan inconnu ne devient pas un succès', () => {
+  const projection = reduceAgentEvents([
+    createAgentEvent('plan_set', { origin: 'tool', payload: { steps: ['Ingest a', 'Ingest b'] } }),
+    createAgentEvent('plan_step_updated', {
+      origin: 'runtime',
+      payload: { step: 1, status: 'skipped', reason: 'dependency_failed:convert' },
+    }),
+    createAgentEvent('plan_step_updated', {
+      origin: 'runtime',
+      payload: { step: 2, status: 'brouette' },
+    }),
+  ]);
+
+  assert.equal(projection.plan[0].status, 'skipped');
+  assert.equal(projection.plan[0].error?.code, 'dependency_failed');
+  assert.match(projection.plan[0].error.message, /convert/);
+  // Un statut incompréhensible laisse l'étape où elle était et se signale :
+  // on ne sait pas ce qui s'est passé, le dire vaut mieux que d'inventer.
+  assert.equal(projection.plan[1].status, 'pending');
+  assert.equal(projection.logs.some((line) => /unknown status "brouette"/.test(line)), true);
+});
+
+test('reduceAgentEvents: les alias de statut tombent sur le canonique', () => {
+  const projection = reduceAgentEvents([
+    createAgentEvent('plan_set', { origin: 'tool', payload: { steps: ['A', 'B', 'C'] } }),
+    createAgentEvent('plan_step_updated', { origin: 'runtime', payload: { step: 1, status: 'succeeded' } }),
+    createAgentEvent('plan_step_updated', { origin: 'runtime', payload: { step: 2, status: 'error' } }),
+    // Contrat historique : un événement de fin sans statut vaut « terminé ».
+    createAgentEvent('plan_step_updated', { origin: 'runtime', payload: { step: 3 } }),
+  ]);
+
+  assert.equal(projection.plan[0].status, 'done');
+  assert.equal(projection.plan[1].status, 'failed');
+  assert.equal(projection.plan[2].status, 'done');
+  assert.equal(projection.logs.some((line) => /unknown status/.test(line)), false);
+});

package/src/core/agentLoop.js

@@ -3,6 +3,11 @@ import { createAgentEvent, dispatchAgentEvent } from './agentEvents.js';
 import { activitySnapshot, newNonTerminalActivities } from './activity.js';
 import { formatCompletedActivities, formatPlanStatus } from './plan.js';
 import { formatReadyTaskPrompt, nextReadyPlanTask, readyPlanTasks, sanitizePlanForExecution } from './planPatch.js';
+import { isActive, isPending, normalizeTaskStatus } from '../orchestrator/taskStatuses.js';
+
+// Les deux formes d'attente d'un accord humain. Distinguées de `pending` :
+// approuver ne les rend pas prêtes de la même manière.
+const isPendingApproval = (status) => ['pending_approval', 'waiting_approval'].includes(normalizeTaskStatus(status));
 
 export function abortError(message = 'Agent run cancelled.') {
   const err = new Error(message);
@@ -111,19 +116,40 @@ export async function runAgenticLoop(agent, session, initialInput, {
     // integrated agent_plan fragment. Prose stays prose.
     sanitizeSessionPlan(session, { runId });
 
+    /*
+     Une décision prise arrête la conversation.
+
+     Dès qu'un fragment structuré est intégré pendant ce tour — Donna vient de
+     déléguer —, la boucle conversationnelle n'a plus rien à décider : le plan
+     existe, validé par l'agent qui l'exécutera. Elle rendait pourtant la main
+     au modèle, parce que le seul critère de bascule était « au moins deux
+     tâches PRÊTES » et qu'un plan intégralement en attente d'approbation n'en
+     compte aucune. Le modèle repartait donc, l'évaluateur jugeait le plan
+     incomplet, le replanificateur relançait une délégation : cinq tâches,
+     puis dix, puis quinze, à l'identique.
+
+     L'attente d'approbation et l'exécution appartiennent au planificateur
+     parallèle, qui sait faire les deux. On lui rend la main tout de suite.
+    */
+    if (parallelHandoff && session._structuredPlanIntegrated) {
+      session._structuredPlanIntegrated = false;
+      return { ok: true, handoff: true };
+    }
+
     const newPending = newNonTerminalActivities(snapshot, session);
     if (newPending.length === 0) {
-      // pending_approval is unfinished work too (a request_approval patch op
-      // sets it) — it must not be treated as "nothing left to do" just
-      // because no step is literally 'pending' anymore.
-      const pending = (session.headlessPlan ?? []).filter((step) => step.status === 'pending' || step.status === 'pending_approval');
+      // Toute attente est du travail inachevé — approbation comprise. La liste
+      // énumérait `pending` et `pending_approval` mais oubliait
+      // `waiting_approval`, que produit justement l'intégration d'un fragment
+      // délégué : un plan entier en attente se lisait « plus rien à faire ».
+      const pending = (session.headlessPlan ?? []).filter((step) => isPending(step.status));
       const pendingSteps = readyPlanTasks(session.headlessPlan);
       if (pending.length === 0) {
         onComplete?.();
         return { ok: true };
       }
       if (pendingSteps.length === 0) {
-        const reason = pending.every((step) => step.status === 'pending_approval') ? 'awaiting_approval' : 'no_ready_plan_task';
+        const reason = pending.every((step) => isPendingApproval(step.status)) ? 'awaiting_approval' : 'no_ready_plan_task';
         onPendingSteps?.({ pendingSteps: pending, blocked: true });
         return { ok: false, stalled: true, reason };
       }
@@ -150,7 +176,7 @@ export async function runAgenticLoop(agent, session, initialInput, {
     const summary = formatCompletedActivities(completed);
     onActivitiesCompleted?.({ completed, summary });
     const unfinished = (session.headlessPlan ?? []).some((step) =>
-      ['pending', 'pending_approval', 'running', 'starting', 'queued'].includes(String(step.status ?? '').toLowerCase()));
+      isPending(step.status) || isActive(step.status));
     if (deterministicTerminalSummary && !unfinished) {
       return { ok: true, completed, summary, deterministicSummary: true };
     }

package/src/core/buildInfo.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.15.38",
-  "commit": "abf8356"
+  "version": "0.15.41",
+  "commit": "d0180aa"
 }

package/src/core/dockerCompose.test.js

@@ -19,6 +19,14 @@ test('workspace compose does not start a per-workspace agent runtime', async ()
   );
 });
 
+test('workspace production agent enables restore by default', async () => {
+  const raw = await readFile(new URL('../../docker-compose.yml', import.meta.url), 'utf8');
+  const compose = YAML.parse(raw);
+  const allowed = compose.services['production-mcp'].environment
+    .find((entry) => String(entry).startsWith('PRODUCTION_ALLOWED_STEPS='));
+  assert.match(String(allowed), /(?:^|,)restore(?:,|})/);
+});
+
 test('shipped compose files never carry a build context', async () => {
   // Ces deux fichiers partent dans le paquet npm, où les dépôts frères
   // (`../agent-external/…`) n'existent pas : un `build:` y rend toute commande

package/src/core/jobQueue.js

@@ -1,3 +1,12 @@
+/**
+ * @statuses-vocabulary
+ *
+ * JOB queue statuses. A queued job has its own lifecycle, independent of
+ * the task that may have enqueued it.
+ *
+ * Declared here rather than in a central exception list so the waiver
+ * travels with the code it excuses (see orchestrator/taskStatuses.test.js).
+ */
 import { randomUUID } from 'node:crypto';
 import { isAbsolute, relative, resolve, sep } from 'node:path';
 import { extractActivity, parseJsonText, sessionActivities } from './activity.js';

package/src/core/mcp.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { managerEnvFile, managerMcpEndpointsFile, readEnvFile } from './env.js';
 
-const WIKI_MANAGER_VERSION = '0.15.38';
+const WIKI_MANAGER_VERSION = '0.15.41';
 
 function envValue(key) {
   const filePath = managerEnvFile();

package/src/core/plan.js

@@ -1,3 +1,4 @@
+import { isUnsuccessfulTerminal } from '../orchestrator/taskStatuses.js';
 export function ensurePlanFromActivity(session, activity) {
   if (!activity) return;
   const actKey = activity.key ?? null;
@@ -57,7 +58,7 @@ export function syncActivitiesToPlan(plan, activities) {
   const contractTaskPlan = isContractTaskPlan(plan);
   for (const activity of activities ?? []) {
     const terminal = Boolean(activity.terminal);
-    const failed = ['failed', 'error', 'cancelled', 'canceled'].includes(String(activity.status).toLowerCase());
+    const failed = isUnsuccessfulTerminal(activity.status);
     const actKey = activity.key ?? activity.id ?? activity.jobId ?? null;
     const structuredMatch = findMatchingPlanStepByStructure(plan, activity);
     const matched = structuredMatch ?? findMatchingPlanStep(plan, activity);
@@ -244,7 +245,7 @@ export function attachActivityToExistingPlan(plan, activity) {
   if (!matched) return;
   matched.activityKey = actKey;
   if (!matched.ownerActivityKey) matched.ownerActivityKey = actKey;
-  const failed = ['failed', 'error', 'cancelled', 'canceled'].includes(String(activity.status).toLowerCase());
+  const failed = isUnsuccessfulTerminal(activity.status);
   if (activity.terminal) {
     matched.status = failed ? 'failed' : 'done';
     return;