@dotdrelle/wiki-manager 0.15.40 → 0.15.42

package/src/core/wikirc.test.js

@@ -163,7 +163,7 @@ test('writeVectorConfig removes commented vector placeholders it replaces', () =
   assert.equal(parsed.retrieval.vector.apiKey, 'vector-key');
 });
 
-test('finalizeCreatedWorkspace copies generated wiki token into default wikirc', () => {
+test('finalizeCreatedWorkspace copies generated wiki token into default wikirc', async () => {
   const root = mkdtempSync(join(tmpdir(), 'wikirc-workspace-token-'));
   const registryRoot = join(root, 'registry');
   const registryPath = join(registryRoot, 'demo');
@@ -190,7 +190,7 @@ test('finalizeCreatedWorkspace copies generated wiki token into default wikirc',
   const previousDir = process.env.WIKI_WORKSPACES_DIR;
   process.env.WIKI_WORKSPACES_DIR = registryRoot;
   try {
-    const workspace = finalizeCreatedWorkspace('demo');
+    const { workspace } = await finalizeCreatedWorkspace('demo');
     const parsed = YAML.parse(readFileSync(join(workspacePath, '.wikirc.yaml'), 'utf8'));
 
     assert.equal(workspace.name, 'demo');
@@ -249,3 +249,122 @@ test('containerReachableUrl only touches loopback hosts', () => {
   assert.equal(containerReachableUrl('http://gateway:4000/v1').rewritten, false);
   assert.equal(containerReachableUrl(undefined).rewritten, false);
 });
+
+// /new used to leave the operator re-entering the same endpoint, key and model
+// they had just proven working in the workspace next door.
+test('finalizeCreatedWorkspace seeds a new workspace from the one in use', async () => {
+  const root = mkdtempSync(join(tmpdir(), 'wikirc-inherit-'));
+  const registryRoot = join(root, 'registry');
+  const agentsData = join(root, '.agents-data');
+  const token = 'b'.repeat(64);
+
+  const makeWorkspace = (name, wikirc) => {
+    const registryPath = join(registryRoot, name);
+    const workspacePath = join(root, name);
+    mkdirSync(registryPath, { recursive: true });
+    mkdirSync(workspacePath, { recursive: true });
+    writeFileSync(join(registryPath, '.env'), [
+      `WORKSPACE_NAME=${name}`,
+      `WIKI_WORKSPACE_PATH=${workspacePath}`,
+      `WIKI_MCP_AUTH_TOKEN=${token}`,
+      '',
+    ].join('\n'), 'utf8');
+    writeFileSync(join(workspacePath, '.wikirc.yaml'), wikirc, 'utf8');
+    return workspacePath;
+  };
+
+  makeWorkspace('acpi', [
+    'language: en',
+    'llm:',
+    '  provider: ai-gateway',
+    '  engine: generic',
+    '  baseUrl: https://itsdonna.events/v1',
+    '  model: deepseek-v4-pro',
+    '  apiKey: sk-real-gateway-key',
+    'mcp:',
+    '  accessKey: ' + 'c'.repeat(64),
+    '',
+  ].join('\n'));
+
+  // Exactly what the scaffold writes: placeholders everywhere.
+  const targetPath = makeWorkspace('nouveau', [
+    'language: en',
+    'llm:',
+    '  provider: openai-compatible',
+    '  engine: generic',
+    '  baseUrl: https://mon-provider.example.com/v1',
+    '  model: YOUR_MODEL_NAME',
+    '  apiKey: YOUR_LLM_API_KEY',
+    'mcp:',
+    '  # accessKey: your-secret-key',
+    '',
+  ].join('\n'));
+
+  mkdirSync(join(agentsData, 'cme', 'acpi', 'cme'), { recursive: true });
+  writeFileSync(join(agentsData, 'cme', 'acpi', 'cme', 'app_data.json'), '{"pat":"x"}', 'utf8');
+
+  const previousDir = process.env.WIKI_WORKSPACES_DIR;
+  const previousData = process.env.AGENTS_DATA_DIR;
+  process.env.WIKI_WORKSPACES_DIR = registryRoot;
+  process.env.AGENTS_DATA_DIR = agentsData;
+  try {
+    const { inherited } = await finalizeCreatedWorkspace('nouveau', { inheritFrom: 'acpi' });
+    const parsed = YAML.parse(readFileSync(join(targetPath, '.wikirc.yaml'), 'utf8'));
+
+    assert.equal(parsed.llm.baseUrl, 'https://itsdonna.events/v1');
+    assert.equal(parsed.llm.model, 'deepseek-v4-pro');
+    assert.equal(parsed.llm.apiKey, 'sk-real-gateway-key');
+    assert.equal(parsed.llm.provider, 'ai-gateway');
+    // The workspace keeps ITS own MCP credential, written just before.
+    assert.equal(parsed.mcp.accessKey, token);
+    assert.ok(inherited.includes('llm.baseUrl'));
+    assert.ok(inherited.includes('cme.app_data.json'));
+    assert.equal(
+      readFileSync(join(agentsData, 'cme', 'nouveau', 'cme', 'app_data.json'), 'utf8'),
+      '{"pat":"x"}',
+    );
+  } finally {
+    if (previousDir === undefined) delete process.env.WIKI_WORKSPACES_DIR;
+    else process.env.WIKI_WORKSPACES_DIR = previousDir;
+    if (previousData === undefined) delete process.env.AGENTS_DATA_DIR;
+    else process.env.AGENTS_DATA_DIR = previousData;
+  }
+});
+
+test('finalizeCreatedWorkspace without a source keeps scaffold defaults', async () => {
+  const root = mkdtempSync(join(tmpdir(), 'wikirc-noinherit-'));
+  const registryRoot = join(root, 'registry');
+  const registryPath = join(registryRoot, 'solo');
+  const workspacePath = join(root, 'solo');
+  const token = 'd'.repeat(64);
+  mkdirSync(registryPath, { recursive: true });
+  mkdirSync(workspacePath, { recursive: true });
+  writeFileSync(join(registryPath, '.env'), [
+    'WORKSPACE_NAME=solo',
+    `WIKI_WORKSPACE_PATH=${workspacePath}`,
+    `WIKI_MCP_AUTH_TOKEN=${token}`,
+    '',
+  ].join('\n'), 'utf8');
+  writeFileSync(join(workspacePath, '.wikirc.yaml'), [
+    'language: en',
+    'llm:',
+    '  baseUrl: https://mon-provider.example.com/v1',
+    'mcp:',
+    '  # accessKey: your-secret-key',
+    '',
+  ].join('\n'), 'utf8');
+
+  const previousDir = process.env.WIKI_WORKSPACES_DIR;
+  process.env.WIKI_WORKSPACES_DIR = registryRoot;
+  try {
+    const { inherited } = await finalizeCreatedWorkspace('solo');
+    const parsed = YAML.parse(readFileSync(join(workspacePath, '.wikirc.yaml'), 'utf8'));
+
+    assert.deepEqual(inherited, []);
+    assert.equal(parsed.llm.baseUrl, 'https://mon-provider.example.com/v1');
+    assert.equal(parsed.mcp.accessKey, token);
+  } finally {
+    if (previousDir === undefined) delete process.env.WIKI_WORKSPACES_DIR;
+    else process.env.WIKI_WORKSPACES_DIR = previousDir;
+  }
+});

package/src/core/workflow.js

@@ -1,8 +1,17 @@
+/**
+ * @statuses-vocabulary
+ *
+ * DISPLAY normalization for the execution graph, with `added_during_run`,
+ * which exists only as a rendering hint.
+ *
+ * Declared here rather than in a central exception list so the waiver
+ * travels with the code it excuses (see orchestrator/taskStatuses.test.js).
+ */
 import { aggregateActivity } from '../activity/activityAggregator.js';
 import { calculateWeightedProgress } from '../activity/progressCalculator.js';
 import { aggregateGraph } from '../graph/graphAggregator.js';
+import { isTerminal } from '../orchestrator/taskStatuses.js';
 
-const TERMINAL_STATUSES = new Set(['done', 'failed', 'cancelled', 'canceled', 'error', 'complete', 'completed', 'success']);
 const RUNNING_STATUSES = new Set(['running', 'starting', 'queued', 'waiting', 'pending_approval']);
 
 // Canonical workflow projection for 0.9.6.
@@ -278,7 +287,7 @@ function isActiveStatus(status) {
 }
 
 function isTerminalStatus(status) {
-  return TERMINAL_STATUSES.has(normalizeStatus(status));
+  return isTerminal(status);
 }
 
 function findCurrentNode(nodes) {

package/src/core/workspaceInherit.js

@@ -0,0 +1,149 @@
+import { copyFile, mkdir } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+
+/**
+ * Config a freshly created workspace inherits from an existing one.
+ *
+ * A new workspace was scaffolded with placeholder values only
+ * (`YOUR_MODEL_NAME`, `https://mon-provider.example.com/v1`…), so the operator
+ * had to redo the whole LLM setup by hand — reachable endpoint, gateway key,
+ * model name, vector settings — every single time, for values they had already
+ * proven working next door. `/new` now carries them over.
+ *
+ * Two rules make this safe rather than merely convenient:
+ *
+ *   - Only ABSENT or PLACEHOLDER target values are filled. Anything the
+ *     scaffold or the operator already set for real is left alone, so this can
+ *     never overwrite a deliberate choice.
+ *   - `mcp.accessKey` is never inherited. It is the workspace's own credential
+ *     and `initializeWorkspaceWikirc` has already written the right one.
+ */
+
+// Kept identical to SetupWizard.tsx on purpose — the wizard applies the same
+// "a scaffolded value is not an answer" rule. `workspaceInherit.test.js`
+// asserts the two literals stay in sync.
+export const PLACEHOLDER_VALUE_RE = /YOUR_|<your|example\.com|infinity\.local/i;
+
+const INHERITED_LLM_KEYS = ['baseUrl', 'model', 'apiKey', 'temperature', 'timeoutMs'];
+
+// `provider` and `engine` describe HOW the endpoint in `baseUrl` behaves, so
+// they are bound to it rather than inherited on their own merit.
+//
+// The scaffold ships `provider: openai-compatible` / `engine: generic` as
+// defaults, and those are real values — not placeholders the fill rule would
+// replace. Inheriting a gateway's `baseUrl` while leaving them behind produced
+// a config claiming a direct openai-compatible server against an AI gateway:
+// exactly the conflation the provider/engine split was introduced to end.
+const ENDPOINT_BOUND_KEYS = ['provider', 'engine'];
+
+// `retrieval.vector` stays independent from `llm` but inherits provider/engine/
+// baseUrl/apiKey when absent, so only keys the source states EXPLICITLY are
+// worth carrying: copying an inherited value would freeze it and break the
+// link the source deliberately left open.
+const INHERITED_VECTOR_KEYS = [
+  'enabled',
+  'provider',
+  'engine',
+  'baseUrl',
+  'apiKey',
+  'embeddingModel',
+  'rerankerModel',
+];
+
+/** A value the operator actually chose, as opposed to scaffold filler. */
+export function isRealValue(value) {
+  if (value === null || value === undefined) return false;
+  if (typeof value === 'boolean' || typeof value === 'number') return true;
+  if (typeof value !== 'string') return false;
+  const text = value.trim();
+  return text.length > 0 && !PLACEHOLDER_VALUE_RE.test(text);
+}
+
+function inheritSection(sourceSection, targetSection, keys, prefix, patch, inherited) {
+  for (const key of keys) {
+    const from = sourceSection?.[key];
+    if (!isRealValue(from)) continue;
+    // Present AND real on the target: a deliberate value, never overwritten.
+    if (isRealValue(targetSection?.[key])) continue;
+    patch[key] = from;
+    inherited.push(`${prefix}.${key}`);
+  }
+}
+
+/**
+ * @param sourceConfig parsed `.wikirc.yaml` of the workspace to copy from
+ * @param targetConfig parsed `.wikirc.yaml` of the freshly created workspace
+ * @returns `{ patch, inherited }` — `patch` is shaped for `patchWikircProfile`
+ *   and is `{}` when there is nothing to carry over.
+ */
+export function buildInheritedWikircPatch(sourceConfig, targetConfig) {
+  const inherited = [];
+  const llm = {};
+  const vector = {};
+
+  inheritSection(sourceConfig?.llm, targetConfig?.llm, INHERITED_LLM_KEYS, 'llm', llm, inherited);
+  // Only once the endpoint itself has been taken over.
+  if (llm.baseUrl) {
+    for (const key of ENDPOINT_BOUND_KEYS) {
+      const from = sourceConfig?.llm?.[key];
+      if (!isRealValue(from) || from === targetConfig?.llm?.[key]) continue;
+      llm[key] = from;
+      inherited.push(`llm.${key}`);
+    }
+  }
+
+  inheritSection(
+    sourceConfig?.retrieval?.vector,
+    targetConfig?.retrieval?.vector,
+    INHERITED_VECTOR_KEYS,
+    'retrieval.vector',
+    vector,
+    inherited,
+  );
+
+  // The gateway key unlocks every provider behind it. If the vector endpoint
+  // ends up on a different host than the LLM one, an inherited apiKey would be
+  // sent there — the exact leak the wizard already refuses to create. Drop the
+  // inherited baseUrl rather than the key: staying on the LLM endpoint is the
+  // conservative default, and the operator can still point it elsewhere.
+  const effectiveLlmBaseUrl = llm.baseUrl ?? targetConfig?.llm?.baseUrl ?? sourceConfig?.llm?.baseUrl;
+  const effectiveVectorBaseUrl = vector.baseUrl ?? targetConfig?.retrieval?.vector?.baseUrl;
+  const hasOwnVectorKey = isRealValue(vector.apiKey ?? targetConfig?.retrieval?.vector?.apiKey);
+  if (effectiveVectorBaseUrl && effectiveVectorBaseUrl !== effectiveLlmBaseUrl && !hasOwnVectorKey) {
+    delete vector.baseUrl;
+    const index = inherited.indexOf('retrieval.vector.baseUrl');
+    if (index >= 0) inherited.splice(index, 1);
+  }
+
+  const patch = {};
+  if (Object.keys(llm).length > 0) patch.llm = llm;
+  if (Object.keys(vector).length > 0) patch.retrieval = { vector };
+  return { patch, inherited };
+}
+
+export function cmeCredentialsPath(agentsDataDir, workspaceName) {
+  return join(agentsDataDir, 'cme', workspaceName, 'cme', 'app_data.json');
+}
+
+/**
+ * Carry the Confluence credentials of an existing workspace over to a new one.
+ *
+ * `app_data.json` only — NOT `sources-manifest.yaml`. The credentials are a
+ * property of the operator's Confluence account and are identical everywhere;
+ * which spaces and pages a workspace exports is precisely what makes it a
+ * different workspace, and copying that would silently re-export someone
+ * else's scope on the first run.
+ */
+export async function copyCmeCredentials(agentsDataDir, sourceWorkspace, targetWorkspace) {
+  if (!agentsDataDir || !sourceWorkspace || !targetWorkspace) return null;
+  if (sourceWorkspace === targetWorkspace) return null;
+  const from = cmeCredentialsPath(agentsDataDir, sourceWorkspace);
+  const to = cmeCredentialsPath(agentsDataDir, targetWorkspace);
+  if (!existsSync(from)) return null;
+  // An existing target file is a real configuration; never clobber it.
+  if (existsSync(to)) return null;
+  await mkdir(join(agentsDataDir, 'cme', targetWorkspace, 'cme'), { recursive: true });
+  await copyFile(from, to);
+  return to;
+}

package/src/core/workspaceInherit.test.js

@@ -0,0 +1,181 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  PLACEHOLDER_VALUE_RE,
+  buildInheritedWikircPatch,
+  cmeCredentialsPath,
+  copyCmeCredentials,
+  isRealValue,
+} from './workspaceInherit.js';
+
+const SCAFFOLD_LLM = {
+  provider: 'openai-compatible',
+  engine: 'generic',
+  baseUrl: 'https://mon-provider.example.com/v1',
+  model: 'YOUR_MODEL_NAME',
+  apiKey: 'YOUR_LLM_API_KEY',
+};
+
+const WORKING_LLM = {
+  provider: 'ai-gateway',
+  engine: 'generic',
+  baseUrl: 'https://itsdonna.events/v1',
+  model: 'deepseek-v4-pro',
+  apiKey: 'sk-real-gateway-key',
+  temperature: 0.1,
+};
+
+test('scaffold placeholders never count as configured values', () => {
+  for (const value of Object.values(SCAFFOLD_LLM).filter((v) => typeof v === 'string')) {
+    if (value === 'openai-compatible' || value === 'generic') continue;
+    assert.equal(isRealValue(value), false, `${value} must be treated as a placeholder`);
+  }
+  assert.equal(isRealValue('https://itsdonna.events/v1'), true);
+  assert.equal(isRealValue(''), false);
+  assert.equal(isRealValue(null), false);
+  // Booleans and numbers are legitimate answers; `false` and `0` must survive.
+  assert.equal(isRealValue(false), true);
+  assert.equal(isRealValue(0), true);
+});
+
+test('the placeholder rule stays identical to the wizard', () => {
+  // The wizard applies the same "a scaffolded value is not an answer" rule. If
+  // the two drift, /new starts inheriting values the wizard would refuse.
+  const wizard = readFileSync(
+    fileURLToPath(new URL('../shell/SetupWizard.tsx', import.meta.url)),
+    'utf8',
+  );
+  const match = wizard.match(/^const PLACEHOLDER_VALUE_RE = (\/.+\/i);$/m);
+  assert.ok(match, 'SetupWizard.tsx must keep PLACEHOLDER_VALUE_RE on one line');
+  assert.equal(match[1], String(PLACEHOLDER_VALUE_RE));
+});
+
+test('a new workspace inherits the working LLM block over scaffold placeholders', () => {
+  const { patch, inherited } = buildInheritedWikircPatch(
+    { llm: WORKING_LLM },
+    { llm: SCAFFOLD_LLM },
+  );
+
+  assert.equal(patch.llm.baseUrl, 'https://itsdonna.events/v1');
+  assert.equal(patch.llm.model, 'deepseek-v4-pro');
+  assert.equal(patch.llm.apiKey, 'sk-real-gateway-key');
+  assert.equal(patch.llm.provider, 'ai-gateway');
+  assert.equal(patch.llm.temperature, 0.1);
+  assert.ok(inherited.includes('llm.baseUrl'));
+});
+
+test('provider and engine follow the endpoint they describe', () => {
+  // Keeping the scaffold's `openai-compatible` while adopting a gateway URL
+  // would describe the wrong kind of server — the conflation the
+  // provider/engine split exists to prevent.
+  const taken = buildInheritedWikircPatch({ llm: WORKING_LLM }, { llm: SCAFFOLD_LLM });
+  assert.equal(taken.patch.llm.provider, 'ai-gateway');
+  assert.ok(taken.inherited.includes('llm.provider'));
+
+  // Endpoint not taken over: provider and engine stay where they are, whatever
+  // the source says.
+  const kept = buildInheritedWikircPatch(
+    { llm: WORKING_LLM },
+    { llm: { ...SCAFFOLD_LLM, baseUrl: 'http://localhost:11434/v1' } },
+  );
+  assert.equal(kept.patch.llm?.provider, undefined);
+  assert.equal(kept.patch.llm?.engine, undefined);
+});
+
+test('a value already set on the target is never overwritten', () => {
+  const { patch } = buildInheritedWikircPatch(
+    { llm: WORKING_LLM },
+    { llm: { ...SCAFFOLD_LLM, model: 'mistral-large', baseUrl: 'http://localhost:11434/v1' } },
+  );
+
+  assert.equal(patch.llm.model, undefined, 'a deliberate model must survive');
+  assert.equal(patch.llm.baseUrl, undefined, 'a deliberate endpoint must survive');
+  assert.equal(patch.llm.apiKey, 'sk-real-gateway-key', 'the still-placeholder key is filled');
+});
+
+test('mcp.accessKey is never part of the inherited patch', () => {
+  const { patch, inherited } = buildInheritedWikircPatch(
+    { llm: WORKING_LLM, mcp: { accessKey: 'source-secret' } },
+    { llm: SCAFFOLD_LLM, mcp: { accessKey: 'target-secret' } },
+  );
+
+  assert.equal(patch.mcp, undefined);
+  assert.ok(!inherited.some((key) => key.startsWith('mcp')));
+});
+
+test('a divergent vector endpoint is not inherited without its own key', () => {
+  // Carrying baseUrl alone would send the gateway key — which unlocks every
+  // provider behind it — to a different host.
+  const { patch, inherited } = buildInheritedWikircPatch(
+    {
+      llm: WORKING_LLM,
+      retrieval: { vector: { enabled: true, baseUrl: 'http://infinity.internal:7997/v1' } },
+    },
+    { llm: SCAFFOLD_LLM, retrieval: { vector: {} } },
+  );
+
+  assert.equal(patch.retrieval?.vector?.baseUrl, undefined);
+  assert.ok(!inherited.includes('retrieval.vector.baseUrl'));
+  assert.equal(patch.retrieval.vector.enabled, true, 'the rest of the block still travels');
+});
+
+test('a divergent vector endpoint IS inherited when it carries its own key', () => {
+  const { patch } = buildInheritedWikircPatch(
+    {
+      llm: WORKING_LLM,
+      retrieval: {
+        vector: { enabled: true, baseUrl: 'http://infinity.internal:7997/v1', apiKey: 'vec-key' },
+      },
+    },
+    { llm: SCAFFOLD_LLM, retrieval: { vector: {} } },
+  );
+
+  assert.equal(patch.retrieval.vector.baseUrl, 'http://infinity.internal:7997/v1');
+  assert.equal(patch.retrieval.vector.apiKey, 'vec-key');
+});
+
+test('nothing to inherit yields an empty patch', () => {
+  const { patch, inherited } = buildInheritedWikircPatch({ llm: SCAFFOLD_LLM }, { llm: WORKING_LLM });
+  assert.deepEqual(patch, {});
+  assert.deepEqual(inherited, []);
+});
+
+test('CME credentials are copied, and the source manifest is not', async () => {
+  const root = mkdtempSync(join(tmpdir(), 'cme-inherit-'));
+  const sourceDir = join(root, 'cme', 'acpi', 'cme');
+  mkdirSync(sourceDir, { recursive: true });
+  writeFileSync(join(sourceDir, 'app_data.json'), '{"auth":{"pat":"secret"}}', 'utf8');
+  // Export scope is what makes a workspace different — it must NOT travel.
+  writeFileSync(join(root, 'cme', 'acpi', 'sources-manifest.yaml'), 'sources: []\n', 'utf8');
+
+  const copied = await copyCmeCredentials(root, 'acpi', 'nouveau');
+
+  assert.equal(copied, cmeCredentialsPath(root, 'nouveau'));
+  assert.equal(readFileSync(copied, 'utf8'), '{"auth":{"pat":"secret"}}');
+  assert.equal(existsSync(join(root, 'cme', 'nouveau', 'sources-manifest.yaml')), false);
+});
+
+test('existing CME credentials on the target are never clobbered', async () => {
+  const root = mkdtempSync(join(tmpdir(), 'cme-inherit-keep-'));
+  mkdirSync(join(root, 'cme', 'acpi', 'cme'), { recursive: true });
+  mkdirSync(join(root, 'cme', 'nouveau', 'cme'), { recursive: true });
+  writeFileSync(join(root, 'cme', 'acpi', 'cme', 'app_data.json'), '{"from":"source"}', 'utf8');
+  writeFileSync(join(root, 'cme', 'nouveau', 'cme', 'app_data.json'), '{"from":"target"}', 'utf8');
+
+  assert.equal(await copyCmeCredentials(root, 'acpi', 'nouveau'), null);
+  assert.equal(
+    readFileSync(cmeCredentialsPath(root, 'nouveau'), 'utf8'),
+    '{"from":"target"}',
+  );
+});
+
+test('copying is a no-op without a source, a target, or a source file', async () => {
+  const root = mkdtempSync(join(tmpdir(), 'cme-inherit-noop-'));
+  assert.equal(await copyCmeCredentials(root, 'absent', 'nouveau'), null);
+  assert.equal(await copyCmeCredentials(root, null, 'nouveau'), null);
+  assert.equal(await copyCmeCredentials(root, 'acpi', 'acpi'), null);
+});

package/src/graph/graphVisibilityPolicy.js

@@ -1,6 +1,6 @@
+import { isFailed, isCancelled } from '../orchestrator/taskStatuses.js';
 const ALWAYS_VISIBLE = new Set(['run', 'task_group', 'barrier', 'approval']);
 const ACTIVE = new Set(['running', 'queued', 'pending_approval', 'waiting_approval']);
-const ERROR = new Set(['failed', 'error', 'cancelled']);
 
 export function applyGraphVisibility(graph, { maxNodes = 18 } = {}) {
   const nodes = graph.nodes ?? [];
@@ -35,6 +35,6 @@ function mustShow(node) {
   const status = String(node.status ?? '').toLowerCase();
   return ALWAYS_VISIBLE.has(node.type)
     || ACTIVE.has(status)
-    || ERROR.has(status)
+    || isFailed(status) || isCancelled(status)
     || node.type === 'plan_expansion';
 }

package/src/orchestrator/agentRegistry.js

@@ -4,6 +4,56 @@ import { assertContract } from '../contracts/schemas.js';
 
 const AVAILABLE = 'available';
 const UNAVAILABLE = 'unavailable';
+/**
+ * Santé d'un agent restauré depuis le journal, tant qu'aucun `agent_describe`
+ * n'a réussi dans le processus courant.
+ *
+ * Ni `available` ni `unavailable` : on ne SAIT pas. Le distinguer de
+ * `unavailable` a une conséquence pratique — un agent inconnu redevient
+ * disponible en silence dès le premier scan réussi, là où un agent déclaré
+ * indisponible mériterait d'être signalé comme tel à l'utilisateur.
+ */
+const UNKNOWN = 'unknown';
+
+/**
+ * Un agent persisté n'est pas un agent joignable.
+ *
+ * Au redémarrage, `hydrateSession` rejoue le journal d'événements et
+ * reconstruit les agents avec la santé qu'ils avaient AU MOMENT où l'événement
+ * a été écrit. `cme-main` réapparaissait donc `available` alors que son
+ * endpoint n'existe plus, était retenu comme fournisseur, et la tâche partait
+ * vers un agent absent — la panne observée le 2026-08-04.
+ *
+ * La persistance dit ce qui a existé, pas ce qui répond maintenant. Seul un
+ * `agent_describe` réussi dans ce processus autorise à parler de disponibilité.
+ */
+export function markPersistedAgentsStale(session) {
+  if (!session || typeof session !== 'object') return [];
+  const stale = (agent) => ({
+    ...agent,
+    health: UNKNOWN,
+    stale: true,
+    // La santé d'origine est conservée : elle raconte ce qu'on savait avant
+    // l'arrêt, ce qui aide à lire un journal, sans jamais servir au routage.
+    healthBeforeRestart: agent?.health ?? null,
+  });
+  /*
+   TOUTES les représentations restaurées, `agentRegistrySnapshot` compris.
+
+   J'avais d'abord épargné le snapshot, au motif qu'il pouvait porter un scan
+   vivant. C'était une inversion : à l'hydratation, aucun scan n'a encore eu
+   lieu — l'ordre est hydrate → invalidate → discover, et rien ne s'exécute
+   entre les deux premiers. Le snapshot vient donc de la même projection
+   persistée que `session.agents`. L'épargner laissait `cme-main` routable avec
+   son endpoint éteint, ce que la validation à chaud a montré.
+
+   Le seul scan qui compte est celui qui suivra : `discover()` réécrit le
+   snapshot en entier à partir des `agent_describe` réussis.
+  */
+  session.agents = (session.agents ?? []).map(stale);
+  session.agentRegistrySnapshot = (session.agentRegistrySnapshot ?? []).map(stale);
+  return session.agentRegistrySnapshot;
+}
 
 export function createAgentRegistry({
   callTool = callMcpTool,

package/src/orchestrator/agentRegistry.test.js

@@ -1,6 +1,7 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
-import { createAgentRegistry } from './agentRegistry.js';
+import { createAgentRegistry, markPersistedAgentsStale } from './agentRegistry.js';
+import { createCapabilityRegistry } from './capabilityRegistry.js';
 
 function description({ agentInstanceId = 'production-main', health = 'available', contractVersion = '1' } = {}) {
   return {
@@ -205,3 +206,77 @@ test('discovery sends no workspace argument when no workspace is active', async
 
   assert.deepEqual(seen, [{}]);
 });
+
+/*
+ Cas observé le 2026-08-04 : après redémarrage du runtime, `cme-main` était
+ toujours présenté `available` alors que son endpoint n'existait plus. La
+ relecture du journal restitue la santé qu'un agent avait AU MOMENT où
+ l'événement a été écrit — la persistance dit ce qui a existé, pas ce qui
+ répond maintenant.
+*/
+test('un agent restauré depuis le journal n’est pas déclaré disponible', () => {
+  const session = {
+    agents: [
+      { agentInstanceId: 'cme-main', serverName: 'cme', health: 'available', description: { contractVersion: '1', capabilities: [{ id: 'external-source.export', version: '1' }] } },
+      { agentInstanceId: 'production-main', serverName: 'production', health: 'available', description: { contractVersion: '1', capabilities: [{ id: 'knowledge.update', version: '1' }] } },
+    ],
+  };
+
+  markPersistedAgentsStale(session);
+
+  for (const agent of session.agents) {
+    assert.equal(agent.health, 'unknown');
+    assert.equal(agent.stale, true);
+    // Ce qu'on savait avant l'arrêt reste lisible, sans jamais servir au routage.
+    assert.equal(agent.healthBeforeRestart, 'available');
+  }
+  // Et surtout : plus aucun fournisseur sélectionnable tant que le scan n'a pas
+  // confirmé. C'est la seule chose qui empêche une tâche de partir vers un
+  // agent absent.
+  const registry = createCapabilityRegistry({ agents: session.agents });
+  assert.deepEqual(registry.providersFor('external-source.export'), []);
+  assert.deepEqual(registry.providersFor('knowledge.update'), []);
+});
+
+test('markPersistedAgentsStale invalide aussi l’instantané routable', () => {
+  /*
+   J'avais d'abord épargné `agentRegistrySnapshot`, au motif qu'il pouvait
+   porter un scan vivant. Inversion : à l'hydratation aucun scan n'a eu lieu,
+   l'ordre étant hydrate → invalidate → discover. L'épargner laissait
+   `cme-main` routable avec son endpoint éteint — constaté à chaud.
+  */
+  const session = {
+    agents: [{ agentInstanceId: 'cme-main', health: 'available' }],
+    agentRegistrySnapshot: [{ agentInstanceId: 'cme-main', health: 'available' }],
+  };
+
+  markPersistedAgentsStale(session);
+
+  assert.equal(session.agents[0].health, 'unknown');
+  assert.equal(session.agentRegistrySnapshot[0].health, 'unknown');
+});
+
+test('un agent redevient sélectionnable après un agent_describe réussi', async () => {
+  const session = {
+    workspace: 'juno',
+    agentEvents: [],
+    agents: [{ agentInstanceId: 'production-main', serverName: 'production', health: 'available', description: { contractVersion: '1', capabilities: [{ id: 'knowledge.update', version: '1' }] } }],
+    mcp: {
+      production: { status: 'connected', tools: [{ name: 'agent_describe' }] },
+    },
+  };
+  markPersistedAgentsStale(session);
+  assert.deepEqual(createCapabilityRegistry({ agents: session.agents }).providersFor('knowledge.update'), []);
+
+  const registry = createAgentRegistry({
+    callTool: async () => ({ content: [{ type: 'text', text: JSON.stringify(description()) }] }),
+  });
+  await registry.discover(session);
+
+  // La reconnexion suffit : aucune intervention, aucun redémarrage.
+  assert.equal(session.agentRegistrySnapshot[0].health, 'available');
+  assert.equal(
+    createCapabilityRegistry({ agents: session.agentRegistrySnapshot }).providersFor('knowledge.update').length,
+    1,
+  );
+});