@dotdrelle/wiki-manager 0.15.41 → 0.15.42

package/src/core/wikiWorkspace.test.js

@@ -105,3 +105,33 @@ test('container refresh pulls and renews only services that are already running'
   assert.match(script, /refresh_running_services 'No running external agent containers to refresh' 'Refreshed running agents: %s' _agents_dc/);
   assert.match(script, /refresh_running_services "No running workspace containers to refresh: \$workspace" "Refreshed running workspace containers: \$workspace \(%s\)" compose_for_workspace "\$workspace"/);
 });
+
+// `${arr[@]}` on an empty array is an unbound-variable error under `set -u` in
+// bash <= 4.3, and macOS still ships /bin/bash 3.2. `parse_global_options`
+// tripped on it, so `wiki-workspace` with no global option died before reaching
+// any subcommand.
+//
+// The execution check below cannot catch a regression on a CI running bash 5,
+// where an empty array is legal — hence the source assertion that every
+// optional array keeps the `${arr[@]+"${arr[@]}"}` guard. Both are needed.
+test('optional arrays keep the empty-array guard required by bash 3.2', async () => {
+  const script = await readFile(new URL('../../wiki-workspace', import.meta.url), 'utf8');
+
+  for (const name of ['parsed', 'PARSED_ARGS', 'log_args']) {
+    const unguarded = new RegExp(String.raw`(?<!\+)"\$\{${name}\[@\]\}"`);
+    assert.doesNotMatch(script, unguarded, `${name}[@] must use the \${name[@]+"..."} guard`);
+  }
+  assert.match(script, /set -- \$\{parsed\[@\]\+"\$\{parsed\[@\]\}"\}/);
+  assert.match(script, /set -- \$\{PARSED_ARGS\[@\]\+"\$\{PARSED_ARGS\[@\]\}"\}/);
+});
+
+test('wiki-workspace reaches its usage text with no arguments', async () => {
+  const { spawnSync } = await import('node:child_process');
+  const scriptPath = new URL('../../wiki-workspace', import.meta.url).pathname;
+
+  const result = spawnSync('bash', [scriptPath], { encoding: 'utf8' });
+
+  assert.doesNotMatch(`${result.stdout}${result.stderr}`, /unbound variable/);
+  assert.match(result.stdout, /^Usage:/);
+  assert.equal(result.status, 2);
+});

package/src/core/wikirc.test.js

@@ -163,7 +163,7 @@ test('writeVectorConfig removes commented vector placeholders it replaces', () =
   assert.equal(parsed.retrieval.vector.apiKey, 'vector-key');
 });
 
-test('finalizeCreatedWorkspace copies generated wiki token into default wikirc', () => {
+test('finalizeCreatedWorkspace copies generated wiki token into default wikirc', async () => {
   const root = mkdtempSync(join(tmpdir(), 'wikirc-workspace-token-'));
   const registryRoot = join(root, 'registry');
   const registryPath = join(registryRoot, 'demo');
@@ -190,7 +190,7 @@ test('finalizeCreatedWorkspace copies generated wiki token into default wikirc',
   const previousDir = process.env.WIKI_WORKSPACES_DIR;
   process.env.WIKI_WORKSPACES_DIR = registryRoot;
   try {
-    const workspace = finalizeCreatedWorkspace('demo');
+    const { workspace } = await finalizeCreatedWorkspace('demo');
     const parsed = YAML.parse(readFileSync(join(workspacePath, '.wikirc.yaml'), 'utf8'));
 
     assert.equal(workspace.name, 'demo');
@@ -249,3 +249,122 @@ test('containerReachableUrl only touches loopback hosts', () => {
   assert.equal(containerReachableUrl('http://gateway:4000/v1').rewritten, false);
   assert.equal(containerReachableUrl(undefined).rewritten, false);
 });
+
+// /new used to leave the operator re-entering the same endpoint, key and model
+// they had just proven working in the workspace next door.
+test('finalizeCreatedWorkspace seeds a new workspace from the one in use', async () => {
+  const root = mkdtempSync(join(tmpdir(), 'wikirc-inherit-'));
+  const registryRoot = join(root, 'registry');
+  const agentsData = join(root, '.agents-data');
+  const token = 'b'.repeat(64);
+
+  const makeWorkspace = (name, wikirc) => {
+    const registryPath = join(registryRoot, name);
+    const workspacePath = join(root, name);
+    mkdirSync(registryPath, { recursive: true });
+    mkdirSync(workspacePath, { recursive: true });
+    writeFileSync(join(registryPath, '.env'), [
+      `WORKSPACE_NAME=${name}`,
+      `WIKI_WORKSPACE_PATH=${workspacePath}`,
+      `WIKI_MCP_AUTH_TOKEN=${token}`,
+      '',
+    ].join('\n'), 'utf8');
+    writeFileSync(join(workspacePath, '.wikirc.yaml'), wikirc, 'utf8');
+    return workspacePath;
+  };
+
+  makeWorkspace('acpi', [
+    'language: en',
+    'llm:',
+    '  provider: ai-gateway',
+    '  engine: generic',
+    '  baseUrl: https://itsdonna.events/v1',
+    '  model: deepseek-v4-pro',
+    '  apiKey: sk-real-gateway-key',
+    'mcp:',
+    '  accessKey: ' + 'c'.repeat(64),
+    '',
+  ].join('\n'));
+
+  // Exactly what the scaffold writes: placeholders everywhere.
+  const targetPath = makeWorkspace('nouveau', [
+    'language: en',
+    'llm:',
+    '  provider: openai-compatible',
+    '  engine: generic',
+    '  baseUrl: https://mon-provider.example.com/v1',
+    '  model: YOUR_MODEL_NAME',
+    '  apiKey: YOUR_LLM_API_KEY',
+    'mcp:',
+    '  # accessKey: your-secret-key',
+    '',
+  ].join('\n'));
+
+  mkdirSync(join(agentsData, 'cme', 'acpi', 'cme'), { recursive: true });
+  writeFileSync(join(agentsData, 'cme', 'acpi', 'cme', 'app_data.json'), '{"pat":"x"}', 'utf8');
+
+  const previousDir = process.env.WIKI_WORKSPACES_DIR;
+  const previousData = process.env.AGENTS_DATA_DIR;
+  process.env.WIKI_WORKSPACES_DIR = registryRoot;
+  process.env.AGENTS_DATA_DIR = agentsData;
+  try {
+    const { inherited } = await finalizeCreatedWorkspace('nouveau', { inheritFrom: 'acpi' });
+    const parsed = YAML.parse(readFileSync(join(targetPath, '.wikirc.yaml'), 'utf8'));
+
+    assert.equal(parsed.llm.baseUrl, 'https://itsdonna.events/v1');
+    assert.equal(parsed.llm.model, 'deepseek-v4-pro');
+    assert.equal(parsed.llm.apiKey, 'sk-real-gateway-key');
+    assert.equal(parsed.llm.provider, 'ai-gateway');
+    // The workspace keeps ITS own MCP credential, written just before.
+    assert.equal(parsed.mcp.accessKey, token);
+    assert.ok(inherited.includes('llm.baseUrl'));
+    assert.ok(inherited.includes('cme.app_data.json'));
+    assert.equal(
+      readFileSync(join(agentsData, 'cme', 'nouveau', 'cme', 'app_data.json'), 'utf8'),
+      '{"pat":"x"}',
+    );
+  } finally {
+    if (previousDir === undefined) delete process.env.WIKI_WORKSPACES_DIR;
+    else process.env.WIKI_WORKSPACES_DIR = previousDir;
+    if (previousData === undefined) delete process.env.AGENTS_DATA_DIR;
+    else process.env.AGENTS_DATA_DIR = previousData;
+  }
+});
+
+test('finalizeCreatedWorkspace without a source keeps scaffold defaults', async () => {
+  const root = mkdtempSync(join(tmpdir(), 'wikirc-noinherit-'));
+  const registryRoot = join(root, 'registry');
+  const registryPath = join(registryRoot, 'solo');
+  const workspacePath = join(root, 'solo');
+  const token = 'd'.repeat(64);
+  mkdirSync(registryPath, { recursive: true });
+  mkdirSync(workspacePath, { recursive: true });
+  writeFileSync(join(registryPath, '.env'), [
+    'WORKSPACE_NAME=solo',
+    `WIKI_WORKSPACE_PATH=${workspacePath}`,
+    `WIKI_MCP_AUTH_TOKEN=${token}`,
+    '',
+  ].join('\n'), 'utf8');
+  writeFileSync(join(workspacePath, '.wikirc.yaml'), [
+    'language: en',
+    'llm:',
+    '  baseUrl: https://mon-provider.example.com/v1',
+    'mcp:',
+    '  # accessKey: your-secret-key',
+    '',
+  ].join('\n'), 'utf8');
+
+  const previousDir = process.env.WIKI_WORKSPACES_DIR;
+  process.env.WIKI_WORKSPACES_DIR = registryRoot;
+  try {
+    const { inherited } = await finalizeCreatedWorkspace('solo');
+    const parsed = YAML.parse(readFileSync(join(workspacePath, '.wikirc.yaml'), 'utf8'));
+
+    assert.deepEqual(inherited, []);
+    assert.equal(parsed.llm.baseUrl, 'https://mon-provider.example.com/v1');
+    assert.equal(parsed.mcp.accessKey, token);
+  } finally {
+    if (previousDir === undefined) delete process.env.WIKI_WORKSPACES_DIR;
+    else process.env.WIKI_WORKSPACES_DIR = previousDir;
+  }
+});

package/src/core/workspaceInherit.js

@@ -0,0 +1,149 @@
+import { copyFile, mkdir } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+
+/**
+ * Config a freshly created workspace inherits from an existing one.
+ *
+ * A new workspace was scaffolded with placeholder values only
+ * (`YOUR_MODEL_NAME`, `https://mon-provider.example.com/v1`…), so the operator
+ * had to redo the whole LLM setup by hand — reachable endpoint, gateway key,
+ * model name, vector settings — every single time, for values they had already
+ * proven working next door. `/new` now carries them over.
+ *
+ * Two rules make this safe rather than merely convenient:
+ *
+ *   - Only ABSENT or PLACEHOLDER target values are filled. Anything the
+ *     scaffold or the operator already set for real is left alone, so this can
+ *     never overwrite a deliberate choice.
+ *   - `mcp.accessKey` is never inherited. It is the workspace's own credential
+ *     and `initializeWorkspaceWikirc` has already written the right one.
+ */
+
+// Kept identical to SetupWizard.tsx on purpose — the wizard applies the same
+// "a scaffolded value is not an answer" rule. `workspaceInherit.test.js`
+// asserts the two literals stay in sync.
+export const PLACEHOLDER_VALUE_RE = /YOUR_|<your|example\.com|infinity\.local/i;
+
+const INHERITED_LLM_KEYS = ['baseUrl', 'model', 'apiKey', 'temperature', 'timeoutMs'];
+
+// `provider` and `engine` describe HOW the endpoint in `baseUrl` behaves, so
+// they are bound to it rather than inherited on their own merit.
+//
+// The scaffold ships `provider: openai-compatible` / `engine: generic` as
+// defaults, and those are real values — not placeholders the fill rule would
+// replace. Inheriting a gateway's `baseUrl` while leaving them behind produced
+// a config claiming a direct openai-compatible server against an AI gateway:
+// exactly the conflation the provider/engine split was introduced to end.
+const ENDPOINT_BOUND_KEYS = ['provider', 'engine'];
+
+// `retrieval.vector` stays independent from `llm` but inherits provider/engine/
+// baseUrl/apiKey when absent, so only keys the source states EXPLICITLY are
+// worth carrying: copying an inherited value would freeze it and break the
+// link the source deliberately left open.
+const INHERITED_VECTOR_KEYS = [
+  'enabled',
+  'provider',
+  'engine',
+  'baseUrl',
+  'apiKey',
+  'embeddingModel',
+  'rerankerModel',
+];
+
+/** A value the operator actually chose, as opposed to scaffold filler. */
+export function isRealValue(value) {
+  if (value === null || value === undefined) return false;
+  if (typeof value === 'boolean' || typeof value === 'number') return true;
+  if (typeof value !== 'string') return false;
+  const text = value.trim();
+  return text.length > 0 && !PLACEHOLDER_VALUE_RE.test(text);
+}
+
+function inheritSection(sourceSection, targetSection, keys, prefix, patch, inherited) {
+  for (const key of keys) {
+    const from = sourceSection?.[key];
+    if (!isRealValue(from)) continue;
+    // Present AND real on the target: a deliberate value, never overwritten.
+    if (isRealValue(targetSection?.[key])) continue;
+    patch[key] = from;
+    inherited.push(`${prefix}.${key}`);
+  }
+}
+
+/**
+ * @param sourceConfig parsed `.wikirc.yaml` of the workspace to copy from
+ * @param targetConfig parsed `.wikirc.yaml` of the freshly created workspace
+ * @returns `{ patch, inherited }` — `patch` is shaped for `patchWikircProfile`
+ *   and is `{}` when there is nothing to carry over.
+ */
+export function buildInheritedWikircPatch(sourceConfig, targetConfig) {
+  const inherited = [];
+  const llm = {};
+  const vector = {};
+
+  inheritSection(sourceConfig?.llm, targetConfig?.llm, INHERITED_LLM_KEYS, 'llm', llm, inherited);
+  // Only once the endpoint itself has been taken over.
+  if (llm.baseUrl) {
+    for (const key of ENDPOINT_BOUND_KEYS) {
+      const from = sourceConfig?.llm?.[key];
+      if (!isRealValue(from) || from === targetConfig?.llm?.[key]) continue;
+      llm[key] = from;
+      inherited.push(`llm.${key}`);
+    }
+  }
+
+  inheritSection(
+    sourceConfig?.retrieval?.vector,
+    targetConfig?.retrieval?.vector,
+    INHERITED_VECTOR_KEYS,
+    'retrieval.vector',
+    vector,
+    inherited,
+  );
+
+  // The gateway key unlocks every provider behind it. If the vector endpoint
+  // ends up on a different host than the LLM one, an inherited apiKey would be
+  // sent there — the exact leak the wizard already refuses to create. Drop the
+  // inherited baseUrl rather than the key: staying on the LLM endpoint is the
+  // conservative default, and the operator can still point it elsewhere.
+  const effectiveLlmBaseUrl = llm.baseUrl ?? targetConfig?.llm?.baseUrl ?? sourceConfig?.llm?.baseUrl;
+  const effectiveVectorBaseUrl = vector.baseUrl ?? targetConfig?.retrieval?.vector?.baseUrl;
+  const hasOwnVectorKey = isRealValue(vector.apiKey ?? targetConfig?.retrieval?.vector?.apiKey);
+  if (effectiveVectorBaseUrl && effectiveVectorBaseUrl !== effectiveLlmBaseUrl && !hasOwnVectorKey) {
+    delete vector.baseUrl;
+    const index = inherited.indexOf('retrieval.vector.baseUrl');
+    if (index >= 0) inherited.splice(index, 1);
+  }
+
+  const patch = {};
+  if (Object.keys(llm).length > 0) patch.llm = llm;
+  if (Object.keys(vector).length > 0) patch.retrieval = { vector };
+  return { patch, inherited };
+}
+
+export function cmeCredentialsPath(agentsDataDir, workspaceName) {
+  return join(agentsDataDir, 'cme', workspaceName, 'cme', 'app_data.json');
+}
+
+/**
+ * Carry the Confluence credentials of an existing workspace over to a new one.
+ *
+ * `app_data.json` only — NOT `sources-manifest.yaml`. The credentials are a
+ * property of the operator's Confluence account and are identical everywhere;
+ * which spaces and pages a workspace exports is precisely what makes it a
+ * different workspace, and copying that would silently re-export someone
+ * else's scope on the first run.
+ */
+export async function copyCmeCredentials(agentsDataDir, sourceWorkspace, targetWorkspace) {
+  if (!agentsDataDir || !sourceWorkspace || !targetWorkspace) return null;
+  if (sourceWorkspace === targetWorkspace) return null;
+  const from = cmeCredentialsPath(agentsDataDir, sourceWorkspace);
+  const to = cmeCredentialsPath(agentsDataDir, targetWorkspace);
+  if (!existsSync(from)) return null;
+  // An existing target file is a real configuration; never clobber it.
+  if (existsSync(to)) return null;
+  await mkdir(join(agentsDataDir, 'cme', targetWorkspace, 'cme'), { recursive: true });
+  await copyFile(from, to);
+  return to;
+}

package/src/core/workspaceInherit.test.js

@@ -0,0 +1,181 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  PLACEHOLDER_VALUE_RE,
+  buildInheritedWikircPatch,
+  cmeCredentialsPath,
+  copyCmeCredentials,
+  isRealValue,
+} from './workspaceInherit.js';
+
+const SCAFFOLD_LLM = {
+  provider: 'openai-compatible',
+  engine: 'generic',
+  baseUrl: 'https://mon-provider.example.com/v1',
+  model: 'YOUR_MODEL_NAME',
+  apiKey: 'YOUR_LLM_API_KEY',
+};
+
+const WORKING_LLM = {
+  provider: 'ai-gateway',
+  engine: 'generic',
+  baseUrl: 'https://itsdonna.events/v1',
+  model: 'deepseek-v4-pro',
+  apiKey: 'sk-real-gateway-key',
+  temperature: 0.1,
+};
+
+test('scaffold placeholders never count as configured values', () => {
+  for (const value of Object.values(SCAFFOLD_LLM).filter((v) => typeof v === 'string')) {
+    if (value === 'openai-compatible' || value === 'generic') continue;
+    assert.equal(isRealValue(value), false, `${value} must be treated as a placeholder`);
+  }
+  assert.equal(isRealValue('https://itsdonna.events/v1'), true);
+  assert.equal(isRealValue(''), false);
+  assert.equal(isRealValue(null), false);
+  // Booleans and numbers are legitimate answers; `false` and `0` must survive.
+  assert.equal(isRealValue(false), true);
+  assert.equal(isRealValue(0), true);
+});
+
+test('the placeholder rule stays identical to the wizard', () => {
+  // The wizard applies the same "a scaffolded value is not an answer" rule. If
+  // the two drift, /new starts inheriting values the wizard would refuse.
+  const wizard = readFileSync(
+    fileURLToPath(new URL('../shell/SetupWizard.tsx', import.meta.url)),
+    'utf8',
+  );
+  const match = wizard.match(/^const PLACEHOLDER_VALUE_RE = (\/.+\/i);$/m);
+  assert.ok(match, 'SetupWizard.tsx must keep PLACEHOLDER_VALUE_RE on one line');
+  assert.equal(match[1], String(PLACEHOLDER_VALUE_RE));
+});
+
+test('a new workspace inherits the working LLM block over scaffold placeholders', () => {
+  const { patch, inherited } = buildInheritedWikircPatch(
+    { llm: WORKING_LLM },
+    { llm: SCAFFOLD_LLM },
+  );
+
+  assert.equal(patch.llm.baseUrl, 'https://itsdonna.events/v1');
+  assert.equal(patch.llm.model, 'deepseek-v4-pro');
+  assert.equal(patch.llm.apiKey, 'sk-real-gateway-key');
+  assert.equal(patch.llm.provider, 'ai-gateway');
+  assert.equal(patch.llm.temperature, 0.1);
+  assert.ok(inherited.includes('llm.baseUrl'));
+});
+
+test('provider and engine follow the endpoint they describe', () => {
+  // Keeping the scaffold's `openai-compatible` while adopting a gateway URL
+  // would describe the wrong kind of server — the conflation the
+  // provider/engine split exists to prevent.
+  const taken = buildInheritedWikircPatch({ llm: WORKING_LLM }, { llm: SCAFFOLD_LLM });
+  assert.equal(taken.patch.llm.provider, 'ai-gateway');
+  assert.ok(taken.inherited.includes('llm.provider'));
+
+  // Endpoint not taken over: provider and engine stay where they are, whatever
+  // the source says.
+  const kept = buildInheritedWikircPatch(
+    { llm: WORKING_LLM },
+    { llm: { ...SCAFFOLD_LLM, baseUrl: 'http://localhost:11434/v1' } },
+  );
+  assert.equal(kept.patch.llm?.provider, undefined);
+  assert.equal(kept.patch.llm?.engine, undefined);
+});
+
+test('a value already set on the target is never overwritten', () => {
+  const { patch } = buildInheritedWikircPatch(
+    { llm: WORKING_LLM },
+    { llm: { ...SCAFFOLD_LLM, model: 'mistral-large', baseUrl: 'http://localhost:11434/v1' } },
+  );
+
+  assert.equal(patch.llm.model, undefined, 'a deliberate model must survive');
+  assert.equal(patch.llm.baseUrl, undefined, 'a deliberate endpoint must survive');
+  assert.equal(patch.llm.apiKey, 'sk-real-gateway-key', 'the still-placeholder key is filled');
+});
+
+test('mcp.accessKey is never part of the inherited patch', () => {
+  const { patch, inherited } = buildInheritedWikircPatch(
+    { llm: WORKING_LLM, mcp: { accessKey: 'source-secret' } },
+    { llm: SCAFFOLD_LLM, mcp: { accessKey: 'target-secret' } },
+  );
+
+  assert.equal(patch.mcp, undefined);
+  assert.ok(!inherited.some((key) => key.startsWith('mcp')));
+});
+
+test('a divergent vector endpoint is not inherited without its own key', () => {
+  // Carrying baseUrl alone would send the gateway key — which unlocks every
+  // provider behind it — to a different host.
+  const { patch, inherited } = buildInheritedWikircPatch(
+    {
+      llm: WORKING_LLM,
+      retrieval: { vector: { enabled: true, baseUrl: 'http://infinity.internal:7997/v1' } },
+    },
+    { llm: SCAFFOLD_LLM, retrieval: { vector: {} } },
+  );
+
+  assert.equal(patch.retrieval?.vector?.baseUrl, undefined);
+  assert.ok(!inherited.includes('retrieval.vector.baseUrl'));
+  assert.equal(patch.retrieval.vector.enabled, true, 'the rest of the block still travels');
+});
+
+test('a divergent vector endpoint IS inherited when it carries its own key', () => {
+  const { patch } = buildInheritedWikircPatch(
+    {
+      llm: WORKING_LLM,
+      retrieval: {
+        vector: { enabled: true, baseUrl: 'http://infinity.internal:7997/v1', apiKey: 'vec-key' },
+      },
+    },
+    { llm: SCAFFOLD_LLM, retrieval: { vector: {} } },
+  );
+
+  assert.equal(patch.retrieval.vector.baseUrl, 'http://infinity.internal:7997/v1');
+  assert.equal(patch.retrieval.vector.apiKey, 'vec-key');
+});
+
+test('nothing to inherit yields an empty patch', () => {
+  const { patch, inherited } = buildInheritedWikircPatch({ llm: SCAFFOLD_LLM }, { llm: WORKING_LLM });
+  assert.deepEqual(patch, {});
+  assert.deepEqual(inherited, []);
+});
+
+test('CME credentials are copied, and the source manifest is not', async () => {
+  const root = mkdtempSync(join(tmpdir(), 'cme-inherit-'));
+  const sourceDir = join(root, 'cme', 'acpi', 'cme');
+  mkdirSync(sourceDir, { recursive: true });
+  writeFileSync(join(sourceDir, 'app_data.json'), '{"auth":{"pat":"secret"}}', 'utf8');
+  // Export scope is what makes a workspace different — it must NOT travel.
+  writeFileSync(join(root, 'cme', 'acpi', 'sources-manifest.yaml'), 'sources: []\n', 'utf8');
+
+  const copied = await copyCmeCredentials(root, 'acpi', 'nouveau');
+
+  assert.equal(copied, cmeCredentialsPath(root, 'nouveau'));
+  assert.equal(readFileSync(copied, 'utf8'), '{"auth":{"pat":"secret"}}');
+  assert.equal(existsSync(join(root, 'cme', 'nouveau', 'sources-manifest.yaml')), false);
+});
+
+test('existing CME credentials on the target are never clobbered', async () => {
+  const root = mkdtempSync(join(tmpdir(), 'cme-inherit-keep-'));
+  mkdirSync(join(root, 'cme', 'acpi', 'cme'), { recursive: true });
+  mkdirSync(join(root, 'cme', 'nouveau', 'cme'), { recursive: true });
+  writeFileSync(join(root, 'cme', 'acpi', 'cme', 'app_data.json'), '{"from":"source"}', 'utf8');
+  writeFileSync(join(root, 'cme', 'nouveau', 'cme', 'app_data.json'), '{"from":"target"}', 'utf8');
+
+  assert.equal(await copyCmeCredentials(root, 'acpi', 'nouveau'), null);
+  assert.equal(
+    readFileSync(cmeCredentialsPath(root, 'nouveau'), 'utf8'),
+    '{"from":"target"}',
+  );
+});
+
+test('copying is a no-op without a source, a target, or a source file', async () => {
+  const root = mkdtempSync(join(tmpdir(), 'cme-inherit-noop-'));
+  assert.equal(await copyCmeCredentials(root, 'absent', 'nouveau'), null);
+  assert.equal(await copyCmeCredentials(root, null, 'nouveau'), null);
+  assert.equal(await copyCmeCredentials(root, 'acpi', 'acpi'), null);
+});

package/src/runtime/server.test.js

@@ -76,6 +76,34 @@ test('interactive turns publish a fallback assistant message exactly once', () =
   assert.equal(published[0].payload.content, 'Réponse concise.');
 });
 
+test('a turn that produces nothing still ends with an assistant message', () => {
+  // C'est la condition de fin que serve attend : la bulle « Request received ·
+  // Donna is preparing… » n'est retirée qu'à l'arrivée d'un message assistant
+  // non vide. Sans message, le point d'attente tournait indéfiniment, sans
+  // erreur nulle part et sans autre issue qu'un rechargement de page.
+  const published = [];
+  const session = { agentEvents: [], _onAgentEvent: (event) => published.push(event) };
+
+  assert.equal(ensureInteractiveAssistantMessage(session, '', { turnId: 'turn-1', workspace: 'demo' }), true);
+
+  assert.equal(published.length, 1);
+  assert.equal(published[0].type, 'assistant_message');
+  assert.match(published[0].payload.content, /No answer was produced/);
+  // Le message doit dire quoi faire, pas seulement constater.
+  assert.match(published[0].payload.content, /\/agent/);
+});
+
+test('a turn whose loop already answered does not answer twice', () => {
+  const published = [];
+  const session = {
+    agentEvents: [{ type: 'assistant_message' }],
+    _onAgentEvent: (event) => published.push(event),
+  };
+
+  assert.equal(ensureInteractiveAssistantMessage(session, '', { turnId: 'turn-1' }), false);
+  assert.equal(published.length, 0);
+});
+
 test('runtime state rebuilds interactive conversation from persisted events', () => {
   const user = {
     ...createAgentEvent('user_message', { origin: 'runtime_turn', turnId: 'turn-1', workspace: 'demo', payload: { content: 'Bonjour' } }),

package/src/shell/repl.js

@@ -345,7 +345,7 @@ function completionValuesFor(parts, inputBuffer, session) {
   // Vocabulaire de l'opérateur uniquement : `serviceChoices()` écarte les noms
   // Compose bruts que les alias désignent déjà. Ils restent tapables.
   if (command === '/start' && tokenIndex === 1) return ['all', 'agents', 'services', ...serviceChoices(), ...togglableAgents()];
-  if (command === '/stop' && tokenIndex === 1) return ['all', 'agents', 'services', ...serviceChoices(), ...togglableAgents()];
+  if (command === '/stop' && tokenIndex === 1) return ['all', 'everything', 'agents', 'services', ...serviceChoices(), ...togglableAgents()];
   if (command === '/logs' && tokenIndex === 1) return ['all', ...serviceChoices()];
   return [];
 }
@@ -583,7 +583,8 @@ export function completionDescription(value, parts) {
     return serviceDescription(value) ?? 'Start this Docker Compose service.';
   }
   if (command === '/stop') {
-    if (value === 'all') return 'Everything: workspace services AND external agents.';
+    if (value === 'all') return 'This workspace, agents included — unless another workspace still needs them.';
+    if (value === 'everything') return 'This workspace AND the shared agents, even if other workspaces are using them.';
     if (value === 'agents' || value === 'agent') return 'External agents only.';
     if (value === 'services') return 'Workspace services only.';
     if (togglableAgents().includes(value)) return `Stop only the ${value} agent, leaving the other agents running.`;
@@ -1471,7 +1472,7 @@ async function runAgentTurn(input, {
 // unitary actions only — it never plans or delegates, which is why the
 // orchestration tools are filtered out upstream. maxToolIterations caps the
 // loop.
-async function runChatToolLoop({ input, session, history, donnaMessage, onUpdate, onStep, allowedTools, openWikiPages, contextMessages = [] }) {
+async function runChatToolLoop({ input, session, history, donnaMessage, onUpdate, onStep, onTextDelta, onTextReset, allowedTools, openWikiPages, contextMessages = [] }) {
   const allowed = new Set(allowedTools.map((item) => item.function.name));
   // /chat only supplies the policy; the loop mechanic lives in runBoundedToolLoop.
   // executeCall enforces the allow-list and turns each call into a text result;
@@ -1503,6 +1504,8 @@ async function runChatToolLoop({ input, session, history, donnaMessage, onUpdate
     maxIterations: Math.min(8, Number(session?.chatAccess?.maxToolIterations) || 4),
     signal: session._abortSignal,
     onStep: (i, cap) => onStep?.(`Chat: consulting… [${i}/${cap}]`),
+    onTextDelta,
+    onTextReset,
   });
   donnaMessage.content = capped
     ? 'Je n’ai pas pu conclure dans la limite d’itérations du mode chat. Passe en /agent si besoin.'
@@ -1574,7 +1577,15 @@ async function runDirectChatTurn(input, { session, onUpdate, onStep }) {
 // implementation of chat access; it just returns the final text instead of
 // driving a live repl bubble. The caller must have seeded session.chatAccess
 // (and session.mcp) so chatAllowedTools can resolve the allow-listed tools.
-export async function runHeadlessChatTurn(session, input, { history = [], onStep, openWikiPages, openWikiPage } = {}) {
+/**
+ * @param onTextDelta fragments de la réponse au fil de la génération. Fourni
+ *   par le tour runtime, qui les publie en `assistant_delta` : le réducteur
+ *   fait grandir la dernière entrée de conversation, et les deux interfaces
+ *   affichent la réponse en train de s'écrire au lieu d'un point d'attente.
+ * @param onTextReset fragments à jeter (itération qui s'est terminée par des
+ *   appels d'outils plutôt que par une réponse).
+ */
+export async function runHeadlessChatTurn(session, input, { history = [], onStep, onTextDelta, onTextReset, openWikiPages, openWikiPage } = {}) {
   const donnaMessage = { role: 'donna', content: '' };
   const allowedTools = chatAllowedTools(session);
   // Keep the singular option as a compatibility input for older serve builds.
@@ -1590,7 +1601,7 @@ export async function runHeadlessChatTurn(session, input, { history = [], onStep
   ];
   const canUseTools = allowedTools.length > 0 && typeof session.llm?.completeWithTools === 'function';
   if (canUseTools) {
-    await runChatToolLoop({ input, session, history, donnaMessage, onStep, allowedTools, openWikiPages: selectedPages, contextMessages });
+    await runChatToolLoop({ input, session, history, donnaMessage, onStep, onTextDelta, onTextReset, allowedTools, openWikiPages: selectedPages, contextMessages });
     return donnaMessage.content;
   }
   if (typeof session.llm?.stream === 'function') {
@@ -1601,7 +1612,7 @@ export async function runHeadlessChatTurn(session, input, { history = [], onStep
       signal: session._abortSignal,
     })) {
       const clean = stripDsmlArtifacts(delta);
-      if (clean) content += clean;
+      if (clean) { content += clean; onTextDelta?.(clean); }
     }
     return stripDsmlArtifacts(content).trimEnd() || formatLlmUnavailableMessage('flux vide');
   }

package/src/shell/setupWizardModality.test.js

@@ -0,0 +1,55 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+// The shell renders in a terminal, so there is no DOM to drive and no
+// typechecker on these .tsx files (bun strips the types at run time). Source
+// assertions are the only mechanized guard available here — they are narrow on
+// purpose: each one names the exact invariant that broke.
+const tuiPath = fileURLToPath(new URL('./tui.tsx', import.meta.url));
+
+function tuiSource() {
+  return readFileSync(tuiPath, 'utf8');
+}
+
+test('the chat composer loses focus while a modal is open', () => {
+  const source = tuiSource();
+
+  // The setup wizard used to leave `chatFocused` true underneath itself, so
+  // every keystroke answering a wizard question was ALSO typed into the chat
+  // input at the bottom of the window — visible, and submitted on Enter.
+  assert.match(
+    source,
+    /chatFocused=\{!state\.activeEditor\(\) && screen\(\) === 'main'\}/,
+    'chatFocused must exclude every non-main screen, not just the file editor',
+  );
+  assert.doesNotMatch(
+    source,
+    /chatFocused=\{!state\.activeEditor\(\)\}/,
+    'the editor-only form of chatFocused lets wizard keystrokes reach the composer',
+  );
+});
+
+test('the setup wizard renders over an opaque backdrop', () => {
+  const source = tuiSource();
+  const setupBranch = source.slice(source.indexOf("{screen() === 'setup' ?"));
+
+  assert.ok(setupBranch, "the setup branch must exist in tui.tsx");
+  // Without a full-bleed backdrop the wizard floats over a live two-pane
+  // layout and the panes show through around its border.
+  assert.match(setupBranch, /position="absolute"[\s\S]{0,200}backgroundColor="#0B0D12"/);
+  assert.match(setupBranch, /width=\{dimensions\(\)\.width\}[\s\S]{0,120}height=\{dimensions\(\)\.height\}/);
+  // The backdrop must sit under the wizard dialog (zIndex 40 in SetupWizard).
+  const zIndex = setupBranch.match(/zIndex=\{(\d+)\}/);
+  assert.ok(zIndex, 'the backdrop must declare a zIndex');
+  assert.ok(Number(zIndex[1]) < 40, 'the backdrop must sit below the wizard dialog');
+});
+
+test('the global key handler ignores every screen but main', () => {
+  const source = tuiSource();
+
+  // Belt to the chatFocused braces: even if a future modal forgets the prop,
+  // the shared shortcuts (history, slash completion, Esc) stay out of it.
+  assert.match(source, /if \(screen\(\) !== 'main'\) return;/);
+});