@dotdrelle/wiki-manager 0.15.70 → 0.15.71

package/src/core/otherWorkspacesRunning.test.js

@@ -27,25 +27,25 @@ function workspaceEntry(root, name) {
 
 test('the current workspace is never counted as another one', async () => {
   const root = mkdtempSync(join(tmpdir(), 'ws-running-self-'));
-  const acpi = workspaceEntry(root, 'acpi');
+  const acme = workspaceEntry(root, 'acme');
 
-  const busy = await otherWorkspacesRunning({ workspace: 'acpi' }, [acpi]);
+  const busy = await otherWorkspacesRunning({ workspace: 'acme' }, [acme]);
 
   assert.deepEqual(busy, [], 'stopping a workspace must not be blocked by itself');
 });
 
 test('an unqueryable workspace does not hold the shared agents hostage', async () => {
   const root = mkdtempSync(join(tmpdir(), 'ws-running-unknown-'));
-  const workspaces = [workspaceEntry(root, 'acpi'), workspaceEntry(root, 'stale')];
+  const workspaces = [workspaceEntry(root, 'acme'), workspaceEntry(root, 'stale')];
 
-  const busy = await otherWorkspacesRunning({ workspace: 'acpi' }, workspaces);
+  const busy = await otherWorkspacesRunning({ workspace: 'acme' }, workspaces);
 
   assert.deepEqual(busy, []);
 });
 
 test('a single workspace, or none at all, never blocks', async () => {
-  assert.deepEqual(await otherWorkspacesRunning({ workspace: 'acpi' }, []), []);
+  assert.deepEqual(await otherWorkspacesRunning({ workspace: 'acme' }, []), []);
   assert.deepEqual(await otherWorkspacesRunning({}, []), []);
   // Entries without a name are registry noise, not workspaces.
-  assert.deepEqual(await otherWorkspacesRunning({ workspace: 'acpi' }, [{}, null]), []);
+  assert.deepEqual(await otherWorkspacesRunning({ workspace: 'acme' }, [{}, null]), []);
 });

package/src/core/runtimeLog.js

@@ -70,7 +70,9 @@ export function formatRuntimeLogPayload(payload = {}, ts = null) {
   const time = timeLabel(ts);
   const event = eventLabel(payload.event);
   const fields = ORDERED_FIELDS
-    .map((key) => formatField(FIELD_ALIASES[key], payload[key]))
+    .map((key) => (key === 'taskId'
+      ? formatField(FIELD_ALIASES[key], shortTaskLabel(payload[key]))
+      : formatField(FIELD_ALIASES[key], payload[key])))
     .filter(Boolean);
   if (payload.status != null) fields.push(formatField('status', payload.status));
   if (payload.percent != null) fields.push(formatField('percent', payload.percent));
@@ -90,11 +92,43 @@ function shortenUuids(text) {
   return String(text ?? '').replace(UUID_RE, (uuid) => `${uuid.slice(0, 8)}…`);
 }
 
+// A structured taskId is `<runId-uuid>:<slug>-<hash8>`. The UUID and the hash
+// carry no meaning for a reader; keep the human-readable slug in between so
+// `task=…` in a runtime log line names the work instead of an opaque id. A
+// plain id that is neither prefixed nor hash-suffixed (`task-build`, `a`, a
+// legacy step number) is left exactly as it is — only the UUID is collapsed.
+const TASK_HASH_SUFFIX = /-[0-9a-f]{8,}$/i;
+
+export function shortTaskLabel(value) {
+  const raw = String(value ?? '').trim();
+  if (!raw) return raw;
+  const hasColon = raw.includes(':');
+  if (!hasColon && !TASK_HASH_SUFFIX.test(raw)) return shortenUuids(raw);
+  const tail = hasColon ? raw.slice(raw.indexOf(':') + 1) : raw;
+  const pretty = tail.replace(TASK_HASH_SUFFIX, '').replace(/[-_]+/g, ' ').trim();
+  return pretty || shortenUuids(raw);
+}
+
 export function shortLogId(value, { maxLength = 40 } = {}) {
   const shortened = shortenUuids(value);
   return shortened.length > maxLength ? `${shortened.slice(0, maxLength - 1)}…` : shortened;
 }
 
+// A line emitted by formatRuntimeLogPayload for a structured event: optional
+// HH:MM:SS, then the ALL-CAPS event token eventLabel() produces from the LAST
+// dotted segment ('job.accepted' → 'ACCEPTED', 'capability.resolving' →
+// 'RESOLVING', 'agent_status' → 'AGENT_STATUS'). These are the dispatch
+// plumbing. A business line the reducer writes starts with a ▸/✓/✗/↻ glyph or
+// a capitalised word ("Plan received", "Run failed:") — never an all-caps
+// token — so this one shape separates the two without an event-name list
+// (which is what an earlier enumeration got wrong: it only ever matched the
+// two underscore-form events and missed every dotted one).
+const DISPATCH_PLUMBING_LINE = /^(?:\d{1,2}:\d{2}(?::\d{2})?\s+)?[A-Z][A-Z0-9_]{2,}(?:\s|$)/;
+
+export function isDispatchPlumbingLine(line) {
+  return DISPATCH_PLUMBING_LINE.test(String(line ?? ''));
+}
+
 export function runtimeLogMatchesFilter(line, filter = '') {
   const query = String(filter ?? '').trim();
   if (!query) return true;

package/src/core/runtimeLog.test.js

@@ -2,7 +2,7 @@ import assert from 'node:assert/strict';
 import test from 'node:test';
 
 import { createAgentEvent, dispatchAgentEvent } from './agentEvents.js';
-import { compactRuntimeLogForDisplay, formatRuntimeLogPayload, shortLogId } from './runtimeLog.js';
+import { compactRuntimeLogForDisplay, formatRuntimeLogPayload, isDispatchPlumbingLine, shortLogId } from './runtimeLog.js';
 import { emitRuntimeLog } from '../runtime/supervisor.js';
 
 const CYCLE_EVENTS = [
@@ -112,12 +112,37 @@ test('long UUIDs collapse to a short prefix so log lines stay on one line', () =
   }, '2026-07-08T14:42:18.000Z');
 
   assert.match(line, /run=7fadad27…/);
-  assert.match(line, /task=7fadad27…:taxonomy-synthesis/);
+  // The taskId's UUID prefix and hash suffix are dropped entirely: the field
+  // names the work ("taxonomy synthesis"), not an opaque id.
+  assert.match(line, /task="taxonomy synthesis"/);
   assert.match(line, /attempt=attempt-7fadad27…/);
   assert.match(line, /agentInstance=production-7fadad27…/);
   assert.doesNotMatch(line, /7fadad27-0be6-4d08-96e5-664fe7ee841e/);
 });
 
+test('isDispatchPlumbingLine recognises every formatted event token, dotted ones included', () => {
+  // eventLabel() keeps only the last dotted segment, so these are the tokens
+  // that actually reach the panel — an event-name enumeration missed them.
+  for (const event of ['job.accepted', 'agent.selected', 'capability.resolving', 'runtime.accepted', 'agent_status', 'agent_execute', 'task.result_returned']) {
+    const line = formatRuntimeLogPayload({ event, runId: 'r1', taskId: 't1' }, '2026-07-08T14:42:18.000Z');
+    assert.equal(isDispatchPlumbingLine(line), true, `expected plumbing: ${line}`);
+  }
+});
+
+test('isDispatchPlumbingLine leaves the business flow lines for the Runtime tab', () => {
+  for (const line of [
+    '14:42:18 ▸ Polish proposition — started  (knowledge.polish  → agent-production)',
+    '14:42:19 ✓ Polish proposition — done (1 output)',
+    '14:42:19 ✗ Ingest DSI — failed: dependency_failed',
+    '14:42:20 ↻ Build overview — retry 2/3 (rate_limit)',
+    '14:42:21 Run failed: No agent provides capability workspace.restore.',
+    '14:42:22 Plan validated for run r1',
+    '14:42:23 Control message: où en est le build ?',
+  ]) {
+    assert.equal(isDispatchPlumbingLine(line), false, `expected business flow: ${line}`);
+  }
+});
+
 test('shortLogId caps an over-long task slug while shortening embedded UUIDs', () => {
   const long = `${'x'.repeat(48)}-deadbeef`;
   assert.match(shortLogId(long), /…$/);

package/src/core/skillInvocation.test.js

@@ -18,7 +18,7 @@ test('matchSkillInvocation resolves only a real workspace skill', () => {
 
 test('parseSkillArguments preserves one free-form argument and parses quoted multi params', () => {
   assert.deepEqual(parseSkillArguments({ params: ['files'] }, 'document A.md document B.md'), { files: 'document A.md document B.md' });
-  assert.deepEqual(parseSkillArguments({ params: ['deliverable', 'polish'] }, '"architecture-juno" "améliorer la sécurité réseau"'), { deliverable: 'architecture-juno', polish: 'améliorer la sécurité réseau' });
+  assert.deepEqual(parseSkillArguments({ params: ['deliverable', 'polish'] }, '"architecture-demo" "improve the network security"'), { deliverable: 'architecture-demo', polish: 'improve the network security' });
 });
 
 test('legacy placeholders remain supported and are reported', () => {

package/src/core/wikiSetup.js

@@ -115,6 +115,31 @@ export async function startAgents(options = {}) {
       profiles: composeContext.profiles,
     };
   } catch (err) {
+    // One optional agent failing to start (today: the agentic gateway, whose
+    // image is not pulled yet) makes `docker compose up` exit non-zero — but
+    // the base stack usually DID come up. Aborting here turned `/start all`
+    // into "gateway image missing ⇒ workspace never starts", which is the
+    // optional tail wagging the whole dog. If the base agents are up, degrade
+    // loudly instead of failing: the caller continues, and the absent agent
+    // announces itself through its own check (/status, preflight, discovery).
+    const verification = await verifyAgentsStarted({
+      context: composeContext,
+      agentsCheck: options.agentsCheck,
+    }).catch(() => null);
+    if (verification?.ok) {
+      return {
+        output: [
+          (options.services ?? []).length > 0
+            ? 'A requested agent failed to start — the rest of the stack is up.'
+            : 'The agents stack started degraded — one optional agent failed (see /status).',
+          err instanceof Error ? (err.message ?? String(err)) : String(err),
+        ].filter(Boolean).join('\n').trim(),
+        missingImages: [],
+        profiles: composeContext.profiles,
+        degraded: true,
+        degradedError: wrapDockerError(err),
+      };
+    }
     throw wrapDockerError(err);
   }
 }

package/src/core/wikiSetup.test.js

@@ -85,3 +85,38 @@ test('the manager .env values override stale blank process values for agents up'
   }));
   assert.equal(childEnv.GOOGLE_OAUTH_CLIENT_SECRET, 'fresh-secret');
 });
+
+test('an optional agent that refuses to start degrades instead of failing /start all', async () => {
+  // The gateway image not being pulled yet makes `docker compose up` exit
+  // non-zero while the base stack still comes up. Aborting there made
+  // `/start all` stop before the workspace services — the optional tail
+  // wagging the whole dog. With the base agents verified up, the start
+  // returns a degraded result the caller can continue from.
+  const result = await startAgents(startOptions({
+    exec: async () => {
+      const err = new Error('pull access denied for dotdrelle/wiki-agentic-gateway:latest');
+      err.code = 1;
+      throw err;
+    },
+    agentsCheck: async () => null,
+  }));
+
+  assert.equal(result.degraded, true);
+  assert.match(result.output, /started degraded/);
+  assert.match(result.output, /wiki-agentic-gateway/);
+  assert.deepEqual(result.profiles, ['connectors']);
+});
+
+test('a docker failure that leaves the base agents down still fails the start', async () => {
+  await assert.rejects(
+    startAgents(startOptions({
+      exec: async () => {
+        const err = new Error('Cannot connect to the Docker daemon');
+        err.code = 1;
+        throw err;
+      },
+      agentsCheck: async () => ({ kind: 'agents', context: { downServices: ['cme', 'documents'] } }),
+    })),
+    /Docker daemon is not running/,
+  );
+});

package/src/core/wikirc.test.js

@@ -273,7 +273,7 @@ test('finalizeCreatedWorkspace seeds a new workspace from the one in use', async
     return workspacePath;
   };
 
-  makeWorkspace('acpi', [
+  makeWorkspace('acme', [
     'language: en',
     'llm:',
     '  provider: ai-gateway',
@@ -287,7 +287,7 @@ test('finalizeCreatedWorkspace seeds a new workspace from the one in use', async
   ].join('\n'));
 
   // Exactly what the scaffold writes: placeholders everywhere.
-  const targetPath = makeWorkspace('nouveau', [
+  const targetPath = makeWorkspace('fresh', [
     'language: en',
     'llm:',
     '  provider: openai-compatible',
@@ -300,15 +300,15 @@ test('finalizeCreatedWorkspace seeds a new workspace from the one in use', async
     '',
   ].join('\n'));
 
-  mkdirSync(join(agentsData, 'cme', 'acpi', 'cme'), { recursive: true });
-  writeFileSync(join(agentsData, 'cme', 'acpi', 'cme', 'app_data.json'), '{"pat":"x"}', 'utf8');
+  mkdirSync(join(agentsData, 'cme', 'acme', 'cme'), { recursive: true });
+  writeFileSync(join(agentsData, 'cme', 'acme', 'cme', 'app_data.json'), '{"pat":"x"}', 'utf8');
 
   const previousDir = process.env.WIKI_WORKSPACES_DIR;
   const previousData = process.env.AGENTS_DATA_DIR;
   process.env.WIKI_WORKSPACES_DIR = registryRoot;
   process.env.AGENTS_DATA_DIR = agentsData;
   try {
-    const { inherited } = await finalizeCreatedWorkspace('nouveau', { inheritFrom: 'acpi' });
+    const { inherited } = await finalizeCreatedWorkspace('fresh', { inheritFrom: 'acme' });
     const parsed = YAML.parse(readFileSync(join(targetPath, '.wikirc.yaml'), 'utf8'));
 
     assert.equal(parsed.llm.baseUrl, 'https://itsdonna.events/v1');
@@ -320,7 +320,7 @@ test('finalizeCreatedWorkspace seeds a new workspace from the one in use', async
     assert.ok(inherited.includes('llm.baseUrl'));
     assert.ok(inherited.includes('cme.app_data.json'));
     assert.equal(
-      readFileSync(join(agentsData, 'cme', 'nouveau', 'cme', 'app_data.json'), 'utf8'),
+      readFileSync(join(agentsData, 'cme', 'fresh', 'cme', 'app_data.json'), 'utf8'),
       '{"pat":"x"}',
     );
   } finally {

package/src/core/workspaceInherit.test.js

@@ -146,36 +146,36 @@ test('nothing to inherit yields an empty patch', () => {
 
 test('CME credentials are copied, and the source manifest is not', async () => {
   const root = mkdtempSync(join(tmpdir(), 'cme-inherit-'));
-  const sourceDir = join(root, 'cme', 'acpi', 'cme');
+  const sourceDir = join(root, 'cme', 'acme', 'cme');
   mkdirSync(sourceDir, { recursive: true });
   writeFileSync(join(sourceDir, 'app_data.json'), '{"auth":{"pat":"secret"}}', 'utf8');
   // Export scope is what makes a workspace different — it must NOT travel.
-  writeFileSync(join(root, 'cme', 'acpi', 'sources-manifest.yaml'), 'sources: []\n', 'utf8');
+  writeFileSync(join(root, 'cme', 'acme', 'sources-manifest.yaml'), 'sources: []\n', 'utf8');
 
-  const copied = await copyCmeCredentials(root, 'acpi', 'nouveau');
+  const copied = await copyCmeCredentials(root, 'acme', 'fresh');
 
-  assert.equal(copied, cmeCredentialsPath(root, 'nouveau'));
+  assert.equal(copied, cmeCredentialsPath(root, 'fresh'));
   assert.equal(readFileSync(copied, 'utf8'), '{"auth":{"pat":"secret"}}');
-  assert.equal(existsSync(join(root, 'cme', 'nouveau', 'sources-manifest.yaml')), false);
+  assert.equal(existsSync(join(root, 'cme', 'fresh', 'sources-manifest.yaml')), false);
 });
 
 test('existing CME credentials on the target are never clobbered', async () => {
   const root = mkdtempSync(join(tmpdir(), 'cme-inherit-keep-'));
-  mkdirSync(join(root, 'cme', 'acpi', 'cme'), { recursive: true });
-  mkdirSync(join(root, 'cme', 'nouveau', 'cme'), { recursive: true });
-  writeFileSync(join(root, 'cme', 'acpi', 'cme', 'app_data.json'), '{"from":"source"}', 'utf8');
-  writeFileSync(join(root, 'cme', 'nouveau', 'cme', 'app_data.json'), '{"from":"target"}', 'utf8');
+  mkdirSync(join(root, 'cme', 'acme', 'cme'), { recursive: true });
+  mkdirSync(join(root, 'cme', 'fresh', 'cme'), { recursive: true });
+  writeFileSync(join(root, 'cme', 'acme', 'cme', 'app_data.json'), '{"from":"source"}', 'utf8');
+  writeFileSync(join(root, 'cme', 'fresh', 'cme', 'app_data.json'), '{"from":"target"}', 'utf8');
 
-  assert.equal(await copyCmeCredentials(root, 'acpi', 'nouveau'), null);
+  assert.equal(await copyCmeCredentials(root, 'acme', 'fresh'), null);
   assert.equal(
-    readFileSync(cmeCredentialsPath(root, 'nouveau'), 'utf8'),
+    readFileSync(cmeCredentialsPath(root, 'fresh'), 'utf8'),
     '{"from":"target"}',
   );
 });
 
 test('copying is a no-op without a source, a target, or a source file', async () => {
   const root = mkdtempSync(join(tmpdir(), 'cme-inherit-noop-'));
-  assert.equal(await copyCmeCredentials(root, 'absent', 'nouveau'), null);
-  assert.equal(await copyCmeCredentials(root, null, 'nouveau'), null);
-  assert.equal(await copyCmeCredentials(root, 'acpi', 'acpi'), null);
+  assert.equal(await copyCmeCredentials(root, 'absent', 'fresh'), null);
+  assert.equal(await copyCmeCredentials(root, null, 'fresh'), null);
+  assert.equal(await copyCmeCredentials(root, 'acme', 'acme'), null);
 });

package/src/orchestrator/agentRegistry.test.js

@@ -144,7 +144,7 @@ test('a failed re-discovery keeps the orchestrator agent, never erases its capab
   */
   const events = [];
   const session = {
-    workspace: 'acpi',
+    workspace: 'acme',
     mcp: {
       production: { status: 'connected', tools: [{ name: 'agent_describe' }] },
     },
@@ -216,7 +216,7 @@ test('a stopped agent is reported once, not on every re-scan', async () => {
   // until it answers again.
   const events = [];
   const session = {
-    workspace: 'acpi',
+    workspace: 'acme',
     mcp: { production: { status: 'connected', tools: [{ name: 'agent_describe' }] } },
     _onAgentEvent: (event) => events.push(event),
   };
@@ -260,7 +260,7 @@ test('discovery sends the workspace only to agents whose schema declares it', as
   });
 
   await registry.discover({
-    workspace: 'acpi',
+    workspace: 'acme',
     mcp: {
       // Declares workspace: gets it, and can scope its vocabulary.
       cme: {
@@ -293,9 +293,9 @@ test('discovery sends the workspace only to agents whose schema declares it', as
     },
   });
 
-  assert.deepEqual(seen.cme, { workspace: 'acpi' });
+  assert.deepEqual(seen.cme, { workspace: 'acme' });
   assert.deepEqual(seen.production, {});
-  assert.deepEqual(seen.connectors, { workspace: 'acpi' });
+  assert.deepEqual(seen.connectors, { workspace: 'acme' });
   assert.deepEqual(seen.legacyish, {});
 });
 
@@ -374,7 +374,7 @@ test('markPersistedAgentsStale invalide aussi l’instantané routable', () => {
 
 test('un agent redevient sélectionnable après un agent_describe réussi', async () => {
   const session = {
-    workspace: 'juno',
+    workspace: 'demo',
     agentEvents: [],
     agents: [{ agentInstanceId: 'production-main', serverName: 'production', health: 'available', description: { contractVersion: '1', capabilities: [{ id: 'knowledge.update', version: '1' }] } }],
     mcp: {

package/src/orchestrator/dispatcher.js

@@ -474,36 +474,80 @@ const READ_ONLY_WIKI_TOOLS = new Set([
   'wiki_workspace_status',
 ]);
 
-// The runtime's EYES, per run: the active workspace's wiki MCP, read tools
-// only. Workspace-scoped endpoints are per-run by nature — they cannot live
-// in a static gateway file. The allow-list here is the authority: nothing
+// An arbitrary external connector's tool names cannot be enumerated ahead of
+// time the way READ_ONLY_WIKI_TOOLS can, so this stays a denylist — but a
+// word-boundary one. The old test was a raw substring match
+// (/write|send|create|update|add|remove/), which dropped safe reads whose name
+// merely contained a mutating verb (`list_recent_updates`, `get_created_at`,
+// `search_addresses`) and missed side-effecting tools that use another verb
+// (`crawl_site`, `post_message`, `run_report`, `publish_draft`). The real
+// guardrails against "hands on the workspace" are elsewhere —
+// EXCLUDED_EXTERNAL_SERVERS covers every workspace-writing agent, and a
+// per-tool `requireApproval` entry drops the whole server — this filter only
+// keeps an obviously-mutating tool of an otherwise-safe connector out of the
+// runtime's eyes.
+const EXTERNAL_MUTATING_VERB = /(?:^|[_-])(?:write|send|post|create|delete|destroy|remove|drop|modify|edit|update|patch|put|upload|publish|submit|execute|run|crawl|trigger|cancel|approve|move|rename|set|add|insert|append|archive)(?:[_-]|$)/i;
+
+function isReadOnlyExternalTool(toolName) {
+  const base = toolName.includes('__') ? toolName.slice(toolName.lastIndexOf('__') + 2) : toolName;
+  return !EXTERNAL_MUTATING_VERB.test(base);
+}
+
+// The runtime's EYES, per run: the active workspace's wiki MCP (read tools
+// only) PLUS the declared external MCP endpoints that are safe to hand over
+// (connected, no approval-gated tools, not a workspace-mutating server) —
+// typically web search (exa). The allow-list here is the authority: nothing
 // else reaches the runtime.
 export function activeProfileMcp(session) {
+  const blocks = [];
   const wiki = session?.mcp?.wiki;
-  if (!wiki?.url || wiki.status !== 'connected') return null;
-  const tools = (wiki.tools ?? [])
-    .map((tool) => String(tool.name ?? ''))
-    .filter((name) => {
-      if (!name) return false;
-      const base = name.includes('__') ? name.slice(name.lastIndexOf('__') + 2) : name;
-      return READ_ONLY_WIKI_TOOLS.has(base);
+  if (wiki?.url && wiki.status === 'connected') {
+    const tools = (wiki.tools ?? [])
+      .map((tool) => String(tool.name ?? ''))
+      .filter((name) => {
+        if (!name) return false;
+        const base = name.includes('__') ? name.slice(name.lastIndexOf('__') + 2) : name;
+        return READ_ONLY_WIKI_TOOLS.has(base);
+      });
+    if (tools.length > 0) {
+      // Same credential contract as the manager's own MCP client (mcp.js
+      // `authorization: Bearer ${endpoint.token}`): the wiki detail carries
+      // `token`, not `headers` — without it the gateway's MCP connection is
+      // rejected by the workspace MCP server ("invalid or missing bearer token")
+      // and the Deep Agent runs blind.
+      const headers = {
+        ...(wiki.headers && typeof wiki.headers === 'object' ? wiki.headers : {}),
+        ...(wiki.token ? { Authorization: `Bearer ${wiki.token}` } : {}),
+      };
+      blocks.push({
+        name: 'wiki',
+        url: String(wiki.url),
+        ...(Object.keys(headers).length > 0 ? { headers } : {}),
+        tools,
+      });
+    }
+  }
+  // External connectors ride along ONLY when the operator declared them safe
+  // for the runtime's eyes. A connector added from the serve panel lands here
+  // too — without this, exa was offered in chat but the agentic path
+  // delegated to the gateway and the Deep Agent answered it had no web tools.
+  const EXCLUDED_EXTERNAL_SERVERS = new Set(['cme', 'documents', 'connectors', 'production']);
+  for (const [name, entry] of Object.entries(session?.mcp ?? {})) {
+    if (!entry?.external || entry.status !== 'connected') continue;
+    if (EXCLUDED_EXTERNAL_SERVERS.has(name)) continue;
+    if (Array.isArray(entry.requireApproval) && entry.requireApproval.length > 0) continue;
+    const tools = (entry.tools ?? [])
+      .map((tool) => String(tool.name ?? ''))
+      .filter((toolName) => toolName && isReadOnlyExternalTool(toolName));
+    if (tools.length === 0) continue;
+    blocks.push({
+      name,
+      url: String(entry.url),
+      ...(entry.headers && typeof entry.headers === 'object' ? { headers: entry.headers } : {}),
+      tools,
     });
-  if (tools.length === 0) return null;
-  // Same credential contract as the manager's own MCP client (mcp.js
-  // `authorization: Bearer ${endpoint.token}`): the wiki detail carries
-  // `token`, not `headers` — without it the gateway's MCP connection is
-  // rejected by the workspace MCP server ("invalid or missing bearer token")
-  // and the Deep Agent runs blind.
-  const headers = {
-    ...(wiki.headers && typeof wiki.headers === 'object' ? wiki.headers : {}),
-    ...(wiki.token ? { Authorization: `Bearer ${wiki.token}` } : {}),
-  };
-  return [{
-    name: 'wiki',
-    url: String(wiki.url),
-    ...(Object.keys(headers).length > 0 ? { headers } : {}),
-    tools,
-  }];
+  }
+  return blocks.length > 0 ? blocks : null;
 }
 
 // The Deep Agent's system prompt, built per run from the same ingredients

package/src/orchestrator/dispatcher.test.js

@@ -35,6 +35,49 @@ test('activeProfileMcp forwards only the read-only wiki tools to the external ru
   );
 });
 
+test('activeProfileMcp hands the external runtime a safe connector\'s read tools by word-boundary verb', () => {
+  const session = {
+    mcp: {
+      wiki: {
+        url: 'http://wiki:3000/mcp', status: 'connected',
+        tools: [{ name: 'wiki_read_page' }],
+      },
+      exa: {
+        url: 'https://exa/mcp', status: 'connected', external: true,
+        tools: [
+          { name: 'web_search_exa' },
+          { name: 'research_paper_search' },
+          // a raw substring denylist wrongly dropped these safe reads:
+          { name: 'list_recent_updates' },
+          { name: 'get_created_items' },
+          // …and wrongly kept these, which use a verb it did not enumerate:
+          { name: 'crawl_site' },
+          { name: 'post_message' },
+          { name: 'run_report' },
+          { name: 'send_email' },
+        ],
+      },
+    },
+  };
+  const exaBlock = activeProfileMcp(session).find((block) => block.name === 'exa');
+  assert.deepEqual(
+    [...exaBlock.tools].sort(),
+    ['get_created_items', 'list_recent_updates', 'research_paper_search', 'web_search_exa'],
+  );
+});
+
+test('activeProfileMcp drops an external connector that is approval-gated or workspace-mutating', () => {
+  const session = {
+    mcp: {
+      wiki: { url: 'http://wiki:3000/mcp', status: 'connected', tools: [{ name: 'wiki_read_page' }] },
+      gated: { url: 'https://g/mcp', status: 'connected', external: true, requireApproval: ['search'], tools: [{ name: 'search' }] },
+      documents: { url: 'https://d/mcp', status: 'connected', external: true, tools: [{ name: 'get_document' }] },
+    },
+  };
+  const names = activeProfileMcp(session).map((block) => block.name);
+  assert.deepEqual(names, ['wiki']);
+});
+
 test('activeProfileMcp tolerates namespaced tool names', () => {
   const session = {
     mcp: {
@@ -243,13 +286,13 @@ test('normalizeTaskError keeps the agent reason as the message, never the fallba
   // Regression: the fallback describes only WHERE the failure was seen
   // ("agent_execute rejected task"). Letting it win discarded the one
   // actionable sentence — and left Donna to invent a cause.
-  const error = normalizeTaskError("Error: source 'acpi' not found", {
+  const error = normalizeTaskError("Error: source 'acme' not found", {
     fallbackCode: 'execution_rejected',
     fallbackMessage: 'agent_execute rejected task',
   });
 
-  assert.equal(error.code, "Error: source 'acpi' not found");
-  assert.equal(error.message, "Error: source 'acpi' not found");
+  assert.equal(error.code, "Error: source 'acme' not found");
+  assert.equal(error.message, "Error: source 'acme' not found");
 });
 
 test('normalizeTaskError falls back only when the agent reports no reason at all', () => {

package/src/orchestrator/providers/deepAgentsProvider.test.js

@@ -93,7 +93,7 @@ test('execute POSTs /runs and returns the runId', async () => {
   const provider = createDeepAgentsProvider({ endpoint: 'http://agent-runtime:8080', fetchImpl });
 
   const run = await provider.execute({
-    objective: 'analyse JUNO',
+    objective: 'analyze the demo workspace',
     operation: 'run',
     arguments: {},
     model: { baseUrl: 'http://llm:11434/v1', model: 'qwen3:14b', apiKey: 'secret' },
@@ -101,7 +101,7 @@ test('execute POSTs /runs and returns the runId', async () => {
   assert.deepEqual(run, { runId: 'run-1', status: 'running' });
   assert.equal(fetchImpl.calls[0].path, '/runs');
   const sent = JSON.parse(fetchImpl.calls[0].body);
-  assert.equal(sent.objective, 'analyse JUNO');
+  assert.equal(sent.objective, 'analyze the demo workspace');
   assert.deepEqual(sent.model, { baseUrl: 'http://llm:11434/v1', model: 'qwen3:14b', apiKey: 'secret' });
 });