@dotdrelle/wiki-manager 0.15.72 → 0.15.74

package/README.md

@@ -310,6 +310,14 @@ wiki-workspace agents up        # start cme, documents…
 wiki-workspace agents status    # check they respond
 ```
 
+One command starts the whole deployment — agent-runtime, agents and every
+configured workspace — and is safe to repeat while things are already up:
+
+```bash
+wiki-workspace start            # runtime + agents + all workspaces
+wiki-workspace start --open     # …and open the first workspace chat
+```
+
 **Step 4 — Move to `wiki-manager` or `serve`.**
 Two entry doors, your choice:
 

package/mcp.endpoints.example.json

@@ -31,7 +31,7 @@
     "servers": {
       "llm-wiki":         { "allow": ["help_list", "help_read", "help_search", "wiki_workspace_status", "wiki_list_pages", "wiki_read_page", "wiki_read_pages", "wiki_search_context", "wiki_collect_context", "wiki_read_ingested_source", "wiki_outline", "template_read", "template_write", "build_context_write", "wiki_read_deliverable"] },
       "wiki-production":  { "allow": ["production_job_status", "production_jobs_list"] },
-      "cme":              { "allow": ["cme_status", "cme_sources_list", "cme_export_status"] }
+      "cme":              { "allow": ["cme_status", "cme_sources_list", "cme_export_status", "cme_confluence_search", "cme_wiki_search"] }
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotdrelle/wiki-manager",
-  "version": "0.15.72",
+  "version": "0.15.74",
   "description": "Agentic shell and orchestration cockpit for llm-wiki workspaces.",
   "repository": {
     "type": "git",
@@ -19,7 +19,7 @@
   },
   "scripts": {
     "start": "bun ./bin/wiki-manager.js",
-    "test": "node --test src/core/skillInvocation.test.js src/core/skillCompiler.test.js src/runtime/skillRun.test.js src/runtime/controlDrain.test.js src/runtime/controlCancellation.test.js src/cli/runtimeStartup.test.js src/cli/wiki-manager.test.js src/agent/graph.test.js src/agent/skillRecursion.test.js src/contracts/schemas.test.js src/core/activity.test.js src/core/env.test.js src/core/agentsCompose.test.js src/core/profileServiceStatus.test.js src/core/workspaceProfile.test.js src/core/buildInfo.test.js src/core/agentEvents.test.js src/core/skillChainView.test.js src/core/runtimeLog.test.js src/core/runtimeEventAdapter.test.js src/activity/activityAggregator.test.js src/graph/runGraphProjector.test.js src/core/workflow.test.js src/core/planPatch.test.js src/core/agentLoop.test.js src/core/plan.test.js src/core/mcp.test.js src/core/toolLoop.test.js src/core/documentIntake.test.js src/core/dockerCompose.test.js src/core/otherWorkspacesRunning.test.js src/core/wikiSetup.test.js src/core/wikiWorkspace.test.js src/core/wikirc.test.js src/core/workspaceInherit.test.js src/core/cacert.test.js src/core/composeOverrides.test.js src/core/setEnvValue.test.js src/core/commandFailure.test.js src/core/currentArtifact.test.js src/core/googleGrants.test.js src/core/modelFetch.test.js src/core/startupCheck.test.js src/core/queueStore.test.js src/orchestrator/agentRegistry.test.js src/orchestrator/capabilityRegistry.test.js src/orchestrator/capabilityResolver.test.js src/orchestrator/planValidator.test.js src/orchestrator/planIntegrator.test.js src/orchestrator/taskStatuses.test.js src/orchestrator/scheduler.test.js src/orchestrator/attemptManager.test.js src/orchestrator/resultAggregator.test.js src/orchestrator/approvalPolicy.test.js src/orchestrator/dispatcher.test.js src/orchestrator/objectiveResolver.test.js src/orchestrator/providers/fakeRuntimeProvider.test.js src/orchestrator/providers/runtimeProviders.test.js src/orchestrator/providers/dispatcherExternalRuntime.test.js src/orchestrator/providers/deepAgentsProvider.test.js src/commands/slash.test.js src/shell/repl.test.js src/shell/setupWizardModality.test.js src/shell/setupWizardPlaceholders.test.js src/shell/setupWizardSuggestions.test.js src/shell/setupWizardDiscovery.test.js src/shell/wrapText.test.js src/runtime/lifecycle.test.js src/runtime/store.test.js src/runtime/workspaceIsolation.test.js src/runtime/controlMessages.test.js src/runtime/recoveryManager.test.js src/runtime/server.test.js src/runtime/supervisor.test.js src/runtime/delegation.test.js src/runtime/runner.test.js src/runtime/runner.e2e.test.js src/runtime/skillChain.e2e.test.js src/runtime/donna-contract.test.js src/runtime/approvals.test.js src/runtime/auth.test.js",
+    "test": "node --test src/core/skillInvocation.test.js src/core/skillCompiler.test.js src/runtime/skillRun.test.js src/runtime/controlDrain.test.js src/runtime/controlCancellation.test.js src/cli/runtimeStartup.test.js src/cli/wiki-manager.test.js src/agent/graph.test.js src/agent/skillRecursion.test.js src/contracts/schemas.test.js src/core/activity.test.js src/core/env.test.js src/core/agentsCompose.test.js src/core/profileServiceStatus.test.js src/core/workspaceProfile.test.js src/core/buildInfo.test.js src/core/agentEvents.test.js src/core/skillChainView.test.js src/core/runtimeLog.test.js src/core/runtimeEventAdapter.test.js src/activity/activityAggregator.test.js src/graph/runGraphProjector.test.js src/core/workflow.test.js src/core/planPatch.test.js src/core/agentLoop.test.js src/core/plan.test.js src/core/mcp.test.js src/core/toolLoop.test.js src/core/documentIntake.test.js src/core/dockerCompose.test.js src/core/otherWorkspacesRunning.test.js src/core/wikiSetup.test.js src/core/wikiWorkspace.test.js src/core/wikiWorkspaceStart.test.js src/core/wikirc.test.js src/core/workspaceInherit.test.js src/core/cacert.test.js src/core/composeOverrides.test.js src/core/setEnvValue.test.js src/core/commandFailure.test.js src/core/currentArtifact.test.js src/core/googleGrants.test.js src/core/modelFetch.test.js src/core/startupCheck.test.js src/core/queueStore.test.js src/orchestrator/agentRegistry.test.js src/orchestrator/capabilityRegistry.test.js src/orchestrator/capabilityResolver.test.js src/orchestrator/planValidator.test.js src/orchestrator/planIntegrator.test.js src/orchestrator/taskStatuses.test.js src/orchestrator/scheduler.test.js src/orchestrator/attemptManager.test.js src/orchestrator/resultAggregator.test.js src/orchestrator/approvalPolicy.test.js src/orchestrator/dispatcher.test.js src/orchestrator/objectiveResolver.test.js src/orchestrator/providers/fakeRuntimeProvider.test.js src/orchestrator/providers/runtimeProviders.test.js src/orchestrator/providers/dispatcherExternalRuntime.test.js src/orchestrator/providers/deepAgentsProvider.test.js src/commands/slash.test.js src/shell/repl.test.js src/shell/setupWizardModality.test.js src/shell/setupWizardPlaceholders.test.js src/shell/setupWizardSuggestions.test.js src/shell/setupWizardDiscovery.test.js src/shell/wrapText.test.js src/runtime/lifecycle.test.js src/runtime/store.test.js src/runtime/workspaceIsolation.test.js src/runtime/controlMessages.test.js src/runtime/recoveryManager.test.js src/runtime/server.test.js src/runtime/supervisor.test.js src/runtime/delegation.test.js src/runtime/runner.test.js src/runtime/runner.e2e.test.js src/runtime/skillChain.e2e.test.js src/runtime/donna-contract.test.js src/runtime/approvals.test.js src/runtime/auth.test.js",
     "check-versions": "node scripts/check-versions.js",
     "prepack": "node scripts/check-versions.js",
     "prepublishOnly": "node scripts/check-versions.js",

package/src/commands/slash.js

@@ -682,6 +682,14 @@ function runtimeProvidersSection(session) {
     // never truncates and stays scannable.
     lines.push('capabilities:');
     for (const capability of capabilities) lines.push(`    ${capability}`);
+    // Configured in agent-runtimes.json but not served by the gateway (the
+    // list above is the intersection): say so, one per line, or the operator
+    // reads a shorter list without knowing the gateway lost its /config.
+    const drift = (session.runtimeProviderDrift ?? []).find((item) => item.runtimeId === runtimeId);
+    if (drift && drift.missing.length > 0) {
+      lines.push('not served by the gateway:');
+      for (const capability of drift.missing) lines.push(`    ${capability}`);
+    }
   }
   return sectionBlock('Agentic runtime', lines);
 }

package/src/core/buildInfo.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.15.72",
-  "commit": "fccddba"
+  "version": "0.15.74",
+  "commit": "4ca493b"
 }

package/src/core/env.js

@@ -11,6 +11,13 @@ const TEMPLATE_AUTHORING_CHAT_TOOLS = [
   'wiki_outline', 'template_read', 'template_write', 'build_context_write',
   'wiki_read_deliverable',
 ];
+// Same additive rule for the packaged cme allow-list: an install scaffolded
+// before the live search tools existed keeps the three legacy reads forever,
+// and /chat can never call cme_confluence_search — the LLM is offered a
+// server with no search and loops. A hand-edited list (not a superset of the
+// legacy default) is the operator's and stays untouched.
+const LEGACY_DEFAULT_CME_CHAT_TOOLS = ['cme_status', 'cme_sources_list', 'cme_export_status'];
+const CME_SEARCH_CHAT_TOOLS = ['cme_confluence_search', 'cme_wiki_search'];
 
 export function userManagerDir() {
   return process.cwd();
@@ -148,17 +155,25 @@ export function ensureManagerScaffold({ log = () => {} } = {}) {
           const missingWikiChatTools = migrateWikiChatTools
             ? TEMPLATE_AUTHORING_CHAT_TOOLS.filter((tool) => !wikiAllow.includes(tool))
             : [];
+          const cmeAllow = current.chatAccess?.servers?.cme?.allow;
+          const migrateCmeChatTools = Array.isArray(cmeAllow)
+            && LEGACY_DEFAULT_CME_CHAT_TOOLS.every((tool) => cmeAllow.includes(tool));
+          const missingCmeChatTools = migrateCmeChatTools
+            ? CME_SEARCH_CHAT_TOOLS.filter((tool) => !cmeAllow.includes(tool))
+            : [];
           if (missing.length > 0) {
             for (const key of missing) current[key] = example[key];
           }
           for (const key of missingServers) currentServers[key] = exampleServers[key];
           wikiAllow?.push(...missingWikiChatTools);
-          if (missing.length > 0 || missingServers.length > 0 || missingWikiChatTools.length > 0) {
+          cmeAllow?.push(...missingCmeChatTools);
+          const missingChatTools = [...missingWikiChatTools, ...missingCmeChatTools];
+          if (missing.length > 0 || missingServers.length > 0 || missingChatTools.length > 0) {
             writeFileSync(endpointsFile, `${JSON.stringify(current, null, 2)}\n`);
             const changes = [
               missing.length > 0 ? `keys: ${missing.join(', ')}` : '',
               missingServers.length > 0 ? `servers: ${missingServers.join(', ')}` : '',
-              missingWikiChatTools.length > 0 ? `chat tools: ${missingWikiChatTools.join(', ')}` : '',
+              missingChatTools.length > 0 ? `chat tools: ${missingChatTools.join(', ')}` : '',
             ].filter(Boolean).join('; ');
             created.push(`mcp.endpoints.json ${changes}`);
           }

package/src/core/env.test.js

@@ -141,6 +141,37 @@ test('scaffold upgrades the packaged wiki chat allow-list with template authorin
   });
 });
 
+test('scaffold upgrades the packaged cme chat allow-list with the live search tools', () => {
+  withTempManagerDir((dir) => {
+    const endpointsFile = join(dir, 'mcp.endpoints.json');
+    const example = JSON.parse(readFileSync('mcp.endpoints.example.json', 'utf8'));
+    example.chatAccess.servers.cme.allow = ['cme_status', 'cme_sources_list', 'cme_export_status'];
+    writeFileSync(endpointsFile, JSON.stringify(example, null, 2));
+
+    const changes = ensureManagerScaffold();
+    const after = JSON.parse(readFileSync(endpointsFile, 'utf8'));
+
+    assert.ok(changes.some((item) => item.includes('cme_confluence_search')));
+    assert.deepEqual(after.chatAccess.servers.cme.allow, [
+      'cme_status', 'cme_sources_list', 'cme_export_status', 'cme_confluence_search', 'cme_wiki_search',
+    ]);
+  });
+});
+
+test('scaffold leaves a custom cme chat allow-list untouched', () => {
+  withTempManagerDir((dir) => {
+    const endpointsFile = join(dir, 'mcp.endpoints.json');
+    writeFileSync(endpointsFile, JSON.stringify({
+      mcpServers: {},
+      chatAccess: { servers: { cme: { allow: ['cme_status'] } } },
+    }, null, 2));
+
+    ensureManagerScaffold();
+    const after = JSON.parse(readFileSync(endpointsFile, 'utf8'));
+    assert.deepEqual(after.chatAccess.servers.cme.allow, ['cme_status']);
+  });
+});
+
 test('scaffold leaves a custom wiki chat allow-list untouched', () => {
   withTempManagerDir((dir) => {
     const endpointsFile = join(dir, 'mcp.endpoints.json');

package/src/core/mcp.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { managerEnvFile, managerMcpEndpointsFile, readEnvFile } from './env.js';
 
-const WIKI_MANAGER_VERSION = '0.15.72';
+const WIKI_MANAGER_VERSION = '0.15.74';
 
 function envValue(key) {
   const filePath = managerEnvFile();

package/src/core/runtimeLog.js

@@ -171,7 +171,10 @@ export function shortLogId(value, { maxLength = 40 } = {}) {
 const DISPATCH_PLUMBING_LINE = /^(?:\d{1,2}:\d{2}(?::\d{2})?\s*(?:·\s*)?)?[A-Z][A-Z0-9_]{2,}(?:\s|$)/;
 
 export function isDispatchPlumbingLine(line) {
-  return DISPATCH_PLUMBING_LINE.test(String(line ?? ''));
+  // The Shell tags every runtime line with a "runtime " prefix before it
+  // reaches the Log panel; classification must look past it, or AGENT_STATUS
+  // rows land in the Runtime tab instead of Agent status.
+  return DISPATCH_PLUMBING_LINE.test(String(line ?? '').replace(/^runtime\s+/, ''));
 }
 
 export function runtimeLogMatchesFilter(line, filter = '') {

package/src/core/runtimeLog.test.js

@@ -146,6 +146,16 @@ test('isDispatchPlumbingLine leaves the business flow lines for the Runtime tab'
   }
 });
 
+test('isDispatchPlumbingLine recognises the shell-tagged "runtime " lines for the Agent status tab', () => {
+  // The Shell prepends "runtime " to every runtime line (useSession
+  // visibleLogs): AGENT_STATUS rows must still classify as plumbing, or they
+  // end up in the Runtime tab instead of Agent status.
+  const tagged = `runtime ${formatRuntimeLogPayload({ event: 'agent_status', runId: 'r1', taskId: 't1' }, '2026-07-08T14:42:18.000Z')}`;
+  assert.equal(isDispatchPlumbingLine(tagged), true, 'a tagged AGENT_STATUS line is dispatch plumbing');
+  assert.equal(isDispatchPlumbingLine('runtime 14:42:21 Run failed: No agent provides capability workspace.restore.'), false);
+  assert.equal(isDispatchPlumbingLine('runtime 14:42:22 Plan validated for run r1'), false);
+});
+
 test('shortLogId caps an over-long task slug while shortening embedded UUIDs', () => {
   const long = `${'x'.repeat(48)}-deadbeef`;
   assert.match(shortLogId(long), /…$/);

package/src/core/skillChainView.test.js

@@ -5,7 +5,7 @@ import { chainStepLabel, projectSkillChains, renderSkillChain, selectionKindLabe
 const WIKI_SYNC = [
   {
     id: 'c0', chainId: 'chain-1', chainSequence: 0, skillName: 'wiki-sync', selectionKind: 'description_match', status: 'done',
-    input: 'Export the requested Confluence source, or all configured sources when none is specified. Check configuration first.\n\nUser parameters:\nsource: docs',
+    input: 'Export every configured Confluence source exactly as the connector is currently configured. Check configuration first.',
   },
   {
     id: 'c1', chainId: 'chain-1', chainSequence: 1, skillName: 'wiki-sync', status: 'running', runId: 'run-b',

package/src/core/skillCompiler.js

@@ -7,10 +7,11 @@ export async function compileSkillObjectives(skill, args = {}, { llmFallback = n
   const body = String(skill?.body ?? '').trim();
   if (!body) throw compileError('Skill body is empty.');
   // Splitting must happen on the body alone. Appending the parameters first
-  // makes them part of the last objective only — `/wiki-sync ESPACE` would hand
-  // `source: ESPACE` to the ingest step and leave the export step, the one that
-  // actually needs it, exporting everything. The compiler cannot know which
-  // step consumes which parameter, so every objective carries them.
+  // makes them part of the last objective only — a skill that compiles into
+  // several steps would hand its arguments to the final step and leave the
+  // earlier ones, the ones that actually consume them, without them. The
+  // compiler cannot know which step consumes which parameter, so every
+  // objective carries them.
   const deterministic = deterministicObjectives(body);
   if (!deterministic.ambiguous) {
     return withNaturalArguments(validateCompiledObjectives(deterministic.objectives), args);

package/src/core/startupCheck.js

@@ -357,13 +357,22 @@ export async function checkAgenticRuntimes({
   for (const { id, provider } of providers) {
     try {
       const description = await provider.describe();
+      const down = description.health === 'unavailable';
+      // Ask the runtime what it serves — describe() alone reflects /health,
+      // not the capability set, and a gateway that lost its config answers
+      // healthy with one default capability.
+      const capabilities = down ? [] : await provider.discoverCapabilities();
+      const missing = provider?.lastDiscovery?.missing ?? [];
       runtimes.push({
         name: id,
-        status: description.health === 'unavailable' ? 'failed' : 'connected',
-        capabilities: (description.capabilities ?? [])
+        status: down ? 'failed' : 'connected',
+        capabilities: (capabilities ?? [])
           .map((capability) => capability?.name ?? capability?.id ?? '')
           .filter(Boolean),
-        reason: description.health === 'unavailable' ? (description.error ?? 'unavailable') : null,
+        ...(missing.length > 0 ? { missingCapabilities: [...missing] } : {}),
+        reason: down
+          ? (description.error ?? 'unavailable')
+          : (missing.length > 0 ? `does not serve configured: ${missing.join(', ')}` : null),
       });
     } catch (err) {
       runtimes.push({ name: id, status: 'failed', reason: commandError(err) });

package/src/core/startupCheck.test.js

@@ -327,3 +327,31 @@ test('checkAgenticRuntimes reports a down runtime as failed', async () => {
   assert.equal(result.context.runtimes[0].status, 'failed');
   assert.match(result.detail, /pending/);
 });
+
+test('checkAgenticRuntimes asks the runtime what it serves and reports configured capabilities it does not', async () => {
+  const provider = {
+    runtime: 'deepagents',
+    lastDiscovery: null,
+    async describe() { return { runtime: 'deepagents', health: 'available', version: 't', protocolVersion: '1' }; },
+    async discoverCapabilities() {
+      this.lastDiscovery = { served: ['agent.review'], configured: ['agent.review', 'agent.notify'], missing: ['agent.notify'], extra: [] };
+      return [{ name: 'agent.review', operations: ['run'] }];
+    },
+    async execute() { throw new Error('unused'); },
+    async status() { throw new Error('unused'); },
+    async cancel() {},
+    async approve() {},
+    subscribe() { return () => {}; },
+  };
+  const result = await checkAgenticRuntimes({
+    loadConfig: () => [{ id: 'deepagents', type: 'deepagents', enabled: true }],
+    resolve: () => ({ providers: [{ id: 'deepagents', type: 'deepagents', provider }], skipped: [] }),
+    env: {},
+  });
+  assert.equal(result.ok, true);
+  const runtime = result.context.runtimes[0];
+  assert.equal(runtime.status, 'connected');
+  assert.deepEqual(runtime.capabilities, ['agent.review'], 'the served set, not the configured one');
+  assert.deepEqual(runtime.missingCapabilities, ['agent.notify']);
+  assert.match(runtime.reason, /does not serve configured: agent\.notify/);
+});

package/src/core/wikiWorkspaceStart.test.js

@@ -0,0 +1,36 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import test from 'node:test';
+
+const script = readFileSync(fileURLToPath(new URL('../../wiki-workspace', import.meta.url)), 'utf8');
+
+test('wiki-workspace start advertises itself in the usage text', () => {
+  const usage = script.slice(script.indexOf('Commands:'), script.indexOf('Configuration:'));
+  assert.match(usage, /start \[--open\]\s+Start everything: agent-runtime, agents and every/);
+  assert.match(usage, /configured workspace/);
+});
+
+test('wiki-workspace start routes to a start_all that composes the three idempotent steps', () => {
+  const fn = script.slice(script.indexOf("# `start` — the whole deployment"), script.indexOf('ensure_workspace_dirs()'));
+  // The whole deployment is the same three commands an operator runs by hand,
+  // in the boot order the runtime expects: runtime, agents, then workspaces.
+  assert.match(fn, /runtime_command up/);
+  assert.match(fn, /agents_compose up/);
+  assert.match(fn, /up_workspace "\$name"/);
+  // Every configured workspace joins, discovered exactly like list_workspaces:
+  // a directory under WORKSPACES_DIR carrying a .env.
+  assert.match(fn, /for entry in "\$WORKSPACES_DIR"\/\*/);
+  assert.match(fn, /env_value "\$file" WORKSPACE_NAME/);
+  // Without workspaces the command still completes, telling the operator how
+  // to create one.
+  assert.match(fn, /wiki-workspace config <name>/);
+  // Repeatable: each step is idempotent, so `start` is safe on a live stack.
+  assert.match(fn, /idempotent/);
+});
+
+test('the start dispatch accepts only an optional --open', () => {
+  const dispatch = script.slice(script.indexOf('# start [--open]'), script.indexOf('# up <workspace> [--open]'));
+  assert.match(dispatch, /\[\[ "\$\{2:-\}" == "" \|\| "\$\{2:-\}" == "--open" \]\]/);
+  assert.match(dispatch, /start_all "\$start_open"/);
+});

package/src/orchestrator/objectiveResolver.test.js

@@ -86,7 +86,7 @@ test('resolveObjective disambiguates "export" of a Confluence source via alias,
   session.llm.completeWithTools = async () => {
     throw new Error('the explicit alias must not depend on LLM selection');
   };
-  const result = await resolveObjective('Export the requested Confluence source', session);
+  const result = await resolveObjective('Export every configured Confluence source exactly as the connector is currently configured', session);
   assert.equal(result.capability, 'external-source.export');
   assert.equal(result.operation, 'export');
   assert.equal(result.provider.agentInstanceId, 'cme-1');

package/src/orchestrator/providers/deepAgentsProvider.js

@@ -56,7 +56,10 @@ export function createDeepAgentsProvider({
     }
   }
 
-  return {
+  const provider = {
+    // Filled by discoverCapabilities: what the gateway served vs what the
+    // config declares. `null` until the first discovery.
+    lastDiscovery: null,
     async describe() {
       let health = 'available';
       let runtimeVersion = version ?? null;
@@ -77,10 +80,33 @@ export function createDeepAgentsProvider({
         ...(lastError ? { error: lastError } : {}),
       };
     },
+    // The gateway is ALWAYS asked what it serves. The static config (the
+    // manager's agent-runtimes.json entry) carries the richer metadata the
+    // resolver routes on — mutationClass, aliases, aliasOperations — but it is
+    // a declaration, not an observation: a gateway that lost its /config
+    // mount degrades to its built-in default and the manager, trusting the
+    // config alone, kept listing eight capabilities it could not govern.
+    // Only the capabilities BOTH declare are offered; the difference is
+    // exposed as `lastDiscovery` so /status and the runtime log can say why a
+    // configured capability is missing.
     async discoverCapabilities() {
-      if (Array.isArray(capabilities)) return capabilities;
       const list = await httpJson('/capabilities');
-      return Array.isArray(list) ? list : [];
+      const served = (Array.isArray(list) ? list : [])
+        .filter((item) => item && typeof item === 'object' && typeof item.name === 'string' && item.name.trim());
+      const servedNames = served.map((item) => item.name);
+      if (!Array.isArray(capabilities)) {
+        provider.lastDiscovery = { served: servedNames, configured: null, missing: [], extra: [] };
+        return served;
+      }
+      const configuredNames = capabilities.map((item) => String(item?.name ?? ''));
+      const offered = capabilities.filter((item) => servedNames.includes(String(item?.name ?? '')));
+      provider.lastDiscovery = {
+        served: servedNames,
+        configured: configuredNames,
+        missing: configuredNames.filter((name) => !servedNames.includes(name)),
+        extra: servedNames.filter((name) => !configuredNames.includes(name)),
+      };
+      return offered;
     },
     async execute(request = {}) {
       const accepted = await httpJson('/runs', {
@@ -165,4 +191,5 @@ export function createDeepAgentsProvider({
       return () => controller.abort();
     },
   };
+  return provider;
 }

package/src/orchestrator/providers/deepAgentsProvider.test.js

@@ -74,16 +74,44 @@ test('discoverCapabilities fetches /capabilities', async () => {
   assert.deepEqual(await provider.discoverCapabilities(), [{ name: 'agent.review', operations: ['run'] }]);
 });
 
-test('discoverCapabilities uses the static config when provided', async () => {
-  const fetchImpl = mockFetch({});
+test('discoverCapabilities keeps the configured metadata but only for capabilities the gateway serves', async () => {
+  const fetchImpl = mockFetch({
+    'GET /capabilities': () => jsonResponse(200, [
+      { name: 'agent.review', operations: ['run'] },
+      { name: 'agent.notify', operations: ['run'] },
+    ]),
+  });
   const provider = createDeepAgentsProvider({
     endpoint: 'http://agent-runtime:8080',
-    capabilities: [{ name: 'agent.review', operations: ['run'] }],
+    capabilities: [
+      { name: 'agent.review', operations: ['run'], aliases: ['audit'] },
+      { name: 'agent.research', operations: ['run'], mutationClass: 'ingest' },
+      { name: 'agent.notify', operations: ['run'], defaultRequiresApproval: true },
+    ],
     fetchImpl,
   });
 
+  const offered = await provider.discoverCapabilities();
+  assert.equal(fetchImpl.calls.length, 1, 'the gateway is always asked what it serves');
+  assert.deepEqual(offered.map((item) => item.name), ['agent.review', 'agent.notify']);
+  assert.equal(offered[0].aliases[0], 'audit', 'the configured metadata is what the resolver routes on');
+  assert.deepEqual(provider.lastDiscovery, {
+    served: ['agent.review', 'agent.notify'],
+    configured: ['agent.review', 'agent.research', 'agent.notify'],
+    missing: ['agent.research'],
+    extra: [],
+  });
+});
+
+test('discoverCapabilities with no static config serves the gateway list as-is', async () => {
+  const fetchImpl = mockFetch({
+    'GET /capabilities': () => jsonResponse(200, [{ name: 'agent.review', operations: ['run'] }]),
+  });
+  const provider = createDeepAgentsProvider({ endpoint: 'http://agent-runtime:8080', fetchImpl });
+
   assert.deepEqual(await provider.discoverCapabilities(), [{ name: 'agent.review', operations: ['run'] }]);
-  assert.equal(fetchImpl.calls.length, 0, 'no HTTP call when capabilities are static');
+  assert.deepEqual(provider.lastDiscovery.missing, []);
+  assert.equal(provider.lastDiscovery.configured, null);
 });
 
 test('execute POSTs /runs and returns the runId', async () => {

package/src/orchestrator/providers/runtimeProviders.js

@@ -24,6 +24,11 @@ export async function discoverRuntimeProviderAgents(runtimeProviders) {
     : (runtimeProviders?.list?.() ?? []);
   const agents = [];
   const unavailable = [];
+  // Configured-but-not-served capabilities, per runtime (deepagents providers
+  // fill `lastDiscovery`). A drift is not an outage: the runtime stays
+  // available with the capabilities it really serves, and the difference is
+  // reported so an operator can see WHY agent.research is not routable.
+  const drift = [];
 
   for (const entry of providers) {
     const provider = entry?.provider ?? entry;
@@ -53,9 +58,13 @@ export async function discoverRuntimeProviderAgents(runtimeProviders) {
     for (const capability of capabilities ?? []) {
       agents.push(runtimeProviderAgent(runtimeId, provider, description, capability, health));
     }
+    const discovery = provider?.lastDiscovery;
+    if (discovery && Array.isArray(discovery.missing) && discovery.missing.length > 0) {
+      drift.push({ runtimeId, missing: [...discovery.missing], served: [...(discovery.served ?? [])] });
+    }
   }
 
-  return { agents, unavailable };
+  return { agents, unavailable, drift };
 }
 
 /**
@@ -254,7 +263,10 @@ export async function discoverRuntimeProvidersOnce(session, {
     },
   });
   const resolved = resolveRuntimeProviders(entries);
-  const { agents, unavailable } = await discoverRuntimeProviderAgents(resolved.providers);
+  const { agents, unavailable, drift } = await discoverRuntimeProviderAgents(resolved.providers);
+  // Exposed for /status: which configured capabilities the runtime does not
+  // serve right now. Replaced on every scan — a recovered gateway clears it.
+  session.runtimeProviderDrift = drift;
 
   // A failed probe is not a lost agent (same rule as agentRegistry): a runtime
   // that reported unavailable this round but for which we hold a last-known-good
@@ -311,11 +323,39 @@ export async function discoverRuntimeProvidersOnce(session, {
     currentDown.add(key);
     if (!session._runtimeProviderDown.has(key)) {
       const kept = preservedByRuntime.get(item.runtimeId)?.length ?? 0;
+      // Transient states get the ⚠ glyph, which both UIs render in blue: the
+      // gateway answering HTTP 401 before its agents are loaded (workspace
+      // switch, boot order), or not listening yet (fetch failed, refused,
+      // timeout). An HTTP 4xx/5xx other than 401 — the server answers but is
+      // broken — stays a red "unavailable", like the non-HTTP agent contract
+      // errors.
+      const errorText = String(item.error ?? '');
+      const httpMatch = errorText.match(/\bHTTP (\d{3})\b/);
+      const connectionFailure = /\b(fetch failed|ECONNREFUSED|ENOTFOUND|EAI_AGAIN|socket hang up|connection refused|network error|timeout|timed out)\b/i.test(errorText);
+      const notReady = (httpMatch != null && httpMatch[1] === '401') || (httpMatch == null && connectionFailure);
+      if (notReady) {
+        dispatchRuntimeLog(session, `⚠ agent-runtimes: ${item.runtimeId} not ready yet (${item.error})${kept > 0 ? ` — keeping ${kept} last-known capabilit${kept === 1 ? 'y' : 'ies'} until it recovers` : ''} — retrying on the next scan`);
+        continue;
+      }
       dispatchRuntimeLog(session, kept > 0
         ? `agent-runtimes: ${item.runtimeId} unavailable (${item.error}) — keeping ${kept} last-known capabilit${kept === 1 ? 'y' : 'ies'} until it recovers`
         : `agent-runtimes: ${item.runtimeId} unavailable (${item.error})`);
     }
   }
+  // Same edge-triggered rule for a capability drift: announced when it
+  // appears (or changes), silent while it persists, announced again after a
+  // recovery.
+  session._runtimeProviderDriftAnnounced ??= new Map();
+  const announced = session._runtimeProviderDriftAnnounced;
+  const currentDrift = new Map(drift.map((item) => [item.runtimeId, item.missing.join(',')]));
+  for (const item of drift) {
+    if (announced.get(item.runtimeId) === currentDrift.get(item.runtimeId)) continue;
+    dispatchRuntimeLog(session, `agent-runtimes: ${item.runtimeId} does not serve ${item.missing.length} configured capabilit${item.missing.length === 1 ? 'y' : 'ies'} (${item.missing.join(', ')}) — it serves ${item.served.join(', ') || 'nothing'}; check the gateway's /config mount (agent-runtimes.json)`);
+  }
+  for (const id of [...announced.keys()]) {
+    if (!currentDrift.has(id)) announced.delete(id);
+  }
+  for (const [id, key] of currentDrift) announced.set(id, key);
   session._runtimeProviderDown = currentDown;
   return effectiveAgents;
 }

package/src/orchestrator/providers/runtimeProviders.test.js

@@ -265,6 +265,118 @@ test('discoverRuntimeProvidersOnce announces a down runtime only once across re-
   assert.equal(logs.length, 1, 'the degradation is announced once, not on every re-scan');
 });
 
+test('a gateway serving fewer capabilities than configured is a drift: offered = intersection, announced once, cleared on recovery', async () => {
+  const session = sessionWithEvents();
+  const config = [{
+    id: 'deepagents', type: 'deepagents', endpoint: 'http://127.0.0.1:7789', enabled: true,
+    capabilities: [
+      { name: 'agent.review', operations: ['run'] },
+      { name: 'agent.research', operations: ['run'], mutationClass: 'ingest' },
+      { name: 'agent.notify', operations: ['run'], defaultRequiresApproval: true },
+    ],
+  }];
+  const originalFetch = globalThis.fetch;
+  let served = [{ name: 'agent.review', operations: ['run'] }];
+  globalThis.fetch = async (url) => {
+    if (String(url).includes('/health')) return new Response(JSON.stringify({ ok: true, version: 't' }), { status: 200, headers: { 'content-type': 'application/json' } });
+    if (String(url).includes('/capabilities')) return new Response(JSON.stringify(served), { status: 200, headers: { 'content-type': 'application/json' } });
+    throw new Error('unexpected probe ' + String(url));
+  };
+  try {
+    await discoverRuntimeProvidersOnce(session, { config });
+    await discoverRuntimeProvidersOnce(session, { config });
+    const driftLogs = () => (session.agentEvents ?? []).filter((event) => event.type === 'runtime_log'
+      && String(event.payload?.message ?? '').includes('does not serve'));
+
+    // Only what the gateway serves is routable — a governed capability the
+    // gateway would run ungoverned is not offered at all.
+    assert.deepEqual(session.runtimeProviderAgents.map((agent) => agent.agentInstanceId), ['deepagents::agent.review']);
+    assert.deepEqual(session.runtimeProviderDrift, [{
+      runtimeId: 'deepagents', missing: ['agent.research', 'agent.notify'], served: ['agent.review'],
+    }]);
+    assert.equal(driftLogs().length, 1, 'announced once across re-scans');
+    assert.match(String(driftLogs()[0].payload.message), /does not serve 2 configured capabilities \(agent\.research, agent\.notify\)/);
+    assert.match(String(driftLogs()[0].payload.message), /\/config mount/);
+
+    // The gateway recovers its config: no drift, all three routable.
+    served = config[0].capabilities.map(({ name, operations }) => ({ name, operations }));
+    await discoverRuntimeProvidersOnce(session, { config });
+    assert.equal(session.runtimeProviderAgents.length, 3);
+    assert.deepEqual(session.runtimeProviderDrift, []);
+
+    // …and a later drift is announced again.
+    served = [{ name: 'agent.review', operations: ['run'] }];
+    await discoverRuntimeProvidersOnce(session, { config });
+    assert.equal(driftLogs().length, 2);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test('an HTTP 401 gateway probe is announced as not-ready with the ⚠ glyph, not as a failure', async () => {
+  const session = sessionWithEvents();
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async (url) => {
+    if (String(url).includes('/health')) return new Response('{}', { status: 401 });
+    throw new Error('unexpected probe ' + String(url));
+  };
+  try {
+    await discoverRuntimeProvidersOnce(session, {
+      config: [{ id: 'deepagents', type: 'deepagents', endpoint: 'http://127.0.0.1:7789', enabled: true }],
+    });
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+
+  const logs = (session.agentEvents ?? []).filter((event) => event.type === 'runtime_log'
+    && String(event.payload?.message ?? '').includes('deepagents'));
+  assert.equal(logs.length, 1, 'the transient auth state is announced once');
+  const message = String(logs[0].payload?.message ?? '');
+  assert.match(message, /^⚠ agent-runtimes: deepagents not ready yet \(HTTP 401/);
+  assert.match(message, /retrying on the next scan/);
+  assert.doesNotMatch(message, /unavailable/, 'a gateway answering before its agents load is not a failure');
+});
+
+test('a gateway that is not listening yet (fetch failed) is also announced as not-ready', async () => {
+  const session = sessionWithEvents();
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async () => {
+    throw new TypeError('fetch failed');
+  };
+  try {
+    await discoverRuntimeProvidersOnce(session, {
+      config: [{ id: 'deepagents', type: 'deepagents', endpoint: 'http://127.0.0.1:7789', enabled: true }],
+    });
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+
+  const logs = (session.agentEvents ?? []).filter((event) => event.type === 'runtime_log'
+    && String(event.payload?.message ?? '').includes('deepagents'));
+  assert.equal(logs.length, 1);
+  const message = String(logs[0].payload?.message ?? '');
+  assert.match(message, /^⚠ agent-runtimes: deepagents not ready yet \(fetch failed\)/);
+  assert.doesNotMatch(message, /unavailable/);
+});
+
+test('an HTTP 500 gateway probe stays a red unavailable announcement', async () => {
+  const session = sessionWithEvents();
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async () => new Response('{}', { status: 500 });
+  try {
+    await discoverRuntimeProvidersOnce(session, {
+      config: [{ id: 'deepagents', type: 'deepagents', endpoint: 'http://127.0.0.1:7789', enabled: true }],
+    });
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+
+  const logs = (session.agentEvents ?? []).filter((event) => event.type === 'runtime_log'
+    && String(event.payload?.message ?? '').includes('deepagents'));
+  assert.equal(logs.length, 1);
+  assert.match(String(logs[0].payload?.message ?? ''), /^agent-runtimes: deepagents unavailable \(HTTP 500/);
+});
+
 test('a transient probe failure keeps the last-known capability set (a failed probe is not a lost agent)', async () => {
   const session = sessionWithEvents();
   const up = [{ id: 'gw', type: 'fake', capabilities: [{ name: 'agent.review', operations: ['run'] }] }];

package/src/runtime/skillChain.e2e.test.js

@@ -136,16 +136,16 @@ test('E2E-002 wiki-sync: two objectives, two ordered runs, one chainId', async (
   const env = await harness(t, { skills: { 'wiki-sync': null } });
   if (!env) return;
 
-  const { body } = await env.post('/run?workspace=acme', { input: '/wiki-sync docs' });
+  const { body } = await env.post('/run?workspace=acme', { input: '/wiki-sync' });
   await env.settle();
 
   assert.equal(body.objectives, 2);
   assert.equal(env.runs.length, 2, 'the second objective must run after the first');
-  assert.match(env.runs[0].input, /^Export the requested Confluence source/);
+  assert.match(env.runs[0].input, /^Export every configured Confluence source/);
   assert.match(env.runs[1].input, /^Run the production pipeline step ingest over the newly exported Markdown/);
-  // CME first, Production second — and the parameter reaches the step that
-  // consumes it, not only the last objective.
-  for (const run of env.runs) assert.match(run.input, /User parameters:\nsource: docs/);
+  // CME first, Production second — the skill carries no source parameter, so
+  // no run may receive a source selector (the export step must stay "all").
+  for (const run of env.runs) assert.doesNotMatch(run.input, /User parameters:/);
   const items = env.chain();
   assert.equal(items.length, 2);
   assert.equal(items[0].chainId, items[1].chainId);
@@ -154,6 +154,24 @@ test('E2E-002 wiki-sync: two objectives, two ordered runs, one chainId', async (
   assert.deepEqual(items.map((item) => item.skillName), ['wiki-sync', 'wiki-sync']);
 });
 
+test('E2E-002b parameters reach every objective of a multi-step skill', async (t) => {
+  const env = await harness(t, {
+    skills: {
+      'two-step': '---\nname: two-step\nparams:\n  - source\n---\nCollect the sources.\n\nThen ingest them.',
+    },
+  });
+  if (!env) return;
+
+  const { body } = await env.post('/run?workspace=acme', { input: '/two-step docs' });
+  await env.settle();
+
+  assert.equal(body.objectives, 2);
+  assert.equal(env.runs.length, 2);
+  // The parameter reaches every step that consumes it, not only the last
+  // objective of the chain.
+  for (const run of env.runs) assert.match(run.input, /User parameters:\nsource: docs/);
+});
+
 test('E2E-003 cancel: the running step and its chain stop, unrelated queue survives', async (t) => {
   const env = await harness(t, {
     autoFinish: false,
@@ -308,7 +326,7 @@ test('E2E-010 skill stack: every run receives the ancestors of its chain', async
   const env = await harness(t, { skills: { 'wiki-sync': null } });
   if (!env) return;
 
-  await env.post('/run?workspace=acme', { input: '/wiki-sync docs' });
+  await env.post('/run?workspace=acme', { input: '/wiki-sync' });
   await env.settle();
 
   assert.ok(env.runs.length >= 1);

package/src/shell/LeftPane.tsx

@@ -830,14 +830,21 @@ export function LeftPane(props: {
         to the foot of the pane: they are an ambient state one glances at, not
         something read before every message, and at the top they pushed the
         conversation down by a line for standing information.
+
+        The hint row exists only while there is a hint. It is null almost
+        always, so reserving a blank line for it left a dead gap between the
+        mode bar and the thread once the standing info moved to the foot;
+        `conversationRows` in tui.tsx adds the row back only when it shows.
       */}
-      <box height={2} flexDirection="column">
+      <box height={props.hintLine ? 2 : 1} flexDirection="column">
         <box height={1} flexDirection="row" backgroundColor={modeColor()} paddingX={1}>
           <text fg="#0B1020">{modeLabel()}</text>
         </box>
-        <box height={1} flexDirection="row">
-          {props.hintLine ? <text fg="#FBBF24">[ {props.hintLine} ]</text> : null}
-        </box>
+        {props.hintLine ? (
+          <box height={1} flexDirection="row">
+            <text fg="#FBBF24">[ {props.hintLine} ]</text>
+          </box>
+        ) : null}
       </box>
       {showWelcome() ? (
         <WelcomeHelpPanels width={props.conversationColumns} />
@@ -875,9 +882,9 @@ export function LeftPane(props: {
         onHeightChange={props.onInputHeightChange}
       />
       {/*
-        Status foot. One line, as in the header before it, so the row budget of
-        `conversationRows` (height - 5 - input) is unchanged: the line moved,
-        it was not added.
+        Status foot. One line: it replaced the standing header line rather than
+        adding one. `conversationRows` (tui.tsx) counts padding (2) + mode bar
+        (1) + this foot (1), plus the hint row only when it is present.
       */}
       <box height={1} flexDirection="row">
         <text fg="#D6DEE8">{props.title}</text>

package/src/shell/RightPane.tsx

@@ -349,6 +349,13 @@ function logMessageColor(message: string): string {
   // would give them anyway.
   if (/^\s*✓/.test(message)) return '#A6E3A1';
   if (/^\s*✗/.test(message)) return '#F38BA8';
+  // ⚠ announces a state the reader should know about, not an error: the
+  // gateway answering 401 before its agents are loaded, a re-scan retry.
+  // Blue, with the glyph carrying the warning — the red rules below must not
+  // claim it (the text may still contain "HTTP 401"). Keyed on the glyph
+  // alone: every legitimate "not ready" line already carries it, whereas a
+  // genuine failure ("Run failed: agent X not ready") must stay red.
+  if (/^\s*⚠/.test(message)) return '#89B4FA';
   // A doctor summary with ZERO errors is a warning by construction
   // ("⚠ 0 error(s), 2 warning(s)") — amber, never red, even though it
   // mentions the word "error".
@@ -419,7 +426,11 @@ export function LogPanel(props: { logs: string[]; width: number; filter?: string
     // above the Runtime/Agent status tabs left a dead gap under a short Plan
     // and made the two panels look detached. The Plan/Queue panel now grows
     // into that space instead, so its bottom edge meets this panel's header.
-    <box flexGrow={2} flexDirection="column" paddingX={1} focusable={false}>
+    // minHeight keeps this panel on screen while a long plan is running: with
+    // no floor the flex column shrank it to zero rows during a treatment — the
+    // plan grew, the Runtime/Agent status tabs vanished — while the Queue tab
+    // (fixed height, no shrink) kept them visible.
+    <box flexGrow={2} minHeight={10} flexDirection="column" paddingX={1} focusable={false}>
       <text width={lineWidth()} fg="#4B5563" content={'─'.repeat(lineWidth())} />
       <box height={1} flexDirection="row">
         <text
@@ -438,6 +449,7 @@ export function LogPanel(props: { logs: string[]; width: number; filter?: string
       </box>
       <scrollbox
         flexGrow={1}
+        minHeight={4}
         focusable={false}
         scrollY={true}
         scrollX={false}

package/src/shell/repl.test.js

@@ -186,6 +186,28 @@ test('a doctor summary with a nonzero error count is colored as an error, not a
   assert.doesNotMatch(colorFn, /\/0 error\\\(s\\\)\/i\.test/);
 });
 
+test('a ⚠ not-ready announcement is blue, even when its text mentions HTTP 401', async () => {
+  const source = await readFile(new URL('./RightPane.tsx', import.meta.url), 'utf8');
+  const colorFn = source.slice(
+    source.indexOf('function logMessageColor'),
+    source.indexOf('function logRenderLines'),
+  );
+  const blueRule = colorFn.indexOf("return '#89B4FA'");
+  const redRule = colorFn.indexOf('HTTP 4\\d\\d');
+  assert.ok(blueRule !== -1 && redRule !== -1, 'the blue and red rules both exist');
+  assert.ok(blueRule < redRule, 'the ⚠ rule must win over the HTTP 4xx red rule');
+  assert.match(colorFn, /\/\^\\s\*⚠\//);
+});
+
+test('local log lines carry a fixed 24h timestamp like the runtime lines', async () => {
+  const source = await readFile(new URL('./useSession.ts', import.meta.url), 'utf8');
+  // A locale default rendered "9:50:37 PM" on some machines while runtime
+  // lines read "21:50:37" — two time dialects in one panel, and the
+  // Runtime/Agent-status classification reads the time prefix structurally.
+  assert.match(source, /toLocaleTimeString\('en-GB', \{ hour12: false \}\)/);
+  assert.doesNotMatch(source, /toLocaleTimeString\(\)/);
+});
+
 test('runtime logs have a separator and a concise Runtime tab label', async () => {
   const source = await readFile(new URL('./RightPane.tsx', import.meta.url), 'utf8');
   const logPanel = source.slice(
@@ -195,6 +217,11 @@ test('runtime logs have a separator and a concise Runtime tab label', async () =
   assert.match(logPanel, /content=\{'─'\.repeat\(lineWidth\(\)\)\}/);
   assert.match(logPanel, /content=" Runtime "/);
   assert.doesNotMatch(logPanel, /Flow \/ Trace/);
+  // The panel keeps a floor so a long plan running above it cannot shrink it
+  // to zero rows — the Queue tab's fixed height is what used to keep it
+  // visible, and a treatment must not make the tabs vanish.
+  assert.match(logPanel, /flexGrow=\{2\} minHeight=\{10\}/);
+  assert.match(logPanel, /minHeight=\{4\}/);
 });
 
 test('ShellUI turns HTTP URLs into valid links without trailing punctuation', () => {

package/src/shell/tui.tsx

@@ -175,9 +175,22 @@ function App(props: {
   let lastCopiedSelection = '';
   const state = useSession(props);
   const startup = createMemo(() => startupInfo(props.packageJson, props.initialWorkspaceName));
-  // The Activity strip (4 rows) now sits above the composer, so it costs the
-  // conversation exactly those 4 rows.
-  const conversationRows = createMemo(() => Math.max(4, dimensions().height - 5 - chatInputHeight() - 4));
+  // Header line that changes the meaning of what is typed. Null most of the
+  // time — a transient exit/copy/runtime prompt only — so the header collapses
+  // to the single mode-bar row when it is absent (see LeftPane).
+  const hintLine = () => {
+    if (exitStatus()) return exitStatus();
+    if (copyHint()) return copyHint();
+    if (exitHint()) return 'Press Ctrl+C again to exit.';
+    if (state.runtimeHint()) return state.runtimeHint();
+    return null;
+  };
+  // Non-conversation rows: outer padding (2) + mode bar (1) + status foot (1),
+  // plus the hint row only when a hint is showing, plus the composer height and
+  // the Activity strip (4 rows, now above the composer).
+  const conversationRows = createMemo(() =>
+    Math.max(4, dimensions().height - 4 - (hintLine() ? 1 : 0) - chatInputHeight() - 4),
+  );
   const rightColumns = createMemo(() => {
     const width = dimensions().width;
     // 38% + 2 columns: the Plan/Activity/Logs panes carry job labels, file
@@ -359,14 +372,6 @@ function App(props: {
     }
   });
 
-  const hintLine = () => {
-    if (exitStatus()) return exitStatus();
-    if (copyHint()) return copyHint();
-    if (exitHint()) return 'Press Ctrl+C again to exit.';
-    if (state.runtimeHint()) return state.runtimeHint();
-    return null;
-  };
-
   return (
     <Show
       when={screen() === 'startup'}

package/src/shell/useSession.ts

@@ -82,7 +82,10 @@ export function useSession(props: { agent: unknown; packageJson: Record<string,
     setActiveEditor(editor);
   };
   const addLog = (line: string) => {
-    setLogs((items) => [...items, `${new Date().toLocaleTimeString()} ${line}`].slice(-200));
+    // Fixed 24h HH:MM:SS, like the runtime's own log lines: a locale default
+    // rendered "9:50:37 PM" on some machines, and the Runtime/Agent-status
+    // split classifies lines structurally from that time prefix.
+    setLogs((items) => [...items, `${new Date().toLocaleTimeString('en-GB', { hour12: false })} ${line}`].slice(-200));
   };
   const runtimeUnavailableReason = createMemo(() => {
     if (props.runtime?.url) return null;

package/wiki-workspace

@@ -97,6 +97,8 @@ Usage:
 Commands:
   config <workspace> [path]         Create workspace folder, auto-select ports, run wiki init
   up <workspace> [--open]           Start workspace stack: wiki + production
+  start [--open]                    Start everything: agent-runtime, agents and every
+                                    configured workspace (--open opens the first chat)
   list                              List configured workspaces
   refresh                           Stop runtime/stacks and remove their Compose images
 
@@ -1438,6 +1440,49 @@ wait_and_open() {
   open_app_mode "${url}"
 }
 
+# `start` — the whole deployment in one command: the host agent-runtime, the
+# external agents, then every configured workspace stack. Each step is the
+# same idempotent command the operator would run by hand, so `start` is safe
+# to repeat while things are already up. A workspace failure stops the run —
+# the failing compose command already says why.
+start_all() {
+  local open_browser="${1:-0}"
+
+  printf -- '── agent-runtime ──\n'
+  runtime_command up
+  printf '\n'
+
+  printf -- '── external agents ──\n'
+  agents_compose up
+  printf '\n'
+
+  mkdir -p "$WORKSPACES_DIR"
+  local found=0 first_name="" entry file name
+  for entry in "$WORKSPACES_DIR"/*; do
+    [[ -d "$entry" ]] || continue
+    file="$entry/.env"
+    [[ -f "$file" ]] || continue
+    name="$(env_value "$file" WORKSPACE_NAME "$(basename "$entry")")"
+    found=1
+    [[ -n "$first_name" ]] || first_name="$name"
+    printf -- '── workspace: %s ──\n' "$name"
+    up_workspace "$name"
+    printf '\n'
+  done
+
+  if [[ "$found" -eq 0 ]]; then
+    printf 'No workspaces configured in %s\n' "$WORKSPACES_DIR"
+    printf 'Create one with: wiki-workspace config <name>\n'
+    return 0
+  fi
+
+  if [[ "$open_browser" == "1" ]]; then
+    local serve_port
+    serve_port="$(workspace_value "$first_name" WIKI_SERVE_PORT 3100)"
+    wait_and_open "http://localhost:${serve_port}/chat" &
+  fi
+}
+
 ensure_workspace_dirs() {
   local ws_path="$1"
   mkdir -p "$ws_path/.wiki/vector-index"
@@ -1575,6 +1620,16 @@ main() {
     exit 0
   fi
 
+  # start [--open] — everything: runtime, agents, every configured workspace
+  if [[ $# -ge 1 && "$1" == "start" ]]; then
+    [[ $# -le 2 ]] || die "start takes at most --open"
+    [[ "${2:-}" == "" || "${2:-}" == "--open" ]] || die "start takes at most --open"
+    local start_open=0
+    [[ "${2:-}" == "--open" ]] && start_open=1
+    start_all "$start_open"
+    exit 0
+  fi
+
   # up <workspace> [--open]
   if [[ $# -ge 2 && "$1" == "up" ]]; then
     local up_open=0