@dotdrelle/wiki-manager 0.15.73 → 0.15.74

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotdrelle/wiki-manager",
-  "version": "0.15.73",
+  "version": "0.15.74",
   "description": "Agentic shell and orchestration cockpit for llm-wiki workspaces.",
   "repository": {
     "type": "git",

package/src/commands/slash.js

@@ -682,6 +682,14 @@ function runtimeProvidersSection(session) {
     // never truncates and stays scannable.
     lines.push('capabilities:');
     for (const capability of capabilities) lines.push(`    ${capability}`);
+    // Configured in agent-runtimes.json but not served by the gateway (the
+    // list above is the intersection): say so, one per line, or the operator
+    // reads a shorter list without knowing the gateway lost its /config.
+    const drift = (session.runtimeProviderDrift ?? []).find((item) => item.runtimeId === runtimeId);
+    if (drift && drift.missing.length > 0) {
+      lines.push('not served by the gateway:');
+      for (const capability of drift.missing) lines.push(`    ${capability}`);
+    }
   }
   return sectionBlock('Agentic runtime', lines);
 }

package/src/core/buildInfo.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.15.73",
-  "commit": "b7de9bb"
+  "version": "0.15.74",
+  "commit": "4ca493b"
 }

package/src/core/env.js

@@ -11,6 +11,13 @@ const TEMPLATE_AUTHORING_CHAT_TOOLS = [
   'wiki_outline', 'template_read', 'template_write', 'build_context_write',
   'wiki_read_deliverable',
 ];
+// Same additive rule for the packaged cme allow-list: an install scaffolded
+// before the live search tools existed keeps the three legacy reads forever,
+// and /chat can never call cme_confluence_search — the LLM is offered a
+// server with no search and loops. A hand-edited list (not a superset of the
+// legacy default) is the operator's and stays untouched.
+const LEGACY_DEFAULT_CME_CHAT_TOOLS = ['cme_status', 'cme_sources_list', 'cme_export_status'];
+const CME_SEARCH_CHAT_TOOLS = ['cme_confluence_search', 'cme_wiki_search'];
 
 export function userManagerDir() {
   return process.cwd();
@@ -148,17 +155,25 @@ export function ensureManagerScaffold({ log = () => {} } = {}) {
           const missingWikiChatTools = migrateWikiChatTools
             ? TEMPLATE_AUTHORING_CHAT_TOOLS.filter((tool) => !wikiAllow.includes(tool))
             : [];
+          const cmeAllow = current.chatAccess?.servers?.cme?.allow;
+          const migrateCmeChatTools = Array.isArray(cmeAllow)
+            && LEGACY_DEFAULT_CME_CHAT_TOOLS.every((tool) => cmeAllow.includes(tool));
+          const missingCmeChatTools = migrateCmeChatTools
+            ? CME_SEARCH_CHAT_TOOLS.filter((tool) => !cmeAllow.includes(tool))
+            : [];
           if (missing.length > 0) {
             for (const key of missing) current[key] = example[key];
           }
           for (const key of missingServers) currentServers[key] = exampleServers[key];
           wikiAllow?.push(...missingWikiChatTools);
-          if (missing.length > 0 || missingServers.length > 0 || missingWikiChatTools.length > 0) {
+          cmeAllow?.push(...missingCmeChatTools);
+          const missingChatTools = [...missingWikiChatTools, ...missingCmeChatTools];
+          if (missing.length > 0 || missingServers.length > 0 || missingChatTools.length > 0) {
             writeFileSync(endpointsFile, `${JSON.stringify(current, null, 2)}\n`);
             const changes = [
               missing.length > 0 ? `keys: ${missing.join(', ')}` : '',
               missingServers.length > 0 ? `servers: ${missingServers.join(', ')}` : '',
-              missingWikiChatTools.length > 0 ? `chat tools: ${missingWikiChatTools.join(', ')}` : '',
+              missingChatTools.length > 0 ? `chat tools: ${missingChatTools.join(', ')}` : '',
             ].filter(Boolean).join('; ');
             created.push(`mcp.endpoints.json ${changes}`);
           }

package/src/core/env.test.js

@@ -141,6 +141,37 @@ test('scaffold upgrades the packaged wiki chat allow-list with template authorin
   });
 });
 
+test('scaffold upgrades the packaged cme chat allow-list with the live search tools', () => {
+  withTempManagerDir((dir) => {
+    const endpointsFile = join(dir, 'mcp.endpoints.json');
+    const example = JSON.parse(readFileSync('mcp.endpoints.example.json', 'utf8'));
+    example.chatAccess.servers.cme.allow = ['cme_status', 'cme_sources_list', 'cme_export_status'];
+    writeFileSync(endpointsFile, JSON.stringify(example, null, 2));
+
+    const changes = ensureManagerScaffold();
+    const after = JSON.parse(readFileSync(endpointsFile, 'utf8'));
+
+    assert.ok(changes.some((item) => item.includes('cme_confluence_search')));
+    assert.deepEqual(after.chatAccess.servers.cme.allow, [
+      'cme_status', 'cme_sources_list', 'cme_export_status', 'cme_confluence_search', 'cme_wiki_search',
+    ]);
+  });
+});
+
+test('scaffold leaves a custom cme chat allow-list untouched', () => {
+  withTempManagerDir((dir) => {
+    const endpointsFile = join(dir, 'mcp.endpoints.json');
+    writeFileSync(endpointsFile, JSON.stringify({
+      mcpServers: {},
+      chatAccess: { servers: { cme: { allow: ['cme_status'] } } },
+    }, null, 2));
+
+    ensureManagerScaffold();
+    const after = JSON.parse(readFileSync(endpointsFile, 'utf8'));
+    assert.deepEqual(after.chatAccess.servers.cme.allow, ['cme_status']);
+  });
+});
+
 test('scaffold leaves a custom wiki chat allow-list untouched', () => {
   withTempManagerDir((dir) => {
     const endpointsFile = join(dir, 'mcp.endpoints.json');

package/src/core/mcp.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { managerEnvFile, managerMcpEndpointsFile, readEnvFile } from './env.js';
 
-const WIKI_MANAGER_VERSION = '0.15.73';
+const WIKI_MANAGER_VERSION = '0.15.74';
 
 function envValue(key) {
   const filePath = managerEnvFile();

package/src/core/startupCheck.js

@@ -357,13 +357,22 @@ export async function checkAgenticRuntimes({
   for (const { id, provider } of providers) {
     try {
       const description = await provider.describe();
+      const down = description.health === 'unavailable';
+      // Ask the runtime what it serves — describe() alone reflects /health,
+      // not the capability set, and a gateway that lost its config answers
+      // healthy with one default capability.
+      const capabilities = down ? [] : await provider.discoverCapabilities();
+      const missing = provider?.lastDiscovery?.missing ?? [];
       runtimes.push({
         name: id,
-        status: description.health === 'unavailable' ? 'failed' : 'connected',
-        capabilities: (description.capabilities ?? [])
+        status: down ? 'failed' : 'connected',
+        capabilities: (capabilities ?? [])
           .map((capability) => capability?.name ?? capability?.id ?? '')
           .filter(Boolean),
-        reason: description.health === 'unavailable' ? (description.error ?? 'unavailable') : null,
+        ...(missing.length > 0 ? { missingCapabilities: [...missing] } : {}),
+        reason: down
+          ? (description.error ?? 'unavailable')
+          : (missing.length > 0 ? `does not serve configured: ${missing.join(', ')}` : null),
       });
     } catch (err) {
       runtimes.push({ name: id, status: 'failed', reason: commandError(err) });

package/src/core/startupCheck.test.js

@@ -327,3 +327,31 @@ test('checkAgenticRuntimes reports a down runtime as failed', async () => {
   assert.equal(result.context.runtimes[0].status, 'failed');
   assert.match(result.detail, /pending/);
 });
+
+test('checkAgenticRuntimes asks the runtime what it serves and reports configured capabilities it does not', async () => {
+  const provider = {
+    runtime: 'deepagents',
+    lastDiscovery: null,
+    async describe() { return { runtime: 'deepagents', health: 'available', version: 't', protocolVersion: '1' }; },
+    async discoverCapabilities() {
+      this.lastDiscovery = { served: ['agent.review'], configured: ['agent.review', 'agent.notify'], missing: ['agent.notify'], extra: [] };
+      return [{ name: 'agent.review', operations: ['run'] }];
+    },
+    async execute() { throw new Error('unused'); },
+    async status() { throw new Error('unused'); },
+    async cancel() {},
+    async approve() {},
+    subscribe() { return () => {}; },
+  };
+  const result = await checkAgenticRuntimes({
+    loadConfig: () => [{ id: 'deepagents', type: 'deepagents', enabled: true }],
+    resolve: () => ({ providers: [{ id: 'deepagents', type: 'deepagents', provider }], skipped: [] }),
+    env: {},
+  });
+  assert.equal(result.ok, true);
+  const runtime = result.context.runtimes[0];
+  assert.equal(runtime.status, 'connected');
+  assert.deepEqual(runtime.capabilities, ['agent.review'], 'the served set, not the configured one');
+  assert.deepEqual(runtime.missingCapabilities, ['agent.notify']);
+  assert.match(runtime.reason, /does not serve configured: agent\.notify/);
+});

package/src/orchestrator/providers/deepAgentsProvider.js

@@ -56,7 +56,10 @@ export function createDeepAgentsProvider({
     }
   }
 
-  return {
+  const provider = {
+    // Filled by discoverCapabilities: what the gateway served vs what the
+    // config declares. `null` until the first discovery.
+    lastDiscovery: null,
     async describe() {
       let health = 'available';
       let runtimeVersion = version ?? null;
@@ -77,10 +80,33 @@ export function createDeepAgentsProvider({
         ...(lastError ? { error: lastError } : {}),
       };
     },
+    // The gateway is ALWAYS asked what it serves. The static config (the
+    // manager's agent-runtimes.json entry) carries the richer metadata the
+    // resolver routes on — mutationClass, aliases, aliasOperations — but it is
+    // a declaration, not an observation: a gateway that lost its /config
+    // mount degrades to its built-in default and the manager, trusting the
+    // config alone, kept listing eight capabilities it could not govern.
+    // Only the capabilities BOTH declare are offered; the difference is
+    // exposed as `lastDiscovery` so /status and the runtime log can say why a
+    // configured capability is missing.
     async discoverCapabilities() {
-      if (Array.isArray(capabilities)) return capabilities;
       const list = await httpJson('/capabilities');
-      return Array.isArray(list) ? list : [];
+      const served = (Array.isArray(list) ? list : [])
+        .filter((item) => item && typeof item === 'object' && typeof item.name === 'string' && item.name.trim());
+      const servedNames = served.map((item) => item.name);
+      if (!Array.isArray(capabilities)) {
+        provider.lastDiscovery = { served: servedNames, configured: null, missing: [], extra: [] };
+        return served;
+      }
+      const configuredNames = capabilities.map((item) => String(item?.name ?? ''));
+      const offered = capabilities.filter((item) => servedNames.includes(String(item?.name ?? '')));
+      provider.lastDiscovery = {
+        served: servedNames,
+        configured: configuredNames,
+        missing: configuredNames.filter((name) => !servedNames.includes(name)),
+        extra: servedNames.filter((name) => !configuredNames.includes(name)),
+      };
+      return offered;
     },
     async execute(request = {}) {
       const accepted = await httpJson('/runs', {
@@ -165,4 +191,5 @@ export function createDeepAgentsProvider({
       return () => controller.abort();
     },
   };
+  return provider;
 }

package/src/orchestrator/providers/deepAgentsProvider.test.js

@@ -74,16 +74,44 @@ test('discoverCapabilities fetches /capabilities', async () => {
   assert.deepEqual(await provider.discoverCapabilities(), [{ name: 'agent.review', operations: ['run'] }]);
 });
 
-test('discoverCapabilities uses the static config when provided', async () => {
-  const fetchImpl = mockFetch({});
+test('discoverCapabilities keeps the configured metadata but only for capabilities the gateway serves', async () => {
+  const fetchImpl = mockFetch({
+    'GET /capabilities': () => jsonResponse(200, [
+      { name: 'agent.review', operations: ['run'] },
+      { name: 'agent.notify', operations: ['run'] },
+    ]),
+  });
   const provider = createDeepAgentsProvider({
     endpoint: 'http://agent-runtime:8080',
-    capabilities: [{ name: 'agent.review', operations: ['run'] }],
+    capabilities: [
+      { name: 'agent.review', operations: ['run'], aliases: ['audit'] },
+      { name: 'agent.research', operations: ['run'], mutationClass: 'ingest' },
+      { name: 'agent.notify', operations: ['run'], defaultRequiresApproval: true },
+    ],
     fetchImpl,
   });
 
+  const offered = await provider.discoverCapabilities();
+  assert.equal(fetchImpl.calls.length, 1, 'the gateway is always asked what it serves');
+  assert.deepEqual(offered.map((item) => item.name), ['agent.review', 'agent.notify']);
+  assert.equal(offered[0].aliases[0], 'audit', 'the configured metadata is what the resolver routes on');
+  assert.deepEqual(provider.lastDiscovery, {
+    served: ['agent.review', 'agent.notify'],
+    configured: ['agent.review', 'agent.research', 'agent.notify'],
+    missing: ['agent.research'],
+    extra: [],
+  });
+});
+
+test('discoverCapabilities with no static config serves the gateway list as-is', async () => {
+  const fetchImpl = mockFetch({
+    'GET /capabilities': () => jsonResponse(200, [{ name: 'agent.review', operations: ['run'] }]),
+  });
+  const provider = createDeepAgentsProvider({ endpoint: 'http://agent-runtime:8080', fetchImpl });
+
   assert.deepEqual(await provider.discoverCapabilities(), [{ name: 'agent.review', operations: ['run'] }]);
-  assert.equal(fetchImpl.calls.length, 0, 'no HTTP call when capabilities are static');
+  assert.deepEqual(provider.lastDiscovery.missing, []);
+  assert.equal(provider.lastDiscovery.configured, null);
 });
 
 test('execute POSTs /runs and returns the runId', async () => {

package/src/orchestrator/providers/runtimeProviders.js

@@ -24,6 +24,11 @@ export async function discoverRuntimeProviderAgents(runtimeProviders) {
     : (runtimeProviders?.list?.() ?? []);
   const agents = [];
   const unavailable = [];
+  // Configured-but-not-served capabilities, per runtime (deepagents providers
+  // fill `lastDiscovery`). A drift is not an outage: the runtime stays
+  // available with the capabilities it really serves, and the difference is
+  // reported so an operator can see WHY agent.research is not routable.
+  const drift = [];
 
   for (const entry of providers) {
     const provider = entry?.provider ?? entry;
@@ -53,9 +58,13 @@ export async function discoverRuntimeProviderAgents(runtimeProviders) {
     for (const capability of capabilities ?? []) {
       agents.push(runtimeProviderAgent(runtimeId, provider, description, capability, health));
     }
+    const discovery = provider?.lastDiscovery;
+    if (discovery && Array.isArray(discovery.missing) && discovery.missing.length > 0) {
+      drift.push({ runtimeId, missing: [...discovery.missing], served: [...(discovery.served ?? [])] });
+    }
   }
 
-  return { agents, unavailable };
+  return { agents, unavailable, drift };
 }
 
 /**
@@ -254,7 +263,10 @@ export async function discoverRuntimeProvidersOnce(session, {
     },
   });
   const resolved = resolveRuntimeProviders(entries);
-  const { agents, unavailable } = await discoverRuntimeProviderAgents(resolved.providers);
+  const { agents, unavailable, drift } = await discoverRuntimeProviderAgents(resolved.providers);
+  // Exposed for /status: which configured capabilities the runtime does not
+  // serve right now. Replaced on every scan — a recovered gateway clears it.
+  session.runtimeProviderDrift = drift;
 
   // A failed probe is not a lost agent (same rule as agentRegistry): a runtime
   // that reported unavailable this round but for which we hold a last-known-good
@@ -330,6 +342,20 @@ export async function discoverRuntimeProvidersOnce(session, {
         : `agent-runtimes: ${item.runtimeId} unavailable (${item.error})`);
     }
   }
+  // Same edge-triggered rule for a capability drift: announced when it
+  // appears (or changes), silent while it persists, announced again after a
+  // recovery.
+  session._runtimeProviderDriftAnnounced ??= new Map();
+  const announced = session._runtimeProviderDriftAnnounced;
+  const currentDrift = new Map(drift.map((item) => [item.runtimeId, item.missing.join(',')]));
+  for (const item of drift) {
+    if (announced.get(item.runtimeId) === currentDrift.get(item.runtimeId)) continue;
+    dispatchRuntimeLog(session, `agent-runtimes: ${item.runtimeId} does not serve ${item.missing.length} configured capabilit${item.missing.length === 1 ? 'y' : 'ies'} (${item.missing.join(', ')}) — it serves ${item.served.join(', ') || 'nothing'}; check the gateway's /config mount (agent-runtimes.json)`);
+  }
+  for (const id of [...announced.keys()]) {
+    if (!currentDrift.has(id)) announced.delete(id);
+  }
+  for (const [id, key] of currentDrift) announced.set(id, key);
   session._runtimeProviderDown = currentDown;
   return effectiveAgents;
 }

package/src/orchestrator/providers/runtimeProviders.test.js

@@ -265,6 +265,54 @@ test('discoverRuntimeProvidersOnce announces a down runtime only once across re-
   assert.equal(logs.length, 1, 'the degradation is announced once, not on every re-scan');
 });
 
+test('a gateway serving fewer capabilities than configured is a drift: offered = intersection, announced once, cleared on recovery', async () => {
+  const session = sessionWithEvents();
+  const config = [{
+    id: 'deepagents', type: 'deepagents', endpoint: 'http://127.0.0.1:7789', enabled: true,
+    capabilities: [
+      { name: 'agent.review', operations: ['run'] },
+      { name: 'agent.research', operations: ['run'], mutationClass: 'ingest' },
+      { name: 'agent.notify', operations: ['run'], defaultRequiresApproval: true },
+    ],
+  }];
+  const originalFetch = globalThis.fetch;
+  let served = [{ name: 'agent.review', operations: ['run'] }];
+  globalThis.fetch = async (url) => {
+    if (String(url).includes('/health')) return new Response(JSON.stringify({ ok: true, version: 't' }), { status: 200, headers: { 'content-type': 'application/json' } });
+    if (String(url).includes('/capabilities')) return new Response(JSON.stringify(served), { status: 200, headers: { 'content-type': 'application/json' } });
+    throw new Error('unexpected probe ' + String(url));
+  };
+  try {
+    await discoverRuntimeProvidersOnce(session, { config });
+    await discoverRuntimeProvidersOnce(session, { config });
+    const driftLogs = () => (session.agentEvents ?? []).filter((event) => event.type === 'runtime_log'
+      && String(event.payload?.message ?? '').includes('does not serve'));
+
+    // Only what the gateway serves is routable — a governed capability the
+    // gateway would run ungoverned is not offered at all.
+    assert.deepEqual(session.runtimeProviderAgents.map((agent) => agent.agentInstanceId), ['deepagents::agent.review']);
+    assert.deepEqual(session.runtimeProviderDrift, [{
+      runtimeId: 'deepagents', missing: ['agent.research', 'agent.notify'], served: ['agent.review'],
+    }]);
+    assert.equal(driftLogs().length, 1, 'announced once across re-scans');
+    assert.match(String(driftLogs()[0].payload.message), /does not serve 2 configured capabilities \(agent\.research, agent\.notify\)/);
+    assert.match(String(driftLogs()[0].payload.message), /\/config mount/);
+
+    // The gateway recovers its config: no drift, all three routable.
+    served = config[0].capabilities.map(({ name, operations }) => ({ name, operations }));
+    await discoverRuntimeProvidersOnce(session, { config });
+    assert.equal(session.runtimeProviderAgents.length, 3);
+    assert.deepEqual(session.runtimeProviderDrift, []);
+
+    // …and a later drift is announced again.
+    served = [{ name: 'agent.review', operations: ['run'] }];
+    await discoverRuntimeProvidersOnce(session, { config });
+    assert.equal(driftLogs().length, 2);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
 test('an HTTP 401 gateway probe is announced as not-ready with the ⚠ glyph, not as a failure', async () => {
   const session = sessionWithEvents();
   const originalFetch = globalThis.fetch;