@dotdrelle/wiki-manager 0.15.84 → 0.15.91

package/src/core/skillCompiler.js

@@ -1,3 +1,4 @@
+import { objectiveForResolution } from '../orchestrator/objectiveResolver.js';
 const OPTIONAL_RE = /^(?:si disponible|si possible|optionnellement|if available|if possible|optionally)\b[\s,:-]*/i;
 const STRONG_CONNECTOR_RE = /\n\s*(?=(?:puis|ensuite|après cela|après .{0,80}?terminé|then|next|after .{0,80}?complete|si disponible|si possible|optionnellement|if available|if possible|optionally)\b)/gi;
 const FORBIDDEN_FIELDS = /\b(?:agent|capability|capabilityPlan|MCP|tool(?: name)?)\s*:/i;
@@ -117,8 +118,25 @@ function objectiveFromText(raw) {
   };
 }
 
+// A guardrail is not an intention. "It never ingests", "Never ask which source
+// to export", "It never builds, exports or publishes" all name an action the
+// skill must NOT take — and counting them made a body MORE ambiguous the more
+// carefully its boundaries were written. Three of wiki-sync's five triggers
+// were guardrails, which is what pushed the best-documented skill in the
+// scaffold over the threshold and handed its split to the LLM.
+// objectiveResolver already strips negative guardrails before resolving; the
+// ambiguity count has to agree with it, or the two read the same sentence as
+// opposite things.
 function looksAmbiguous(text) {
-  return (text.match(/(?:^|[.!?]\s+)[A-ZÀ-Ý][^.!?]{0,80}\b(?:export|ingest|build|send|create|delete|sync|publish|diagnos|analyse|constru|envoi|cré|supprim)/gi)?.length ?? 0) > 2;
+  // Count what the resolver will actually resolve, not the raw prose. A second
+  // guardrail regex living here drifted from objectiveResolver's within one
+  // edit: "Check the sources without asking, then export and build." was
+  // dropped by one and kept whole by the other, so the two read the same
+  // sentence as opposite things. Reusing objectiveForResolution makes them
+  // agree by construction — there is one definition of "this clause is a
+  // constraint, not an intention", and it lives with the resolver.
+  const resolvable = objectiveForResolution(text);
+  return (resolvable.match(/(?:^|[.!?]\s+)[A-ZÀ-Ý][^.!?]{0,80}\b(?:export|ingest|build|send|create|delete|sync|publish|diagnos|analyse|constru|envoi|cré|supprim)/gi)?.length ?? 0) > 2;
 }
 
 function normalizeFallback(value) {

package/src/core/skillCompiler.test.js

@@ -30,12 +30,44 @@ test('validation rejects technical routing details', () => {
   assert.throws(() => validateCompiledObjectives([{ text: 'agent: cme' }]), { code: 'skill_compile_failed' });
 });
 
-test('every shipped scaffold skill compiles to a single intention', async () => {
+test('every shipped scaffold skill compiles to a single intention, deterministically', async () => {
   const expected = { pipeline: 1, 'wiki-sync': 1, 'wiki-ingest': 1, 'wiki-build': 1, deliver: 1, diagnose: 1, status: 1, 'new-template': 1 };
+  // Passing no llmFallback used to make this test assert the one path
+  // production never takes: an ambiguous body silently returns the safe
+  // mono-intention fallback, so the count was 1 and the test was green while
+  // production called the LLM and got 3. A shipped skill reaching the LLM
+  // splitter is a build-time defect, not a runtime coin flip — so the fallback
+  // here throws, and the deterministic pass must never need it.
+  const llmFallback = () => { throw new Error('a shipped skill must not need the LLM splitter'); };
   for (const [name, count] of Object.entries(expected)) {
     const raw = readFileSync(resolve('../llm-wiki/scaffold/workspace/.wiki/skills', `${name}.md`), 'utf8');
     const { meta, body } = parseFrontmatter(raw);
-    assert.equal((await compileSkillObjectives({ ...meta, body })).length, count, name);
+    assert.equal(deterministicObjectives(body).ambiguous, false, `${name} is ambiguous for the deterministic pass`);
+    assert.equal((await compileSkillObjectives({ ...meta, body }, {}, { llmFallback })).length, count, name);
+  }
+});
+
+test('every orchestrated scaffold skill declares the capability it targets', () => {
+  // Without a declaration the capability is inferred from the body's prose by
+  // alias matching, which any runtime added to agent-runtimes.json can break by
+  // declaring a bare English word as an alias. Declared, the run is routed by
+  // registry lookup and no text is matched at all.
+  // Only the skills whose declaration is actually APPLIED, and only where the
+  // target agent accepts it. The list is deliberately short:
+  // - parameterised skills are dropped by skillRun (the capabilityPlan route
+  //   skips the argument extraction a selector like <template> needs);
+  // - pipeline keeps text resolution until an E2E test can assert its agent
+  //   still plans its own DAG;
+  // - diagnose declared `workspace.diagnose/doctor` and BROKE: agent_plan's
+  //   operation allow-list has no `doctor`, so the plan was refused, the
+  //   refusal swallowed, and the run reported done without diagnosing
+  //   anything. Declaring a capability the executor cannot plan is worse than
+  //   not declaring one.
+  const orchestrated = ['wiki-sync'];
+  for (const name of orchestrated) {
+    const raw = readFileSync(resolve('../llm-wiki/scaffold/workspace/.wiki/skills', `${name}.md`), 'utf8');
+    const { meta } = parseFrontmatter(raw);
+    assert.match(String(meta.capability ?? ''), /^[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9_-]*)+$/, `${name} declares no capability`);
   }
 });
 

package/src/core/skills.js

@@ -5,6 +5,8 @@ const SKILL_NAME_RE = /^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/;
 const SKILL_PARAM_RE = /^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/;
 const DANGEROUS_PARAM_NAMES = new Set(['__proto__', 'prototype', 'constructor']);
 const DEFAULT_UI_SKILL_DIR = '.wiki/skills';
+const SKILL_CAPABILITY_RE = /^[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9_-]*)+$/;
+const SKILL_OPERATION_RE = /^[a-z][a-z0-9_-]{0,63}$/;
 // The CSI branch must come FIRST. `[` is 0x5B, inside the `[@-_]` range, so the
 // two-character alternative would otherwise consume `ESC [` alone and leave the
 // parameter bytes behind as literal text: "\x1B[31m" would become "31m".
@@ -71,6 +73,30 @@ function inspectSkillFile(filePath, fallbackName, scope, root) {
     return { rejected: { relativePath, name, reason: 'invalid_param' } };
   }
   const description = descriptionMetadata(meta.description);
+  // A skill may DECLARE the capability it targets. Without it, the capability
+  // is inferred from the body's prose by alias matching in objectiveResolver —
+  // which is text-similarity executor selection under another name, the very
+  // thing this repo removed once and must not reintroduce. Worse, the aliases
+  // come from `agent-runtimes.json`, user-editable config: adding any runtime
+  // whose alias is a bare English word ("report", "check") makes two aliases
+  // hit at once, and `aliasHits.length > 1` abandons the deterministic path for
+  // the LLM resolver — silently, for every shipped skill at once.
+  //
+  // Declaring it in FRONTMATTER, never in the body, keeps both rules intact:
+  // the body stays a business intention naming no agent, tool or server
+  // (skillCompiler's FORBIDDEN_FIELDS still enforces that), while routing
+  // targets a capability — the same abstraction plans already target.
+  const capability = String(meta.capability || '').trim();
+  if (capability && !SKILL_CAPABILITY_RE.test(capability)) {
+    return { rejected: { relativePath, name, reason: 'invalid_capability' } };
+  }
+  const operation = String(meta.operation || '').trim();
+  if (operation && !SKILL_OPERATION_RE.test(operation)) {
+    return { rejected: { relativePath, name, reason: 'invalid_operation' } };
+  }
+  if (operation && !capability) {
+    return { rejected: { relativePath, name, reason: 'operation_without_capability' } };
+  }
   const execution = String(meta.execution || 'orchestrated').trim().toLowerCase();
   if (!['orchestrated', 'direct'].includes(execution)) {
     return { rejected: { relativePath, name, reason: 'invalid_execution' } };
@@ -83,6 +109,8 @@ function inspectSkillFile(filePath, fallbackName, scope, root) {
     execution,
     scope,
     path: filePath,
+    ...(capability ? { capability } : {}),
+    ...(operation ? { operation } : {}),
   };
   const warnings = [];
   if (description.missing) warnings.push({ relativePath, name, reason: 'missing_description' });

package/src/core/workflow.js

@@ -38,7 +38,22 @@ export function projectWorkflow(state = {}, events = []) {
   const approvalNodes = approvals.map(approvalNode);
   nodes.push(...planNodes, ...activityNodes, ...queueNodes, ...approvalNodes);
 
-  for (const node of [...planNodes, ...activityNodes, ...queueNodes, ...approvalNodes]) {
+  // The external runtime's collective (lot 2): each named subagent becomes a
+  // child node of the run node, so the Canvas shows the run's internal
+  // timeline instead of burying the roles in log lines.
+  const subagentNodes = (Array.isArray(state.subagents) ? state.subagents : [])
+    .map((entry, index) => ({
+      id: `subagent:${String(entry.subagent ?? 'subagent')}:${index}`,
+      type: 'subagent',
+      label: String(entry.subagent ?? 'subagent'),
+      status: entry.status === 'done' ? 'done' : 'running',
+      startedAt: entry.startedAt ?? null,
+      finishedAt: entry.finishedAt ?? null,
+      subagent: String(entry.subagent ?? 'subagent'),
+    }));
+  nodes.push(...subagentNodes);
+
+  for (const node of [...planNodes, ...activityNodes, ...queueNodes, ...approvalNodes, ...subagentNodes]) {
     if (run) relations.push({ type: 'contains', from: run.id, to: node.id });
   }
 
@@ -191,6 +206,15 @@ function metricNumber(value) {
   return Number.isFinite(number) && number >= 0 ? number : null;
 }
 
+
+// The Plan panel names a run; it does not reproduce it. One line, bounded.
+const RUN_LABEL_MAX = 80;
+function runLabel(value) {
+  const text = String(value ?? '').replace(/\s+/g, ' ').trim();
+  if (!text) return 'Runtime run';
+  return text.length > RUN_LABEL_MAX ? `${text.slice(0, RUN_LABEL_MAX - 1)}…` : text;
+}
+
 function currentRun(state, events) {
   const runId = state.runId ?? state.runs?.find((run) => isActiveStatus(run.status))?.id ?? events.findLast?.((event) => event.runId)?.runId ?? null;
   if (!runId && !state.status) return null;
@@ -198,7 +222,12 @@ function currentRun(state, events) {
     id: runId ? `run:${runId}` : 'run:current',
     type: 'run',
     runId,
-    label: state.summary || state.input || 'Runtime run',
+    // A skill run's `input` is the COMPILED objective — the private body's
+    // business intention, often a full paragraph. Printing it whole turned the
+    // Plan panel into a prompt dump, where the reader wanted the run's identity
+    // and its status. Prefer the summary, then the public invocation the
+    // control item already carries, and cap whatever is left.
+    label: runLabel(state.summary || state.publicInput || state.input),
     status: normalizeStatus(state.status ?? 'idle'),
     workspace: state.workspace ?? null,
     startedAt: state.startedAt ?? state.runs?.find((run) => run.id === runId)?.createdAt ?? null,

package/src/core/workflow.test.js

@@ -121,3 +121,34 @@ test('projectWorkflow derives per-task timing (start, finish, duration) from lif
   assert.equal(workflow.timingByTask.ingest.finishedAt, Date.parse('2026-07-23T10:00:12.500Z'));
   assert.equal(workflow.timingByTask.ingest.durationMs, 12500);
 });
+
+test('projectWorkflow renders the collective subagents as child nodes of the run', () => {
+  const workflow = projectWorkflow({
+    status: 'running',
+    runId: 'run-1',
+    workspace: 'docs',
+    plan: [],
+    activities: [],
+    queue: [],
+    approvals: [],
+    subagents: [
+      { subagent: 'scout', status: 'done', startedAt: '2026-09-09T10:00:00.000Z', finishedAt: '2026-09-09T10:00:04.000Z' },
+      { subagent: 'critique', status: 'running', startedAt: '2026-09-09T10:00:05.000Z' },
+    ],
+  });
+
+  const subagentNodes = workflow.nodes.filter((node) => node.type === 'subagent');
+  assert.equal(subagentNodes.length, 2);
+  assert.equal(subagentNodes[0].label, 'scout');
+  assert.equal(subagentNodes[0].status, 'done');
+  assert.equal(subagentNodes[1].label, 'critique');
+  assert.equal(subagentNodes[1].status, 'running');
+
+  const run = workflow.nodes.find((node) => node.type === 'run');
+  for (const node of subagentNodes) {
+    assert.ok(
+      workflow.relations.some((rel) => rel.type === 'contains' && rel.from === run.id && rel.to === node.id),
+      `${node.label} hangs off the run node`,
+    );
+  }
+});

package/src/orchestrator/dispatcher.js

@@ -2,12 +2,24 @@ import { normalizeActivity, parseJsonText } from '../core/activity.js';
 import { createAgentEvent, dispatchAgentEvent } from '../core/agentEvents.js';
 import { callMcpTool, formatMcpToolResult } from '../core/mcp.js';
 import { loadWorkspaceProfile } from '../core/profile.js';
+import { containerReachableUrl } from '../core/wikiSetup.js';
 import { mapRuntimeEvent } from '../core/runtimeEventAdapter.js';
 import { emitRuntimeLog, pollActivitiesOnce } from '../runtime/supervisor.js';
 import { APPROVAL_DEFAULT_CLASS, approvalCovered } from './approvalPolicy.js';
 import { isSuccessful, isTerminal } from './taskStatuses.js';
 
 
+// Distinguishes "the manager process is shutting down" from a genuine task
+// cancellation (/run cancel, /stop, /control cancel) on the SAME shared
+// AbortController + signal (server.js's context.currentAbortController) —
+// the dispatcher otherwise cannot tell the two apart, and calling agent_cancel
+// on a shutdown-abort was cancelling a still-healthy job the very recovery
+// mechanism (recoveryManager.js's idempotency requeue) exists to reattach to
+// on the next boot. A shutdown must still abort the poll loop — the `finally`
+// block's lock release has to run before the process exits — it must just not
+// tell the agent to give up on real work.
+export const RUNTIME_SHUTDOWN_ABORT_REASON = 'runtime_shutdown';
+
 export function createDispatcher({
   session = null,
   callTool = callMcpTool,
@@ -66,7 +78,7 @@ export async function execute(task, assignment, {
       session.mcp,
       serverName,
       executeTool,
-      executeRequest(task, session, runId),
+      executeRequest(task, session, runId, assignment),
       signal,
     ));
     if (accepted?.accepted === false || accepted?.ok === false) {
@@ -155,7 +167,7 @@ export async function execute(task, assignment, {
       }
     }
   } catch (error) {
-    if (isAbortError(error) && jobId) {
+    if (isAbortError(error) && jobId && error.reason !== RUNTIME_SHUTDOWN_ABORT_REASON) {
       await callTool(session.mcp, serverName, cancelTool, { jobId }, null).catch(() => null);
     }
     throw error;
@@ -407,7 +419,20 @@ function dispatchExternalRuntimeActivity(session, task, assignment, runtimeRunId
   }));
 }
 
-function executeRequest(task, session, runId) {
+function executeRequest(task, session, runId, assignment) {
+  // The assignment's `capability` field is the capability ID (a string) for
+  // MCP agents; the OBJECT with the inputSchema lives on the registry agent's
+  // description. Resolve it properly — reading inputSchema off the string is
+  // what silently disabled the configPath injection below.
+  const capabilityId = task?.requiredCapability;
+  const capabilityObject = (assignment?.capability && typeof assignment.capability === 'object'
+    ? assignment.capability
+    : null)
+    ?? assignment?.agent?.description?.capabilities?.find(
+      (capability) => String(capability?.id ?? '') === String(capabilityId ?? ''),
+    )
+    ?? null;
+  const schemaProperties = capabilityObject?.inputSchema?.properties ?? {};
   return {
     taskId: String(task.id ?? task.step),
     ...(runId ? { runId: String(runId) } : {}),
@@ -428,6 +453,17 @@ function executeRequest(task, session, runId) {
       // first E2E ingest plan dispatched by the deep agent's
       // planExpansionRequest failed exactly that way, 19 tasks in one batch.
       ...(task.requiresApproval === true ? { confirm: true } : {}),
+      // The ACTIVE profile must reach the job: a task planned without an
+      // explicit configPath (the common case) otherwise runs on the workspace
+      // default .wikirc, so /config use <profile> changes the runtime's own
+      // LLM but silently not the production job's. The dispatcher is the one
+      // place every executor sees — inject the session's current profile when
+      // the capability declares the field and the task did not set one.
+      ...(task.arguments?.configPath === undefined
+        && 'configPath' in schemaProperties
+        && session?.wikirc?.fileName
+        ? { configPath: session.wikirc.fileName }
+        : {}),
     },
     constraints: {
       requireApprovalForMutations: task.requiresApproval === true,
@@ -448,7 +484,7 @@ function workspaceRequest(session) {
 function activeProfileModel(session) {
   const llm = session?.wikircConfig?.llm ?? {};
   const model = {
-    ...(llm.baseUrl ? { baseUrl: String(llm.baseUrl) } : {}),
+    ...(llm.baseUrl ? { baseUrl: containerReachableUrl(String(llm.baseUrl)).url } : {}),
     ...(llm.model ? { model: String(llm.model) } : {}),
     ...(llm.apiKey ? { apiKey: String(llm.apiKey) } : {}),
   };
@@ -521,7 +557,7 @@ export function activeProfileMcp(session) {
       };
       blocks.push({
         name: 'wiki',
-        url: String(wiki.url),
+        url: containerReachableUrl(String(wiki.url)).url,
         ...(Object.keys(headers).length > 0 ? { headers } : {}),
         tools,
       });
@@ -542,7 +578,7 @@ export function activeProfileMcp(session) {
     if (tools.length === 0) continue;
     blocks.push({
       name,
-      url: String(entry.url),
+      url: containerReachableUrl(String(entry.url)).url,
       ...(entry.headers && typeof entry.headers === 'object' ? { headers: entry.headers } : {}),
       tools,
     });
@@ -739,24 +775,25 @@ function taskLogPayload(event, task, assignment, {
 function delay(ms, signal) {
   return new Promise((resolve, reject) => {
     if (signal?.aborted) {
-      reject(abortError());
+      reject(abortError(signal));
       return;
     }
     const timer = setTimeout(resolve, Math.max(0, Number(ms) || 0));
     signal?.addEventListener('abort', () => {
       clearTimeout(timer);
-      reject(abortError());
+      reject(abortError(signal));
     }, { once: true });
   });
 }
 
 function throwIfAborted(signal) {
-  if (signal?.aborted) throw abortError();
+  if (signal?.aborted) throw abortError(signal);
 }
 
-function abortError() {
+function abortError(signal) {
   const error = new Error('Runtime run cancelled.');
   error.name = 'AbortError';
+  error.reason = signal?.reason;
   return error;
 }
 

package/src/orchestrator/dispatcher.test.js

@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
-import { activeProfileMcp, createDispatcher, normalizeTaskError } from './dispatcher.js';
+import { activeProfileMcp, createDispatcher, normalizeTaskError, RUNTIME_SHUTDOWN_ABORT_REASON } from './dispatcher.js';
 
 test('activeProfileMcp forwards only the read-only wiki tools to the external runtime', () => {
   const session = {
@@ -91,6 +91,29 @@ test('activeProfileMcp tolerates namespaced tool names', () => {
   assert.deepEqual(activeProfileMcp(session)[0].tools, ['wiki__wiki_read_page']);
 });
 
+test('activeProfileMcp rewrites loopback URLs for the container the runtime runs in', () => {
+  const session = {
+    mcp: {
+      wiki: {
+        url: 'http://127.0.0.1:3201/mcp', status: 'connected',
+        tools: [{ name: 'wiki_read_page' }],
+      },
+      exa: {
+        url: 'http://localhost:9999/mcp/', status: 'connected', external: true,
+        tools: [{ name: 'web_search_exa' }],
+      },
+      hosted: {
+        url: 'https://mcp.exa.ai/mcp', status: 'connected', external: true,
+        tools: [{ name: 'web_search_exa' }],
+      },
+    },
+  };
+  const pool = activeProfileMcp(session);
+  assert.equal(pool.find((block) => block.name === 'wiki').url, 'http://host.docker.internal:3201/mcp');
+  assert.equal(pool.find((block) => block.name === 'exa').url, 'http://host.docker.internal:9999/mcp');
+  assert.equal(pool.find((block) => block.name === 'hosted').url, 'https://mcp.exa.ai/mcp');
+});
+
 test('dispatcher returns a retryable logical failure when agent_execute reports workspace_busy', async () => {
   const session = {
     workspace: 'test',
@@ -203,6 +226,72 @@ test('dispatcher completes when an executor-only agent reports succeeded', async
   assert.equal(result.jobId, 'job-connectors');
 });
 
+test('dispatcher cancels the agent job when genuinely aborted mid-poll', async () => {
+  const session = {
+    workspace: 'test',
+    mcp: { production: { status: 'connected', tools: [{ name: 'agent_execute' }, { name: 'agent_status' }, { name: 'agent_cancel' }] } },
+    activities: {},
+  };
+  const calledTools = [];
+  const dispatcher = createDispatcher({
+    session,
+    pollIntervalMs: 5,
+    callTool: async (_mcp, _server, tool) => {
+      calledTools.push(tool);
+      if (tool === 'agent_execute') return { accepted: true, jobId: 'job-1', status: 'queued' };
+      if (tool === 'agent_cancel') return { ok: true };
+      // agent_status: never terminal, forces the poll loop to keep waiting
+      // until the abort fires.
+      return { jobId: 'job-1', status: 'running' };
+    },
+  });
+  const controller = new AbortController();
+  setTimeout(() => controller.abort(), 10);
+
+  await assert.rejects(
+    dispatcher.execute(
+      { id: 'analyze-doc', label: 'Analyze doc', requiredCapability: 'knowledge.update', operation: 'ingest_plan', arguments: {} },
+      { serverName: 'production', agentInstanceId: 'production-main' },
+      { attempt: { attemptId: 'analyze-doc:attempt-1', locks: [], release() {} }, signal: controller.signal },
+    ),
+  );
+  assert.ok(calledTools.includes('agent_cancel'), 'a genuine cancel/abort must still cancel the agent job');
+});
+
+test('dispatcher does NOT cancel the agent job when the manager is only shutting down', async () => {
+  // The exact scenario that caused a real incident: restarting the runtime
+  // mid-ingest orphaned in-flight sources because this path cancelled their
+  // still-healthy jobs instead of leaving them for recoveryManager.js's
+  // idempotency requeue to reattach to on the next boot.
+  const session = {
+    workspace: 'test',
+    mcp: { production: { status: 'connected', tools: [{ name: 'agent_execute' }, { name: 'agent_status' }, { name: 'agent_cancel' }] } },
+    activities: {},
+  };
+  const calledTools = [];
+  const dispatcher = createDispatcher({
+    session,
+    pollIntervalMs: 5,
+    callTool: async (_mcp, _server, tool) => {
+      calledTools.push(tool);
+      if (tool === 'agent_execute') return { accepted: true, jobId: 'job-2', status: 'queued' };
+      if (tool === 'agent_cancel') return { ok: true };
+      return { jobId: 'job-2', status: 'running' };
+    },
+  });
+  const controller = new AbortController();
+  setTimeout(() => controller.abort(RUNTIME_SHUTDOWN_ABORT_REASON), 10);
+
+  await assert.rejects(
+    dispatcher.execute(
+      { id: 'analyze-doc', label: 'Analyze doc', requiredCapability: 'knowledge.update', operation: 'ingest_plan', arguments: {} },
+      { serverName: 'production', agentInstanceId: 'production-main' },
+      { attempt: { attemptId: 'analyze-doc:attempt-1', locks: [], release() {} }, signal: controller.signal },
+    ),
+  );
+  assert.ok(!calledTools.includes('agent_cancel'), 'a shutdown-reason abort must leave the still-healthy agent job running');
+});
+
 test('dispatcher normalizes a bare string error reported on a terminal agent_status', async () => {
   const session = {
     workspace: 'test',

package/src/orchestrator/providers/dispatcherExternalRuntime.test.js

@@ -298,7 +298,7 @@ test('dispatcher sends the active profile model with the run', async () => {
   assert.equal(requests[0].language, 'fr', 'the workspace language travels with the run');
   assert.deepEqual(requests[0].mcp, [{
     name: 'wiki',
-    url: 'http://localhost:3335/mcp/',
+    url: 'http://host.docker.internal:3335/mcp',
     headers: { Authorization: 'Bearer wiki-token' },
     tools: ['wiki_search_context', 'wiki_read_page'],
   }], 'the wiki MCP travels per run, read tools only — write tools never leave');
@@ -378,7 +378,7 @@ test('dispatcher sends the active profile model with the run', async () => {
   );
 
   assert.equal(received[0].model.model, 'openai/gpt-test');
-  assert.equal(received[0].model.baseUrl, 'http://127.0.0.1:9/v1');
+  assert.equal(received[0].model.baseUrl, 'http://host.docker.internal:9/v1');
   assert.equal(received[0].model.apiKey, 'k');
   assert.equal(received[0].model.temperature, 0.2);
 });

package/src/orchestrator/providers/runtimeProviders.test.js

@@ -157,8 +157,10 @@ test('resolveRuntimeProviders maps enabled entries and skips unknown types', ()
 test('loadAgentRuntimesConfig reads both array and object forms', () => {
   const dir = mkdtempSync(join(tmpdir(), 'agent-runtimes-'));
   try {
+    // env: {} — the machine's manager .env (GATEWAY_ENABLED) must not leak
+    // into this parse-shape test through the implied-gateway path.
     writeFileSync(join(dir, 'agent-runtimes.json'), JSON.stringify({ runtimes: [{ id: 'a', type: 'fake' }] }));
-    assert.deepEqual(loadAgentRuntimesConfig({ stateDir: dir }), [{ id: 'a', type: 'fake' }]);
+    assert.deepEqual(loadAgentRuntimesConfig({ stateDir: dir, env: {} }), [{ id: 'a', type: 'fake' }]);
   } finally {
     rmSync(dir, { recursive: true, force: true });
   }

package/src/orchestrator/resultAggregator.js

@@ -1,3 +1,5 @@
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { validateContract } from '../contracts/schemas.js';
 import { parseJsonText } from '../core/activity.js';
 import { createAgentEvent, dispatchAgentEvent } from '../core/agentEvents.js';
@@ -63,6 +65,26 @@ export async function accept(result, {
     taskId,
     payload,
   })));
+  // A worktree proposal is a review item, not a log line: persist it into the
+  // workspace review queue (.wiki/agent-proposals/) where the served review
+  // surface reads it, and announce it — a proposal nobody is told about is a
+  // proposal nobody merges, and a merge is the approval.
+  const worktreePersisted = persistWorktreeProposal(session, result, { runId, taskId, ok, status });
+  if (worktreePersisted.error) {
+    persistDispatch(store, dispatchAgentEvent(session, createAgentEvent('runtime_log', {
+      origin: 'result_aggregator',
+      runId,
+      taskId,
+      payload: { message: `agent-proposal: could not persist the worktree proposal for ${taskId}: ${worktreePersisted.error}` },
+    })));
+  } else if (worktreePersisted.path) {
+    persistDispatch(store, dispatchAgentEvent(session, createAgentEvent('runtime_log', {
+      origin: 'result_aggregator',
+      runId,
+      taskId,
+      payload: { message: `agent-proposal: ${taskId} is waiting for review — ${worktreePersisted.path}` },
+    })));
+  }
   persistDispatch(store, dispatchAgentEvent(session, createAgentEvent('plan_step_updated', {
     origin: 'result_aggregator',
     runId,
@@ -227,6 +249,51 @@ function persistDispatch(store, event) {
   store?.persistEvent?.(event);
 }
 
+/**
+ * Worktree proposals (agent.curate): the external runtime's run result carries
+ * `worktreeProposal` — the confined branch's changed files, their new content
+ * and the unified diff. The manager writes it into the workspace review queue
+ * (`.wiki/agent-proposals/<id>.json`, gitignored state) where the served
+ * review surface reads it; the MERGE happens there, through the engine's own
+ * write machinery — this function only records, it never touches wiki content.
+ */
+function persistWorktreeProposal(session, result, { runId, taskId }) {
+  const proposal = result?.result?.worktreeProposal ?? result?.worktreeProposal;
+  if (!proposal || typeof proposal !== 'object') return { path: null };
+  const changes = Array.isArray(proposal.changes) ? proposal.changes : [];
+  if (changes.length === 0) return { path: null };
+  const workspacePath = session?.workspacePath;
+  if (!workspacePath || typeof workspacePath !== 'string') {
+    return { error: 'no workspace path on the session — the proposal stays in the run result only' };
+  }
+  const record = {
+    id: String(taskId),
+    runId: String(runId ?? ''),
+    workspace: String(proposal.workspace ?? session.workspace ?? ''),
+    branch: String(proposal.branch ?? ''),
+    worktreePath: String(proposal.worktreePath ?? ''),
+    worktreeRelativePath: String(proposal.worktreeRelativePath ?? ''),
+    createdAt: new Date().toISOString(),
+    justification: String(proposal.justification ?? ''),
+    ...(Array.isArray(proposal.objections) && proposal.objections.length > 0
+      ? { objections: proposal.objections }
+      : {}),
+    changedFiles: Array.isArray(proposal.changedFiles) ? proposal.changedFiles : [],
+    changes,
+    diff: String(proposal.diff ?? ''),
+  };
+  try {
+    const safeId = String(taskId).replace(/[^a-zA-Z0-9._-]/g, '_');
+    const dir = join(workspacePath, '.wiki', 'agent-proposals');
+    mkdirSync(dir, { recursive: true });
+    const path = join(dir, `${safeId}.json`);
+    writeFileSync(path, JSON.stringify(record, null, 2));
+    return { path };
+  } catch (error) {
+    return { error: error instanceof Error ? error.message : String(error) };
+  }
+}
+
 function agentPlanRequest(request, session) {
   return {
     capability: request.capability,