@dotdrelle/wiki-manager 0.15.93 → 0.15.96

package/src/runtime/loginSession.test.js

@@ -0,0 +1,143 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { totpCode } from './totp.js';
+import {
+  enrollment,
+  isTotpEnabled,
+  issueSessionWithTotp,
+  loginAttemptAllowed,
+  loginStatus,
+  resetTotpEnrollment,
+  revokeSession,
+  SESSION_TTL_MS,
+  verifySessionToken,
+} from './loginSession.js';
+
+// Each test gets a fresh in-memory enrollment and a fresh state dir.
+function freshStateDir() {
+  const dir = mkdtempSync(join(tmpdir(), 'login-session-'));
+  process.env.WIKI_MANAGER_STATE_DIR = dir;
+  return dir;
+}
+
+test.afterEach(() => {
+  const dir = process.env.WIKI_MANAGER_STATE_DIR;
+  if (dir && dir.startsWith(tmpdir())) rmSync(dir, { recursive: true, force: true });
+  delete process.env.WIKI_MANAGER_STATE_DIR;
+});
+
+test('enrollment publishes a secret and URI, then the first code persists it', () => {
+  freshStateDir();
+  const before = enrollment();
+  assert.ok(before.secret.match(/^[A-Z2-7]{32}$/));
+  assert.ok(before.uri.startsWith('otpauth://totp/'));
+  assert.equal(loginStatus().enrolled, false);
+
+  // The SAME pending secret is shown again (the page reloads, not re-rolls).
+  assert.equal(enrollment().secret, before.secret);
+
+  const result = issueSessionWithTotp(totpCode(before.secret));
+  assert.equal(result.ok, true);
+  assert.equal(result.enrolled, true);
+  assert.ok(result.token.length >= 32);
+  assert.equal(loginStatus().enrolled, true);
+  assert.equal(enrollment(), null);
+});
+
+test('a wrong code never enrolls and never issues a session', () => {
+  freshStateDir();
+  const pending = enrollment();
+  const wrong = totpCode(pending.secret) === '000000' ? '111111' : '000000';
+  const result = issueSessionWithTotp(wrong);
+  assert.equal(result.ok, false);
+  assert.equal(result.error, 'invalid_code');
+  assert.equal(loginStatus().enrolled, false);
+});
+
+test('enrollment is refused from a non-loopback address', () => {
+  freshStateDir();
+  const pending = enrollment();
+  const result = issueSessionWithTotp(totpCode(pending.secret), { remoteAddress: '192.168.1.10' });
+  assert.equal(result.ok, false);
+  assert.equal(result.error, 'enrollment_requires_loopback');
+  // From loopback the same code succeeds.
+  const ok = issueSessionWithTotp(totpCode(pending.secret), { remoteAddress: '127.0.0.1' });
+  assert.equal(ok.ok, true);
+});
+
+test('a verified session slides instead of expiring', () => {
+  freshStateDir();
+  const pending = enrollment();
+  const issued = issueSessionWithTotp(totpCode(pending.secret));
+  assert.ok(issued.token);
+
+  // Right after issue: valid.
+  assert.equal(verifySessionToken(issued.token).ok, true);
+  // Near the end of the TTL: still valid, and the slide pushes expiry forward.
+  const late = issued.expiresAt - 1;
+  const check = verifySessionToken(issued.token, { timestamp: late });
+  assert.equal(check.ok, true);
+  assert.ok(check.expiresAt > issued.expiresAt);
+  // Past the NEW expiry the token is refused.
+  const past = check.expiresAt + 1;
+  assert.equal(verifySessionToken(issued.token, { timestamp: past, renew: false }).ok, false);
+});
+
+test('an unknown token is refused and revocation invalidates the real one', () => {
+  freshStateDir();
+  const pending = enrollment();
+  const issued = issueSessionWithTotp(totpCode(pending.secret));
+
+  assert.equal(verifySessionToken('nope').ok, false);
+  assert.equal(revokeSession(issued.token), true);
+  assert.equal(verifySessionToken(issued.token).ok, false);
+  assert.equal(loginStatus().sessionActive, false);
+  // Revoking twice is a no-op, not an error.
+  assert.equal(revokeSession(issued.token), false);
+});
+
+test('resetTotpEnrollment wipes the secret and the session for re-enrollment', () => {
+  freshStateDir();
+  const pending = enrollment();
+  const issued = issueSessionWithTotp(totpCode(pending.secret));
+  assert.equal(loginStatus().enrolled, true);
+  assert.equal(loginStatus().sessionActive, true);
+
+  resetTotpEnrollment();
+
+  const status = loginStatus();
+  assert.equal(status.enrolled, false);
+  assert.equal(status.sessionActive, false);
+  assert.equal(verifySessionToken(issued.token).ok, false);
+  // A fresh enrollment secret is generated for the next page.
+  const fresh = enrollment();
+  assert.ok(fresh.secret);
+  assert.notEqual(fresh.secret, pending.secret);
+});
+
+test('login attempts are rate-limited per address', () => {
+  for (let index = 0; index < 10; index++) {
+    const allowed = loginAttemptAllowed('127.0.0.1');
+    assert.equal(allowed.ok, true, `attempt ${index}`);
+  }
+  const refused = loginAttemptAllowed('127.0.0.1');
+  assert.equal(refused.ok, false);
+  assert.ok(refused.retryAfterSeconds > 0);
+  // Another address is unaffected.
+  assert.equal(loginAttemptAllowed('10.0.0.2').ok, true);
+});
+
+test('TOTP can be disabled from the environment', () => {
+  freshStateDir();
+  process.env.WIKI_MANAGER_TOTP = 'off';
+  assert.equal(isTotpEnabled(), false);
+  assert.equal(enrollment(), null);
+  delete process.env.WIKI_MANAGER_TOTP;
+});
+
+test('the default session TTL is 12 hours', () => {
+  assert.equal(SESSION_TTL_MS, 12 * 60 * 60 * 1000);
+});

package/src/runtime/qrCode.js

@@ -0,0 +1,15 @@
+import qrcodeGenerator from './vendor/qrcode.cjs';
+
+/*
+ Thin wrapper over the vendored MIT qrcode-generator (Kazuhiko Arase, 2009 —
+ see vendor/qrcode.cjs header). The login page renders the enrollment QR as a
+ responsive SVG; the otpauth:// URI is ASCII-only, so the generator's default
+ latin-1 byte conversion is sufficient.
+ */
+
+export function qrSvg(content, { cellSize = 4, margin = 8 } = {}) {
+  const qr = qrcodeGenerator(0, 'M');
+  qr.addData(String(content), 'Byte');
+  qr.make();
+  return qr.createSvgTag({ cellSize, margin, scalable: true, alt: { text: 'QR code' } });
+}

package/src/runtime/runner.js

@@ -63,7 +63,12 @@ export function conversationSeed(session, currentInput, { limit = 12, maxChars =
   const conversation = Array.isArray(session.agentProjection?.conversation)
     ? session.agentProjection.conversation
     : [];
+  // Everything before the last compact (conversation_reset) is forgotten for
+  // grounding, while it stays visible in the displayed thread. The boundary is
+  // an index into the same array, so no message is actually removed.
+  const seedStart = Math.max(0, Number(session.agentProjection?.conversationSeedStart) || 0);
   const seed = conversation
+    .slice(seedStart)
     .filter((message) => ['user', 'assistant'].includes(message?.role) && String(message?.content ?? '').trim())
     .slice(-limit)
     .map((message) => ({ role: message.role, content: String(message.content).slice(0, maxChars) }));
@@ -71,6 +76,13 @@ export function conversationSeed(session, currentInput, { limit = 12, maxChars =
   // drop it from the seed to avoid sending it twice.
   const last = seed.at(-1);
   if (last && last.role === 'user' && last.content === String(currentInput ?? '').slice(0, maxChars)) seed.pop();
+  // A compact does not just cut the older turns — it replaces them with a
+  // short summary (see /conversation/compact), so what was agreed there is
+  // not lost to the grounding window entirely, only condensed.
+  const summary = String(session.agentProjection?.conversationSummary ?? '').trim();
+  if (summary) {
+    seed.unshift({ role: 'user', content: `[Summary of earlier conversation, compacted]\n${summary.slice(0, maxChars)}` });
+  }
   return seed;
 }
 
@@ -291,12 +303,13 @@ export async function runRuntimeAgenticWorkflow(agent, session, input, {
 // instead of the client streaming a per-job line for every task. Uses the
 // workspace LLM to phrase it, degrading to a plain templated fact line if the
 // LLM is unavailable or errors — the run must never block on this summary.
-async function announceRunOutcome(session, { runId, ok, signal = null } = {}) {
+export async function announceRunOutcome(session, { runId, ok, signal = null } = {}) {
   const plan = Array.isArray(session.headlessPlan) ? session.headlessPlan : [];
   if (plan.length === 0) return;
   let failed = 0;
   let cancelled = 0;
   let completed = 0;
+  let pending = 0;
   let firstError = null;
   for (const step of plan) {
     const status = String(step?.status ?? '').toLowerCase();
@@ -310,12 +323,24 @@ async function announceRunOutcome(session, { runId, ok, signal = null } = {}) {
       cancelled += 1;
     } else if (isSuccessful(status)) {
       completed += 1;
+    } else if (isPending(status) || !isTerminal(status)) {
+      // pending_approval, waiting_approval, running, unknown: the work has NOT
+      // happened. Counting these as neither success nor failure is what made a
+      // run that had only *planned* its mutations announce a success (LLM
+      // rephrasing "0/N réussie" into "le livrable a bien été publié") before
+      // the approval that would actually run it.
+      pending += 1;
     }
   }
   const total = plan.length;
-  const factLine = ok && failed === 0
+  const finished = ok && failed === 0 && cancelled === 0 && pending === 0 && completed === total;
+  const factLine = finished
     ? `Plan terminé avec succès — ${completed}/${total} tâche(s) réussie(s).`
-    : `Plan terminé en erreur — ${completed}/${total} tâche(s) réussie(s), ${failed} en erreur${cancelled ? `, ${cancelled} annulée(s)` : ''}.${firstError ? ` Première erreur : ${firstError}.` : ''}`;
+    : `Plan non terminé — ${completed}/${total} tâche(s) réussie(s)` +
+      `${pending ? `, ${pending} en attente (approbation ou exécution)` : ''}` +
+      `${failed ? `, ${failed} en erreur` : ''}` +
+      `${cancelled ? `, ${cancelled} annulée(s)` : ''}.` +
+      `${firstError ? ` Première erreur : ${firstError}.` : ''}`;
   let content = factLine;
   const llm = session.llm;
   if (llm && typeof llm.completeWithTools === 'function') {
@@ -325,6 +350,7 @@ async function announceRunOutcome(session, { runId, ok, signal = null } = {}) {
           'You are Donna, an orchestration assistant reporting a run result to the user.',
           'Rephrase the outcome facts in ONE short, natural sentence, in the same language as the facts.',
           'No lists, no headers, no raw job ids — just a concise human summary.',
+          'If the facts say the plan is NOT finished, say so plainly and name what is still pending or failed: never claim the work was completed, published or successful.',
         ].join('\n'),
         tools: [],
         messages: [{ role: 'user', content: `Run outcome facts:\n${factLine}` }],

package/src/runtime/runner.test.js

@@ -4,7 +4,7 @@ import { createAgentEvent, dispatchAgentEvent, reduceAgentEvents } from '../core
 import { tasksAwaitingApproval } from '../orchestrator/dependencyResolver.js';
 import { isTerminal } from '../orchestrator/taskStatuses.js';
 import { readyPlanTasks } from '../core/planPatch.js';
-import { skipImpossibleTasks, structuredPlanEvaluation, ensurePlanProjection, evaluateRuntimeRun, finishRuntimeRun, materializeTaskInputs, replanRuntimeRun, runRuntimeAgenticWorkflow, runRuntimeParallelPlan, shouldUseParallelScheduler } from './runner.js';
+import { skipImpossibleTasks, structuredPlanEvaluation, ensurePlanProjection, evaluateRuntimeRun, finishRuntimeRun, materializeTaskInputs, replanRuntimeRun, runRuntimeAgenticWorkflow, runRuntimeParallelPlan, shouldUseParallelScheduler, announceRunOutcome } from './runner.js';
 
 test('ensurePlanProjection re-projects when the chained plan changes shape (step 2)', () => {
   const session = { agentEvents: [], agentProjection: null };
@@ -1103,6 +1103,64 @@ test('runtime runs are seeded with the chat that preceded them', async () => {
   assert.equal(clipped[0].content.length, 2000);
 });
 
+test('a compact boundary hides the prior exchanges from the seed but keeps them in the conversation', async () => {
+  const { conversationSeed } = await import('./runner.js');
+  const session = {
+    agentProjection: {
+      conversation: [
+        { role: 'user', content: 'avant 1' },
+        { role: 'assistant', content: 'avant 2' },
+        { role: 'user', content: 'après 1' },
+        { role: 'assistant', content: 'après 2' },
+      ],
+      conversationSeedStart: 2,
+    },
+  };
+  const seed = conversationSeed(session, 'nouvelle question');
+  assert.deepEqual(seed, [
+    { role: 'user', content: 'après 1' },
+    { role: 'assistant', content: 'après 2' },
+  ]);
+  // The pre-compact exchange is gone from the grounding…
+  assert.equal(seed.some((message) => /avant/.test(message.content)), false);
+  // …but it stays in the displayed conversation.
+  assert.equal(session.agentProjection.conversation.length, 4);
+});
+
+test('a stored compact summary is prepended to the seed, ahead of the recent exchanges', async () => {
+  const { conversationSeed } = await import('./runner.js');
+  const session = {
+    agentProjection: {
+      conversation: [
+        { role: 'user', content: 'après 1' },
+        { role: 'assistant', content: 'après 2' },
+      ],
+      conversationSeedStart: 0,
+      conversationSummary: 'Résumé condensé des échanges précédents.',
+    },
+  };
+  const seed = conversationSeed(session, 'nouvelle question');
+  assert.equal(seed.length, 3);
+  assert.equal(seed[0].role, 'user');
+  assert.match(seed[0].content, /Résumé condensé des échanges précédents\./);
+  assert.deepEqual(seed.slice(1), [
+    { role: 'user', content: 'après 1' },
+    { role: 'assistant', content: 'après 2' },
+  ]);
+});
+
+test('no stored summary means no synthetic entry is added to the seed', async () => {
+  const { conversationSeed } = await import('./runner.js');
+  const session = {
+    agentProjection: {
+      conversation: [{ role: 'user', content: 'salut' }],
+      conversationSeedStart: 0,
+    },
+  };
+  const seed = conversationSeed(session, 'autre question');
+  assert.deepEqual(seed, [{ role: 'user', content: 'salut' }]);
+});
+
 test('skipImpossibleTasks propage un échec jusqu’au point fixe', () => {
   /*
    Marquer les seules tâches directement bloquées laissait un résidu : A en
@@ -1230,3 +1288,34 @@ test('rejouer les événements redonne exactement les mêmes statuts', () => {
   );
   assert.deepEqual(replayed.plan.map((step) => step.status), ['failed', 'skipped']);
 });
+
+test('announceRunOutcome never calls a plan with pending tasks a success', async () => {
+  // The outcome summary counted only failed/cancelled/successful, so a run
+  // whose single mutating task was still `pending_approval` produced
+  // "Plan terminé avec succès — 0/1 réussie", which the model rephrased into
+  // "le livrable a bien été publié" — before the approval that would run it.
+  const session = {
+    agentEvents: [],
+    agentProjection: null,
+    headlessPlan: [{ id: 'a', description: 'Build TechSections', status: 'pending_approval' }],
+  };
+  await announceRunOutcome(session, { runId: 'run-1', ok: true });
+  const message = session.agentEvents.find((event) => event.type === 'assistant_message');
+  assert.match(message.payload.content, /non terminé/i);
+  assert.match(message.payload.content, /en attente/);
+  assert.doesNotMatch(message.payload.content, /succès/i);
+});
+
+test('announceRunOutcome reports success only when every task finished', async () => {
+  const session = {
+    agentEvents: [],
+    agentProjection: null,
+    headlessPlan: [
+      { id: 'a', description: 'Build TechSections', status: 'done' },
+      { id: 'b', description: 'Export', status: 'success' },
+    ],
+  };
+  await announceRunOutcome(session, { runId: 'run-2', ok: true });
+  const message = session.agentEvents.find((event) => event.type === 'assistant_message');
+  assert.match(message.payload.content, /succès/);
+});

package/src/runtime/server.js

@@ -15,6 +15,29 @@ import { cancelControlChain, cancelQueuedControlItem } from './controlCancellati
 import { generateSkillAcknowledgment, runSkillChain } from './skillRun.js';
 import { emitRuntimeLog } from './supervisor.js';
 import { findSkill, listSkills } from '../core/skills.js';
+import {
+  enrollment,
+  isLoopbackAddress,
+  isTotpEnabled,
+  issueSessionWithTotp,
+  loginAttemptAllowed,
+  loginStatus,
+  pruneLoginAttempts,
+  resetLoginAttempts,
+  revokeSession,
+  verifySessionToken,
+} from './loginSession.js';
+import { loginPageHtml } from './loginPage.js';
+
+function loginErrorText(code) {
+  const messages = {
+    totp_disabled: 'TOTP login is disabled on this manager.',
+    no_enrollment: 'Enrollment expired. Reload this page.',
+    enrollment_requires_loopback: 'Enrollment must be done from the machine running the manager.',
+    invalid_code: 'Invalid verification code.',
+  };
+  return messages[code] ?? 'Verification failed.';
+}
 
 const PRIVATE_CONTROL_INPUTS = new WeakMap();
 
@@ -75,12 +98,85 @@ export function startRuntimeServer({
 
   const server = createServer(async (request, response) => {
     try {
+      const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);
+
+      // ── TOTP login surface — public by design: it is the door, not a room ──
+      if (url.pathname === '/login' && request.method === 'GET') {
+        const remoteAddress = request.socket?.remoteAddress ?? null;
+        const current = enrollment();
+        const status = loginStatus();
+        if (!status.enabled) {
+          sendHtml(response, 200, loginPageHtml({ error: 'TOTP login is disabled on this manager.' }));
+          return;
+        }
+        if (!status.enrolled && !isLoopbackAddress(remoteAddress)) {
+          sendHtml(response, 403, loginPageHtml({ error: 'Enrollment must be done from the machine running the manager.' }));
+          return;
+        }
+        sendHtml(response, 200, loginPageHtml({
+          enrolled: status.enrolled,
+          secret: current?.secret ?? null,
+          uri: current?.uri ?? null,
+        }));
+        return;
+      }
+      if (url.pathname === '/login/verify' && request.method === 'POST') {
+        const remoteAddress = request.socket?.remoteAddress ?? null;
+        const allowed = loginAttemptAllowed(remoteAddress);
+        if (!allowed.ok) {
+          sendJson(response, 429, { ok: false, error: `Too many attempts. Try again in ${allowed.retryAfterSeconds}s.` });
+          return;
+        }
+        const body = await readJson(request).catch(() => ({}));
+        const result = issueSessionWithTotp(body?.code, { remoteAddress });
+        if (!result.ok) {
+          sendJson(response, 401, { ok: false, error: loginErrorText(result.error) });
+          return;
+        }
+        resetLoginAttempts(remoteAddress);
+        // Hand the session to the browser as a cookie, on the runtime's own
+        // origin. Cookies ignore the port, so a browser that logged in here
+        // (the ShellUI gate) carries the same `wiki_session` to `serve` when
+        // it runs on this host — one TOTP login for both surfaces. serve sets
+        // its own cookie too when a browser reaches it first.
+        setSessionCookie(response, result.token, result.expiresAt, request);
+        sendJson(response, 200, {
+          ok: true,
+          token: result.token,
+          expiresAt: result.expiresAt,
+          page: loginPageHtml({ enrolled: true, sessionExpiresAt: result.expiresAt }),
+        });
+        return;
+      }
+      if (url.pathname === '/login/status' && request.method === 'GET') {
+        sendJson(response, 200, { ok: true, ...loginStatus() });
+        return;
+      }
+      if (url.pathname === '/logout' && request.method === 'POST') {
+        const body = await readJson(request).catch(() => ({}));
+        // revokeSession refuses without the session's own token — this route
+        // sits before the bearer gate by design, so the token itself is the
+        // only proof that the caller is the session being revoked, not an
+        // unauthenticated third party forcing the operator out.
+        const revoked = revokeSession(body?.token ?? null);
+        sendJson(response, 200, { ok: true, revoked });
+        return;
+      }
+      if (request.method === 'GET' && url.pathname === '/session/verify') {
+        // Public on purpose: the token IS the credential being checked — the
+        // caller already holds it, so verifying it leaks nothing beyond what
+        // possession implies. serve and the shell call this without bearer.
+        const sessionToken = String(url.searchParams.get('token') ?? '').trim();
+        const result = verifySessionToken(sessionToken);
+        sendJson(response, 200, { ok: result.ok, ...result });
+        return;
+      }
+
       if (!isAuthorized(request, token)) {
         sendJson(response, 401, { error: 'Unauthorized' });
         return;
       }
 
-      const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);
       if (request.method === 'GET' && url.pathname === '/health') {
         const workspace = workspaceFromUrl(url);
         const context = workspace ? await resolveContext({ workspace }) : null;
@@ -433,6 +529,20 @@ export function startRuntimeServer({
           }
           return;
         }
+        // A run/job status question is answered by the runtime itself, whatever
+        // the mode and whether or not a run is active. Left to the model it
+        // confused the runtime runId with a production job id ("job not
+        // found"); in chat mode it had no runtime status tool at all.
+        if (asksForRunStatus(input)) {
+          const status = controlStatus(context, store);
+          sendJson(response, 200, {
+            accepted: true,
+            kind: 'observe',
+            ...status,
+            explanation: explainControlState(status),
+          });
+          return;
+        }
         if (context.running && !readOnlyChat) {
           // Agent-mode message while a run is active. Classify once: control
           // verbs and new tasks go to the control lane, plain conversation is
@@ -649,6 +759,51 @@ export function startRuntimeServer({
         sendJson(response, 200, { truncated: true, index, removedEvents });
         return;
       }
+      // Compact: a deliberate "forget everything said so far in this
+      // workspace" action (served chat's memory gauge). Unlike
+      // /conversation/truncate above, nothing is deleted from the event log —
+      // the audit trail (GET /audit) stays intact. A single conversation_reset
+      // event is enough: the reducer (core/agentEvents.js) moves the
+      // conversationSeedStart boundary on it, and since executeInteractiveTurn
+      // rebuilds its conversationSeed from a fresh reduceAgentEvents() replay
+      // on every turn, future turns stop seeing anything before this point
+      // while the displayed conversation (and the ShellUI thread) stays whole.
+      if (request.method === 'POST' && url.pathname === '/conversation/compact') {
+        const { workspace, context } = await resolveBodyContext(request, url);
+        if (context?.running) {
+          sendJson(response, 409, { compacted: false, reason: 'run_active' });
+          return;
+        }
+        const resolvedWorkspace = context?.workspace ?? workspace ?? null;
+        if (!resolvedWorkspace) {
+          sendJson(response, 400, { compacted: false, reason: 'workspace_required' });
+          return;
+        }
+        let summary = null;
+        if (context?.session) {
+          const conversation = Array.isArray(context.session.agentProjection?.conversation)
+            ? context.session.agentProjection.conversation
+            : [];
+          const seedStart = Math.max(0, Number(context.session.agentProjection?.conversationSeedStart) || 0);
+          const previousSummary = context.session.agentProjection?.conversationSummary ?? null;
+          // Summarize BEFORE dispatching: the event's payload carries the
+          // result so the reducer only ever has to store a plain string, and
+          // a run cannot start concurrently (already refused with 409 above)
+          // to move conversation.length out from under this read.
+          summary = await summarizeCompactedConversation(context.session, {
+            previousSummary,
+            segment: conversation.slice(seedStart),
+          });
+          dispatchAgentEvent(context.session, createAgentEvent('conversation_reset', {
+            origin: 'user',
+            workspace: resolvedWorkspace,
+            payload: summary ? { summary } : {},
+          }));
+        }
+        publishState(resolvedWorkspace, context);
+        sendJson(response, 200, { compacted: true, summary });
+        return;
+      }
       if (request.method === 'POST' && url.pathname === '/resume') {
         const workspace = workspaceFromUrl(url);
         const result = await resume?.({ workspace });
@@ -681,6 +836,12 @@ export function startRuntimeServer({
     }
   });
 
+  // Housekeeping for the in-memory login-attempt rate limiter: nothing else
+  // ever calls pruneLoginAttempts, so without this the `attempts` Map grows
+  // by one entry per distinct source address for the life of the process.
+  const loginAttemptPruneTimer = setInterval(() => pruneLoginAttempts(), 10 * 60 * 1000);
+  loginAttemptPruneTimer.unref?.();
+
   return new Promise((resolve, reject) => {
     server.once('error', reject);
     server.listen(port, host, () => {
@@ -692,6 +853,7 @@ export function startRuntimeServer({
         publish,
         drainControl: (context) => drainControlQueue(context),
         close: () => new Promise((closeResolve, closeReject) => {
+          clearInterval(loginAttemptPruneTimer);
           for (const client of clients) client.response.end();
           clients.clear();
           server.close((err) => (err ? closeReject(err) : closeResolve()));
@@ -1206,6 +1368,44 @@ async function handleControlMessage(context, store, input, { intent = null, star
  falls back to the deterministic English catalog when no LLM is configured or
  the call fails. The fallback is what keeps the lane deterministic-under-failure.
  */
+const CONVERSATION_SUMMARY_TIMEOUT_MS = 20_000;
+const CONVERSATION_SUMMARY_MAX_INPUT_CHARS = 8_000;
+
+/*
+ A compact does not just cut older turns from conversationSeed — it replaces
+ them with a short rolling summary, so a decision made 20 messages ago is not
+ gone from Donna's grounding entirely, only condensed. Best-effort: no LLM
+ configured, an empty reply, or a call failure all fall back to keeping
+ whatever summary already existed (never worse than before this compact),
+ the same deterministic-under-failure shape as generateControlAcknowledgment.
+ */
+async function summarizeCompactedConversation(session, { previousSummary, segment }) {
+  const llm = session?.llm;
+  const transcript = (Array.isArray(segment) ? segment : [])
+    .filter((message) => ['user', 'assistant'].includes(message?.role) && String(message?.content ?? '').trim())
+    .map((message) => `${message.role === 'user' ? 'User' : 'Assistant'}: ${String(message.content).trim()}`)
+    .join('\n')
+    .slice(0, CONVERSATION_SUMMARY_MAX_INPUT_CHARS);
+  if (!transcript) return previousSummary || null;
+  if (!(llm && typeof llm.complete === 'function')) return previousSummary || null;
+  try {
+    const reply = await llm.complete({
+      system: 'You maintain a compact working memory for Donna, a workspace assistant. You are shown an optional PREVIOUS SUMMARY and a NEW SEGMENT of conversation about to leave the assistant\'s context window. Write ONE updated summary that preserves the facts, decisions, open questions and user preferences that still matter for future turns. Be concise: well under 200 words. Return only the summary text — no preamble, no meta-commentary, no headings.',
+      input: [
+        previousSummary ? `PREVIOUS SUMMARY:\n${previousSummary}` : null,
+        `NEW SEGMENT:\n${transcript}`,
+      ].filter(Boolean).join('\n\n'),
+      signal: AbortSignal.timeout(CONVERSATION_SUMMARY_TIMEOUT_MS),
+    });
+    const text = String(reply ?? '').trim();
+    if (text) return text;
+    emitRuntimeLog(session, 'conversation-compact: LLM returned an empty summary, keeping the previous one');
+  } catch (err) {
+    emitRuntimeLog(session, `conversation-compact: summary LLM call failed, keeping the previous summary — ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return previousSummary || null;
+}
+
 async function generateControlAcknowledgment(session, { kind, input }) {
   const language = String(session?.language ?? '').trim().toLowerCase() || 'en';
   const llm = session?.llm;
@@ -1446,6 +1646,18 @@ function rejectPlanPatch(context, store, patchId, reason) {
   };
 }
 
+// A question about the run/job currently executing. Deliberately narrow — a
+// status word AND a run/job noun — so it never hijacks an ordinary "explain how
+// X works" question. Such a question must be answered by the runtime itself:
+// left to the model, a runtime runId was mistaken for a production job id and
+// reported as "not found", and a read-only chat turn had no runtime status tool.
+function asksForRunStatus(input) {
+  const text = String(input ?? '');
+  const statusWord = /\b(status|statut|progression|progress|avancement|o[uù] en est|o[uù] en sont)\b/i;
+  const runNoun = /\b(job|run|t[aâ]che|task|build|ingest|pipeline|export|polish|traitement)\b/i;
+  return statusWord.test(text) && runNoun.test(text);
+}
+
 // Classifier for the control lane's free-text messages. The classification is
 // LLM-backed: the only deterministic matches left are the runtime's own
 // control verbs (cancel, an explicit "later/queue", status and plan-change
@@ -1482,6 +1694,14 @@ async function classifyControlMessage(input, status, { forcedIntent = null, llm
   if (/\b(o[uù] en es[t-]|status|statut|progress|progression|logs?|explique|explain|inspect|show|montre|quoi de neuf)\b/i.test(lower)) {
     return { kind: 'observe', confidence: 0.86, reason: 'status_or_explanation_request' };
   }
+  // A bare "yes" answers the runtime's own last prompt (the launch
+  // acknowledgement used to end on "check progress or cancel?"). While a run is
+  // active, the only thing the runtime can act on is a status check: treating
+  // the word as ordinary conversation made the read-only chat fallback lecture
+  // the user about switching modes instead of answering.
+  if (status.running && /^\s*(oui|yes|yep|ok|okay|vas[- ]?y|d'accord|daccord|entendu)\b/i.test(lower)) {
+    return { kind: 'observe', confidence: 0.7, reason: 'confirmation_of_runtime_prompt' };
+  }
   if (status.running && /\b(ajoute|add|change|modifie|modify|remplace|replace|retire|remove|skip|ignore|apr[eè]s|before|after|chaque|each|plan|step|t[aâ]che)\b/i.test(lower)) {
     return { kind: 'modify_run', confidence: 0.78, reason: 'active_run_change_request' };
   }
@@ -1549,6 +1769,25 @@ function sendJson(response, statusCode, value) {
   response.end(`${JSON.stringify(value)}\n`);
 }
 
+function sendHtml(response, statusCode, html) {
+  response.writeHead(statusCode, { 'Content-Type': 'text/html; charset=utf-8' });
+  response.end(html);
+}
+
+// Mirrors serve's cookie (same name, flags and lifetime) so one runtime-issued
+// session is also the one serve validates. Secure only when the request
+// already arrived over TLS — a localhost HTTP install must still get the
+// cookie, but a proxied HTTPS one must not leak it.
+function setSessionCookie(response, token, expiresAt, request) {
+  const maxAgeSeconds = Math.max(1, Math.floor((Number(expiresAt) - Date.now()) / 1000));
+  const tls = Boolean(request.socket?.encrypted) || request.headers['x-forwarded-proto'] === 'https';
+  const secure = tls ? '; Secure' : '';
+  response.setHeader(
+    'Set-Cookie',
+    `wiki_session=${encodeURIComponent(token)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAgeSeconds}${secure}`,
+  );
+}
+
 function readRequiredPatchId(body, response) {
   const patchId = String(body.patchId ?? body.id ?? '').trim();
   if (!patchId) {