@dotdrelle/wiki-manager 0.15.97 → 0.15.99

package/src/runtime/controlClassify.test.js

@@ -0,0 +1,31 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { classifyControlMessage } from './server.js';
+
+const running = { running: true };
+
+// A bare "yes" answers the runtime's own last prompt. Anything MORE than a
+// bare yes is a request, and the rule used to be prefix-anchored only: every
+// message merely STARTING on a yes was classified `observe` and answered with
+// a status report, shadowing the modify_run and enqueue_run branches below it.
+test('a bare confirmation during a run is a status check', async () => {
+  for (const input of ['oui', 'OK', 'vas-y', "d'accord", 'yes.', 'entendu !']) {
+    const result = await classifyControlMessage(input, running);
+    assert.equal(result.kind, 'observe', `expected observe for ${JSON.stringify(input)}`);
+  }
+});
+
+test('a plan change that merely opens on a yes is still a plan change', async () => {
+  const result = await classifyControlMessage(
+    'oui, ajoute une étape de polish après le build',
+    running,
+  );
+  assert.equal(result.kind, 'modify_run');
+});
+
+test('a new task that opens on a yes reaches the model classifier, not the status branch', async () => {
+  const result = await classifyControlMessage("vas-y lance l'export", running, {
+    llm: { complete: async () => 'action' },
+  });
+  assert.equal(result.kind, 'enqueue_run');
+});

package/src/runtime/runner.js

@@ -9,7 +9,7 @@ import { createBudgetManager, BudgetExceededError } from '../orchestrator/budget
 import { createDispatcher } from '../orchestrator/dispatcher.js';
 import { approvalCovered, approvalRequestForTask } from '../orchestrator/approvalPolicy.js';
 import { blockedByFailedDependency, tasksAwaitingApproval } from '../orchestrator/dependencyResolver.js';
-import { isFailed, isPending, isSkipped, isSuccessful, isTerminal, isUnknownStatus } from '../orchestrator/taskStatuses.js';
+import { isCancelled, isFailed, isPending, isSkipped, isSuccessful, isTerminal, isUnknownStatus } from '../orchestrator/taskStatuses.js';
 import { assertValidatedFragment } from '../orchestrator/planValidator.js';
 import { createResultAggregator } from '../orchestrator/resultAggregator.js';
 import { describePlanConcurrency, drainActive, startReadyTasks } from '../orchestrator/scheduler.js';
@@ -308,6 +308,7 @@ export async function announceRunOutcome(session, { runId, ok, signal = null } =
   if (plan.length === 0) return;
   let failed = 0;
   let cancelled = 0;
+  let skipped = 0;
   let completed = 0;
   let pending = 0;
   let firstError = null;
@@ -319,8 +320,14 @@ export async function announceRunOutcome(session, { runId, ok, signal = null } =
         step?.error?.message ?? step?.error?.code ?? step?.error
         ?? step?.result?.error?.message ?? step?.result?.error?.code ?? '',
       ).trim() || null;
-    } else if (['cancelled', 'canceled'].includes(status)) {
+    } else if (isCancelled(status)) {
       cancelled += 1;
+    } else if (isSkipped(status)) {
+      // A chain step abandoned because an earlier required one failed. It fell
+      // through every bucket, so a 3-step chain that failed at step 1
+      // announced "0/3 réussie(s), 1 en erreur" and never mentioned the two
+      // steps nobody ran — precisely the silence the announce rule forbids.
+      skipped += 1;
     } else if (isSuccessful(status)) {
       completed += 1;
     } else if (isPending(status) || !isTerminal(status)) {
@@ -333,13 +340,15 @@ export async function announceRunOutcome(session, { runId, ok, signal = null } =
     }
   }
   const total = plan.length;
-  const finished = ok && failed === 0 && cancelled === 0 && pending === 0 && completed === total;
+  const finished = ok && failed === 0 && cancelled === 0 && skipped === 0
+    && pending === 0 && completed === total;
   const factLine = finished
     ? `Plan terminé avec succès — ${completed}/${total} tâche(s) réussie(s).`
     : `Plan non terminé — ${completed}/${total} tâche(s) réussie(s)` +
       `${pending ? `, ${pending} en attente (approbation ou exécution)` : ''}` +
       `${failed ? `, ${failed} en erreur` : ''}` +
-      `${cancelled ? `, ${cancelled} annulée(s)` : ''}.` +
+      `${cancelled ? `, ${cancelled} annulée(s)` : ''}` +
+      `${skipped ? `, ${skipped} abandonnée(s) faute d'une étape précédente` : ''}.` +
       `${firstError ? ` Première erreur : ${firstError}.` : ''}`;
   let content = factLine;
   const llm = session.llm;

package/src/runtime/runner.test.js

@@ -1306,6 +1306,26 @@ test('announceRunOutcome never calls a plan with pending tasks a success', async
   assert.doesNotMatch(message.payload.content, /succès/i);
 });
 
+test('announceRunOutcome names the steps a failed chain abandoned', async () => {
+  // `skipped` fell through every bucket: a 3-step chain failing at step 1
+  // announced "0/3 réussie(s), 1 en erreur" and never mentioned the two steps
+  // nobody ran. "When something is skipped, say so where the panels read."
+  const session = {
+    agentEvents: [],
+    agentProjection: null,
+    headlessPlan: [
+      { id: 'a', description: 'Sync', status: 'failed' },
+      { id: 'b', description: 'Ingest', status: 'skipped' },
+      { id: 'c', description: 'Build', status: 'skipped' },
+    ],
+  };
+  await announceRunOutcome(session, { runId: 'run-3', ok: false });
+  const message = session.agentEvents.find((event) => event.type === 'assistant_message');
+  assert.match(message.payload.content, /non terminé/i);
+  assert.match(message.payload.content, /1 en erreur/);
+  assert.match(message.payload.content, /2 abandonnée\(s\)/);
+});
+
 test('announceRunOutcome reports success only when every task finished', async () => {
   const session = {
     agentEvents: [],

package/src/runtime/server.js

@@ -10,6 +10,21 @@ import { tasksAwaitingApproval } from '../orchestrator/dependencyResolver.js';
 import { isActive, isCancelled, isFailed, isSuccessful } from '../orchestrator/taskStatuses.js';
 import { approvalClassForTask } from '../orchestrator/approvalPolicy.js';
 import { RUNTIME_SHUTDOWN_ABORT_REASON } from '../orchestrator/dispatcher.js';
+import {
+  PROACTIVE_REVIEW_CAPABILITY,
+  buildProactiveReviewObjective,
+  createProactiveReviewScheduler,
+  normalizeProactiveConfig,
+} from '../orchestrator/proactiveReviewScheduler.js';
+import {
+  conflictFingerprint,
+  detectConceptConflicts,
+  detectStaleKnowledge,
+  readConceptLeaves,
+  readSourceRegistry,
+  readWikiPages,
+  staleFingerprint,
+} from '../orchestrator/knowledgeSignals.js';
 import { matchSkillInvocation } from '../core/skillInvocation.js';
 import { reconcileControlQueue } from './controlDrain.js';
 import { cancelControlChain, cancelQueuedControlItem } from './controlCancellation.js';
@@ -74,6 +89,17 @@ export function startRuntimeServer({
   exitOnShutdown = process.env.WIKI_MANAGER_RUNTIME_CHILD === '1',
 } = {}) {
   const clients = new Set();
+  // Deterministic dedup/cooldown/budget for proactive reviews; the run itself
+  // stays the normal control-lane path.
+  const proactiveScheduler = createProactiveReviewScheduler({
+    db: store?.db,
+    pendingReviews: store?.getProjection ? () => (store.getProjection().controlQueue ?? [])
+      .filter((item) => item.proactiveReview && ['queued', 'running'].includes(item.status))
+      .map((item) => item.proactiveReview) : null,
+  });
+  // runId -> the review record that started it, so the slot is released exactly
+  // once when the run reaches a terminal state (persisted or not).
+  const proactiveRuns = new Map();
   // Compiled objectives are private execution material. They deliberately do
   // not enter events, projections, SSE, audit output or the runs table.
   // When this runtime process started — used by ensureRuntime to detect that
@@ -508,6 +534,12 @@ export function startRuntimeServer({
           sendJson(response, 400, { error: 'Missing input.' });
           return;
         }
+        // What the reader actually typed. `input` below may be replaced by a
+        // system fact block for the model; the THREAD must still show the
+        // reader's own words — the replacement was persisted as the
+        // `user_message` and replayed as history on every later turn, which is
+        // exactly the "raw facts never enter the thread" rule it broke.
+        const displayInput = input;
         // Read-only chat turns intentionally remain available while an agent
         // run is active. Other interactive turns still become control
         // messages so they cannot start a competing agent decision.
@@ -603,7 +635,12 @@ export function startRuntimeServer({
               return result.body;
             }
           }
-          return turn(context, { ...body, input, mode: readOnlyChat ? 'chat' : body.mode }, {
+          return turn(context, {
+            ...body,
+            input,
+            displayInput,
+            mode: readOnlyChat ? 'chat' : body.mode,
+          }, {
             signal: controller.signal,
             turnId,
           });
@@ -849,6 +886,26 @@ export function startRuntimeServer({
   const loginAttemptPruneTimer = setInterval(() => pruneLoginAttempts(), 10 * 60 * 1000);
   loginAttemptPruneTimer.unref?.();
 
+  // The corpus clock. `aged` is caused by TIME, and a workspace that stops
+  // ingesting — precisely the one whose knowledge ages — would otherwise never
+  // re-run the detector; conflicts and vanished paths are edit-caused, so the
+  // ingest moment covers them. This tick therefore reads only the source
+  // registry (staleOnly), and the opt-in gating happens inside the scan.
+  const corpusScanMs = Number(process.env.WIKI_MANAGER_CORPUS_SCAN_INTERVAL_MS ?? 15 * 60 * 1000);
+  const corpusScanTimer = Number.isFinite(corpusScanMs) && corpusScanMs > 0
+    ? setInterval(() => {
+      void (async () => {
+        try {
+          const context = await resolvedGetContext(null);
+          if (!context?.session) return;
+          const workspace = context.workspace ?? context.session.workspace ?? null;
+          if (workspace) emitCorpusSignals(context, workspace, { staleOnly: true });
+        } catch { /* a clock tick never breaks the server */ }
+      })();
+    }, corpusScanMs)
+    : null;
+  corpusScanTimer?.unref?.();
+
   return new Promise((resolve, reject) => {
     server.once('error', reject);
     server.listen(port, host, () => {
@@ -861,6 +918,7 @@ export function startRuntimeServer({
         drainControl: (context) => drainControlQueue(context),
         close: () => new Promise((closeResolve, closeReject) => {
           clearInterval(loginAttemptPruneTimer);
+          if (corpusScanTimer) clearInterval(corpusScanTimer);
           for (const client of clients) client.response.end();
           clients.clear();
           server.close((err) => (err ? closeReject(err) : closeResolve()));
@@ -1018,6 +1076,14 @@ export function startRuntimeServer({
         announceControlLaunch(context.session, body.publicInput ?? body.input, runWorkspace);
       }
     }
+    // The trigger hook and the proactive marker belong to THIS run on the
+    // session; the review that opened it is remembered so its concurrency slot
+    // is released exactly once, whatever terminal state it reaches.
+    if (context.session) context.session._onKnowledgeTrigger = (payload) => handleKnowledgeTrigger(context, payload);
+    if (body.proactiveReview) {
+      if (context.session) context.session._proactiveReview = { ...body.proactiveReview, runId };
+      proactiveRuns.set(runId, body.proactiveReview);
+    }
     const runPromise = run(context, runBody, { signal: context.currentAbortController.signal, runId });
     runPromise
       .catch((err) => {
@@ -1028,6 +1094,12 @@ export function startRuntimeServer({
         context.session?._onRuntimeError?.(err, runId);
       })
       .finally(() => {
+        const proactive = proactiveRuns.get(runId);
+        if (proactive) {
+          proactiveRuns.delete(runId);
+          proactiveScheduler.release(proactive.workspace);
+        }
+        if (context.session?._proactiveReview?.runId === runId) context.session._proactiveReview = null;
         context.running = false;
         context.currentAbortController = null;
         context.currentRunId = null;
@@ -1062,6 +1134,7 @@ export function startRuntimeServer({
         // may still grant the pending run explicitly through --auto-approve.
         ...(item.chainId ? { requireApproval: true } : {}),
         ...(item.capabilityPlan !== undefined ? { capabilityPlan: item.capabilityPlan } : {}),
+        ...(item.proactiveReview ? { proactiveReview: item.proactiveReview } : {}),
         ...(item.chainId
           ? {
             skillChain: {
@@ -1082,6 +1155,179 @@ export function startRuntimeServer({
     });
   }
 
+  /*
+   A knowledge fact is not an order: it is an opportunity, and the workspace
+   says (opt-in) whether it wants one. The decision is deterministic — dedup,
+   cooldown, budget, concurrency — and a refusal is said out loud, never a
+   silent no. An accepted trigger queues a read-only `agent.review` through the
+   normal control lane; nothing here mutates, creates a worktree or sends
+   anything.
+  */
+  function handleKnowledgeTrigger(context, payload) {
+    const session = context?.session ?? null;
+    const workspace = String(payload?.workspace ?? context?.workspace ?? '');
+    const trigger = String(payload?.trigger ?? '');
+    // The corpus detectors are reads that only make sense when the corpus just
+    // changed. They feed this same scheduler — never a second one — and cannot
+    // recurse, since a conflict/stale fact does not re-run the detectors.
+    if (trigger === 'knowledge.ingested' || trigger === 'knowledge.rebuilt') {
+      emitCorpusSignals(context, workspace);
+    }
+    const config = session?.wikircConfig?.proactiveReviews ?? null;
+    let decision;
+    try {
+      decision = proactiveScheduler.decide({
+        workspace, trigger, sourceVersion: payload?.sourceVersion ?? null, config,
+      });
+    } catch (error) {
+      emitRuntimeLog(session, `proactive-review: skipped — budget state unavailable: ${error.message}`);
+      return;
+    }
+    if (decision.action !== 'review') {
+      const inFlight = proactiveScheduler.snapshot(workspace).inFlightTrigger;
+      // The conflict detector runs first, so it can take the only slot; saying
+      // so turns an effect of statement order into a stated precedence.
+      const precedence = decision.reason === 'concurrency' && inFlight
+        ? ` — a ${inFlight} review already holds the slot`
+        : '';
+      emitRuntimeLog(
+        session,
+        `proactive-review: skipped (${decision.reason}${precedence}) for ${workspace || 'workspace'} [${trigger}]`,
+      );
+      return;
+    }
+    const evidence = payload?.evidence ?? null;
+    const record = {
+      id: `review-${randomUUID()}`,
+      workspace,
+      trigger,
+      sourceVersion: decision.sourceVersion,
+      createdAt: new Date().toISOString(),
+      budget: proactiveScheduler.snapshot(workspace),
+      // The deterministic facts, so the filed note says WHAT the scan knew —
+      // not only that a review happened. Persisted with the item's marker.
+      ...(evidence ? { evidence } : {}),
+    };
+    const objective = buildProactiveReviewObjective({
+      trigger,
+      sourceVersion: decision.sourceVersion,
+      evidence,
+    });
+    let item;
+    try {
+      item = enqueueControlRequest(context, objective, {
+        publicInput: objective,
+        // Routing is EXPLICIT. The objective names evidence paths, which could
+        // contain another capability's alias (`report`, `plan`, `check`…), and
+        // the free-text resolver returns null on two hits. Naming the
+        // capability removes that risk entirely.
+        capabilityPlan: { capability: PROACTIVE_REVIEW_CAPABILITY, operation: 'run' },
+        proactiveReview: record,
+      });
+    } catch (error) {
+      // A reservation that never became a queued item must be UNDONE: burning a
+      // budget unit and marking the version seen would silently cancel an audit
+      // that was never enqueued.
+      proactiveScheduler.release(workspace, { undo: true, sourceVersion: decision.sourceVersion });
+      emitRuntimeLog(
+        session,
+        `proactive-review: could not queue the review — ${error instanceof Error ? error.message : String(error)}`,
+      );
+      return;
+    }
+    emitRuntimeLog(
+      session,
+      `proactive-review: queued ${item.id} (${trigger}) for ${workspace || 'workspace'} — ${PROACTIVE_REVIEW_CAPABILITY}, read-only`,
+    );
+    void startNextControlRequest(context);
+  }
+
+  /*
+   The live-corpus read: two homonym leaves under one concept folder are a
+   conflict the ingest plan never sees (they are already written). Pure fs +
+   string work, no model. A conflict set is a stable fingerprint, so the same
+   conflict dedups instead of re-firing every time the corpus is touched.
+  */
+  function emitConflictSignal(context, workspace, session, workspacePath) {
+    const { conflicts, total, dropped } = detectConceptConflicts(readConceptLeaves(workspacePath));
+    if (total === 0) return;
+    if (dropped > 0) {
+      emitRuntimeLog(
+        session,
+        `knowledge-signals: ${total} conflict(s) found, ${dropped} beyond the ceiling are not listed (the fingerprint still counts them)`,
+      );
+    }
+    handleKnowledgeTrigger(context, {
+      workspace,
+      trigger: 'knowledge.conflict_detected',
+      // The fingerprint includes the full count, so a conflict beyond the cap
+      // still moves the version and is not deduped away.
+      sourceVersion: conflictFingerprint(conflicts, total),
+      // The exact facts travel to the agent and the filed note.
+      evidence: { kind: 'conflict', items: conflicts },
+    });
+  }
+
+  function emitStaleSignal(context, workspace, session, workspacePath, config) {
+    const { stale, total, dropped, counts } = detectStaleKnowledge(readSourceRegistry(workspacePath), {
+      rootDir: workspacePath,
+      staleAfterDays: config.staleAfterDays,
+      wikiPages: readWikiPages(workspacePath),
+    });
+    if (total === 0) return;
+    if (dropped > 0) {
+      // Counted PER NATURE: the ceiling hides evidence of several kinds, and a
+      // single "N source(s)" would be false for the others.
+      const breakdown = [
+        counts.aged ? `${counts.aged} aged` : null,
+        counts.orphan ? `${counts.orphan} orphan page(s)` : null,
+        counts.vanishedArchive ? `${counts.vanishedArchive} vanished archive(s)` : null,
+        counts.vanishedPage ? `${counts.vanishedPage} vanished page(s)` : null,
+      ].filter(Boolean).join(', ');
+      emitRuntimeLog(
+        session,
+        `knowledge-signals: stale knowledge — ${breakdown}; ${dropped} beyond the ceiling are not listed`,
+      );
+    }
+    handleKnowledgeTrigger(context, {
+      workspace,
+      trigger: 'knowledge.stale',
+      sourceVersion: staleFingerprint(stale, total),
+      evidence: { kind: 'stale', counts, items: stale },
+    });
+  }
+
+  /*
+   The live-corpus read, run when an ingest/rebuild completes AND on the
+   runtime's clock. The clock matters for `aged`: it is caused by TIME, and a
+   workspace that stops ingesting — precisely the one whose knowledge ages —
+   would otherwise never re-run the detector. Conflicts and vanished paths are
+   caused by edits, so the ingest moment is enough for them; `staleOnly` keeps
+   the periodic tick from re-walking every leaf it does not need.
+  */
+  function emitCorpusSignals(context, workspace, { staleOnly = false } = {}) {
+    const session = context?.session ?? null;
+    // Stay OFF the corpus until the workspace actually opted in: reading every
+    // leaf synchronously on the event loop that also serves both chats' SSE is
+    // a cost the default (disabled) must not pay.
+    const config = normalizeProactiveConfig(session?.wikircConfig?.proactiveReviews);
+    if (!config.enabled) return;
+    const wantsConflicts = !staleOnly && config.triggers.includes('knowledge.conflict_detected');
+    const wantsStale = config.triggers.includes('knowledge.stale');
+    if (!wantsConflicts && !wantsStale) return;
+    const workspacePath = session?.workspacePath;
+    if (!workspacePath) return;
+    try {
+      if (wantsConflicts) emitConflictSignal(context, workspace, session, workspacePath);
+      if (wantsStale) emitStaleSignal(context, workspace, session, workspacePath, config);
+    } catch (error) {
+      emitRuntimeLog(
+        session,
+        `knowledge-signals: a corpus scan failed — ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
+  }
+
   function takePrivateControlInput(session, item) {
     const privateControlInputs = privateControlInputsFor(session);
     const input = privateControlInputs.get(item.id) ?? item.input;
@@ -1581,7 +1827,7 @@ function announceControlLaunch(session, input, workspace) {
  Une file est un passage de témoin : ce qui doit survivre au parent voyage avec
  le message, pas dans l'état de celui qui l'a posté.
 */
-function enqueueControlRequest(context, input, { publicInput = null, capabilityPlan, chainId, chainSequence, skillName, skillExecution, skillStack, selectionKind, optional = false, continueOnFailure = false } = {}) {
+function enqueueControlRequest(context, input, { publicInput = null, capabilityPlan, chainId, chainSequence, skillName, skillExecution, skillStack, selectionKind, optional = false, continueOnFailure = false, proactiveReview = null } = {}) {
   const now = new Date().toISOString();
   const item = {
     id: `control-${randomUUID()}`,
@@ -1598,6 +1844,9 @@ function enqueueControlRequest(context, input, { publicInput = null, capabilityP
     ...(skillExecution ? { skillExecution } : {}),
     ...(Array.isArray(skillStack) && skillStack.length ? { skillStack: [...skillStack] } : {}),
     ...(selectionKind ? { selectionKind } : {}),
+    // The proactive marker rides on the ITEM, so it survives projection and a
+    // runtime restart, and the drain can hand it back to the run it starts.
+    ...(proactiveReview ? { proactiveReview } : {}),
     optional: optional === true,
     continueOnFailure: continueOnFailure === true,
   };
@@ -1789,7 +2038,7 @@ function asksForRunStatus(input) {
 // semantic judgement about the workspace's domain, so it is never a keyword
 // list here — it goes to the model, bounded, and falls back to the choice menu
 // (`ambiguous`) rather than guessing when no model is available.
-async function classifyControlMessage(input, status, { forcedIntent = null, llm = null, session = null } = {}) {
+export async function classifyControlMessage(input, status, { forcedIntent = null, llm = null, session = null } = {}) {
   // Caller (the /control message route) already trims and rejects empty input.
   const lower = String(input ?? '').toLowerCase();
   const intent = forcedIntent ? String(forcedIntent).toLowerCase() : null;
@@ -1823,7 +2072,10 @@ async function classifyControlMessage(input, status, { forcedIntent = null, llm
   // active, the only thing the runtime can act on is a status check: treating
   // the word as ordinary conversation made the read-only chat fallback lecture
   // the user about switching modes instead of answering.
-  if (status.running && /^\s*(oui|yes|yep|ok|okay|vas[- ]?y|d'accord|daccord|entendu)\b/i.test(lower)) {
+  // Anchored at BOTH ends: "oui" is a confirmation, "oui, ajoute une étape de
+  // polish" is a plan change. Without the end anchor this branch shadowed
+  // modify_run and enqueue_run for every message merely STARTING on a yes.
+  if (status.running && /^\s*(oui|yes|yep|ok|okay|vas[- ]?y|d'accord|daccord|entendu)\s*[.!…]*\s*$/i.test(lower)) {
     return { kind: 'observe', confidence: 0.7, reason: 'confirmation_of_runtime_prompt' };
   }
   if (status.running && /\b(ajoute|add|change|modifie|modify|remplace|replace|retire|remove|skip|ignore|apr[eè]s|before|after|chaque|each|plan|step|t[aâ]che)\b/i.test(lower)) {

package/src/runtime/server.test.js

@@ -1747,6 +1747,7 @@ test('POST /turn hands a run status question to Donna with the runtime facts', a
   };
   let turns = 0;
   let turnInput = '';
+  let turnDisplayInput = '';
   let turnMode = null;
   let handle;
   try {
@@ -1755,7 +1756,13 @@ test('POST /turn hands a run status question to Donna with the runtime facts', a
       store: { dbPath: ':memory:', getState: () => status, listEvents: () => [] },
       getContext: async () => context,
       run: async () => new Promise(() => {}),
-      turn: async (_context, options) => { turns += 1; turnInput = options.input; turnMode = options.mode; return { ok: true }; },
+      turn: async (_context, options) => {
+        turns += 1;
+        turnInput = options.input;
+        turnDisplayInput = options.displayInput;
+        turnMode = options.mode;
+        return { ok: true };
+      },
     });
   } catch (err) {
     if (err?.code === 'EPERM') { t.skip('network listen is not permitted in this sandbox'); return; }
@@ -1778,6 +1785,11 @@ test('POST /turn hands a run status question to Donna with the runtime facts', a
     assert.equal(turnMode, 'chat');
     assert.match(turnInput, /Build TechSections/);
     assert.match(turnInput, /runtime run, not a production job/i);
+    // …and the THREAD still shows what the reader typed. `executeInteractiveTurn`
+    // persists `displayInput` as the user_message; feeding it the fact block
+    // put a raw English dump in the reader's own bubble and replayed it as
+    // history on every later turn.
+    assert.equal(turnDisplayInput, 'donne le status du job en cours');
   } finally {
     context.currentAbortController?.abort();
     await handle.close();

package/src/runtime/store.js

@@ -25,7 +25,7 @@ export { defaultRuntimeStateDir };
 // turn's LLM context. A persisted progress note would be re-read by the model
 // on every later turn as if it were something the user said or Donna answered,
 // growing the context with commentary about work already finished.
-const NON_PERSISTED_EVENT_TYPES = new Set(['runtime_log', 'assistant_progress']);
+const NON_PERSISTED_EVENT_TYPES = new Set(['runtime_log', 'assistant_progress', 'runtime_heartbeat']);
 export const RUNTIME_STORE_SCHEMA_VERSION = 1;
 const RUNTIME_RETENTION_DAYS = 30;
 const TERMINAL_RUN_STATUSES = ['done', 'error', 'cancelled', 'interrupted'];

package/src/runtime/store.test.js

@@ -770,13 +770,17 @@ test('runtime store backfills sequence for legacy event rows', () => {
   store.close();
 });
 
-test('runtime store does not persist runtime logs', () => {
+test('runtime store does not persist runtime logs or liveness beats', () => {
   const stateDir = mkdtempSync(join(tmpdir(), 'wiki-manager-runtime-'));
   const store = openRuntimeStore({ stateDir });
   store.persistEvent(createAgentEvent('runtime_log', {
     origin: 'runtime',
     payload: { message: 'agentic-loop: turn 1/20' },
   }));
+  store.persistEvent(createAgentEvent('runtime_heartbeat', {
+    origin: 'runtime_provider',
+    payload: { elapsedMs: 30_000 },
+  }));
 
   assert.equal(store.listEvents().length, 0);
   store.close();

package/src/shell/openExternal.js

@@ -51,3 +51,46 @@ export function openExternalUrl(value, { run = execFileSync } = {}) {
   }
   return null;
 }
+
+// A Chromium `--app=<url>` window is chromeless from the start — no tab
+// strip, no address bar — and, when the origin serves a manifest (llm-wiki's
+// `/manifest.webmanifest`), it picks up the site's name/icon/theme-color and
+// window-controls-overlay exactly like a formally "installed" PWA, with no
+// prior install step required. `/openui`'s whole point is a desktop-feeling
+// window, so it tries this before falling back to `openExternalUrl`'s plain
+// tab. Same candidate/fallback shape as `openerCandidates` above, and the same
+// contract: returns the opened URL, or null when no Chromium browser answered.
+function appModeCandidates() {
+  if (process.platform === 'darwin') {
+    return [
+      ['open', ['-na', 'Google Chrome', '--args']],
+      ['open', ['-na', 'Microsoft Edge', '--args']],
+    ];
+  }
+  if (process.platform === 'win32') {
+    return [
+      ['cmd', ['/c', 'start', '', 'chrome']],
+      ['cmd', ['/c', 'start', '', 'msedge']],
+    ];
+  }
+  return [
+    ['google-chrome', []],
+    ['chromium', []],
+    ['chromium-browser', []],
+    ['microsoft-edge', []],
+  ];
+}
+
+export function openAppWindowUrl(value, { run = execFileSync } = {}) {
+  const url = normalizeExternalUrl(value);
+  if (!url) return null;
+  for (const [command, args] of appModeCandidates()) {
+    try {
+      run(command, [...args, `--app=${url}`], { stdio: 'ignore', timeout: 5_000 });
+      return url;
+    } catch {
+      // Missing binary or non-zero exit: try the next candidate.
+    }
+  }
+  return null;
+}

package/src/shell/repl.js

@@ -94,7 +94,7 @@ const COMMAND_COMPLETION_DESCRIPTIONS = {
   '/clear': 'Clear the conversation screen.',
   '/chat': 'Switch free text to direct LLM chat without tools.',
   '/agent': 'Switch to agent mode, or run one agent request with /agent <question>.',
-  '/openui': 'Open the workspace web UI in the browser.',
+  '/openui': 'Open the workspace web UI as a chromeless desktop window (Chrome/Edge), or a browser tab as fallback.',
   '/run': 'Inspect, cancel, kill runtime runs, or start a capability run.',
   '/approve': 'Approve a pending runtime run or tool.',
 };

package/wiki-workspace

@@ -138,7 +138,6 @@ wiki CLI commands reachable through `wiki <workspace> run`:
   index                             Create or update the local vector index
   refresh                           Regenerate only the stale deliverables
   lint                              Static checks: dead links, orphans, stale deliverables
-  add-skill <source>                Install a workspace method (directory, .zip, HTTPS .zip)
   config                            Show the effective .wikirc.yaml
   doctor, ingest, build, export     Also available directly: wiki <workspace> <command>