@dotdrelle/wiki-manager 0.6.47 → 0.8.2

package/src/shell/useSession.ts

@@ -5,7 +5,9 @@ import { formatMcpToolResult, callMcpTool } from '../core/mcp.js';
 import { extractActivity, parseJsonText, sessionActivities } from '../core/activity.js';
 import { formatPlanStatus, formatCompletedActivities } from '../core/plan.js';
 import { createAgentEvent, dispatchAgentEvent } from '../core/agentEvents.js';
-import { queueCounts, startNextQueuedJob, syncQueueWithActivity } from '../core/jobQueue.js';
+import { projectQueue, queueCounts, startNextQueuedJob, syncQueueWithActivity } from '../core/jobQueue.js';
+import { queueStoreFor } from '../core/queueStore.js';
+import { fetchRuntimeState, streamRuntimeEvents } from '../runtime/client.js';
 import type { ActiveFileEditor } from './FileEditorDialog';
 import {
   completionContext,
@@ -15,6 +17,16 @@ import {
 } from './repl.js';
 import { useAgent } from './useAgent';
 
+function runtimeStatusText(status: 'disabled' | 'connected' | 'disconnected', runStatus: string): string {
+  if (status === 'connected') return `runtime ${runStatus}`;
+  if (status === 'disconnected') return 'runtime offline';
+  return 'runtime off';
+}
+
+function nonEmptyRuntimeArray<T>(value: T[] | undefined | null): T[] | null {
+  return Array.isArray(value) && value.length > 0 ? value : null;
+}
+
 function buildContinuationPrompt(session: any, completed: any[]): string {
   const originalTask = [...conversationMessages(session)]
     .reverse()
@@ -31,10 +43,12 @@ function buildContinuationPrompt(session: any, completed: any[]): string {
   ].filter(Boolean).join('\n');
 }
 
-export function useSession(props: { agent: unknown; packageJson: Record<string, unknown> }) {
+export function useSession(props: { agent: unknown; packageJson: Record<string, unknown>; runtime?: any }) {
   const session = createSession();
   const [version, setVersion] = createSignal(0);
   const [logs, setLogs] = createSignal<string[]>([]);
+  const [runtimeState, setRuntimeState] = createSignal<any | null>(null);
+  const [runtimeStatus, setRuntimeStatus] = createSignal<'disabled' | 'connected' | 'disconnected'>(props.runtime ? 'disconnected' : 'disabled');
   const [input, setInput] = createSignal('');
   const [chatMode, setChatMode] = createSignal(true);
   (session as any).chatMode = true;
@@ -60,10 +74,45 @@ export function useSession(props: { agent: unknown; packageJson: Record<string,
   const addLog = (line: string) => {
     setLogs((items) => [...items, `${new Date().toLocaleTimeString()} ${line}`].slice(-200));
   };
-  const agent = useAgent({ agent: props.agent, packageJson: props.packageJson, session, chatMode, refresh, addLog });
+  if (props.runtime?.url) addLog(`runtime: connected ${props.runtime.url}${props.runtime.started ? ' (started)' : ''}`);
+  const agent = useAgent({
+    agent: props.agent,
+    packageJson: props.packageJson,
+    session,
+    chatMode,
+    runtimeUrl: props.runtime?.url ?? null,
+    refresh,
+    addLog,
+    onRuntimeAccepted: () => {
+      setRuntimeState((state) => ({ ...(state ?? {}), status: 'running' }));
+      setRuntimeStatus('connected');
+      refresh();
+    },
+  });
+  const runtimeRunStatus = createMemo(() => String(runtimeState()?.status ?? 'idle'));
+  const agentBusy = createMemo(() =>
+    props.runtime?.url
+      ? runtimeRunStatus() === 'running' || agent.busy()
+      : agent.busy(),
+  );
+  const localFallbackActive = createMemo(() => !props.runtime?.url || runtimeStatus() === 'disconnected');
 
   const messages = createMemo(() => {
     version();
+    const runtimeConversation = runtimeState()?.conversation;
+    const localCommands = conversationMessages(session)
+      .filter((message: any) => message.role === 'command')
+      .map((message: any) => ({
+        role: 'command',
+        content: String(message.content ?? ''),
+      }));
+    if (Array.isArray(runtimeConversation) && runtimeConversation.length > 0) {
+      const runtimeMessages = runtimeConversation.map((message: any) => ({
+        role: message.role === 'assistant' ? 'donna' : message.role,
+        content: String(message.content ?? ''),
+      }));
+      return [...runtimeMessages, ...localCommands].slice(-200);
+    }
     return [...conversationMessages(session)];
   });
   const prompt = createMemo(() => {
@@ -84,6 +133,7 @@ export function useSession(props: { agent: unknown; packageJson: Record<string,
       session.wikirc?.profile ? session.wikirc.profile : 'no wikirc',
       session.language ? session.language : 'no language',
       session.llm ? 'llm ready' : 'llm limited',
+      runtimeStatusText(runtimeStatus(), runtimeRunStatus()),
     ].join('  ');
   });
   const matchContext = createMemo(() => {
@@ -119,37 +169,122 @@ export function useSession(props: { agent: unknown; packageJson: Record<string,
   let lastVisiblePlan: Array<{ step: number; description: string; status: string }> | null = null;
   const activities = createMemo(() => {
     version();
+    const runtimeActivities = nonEmptyRuntimeArray(runtimeState()?.activities);
+    if (runtimeActivities) {
+      return runtimeActivities.map((activity: any) => ({ ...activity, _runtime: true }));
+    }
     const current = sessionActivities(session);
     if (current.length > 0) {
       lastVisibleActivities = current.map((activity) => ({ ...activity }));
       return current;
     }
-    return agent.busy() && lastVisibleActivities.length > 0
+    return agentBusy() && lastVisibleActivities.length > 0
       ? lastVisibleActivities.map((activity) => ({ ...activity }))
       : current;
   });
   const queueItems = createMemo(() => {
     version();
-    return ((session as any).jobQueue ?? []).map((item: any) => ({ ...item }));
+    const runtimeQueue = nonEmptyRuntimeArray(runtimeState()?.queue);
+    if (runtimeQueue) return runtimeQueue.map((item: any) => ({ ...item, _runtime: true }));
+    return projectQueue((session as any).headlessPlan, (session as any).jobQueue ?? [], { workspace: (session as any).workspace ?? null })
+      .map((item: any) => ({ ...item }));
   });
   const queueInfo = createMemo(() => {
     version();
+    const runtimeQueue = runtimeState()?.queue;
+    if (Array.isArray(runtimeQueue)) {
+      return {
+        active: runtimeQueue.filter((item: any) => ['waiting', 'starting', 'running', 'queued', 'pending', 'pending_approval'].includes(String(item.status ?? '').toLowerCase())).length,
+        current: runtimeQueue.filter((item: any) => ['starting', 'running'].includes(String(item.status ?? '').toLowerCase())).length,
+        frozen: 0,
+      };
+    }
     return queueCounts(session);
   });
   const plan = createMemo(() => {
     version();
+    const runtimePlan = nonEmptyRuntimeArray(runtimeState()?.plan);
+    if (runtimePlan) {
+      return runtimePlan.map((step: any, index: number) => ({
+        step: Number(step.step ?? index + 1),
+        description: String(step.description ?? step.label ?? step.name ?? `Step ${index + 1}`),
+        status: String(step.status ?? 'pending'),
+      }));
+    }
     const p = (session as any).headlessPlan as Array<{ step: number; description: string; status: string }> | null;
     const current = p ? p.map((s) => ({ ...s })) : null;
     if (current && current.length > 0) {
       lastVisiblePlan = current.map((step) => ({ ...step }));
       return current;
     }
-    return agent.busy() && lastVisiblePlan && lastVisiblePlan.length > 0
+    return agentBusy() && lastVisiblePlan && lastVisiblePlan.length > 0
       ? lastVisiblePlan.map((step) => ({ ...step }))
       : current;
   });
+  const visibleLogs = createMemo(() => {
+    version();
+    const runtimeLogs = runtimeState()?.logs;
+    if (!Array.isArray(runtimeLogs) || runtimeLogs.length === 0) return logs();
+    const tagged = runtimeLogs.slice(-80).map((line: any) => `runtime ${String(line)}`);
+    return [...logs(), ...tagged].slice(-200);
+  });
+
+  function syncRuntimeState() {
+    void fetchRuntimeState({ url: props.runtime.url, workspace: (session as any).workspace ?? null })
+      .then((state) => {
+        setRuntimeState(state);
+        setRuntimeStatus('connected');
+        refresh();
+      })
+      .catch(() => {
+        setRuntimeStatus('disconnected');
+        refresh();
+      });
+  }
+  let runtimeStreamAbort: AbortController | null = null;
+  let runtimeSyncDebounce: ReturnType<typeof setTimeout> | null = null;
+  let runtimeReconnectTimer: ReturnType<typeof setTimeout> | null = null;
+  let runtimeStreamStopped = false;
+
+  function debouncedSyncRuntimeState() {
+    if (runtimeSyncDebounce) clearTimeout(runtimeSyncDebounce);
+    runtimeSyncDebounce = setTimeout(syncRuntimeState, 200);
+  }
+
+  async function subscribeRuntimeEvents() {
+    if (!props.runtime?.url || runtimeStreamStopped) return;
+    runtimeStreamAbort = new AbortController();
+    try {
+      for await (const _event of streamRuntimeEvents({
+        url: props.runtime.url,
+        signal: runtimeStreamAbort.signal,
+        workspace: (session as any).workspace ?? null,
+      })) {
+        setRuntimeStatus('connected');
+        debouncedSyncRuntimeState();
+      }
+    } catch {
+      // stream dropped or errored — fall through to reconnect below
+    }
+    if (runtimeStreamStopped) return;
+    setRuntimeStatus('disconnected');
+    refresh();
+    runtimeReconnectTimer = setTimeout(() => { void subscribeRuntimeEvents(); }, 1500);
+  }
+
+  if (props.runtime?.url) {
+    syncRuntimeState();
+    void subscribeRuntimeEvents();
+  }
+  onCleanup(() => {
+    runtimeStreamStopped = true;
+    runtimeStreamAbort?.abort();
+    if (runtimeSyncDebounce) clearTimeout(runtimeSyncDebounce);
+    if (runtimeReconnectTimer) clearTimeout(runtimeReconnectTimer);
+  });
 
   const activityPollTimer = setInterval(() => {
+    if (!localFallbackActive()) return;
     for (const activity of sessionActivities(session)) {
       if (activity.terminal || !activity.poll) continue;
       const key = activity.key ?? `${activity.poll.server}:${activity.id ?? activity.label}`;
@@ -195,7 +330,7 @@ export function useSession(props: { agent: unknown; packageJson: Record<string,
               const plan = (session as any).headlessPlan;
               const stillRunning = sessionActivities(session).filter((a) => !a.terminal && a.poll);
               const pendingSteps = (plan ?? []).filter((s: any) => s.status === 'pending');
-              if (stillRunning.length === 0 && pendingSteps.length > 0 && !agent.busy()) {
+              if (stillRunning.length === 0 && pendingSteps.length > 0 && !agentBusy()) {
                 const completedAll = sessionActivities(session).filter((a) => a.terminal);
                 const prompt = buildContinuationPrompt(session, completedAll);
                 void agent.submit(prompt);
@@ -211,18 +346,23 @@ export function useSession(props: { agent: unknown; packageJson: Record<string,
         });
     }
   }, 1000);
-  onCleanup(() => clearInterval(activityPollTimer));
+  onCleanup(() => {
+    if (activityPollTimer) clearInterval(activityPollTimer);
+  });
 
   const queueFallbackTimer = setInterval(() => {
-    if ((session as any).jobQueue?.some((item: any) => item.status === 'waiting')) {
+    if (!localFallbackActive()) return;
+    if (queueStoreFor(session).list().some((item: any) => item.status === 'waiting')) {
       void startNextQueuedJob(session, { addLog, refresh });
     }
   }, 10000);
-  onCleanup(() => clearInterval(queueFallbackTimer));
+  onCleanup(() => {
+    if (queueFallbackTimer) clearInterval(queueFallbackTimer);
+  });
 
   async function submitInput(submittedValue?: string) {
     const line = typeof submittedValue === 'string' && submittedValue.trim() ? submittedValue : input();
-    if (agent.busy()) return { exit: false, busy: true };
+    if (agentBusy()) return { exit: false, busy: true };
     setInput('');
     setConversationScroll(0);
     if (line.trim()) {
@@ -344,7 +484,7 @@ export function useSession(props: { agent: unknown; packageJson: Record<string,
   return {
     session,
     messages,
-    logs,
+    logs: visibleLogs,
     input,
     setInput: updateInput,
     title,
@@ -364,7 +504,7 @@ export function useSession(props: { agent: unknown; packageJson: Record<string,
     plan,
     conversationScroll,
     scrollConversation,
-    busy: agent.busy,
+    busy: agentBusy,
     abort,
     submitInput,
     completeSelected,

package/wiki-workspace

@@ -92,6 +92,11 @@ Commands:
   agents pull                       Pull latest external agent images
   agents status                     Check reachability of configured MCP endpoints
 
+  runtime up                        Start the single host agent-runtime on Node.js 22
+  runtime down                      Stop the host agent-runtime
+  runtime status                    Check host agent-runtime health
+  runtime logs [args...]            Show host agent-runtime logs
+
   wiki <workspace> init             Initialize the workspace with wiki init
   wiki <workspace> up               Start llm-wiki serve + mcp-http + production-mcp
   wiki <workspace> down             Stop all services for this workspace
@@ -106,6 +111,7 @@ Commands:
 Configuration:
   workspaces/<workspace>/.env
   Override directory: WIKI_WORKSPACES_DIR=/path/to/dir
+  Runtime node: WIKI_MANAGER_NODE_BIN=/path/to/node
   Local CA: --cacert /absolute/path/to/ca.pem (Docker must be able to read this host path)
 EOF
 }
@@ -362,6 +368,179 @@ NODE
   esac
 }
 
+runtime_node_bin() {
+  printf '%s\n' "${WIKI_MANAGER_NODE_BIN:-node}"
+}
+
+ensure_runtime_node() {
+  local node_bin
+  node_bin="$(runtime_node_bin)"
+  command -v "$node_bin" >/dev/null 2>&1 || die "runtime requires Node.js 22+: command not found: $node_bin (set WIKI_MANAGER_NODE_BIN)"
+  local version major
+  version="$("$node_bin" -p 'process.versions.node' 2>/dev/null)" || die "could not execute Node runtime: $node_bin"
+  major="${version%%.*}"
+  [[ "$major" =~ ^[0-9]+$ && "$major" -ge 22 ]] || die "runtime requires Node.js 22+ for node:sqlite; $node_bin is Node $version"
+}
+
+ensure_manager_runtime_token() {
+  local token
+  token="$(env_value "$MANAGER_ENV_FILE" WIKI_MANAGER_RUNTIME_TOKEN "")"
+  if [[ -z "$token" ]]; then
+    token="$(generate_token)"
+    mkdir -p "$(dirname "$MANAGER_ENV_FILE")"
+    set_env_value "$MANAGER_ENV_FILE" WIKI_MANAGER_RUNTIME_TOKEN "$token"
+  fi
+  printf '%s\n' "$token"
+}
+
+runtime_pid_file() {
+  printf '%s/runtime.pid\n' "$MANAGER_RUNTIME_DIR"
+}
+
+runtime_log_file() {
+  printf '%s/runtime.log\n' "$MANAGER_RUNTIME_DIR"
+}
+
+runtime_pid_running() {
+  local pid_file pid
+  pid_file="$(runtime_pid_file)"
+  [[ -f "$pid_file" ]] || return 1
+  pid="$(cat "$pid_file" 2>/dev/null || true)"
+  [[ "$pid" =~ ^[0-9]+$ ]] || return 1
+  kill -0 "$pid" >/dev/null 2>&1
+}
+
+runtime_pid_command() {
+  local pid="$1"
+  ps -p "$pid" -o command= 2>/dev/null || ps -p "$pid" -o args= 2>/dev/null || true
+}
+
+runtime_pid_matches() {
+  local pid command
+  pid="$(cat "$(runtime_pid_file)" 2>/dev/null || true)"
+  [[ "$pid" =~ ^[0-9]+$ ]] || return 1
+  command="$(runtime_pid_command "$pid")"
+  [[ "$command" == *"/bin/wiki-manager.js runtime"* || "$command" == *" bin/wiki-manager.js runtime"* ]]
+}
+
+runtime_health_url() {
+  printf 'http://127.0.0.1:%s/health\n' "${WIKI_MANAGER_RUNTIME_PORT:-7788}"
+}
+
+runtime_health_check() {
+  local token url
+  token="$(env_value "$MANAGER_ENV_FILE" WIKI_MANAGER_RUNTIME_TOKEN "")"
+  url="$(runtime_health_url)"
+  if command -v curl >/dev/null 2>&1; then
+    if [[ -n "$token" ]]; then
+      curl -fsS -H "Authorization: Bearer $token" "$url" >/dev/null 2>&1
+    else
+      curl -fsS "$url" >/dev/null 2>&1
+    fi
+    return
+  fi
+  local node_bin
+  node_bin="$(runtime_node_bin)"
+  RUNTIME_URL="$url" RUNTIME_TOKEN="$token" "$node_bin" --input-type=module -e "const h=process.env.RUNTIME_TOKEN?{Authorization:'Bearer '+process.env.RUNTIME_TOKEN}:{}; const r=await fetch(process.env.RUNTIME_URL,{headers:h}); process.exit(r.ok?0:1);"
+}
+
+runtime_command() {
+  local subcommand="$1"
+  shift
+  local host="${WIKI_MANAGER_RUNTIME_HOST:-0.0.0.0}"
+  local port="${WIKI_MANAGER_RUNTIME_PORT:-7788}"
+  local pid_file log_file node_bin token
+  pid_file="$(runtime_pid_file)"
+  log_file="$(runtime_log_file)"
+  node_bin="$(runtime_node_bin)"
+
+  case "$subcommand" in
+    up)
+      [[ $# -eq 0 ]] || die "runtime up does not take arguments"
+      mkdir -p "$MANAGER_RUNTIME_DIR"
+      ensure_runtime_node
+      token="$(ensure_manager_runtime_token)"
+      export WIKI_MANAGER_RUNTIME_TOKEN="$token"
+      if runtime_health_check; then
+        printf 'agent-runtime already healthy at %s\n' "$(runtime_health_url)"
+        return
+      fi
+      if runtime_pid_running; then
+        printf 'agent-runtime process is already running (pid %s), but health is not ready yet.\n' "$(cat "$pid_file")"
+        return
+      fi
+      WIKI_WORKSPACES_DIR="$WORKSPACES_DIR" \
+      WIKI_MANAGER_ENV_FILE="$MANAGER_ENV_FILE" \
+      WIKI_MANAGER_STATE_DIR="$MANAGER_RUNTIME_DIR" \
+      WIKI_MANAGER_RUNTIME_TOKEN="$token" \
+      nohup "$node_bin" "$ROOT_DIR/bin/wiki-manager.js" runtime --host "$host" --port "$port" --state-dir "$MANAGER_RUNTIME_DIR" > "$log_file" 2>&1 &
+      printf '%s\n' "$!" > "$pid_file"
+      sleep 0.5
+      printf 'agent-runtime started on http://127.0.0.1:%s (pid %s)\n' "$port" "$(cat "$pid_file")"
+      printf 'state: %s\nlog:   %s\n' "$MANAGER_RUNTIME_DIR" "$log_file"
+      ;;
+    down|stop)
+      [[ $# -eq 0 ]] || die "runtime down does not take arguments"
+      if ! runtime_pid_running; then
+        printf 'agent-runtime is not running from %s\n' "$pid_file"
+        rm -f "$pid_file"
+        return
+      fi
+      if ! runtime_pid_matches; then
+        printf 'refusing to stop pid %s: command does not look like wiki-manager runtime\n' "$(cat "$pid_file")" >&2
+        printf 'command: %s\n' "$(runtime_pid_command "$(cat "$pid_file")")" >&2
+        rm -f "$pid_file"
+        exit 1
+      fi
+      kill "$(cat "$pid_file")"
+      rm -f "$pid_file"
+      printf 'agent-runtime stopped\n'
+      ;;
+    status)
+      [[ $# -eq 0 ]] || die "runtime status does not take arguments"
+      if runtime_health_check; then
+        printf 'agent-runtime healthy at %s\n' "$(runtime_health_url)"
+      elif runtime_pid_running; then
+        printf 'agent-runtime process running (pid %s), health check failed\n' "$(cat "$pid_file")"
+        exit 1
+      else
+        printf 'agent-runtime is not running\n'
+        exit 1
+      fi
+      ;;
+    logs)
+      if [[ ! -f "$log_file" ]]; then
+        printf 'No runtime log found at %s\n' "$log_file" >&2
+        exit 1
+      fi
+      if [[ $# -eq 0 ]]; then
+        tail -100 -f "$log_file"
+      else
+        tail "$@" "$log_file"
+      fi
+      ;;
+    *)
+      die "unknown runtime command: $subcommand (expected: up, down, status, logs)"
+      ;;
+  esac
+}
+
+ensure_runtime_up() {
+  if [[ "${WIKI_MANAGER_RUNTIME_AUTOSTART:-1}" == "0" ]]; then
+    return
+  fi
+  if runtime_health_check; then
+    return
+  fi
+  printf 'Starting host agent-runtime...\n'
+  runtime_command up
+}
+
+start_workspace_services() {
+  ensure_runtime_up
+  compose_for_workspace "$1" up -d serve mcp-http production-mcp
+}
+
 ensure_manager_endpoints_file() {
   if [[ ! -f "$MANAGER_ENDPOINTS_FILE" && -f "$ROOT_DIR/mcp.endpoints.example.json" ]]; then
     mkdir -p "$(dirname "$MANAGER_ENDPOINTS_FILE")"
@@ -478,13 +657,14 @@ compose_for_workspace() {
   local workspace="$1"
   shift
   need_workspace_env "$workspace"
-  local workspace_env ws_path serve_port mcp_port prod_port project
+  local workspace_env ws_path serve_port mcp_port prod_port project agents_data_dir
   workspace_env="$(workspace_env_file "$workspace")"
   ws_path="$(normalize_path "$(workspace_value "$workspace" WIKI_WORKSPACE_PATH)")"
   serve_port="$(workspace_value "$workspace" WIKI_SERVE_PORT 3100)"
   mcp_port="$(workspace_value "$workspace" WIKI_MCP_PORT 3101)"
   prod_port="$(workspace_value "$workspace" PRODUCTION_MCP_PORT 3102)"
   project="$(compose_project "$workspace")"
+  agents_data_dir="$(absolute_path "${AGENTS_DATA_DIR:-.agents-data}" "$DEFAULT_MANAGER_DIR")"
 
   local compose_env_args=()
   [[ -f "$MANAGER_ENV_FILE" ]] && compose_env_args+=(--env-file "$MANAGER_ENV_FILE")
@@ -500,6 +680,7 @@ compose_for_workspace() {
   WIKI_SERVE_PORT="$serve_port" \
   WIKI_MCP_PORT="$mcp_port" \
   PRODUCTION_MCP_PORT="$prod_port" \
+  AGENTS_DATA_DIR="$agents_data_dir" \
   docker compose --project-directory "$DEFAULT_MANAGER_DIR" \
     ${compose_env_args[@]+"${compose_env_args[@]}"} -f "$ROOT_DIR/docker-compose.yml" ${cacert_args[@]+"${cacert_args[@]}"} -p "$project" "$@"
 }
@@ -547,22 +728,23 @@ cacert_compose_args() {
 
   mkdir -p "$MANAGER_RUNTIME_DIR"
   local override_path="$MANAGER_RUNTIME_DIR/$override_name"
-  {
-    printf '# Generated by wiki-manager. Safe to delete.\n'
-    printf '# Rewritten when --cacert is used with a Docker Compose command.\n'
-    printf 'services:\n'
-    while IFS= read -r service || [[ -n "$service" ]]; do
-      [[ -n "$service" ]] || continue
-      printf '  %s:\n' "$service"
-      printf '    volumes:\n'
-      printf '      - %s:/wiki-manager-ca.pem:ro\n' "$CACERT_PATH"
-      printf '    environment:\n'
-      printf '      NODE_EXTRA_CA_CERTS: /wiki-manager-ca.pem\n'
-      printf '      SSL_CERT_FILE: /wiki-manager-ca.pem\n'
-      printf '      REQUESTS_CA_BUNDLE: /wiki-manager-ca.pem\n'
-      printf '      CURL_CA_BUNDLE: /wiki-manager-ca.pem\n'
-    done <<< "$services"
-  } > "$override_path"
+  if [[ ! -f "$override_path" ]]; then
+    {
+      printf '# Generated by wiki-manager. Edit freely; delete to regenerate.\n'
+      printf 'services:\n'
+      while IFS= read -r service || [[ -n "$service" ]]; do
+        [[ -n "$service" ]] || continue
+        printf '  %s:\n' "$service"
+        printf '    volumes:\n'
+        printf '      - %s:/wiki-manager-ca.pem:ro\n' "$CACERT_PATH"
+        printf '    environment:\n'
+        printf '      NODE_EXTRA_CA_CERTS: /wiki-manager-ca.pem\n'
+        printf '      SSL_CERT_FILE: /wiki-manager-ca.pem\n'
+        printf '      REQUESTS_CA_BUNDLE: /wiki-manager-ca.pem\n'
+        printf '      CURL_CA_BUNDLE: /wiki-manager-ca.pem\n'
+      done <<< "$services"
+    } > "$override_path"
+  fi
   printf '%s\n' -f "$override_path"
 }
 
@@ -689,7 +871,8 @@ config_workspace() {
   local env_file="$target_path/.env"
   [[ -f "$env_file" ]] && die "workspace already configured: $env_file"
 
-  local port_base serve_port mcp_port prod_port wiki_token prod_token
+  local port_base serve_port mcp_port prod_port wiki_token prod_token agents_data_dir
+  agents_data_dir="$(absolute_path "${AGENTS_DATA_DIR:-.agents-data}" "$DEFAULT_MANAGER_DIR")"
   port_base="$(find_free_workspace_port_base 3100)"
   serve_port="$port_base"
   mcp_port=$((port_base + 1))
@@ -724,6 +907,7 @@ config_workspace() {
   WIKI_WORKSPACE_PATH="$target_path" \
   WIKI_SERVE_PORT="$serve_port" \
   WIKI_MCP_PORT="$mcp_port" \
+  AGENTS_DATA_DIR="$agents_data_dir" \
     docker compose --project-directory "$DEFAULT_MANAGER_DIR" \
       ${compose_env_args[@]+"${compose_env_args[@]}"} -f "$ROOT_DIR/docker-compose.yml" ${cacert_args[@]+"${cacert_args[@]}"} run --rm wiki init
 
@@ -738,8 +922,7 @@ up_workspace() {
   local ws_path
   ws_path="$(normalize_path "$(workspace_value "$workspace" WIKI_WORKSPACE_PATH)")"
   ensure_workspace_dirs "$ws_path"
-
-  compose_for_workspace "$workspace" up -d serve mcp-http production-mcp
+  start_workspace_services "$workspace"
 
   local serve_port prod_port
   serve_port="$(workspace_value "$workspace" WIKI_SERVE_PORT 3100)"
@@ -747,6 +930,7 @@ up_workspace() {
   printf 'Workspace UI: http://localhost:%s\n' "$serve_port"
   printf 'Chat:         http://localhost:%s/chat\n' "$serve_port"
   printf 'Production:   http://localhost:%s/mcp/\n' "$prod_port"
+  printf 'Runtime:      %s\n' "$(runtime_health_check && printf 'healthy at %s' "$(runtime_health_url)" || printf 'start with: wiki-workspace runtime up')"
   printf 'External MCPs: see %s\n' "$MANAGER_ENDPOINTS_FILE"
 
   if [[ "$open_browser" == "1" ]]; then
@@ -797,10 +981,22 @@ main() {
     exit 0
   fi
 
+  # runtime <subcommand> [args...]
+  if [[ $# -ge 1 && "$1" == "runtime" ]]; then
+    local runtime_sub="${2:-status}"
+    if [[ $# -ge 2 ]]; then
+      shift 2
+    else
+      shift 1
+    fi
+    runtime_command "$runtime_sub" "$@"
+    exit 0
+  fi
+
   [[ $# -ge 2 ]] || { usage; exit 2; }
 
   local scope="$1"
-  [[ "$scope" == "wiki" ]] || die "unknown scope: $scope (expected: wiki, agents, up, config, or list)"
+  [[ "$scope" == "wiki" ]] || die "unknown scope: $scope (expected: wiki, agents, runtime, up, config, or list)"
   shift
   [[ $# -ge 2 ]] || die "wiki requires a workspace and a command"
 
@@ -813,13 +1009,14 @@ main() {
       run_wiki "$workspace" init "$@"
       ;;
     up)
-      compose_for_workspace "$workspace" up -d serve mcp-http production-mcp
+      start_workspace_services "$workspace"
       local serve_port production_port
       serve_port="$(workspace_value "$workspace" WIKI_SERVE_PORT 3100)"
       production_port="$(workspace_value "$workspace" PRODUCTION_MCP_PORT 3102)"
       printf 'Workspace UI: http://localhost:%s\n' "$serve_port"
       printf 'Chat MCP:     http://localhost:%s/chat\n' "$serve_port"
       printf 'Production:   http://localhost:%s/mcp/\n' "$production_port"
+      printf 'Runtime:      %s\n' "$(runtime_health_check && printf 'healthy at %s' "$(runtime_health_url)" || printf 'start with: wiki-workspace runtime up')"
       ;;
     down)
       compose_for_workspace "$workspace" down
@@ -837,6 +1034,7 @@ main() {
         die "serve accepts only --open as optional flag; port is configured in the workspace .env"
       fi
 
+      ensure_runtime_up
       printf 'Starting mcp-http...\n'
       compose_for_workspace "$workspace" up -d mcp-http
       printf 'Starting production-mcp...\n'
@@ -847,6 +1045,7 @@ main() {
       printf 'Workspace UI: http://localhost:%s\n' "$serve_port"
       printf 'Chat MCP:     http://localhost:%s/chat\n' "$serve_port"
       printf 'Production:   http://localhost:%s/mcp/\n' "$production_port"
+      printf 'Runtime:      %s\n' "$(runtime_health_check && printf 'healthy at %s' "$(runtime_health_url)" || printf 'start with: wiki-workspace runtime up')"
       printf 'Note: compose logs may show http://localhost:3000, which is the container port.\n'
       if [[ $open_browser -eq 1 ]]; then
         wait_and_open "http://localhost:${serve_port}" &