@dotdrelle/wiki-manager 0.7.3 → 0.9.3

package/src/core/mcp.js

@@ -70,11 +70,28 @@ function endpointStatus(configured, detail = '') {
   };
 }
 
+function approvalToolsFor(serverName) {
+  const raw = envValue('WIKI_MANAGER_REQUIRE_APPROVAL_TOOLS');
+  if (!raw) return undefined;
+  const tools = String(raw)
+    .split(',')
+    .map((item) => item.trim())
+    .filter(Boolean)
+    .filter((item) => item === '*' || item.startsWith(`${serverName}.`) || !item.includes('.'))
+    .map((item) => item.startsWith(`${serverName}.`) ? item.slice(serverName.length + 1) : item);
+  return tools.length > 0 ? tools : undefined;
+}
+
 const MCP_SERVICE_MAP = {
   wiki: 'mcp-http',
   production: 'production-mcp',
 };
 
+const DEFAULT_MCP_RETRY_POLICY = {
+  maxAttempts: 2,
+  backoffMs: 500,
+};
+
 export function buildMcpStatus(session) {
   const workspaceEnv = session.workspaceEnv ?? {};
   const wikiMcpToken = session.wikircConfig?.mcp?.accessKey;
@@ -91,6 +108,7 @@ export function buildMcpStatus(session) {
       ),
       url: workspaceEnv.WIKI_MCP_PORT ? `http://127.0.0.1:${workspaceEnv.WIKI_MCP_PORT}/mcp` : null,
       token: wikiMcpToken || null,
+      requireApproval: approvalToolsFor('wiki'),
     },
     production: {
       ...endpointStatus(
@@ -100,6 +118,7 @@ export function buildMcpStatus(session) {
       url: workspaceEnv.PRODUCTION_MCP_PORT ? `http://127.0.0.1:${workspaceEnv.PRODUCTION_MCP_PORT}/mcp/` : null,
       token: workspaceEnv.PRODUCTION_MCP_AUTH_TOKEN || null,
       activeConfigPath: session.wikirc?.fileName || null,
+      requireApproval: approvalToolsFor('production'),
     },
     ...external,
   };
@@ -211,7 +230,7 @@ async function mcpRequest(endpoint, method, params, signal, options = {}) {
           params: {
             protocolVersion: '2025-06-18',
             capabilities: {},
-            clientInfo: { name: 'wiki-manager', version: '0.7.3' },
+            clientInfo: { name: 'wiki-manager', version: '0.9.3' },
           },
         }),
       });
@@ -240,7 +259,7 @@ async function mcpRequest(endpoint, method, params, signal, options = {}) {
   }
 }
 
-export async function callMcpTool(mcpStatus, serverName, toolName, args = {}, signal) {
+export async function callMcpTool(mcpStatus, serverName, toolName, args = {}, signal, options = {}) {
   const endpoint = mcpStatus?.[serverName];
   if (!endpoint) throw new Error(`Unknown MCP: ${serverName}`);
   if (endpoint.status !== 'connected') throw new Error(`MCP is not connected: ${serverName}`);
@@ -254,14 +273,17 @@ export async function callMcpTool(mcpStatus, serverName, toolName, args = {}, si
     ...(shouldInjectConfigPath ? { configPath: endpoint.activeConfigPath } : {}),
   };
   const timeoutMs = serverName === 'documents' && toolName === 'documents_convert_to_markdown' ? 600_000 : 8000;
-  const payload = await mcpRequest(endpoint, 'tools/call', {
-    name: toolName,
-    arguments: toolArgs,
-  }, signal, { timeoutMs });
-  if (payload?.result?.isError) {
-    throw new Error(formatMcpToolResult(payload.result));
-  }
-  return payload?.result ?? null;
+  const retry = resolveRetryPolicy(endpoint, toolName, options.retry);
+  return withRetry(async () => {
+    const payload = await mcpRequest(endpoint, 'tools/call', {
+      name: toolName,
+      arguments: toolArgs,
+    }, signal, { timeoutMs });
+    if (payload?.result?.isError) {
+      throw new Error(formatMcpToolResult(payload.result));
+    }
+    return payload?.result ?? null;
+  }, retry, { signal, onRetry: options.onRetry });
 }
 
 export function formatMcpToolResult(result) {
@@ -278,6 +300,94 @@ export function formatMcpToolResult(result) {
     .trim() || 'No result.';
 }
 
+let _cachedEnvRetryPolicy = null;
+function getEnvRetryPolicy() {
+  if (!_cachedEnvRetryPolicy) {
+    _cachedEnvRetryPolicy = {
+      maxAttempts: numberFromEnv('WIKI_MANAGER_MCP_RETRY_MAX_ATTEMPTS')
+        ?? numberFromEnv('WIKI_MANAGER_MCP_RETRY_ATTEMPTS')
+        ?? DEFAULT_MCP_RETRY_POLICY.maxAttempts,
+      backoffMs: numberFromEnv('WIKI_MANAGER_MCP_RETRY_BACKOFF_MS')
+        ?? DEFAULT_MCP_RETRY_POLICY.backoffMs,
+    };
+  }
+  return _cachedEnvRetryPolicy;
+}
+
+export function resolveRetryPolicy(endpoint = {}, toolName = null, override = null) {
+  const toolPolicy = toolName ? endpoint.toolRetries?.[toolName] : null;
+  return normalizeRetryPolicy(getEnvRetryPolicy(), endpoint.retry, toolPolicy, override);
+}
+
+function normalizeRetryPolicy(...policies) {
+  const merged = {};
+  for (const policy of policies) {
+    if (policy === false) {
+      merged.maxAttempts = 1;
+      continue;
+    }
+    if (!policy || typeof policy !== 'object') continue;
+    if (policy.maxAttempts != null) merged.maxAttempts = Number(policy.maxAttempts);
+    if (policy.backoffMs != null) merged.backoffMs = Number(policy.backoffMs);
+  }
+  const maxAttempts = Number.isFinite(merged.maxAttempts)
+    ? Math.max(1, Math.floor(merged.maxAttempts))
+    : DEFAULT_MCP_RETRY_POLICY.maxAttempts;
+  const backoffMs = Number.isFinite(merged.backoffMs)
+    ? Math.max(0, Math.floor(merged.backoffMs))
+    : DEFAULT_MCP_RETRY_POLICY.backoffMs;
+  return { maxAttempts, backoffMs };
+}
+
+function numberFromEnv(key) {
+  const raw = envValue(key);
+  if (raw == null || raw === '') return null;
+  const value = Number(raw);
+  return Number.isFinite(value) ? value : null;
+}
+
+async function withRetry(operation, policy, { signal = null, onRetry = null } = {}) {
+  let lastError;
+  for (let attempt = 1; attempt <= policy.maxAttempts; attempt += 1) {
+    try {
+      return await operation({ attempt });
+    } catch (err) {
+      lastError = err;
+      if (attempt >= policy.maxAttempts || signal?.aborted) throw err;
+      onRetry?.({ attempt, maxAttempts: policy.maxAttempts, error: err });
+      await retryDelay(policy.backoffMs * (2 ** (attempt - 1)), signal);
+    }
+  }
+  throw lastError;
+}
+
+function retryDelay(ms, signal) {
+  if (ms <= 0) return Promise.resolve();
+  return new Promise((resolve, reject) => {
+    let timer = null;
+    const cleanup = () => {
+      if (timer) clearTimeout(timer);
+      signal?.removeEventListener('abort', onAbort);
+    };
+    const onAbort = () => {
+      cleanup();
+      const err = new Error('Operation aborted.');
+      err.name = 'AbortError';
+      reject(err);
+    };
+    timer = setTimeout(() => {
+      cleanup();
+      resolve();
+    }, ms);
+    if (!signal) return;
+    if (signal.aborted) {
+      onAbort();
+      return;
+    }
+    signal.addEventListener('abort', onAbort, { once: true });
+  });
+}
+
 export async function discoverMcpTools(mcpStatus) {
   const next = {};
   await Promise.all(Object.entries(mcpStatus ?? {}).map(async ([name, value]) => {

package/src/core/mcp.test.js

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import { mkdtemp, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { buildMcpStatus, callMcpTool, discoverMcpTools } from './mcp.js';
+import { buildMcpStatus, callMcpTool, discoverMcpTools, resolveRetryPolicy } from './mcp.js';
 
 test('buildMcpStatus reads external MCP endpoints from mcp.endpoints.json', async () => {
   const originalCwd = process.cwd();
@@ -163,6 +163,29 @@ test('buildMcpStatus uses active wikirc mcp.accessKey for wiki MCP', () => {
   assert.equal(status.wiki.token, 'wikirc-wiki-token');
 });
 
+test('buildMcpStatus applies internal tool approval policy from env', () => {
+  const original = process.env.WIKI_MANAGER_REQUIRE_APPROVAL_TOOLS;
+  process.env.WIKI_MANAGER_REQUIRE_APPROVAL_TOOLS = 'production.production_start_job,wiki.wiki_search';
+  try {
+    const status = buildMcpStatus({
+      workspaceEnv: {
+        PRODUCTION_MCP_PORT: '3102',
+        PRODUCTION_MCP_AUTH_TOKEN: 'production-token',
+        WIKI_MCP_PORT: '3101',
+      },
+      wikircConfig: {
+        mcp: { accessKey: 'wiki-token' },
+      },
+    });
+
+    assert.deepEqual(status.production.requireApproval, ['production_start_job']);
+    assert.deepEqual(status.wiki.requireApproval, ['wiki_search']);
+  } finally {
+    if (original === undefined) delete process.env.WIKI_MANAGER_REQUIRE_APPROVAL_TOOLS;
+    else process.env.WIKI_MANAGER_REQUIRE_APPROVAL_TOOLS = original;
+  }
+});
+
 test('callMcpTool injects active configPath for production_start_job', async () => {
   const originalFetch = globalThis.fetch;
   let requestBody = null;
@@ -269,6 +292,103 @@ test('callMcpTool sends configured endpoint headers', async () => {
   }
 });
 
+test('callMcpTool retries transient MCP failures', async () => {
+  const originalFetch = globalThis.fetch;
+  let attempts = 0;
+  const retries = [];
+  globalThis.fetch = async () => {
+    attempts += 1;
+    if (attempts === 1) {
+      return {
+        ok: false,
+        status: 503,
+        headers: { get: () => null },
+        text: async () => 'temporarily unavailable',
+      };
+    }
+    return {
+      ok: true,
+      status: 200,
+      headers: { get: () => null },
+      text: async () => JSON.stringify({ result: { content: [{ type: 'text', text: '{"ok":true}' }] } }),
+    };
+  };
+
+  try {
+    const result = await callMcpTool(
+      {
+        production: {
+          status: 'connected',
+          url: 'http://127.0.0.1:3000/mcp/',
+          retry: { maxAttempts: 2, backoffMs: 0 },
+        },
+      },
+      'production',
+      'production_start_job',
+      { type: 'doctor' },
+      null,
+      { onRetry: (event) => retries.push(event) },
+    );
+
+    assert.equal(attempts, 2);
+    assert.equal(retries.length, 1);
+    assert.match(retries[0].error.message, /503/);
+    assert.equal(result.content[0].text, '{"ok":true}');
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test('callMcpTool retries tool result errors', async () => {
+  const originalFetch = globalThis.fetch;
+  let attempts = 0;
+  globalThis.fetch = async () => {
+    attempts += 1;
+    return {
+      ok: true,
+      status: 200,
+      headers: { get: () => null },
+      text: async () => JSON.stringify({
+        result: attempts === 1
+          ? { isError: true, content: [{ type: 'text', text: 'rate limited' }] }
+          : { content: [{ type: 'text', text: '{"ok":true}' }] },
+      }),
+    };
+  };
+
+  try {
+    const result = await callMcpTool(
+      {
+        production: {
+          status: 'connected',
+          url: 'http://127.0.0.1:3000/mcp/',
+        },
+      },
+      'production',
+      'production_start_job',
+      { type: 'doctor' },
+      null,
+      { retry: { maxAttempts: 2, backoffMs: 0 } },
+    );
+
+    assert.equal(attempts, 2);
+    assert.equal(result.content[0].text, '{"ok":true}');
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test('resolveRetryPolicy supports endpoint and tool overrides', () => {
+  const policy = resolveRetryPolicy({
+    retry: { maxAttempts: 2, backoffMs: 100 },
+    toolRetries: {
+      production_start_job: { maxAttempts: 4 },
+    },
+  }, 'production_start_job');
+
+  assert.deepEqual(policy, { maxAttempts: 4, backoffMs: 100 });
+});
+
 test('discoverMcpTools downgrades connected endpoint when tool discovery fails', async () => {
   const originalFetch = globalThis.fetch;
   globalThis.fetch = async () => ({

package/src/core/plan.js

@@ -1,6 +1,11 @@
 export function ensurePlanFromActivity(session, activity) {
   if (!activity) return;
   const actKey = activity.key ?? null;
+  if (session.headlessPlan?.some((step) => step.owner === 'orchestrator')) {
+    attachActivityToExistingPlan(session.headlessPlan, activity);
+    session._onPlanUpdate?.();
+    return;
+  }
   // Same activity still being tracked — preserve current plan state (polling update).
   if (session.headlessPlan && actKey !== null && session.headlessPlan[0]?._activityKey === actKey) return;
   const steps = activity.plan?.steps;
@@ -10,6 +15,8 @@ export function ensurePlanFromActivity(session, activity) {
       id: s.id ?? null,
       description: s.label,
       status: 'pending',
+      owner: 'activity',
+      ownerActivityKey: activity.key,
       _activityKey: activity.key,
     }));
   } else {
@@ -18,6 +25,8 @@ export function ensurePlanFromActivity(session, activity) {
       id: null,
       description: activity.label,
       status: 'pending',
+      owner: 'activity',
+      ownerActivityKey: activity.key,
       _activityKey: activity.key,
     }];
   }
@@ -179,3 +188,27 @@ function statusRank(status) {
   if (status === 'done') return 2;
   return 3;
 }
+
+export function attachActivityToExistingPlan(plan, activity) {
+  const actKey = activity.key ?? activity.id ?? activity.jobId ?? null;
+  if (!actKey) return;
+  const matched = plan.find((step) => step.activityKey === actKey)
+    ?? plan.find((step) => step.ownerActivityKey === actKey)
+    ?? plan.find((step) => step.status === 'pending')
+    ?? plan.find((step) => step.status === 'running');
+  if (!matched) return;
+  matched.activityKey = actKey;
+  if (!matched.ownerActivityKey) matched.ownerActivityKey = actKey;
+  const failed = ['failed', 'error', 'cancelled', 'canceled'].includes(String(activity.status).toLowerCase());
+  if (activity.terminal) {
+    matched.status = failed ? 'failed' : 'done';
+    return;
+  }
+  if (!failed) {
+    for (const step of plan) {
+      if (step.status === 'failed') continue;
+      if (step.step < matched.step) step.status = 'done';
+      else if (step.step === matched.step) step.status = 'running';
+    }
+  }
+}

package/src/core/queueStore.test.js

@@ -25,6 +25,7 @@ test('job queue uses an injected queue store', () => {
   const item = enqueueProductionJob(session, { type: 'build' }, 'workspace_busy');
 
   assert.equal(item.workspace, 'docs');
+  assert.match(item.id, /^q-[0-9a-f-]{36}$/);
   assert.equal(queue.length, 1);
   assert.equal(ensureJobQueue(session), queue);
   assert.equal(changed, 1);

package/src/core/sessionConfig.js

@@ -0,0 +1,24 @@
+import { createLlmClientFromWikiConfig } from '../agent/llm.js';
+import { loadWikircProfile, summarizeWikircConfig } from './wikirc.js';
+
+export function applySessionWikircProfile(session, profileName = 'default') {
+  if (!session.workspacePath) {
+    throw new Error('No workspace loaded. Use /use <workspace>.');
+  }
+  const loaded = loadWikircProfile(session.workspacePath, profileName);
+  session.wikirc = {
+    profile: loaded.profile.name,
+    fileName: loaded.profile.fileName,
+    path: loaded.profile.path,
+  };
+  session.wikircConfig = loaded.config;
+  session.language = loaded.config?.language ?? null;
+  session.llm = createLlmClientFromWikiConfig(loaded.config);
+  if (session.mcp?.production) {
+    session.mcp.production.activeConfigPath = loaded.profile.fileName;
+  }
+  return {
+    summary: summarizeWikircConfig(loaded.profile, loaded.config),
+    config: loaded.config,
+  };
+}

package/src/core/wikiWorkspace.test.js

@@ -0,0 +1,24 @@
+import { readFile } from 'node:fs/promises';
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+test('wiki-workspace autostarts host runtime before workspace services', async () => {
+  const script = await readFile(new URL('../../wiki-workspace', import.meta.url), 'utf8');
+
+  assert.match(script, /ensure_runtime_up\(\) \{/);
+  assert.match(script, /WIKI_MANAGER_RUNTIME_AUTOSTART:-1/);
+  assert.match(script, /Starting host agent-runtime/);
+  assert.match(script, /start_workspace_services\(\) \{\n  ensure_runtime_up\n  compose_for_workspace "\$1" up -d serve mcp-http production-mcp/);
+  assert.match(script, /start_workspace_services "\$workspace"\n\n  local serve_port prod_port/);
+  assert.match(script, /start_workspace_services "\$workspace"\n      local serve_port production_port/);
+  assert.match(script, /ensure_runtime_up\n      printf 'Starting mcp-http/);
+});
+
+test('wiki-workspace checks runtime pid command before killing', async () => {
+  const script = await readFile(new URL('../../wiki-workspace', import.meta.url), 'utf8');
+
+  assert.match(script, /runtime_pid_command\(\) \{/);
+  assert.match(script, /runtime_pid_matches\(\) \{/);
+  assert.match(script, /if ! runtime_pid_matches; then\n        printf 'refusing to stop pid/);
+  assert.match(script, /kill "\$\(cat "\$pid_file"\)"/);
+});

package/src/runtime/approvals.js

@@ -0,0 +1,113 @@
+import { randomUUID } from 'node:crypto';
+import { createAgentEvent, dispatchAgentEvent } from '../core/agentEvents.js';
+
+const DEFAULT_APPROVAL_TIMEOUT_MS = 10 * 60 * 1000;
+
+export function createApprovalManager(session, {
+  defaultTimeoutMs = DEFAULT_APPROVAL_TIMEOUT_MS,
+} = {}) {
+  const pending = new Map();
+
+  async function requestApproval(request = {}) {
+    const scope = request.scope === 'tool' ? 'tool' : 'run';
+    const approvalId = request.approvalId ?? randomUUID();
+    const runId = request.runId ?? session._currentRunIdentity?.runId ?? null;
+    const timeoutMs = Number.isFinite(Number(request.timeoutMs))
+      ? Math.max(1, Number(request.timeoutMs))
+      : defaultTimeoutMs;
+    const eventType = scope === 'tool' ? 'tool_pending_approval' : 'run_pending_approval';
+    const approvedType = scope === 'tool' ? 'tool_approved' : 'run_approved';
+
+    dispatchAgentEvent(session, createAgentEvent(eventType, {
+      origin: 'runtime',
+      runId,
+      payload: {
+        approvalId,
+        runId,
+        itemId: request.itemId ?? null,
+        reason: request.reason ?? null,
+        tool: request.tool ?? null,
+        plan: request.plan ?? null,
+        timeoutMs,
+      },
+    }));
+
+    await new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        pending.delete(approvalId);
+        const err = new Error(`Approval timed out: ${approvalId}`);
+        err.name = 'ApprovalError';
+        reject(err);
+      }, timeoutMs);
+      const cleanup = () => {
+        clearTimeout(timer);
+        request.signal?.removeEventListener('abort', onAbort);
+      };
+      const onAbort = () => {
+        pending.delete(approvalId);
+        cleanup();
+        const err = new Error(`Approval cancelled: ${approvalId}`);
+        err.name = 'AbortError';
+        reject(err);
+      };
+      pending.set(approvalId, {
+        approvalId,
+        scope,
+        runId,
+        itemId: request.itemId ?? null,
+        resolve: () => {
+          pending.delete(approvalId);
+          cleanup();
+          resolve();
+        },
+      });
+      if (request.signal?.aborted) {
+        onAbort();
+        return;
+      }
+      request.signal?.addEventListener('abort', onAbort, { once: true });
+    });
+
+    dispatchAgentEvent(session, createAgentEvent(approvedType, {
+      origin: 'runtime',
+      runId,
+      payload: {
+        approvalId,
+        runId,
+        itemId: request.itemId ?? null,
+      },
+    }));
+    return { approved: true, approvalId, runId, itemId: request.itemId ?? null };
+  }
+
+  function approve({ approvalId = null, runId = null, itemId = null } = {}) {
+    const entry = approvalId
+      ? pending.get(approvalId)
+      : [...pending.values()].find((item) =>
+          (runId && item.runId === runId) || (itemId && item.itemId === itemId),
+        );
+    if (!entry) return { approved: false, reason: 'approval not found' };
+    entry.resolve();
+    return {
+      approved: true,
+      approvalId: entry.approvalId,
+      runId: entry.runId,
+      itemId: entry.itemId,
+    };
+  }
+
+  function list() {
+    return [...pending.entries()].map(([approvalId, item]) => ({
+      approvalId,
+      scope: item.scope,
+      runId: item.runId,
+      itemId: item.itemId,
+    }));
+  }
+
+  return {
+    requestApproval,
+    approve,
+    list,
+  };
+}

package/src/runtime/auth.test.js

@@ -4,6 +4,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import test from 'node:test';
 import { resolveRuntimeAuthToken } from './auth.js';
+import { assertRuntimeNode, runtimeNodeExecutable } from './lifecycle.js';
 
 test('resolveRuntimeAuthToken: loopback host does not require token', () => {
   const result = resolveRuntimeAuthToken({ host: '127.0.0.1', explicitToken: null });
@@ -19,3 +20,10 @@ test('resolveRuntimeAuthToken: exposed host generates and reuses token', () => {
   assert.equal(second.source, 'file');
   assert.equal(second.token, first.token);
 });
+
+test('runtime lifecycle uses a Node executable with node:sqlite support', async () => {
+  const runtimeNode = await assertRuntimeNode(runtimeNodeExecutable());
+
+  assert.ok(runtimeNode.executable);
+  assert.ok(Number(runtimeNode.version.split('.')[0]) >= 22);
+});

package/src/runtime/client.js

@@ -4,6 +4,12 @@ function base(url) {
   return url.replace(/\/$/, '');
 }
 
+function runtimeEndpoint(url, path, workspace = null) {
+  const endpoint = new URL(`${base(url)}${path}`);
+  if (workspace) endpoint.searchParams.set('workspace', workspace);
+  return endpoint.toString();
+}
+
 export function runtimeUrlFromEnv() {
   return process.env.WIKI_MANAGER_RUNTIME_URL ?? 'http://127.0.0.1:7788';
 }
@@ -11,8 +17,9 @@ export function runtimeUrlFromEnv() {
 export async function fetchRuntimeState({
   url = runtimeUrlFromEnv(),
   token = runtimeToken(),
+  workspace = null,
 } = {}) {
-  const response = await fetch(`${base(url)}/state`, {
+  const response = await fetch(runtimeEndpoint(url, '/state', workspace), {
     headers: runtimeHeaders(token),
   });
   if (!response.ok) throw new Error(`Runtime state failed: HTTP ${response.status}`);
@@ -22,8 +29,9 @@ export async function fetchRuntimeState({
 export async function checkRuntimeHealth({
   url = runtimeUrlFromEnv(),
   token = runtimeToken(),
+  workspace = null,
 } = {}) {
-  const response = await fetch(`${base(url)}/health`, {
+  const response = await fetch(runtimeEndpoint(url, '/health', workspace), {
     headers: runtimeHeaders(token),
   });
   if (!response.ok) return null;
@@ -34,14 +42,16 @@ export async function postRuntimeRun(input, {
   url = runtimeUrlFromEnv(),
   token = runtimeToken(),
   workspace = null,
+  evaluate = undefined,
+  replans = undefined,
 } = {}) {
-  const response = await fetch(`${base(url)}/run`, {
+  const response = await fetch(runtimeEndpoint(url, '/run', workspace), {
     method: 'POST',
     headers: {
       ...runtimeHeaders(token),
       'Content-Type': 'application/json',
     },
-    body: JSON.stringify({ input, workspace }),
+    body: JSON.stringify(Object.assign({ input, workspace }, evaluate !== undefined && { evaluate }, replans !== undefined && { replans })),
   });
   if (!response.ok) throw new Error(`Runtime run failed: HTTP ${response.status}`);
   return response.json();
@@ -50,8 +60,9 @@ export async function postRuntimeRun(input, {
 export async function postRuntimeCancel({
   url = runtimeUrlFromEnv(),
   token = runtimeToken(),
+  workspace = null,
 } = {}) {
-  const response = await fetch(`${base(url)}/cancel`, {
+  const response = await fetch(runtimeEndpoint(url, '/cancel', workspace), {
     method: 'POST',
     headers: runtimeHeaders(token),
   });
@@ -59,6 +70,40 @@ export async function postRuntimeCancel({
   return response.json();
 }
 
+export async function postRuntimeResume({
+  url = runtimeUrlFromEnv(),
+  token = runtimeToken(),
+  workspace = null,
+} = {}) {
+  const response = await fetch(runtimeEndpoint(url, '/resume', workspace), {
+    method: 'POST',
+    headers: runtimeHeaders(token),
+  });
+  if (!response.ok) throw new Error(`Runtime resume failed: HTTP ${response.status}`);
+  return response.json();
+}
+
+export async function postRuntimeApprove({
+  url = runtimeUrlFromEnv(),
+  token = runtimeToken(),
+  workspace = null,
+  runId = null,
+  itemId = null,
+  approvalId = null,
+} = {}) {
+  const endpoint = runtimeEndpoint(url, '/approve', workspace);
+  const parsed = new URL(endpoint);
+  if (runId) parsed.searchParams.set('runId', runId);
+  if (itemId) parsed.searchParams.set('itemId', itemId);
+  if (approvalId) parsed.searchParams.set('approvalId', approvalId);
+  const response = await fetch(parsed.toString(), {
+    method: 'POST',
+    headers: runtimeHeaders(token),
+  });
+  if (!response.ok) throw new Error(`Runtime approve failed: HTTP ${response.status}`);
+  return response.json();
+}
+
 function runtimeHeaders(token) {
   return token ? { Authorization: `Bearer ${token}` } : {};
 }
@@ -67,8 +112,9 @@ export async function* streamRuntimeEvents({
   url = runtimeUrlFromEnv(),
   token = runtimeToken(),
   signal = null,
+  workspace = null,
 } = {}) {
-  const response = await fetch(`${base(url)}/events/stream`, {
+  const response = await fetch(runtimeEndpoint(url, '/events/stream', workspace), {
     headers: { ...runtimeHeaders(token), Accept: 'text/event-stream' },
     signal,
   });