sneakoscope 6.7.0 → 7.0.0

package/dist/core/codex-app.js

@@ -10,6 +10,8 @@ import { GLM_CODEX_CONFIG_PROVIDER_ID, GLM_CODEX_CONFIG_REASONING_PROFILES } fro
 import { GLM_52_OPENROUTER_MODEL } from './providers/glm/glm-52-settings.js';
 import { resolveOpenRouterApiKey } from './providers/openrouter/openrouter-secret-store.js';
 import { codexLbEnvPath, loadCodexLbEnv, parseShellEnvValue, readCodexLbModelCatalog } from './codex-lb/codex-lb-env.js';
+import { codexLbToolCatalogPath, inspectCodexLbToolCatalog } from './codex-lb/codex-lb-tool-catalog.js';
+import { isSksOwnedGlobalUiLock } from './codex-app/codex-app-ui-state-snapshot.js';
 import { redactString } from './secret-redaction.js';
 export const CODEX_APP_DOCS_URL = 'https://developers.openai.com/codex/app/features';
 export const CODEX_CHANGELOG_URL = 'https://developers.openai.com/codex/changelog';
@@ -865,9 +867,18 @@ async function codexFastModeConfigStatus(opts = {}) {
     for (const config of configs) {
         if (!config.text)
             continue;
-        const topLevel = topLevelToml(config.text);
-        if (/(^|\n)\s*model_reasoning_effort\s*=/.test(topLevel))
-            blockers.push(`${config.scope}:top_level_model_reasoning_effort`);
+        const lines = String(config.text).split(/\r?\n/);
+        const topLevelEnd = lines.findIndex((line) => /^\s*\[/.test(line));
+        const topLevelBound = topLevelEnd === -1 ? lines.length : topLevelEnd;
+        for (let index = 0; index < topLevelBound; index += 1) {
+            const line = lines[index] || '';
+            if (!/^\s*model_reasoning_effort\s*=/.test(line))
+                continue;
+            // Preserve unmarked user reasoning choices. Only SKS-provenanced locks hide Fast UI.
+            if (config.scope === 'global' ? isSksOwnedGlobalUiLock(lines, index) : true) {
+                blockers.push(`${config.scope}:top_level_model_reasoning_effort`);
+            }
+        }
         if (/(^|\n)\s*fast_default_opt_out\s*=\s*true\s*(?:#.*)?(?=\n|$)/.test(tomlTable(config.text, 'notice')))
             blockers.push(`${config.scope}:fast_default_opt_out`);
     }
@@ -946,11 +957,39 @@ export async function codexProviderModelUiStatus(opts = {}) {
         && hasTomlBoolean(codexLbProvider, 'supports_websockets', true)
         && hasTomlBoolean(codexLbProvider, 'requires_openai_auth', true);
     const codexLbSelectedDefault = /(?:^|\n)\s*model_provider\s*=\s*"codex-lb"\s*(?:#.*)?(?=\n|$)/.test(topLevelToml(globalConfig));
-    let codexLbModelCatalog = opts.codexLbModelCatalog || null;
-    if (!codexLbModelCatalog && codexLbProviderContractOk && codexLbApiKeySource !== 'missing' && codexLbBaseUrlSource !== 'missing') {
+    const managedCatalogPath = codexLbToolCatalogPath(path.join(home || '', '.codex'));
+    const configuredCatalogPath = topLevelToml(globalConfig).match(/(?:^|\n)\s*model_catalog_json\s*=\s*"([^"]+)"\s*(?:#.*)?(?=\n|$)/)?.[1] || '';
+    const managedCatalogConfigured = Boolean(configuredCatalogPath)
+        && path.resolve(configuredCatalogPath) === path.resolve(managedCatalogPath);
+    let persistedCatalog = null;
+    if (!opts.codexLbModelCatalog && managedCatalogConfigured) {
+        persistedCatalog = await inspectCodexLbToolCatalog(managedCatalogPath).catch(() => null);
+    }
+    let liveCatalog = opts.codexLbModelCatalog || null;
+    if (!liveCatalog && !persistedCatalog?.ok && codexLbProviderContractOk && codexLbApiKeySource !== 'missing' && codexLbBaseUrlSource !== 'missing') {
         const loadedEnv = await loadCodexLbEnv({ home, envPath: codexLbEnvFilePath }).catch(() => null);
-        codexLbModelCatalog = loadedEnv ? await readCodexLbModelCatalog({ loadedEnv }).catch(() => null) : null;
+        liveCatalog = loadedEnv ? await readCodexLbModelCatalog({ loadedEnv }).catch(() => null) : null;
     }
+    // Prefer the persisted Codex-owned catalog that Desktop actually loads. Live
+    // /models remains freshness telemetry and a fallback when no managed file exists.
+    const codexLbModelCatalog = opts.codexLbModelCatalog || (persistedCatalog?.ok
+        ? {
+            ok: true,
+            models: Array.isArray(persistedCatalog.gpt56_models) ? persistedCatalog.gpt56_models : [],
+            blockers: [],
+            source: 'persisted_model_catalog_json',
+            tools_transport: persistedCatalog.tools_transport || null
+        }
+        : liveCatalog
+            ? { ...liveCatalog, source: liveCatalog.source || 'live_models' }
+            : persistedCatalog
+                ? {
+                    ok: false,
+                    models: Array.isArray(persistedCatalog.gpt56_models) ? persistedCatalog.gpt56_models : [],
+                    blockers: persistedCatalog.blockers || ['codex_lb_persisted_catalog_invalid'],
+                    source: 'persisted_model_catalog_json'
+                }
+                : null);
     const expectedCodexLbModels = ['gpt-5.6-luna', 'gpt-5.6-terra', 'gpt-5.6-sol'];
     const catalogModels = Array.isArray(codexLbModelCatalog?.models) ? codexLbModelCatalog.models.map(String) : [];
     const expectedCodexLbModelsPresent = expectedCodexLbModels.every((model) => catalogModels.includes(model));
@@ -964,6 +1003,9 @@ export async function codexProviderModelUiStatus(opts = {}) {
         ...(codexLbProviderPresent && !codexLbProviderContractOk ? ['codex_lb_provider_contract_drift'] : []),
         ...(codexLbApiKeySource !== 'missing' ? [] : ['codex_lb_api_key_missing']),
         ...(codexLbBaseUrlSource !== 'missing' ? [] : ['codex_lb_base_url_missing']),
+        ...(codexLbSelectedDefault && !managedCatalogConfigured && !expectedCodexLbModelsPresent
+            ? ['codex_lb_model_catalog_json_unselected']
+            : []),
         ...(codexLbProviderContractOk && codexLbApiKeySource !== 'missing' && codexLbBaseUrlSource !== 'missing' && !expectedCodexLbModelsPresent
             ? ['codex_lb_gpt_5_6_catalog_unverified']
             : [])
@@ -1022,9 +1064,13 @@ export async function codexProviderModelUiStatus(opts = {}) {
             base_url_source: codexLbBaseUrlSource,
             model_catalog_checked: Boolean(codexLbModelCatalog),
             model_catalog_ok: codexLbModelCatalog?.ok === true,
+            model_catalog_source: codexLbModelCatalog?.source || null,
+            model_catalog_json_configured: managedCatalogConfigured,
+            model_catalog_json_path: managedCatalogConfigured ? managedCatalogPath : configuredCatalogPath || null,
             model_catalog_models: catalogModels,
             expected_models: expectedCodexLbModels,
             expected_models_present: expectedCodexLbModelsPresent,
+            tools_transport: codexLbModelCatalog?.tools_transport || null,
             model_catalog_blockers: codexLbModelCatalog?.blockers || [],
             setup_command: setupCommand,
             set_key_command: setKeyCommand,

package/dist/core/hooks-runtime.js

@@ -34,6 +34,8 @@ import { recordOfficialSubagentParentOutcomesTelemetry, recordOfficialSubagentZe
 import { bindTrustworthySubagentParentSummaryToRun, normalizeSubagentEvent, normalizeSubagentParentSummary, persistOrReuseTrustworthySubagentParentSummary, readSubagentEvents, recordSubagentEvent, SUBAGENT_EVIDENCE_FILENAME, SUBAGENT_PARENT_SUMMARY_FILENAME, writeSubagentEvidence } from './subagents/subagent-evidence.js';
 import { officialSubagentPreparationInProgress, withOfficialSubagentLifecycleLock, writeNarutoGate } from './subagents/official-subagent-preparation.js';
 import { effectiveSubagentTarget, normalizeLegacySubagentCountFields, refreshSubagentWaveLifecycle, subagentCountContractBlockers } from './subagents/wave-lifecycle.js';
+import { buildWaveParentGuidance, renderWaveParentGuidance } from './subagents/wave-parent-guidance.js';
+import { managedOfficialSubagentRoleByName } from './managed-assets/managed-assets-manifest.js';
 import { SSOT_GUARD_ARTIFACT, validateSsotGuardArtifact } from './safety/ssot-guard.js';
 const LIGHT_ROUTE_STOP_ARTIFACT = 'light-route-stop.json';
 const CODEX_GIT_ACTION_STOP_ARTIFACT = 'codex-git-action-stop-bypass.json';
@@ -134,16 +136,60 @@ async function hookSubagentStart(root, state, payload = {}, sessionKey = null) {
     const config = await readOfficialSubagentConfig(root);
     const budget = resolveSubagentThreadBudget({ configuredMaxThreads: config.maxThreads });
     const active = subagentRouteContext(state);
+    const routingContext = await sealedSubagentRoutingContext(artifactDir, payload);
     const resourceGuard = [
         `SKS subagent policy: Codex [agents].max_threads is ${budget.maxThreads}.`,
         'Use max_depth=1. Subagents must not spawn subagents.',
         'Do not duplicate an already assigned slice.',
         'Parallel writes require disjoint paths; serialize overlapping paths.',
-        'Close completed agent threads when no longer needed.'
+        'Finish only your assigned slice, return a concise result, then stop so the root parent can close this thread.'
     ].join(' ');
-    const additionalContext = [coreEngineeringDirectiveReferenceText(), resourceGuard, active].filter(Boolean).join('\n\n');
+    const additionalContext = [coreEngineeringDirectiveReferenceText(), resourceGuard, routingContext, active].filter(Boolean).join('\n\n');
     return { continue: true, additionalContext };
 }
+async function sealedSubagentRoutingContext(artifactDir, payload = {}) {
+    const plan = await readJson(path.join(artifactDir, 'subagent-plan.json'), null).catch(() => null);
+    if (!plan || plan.workflow !== 'official_codex_subagent')
+        return '';
+    const agentName = extractSubagentAgentName(payload);
+    const agents = plan.agents && typeof plan.agents === 'object' ? plan.agents : {};
+    const planned = agentName && agents[agentName] ? agents[agentName] : null;
+    const role = agentName ? managedOfficialSubagentRoleByName(agentName) : null;
+    const model = String(planned?.routed_model || planned?.model || role?.model || '').trim();
+    const effort = String(planned?.routed_model_reasoning_effort || planned?.model_reasoning_effort || role?.model_reasoning_effort || '').trim();
+    if (!agentName && !model)
+        return '';
+    return [
+        'SKS sealed child routing:',
+        agentName ? `- custom agent: ${agentName}` : null,
+        model ? `- model: ${model}` : null,
+        effort ? `- model_reasoning_effort: ${effort}` : null,
+        '- keep this sealed profile; do not retarget model/effort or spawn nested agents'
+    ].filter(Boolean).join('\n');
+}
+function extractSubagentAgentName(payload = {}) {
+    const candidates = [
+        payload.agent_type,
+        payload.agentType,
+        payload.subagent_type,
+        payload.subagentType,
+        payload.agent_name,
+        payload.agentName,
+        payload.agent,
+        payload.role,
+        payload.payload?.agent_type,
+        payload.payload?.agentType,
+        payload.payload?.subagent_type,
+        payload.data?.agent_type,
+        payload.input?.agent_type
+    ];
+    for (const value of candidates) {
+        const name = String(value || '').trim();
+        if (name)
+            return name;
+    }
+    return '';
+}
 function subagentRouteContext(state = {}) {
     if (!state?.route && !state?.mode)
         return '';
@@ -486,7 +532,6 @@ function activeGoalOverlayContext(state = {}, route = null) {
     ].join('\n');
 }
 async function hookPreTool(root, state, payload, noQuestion, sessionKey = null) {
-    void sessionKey;
     if (needsMutationSafetyCheck(payload)) {
         const madSksImmutableDecision = await checkMadSksImmutableModification(root, state, payload);
         if (madSksImmutableDecision.action === 'block') {
@@ -510,8 +555,37 @@ async function hookPreTool(root, state, payload, noQuestion, sessionKey = null)
         return agentRecursionDecision;
     if (noQuestion && looksInteractiveCommand(command))
         return { decision: 'block', reason: interactiveCommandReason(command) };
+    const waveGuidance = await parentWaveGuidanceContext(root, state, sessionKey).catch(() => '');
+    if (waveGuidance) {
+        return {
+            continue: true,
+            additionalContext: waveGuidance,
+            systemMessage: visibleHookMessage('pre-tool', 'SKS Naruto wave lifecycle requires root-parent follow-up.')
+        };
+    }
     return { continue: true };
 }
+async function parentWaveGuidanceContext(root, state = {}, sessionKey = null) {
+    if (!state?.mission_id && !state?.official_subagent_run_id)
+        return '';
+    const isNaruto = String(state?.mode || '').toUpperCase() === 'NARUTO'
+        || String(state?.route || state?.route_command || '').replace(/^\$/, '').toUpperCase() === 'NARUTO'
+        || state?.subagents_required === true;
+    if (!isNaruto)
+        return '';
+    // Child worker hooks must not receive parent wave spawn instructions.
+    if (agentWorkerHookContext(state, {}))
+        return '';
+    const artifactDir = officialSubagentArtifactDir(root, state, sessionKey);
+    const plan = await readJson(path.join(artifactDir, 'subagent-plan.json'), null).catch(() => null);
+    if (!plan || plan.workflow !== 'official_codex_subagent')
+        return '';
+    const lifecycle = plan.wave_lifecycle || null;
+    const guidance = lifecycle?.parent_guidance || buildWaveParentGuidance(lifecycle);
+    if (!guidance?.required)
+        return '';
+    return renderWaveParentGuidance(guidance);
+}
 function agentWorkerHookRecursionDecision(state = {}, payload = {}, command = '') {
     if (!agentWorkerHookContext(state, payload))
         return null;

package/dist/core/managed-assets/managed-assets-manifest.js

@@ -1,7 +1,7 @@
 import { sha256 } from '../fsx.js';
 import { subagentModelProfile } from '../subagents/model-policy.js';
 export const MANAGED_ASSET_SCHEMA_VERSION = 1;
-export const MANAGED_ASSET_VERSION = '6.7.0';
+export const MANAGED_ASSET_VERSION = '7.0.0';
 export const MANAGED_ASSET_MARKER = 'SKS-MANAGED-ASSET';
 export const MANAGED_OFFICIAL_SUBAGENT_MARKER = 'SKS-MANAGED-OFFICIAL-SUBAGENT';
 /** Internal cleanup tombstones for SKS-owned role files retired from the installed catalog. */

package/dist/core/release/package-size-budget.js

@@ -1,2 +1,2 @@
-export const DEFAULT_MAX_PACK_BYTES = 2448 * 1024;
+export const DEFAULT_MAX_PACK_BYTES = 2464 * 1024;
 export const DEFAULT_MAX_UNPACKED_BYTES = 11_141_120;

package/dist/core/subagents/official-subagent-config.js

@@ -58,17 +58,20 @@ export async function readOfficialSubagentConfig(root, opts = {}) {
     const maxDepth = resolveLayeredValue(projectLayer.agents.max_depth, globalLayer.agents.max_depth, DEFAULT_OFFICIAL_SUBAGENT_MAX_DEPTH, positiveInteger);
     const jobMaxRuntimeSeconds = resolveLayeredValue(projectLayer.agents.job_max_runtime_seconds, globalLayer.agents.job_max_runtime_seconds, DEFAULT_OFFICIAL_SUBAGENT_JOB_MAX_RUNTIME_SECONDS, positiveInteger);
     const interruptMessage = resolveLayeredValue(projectLayer.agents.interrupt_message, globalLayer.agents.interrupt_message, DEFAULT_OFFICIAL_SUBAGENT_INTERRUPT_MESSAGE, booleanValue);
-    const warnings = maxDepth.value > 1
-        ? [`official_subagent_max_depth_above_one_preserved:${maxDepth.value}:${maxDepth.source}`]
+    // Official Naruto admits only depth=1. Coerce higher values so they cannot
+    // contradict the launcher hard-enforcement or look "supported".
+    const depthCoerced = maxDepth.value > 1;
+    const warnings = depthCoerced
+        ? [`official_subagent_max_depth_coerced_to_one:${maxDepth.value}:${maxDepth.source}`]
         : [];
     return {
         maxThreads: maxThreads.value,
-        maxDepth: maxDepth.value,
+        maxDepth: depthCoerced ? DEFAULT_OFFICIAL_SUBAGENT_MAX_DEPTH : maxDepth.value,
         jobMaxRuntimeSeconds: jobMaxRuntimeSeconds.value,
         interruptMessage: interruptMessage.value,
         sources: {
             maxThreads: maxThreads.source,
-            maxDepth: maxDepth.source,
+            maxDepth: depthCoerced ? 'default' : maxDepth.source,
             jobMaxRuntimeSeconds: jobMaxRuntimeSeconds.source,
             interruptMessage: interruptMessage.source
         },
@@ -85,7 +88,7 @@ export function officialSubagentConfigWarnings(text = '', inheritedText = '') {
         return [];
     const maxDepth = resolveLayeredValue(project.agents.max_depth, inherited.agents.max_depth, DEFAULT_OFFICIAL_SUBAGENT_MAX_DEPTH, positiveInteger);
     return maxDepth.value > 1
-        ? [`official_subagent_max_depth_above_one_preserved:${maxDepth.value}:${maxDepth.source}`]
+        ? [`official_subagent_max_depth_coerced_to_one:${maxDepth.value}:${maxDepth.source}`]
         : [];
 }
 export async function readInheritedOfficialSubagentConfigText(projectConfigPath, opts = {}) {

package/dist/core/subagents/official-subagent-preparation.js

@@ -10,6 +10,7 @@ import { NARUTO_PARENT_EFFORT, NARUTO_PARENT_MODEL } from './model-policy.js';
 import { MAX_ON_DEMAND_SUBAGENT_ROLE_COUNT, officialSubagentFanoutPolicy, officialSubagentOnDemandRolePlan, officialSubagentRoleCatalog, recommendOfficialSubagentRoles } from './agent-catalog.js';
 import { resolveSubagentThreadBudget } from './thread-budget.js';
 import { createSubagentWaveLifecycle } from './wave-lifecycle.js';
+import { decideOfficialSubagentModel } from '../agents/agent-effort-policy.js';
 import { readBoundedTriwikiAttention } from './triwiki-attention.js';
 import { SUBAGENT_EVIDENCE_FILENAME, SUBAGENT_EVENT_LOG_FILENAME, SUBAGENT_PARENT_SUMMARY_FILENAME, normalizeSubagentParentSummary, writeSubagentEvidence } from './subagent-evidence.js';
 import { sksPrefixedDollarCommand, unprefixedSksSkillName } from '../routes/dollar-prefix.js';
@@ -113,6 +114,28 @@ async function prepareOfficialSubagentMissionLocked(input) {
         recommendedAgents: suggestedAgents
     });
     const selectedAgentPlan = officialSubagentOnDemandRolePlan(suggestedAgents);
+    const agentRouting = Object.fromEntries(Object.entries(selectedAgentPlan).map(([name, config]) => {
+        const decision = decideOfficialSubagentModel({
+            persona: {
+                role: name,
+                naruto_role: name,
+                write_policy: config.sandbox_mode === 'read-only' ? 'read-only' : 'route-local-artifact',
+                read_only: config.sandbox_mode === 'read-only'
+            },
+            prompt: goal,
+            agentId: name,
+            readonly: config.sandbox_mode === 'read-only'
+        });
+        return [name, {
+                ...config,
+                // Catalog TOML remains the spawn-type contract; dynamic decision records why
+                // this role maps onto the sealed four-profile matrix for this goal.
+                routed_model: decision.model,
+                routed_model_reasoning_effort: decision.model_reasoning_effort,
+                routed_model_policy: decision.model_selection_reason,
+                routing_dynamic: true
+            }];
+    }));
     const agentCatalog = onDemandAgentCatalogMetadata(selectedAgentPlan);
     const ssotGuard = buildSsotGuard({ route: input.route, mode: mode === 'naruto' ? 'NARUTO' : 'OFFICIAL_SUBAGENT', task: goal });
     const ssotGuardValidation = validateSsotGuardArtifact(ssotGuard);
@@ -164,7 +187,7 @@ async function prepareOfficialSubagentMissionLocked(input) {
             model_reasoning_effort: NARUTO_PARENT_EFFORT
         },
         agent_catalog: agentCatalog,
-        agents: selectedAgentPlan,
+        agents: agentRouting,
         verification_budget: verification,
         verification_checks: [],
         verification: { budget: verification },

package/dist/core/subagents/official-subagent-prompt.js

@@ -88,11 +88,12 @@ Subagent rules:
 - if paths overlap, run those slices serially
 - reject duplicate slice fingerprints and homogeneous clone work; diversity may come from roles, disjoint shards, or different tool surfaces
 - security, database, release, authorization, and irreversible-effect checks are protected strata; aggregate speed or accuracy never offsets a failed protected gate
-- after each settled wave: collect results, close completed threads, refresh evidence and the wave lifecycle ledger, rescan the ready DAG, then launch the next defensible direct-child wave when useful work remains
+- after each settled wave: collect results, close completed threads, refresh evidence and the wave lifecycle ledger, read \`wave_lifecycle.next_parent_actions\` / \`parent_guidance\`, rescan the ready DAG, then launch the next defensible direct-child wave when \`remaining_to_start > 0\`
 - recovered thread capacity is reusable by later root-owned waves; completed child threads do not permanently consume the mission fan-out budget
+- when PreTool/UserPrompt guidance says \`spawn_next_direct_child_wave_upto:N\`, spawn that next wave immediately with sealed custom-agent model/effort profiles; do not wait for another user message
 - automatic targets may resize between waves when the ready DAG changes, but update plan/evidence before spawning; explicit operator and route-owned counts remain exact
 - wait for every final planned subagent before integrating
-- close completed threads after collecting results
+- close completed threads after collecting results so capacity returns to the root parent
 ${parentDecompositionRequired ? `- decomposition status: parent_required
 - before spawning, decompose the goal into independent, non-overlapping slices
 - do not invent write scopes merely to reach the requested count

package/dist/core/subagents/wave-lifecycle.js

@@ -2,6 +2,7 @@ import path from 'node:path';
 import { nowIso, readJson, writeJsonAtomic } from '../fsx.js';
 import { readSubagentEvents } from './subagent-evidence.js';
 import { MAX_AUTOMATIC_SUBAGENT_COUNT } from './agent-catalog.js';
+import { buildWaveParentGuidance } from './wave-parent-guidance.js';
 export const SUBAGENT_WAVE_LIFECYCLE_SCHEMA = 'sks.subagent-wave-lifecycle.v1';
 export function subagentCountPolicy(plan) {
     const lifecycle = plan?.wave_lifecycle;
@@ -89,6 +90,15 @@ export function createSubagentWaveLifecycle(input) {
         remaining_to_start: normalizeCount(input.targetSubagents),
         post_wave_rescan_required: false,
         recovered_capacity: 0,
+        next_parent_actions: [],
+        parent_guidance: buildWaveParentGuidance({
+            remaining_to_start: normalizeCount(input.targetSubagents),
+            open_threads: 0,
+            recovered_capacity: 0,
+            post_wave_rescan_required: false,
+            current_wave: 0,
+            completed_waves: 0
+        }),
         waves: [],
         last_event: null,
         updated_at: nowIso()
@@ -188,6 +198,14 @@ function projectLifecycle(previous, input) {
     const postWaveRescanRequired = Boolean(lastWave?.status === 'settled'
         && openThreads === 0
         && remainingToStart > 0);
+    const parentGuidance = buildWaveParentGuidance({
+        remaining_to_start: remainingToStart,
+        open_threads: openThreads,
+        recovered_capacity: cumulativeSettled,
+        post_wave_rescan_required: postWaveRescanRequired,
+        current_wave: lastWave?.wave || 0,
+        completed_waves: waves.filter((wave) => wave.status === 'settled').length
+    });
     return {
         ...previous,
         workflow_run_id: input.workflowRunId,
@@ -205,6 +223,8 @@ function projectLifecycle(previous, input) {
         remaining_to_start: remainingToStart,
         post_wave_rescan_required: postWaveRescanRequired,
         recovered_capacity: cumulativeSettled,
+        next_parent_actions: parentGuidance.actions,
+        parent_guidance: parentGuidance,
         waves,
         last_event: input.lastEvent,
         updated_at: nowIso()

package/dist/core/subagents/wave-parent-guidance.js

@@ -0,0 +1,42 @@
+export const WAVE_PARENT_GUIDANCE_SCHEMA = 'sks.subagent-wave-parent-guidance.v1';
+export function buildWaveParentGuidance(lifecycle) {
+    const remaining = Math.max(0, Math.floor(Number(lifecycle?.remaining_to_start || 0)));
+    const openThreads = Math.max(0, Math.floor(Number(lifecycle?.open_threads || 0)));
+    const recovered = Math.max(0, Math.floor(Number(lifecycle?.recovered_capacity || 0)));
+    const rescan = lifecycle?.post_wave_rescan_required === true;
+    const actions = [];
+    if (openThreads > 0) {
+        actions.push('close_completed_child_threads_after_collecting_results');
+    }
+    if (rescan || remaining > 0) {
+        actions.push('refresh_wave_lifecycle_and_ready_dag');
+        actions.push(`spawn_next_direct_child_wave_upto:${Math.max(1, Math.min(remaining || recovered, recovered || remaining || 1))}`);
+    }
+    if (remaining === 0 && openThreads === 0 && !rescan) {
+        actions.push('integrate_settled_child_results_and_emit_parent_summary');
+    }
+    return {
+        schema: WAVE_PARENT_GUIDANCE_SCHEMA,
+        required: actions.some((action) => action.startsWith('spawn_next_') || action.startsWith('close_')),
+        actions: [...new Set(actions)],
+        remaining_to_start: remaining,
+        open_threads: openThreads,
+        recovered_capacity: recovered,
+        post_wave_rescan_required: rescan,
+        current_wave: Math.max(0, Math.floor(Number(lifecycle?.current_wave || 0))),
+        completed_waves: Math.max(0, Math.floor(Number(lifecycle?.completed_waves || 0)))
+    };
+}
+export function renderWaveParentGuidance(guidance) {
+    if (!guidance.required && guidance.actions.length === 0)
+        return '';
+    return [
+        'SKS Naruto wave lifecycle (root parent only):',
+        `- current_wave=${guidance.current_wave}; completed_waves=${guidance.completed_waves}`,
+        `- open_threads=${guidance.open_threads}; remaining_to_start=${guidance.remaining_to_start}; recovered_capacity=${guidance.recovered_capacity}`,
+        `- post_wave_rescan_required=${guidance.post_wave_rescan_required}`,
+        ...guidance.actions.map((action) => `- action: ${action}`),
+        '- max_depth=1: children must not spawn children; only this root may launch later direct-child waves',
+        '- after collecting results, close completed child threads so recovered capacity can be reused'
+    ].join('\n');
+}

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '6.7.0';
+export const PACKAGE_VERSION = '7.0.0';

package/dist/native/sks-menubar/Sources/AppIdentity.swift

@@ -13,7 +13,9 @@ enum AppIdentity {
     }
 
     static func statusImage(resource: String, symbol: String) -> NSImage? {
-        let image = NSImage(systemSymbolName: symbol, accessibilityDescription: "SKS status") ?? Bundle.main.image(forResource: resource)
+        // Prefer the validated custom status PDFs; fall back to SF Symbols only when missing.
+        let image = Bundle.main.image(forResource: resource)
+            ?? NSImage(systemSymbolName: symbol, accessibilityDescription: "SKS status")
         image?.isTemplate = true
         return image
     }

package/dist/native/sks-menubar/Sources/ControlCenterWindowController.swift

@@ -6,6 +6,7 @@ final class ControlCenterWindowController: NSWindowController, NSTableViewDataSo
     private let controllers: [SidebarItem: NSViewController]
     private let overviewController: OverviewViewController
     private var selected: SidebarItem = .overview
+    private var hasPresented = false
 
     init(processClient: ProcessClient, operations: OperationCoordinator, notifications: NotificationCoordinator) {
         let overview = OverviewViewController(processClient: processClient, operations: operations)
@@ -14,9 +15,9 @@ final class ControlCenterWindowController: NSWindowController, NSTableViewDataSo
             .overview: overview,
             .updates: UpdatesViewController(processClient: processClient, operations: operations, notifications: notifications),
             .mcpServers: MCPServersViewController(processClient: processClient, operations: operations, notifications: notifications),
-            .providers: ProvidersViewController(processClient: processClient),
+            .providers: ProvidersViewController(processClient: processClient, operations: operations),
             .remoteTelegram: RemoteTelegramViewController(processClient: processClient),
-            .diagnostics: DiagnosticsViewController(processClient: processClient),
+            .diagnostics: DiagnosticsViewController(processClient: processClient, operations: operations),
             .settings: SettingsViewController(notifications: notifications)
         ]
         let window = NSWindow(
@@ -38,7 +39,10 @@ final class ControlCenterWindowController: NSWindowController, NSTableViewDataSo
         if let row = SidebarItem.allCases.firstIndex(of: section) { sidebar.selectRowIndexes(IndexSet(integer: row), byExtendingSelection: false) }
         display(section)
         NSApp.activate(ignoringOtherApps: true)
-        window?.center()
+        if !hasPresented {
+            window?.center()
+            hasPresented = true
+        }
         showWindow(nil)
         window?.makeKeyAndOrderFront(nil)
     }
@@ -97,12 +101,14 @@ final class ControlCenterWindowController: NSWindowController, NSTableViewDataSo
     private func display(_ section: SidebarItem) {
         contentHost.subviews.forEach { $0.removeFromSuperview() }
         guard let controller = controllers[section] else { return }
-        let view = controller.view
-        view.translatesAutoresizingMaskIntoConstraints = false
-        contentHost.addSubview(view)
+        let page = NativeView.scrollable(controller.view)
+        contentHost.addSubview(page)
         NSLayoutConstraint.activate([
-            view.leadingAnchor.constraint(equalTo: contentHost.leadingAnchor), view.trailingAnchor.constraint(equalTo: contentHost.trailingAnchor),
-            view.topAnchor.constraint(equalTo: contentHost.topAnchor), view.bottomAnchor.constraint(equalTo: contentHost.bottomAnchor)
+            page.leadingAnchor.constraint(equalTo: contentHost.leadingAnchor),
+            page.trailingAnchor.constraint(equalTo: contentHost.trailingAnchor),
+            page.topAnchor.constraint(equalTo: contentHost.topAnchor),
+            page.bottomAnchor.constraint(equalTo: contentHost.bottomAnchor)
         ])
+        (controller as? ControlCenterPage)?.refreshOnAppear()
     }
 }

package/dist/native/sks-menubar/Sources/DiagnosticsViewController.swift

@@ -1,9 +1,16 @@
 import Cocoa
 
-final class DiagnosticsViewController: NSViewController {
+final class DiagnosticsViewController: NSViewController, ControlCenterPage {
     private let processClient: ProcessClient
+    private let operations: OperationCoordinator
     private let status = NativeView.detail("Diagnostics are idle.")
-    init(processClient: ProcessClient) { self.processClient = processClient; super.init(nibName: nil, bundle: nil) }
+    private var busy = false
+
+    init(processClient: ProcessClient, operations: OperationCoordinator) {
+        self.processClient = processClient
+        self.operations = operations
+        super.init(nibName: nil, bundle: nil)
+    }
     required init?(coder: NSCoder) { nil }
 
     override func loadView() {
@@ -15,15 +22,72 @@ final class DiagnosticsViewController: NSViewController {
         buttons.orientation = .horizontal; buttons.spacing = 8
         view = NativeView.stack([
             NativeView.title("Diagnostics"),
-            NativeView.detail("Diagnostic output is bounded, redacted, and written with owner-only permissions."),
+            NativeView.detail("Diagnostic output is bounded, redacted, and written with owner-only permissions. Use this page when another Center action reports a blocker."),
             status, buttons
         ])
+        refreshOnAppear()
+    }
+
+    func refreshOnAppear() {
+        guard !busy else { return }
+        if let latest = operations.latestSnapshot() {
+            status.stringValue = "Last operation: \(latest.kind) · \(latest.state.rawValue) · \(latest.publicSummary)"
+        } else if FileManager.default.fileExists(atPath: AppRuntime.lastActionLogPath) {
+            status.stringValue = "Diagnostics idle. A previous action log is available via Open Last Log."
+        } else {
+            status.stringValue = "Diagnostics are idle. No operation log exists yet."
+        }
+    }
+
+    @objc private func doctor() {
+        busy = true
+        status.stringValue = "Doctor is running…"
+        processClient.run(["doctor", "--json"], timeout: NativeView.mutationTimeout) { [weak self] result in
+            guard let self = self else { return }
+            self.busy = false
+            if result.code == 0 {
+                self.status.stringValue = "Doctor completed with no blocking issue."
+                return
+            }
+            if let json = self.json(result.output) {
+                let ok = json["ok"] as? Bool
+                let blockers = (json["blockers"] as? [String])?.count ?? (json["issues"] as? [Any])?.count
+                if let blockers = blockers {
+                    self.status.stringValue = "Doctor reported \(blockers) issue\(blockers == 1 ? "" : "s"). Open Last Log for redacted detail."
+                    return
+                }
+                if ok == false {
+                    self.status.stringValue = "Doctor reported a blocker. Open Last Log for redacted detail."
+                    return
+                }
+            }
+            self.status.stringValue = "Doctor reported a blocker · \(NativeView.redactPreview(result.output))"
+        }
     }
 
-    @objc private func doctor() { status.stringValue = "Doctor is running…"; processClient.run(["doctor", "--json"]) { [weak self] result in self?.status.stringValue = result.code == 0 ? "Doctor completed." : "Doctor reported a blocker." } }
     @objc private func openLog() {
-        if FileManager.default.fileExists(atPath: AppRuntime.lastActionLogPath) { NSWorkspace.shared.open(URL(fileURLWithPath: AppRuntime.lastActionLogPath)) }
-        else { status.stringValue = "No operation log exists yet." }
+        if FileManager.default.fileExists(atPath: AppRuntime.lastActionLogPath) {
+            NSWorkspace.shared.open(URL(fileURLWithPath: AppRuntime.lastActionLogPath))
+            status.stringValue = "Opened the latest redacted action log."
+        } else {
+            status.stringValue = "No operation log exists yet. Run Doctor or another Center action first."
+        }
+    }
+
+    @objc private func restart() {
+        busy = true
+        status.stringValue = "Restarting Menu Bar…"
+        processClient.run(["menubar", "restart", "--json"], timeout: NativeView.mutationTimeout) { [weak self] result in
+            guard let self = self else { return }
+            self.busy = false
+            self.status.stringValue = result.code == 0
+                ? "Restart requested. Control Center will reopen after the Menu Bar process returns."
+                : "Restart failed · \(NativeView.redactPreview(result.output))"
+        }
+    }
+
+    private func json(_ text: String) -> [String: Any]? {
+        guard let data = text.data(using: .utf8) else { return nil }
+        return try? JSONSerialization.jsonObject(with: data) as? [String: Any]
     }
-    @objc private func restart() { processClient.run(["menubar", "restart", "--json"]) { [weak self] result in self?.status.stringValue = result.code == 0 ? "Restart requested." : "Restart failed." } }
 }