vgxness 1.20.1 → 1.20.3

package/dist/agents/canonical-agent-manifest.js

@@ -157,10 +157,10 @@ export function createCanonicalOpenCodeSddSubagentPrompt(name) {
  */
 export const canonicalOpenCodeManagerPrompt = `# VGXNESS Manager
 
-Bind to \`vgxness-manager\` only. Executors use their own prompts.
+Bind to \`vgxness-manager\` only.
 
 ## Role
-Coordinate SDD; keep chat thin, use VGXNESS MCP state, delegate to exact SDD subagent. Coach while coordinating: teach briefly; explain practical tradeoffs, risk/effort/unknowns; challenge weak assumptions; keep user in control; avoid lectures.
+Coordinate SDD; keep chat thin, use MCP state, delegate to exact SDD subagent. Coach while coordinating: teach briefly; explain practical tradeoffs, risk/effort/unknowns; challenge weak assumptions; keep user in control; avoid lectures.
 
 ## Non-negotiable governance
 - VGXNESS uses SQLite artifacts/control-plane; OpenCode as primary provider; artifacts are not openspec files. Do not write to \`openspec/\`.
@@ -168,24 +168,24 @@ Coordinate SDD; keep chat thin, use VGXNESS MCP state, delegate to exact SDD sub
 - Before phase advancement, call \`vgxness_sdd_status\`/\`vgxness_sdd_next\` plus \`vgxness_sdd_ready\` or \`vgxness_sdd_get_readiness\`.
 - Before risky VGX-managed side effects (edit, shell/tests, git, network, provider-tool, secrets, external-directory, destructive, privileged, ambiguous), call \`vgxness_run_preflight\` with runId/workflow/phase/agent when available. Stop on approval/block; never invent approval.
 - Direct human acceptance via \`vgxness_sdd_accept_artifact\` is not a generic SDD write: do not preflight solely for it; require exact project/change/phase, \`acceptedBy.type\` \`"human"\`, non-empty \`acceptedBy.id\`, and eligible status/readiness. Shortcut only for acceptance/trusted draft autorun; excludes edits, shell/tests, git, provider config, memory writes, external paths, secrets, destructive/privileged/ambiguous operations.
-- manager native repo tools are disabled in config (read/glob/edit/write/bash); report config-level enforcement, not proof of host runtime behavior. Subagents keep phase tools.
+- bounded read/search repo tools may be enabled for inspection; bash, edit, and write remain denied. Diagnostics are config-level evidence, not host runtime proof.
 - Do not mutate provider/global OpenCode config. Do not publish packages unless explicitly requested. Never revert/overwrite unrelated user work. Preserve \`permission.task\` deny-by-default with only exact known SDD subagents.
 - Do not change provider model/reasoning config unless explicitly requested.
 
 ## Routing
-Use lightest safe path: T0-2 direct, T3 preflight, T4 SDD for governance/permissions/acceptance/architecture/security/cross-surface behavior. Provider status/doctor/preview/handoff read-only/audit-only; writes gated.
+Use lightest safe path: T0-2 direct, T3 preflight, T4 SDD.
 
 ## Provider-native daily flow
-SDD happens in OpenCode via conversation, VGXNESS MCP, and SDD subagents. No terminal SDD phase commands. CLI is an escape hatch for bootstrap, doctor, recovery, setup gaps, or explicit request.
+SDD happens in OpenCode conversation + VGXNESS MCP/subagents. No terminal SDD phase commands. CLI is an escape hatch for bootstrap, doctor, recovery, setup gaps, or explicit request.
 
 ## MCP playbook
 - For starting, resuming, or recovering context: use \`vgxness_resume_context\` first for generic resume/continue prompts; pass \`explicitChange\` only when the user gave an exact valid change. \`resume_context\` is read-only/no-trace/no-mutation and is the selector gate. For retrospective/status prompts like "what did we do?" or "qué habíamos hecho", use recent completed run history first (\`vgxness_run_list completed\`) and mention interrupted candidates only as old blockers, not as latest truth. \`vgxness_context_cockpit\` and \`vgxness_session_restore\` are advisory context only after the gate; \`vgxness_session_restore\` is one signal, not truth. Do not infer a change from \`context_cockpit.memoryPreviews\`; context cockpit previews, \`memoryPreviews\`, and SDD summaries are advisory only. For ending, pausing, handing off, or compacting: \`vgxness_session_close\` with id and actor \`manager\`; if no id, do not invent one; summarize.
 - Bounded resume/start hard stop: for generic "continue"/"sigamos"/"continuemos"/"resume development" without an explicit user change, call \`vgxness_resume_context\` before any SDD continuation/status. If it returns \`proceed-explicit-change\` or \`proceed-single-active-work\`, then SDD status/continue may use that change. If it returns \`inspect-interrupted-run\`, call \`vgxness_run_resume_inspect\`. If it returns \`ask-change\`, treat it as: If no interrupted run, no exact user-specified change, and no single parsed active-work change, hard stop: do not call \`vgxness_agent_resolve\`; do not call \`vgxness_sdd_status\` or \`vgxness_sdd_continue\`, do not create runs, do not use Glob/Read/docs, do not inspect repo files/native repo tools, do not delegate to SDD subagents, do not start runs, or use \`skill_index\`/\`skill_search\` fallback; ask one question: "¿qué cambio retomamos?".
 - Proposal clarity: if product/business clarity is missing, run a proposal question round.
-- SDD artifacts: guide with \`vgxness_sdd_next\`/\`vgxness_sdd_cockpit\`; list/read with \`vgxness_sdd_get_artifact\`/\`vgxness_sdd_list_artifacts\`; prefer \`payloadMode: "compact"\` so primary context stays clean; use verbose only when required, preferably inside the delegated phase subagent. Save with \`vgxness_sdd_save_artifact\` after the right flow. Use \`vgxness_sdd_reopen_artifact\` only for rejected artifacts returning to draft, with explicit human actor/audit context.
+- SDD artifacts: guide with \`vgxness_sdd_next\`/\`vgxness_sdd_cockpit\`; list/read with \`vgxness_sdd_list_artifacts\`/\`vgxness_sdd_get_artifact\` (\`payloadMode: "compact"\`); verbose preferably inside the delegated phase subagent so primary context stays clean. After hidden subagent returns a valid current-phase artifact, save draft immediately with \`vgxness_sdd_save_artifact\`, summarize it, then ask: "Do you accept this artifact and should I continue to the next phase?" Use \`vgxness_sdd_reopen_artifact\` for rejected artifacts only; \`vgxness_sdd_reopen_artifact\` only for rejected artifacts returning to draft, with explicit human actor/audit context.
 - Delegated phase outputs: inspect delegated result-envelope completeness before SDD artifact persistence or phase advancement (status, executive_summary, artifacts_examined, skill_resolution, risks, next_recommended); this is prompt guidance only, not runtime parsing/rejection.
 - Trusted draft autorun: when the exact \`proposal\` artifact is already accepted, run \`spec -> design -> tasks\` without extra human confirmation via subagents; save drafts with \`vgxness_sdd_save_artifact\`. This is draft-only planning, not acceptance or completion. Excludes explore/proposal/apply-progress/verify/archive, accepted overwrites, risky side effects; re-check status/readiness.
-- Acceptance/readiness: check exact status/readiness; confirm explicit human acceptance; call \`vgxness_sdd_accept_artifact\` directly with audit context (\`acceptedBy.type: "human"\`, non-empty \`acceptedBy.id\`, runId, agentId); re-check before reporting. Do not preflight solely for exact acceptance. Ambiguous replies count only when tied to an immediate exact acceptance prompt. Use \`vgxness_governance_report\` for readiness, artifact states, preflight posture, audit warnings.
+- Acceptance/readiness: check exact status/readiness; call \`vgxness_sdd_accept_artifact\` directly with audit context (\`acceptedBy.type: "human"\`, non-empty \`acceptedBy.id\`, runId, agentId); re-check before reporting. Do not preflight solely for exact acceptance. Affirmative continue/sí/yes/dale to the immediate accept+continue prompt is explicit human acceptance; only save/no/revise keeps draft and must not advance. Never silently auto-accept. Use \`vgxness_governance_report\` for readiness/artifact/preflight audit.
 - Memory: \`vgxness_memory_search\`/\`vgxness_memory_get\` for prior work/unclear context and duplicate avoidance. Save/update only durable, actionable, scoped, evidence-backed, compact, non-sensitive observations that are future-relevant: discoveries, decisions, bug fixes, config, patterns, preferences, learnings, or manual notes. \`vgxness_memory_save\` may upsert by \`topicKey\`; \`vgxness_memory_update\` requires a known id. Prefer \`vgxness_memory_update\` over duplicate save when you know the id/topic key. Treat lifecycle \`memoryCapture\` as review-first advisory metadata only: no automatic persistence, no durable queue, explicit save/update policy/consent still required. Do not save full SDD artifacts, transcripts, raw logs, hidden reasoning, secrets, credentials, or sensitive user data. Memory is advisory only and never proves SDD acceptance/readiness/verification/approval/authorization. SDD artifacts are canonical for phase deliverables and governance state. OpenCode previews/handoff are read-only and capture-free. \`memory-write\` requires preflight/explicit consent when governed or risky. Choose scope intentionally: \`project\` for repo facts, \`personal\` for reusable user preferences.
 - Active-work memory uses existing memory APIs only: \`active-work/{change}/summary\` (+others). No secrets or hidden reasoning. Active-work memory is advisory only; never proves SDD acceptance/readiness, verification, approval, or authorization.
 - Agents/skills: Use \`vgxness_skill_payload\` first for contextual skill guidance; preview/context-only, no provider execution or config writes. Use \`vgxness_skill_index\`/\`vgxness_skill_search\` only for explicit diagnostics/catalog, not normal resume fallback. Resolve phase with \`vgxness_agent_resolve\`; if none resolves, report evidence and ask for the smallest decision instead of inventing agent ids. \`vgxness_agent_activate\` and \`vgxness_opencode_manager_payload\` are preview/context-only. \`vgxness_manager_profile_get\` before changes; \`vgxness_manager_profile_set\` needs explicit human authorization.
@@ -193,8 +193,7 @@ SDD happens in OpenCode via conversation, VGXNESS MCP, and SDD subagents. No ter
 - Provider diagnostics: \`vgxness_provider_status\`/\`vgxness_provider_doctor\` read-only; report \`providerEvidence.evidenceLevel\` and \`hostToolPresenceVerified\` limits.
 
 ## Minimum flows
-- Simple answer: inline; no run by default.
-- Proposal/spec/design/tasks: status/next -> readiness -> prereqs -> exact subagent -> delegate -> persist; if proposal is accepted, spec/design/tasks may use trusted draft autorun without extra confirmation; drafts remain unaccepted.
+- Proposal/spec/design/tasks: status/next -> readiness -> prereqs -> subagent -> save draft -> summarize -> ask accept+continue; trusted autorun may draft spec/design/tasks after accepted proposal; drafts stay unaccepted until human acceptance.
 - Apply/verify: prereqs -> artifacts -> exact subagent -> start/recover run -> preflight writes/shell/git/tests -> delegate -> checkpoint -> save -> finalize. Before apply/PR, review workload guard: estimate size/risk/reviewer load; recommend slicing into work units or chained PRs when large.
 - Config/provider/prompt change: inspect manager/profile/payload first; persistence needs explicit human authorization.
 - Recovery: MCP first. Continue: use \`vgxness_sdd_continue\`; read-only/advisory: no provider execution, run creation, artifact mutation, provider config/openspec writes, or acceptance/apply-progress bypass. CLI \`vgxness sdd continue\` is human fallback only. \`vgxness resume --project\` is for candidate runs. The removed experimental \`vgxness code\` runtime is not an SDD fallback.
@@ -215,6 +214,7 @@ const registryManagerInstructionsV11 = [
     'Default to delegation for SDD phase-shaped work, repository exploration beyond one narrow lookup, implementation, verification, incident recovery, or multi-step analysis. Inline only conversational guidance, single-fact lookup, MCP/status/readiness checks, and trivial mechanical edits when safe. When uncertain between inline work and subagent work, delegate to the exact smallest SDD subagent.',
     'Use VGXNESS MCP as the durable control plane: for generic resume/continue prompts call vgxness_resume_context first, pass explicitChange only when the user gave an exact valid change, and do not infer a change from context_cockpit.memoryPreviews; for retrospective/status prompts such as "what did we do?" or "qué habíamos hecho", inspect recent completed run history first with vgxness_run_list completed and mention interrupted candidates only as old blockers, not as latest truth; vgxness_context_cockpit and vgxness_session_restore are advisory context only after the gate, and context cockpit previews, memoryPreviews, and SDD summaries are advisory only. Close/pause/compact with vgxness_session_close using actor manager plus an actionable summary when a current session id exists.',
     'For generic continue/sigamos/continuemos/resume development without an explicit user change, call vgxness_resume_context before any SDD status/continuation. If decision is proceed-explicit-change or proceed-single-active-work, then call SDD tools for that change. If inspect-interrupted-run, call vgxness_run_resume_inspect. If ask-change (no interrupted run, no exact user-specified change, and no single parsed active-work change), hard stop: do not call vgxness_agent_resolve; do not call vgxness_sdd_status or vgxness_sdd_continue, do not create runs, do not inspect repo files/native repo tools, do not delegate to SDD subagents, do not start runs, do not use skill_index/skill_search fallback, or invent agent ids; ask one question: "¿qué cambio retomamos?".',
+    'Manager save-then-accept behavior: after a valid hidden phase subagent artifact, save it immediately as a draft with sdd_save_artifact, summarize the saved draft, then ask whether the human accepts it and wants to continue to the next phase. An affirmative continue/sí/yes/dale reply in that immediate context is explicit human acceptance. A reply of only save/no/revise keeps draft and must not advance. Never silently auto-accept.',
     'Check SDD status/next/ready/cockpit, read prerequisites with sdd_get_artifact or sdd_list_artifacts, use public sdd_continue/internal vgxness_sdd_continue first for advisory read-only continuation plans, use sdd_reopen_artifact only for rejected artifacts returning to draft with explicit human actor/audit context, save phase output with sdd_save_artifact only by governance; inspect delegated result-envelope completeness before SDD artifact persistence or phase advancement (status, executive_summary, artifacts_examined, skill_resolution, risks, next_recommended) as prompt guidance only, not runtime parsing/rejection; when proposal is accepted, spec/design/tasks may run sequentially as draft-only autorun without extra confirmation, while acceptance remains human-only. Memory capture policy: save/update only durable, future-relevant, actionable, scoped, evidence-backed, compact, non-sensitive observations; lifecycle memoryCapture candidates are review-first advisory metadata only, not persisted automatically, not a durable candidate queue, and still require explicit save/update policy and consent; prefer update by known id/topicKey over duplicate saves; never save full SDD artifacts, transcripts, raw logs, hidden reasoning, secrets, credentials, or sensitive user data. Memory is advisory only and never proves SDD acceptance, readiness, verification, approval, or authorization. SDD artifacts are canonical for phase deliverables/governance state. OpenCode previews/handoff are read-only and capture-free. Choose project scope for repo-specific facts and personal scope for reusable user preferences; memory-write requires preflight/explicit consent when governed/risky. Resolve exact SDD subagents before substantial phase work, use runs/checkpoints/preflight/finalize for significant implementation or verification, use run_resume_candidates for unknown runId, inspect interrupted runs by runId with run_resume_inspect, then call run_resume_gate with approvalId from pendingApprovals/inspect; never pass runId as approvalId; use vgxness_provider_status for configured/phase/next questions plus vgxness_provider_doctor for read-only OpenCode MCP/manager health.',
     'When sdd_continue/vgxness_sdd_continue returns recommendedActions, prefer the first safe action with agentCallable true and humanOnly false; use targetTool plus suggestedArgs as the starting point, and stop for requiresHumanConfirmation, requiresProviderWriteConsent, requiresPreflight, ambiguous, destructive, privileged, external, or outside-approval actions. For readiness, use cockpit/status/readiness to distinguish missing, draft, ready, blocked, and accepted; never infer acceptance. For provider evidence, report providerEvidence.evidenceLevel, hostToolPresenceVerified, notes, and limitations; do not claim true host presence unless evidence explicitly verifies it.',
     'Prefer payloadMode=compact for manager-facing status/context reads, SDD artifact reads/lists, and activation handoffs so the primary context stays clean; request payloadMode=verbose only when full artifact contents, provider payloads, or skill context are actually needed, preferably inside delegated phase subagents.',

package/dist/agents/canonical-agent-projection.js

@@ -137,7 +137,7 @@ function openCodeManagerPermissionsFor(agent) {
         ...openCodePermissionsFor(agent, { task: createCanonicalOpenCodeSddTaskPermissions() }),
         bash: 'deny',
         edit: 'deny',
-        read: 'deny',
+        read: 'allow',
         write: 'deny',
     };
 }
@@ -148,9 +148,9 @@ function openCodeManagerTools() {
         delegation_list: true,
         delegation_read: true,
         edit: false,
-        glob: false,
-        grep: false,
-        read: false,
+        glob: true,
+        grep: true,
+        read: true,
         write: false,
     };
 }

package/dist/agents/renderers/opencode-renderer.js

@@ -15,7 +15,7 @@ const openCodeCapabilities = {
         'instructions',
         'mode',
         'adapter model',
-        'adapter config keys: variant, temperature, top_p, hidden, options, color, steps, permission',
+        'adapter config keys: variant, temperature, top_p, hidden, options, color, steps, permission, tools',
     ],
     skillInjectionModes: ['external preview services may inject skill payloads before rendering; renderer does not resolve skills'],
     permissionCategories: ['registry permission metadata mapped from adapter permission config'],
@@ -78,6 +78,7 @@ function openCodeAgentConfig(agent) {
     copyString(config, rendered, 'color');
     copyNumber(config, rendered, 'steps');
     copyJson(config, rendered, 'permission');
+    copyJson(config, rendered, 'tools');
     return rendered;
 }
 function copyString(source, target, key) {

package/dist/mcp/client-install-opencode-contract.js

@@ -197,7 +197,11 @@ function warningsForScope(scope, overwriteVgxness, agentPlan, bashPermissionPoli
             `Reinstall/overwrite is enabled: existing VGXNESS-managed OpenCode entries will be replaced (${agentPlan.installsAgents ? 'mcp.vgxness, default_agent, instructions AGENTS.md, and known VGXNESS agents' : 'mcp.vgxness only'}); unrelated OpenCode config is preserved.`,
         ]
         : [];
-    const bashWarnings = bashPermissionPolicy.manager === 'deny' ? ['OpenCode top-level permission.bash is set to ask; the VGXNESS manager agent denies bash while SDD subagents keep explicit phase permissions.'] : ['OpenCode top-level permission.bash is set to ask.'];
+    const bashWarnings = bashPermissionPolicy.manager === 'deny'
+        ? [
+            'OpenCode config sets top-level permission.bash = ask; manager read/search discovery tools (read/glob/grep) are allowed while manager bash/edit/write are denied; SDD subagents keep explicit phase permissions. This is config-level evidence only and does not verify provider runtime enforcement.',
+        ]
+        : ['OpenCode top-level permission.bash is set to ask.'];
     return [
         'Restart OpenCode after installation so it reloads the user MCP config.',
         'OpenCode project config may override user config for a workspace; check project-level config if vgxness is not visible.',

package/dist/mcp/client-install-opencode.js

@@ -214,7 +214,10 @@ function confirmationRequiredMessage(scope) {
     return `\`mcp install opencode\` requires explicit --yes before any ${scope} config write.`;
 }
 function warnings() {
-    return ['Restart OpenCode after installation so it reloads the project MCP config.', 'OpenCode top-level permission.bash is set to ask; the VGXNESS manager agent denies bash while SDD subagents keep explicit phase permissions.'];
+    return [
+        'Restart OpenCode after installation so it reloads the project MCP config.',
+        'OpenCode config sets top-level permission.bash = ask; manager read/search discovery tools (read/glob/grep) are allowed while manager bash/edit/write are denied; SDD subagents keep explicit phase permissions. This is config-level evidence only and does not verify provider runtime enforcement.',
+    ];
 }
 function manualTest(databasePath, source) {
     return {

package/dist/mcp/provider-doctor.js

@@ -40,6 +40,7 @@ export class ProviderDoctorService {
             configReadableCheck(readableJson.length, paths.filter((path) => path.exists).length),
             mcpEntryCheck(config),
             defaultAgentCheck(config),
+            managerNativeCapabilityCheck(config),
             subagentsCheck(config),
             delegationCheck(config),
             { id: 'mcp-current-call', status: 'pass', detail: 'Current MCP call reached the VGXNESS control-plane.' },
@@ -255,6 +256,35 @@ function defaultAgentCheck(config) {
         return { id: 'opencode-default-agent', status: 'fail', detail: 'OpenCode default_agent is not vgxness-manager or the manager config is missing.' };
     return { id: 'opencode-default-agent', status: 'pass', detail: 'OpenCode default agent points to vgxness-manager.' };
 }
+function managerNativeCapabilityCheck(config) {
+    const manager = isRecord(config?.agent) && isRecord(config.agent[vgxnessOpenCodeDefaultAgent]) ? config.agent[vgxnessOpenCodeDefaultAgent] : undefined;
+    const permission = isRecord(manager?.permission) ? manager.permission : undefined;
+    const tools = isRecord(manager?.tools) ? manager.tools : undefined;
+    const problems = [];
+    if (permission?.read !== 'allow')
+        problems.push('permission.read is not allow');
+    for (const tool of ['read', 'glob', 'grep']) {
+        if (tools?.[tool] !== true)
+            problems.push(`tools.${tool} is not enabled`);
+    }
+    for (const tool of ['bash', 'edit', 'write']) {
+        if (tools?.[tool] !== false)
+            problems.push(`tools.${tool} is not disabled`);
+    }
+    const evidenceSuffix = 'This is config-level evidence only; host runtime/tool presence is not verified.';
+    if (problems.length > 0)
+        return {
+            id: 'opencode-manager-native-capability',
+            status: 'fail',
+            detail: `Manager native capability drift detected: ${problems.join('; ')}. ${evidenceSuffix}`,
+            remediation: 'Re-run explicit OpenCode setup/install only after reviewing provider config drift; doctor does not auto-repair or write config.',
+        };
+    return {
+        id: 'opencode-manager-native-capability',
+        status: 'pass',
+        detail: `Manager config allows read/glob/grep inspection and denies bash/edit/write native tools. ${evidenceSuffix}`,
+    };
+}
 function subagentsCheck(config) {
     const agents = isRecord(config?.agent) ? config.agent : undefined;
     const missing = vgxnessOpenCodeSddSubagents.filter((name) => !isRecord(agents?.[name]) || agents[name]?.hidden !== true);

package/dist/mcp/provider-status.js

@@ -27,10 +27,11 @@ export class ProviderStatusService {
         const mcpEntry = inspectOpenCodeMcpEntry(paths);
         const providerConfig = readFirstParsedConfig(paths);
         const managerConfigured = hasConfiguredManager(providerConfig);
+        const managerNativeCapabilityStatus = inspectManagerNativeCapability(providerConfig);
         const subagentsConfigured = hasConfiguredSubagents(providerConfig);
         const tools = requiredToolPresence();
         const evidence = providerEvidence({ staticManifestKnown: true, renderedConfigExpected: true, configPathInspected: paths.length > 0 });
-        const configStatus = resolveConfigStatus(paths, mcpEntry, managerConfigured, subagentsConfigured);
+        const configStatus = resolveConfigStatus(paths, mcpEntry, managerConfigured, managerNativeCapabilityStatus, subagentsConfigured);
         const status = rollupProviderHealth([canonicalAgentManifest.status, configStatus, ...tools.map((tool) => (tool.present ? 'pass' : 'fail'))]);
         const sdd = normalized.change.length > 0 ? this.readSdd(normalized.project, normalized.change) : undefined;
         const generatedAt = 'read-only-snapshot';
@@ -38,14 +39,14 @@ export class ProviderStatusService {
             ? paths.map((path) => path.path)
             : paths.filter((path) => path.exists || path.status !== 'not-configured').map((path) => path.path);
         const verboseShape = {
-            config: { status: configStatus, paths, mcpEntry },
+            config: { status: configStatus, paths, mcpEntry, managerNativeCapability: managerNativeCapabilityStatus },
             canonicalAgentManifest,
             providerEvidence: evidence,
             sdd,
             mcpRequiredTools: tools,
         };
         const compactShape = {
-            config: { status: configStatus, paths: compactPaths(paths, 'compact'), mcpEntry: compactMcpEntry(mcpEntry, 'compact') },
+            config: { status: configStatus, paths: compactPaths(paths, 'compact'), mcpEntry: compactMcpEntry(mcpEntry, 'compact'), managerNativeCapability: managerNativeCapabilityStatus },
             canonicalAgentManifest,
             providerEvidence: evidence,
             sdd: sdd === undefined ? undefined : compactSdd(sdd, 'compact'),
@@ -86,8 +87,8 @@ export class ProviderStatusService {
         return {
             ok: true,
             value: normalized.payloadMode === 'verbose'
-                ? { ...reportBase, payloadMode: 'verbose', config: { status: configStatus, paths: compactPaths(paths, 'verbose'), mcpEntry: compactMcpEntry(mcpEntry, 'verbose') } }
-                : { ...reportBase, payloadMode: 'compact', config: { status: configStatus, paths: compactPaths(paths, 'compact'), mcpEntry: compactMcpEntry(mcpEntry, 'compact') } },
+                ? { ...reportBase, payloadMode: 'verbose', config: { status: configStatus, paths: compactPaths(paths, 'verbose'), mcpEntry: compactMcpEntry(mcpEntry, 'verbose'), managerNativeCapability: managerNativeCapabilityStatus } }
+                : { ...reportBase, payloadMode: 'compact', config: { status: configStatus, paths: compactPaths(paths, 'compact'), mcpEntry: compactMcpEntry(mcpEntry, 'compact'), managerNativeCapability: managerNativeCapabilityStatus } },
         };
     }
     readSdd(project, change) {
@@ -393,12 +394,12 @@ function requiredToolPresence() {
         diagnostic: 'Static VGXNESS manifest expects this MCP tool; provider host tool presence was not verified.',
     }));
 }
-function resolveConfigStatus(paths, mcpEntry, managerConfigured, subagentsConfigured) {
+function resolveConfigStatus(paths, mcpEntry, managerConfigured, managerNativeCapabilityStatus, subagentsConfigured) {
     if (paths.some((path) => path.status === 'fail') || mcpEntry.status === 'fail')
         return 'fail';
     if (mcpEntry.status === 'not-configured')
         return 'not-configured';
-    if (!managerConfigured || !subagentsConfigured)
+    if (!managerConfigured || managerNativeCapabilityStatus === 'warn' || !subagentsConfigured)
         return 'warn';
     if (hasProjectConfigAlongsideUser(paths))
         return 'warn';
@@ -449,6 +450,17 @@ function hasConfiguredManager(config) {
         isRecord(agent?.[vgxnessOpenCodeDefaultAgent]) &&
         promptContractVersion(agent[vgxnessOpenCodeDefaultAgent]) === vgxnessOpenCodePromptContractVersion);
 }
+function inspectManagerNativeCapability(config) {
+    if (config === undefined)
+        return 'not-configured';
+    const agent = isRecord(config.agent) ? config.agent : undefined;
+    const manager = isRecord(agent?.[vgxnessOpenCodeDefaultAgent]) ? agent[vgxnessOpenCodeDefaultAgent] : undefined;
+    const permission = isRecord(manager?.permission) ? manager.permission : undefined;
+    const tools = isRecord(manager?.tools) ? manager.tools : undefined;
+    const readSearchEnabled = permission?.read === 'allow' && tools?.read === true && tools.glob === true && tools.grep === true;
+    const writeShellDenied = tools?.bash === false && tools.edit === false && tools.write === false;
+    return readSearchEnabled && writeShellDenied ? 'pass' : 'warn';
+}
 function hasConfiguredSubagents(config) {
     if (config === undefined)
         return false;

package/dist/sdd/sdd-continuation-plan.js

@@ -115,7 +115,7 @@ function draftPhaseAction(project, change, phase, reason) {
         id: `sdd.${change}.${phase}.draft`,
         label: `Prepare ${phase} draft through normal SDD phase flow`,
         title: `Prepare ${phase} draft`,
-        description: 'The next SDD phase appears runnable; draft generation must still use the normal phase workflow and any required preflight/confirmation gates.',
+        description: 'The next SDD phase appears runnable; draft generation must still use the normal phase workflow and any required preflight gates. After a valid phase artifact is produced, save it as a draft immediately, then ask the human acceptance/continue question before advancing.',
         kind: 'draft-phase',
         category: 'sdd-phase',
         phase,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vgxness",
-  "version": "1.20.1",
+  "version": "1.20.3",
   "description": "CLI and MCP control plane for guided AI-agent workflows, SDD, memory, and OpenCode setup.",
   "license": "SEE LICENSE IN LICENSE",
   "repository": {