create-shibumi 0.2.9 → 0.3.2

package/src/templates/ship.ts

@@ -3,9 +3,10 @@
 /**
  * Project-owned client for shibumi-server.
  *
- * `bun ship:setup` connects this repository to one server and creates its
- * deployment trigger. Later, `bun ship` checks local work, pushes one commit,
- * triggers it over SSH by default, and follows status until the app is healthy.
+ * `bun ship:setup` connects this repository to one server and registers the
+ * app. Later, `bun ship` checks local work, pushes one commit, triggers it
+ * over SSH, and follows status until the app is healthy. `bun ship:webhook`
+ * is the opt-in for push-to-deploy; `--off` reverses it.
  *
  * Commit this file and shibumi-server.json. SSH targets stay in machine-local
  * Shibumi config. Webhook secrets stay on the server and pass directly to GitHub CLI.
@@ -25,7 +26,7 @@ const SERVER_HOSTNAME = /^[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?$/;
 const COMMIT = /^[a-f0-9]{40}$/;
 const SERVER_CLI = "~/.local/bin/shibumi-server";
 const LATEST_SOURCE = "https://shibumistack.dev/ship/latest.ts";
-const CURRENT_SOURCE = "https://shibumistack.dev/ship/v47.ts";
+const CURRENT_SOURCE = "https://shibumistack.dev/ship/v48.ts";
 let sshControlDirectory: string | undefined;
 let sshControlTarget: string | undefined;
 
@@ -87,11 +88,14 @@ interface ShipOptions {
   logs: boolean;
   status: boolean;
   dev: boolean;
+  webhook: boolean;
+  off: boolean;
   rebuild: boolean;
   yes: boolean;
+  interactive: boolean;
+  publicRepo: boolean;
   server?: string;
   domain?: string;
-  trigger?: "ship" | "github-push";
   staticSite: boolean;
   outputDir?: string;
   buildScript?: string;
@@ -105,7 +109,7 @@ export interface StaticSiteConfig {
   spa: boolean;
 }
 
-let options: ShipOptions = { setup: false, update: false, rollback: false, logs: false, status: false, dev: false, rebuild: false, yes: false, staticSite: false, spa: false };
+let options: ShipOptions = { setup: false, update: false, rollback: false, logs: false, status: false, dev: false, webhook: false, off: false, rebuild: false, yes: false, interactive: false, publicRepo: false, staticSite: false, spa: false };
 let agentRun = false;
 
 export function isAgentExecution(env: NodeJS.ProcessEnv = process.env, stdinTTY = Boolean(process.stdin.isTTY), stdoutTTY = Boolean(process.stdout.isTTY)): boolean {
@@ -147,7 +151,7 @@ function spinner(): ShipSpinner {
 }
 
 export function parseShipArgs(args: string[]): ShipOptions {
-  const parsed: ShipOptions = { setup: false, update: false, rollback: false, logs: false, status: false, dev: false, rebuild: false, yes: false, staticSite: false, spa: false };
+  const parsed: ShipOptions = { setup: false, update: false, rollback: false, logs: false, status: false, dev: false, webhook: false, off: false, rebuild: false, yes: false, interactive: false, publicRepo: false, staticSite: false, spa: false };
   for (let index = 0; index < args.length; index += 1) {
     const argument = args[index];
     if (argument === "--") continue;
@@ -157,26 +161,31 @@ export function parseShipArgs(args: string[]): ShipOptions {
     else if (argument === "--logs") parsed.logs = true;
     else if (argument === "--status") parsed.status = true;
     else if (argument === "--dev") parsed.dev = true;
+    else if (argument === "--webhook") parsed.webhook = true;
+    else if (argument === "--off") parsed.off = true;
     else if (argument === "--rebuild") parsed.rebuild = true;
     else if (argument === "--yes" || argument === "-y") parsed.yes = true;
+    else if (argument === "--interactive") parsed.interactive = true;
+    else if (argument === "--public") parsed.publicRepo = true;
     else if (argument === "--static") parsed.staticSite = true;
     else if (argument === "--spa") parsed.spa = true;
     else if (argument === "--no-spa") parsed.noSpa = true;
-    else if (argument === "--server" || argument === "--domain" || argument === "--trigger" || argument === "--output-dir" || argument === "--build-script") {
+    else if (argument === "--server" || argument === "--domain" || argument === "--output-dir" || argument === "--build-script") {
       const value = args[index + 1];
       if (!value || value.startsWith("-")) throw new Error(`${argument} requires a value`);
       if (argument === "--server") parsed.server = value;
       else if (argument === "--domain") parsed.domain = value;
       else if (argument === "--output-dir") parsed.outputDir = value;
-      else if (argument === "--build-script") parsed.buildScript = value;
-      else if (value === "ship" || value === "github-push") parsed.trigger = value;
-      else throw new Error("--trigger must be ship or github-push");
+      else parsed.buildScript = value;
       index += 1;
     } else throw new Error(`unknown ship option: ${argument}`);
   }
-  if ([parsed.setup, parsed.update, parsed.rollback, parsed.logs, parsed.status, parsed.dev].filter(Boolean).length > 1) throw new Error("choose only one ship action");
-  if (parsed.rebuild && (parsed.setup || parsed.update || parsed.rollback || parsed.logs || parsed.status || parsed.dev)) throw new Error("--rebuild applies only to shipping");
-  if (parsed.trigger && !parsed.setup) throw new Error("--trigger requires --setup");
+  if ([parsed.setup, parsed.update, parsed.rollback, parsed.logs, parsed.status, parsed.dev, parsed.webhook].filter(Boolean).length > 1) throw new Error("choose only one ship action");
+  if (parsed.rebuild && (parsed.setup || parsed.update || parsed.rollback || parsed.logs || parsed.status || parsed.dev || parsed.webhook)) throw new Error("--rebuild applies only to shipping");
+  if (parsed.off && !parsed.webhook) throw new Error("--off requires --webhook");
+  if (parsed.interactive && !parsed.setup) throw new Error("--interactive requires --setup");
+  if (parsed.publicRepo && !parsed.setup) throw new Error("--public requires --setup");
+  if (parsed.interactive && parsed.yes) throw new Error("--interactive and --yes are mutually exclusive");
   if (parsed.spa && parsed.noSpa) throw new Error("--spa and --no-spa are mutually exclusive");
   if ((parsed.staticSite || parsed.outputDir || parsed.buildScript || parsed.spa || parsed.noSpa) && !parsed.setup) throw new Error("--static, --output-dir, --build-script, and --spa require --setup");
   if ((parsed.outputDir || parsed.buildScript || parsed.spa || parsed.noSpa) && !parsed.staticSite) throw new Error("--output-dir, --build-script, and --spa require --static");
@@ -296,12 +305,28 @@ async function rememberSshTarget(hostname: string, sshTarget: string): Promise<v
   log.success(`Saved server ${sshTarget} in ${path}`);
 }
 
+function planSetup(): boolean {
+  return !options.interactive && !options.yes && !agentRun
+    && Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY);
+}
+
 async function approve(message: string): Promise<boolean> {
   if (options.yes || agentRun) return true;
   const accepted = await confirm({ message, initialValue: true });
   return !isCancel(accepted) && accepted;
 }
 
+// Setup asks two questions, shows the plan, and runs it on one confirm. That
+// confirm answers exactly the steps the plan enumerated and nothing else:
+// anything the plan never named keeps asking for itself, including the GitHub
+// sign-in (it opens a browser) and the Caddy cutover (it moves public
+// traffic). `--setup --interactive` restores the per-step gates.
+let planApproved = false;
+
+async function approvePlanned(message: string): Promise<boolean> {
+  return planApproved ? true : approve(message);
+}
+
 function explain(title: string, message: string): void {
   log.info(`${title}\n${message}`);
 }
@@ -342,7 +367,9 @@ async function git(...args: string[]): Promise<string> {
 
 const setupFiles = ["package.json", "bun.lock", "scripts/ship.ts", "shibumi-server.json"];
 
-async function offerSetupCommit(config: ClientConfig): Promise<"none" | "committed" | "declined"> {
+type SetupCommit = "none" | "committed" | "declined";
+
+async function offerSetupCommit(config: ClientConfig): Promise<SetupCommit> {
   const changed: string[] = [];
   for (const file of setupFiles) {
     const status = await run(["git", "status", "--porcelain", "--", file]);
@@ -355,7 +382,7 @@ async function offerSetupCommit(config: ClientConfig): Promise<"none" | "committ
     return "declined";
   }
   const trackedConfig = (await run(["git", "ls-files", "--error-unmatch", "shibumi-server.json"], { allowFailure: true })).exitCode === 0;
-  if (!await approve(updateOnly ? "Commit ship client update now?" : "Commit deployment setup now?")) return "declined";
+  if (!await approvePlanned(updateOnly ? "Commit ship client update now?" : "Commit deployment setup now?")) return "declined";
   await run(["git", "add", "--", ...changed]);
   await run(["git", "commit", "--only", "-m", trackedConfig ? "Update Shibumi deployment" : "Add Shibumi deployment", "--", ...changed], { inherit: true });
   log.success(updateOnly ? "Committed ship client update" : "Committed Shibumi deployment setup");
@@ -774,20 +801,35 @@ async function otherWorktreeCompose(): Promise<WorktreeCompose[]> {
   return alternatives;
 }
 
-async function prepareCompose(): Promise<boolean> {
+// Deciding what to deploy is separated from writing it, so a plan run can
+// state "Generate deployment files (static, dist/)" and mean it: nothing is
+// on disk until the plan is approved, and cancelling really changed nothing.
+type DeploymentDecision =
+  | { kind: "tracked" }
+  | { kind: "untracked"; file: string }
+  | { kind: "static"; config: StaticSiteConfig }
+  | { kind: "server"; dockerfileExists: boolean; hasBuildScript: boolean };
+
+export function deploymentPlanLine(decision: { kind: string; config?: StaticSiteConfig }): string | undefined {
+  if (decision.kind === "static" && decision.config) {
+    const build = decision.config.buildScript ? `, bun run ${decision.config.buildScript}` : "";
+    return `Generate deployment files (static, ${decision.config.outputDir}/${build})`;
+  }
+  if (decision.kind === "server") return "Generate deployment files (Bun server app)";
+  return undefined;
+}
+
+async function decideDeployment(): Promise<DeploymentDecision> {
   const branch = await git("branch", "--show-current");
   if (!branch) throw new Error("ship requires a named Git branch");
   const tracked = (await git("ls-files")).split("\n").filter(Boolean);
-  if (composeCandidates(tracked).length > 0) return false;
+  if (composeCandidates(tracked).length > 0) return { kind: "tracked" };
   const alternatives = await otherWorktreeCompose();
   if (alternatives.length > 0) throw new Error(missingComposeMessage(branch, alternatives));
 
   const names = ["compose.yaml", "compose.yml", "docker-compose.yml", "docker-compose.yaml"];
-  const existingCompose = (await Promise.all(names.map(async (name) => await Bun.file(join(root, name)).exists() ? name : undefined))).find(Boolean);
-  if (existingCompose) {
-    outro(`Found uncommitted ${existingCompose}.\n\nNext: review it, commit and push it, then run bun ship:setup.`);
-    return true;
-  }
+  const existing = (await Promise.all(names.map(async (name) => await Bun.file(join(root, name)).exists() ? name : undefined))).find(Boolean);
+  if (existing) return { kind: "untracked", file: existing };
 
   if (agentRun && !options.yes) {
     throw new Error("Compose deployment files are missing.\n\nAgent: ask user for permission to generate deployment files, then run bun ship:setup -y (add --static --output-dir <dir> for static output).");
@@ -804,78 +846,19 @@ async function prepareCompose(): Promise<boolean> {
     if (isCancel(kind)) throw new Error(missingComposeMessage(branch, []));
     wantStatic = kind === "static";
   }
-
-  if (wantStatic) {
-    await generateStaticDeployment();
-    if (await offerGeneratedCommit(["Dockerfile", "compose.yaml", ".dockerignore", "scripts/static-server.ts", "package.json", "bun.lock"])) return false;
-    outro("Review generated deployment files.\n\nNext: commit and push these changes, then run bun ship:setup.");
-    return true;
-  }
-
-  const packageJson = JSON.parse(await readFile(join(root, "package.json"), "utf8")) as { scripts?: Record<string, unknown> };
-  const dockerfileExists = await Bun.file(join(root, "Dockerfile")).exists();
-  if (!dockerfileExists && typeof packageJson.scripts?.start !== "string") {
-    throw new Error("Dockerfile generation requires a package.json start script.\n\nNext: add a start script that binds to 0.0.0.0 and reads PORT, then run bun ship:setup.");
-  }
-  const templates = deploymentFileTemplates(typeof packageJson.scripts?.build === "string");
-  const written: string[] = [];
-  for (const [name, contents] of Object.entries(templates)) {
-    if (name === "Dockerfile" && dockerfileExists) continue;
-    if (await Bun.file(join(root, name)).exists()) continue;
-    await writeFile(join(root, name), contents, { mode: 0o644 });
-    written.push(name);
-  }
-  log.success(`Generated ${written.join(", ")}`);
-  log.info("Verify the app binds to 0.0.0.0 and reads PORT before shipping.");
-  if (await offerGeneratedCommit(written)) return false;
-  outro("Review generated deployment files and verify app binds to 0.0.0.0 and reads PORT.\n\nNext: commit and push these changes, then run bun ship:setup.");
-  return true;
-}
-
-const SHIP_SCRIPTS = {
-  ship: "bun scripts/ship.ts",
-  "ship:setup": "bun scripts/ship.ts --setup",
-  "ship:update": "bun scripts/ship.ts --update",
-  "ship:status": "bun scripts/ship.ts --status",
-  "ship:logs": "bun scripts/ship.ts --logs",
-};
-
-
-// After generating deployment files interactively, offer to commit and push
-// them in the same run so setup continues without a manual rerun. Returns
-// true when the files are committed and pushed.
-async function offerGeneratedCommit(files: string[]): Promise<boolean> {
-  if (agentRun || !process.stdin.isTTY || !process.stdout.isTTY) return false;
-  const accepted = await confirm({ message: "Commit and push the generated files, then continue setup?", initialValue: true });
-  if (isCancel(accepted) || !accepted) return false;
-  const present: string[] = [];
-  for (const file of files) if (await Bun.file(join(root, file)).exists()) present.push(file);
-  await run(["git", "add", "--", ...present]);
-  await run(["git", "commit", "--only", "-m", "Add deployment configuration", "--", ...present], { inherit: true });
-  await run(["git", "push"], { inherit: true });
-  log.success("Committed and pushed deployment files");
-  return true;
+  return wantStatic ? { kind: "static", config: await staticDeploymentInputs() } : await serverDeploymentInputs();
 }
 
-async function generateStaticDeployment(): Promise<void> {
-  // Script-less generators (Jekyll) have no package.json; create a minimal one
-  // so bun ship commands and an optional build script have a home.
-  const packagePath = join(root, "package.json");
-  let packageJson: { name?: unknown; scripts?: Record<string, unknown> };
-  if (await Bun.file(packagePath).exists()) {
-    packageJson = JSON.parse(await readFile(packagePath, "utf8")) as typeof packageJson;
-  } else {
-    const name = root.split("/").pop()?.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[._-]+|[._-]+$/g, "") || "static-site";
-    packageJson = { name, private: true, scripts: { ...SHIP_SCRIPTS } } as typeof packageJson;
-    await writeFile(packagePath, `${JSON.stringify(packageJson, null, 2)}\n`, { mode: 0o644 });
-    log.success("Created minimal package.json");
-  }
-
+// Everything that can refuse the deployment runs here, before the plan is
+// rendered: a bad output directory, a missing build script, uncommitted output
+// with no build, or files that would be overwritten.
+async function staticDeploymentInputs(): Promise<StaticSiteConfig> {
+  const scripts = ((await Bun.file(join(root, "package.json")).json().catch(() => ({}))) as { scripts?: Record<string, unknown> }).scripts;
   let buildScript = options.buildScript;
-  if (buildScript && typeof packageJson.scripts?.[buildScript] !== "string") {
+  if (buildScript && typeof scripts?.[buildScript] !== "string") {
     throw new Error(`package.json has no "${buildScript}" script.\n\nNext: add it (for example "build": "jekyll build"), then run bun ship:setup again.`);
   }
-  if (!buildScript && typeof packageJson.scripts?.build === "string") buildScript = "build";
+  if (!buildScript && typeof scripts?.build === "string") buildScript = "build";
 
   let outputDir = options.outputDir;
   if (!outputDir) {
@@ -914,25 +897,291 @@ async function generateStaticDeployment(): Promise<void> {
     }
   }
 
-  const staticConfig: StaticSiteConfig = { outputDir: outputDir!, buildScript, spa };
-  const templates = staticDeploymentFileTemplates(staticConfig);
-  const targets = [...Object.keys(templates), ...(spa ? ["scripts/static-server.ts"] : [])];
+  const config: StaticSiteConfig = { outputDir: outputDir!, buildScript, spa };
+  const targets = [...Object.keys(staticDeploymentFileTemplates(config)), ...(spa ? ["scripts/static-server.ts"] : [])];
   const conflicts: string[] = [];
   for (const name of targets) if (await Bun.file(join(root, name)).exists()) conflicts.push(name);
   if (conflicts.length > 0) {
     throw new Error(`Static setup would generate ${conflicts.join(", ")}, which already exist and may package or run something else.\n\nNext: remove or rename them, then run bun ship:setup again.`);
   }
+  return config;
+}
+
+async function serverDeploymentInputs(): Promise<DeploymentDecision> {
+  const packageJson = JSON.parse(await readFile(join(root, "package.json"), "utf8")) as { scripts?: Record<string, unknown> };
+  const dockerfileExists = await Bun.file(join(root, "Dockerfile")).exists();
+  if (!dockerfileExists && typeof packageJson.scripts?.start !== "string") {
+    throw new Error("Dockerfile generation requires a package.json start script.\n\nNext: add a start script that binds to 0.0.0.0 and reads PORT, then run bun ship:setup.");
+  }
+  return { kind: "server", dockerfileExists, hasBuildScript: typeof packageJson.scripts?.build === "string" };
+}
+
+async function writeDeployment(decision: DeploymentDecision): Promise<string[]> {
   const written: string[] = [];
-  for (const [name, contents] of Object.entries(templates)) {
-    await writeFile(join(root, name), contents, { mode: 0o644 });
-    written.push(name);
+  if (decision.kind === "static") {
+    // Script-less generators (Jekyll) have no package.json; create a minimal
+    // one so bun ship commands and an optional build script have a home.
+    const packagePath = join(root, "package.json");
+    if (!await Bun.file(packagePath).exists()) {
+      const name = root.split("/").pop()?.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[._-]+|[._-]+$/g, "") || "static-site";
+      await writeFile(packagePath, `${JSON.stringify({ name, private: true, scripts: { ...SHIP_SCRIPTS } }, null, 2)}\n`, { mode: 0o644 });
+      written.push("package.json");
+      log.success("Created minimal package.json");
+    }
+    for (const [name, contents] of Object.entries(staticDeploymentFileTemplates(decision.config))) {
+      await writeFile(join(root, name), contents, { mode: 0o644 });
+      written.push(name);
+    }
+    if (decision.config.spa) {
+      await mkdir(join(root, "scripts"), { recursive: true });
+      await writeFile(join(root, "scripts", "static-server.ts"), staticServerSource(decision.config.outputDir), { mode: 0o644 });
+      written.push("scripts/static-server.ts");
+    }
+  } else if (decision.kind === "server") {
+    for (const [name, contents] of Object.entries(deploymentFileTemplates(decision.hasBuildScript))) {
+      if (name === "Dockerfile" && decision.dockerfileExists) continue;
+      if (await Bun.file(join(root, name)).exists()) continue;
+      await writeFile(join(root, name), contents, { mode: 0o644 });
+      written.push(name);
+    }
   }
-  if (spa) {
-    await mkdir(join(root, "scripts"), { recursive: true });
-    await writeFile(join(root, "scripts", "static-server.ts"), staticServerSource(staticConfig.outputDir), { mode: 0o644 });
-    written.push("scripts/static-server.ts");
+  if (written.length > 0) log.success(`Generated ${written.join(", ")}`);
+  if (decision.kind === "server") log.info("Verify the app binds to 0.0.0.0 and reads PORT before shipping.");
+  return written;
+}
+
+// Plan runs defer every write to plan execution. The other modes keep the
+// v47 behavior: generate now, offer to commit, otherwise stop for review.
+async function prepareDeployment(): Promise<{ decision: DeploymentDecision; pending: boolean } | undefined> {
+  const decision = await decideDeployment();
+  if (decision.kind === "tracked") return { decision, pending: false };
+  if (planSetup()) return { decision, pending: decision.kind !== "untracked" };
+  if (decision.kind === "untracked") {
+    outro(`Found uncommitted ${decision.file}.\n\nNext: review it, commit and push it, then run bun ship:setup.`);
+    return undefined;
+  }
+  const written = await writeDeployment(decision);
+  if (await offerGeneratedCommit(written)) return { decision, pending: false };
+  outro(decision.kind === "server"
+    ? "Review generated deployment files and verify app binds to 0.0.0.0 and reads PORT.\n\nNext: commit and push these changes, then run bun ship:setup."
+    : "Review generated deployment files.\n\nNext: commit and push these changes, then run bun ship:setup.");
+  return undefined;
+}
+
+const SHIP_SCRIPTS = {
+  ship: "bun scripts/ship.ts",
+  "ship:setup": "bun scripts/ship.ts --setup",
+  "ship:update": "bun scripts/ship.ts --update",
+  "ship:status": "bun scripts/ship.ts --status",
+  "ship:logs": "bun scripts/ship.ts --logs",
+  "ship:webhook": "bun scripts/ship.ts --webhook",
+};
+
+
+// After generating deployment files interactively, offer to commit and push
+// them in the same run so setup continues without a manual rerun. Returns
+// true when the files are committed. A project with no origin yet cannot be
+// pushed to; setup creates the repository and pushes a few steps later.
+async function offerGeneratedCommit(files: string[]): Promise<boolean> {
+  if (agentRun || !process.stdin.isTTY || !process.stdout.isTTY) return false;
+  const accepted = await confirm({ message: "Commit the generated files, then continue setup?", initialValue: true });
+  if (isCancel(accepted) || !accepted) return false;
+  const present: string[] = [];
+  for (const file of files) if (await Bun.file(join(root, file)).exists()) present.push(file);
+  await run(["git", "add", "--", ...present]);
+  await run(["git", "commit", "--only", "-m", "Add deployment configuration", "--", ...present], { inherit: true });
+  if ((await run(["git", "remote", "get-url", "origin"], { allowFailure: true })).exitCode !== 0) {
+    log.success("Committed deployment files");
+    return true;
   }
-  log.success(`Generated ${written.join(", ")}`);
+  await run(["git", "push"], { inherit: true, allowFailure: true });
+  log.success("Committed and pushed deployment files");
+  return true;
+}
+
+// ── Repository facts ───────────────────────────────────────────────────
+// Setup runs before a project necessarily has commits or a GitHub origin, so
+// these read the repository defensively. inferredProject below assumes both
+// and only runs once the plan has supplied them.
+
+interface ProjectFacts {
+  name: string;
+  branch: string;
+  origin?: string;
+  committed: boolean;
+  composeTracked: boolean;
+  dirty: boolean;
+}
+
+export function repositoryNameFromProject(packageName: unknown, directory: string): string {
+  const candidate = typeof packageName === "string" && packageName ? packageName.replace(/^@[^/]+\//, "") : directory;
+  return candidate.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[._-]+|[._-]+$/g, "") || "app";
+}
+
+async function projectFacts(): Promise<ProjectFacts> {
+  if ((await run(["git", "rev-parse", "--git-dir"], { allowFailure: true })).exitCode !== 0) {
+    throw new Error("This project is not a Git repository.\n\nNext: run git init, then bun ship:setup.");
+  }
+  const packageJson = await Bun.file(join(root, "package.json")).json().catch(() => ({})) as { name?: unknown };
+  const remote = await run(["git", "remote", "get-url", "origin"], { allowFailure: true });
+  let origin: string | undefined;
+  if (remote.exitCode === 0 && remote.stdout.trim()) {
+    try {
+      origin = repositoryFromRemote(remote.stdout.trim());
+    } catch {
+      throw new Error(`origin ${remote.stdout.trim()} is not a GitHub repository.\n\nNext: point origin at GitHub, then run bun ship:setup.`);
+    }
+  }
+  const branch = (await run(["git", "branch", "--show-current"], { allowFailure: true })).stdout.trim();
+  if (!branch) throw new Error("ship requires a named Git branch");
+  const tracked = (await run(["git", "ls-files"], { allowFailure: true })).stdout.split("\n").filter(Boolean);
+  return {
+    name: repositoryNameFromProject(packageJson.name, root.split("/").pop() ?? "app"),
+    branch,
+    origin,
+    committed: (await run(["git", "rev-parse", "--verify", "HEAD"], { allowFailure: true })).exitCode === 0,
+    composeTracked: composeCandidates(tracked).length > 0,
+    dirty: Boolean((await run(["git", "status", "--porcelain"], { allowFailure: true })).stdout.trim()),
+  };
+}
+
+// The domain question comes before the plan, so it cannot wait for
+// inferredProject (which needs a tracked Compose file and an origin).
+async function inferredDomain(): Promise<string | undefined> {
+  const packageJson = await Bun.file(join(root, "package.json")).json().catch(() => ({})) as { name?: unknown };
+  let compose = "";
+  for (const name of ["compose.yaml", "compose.yml", "docker-compose.yml", "docker-compose.yaml"]) {
+    const file = Bun.file(join(root, name));
+    if (await file.exists()) {
+      compose = await file.text();
+      break;
+    }
+  }
+  return domainFromProject(packageJson.name, compose);
+}
+
+async function resolveDomain(current?: ClientConfig): Promise<string> {
+  const known = setupDomain(options.domain, current?.domain, await inferredDomain());
+  if (known) return known;
+  if (agentRun || options.yes) throw new Error("App domain could not be inferred.\n\nAgent: ask user for the app domain, then run bun ship:setup --domain <domain>");
+  const answer = await text({
+    message: "App domain",
+    placeholder: "example.com",
+    validate: (value) => value && DOMAIN.test(value) ? undefined : "Use a lowercase public hostname",
+  });
+  if (isCancel(answer)) throw new Error("setup cancelled");
+  return answer;
+}
+
+// A local .env holds exactly what must never reach a repository, and the next
+// step of this plan pushes. Templates gitignore it, but an adopted project may
+// not, so the pathspec keeps it out of the index no matter what git thinks.
+// glob magic on purpose: without it git matches the pathspec with slashes
+// fair game, so ":(exclude)*.env.*" also drops src/schema.env.ts and
+// src/config.env.json out of the commit. With it, "**/" walks directories and
+// "*" stops at the separator, so only real dotenv basenames match.
+const ENV_EXCLUDES = [":(exclude,glob)**/.env", ":(exclude,glob)**/.env.*"];
+const ENV_GLOBS = [":(glob)**/.env", ":(glob)**/.env.*"];
+// The three conventional names for the file that lists the variables and none
+// of their values.
+const ENV_EXAMPLE_NAMES = [".env.example", ".env.sample", ".env.template"];
+const ENV_EXAMPLE_GLOBS = ENV_EXAMPLE_NAMES.map((name) => `:(glob)**/${name}`);
+
+function isEnvExample(path: string): boolean {
+  return ENV_EXAMPLE_NAMES.some((name) => path === name || path.endsWith(`/${name}`));
+}
+
+async function untrackedEnvFiles(): Promise<string[]> {
+  const listed = await run(["git", "ls-files", "--others", "--exclude-standard", "--", ...ENV_GLOBS], { allowFailure: true });
+  return listed.stdout.split("\n").filter(Boolean).filter((path) => !isEnvExample(path));
+}
+
+// The example files document the variable names and hold none of the values,
+// so they ride along after the blanket exclude took them out.
+async function addEnvExamples(): Promise<void> {
+  const listed = await run(["git", "ls-files", "--others", "--modified", "--exclude-standard", "--", ...ENV_EXAMPLE_GLOBS], { allowFailure: true });
+  const examples = [...new Set(listed.stdout.split("\n").filter(Boolean))];
+  if (examples.length > 0) await run(["git", "add", "--", ...examples], { allowFailure: true });
+}
+
+// The first commit belongs to the user, so create-shibumi never makes one;
+// approving the plan is where the user makes it.
+async function commitEverything(message: string): Promise<boolean> {
+  const secrets = await untrackedEnvFiles();
+  await run(["git", "add", "-A", "--", ".", ...ENV_EXCLUDES]);
+  await addEnvExamples();
+  if ((await run(["git", "diff", "--cached", "--quiet"], { allowFailure: true })).exitCode === 0) return false;
+  const commit = await run(["git", "commit", "-m", message], { inherit: true, allowFailure: true });
+  if (commit.exitCode !== 0) throw new Error("git commit failed.\n\nNext: fix the git error above (identity, hooks), then run bun ship:setup.");
+  log.success(`Committed: ${message}`);
+  if (secrets.length > 0) {
+    log.warn(`Left ${secrets.join(", ")} out of the commit.\nNext: add ${secrets.length === 1 ? "it" : "them"} to .gitignore, and set production values with bun ship:env set KEY=VALUE.`);
+  }
+  return true;
+}
+
+// A repository with history gets a path-scoped commit instead, so unrelated
+// work in progress is never swept into a deployment commit.
+const DEPLOYMENT_FILES = ["Dockerfile", "compose.yaml", "compose.yml", ".dockerignore", "scripts/static-server.ts", "package.json", "bun.lock"];
+
+async function commitDeploymentFiles(): Promise<boolean> {
+  const present: string[] = [];
+  for (const file of DEPLOYMENT_FILES) if (await Bun.file(join(root, file)).exists()) present.push(file);
+  if (present.length === 0) return false;
+  await run(["git", "add", "--", ...present]);
+  if ((await run(["git", "diff", "--cached", "--quiet", "--", ...present], { allowFailure: true })).exitCode === 0) return false;
+  const commit = await run(["git", "commit", "--only", "-m", "Add deployment configuration", "--", ...present], { inherit: true, allowFailure: true });
+  if (commit.exitCode !== 0) throw new Error("git commit failed.\n\nNext: fix the git error above (identity, hooks), then run bun ship:setup.");
+  log.success("Committed deployment configuration");
+  return true;
+}
+
+// No GitHub origin is not an error: setup offers to create the repository.
+// Private by default; --public opts out. There is no visibility question.
+async function createGitHubRepository(facts: ProjectFacts): Promise<string> {
+  if (!Bun.which("gh")) {
+    throw new Error("Creating the GitHub repository needs the GitHub CLI.\n\nNext: install gh from https://cli.github.com, or add an origin remote yourself, then run bun ship:setup.");
+  }
+  await ensureGitHubAuth();
+  const created = await run([
+    "gh", "repo", "create", facts.name, options.publicRepo ? "--public" : "--private",
+    "--source", ".", "--remote", "origin", "--push",
+  ], { allowFailure: true });
+  if (created.exitCode !== 0) {
+    throw new Error(`${created.stderr.trim() || "gh repo create failed"}\n\nNext: create the repository yourself, add it as origin, then run bun ship:setup.`);
+  }
+  const origin = repositoryFromRemote(await git("remote", "get-url", "origin"));
+  log.success(`Created ${options.publicRepo ? "public" : "private"} repo ${origin} and pushed ${facts.branch}`);
+  return origin;
+}
+
+async function githubOwner(): Promise<string | undefined> {
+  if (!Bun.which("gh")) return undefined;
+  const login = await run(["gh", "api", "user", "--jq", ".login"], { allowFailure: true });
+  return login.exitCode === 0 && login.stdout.trim() ? login.stdout.trim() : undefined;
+}
+
+// One rendered block instead of six questions. Every line names something
+// the single "Run setup?" confirm authorises.
+export function setupPlanLines(input: {
+  target: string;
+  domain: string;
+  branch: string;
+  newRepository?: string;
+  visibility: "private" | "public";
+  generate?: string;
+  commit: boolean;
+  trigger: "ship" | "github-push";
+}): string[] {
+  return [
+    ...(input.generate ? [input.generate] : []),
+    ...(input.newRepository ? [`Create ${input.visibility} repo ${input.newRepository}, push ${input.branch}`] : []),
+    `Connect to ${input.target}, save target for this project`,
+    "Install or upgrade shibumi-server (sudo password once)",
+    `Register ${input.domain}`,
+    ...(input.commit ? ["Commit and push deployment files"] : []),
+    `Deploys run on: ${input.trigger === "github-push" ? `git push origin ${input.branch}` : "bun ship"}`,
+  ];
 }
 
 async function inferredProject() {
@@ -1021,10 +1270,14 @@ async function requestSshTarget(configHostname?: string): Promise<string | undef
     if (!suggestion) throw new Error("SSH server could not be inferred.\n\nAgent: ask user for their SSH target (user@host or SSH alias), then run bun ship:setup --server <target>");
     return suggestion;
   }
-  explain(
-    "Local configuration",
-    `Use the same user@server target or SSH alias you use in your terminal.\nIt will be saved in ${clientSettingsPath()} on this computer and will not be committed.\nResolved server hostname, app domain, and deploy settings go in committed shibumi-server.json.`,
-  );
+  // The plan states where the target is saved and that it is not committed,
+  // so plan mode goes straight to the question.
+  if (!planSetup()) {
+    explain(
+      "Local configuration",
+      `Use the same user@server target or SSH alias you use in your terminal.\nIt will be saved in ${clientSettingsPath()} on this computer and will not be committed.\nResolved server hostname, app domain, and deploy settings go in committed shibumi-server.json.`,
+    );
+  }
   const answer = await text({
     message: "SSH target (user@server or alias)",
     placeholder: suggestion ?? "user@example-vps.com",
@@ -1033,7 +1286,7 @@ async function requestSshTarget(configHostname?: string): Promise<string | undef
   if (isCancel(answer)) return undefined;
   const target = answer || suggestion;
   if (!target) return undefined;
-  if (!await approve(`Save ${target} locally and connect?`)) return undefined;
+  if (!planSetup() && !await approve(`Save ${target} locally and connect?`)) return undefined;
   return target;
 }
 
@@ -1098,7 +1351,7 @@ async function ensureServer(target: string): Promise<void> {
     version.exitCode === 0 ? `shibumi-server ${version.stdout.trim()} needs an upgrade` : "shibumi-server is not installed",
     "This runs the reviewed installer on the SSH server. SSH and sudo prompts stay attached directly to your terminal.",
   );
-  if (!await approve("Install or upgrade shibumi-server now?")) throw new Error("server setup cancelled");
+  if (!await approvePlanned("Install or upgrade shibumi-server now?")) throw new Error("server setup cancelled");
   const result = await ssh(target, ["curl -fsSL https://shibumistack.dev/install/server | bash"], { tty: true, allowFailure: true });
   if (result.exitCode !== 0) throw new Error("remote shibumi-server installation failed");
   const installed = await ssh(target, [SERVER_CLI, "--version"], { allowFailure: true });
@@ -1109,19 +1362,8 @@ async function ensureServer(target: string): Promise<void> {
 
 // Reuse an existing registration silently. New apps retain interactive SSH so
 // server and sudo prompts stay attached to the local terminal.
-async function remoteSetup(target: string, _force: boolean, current?: ClientConfig): Promise<ClientConfig> {
+async function remoteSetup(target: string, domain: string): Promise<ClientConfig> {
   const project = await inferredProject();
-  let domain = setupDomain(options.domain, current?.domain, project.domain);
-  if (!domain && (agentRun || options.yes)) throw new Error("App domain could not be inferred.\n\nAgent: ask user for the app domain, then run bun ship:setup --domain <domain>");
-  if (!domain) {
-    const answer = await text({
-      message: "App domain",
-      placeholder: "example.com",
-      validate: (value) => value && DOMAIN.test(value) ? undefined : "Use a lowercase public hostname",
-    });
-    if (isCancel(answer)) throw new Error("setup cancelled");
-    domain = answer;
-  }
   const serverHostname = await resolvedSshHostname(target);
   await rememberSshTarget(serverHostname, target);
   await ensureServer(target);
@@ -1136,7 +1378,7 @@ async function remoteSetup(target: string, _force: boolean, current?: ClientConf
       "Server setup required",
       `SSH target  ${target}\nDomain      ${domain}\nRepository  github:${project.repository}\n\nSSH and sudo prompts stay attached to this terminal.`,
     );
-    if (!await approve("Continue through SSH?")) throw new Error("server setup cancelled");
+    if (!await approvePlanned("Continue through SSH?")) throw new Error("server setup cancelled");
     const setup = await ssh(target, [
       "env", "SHIBUMI_SHIP_SETUP=1", SERVER_CLI, "add", domain,
       "--repository", `github:${project.repository}`,
@@ -1178,19 +1420,19 @@ async function ensureGitHubAuth(): Promise<void> {
   if (status.exitCode === 0) return;
   explain("GitHub sign-in required", "GitHub CLI stores your credentials. Shibumi never reads them.");
   if (agentRun || options.yes) throw new Error("GitHub sign-in required.\n\nAgent: ask user to run gh auth login -h github.com -p https -w, then retry.");
-  if (!await approve("Sign in to GitHub now?")) throw new Error("Next: run gh auth login -h github.com -p https -w, then rerun bun ship.");
+  if (!await approve("Sign in to GitHub now?")) throw new Error("Next: run gh auth login -h github.com -p https -w, then rerun this command.");
   const login = await run(["gh", "auth", "login", "-h", "github.com", "-p", "https", "-w"], { inherit: true, allowFailure: true });
   if (login.exitCode !== 0 || (await run(["gh", "auth", "status", "-h", "github.com"], { allowFailure: true })).exitCode !== 0) {
-    throw new Error("GitHub sign-in did not complete.\n\nNext: run gh auth login -h github.com -p https -w, then rerun bun ship.");
+    throw new Error("GitHub sign-in did not complete.\n\nNext: run gh auth login -h github.com -p https -w, then rerun this command.");
   }
 }
 
 async function authorizeWebhookAccess(): Promise<void> {
   explain("GitHub webhook access required", "GitHub CLI needs admin:repo_hook to create or repair this repository webhook.");
   if (agentRun || options.yes) throw new Error("GitHub webhook access required.\n\nAgent: ask user to run gh auth refresh -h github.com -s admin:repo_hook, then retry.");
-  if (!await approve("Authorize webhook access now?")) throw new Error("Next: run gh auth refresh -h github.com -s admin:repo_hook, then rerun bun ship.");
+  if (!await approve("Authorize webhook access now?")) throw new Error("Next: run gh auth refresh -h github.com -s admin:repo_hook, then rerun bun ship:webhook.");
   const refresh = await run(["gh", "auth", "refresh", "-h", "github.com", "-s", "admin:repo_hook"], { inherit: true, allowFailure: true });
-  if (refresh.exitCode !== 0) throw new Error("GitHub webhook authorization did not complete.\n\nNext: run gh auth refresh -h github.com -s admin:repo_hook, then rerun bun ship.");
+  if (refresh.exitCode !== 0) throw new Error("GitHub webhook authorization did not complete.\n\nNext: run gh auth refresh -h github.com -s admin:repo_hook, then rerun bun ship:webhook.");
 }
 
 async function findWebhook(config: ClientConfig): Promise<GitHubWebhook | undefined> {
@@ -1201,24 +1443,26 @@ async function findWebhook(config: ClientConfig): Promise<GitHubWebhook | undefi
     await authorizeWebhookAccess();
     hooks = await run(["gh", "api", `repos/${repository}/hooks?per_page=100`], { allowFailure: true });
   }
-  if (hooks.exitCode !== 0) throw new Error(`${hooks.stderr.trim() || "GitHub CLI could not read repository webhooks"}\n\nNext: confirm repository admin access, then rerun bun ship.`);
+  if (hooks.exitCode !== 0) throw new Error(`${hooks.stderr.trim() || "GitHub CLI could not read repository webhooks"}\n\nNext: confirm repository admin access, then rerun bun ship:webhook.`);
   return matchingWebhook(JSON.parse(hooks.stdout), config.webhookUrl);
 }
 
 // Fetch the secret only when GitHub needs it. It moves through process memory
 // from server output to `gh` input and is never printed or written locally.
-async function ensureWebhook(config: ClientConfig, target: string): Promise<void> {
+// Returns true when this run created the hook, which is the only case where
+// a later failure may take it back down.
+async function ensureWebhook(config: ClientConfig, target: string, assumeApproved = false): Promise<boolean> {
   const existing = await findWebhook(config);
   if (existing && !existing.needsRepair) {
     log.success("GitHub webhook is active");
-    return;
+    return false;
   }
   const repository = config.repository.slice("github:".length);
   explain(
     existing ? "GitHub webhook needs repair" : "GitHub webhook is missing",
     `Repository  ${repository}\nPayload URL ${config.webhookUrl}\nEvents      push\n\nThe secret travels from server to GitHub CLI through memory only.`,
   );
-  if (!existing && !await approve("Create webhook with GitHub CLI?")) throw new Error(`Next: review ${config.webhookUrl} at https://github.com/${repository}/settings/hooks`);
+  if (!existing && !assumeApproved && !await approve("Create webhook with GitHub CLI?")) throw new Error(`Next: review ${config.webhookUrl} at https://github.com/${repository}/settings/hooks`);
   if (existing) log.info("Refreshing webhook secret from server configuration");
   const secretResult = await ssh(target, ["env", "SHIBUMI_SKIP_UPDATE_CHECK=1", SERVER_CLI, "webhook-secret", config.appId]);
   const secretValue: unknown = JSON.parse(secretResult.stdout);
@@ -1235,14 +1479,14 @@ async function ensureWebhook(config: ClientConfig, target: string): Promise<void
     await authorizeWebhookAccess();
     result = await run(args, { input, allowFailure: true });
   }
-  if (result.exitCode !== 0) throw new Error(`${result.stderr.trim() || "GitHub CLI could not configure webhook"}\n\nNext: confirm repository admin access, then rerun bun ship.`);
+  if (result.exitCode !== 0) throw new Error(`${result.stderr.trim() || "GitHub CLI could not configure webhook"}\n\nNext: confirm repository admin access, then rerun bun ship:webhook.`);
   const hookId = existing?.id ?? (JSON.parse(result.stdout) as { id?: unknown }).id;
   if (typeof hookId !== "number") throw new Error("GitHub returned an invalid webhook");
   if (existing && !existing.active) {
     result = await run(["gh", "api", "-X", "PATCH", `repos/${repository}/hooks/${hookId}`, "--input", "-"], {
       input: JSON.stringify({ active: true, events: ["push"] }), allowFailure: true,
     });
-    if (result.exitCode !== 0) throw new Error(`${result.stderr.trim() || "GitHub CLI could not enable webhook"}\n\nNext: confirm repository admin access, then rerun bun ship:setup.`);
+    if (result.exitCode !== 0) throw new Error(`${result.stderr.trim() || "GitHub CLI could not enable webhook"}\n\nNext: confirm repository admin access, then rerun bun ship:webhook.`);
   }
   const ping = await run(["gh", "api", "-X", "POST", `repos/${repository}/hooks/${hookId}/pings`], { allowFailure: true });
   if (ping.exitCode !== 0) throw new Error(`${ping.stderr.trim() || "GitHub CLI could not test webhook"}\n\nNext: review https://github.com/${repository}/settings/hooks.`);
@@ -1251,22 +1495,22 @@ async function ensureWebhook(config: ClientConfig, target: string): Promise<void
     const checked = await run(["gh", "api", `repos/${repository}/hooks/${hookId}`], { allowFailure: true });
     if (checked.exitCode === 0 && (JSON.parse(checked.stdout) as { last_response?: { code?: unknown } }).last_response?.code === 200) {
       log.success(existing ? "GitHub webhook repaired and tested" : "GitHub webhook created and tested");
-      return;
+      return !existing;
     }
   }
-  throw new Error(`GitHub webhook is configured but not reachable yet.\n\nNext: confirm ${config.domain} DNS and TLS, then run bun ship:setup. For proxied Cloudflare domains, use Full (strict) SSL/TLS mode.\n\nGitHub: https://github.com/${repository}/settings/hooks`);
+  throw new Error(`GitHub webhook is configured but not reachable yet.\n\nNext: confirm ${config.domain} DNS and TLS, then run bun ship:webhook. For proxied Cloudflare domains, use Full (strict) SSL/TLS mode. Prefer deploying with bun ship? Run bun ship:webhook --off.\n\nGitHub: https://github.com/${repository}/settings/hooks`);
 }
 
-async function disableWebhook(config: ClientConfig): Promise<void> {
+async function disableWebhook(config: ClientConfig, assumeApproved = false): Promise<void> {
   const repository = config.repository.slice("github:".length);
   const settings = `https://github.com/${repository}/settings/hooks`;
   if (!Bun.which("gh") || (await run(["gh", "auth", "status", "-h", "github.com"], { allowFailure: true })).exitCode !== 0) {
-    log.warn(`Direct shipping enabled. GitHub webhook cleanup skipped because GitHub CLI is not authenticated.\nNext: disable ${config.webhookUrl} at ${settings}, or rerun bun ship:setup after GitHub sign-in.`);
+    log.warn(`Direct shipping enabled. GitHub webhook cleanup skipped because GitHub CLI is not authenticated.\nNext: disable ${config.webhookUrl} at ${settings}, or rerun bun ship:webhook --off after GitHub sign-in.`);
     return;
   }
   const hooks = await run(["gh", "api", `repos/${repository}/hooks?per_page=100`], { allowFailure: true });
   if (hooks.exitCode !== 0) {
-    log.warn(`Direct shipping enabled. GitHub webhook cleanup could not reach GitHub.\nNext: disable ${config.webhookUrl} at ${settings}, or rerun bun ship:setup later.`);
+    log.warn(`Direct shipping enabled. GitHub webhook cleanup could not reach GitHub.\nNext: disable ${config.webhookUrl} at ${settings}, or rerun bun ship:webhook --off later.`);
     return;
   }
   const existing = matchingWebhook(JSON.parse(hooks.stdout), config.webhookUrl);
@@ -1274,13 +1518,15 @@ async function disableWebhook(config: ClientConfig): Promise<void> {
     log.success("GitHub webhook is disabled");
     return;
   }
-  explain("Disable deploy-on-push", `Repository  ${repository}\nPayload URL ${config.webhookUrl}\n\nGit pushes will stop changing production. Run bun ship to deploy.`);
-  if (!await approve("Disable GitHub webhook?")) throw new Error("webhook change cancelled");
+  if (!assumeApproved) {
+    explain("Disable deploy-on-push", `Repository  ${repository}\nPayload URL ${config.webhookUrl}\n\nGit pushes will stop changing production. Run bun ship to deploy.`);
+    if (!await approve("Disable GitHub webhook?")) throw new Error("webhook change cancelled");
+  }
   const result = await run(["gh", "api", "-X", "PATCH", `repos/${repository}/hooks/${existing.id}`, "--input", "-"], {
     input: JSON.stringify({ active: false }), allowFailure: true,
   });
   if (result.exitCode !== 0) {
-    log.warn(`Direct shipping enabled. GitHub webhook cleanup failed.\nNext: disable ${config.webhookUrl} at ${settings}, or rerun bun ship:setup later.`);
+    log.warn(`Direct shipping enabled. GitHub webhook cleanup failed.\nNext: disable ${config.webhookUrl} at ${settings}, or rerun bun ship:webhook --off later.`);
     return;
   }
   log.success("GitHub webhook disabled");
@@ -1299,42 +1545,162 @@ async function setDeploymentMode(config: ClientConfig, target: string, trigger:
   return { ...validateConfig(JSON.parse(downloaded.stdout)), trigger };
 }
 
-async function selectTrigger(current: ClientConfig["trigger"], force: boolean): Promise<ClientConfig["trigger"]> {
-  if (options.trigger) return options.trigger;
-  if (!force || options.yes || agentRun) return current;
-  log.info(`Current deployment: ${current === "ship" ? "Run bun ship" : "Every GitHub push"}`);
-  const answer = await select({
-    message: "How do you want to deploy?",
-    initialValue: current,
-    options: [
-      { value: "ship", label: "Run bun ship", hint: "recommended" },
-      { value: "github-push", label: "Deploy every GitHub push" },
-    ],
-  });
-  if (isCancel(answer)) throw new Error("setup cancelled");
-  return answer as ClientConfig["trigger"];
+// Opt-in push-to-deploy. Setup never creates a webhook: with the default
+// `bun ship` trigger it buys nothing, and it costs a GitHub sign-in plus an
+// admin:repo_hook grant. This command pays that cost only when asked, and
+// --off reverses both halves (webhook and trigger).
+async function runWebhook(): Promise<void> {
+  intro(`渋み  ship webhook${options.off ? " --off" : ""}`);
+  try {
+    const config = await readConfig();
+    if (!config) throw new Error("Shibumi setup is missing.\n\nNext: run bun ship:setup.");
+    const target = await projectTarget(config);
+    if (options.off) {
+      // Runs whatever the recorded trigger says: a hook can outlive the
+      // trigger that installed it, and that hook is the thing to switch off.
+      const updated = config.trigger === "github-push"
+        ? await setDeploymentMode({ ...config, trigger: "ship" }, target, "ship")
+        : config;
+      await writeFile(configPath, `${JSON.stringify(updated, null, 2)}\n`);
+      await disableWebhook(updated, true);
+      await offerSetupCommit(updated);
+      outro("Pushes no longer deploy. Deploys run on: bun ship");
+      return;
+    }
+    if (!Bun.which("gh")) throw new Error("Push-to-deploy needs the GitHub CLI.\n\nNext: install gh from https://cli.github.com, then run bun ship:webhook.");
+    const already = config.trigger === "github-push";
+    explain(
+      already ? "Push-to-deploy: repair" : "Push-to-deploy",
+      `Every push to ${config.branch} deploys ${config.domain} automatically.\nThe webhook secret travels from server to GitHub CLI through memory only.`,
+    );
+    await ensureGitHubAuth();
+    if (!await approve(already ? "Repair the webhook and keep push-to-deploy?" : "Install webhook and switch to push-to-deploy?")) {
+      throw new Error("Next: run bun ship:webhook when you want pushes to deploy.");
+    }
+    // Hook first, then the trigger: if the trigger switch fails, the hook is
+    // taken back down, so an active hook always means trigger github-push.
+    const created = await ensureWebhook(config, target, true);
+    let updated: ClientConfig;
+    try {
+      updated = await setDeploymentMode({ ...config, trigger: "github-push" }, target, "github-push");
+    } catch (error) {
+      // Only undo what this run did: a hook that was already there (repair
+      // path) stays, and its project keeps deploying on push.
+      if (created) await disableWebhook(config, true);
+      throw error;
+    }
+    await writeFile(configPath, `${JSON.stringify(updated, null, 2)}\n`);
+    await offerSetupCommit(updated);
+    outro(`git push origin ${updated.branch} now deploys. Undo: bun ship:webhook --off`);
+  } finally {
+    await closeSshControl();
+  }
+}
+
+interface SetupResult {
+  config: ClientConfig;
+  target: string;
+  changed: boolean;
+  setupCommit?: SetupCommit;
 }
 
-async function setup(force: boolean): Promise<{ config: ClientConfig; target: string; changed: boolean } | undefined> {
+async function setup(force: boolean): Promise<SetupResult | undefined> {
   let config = await readConfig();
-  if ((force || !config) && await prepareCompose()) return undefined;
-  if (force || !config) await inferredProject();
+  const first = force || !config;
+  const previous = config;
+  // Projects set up before ship:webhook existed keep their github-push
+  // trigger; new ones deploy on bun ship until ship:webhook says otherwise.
+  const trigger = previous?.trigger ?? "ship";
+  let deployment: { decision: DeploymentDecision; pending: boolean } | undefined;
+  if (first) {
+    deployment = await prepareDeployment();
+    if (!deployment) return undefined;
+  }
   let target = await configuredSshTarget(config?.server.hostname);
   if (!target) target = await requestSshTarget(config?.server.hostname);
   if (!target) throw new Error("SSH server is required");
-  const previous = config;
-  if (force || !config) config = await remoteSetup(target, force, config);
+  if (first && deployment) {
+    // Question two of two. Everything after this is plan, confirm, run.
+    const domain = await resolveDomain(config);
+    const facts = await projectFacts();
+    if (!facts.origin && agentRun) {
+      throw new Error(`This project has no GitHub origin.\n\nAgent: ask user whether to create a repository for ${facts.name}, then run bun ship:setup -y (add --public for a public repo).`);
+    }
+    const owner = facts.origin ? undefined : await githubOwner();
+    const willCommit = !facts.committed || !facts.composeTracked || facts.dirty || deployment.pending || !previous;
+    // Rendered in every mode, prompted in none but a plan run: even under
+    // --yes the transcript has to say what this run is about to do.
+    explain("Plan", setupPlanLines({
+      target,
+      domain,
+      branch: facts.branch,
+      newRepository: facts.origin ? undefined : owner ? `${owner}/${facts.name}` : facts.name,
+      visibility: options.publicRepo ? "public" : "private",
+      generate: deploymentPlanLine(deployment.decision),
+      commit: willCommit,
+      trigger,
+    }).join("\n"));
+    if (planSetup()) {
+      const accepted = await confirm({ message: "Run setup?", initialValue: true });
+      if (isCancel(accepted) || !accepted) {
+        cancel("Setup cancelled. Nothing was changed.");
+        return undefined;
+      }
+      planApproved = true;
+    }
+    if (deployment.pending) await writeDeployment(deployment.decision);
+    // A repository needs a commit before it can be pushed, and registration
+    // reads the Compose file out of the committed tree. Each approvePlanned()
+    // here is answered by the plan confirm; only --interactive asks again.
+    if (!facts.committed) {
+      if (!await approvePlanned("Commit this project now?")) throw new Error("Next: commit your project, then run bun ship:setup.");
+      await commitEverything("Initial commit");
+    } else if (!facts.composeTracked || deployment.pending) {
+      if (!await approvePlanned("Commit the deployment files now?")) throw new Error("Next: commit the deployment files, then run bun ship:setup.");
+      await commitDeploymentFiles();
+    }
+    if (!facts.origin) {
+      if (!await approvePlanned(`Create ${options.publicRepo ? "public" : "private"} repo ${facts.name} and push ${facts.branch}?`)) {
+        throw new Error("Next: create the repository, add it as origin, then run bun ship:setup.");
+      }
+      await createGitHubRepository(facts);
+    }
+    config = await remoteSetup(target, domain);
+  }
   if (!config) throw new Error("deployment setup did not return client configuration");
   await rememberSshTarget(config.server.hostname, target);
-  const trigger = await selectTrigger(previous?.trigger ?? config.trigger, force);
   config = await setDeploymentMode({ ...config, trigger }, target, trigger);
+  // Persisting is ship:setup's job. A bare `bun ship` that had to run setup
+  // leaves the commit to runShip below, exactly as it did before v48.
+  let setupCommit: SetupCommit | undefined;
   if (force) {
     await writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`);
-    if (trigger === "github-push") await ensureWebhook(config, target);
-    else if (previous) await disableWebhook(config);
-    else log.success("Deployments run through bun ship");
+    log.success(trigger === "ship"
+      ? "Deployments run through bun ship"
+      : `Deployments run on every push to ${config.branch}`);
+    // The plan said commit and push, so this run does both, and runShip is
+    // told the outcome so it never asks the same question twice.
+    setupCommit = await offerSetupCommit(config);
+    if (setupCommit !== "declined") await pushSetupCommit(config.branch);
+  }
+  return {
+    config,
+    target,
+    setupCommit,
+    changed: !previous || JSON.stringify(previous) !== JSON.stringify(config),
+  };
+}
+
+async function pushSetupCommit(branch: string): Promise<void> {
+  if ((await run(["git", "remote", "get-url", "origin"], { allowFailure: true })).exitCode !== 0) return;
+  const ahead = await run(["git", "rev-list", "--count", `origin/${branch}..HEAD`], { allowFailure: true });
+  if (ahead.exitCode === 0 && ahead.stdout.trim() === "0") return;
+  const push = await run(["git", "push", "origin", branch], { inherit: true, allowFailure: true });
+  if (push.exitCode !== 0) {
+    log.warn(`Could not push ${branch}.\nNext: git push origin ${branch}, then run bun ship.`);
+    return;
   }
-  return { config, target, changed: !previous || JSON.stringify(previous) !== JSON.stringify(config) };
+  log.success(`Pushed ${branch} to origin`);
 }
 
 // Refuse ambiguous deploys: wrong origin, wrong branch, dirty work, or remote
@@ -1612,7 +1978,7 @@ async function followStatus(config: ClientConfig, target: string, commit: string
     }
     if (!lastStage && Date.now() >= webhookDeadline) {
       progress.stop("Webhook did not start deployment", 1);
-      throw new Error(`GitHub webhook did not reach shibumi-server.\n\nNext: check https://github.com/${config.repository.slice("github:".length)}/settings/hooks, then rerun bun ship after repairing delivery.`);
+      throw new Error(`GitHub webhook did not reach shibumi-server.\n\nNext: run bun ship:webhook to repair delivery (or bun ship:webhook --off to deploy with bun ship instead).\n\nGitHub: https://github.com/${config.repository.slice("github:".length)}/settings/hooks`);
     }
     await Bun.sleep(2_000);
   }
@@ -1818,12 +2184,15 @@ export async function runShip(): Promise<void> {
     const forceSetup = options.setup;
     const result = await setup(forceSetup);
     if (!result) return;
-    const setupCommit = await offerSetupCommit(result.config);
+    // ship:setup already committed and pushed; asking again would prompt
+    // twice and, on a decline, commit without pushing.
+    const setupCommit = result.setupCommit ?? await offerSetupCommit(result.config);
     if (setupCommit === "declined") {
       outro(`${accent("Next:")} review and commit Shibumi setup files, then run bun ship.`);
       return;
     }
-    if (forceSetup || result.changed) {
+    const firstRun = forceSetup || result.changed;
+    if (firstRun) {
       // Setup succeeded with everything committed, so the first deploy is one
       // Enter away. Offer it here instead of ending on "Next: bun ship".
       // Only for direct-ship triggers in an interactive run: github-push
@@ -1832,7 +2201,12 @@ export async function runShip(): Promise<void> {
         ? await confirm({ message: "Ship now?", initialValue: true })
         : false;
       if (shipNow !== true || isCancel(shipNow)) {
-        outro(`${accent("Next:")} ${result.config.trigger === "github-push" ? `git push origin ${result.config.branch} to deploy` : "bun ship"}`);
+        // A commit made just above still has to reach origin; leaving here
+        // must not leave "commit and push" half done.
+        if (setupCommit === "committed") await pushSetupCommit(result.config.branch);
+        outro(result.config.trigger === "github-push"
+          ? `${accent("Next:")} git push origin ${result.config.branch} to deploy`
+          : `${accent("Next:")} bun ship\n      Prefer push-to-deploy? bun ship:webhook`);
         return;
       }
     }
@@ -1865,7 +2239,9 @@ export async function runShip(): Promise<void> {
     const complete = spinner();
     complete.start("Finishing ship");
     complete.stop(`Shipped in ${formatDuration(Date.now() - startedAt)} (--rollback if needed)`);
-    outro(`https://${result.config.domain}`);
+    outro(firstRun && result.config.trigger === "ship"
+      ? `Live at https://${result.config.domain}\n      Deploys run on: bun ship. Prefer push-to-deploy? bun ship:webhook`
+      : `https://${result.config.domain}`);
   } finally {
     await closeSshControl();
   }
@@ -1876,7 +2252,7 @@ export function immutableShipSource(source: string): string | undefined {
 }
 
 export function shouldCheckForShipUpdate(value: ShipOptions): boolean {
-  return !(value.setup || value.update || value.rollback || value.logs || value.status || value.dev);
+  return !(value.setup || value.update || value.rollback || value.logs || value.status || value.dev || value.webhook);
 }
 
 async function runLatestShipClient(args: string[]): Promise<boolean> {
@@ -2063,6 +2439,7 @@ export function runShipCli(): void {
     : options.logs ? showLogs()
     : options.status ? showStatus()
     : options.dev ? runDev()
+    : options.webhook ? runWebhook()
     : runShip();
   action.catch((error) => {
     cancel(error instanceof Error ? error.message : String(error));