opencode-ship 0.9.0 → 0.10.0-rc.17

package/dist/plugin.js

@@ -1,4 +1,4 @@
-// opencode-ship v0.9.0
+// opencode-ship v0.10.0-rc.17
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -9,27 +9,41 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/profile.js
+function isValidProfile(name) {
+  return typeof name === "string" && PROFILES.includes(name);
+}
+var PROFILES;
+var init_profile = __esm({
+  "src/profile.js"() {
+    PROFILES = Object.freeze(["core", "engineering"]);
+  }
+});
+
 // src/installer/json-pointer.js
-function isObject3(v) {
+function isObject2(v) {
   return v !== null && typeof v === "object" && !Array.isArray(v);
 }
 function stableStringify(value) {
   if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
-  if (isObject3(value)) {
+  if (isObject2(value)) {
     const keys = Object.keys(value).sort();
     return `{${keys.map((k) => `${JSON.stringify(k)}:${stableStringify(value[k])}`).join(",")}}`;
   }
   return JSON.stringify(value);
 }
+function canonicalJson(value) {
+  return stableStringify(value);
+}
 var init_json_pointer = __esm({
   "src/installer/json-pointer.js"() {
   }
 });
 
 // src/installer/hash.js
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 function bytesHash(buffer) {
-  return createHash2("sha256").update(buffer).digest("hex");
+  return createHash8("sha256").update(buffer).digest("hex");
 }
 function bytesHashString(text) {
   return bytesHash(Buffer.from(text, "utf8"));
@@ -40,17 +54,6 @@ var init_hash = __esm({
   }
 });
 
-// src/profile.js
-function isValidProfile(name) {
-  return typeof name === "string" && PROFILES.includes(name);
-}
-var PROFILES;
-var init_profile = __esm({
-  "src/profile.js"() {
-    PROFILES = Object.freeze(["core", "engineering"]);
-  }
-});
-
 // src/installer/lock.js
 var lock_exports = {};
 __export(lock_exports, {
@@ -65,20 +68,20 @@ __export(lock_exports, {
   validateLock: () => validateLock,
   writeLock: () => writeLock
 });
-import { readFile as readFile4, writeFile as writeFile4, rename as rename4, mkdir as mkdir4 } from "node:fs/promises";
-import { existsSync as existsSync4 } from "node:fs";
-import { dirname as dirname4, resolve as resolve8 } from "node:path";
+import { readFile as readFile11, writeFile as writeFile10, rename as rename4, mkdir as mkdir12 } from "node:fs/promises";
+import { existsSync as existsSync10 } from "node:fs";
+import { dirname as dirname6, resolve as resolve10 } from "node:path";
 function lockSchemaRevision() {
   return CURRENT_LOCK_SCHEMA;
 }
 function lockPath(repoRoot) {
-  return resolve8(repoRoot, ".opencode", "ship.lock.json");
+  return resolve10(repoRoot, ".opencode", "ship.lock.json");
 }
 async function readLock2(repoRoot) {
   const path = lockPath(repoRoot);
-  if (!existsSync4(path)) return null;
+  if (!existsSync10(path)) return null;
   try {
-    const raw = await readFile4(path, "utf8");
+    const raw = await readFile11(path, "utf8");
     const parsed = JSON.parse(raw);
     return parsed;
   } catch {
@@ -87,12 +90,12 @@ async function readLock2(repoRoot) {
 }
 async function writeLock(repoRoot, lock) {
   const path = lockPath(repoRoot);
-  await mkdir4(dirname4(path), { recursive: true });
+  await mkdir12(dirname6(path), { recursive: true });
   const integrity = computeIntegrity(lock);
   const finalLock = { ...lock, integrity };
   const raw = JSON.stringify(finalLock, null, 2) + "\n";
   const tmp = `${path}.tmp`;
-  await writeFile4(tmp, raw, "utf8");
+  await writeFile10(tmp, raw, "utf8");
   await rename4(tmp, path);
   return path;
 }
@@ -117,8 +120,8 @@ function validateLock(rawLock) {
   }
   const issues = [];
   let kind = "ok";
-  if (rawLock.contractVersion !== CURRENT_LOCK_SCHEMA && rawLock.contractVersion !== 1) {
-    issues.push(`unsupported contractVersion: ${JSON.stringify(rawLock.contractVersion)} (expected ${CURRENT_LOCK_SCHEMA} or 1)`);
+  if (rawLock.contractVersion !== CURRENT_LOCK_SCHEMA && rawLock.contractVersion !== 1 && rawLock.contractVersion !== 2) {
+    issues.push(`unsupported contractVersion: ${JSON.stringify(rawLock.contractVersion)} (expected ${CURRENT_LOCK_SCHEMA}, 2, or 1)`);
     kind = "schema";
   }
   const manager = rawLock.manager;
@@ -128,13 +131,13 @@ function validateLock(rawLock) {
   } else if (typeof manager !== "object" || manager === null) {
     issues.push("manager section must be an object");
     kind = kind === "ok" ? "shape" : kind;
-  } else if (manager.schemaVersion !== CURRENT_LOCK_SCHEMA && manager.schemaVersion !== 1) {
-    issues.push(`unsupported manager.schemaVersion: ${JSON.stringify(manager.schemaVersion)} (expected ${CURRENT_LOCK_SCHEMA} or 1)`);
+  } else if (manager.schemaVersion !== CURRENT_LOCK_SCHEMA && manager.schemaVersion !== 2 && manager.schemaVersion !== 1) {
+    issues.push(`unsupported manager.schemaVersion: ${JSON.stringify(manager.schemaVersion)} (expected ${CURRENT_LOCK_SCHEMA}, 2, or 1)`);
     kind = "schema";
   } else if (manager.name !== "opencode-ship") {
     issues.push(`unknown manager.name: ${JSON.stringify(manager.name)}`);
     kind = "shape";
-  } else if (rawLock.contractVersion === CURRENT_LOCK_SCHEMA && manager.schemaVersion === CURRENT_LOCK_SCHEMA && manager.profile !== void 0 && !isValidProfile(manager.profile)) {
+  } else if (rawLock.contractVersion >= 2 && manager.schemaVersion >= 2 && manager.profile !== void 0 && !isValidProfile(manager.profile)) {
     issues.push(`invalid manager.profile: ${JSON.stringify(manager.profile)} (expected one of: core, engineering)`);
     kind = "shape";
   }
@@ -156,12 +159,12 @@ function validateLock(rawLock) {
 }
 async function readValidatedLock(repoRoot) {
   const path = lockPath(repoRoot);
-  if (!existsSync4(path)) {
+  if (!existsSync10(path)) {
     return { kind: "missing", lock: null, issues: [] };
   }
   let raw;
   try {
-    const text = await readFile4(path, "utf8");
+    const text = await readFile11(path, "utf8");
     raw = JSON.parse(text);
   } catch (e) {
     return {
@@ -174,10 +177,10 @@ async function readValidatedLock(repoRoot) {
   return { kind: validation.kind, lock: validation.ok ? raw : null, issues: validation.issues };
 }
 async function migrateLegacyLock(repoRoot) {
-  const legacy = resolve8(repoRoot, ".opencode", "delivery.lock.json");
-  if (!existsSync4(legacy)) return null;
+  const legacy = resolve10(repoRoot, ".opencode", "delivery.lock.json");
+  if (!existsSync10(legacy)) return null;
   try {
-    const raw = await readFile4(legacy, "utf8");
+    const raw = await readFile11(legacy, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed.contractVersion !== 1 || typeof parsed.adapterSha256 !== "string") return null;
     return {
@@ -196,7 +199,7 @@ var init_lock = __esm({
     init_hash();
     init_json_pointer();
     init_profile();
-    CURRENT_LOCK_SCHEMA = 2;
+    CURRENT_LOCK_SCHEMA = 3;
   }
 });
 
@@ -12623,8 +12626,8 @@ function tool(input) {
 tool.schema = external_exports;
 
 // src/plugin.js
-import { resolve as resolve12 } from "node:path";
-import { readFile as readFile5 } from "node:fs/promises";
+import { resolve as resolve14 } from "node:path";
+import { readFile as readFile12 } from "node:fs/promises";
 
 // src/adapter.js
 import { readFile, writeFile, mkdir, rename } from "node:fs/promises";
@@ -12821,8 +12824,8 @@ async function loadAdapter(repoRoot) {
   }
   const v = validateAdapter(parsed);
   if (!v.ok) return { ok: false, error: { kind: "contract", path, issues: v.issues } };
-  const sha256 = createHash("sha256").update(raw).digest("hex");
-  return { ok: true, adapter: v.adapter, path, sha256 };
+  const sha2563 = createHash("sha256").update(raw).digest("hex");
+  return { ok: true, adapter: v.adapter, path, sha256: sha2563 };
 }
 async function readLock(repoRoot) {
   const lockPath2 = resolve(repoRoot, ".opencode", LOCK_FILENAME);
@@ -12846,9 +12849,62 @@ function parseRepoSlug(slug) {
   return { owner: slug.slice(0, slash), name: slug.slice(slash + 1) };
 }
 
+// src/drivers/github-command-policy.js
+var ALLOWED_VERBS = /* @__PURE__ */ new Set([
+  "issue list",
+  "issue view",
+  "issue create",
+  "issue comment",
+  "issue edit",
+  "issue close",
+  "pr list",
+  "pr view",
+  "pr create",
+  "pr edit",
+  "pr checks",
+  "pr ready",
+  "pr merge"
+]);
+var FORBIDDEN_FLAGS = /* @__PURE__ */ new Set([
+  "--web",
+  "--body-file",
+  "--template"
+]);
+function validateGhArgv(argv) {
+  if (!Array.isArray(argv) || argv.length < 2) {
+    return { ok: false, reason: "argv must be a non-empty array starting with the binary" };
+  }
+  const [bin, ...rest] = argv;
+  if (bin !== "gh") {
+    return { ok: false, reason: `expected 'gh' binary, got ${JSON.stringify(bin)}` };
+  }
+  if (rest.length === 0) {
+    return { ok: false, reason: "no gh subcommand" };
+  }
+  const verb = rest.slice(0, 2).join(" ");
+  if (verb.includes("api")) {
+    return { ok: false, reason: "gh api is not allowed (use typed Ship tools instead)" };
+  }
+  if (!ALLOWED_VERBS.has(verb)) {
+    return { ok: false, reason: `gh subcommand not in the allowlist: ${verb}` };
+  }
+  for (const arg of rest.slice(2)) {
+    if (FORBIDDEN_FLAGS.has(arg)) {
+      return { ok: false, reason: `gh flag ${arg} is forbidden (use Ship's typed body argument instead)` };
+    }
+    if (typeof arg !== "string" || arg.length === 0) {
+      return { ok: false, reason: "gh argv must contain only non-empty strings" };
+    }
+  }
+  return { ok: true, verb: (
+    /** @type {any} */
+    verb
+  ) };
+}
+
 // src/drivers/gh-cli.js
 function defaultRunner(cwd, env) {
-  return (args) => new Promise((resolve13, reject2) => {
+  return (args) => new Promise((resolve15, reject2) => {
     const proc = spawn("gh", args, {
       cwd,
       env,
@@ -12860,7 +12916,7 @@ function defaultRunner(cwd, env) {
     proc.stdout.on("data", (d) => stdout += d.toString());
     proc.stderr.on("data", (d) => stderr += d.toString());
     proc.on("error", reject2);
-    proc.on("close", (status) => resolve13({ status: status ?? -1, stdout, stderr }));
+    proc.on("close", (status) => resolve15({ status: status ?? -1, stdout, stderr }));
   });
 }
 function viewFields() {
@@ -13096,6 +13152,20 @@ Closes #${issueNumber}`;
         "headRefOid"
       ]);
       return fields.headRefOid;
+    },
+    async runCommand(argv) {
+      if (!Array.isArray(argv) || argv.length === 0) {
+        throw new Error("runCommand: argv must be a non-empty array");
+      }
+      if (typeof argv[0] !== "string" || argv[0].length === 0) {
+        throw new Error("runCommand: argv[0] must be a non-empty string");
+      }
+      const policy = validateGhArgv(argv);
+      if (!policy.ok) {
+        throw new Error(`runCommand: rejected by policy: ${policy.reason}`);
+      }
+      const r = await run(argv);
+      return r;
     }
   };
 }
@@ -13162,82 +13232,326 @@ async function doctor(repoRoot, packageVersion) {
 }
 
 // src/state/manifest-store.js
-import { readFile as readFile2, writeFile as writeFile2, rename as rename2, mkdir as mkdir2, readdir, unlink } from "node:fs/promises";
-import { dirname as dirname2, join as join2, resolve as resolve3 } from "node:path";
+import { readFile as readFile3, readdir as readdir2, unlink as unlink2 } from "node:fs/promises";
+import { join as join4, resolve as resolve5 } from "node:path";
+
+// src/state/git-common-dir.js
 import { spawn as spawn2 } from "node:child_process";
-async function runGitCommonDir(repoRoot) {
-  return new Promise((res, rej) => {
+import { resolve as resolve3, join as join2 } from "node:path";
+var STATE_DIRNAME = "opencode-ship";
+async function resolveGitCommonDir(repoRoot) {
+  if (typeof repoRoot !== "string" || repoRoot.length === 0) {
+    throw new Error("resolveGitCommonDir: repoRoot must be a non-empty string");
+  }
+  return new Promise((resolveP, reject2) => {
     const proc = spawn2(
       "git",
-      ["rev-parse", "--path-format=absolute", "--git-common-dir"],
-      { cwd: repoRoot, stdio: ["ignore", "pipe", "pipe"], shell: false }
+      ["-C", repoRoot, "rev-parse", "--path-format=absolute", "--git-common-dir"],
+      { stdio: ["ignore", "pipe", "pipe"], shell: false }
     );
     let out = "";
-    proc.stdout.on("data", (d) => out += d.toString());
-    proc.on("error", rej);
+    let err = "";
+    proc.stdout.on("data", (d) => {
+      out += d.toString("utf8");
+    });
+    proc.stderr.on("data", (d) => {
+      err += d.toString("utf8");
+    });
+    proc.on("error", reject2);
     proc.on("close", (code) => {
       if (code !== 0) {
-        rej(new Error(`git rev-parse --git-common-dir failed with ${code}`));
+        reject2(new Error(
+          `git rev-parse --git-common-dir failed (exit ${code}): ${err.trim() || "unknown error"}`
+        ));
         return;
       }
       const trimmed = out.trim();
       if (!trimmed) {
-        rej(new Error("git rev-parse returned an empty path"));
+        reject2(new Error("git rev-parse --git-common-dir returned an empty path"));
         return;
       }
-      res(resolve3(repoRoot, trimmed));
+      resolveP(resolve3(repoRoot, trimmed));
     });
   });
 }
-function manifestPath(commonDir, taskId) {
-  return join2(commonDir, "opencode-delivery", "manifests", `${taskId}.json`);
+function opencodeShipStateDir(commonDir, ...segments) {
+  if (typeof commonDir !== "string" || commonDir.length === 0) {
+    throw new Error("opencodeShipStateDir: commonDir must be a non-empty string");
+  }
+  return join2(commonDir, STATE_DIRNAME, ...segments);
 }
-async function writeManifest(repoRoot, manifest) {
-  const commonDir = await runGitCommonDir(repoRoot);
-  const path = manifestPath(commonDir, manifest.taskId);
-  await mkdir2(dirname2(path), { recursive: true });
-  const tmp = `${path}.tmp`;
-  await writeFile2(tmp, JSON.stringify(manifest, null, 2) + "\n", "utf8");
-  await rename2(tmp, path);
-  return resolve3(path);
+
+// src/state/durable-store.js
+import {
+  open as fsOpen,
+  writeFile as writeFile2,
+  readFile as readFile2,
+  rename as rename2,
+  link,
+  mkdir as mkdir2,
+  readdir,
+  unlink,
+  stat
+} from "node:fs/promises";
+import { existsSync as existsSync2 } from "node:fs";
+import { dirname as dirname2, join as join3, resolve as resolve4 } from "node:path";
+import { createHash as createHash2, randomBytes } from "node:crypto";
+import { hostname as osHostname } from "node:os";
+var STALE_LOCK_MS = 120 * 1e3;
+function randomToken() {
+  return randomBytes(8).toString("hex");
 }
-async function readManifest(repoRoot, taskId) {
-  const commonDir = await runGitCommonDir(repoRoot);
-  const path = manifestPath(commonDir, taskId);
+function ensureString(value) {
+  return JSON.stringify(value, null, 2) + "\n";
+}
+async function fsyncDir(path) {
   try {
-    const raw = await readFile2(path, "utf8");
-    return JSON.parse(raw);
+    const handle = await fsOpen(path, "r");
+    try {
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
   } catch {
-    return null;
   }
 }
-async function listManifests(repoRoot) {
-  const commonDir = await runGitCommonDir(repoRoot);
-  const dir = join2(commonDir, "opencode-delivery", "manifests");
-  let names;
+async function atomicReplaceJson(path, value) {
+  if (typeof path !== "string" || path.length === 0) {
+    throw new Error("atomicReplaceJson: path must be a non-empty string");
+  }
+  const target = resolve4(path);
+  const parent = dirname2(target);
+  await mkdir2(parent, { recursive: true });
+  const tmp = `${target}.${randomToken()}.tmp`;
+  const handle = await fsOpen(tmp, "w", 384);
+  try {
+    await handle.writeFile(ensureString(value), "utf8");
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+  await rename2(tmp, target);
+  await fsyncDir(parent);
+}
+async function publishImmutableJson(path, value) {
+  if (typeof path !== "string" || path.length === 0) {
+    throw new Error("publishImmutableJson: path must be a non-empty string");
+  }
+  const target = resolve4(path);
+  const parent = dirname2(target);
+  await mkdir2(parent, { recursive: true });
+  if (existsSync2(target)) {
+    throw new Error(`publishImmutableJson: target already exists: ${target}`);
+  }
+  const tmp = `${target}.${randomToken()}.immutable.tmp`;
+  const handle = await fsOpen(tmp, "w", 384);
+  try {
+    await handle.writeFile(ensureString(value), "utf8");
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+  const attempt = await tryHardLink(tmp, target);
+  if (attempt === "exists") {
+    await unlink(tmp).catch(() => null);
+    throw new Error(`publishImmutableJson: target already exists: ${target}`);
+  }
+  if (attempt === "linked") {
+    await unlink(tmp).catch(() => null);
+  } else {
+    try {
+      await rename2(tmp, target);
+    } catch (err) {
+      await unlink(tmp).catch(() => null);
+      if (err && err.code === "EEXIST") {
+        throw new Error(`publishImmutableJson: target already exists: ${target}`);
+      }
+      throw err;
+    }
+  }
+  await fsyncDir(parent);
+}
+async function tryHardLink(src, dst) {
+  try {
+    await link(src, dst);
+    return "linked";
+  } catch (err) {
+    if (err && err.code === "EEXIST") return "exists";
+    if (err && (err.code === "ENOTSUP" || err.code === "EPERM" || err.code === "ENOSYS" || err.code === "EOPNOTSUPP" || err.code === "EXDEV")) {
+      return "fallback";
+    }
+    throw err;
+  }
+}
+async function withResourceLock(stateDir, resourceKey, input) {
+  if (typeof stateDir !== "string" || stateDir.length === 0) {
+    throw new Error("withResourceLock: stateDir must be a non-empty string");
+  }
+  if (typeof resourceKey !== "string" || resourceKey.length === 0) {
+    throw new Error("withResourceLock: resourceKey must be a non-empty string");
+  }
+  const callback = typeof input === "function" ? input : input?.callback;
+  const options = typeof input === "function" ? {} : input?.options ?? {};
+  if (typeof callback !== "function") {
+    throw new Error("withResourceLock: callback must be a function");
+  }
+  const acquireMode = options.acquire ?? "wait";
+  const waitMs = Number.isInteger(options.waitMs) && options.waitMs >= 0 ? options.waitMs : 30 * 1e3;
+  const pollMs = Number.isInteger(options.pollMs) && options.pollMs > 0 ? options.pollMs : 25;
+  const keyHash = createHash2("sha256").update(resourceKey).digest("hex");
+  const lockDir = join3(stateDir, "locks", keyHash);
+  const ownerPath = join3(lockDir, "owner.json");
+  await mkdir2(stateDir, { recursive: true });
+  const deadline = Date.now() + waitMs;
+  let acquired = false;
+  let quarantinedThisAcquire = false;
+  while (!acquired) {
+    try {
+      await mkdir2(lockDir, { recursive: true });
+      const handle = await fsOpen(ownerPath, "wx", 384);
+      try {
+        const owner = {
+          pid: process.pid,
+          hostname: osHostname(),
+          resource: resourceKey,
+          startedAt: (/* @__PURE__ */ new Date()).toISOString()
+        };
+        await handle.writeFile(JSON.stringify(owner, null, 2) + "\n", "utf8");
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      acquired = true;
+    } catch (err) {
+      if (err && err.code === "EEXIST") {
+        const claimed = await maybeQuarantineStaleLock(lockDir, ownerPath, resourceKey);
+        if (claimed) {
+          quarantinedThisAcquire = true;
+          continue;
+        }
+        if (acquireMode === "try") {
+          throw new Error(`withResourceLock: resource is busy: ${resourceKey}`);
+        }
+        if (Date.now() >= deadline) {
+          throw new Error(`withResourceLock: timed out waiting for ${resourceKey}`);
+        }
+        await new Promise((r) => setTimeout(r, pollMs));
+        continue;
+      }
+      throw err;
+    }
+  }
+  try {
+    return await callback();
+  } finally {
+    await unlink(ownerPath).catch(() => null);
+    if (!quarantinedThisAcquire) {
+      await unlink(lockDir).catch(() => null);
+    }
+  }
+}
+async function maybeQuarantineStaleLock(lockDir, ownerPath, resourceKey) {
+  let raw;
+  try {
+    raw = await readFile2(ownerPath, "utf8");
+  } catch {
+    return false;
+  }
+  let owner;
+  try {
+    owner = JSON.parse(raw);
+  } catch {
+    return false;
+  }
+  if (!owner || typeof owner !== "object") return false;
+  if (!Number.isInteger(owner.pid) || owner.pid <= 0) return false;
+  if (typeof owner.startedAt !== "string") return false;
+  const start = Date.parse(owner.startedAt);
+  if (!Number.isFinite(start)) return false;
+  if (Date.now() - start < STALE_LOCK_MS) return false;
+  if (owner.hostname !== osHostname()) return false;
+  let alive = true;
+  try {
+    process.kill(owner.pid, 0);
+  } catch (e) {
+    alive = e?.code === "EPERM";
+  }
+  if (alive) return false;
+  const stamp = new Date(start).toISOString().replace(/[:.]/g, "-");
+  const quarantinePath = join3(lockDir, `stale-${stamp}-${resourceKey.replace(/[^A-Za-z0-9._-]+/g, "_")}.owner.json`);
+  try {
+    await rename2(ownerPath, quarantinePath);
+  } catch {
+    return false;
+  }
+  return "quarantined";
+}
+
+// src/state/manifest-store.js
+var SHIP_DIRNAME = "opencode-ship";
+var LEGACY_DIRNAME = "opencode-delivery";
+function canonicalManifestPath(commonDir, taskId) {
+  return join4(commonDir, SHIP_DIRNAME, "delivery", "manifests", `${taskId}.json`);
+}
+function legacyManifestPath(commonDir, taskId) {
+  return join4(commonDir, LEGACY_DIRNAME, "manifests", `${taskId}.json`);
+}
+async function commonDirFromRepoRoot(repoRoot) {
+  return resolveGitCommonDir(repoRoot);
+}
+async function readJsonOrNull(path) {
   try {
-    names = await readdir(dir);
+    const raw = await readFile3(path, "utf8");
+    return JSON.parse(raw);
   } catch {
-    return [];
+    return null;
   }
+}
+async function writeManifest(repoRoot, manifest) {
+  const commonDir = await commonDirFromRepoRoot(repoRoot);
+  const path = canonicalManifestPath(commonDir, manifest.taskId);
+  await atomicReplaceJson(path, manifest);
+  return resolve5(path);
+}
+async function readManifest(repoRoot, taskId) {
+  const commonDir = await commonDirFromRepoRoot(repoRoot);
+  const canonical = await readJsonOrNull(canonicalManifestPath(commonDir, taskId));
+  if (canonical !== null) return canonical;
+  const legacy = await readJsonOrNull(legacyManifestPath(commonDir, taskId));
+  if (legacy !== null) return legacy;
+  return null;
+}
+async function listManifests(repoRoot) {
+  const commonDir = await commonDirFromRepoRoot(repoRoot);
+  const canonicalDir = join4(commonDir, SHIP_DIRNAME, "delivery", "manifests");
+  const legacyDir = join4(commonDir, LEGACY_DIRNAME, "manifests");
   const out = [];
-  for (const name of names) {
-    if (!name.endsWith(".json")) continue;
+  const seen = /* @__PURE__ */ new Set();
+  for (const dir of [canonicalDir, legacyDir]) {
+    let names;
     try {
-      const raw = await readFile2(join2(dir, name), "utf8");
-      out.push(JSON.parse(raw));
+      names = await readdir2(dir);
     } catch {
+      continue;
+    }
+    for (const name of names) {
+      if (!name.endsWith(".json")) continue;
+      if (seen.has(name)) continue;
+      const parsed = await readJsonOrNull(join4(dir, name));
+      if (parsed !== null) {
+        seen.add(name);
+        out.push(parsed);
+      }
     }
   }
   return out;
 }
 async function deleteManifest(repoRoot, taskId) {
-  const commonDir = await runGitCommonDir(repoRoot);
-  const path = manifestPath(commonDir, taskId);
-  try {
-    await unlink(path);
-  } catch {
-  }
+  const commonDir = await commonDirFromRepoRoot(repoRoot);
+  const canonical = canonicalManifestPath(commonDir, taskId);
+  const legacy = legacyManifestPath(commonDir, taskId);
+  await unlink2(canonical).catch(() => null);
+  await unlink2(legacy).catch(() => null);
 }
 
 // src/tools/delivery-inspect.js
@@ -13395,13 +13709,13 @@ function createIssueTool(deps) {
 }
 
 // src/tools/delivery-worktree.js
-import { resolve as resolve5 } from "node:path";
+import { resolve as resolve7 } from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 
 // src/drivers/git.js
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { resolve as resolve4 } from "node:path";
-import { existsSync as existsSync2 } from "node:fs";
+import { resolve as resolve6 } from "node:path";
+import { existsSync as existsSync3 } from "node:fs";
 function runGit(args, cwd) {
   return spawnSync2("git", args, {
     cwd,
@@ -13440,13 +13754,13 @@ function isWorktreeClean(cwd) {
 function isRebaseInProgress(cwd) {
   const merge2 = runGit(["rev-parse", "--git-path", "rebase-merge"], cwd);
   const apply = runGit(["rev-parse", "--git-path", "rebase-apply"], cwd);
-  const mergeExists = merge2.status === 0 && safeExists(resolve4(cwd, merge2.stdout.trim()));
-  const applyExists = apply.status === 0 && safeExists(resolve4(cwd, apply.stdout.trim()));
+  const mergeExists = merge2.status === 0 && safeExists(resolve6(cwd, merge2.stdout.trim()));
+  const applyExists = apply.status === 0 && safeExists(resolve6(cwd, apply.stdout.trim()));
   return mergeExists || applyExists;
 }
 function safeExists(p) {
   try {
-    return existsSync2(p);
+    return existsSync3(p);
   } catch {
     return false;
   }
@@ -13506,8 +13820,8 @@ function runBootstrap(args, cwd) {
   });
 }
 function isPathContained(repoRoot, worktreeRoot, candidatePath) {
-  const rootAbs = resolve5(repoRoot, worktreeRoot);
-  const normalized = resolve5(candidatePath);
+  const rootAbs = resolve7(repoRoot, worktreeRoot);
+  const normalized = resolve7(candidatePath);
   if (normalized !== rootAbs && !normalized.startsWith(rootAbs + "/")) {
     return false;
   }
@@ -13543,12 +13857,12 @@ function createWorktreeTool(deps) {
       return { kind: "missing-input", field: "worktreeRelativePath" };
     }
     const worktreeRoot = deps.adapter?.worktree?.root ?? ".worktrees";
-    const worktreePath = resolve5(deps.repoRoot, input.worktreeRelativePath);
+    const worktreePath = resolve7(deps.repoRoot, input.worktreeRelativePath);
     if (!isPathContained(deps.repoRoot, worktreeRoot, worktreePath)) {
       return {
         kind: "path-escape",
         resolvedPath: worktreePath,
-        expectedRoot: resolve5(deps.repoRoot, worktreeRoot)
+        expectedRoot: resolve7(deps.repoRoot, worktreeRoot)
       };
     }
     const remote = deps.remote ?? "origin";
@@ -13719,7 +14033,7 @@ function createVerifyTool(deps) {
       ],
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    const manifestPath2 = await writeManifest(deps.repoRoot, next);
+    const manifestPath = await writeManifest(deps.repoRoot, next);
     return {
       contractVersion: 1,
       commandId: cmd.id,
@@ -13727,7 +14041,7 @@ function createVerifyTool(deps) {
       stdoutTail,
       stderrTail,
       headSha: head,
-      manifestPath: manifestPath2
+      manifestPath
     };
   };
 }
@@ -14109,7 +14423,7 @@ function createMergeTool(deps) {
 }
 
 // src/tools/delivery-cleanup.js
-import { resolve as resolve6 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 import { spawnSync as spawnSync3 } from "node:child_process";
 function safeRemoveWorktree(repoRoot, path) {
   const r = spawnSync3("git", ["worktree", "remove", path], {
@@ -14170,8 +14484,8 @@ function createCleanupTool(deps) {
       return { kind: "manifest-state", state: m.state };
     }
     if (!m.worktreePath) return { kind: "missing-worktree-path" };
-    const wtPath = resolve6(m.worktreePath);
-    const mainCwd = resolve6(deps.repoRoot);
+    const wtPath = resolve8(m.worktreePath);
+    const mainCwd = resolve8(deps.repoRoot);
     if (wtPath === mainCwd) return { kind: "current-checkout", worktreePath: wtPath };
     if (!isWorktreeClean(wtPath)) return { kind: "dirty-worktree" };
     if (isRebaseInProgress(wtPath)) return { kind: "rebase-in-progress" };
@@ -14267,106 +14581,1615 @@ function createCleanupTool(deps) {
   };
 }
 
-// src/recovery.js
-function recoverManifestAfterCrash(manifest) {
-  return manifest;
+// src/tools/envelope.js
+import { randomBytes as randomBytes2 } from "node:crypto";
+var CONTRACT_VERSION = 2;
+function operationId(prefix = "op") {
+  return `${prefix}-${Date.now().toString(36)}-${randomBytes2(4).toString("hex")}`;
+}
+function success2(kind, data, options = {}) {
+  if (typeof kind !== "string" || kind.length === 0) {
+    throw new Error("envelope.success: kind must be a non-empty string");
+  }
+  return {
+    contractVersion: CONTRACT_VERSION,
+    ok: true,
+    kind,
+    operationId: options.operationId ?? operationId(kind),
+    idempotent: options.idempotent !== false,
+    data
+  };
+}
+function failure(kind, message, options = {}) {
+  if (typeof kind !== "string" || kind.length === 0) {
+    throw new Error("envelope.failure: kind must be a non-empty string");
+  }
+  if (typeof message !== "string" || message.length === 0) {
+    throw new Error("envelope.failure: message must be a non-empty string");
+  }
+  const details = options.details ?? {};
+  return {
+    contractVersion: CONTRACT_VERSION,
+    ok: false,
+    kind,
+    operationId: options.operationId ?? operationId(`${kind}-err`),
+    retryable: options.retryable === true,
+    message,
+    details
+  };
 }
 
-// src/installer/plugin-owner.js
-import { spawnSync as spawnSync4 } from "node:child_process";
-async function reconcileOwner(repoRoot, adapter) {
-  const r = spawnSync4("git", ["-C", repoRoot, "config", "--get", "user.name"], {
-    encoding: "utf8"
-  });
-  if (r.status === 0 && r.stdout.trim()) return r.stdout.trim();
-  return process.env.USER ?? process.env.USERNAME ?? "opencode-ship";
+// src/state/github-operation-store.js
+import { readFile as readFile4, writeFile as writeFile3, mkdir as mkdir3, readdir as readdir3, unlink as unlink3 } from "node:fs/promises";
+import { existsSync as existsSync4 } from "node:fs";
+import { join as join5, dirname as dirname3 } from "node:path";
+async function operationsDir(repoRoot) {
+  const common = await resolveGitCommonDir(repoRoot);
+  return join5(opencodeShipStateDir(common), "github", "operations");
+}
+var SAFE_ID_RE = /^[A-Za-z0-9._-]{1,128}$/;
+function operationPath(dir, operationId2) {
+  if (!SAFE_ID_RE.test(operationId2)) {
+    throw new Error(`invalid operationId: ${JSON.stringify(operationId2)}`);
+  }
+  return join5(dir, `${operationId2}.json`);
+}
+async function hasOperation(repoRoot, operationId2) {
+  const dir = await operationsDir(repoRoot);
+  return existsSync4(operationPath(dir, operationId2));
+}
+async function recordOperation(repoRoot, operationId2, record2) {
+  if (typeof operationId2 !== "string" || operationId2.length === 0) {
+    throw new Error("recordOperation: operationId must be a non-empty string");
+  }
+  if (!record2 || typeof record2 !== "object") {
+    throw new Error("recordOperation: record must be an object");
+  }
+  const dir = await operationsDir(repoRoot);
+  await mkdir3(dir, { recursive: true });
+  const path = operationPath(dir, operationId2);
+  if (existsSync4(path)) {
+    return { recorded: false, path };
+  }
+  const fullRecord = {
+    operationId: operationId2,
+    kind: record2.kind,
+    ok: record2.ok,
+    payload: record2.payload ?? null,
+    recordedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await publishImmutableJson(path, fullRecord);
+  return { recorded: true, path };
 }
 
-// src/installer/config.js
-import { readFile as readFile3, writeFile as writeFile3, rename as rename3, mkdir as mkdir3 } from "node:fs/promises";
-import { existsSync as existsSync3 } from "node:fs";
-import { dirname as dirname3, resolve as resolve7 } from "node:path";
+// src/tools/delivery-github-read.js
+function createGithubReadTool(deps) {
+  return async function githubRead(input) {
+    const opId = input.operationId ?? `gh-read-${Date.now().toString(36)}`;
+    const resource = String(input.resource ?? "");
+    const repo = deps.repoSlug;
+    const number4 = Number(input.number);
+    if (!repo) return failure("github-read", "repo slug missing", { operationId: opId, retryable: false });
+    if (!["issue", "pr", "checks"].includes(resource)) {
+      return failure("github-read", `unknown resource: ${resource}`, { operationId: opId, retryable: false });
+    }
+    if (resource !== "checks" && (!Number.isInteger(number4) || number4 <= 0)) {
+      return failure("github-read", "issue/PR number required", { operationId: opId, retryable: false });
+    }
+    if (await hasOperation(deps.repoRoot, opId)) {
+      const prior = await deps.operationStore.readOperation(deps.repoRoot, opId).catch(() => null);
+      if (prior && prior.ok) return success2("github-read", prior.payload, { operationId: opId, idempotent: true });
+    }
+    let argv;
+    if (resource === "issue") {
+      argv = ["gh", "issue", "view", String(number4), "--repo", repo, "--json", "number,title,state,body,url"];
+    } else if (resource === "pr") {
+      argv = ["gh", "pr", "view", String(number4), "--repo", repo, "--json", "number,url,state,headRefOid,isDraft"];
+    } else {
+      const sha = input.sha ? String(input.sha) : null;
+      if (!sha) return failure("github-read", "sha required for checks", { operationId: opId, retryable: false });
+      argv = ["gh", "pr", "checks", String(number4), "--repo", repo, "--json", "name,state,conclusion"];
+    }
+    const policy = validateGhArgv(argv);
+    if (!policy.ok) return failure("github-read", policy.reason, { operationId: opId, retryable: false });
+    try {
+      const result = await deps.driver.runCommand(argv);
+      if (result.status !== 0) {
+        return failure("github-read", `exit ${result.status}: ${result.stderr}`, { operationId: opId, retryable: false });
+      }
+      const payload = JSON.parse(result.stdout || "{}");
+      await recordOperation(deps.repoRoot, opId, { kind: "github-read", ok: true, payload });
+      return success2("github-read", { resource, number: number4, payload }, { operationId: opId });
+    } catch (err) {
+      return failure("github-read", String(err?.message ?? err), { operationId: opId, retryable: true });
+    }
+  };
+}
 
-// schema/ship-config.schema.json
-var ship_config_schema_default = {
-  $schema: "https://json-schema.org/draft/2020-12/schema",
-  $id: "https://github.com/Viktorxyz/opencode-ship/schema/ship-config.schema.json",
-  title: "opencode-ship user config",
-  type: "object",
-  required: ["schemaVersion"],
-  additionalProperties: false,
-  properties: {
-    schemaVersion: { const: 1 },
-    profile: {
-      type: "string",
-      enum: ["core", "engineering"],
-      description: "Active profile (precedence layer 2: ship.config > lock > core default)."
-    },
-    owner: {
-      type: "string",
-      description: "Optional override for the issue/manifest owner field. Defaults to the agent's local user.name."
-    },
-    project: {
-      type: "object",
-      additionalProperties: false,
-      properties: {
-        remote: { type: "string", minLength: 1 },
-        repository: { type: "string", pattern: "^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$" },
-        defaultBranch: { type: "string", minLength: 1 },
-        packageManager: { enum: ["npm", "pnpm", "yarn", "bun"] },
-        detectOverrides: { type: "boolean", description: "Permit detection to refresh previously persisted values." }
+// src/tools/delivery-issue-comment.js
+function createIssueCommentTool(deps) {
+  return async function issueComment(input) {
+    const opId = input.operationId ?? `issue-comment-${Date.now().toString(36)}`;
+    const number4 = Number(input.number);
+    const body = String(input.body ?? "");
+    if (!Number.isInteger(number4) || number4 <= 0) {
+      return failure("issue-comment", "issue number required", { operationId: opId, retryable: false });
+    }
+    if (body.length === 0) {
+      return failure("issue-comment", "comment body required", { operationId: opId, retryable: false });
+    }
+    if (await hasOperation(deps.repoRoot, opId)) {
+      return success2("issue-comment", { number: number4, idempotent: true }, { operationId: opId, idempotent: true });
+    }
+    const argv = ["gh", "issue", "comment", String(number4), "--repo", deps.repoSlug, "--body", body];
+    const policy = validateGhArgv(argv);
+    if (!policy.ok) return failure("issue-comment", policy.reason, { operationId: opId, retryable: false });
+    try {
+      const result = await deps.driver.runCommand(argv);
+      if (result.status !== 0) {
+        return failure("issue-comment", `exit ${result.status}: ${result.stderr}`, { operationId: opId, retryable: false });
       }
-    },
-    delivery: {
-      type: "object",
-      additionalProperties: false,
-      properties: {
-        worktree: {
-          type: "object",
-          additionalProperties: false,
-          properties: {
-            root: { type: "string", minLength: 1 },
-            branchTemplate: { type: "string", minLength: 1 },
-            bootstrap: {
-              type: "array",
-              items: {
-                type: "array",
-                items: { type: "string", minLength: 1 },
-                minItems: 1
-              }
-            }
-          }
-        },
-        verification: {
-          type: "object",
-          additionalProperties: false,
-          properties: {
-            commands: {
-              type: "array",
-              minItems: 1,
-              items: {
-                type: "object",
-                required: ["id", "argv"],
-                additionalProperties: false,
-                properties: {
-                  id: { type: "string", minLength: 1 },
-                  argv: {
-                    type: "array",
-                    items: { type: "string", minLength: 1 },
-                    minItems: 1
-                  },
-                  timeoutMs: { type: "integer", minimum: 1 }
-                }
-              }
-            },
-            requireCleanDiffAfter: { type: "boolean" },
-            invalidateOnHeadChange: { type: "boolean" }
-          }
-        },
-        review: {
-          type: "object",
-          additionalProperties: false,
-          properties: {
+      await recordOperation(deps.repoRoot, opId, { kind: "issue-comment", ok: true, payload: { number: number4 } });
+      return success2("issue-comment", { number: number4 }, { operationId: opId });
+    } catch (err) {
+      return failure("issue-comment", String(err?.message ?? err), { operationId: opId, retryable: true });
+    }
+  };
+}
+
+// src/tools/delivery-issue-labels.js
+function createIssueLabelsTool(deps) {
+  return async function issueLabels(input) {
+    const opId = input.operationId ?? `issue-labels-${Date.now().toString(36)}`;
+    const number4 = Number(input.number);
+    const add = Array.isArray(input.add) ? input.add : [];
+    const remove = Array.isArray(input.remove) ? input.remove : [];
+    if (!Number.isInteger(number4) || number4 <= 0) {
+      return failure("issue-labels", "issue number required", { operationId: opId, retryable: false });
+    }
+    if (add.length === 0 && remove.length === 0) {
+      return failure("issue-labels", "add or remove list required", { operationId: opId, retryable: false });
+    }
+    if (await hasOperation(deps.repoRoot, opId)) {
+      return success2("issue-labels", { number: number4, idempotent: true }, { operationId: opId, idempotent: true });
+    }
+    const attempted = [];
+    for (const label of add) {
+      const argv = ["gh", "issue", "edit", String(number4), "--repo", deps.repoSlug, "--add-label", label];
+      const policy = validateGhArgv(argv);
+      if (!policy.ok) return failure("issue-labels", policy.reason, { operationId: opId, retryable: false });
+      attempted.push({ action: "add", label });
+    }
+    for (const label of remove) {
+      const argv = ["gh", "issue", "edit", String(number4), "--repo", deps.repoSlug, "--remove-label", label];
+      const policy = validateGhArgv(argv);
+      if (!policy.ok) return failure("issue-labels", policy.reason, { operationId: opId, retryable: false });
+      attempted.push({ action: "remove", label });
+    }
+    try {
+      for (const { action, label } of attempted) {
+        const flag = action === "add" ? "--add-label" : "--remove-label";
+        const result = await deps.driver.runCommand(["gh", "issue", "edit", String(number4), "--repo", deps.repoSlug, flag, label]);
+        if (result.status !== 0) {
+          return failure("issue-labels", `${action} ${label} failed: ${result.stderr}`, { operationId: opId, retryable: false });
+        }
+      }
+      await recordOperation(deps.repoRoot, opId, { kind: "issue-labels", ok: true, payload: { number: number4, add, remove } });
+      return success2("issue-labels", { number: number4, add, remove }, { operationId: opId });
+    } catch (err) {
+      return failure("issue-labels", String(err?.message ?? err), { operationId: opId, retryable: true });
+    }
+  };
+}
+
+// src/tools/delivery-issue-link.js
+var RELATIONSHIPS = /* @__PURE__ */ new Set(["blocks", "is-blocked-by", "closes", "is-closed-by", "related"]);
+function createIssueLinkTool(deps) {
+  return async function issueLink(input) {
+    const opId = input.operationId ?? `issue-link-${Date.now().toString(36)}`;
+    const from = Number(input.from);
+    const to = Number(input.to);
+    const relationship = String(input.relationship ?? "");
+    if (!Number.isInteger(from) || from <= 0) return failure("issue-link", "from number required", { operationId: opId, retryable: false });
+    if (!Number.isInteger(to) || to <= 0) return failure("issue-link", "to number required", { operationId: opId, retryable: false });
+    if (!RELATIONSHIPS.has(relationship)) return failure("issue-link", `unknown relationship: ${relationship}`, { operationId: opId, retryable: false });
+    if (await hasOperation(deps.repoRoot, opId)) {
+      return success2("issue-link", { from, to, relationship, idempotent: true }, { operationId: opId, idempotent: true });
+    }
+    const body = `<!-- opencode-ship-link:${relationship} from=${from} to=${to} -->`;
+    const argv = ["gh", "issue", "comment", String(from), "--repo", deps.repoSlug, "--body", body];
+    const policy = validateGhArgv(argv);
+    if (!policy.ok) return failure("issue-link", policy.reason, { operationId: opId, retryable: false });
+    try {
+      const result = await deps.driver.runCommand(argv);
+      if (result.status !== 0) {
+        return failure("issue-link", `exit ${result.status}: ${result.stderr}`, { operationId: opId, retryable: false });
+      }
+      await recordOperation(deps.repoRoot, opId, { kind: "issue-link", ok: true, payload: { from, to, relationship } });
+      return success2("issue-link", { from, to, relationship }, { operationId: opId });
+    } catch (err) {
+      return failure("issue-link", String(err?.message ?? err), { operationId: opId, retryable: true });
+    }
+  };
+}
+
+// src/tools/delivery-issue-close.js
+function createIssueCloseTool(deps) {
+  return async function issueClose(input) {
+    const opId = input.operationId ?? `issue-close-${Date.now().toString(36)}`;
+    const number4 = Number(input.number);
+    const subject = String(input.subject ?? "");
+    if (!Number.isInteger(number4) || number4 <= 0) {
+      return failure("issue-close", "issue number required", { operationId: opId, retryable: false });
+    }
+    if (subject.length === 0) {
+      return failure("issue-close", "user permission subject required", { operationId: opId, retryable: false });
+    }
+    if (await hasOperation(deps.repoRoot, opId)) {
+      return success2("issue-close", { number: number4, idempotent: true }, { operationId: opId, idempotent: true });
+    }
+    const argv = ["gh", "issue", "close", String(number4), "--repo", deps.repoSlug, "--comment", `closed via Ship (subject=${subject})`];
+    const policy = validateGhArgv(argv);
+    if (!policy.ok) return failure("issue-close", policy.reason, { operationId: opId, retryable: false });
+    try {
+      const result = await deps.driver.runCommand(argv);
+      if (result.status !== 0) {
+        return failure("issue-close", `exit ${result.status}: ${result.stderr}`, { operationId: opId, retryable: false });
+      }
+      await recordOperation(deps.repoRoot, opId, { kind: "issue-close", ok: true, payload: { number: number4, subject } });
+      return success2("issue-close", { number: number4, subject }, { operationId: opId });
+    } catch (err) {
+      return failure("issue-close", String(err?.message ?? err), { operationId: opId, retryable: true });
+    }
+  };
+}
+
+// src/tools/delivery-sync.js
+function createSyncTool(deps) {
+  return async function sync(input) {
+    const opId = input.operationId ?? `sync-${Date.now().toString(36)}`;
+    const base = String(input.base ?? "");
+    const branch = String(input.branch ?? "");
+    if (!base || !branch) {
+      return failure("sync", "base and branch required", { operationId: opId, retryable: false });
+    }
+    if (await hasOperation(deps.repoRoot, opId)) {
+      return success2("sync", { base, branch, idempotent: true }, { operationId: opId, idempotent: true });
+    }
+    const argv = ["gh", "pr", "view", "--repo", deps.repoSlug, "--json", "headRefName,baseRefName"];
+    const policy = validateGhArgv(argv);
+    if (!policy.ok) return failure("sync", policy.reason, { operationId: opId, retryable: false });
+    try {
+      const fetchResult = await deps.driver.runCommand(["git", "fetch", "origin", base]);
+      if (fetchResult.status !== 0) {
+        return failure("sync", `fetch failed: ${fetchResult.stderr}`, { operationId: opId, retryable: true });
+      }
+      const mergeResult = await deps.driver.runCommand(["git", "merge", "--no-ff", `origin/${base}`]);
+      if (mergeResult.status !== 0) {
+        return failure("sync", `merge failed: ${mergeResult.stderr}`, { operationId: opId, retryable: true });
+      }
+      const head = await deps.driver.runCommand(["git", "rev-parse", "HEAD"]);
+      const headSha = head.stdout.trim();
+      await recordOperation(deps.repoRoot, opId, { kind: "sync", ok: true, payload: { base, branch, headSha } });
+      return success2("sync", { base, branch, headSha }, { operationId: opId });
+    } catch (err) {
+      return failure("sync", String(err?.message ?? err), { operationId: opId, retryable: true });
+    }
+  };
+}
+
+// src/tools/delivery-publish.js
+var FORBIDDEN_FLAGS2 = /* @__PURE__ */ new Set(["--force", "-f", "--force-with-lease"]);
+function createPublishTool(deps) {
+  return async function publish(input) {
+    const opId = input.operationId ?? `publish-${Date.now().toString(36)}`;
+    const taskId = String(input.taskId ?? "");
+    const expectedHead = String(input.expectedHead ?? "");
+    if (!taskId) return failure("publish", "taskId required", { operationId: opId, retryable: false });
+    if (!expectedHead) return failure("publish", "expectedHead required", { operationId: opId, retryable: false });
+    if (await hasOperation(deps.repoRoot, opId)) {
+      return success2("publish", { taskId, idempotent: true }, { operationId: opId, idempotent: true });
+    }
+    const manifest = await readManifest(deps.repoRoot, taskId);
+    if (!manifest) return failure("publish", "no manifest for taskId", { operationId: opId, retryable: false });
+    const branch = manifest.branch;
+    if (!branch) return failure("publish", "manifest has no branch", { operationId: opId, retryable: false });
+    const argv = ["git", "push", "origin", `HEAD:refs/heads/${branch}`];
+    for (const arg of argv.slice(1)) {
+      if (FORBIDDEN_FLAGS2.has(arg)) {
+        return failure("publish", `forbidden push flag: ${arg}`, { operationId: opId, retryable: false });
+      }
+    }
+    try {
+      const head = await deps.driver.runCommand(["git", "rev-parse", "HEAD"]);
+      const currentHead2 = head.stdout.trim();
+      if (currentHead2 !== expectedHead) {
+        return failure("publish", `HEAD drift (expected ${expectedHead.slice(0, 8)}, got ${currentHead2.slice(0, 8)})`, { operationId: opId, retryable: false });
+      }
+      const result = await deps.driver.runCommand(argv);
+      if (result.status !== 0) {
+        return failure("publish", `push failed: ${result.stderr}`, { operationId: opId, retryable: false });
+      }
+      await recordOperation(deps.repoRoot, opId, { kind: "publish", ok: true, payload: { taskId, branch, headSha: currentHead2 } });
+      return success2("publish", { taskId, branch, headSha: currentHead2 }, { operationId: opId });
+    } catch (err) {
+      return failure("publish", String(err?.message ?? err), { operationId: opId, retryable: true });
+    }
+  };
+}
+
+// src/installer/engineering-config.js
+init_profile();
+var MODEL_ID_RE = /^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+$/;
+var DEFAULTS = Object.freeze({
+  planner: "openai/gpt-5.6-sol",
+  builder: "minimax/MiniMax-M3",
+  finalReviewer: "openai/gpt-5.6-sol"
+});
+function resolveModelRoles(cfg, { strict = false } = {}) {
+  const REQUIRED = ["planner", "builder", "finalReviewer"];
+  if (strict) {
+    const issues = [];
+    for (const role of REQUIRED) {
+      const id = cfg?.models?.[role];
+      if (typeof id !== "string" || id.length === 0 || !MODEL_ID_RE.test(id)) {
+        issues.push(role);
+      }
+    }
+    if (issues.length > 0) {
+      throw new Error(`resolveModelRoles: required role(s) missing or invalid: ${issues.join(", ")}`);
+    }
+    return { planner: cfg.models.planner, builder: cfg.models.builder, finalReviewer: cfg.models.finalReviewer };
+  }
+  const out = { ...DEFAULTS };
+  if (cfg && cfg.models) {
+    for (const [role, id] of Object.entries(cfg.models)) {
+      if (id && typeof id === "string" && id.length > 0) {
+        out[role] = id;
+      } else if (strict && Object.prototype.hasOwnProperty.call(cfg.models, role)) {
+        throw new Error(`resolveModelRoles: user provided empty model id for '${role}'`);
+      }
+    }
+  }
+  for (const role of REQUIRED) {
+    if (!out[role]) {
+      throw new Error(`resolveModelRoles: required role '${role}' missing and no default available`);
+    }
+  }
+  return out;
+}
+
+// src/tools/ship-plan-start.js
+import { mkdir as mkdir4, writeFile as writeFile4 } from "node:fs/promises";
+import { join as join6 } from "node:path";
+function normalizeWorkflowId(issueNumber) {
+  return `wf-${issueNumber}`;
+}
+function createPlanStartTool(deps) {
+  return async function planStart(input) {
+    const opId = input.operationId ?? `plan-start-${Date.now().toString(36)}`;
+    const issueNumber = Number(input.issueNumber);
+    if (!Number.isInteger(issueNumber) || issueNumber <= 0) {
+      return failure("plan-start", "issueNumber required", { operationId: opId, retryable: false });
+    }
+    let models;
+    try {
+      models = resolveModelRoles(deps.config?.workflow, { strict: true });
+    } catch (err) {
+      return failure("plan-start", `model roles unresolved: ${err?.message ?? err}`, { operationId: opId, retryable: false });
+    }
+    const workflowId = normalizeWorkflowId(issueNumber);
+    const repoRoot = deps.repoRoot;
+    try {
+      const commonDir = await resolveGitCommonDir(repoRoot);
+      const wfDir = join6(opencodeShipStateDir(commonDir), "plans", workflowId);
+      await mkdir4(wfDir, { recursive: true });
+      const indexRecord = {
+        workflowId,
+        issueNumber,
+        owner: deps.owner,
+        planner: models.planner,
+        builder: models.builder,
+        finalReviewer: models.finalReviewer,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        state: "drafting"
+      };
+      await writeFile4(join6(wfDir, "index.json"), JSON.stringify(indexRecord, null, 2), "utf8");
+      return success2("plan-start", { workflowId, issueNumber, models: { planner: models.planner, builder: models.builder, finalReviewer: models.finalReviewer } }, { operationId: opId });
+    } catch (err) {
+      return failure("plan-start", String(err?.message ?? err), { operationId: opId, retryable: true });
+    }
+  };
+}
+
+// src/workflow/plan.js
+init_json_pointer();
+import { createHash as createHash3 } from "node:crypto";
+function isPlainObject2(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+function expectString(obj, key, issues) {
+  const v = obj?.[key];
+  if (typeof v !== "string" || v.length === 0) {
+    issues.push(`field ${key} must be a non-empty string`);
+    return null;
+  }
+  return v;
+}
+function isAbsoluteOrParentPath(path) {
+  if (typeof path !== "string") return true;
+  if (path.startsWith("/") || path.startsWith("\\")) return true;
+  if (path === ".." || path.startsWith("../") || path.startsWith("..\\")) return true;
+  return false;
+}
+function isGitPath(path) {
+  return typeof path === "string" && (path === ".git" || path === "/.git" || path.startsWith(".git/") || path.startsWith(".git\\") || path.startsWith("/.git/") || path.startsWith("/.git\\"));
+}
+function looksLikeShellCommand(s) {
+  if (typeof s !== "string") return false;
+  if (s.length > 256) return false;
+  if (/^[/~]/.test(s)) return true;
+  if (/[|&;()<>`$]/.test(s)) return true;
+  if (/\b(?:rm|chmod|chown|curl|wget|sudo|bash|sh)\b/.test(s)) return true;
+  return false;
+}
+function validatePlanV2(raw) {
+  const issues = [];
+  if (!isPlainObject2(raw)) {
+    return { ok: false, kind: "shape", issues: ["plan root must be an object"] };
+  }
+  const plan = (
+    /** @type {any} */
+    raw
+  );
+  if (plan.schemaVersion !== 2) {
+    issues.push(`unsupported schemaVersion: ${JSON.stringify(plan.schemaVersion)} (expected 2)`);
+  }
+  expectString(plan, "workflowId", issues);
+  if (typeof plan.revision !== "number" || !Number.isInteger(plan.revision) || plan.revision < 1) {
+    issues.push("revision must be a positive integer");
+  }
+  if (plan.supersedes !== null && plan.supersedes !== void 0) {
+    if (!isPlainObject2(plan.supersedes)) {
+      issues.push("supersedes must be null or an object");
+    } else {
+      expectString(plan.supersedes, "revision", issues);
+      expectString(plan.supersedes, "sha256", issues);
+    }
+  }
+  if (!isPlainObject2(plan.authoredBy)) {
+    issues.push("authoredBy must be an object");
+  } else {
+    expectString(plan.authoredBy, "sessionID", issues);
+    const model = plan.authoredBy.model;
+    if (typeof model !== "string" || !/^[^/]+\/[^/]+$/.test(model)) {
+      issues.push("authoredBy.model must be a <provider>/<model> id");
+    }
+    expectString(plan.authoredBy, "createdAt", issues);
+  }
+  if (!isPlainObject2(plan.source)) {
+    issues.push("source must be an object");
+  } else {
+    expectString(plan.source, "repository", issues);
+    if (typeof plan.source.issueNumber !== "number" || !Number.isInteger(plan.source.issueNumber) || plan.source.issueNumber < 1) {
+      issues.push("source.issueNumber must be a positive integer");
+    }
+    expectString(plan.source, "issueUrl", issues);
+    expectString(plan.source, "baseBranch", issues);
+    if (typeof plan.source.baseSha !== "string" || !/^[0-9a-f]{40}$/.test(plan.source.baseSha)) {
+      issues.push("source.baseSha must be a 40-char commit SHA");
+    }
+  }
+  if (typeof plan.goal !== "string" || plan.goal.length < 8) {
+    issues.push("goal must be a non-trivial string");
+  }
+  if (!isPlainObject2(plan.architecture)) {
+    issues.push("architecture must be an object");
+  } else {
+    expectString(plan.architecture, "summary", issues);
+    if (!Array.isArray(plan.architecture.decisions)) {
+      issues.push("architecture.decisions must be an array");
+    }
+  }
+  if (!Array.isArray(plan.constraints)) {
+    issues.push("constraints must be an array");
+  }
+  if (!Array.isArray(plan.files)) {
+    issues.push("files must be an array");
+  } else {
+    for (const f of plan.files) {
+      if (!isPlainObject2(f)) {
+        issues.push("file entry is not an object");
+        continue;
+      }
+      if (!["create", "modify", "delete"].includes(f.action)) {
+        issues.push(`file action must be one of create|modify|delete, got ${JSON.stringify(f.action)}`);
+      }
+      if (isAbsoluteOrParentPath(f.path)) {
+        issues.push(`file path must be a relative package path, got ${JSON.stringify(f.path)}`);
+      }
+    }
+  }
+  if (!Array.isArray(plan.tasks)) {
+    issues.push("tasks must be an array");
+    return finalize(plan, issues);
+  }
+  if (plan.tasks.length === 0) {
+    issues.push("tasks must contain at least one task");
+  }
+  const seenIds = /* @__PURE__ */ new Set();
+  for (const t of plan.tasks) {
+    validateTask(t, issues, seenIds, plan);
+  }
+  return finalize(plan, issues);
+}
+function finalize(raw, issues) {
+  if (Array.isArray(raw.tasks)) {
+    const ids = new Set(raw.tasks.map((t) => t.id));
+    for (const t of raw.tasks) {
+      if (!Array.isArray(t.dependsOn)) continue;
+      for (const dep of t.dependsOn) {
+        if (!ids.has(dep)) {
+          issues.push(`task ${t.id} depends on unknown task ${dep}`);
+        }
+      }
+    }
+  }
+  if (Array.isArray(raw.tasks) && Array.isArray(raw.files)) {
+    const declared = new Set(raw.files.map((f) => f.path));
+    for (const t of raw.tasks) {
+      for (const c of t.changes ?? []) {
+        if (!declared.has(c.path)) {
+          issues.push(`task ${t.id} changes undeclared file: ${c.path}`);
+        }
+      }
+    }
+  }
+  return {
+    ok: issues.length === 0,
+    kind: issues.length === 0 ? "ok" : "shape",
+    issues
+  };
+}
+function validateTask(t, issues, seenIds, plan) {
+  if (!isPlainObject2(t)) {
+    issues.push("task entry is not an object");
+    return;
+  }
+  if (typeof t.id !== "string" || t.id.length === 0) {
+    issues.push("task id must be a non-empty string");
+  } else if (seenIds.has(t.id)) {
+    issues.push(`duplicate task id: ${t.id}`);
+  } else {
+    seenIds.add(t.id);
+  }
+  if (typeof t.ordinal !== "number" || !Number.isInteger(t.ordinal) || t.ordinal < 1) {
+    issues.push(`task ${t.id}: ordinal must be a positive integer`);
+  }
+  expectString(t, "title", issues);
+  expectString(t, "objective", issues);
+  if (!Array.isArray(t.dependsOn)) {
+    issues.push(`task ${t.id}: dependsOn must be an array`);
+  }
+  if (!Array.isArray(t.preconditions)) {
+    issues.push(`task ${t.id}: preconditions must be an array`);
+  }
+  if (!Array.isArray(t.changes)) {
+    issues.push(`task ${t.id}: changes must be an array`);
+  } else {
+    for (const c of t.changes) {
+      if (!isPlainObject2(c)) continue;
+      if (!["create", "modify", "delete"].includes(c.operation)) {
+        issues.push(`task ${t.id}: change operation must be create|modify|delete, got ${JSON.stringify(c.operation)}`);
+      }
+      if (isAbsoluteOrParentPath(c.path)) {
+        issues.push(`task ${t.id}: change path must be relative, got ${JSON.stringify(c.path)}`);
+      }
+      if (isGitPath(c.path)) {
+        issues.push(`task ${t.id}: change path must not target .git, got ${JSON.stringify(c.path)}`);
+      }
+      if (!Array.isArray(c.instructions) || c.instructions.length === 0) {
+        issues.push(`task ${t.id}: change ${c.path} must declare at least one instruction`);
+      } else {
+        for (const ins of c.instructions) {
+          if (typeof ins !== "string" || ins.length === 0) {
+            issues.push(`task ${t.id}: change ${c.path} instructions must be non-empty strings`);
+            break;
+          }
+        }
+      }
+      if (!Array.isArray(c.preserve) || c.preserve.length === 0) {
+        issues.push(`task ${t.id}: change ${c.path} must declare at least one preserve entry`);
+      }
+    }
+  }
+  if (!Array.isArray(t.interfaces)) {
+    issues.push(`task ${t.id}: interfaces must be an array`);
+  }
+  if (!Array.isArray(t.tests)) {
+    issues.push(`task ${t.id}: tests must be an array`);
+  } else {
+    for (const tc of t.tests) {
+      if (!isPlainObject2(tc)) continue;
+      if (typeof tc.file !== "string" || tc.file.length === 0) {
+        issues.push(`task ${t.id}: test file must be a non-empty string`);
+      }
+      if (!Array.isArray(tc.cases) || tc.cases.length === 0) {
+        issues.push(`task ${t.id}: test ${tc.file} must declare at least one case`);
+      }
+    }
+  }
+  if (!Array.isArray(t.commands)) {
+    issues.push(`task ${t.id}: commands must be an array`);
+  } else {
+    for (const cmd of t.commands) {
+      if (!isPlainObject2(cmd)) continue;
+      if (!Array.isArray(cmd.argv) || cmd.argv.length < 1) {
+        issues.push(`task ${t.id}: command argv must be a non-empty array`);
+        continue;
+      }
+      for (const a of cmd.argv) {
+        if (typeof a !== "string") {
+          issues.push(`task ${t.id}: command argv entries must be strings`);
+          break;
+        }
+        if (looksLikeShellCommand(a)) {
+          issues.push(`task ${t.id}: command argv entry looks like a shell command: ${JSON.stringify(a)}`);
+          break;
+        }
+      }
+    }
+  }
+  if (!Array.isArray(t.acceptance) || t.acceptance.length === 0) {
+    issues.push(`task ${t.id}: acceptance must be a non-empty array`);
+  } else {
+    for (const a of t.acceptance) {
+      if (!isPlainObject2(a)) continue;
+      expectString(a, "id", issues);
+      expectString(a, "assertion", issues);
+      if (!Array.isArray(a.evidence) || a.evidence.length === 0) {
+        issues.push(`task ${t.id}: acceptance ${a.id} must declare non-empty evidence`);
+      }
+    }
+  }
+  if (!isPlainObject2(t.commit) || typeof t.commit.message !== "string" || t.commit.message.length === 0) {
+    issues.push(`task ${t.id}: commit.message must be a non-empty string`);
+  }
+}
+function computePlanHash(plan) {
+  const json2 = canonicalJson(plan);
+  return sha256(json2);
+}
+function sha256(text) {
+  return createHash3("sha256").update(text, "utf8").digest("hex");
+}
+
+// src/workflow/plan-store.js
+import { readFile as readFile5, writeFile as writeFile5, mkdir as mkdir5, readdir as readdir4, unlink as unlink4 } from "node:fs/promises";
+import { existsSync as existsSync5 } from "node:fs";
+import { join as join7, dirname as dirname4 } from "node:path";
+import { createHash as createHash4 } from "node:crypto";
+function revisionsDir(commonDir, workflowId) {
+  return join7(opencodeShipStateDir(commonDir), "plans", workflowId, "revisions");
+}
+function revisionDir(commonDir, workflowId, revision) {
+  const n = String(revision).padStart(6, "0");
+  return join7(revisionsDir(commonDir, workflowId), n);
+}
+async function resolveCommon(repoRoot) {
+  return resolveGitCommonDir(repoRoot);
+}
+async function publishPlanRevision(repoRoot, plan) {
+  const v = validatePlanV2(plan);
+  if (!v.ok) {
+    throw new Error(`publishPlanRevision: invalid plan: ${v.issues.join("; ")}`);
+  }
+  const hash2 = computePlanHash(plan);
+  const common = await resolveCommon(repoRoot);
+  const dir = revisionDir(common, plan.workflowId, plan.revision);
+  await mkdir5(dir, { recursive: true });
+  const planPath = join7(dir, "plan.json");
+  if (existsSync5(planPath)) {
+    const existing = JSON.parse(await readFile5(planPath, "utf8"));
+    if (existing?.plan?.workflowId !== plan.workflowId) {
+      throw new Error(`publishPlanRevision: workflowId mismatch on existing record at ${planPath}`);
+    }
+    if (existing?.hash !== hash2) {
+      throw new Error(`publishPlanRevision: hash mismatch on existing record at ${planPath} (existing ${existing.hash}, new ${hash2})`);
+    }
+    return { recorded: false, path: planPath, hash: hash2 };
+  }
+  const record2 = {
+    plan,
+    hash: hash2,
+    publishedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await publishImmutableJson(planPath, record2);
+  return { recorded: true, path: planPath, hash: hash2 };
+}
+async function publishApproval(repoRoot, approval) {
+  if (!approval || typeof approval !== "object") {
+    throw new Error("publishApproval: approval must be an object");
+  }
+  if (approval.decision !== "approved") {
+    throw new Error(`publishApproval: unsupported decision ${approval.decision}`);
+  }
+  if (typeof approval.sha256 !== "string" || approval.sha256.length !== 64) {
+    throw new Error("publishApproval: sha256 required");
+  }
+  const common = await resolveCommon(repoRoot);
+  const dir = revisionDir(common, approval.workflowId, approval.revision);
+  await mkdir5(dir, { recursive: true });
+  const path = join7(dir, "approval.json");
+  const planPath = join7(dir, "plan.json");
+  if (existsSync5(planPath)) {
+    const planRecord = JSON.parse(await readFile5(planPath, "utf8"));
+    if (planRecord.hash !== approval.sha256) {
+      throw new Error(`publishApproval: sha256 mismatch with plan record (plan ${planRecord.hash?.slice(0, 8)}, approval ${approval.sha256.slice(0, 8)})`);
+    }
+  }
+  if (existsSync5(path)) {
+    return { recorded: false, path };
+  }
+  await publishImmutableJson(path, { ...approval, publishedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  return { recorded: true, path };
+}
+async function readPlanRevision(repoRoot, workflowId, revision) {
+  const common = await resolveCommon(repoRoot);
+  const path = join7(revisionDir(common, workflowId, revision), "plan.json");
+  if (!existsSync5(path)) return null;
+  try {
+    const raw = await readFile5(path, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+// src/tools/ship-plan-submit.js
+var SAFE_ID_RE2 = /^[A-Za-z0-9._-]{1,128}$/;
+function createPlanSubmitTool(deps) {
+  return async function planSubmit(input) {
+    const opId = input.operationId ?? `plan-submit-${Date.now().toString(36)}`;
+    const workflowId = String(input.workflowId ?? "");
+    const revision = Number(input.revision);
+    const plan = input.plan;
+    const submittedBy = String(input.submittedBy ?? "");
+    if (!workflowId || !SAFE_ID_RE2.test(workflowId)) {
+      return failure("plan-submit", "workflowId required (safe id)", { operationId: opId, retryable: false });
+    }
+    if (!Number.isInteger(revision) || revision <= 0) {
+      return failure("plan-submit", "revision must be a positive integer", { operationId: opId, retryable: false });
+    }
+    if (!plan || typeof plan !== "object") {
+      return failure("plan-submit", "plan object required", { operationId: opId, retryable: false });
+    }
+    const v = validatePlanV2(plan);
+    if (!v.ok) {
+      return failure("plan-submit", `plan validation failed: ${v.issues.join("; ")}`, { operationId: opId, retryable: false });
+    }
+    const expectedHash = computePlanHash(plan);
+    const providedHash = String(input.sha256 ?? "");
+    if (providedHash && providedHash !== expectedHash) {
+      return failure("plan-submit", `sha256 mismatch (expected ${expectedHash.slice(0, 8)}, got ${providedHash.slice(0, 8)})`, { operationId: opId, retryable: false });
+    }
+    try {
+      const result = await publishPlanRevision(deps.repoRoot, plan);
+      return success2("plan-submit", {
+        workflowId,
+        revision,
+        sha256: result.hash,
+        recorded: result.recorded
+      }, { operationId: opId });
+    } catch (err) {
+      return failure("plan-submit", String(err?.message ?? err), { operationId: opId, retryable: true });
+    }
+  };
+}
+
+// src/tools/ship-plan-approve.js
+var SAFE_ID_RE3 = /^[A-Za-z0-9._-]{1,128}$/;
+function createPlanApproveTool(deps) {
+  return async function planApprove(input) {
+    const opId = input.operationId ?? `plan-approve-${Date.now().toString(36)}`;
+    const workflowId = String(input.workflowId ?? "");
+    const revision = Number(input.revision);
+    const sha2563 = String(input.sha256 ?? "");
+    const subject = String(input.subject ?? "");
+    if (!workflowId || !SAFE_ID_RE3.test(workflowId)) {
+      return failure("plan-approve", "workflowId required (safe id)", { operationId: opId, retryable: false });
+    }
+    if (!Number.isInteger(revision) || revision <= 0) {
+      return failure("plan-approve", "revision required", { operationId: opId, retryable: false });
+    }
+    if (!/^[0-9a-f]{64}$/.test(sha2563)) {
+      return failure("plan-approve", "sha256 required (64 hex chars)", { operationId: opId, retryable: false });
+    }
+    if (!subject) {
+      return failure("plan-approve", "user permission subject required", { operationId: opId, retryable: false });
+    }
+    try {
+      const result = await publishApproval(deps.repoRoot, {
+        workflowId,
+        revision,
+        decision: "approved",
+        sessionID: input.sessionID ?? "ship-controller",
+        approvedBy: subject,
+        approvedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        chunkIds: Array.isArray(input.chunkIds) ? input.chunkIds : [],
+        chunkHashes: Array.isArray(input.chunkHashes) ? input.chunkHashes : [],
+        baseSha: input.baseSha ?? "",
+        models: input.models ?? null,
+        sha256: sha2563
+      });
+      return success2("plan-approve", {
+        workflowId,
+        revision,
+        sha256: sha2563,
+        recorded: result.recorded
+      }, { operationId: opId });
+    } catch (err) {
+      return failure("plan-approve", String(err?.message ?? err), { operationId: opId, retryable: true });
+    }
+  };
+}
+
+// src/tools/ship-run-start.js
+import { readFile as readFile6, mkdir as mkdir6, writeFile as writeFile6 } from "node:fs/promises";
+import { join as join8 } from "node:path";
+var SAFE_ID_RE4 = /^[A-Za-z0-9._-]{1,128}$/;
+async function readRevisionRecord(repoRoot, workflowId, revision) {
+  const commonDir = await resolveGitCommonDir(repoRoot);
+  const rev = String(revision).padStart(6, "0");
+  const dir = join8(opencodeShipStateDir(commonDir), "plans", workflowId, "revisions", rev);
+  const planRaw = await readFile6(join8(dir, "plan.json"), "utf8");
+  const plan = JSON.parse(planRaw);
+  const approvalPath = join8(dir, "approval.json");
+  let approval = null;
+  try {
+    approval = JSON.parse(await readFile6(approvalPath, "utf8"));
+  } catch {
+    approval = null;
+  }
+  return { dir, plan, approval };
+}
+function createRunStartTool(deps) {
+  return async function runStart(input) {
+    const opId = input.operationId ?? `run-start-${Date.now().toString(36)}`;
+    const workflowId = String(input.workflowId ?? "");
+    if (!workflowId || !SAFE_ID_RE4.test(workflowId)) {
+      return failure("run-start", "workflowId required (safe id)", { operationId: opId, retryable: false });
+    }
+    const config2 = deps.config ?? null;
+    const expectedModels = config2?.value?.workflow?.models ?? null;
+    if (!expectedModels) {
+      return failure("run-start", "run-start requires configured workflow.models", { operationId: opId, retryable: false });
+    }
+    const revision = Number(input.revision ?? 0);
+    if (!Number.isInteger(revision) || revision <= 0) {
+      return failure("run-start", "revision required", { operationId: opId, retryable: false });
+    }
+    let records;
+    try {
+      records = await readRevisionRecord(deps.repoRoot, workflowId, revision);
+    } catch (err) {
+      return failure("run-start", `plan revision not found: ${err?.message ?? err}`, { operationId: opId, retryable: false });
+    }
+    if (!records.approval) {
+      return failure("run-start", "no approval record for this revision", { operationId: opId, retryable: false });
+    }
+    if (records.approval.sha256 !== records.plan.hash) {
+      return failure("run-start", `approval sha256 mismatch: plan ${records.plan.hash?.slice(0, 8)} vs approval ${records.approval.sha256?.slice(0, 8)}`, { operationId: opId, retryable: false });
+    }
+    const expectedHash = records.approval.sha256;
+    if (input.sha256 && input.sha256 !== expectedHash) {
+      return failure("run-start", `sha256 mismatch: expected ${expectedHash.slice(0, 8)}, got ${String(input.sha256).slice(0, 8)}`, { operationId: opId, retryable: false });
+    }
+    if (records.approval.models) {
+      const a = records.approval.models;
+      if (a.planner !== expectedModels.planner || a.builder !== expectedModels.builder || a.finalReviewer !== expectedModels.finalReviewer) {
+        return failure("run-start", "approval models no longer match configured workflow.models", { operationId: opId, retryable: false });
+      }
+    }
+    try {
+      const commonDir = await resolveGitCommonDir(deps.repoRoot);
+      const runDir2 = join8(opencodeShipStateDir(commonDir), "runs", workflowId);
+      await mkdir6(join8(runDir2, "events"), { recursive: true });
+      const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const runRecord = {
+        workflowId,
+        revision,
+        sha256: expectedHash,
+        startedAt,
+        state: "running",
+        activeTask: null,
+        round: 0,
+        models: expectedModels
+      };
+      await publishImmutableJson(join8(runDir2, "run.json"), runRecord);
+      const event = { sequence: 1, kind: "run-start", at: startedAt, data: { revision, sha256: expectedHash } };
+      await publishImmutableJson(join8(runDir2, "events", "00000001.json"), event);
+      return success2("run-start", { workflowId, revision, sha256: expectedHash }, { operationId: opId });
+    } catch (err) {
+      return failure("run-start", String(err?.message ?? err), { operationId: opId, retryable: true });
+    }
+  };
+}
+
+// src/tools/ship-task-report.js
+import { mkdir as mkdir8 } from "node:fs/promises";
+import { createHash as createHash6 } from "node:crypto";
+import { join as join10 } from "node:path";
+
+// src/workflow/run-controller.js
+import { createHash as createHash5 } from "node:crypto";
+import { readFile as readFile7, writeFile as writeFile7, mkdir as mkdir7, readdir as readdir5 } from "node:fs/promises";
+import { existsSync as existsSync6 } from "node:fs";
+import { join as join9 } from "node:path";
+async function readSnapshotFromDisk(repoRoot, workflowId) {
+  const common = await resolveGitCommonDir(repoRoot);
+  const runPath = join9(opencodeShipStateDir(common), "runs", workflowId, "run.json");
+  if (!existsSync6(runPath)) return null;
+  try {
+    const raw = await readFile7(runPath, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+async function readEventsFromDisk(repoRoot, workflowId) {
+  const common = await resolveGitCommonDir(repoRoot);
+  const dir = join9(opencodeShipStateDir(common), "runs", workflowId, "events");
+  if (!existsSync6(dir)) return [];
+  const entries = await readdir5(dir);
+  const sorted = entries.filter((n) => n.endsWith(".json")).sort();
+  const out = [];
+  for (const name of sorted) {
+    try {
+      const raw = await readFile7(join9(dir, name), "utf8");
+      out.push(JSON.parse(raw));
+    } catch {
+    }
+  }
+  return out;
+}
+var STATES2 = Object.freeze({
+  CREATED: "created",
+  RUNNING: "running",
+  COMMIT_PENDING: "commit-pending",
+  COMMITTED: "committed",
+  FIX_PENDING: "fix-pending",
+  REVISION_REQUIRED: "revision-required",
+  BLOCKED: "blocked",
+  ALL_TASKS_DONE: "all-tasks-done",
+  READY_PENDING: "ready-pending",
+  READY: "ready",
+  MERGED: "merged",
+  DONE: "done"
+});
+var EVENT_KINDS = Object.freeze({
+  RUN_START: "run-start",
+  TASK_DISPATCH: "task-dispatch",
+  TASK_REPORT: "task-report",
+  TASK_REVIEW: "task-review",
+  COMMIT: "commit",
+  TASK_COMPLETE: "task-complete",
+  FINAL_REVIEW: "final-review",
+  READY: "ready",
+  MERGE: "merge",
+  BLOCKED: "blocked"
+});
+var MAX_FIX_ROUNDS = 3;
+function sha2562(value) {
+  return createHash5("sha256").update(value, "utf8").digest("hex");
+}
+function canonicalize(value) {
+  const seen = /* @__PURE__ */ new WeakSet();
+  const sort = (v) => {
+    if (v === null || typeof v !== "object") return v;
+    if (seen.has(v)) return null;
+    seen.add(v);
+    if (Array.isArray(v)) return v.map(sort);
+    const out = {};
+    for (const k of Object.keys(v).sort()) out[k] = sort(v[k]);
+    return out;
+  };
+  return JSON.stringify(sort(value));
+}
+function nextRound(failures) {
+  return (failures ?? 0) + 1;
+}
+function nextSequence(events) {
+  return events.length + 1;
+}
+function appendEvent(state, recorded) {
+  const prev = state.events[state.events.length - 1];
+  const priorHash = prev?.hash ?? "0".repeat(64);
+  const hash2 = sha2562(canonicalize({ kind: recorded.kind, data: recorded.data, at: recorded.at, sequence: recorded.sequence, priorHash }));
+  const withHash = { ...recorded, priorHash, hash: hash2 };
+  return [...state.events, withHash];
+}
+function normalizeState(state) {
+  return {
+    ...state,
+    completedTasks: Array.isArray(state.completedTasks) ? state.completedTasks : [],
+    taskReady: state.taskReady ?? null,
+    events: Array.isArray(state.events) ? state.events : [],
+    round: Number.isInteger(state.round) ? state.round : 0,
+    failures: Number.isInteger(state.failures) ? state.failures : 0
+  };
+}
+function ensureActiveTask(state, taskId) {
+  if (state.activeTask === null) return;
+  if (state.activeTask !== taskId) {
+    throw new Error(`run reducer: another task is active (${state.activeTask}), refusing ${taskId}`);
+  }
+}
+function reduce(state, event) {
+  const ev = { ...event, at: event.at ?? (/* @__PURE__ */ new Date()).toISOString() };
+  const sequence = nextSequence(state.events);
+  const recorded = (kind, data) => ({ sequence, kind, at: ev.at, data });
+  const nextState = (extra) => ({ ...state, ...extra, events: appendEvent(state, recorded(event.kind, event.data)) });
+  switch (event.kind) {
+    case EVENT_KINDS.RUN_START: {
+      if (state.state !== STATES2.CREATED) {
+        throw new Error(`run reducer: RUN_START requires state=created, got ${state.state}`);
+      }
+      return {
+        state: nextState({ state: STATES2.RUNNING, activeTask: null, round: 0, completedTasks: [] }),
+        event: recorded(EVENT_KINDS.RUN_START, { revision: event.data.revision, sha256: event.data.sha256 })
+      };
+    }
+    case EVENT_KINDS.TASK_DISPATCH: {
+      if (state.state !== STATES2.RUNNING && state.state !== STATES2.FIX_PENDING) {
+        throw new Error(`run reducer: TASK_DISPATCH requires state=running|fix-pending, got ${state.state}`);
+      }
+      if (state.activeTask !== null) {
+        throw new Error(`run reducer: TASK_DISPATCH while another task is active (${state.activeTask})`);
+      }
+      const round = state.round > 0 ? state.round : 1;
+      return {
+        state: nextState({ state: STATES2.RUNNING, activeTask: event.data.taskId, round }),
+        event: recorded(EVENT_KINDS.TASK_DISPATCH, { taskId: event.data.taskId, briefHash: event.data.briefHash, round })
+      };
+    }
+    case EVENT_KINDS.TASK_REVIEW: {
+      if (state.state !== STATES2.RUNNING && state.state !== STATES2.FIX_PENDING || state.activeTask === null) {
+        throw new Error(`run reducer: TASK_REVIEW requires running with active task`);
+      }
+      ensureActiveTask(state, event.data.taskId);
+      const failures = event.data.verdict === "pass" ? 0 : nextRound(state.failures);
+      const next = state.round + 1;
+      if (event.data.verdict === "pass") {
+        return {
+          state: nextState({ state: STATES2.COMMIT_PENDING, round: state.round, taskReady: { taskId: event.data.taskId, reviewHash: event.data.reviewHash } }),
+          event: recorded(EVENT_KINDS.TASK_REVIEW, { taskId: event.data.taskId, verdict: "pass", reviewHash: event.data.reviewHash })
+        };
+      }
+      if (failures >= MAX_FIX_ROUNDS) {
+        return {
+          state: nextState({ state: STATES2.REVISION_REQUIRED, failures, round: next, activeTask: null }),
+          event: recorded(EVENT_KINDS.TASK_REVIEW, { taskId: event.data.taskId, verdict: "fail", failures })
+        };
+      }
+      return {
+        state: nextState({ state: STATES2.FIX_PENDING, failures, round: next, activeTask: null }),
+        event: recorded(EVENT_KINDS.TASK_REVIEW, { taskId: event.data.taskId, verdict: "fail", round: next, failures })
+      };
+    }
+    case EVENT_KINDS.COMMIT: {
+      if (state.state !== STATES2.COMMIT_PENDING) {
+        throw new Error(`run reducer: COMMIT requires state=commit-pending, got ${state.state}`);
+      }
+      return {
+        state: nextState({ state: STATES2.COMMITTED, activeTask: null, round: 0, failures: 0, completedTasks: [...state.completedTasks, state.taskReady?.taskId].filter(Boolean) }),
+        event: recorded(EVENT_KINDS.COMMIT, { taskId: state.taskReady?.taskId, commitSha: event.data.commitSha })
+      };
+    }
+    case EVENT_KINDS.TASK_COMPLETE: {
+      if (state.state !== STATES2.COMMITTED) {
+        throw new Error(`run reducer: TASK_COMPLETE requires state=committed, got ${state.state}`);
+      }
+      return {
+        state: nextState({ state: STATES2.RUNNING, activeTask: null, taskReady: null, round: 0, failures: 0 }),
+        event: recorded(EVENT_KINDS.TASK_COMPLETE, { taskId: event.data.taskId })
+      };
+    }
+    case EVENT_KINDS.READY: {
+      if (state.state !== STATES2.COMMITTED && state.state !== STATES2.READY_PENDING) {
+        throw new Error(`run reducer: READY requires state=committed|ready-pending, got ${state.state}`);
+      }
+      return {
+        state: nextState({ state: STATES2.READY, activeTask: null, completedTasks: state.completedTasks }),
+        event: recorded(EVENT_KINDS.READY, { headSha: event.data.headSha })
+      };
+    }
+    case EVENT_KINDS.MERGE: {
+      if (state.state !== STATES2.READY) {
+        throw new Error(`run reducer: MERGE requires state=ready, got ${state.state}`);
+      }
+      return {
+        state: nextState({ state: STATES2.MERGED, mergedAt: ev.at, mergeSha: event.data.mergeSha }),
+        event: recorded(EVENT_KINDS.MERGE, { mergeSha: event.data.mergeSha })
+      };
+    }
+    case EVENT_KINDS.BLOCKED: {
+      return {
+        state: nextState({ state: STATES2.BLOCKED, blockedReason: event.data.reason }),
+        event: recorded(EVENT_KINDS.BLOCKED, { reason: event.data.reason })
+      };
+    }
+    default:
+      throw new Error(`run reducer: unknown event kind ${event.kind}`);
+  }
+}
+var RUN_EVENT_KINDS = EVENT_KINDS;
+async function runDir(repoRoot, workflowId) {
+  const common = await resolveGitCommonDir(repoRoot);
+  return join9(opencodeShipStateDir(common), "runs", workflowId);
+}
+async function appendRunEvent(repoRoot, workflowId, state, event) {
+  const common = await resolveGitCommonDir(repoRoot);
+  const dir = join9(opencodeShipStateDir(common), "runs", workflowId, "events");
+  await mkdir7(dir, { recursive: true });
+  const lockKey = `run:${workflowId}`;
+  return withResourceLock(opencodeShipStateDir(common), lockKey, async () => {
+    const persistedEvents = await readEventsFromDisk(repoRoot, workflowId);
+    const persistedSnapshot = await readSnapshotFromDisk(repoRoot, workflowId);
+    const liveState = normalizeState({
+      ...persistedSnapshot ?? state,
+      events: persistedEvents.length > 0 ? persistedEvents : state.events ?? []
+    });
+    const { state: next, event: recorded } = reduce(liveState, event);
+    const sequence = String(recorded.sequence).padStart(8, "0");
+    const path = join9(dir, `${sequence}.json`);
+    await publishImmutableJson(path, recorded);
+    const runPath = join9(opencodeShipStateDir(common), "runs", workflowId, "run.json");
+    const snapshot = {
+      workflowId,
+      revision: next.revision,
+      sha256: next.sha256,
+      state: next.state,
+      activeTask: next.activeTask,
+      taskReady: next.taskReady ?? null,
+      failures: next.failures,
+      round: next.round,
+      completedTasks: next.completedTasks,
+      lastEvent: recorded,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await writeFile7(runPath, JSON.stringify(snapshot, null, 2), "utf8");
+    return { state: next, event: recorded };
+  });
+}
+async function readRunState(repoRoot, workflowId) {
+  const dir = await runDir(repoRoot, workflowId);
+  const runPath = join9(dir, "run.json");
+  if (!existsSync6(runPath)) return null;
+  const snapshot = JSON.parse(await readFile7(runPath, "utf8"));
+  const eventsDir = join9(dir, "events");
+  const events = existsSync6(eventsDir) ? await Promise.all(
+    (await readdir5(eventsDir)).filter((n) => n.endsWith(".json")).sort().map(async (n) => JSON.parse(await readFile7(join9(eventsDir, n), "utf8")))
+  ) : [];
+  return {
+    workflowId,
+    revision: snapshot.revision,
+    sha256: snapshot.sha256,
+    state: snapshot.state,
+    activeTask: snapshot.activeTask,
+    failures: snapshot.failures,
+    round: snapshot.round,
+    completedTasks: snapshot.completedTasks,
+    events
+  };
+}
+
+// src/tools/ship-task-report.js
+var SAFE_ID_RE5 = /^[A-Za-z0-9._-]{1,128}$/;
+function createTaskReportTool(deps) {
+  return async function taskReport(input) {
+    const opId = input.operationId ?? `task-report-${Date.now().toString(36)}`;
+    const workflowId = String(input.workflowId ?? "");
+    const taskId = String(input.taskId ?? "");
+    const round = Number(input.round ?? 1);
+    const submittedBy = String(input.submittedBy ?? "");
+    const summary = String(input.summary ?? "");
+    if (!workflowId || !SAFE_ID_RE5.test(workflowId)) {
+      return failure("task-report", "workflowId required (safe id)", { operationId: opId, retryable: false });
+    }
+    if (!taskId || !SAFE_ID_RE5.test(taskId)) {
+      return failure("task-report", "taskId required (safe id)", { operationId: opId, retryable: false });
+    }
+    if (!Number.isInteger(round) || round <= 0) {
+      return failure("task-report", "round must be a positive integer", { operationId: opId, retryable: false });
+    }
+    if (!summary) return failure("task-report", "summary required", { operationId: opId, retryable: false });
+    if (!submittedBy) {
+      return failure("task-report", "submittedBy required (must identify builder model)", { operationId: opId, retryable: false });
+    }
+    let models;
+    try {
+      models = resolveModelRoles(deps.config?.workflow, { strict: true });
+    } catch (err) {
+      return failure("task-report", `builder model unresolved: ${err?.message ?? err}`, { operationId: opId, retryable: false });
+    }
+    if (!submittedBy.startsWith(models.builder)) {
+      return failure("task-report", `submittedBy must be the configured builder model ${models.builder}`, { operationId: opId, retryable: false });
+    }
+    let runState;
+    try {
+      runState = await readRunState(deps.repoRoot, workflowId);
+    } catch (err) {
+      return failure("task-report", `run state unreadable: ${err?.message ?? err}`, { operationId: opId, retryable: false });
+    }
+    if (!runState) {
+      return failure("task-report", "run not started", { operationId: opId, retryable: false });
+    }
+    if (runState.activeTask !== null && runState.activeTask !== taskId) {
+      return failure("task-report", `another task is already active (${runState.activeTask})`, { operationId: opId, retryable: false });
+    }
+    try {
+      const commonDir = await resolveGitCommonDir(deps.repoRoot);
+      const reportDir = join10(opencodeShipStateDir(commonDir), "runs", workflowId, "tasks", taskId, "rounds", `${String(round).padStart(4, "0")}`);
+      await mkdir8(reportDir, { recursive: true });
+      const record2 = {
+        workflowId,
+        taskId,
+        round,
+        submittedBy,
+        builder: models.builder,
+        summary,
+        changes: Array.isArray(input.changes) ? input.changes : [],
+        tests: Array.isArray(input.tests) ? input.tests : [],
+        submittedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      await publishImmutableJson(join10(reportDir, "implementer-report.json"), record2);
+      const { state, event } = await appendRunEvent(
+        deps.repoRoot,
+        workflowId,
+        runState,
+        { kind: RUN_EVENT_KINDS.TASK_REPORT, data: { taskId, round, summary, reportHash: reportHash(record2) } }
+      );
+      return success2("task-report", { workflowId, taskId, round, state: state.state, sequence: event.sequence }, { operationId: opId });
+    } catch (err) {
+      return failure("task-report", String(err?.message ?? err), { operationId: opId, retryable: true });
+    }
+  };
+}
+function reportHash(record2) {
+  const sorted = Object.keys(record2).sort();
+  const ordered = {};
+  for (const k of sorted) ordered[k] = record2[k];
+  return createHash6("sha256").update(JSON.stringify(ordered), "utf8").digest("hex");
+}
+
+// src/tools/ship-task-review.js
+import { createHash as createHash7 } from "node:crypto";
+import { mkdir as mkdir9 } from "node:fs/promises";
+import { join as join11 } from "node:path";
+var SAFE_ID_RE6 = /^[A-Za-z0-9._-]{1,128}$/;
+var VERDICT_VALUES = /* @__PURE__ */ new Set(["pass", "fail", "none"]);
+function createTaskReviewTool(deps) {
+  return async function taskReview(input) {
+    const opId = input.operationId ?? `task-review-${Date.now().toString(36)}`;
+    const workflowId = String(input.workflowId ?? "");
+    const taskId = String(input.taskId ?? "");
+    const round = Number(input.round ?? 1);
+    const spec = input.spec;
+    const quality = input.quality;
+    const submittedBy = String(input.submittedBy ?? "");
+    if (!workflowId || !SAFE_ID_RE6.test(workflowId)) {
+      return failure("task-review", "workflowId required (safe id)", { operationId: opId, retryable: false });
+    }
+    if (!taskId || !SAFE_ID_RE6.test(taskId)) {
+      return failure("task-review", "taskId required (safe id)", { operationId: opId, retryable: false });
+    }
+    if (!Number.isInteger(round) || round <= 0) {
+      return failure("task-review", "round must be a positive integer", { operationId: opId, retryable: false });
+    }
+    if (!spec || typeof spec !== "object" || !VERDICT_VALUES.has(String(spec.verdict ?? ""))) {
+      return failure("task-review", "spec verdict required (pass|fail|none)", { operationId: opId, retryable: false });
+    }
+    if (!quality || typeof quality !== "object" || !VERDICT_VALUES.has(String(quality.verdict ?? ""))) {
+      return failure("task-review", "quality verdict required (pass|fail|none)", { operationId: opId, retryable: false });
+    }
+    if (!submittedBy) {
+      return failure("task-review", "submittedBy required (must identify reviewer model)", { operationId: opId, retryable: false });
+    }
+    let models;
+    try {
+      models = resolveModelRoles(deps.config?.workflow, { strict: true });
+    } catch (err) {
+      return failure("task-review", `reviewer model unresolved: ${err?.message ?? err}`, { operationId: opId, retryable: false });
+    }
+    if (!submittedBy.startsWith(models.finalReviewer)) {
+      return failure("task-review", `submittedBy must be the configured finalReviewer model ${models.finalReviewer}`, { operationId: opId, retryable: false });
+    }
+    let runState;
+    try {
+      runState = await readRunState(deps.repoRoot, workflowId);
+    } catch (err) {
+      return failure("task-review", `run state unreadable: ${err?.message ?? err}`, { operationId: opId, retryable: false });
+    }
+    if (!runState) {
+      return failure("task-review", "run not started", { operationId: opId, retryable: false });
+    }
+    if (runState.activeTask !== taskId) {
+      return failure("task-review", `no active task ${taskId} (active=${runState.activeTask})`, { operationId: opId, retryable: false });
+    }
+    try {
+      const commonDir = await resolveGitCommonDir(deps.repoRoot);
+      const reviewDir = join11(opencodeShipStateDir(commonDir), "runs", workflowId, "tasks", taskId, "rounds", `${String(round).padStart(4, "0")}`);
+      await mkdir9(reviewDir, { recursive: true });
+      const specPass = String(spec.verdict) === "pass";
+      const qualityPass = String(quality.verdict) === "pass";
+      const reviewHash = verdictHash({ spec, quality, submittedBy, taskId, round });
+      const record2 = {
+        workflowId,
+        taskId,
+        round,
+        submittedBy,
+        reviewer: models.finalReviewer,
+        spec,
+        quality,
+        state: specPass && qualityPass ? "commit-pending" : "fix-pending",
+        reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      await publishImmutableJson(join11(reviewDir, "review.json"), record2);
+      const verdict = specPass && qualityPass ? "pass" : "fail";
+      const { state, event } = await appendRunEvent(
+        deps.repoRoot,
+        workflowId,
+        runState,
+        { kind: RUN_EVENT_KINDS.TASK_REVIEW, data: { taskId, verdict, reviewHash, round } }
+      );
+      return success2("task-review", { workflowId, taskId, round, state: state.state, sequence: event.sequence }, { operationId: opId });
+    } catch (err) {
+      return failure("task-review", String(err?.message ?? err), { operationId: opId, retryable: true });
+    }
+  };
+}
+function verdictHash(record2) {
+  const sorted = Object.keys(record2).sort();
+  const ordered = {};
+  for (const k of sorted) ordered[k] = record2[k];
+  return createHash7("sha256").update(JSON.stringify(ordered), "utf8").digest("hex");
+}
+
+// src/workflow/resume.js
+import { readFile as readFile8, writeFile as writeFile8, readdir as readdir6, mkdir as mkdir10 } from "node:fs/promises";
+import { existsSync as existsSync7 } from "node:fs";
+import { join as join12 } from "node:path";
+function parseTrailer(text, key) {
+  if (typeof text !== "string") return null;
+  const re = new RegExp(`^${key}:\\s*(.+)$`, "m");
+  const m = text.match(re);
+  return m ? m[1].trim() : null;
+}
+async function reconstructCompletedTasksFromGitTrailers(repoRoot, workflowId) {
+  const cp = await import("node:child_process");
+  return new Promise((resolveRun) => {
+    cp.execFile("git", ["log", "-n", "200", "--format=%H%n%B%n--END--"], { cwd: repoRoot }, (err, stdout) => {
+      if (err || !stdout) return resolveRun([]);
+      const commits = stdout.split("--END--").map((s) => s.trim()).filter(Boolean);
+      const completed = [];
+      for (const block of commits) {
+        const [sha, ...body] = block.split("\n");
+        const bodyText = body.join("\n");
+        const wf = parseTrailer(bodyText, "Opencode-Ship-Workflow");
+        const taskId = parseTrailer(bodyText, "Opencode-Ship-Task");
+        if (wf === workflowId && taskId) {
+          completed.push([taskId, sha]);
+        }
+      }
+      resolveRun(completed);
+    });
+  });
+}
+async function lockRun(repoRoot, workflowId, callback) {
+  const common = await resolveGitCommonDir(repoRoot);
+  const stateRoot = opencodeShipStateDir(common);
+  const lockKey = `run:${workflowId}`;
+  return withResourceLock(stateRoot, lockKey, callback);
+}
+async function resumeRun(repoRoot, workflowId) {
+  return lockRun(repoRoot, workflowId, async () => {
+    const run = await readRunState(repoRoot, workflowId);
+    if (!run) {
+      const plan = await readPlanRevision(repoRoot, workflowId, 1);
+      if (plan) {
+        const completed = await reconstructCompletedTasksFromGitTrailers(repoRoot, workflowId);
+        return {
+          state: {
+            workflowId,
+            revision: 1,
+            sha256: plan.hash,
+            state: "reconstructed",
+            activeTask: null,
+            round: 0,
+            completedTasks: completed,
+            events: []
+          },
+          nextAction: "run-start",
+          mirrored: false
+        };
+      }
+      return {
+        state: { workflowId, state: "missing", completedTasks: [], events: [] },
+        nextAction: "plan-start",
+        mirrored: false
+      };
+    }
+    let nextAction = "task-report";
+    if (run.state === "running") nextAction = "task-report";
+    else if (run.state === "commit-pending") nextAction = "commit";
+    else if (run.state === "committed") nextAction = "task-complete";
+    else if (run.state === "fix-pending") nextAction = "task-dispatch";
+    else if (run.state === "ready") nextAction = "merge";
+    else if (run.state === "merged") nextAction = "done";
+    else if (run.state === "blocked") nextAction = "blocked";
+    return { state: run, nextAction, mirrored: false };
+  });
+}
+
+// src/tools/ship-resume.js
+var SAFE_ID_RE7 = /^[A-Za-z0-9._-]{1,128}$/;
+function createResumeTool(deps) {
+  return async function resume(input) {
+    const opId = input.operationId ?? `resume-${Date.now().toString(36)}`;
+    const workflowId = String(input.workflowId ?? "");
+    if (!workflowId || !SAFE_ID_RE7.test(workflowId)) {
+      return failure("resume", "workflowId required (safe id)", { operationId: opId, retryable: false });
+    }
+    try {
+      const result = await resumeRun(deps.repoRoot, workflowId);
+      return success2("resume", {
+        workflowId,
+        state: result.state,
+        nextAction: result.nextAction,
+        mirrored: result.mirrored ?? false
+      }, { operationId: opId });
+    } catch (err) {
+      return failure("resume", String(err?.message ?? err), { operationId: opId, retryable: true });
+    }
+  };
+}
+
+// src/tools/ship-status.js
+import { readFile as readFile9, readdir as readdir7 } from "node:fs/promises";
+import { existsSync as existsSync8 } from "node:fs";
+import { join as join13 } from "node:path";
+function createStatusTool(deps) {
+  return async function status(input) {
+    const opId = input.operationId ?? `status-${Date.now().toString(36)}`;
+    const workflowId = String(input.workflowId ?? "");
+    if (!workflowId) return failure("status", "workflowId required", { operationId: opId, retryable: false });
+    try {
+      const commonDir = await resolveGitCommonDir(deps.repoRoot);
+      const planRoot = join13(opencodeShipStateDir(commonDir), "plans", workflowId);
+      const runRoot = join13(opencodeShipStateDir(commonDir), "runs", workflowId);
+      const indexPath = join13(planRoot, "index.json");
+      if (!existsSync8(indexPath)) return failure("status", "no workflow record", { operationId: opId, retryable: false });
+      const index = JSON.parse(await readFile9(indexPath, "utf8"));
+      let run = null;
+      const runPath = join13(runRoot, "run.json");
+      if (existsSync8(runPath)) run = JSON.parse(await readFile9(runPath, "utf8"));
+      let lastEvent = null;
+      const eventsDir = join13(runRoot, "events");
+      if (existsSync8(eventsDir)) {
+        const events = await readdir7(eventsDir);
+        const sorted = events.filter((n) => n.endsWith(".json")).sort();
+        if (sorted.length > 0) {
+          lastEvent = JSON.parse(await readFile9(join13(eventsDir, sorted[sorted.length - 1]), "utf8"));
+        }
+      }
+      return success2("status", { workflowId, index, run, lastEvent }, { operationId: opId });
+    } catch (err) {
+      return failure("status", String(err?.message ?? err), { operationId: opId, retryable: true });
+    }
+  };
+}
+
+// src/recovery.js
+function recoverManifestAfterCrash(manifest) {
+  return manifest;
+}
+
+// src/installer/plugin-owner.js
+import { spawnSync as spawnSync4 } from "node:child_process";
+async function reconcileOwner(repoRoot, adapter) {
+  const r = spawnSync4("git", ["-C", repoRoot, "config", "--get", "user.name"], {
+    encoding: "utf8"
+  });
+  if (r.status === 0 && r.stdout.trim()) return r.stdout.trim();
+  return process.env.USER ?? process.env.USERNAME ?? "opencode-ship";
+}
+
+// src/installer/config.js
+import { readFile as readFile10, writeFile as writeFile9, rename as rename3, mkdir as mkdir11 } from "node:fs/promises";
+import { existsSync as existsSync9 } from "node:fs";
+import { dirname as dirname5, resolve as resolve9 } from "node:path";
+
+// schema/ship-config.schema.json
+var ship_config_schema_default = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: "https://github.com/Viktorxyz/opencode-ship/schema/ship-config.schema.json",
+  title: "opencode-ship user config",
+  type: "object",
+  required: ["schemaVersion"],
+  additionalProperties: false,
+  properties: {
+    schemaVersion: { enum: [1, 2] },
+    profile: {
+      type: "string",
+      enum: ["core", "engineering"],
+      description: "Active profile (precedence layer 2: ship.config > lock > core default)."
+    },
+    owner: {
+      type: "string",
+      description: "Optional override for the issue/manifest owner field. Defaults to the agent's local user.name."
+    },
+    project: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        remote: { type: "string", minLength: 1 },
+        repository: { type: "string", pattern: "^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$" },
+        defaultBranch: { type: "string", minLength: 1 },
+        packageManager: { enum: ["npm", "pnpm", "yarn", "bun"] },
+        detectOverrides: { type: "boolean", description: "Permit detection to refresh previously persisted values." }
+      }
+    },
+    delivery: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        worktree: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            root: { type: "string", minLength: 1 },
+            branchTemplate: { type: "string", minLength: 1 },
+            bootstrap: {
+              type: "array",
+              items: {
+                type: "array",
+                items: { type: "string", minLength: 1 },
+                minItems: 1
+              }
+            }
+          }
+        },
+        verification: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            commands: {
+              type: "array",
+              minItems: 1,
+              items: {
+                type: "object",
+                required: ["id", "argv"],
+                additionalProperties: false,
+                properties: {
+                  id: { type: "string", minLength: 1 },
+                  argv: {
+                    type: "array",
+                    items: { type: "string", minLength: 1 },
+                    minItems: 1
+                  },
+                  timeoutMs: { type: "integer", minimum: 1 }
+                }
+              }
+            },
+            requireCleanDiffAfter: { type: "boolean" },
+            invalidateOnHeadChange: { type: "boolean" }
+          }
+        },
+        review: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
             agent: { type: "string", minLength: 1 },
             required: { type: "boolean" },
             invalidateOnHeadChange: { type: "boolean" }
@@ -14426,17 +16249,78 @@ var ship_config_schema_default = {
         agentsDir: { type: "string", pattern: "^\\.opencode/agents/?$" },
         skillsDir: { type: "string", pattern: "^\\.opencode/skills/?$" }
       }
+    },
+    workflow: {
+      type: "object",
+      description: "Required when profile is engineering. Ignored when profile is core.",
+      additionalProperties: false,
+      properties: {
+        models: {
+          type: "object",
+          additionalProperties: false,
+          required: ["planner", "builder", "finalReviewer"],
+          properties: {
+            planner: {
+              type: "string",
+              pattern: "^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$",
+              description: "Provider/model id for the strong planning child session."
+            },
+            builder: {
+              type: "string",
+              pattern: "^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$",
+              description: "Provider/model id for the cheap builder child session."
+            },
+            finalReviewer: {
+              type: "string",
+              pattern: "^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$",
+              description: "Provider/model id for the final Standards + Spec reviewers."
+            }
+          }
+        },
+        approval: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            mirrorToIssue: { const: true },
+            maxFailedRounds: { const: 3 }
+          }
+        }
+      }
     }
-  }
+  },
+  allOf: [
+    {
+      if: {
+        required: ["profile"],
+        properties: { profile: { const: "engineering" } }
+      },
+      then: {
+        required: ["workflow"],
+        properties: {
+          workflow: {
+            required: ["models", "approval"],
+            properties: {
+              models: {
+                required: ["planner", "builder", "finalReviewer"]
+              },
+              approval: {
+                required: ["mirrorToIssue", "maxFailedRounds"]
+              }
+            }
+          }
+        }
+      }
+    }
+  ]
 };
 
 // src/installer/validation.js
 var FORMAT_DATE_TIME = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:?\d{2})$/;
-function isObject2(v) {
+function isObject3(v) {
   return v !== null && typeof v === "object" && !Array.isArray(v);
 }
 function validate(value, schema, pointer, issues) {
-  if (!isObject2(schema)) return;
+  if (!isObject3(schema)) return;
   if (schema.const !== void 0 && value !== schema.const) {
     issues.push(`${pointer}: expected const ${JSON.stringify(schema.const)}, got ${JSON.stringify(value)}`);
     return;
@@ -14445,6 +16329,18 @@ function validate(value, schema, pointer, issues) {
     issues.push(`${pointer}: expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`);
     return;
   }
+  if (Array.isArray(schema.allOf)) {
+    for (const sub of schema.allOf) validate(value, sub, pointer, issues);
+  }
+  if (isObject3(schema.if)) {
+    const ifIssues = [];
+    validate(value, schema.if, pointer, ifIssues);
+    if (ifIssues.length === 0) {
+      if (isObject3(schema.then)) validate(value, schema.then, pointer, issues);
+    } else if (isObject3(schema.else)) {
+      validate(value, schema.else, pointer, issues);
+    }
+  }
   const type = schema.type;
   if (type !== void 0) {
     const actual = Array.isArray(value) ? "array" : value === null ? "null" : typeof value;
@@ -14495,18 +16391,18 @@ function validate(value, schema, pointer, issues) {
       value.forEach((entry, i) => validate(entry, schema.items, `${pointer}/${i}`, issues));
     }
   }
-  if (type === "object") {
+  if (type === "object" || isObject3(schema.properties) || Array.isArray(schema.required)) {
     if (Array.isArray(schema.required)) {
       for (const key of schema.required) {
         if (!(key in value)) issues.push(`${pointer}: missing required field ${key}`);
       }
     }
-    if (schema.additionalProperties === false && isObject2(schema.properties)) {
+    if (schema.additionalProperties === false && isObject3(schema.properties)) {
       for (const key of Object.keys(value)) {
         if (!(key in schema.properties)) issues.push(`${pointer}: unknown field ${key}`);
       }
     }
-    if (isObject2(schema.properties)) {
+    if (isObject3(schema.properties)) {
       for (const key of Object.keys(schema.properties)) {
         if (key in value) validate(value[key], schema.properties[key], `${pointer}/${key}`, issues);
       }
@@ -14523,12 +16419,12 @@ function validateSchema(value, schema) {
 init_json_pointer();
 init_hash();
 function configPath(repoRoot) {
-  return resolve7(repoRoot, ".opencode", "ship.config.json");
+  return resolve9(repoRoot, ".opencode", "ship.config.json");
 }
 async function loadConfig(repoRoot) {
   const path = configPath(repoRoot);
-  if (!existsSync3(path)) return null;
-  const raw = await readFile3(path, "utf8");
+  if (!existsSync9(path)) return null;
+  const raw = await readFile10(path, "utf8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -14592,8 +16488,8 @@ init_lock();
 
 // src/installer/detection/project.js
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync5, readFileSync } from "node:fs";
-import { resolve as resolve9, join as join3 } from "node:path";
+import { existsSync as existsSync11, readFileSync } from "node:fs";
+import { resolve as resolve11, join as join14 } from "node:path";
 function runGit2(cwd, args) {
   const r = spawnSync5("git", ["-C", cwd, ...args], {
     stdio: ["ignore", "pipe", "pipe"],
@@ -14602,15 +16498,15 @@ function runGit2(cwd, args) {
   return { status: r.status ?? -1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
 }
 function detectPackageManager(repoRoot) {
-  if (existsSync5(join3(repoRoot, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync5(join3(repoRoot, "yarn.lock"))) return "yarn";
-  if (existsSync5(join3(repoRoot, "bun.lockb"))) return "bun";
-  if (existsSync5(join3(repoRoot, "package-lock.json"))) return "npm";
+  if (existsSync11(join14(repoRoot, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync11(join14(repoRoot, "yarn.lock"))) return "yarn";
+  if (existsSync11(join14(repoRoot, "bun.lockb"))) return "bun";
+  if (existsSync11(join14(repoRoot, "package-lock.json"))) return "npm";
   return null;
 }
 function readPackageJson(repoRoot) {
-  const path = join3(repoRoot, "package.json");
-  if (!existsSync5(path)) return null;
+  const path = join14(repoRoot, "package.json");
+  if (!existsSync11(path)) return null;
   try {
     return JSON.parse(readFileSync(path, "utf8"));
   } catch {
@@ -14687,7 +16583,7 @@ function detectOwner(repoRoot) {
 }
 function detectProject(repoRoot = process.cwd()) {
   const errors = [];
-  const cwd = resolve9(repoRoot);
+  const cwd = resolve11(repoRoot);
   const inside = runGit2(cwd, ["rev-parse", "--show-toplevel"]);
   if (inside.status !== 0) {
     errors.push({ kind: "not-a-git-repo", path: cwd, detail: inside.stderr.trim() });
@@ -14853,7 +16749,7 @@ async function listPending(repoRoot) {
 }
 
 // src/installer/ship-adapter.js
-import { resolve as resolve10 } from "node:path";
+import { resolve as resolve12 } from "node:path";
 var REQUIRED_DEFAULTS = {
   review: { agent: "delivery-reviewer", required: true, invalidateOnHeadChange: true },
   ci: { driver: "github-status-checks", requiredChecks: ["delivery-verify"], wait: true, flakyRetry: 1 },
@@ -14894,10 +16790,10 @@ function flattenShipConfig(ship) {
 }
 
 // src/version.js
-import { readFileSync as readFileSync2, existsSync as existsSync6 } from "node:fs";
-import { dirname as dirname5, resolve as resolve11 } from "node:path";
+import { readFileSync as readFileSync2, existsSync as existsSync12 } from "node:fs";
+import { dirname as dirname7, resolve as resolve13 } from "node:path";
 import { fileURLToPath } from "node:url";
-var PACKAGE_VERSION = "0.9.0";
+var PACKAGE_VERSION = "0.10.0-rc.17";
 var TEMPLATE_SET = `v${PACKAGE_VERSION}`;
 
 // src/plugin.js
@@ -14910,26 +16806,67 @@ var toolDefs = [
   ["delivery_pr", "Open a draft PR linked to the issue.", "pr"],
   ["delivery_ready", "Mark the PR ready after every required gate has passed.", "ready"],
   ["delivery_merge", "Squash merge the PR after an explicit user request.", "merge"],
-  ["delivery_cleanup", "Remove the agent-owned worktree and branch after merge.", "cleanup"]
+  ["delivery_cleanup", "Remove the agent-owned worktree and branch after merge.", "cleanup"],
+  ["delivery_github_read", "Typed read of issue, PR, or check data.", "githubRead"],
+  ["delivery_issue_comment", "Idempotent typed comment on an issue.", "issueComment"],
+  ["delivery_issue_labels", "Idempotent label add/remove on an issue.", "issueLabels"],
+  ["delivery_issue_link", "Mark a relationship between two issues.", "issueLink"],
+  ["delivery_issue_close", "Close an issue with a recorded user permission subject.", "issueClose"],
+  ["delivery_sync", "Fetch and merge base into the feature branch.", "sync"],
+  ["delivery_publish", "Push the manifest branch to origin with HEAD verification.", "publish"],
+  ["ship_plan_start", "Create a workflow and dispatch the configured planner.", "planStart"],
+  ["ship_plan_submit", "Planner-only immutable PlanV2 submission.", "planSubmit"],
+  ["ship_plan_approve", "Interactive approval + immutable local seal.", "planApprove"],
+  ["ship_run_start", "Start execution of an approved plan.", "runStart"],
+  ["ship_task_report", "Builder-only immutable task report.", "taskReport"],
+  ["ship_task_review", "Task reviewer Spec/Quality verdict.", "taskReview"],
+  ["ship_resume", "Restore, reconcile, and continue idempotently.", "resume"],
+  ["ship_status", "Read-only compact workflow state.", "status"]
 ];
+function wrapEnvelopeV2(id, result) {
+  if (result && typeof result === "object" && result.contractVersion === 2) {
+    return result;
+  }
+  if (result && typeof result === "object" && result.contractVersion === 1) {
+    const { contractVersion: _cv, ...rest } = result;
+    return {
+      contractVersion: 2,
+      ok: true,
+      kind: id,
+      operationId: `legacy-${Date.now().toString(36)}`,
+      idempotent: false,
+      data: rest
+    };
+  }
+  if (result && typeof result === "object" && typeof result.kind === "string") {
+    return {
+      contractVersion: 2,
+      ok: false,
+      kind: id,
+      operationId: `legacy-${Date.now().toString(36)}`,
+      retryable: false,
+      message: result.kind,
+      details: result
+    };
+  }
+  return {
+    contractVersion: 2,
+    ok: true,
+    kind: id,
+    operationId: `legacy-${Date.now().toString(36)}`,
+    idempotent: false,
+    data: result
+  };
+}
 function makeTool(id, description, factory, runtime) {
   return tool({
     description,
     args: factory.args,
     async execute(args, ctx) {
       const runner = factory.build(runtime, ctx);
-      let env = await runner(args);
-      const taskId = typeof args?.taskId === "string" ? args.taskId : null;
-      if (env?.kind === "merge" && taskId) {
-        runtime.lastTaskId = taskId;
-        const result = await tryImmediateCleanup({
-          repoRoot: runtime.repoRoot,
-          taskId,
-          adapter: runtime.adapter
-        }).catch((e) => ({ ok: false, reason: String(e?.message ?? e) }));
-        env = { ...env, cleanup: result };
-      }
-      return JSON.stringify(env, null, 2);
+      const env = await runner(args);
+      const wrapped = wrapEnvelopeV2(id, env);
+      return JSON.stringify(wrapped, null, 2);
     }
   });
 }
@@ -14937,7 +16874,7 @@ async function resolveRepoSlug(repoRoot, detection, config2) {
   const fromConfig = config2?.value?.project?.repository;
   if (typeof fromConfig === "string" && fromConfig.includes("/")) return fromConfig;
   if (detection?.repository) return detection.repository;
-  const gitConfig = await readFile5(resolve12(repoRoot, ".git/config"), "utf8").catch(() => null);
+  const gitConfig = await readFile12(resolve14(repoRoot, ".git/config"), "utf8").catch(() => null);
   if (gitConfig) {
     const m = gitConfig.match(/url\s*=\s*.*?github\.com[:/]([^/]+)\/([^/\s]+?)(?:\.git)?\b/);
     if (m) return `${m[1]}/${m[2]}`;
@@ -14969,7 +16906,7 @@ async function bestEffortCleanupQueue(repoRoot, adapter) {
   return { pending, manifestTasks: tasks.map((t) => t.taskId), ...out };
 }
 async function buildRuntime(worktree) {
-  const repoRootAbs = resolve12(worktree ?? process.cwd());
+  const repoRootAbs = resolve14(worktree ?? process.cwd());
   const detection = detectProject(repoRootAbs);
   const legacyAdapter = await loadAdapter(repoRootAbs);
   const config2 = await loadConfig(repoRootAbs);
@@ -15120,6 +17057,207 @@ var factories = {
       adapter: rt.adapter,
       remote: "origin"
     })
+  },
+  githubRead: {
+    args: {
+      resource: tool.schema.enum(["issue", "pr", "checks"]),
+      number: tool.schema.number().optional(),
+      sha: tool.schema.string().optional(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createGithubReadTool({
+      driver: rt.driver,
+      repoRoot: rt.repoRoot,
+      repoSlug: rt.repoSlug,
+      owner: rt.owner,
+      operationStore: { readOperation: async () => null }
+    })
+  },
+  issueComment: {
+    args: {
+      number: tool.schema.number(),
+      body: tool.schema.string(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createIssueCommentTool({
+      driver: rt.driver,
+      repoRoot: rt.repoRoot,
+      repoSlug: rt.repoSlug,
+      owner: rt.owner
+    })
+  },
+  issueLabels: {
+    args: {
+      number: tool.schema.number(),
+      add: tool.schema.array(tool.schema.string()).optional(),
+      remove: tool.schema.array(tool.schema.string()).optional(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createIssueLabelsTool({
+      driver: rt.driver,
+      repoRoot: rt.repoRoot,
+      repoSlug: rt.repoSlug,
+      owner: rt.owner
+    })
+  },
+  issueLink: {
+    args: {
+      from: tool.schema.number(),
+      to: tool.schema.number(),
+      relationship: tool.schema.enum(["blocks", "is-blocked-by", "closes", "is-closed-by", "related"]),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createIssueLinkTool({
+      driver: rt.driver,
+      repoRoot: rt.repoRoot,
+      repoSlug: rt.repoSlug,
+      owner: rt.owner
+    })
+  },
+  issueClose: {
+    args: {
+      number: tool.schema.number(),
+      subject: tool.schema.string(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createIssueCloseTool({
+      driver: rt.driver,
+      repoRoot: rt.repoRoot,
+      repoSlug: rt.repoSlug,
+      owner: rt.owner
+    })
+  },
+  sync: {
+    args: {
+      base: tool.schema.string(),
+      branch: tool.schema.string(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createSyncTool({
+      driver: rt.driver,
+      repoRoot: rt.repoRoot,
+      repoSlug: rt.repoSlug,
+      owner: rt.owner
+    })
+  },
+  publish: {
+    args: {
+      taskId: tool.schema.string(),
+      expectedHead: tool.schema.string(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createPublishTool({
+      driver: rt.driver,
+      repoRoot: rt.repoRoot,
+      repoSlug: rt.repoSlug,
+      owner: rt.owner
+    })
+  },
+  planStart: {
+    args: {
+      issueNumber: tool.schema.number(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createPlanStartTool({
+      repoRoot: rt.repoRoot,
+      owner: rt.owner,
+      config: rt.configValue
+    })
+  },
+  planSubmit: {
+    args: {
+      workflowId: tool.schema.string(),
+      revision: tool.schema.number(),
+      plan: tool.schema.unknown(),
+      sha256: tool.schema.string().optional(),
+      submittedBy: tool.schema.string(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createPlanSubmitTool({
+      repoRoot: rt.repoRoot,
+      owner: rt.owner
+    })
+  },
+  planApprove: {
+    args: {
+      workflowId: tool.schema.string(),
+      revision: tool.schema.number(),
+      sha256: tool.schema.string(),
+      subject: tool.schema.string(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createPlanApproveTool({
+      repoRoot: rt.repoRoot,
+      owner: rt.owner
+    })
+  },
+  runStart: {
+    args: {
+      workflowId: tool.schema.string(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createRunStartTool({
+      repoRoot: rt.repoRoot,
+      owner: rt.owner
+    })
+  },
+  taskReport: {
+    args: {
+      workflowId: tool.schema.string(),
+      taskId: tool.schema.string(),
+      round: tool.schema.number(),
+      submittedBy: tool.schema.string(),
+      summary: tool.schema.string(),
+      changes: tool.schema.array(tool.schema.unknown()).optional(),
+      tests: tool.schema.array(tool.schema.unknown()).optional(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createTaskReportTool({
+      repoRoot: rt.repoRoot,
+      owner: rt.owner,
+      config: rt.configValue
+    })
+  },
+  taskReview: {
+    args: {
+      workflowId: tool.schema.string(),
+      taskId: tool.schema.string(),
+      round: tool.schema.number(),
+      submittedBy: tool.schema.string(),
+      spec: tool.schema.object({
+        verdict: tool.schema.enum(["pass", "none", "fail"]),
+        notes: tool.schema.string().optional()
+      }),
+      quality: tool.schema.object({
+        verdict: tool.schema.enum(["pass", "none", "fail"]),
+        notes: tool.schema.string().optional()
+      }),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createTaskReviewTool({
+      repoRoot: rt.repoRoot,
+      owner: rt.owner
+    })
+  },
+  resume: {
+    args: {
+      workflowId: tool.schema.string(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createResumeTool({
+      repoRoot: rt.repoRoot,
+      owner: rt.owner
+    })
+  },
+  status: {
+    args: {
+      workflowId: tool.schema.string(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createStatusTool({
+      repoRoot: rt.repoRoot,
+      owner: rt.owner
+    })
   }
 };
 var ShipPlugin = async (ctx) => {