opencode-ship 0.9.0 → 0.10.0-rc.18

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// opencode-ship CLI v0.9.0
+// opencode-ship CLI v0.10.0-rc.18
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -11,21 +11,9 @@ var __export = (target, all) => {
 };
 
 // src/installer/json-pointer.js
-var json_pointer_exports = {};
-__export(json_pointer_exports, {
-  getPointer: () => getPointer,
-  parsePointer: () => parsePointer,
-  pointerPath: () => pointerPath,
-  removePointer: () => removePointer,
-  setPointer: () => setPointer,
-  stableStringify: () => stableStringify
-});
 function unescape(token) {
   return token.replace(/~1/g, "/").replace(/~0/g, "~");
 }
-function escape(token) {
-  return token.replace(/~/g, "~0").replace(/\//g, "~1");
-}
 function* parsePointer(pointer) {
   if (typeof pointer !== "string" || pointer === "") return;
   if (pointer[0] !== "/") {
@@ -88,9 +76,6 @@ function stableStringify(value) {
   }
   return JSON.stringify(value);
 }
-function pointerPath(segments) {
-  return "/" + segments.map((s) => escape(String(s))).join("/");
-}
 var init_json_pointer = __esm({
   "src/installer/json-pointer.js"() {
   }
@@ -114,21 +99,22 @@ var init_hash = __esm({
 function planModePermissions() {
   return {
     build: {
-      // Broad-deny entries for the standard Build verbs. These
-      // cover bash, source edits, and writes outside the plans
-      // path. opencode.js evaluates the last matching rule, so
-      // a narrow object-typed entry after a string-typed deny
-      // creates a per-path exception.
       bash: DENY_DEFAULT,
-      edit: { [PLANS_GLOB]: ALLOW_PLANS },
-      write: { [PLANS_GLOB]: ALLOW_PLANS },
+      edit: {
+        "*": DENY_DEFAULT,
+        [PLANS_GLOB]: ALLOW_PLANS
+      },
       webfetch: DENY_DEFAULT,
-      // The Plan Mode sub-agent also has no business calling
-      // delivery tools itself; that is the Build controller's
-      // job. Keep the canonical nine tools as deny so a Plan
-      // Mode prompt injection cannot trigger them.
-      "task.plan-agent": DENY_DEFAULT,
-      "task.build-agent": DENY_DEFAULT
+      task: DENY_DEFAULT,
+      delivery_inspect: DENY_DEFAULT,
+      delivery_issue: DENY_DEFAULT,
+      delivery_worktree: DENY_DEFAULT,
+      delivery_verify: DENY_DEFAULT,
+      delivery_review: DENY_DEFAULT,
+      delivery_pr: DENY_DEFAULT,
+      delivery_ready: DENY_DEFAULT,
+      delivery_merge: DENY_DEFAULT,
+      delivery_cleanup: DENY_DEFAULT
     }
   };
 }
@@ -203,15 +189,15 @@ function stripJsonc(text) {
   let stripped = "";
   let i = 0;
   let inString = false;
-  let escape2 = false;
+  let escape = false;
   while (i < text.length) {
     const ch = text[i];
     if (inString) {
       stripped += ch;
-      if (escape2) {
-        escape2 = false;
+      if (escape) {
+        escape = false;
       } else if (ch === "\\") {
-        escape2 = true;
+        escape = true;
       } else if (ch === '"') {
         inString = false;
       }
@@ -582,15 +568,19 @@ Commands:
   --help      Show this usage and exit.
 
 Options:
-  --root <path>          Project root (defaults to cwd).
-  --profile <name>       Override active profile: ${PROFILES.join(", ")}.
-  --force-config         Rewrite the user config from detection (init only).
-  --force-root-config    Create opencode.json when absent (init only).
-  --strict-doctor        Fail init when doctor reports unhealthy checks.
-  --replace-managed      Replace locally-modified managed files (update only).
-  --purge-config         Remove ship.config.json when uninstalling.
-  --json                 Emit a JSON envelope instead of human output.
+  --root <path>               Project root (defaults to cwd).
+  --profile <name>            Override active profile: ${PROFILES.join(", ")}.
+  --force-config              Rewrite the user config from detection (init only).
+  --force-root-config         Create opencode.json when absent (init only).
+  --strict-doctor             Fail init when doctor reports unhealthy checks.
+  --replace-managed           Replace locally-modified managed files (update only).
+  --purge-config              Remove ship.config.json when uninstalling.
+  --planner-model <id>        Engineering model id for the strong planner.
+  --builder-model <id>        Engineering model id for the cheap builder.
+  --final-reviewer-model <id> Engineering model id for the Standards + Spec reviewer.
+  --json                      Emit a JSON envelope instead of human output.
 `;
+var MODEL_ID_RE = /^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+$/;
 function parseFlags(argv) {
   const options = {
     rootPath: null,
@@ -600,7 +590,10 @@ function parseFlags(argv) {
     purgeConfig: false,
     forceConfig: false,
     forceRootConfig: false,
-    strictDoctor: false
+    strictDoctor: false,
+    plannerModel: null,
+    builderModel: null,
+    finalReviewerModel: null
   };
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
@@ -620,6 +613,15 @@ function parseFlags(argv) {
         return { error: `unknown profile '${value}' (expected one of: ${PROFILES.join(", ")})` };
       }
       options.profile = value;
+    } else if (arg === "--planner-model" || arg === "--builder-model" || arg === "--final-reviewer-model") {
+      const value = argv[++i];
+      if (value === void 0) return { error: `${arg} requires a value` };
+      if (!MODEL_ID_RE.test(value)) {
+        return { error: `${arg} must be a "<provider>/<model>" id, got ${JSON.stringify(value)}` };
+      }
+      if (arg === "--planner-model") options.plannerModel = value;
+      else if (arg === "--builder-model") options.builderModel = value;
+      else options.finalReviewerModel = value;
     } else if (arg === "-h" || arg === "--help") return { help: true };
     else if (arg === "-v" || arg === "--version") return { version: true };
     else return { error: `unknown flag ${arg}` };
@@ -653,9 +655,9 @@ function helpText() {
 }
 
 // src/installer/executor.js
-import { existsSync as existsSync11 } from "node:fs";
-import { mkdir as mkdir4, readFile as readFile7, rename as rename4, unlink as unlink2, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname6, resolve as resolve10 } from "node:path";
+import { existsSync as existsSync13 } from "node:fs";
+import { mkdir as mkdir5, readFile as readFile8, rename as rename5, unlink as unlink3, writeFile as writeFile5 } from "node:fs/promises";
+import { dirname as dirname7, resolve as resolve12 } from "node:path";
 
 // src/installer/catalog.js
 import { resolve as resolve3, relative, sep } from "node:path";
@@ -687,12 +689,53 @@ function resolvePackageRoot(startUrl) {
 import { readFileSync as readFileSync2, existsSync as existsSync2 } from "node:fs";
 import { dirname as dirname2, resolve as resolve2 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-var PACKAGE_VERSION = "0.9.0";
+var PACKAGE_VERSION = "0.10.0-rc.18";
 var TEMPLATE_SET = `v${PACKAGE_VERSION}`;
 
 // src/installer/catalog.js
 var TEMPLATE_SET_ID = TEMPLATE_SET;
 var packageRoot = resolvePackageRoot(import.meta.url);
+var MATT_SKILLS = [
+  "setup-engineering-workflow",
+  "engineering-workflow",
+  "grilling",
+  "domain-modeling",
+  "grill-with-docs",
+  "triage",
+  "to-spec",
+  "to-tickets",
+  "wayfinder",
+  "handoff",
+  "research",
+  "prototype",
+  "codebase-design",
+  "code-review"
+];
+var SUPER_SKILLS = [
+  "brainstorming",
+  "writing-plans",
+  "executing-plans",
+  "subagent-driven-development",
+  "dispatching-parallel-agents",
+  "test-driven-development",
+  "systematic-debugging",
+  "verification-before-completion",
+  "requesting-code-review",
+  "receiving-code-review"
+];
+var ENGINEERING_AGENTS = [
+  "ship-controller",
+  "ship-planner",
+  "ship-task-builder",
+  "ship-task-reviewer",
+  "ship-final-standards-reviewer",
+  "ship-final-spec-reviewer"
+];
+var ENGINEERING_COMMANDS = [
+  "ship-deliver",
+  "ship-resume",
+  "ship-status"
+];
 var CATALOG = [
   {
     id: "plugin:opencode-ship",
@@ -718,6 +761,22 @@ var CATALOG = [
     mode: 420,
     profiles: ["core", "engineering"]
   },
+  ...ENGINEERING_AGENTS.map((name) => ({
+    id: `agent:${name}`,
+    kind: "agent",
+    path: `.opencode/agents/${name}.md`,
+    source: resolve3(packageRoot, `assets/agents/${name}.md`),
+    mode: 420,
+    profiles: ["engineering"]
+  })),
+  ...ENGINEERING_COMMANDS.map((name) => ({
+    id: `command:${name}`,
+    kind: "support",
+    path: `.opencode/commands/${name}.md`,
+    source: resolve3(packageRoot, `assets/commands/${name}.md`),
+    mode: 420,
+    profiles: ["engineering"]
+  })),
   {
     id: "skill:delivery-workflow",
     kind: "skill",
@@ -734,22 +793,22 @@ var CATALOG = [
     mode: 420,
     profiles: ["core", "engineering"]
   },
-  {
-    id: "skill:triage",
+  ...MATT_SKILLS.map((name) => ({
+    id: `skill:matt:${name}`,
     kind: "skill",
-    path: ".opencode/skills/triage/SKILL.md",
-    source: resolve3(packageRoot, "assets/skills/triage/SKILL.md"),
+    path: `.opencode/skills/${name}/SKILL.md`,
+    source: resolve3(packageRoot, `assets/skills/${name}/SKILL.md`),
     mode: 420,
     profiles: ["engineering"]
-  },
-  {
-    id: "skill:grill-with-docs",
+  })),
+  ...SUPER_SKILLS.map((name) => ({
+    id: `skill:super:${name}`,
     kind: "skill",
-    path: ".opencode/skills/grill-with-docs/SKILL.md",
-    source: resolve3(packageRoot, "assets/skills/grill-with-docs/SKILL.md"),
+    path: `.opencode/skills/${name}/SKILL.md`,
+    source: resolve3(packageRoot, `assets/skills/${name}/SKILL.md`),
     mode: 420,
     profiles: ["engineering"]
-  }
+  }))
 ];
 function filterCatalogByProfile(catalog, profile) {
   const effective = profile === void 0 || profile === null ? DEFAULT_PROFILE : profile;
@@ -833,7 +892,7 @@ function validateCatalog({ catalog = CATALOG } = {}) {
 }
 
 // src/installer/planner.js
-import { existsSync as existsSync6 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 import { readFile as readFile3, stat } from "node:fs/promises";
 init_hash();
 
@@ -851,7 +910,7 @@ var ship_config_schema_default = {
   required: ["schemaVersion"],
   additionalProperties: false,
   properties: {
-    schemaVersion: { const: 1 },
+    schemaVersion: { enum: [1, 2] },
     profile: {
       type: "string",
       enum: ["core", "engineering"],
@@ -981,8 +1040,69 @@ var ship_config_schema_default = {
         agentsDir: { type: "string", pattern: "^\\.opencode/agents/?$" },
         skillsDir: { type: "string", pattern: "^\\.opencode/skills/?$" }
       }
+    },
+    workflow: {
+      type: "object",
+      description: "Required when profile is engineering. Ignored when profile is core.",
+      additionalProperties: false,
+      properties: {
+        models: {
+          type: "object",
+          additionalProperties: false,
+          required: ["planner", "builder", "finalReviewer"],
+          properties: {
+            planner: {
+              type: "string",
+              pattern: "^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$",
+              description: "Provider/model id for the strong planning child session."
+            },
+            builder: {
+              type: "string",
+              pattern: "^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$",
+              description: "Provider/model id for the cheap builder child session."
+            },
+            finalReviewer: {
+              type: "string",
+              pattern: "^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$",
+              description: "Provider/model id for the final Standards + Spec reviewers."
+            }
+          }
+        },
+        approval: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            mirrorToIssue: { const: true },
+            maxFailedRounds: { const: 3 }
+          }
+        }
+      }
     }
-  }
+  },
+  allOf: [
+    {
+      if: {
+        required: ["profile"],
+        properties: { profile: { const: "engineering" } }
+      },
+      then: {
+        required: ["workflow"],
+        properties: {
+          workflow: {
+            required: ["models", "approval"],
+            properties: {
+              models: {
+                required: ["planner", "builder", "finalReviewer"]
+              },
+              approval: {
+                required: ["mirrorToIssue", "maxFailedRounds"]
+              }
+            }
+          }
+        }
+      }
+    }
+  ]
 };
 
 // src/installer/validation.js
@@ -1000,6 +1120,18 @@ function validate(value, schema, pointer, issues) {
     issues.push(`${pointer}: expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`);
     return;
   }
+  if (Array.isArray(schema.allOf)) {
+    for (const sub of schema.allOf) validate(value, sub, pointer, issues);
+  }
+  if (isObject2(schema.if)) {
+    const ifIssues = [];
+    validate(value, schema.if, pointer, ifIssues);
+    if (ifIssues.length === 0) {
+      if (isObject2(schema.then)) validate(value, schema.then, pointer, issues);
+    } else if (isObject2(schema.else)) {
+      validate(value, schema.else, pointer, issues);
+    }
+  }
   const type = schema.type;
   if (type !== void 0) {
     const actual = Array.isArray(value) ? "array" : value === null ? "null" : typeof value;
@@ -1050,7 +1182,7 @@ function validate(value, schema, pointer, issues) {
       value.forEach((entry, i) => validate(entry, schema.items, `${pointer}/${i}`, issues));
     }
   }
-  if (type === "object") {
+  if (type === "object" || isObject2(schema.properties) || Array.isArray(schema.required)) {
     if (Array.isArray(schema.required)) {
       for (const key of schema.required) {
         if (!(key in value)) issues.push(`${pointer}: missing required field ${key}`);
@@ -1145,15 +1277,510 @@ function renderDefaultConfig(detection, overrides = {}) {
 // src/installer/planner.js
 init_json_pointer();
 init_root_config();
+
+// src/installer/root-reconciliation.js
 init_root_config();
+init_json_pointer();
+init_hash();
+init_plan_mode_permissions();
+import { existsSync as existsSync6 } from "node:fs";
+import { join } from "node:path";
+var PLAN_MODE_POINTER2 = "/agent/plan/permission";
+function desiredPointersForProfile(profile) {
+  const out = POINTER_ENTRIES.map((entry) => ({
+    pointer: entry.pointer,
+    strategy: (
+      /** @type {"value" | "object-entry" | "array-member"} */
+      entry.strategy
+    ),
+    scope: (
+      /** @type {Profile} */
+      "core"
+    ),
+    value: entry.value
+  }));
+  if (profile === "engineering") {
+    out.push({
+      pointer: PLAN_MODE_POINTER2,
+      strategy: (
+        /** @type {"value" | "object-entry" | "array-member"} */
+        "value"
+      ),
+      scope: (
+        /** @type {Profile} */
+        "engineering"
+      ),
+      value: (
+        /** @type {any} */
+        planModePermissions().build
+      )
+    });
+  }
+  return out;
+}
+async function planRootReconciliation(input) {
+  const profile = input.profile;
+  const mode = input.mode;
+  if (!["core", "engineering"].includes(profile)) {
+    throw new Error(`planRootReconciliation: invalid profile ${profile}`);
+  }
+  if (!["install", "profile-transition", "uninstall"].includes(mode)) {
+    throw new Error(`planRootReconciliation: invalid mode ${mode}`);
+  }
+  const detected = findRootConfig(input.repoRoot);
+  const target = detected.path ?? join(input.repoRoot, detected.relative);
+  const descriptors = input.pointerDescriptors ?? desiredPointersForProfile(profile);
+  const previousRecords = input.previousRecords ?? [];
+  if (mode === "uninstall") {
+    return planUninstallRoot({
+      target,
+      relPath: detected.relative,
+      previousRecords,
+      previousDocument: input.previousDocument
+    });
+  }
+  const fileMissing = !existsSync6(target);
+  if (fileMissing && !input.forceRepair) {
+    if (mode === "profile-transition") {
+      return {
+        kind: "noop",
+        op: "root-config",
+        target,
+        relPath: detected.relative,
+        reason: "no root opencode.json present",
+        edits: [],
+        pointerRecords: reconcileRecordsAfterTransition(descriptors, previousRecords)
+      };
+    }
+    return {
+      kind: "noop",
+      op: "root-config",
+      target,
+      relPath: detected.relative,
+      reason: "no root opencode.json present",
+      edits: [],
+      pointerRecords: seedPointerRecords(descriptors, previousRecords)
+    };
+  }
+  let doc;
+  if (fileMissing && input.forceRepair) {
+    doc = synthesizeDefaultRootConfig();
+    if (mode === "install" && profile === "engineering") {
+      const applied = applyPlanModeOwnership(doc, { block: planModePermissions().build });
+      doc = applied.doc;
+    }
+    const bytes = Buffer.from(formatRootConfig(doc), "utf8");
+    return {
+      kind: "create",
+      op: "root-config",
+      target,
+      relPath: detected.relative,
+      bytes,
+      desiredSha: bytesHashString(stableStringify(doc)),
+      currentSha: null,
+      edits: descriptors.map((d) => ({ kind: "create", pointer: d.pointer, value: "(synthesized)" })),
+      pointerRecords: seedPointerRecords(descriptors, previousRecords),
+      format: "json",
+      document: doc,
+      reason: "creating root opencode.json with installer-owned Build permissions"
+    };
+  }
+  const docResult = readRootConfig(target);
+  if (!docResult.ok) {
+    return {
+      kind: "noop",
+      op: "root-config",
+      target,
+      relPath: detected.relative,
+      reason: `root config ${docResult.error.kind}`,
+      edits: [],
+      pointerRecords: previousRecords
+    };
+  }
+  if (mode === "profile-transition") {
+    return planProfileTransitionRoot({
+      doc: docResult,
+      target,
+      relPath: detected.relative,
+      descriptors,
+      previousRecords
+    });
+  }
+  return planInstallRoot({
+    doc: docResult,
+    target,
+    relPath: detected.relative,
+    descriptors,
+    previousRecords
+  });
+}
+function reconcileRecordsAfterTransition(descriptors, previousRecords) {
+  const desiredCore = new Set(descriptors.filter((d) => d.scope === "core").map((d) => d.pointer));
+  const out = previousRecords.filter((r) => r.scope === "core" || r.scope === "engineering" && desiredCore.has(r.pointer));
+  const seen = new Set(out.map((r) => r.pointer));
+  for (const d of descriptors) {
+    if (seen.has(d.pointer)) continue;
+    out.push({
+      pointer: d.pointer,
+      strategy: d.strategy,
+      scope: d.scope,
+      installedSha256: d.value !== void 0 ? bytesHashString(stableStringify(d.value)) : null,
+      previous: { existed: false }
+    });
+  }
+  return out;
+}
+function planInstallRoot({ doc, target, relPath, descriptors, previousRecords }) {
+  const result = applyOwnedPointers(doc.value, {
+    pointerEntries: descriptors.map((d) => ({ pointer: d.pointer, strategy: d.strategy, value: d.value })),
+    allowEqualValues: true
+  });
+  const edits = [];
+  for (const a of result.applied) edits.push({ kind: "create", pointer: a.pointer, value: a.value });
+  for (const s of result.skipped) {
+    if (s.reason === "already equal") continue;
+    edits.push({ kind: "conflict", pointer: s.pointer, reason: s.reason, existing: s.existing, desired: s.desired });
+  }
+  let docForWrite = result.doc;
+  let bytes;
+  try {
+    const { value: sourceValue } = parseRootConfigPreservingOrder(doc.raw ?? "");
+    if (sourceValue && typeof sourceValue === "object") {
+      docForWrite = sourceValue;
+      for (const a of result.applied) {
+        docForWrite = setPointer(docForWrite, a.pointer, a.value);
+      }
+    }
+    bytes = Buffer.from(formatRootConfigPreserving(docForWrite), "utf8");
+  } catch {
+    bytes = Buffer.from(formatRootConfig(result.doc), "utf8");
+  }
+  const records = mergePointerRecords(descriptors, previousRecords, result, doc.before);
+  return {
+    kind: edits.some((e) => e.kind === "conflict") ? "conflict" : edits.length ? "update" : "noop",
+    op: "root-config",
+    target,
+    relPath,
+    bytes,
+    desiredSha: bytesHashString(stableStringify(docForWrite)),
+    currentSha: doc.sha256 ?? null,
+    edits,
+    pointerRecords: records,
+    format: doc.format,
+    document: docForWrite,
+    reason: edits.length === 0 ? "no installer-owned entries missing" : `apply ${result.applied.length} / skip ${result.skipped.length}`
+  };
+}
+function planProfileTransitionRoot({ doc, target, relPath, descriptors, previousRecords }) {
+  const desired = descriptors;
+  const drift = [];
+  for (const rec of previousRecords) {
+    const stillDesired = desired.some((d) => d.pointer === rec.pointer && d.scope === rec.scope);
+    if (stillDesired) continue;
+    if (typeof rec.installedSha256 !== "string" || rec.installedSha256.length === 0) continue;
+    const currentValue = getPointer(doc.value, rec.pointer);
+    if (currentValue === void 0) {
+      continue;
+    }
+    const currentHash = bytesHashString(stableStringify(currentValue));
+    if (currentHash !== rec.installedSha256) {
+      drift.push({ pointer: rec.pointer, recorded: rec.installedSha256, current: currentHash });
+    }
+  }
+  if (drift.length > 0) {
+    return {
+      kind: "conflict",
+      op: "root-config",
+      target,
+      relPath,
+      reason: `installed pointer drift: ${drift.map((d) => `${d.pointer} (recorded ${d.recorded.slice(0, 8)}\u2026, current ${d.current.slice(0, 8)}\u2026)`).join("; ")}`,
+      edits: drift.map((d) => ({ kind: "conflict", pointer: d.pointer, reason: "installed-pointer-drift" })),
+      pointerRecords: previousRecords
+    };
+  }
+  let next = JSON.parse(JSON.stringify(doc.value));
+  const edits = [];
+  const mergedRecords = previousRecords.map((r) => ({ ...r }));
+  const recordIndex = new Map(mergedRecords.map((r, idx) => [r.pointer, idx]));
+  for (let i = mergedRecords.length - 1; i >= 0; i--) {
+    const rec = mergedRecords[i];
+    const isStillDesired = desired.some((d) => d.pointer === rec.pointer && d.scope === rec.scope);
+    if (isStillDesired) continue;
+    if (rec.previous && rec.previous.existed) {
+      next = setPointer(next, rec.pointer, rec.previous.value);
+      edits.push({ kind: "restore", pointer: rec.pointer, value: rec.previous.value });
+    } else {
+      if (getPointer(next, rec.pointer) !== void 0) {
+        next = removePointer(next, rec.pointer);
+        edits.push({ kind: "remove", pointer: rec.pointer });
+      }
+    }
+    mergedRecords.splice(i, 1);
+    recordIndex.delete(rec.pointer);
+  }
+  for (const d of desired) {
+    const existing = getPointer(next, d.pointer);
+    if (existing === d.value) {
+      const idx = recordIndex.get(d.pointer);
+      if (idx != null) {
+        mergedRecords[idx] = {
+          ...mergedRecords[idx],
+          scope: d.scope,
+          installedSha256: bytesHashString(stableStringify(d.value))
+        };
+      } else {
+        mergedRecords.push({
+          pointer: d.pointer,
+          strategy: d.strategy,
+          scope: d.scope,
+          installedSha256: bytesHashString(stableStringify(d.value)),
+          previous: { existed: existing !== void 0, value: existing ?? null }
+        });
+      }
+      continue;
+    }
+    if (existing === void 0) {
+      next = setPointer(next, d.pointer, d.value);
+      edits.push({ kind: "create", pointer: d.pointer, value: d.value });
+      const idx = recordIndex.get(d.pointer);
+      if (idx != null) {
+        mergedRecords[idx] = {
+          ...mergedRecords[idx],
+          scope: d.scope,
+          installedSha256: bytesHashString(stableStringify(d.value)),
+          previous: { existed: false }
+        };
+      } else {
+        mergedRecords.push({
+          pointer: d.pointer,
+          strategy: d.strategy,
+          scope: d.scope,
+          installedSha256: bytesHashString(stableStringify(d.value)),
+          previous: { existed: false }
+        });
+      }
+    } else {
+      edits.push({
+        kind: "conflict",
+        pointer: d.pointer,
+        reason: "different existing value",
+        existing,
+        desired: d.value
+      });
+    }
+  }
+  let docForWrite = next;
+  let bytes;
+  try {
+    const { value: sourceValue } = parseRootConfigPreservingOrder(doc.raw ?? "");
+    if (sourceValue && typeof sourceValue === "object") {
+      docForWrite = sourceValue;
+      for (const e of edits) {
+        if (e.kind === "create" || e.kind === "restore") {
+          docForWrite = setPointer(docForWrite, e.pointer, e.value);
+        } else if (e.kind === "remove") {
+          docForWrite = removePointer(docForWrite, e.pointer);
+        }
+      }
+    }
+    docForWrite = collapseEmptyAncestors(docForWrite) ?? docForWrite;
+    bytes = Buffer.from(formatRootConfigPreserving(docForWrite), "utf8");
+  } catch {
+    bytes = Buffer.from(formatRootConfig(collapseEmptyAncestors(next) ?? next), "utf8");
+  }
+  return {
+    kind: edits.some((e) => e.kind === "conflict") ? "conflict" : edits.some((e) => e.kind === "create" || e.kind === "remove" || e.kind === "restore") ? "update" : "noop",
+    op: "root-config",
+    target,
+    relPath,
+    bytes,
+    desiredSha: bytesHashString(stableStringify(docForWrite)),
+    currentSha: doc.sha256 ?? null,
+    edits,
+    pointerRecords: mergedRecords,
+    format: doc.format,
+    document: docForWrite,
+    reason: "profile transition reconciliation"
+  };
+}
+function planUninstallRoot({ target, relPath, previousRecords, previousDocument }) {
+  if (previousRecords.length === 0) {
+    return {
+      kind: "noop",
+      op: "root-config",
+      target,
+      relPath,
+      reason: "no installer-owned pointers recorded",
+      edits: [],
+      pointerRecords: []
+    };
+  }
+  const docResult = readRootConfig(target);
+  if (!docResult.ok) {
+    return {
+      kind: "noop",
+      op: "root-config",
+      target,
+      relPath,
+      reason: `root config ${docResult.error.kind}`,
+      edits: [],
+      pointerRecords: previousRecords
+    };
+  }
+  const drift = [];
+  for (const rec of previousRecords) {
+    if (typeof rec.installedSha256 !== "string" || rec.installedSha256.length === 0) continue;
+    const currentValue = getPointer(docResult.value, rec.pointer);
+    if (currentValue === void 0) continue;
+    const currentHash = bytesHashString(stableStringify(currentValue));
+    if (currentHash !== rec.installedSha256) {
+      drift.push({ pointer: rec.pointer, recorded: rec.installedSha256, current: currentHash });
+    }
+  }
+  if (drift.length > 0) {
+    return {
+      kind: "conflict",
+      op: "root-config",
+      target,
+      relPath,
+      reason: `installed pointer drift: ${drift.map((d) => `${d.pointer} (recorded ${d.recorded.slice(0, 8)}\u2026, current ${d.current.slice(0, 8)}\u2026)`).join("; ")}`,
+      edits: drift.map((d) => ({ kind: "conflict", pointer: d.pointer, reason: "installed-pointer-drift" })),
+      pointerRecords: previousRecords
+    };
+  }
+  let doc = docResult.value;
+  const edits = [];
+  for (const rec of previousRecords) {
+    if (rec.previous && rec.previous.existed) {
+      doc = setPointer(doc, rec.pointer, rec.previous.value);
+      edits.push({ kind: "restore", pointer: rec.pointer, value: rec.previous.value });
+    } else {
+      const current = getPointer(doc, rec.pointer);
+      if (current !== void 0) {
+        doc = removePointer(doc, rec.pointer);
+        edits.push({ kind: "remove", pointer: rec.pointer });
+      }
+    }
+  }
+  let docForWrite = doc;
+  let bytes;
+  try {
+    const { value: sourceValue } = parseRootConfigPreservingOrder(docResult.raw ?? "");
+    if (sourceValue && typeof sourceValue === "object") {
+      docForWrite = sourceValue;
+      for (const e of edits) {
+        if (e.kind === "restore") {
+          docForWrite = setPointer(docForWrite, e.pointer, e.value);
+        } else if (e.kind === "remove") {
+          docForWrite = removePointer(docForWrite, e.pointer);
+        }
+      }
+    }
+    docForWrite = collapseEmptyAncestors(docForWrite);
+    bytes = Buffer.from(formatRootConfigPreserving(docForWrite), "utf8");
+  } catch {
+    bytes = Buffer.from(formatRootConfig(collapseEmptyAncestors(doc)), "utf8");
+  }
+  return {
+    kind: edits.length ? "update" : "noop",
+    op: "root-config",
+    target,
+    relPath,
+    bytes,
+    desiredSha: bytesHashString(stableStringify(docForWrite)),
+    currentSha: docResult.sha256 ?? null,
+    edits,
+    pointerRecords: [],
+    format: docResult.format,
+    document: docForWrite,
+    reason: "uninstall restores the preinstall root config"
+  };
+}
+function collapseEmptyAncestors(doc) {
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) return doc;
+  const out = {};
+  for (const k of Object.keys(doc)) {
+    if (k === "__sourceOrder__") continue;
+    out[k] = collapseEmptyAncestors(doc[k]);
+  }
+  if (Array.isArray(doc.__sourceOrder__)) {
+    out.__sourceOrder__ = doc.__sourceOrder__.filter((k) => k in out);
+  }
+  const remainingKeys = Object.keys(out).filter((k) => k !== "__sourceOrder__");
+  if (remainingKeys.length === 0) return void 0;
+  return out;
+}
+function seedPointerRecords(descriptors, previousRecords) {
+  const out = previousRecords.map((r) => ({ ...r }));
+  const seen = new Set(out.map((r) => r.pointer));
+  for (const d of descriptors) {
+    if (seen.has(d.pointer)) continue;
+    out.push({
+      pointer: d.pointer,
+      strategy: (
+        /** @type {any} */
+        d.strategy
+      ),
+      scope: d.scope,
+      installedSha256: d.value !== void 0 ? bytesHashString(stableStringify(d.value)) : null,
+      previous: { existed: false }
+    });
+  }
+  return out;
+}
+function mergePointerRecords(descriptors, previousRecords, result, beforeSnapshot) {
+  const out = previousRecords.map((r) => ({ ...r }));
+  const index = new Map(out.map((r, idx) => [r.pointer, idx]));
+  for (const a of result.applied) {
+    const previousEntry = beforeSnapshot?.[a.pointer];
+    const previous = previousEntry === void 0 ? { existed: false } : { existed: true, value: previousEntry };
+    const next = {
+      pointer: a.pointer,
+      strategy: "value",
+      scope: descriptors.find((d) => d.pointer === a.pointer)?.scope ?? "core",
+      installedSha256: bytesHashString(stableStringify(a.value)),
+      previous
+    };
+    if (index.has(a.pointer)) {
+      const idx = index.get(a.pointer);
+      out[idx] = {
+        ...out[idx],
+        scope: next.scope,
+        installedSha256: next.installedSha256,
+        // If the lock already had a record, keep its previous value
+        // verbatim so uninstall restores the original pre-install
+        // state even after multiple in-place updates.
+        previous: out[idx].previous ?? next.previous
+      };
+    } else {
+      out.push(next);
+    }
+  }
+  for (const s of result.skipped) {
+    if (s.reason !== "already equal") continue;
+    if (index.has(s.pointer)) continue;
+    const existing = beforeSnapshot?.[s.pointer];
+    const previous = existing === void 0 ? { existed: false } : { existed: true, value: existing };
+    out.push({
+      pointer: s.pointer,
+      strategy: "value",
+      scope: descriptors.find((d) => d.pointer === s.pointer)?.scope ?? "core",
+      installedSha256: bytesHashString(stableStringify(existing ?? null)),
+      previous
+    });
+  }
+  return out;
+}
+
+// src/installer/planner.js
 async function readBytes(path) {
-  if (!existsSync6(path)) return null;
+  if (!existsSync7(path)) return null;
   const buf = await readFile3(path);
   const fileStat = await stat(path);
   return { bytes: buf, hash: bytesHashString(buf.toString("utf8")), mode: fileStat.mode & 511 };
 }
 async function readDesiredBytes(source) {
-  if (!source || !existsSync6(source)) return null;
+  if (!source || !existsSync7(source)) return null;
   const buf = await readFile3(source);
   return { bytes: buf, hash: bytesHashString(buf.toString("utf8")) };
 }
@@ -1233,6 +1860,34 @@ async function planFileInstall({ repoRoot, lock, allowUnowned = false, catalog =
   }
   return plan;
 }
+async function planStaleFileRemoval({ repoRoot, lock, staleCatalog }) {
+  if (!Array.isArray(staleCatalog) || staleCatalog.length === 0) return [];
+  const out = [];
+  for (const entry of staleCatalog) {
+    const targetPath = `${repoRoot}/${entry.path}`;
+    const current = await readBytes(targetPath);
+    if (!current) continue;
+    const locked = lookupLockedFile(lock, entry.path);
+    if (current.hash !== (locked?.sha256 ?? null)) {
+      out.push({
+        kind: "conflict",
+        op: "file",
+        target: targetPath,
+        relPath: entry.path,
+        reason: "stale profile asset is locally modified; refusing to remove"
+      });
+      continue;
+    }
+    out.push({
+      kind: "delete",
+      op: "file",
+      target: targetPath,
+      relPath: entry.path,
+      reason: "remove stale profile asset on profile transition"
+    });
+  }
+  return out;
+}
 async function planMigrationCleanup({ repoRoot, lock, migrationReport, allowUnowned = false }) {
   const action = migrationReport?.actions?.find((entry) => entry.kind === "candidate-remove-legacy-plugin-path");
   if (!action) return [];
@@ -1263,6 +1918,7 @@ async function planMigrationCleanup({ repoRoot, lock, migrationReport, allowUnow
 async function planUninstall({ repoRoot, lock }) {
   if (!lock) return [];
   const plan = [];
+  const activeProfile = lock?.manager?.profile ?? "core";
   for (const entry of lock.files ?? []) {
     const targetPath = `${repoRoot}/${entry.path}`;
     const current = await readBytes(targetPath);
@@ -1279,9 +1935,41 @@ async function planUninstall({ repoRoot, lock }) {
     }
     plan.push({ kind: "delete", op: "file", target: targetPath, relPath: entry.path });
   }
+  const rootPlan = await planRootReconciliation({
+    repoRoot,
+    profile: activeProfile,
+    mode: "uninstall",
+    previousRecords: (lock?.manager?.rootDocuments ?? []).flatMap((d) => d.pointers ?? [])
+  });
+  if (rootPlan?.kind === "conflict") {
+    plan.push({
+      op: "root-config",
+      kind: "conflict",
+      target: rootPlan.target,
+      relPath: rootPlan.relPath,
+      reason: rootPlan.reason
+    });
+  } else if (rootPlan && rootPlan.kind && rootPlan.kind !== "noop" && rootPlan.bytes) {
+    plan.push({
+      op: "file",
+      kind: "update",
+      target: rootPlan.target,
+      relPath: rootPlan.relPath,
+      bytes: rootPlan.bytes,
+      mode: 420,
+      reason: rootPlan.reason
+    });
+  }
+  plan.push({
+    kind: "delete",
+    op: "file",
+    target: `${repoRoot}/.opencode/ship.lock.json`,
+    relPath: ".opencode/ship.lock.json",
+    reason: "remove the install lock inside the transaction"
+  });
   return plan;
 }
-async function planConfigSynthesis({ repoRoot, detection, lock, forceOverwrite, migrationSeed = null }) {
+async function planConfigSynthesis({ repoRoot, detection, lock, forceOverwrite, migrationSeed = null, models = null }) {
   const existing = await loadConfig(repoRoot);
   if (existing?.ok && !forceOverwrite) {
     return {
@@ -1295,7 +1983,28 @@ async function planConfigSynthesis({ repoRoot, detection, lock, forceOverwrite,
       reason: "user config already present"
     };
   }
-  const desiredValue = migrationSeed ?? renderDefaultConfig(detection);
+  let desiredValue = migrationSeed ?? renderDefaultConfig(detection);
+  if (models && (models.planner || models.builder || models.finalReviewer)) {
+    const merged = {
+      ...desiredValue,
+      schemaVersion: 2,
+      profile: "engineering",
+      workflow: {
+        ...desiredValue.workflow ?? {},
+        models: {
+          planner: models.planner ?? desiredValue?.workflow?.models?.planner,
+          builder: models.builder ?? desiredValue?.workflow?.models?.builder,
+          finalReviewer: models.finalReviewer ?? desiredValue?.workflow?.models?.finalReviewer
+        },
+        approval: {
+          mirrorToIssue: true,
+          maxFailedRounds: 3,
+          ...desiredValue?.workflow?.approval ?? {}
+        }
+      }
+    };
+    desiredValue = merged;
+  }
   const desiredJson = JSON.stringify(desiredValue, null, 2) + "\n";
   const desiredSha = bytesHashString(desiredJson);
   const kind = existing?.ok && forceOverwrite ? "update" : "create";
@@ -1313,184 +2022,27 @@ async function planConfigSynthesis({ repoRoot, detection, lock, forceOverwrite,
   };
 }
 async function planRootConfigApply({ repoRoot, lock, forceRepair, planMode = null }) {
-  const detected = findRootConfig(repoRoot);
-  const target = detected.path ?? defaultRootConfigPath(repoRoot);
-  const previous = lock?.manager?.rootDocuments?.find((d) => d.path === detected.relative);
-  const fileMissing = !existsSync6(target);
-  if (fileMissing && !forceRepair) {
-    const seededRecords = previous?.pointers && previous.pointers.length > 0 ? previous.pointers : POINTER_ENTRIES.map((entry) => ({
-      pointer: entry.pointer,
-      strategy: entry.strategy,
-      installedSha256: bytesHashString(stableStringify(entry.value)),
-      previous: { existed: false }
-    }));
-    if (planMode) {
-      seededRecords.push({
-        pointer: planMode.id,
-        strategy: "value",
-        installedSha256: bytesHashString(stableStringify(planMode.block)),
-        previous: { existed: false }
-      });
-    }
-    return {
-      kind: "noop",
-      op: "root-config",
-      target,
-      relPath: detected.relative,
-      reason: "no root opencode.json present",
-      edits: [],
-      pointerRecords: seededRecords
-    };
-  }
-  if (fileMissing && forceRepair) {
-    const { synthesizeDefaultRootConfig: synthesizeDefaultRootConfig2, formatRootConfig: formatRootConfig3, applyPlanModeOwnership: applyPlanModeOwnership2 } = await Promise.resolve().then(() => (init_root_config(), root_config_exports));
-    let doc = synthesizeDefaultRootConfig2();
-    if (planMode) {
-      const applied = applyPlanModeOwnership2(doc, { block: planMode.block, pointer: planMode.id });
-      doc = applied.doc;
-    }
-    const bytes2 = Buffer.from(formatRootConfig3(doc), "utf8");
-    const newSha2 = bytesHashString(stableStringify(doc));
-    const installedPointers2 = POINTER_ENTRIES.map((entry) => ({
-      pointer: entry.pointer,
-      strategy: entry.strategy,
-      installedSha256: bytesHashString(stableStringify(entry.value)),
-      previous: { existed: false }
-    }));
-    if (planMode) {
-      installedPointers2.push({
-        pointer: planMode.id,
-        strategy: "value",
-        installedSha256: bytesHashString(stableStringify(planMode.block)),
-        previous: { existed: false }
-      });
-    }
-    return {
-      kind: "create",
-      op: "root-config",
-      target,
-      relPath: detected.relative,
-      bytes: bytes2,
-      desiredSha: newSha2,
-      currentSha: null,
-      edits: installedPointers2.map((p) => ({ kind: "create", pointer: p.pointer, value: "(synthesized)" })),
-      pointerRecords: installedPointers2,
-      format: "json",
-      document: doc,
-      reason: "creating root opencode.json with installer-owned Build permissions"
-    };
-  }
-  const docResult = readRootConfig(target);
-  if (!docResult.ok) {
-    return {
-      kind: "noop",
-      op: "root-config",
-      target,
-      relPath: detected.relative,
-      reason: `root config ${docResult.error.kind}`,
-      edits: [],
-      pointerRecords: previous?.pointers ?? []
-    };
-  }
-  const previousPointers = previous?.pointers ?? [];
-  const result = applyOwnedPointers(docResult.value, { allowEqualValues: true });
-  if (result.applied.length === 0 && result.skipped.every((s) => s.reason === "already equal")) {
-    const ownedPointers = previousPointers.length > 0 ? previousPointers : POINTER_ENTRIES.map((entry) => {
-      const existing = getPointer(docResult.value, entry.pointer);
-      return {
-        pointer: entry.pointer,
-        strategy: entry.strategy,
-        installedSha256: bytesHashString(stableStringify(existing ?? entry.value)),
-        previous: existing === void 0 ? { existed: false } : { existed: true, value: existing }
-      };
-    });
-    return {
-      kind: "noop",
-      op: "root-config",
-      target,
-      relPath: detected.relative,
-      reason: "no installer-owned entries missing",
-      edits: [],
-      pointerRecords: ownedPointers,
-      format: docResult.format,
-      document: docResult.value,
-      currentSha: docResult.sha256 ?? null,
-      desiredSha: docResult.sha256 ?? null
-    };
-  }
-  const edits = result.applied.map((a) => ({
-    kind: "create",
-    pointer: a.pointer,
-    value: a.value
-  }));
-  for (const s of result.skipped) {
-    if (s.reason === "already equal") continue;
-    edits.push({ kind: "conflict", pointer: s.pointer, reason: s.reason, existing: s.existing, desired: s.desired });
-  }
-  const { formatRootConfigPreserving: formatRootConfigPreserving2, formatRootConfig: formatRootConfig2 } = await Promise.resolve().then(() => (init_root_config(), root_config_exports));
-  const { parseRootConfigPreservingOrder: parseRootConfigPreservingOrder2 } = await Promise.resolve().then(() => (init_root_config(), root_config_exports));
-  const { setPointer: setPointer2 } = await Promise.resolve().then(() => (init_json_pointer(), json_pointer_exports));
-  let bytes;
-  let docForWrite = result.doc;
-  try {
-    const { value: sourceValue, format: sourceFormat } = parseRootConfigPreservingOrder2(docResult.raw ?? "");
-    docForWrite = sourceValue && typeof sourceValue === "object" ? sourceValue : result.doc;
-    for (const entry of result.applied) {
-      docForWrite = setPointer2(docForWrite, entry.pointer, entry.value);
-    }
-    bytes = Buffer.from(formatRootConfigPreserving2(docForWrite), "utf8");
-    void sourceFormat;
-  } catch {
-    bytes = Buffer.from(formatRootConfig2(result.doc), "utf8");
-  }
-  const newSha = bytesHashString(stableStringify(docForWrite));
-  const installedPointers = [...previousPointers];
-  for (const e of result.applied) {
-    const idx = installedPointers.findIndex((p) => p.pointer === e.pointer);
-    const previousEntry = docResult.before?.[e.pointer];
-    const next = {
-      pointer: e.pointer,
-      strategy: "value",
-      installedSha256: bytesHashString(stableStringify(e.value)),
-      previous: previousEntry == null ? { existed: false } : { existed: true, value: previousEntry }
-    };
-    if (idx >= 0) installedPointers[idx] = next;
-    else installedPointers.push(next);
-  }
-  for (const e of result.skipped) {
-    if (e.reason !== "already equal") continue;
-    const idx = installedPointers.findIndex((p) => p.pointer === e.pointer);
-    if (idx >= 0) continue;
-    installedPointers.push({
-      pointer: e.pointer,
-      strategy: "value",
-      installedSha256: bytesHashString(stableStringify(e.existing ?? null)),
-      previous: { existed: true, value: e.existing }
-    });
-  }
-  return {
-    kind: edits.some((e) => e.kind === "conflict") ? "conflict" : edits.length ? "update" : "noop",
-    op: "root-config",
-    target,
-    relPath: detected.relative,
-    bytes,
-    desiredSha: newSha,
-    currentSha: docResult.sha256 ?? null,
-    edits,
-    pointerRecords: installedPointers,
-    format: docResult.format,
-    document: docForWrite,
-    reason: edits.length === 0 ? "no installer-owned entries missing" : `apply ${result.applied.length} / skip ${result.skipped.length}`
-  };
+  const previous = (lock?.manager?.rootDocuments ?? []).flatMap((d) => d.pointers ?? []);
+  const previousProfile = lock?.manager?.profile ?? null;
+  const desiredProfile = planMode && planMode.scope === "engineering" ? "engineering" : "core";
+  const isTransition = previousProfile !== null && previousProfile !== desiredProfile;
+  const mode = previous.length === 0 ? "install" : isTransition ? "profile-transition" : "install";
+  return planRootReconciliation({
+    repoRoot,
+    profile: desiredProfile,
+    mode,
+    previousRecords: previous,
+    forceRepair: Boolean(forceRepair)
+  });
 }
 
 // src/installer/lock.js
 init_hash();
 init_json_pointer();
 import { readFile as readFile4, writeFile as writeFile2, rename as rename2, mkdir as mkdir2 } from "node:fs/promises";
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 import { dirname as dirname4, resolve as resolve6 } from "node:path";
-var CURRENT_LOCK_SCHEMA = 2;
+var CURRENT_LOCK_SCHEMA = 3;
 function lockPath(repoRoot) {
   return resolve6(repoRoot, ".opencode", "ship.lock.json");
 }
@@ -1510,8 +2062,8 @@ function validateLock(rawLock) {
   }
   const issues = [];
   let kind = "ok";
-  if (rawLock.contractVersion !== CURRENT_LOCK_SCHEMA && rawLock.contractVersion !== 1) {
-    issues.push(`unsupported contractVersion: ${JSON.stringify(rawLock.contractVersion)} (expected ${CURRENT_LOCK_SCHEMA} or 1)`);
+  if (rawLock.contractVersion !== CURRENT_LOCK_SCHEMA && rawLock.contractVersion !== 1 && rawLock.contractVersion !== 2) {
+    issues.push(`unsupported contractVersion: ${JSON.stringify(rawLock.contractVersion)} (expected ${CURRENT_LOCK_SCHEMA}, 2, or 1)`);
     kind = "schema";
   }
   const manager = rawLock.manager;
@@ -1521,13 +2073,13 @@ function validateLock(rawLock) {
   } else if (typeof manager !== "object" || manager === null) {
     issues.push("manager section must be an object");
     kind = kind === "ok" ? "shape" : kind;
-  } else if (manager.schemaVersion !== CURRENT_LOCK_SCHEMA && manager.schemaVersion !== 1) {
-    issues.push(`unsupported manager.schemaVersion: ${JSON.stringify(manager.schemaVersion)} (expected ${CURRENT_LOCK_SCHEMA} or 1)`);
+  } else if (manager.schemaVersion !== CURRENT_LOCK_SCHEMA && manager.schemaVersion !== 2 && manager.schemaVersion !== 1) {
+    issues.push(`unsupported manager.schemaVersion: ${JSON.stringify(manager.schemaVersion)} (expected ${CURRENT_LOCK_SCHEMA}, 2, or 1)`);
     kind = "schema";
   } else if (manager.name !== "opencode-ship") {
     issues.push(`unknown manager.name: ${JSON.stringify(manager.name)}`);
     kind = "shape";
-  } else if (rawLock.contractVersion === CURRENT_LOCK_SCHEMA && manager.schemaVersion === CURRENT_LOCK_SCHEMA && manager.profile !== void 0 && !isValidProfile(manager.profile)) {
+  } else if (rawLock.contractVersion >= 2 && manager.schemaVersion >= 2 && manager.profile !== void 0 && !isValidProfile(manager.profile)) {
     issues.push(`invalid manager.profile: ${JSON.stringify(manager.profile)} (expected one of: core, engineering)`);
     kind = "shape";
   }
@@ -1549,7 +2101,7 @@ function validateLock(rawLock) {
 }
 async function readValidatedLock(repoRoot) {
   const path = lockPath(repoRoot);
-  if (!existsSync7(path)) {
+  if (!existsSync8(path)) {
     return { kind: "missing", lock: null, issues: [] };
   }
   let raw;
@@ -1573,8 +2125,8 @@ init_json_pointer();
 
 // src/installer/detection/project.js
 import { spawnSync } from "node:child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync4 } from "node:fs";
-import { resolve as resolve7, join } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync4 } from "node:fs";
+import { resolve as resolve7, join as join2 } from "node:path";
 function runGit(cwd, args) {
   const r = spawnSync("git", ["-C", cwd, ...args], {
     stdio: ["ignore", "pipe", "pipe"],
@@ -1583,15 +2135,15 @@ function runGit(cwd, args) {
   return { status: r.status ?? -1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
 }
 function detectPackageManager(repoRoot) {
-  if (existsSync8(join(repoRoot, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync8(join(repoRoot, "yarn.lock"))) return "yarn";
-  if (existsSync8(join(repoRoot, "bun.lockb"))) return "bun";
-  if (existsSync8(join(repoRoot, "package-lock.json"))) return "npm";
+  if (existsSync9(join2(repoRoot, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync9(join2(repoRoot, "yarn.lock"))) return "yarn";
+  if (existsSync9(join2(repoRoot, "bun.lockb"))) return "bun";
+  if (existsSync9(join2(repoRoot, "package-lock.json"))) return "npm";
   return null;
 }
 function readPackageJson(repoRoot) {
-  const path = join(repoRoot, "package.json");
-  if (!existsSync8(path)) return null;
+  const path = join2(repoRoot, "package.json");
+  if (!existsSync9(path)) return null;
   try {
     return JSON.parse(readFileSync4(path, "utf8"));
   } catch {
@@ -1719,34 +2271,130 @@ init_root_config();
 
 // src/installer/transaction.js
 import {
-  writeFile as writeFile3,
-  rename as rename3,
-  readFile as readFile5,
-  unlink,
-  mkdir as mkdir3,
-  stat as stat2,
+  writeFile as writeFile4,
+  rename as rename4,
+  readFile as readFile6,
+  unlink as unlink2,
+  mkdir as mkdir4,
+  stat as stat3,
   open
 } from "node:fs/promises";
-import { existsSync as existsSync9 } from "node:fs";
-import { dirname as dirname5, resolve as resolve8 } from "node:path";
-import { spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync11 } from "node:fs";
+import { dirname as dirname6, resolve as resolve10, join as join5 } from "node:path";
 init_hash();
-function gitDir(repoRoot) {
-  const r = spawnSync2("git", ["-C", repoRoot, "rev-parse", "--path-format=absolute", "--git-dir"], {
-    encoding: "utf8"
+
+// src/state/git-common-dir.js
+import { spawn } from "node:child_process";
+import { resolve as resolve8, join as join3 } from "node:path";
+var STATE_DIRNAME = "opencode-ship";
+async function resolveGitCommonDir(repoRoot) {
+  if (typeof repoRoot !== "string" || repoRoot.length === 0) {
+    throw new Error("resolveGitCommonDir: repoRoot must be a non-empty string");
+  }
+  return new Promise((resolveP, reject) => {
+    const proc = spawn(
+      "git",
+      ["-C", repoRoot, "rev-parse", "--path-format=absolute", "--git-common-dir"],
+      { stdio: ["ignore", "pipe", "pipe"], shell: false }
+    );
+    let out = "";
+    let err = "";
+    proc.stdout.on("data", (d) => {
+      out += d.toString("utf8");
+    });
+    proc.stderr.on("data", (d) => {
+      err += d.toString("utf8");
+    });
+    proc.on("error", reject);
+    proc.on("close", (code) => {
+      if (code !== 0) {
+        reject(new Error(
+          `git rev-parse --git-common-dir failed (exit ${code}): ${err.trim() || "unknown error"}`
+        ));
+        return;
+      }
+      const trimmed = out.trim();
+      if (!trimmed) {
+        reject(new Error("git rev-parse --git-common-dir returned an empty path"));
+        return;
+      }
+      resolveP(resolve8(repoRoot, trimmed));
+    });
   });
-  if (r.status !== 0) return null;
-  const trimmed = r.stdout.trim();
-  return trimmed ? resolve8(repoRoot, trimmed) : null;
 }
-function lockDir(repoRoot) {
-  return resolve8(gitDir(repoRoot) ?? repoRoot, "opencode-ship");
+function opencodeShipStateDir(commonDir, ...segments) {
+  if (typeof commonDir !== "string" || commonDir.length === 0) {
+    throw new Error("opencodeShipStateDir: commonDir must be a non-empty string");
+  }
+  return join3(commonDir, STATE_DIRNAME, ...segments);
 }
-function transactionLockPath(repoRoot) {
-  return resolve8(lockDir(repoRoot), ".txn.lock");
+
+// src/state/durable-store.js
+import {
+  open as fsOpen,
+  writeFile as writeFile3,
+  readFile as readFile5,
+  rename as rename3,
+  link,
+  mkdir as mkdir3,
+  readdir,
+  unlink,
+  stat as stat2
+} from "node:fs/promises";
+import { existsSync as existsSync10 } from "node:fs";
+import { dirname as dirname5, join as join4, resolve as resolve9 } from "node:path";
+import { createHash as createHash2, randomBytes } from "node:crypto";
+import { hostname as osHostname } from "node:os";
+var STALE_LOCK_MS = 120 * 1e3;
+function randomToken() {
+  return randomBytes(8).toString("hex");
 }
-function journalPath(repoRoot, txnId) {
-  return resolve8(lockDir(repoRoot), `.txn-${txnId}.journal`);
+function ensureString(value) {
+  return JSON.stringify(value, null, 2) + "\n";
+}
+async function fsyncDir(path) {
+  try {
+    const handle = await fsOpen(path, "r");
+    try {
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+  } catch {
+  }
+}
+async function atomicReplaceJson(path, value) {
+  if (typeof path !== "string" || path.length === 0) {
+    throw new Error("atomicReplaceJson: path must be a non-empty string");
+  }
+  const target = resolve9(path);
+  const parent = dirname5(target);
+  await mkdir3(parent, { recursive: true });
+  const tmp = `${target}.${randomToken()}.tmp`;
+  const handle = await fsOpen(tmp, "w", 384);
+  try {
+    await handle.writeFile(ensureString(value), "utf8");
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+  await rename3(tmp, target);
+  await fsyncDir(parent);
+}
+
+// src/installer/transaction.js
+function lockDirFromCommonDir(commonDir) {
+  return opencodeShipStateDir(commonDir);
+}
+async function lockDirForRepo(repoRoot) {
+  const commonDir = await resolveGitCommonDir(repoRoot);
+  return lockDirFromCommonDir(commonDir);
+}
+function transactionLockPath(lockDir) {
+  return resolve10(lockDir, ".txn.lock");
+}
+function journalPath(lockDir, txnId) {
+  return resolve10(lockDir, `.txn-${txnId}.journal`);
 }
 function backupPath(target, token) {
   return `${target}.txn-${token}-backup`;
@@ -1755,46 +2403,35 @@ function stagedPath(target, token) {
   return `${target}.txn-${token}-staged`;
 }
 async function mkdirp(path) {
-  await mkdir3(path, { recursive: true });
+  await mkdir4(path, { recursive: true });
 }
-async function acquireLock(repoRoot, txnId) {
-  const dir = lockDir(repoRoot);
-  const path = transactionLockPath(repoRoot);
-  await mkdirp(dir);
-  let created = false;
+async function acquireLock(lockDir, txnId) {
+  await mkdirp(lockDir);
+  const path = transactionLockPath(lockDir);
+  const handle = await open(path, "wx", 384);
   try {
-    const handle = await open(path, "wx", 384);
-    created = true;
-    try {
-      await handle.writeFile(JSON.stringify({
-        pid: process.pid,
-        txnId,
-        startedAt: (/* @__PURE__ */ new Date()).toISOString()
-      }));
-      await handle.sync();
-    } finally {
-      await handle.close();
-    }
-    await fsyncDir(dir);
-  } catch (error) {
-    if (created) {
-      await unlink(path).catch(() => null);
-      await fsyncDir(dir);
-    }
-    throw error;
+    await handle.writeFile(JSON.stringify({
+      pid: process.pid,
+      txnId,
+      startedAt: (/* @__PURE__ */ new Date()).toISOString()
+    }));
+    await handle.sync();
+  } finally {
+    await handle.close();
   }
+  await fsyncDir2(lockDir);
 }
-async function releaseLock(repoRoot) {
+async function releaseLock(lockDir) {
   try {
-    await unlink(transactionLockPath(repoRoot));
+    await unlink2(transactionLockPath(lockDir));
   } catch {
   }
 }
-async function liveLockOwner(repoRoot) {
-  const path = transactionLockPath(repoRoot);
-  if (!existsSync9(path)) return false;
+async function liveLockOwner(lockDir) {
+  const path = transactionLockPath(lockDir);
+  if (!existsSync11(path)) return false;
   try {
-    const lock = JSON.parse(await readFile5(path, "utf8"));
+    const lock = JSON.parse(await readFile6(path, "utf8"));
     if (!Number.isInteger(lock?.pid) || lock.pid <= 0) return false;
     process.kill(lock.pid, 0);
     return true;
@@ -1802,7 +2439,7 @@ async function liveLockOwner(repoRoot) {
     return error?.code === "EPERM";
   }
 }
-async function fsyncDir(path) {
+async function fsyncDir2(path) {
   try {
     const handle = await open(path, "r");
     await handle.sync();
@@ -1810,13 +2447,13 @@ async function fsyncDir(path) {
   } catch {
   }
 }
-function randomToken() {
+function randomToken2() {
   return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
 }
 function asMode(mode) {
   return typeof mode === "number" ? mode : 420;
 }
-async function writeJournal(repoRoot, txnId, journal) {
+async function writeJournal(lockDir, txnId, journal) {
   const { entries, ...header } = journal;
   const json = { ...header, ledger: entries.map((entry) => ({
     op: entry.op,
@@ -1828,62 +2465,63 @@ async function writeJournal(repoRoot, txnId, journal) {
     installedSha256: entry.installedSha256 ?? null,
     mode: entry.mode ?? null
   })) };
-  const target = journalPath(repoRoot, txnId);
-  const staged = `${target}.tmp`;
-  const handle = await open(staged, "w", 384);
-  try {
-    await handle.writeFile(JSON.stringify(json, null, 2), "utf8");
-    await handle.sync();
-  } finally {
-    await handle.close();
-  }
-  await rename3(staged, target);
-  await fsyncDir(dirname5(target));
+  await atomicReplaceJson(journalPath(lockDir, txnId), json);
 }
-async function clearJournal(repoRoot, txnId) {
+async function clearJournal(lockDir, txnId) {
   if (!txnId) return;
   try {
-    await unlink(journalPath(repoRoot, txnId));
+    await unlink2(journalPath(lockDir, txnId));
   } catch {
   }
 }
-async function readJournal(repoRoot, name) {
-  const path = resolve8(lockDir(repoRoot), name);
+async function readJournal(lockDir, name) {
+  const path = resolve10(lockDir, name);
+  let raw;
   try {
-    const raw = await readFile5(path, "utf8");
-    return JSON.parse(raw);
-  } catch {
-    return null;
+    raw = await readFile6(path, "utf8");
+  } catch (err) {
+    throw new Error(`transaction journal unreadable: ${path}: ${err?.message ?? err}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`transaction journal malformed JSON: ${path}: ${err?.message ?? err}`);
   }
+  if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.ledger)) {
+    throw new Error(`transaction journal missing ledger: ${path}`);
+  }
+  return parsed;
 }
 async function isCommitted(journal) {
   if (journal.committed) return true;
   const marker = journal.ledger?.find((entry) => entry.commitMarker);
-  if (!marker?.target || !marker.installedSha256 || !existsSync9(marker.target)) return false;
+  if (!marker?.target || !marker.installedSha256 || !existsSync11(marker.target)) return false;
   try {
-    return bytesHashString(await readFile5(marker.target, "utf8")) === marker.installedSha256;
+    return bytesHashString(await readFile6(marker.target, "utf8")) === marker.installedSha256;
   } catch {
     return false;
   }
 }
 async function restoreEntry(entry) {
   if (entry.op === "write") {
-    if (entry.backup && existsSync9(entry.backup)) {
-      await rename3(entry.backup, entry.target);
-    } else if (entry.hadOriginal === false && existsSync9(entry.target)) {
-      await unlink(entry.target);
+    if (entry.backup && existsSync11(entry.backup)) {
+      await rename4(entry.backup, entry.target);
+    } else if (entry.hadOriginal === false && existsSync11(entry.target)) {
+      await unlink2(entry.target);
     }
-    if (entry.staged && existsSync9(entry.staged)) await unlink(entry.staged);
-  } else if (entry.op === "delete" && entry.backup && existsSync9(entry.backup)) {
-    await rename3(entry.backup, entry.target);
+    if (entry.staged && existsSync11(entry.staged)) await unlink2(entry.staged);
+  } else if (entry.op === "delete" && entry.backup && existsSync11(entry.backup)) {
+    await rename4(entry.backup, entry.target);
   }
-  await fsyncDir(dirname5(entry.target));
+  await fsyncDir2(dirname6(entry.target));
 }
-async function recoverJournal(repoRoot, dir, name) {
-  const journal = await readJournal(repoRoot, name);
-  if (!journal) {
-    await unlink(resolve8(dir, name)).catch(() => null);
-    return true;
+async function recoverJournal(lockDir, name) {
+  let journal;
+  try {
+    journal = await readJournal(lockDir, name);
+  } catch (err) {
+    return { ok: false, error: err };
   }
   const committed = await isCommitted(journal);
   const entries = committed ? journal.ledger ?? [] : [...journal.ledger ?? []].reverse();
@@ -1896,72 +2534,79 @@ async function recoverJournal(repoRoot, dir, name) {
       complete = false;
     }
   }
-  if (complete) await unlink(resolve8(dir, name)).catch(() => null);
-  return complete;
+  if (complete) await unlink2(resolve10(lockDir, name)).catch(() => null);
+  return { ok: complete };
 }
-async function recover(repoRoot) {
-  const dir = lockDir(repoRoot);
-  if (!existsSync9(dir)) return { recovered: false, recoveredCount: 0 };
-  if (await liveLockOwner(repoRoot)) {
+async function recover(repoRoot, lockDir) {
+  if (!existsSync11(lockDir)) return { recovered: false, recoveredCount: 0 };
+  if (await liveLockOwner(lockDir)) {
     return { recovered: false, recoveredCount: 0, blocked: true };
   }
-  const { readdir } = await import("node:fs/promises");
-  const names = await readdir(dir).catch(() => []);
+  const { readdir: readdir2 } = await import("node:fs/promises");
+  const names = await readdir2(lockDir).catch(() => []);
   const journals = names.filter((n) => n.startsWith(".txn-") && n.endsWith(".journal"));
   if (!journals.length) {
-    await releaseLock(repoRoot);
+    await releaseLock(lockDir);
     return { recovered: false, recoveredCount: 0 };
   }
   let totalRecovered = 0;
   let recoveryFailed = false;
+  let recoveryError = null;
   for (const name of journals) {
-    if (await recoverJournal(repoRoot, dir, name)) totalRecovered += 1;
-    else recoveryFailed = true;
+    const result = await recoverJournal(lockDir, name);
+    if (!result.ok) {
+      recoveryFailed = true;
+      if (result.error) recoveryError = result.error.message ?? String(result.error);
+    } else {
+      totalRecovered += 1;
+    }
   }
-  await releaseLock(repoRoot);
+  await releaseLock(lockDir);
   return {
     recovered: totalRecovered > 0,
     recoveredCount: totalRecovered,
     blocked: recoveryFailed,
-    reason: recoveryFailed ? "recovery-failed" : null
+    reason: recoveryFailed ? "recovery-failed" : null,
+    recoveryError
   };
 }
 async function commitEntry(entry) {
   let changed = false;
-  if (entry.backup && existsSync9(entry.backup)) {
-    await unlink(entry.backup);
+  if (entry.backup && existsSync11(entry.backup)) {
+    await unlink2(entry.backup);
     changed = true;
   }
-  if (entry.staged && existsSync9(entry.staged)) {
-    await unlink(entry.staged);
+  if (entry.staged && existsSync11(entry.staged)) {
+    await unlink2(entry.staged);
     changed = true;
   }
-  if (changed) await fsyncDir(dirname5(entry.target));
+  if (changed) await fsyncDir2(dirname6(entry.target));
 }
 async function executePlan({ repoRoot, plan, newLockBuilder }) {
-  const recovered = await recover(repoRoot);
+  const lockDir = await lockDirForRepo(repoRoot);
+  const recovered = await recover(repoRoot, lockDir);
   if (recovered.blocked) {
     const kind = recovered.reason ?? "lock-held";
-    const message = kind === "lock-held" ? "another opencode-ship transaction is active" : "a previous opencode-ship transaction could not be recovered";
+    const message = kind === "lock-held" ? "another opencode-ship transaction is active" : `a previous opencode-ship transaction could not be recovered: ${recovered.recoveryError ?? "unknown error"}`;
     return { ok: false, error: { kind, message } };
   }
   const txnId = `txn-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`;
   try {
-    await acquireLock(repoRoot, txnId);
+    await acquireLock(lockDir, txnId);
   } catch (e) {
     return { ok: false, error: { kind: "lock-held", message: e?.message ?? String(e) } };
   }
   const journal = { repoRoot, txnId, startedAt: (/* @__PURE__ */ new Date()).toISOString(), entries: [] };
   try {
-    await writeJournal(repoRoot, txnId, journal);
+    await writeJournal(lockDir, txnId, journal);
     for (const op of plan) {
       if (op.op !== "file") continue;
       if (op.kind === "conflict" || op.kind === "noop" || op.kind === "converge") continue;
-      const token = randomToken();
+      const token = randomToken2();
       const backup = backupPath(op.target, token);
       const staged = stagedPath(op.target, token);
       if (op.kind === "delete") {
-        if (!existsSync9(op.target)) continue;
+        if (!existsSync11(op.target)) continue;
         journal.entries.push({
           op: "delete",
           target: op.target,
@@ -1970,11 +2615,11 @@ async function executePlan({ repoRoot, plan, newLockBuilder }) {
           hadOriginal: true,
           mode: asMode(op.mode)
         });
-        await writeJournal(repoRoot, txnId, journal);
-        await rename3(op.target, backup);
+        await writeJournal(lockDir, txnId, journal);
+        await rename4(op.target, backup);
       } else {
-        await mkdirp(dirname5(op.target));
-        const hadOriginal = existsSync9(op.target);
+        await mkdirp(dirname6(op.target));
+        const hadOriginal = existsSync11(op.target);
         journal.entries.push({
           op: "write",
           target: op.target,
@@ -1983,24 +2628,24 @@ async function executePlan({ repoRoot, plan, newLockBuilder }) {
           hadOriginal,
           mode: asMode(op.mode)
         });
-        await writeJournal(repoRoot, txnId, journal);
-        await writeFile3(staged, op.bytes ?? Buffer.alloc(0), { mode: asMode(op.mode) });
+        await writeJournal(lockDir, txnId, journal);
+        await writeFile4(staged, op.bytes ?? Buffer.alloc(0), { mode: asMode(op.mode) });
         const h = await open(staged, "r+");
         await h.sync();
         await h.close();
-        if (hadOriginal) await rename3(op.target, backup);
-        await rename3(staged, op.target);
+        if (hadOriginal) await rename4(op.target, backup);
+        await rename4(staged, op.target);
       }
-      await fsyncDir(dirname5(op.target));
+      await fsyncDir2(dirname6(op.target));
     }
     if (newLockBuilder) {
       const lockValue = await newLockBuilder();
       const lockPathTarget = `${repoRoot}/.opencode/ship.lock.json`;
-      await mkdirp(dirname5(lockPathTarget));
-      const token = randomToken();
+      await mkdirp(dirname6(lockPathTarget));
+      const token = randomToken2();
       const backup = backupPath(lockPathTarget, token);
       const staged = stagedPath(lockPathTarget, token);
-      const hadOriginal = existsSync9(lockPathTarget);
+      const hadOriginal = existsSync11(lockPathTarget);
       const finalLock = { ...lockValue, integrity: computeIntegrity(lockValue) };
       const lockBytes = JSON.stringify(finalLock, null, 2) + "\n";
       journal.entries.push({
@@ -2013,17 +2658,17 @@ async function executePlan({ repoRoot, plan, newLockBuilder }) {
         installedSha256: bytesHashString(lockBytes),
         mode: 420
       });
-      await writeJournal(repoRoot, txnId, journal);
-      await writeFile3(staged, lockBytes, { mode: 420 });
+      await writeJournal(lockDir, txnId, journal);
+      await writeFile4(staged, lockBytes, { mode: 420 });
       const handle = await open(staged, "r+");
       await handle.sync();
       await handle.close();
-      if (hadOriginal) await rename3(lockPathTarget, backup);
-      await rename3(staged, lockPathTarget);
-      await fsyncDir(dirname5(lockPathTarget));
+      if (hadOriginal) await rename4(lockPathTarget, backup);
+      await rename4(staged, lockPathTarget);
+      await fsyncDir2(dirname6(lockPathTarget));
     }
     journal.committed = true;
-    await writeJournal(repoRoot, txnId, journal);
+    await writeJournal(lockDir, txnId, journal);
     let cleanupComplete = true;
     for (const entry of journal.entries) {
       try {
@@ -2032,7 +2677,7 @@ async function executePlan({ repoRoot, plan, newLockBuilder }) {
         cleanupComplete = false;
       }
     }
-    if (cleanupComplete) await clearJournal(repoRoot, txnId);
+    if (cleanupComplete) await clearJournal(lockDir, txnId);
     return {
       ok: true,
       txnId,
@@ -2041,13 +2686,13 @@ async function executePlan({ repoRoot, plan, newLockBuilder }) {
       cleanupPending: !cleanupComplete
     };
   } catch (e) {
-    await rollback(repoRoot, journal);
+    await rollback(lockDir, journal);
     return { ok: false, error: { kind: "transaction-failed", message: e?.message ?? String(e) } };
   } finally {
-    await releaseLock(repoRoot);
+    await releaseLock(lockDir);
   }
 }
-async function rollback(repoRoot, journal) {
+async function rollback(lockDir, journal) {
   const entries = journal.entries ?? journal.ledger ?? [];
   let complete = true;
   for (const entry of [...entries].reverse()) {
@@ -2057,21 +2702,21 @@ async function rollback(repoRoot, journal) {
       complete = false;
     }
   }
-  if (complete && journal.txnId) await clearJournal(repoRoot, journal.txnId);
+  if (complete && journal.txnId) await clearJournal(lockDir, journal.txnId);
 }
 
 // src/installer/migration.js
-import { readFile as readFile6 } from "node:fs/promises";
-import { existsSync as existsSync10 } from "node:fs";
-import { resolve as resolve9 } from "node:path";
+import { readFile as readFile7 } from "node:fs/promises";
+import { existsSync as existsSync12 } from "node:fs";
+import { resolve as resolve11 } from "node:path";
 function legacyAdapterPath(repoRoot) {
-  return resolve9(repoRoot, ".opencode", "delivery.json");
+  return resolve11(repoRoot, ".opencode", "delivery.json");
 }
 function legacyLockPath(repoRoot) {
-  return resolve9(repoRoot, ".opencode", "delivery.lock.json");
+  return resolve11(repoRoot, ".opencode", "delivery.lock.json");
 }
 function legacyPluginPath(repoRoot) {
-  return resolve9(repoRoot, ".opencode", "plugin", "delivery.ts");
+  return resolve11(repoRoot, ".opencode", "plugin", "delivery.ts");
 }
 async function detectLegacyShapes(repoRoot) {
   const out = {
@@ -2082,19 +2727,19 @@ async function detectLegacyShapes(repoRoot) {
     reviewer: false,
     verifier: false
   };
-  if (existsSync10(legacyAdapterPath(repoRoot))) out.adapter = true;
-  if (existsSync10(legacyLockPath(repoRoot))) out.legacyLock = true;
-  if (existsSync10(legacyPluginPath(repoRoot))) out.plugin = true;
-  if (existsSync10(resolve9(repoRoot, ".opencode/plugin/opencode-ship.js"))) out.pluginOld = true;
-  if (existsSync10(resolve9(repoRoot, ".opencode/agents/delivery-reviewer.md"))) out.reviewer = true;
-  if (existsSync10(resolve9(repoRoot, ".opencode/agents/delivery-verifier.md"))) out.verifier = true;
+  if (existsSync12(legacyAdapterPath(repoRoot))) out.adapter = true;
+  if (existsSync12(legacyLockPath(repoRoot))) out.legacyLock = true;
+  if (existsSync12(legacyPluginPath(repoRoot))) out.plugin = true;
+  if (existsSync12(resolve11(repoRoot, ".opencode/plugin/opencode-ship.js"))) out.pluginOld = true;
+  if (existsSync12(resolve11(repoRoot, ".opencode/agents/delivery-reviewer.md"))) out.reviewer = true;
+  if (existsSync12(resolve11(repoRoot, ".opencode/agents/delivery-verifier.md"))) out.verifier = true;
   return out;
 }
 async function readLegacyAdapter(repoRoot) {
   const path = legacyAdapterPath(repoRoot);
-  if (!existsSync10(path)) return null;
+  if (!existsSync12(path)) return null;
   try {
-    const raw = await readFile6(path, "utf8");
+    const raw = await readFile7(path, "utf8");
     return { path, raw, value: JSON.parse(raw) };
   } catch {
     return null;
@@ -2113,13 +2758,13 @@ async function migration({ repoRoot, lock, forceRepair, detection = null }) {
   if (legacy && shapes.legacyLock && !lock?.manager) {
     actions.push({ kind: "kept-legacy-lock", path: legacyLockPath(repoRoot) });
   }
-  if (shapes.plugin && existsSync10(resolve9(repoRoot, ".opencode/plugins/opencode-ship.js"))) {
+  if (shapes.plugin && existsSync12(resolve11(repoRoot, ".opencode/plugins/opencode-ship.js"))) {
     if (!forceRepair) {
       actions.push({ kind: "candidate-remove-legacy-plugin", path: legacyPluginPath(repoRoot) });
     }
   }
   if (shapes.pluginOld) {
-    actions.push({ kind: "candidate-remove-legacy-plugin-path", path: resolve9(repoRoot, ".opencode/plugin/opencode-ship.js") });
+    actions.push({ kind: "candidate-remove-legacy-plugin-path", path: resolve11(repoRoot, ".opencode/plugin/opencode-ship.js") });
   }
   return { shapes, actions, legacyPresent: Boolean(legacy), proposedConfigSeed };
 }
@@ -2163,11 +2808,11 @@ function legacyToShipConfig(legacy, detection = null) {
 // src/installer/executor.js
 init_plan_mode_permissions();
 async function readCurrentBytes(targetPath) {
-  if (!existsSync11(targetPath)) return null;
-  const buf = await readFile7(targetPath);
+  if (!existsSync13(targetPath)) return null;
+  const buf = await readFile8(targetPath);
   return { bytes: buf, hash: bytesHashString(buf.toString("utf8")) };
 }
-async function previewInstall({ rootPath, profile = null, replaceManaged, forceConfig, forceRootConfig }) {
+async function previewInstall({ rootPath, profile = null, replaceManaged, forceConfig, forceRootConfig, models = null }) {
   const detection = detectProject(rootPath ?? process.cwd());
   if (detection.errors.some((e) => e.kind === "not-a-git-repo")) {
     return { ok: false, error: { kind: "invalid-project", errors: detection.errors } };
@@ -2189,7 +2834,33 @@ async function previewInstall({ rootPath, profile = null, replaceManaged, forceC
     config: configValue,
     lock
   });
+  if (resolved.profile === "engineering") {
+    const candidate = await planConfigSynthesis({
+      repoRoot,
+      detection,
+      lock,
+      forceOverwrite: Boolean(forceConfig),
+      migrationSeed: migrationReport?.proposedConfigSeed ?? null,
+      models
+    });
+    if (candidate.kind === "create" || candidate.kind === "update") {
+      const configValue2 = candidate.configValue;
+      if (!configValue2.workflow || !configValue2.workflow.models) {
+        return { ok: false, error: { kind: "engineering-models-required", message: "engineering profile requires workflow.models.{planner,builder,finalReviewer}" } };
+      }
+      const { planner, builder, finalReviewer } = configValue2.workflow.models;
+      if (!planner || !builder || !finalReviewer) {
+        return { ok: false, error: { kind: "engineering-models-required", message: "all three workflow.models.* are required" } };
+      }
+      if (!configValue2.workflow.approval || !configValue2.workflow.approval.mirrorToIssue || configValue2.workflow.approval.maxFailedRounds !== 3) {
+        return { ok: false, error: { kind: "engineering-approval-required", message: "engineering profile requires workflow.approval.{mirrorToIssue:true, maxFailedRounds:3}" } };
+      }
+    }
+  }
+  const previousProfile = lock?.manager?.profile ?? null;
+  const isProfileTransition = previousProfile && previousProfile !== resolved.profile;
   const activeCatalog = filterCatalogByProfile(CATALOG, resolved.profile);
+  const staleCatalog = isProfileTransition ? filterCatalogByProfile(CATALOG, previousProfile).filter((e) => !activeCatalog.includes(e)) : [];
   const configPlan = await planConfigSynthesis({
     repoRoot,
     detection,
@@ -2198,15 +2869,16 @@ async function previewInstall({ rootPath, profile = null, replaceManaged, forceC
     migrationSeed: migrationReport?.proposedConfigSeed ?? null
   });
   const filePlan = await planFileInstall({ repoRoot, lock, allowUnowned: Boolean(replaceManaged), catalog: activeCatalog });
+  const staleFilePlan = await planStaleFileRemoval({ repoRoot, lock, staleCatalog });
   const migrationPlan = await planMigrationCleanup({
     repoRoot,
     lock,
     migrationReport,
     allowUnowned: Boolean(replaceManaged)
   });
-  const planMode = resolved.profile === "engineering" ? { id: "/agent/plan/permission", block: planModePermissions().build } : null;
+  const planMode = resolved.profile === "engineering" ? { id: "/agent/plan/permission", block: planModePermissions().build, scope: "engineering" } : null;
   const rootPlan = await planRootConfigApply({ repoRoot, lock, forceRepair: Boolean(forceRootConfig), planMode });
-  const plan = [...filePlan ?? [], ...migrationPlan, configPlan, rootPlan];
+  const plan = [...filePlan ?? [], ...staleFilePlan, ...migrationPlan, configPlan, rootPlan];
   const conflicts = plan.filter((p) => p && p.kind === "conflict");
   const summary = summarise(plan);
   return {
@@ -2215,6 +2887,8 @@ async function previewInstall({ rootPath, profile = null, replaceManaged, forceC
     detection,
     lock,
     profile: resolved,
+    previousProfile,
+    isProfileTransition,
     plan,
     conflicts,
     summary,
@@ -2286,7 +2960,7 @@ async function assembleLock({ repoRoot, plan, lock, configPlan, rootPlan, profil
     manager: {
       schemaVersion: CURRENT_LOCK_SCHEMA,
       name: "opencode-ship",
-      version: "0.9.0",
+      version: "0.10.0-rc.18",
       templateSet: TEMPLATE_SET_ID,
       // Newly written locks always carry the resolved profile so
       // future CLI invocations without --profile still resolve to
@@ -2434,10 +3108,10 @@ function relativeTemplate(source) {
 }
 
 // src/installer/commands/doctor.js
-import { existsSync as existsSync12, readFileSync as readFileSync5 } from "node:fs";
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { existsSync as existsSync14, readFileSync as readFileSync5 } from "node:fs";
+import { spawnSync as spawnSync2 } from "node:child_process";
 init_hash();
-import { resolve as resolve11 } from "node:path";
+import { resolve as resolve13 } from "node:path";
 init_root_config();
 
 // src/installer/report.js
@@ -2492,11 +3166,11 @@ function checkNode() {
   return { name: "node>=22.6.0", ok: /^v2[2-9]/.test(process.version), detail: process.version };
 }
 function checkGit() {
-  const r = spawnSync3("git", ["--version"], { encoding: "utf8" });
+  const r = spawnSync2("git", ["--version"], { encoding: "utf8" });
   return { name: "git installed", ok: r.status === 0, detail: r.status === 0 ? r.stdout.trim() : "git not on PATH" };
 }
 function checkGh() {
-  const r = spawnSync3("gh", ["--version"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+  const r = spawnSync2("gh", ["--version"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   return { name: "gh installed", ok: r.status === 0, detail: r.status === 0 ? r.stdout.trim() : "gh CLI not on PATH" };
 }
 function checkGhAuth() {
@@ -2504,7 +3178,7 @@ function checkGhAuth() {
   if (!envToken) {
     return { name: "gh auth status", ok: false, detail: "no GH_TOKEN / GITHUB_TOKEN in environment; gh auth skipped" };
   }
-  const r = spawnSync3("gh", ["auth", "status"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+  const r = spawnSync2("gh", ["auth", "status"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   return {
     name: "gh auth status",
     ok: r.status === 0,
@@ -2526,7 +3200,7 @@ function checkPackageIntegrity() {
 function buildSourceHashIndex() {
   const idx = /* @__PURE__ */ new Map();
   for (const entry of CATALOG) {
-    if (!existsSync12(entry.source)) continue;
+    if (!existsSync14(entry.source)) continue;
     try {
       const buf = readFileSync5(entry.source, "utf8");
       idx.set(entry.source, bytesHashString(buf));
@@ -2535,11 +3209,12 @@ function buildSourceHashIndex() {
   }
   return idx;
 }
-function checkCatalogInstall(repoRoot, sourceHashes) {
+function checkCatalogInstall(repoRoot, sourceHashes, profile) {
   const rows = [];
-  for (const entry of CATALOG) {
-    const target = resolve11(repoRoot, entry.path);
-    if (!existsSync12(target)) {
+  const scoped = profile ? filterCatalogByProfile(CATALOG, profile) : CATALOG;
+  for (const entry of scoped) {
+    const target = resolve13(repoRoot, entry.path);
+    if (!existsSync14(target)) {
       rows.push(`${entry.id}: missing`);
       continue;
     }
@@ -2558,7 +3233,7 @@ function checkCatalogInstall(repoRoot, sourceHashes) {
   }
   const allOk = rows.length === 0 || rows.every((r) => r.endsWith("ok"));
   return {
-    name: "catalog assets present",
+    name: `catalog assets present (${profile ?? "core"})`,
     ok: allOk,
     detail: rows.join(",")
   };
@@ -2598,8 +3273,8 @@ async function checkManagedHashes(repoRoot, validatedLock) {
   }
   const drift = [];
   for (const entry of validatedLock.lock.files ?? []) {
-    const p = resolve11(repoRoot, entry.path);
-    if (!existsSync12(p)) {
+    const p = resolve13(repoRoot, entry.path);
+    if (!existsSync14(p)) {
       drift.push(`missing:${entry.path}`);
       continue;
     }
@@ -2683,7 +3358,7 @@ async function runDoctor({ rootPath, profile, json, writeOutput = true }) {
     checkGh(),
     checkGhAuth(),
     packageIntegrity,
-    checkCatalogInstall(repoRoot, sourceHashes),
+    checkCatalogInstall(repoRoot, sourceHashes, resolved.profile),
     await checkLock(repoRoot),
     await checkConfig(repoRoot),
     await checkManagedHashes(repoRoot, validatedLock),
@@ -2723,12 +3398,19 @@ async function runInit(options) {
     profile: options.profile ?? null,
     replaceManaged: false,
     forceConfig: Boolean(options.forceConfig),
-    forceRootConfig: Boolean(options.forceRootConfig)
+    forceRootConfig: Boolean(options.forceRootConfig),
+    models: options.models ?? null
   });
   if (!preview.ok) {
     if (preview.error?.kind === "unsupported-lock-schema") {
       return emitFailure(5, `unsupported lock schema: ${(preview.error.issues ?? []).join("; ")}`, options.json, "init");
     }
+    if (preview.error?.kind === "engineering-models-required") {
+      return emitFailure(2, preview.error.message, options.json, "init");
+    }
+    if (preview.error?.kind === "engineering-approval-required") {
+      return emitFailure(2, preview.error.message, options.json, "init");
+    }
     if (preview.error?.kind === "lock-invalid") {
       return emitFailure(3, `lock invalid: ${(preview.error.issues ?? []).join("; ")}`, options.json, "init");
     }
@@ -2895,7 +3577,11 @@ async function runDiff(options) {
     const head = "# opencode-ship diff";
     const lines = [head, "", "## Plan"];
     for (const op of plan.filter(Boolean)) {
-      const bytesHint = op.bytes ? `${op.bytes.length ?? 0}b` : "";
+      const bytesHint = (
+        /** @type {any} */
+        op.bytes ? `${/** @type {any} */
+        op.bytes.length ?? 0}b` : ""
+      );
       lines.push(`  - ${op.kind.padEnd(9)} ${op.op} ${op.relPath ?? op.target}${bytesHint ? ` (${bytesHint})` : ""}${op.reason ? ` \u2014 ${op.reason}` : ""}`);
     }
     if (conflicts.length) {
@@ -2979,11 +3665,9 @@ function emitFailure2(code, message, json, command) {
 }
 
 // src/installer/commands/uninstall.js
-import { unlink as unlink3 } from "node:fs/promises";
-import { existsSync as existsSync13 } from "node:fs";
-import { resolve as resolve12 } from "node:path";
+import { unlink as unlink4 } from "node:fs/promises";
 async function runUninstall(options) {
-  const preview = await previewUninstall({ rootPath: options.rootPath, profile: options.profile ?? null });
+  const preview = await previewUninstall({ rootPath: options.rootPath });
   if (!preview.ok) {
     if (preview.error?.kind === "unsupported-lock-schema") {
       return emitFailure3(5, `unsupported lock schema: ${(preview.error.issues ?? []).join("; ")}`, options.json);
@@ -2994,6 +3678,16 @@ async function runUninstall(options) {
     return emitFailure3(2, preview.error?.kind ?? "invalid-project", options.json);
   }
   const { repoRoot, plan, conflicts, summary } = preview;
+  if (options.purgeConfig) {
+    const cfg = configPath(repoRoot);
+    plan.push({
+      op: "file",
+      kind: "delete",
+      target: cfg,
+      relPath: ".opencode/ship.config.json",
+      reason: "purge user-owned ship.config.json"
+    });
+  }
   if (conflicts.length > 0) {
     return emitReport(plan, conflicts, summary, options.json, 3, ["modified managed files; refusing to delete"]);
   }
@@ -3001,11 +3695,6 @@ async function runUninstall(options) {
   if (!tx.ok) {
     return emitFailure3(4, tx.error?.message ?? "transaction failure", options.json);
   }
-  const lockPath2 = resolve12(repoRoot, ".opencode", "ship.lock.json");
-  if (existsSync13(lockPath2)) await unlink3(lockPath2).catch(() => null);
-  if (options.purgeConfig) {
-    await unlink3(configPath(repoRoot)).catch(() => null);
-  }
   return emitReport(plan, [], summary, options.json, 0, [tx.recovered ? "journal recovered before uninstall" : ""].filter(Boolean));
 }
 function emitFailure3(code, message, json) {
@@ -3083,15 +3772,37 @@ ${helpText()}`);
   const options = parsed.options ?? {};
   const opts = options;
   const profile = opts.profile ?? null;
+  const models = {
+    planner: opts.plannerModel ?? null,
+    builder: opts.builderModel ?? null,
+    finalReviewer: opts.finalReviewerModel ?? null
+  };
+  const hasModels = Boolean(models.planner || models.builder || models.finalReviewer);
   switch (parsed.command) {
     case "init":
-      await runInit({ json: !!opts.json, rootPath: opts.rootPath, profile, forceConfig: !!opts.forceConfig, forceRootConfig: !!opts.forceRootConfig, strictDoctor: !!opts.strictDoctor });
+      await runInit({
+        json: !!opts.json,
+        rootPath: opts.rootPath,
+        profile,
+        forceConfig: !!opts.forceConfig,
+        forceRootConfig: !!opts.forceRootConfig,
+        strictDoctor: !!opts.strictDoctor,
+        models: hasModels ? models : null
+      });
       return;
     case "diff":
       await runDiff({ json: !!opts.json, rootPath: opts.rootPath, profile });
       return;
     case "update":
-      await runUpdate({ json: !!opts.json, rootPath: opts.rootPath, profile, replaceManaged: !!opts.replaceManaged, forceConfig: !!opts.forceConfig, forceRootConfig: !!opts.forceRootConfig });
+      await runUpdate({
+        json: !!opts.json,
+        rootPath: opts.rootPath,
+        profile,
+        replaceManaged: !!opts.replaceManaged,
+        forceConfig: !!opts.forceConfig,
+        forceRootConfig: !!opts.forceRootConfig,
+        models: hasModels ? models : null
+      });
       return;
     case "doctor":
       await runDoctor({ json: !!opts.json, rootPath: opts.rootPath, profile });