opencode-ship 1.1.1 → 1.1.2-rc.1

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// opencode-ship CLI v1.1.1
+// opencode-ship CLI v1.1.2-rc.1
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -110,7 +110,7 @@ import { fileURLToPath as fileURLToPath2 } from "node:url";
 var PACKAGE_VERSION, TEMPLATE_SET;
 var init_version = __esm({
   "src/version.js"() {
-    PACKAGE_VERSION = "1.1.1";
+    PACKAGE_VERSION = "1.1.2-rc.1";
     TEMPLATE_SET = `v${PACKAGE_VERSION}`;
   }
 });
@@ -1145,6 +1145,34 @@ var init_root_config = __esm({
         pointer: "/agent/build/permission/task/delivery-verifier",
         strategy: "value",
         value: "allow"
+      },
+      // Build -> ship-controller delegation so the deep plan/build/review
+      // chain works with subagent_depth=2.
+      {
+        pointer: "/agent/build/permission/task/ship-controller",
+        strategy: "value",
+        value: "allow"
+      },
+      {
+        pointer: "/subagent_depth",
+        strategy: "value",
+        value: 2
+      },
+      // Build-tool permission ask/allow/deny surface.
+      {
+        pointer: "/agent/build/permission/ship_plan_approve",
+        strategy: "value",
+        value: "ask"
+      },
+      {
+        pointer: "/agent/build/permission/ship_resume",
+        strategy: "value",
+        value: "allow"
+      },
+      {
+        pointer: "/agent/build/permission/ship_status",
+        strategy: "value",
+        value: "allow"
       }
     ];
     ROOT_PATH_CANDIDATES = ["opencode.json", "opencode.jsonc"];
@@ -1278,6 +1306,114 @@ var init_root_config = __esm({
   }
 });
 
+// src/installer/lock.js
+import { readFile as readFile4, writeFile as writeFile2, rename as rename2, mkdir as mkdir2 } from "node:fs/promises";
+import { existsSync as existsSync8 } from "node:fs";
+import { dirname as dirname4, resolve as resolve6 } from "node:path";
+function lockPath(repoRoot) {
+  return resolve6(repoRoot, ".opencode", "ship.lock.json");
+}
+function computeIntegrity(lock) {
+  const { integrity: _ignored, ...without } = lock ?? {};
+  void _ignored;
+  return {
+    lockSha256: bytesHashString(stableStringify(without))
+  };
+}
+function normalizeLegacyLock(lock) {
+  if (!lock || typeof lock !== "object") return lock;
+  const { cleanupPending: _drop, ...rest } = lock;
+  void _drop;
+  return rest;
+}
+function validateLock(rawLock) {
+  if (rawLock === null || rawLock === void 0) {
+    return { ok: true, kind: "missing", issues: [] };
+  }
+  if (typeof rawLock !== "object" || Array.isArray(rawLock)) {
+    return { ok: false, kind: "shape", issues: ["lock root must be an object"] };
+  }
+  const issues = [];
+  let kind = "ok";
+  if (rawLock.contractVersion !== CURRENT_LOCK_SCHEMA && rawLock.contractVersion !== 3 && rawLock.contractVersion !== 2 && rawLock.contractVersion !== 1) {
+    issues.push(`unsupported contractVersion: ${JSON.stringify(rawLock.contractVersion)} (expected ${CURRENT_LOCK_SCHEMA}, 3, 2, or 1)`);
+    kind = "schema";
+  }
+  const manager = rawLock.manager;
+  if (manager === void 0) {
+    issues.push("manager section missing");
+    kind = kind === "ok" ? "shape" : kind;
+  } else if (typeof manager !== "object" || manager === null) {
+    issues.push("manager section must be an object");
+    kind = kind === "ok" ? "shape" : kind;
+  } else if (manager.schemaVersion !== CURRENT_LOCK_SCHEMA && manager.schemaVersion !== 3 && manager.schemaVersion !== 2 && manager.schemaVersion !== 1) {
+    issues.push(`unsupported manager.schemaVersion: ${JSON.stringify(manager.schemaVersion)} (expected ${CURRENT_LOCK_SCHEMA}, 3, 2, or 1)`);
+    kind = "schema";
+  } else if (manager.name !== "opencode-ship") {
+    issues.push(`unknown manager.name: ${JSON.stringify(manager.name)}`);
+    kind = "shape";
+  } else if (rawLock.contractVersion >= 2 && manager.schemaVersion >= 2 && manager.profile !== void 0 && manager.profile !== "core" && manager.profile !== "engineering") {
+    issues.push(`invalid manager.profile: ${JSON.stringify(manager.profile)} (expected one of: engineering, core [legacy])`);
+    kind = "shape";
+  }
+  if (!rawLock.files || !Array.isArray(rawLock.files)) {
+    issues.push("files must be an array");
+    kind = kind === "ok" ? "shape" : kind;
+  }
+  if (!rawLock.integrity || typeof rawLock.integrity !== "object") {
+    issues.push("integrity section missing");
+    kind = kind === "ok" ? "shape" : kind;
+  } else {
+    const expected = computeIntegrity(rawLock).lockSha256;
+    if (expected !== rawLock.integrity.lockSha256) {
+      issues.push(`integrity mismatch: stored ${rawLock.integrity.lockSha256} != computed ${expected}`);
+      kind = "integrity";
+    }
+  }
+  return { ok: issues.length === 0, kind, issues };
+}
+async function readValidatedLock(repoRoot) {
+  const path = lockPath(repoRoot);
+  if (!existsSync8(path)) {
+    return { kind: "missing", lock: null, issues: [] };
+  }
+  let raw;
+  try {
+    const text = await readFile4(path, "utf8");
+    raw = JSON.parse(text);
+  } catch (e) {
+    return {
+      kind: "integrity",
+      lock: null,
+      issues: [`unable to parse lock JSON: ${e?.message ?? String(e)}`]
+    };
+  }
+  const validation = validateLock(raw);
+  if (validation.ok) {
+    return {
+      kind: validation.kind,
+      lock: normalizeLegacyLock(raw),
+      issues: []
+    };
+  }
+  return { kind: validation.kind, lock: null, issues: validation.issues };
+}
+function isSetupComplete(lock) {
+  if (!lock || typeof lock !== "object") return false;
+  const manager = lock.manager;
+  if (!manager || typeof manager !== "object") return false;
+  return manager.setupComplete === true;
+}
+var CURRENT_LOCK_SCHEMA;
+var init_lock = __esm({
+  "src/installer/lock.js"() {
+    init_hash();
+    init_json_pointer();
+    init_profile();
+    CURRENT_LOCK_SCHEMA = 4;
+  }
+});
+
 // src/installer/agent-renderer.js
 var agent_renderer_exports = {};
 __export(agent_renderer_exports, {
@@ -1346,18 +1482,116 @@ var init_agent_renderer = __esm({
   }
 });
 
+// src/installer/setup-pending.js
+import { existsSync as existsSync14, readFileSync as readFileSync5, unlinkSync, writeFile as writeFile7, mkdir as mkdirAsync } from "node:fs";
+import { promisify } from "node:util";
+import { resolve as resolve13, dirname as dirname9 } from "node:path";
+function setupPendingPath(repoRoot) {
+  return resolve13(repoRoot, REL_PATH);
+}
+async function writeSetupPending(repoRoot, payload) {
+  const path = setupPendingPath(repoRoot);
+  await mkdirAsyncAsync(dirname9(path), { recursive: true });
+  await writeFileAsync(path, JSON.stringify(payload, null, 2) + "\n", "utf8");
+}
+function clearSetupPending(repoRoot) {
+  const path = setupPendingPath(repoRoot);
+  if (!existsSync14(path)) return false;
+  try {
+    unlinkSync(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var writeFileAsync, mkdirAsyncAsync, REL_PATH;
+var init_setup_pending = __esm({
+  "src/installer/setup-pending.js"() {
+    writeFileAsync = promisify(writeFile7);
+    mkdirAsyncAsync = promisify(mkdirAsync);
+    REL_PATH = ".opencode/ship.setup-pending.json";
+  }
+});
+
+// src/installer/setup-state.js
+var setup_state_exports = {};
+__export(setup_state_exports, {
+  SETUP_PENDING_REL_PATH: () => SETUP_PENDING_REL_PATH,
+  SETUP_REQUIREMENTS: () => SETUP_REQUIREMENTS,
+  modelsComplete: () => modelsComplete,
+  setupComplete: () => setupComplete
+});
+import { existsSync as existsSync15 } from "node:fs";
+import { readFile as readFile10 } from "node:fs/promises";
+import { resolve as resolve14, dirname as dirname10 } from "node:path";
+function modelsComplete(repoRoot, configValue) {
+  if (configValue === void 0) return false;
+  return hasCompletedModels(configValue);
+}
+async function setupComplete(repoRoot, configValue) {
+  const missing = [];
+  for (const rel of REQUIRED_DOCS) {
+    const path = resolve14(repoRoot, rel);
+    if (!existsSync15(path)) missing.push(rel);
+  }
+  const agentsPath = resolve14(repoRoot, "AGENTS.md");
+  let agentsOk = false;
+  if (existsSync15(agentsPath)) {
+    try {
+      const raw = await readFile10(agentsPath, "utf8");
+      agentsOk = /##\s+Ship workflow\b/.test(raw);
+    } catch {
+      agentsOk = false;
+    }
+    if (!agentsOk) missing.push("AGENTS.md Ship workflow block");
+  } else {
+    missing.push("AGENTS.md");
+  }
+  const lockResult = await readValidatedLock(repoRoot);
+  const cfgOk = modelsComplete(repoRoot, configValue);
+  const markerPath = setupPendingPath(repoRoot);
+  if (existsSync15(markerPath)) missing.push("setup-pending marker");
+  const lockOk = lockResult.kind === "ok" || lockResult.kind === "missing";
+  const ok = cfgOk && lockOk && missing.length === 0;
+  return {
+    ok,
+    missing,
+    config: { ok: cfgOk, lock: { ok: lockOk, setupComplete: isSetupComplete(lockResult.lock) } }
+  };
+}
+var REQUIRED_DOCS, SETUP_PENDING_REL_PATH, SETUP_REQUIREMENTS;
+var init_setup_state = __esm({
+  "src/installer/setup-state.js"() {
+    init_config();
+    init_lock();
+    init_setup_pending();
+    REQUIRED_DOCS = [
+      "docs/agents/issue-tracker.md",
+      "docs/agents/domain.md",
+      "docs/agents/triage-labels.md"
+    ];
+    SETUP_PENDING_REL_PATH = ".opencode/ship.setup-pending.json";
+    SETUP_REQUIREMENTS = Object.freeze({
+      docs: REQUIRED_DOCS,
+      agentFile: "AGENTS.md",
+      markerPath: SETUP_PENDING_REL_PATH
+    });
+  }
+});
+
 // src/installer/cli-args.js
 init_profile();
 var USAGE = `opencode-ship <command> [options]
 
 Commands:
-  init        Install managed files in this project. One-liner: pnpm dlx opencode-ship@latest init
-  diff        Show what would change without writing.
-  update      Apply pending updates after recovering the journal.
-  doctor      Validate environment, lock, and references.
-  uninstall   Remove managed files that still match the lock.
-  --version   Print the version and exit.
-  --help      Show this usage and exit.
+  init             Install managed files in this project. One-liner: pnpm dlx opencode-ship@latest init
+  diff             Show what would change without writing.
+  update           Apply pending updates after recovering the journal.
+  doctor           Validate environment, lock, and references.
+  setup-complete   Sole writer of lock.manager.setupComplete = true. Validates models + docs + AGENTS.md.
+  uninstall        Remove managed files that still match the lock.
+  --version        Print the version and exit.
+  --help           Show this usage and exit.
 
 Options:
   --root <path>               Project root (defaults to cwd).
@@ -1372,8 +1606,10 @@ Options:
   --final-reviewer-model <id> Final Standards + Spec reviewer model id (init only, optional).
   --json                      Emit a JSON envelope instead of human output.
 
-After init succeeds, restart OpenCode and run /setup-ship-workflow to
-fill in the workflow.models fields and the per-repo docs.
+After init succeeds, restart OpenCode and run /setup-ship-workflow.
+The setup skill calls 'opencode-ship setup-complete' at the end so
+the lock.manager.setupComplete flag flips to true and the ship
+controller can dispatch.
 `;
 var MODEL_ID_RE = /^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+$/;
 function parseFlags(argv) {
@@ -1444,6 +1680,7 @@ function parseCommand(argv) {
     case "diff":
     case "update":
     case "doctor":
+    case "setup-complete":
     case "uninstall":
       return { command: cmd, options: flags };
     default:
@@ -1457,7 +1694,7 @@ function helpText() {
 // src/installer/commands/init.js
 import { promisify as promisify2 } from "node:util";
 import { writeFile as writeFile8, mkdir as mkdirAsync2 } from "node:fs/promises";
-import { dirname as dirname10, resolve as resolvePath } from "node:path";
+import { dirname as dirname11, resolve as resolvePath } from "node:path";
 
 // src/installer/executor.js
 init_catalog();
@@ -2212,104 +2449,8 @@ async function planRootConfigApply({ repoRoot, lock, forceRepair, planMode = nul
   });
 }
 
-// src/installer/lock.js
-init_hash();
-init_json_pointer();
-init_profile();
-import { readFile as readFile4, writeFile as writeFile2, rename as rename2, mkdir as mkdir2 } from "node:fs/promises";
-import { existsSync as existsSync8 } from "node:fs";
-import { dirname as dirname4, resolve as resolve6 } from "node:path";
-var CURRENT_LOCK_SCHEMA = 4;
-function lockPath(repoRoot) {
-  return resolve6(repoRoot, ".opencode", "ship.lock.json");
-}
-function computeIntegrity(lock) {
-  const { integrity: _ignored, ...without } = lock ?? {};
-  void _ignored;
-  return {
-    lockSha256: bytesHashString(stableStringify(without))
-  };
-}
-function normalizeLegacyLock(lock) {
-  if (!lock || typeof lock !== "object") return lock;
-  const { cleanupPending: _drop, ...rest } = lock;
-  void _drop;
-  return rest;
-}
-function validateLock(rawLock) {
-  if (rawLock === null || rawLock === void 0) {
-    return { ok: true, kind: "missing", issues: [] };
-  }
-  if (typeof rawLock !== "object" || Array.isArray(rawLock)) {
-    return { ok: false, kind: "shape", issues: ["lock root must be an object"] };
-  }
-  const issues = [];
-  let kind = "ok";
-  if (rawLock.contractVersion !== CURRENT_LOCK_SCHEMA && rawLock.contractVersion !== 3 && rawLock.contractVersion !== 2 && rawLock.contractVersion !== 1) {
-    issues.push(`unsupported contractVersion: ${JSON.stringify(rawLock.contractVersion)} (expected ${CURRENT_LOCK_SCHEMA}, 3, 2, or 1)`);
-    kind = "schema";
-  }
-  const manager = rawLock.manager;
-  if (manager === void 0) {
-    issues.push("manager section missing");
-    kind = kind === "ok" ? "shape" : kind;
-  } else if (typeof manager !== "object" || manager === null) {
-    issues.push("manager section must be an object");
-    kind = kind === "ok" ? "shape" : kind;
-  } else if (manager.schemaVersion !== CURRENT_LOCK_SCHEMA && manager.schemaVersion !== 3 && manager.schemaVersion !== 2 && manager.schemaVersion !== 1) {
-    issues.push(`unsupported manager.schemaVersion: ${JSON.stringify(manager.schemaVersion)} (expected ${CURRENT_LOCK_SCHEMA}, 3, 2, or 1)`);
-    kind = "schema";
-  } else if (manager.name !== "opencode-ship") {
-    issues.push(`unknown manager.name: ${JSON.stringify(manager.name)}`);
-    kind = "shape";
-  } else if (rawLock.contractVersion >= 2 && manager.schemaVersion >= 2 && manager.profile !== void 0 && manager.profile !== "core" && manager.profile !== "engineering") {
-    issues.push(`invalid manager.profile: ${JSON.stringify(manager.profile)} (expected one of: engineering, core [legacy])`);
-    kind = "shape";
-  }
-  if (!rawLock.files || !Array.isArray(rawLock.files)) {
-    issues.push("files must be an array");
-    kind = kind === "ok" ? "shape" : kind;
-  }
-  if (!rawLock.integrity || typeof rawLock.integrity !== "object") {
-    issues.push("integrity section missing");
-    kind = kind === "ok" ? "shape" : kind;
-  } else {
-    const expected = computeIntegrity(rawLock).lockSha256;
-    if (expected !== rawLock.integrity.lockSha256) {
-      issues.push(`integrity mismatch: stored ${rawLock.integrity.lockSha256} != computed ${expected}`);
-      kind = "integrity";
-    }
-  }
-  return { ok: issues.length === 0, kind, issues };
-}
-async function readValidatedLock(repoRoot) {
-  const path = lockPath(repoRoot);
-  if (!existsSync8(path)) {
-    return { kind: "missing", lock: null, issues: [] };
-  }
-  let raw;
-  try {
-    const text = await readFile4(path, "utf8");
-    raw = JSON.parse(text);
-  } catch (e) {
-    return {
-      kind: "integrity",
-      lock: null,
-      issues: [`unable to parse lock JSON: ${e?.message ?? String(e)}`]
-    };
-  }
-  const validation = validateLock(raw);
-  if (validation.ok) {
-    return {
-      kind: validation.kind,
-      lock: normalizeLegacyLock(raw),
-      issues: []
-    };
-  }
-  return { kind: validation.kind, lock: null, issues: validation.issues };
-}
-
 // src/installer/executor.js
+init_lock();
 init_config();
 init_hash();
 init_json_pointer();
@@ -2459,8 +2600,11 @@ function detectProject(repoRoot = process.cwd()) {
 
 // src/installer/executor.js
 init_root_config();
+init_lock();
 
 // src/installer/transaction.js
+init_lock();
+init_hash();
 import {
   writeFile as writeFile4,
   rename as rename4,
@@ -2472,7 +2616,6 @@ import {
 } from "node:fs/promises";
 import { existsSync as existsSync11 } from "node:fs";
 import { dirname as dirname6, resolve as resolve10, join as join5 } from "node:path";
-init_hash();
 
 // src/state/git-common-dir.js
 import { spawn } from "node:child_process";
@@ -2897,10 +3040,11 @@ async function rollback(lockDir, journal) {
 }
 
 // src/installer/migration.js
+init_lock();
+init_config();
 import { readFile as readFile7 } from "node:fs/promises";
 import { existsSync as existsSync12 } from "node:fs";
 import { resolve as resolve11 } from "node:path";
-init_config();
 function legacyAdapterPath(repoRoot) {
   return resolve11(repoRoot, ".opencode", "delivery.json");
 }
@@ -3095,7 +3239,7 @@ async function previewInstall({ rootPath, profile = null, replaceManaged, forceC
   });
   const planMode = null;
   const rootPlan = await planRootConfigApply({ repoRoot, lock, forceRepair: Boolean(forceRootConfig), planMode });
-  const setupPending = resolved.profile === "engineering" && !lock?.manager?.setupComplete && !hasCompletedModels(configValue) && !models?.planner;
+  const setupPending = resolved.profile === "engineering" && !hasCompletedModels(configValue);
   const plan = [...filePlan ?? [], ...staleFilePlan, ...migrationPlan, configPlan, rootPlan];
   const conflicts = plan.filter((p) => p && p.kind === "conflict");
   const summary = summarise(plan);
@@ -3146,7 +3290,7 @@ function summarise(plan) {
   }
   return counts;
 }
-async function assembleLock({ repoRoot, plan, lock, configPlan, rootPlan, profile = null, models = null }) {
+async function assembleLock({ repoRoot, plan, lock, configPlan, rootPlan, profile = null, models = null, fullSetupComplete = false }) {
   const files = [];
   const remain = lock?.files?.filter((f) => !plan.some((op) => op?.relPath === f.path)) ?? [];
   for (const op of plan) {
@@ -3182,11 +3326,11 @@ async function assembleLock({ repoRoot, plan, lock, configPlan, rootPlan, profil
     manager: {
       schemaVersion: CURRENT_LOCK_SCHEMA,
       name: "opencode-ship",
-      version: "1.1.1",
+      version: "1.1.2-rc.1",
       templateSet: TEMPLATE_SET_ID,
       profile: resolvedProfile,
       appliedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      setupComplete: completedModels,
+      setupComplete: Boolean(fullSetupComplete) && completedModels,
       config: {
         path: ".opencode/ship.config.json",
         sha256: configSha ?? lock?.manager?.config?.sha256 ?? "",
@@ -3201,7 +3345,7 @@ async function assembleLock({ repoRoot, plan, lock, configPlan, rootPlan, profil
     files
   };
 }
-async function commitInstall(preview, { json, command }) {
+async function commitInstall(preview, { json, command, fullSetupComplete = false }) {
   if (!preview.ok) {
     return {
       ok: false,
@@ -3237,7 +3381,8 @@ async function commitInstall(preview, { json, command }) {
     lock: preview.lock,
     configPlan,
     rootPlan,
-    profile: preview.profile?.profile
+    profile: preview.profile?.profile,
+    fullSetupComplete
   });
   const txPlan = await stageFiles(fileOnly, repoRoot);
   if (configPlan && (configPlan.kind === "create" || configPlan.kind === "update")) {
@@ -3327,13 +3472,14 @@ function relativeTemplate(source) {
 }
 
 // src/installer/commands/doctor.js
-import { existsSync as existsSync14, readFileSync as readFileSync5 } from "node:fs";
-import { spawnSync as spawnSync2 } from "node:child_process";
+init_lock();
 init_config();
+import { existsSync as existsSync16, readFileSync as readFileSync6 } from "node:fs";
+import { spawnSync as spawnSync2 } from "node:child_process";
 init_hash();
 init_catalog();
 init_root_config();
-import { resolve as resolve13 } from "node:path";
+import { resolve as resolve15 } from "node:path";
 
 // src/installer/report.js
 var REPORT_VERSION = 1;
@@ -3422,9 +3568,9 @@ function checkPackageIntegrity() {
 function buildSourceHashIndex() {
   const idx = /* @__PURE__ */ new Map();
   for (const entry of CATALOG) {
-    if (!existsSync14(entry.source)) continue;
+    if (!existsSync16(entry.source)) continue;
     try {
-      const buf = readFileSync5(entry.source, "utf8");
+      const buf = readFileSync6(entry.source, "utf8");
       idx.set(entry.source, bytesHashString(buf));
     } catch {
     }
@@ -3435,13 +3581,13 @@ async function checkCatalogInstall(repoRoot, sourceHashes, profile, renderedAgen
   const rows = [];
   const scoped = profile ? filterCatalogByProfile(CATALOG, profile) : CATALOG;
   for (const entry of scoped) {
-    const target = resolve13(repoRoot, entry.path);
-    if (!existsSync14(target)) {
+    const target = resolve15(repoRoot, entry.path);
+    if (!existsSync16(target)) {
       rows.push(`${entry.id}: missing`);
       continue;
     }
     try {
-      const buf = readFileSync5(target, "utf8");
+      const buf = readFileSync6(target, "utf8");
       const actual = bytesHashString(buf);
       const rendered = renderedAgentMap.get(entry.path);
       const expected = rendered ? rendered.sha256 : sourceHashes.get(entry.source);
@@ -3497,12 +3643,12 @@ async function checkManagedHashes(repoRoot, validatedLock) {
   const drift = [];
   const renderedAgents = await loadRenderedAgentOverrides(repoRoot);
   for (const entry of validatedLock.lock.files ?? []) {
-    const p = resolve13(repoRoot, entry.path);
-    if (!existsSync14(p)) {
+    const p = resolve15(repoRoot, entry.path);
+    if (!existsSync16(p)) {
       drift.push(`missing:${entry.path}`);
       continue;
     }
-    const buf = readFileSync5(p, "utf8");
+    const buf = readFileSync6(p, "utf8");
     const actual = bytesHashString(buf);
     if (actual !== entry.sha256) drift.push(`drift:${entry.path}`);
   }
@@ -3552,6 +3698,18 @@ async function checkRootConfig(repoRoot) {
     detail: conflict ? `conflict on ${conflict.pointer}` : `applied=${r.applied.length}, skipped=${r.skipped.length}`
   };
 }
+async function checkSetupState(repoRoot, configValue) {
+  const { setupComplete: setupComplete2 } = await Promise.resolve().then(() => (init_setup_state(), setup_state_exports));
+  const state = await setupComplete2(repoRoot, configValue);
+  if (state.ok) {
+    return { name: "setup-complete", ok: true, detail: "models + docs + AGENTS.md all present" };
+  }
+  return {
+    name: "setup-complete",
+    ok: true,
+    detail: `pending: ${state.missing.join(", ") || "(none)"}`
+  };
+}
 function writeEnvelope({ command, plan, summary, diagnostics, json, exitCode }) {
   const conflicts = plan.filter((p) => p.kind === "conflict");
   if (json) {
@@ -3599,7 +3757,8 @@ async function runDoctor({ rootPath, profile, json, writeOutput = true }) {
     await checkConfig(repoRoot),
     await checkManagedHashes(repoRoot, validatedLock),
     await checkActiveProfileFootprint(repoRoot, validatedLock, resolved.profile),
-    await checkRootConfig(repoRoot)
+    await checkRootConfig(repoRoot),
+    await checkSetupState(repoRoot, configValue)
   ];
   const issues = checks.filter((c) => !c.ok).map((c) => `${c.name}: ${c.detail}`);
   const plan = checks.map((c) => ({
@@ -3622,34 +3781,7 @@ async function runDoctor({ rootPath, profile, json, writeOutput = true }) {
 // src/installer/commands/init.js
 init_catalog();
 init_config();
-
-// src/installer/setup-pending.js
-import { existsSync as existsSync15, readFileSync as readFileSync6, unlinkSync, writeFile as writeFile7, mkdir as mkdirAsync } from "node:fs";
-import { promisify } from "node:util";
-import { resolve as resolve14, dirname as dirname9 } from "node:path";
-var writeFileAsync = promisify(writeFile7);
-var mkdirAsyncAsync = promisify(mkdirAsync);
-var REL_PATH = ".opencode/ship.setup-pending.json";
-function setupPendingPath(repoRoot) {
-  return resolve14(repoRoot, REL_PATH);
-}
-async function writeSetupPending(repoRoot, payload) {
-  const path = setupPendingPath(repoRoot);
-  await mkdirAsyncAsync(dirname9(path), { recursive: true });
-  await writeFileAsync(path, JSON.stringify(payload, null, 2) + "\n", "utf8");
-}
-function clearSetupPending(repoRoot) {
-  const path = setupPendingPath(repoRoot);
-  if (!existsSync15(path)) return false;
-  try {
-    unlinkSync(path);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-// src/installer/commands/init.js
+init_setup_pending();
 var writeFileAsync2 = promisify2(writeFile8);
 var mkdirAsyncAsync2 = promisify2(mkdirAsync2);
 async function runInit(options) {
@@ -3914,6 +4046,7 @@ async function runDiff(options) {
 
 // src/installer/commands/update.js
 init_catalog();
+init_setup_pending();
 async function runUpdate(options) {
   try {
     validateCatalog();
@@ -3948,9 +4081,6 @@ async function runUpdate(options) {
     return emitFailure2(3, "modified managed files; rerun with --replace-managed", options.json, "update");
   }
   const committed = await commitInstall(preview, { json: options.json, command: "update" });
-  if (committed.extra?.exitCode === 0 && preview.repoRoot && !preview.setupPending) {
-    clearSetupPending(preview.repoRoot);
-  }
   if (options.json) {
     process.stdout.write(JSON.stringify({
       reportVersion: 1,
@@ -3991,6 +4121,87 @@ function emitFailure2(code, message, json, command) {
   return { ok: false, exitCode: code };
 }
 
+// src/installer/commands/setup-complete.js
+init_config();
+init_setup_state();
+init_setup_pending();
+import { existsSync as existsSync17 } from "node:fs";
+import { resolve as resolve16 } from "node:path";
+async function runSetupComplete(options) {
+  const repoRoot = options.rootPath ?? process.cwd();
+  if (!existsSync17(resolve16(repoRoot, ".git"))) {
+    return emitFailure3(2, "not a git repository", options.json);
+  }
+  clearSetupPending(repoRoot);
+  const config = await loadConfig(repoRoot);
+  const configValue = config?.ok ? config.value : null;
+  const state = await setupComplete(repoRoot, configValue);
+  const diagnostics = [];
+  if (!state.config.ok) diagnostics.push("workflow.models incomplete");
+  if (!state.config.lock.ok) diagnostics.push("lock is not v4 or fails integrity");
+  if (state.missing.length > 0) {
+    diagnostics.push(`missing: ${state.missing.join(", ")}`);
+  }
+  if (!state.ok) {
+    return emitFailure3(6, `setup incomplete: ${diagnostics.join("; ")}`, options.json, { state });
+  }
+  const preview = await previewInstall({
+    rootPath: repoRoot,
+    profile: "engineering",
+    replaceManaged: false,
+    forceConfig: false,
+    forceRootConfig: false
+  });
+  if (!preview.ok) {
+    return emitFailure3(2, `preview failed: ${preview.error?.kind ?? "unknown"}`, options.json);
+  }
+  if (preview.conflicts.length > 0) {
+    return emitFailure3(3, "managed files conflict; resolve with `opencode-ship update --replace-managed` first", options.json);
+  }
+  const committed = await commitInstall(preview, {
+    json: options.json,
+    command: "setup-complete",
+    fullSetupComplete: true
+  });
+  if (committed.extra?.exitCode !== 0) {
+    return emitFailure3(committed.extra?.exitCode ?? 1, "commit failed", options.json, { committed });
+  }
+  if (options.json) {
+    process.stdout.write(JSON.stringify({
+      reportVersion: 1,
+      command: "setup-complete",
+      status: "ok",
+      setupComplete: true,
+      requirements: SETUP_REQUIREMENTS,
+      plan: serializePlan(committed.plan ?? []),
+      summary: committed.summary ?? {},
+      exitCode: 0
+    }, null, 2) + "\n");
+  } else {
+    process.stdout.write("opencode-ship: setup complete\n");
+  }
+  process.exitCode = 0;
+  return committed;
+}
+function emitFailure3(code, message, json, extra) {
+  if (json) {
+    process.stdout.write(JSON.stringify({
+      reportVersion: 1,
+      command: "setup-complete",
+      status: "error",
+      setupComplete: false,
+      diagnostics: [message],
+      ...extra ?? {},
+      exitCode: code
+    }, null, 2) + "\n");
+  } else {
+    process.stdout.write(`opencode-ship: ${message}
+`);
+  }
+  process.exitCode = code;
+  return { ok: false, exitCode: code };
+}
+
 // src/installer/commands/uninstall.js
 init_config();
 import { unlink as unlink4 } from "node:fs/promises";
@@ -3998,12 +4209,12 @@ async function runUninstall(options) {
   const preview = await previewUninstall({ rootPath: options.rootPath });
   if (!preview.ok) {
     if (preview.error?.kind === "unsupported-lock-schema") {
-      return emitFailure3(5, `unsupported lock schema: ${(preview.error.issues ?? []).join("; ")}`, options.json);
+      return emitFailure4(5, `unsupported lock schema: ${(preview.error.issues ?? []).join("; ")}`, options.json);
     }
     if (preview.error?.kind === "lock-invalid") {
-      return emitFailure3(3, `lock invalid: ${(preview.error.issues ?? []).join("; ")}`, options.json);
+      return emitFailure4(3, `lock invalid: ${(preview.error.issues ?? []).join("; ")}`, options.json);
     }
-    return emitFailure3(2, preview.error?.kind ?? "invalid-project", options.json);
+    return emitFailure4(2, preview.error?.kind ?? "invalid-project", options.json);
   }
   const { repoRoot, plan, conflicts, summary } = preview;
   if (options.purgeConfig) {
@@ -4021,11 +4232,11 @@ async function runUninstall(options) {
   }
   const tx = await executePlan({ repoRoot, plan, newLockBuilder: null });
   if (!tx.ok) {
-    return emitFailure3(4, tx.error?.message ?? "transaction failure", options.json);
+    return emitFailure4(4, tx.error?.message ?? "transaction failure", options.json);
   }
   return emitReport(plan, [], summary, options.json, 0, [tx.recovered ? "journal recovered before uninstall" : ""].filter(Boolean));
 }
-function emitFailure3(code, message, json) {
+function emitFailure4(code, message, json) {
   if (json) {
     process.stdout.write(JSON.stringify({
       reportVersion: 1,
@@ -4136,6 +4347,9 @@ ${helpText()}`);
     case "doctor":
       await runDoctor({ json: !!opts.json, rootPath: opts.rootPath, profile });
       return;
+    case "setup-complete":
+      await runSetupComplete({ json: !!opts.json, rootPath: opts.rootPath });
+      return;
     case "uninstall":
       await runUninstall({ json: !!opts.json, rootPath: opts.rootPath, profile, purgeConfig: !!opts.purgeConfig });
       return;