opencode-ship 1.1.2 → 1.1.3

package/CHANGELOG.md

@@ -2,6 +2,38 @@
 
 All notable changes to `opencode-ship` are recorded here.
 
+## 1.1.3 — Tool permission regression + setup-ship-workflow loader
+
+> Branch: `fix/1.1.3-tool-permissions`. Hotfix on top of `1.1.2`.
+
+- **Drop the `*` wildcard from the Build / ship-controller tool
+  permission map.** `1.1.2` emitted a `permission: { "*": "deny" }`
+  leaf at the agent root, and OpenCode's last-match-wins semantics
+  masked the consumer-owned built-ins (`read`, `edit`, `bash`,
+  `glob`, `grep`, `list`, `skill`, `webfetch`, …). Symptom: the
+  Build agent kept only the ship/delivery tool subset, the
+  `setup-ship-workflow` skill was never auto-loaded because the
+  agent could not read its own `SKILL.md`, and the user was
+  prompted with `Skill install blocked: … untrusted-owner` because
+  the model tried to reinstall the locally-installed skill via
+  `ship_skill_install`. The fix is to deny only the explicit
+  `PUBLIC_TOOL_ID` set (plus `allow` / `ask`) and let consumer
+  built-ins stay consumer-owned.
+- **Drop leftover matrix leaves on install / update.** The
+  reconciler now diffs `previousRecords` against the current
+  descriptor set and removes pointers that the matrix no longer
+  emits (for example the dropped `/agent/build/permission/*`),
+  restoring the preinstall `previous` value or the leaf when no
+  previous existed. The byte output is updated for both JSON and
+  JSONC paths so `opencode-ship update` from `1.1.2` to `1.1.3`
+  cleans the orphan pointer on the first run.
+- **`/setup-ship-workflow` command is self-loading.** The command
+  wrapper now spells out the procedure: read the skill body from
+  `.opencode/skills/setup-ship-workflow/SKILL.md` and follow it.
+  Do not call `ship_skill_install` for this skill — it is
+  installed by `init` and the install path requires a trusted
+  npm-owner allowlist that `opencode-ship` does not satisfy.
+
 ## 1.1.2 — Stable: Plan Mode write access
 
 > Branch: `release/1.1.2`. Promoted from `1.1.2-rc.4` after dogfood.

package/README.md

@@ -2,7 +2,7 @@
 
 > npm-distributed OpenCode installer and delivery plugin: a single command materialises the lifecycle plugin, reviewer/verifier agents, and skills into any consumer repository, with a recoverable lock and never silently overwrites managed files.
 >
-> **Status:** `1.1.2` is on `npm dist-tag latest` and is the first fully self-hosting release. It is the accepted successor of `1.1.1` (now deprecated). The `1.1.2 stabilization` line carried three rejected RCs (`1.1.2-rc.1`, `1.1.2-rc.2`, `1.1.2-rc.3`) before the stable candidate `1.1.2-rc.4` was promoted; see `docs/release/1.1.2-correction-plan.md` for the authoritative plan and issue #56 for the bounded evidence ledger. The `1.1.0` tag is immutable. Consumers of `opencode-delivery@0.1.x` should run `pnpm dlx opencode-ship@latest init` from the same checkout; migration recognises the legacy artifacts and adopts them when their bytes match.
+> **Status:** `1.1.3` is on `npm dist-tag latest` and supersedes the `1.1.2 stabilization` line. `1.1.2` published a `permission: { "*": "deny" }` leaf that masked the consumer-owned built-ins and broke `/setup-ship-workflow`; `1.1.3` drops the wildcard, adds a stale-pointer removal path so `update` cleans the orphan key on the first run, and makes the `/setup-ship-workflow` command self-loading. The `1.1.0` tag is immutable. Consumers of `opencode-delivery@0.1.x` should run `pnpm dlx opencode-ship@latest init` from the same checkout; migration recognises the legacy artifacts and adopts them when their bytes match.
 >
 > Consumers should use `opencode-ship@1.1.0` (or `@latest`) until `1.1.1` ships. The previous `1.0.0` is on `next`; consumers who pinned to `1.0.x` will continue to receive updates on that channel.
 

package/THIRD_PARTY_NOTICES.md

@@ -1,6 +1,6 @@
 # Third-Party Notices
 
-`opencode-ship@1.1.2` ships the complete Matt Pocock and Superpowers
+`opencode-ship@1.1.3` ships the complete Matt Pocock and Superpowers
 methodology under the MIT license, plus the Ship-owned installer,
 plugin, agents, and skills. The complete immutable pin list is in
 `vendor/sources.json`; the upstream snapshots are under

package/assets/commands/setup-ship-workflow.md

@@ -5,11 +5,30 @@ description: Configure the opencode-ship workflow for this repo: GitHub tracker,
 # Setup Ship Workflow
 
 This command is a thin wrapper around the canonical
-`setup-ship-workflow` skill. OpenCode will load the skill
-and follow its procedure.
-
-To run the skill from this command, the user types
-`/setup-ship-workflow` in OpenCode. The CLI's
-`setup-complete` command is the transactional gate that
-commits the lock flip and clears the marker once the skill
-has produced every artifact.
+`setup-ship-workflow` skill. The skill file is written to disk by
+`opencode-ship init` at `.opencode/skills/setup-ship-workflow/SKILL.md`
+in the consumer repo and in every issue worktree.
+
+## When the user types `/setup-ship-workflow`
+
+1. **Read** the skill body from
+   `.opencode/skills/setup-ship-workflow/SKILL.md` in the current
+   worktree (or the consumer repo root if no worktree is open).
+   Do NOT call `ship_skill_install` for this skill: it is already
+   on disk from `init` and the install path requires a trusted
+   npm-owner allowlist that the `opencode-ship` publisher does
+   not satisfy.
+2. **Follow** the procedure in the skill body. The skill writes
+   the four required artifacts (`docs/agents/issue-tracker.md`,
+   `docs/agents/triage-labels.md`, `docs/agents/domain.md`,
+   `AGENTS.md`), populates the `workflow.models` block in
+   `.opencode/ship.config.json`, and runs the
+   `opencode-ship setup-complete` CLI to flip
+   `lock.manager.setupComplete` to `true`.
+
+If the skill file is missing (for example the consumer skipped
+`init`), fall back to running `opencode-ship init --root "$PWD"`
+from a `bash` block first, then read the freshly written skill and
+continue. Do not silently invent the setup procedure; the CLI is
+the single source of truth for the artifact list and the model
+names that the controller will dispatch.

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// opencode-ship CLI v1.1.2
+// opencode-ship CLI v1.1.3
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -110,7 +110,7 @@ import { fileURLToPath as fileURLToPath2 } from "node:url";
 var PACKAGE_VERSION, TEMPLATE_SET;
 var init_version = __esm({
   "src/version.js"() {
-    PACKAGE_VERSION = "1.1.2";
+    PACKAGE_VERSION = "1.1.3";
     TEMPLATE_SET = `v${PACKAGE_VERSION}`;
   }
 });
@@ -1871,7 +1871,7 @@ function denyMap(globs) {
   return out;
 }
 function toolPermissionMap(allow, ask) {
-  const out = { "*": DENY };
+  const out = {};
   for (const id of PUBLIC_TOOL_IDS) out[id] = DENY;
   for (const id of allow) out[id] = ALLOW;
   for (const id of ask) out[id] = ASK;
@@ -3538,6 +3538,10 @@ function reconcileRecordsAfterTransition(descriptors, previousRecords) {
   }
   return out;
 }
+function staleRecordsToRemove(previousRecords, descriptors) {
+  const desired = new Set(descriptors.map((d) => d.pointer));
+  return previousRecords.filter((r) => r.scope === "engineering" && !desired.has(r.pointer));
+}
 function planInstallRoot({ doc, target, relPath, descriptors, previousRecords }) {
   const promotion = promotePlanEditIfString(doc.value);
   if (promotion.record && promotion.record.conflict) {
@@ -3553,12 +3557,24 @@ function planInstallRoot({ doc, target, relPath, descriptors, previousRecords })
       document: doc.value
     };
   }
-  const sourceDoc = promotion.doc;
+  const stale = staleRecordsToRemove(previousRecords, descriptors);
+  let sourceDoc = promotion.doc;
+  const staleEdits = [];
+  for (const r of stale) {
+    if (r.previous && r.previous.existed) {
+      sourceDoc = setPointer(sourceDoc, r.pointer, r.previous.value);
+      staleEdits.push({ kind: "restore", pointer: r.pointer, value: r.previous.value });
+    } else {
+      sourceDoc = removePointer(sourceDoc, r.pointer);
+      staleEdits.push({ kind: "remove", pointer: r.pointer });
+    }
+  }
+  const livePreviousRecords = previousRecords.filter((r) => !stale.some((s) => s.pointer === r.pointer));
   const result = applyOwnedPointers(sourceDoc, {
     pointerEntries: descriptors.map((d) => ({ pointer: d.pointer, strategy: d.strategy, value: d.value })),
     allowEqualValues: true
   });
-  const edits = [];
+  const edits = [...staleEdits];
   for (const a of result.applied) edits.push({ kind: "create", pointer: a.pointer, value: a.value });
   for (const s of result.skipped) {
     if (s.reason === "already equal") continue;
@@ -3592,11 +3608,31 @@ function planInstallRoot({ doc, target, relPath, descriptors, previousRecords })
           "set"
         ) });
       }
+      for (const e of staleEdits) {
+        if (e.kind === "restore") {
+          pointerEdits.push({ pointer: e.pointer, op: (
+            /** @type {"set"} */
+            "set"
+          ), value: e.value });
+        } else {
+          pointerEdits.push({ pointer: e.pointer, op: (
+            /** @type {"delete"} */
+            "delete"
+          ) });
+        }
+      }
       bytes = applyJsoncEdits(doc.raw ?? "", pointerEdits);
     } else {
       const { value: sourceValue } = parseRootConfigPreservingOrder(doc.raw ?? "");
       if (sourceValue && typeof sourceValue === "object") {
         docForWrite = sourceValue;
+        for (const e of staleEdits) {
+          if (e.kind === "restore") {
+            docForWrite = setPointer(docForWrite, e.pointer, e.value);
+          } else {
+            docForWrite = removePointer(docForWrite, e.pointer);
+          }
+        }
         if (promotion.record) {
           docForWrite = setPointer(docForWrite, promotion.record.pointer, { "*": promotion.record.previous.value });
         }
@@ -3612,7 +3648,7 @@ function planInstallRoot({ doc, target, relPath, descriptors, previousRecords })
   } catch {
     bytes = Buffer.from(formatRootConfig(result.doc), "utf8");
   }
-  const records = mergePointerRecords(descriptors, previousRecords, result, doc.before);
+  const records = mergePointerRecords(descriptors, livePreviousRecords, result, doc.before);
   if (promotion.record) {
     records.push({
       pointer: promotion.record.pointer,
@@ -5210,7 +5246,7 @@ async function assembleLock({ repoRoot, plan, lock, configPlan, rootPlan, profil
     manager: {
       schemaVersion: CURRENT_LOCK_SCHEMA,
       name: "opencode-ship",
-      version: "1.1.2",
+      version: "1.1.3",
       templateSet: TEMPLATE_SET_ID,
       profile: resolvedProfile,
       appliedAt: (/* @__PURE__ */ new Date()).toISOString(),

package/dist/core.js

@@ -1,4 +1,4 @@
-// opencode-ship/core v1.1.2
+// opencode-ship/core v1.1.3
 
 // src/adapter.js
 import { readFile, writeFile, mkdir, rename } from "node:fs/promises";

package/dist/plugin.js

@@ -1,4 +1,4 @@
-// opencode-ship v1.1.2
+// opencode-ship v1.1.3
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -19328,7 +19328,7 @@ function selectRuntimeAdapter({ config: config2, shipAdapter, legacyAdapter }) {
 import { readFileSync as readFileSync4, existsSync as existsSync27 } from "node:fs";
 import { dirname as dirname12, resolve as resolve21 } from "node:path";
 import { fileURLToPath } from "node:url";
-var PACKAGE_VERSION = "1.1.2";
+var PACKAGE_VERSION = "1.1.3";
 var TEMPLATE_SET = `v${PACKAGE_VERSION}`;
 
 // src/plugin.js

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-ship",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "private": false,
   "description": "npm-distributed OpenCode installer that materializes the delivery plugin, reviewer/verifier agents, skills, ship config and lock into any consumer repository.",
   "license": "MIT",