opencode-ship 1.1.5 → 1.1.8

package/CHANGELOG.md

@@ -2,6 +2,59 @@
 
 All notable changes to `opencode-ship` are recorded here.
 
+## 1.1.8 — Durable self-host routing correction (unreleased)
+
+- **Deterministic controller entrypoint.** Build calls `ship_deliver` to
+  dispatch one `ship-controller` session per issue. Schema-v2 worktrees
+  refuse implementation until the durable workflow is linked.
+- **Linked-worktree execution.** Builder, task review, commit verification,
+  verifier/CI binding, and dual-axis final review run in the registered
+  feature worktree while durable state stays in the Git common directory.
+- **Audited abandon.** `delivery_abandon` records immutable intent and
+  completion around CAS-safe cleanup of a closed, unmerged attempt. It
+  never closes a PR and never marks Ready.
+- Automated install, qualification, and rollout continue to pin exact
+  `opencode-ship@<X.Y.Z>` and never resolve `@latest`.
+
+## 1.1.7 — Stabilization and self-hosting
+
+> Baseline: https://github.com/Viktorxyz/opencode-ship/issues/70.
+> Corrective package: https://github.com/Viktorxyz/opencode-ship/issues/72.
+> Authoritative plan: `docs/release/1.1.6-correction-plan.md`.
+
+- **Truthful baseline before implementation.** `1.1.5` remains the current
+  npm `latest`, and `1.1.7` is the active unpublished correction. The immutable
+  tag `1.1.6` failed in `pack` before npm publish or GitHub Release. This entry
+  does not claim the `1.1.7` fixes have shipped or qualified, and `main` does
+  not yet contain its own installed `.opencode` control layer.
+- **Bounded follow-up slices.** Runtime and release corrections, exact-version
+  self-host bootstrap, and automated exact-version update proposals will ship
+  as separate issue/worktree/PR lifecycles. Every automated install or update
+  pins `opencode-ship@<X.Y.Z>` and never resolves `@latest`.
+- **Convergent merge and cleanup recovery.** A Ready manifest now reconciles a
+  PR that a maintainer already merged in GitHub instead of attempting a second
+  merge. Cleanup retries resume from their persisted stage, tolerate an
+  already-removed worktree, delete the branch with the existing CAS guard,
+  seal the manifest, and clear the Git-common-dir pending record.
+- **Portable locks and bounded permissions.** Managed lock templates are
+  package-relative rather than npm-cache absolute paths. Build no longer
+  installs a broad `bash/* = allow` rule; destructive command denies remain
+  explicit while ordinary built-ins stay consumer-owned.
+- **Release and package hardening.** The GitHub Release job checks out the
+  resolved release ref, `prepack` fails without installing missing tools,
+  `opencode-ship/core` publishes real declarations and the canonical package
+  version, and the stale `0.1.3` source literal is removed.
+- **Release claims stay evidence-bound.** This entry becomes a released
+  changelog only after local verification, npm provenance, the GitHub Release,
+  qualification hashes, and a real self-host lifecycle all agree.
+
+## 1.1.6 — Qualification failed before publication
+
+> Release workflow run: https://github.com/Viktorxyz/opencode-ship/actions/runs/33495352417.
+
+- The immutable `1.1.6` tag failed in `pack` before npm publish or GitHub
+  Release. No npm package or GitHub Release was created.
+
 ## 1.1.5 — `ship-plan` is product-only
 
 > Branch: `feat/1.1.5-ship-plan-prompt`.

package/README.md

@@ -2,9 +2,9 @@
 
 > npm-distributed OpenCode installer and delivery plugin: a single command materialises the lifecycle plugin, reviewer/verifier agents, and skills into any consumer repository, with a recoverable lock and never silently overwrites managed files.
 >
-> **Status:** `1.1.5` is on `npm dist-tag latest` and tightens the `ship-plan` primary planning agent so the Plan tab is product-only: it asks about the product, writes `.opencode/plans/*.md`, and stops. It never asks the user how to run the work (issues vs Task N, subagent vs inline, Tab / Build, `ship-deliver`), never mentions permission globs, and never offers to implement. From 1.1.4 `ship-plan` is the write-capable planning agent; OpenCode's built-in lowercase `plan` Tab is disabled. `1.1.3` supersedes the `1.1.2 stabilization` line by dropping the broken `permission: { "*": "deny" }` wildcard and adding a stale-pointer removal path so `update` cleans the orphan key on the first run. The `1.1.0` tag is immutable. Consumers of `opencode-delivery@0.1.x` should run `pnpm dlx opencode-ship@latest init` from the same checkout; migration recognises the legacy artifacts and adopts them when their bytes match.
+> **Status:** `1.1.7` is the published stabilization and self-hosting correction. The immutable tag `1.1.6` failed in `pack` before npm publish or GitHub Release; no npm package or GitHub Release was created. `1.1.8` is the unpublished durable-routing correction: Build dispatches `ship_deliver`, schema-v2 execution binds to the linked worktree, and closed unmerged attempts can be abandoned with `delivery_abandon`. See [`docs/release/1.1.6-correction-plan.md`](docs/release/1.1.6-correction-plan.md).
 >
-> Consumers should use `opencode-ship@1.1.0` (or `@latest`) until `1.1.1` ships. The previous `1.0.0` is on `next`; consumers who pinned to `1.0.x` will continue to receive updates on that channel.
+> Use an exact package version for reproducible installs and all self-hosting work. Never resolve `@latest` inside an automated release or self-host update. Prerelease candidates publish under `npm dist-tag next` until qualification promotes a stable pin.
 
 ---
 
@@ -12,7 +12,7 @@
 
 ```sh
 # 1. Install managed files. No flags required.
-pnpm dlx opencode-ship@latest init
+pnpm dlx opencode-ship@1.1.5 init
 
 # 2. Restart OpenCode in this repo.
 
@@ -70,11 +70,11 @@ The only source tree that ships in the npm tarball is `assets/`. Anything copied
 Once `opencode-ship` is published, consumers install with `pnpm dlx` (or `npx`) and never edit the file by hand:
 
 ```
-pnpm dlx opencode-ship@latest init      # install managed files
-pnpm dlx opencode-ship@latest update    # apply a packaged upgrade
-pnpm dlx opencode-ship@latest diff      # preview what would change
-pnpm dlx opencode-ship@latest doctor    # environment and lock audit
-pnpm dlx opencode-ship@latest uninstall # remove only the files still matching the lock
+pnpm dlx opencode-ship@1.1.5 init      # install managed files
+pnpm dlx opencode-ship@1.1.5 update    # apply a packaged upgrade
+pnpm dlx opencode-ship@1.1.5 diff      # preview what would change
+pnpm dlx opencode-ship@1.1.5 doctor    # environment and lock audit
+pnpm dlx opencode-ship@1.1.5 uninstall # remove only the files still matching the lock
 ```
 
 If you want to try a pre-release tarball locally without publishing to npm:
@@ -109,13 +109,13 @@ These JSON Schemas are published and discoverable through the `exports` map:
 
 ### Legacy migration
 
-Existing consumers of `opencode-delivery@0.1.x` (commit-pinned shim) can run `pnpm dlx opencode-ship@latest init` from the same checkout. Migration recognises `.opencode/delivery.json`, `.opencode/delivery.lock.json`, the two canonical agents, and the generic plugin `.opencode/plugin/delivery.ts`, and adopts them when their bytes match. Legacy artifacts are preserved on disk so a downgrade remains possible; the installer does NOT modify Leo or any other consumer.
+Existing consumers of `opencode-delivery@0.1.x` (commit-pinned shim) can run `pnpm dlx opencode-ship@1.1.5 init` from the same checkout. Migration recognises `.opencode/delivery.json`, `.opencode/delivery.lock.json`, the two canonical agents, and the generic plugin `.opencode/plugin/delivery.ts`, and adopts them when their bytes match. Legacy artifacts are preserved on disk so a downgrade remains possible; the installer does NOT modify Leo or any other consumer.
 
 `diff` is now strictly read-only; it reports every change but never writes to disk, even when the migration phase has a candidate seed-config to plant.
 
 ## Lifecycle
 
-1. Begin a Build task: the delivery plugin immediately runs any queued post-merge cleanups. Failed cleanups are recorded in `ship.lock.json#cleanupPending` and retried at the next delivery task or plugin startup.
+1. Begin a Build task: the delivery plugin immediately runs any queued post-merge cleanups. Failed cleanups are recorded under `<git-common-dir>/opencode-ship/cleanup-pending.json` and retried at the next delivery task or plugin startup.
 2. Optional Deep Research checkpoint for non-trivial plans.
 3. Find or create exactly one issue per PR.
 4. Discover the default branch and fetch it.
@@ -130,7 +130,7 @@ Existing consumers of `opencode-delivery@0.1.x` (commit-pinned shim) can run `pn
 13. Push and wait for required remote CI checks.
 14. Mark the PR Ready and stop.
 15. Explicit "merge it" re-runs the freshness checks and performs the squash merge.
-16. The plugin immediately invokes `delivery_cleanup`; failures leave `cleanupPending` for the next session.
+16. The plugin immediately invokes `delivery_cleanup`; failures persist their next cleanup stage in the Git common dir for the next session.
 
 ## Exit codes
 
@@ -158,7 +158,7 @@ The shipped artifact is built by esbuild (`scripts/build.mjs`); self-contained `
 ## Status and licensing
 
 - **License:** MIT. See `LICENSE`.
-- **Versioning:** SemVer. v0.2.0 is the first npm-distributed release. v0.3.0 is the installer foundation. v0.4.0 adds the profile-aware installer foundation (`--profile` flag, lock schema v2, profile precedence) that issue #18 requires. v0.5.0 ships the engineering profile content (triage + grill-with-docs SKILL.md placeholders) required by issue #20. v0.6.0 ships the durable plan artifact + Plan Mode permission integration required by issue #21. v0.7.0 ships the M3 task loop contract (run store, task brief, Spec/Quality verdicts, 3-round breaker, commit binding, compaction context) required by issue #22. v0.8.0 ships the Ready gate contract (parallel Standards/Spec + verifier + CI on one HEAD) required by issue #23. v0.9.0 ships the transition matrix smoke (engineering installs all assets, lock tracks the active profile) required by issue #24. v1.0.0 promotes the dogfooded 0.10.0 to stable. v1.1.0 removes the legacy core profile and ships the one-liner init + setup-ship-workflow skill. v1.1.1 is the first fully self-hosting release (see `docs/release/1.1.1-stabilization-plan.md`).
+- **Versioning:** SemVer. v0.2.0 is the first npm-distributed release. v0.3.0 is the installer foundation. v0.4.0 adds the profile-aware installer foundation (`--profile` flag, lock schema v2, profile precedence) that issue #18 requires. v0.5.0 ships the engineering profile content (triage + grill-with-docs SKILL.md placeholders) required by issue #20. v0.6.0 ships the durable plan artifact + Plan Mode permission integration required by issue #21. v0.7.0 ships the M3 task loop contract (run store, task brief, Spec/Quality verdicts, 3-round breaker, commit binding, compaction context) required by issue #22. v0.8.0 ships the Ready gate contract (parallel Standards/Spec + verifier + CI on one HEAD) required by issue #23. v0.9.0 ships the transition matrix smoke (engineering installs all assets, lock tracks the active profile) required by issue #24. v1.0.0 promotes the dogfooded 0.10.0 to stable. v1.1.0 removes the legacy core profile and ships the one-liner init + setup-ship-workflow skill. v1.1.1 began the self-hosting correction line; the immutable `1.1.6` failed before publication, `1.1.7` is the published stabilization correction, and `1.1.8` is the unpublished durable-routing correction (see `docs/release/1.1.6-correction-plan.md`).
 - **Compatibility:** the bundled plugin targets `@opencode-ai/plugin >= 1.15.5 < 2` and OpenCode `>= 1.15.5`.
 
 ## FAQ

package/THIRD_PARTY_NOTICES.md

@@ -1,6 +1,6 @@
 # Third-Party Notices
 
-`opencode-ship@1.1.5` ships the complete Matt Pocock and Superpowers
+`opencode-ship@1.1.8` includes the complete Matt Pocock and Superpowers
 methodology under the MIT license, plus the Ship-owned installer,
 plugin, agents, and skills. The complete immutable pin list is in
 `vendor/sources.json`; the upstream snapshots are under

package/assets/agents/ship-controller.md

@@ -75,6 +75,7 @@ permission:
   delivery_issue_labels: allow
   delivery_issue_link: allow
   delivery_issue_close: ask
+  delivery_abandon: ask
   delivery_sync: allow
   delivery_publish: allow
   ship_plan_start: allow
@@ -89,7 +90,7 @@ permission:
   ship_final_review: deny
   ship_resume: allow
   ship_status: allow
-  ship_deliver: allow
+  ship_deliver: deny
   ship_skill_discover: allow
   ship_skill_install: allow
   ship_skill_audit: allow
@@ -118,11 +119,13 @@ strong planner and task reviewer child sessions.
 5. On the final task, dispatch the parallel Standards + Spec
    final reviewers against the same HEAD, run the verifier
    in an independent session, and bind every gate to one HEAD.
-6. On explicit user request, run the merge with a fresh gate
-   recheck.
-7. On resume, reconcile the durable state with the live Git
-   state and never duplicate work already recorded in a
-   commit trailer.
+  6. On explicit user request, run the merge with a fresh gate
+     recheck.
+  7. On resume, reconcile the durable state with the live Git
+     state and never duplicate work already recorded in a
+     commit trailer.
+  8. After the user explicitly closes an unmerged PR and requests
+     abandon, call `delivery_abandon`. Never close the PR yourself.
 
 ## What you never do
 

package/assets/commands/ship-deliver.md

@@ -1,5 +1,5 @@
 ---
-description: Start a delivery workflow. First checks the setup-pending marker, runs skill discovery, then triggers planning with the same-HEAD Ready and merge gates.
+description: Start a delivery workflow. First checks the setup-pending marker, then dispatches the durable ship-controller through ship_deliver.
 ---
 
 # ship-deliver
@@ -25,31 +25,23 @@ If the marker is present:
 
 If the marker is absent, continue.
 
-### 1. Skill discovery (mandatory)
+### 1. Dispatch the controller
 
-Before dispatching the planner, run the `skill-discovery` skill:
+Call `ship_deliver` with the issue number. Do not implement the issue through the legacy `delivery_issue` / `delivery_worktree` / `delivery_pr` path.
 
-```text
-npx skills find "<query from issue/plan>"
-```
-
-Auto-install trusted sources (see `ship.config.json#skillDiscovery.trustedOwners`); present non-trusted candidates to the user. Limit to 5 auto-installs per dispatch.
+1. Check setup-pending.
+2. Call `ship_deliver(issueNumber)`.
+3. Surface the controller session and `wf-<issue>` workflow id.
+4. Await the explicit plan approval prompt.
+5. Resume only through `ship-controller`.
 
 ### 2. Plan + approve
 
-1. Resolve or restore workflow state from `<git-common-dir>/opencode-ship/`.
-2. Dispatch the strong planner (`openai/gpt-5.6-sol` by default) to produce a PlanV2 contract.
-3. Wait for `ship_plan_approve` from the user. Never auto-approve.
-4. Mirror the plan to the issue.
+The controller starts or resumes durable workflow state, dispatches the planner, and waits for `ship_plan_approve`. Never auto-approve.
 
 ### 3. Execute
 
-Drive each task through:
-
-- cheap builder (`minimax/MiniMax-M3` by default) — implement + report
-- task reviewer (Spec + Quality) — verdict
-- controller commit + push
-- same-HEAD gate: Standards + Spec final reviews, verifier, required CI
+The controller drives each task through the cheap builder, task reviewer, commit binding, and same-HEAD Standards + Spec + verifier + required CI gates.
 
 ### 4. Ready
 
@@ -57,27 +49,20 @@ Stop at Ready. Surface PR URL, worktree path, verifier SHA, and the explicit-mer
 
 ### 5. Merge
 
-On explicit `merge it`: fresh gate recheck, squash merge, cleanup, core downgrade, uninstall, root-config byte restoration.
+On explicit `merge it`: fresh gate recheck, squash merge, and cleanup.
 
 ## Hard rules
 
 - **Never skip the setup gate.** If the marker is present, refuse to plan.
-- **Never skip skill discovery.** The discovery is part of the autonomous-uplift contract.
 - **Never auto-approve a plan.** The user always reviews the plan.
 - **Never mark Ready or merge without a passing Standards review, a passing Spec review, a passing verifier run, and a passing required-CI check, all bound to one HEAD.**
 - **Never force-push, hard-reset, stash, or `git worktree remove`.**
 - **Never use `gh api` or raw shell on GitHub.** Use the typed `delivery_*` tools.
-
-## Single-shot research checkpoint
-
-If you decide the task is non-trivial, pause once and **ask the user** whether to run Deep Research before generating any prompt. The default save-tokens path is "no research, continue with the plan as written". Only on explicit "yes" do you generate a draft Deep Research prompt and run the research; summarize the relevant findings inline and continue. Do not write to `docs/research/` unless the findings materially shape an ADR; ADR storage is the project's call, not yours. Continue only after the user confirms or declines.
-
-The full procedure lives in the `planning-research-checkpoint` skill. Do not duplicate the prompt-generation logic here — just trigger the skill and respect its ask-first policy.
+- **Never abandon an attempt without an explicit user request after the PR is closed unmerged.** The controller may then call `delivery_abandon`.
 
 ## Stop conditions
 
 - Setup pending: stop, run setup, then re-dispatch.
 - Ready reached: stop. Surface the PR URL, the worktree path, the recorded verifier SHA, and the explicit-merge instruction.
-- `merge it` requested and gates are fresh: perform the squash merge. Surface the merge SHA. The plugin will queue immediate cleanup; if cleanup fails it is recorded as `cleanupPending` and retried on the next Build task.
+- `merge it` requested and gates are fresh: perform the squash merge. Surface the merge SHA.
 - Any gate fails after one re-run: stop. Surface the failing tool, the failing input, and the recorded evidence.
-- Unexpected lifecycle error (missing-manifest, head-changed, ci-failing): stop. Surface the error envelope.

package/assets/skills/delivery-workflow/SKILL.md

@@ -5,7 +5,7 @@ description: Orchestrates the canonical delivery lifecycle from issue creation t
 
 # delivery-workflow
 
-You drive the opencode-ship package from a one-line user request to a green, conflict-free, ready-to-merge pull request.
+You drive the opencode-ship package from a one-line user request to a green, conflict-free, ready-to-merge pull request by dispatching the durable controller.
 
 ## When you trigger
 
@@ -17,6 +17,7 @@ You drive the opencode-ship package from a one-line user request to a green, con
 - "Clean up my worktree" / "Tidy old worktrees" — entry point for next-task cleanup
 
 Do **not** trigger on:
+
 - Read-only questions ("explain issue N")
 - Plain chat about the project's domain model
 - Typo / doc one-liners that do not deserve a PR
@@ -25,40 +26,32 @@ Do **not** trigger on:
 
 | Step | Tool | Notes |
 |---|---|---|
-| 1. Cleanup old worktrees | `delivery_inspect` for each manifest, recovery scan, `delivery_cleanup` for provably-merged ones | Runs immediately after a successful merge; retries on next Build task if interrupted |
-| 2. Offer research checkpoint | (this skill) | Single-shot per session; offer only if the plan is non-trivial |
-| 3. Find or create the issue | `delivery_issue` | Always idempotent; never create a duplicate |
-| 4. Create a worktree | `delivery_worktree` | Refuse overwrites; refuse dirty tree |
-| 5. Implement | (consumer-owned) | Stay inside the worktree |
-| 6. Commit + push | (consumer-owned `git`) | Use Conventional Commits |
-| 7. Open draft PR | `delivery_pr` | `Closes #N` is added automatically |
-| 8. Sync with default branch | (consumer-owned `git`) | Merge `origin/main` into the feature branch; never rebase a published branch |
-| 9. Review | `task reviewer:delivery-reviewer` | Re-run if HEAD changed |
-| 10. Verify | `task verifier:delivery-verifier` | Same final HEAD required |
-| 11. Mark Ready | `delivery_ready` | Refreshes checks; refuses if any gate is stale |
-| 12. Stop at Ready | (this skill) | Do not merge without an explicit user request |
-| 13. Merge (only on explicit request) | `delivery_merge` | Re-checks base, head, and mergeability |
-| 14. Immediate cleanup | `delivery_cleanup` | Runs automatically right after a successful merge |
+| 1. Cleanup merged worktrees | `delivery_inspect` / `delivery_cleanup` | Only for provably merged attempts |
+| 2. Setup gate | `/ship-deliver` | Refuse if `.opencode/ship.setup-pending.json` exists |
+| 3. Dispatch controller | `ship_deliver` | Canonical Build-to-controller entrypoint |
+| 4. Plan + approve | controller / `ship_plan_approve` | Never auto-approve |
+| 5. Execute in linked worktree | controller | Builder, task review, commit, verifier, CI, dual-axis final review |
+| 6. Ready | `delivery_ready` | Controller-owned; same-HEAD gates required |
+| 7. Stop at Ready | (this skill) | Do not merge without an explicit user request |
+| 8. Merge | `delivery_merge` | Explicit user request only |
+| 9. Cleanup | `delivery_cleanup` | After a successful merge |
+| 10. Abandon closed unmerged attempts | `delivery_abandon` | Only after the user explicitly closes the PR and requests abandon |
+
+Do not call `delivery_worktree`, `delivery_pr`, `delivery_ready`, or `delivery_merge` from Build to implement an issue. Those mutations belong to `ship-controller` after `ship_deliver`.
 
 ## Hard rules
 
-1. Every PR carries a `Closes #N` reference. If the issue does not exist, create it first.
+1. Every PR carries a `Closes #N` reference. If the issue does not exist, the controller creates it first.
 2. The lifecycle stops at Ready by default. An explicit "merge it" is the only thing that triggers `delivery_merge`.
-3. Force-push, hard-reset, stash, and `git worktree remove` are denied to you. Use `delivery_worktree` and `delivery_cleanup` instead.
+3. Force-push, hard-reset, stash, and `git worktree remove` are denied. Use typed cleanup/abandon tools.
 4. You never edit `main` directly. You never bypass the reviewer/verifier gates.
-5. The typed `delivery_*` tools are the only sanctioned way to mutate GitHub state. Do not invoke `gh pr merge`, `gh api`, or raw Git plumbing directly.
+5. The typed tools are the only sanctioned way to mutate GitHub state. Do not invoke `gh pr merge`, `gh api`, or raw Git plumbing directly.
 6. When a gate fails, fix the cause and re-run only the failed gate; never skip.
 7. If `delivery_merge` returns a `MergeError`, surface it verbatim. Do not invent a workaround.
 
-## Single-shot research checkpoint
-
-If you decide the task is non-trivial, pause once and **ask the user** whether to run Deep Research before generating any prompt. The default save-tokens path is "no research, continue with the plan as written". Only on explicit "yes" do you generate a draft Deep Research prompt and run the research; summarize the relevant findings inline and continue. Do not write to `docs/research/` unless the findings materially shape an ADR; ADR storage is the project's call, not yours. Continue only after the user confirms or declines.
-
-The full procedure lives in the `planning-research-checkpoint` skill. Do not duplicate the prompt-generation logic here — just trigger the skill and respect its ask-first policy.
-
 ## Stop conditions
 
 - Ready reached: stop. Surface the PR URL, the worktree path, the recorded verifier SHA, and the explicit-merge instruction.
-- `merge it` requested and gates are fresh: perform the squash merge. Surface the merge SHA. The plugin will queue immediate cleanup; if cleanup fails it is recorded as `cleanupPending` and retried on the next Build task.
+- `merge it` requested and gates are fresh: perform the squash merge. Surface the merge SHA.
 - Any gate fails after one re-run: stop. Surface the failing tool, the failing input, and the recorded evidence.
-- Unexpected lifecycle error (missing-manifest, head-changed, ci-failing): stop. Surface the error envelope.
+- Unexpected lifecycle error (missing-manifest, missing-workflow-link, head-changed, ci-failing): stop. Surface the error envelope.

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// opencode-ship CLI v1.1.5
+// opencode-ship CLI v1.1.8
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -110,7 +110,7 @@ import { fileURLToPath as fileURLToPath2 } from "node:url";
 var PACKAGE_VERSION, TEMPLATE_SET;
 var init_version = __esm({
   "src/version.js"() {
-    PACKAGE_VERSION = "1.1.5";
+    PACKAGE_VERSION = "1.1.8";
     TEMPLATE_SET = `v${PACKAGE_VERSION}`;
   }
 });
@@ -119,6 +119,7 @@ var init_version = __esm({
 var catalog_exports = {};
 __export(catalog_exports, {
   CATALOG: () => CATALOG,
+  PACKAGE_ROOT: () => PACKAGE_ROOT,
   PACKAGE_VERSION: () => PACKAGE_VERSION,
   TEMPLATE_SET_ID: () => TEMPLATE_SET_ID,
   filterCatalogByProfile: () => filterCatalogByProfile,
@@ -205,7 +206,7 @@ function validateCatalog({ catalog = CATALOG } = {}) {
   }
   return catalog;
 }
-var TEMPLATE_SET_ID, packageRoot, MATT_SKILLS, SUPER_SKILLS, ENGINEERING_AGENTS, ENGINEERING_COMMANDS, CATALOG, ALLOWED_KINDS;
+var TEMPLATE_SET_ID, packageRoot, PACKAGE_ROOT, MATT_SKILLS, SUPER_SKILLS, ENGINEERING_AGENTS, ENGINEERING_COMMANDS, CATALOG, ALLOWED_KINDS;
 var init_catalog = __esm({
   "src/installer/catalog.js"() {
     init_package_root();
@@ -213,6 +214,7 @@ var init_catalog = __esm({
     init_profile();
     TEMPLATE_SET_ID = TEMPLATE_SET;
     packageRoot = resolvePackageRoot(import.meta.url);
+    PACKAGE_ROOT = packageRoot;
     MATT_SKILLS = [
       "engineering-workflow",
       "grilling",
@@ -1731,7 +1733,7 @@ init_catalog();
 init_version();
 import { existsSync as existsSync13 } from "node:fs";
 import { mkdir as mkdir6, readFile as readFile9, rename as rename5, unlink as unlink3, writeFile as writeFile6 } from "node:fs/promises";
-import { dirname as dirname8, resolve as resolve12 } from "node:path";
+import { dirname as dirname8, relative as relative2, resolve as resolve12, sep as sep2 } from "node:path";
 
 // src/installer/planner.js
 init_catalog();
@@ -1767,6 +1769,7 @@ var CONTROLLER_TASK_ALLOW = [
   "delivery-verifier"
 ];
 var PUBLIC_TOOL_IDS = [
+  "delivery_abandon",
   "delivery_cleanup",
   "delivery_github_read",
   "delivery_inspect",
@@ -1783,6 +1786,7 @@ var PUBLIC_TOOL_IDS = [
   "delivery_sync",
   "delivery_verify",
   "delivery_worktree",
+  "ship_deliver",
   "ship_final_review",
   "ship_plan_approve",
   "ship_plan_start",
@@ -1807,6 +1811,7 @@ var BUILD_TOOL_ALLOW = [
   "delivery_pr",
   "delivery_ready",
   "delivery_worktree",
+  "ship_deliver",
   "ship_status",
   "ship_resume"
 ];
@@ -1814,6 +1819,7 @@ var BUILD_TOOL_ASK = [
   "ship_plan_approve",
   "delivery_merge",
   "delivery_issue_close",
+  "delivery_abandon",
   "ship_skill_install"
 ];
 var CONTROLLER_TOOL_ALLOW = [
@@ -1844,7 +1850,8 @@ var CONTROLLER_TOOL_ALLOW = [
 var CONTROLLER_TOOL_ASK = [
   "ship_plan_approve",
   "delivery_merge",
-  "delivery_issue_close"
+  "delivery_issue_close",
+  "delivery_abandon"
 ];
 var H = "git";
 var RESET = "--hard";
@@ -1867,8 +1874,8 @@ var FORBIDDEN_BASH_GLOBS_CONTROLLER = [
   "rm -rf *",
   "rm -rf /*"
 ];
-function denyMap(globs) {
-  const out = { "*": "allow" };
+function denyMap(globs, allowByDefault = true) {
+  const out = allowByDefault ? { "*": "allow" } : {};
   for (const g of globs) out[g] = "deny";
   return out;
 }
@@ -1893,7 +1900,7 @@ function rootPermissionMatrix() {
           "delivery-verifier": "allow"
         },
         bash: {
-          ...denyMap(FORBIDDEN_BASH_GLOBS),
+          ...denyMap(FORBIDDEN_BASH_GLOBS, false),
           "rm *": "ask"
         }
       },
@@ -2734,11 +2741,11 @@ function parseTree(text, errors = [], options = ParseOptions.DEFAULT) {
       onValue({ type: getNodeType(value), offset, length, parent: currentParent, value });
       ensurePropertyComplete(offset + length);
     },
-    onSeparator: (sep2, offset, length) => {
+    onSeparator: (sep3, offset, length) => {
       if (currentParent.type === "property") {
-        if (sep2 === ":") {
+        if (sep3 === ":") {
           currentParent.colonOffset = offset;
-        } else if (sep2 === ",") {
+        } else if (sep3 === ",") {
           ensurePropertyComplete(offset);
         }
       }
@@ -5249,7 +5256,7 @@ async function assembleLock({ repoRoot, plan, lock, configPlan, rootPlan, profil
     manager: {
       schemaVersion: CURRENT_LOCK_SCHEMA,
       name: "opencode-ship",
-      version: "1.1.5",
+      version: "1.1.8",
       templateSet: TEMPLATE_SET_ID,
       profile: resolvedProfile,
       appliedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -5390,9 +5397,7 @@ function serializePlan(plan) {
 }
 function relativeTemplate(source) {
   if (typeof source !== "string") return source;
-  const prefix = `${process.cwd()}/`;
-  if (source.startsWith(prefix)) return source.slice(prefix.length);
-  return source;
+  return relative2(PACKAGE_ROOT, source).split(sep2).join("/");
 }
 
 // src/installer/commands/doctor.js