opencode-ship 1.1.5 → 1.1.8

package/dist/plugin.js

@@ -1,4 +1,4 @@
-// opencode-ship v1.1.5
+// opencode-ship v1.1.8
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -12706,7 +12706,7 @@ tool.schema = external_exports;
 
 // src/plugin.js
 import { resolve as resolve22 } from "node:path";
-import { readFile as readFile24 } from "node:fs/promises";
+import { readFile as readFile26 } from "node:fs/promises";
 
 // src/adapter.js
 import { readFile, writeFile, mkdir, rename } from "node:fs/promises";
@@ -13740,6 +13740,9 @@ function createWorktreeTool(deps) {
         expectedRoot: resolve7(deps.repoRoot, worktreeRoot)
       };
     }
+    if (m.schemaVersion >= 2 && !m.workflowId) {
+      return { kind: "missing-workflow-link", taskId: m.taskId };
+    }
     const remote = deps.remote ?? "origin";
     const hasRemote = remoteExists(remote, deps.repoRoot);
     if (hasRemote) {
@@ -14925,6 +14928,42 @@ function createMergeTool(deps) {
     } else if (m.schemaVersion >= 2) {
       return { kind: "missing-workflow-link", taskId: m.taskId };
     }
+    if (pr.headSha !== (m.lastPrHeadSha ?? pr.headSha)) {
+      return {
+        kind: "head-changed",
+        headSha: pr.headSha,
+        manifestSha: m.lastPrHeadSha ?? ""
+      };
+    }
+    async function recordMerged(merged2, reason) {
+      const t = transition(
+        { ...m, lastPrHeadSha: merged2.headSha },
+        "merged",
+        { reason }
+      );
+      if (!t.ok) return { kind: "lifecycle", reason: t.reason };
+      const next = {
+        ...m,
+        lastPrHeadSha: merged2.headSha,
+        state: t.to,
+        transitionLog: [
+          ...m.transitionLog,
+          { from: t.from, to: t.to, at: t.at, reason: t.reason }
+        ],
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      const path = await writeManifest(deps.repoRoot, next);
+      if (finalEvidence && m.workflowId) {
+        await appendRunEvent(deps.repoRoot, m.workflowId, finalEvidence.runState, {
+          kind: RUN_EVENT_KINDS.MERGE,
+          data: { mergeSha: merged2.mergeSha ?? merged2.mergeCommitSha ?? merged2.headSha }
+        });
+      }
+      return { kind: "merge", contractVersion: 1, manifestPath: path, pr: m.prNumber, taskId: m.taskId };
+    }
+    if (pr.merged) {
+      return recordMerged(pr, `reconciled external merge as ${input.subject}`);
+    }
     if (freshGates) {
       const required2 = deps.adapter?.ready?.requires ?? [
         "review",
@@ -14951,13 +14990,6 @@ function createMergeTool(deps) {
       });
       if (!result.ok) return gateFailureEnvelope(result);
     }
-    if (pr.headSha !== (m.lastPrHeadSha ?? pr.headSha)) {
-      return {
-        kind: "head-changed",
-        headSha: pr.headSha,
-        manifestSha: m.lastPrHeadSha ?? ""
-      };
-    }
     if (pr.draft) return { kind: "not-mergeable", reason: "PR is still draft" };
     if (pr.mergeable !== "MERGEABLE") {
       return { kind: "not-mergeable", reason: `mergeable=${pr.mergeable}` };
@@ -14967,30 +14999,7 @@ function createMergeTool(deps) {
       number: m.prNumber,
       subject: input.subject
     });
-    const t = transition(
-      { ...m, lastPrHeadSha: merged.headSha },
-      "merged",
-      { reason: `squash merged as ${input.subject}` }
-    );
-    if (!t.ok) return { kind: "lifecycle", reason: t.reason };
-    const next = {
-      ...m,
-      lastPrHeadSha: merged.headSha,
-      state: t.to,
-      transitionLog: [
-        ...m.transitionLog,
-        { from: t.from, to: t.to, at: t.at, reason: t.reason }
-      ],
-      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    const path = await writeManifest(deps.repoRoot, next);
-    if (finalEvidence && m.workflowId) {
-      await appendRunEvent(deps.repoRoot, m.workflowId, finalEvidence.runState, {
-        kind: RUN_EVENT_KINDS.MERGE,
-        data: { mergeSha: merged.mergeSha ?? merged.mergeCommitSha ?? merged.headSha }
-      });
-    }
-    return { kind: "merge", contractVersion: 1, manifestPath: path, pr: m.prNumber, taskId: m.taskId };
+    return recordMerged(merged, `squash merged as ${input.subject}`);
   };
 }
 
@@ -15167,6 +15176,231 @@ function createCleanupTool(deps) {
   };
 }
 
+// src/tools/delivery-abandon.js
+import { join as join10 } from "node:path";
+import { spawnSync as spawnSync4 } from "node:child_process";
+import { existsSync as existsSync8 } from "node:fs";
+
+// src/state/abandon-store.js
+import { readFile as readFile7 } from "node:fs/promises";
+import { join as join8 } from "node:path";
+import { createHash as createHash7 } from "node:crypto";
+init_durable_store();
+var SAFE_ID_RE2 = /^[A-Za-z0-9._-]{1,128}$/;
+var HASH_RE2 = /^[0-9a-f]{64}$/;
+function abandonDir(commonDir, taskId) {
+  return join8(commonDir, "opencode-ship", "delivery", "abandoned", taskId);
+}
+function intentPathFor(commonDir, taskId) {
+  return join8(abandonDir(commonDir, taskId), "intent.json");
+}
+function completionPathFor(commonDir, taskId) {
+  return join8(abandonDir(commonDir, taskId), "completion.json");
+}
+async function readJsonOrNull2(path) {
+  try {
+    return JSON.parse(await readFile7(path, "utf8"));
+  } catch (err) {
+    if (err?.code === "ENOENT") return null;
+    throw err;
+  }
+}
+function withoutIntentHash(record2) {
+  const copy = { ...record2 ?? {} };
+  delete copy.intentHash;
+  return copy;
+}
+function hashAbandonIntent(record2) {
+  return createHash7("sha256").update(canonicalJson(withoutIntentHash(record2)), "utf8").digest("hex");
+}
+async function readAbandon(repoRoot, taskId) {
+  const commonDir = await resolveGitCommonDir(repoRoot);
+  if (!SAFE_ID_RE2.test(String(taskId ?? ""))) {
+    return { intent: null, completion: null };
+  }
+  return {
+    intent: await readJsonOrNull2(intentPathFor(commonDir, taskId)),
+    completion: await readJsonOrNull2(completionPathFor(commonDir, taskId))
+  };
+}
+async function publishOrReuse(path, record2) {
+  try {
+    await publishImmutableJson(path, record2);
+    return { ok: true, record: record2, idempotent: false };
+  } catch (err) {
+    const message = String(err?.message ?? err);
+    if (!message.includes("already exists")) throw err;
+    const existing = await readJsonOrNull2(path);
+    if (existing && canonicalJson(existing) === canonicalJson(record2)) {
+      return { ok: true, record: existing, idempotent: true };
+    }
+    return { ok: false, kind: "abandon-conflict" };
+  }
+}
+async function publishAbandonIntent(repoRoot, record2) {
+  const taskId = String(record2?.taskId ?? "");
+  if (!SAFE_ID_RE2.test(taskId)) {
+    return { ok: false, kind: "invalid-task-id" };
+  }
+  const sealed = { ...withoutIntentHash(record2), intentHash: hashAbandonIntent(record2) };
+  const commonDir = await resolveGitCommonDir(repoRoot);
+  return publishOrReuse(intentPathFor(commonDir, taskId), sealed);
+}
+async function publishAbandonCompletion(repoRoot, record2) {
+  const taskId = String(record2?.taskId ?? "");
+  const intentHash = String(record2?.intentHash ?? "");
+  if (!SAFE_ID_RE2.test(taskId)) {
+    return { ok: false, kind: "invalid-task-id" };
+  }
+  if (!HASH_RE2.test(intentHash)) {
+    return { ok: false, kind: "invalid-intent-hash" };
+  }
+  const commonDir = await resolveGitCommonDir(repoRoot);
+  return publishOrReuse(completionPathFor(commonDir, taskId), record2);
+}
+
+// src/skills/worktree.js
+import { execFile } from "node:child_process";
+import { promises as fs, existsSync as existsSync7 } from "node:fs";
+import { resolve as resolve9, dirname as dirname3, sep, isAbsolute, join as join9 } from "node:path";
+function listRegisteredWorktrees(mainRepo) {
+  return new Promise((resolveP, rejectP) => {
+    execFile(
+      "git",
+      ["-C", mainRepo, "worktree", "list", "--porcelain", "-z"],
+      { shell: false, maxBuffer: 1024 * 1024 },
+      (err, stdout) => {
+        if (err) return rejectP(err);
+        const records = parsePorcelain(stdout);
+        const mainRecord = records.shift();
+        const mainPath = mainRecord?.worktree ? resolve9(mainRecord.worktree) : null;
+        const linked = [];
+        for (const r of records) {
+          if (!r.worktree) continue;
+          const p = resolve9(r.worktree);
+          if (mainPath && p === mainPath) continue;
+          linked.push({ path: p, branch: r.HEAD ?? null });
+        }
+        resolveP(linked);
+      }
+    );
+  });
+}
+function parsePorcelain(text) {
+  const tokens = text.split("\0");
+  const out = [];
+  let current = {};
+  for (const tok of tokens) {
+    if (tok.length === 0) {
+      if (Object.keys(current).length > 0) {
+        out.push(current);
+        current = {};
+      }
+      continue;
+    }
+    const idx = tok.indexOf(" ");
+    const key = idx === -1 ? tok : tok.slice(0, idx);
+    const value = idx === -1 ? "" : tok.slice(idx + 1);
+    if (key === "branch") {
+      current.HEAD = value.startsWith("refs/heads/") ? value : `refs/heads/${value}`;
+    } else {
+      current[key] = value;
+    }
+  }
+  if (Object.keys(current).length > 0) out.push(current);
+  return out;
+}
+async function validateLinkedWorktree(mainRepo, worktreePath, options = {}) {
+  const main = resolve9(mainRepo);
+  if (!existsSync7(main)) {
+    return { ok: false, kind: "missing", message: `main repository ${main} does not exist` };
+  }
+  if (!worktreePath) {
+    return { ok: false, kind: "unlinked", message: "worktreePath is required" };
+  }
+  const wt = resolve9(worktreePath);
+  if (!existsSync7(wt)) {
+    return { ok: false, kind: "missing", message: `worktree ${wt} does not exist` };
+  }
+  const isCurrent = wt === main;
+  if (isCurrent) {
+    const gitEntry = options.allowCurrentLinked ? await fs.lstat(join9(main, ".git")).catch(() => null) : null;
+    if (!gitEntry?.isFile()) {
+      return { ok: false, kind: "main", message: "installs into the main worktree are forbidden" };
+    }
+  }
+  let cursor = wt;
+  while (cursor !== dirname3(cursor)) {
+    const stat3 = await fs.lstat(cursor).catch(() => null);
+    if (stat3?.isSymbolicLink()) {
+      return {
+        ok: false,
+        kind: "ancestor-symlink",
+        message: `worktree path contains a symlink at ${cursor}`
+      };
+    }
+    cursor = dirname3(cursor);
+  }
+  const real = await fs.realpath(wt).catch(() => null);
+  if (real && real !== wt) {
+    return {
+      ok: false,
+      kind: "symlink",
+      message: `worktree ${wt} resolves through a symlink to ${real}`
+    };
+  }
+  const linked = await listRegisteredWorktrees(main);
+  const matched = linked.find((entry) => entry.path === wt);
+  if (!matched) {
+    return {
+      ok: false,
+      kind: "unlinked",
+      message: `worktree ${wt} is not registered (git worktree list)`
+    };
+  }
+  return { ok: true, path: wt, registered: !!matched };
+}
+function validateRelativeInstallPath(destRel) {
+  if (typeof destRel !== "string" || destRel.length === 0) {
+    return { ok: false, kind: "absolute", message: "destination path required" };
+  }
+  if (isAbsolute(destRel)) {
+    return { ok: false, kind: "absolute", message: `destination must be relative: ${destRel}` };
+  }
+  if (destRel.includes("\\")) {
+    return { ok: false, kind: "parent-relative", message: `destination must use POSIX separators: ${destRel}` };
+  }
+  const parts = destRel.split("/");
+  for (const p of parts) {
+    if (p === "" || p === "." || p === "..") {
+      return { ok: false, kind: "parent-relative", message: `destination escapes worktree: ${destRel}` };
+    }
+  }
+  return { ok: true };
+}
+async function validateInstallDestination(worktreeRoot, destRel) {
+  const relativeCheck = validateRelativeInstallPath(destRel);
+  if (!relativeCheck.ok) return relativeCheck;
+  const root = resolve9(worktreeRoot);
+  const destination = resolve9(root, ...destRel.split("/"));
+  if (destination !== root && !destination.startsWith(root + sep)) {
+    return { ok: false, kind: "escape", message: `destination escapes worktree: ${destRel}` };
+  }
+  let cursor = root;
+  for (const part of destRel.split("/")) {
+    cursor = join9(cursor, part);
+    const entry = await fs.lstat(cursor).catch(() => null);
+    if (!entry) continue;
+    if (entry.isSymbolicLink()) {
+      return { ok: false, kind: "symlink", message: `destination path contains a symlink at ${cursor}` };
+    }
+    if (cursor !== destination && !entry.isDirectory()) {
+      return { ok: false, kind: "not-directory", message: `destination ancestor is not a directory: ${cursor}` };
+    }
+  }
+  return { ok: true, path: destination };
+}
+
 // src/tools/envelope.js
 import { randomBytes as randomBytes2 } from "node:crypto";
 var CONTRACT_VERSION = 2;
@@ -15205,25 +15439,224 @@ function failure(kind, message, options = {}) {
   };
 }
 
+// src/tools/delivery-abandon.js
+import { readFile as readFile8 } from "node:fs/promises";
+function runGit2(args, cwd) {
+  return spawnSync4("git", args, {
+    cwd,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    env: process.env
+  });
+}
+function defaultRemoveWorktree(repoRoot, path) {
+  return runGit2(["worktree", "remove", path], repoRoot);
+}
+function defaultDeleteBranch(repoRoot, branch, expectedSha) {
+  const args = ["update-ref", "-d", `refs/heads/${branch}`];
+  if (expectedSha && /^[0-9a-f]{7,}$/i.test(expectedSha)) args.push(expectedSha);
+  return runGit2(args, repoRoot);
+}
+function branchExists(repoRoot, branch) {
+  return runGit2(["show-ref", "--verify", "--quiet", `refs/heads/${branch}`], repoRoot).status === 0;
+}
+function remoteBranchHead(repoRoot, remote, branch) {
+  const r = runGit2(["ls-remote", "--heads", remote, branch], repoRoot);
+  if (r.status !== 0) return { ok: false, sha: null, present: false };
+  const line = r.stdout.split("\n").find((row) => row.includes(`refs/heads/${branch}`));
+  if (!line) return { ok: true, sha: null, present: false };
+  return { ok: true, sha: line.split(/\s+/)[0], present: true };
+}
+function unpublishedAhead(repoRoot, remote, branch) {
+  const r = runGit2(["rev-list", "--count", `${remote}/${branch}..${branch}`], repoRoot);
+  if (r.status !== 0) return null;
+  const n = parseInt(r.stdout.trim(), 10);
+  return Number.isFinite(n) ? n : null;
+}
+function refuse(opId, kind, extras = {}) {
+  return failure("abandon", kind, {
+    operationId: opId,
+    retryable: false,
+    details: { kind, ...extras }
+  });
+}
+async function readRunSnapshot(repoRoot, workflowId) {
+  try {
+    const common = await resolveGitCommonDir(repoRoot);
+    const path = join10(opencodeShipStateDir(common), "runs", workflowId, "run.json");
+    if (!existsSync8(path)) return null;
+    return JSON.parse(await readFile8(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function validateLiveAttempt({ deps, manifest, subject, opId }) {
+  if (!manifest.prNumber) return refuse(opId, "missing-pr");
+  if (!manifest.worktreePath) return refuse(opId, "missing-worktree-path");
+  const pr = await deps.driver.readPullRequest({
+    repo: deps.repoSlug,
+    number: manifest.prNumber
+  });
+  if (pr.merged || pr.state === "MERGED") return refuse(opId, "pr-merged");
+  if (pr.state !== "CLOSED") return refuse(opId, "pr-open");
+  if (pr.headRefName && pr.headRefName !== manifest.branch) {
+    return refuse(opId, "branch-mismatch", { expected: manifest.branch, received: pr.headRefName });
+  }
+  if (pr.baseRefName && pr.baseRefName !== manifest.baseBranch) {
+    return refuse(opId, "base-mismatch", { expected: manifest.baseBranch, received: pr.baseRefName });
+  }
+  const linked = await validateLinkedWorktree(deps.repoRoot, manifest.worktreePath);
+  if (!linked.ok) {
+    return refuse(opId, "invalid-worktree", { reason: linked.kind, message: linked.message });
+  }
+  if (!isWorktreeClean(linked.path)) return refuse(opId, "dirty-worktree");
+  if (isRebaseInProgress(linked.path)) return refuse(opId, "rebase-in-progress");
+  const head = currentHead(linked.path);
+  if (!head || head !== manifest.lastPrHeadSha || head !== pr.headSha) {
+    return refuse(opId, "head-mismatch", {
+      local: head ?? "",
+      manifest: manifest.lastPrHeadSha ?? "",
+      pr: pr.headSha ?? ""
+    });
+  }
+  const remote = deps.remote ?? "origin";
+  const remoteHead = remoteBranchHead(linked.path, remote, manifest.branch);
+  if (remoteHead.ok && remoteHead.present && remoteHead.sha !== head) {
+    return refuse(opId, "remote-diverged", { local: head, remote: remoteHead.sha });
+  }
+  const ahead = unpublishedAhead(linked.path, remote, manifest.branch);
+  if (ahead !== null && ahead > 0) {
+    return refuse(opId, "has-unpublished-commits", { ahead, branch: manifest.branch, remote });
+  }
+  if (manifest.workflowId) {
+    const snapshot = await readRunSnapshot(deps.repoRoot, manifest.workflowId);
+    if (snapshot?.state === "ready") return refuse(opId, "workflow-ready");
+    if (snapshot?.state === "merged") return refuse(opId, "workflow-merged");
+  }
+  return {
+    ok: true,
+    intent: {
+      schemaVersion: 1,
+      taskId: manifest.taskId,
+      issueNumber: manifest.issueNumber,
+      prNumber: manifest.prNumber,
+      branch: manifest.branch,
+      worktreePath: linked.path,
+      headSha: head,
+      workflowId: manifest.workflowId ?? null,
+      subject,
+      requestedAt: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  };
+}
+async function resumeCleanup({ deps, intent, opId }) {
+  const removeWorktree = deps.removeWorktree ?? defaultRemoveWorktree;
+  const deleteBranch = deps.deleteBranch ?? defaultDeleteBranch;
+  const removeManifest = deps.deleteManifest ?? deleteManifest;
+  let removedWorktree = !existsSync8(intent.worktreePath);
+  if (!removedWorktree) {
+    let removed;
+    try {
+      removed = await Promise.resolve(removeWorktree(deps.repoRoot, intent.worktreePath));
+    } catch (err) {
+      return refuse(opId, "remove-failed", { stderr: String(err?.message ?? err) });
+    }
+    if (removed?.status !== 0 && existsSync8(intent.worktreePath)) {
+      return refuse(opId, "remove-failed", { stderr: removed?.stderr ?? "" });
+    }
+    removedWorktree = !existsSync8(intent.worktreePath);
+  }
+  let deletedBranch = !branchExists(deps.repoRoot, intent.branch);
+  if (!deletedBranch) {
+    let deleted;
+    try {
+      deleted = await Promise.resolve(deleteBranch(deps.repoRoot, intent.branch, intent.headSha));
+    } catch (err) {
+      return refuse(opId, "branch-delete-failed", { stderr: String(err?.message ?? err) });
+    }
+    if (deleted?.status !== 0 && branchExists(deps.repoRoot, intent.branch)) {
+      return refuse(opId, "branch-delete-failed", { stderr: deleted?.stderr ?? "" });
+    }
+    deletedBranch = !branchExists(deps.repoRoot, intent.branch);
+  }
+  try {
+    await Promise.resolve(removeManifest(deps.repoRoot, intent.taskId));
+  } catch (err) {
+    return refuse(opId, "manifest-delete-failed", { stderr: String(err?.message ?? err) });
+  }
+  const remaining = await readManifest(deps.repoRoot, intent.taskId);
+  const deletedManifest = remaining === null;
+  const completion = {
+    schemaVersion: 1,
+    taskId: intent.taskId,
+    intentHash: intent.intentHash,
+    removedWorktree,
+    deletedBranch,
+    deletedManifest,
+    completedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const published = await publishAbandonCompletion(deps.repoRoot, completion);
+  if (!published.ok) return refuse(opId, published.kind);
+  return success2("abandon", {
+    taskId: intent.taskId,
+    intentHash: intent.intentHash,
+    removedWorktree,
+    deletedBranch,
+    deletedManifest
+  }, { operationId: opId, idempotent: published.idempotent === true });
+}
+function createAbandonTool(deps) {
+  return async function abandon(input) {
+    const opId = input.operationId ?? `abandon-${Date.now().toString(36)}`;
+    const taskId = String(input.taskId ?? "");
+    const subject = String(input.subject ?? "").trim();
+    if (!taskId) return refuse(opId, "missing-input", { field: "taskId" });
+    if (!subject) return refuse(opId, "missing-input", { field: "subject" });
+    const existing = await readAbandon(deps.repoRoot, taskId);
+    if (existing.completion) {
+      return success2("abandon", {
+        taskId,
+        intentHash: existing.completion.intentHash,
+        removedWorktree: existing.completion.removedWorktree,
+        deletedBranch: existing.completion.deletedBranch,
+        deletedManifest: existing.completion.deletedManifest
+      }, { operationId: opId, idempotent: true });
+    }
+    if (existing.intent) {
+      if (existing.intent.subject !== subject || existing.intent.taskId !== taskId) {
+        return refuse(opId, "abandon-conflict");
+      }
+      return resumeCleanup({ deps, intent: existing.intent, opId });
+    }
+    const manifest = await readManifest(deps.repoRoot, taskId);
+    if (!manifest) return refuse(opId, "missing-manifest", { taskId });
+    const validated = await validateLiveAttempt({ deps, manifest, subject, opId });
+    if (!validated.ok) return validated;
+    const publishedIntent = await publishAbandonIntent(deps.repoRoot, validated.intent);
+    if (!publishedIntent.ok) return refuse(opId, publishedIntent.kind);
+    return resumeCleanup({ deps, intent: publishedIntent.record, opId });
+  };
+}
+
 // src/state/github-operation-store.js
-import { readFile as readFile7, writeFile as writeFile4, mkdir as mkdir5, readdir as readdir4, unlink as unlink3 } from "node:fs/promises";
-import { existsSync as existsSync7 } from "node:fs";
-import { join as join8, dirname as dirname3 } from "node:path";
+import { readFile as readFile9, writeFile as writeFile4, mkdir as mkdir5, readdir as readdir4, unlink as unlink3 } from "node:fs/promises";
+import { existsSync as existsSync9 } from "node:fs";
+import { join as join11, dirname as dirname4 } from "node:path";
 init_durable_store();
 async function operationsDir(repoRoot) {
   const common = await resolveGitCommonDir(repoRoot);
-  return join8(opencodeShipStateDir(common), "github", "operations");
+  return join11(opencodeShipStateDir(common), "github", "operations");
 }
-var SAFE_ID_RE2 = /^[A-Za-z0-9._-]{1,128}$/;
+var SAFE_ID_RE3 = /^[A-Za-z0-9._-]{1,128}$/;
 function operationPath(dir, operationId2) {
-  if (!SAFE_ID_RE2.test(operationId2)) {
+  if (!SAFE_ID_RE3.test(operationId2)) {
     throw new Error(`invalid operationId: ${JSON.stringify(operationId2)}`);
   }
-  return join8(dir, `${operationId2}.json`);
+  return join11(dir, `${operationId2}.json`);
 }
 async function hasOperation(repoRoot, operationId2) {
   const dir = await operationsDir(repoRoot);
-  return existsSync7(operationPath(dir, operationId2));
+  return existsSync9(operationPath(dir, operationId2));
 }
 async function recordOperation(repoRoot, operationId2, record2) {
   if (typeof operationId2 !== "string" || operationId2.length === 0) {
@@ -15235,7 +15668,7 @@ async function recordOperation(repoRoot, operationId2, record2) {
   const dir = await operationsDir(repoRoot);
   await mkdir5(dir, { recursive: true });
   const path = operationPath(dir, operationId2);
-  if (existsSync7(path)) {
+  if (existsSync9(path)) {
     return { recorded: false, path };
   }
   const fullRecord = {
@@ -15505,76 +15938,33 @@ function createPublishTool(deps) {
   };
 }
 
-// src/profile.js
-var PROFILES = Object.freeze(["engineering"]);
-var LEGACY_PROFILES = Object.freeze(["core"]);
-
-// src/installer/engineering-config.js
-var MODEL_ID_RE = /^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+$/;
-var DEFAULTS = Object.freeze({
-  planner: "openai/gpt-5.6-sol",
-  builder: "minimax/MiniMax-M3",
-  finalReviewer: "openai/gpt-5.6-sol"
-});
-function resolveModelRoles(cfg, { strict = false, allowDeferred = false } = {}) {
-  const REQUIRED = ["planner", "builder", "finalReviewer"];
-  if (strict) {
-    const issues = [];
-    for (const role of REQUIRED) {
-      const id = cfg?.models?.[role];
-      if (typeof id !== "string" || id.length === 0 || !MODEL_ID_RE.test(id)) {
-        issues.push(role);
-      }
-    }
-    if (issues.length > 0) {
-      throw new Error(`resolveModelRoles: required role(s) missing or invalid: ${issues.join(", ")}`);
-    }
-    return { planner: cfg.models.planner, builder: cfg.models.builder, finalReviewer: cfg.models.finalReviewer };
-  }
-  const out = { ...DEFAULTS };
-  if (cfg && cfg.models) {
-    for (const [role, id] of Object.entries(cfg.models)) {
-      if (id && typeof id === "string" && id.length > 0) {
-        out[role] = id;
-      } else if (strict && Object.prototype.hasOwnProperty.call(cfg.models, role)) {
-        throw new Error(`resolveModelRoles: user provided empty model id for '${role}'`);
-      }
-    }
-  }
-  if (allowDeferred) {
-    return { planner: out.planner ?? null, builder: out.builder ?? null, finalReviewer: out.finalReviewer ?? null };
-  }
-  for (const role of REQUIRED) {
-    if (!out[role]) {
-      throw new Error(`resolveModelRoles: required role '${role}' missing and no default available`);
-    }
-  }
-  return out;
-}
-
 // src/installer/lock.js
-import { readFile as readFile8, writeFile as writeFile5, rename as rename3, mkdir as mkdir6 } from "node:fs/promises";
-import { existsSync as existsSync8 } from "node:fs";
-import { dirname as dirname4, resolve as resolve9, posix } from "node:path";
+import { readFile as readFile10, writeFile as writeFile5, rename as rename3, mkdir as mkdir6 } from "node:fs/promises";
+import { existsSync as existsSync10 } from "node:fs";
+import { dirname as dirname5, resolve as resolve10, posix } from "node:path";
 
 // src/installer/hash.js
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 function bytesHash(buffer) {
-  return createHash7("sha256").update(buffer).digest("hex");
+  return createHash8("sha256").update(buffer).digest("hex");
 }
 function bytesHashString(text) {
   return bytesHash(Buffer.from(text, "utf8"));
 }
 
+// src/profile.js
+var PROFILES = Object.freeze(["engineering"]);
+var LEGACY_PROFILES = Object.freeze(["core"]);
+
 // src/installer/lock.js
 function lockPath(repoRoot) {
-  return resolve9(repoRoot, ".opencode", "ship.lock.json");
+  return resolve10(repoRoot, ".opencode", "ship.lock.json");
 }
 async function readLock2(repoRoot) {
   const path = lockPath(repoRoot);
-  if (!existsSync8(path)) return null;
+  if (!existsSync10(path)) return null;
   try {
-    const raw = await readFile8(path, "utf8");
+    const raw = await readFile10(path, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -15587,15 +15977,11 @@ function isSetupComplete(lock) {
   return manager.setupComplete === true;
 }
 
-// src/tools/ship-plan-start.js
-import { join as join10 } from "node:path";
-import { mkdir as mkdir8, writeFile as writeFile6 } from "node:fs/promises";
-
 // src/runtime/opencode-dispatcher.js
 import { mkdir as mkdir7 } from "node:fs/promises";
-import { join as join9 } from "node:path";
+import { join as join12 } from "node:path";
 init_durable_store();
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import { dirname as dirnameOf } from "node:path";
 var ROLE_PLANNER = "planner";
 var ROLE_BUILDER = "builder";
@@ -15620,20 +16006,16 @@ function dispatchKeyFor(role, input) {
   }
 }
 function dispatchDir(commonDir, workflowId, dispatchKey) {
-  return join9(opencodeShipStateDir(commonDir), "runs", workflowId, "dispatch", dispatchKey);
+  return join12(opencodeShipStateDir(commonDir), "runs", workflowId, "dispatch", dispatchKey);
 }
 async function dispatchPath(commonDir, workflowId, dispatchKey) {
-  return join9(dispatchDir(commonDir, workflowId, dispatchKey), "dispatch.json");
+  return join12(dispatchDir(commonDir, workflowId, dispatchKey), "dispatch.json");
 }
 function hashPayload(value) {
-  return createHash8("sha256").update(JSON.stringify(value), "utf8").digest("hex");
+  return createHash9("sha256").update(JSON.stringify(value), "utf8").digest("hex");
 }
-async function prepareDispatch(repoRoot, workflowId, role, keyInput, payload) {
-  if (!ROLE_KEYS.has(role)) {
-    throw new Error(`prepareDispatch: unknown role ${role}`);
-  }
+async function prepareDispatchRecord(repoRoot, workflowId, dispatchKey, role, keyInput, payload) {
   const common = await resolveGitCommonDir(repoRoot);
-  const dispatchKey = dispatchKeyFor(role, keyInput);
   const commonDir = opencodeShipStateDir(common);
   const dir = dispatchDir(common, workflowId, dispatchKey);
   await mkdir7(dir, { recursive: true });
@@ -15652,10 +16034,10 @@ async function prepareDispatch(repoRoot, workflowId, role, keyInput, payload) {
 }
 async function transitionDispatch(repoRoot, workflowId, dispatchKey, nextState, fields = {}) {
   const common = await resolveGitCommonDir(repoRoot);
-  const baseDir = join9(opencodeShipStateDir(common), "runs", workflowId, "dispatch", dispatchKey);
+  const baseDir = join12(opencodeShipStateDir(common), "runs", workflowId, "dispatch", dispatchKey);
   await mkdir7(baseDir, { recursive: true });
   const next = Number(fields.sequence ?? 0);
-  const path = join9(baseDir, `seq-${String(next).padStart(6, "0")}.json`);
+  const path = join12(baseDir, `seq-${String(next).padStart(6, "0")}.json`);
   const record2 = {
     workflowId,
     dispatchKey,
@@ -15667,27 +16049,27 @@ async function transitionDispatch(repoRoot, workflowId, dispatchKey, nextState,
   return record2;
 }
 async function readLatestDispatch(repoRoot, workflowId, dispatchKey) {
-  const { readdir: readdir10, readFile: readFile25 } = await import("node:fs/promises");
+  const { readdir: readdir10, readFile: readFile27 } = await import("node:fs/promises");
   const common = await resolveGitCommonDir(repoRoot);
-  const baseDir = join9(opencodeShipStateDir(common), "runs", workflowId, "dispatch", dispatchKey);
+  const baseDir = join12(opencodeShipStateDir(common), "runs", workflowId, "dispatch", dispatchKey);
   const { readdirSync: readdirSync2, statSync: statSync2 } = await import("node:fs");
   if (!statSync2(baseDir, { throwIfNoEntry: false })) return null;
   const files = readdirSync2(baseDir).filter((f) => f.startsWith("seq-")).sort();
   if (files.length === 0) {
-    const initial = join9(baseDir, "dispatch.json");
+    const initial = join12(baseDir, "dispatch.json");
     if (!statSync2(initial, { throwIfNoEntry: false })) return null;
-    return JSON.parse(await readFile25(initial, "utf8"));
+    return JSON.parse(await readFile27(initial, "utf8"));
   }
   const last = files[files.length - 1];
-  const raw = await readFile25(join9(baseDir, last), "utf8");
+  const raw = await readFile27(join12(baseDir, last), "utf8");
   return JSON.parse(raw);
 }
 async function readPreparedDispatch(repoRoot, workflowId, dispatchKey) {
-  const { readFile: readFile25 } = await import("node:fs/promises");
+  const { readFile: readFile27 } = await import("node:fs/promises");
   const common = await resolveGitCommonDir(repoRoot);
-  const path = join9(opencodeShipStateDir(common), "runs", workflowId, "dispatch", dispatchKey, "dispatch.json");
+  const path = join12(opencodeShipStateDir(common), "runs", workflowId, "dispatch", dispatchKey, "dispatch.json");
   try {
-    return JSON.parse(await readFile25(path, "utf8"));
+    return JSON.parse(await readFile27(path, "utf8"));
   } catch (err) {
     if (err?.code === "ENOENT") return null;
     throw err;
@@ -15698,33 +16080,91 @@ async function dispatchWorker(input) {
   if (!ROLE_KEYS.has(role)) {
     throw new Error(`dispatchWorker: unknown role ${role}`);
   }
+  const dispatchKey = dispatchKeyFor(role, keyInput);
+  return dispatchSession({
+    repoRoot,
+    workflowId,
+    dispatchKey,
+    role,
+    keyInput,
+    payload,
+    client,
+    parentSessionID,
+    titleMarker,
+    agent,
+    model,
+    promptText: payload?.promptText,
+    requireControllerLease: true,
+    caller: "dispatchWorker"
+  });
+}
+async function dispatchController({ repoRoot, issueNumber, client, parentSessionID }) {
+  if (!Number.isInteger(issueNumber) || issueNumber <= 0) {
+    throw new Error("dispatchController: positive issueNumber required");
+  }
+  return dispatchSession({
+    repoRoot,
+    workflowId: `wf-${issueNumber}`,
+    dispatchKey: `controller:issue-${issueNumber}`,
+    role: "controller",
+    keyInput: { issueNumber },
+    payload: { issueNumber, agent: "ship-controller" },
+    client,
+    parentSessionID,
+    titleMarker: `ship-controller-wf-${issueNumber}`,
+    agent: "ship-controller",
+    promptText: `Start or resume durable delivery for issue #${issueNumber}. Call ship_plan_start before implementation mutation.`,
+    requireControllerLease: false,
+    caller: "dispatchController"
+  });
+}
+async function dispatchSession(input) {
+  const {
+    repoRoot,
+    workflowId,
+    dispatchKey,
+    role,
+    keyInput,
+    payload,
+    client,
+    parentSessionID,
+    titleMarker,
+    agent,
+    model,
+    promptText,
+    requireControllerLease,
+    caller
+  } = input;
   if (!client || typeof client.session?.create !== "function" || typeof client.session?.promptAsync !== "function") {
-    throw new Error("dispatchWorker: client.session.create and client.session.promptAsync are required");
+    throw new Error(`${caller}: client.session.create and client.session.promptAsync are required`);
   }
   if (!parentSessionID || typeof parentSessionID !== "string") {
-    throw new Error("dispatchWorker: parentSessionID required");
+    throw new Error(`${caller}: parentSessionID required`);
+  }
+  if (requireControllerLease) {
+    await assertControllerLease(repoRoot, workflowId, parentSessionID);
   }
-  await assertControllerLease(repoRoot, workflowId, parentSessionID);
-  const dispatchKey = dispatchKeyFor(role, keyInput);
   const common = await resolveGitCommonDir(repoRoot);
   const stateDir = opencodeShipStateDir(common);
   const preparedPayload = { ...payload, agent: agent ?? null, model: model ?? null };
+  const parentAudit = requireControllerLease ? { controllerSessionID: parentSessionID } : { parentSessionID };
   return withResourceLock(stateDir, `dispatch:${workflowId}:${dispatchKey}`, async () => {
     let latest = await readLatestDispatch(repoRoot, workflowId, dispatchKey);
     const preparedRecord = await readPreparedDispatch(repoRoot, workflowId, dispatchKey);
     if (preparedRecord && preparedRecord.payloadHash !== hashPayload(preparedPayload)) {
-      throw new Error(`dispatchWorker: payload changed for existing dispatch ${dispatchKey}`);
+      throw new Error(`${caller}: payload changed for existing dispatch ${dispatchKey}`);
     }
     if (latest?.state === "prompted" || latest?.state === "completed") {
       return { sessionID: latest.sessionID, dispatchKey };
     }
     if (!preparedRecord) {
-      await prepareDispatch(repoRoot, workflowId, role, keyInput, preparedPayload);
+      await prepareDispatchRecord(repoRoot, workflowId, dispatchKey, role, keyInput, preparedPayload);
       latest = { state: "prepared", sequence: 0 };
     }
     let sequence = Number(latest?.sequence ?? 0);
     const title = titleMarker ?? `ship-${role}-${dispatchKey}`;
-    let sessionID = latest?.state === "created" ? latest.sessionID : null;
+    const canReuseSession = latest?.state === "created" || latest?.state === "failed" && latest?.lastError?.startsWith("promptAsync:");
+    let sessionID = canReuseSession ? latest?.sessionID ?? null : null;
     if (!sessionID) {
       try {
         const created = await client.session.create({
@@ -15732,12 +16172,12 @@ async function dispatchWorker(input) {
           query: { directory: repoRoot }
         });
         if (created?.error) {
-          throw new Error(`dispatchWorker: session.create failed: ${formatSdkError(created.error)}`);
+          throw new Error(`${caller}: session.create failed: ${formatSdkError(created.error)}`);
         }
         const createdData = created?.data ?? created;
         sessionID = createdData?.id ?? createdData?.sessionID;
         if (!sessionID) {
-          throw new Error(`dispatchWorker: client.session.create did not return a session id`);
+          throw new Error(`${caller}: client.session.create did not return a session id`);
         }
       } catch (err) {
         sequence += 1;
@@ -15751,12 +16191,12 @@ async function dispatchWorker(input) {
       await transitionDispatch(repoRoot, workflowId, dispatchKey, "created", {
         sequence,
         sessionID,
-        controllerSessionID: parentSessionID
+        ...parentAudit
       });
     }
     try {
       const body = {
-        parts: [{ type: "text", text: String(payload?.promptText ?? "") }]
+        parts: [{ type: "text", text: String(promptText ?? "") }]
       };
       if (agent) body.agent = agent;
       if (model) body.model = parseModelId(model);
@@ -15766,14 +16206,14 @@ async function dispatchWorker(input) {
         query: { directory: repoRoot }
       });
       if (prompted?.error) {
-        throw new Error(`dispatchWorker: session.promptAsync failed: ${formatSdkError(prompted.error)}`);
+        throw new Error(`${caller}: session.promptAsync failed: ${formatSdkError(prompted.error)}`);
       }
     } catch (err) {
       sequence += 1;
       await transitionDispatch(repoRoot, workflowId, dispatchKey, "failed", {
         sequence,
         sessionID,
-        controllerSessionID: parentSessionID,
+        ...parentAudit,
         lastError: `promptAsync: ${err?.message ?? err}`
       });
       throw err;
@@ -15782,7 +16222,7 @@ async function dispatchWorker(input) {
     await transitionDispatch(repoRoot, workflowId, dispatchKey, "prompted", {
       sequence,
       sessionID,
-      controllerSessionID: parentSessionID
+      ...parentAudit
     });
     return { sessionID, dispatchKey };
   });
@@ -15806,7 +16246,7 @@ function formatSdkError(error45) {
 async function issueControllerLease(repoRoot, workflowId, controllerSessionID) {
   const { atomicReplaceJson: atomicReplaceJson2 } = await Promise.resolve().then(() => (init_durable_store(), durable_store_exports));
   const common = await resolveGitCommonDir(repoRoot);
-  const path = join9(opencodeShipStateDir(common), "runs", workflowId, "controller.json");
+  const path = join12(opencodeShipStateDir(common), "runs", workflowId, "controller.json");
   await mkdir7(dirnameOf(path), { recursive: true });
   await atomicReplaceJson2(path, {
     workflowId,
@@ -15815,13 +16255,13 @@ async function issueControllerLease(repoRoot, workflowId, controllerSessionID) {
   });
 }
 async function readControllerLease(repoRoot, workflowId) {
-  const { readFile: readFile25 } = await import("node:fs/promises");
-  const { existsSync: existsSync28 } = await import("node:fs");
+  const { readFile: readFile27 } = await import("node:fs/promises");
+  const { existsSync: existsSync29 } = await import("node:fs");
   const common = await resolveGitCommonDir(repoRoot);
-  const path = join9(opencodeShipStateDir(common), "runs", workflowId, "controller.json");
-  if (!existsSync28(path)) return null;
+  const path = join12(opencodeShipStateDir(common), "runs", workflowId, "controller.json");
+  if (!existsSync29(path)) return null;
   try {
-    return JSON.parse(await readFile25(path, "utf8"));
+    return JSON.parse(await readFile27(path, "utf8"));
   } catch {
     return null;
   }
@@ -15890,7 +16330,118 @@ var ROLES = Object.freeze({
   FINAL_SPEC: ROLE_FINAL_SPEC
 });
 
+// src/tools/ship-deliver.js
+function createDeliverTool(deps) {
+  return async function deliver(input) {
+    const opId = input.operationId ?? `deliver-${Date.now().toString(36)}`;
+    const issueNumber = input.issueNumber;
+    if (!Number.isInteger(issueNumber) || issueNumber <= 0) {
+      return failure("deliver", "positive issueNumber required", {
+        operationId: opId,
+        retryable: false,
+        details: { workflowId: null, controllerSessionID: null }
+      });
+    }
+    const workflowId = `wf-${issueNumber}`;
+    const ctx = deps.ctx ?? null;
+    if (!ctx || typeof ctx.sessionID !== "string" || ctx.sessionID.length === 0) {
+      return failure("deliver", "ToolContext.sessionID required (Build session)", {
+        operationId: opId,
+        retryable: false,
+        details: { workflowId, controllerSessionID: null }
+      });
+    }
+    if (ctx.agent !== "build") {
+      return failure("deliver", "ToolContext.agent must be Build", {
+        operationId: opId,
+        retryable: false,
+        details: { workflowId, controllerSessionID: null }
+      });
+    }
+    const client = deps.opencodeClient;
+    if (!client || typeof client.session?.create !== "function" || typeof client.session?.promptAsync !== "function") {
+      return failure("deliver", "OpenCode client is unavailable", {
+        operationId: opId,
+        retryable: false,
+        details: { workflowId, controllerSessionID: null }
+      });
+    }
+    const lock = await readLock2(deps.repoRoot);
+    if (!isSetupComplete(lock)) {
+      return failure("deliver", "setup is not complete; run /setup-ship-workflow first", {
+        operationId: opId,
+        retryable: false,
+        details: { workflowId, controllerSessionID: null }
+      });
+    }
+    try {
+      const dispatched = await dispatchController({
+        repoRoot: deps.repoRoot,
+        issueNumber,
+        client,
+        parentSessionID: ctx.sessionID
+      });
+      return success2("deliver", {
+        workflowId,
+        controllerSessionID: dispatched.sessionID,
+        dispatchKey: dispatched.dispatchKey
+      }, { operationId: opId });
+    } catch (err) {
+      return failure("deliver", String(err?.message ?? err), {
+        operationId: opId,
+        retryable: true,
+        details: { workflowId, controllerSessionID: null }
+      });
+    }
+  };
+}
+
+// src/installer/engineering-config.js
+var MODEL_ID_RE = /^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+$/;
+var DEFAULTS = Object.freeze({
+  planner: "openai/gpt-5.6-sol",
+  builder: "minimax/MiniMax-M3",
+  finalReviewer: "openai/gpt-5.6-sol"
+});
+function resolveModelRoles(cfg, { strict = false, allowDeferred = false } = {}) {
+  const REQUIRED = ["planner", "builder", "finalReviewer"];
+  if (strict) {
+    const issues = [];
+    for (const role of REQUIRED) {
+      const id = cfg?.models?.[role];
+      if (typeof id !== "string" || id.length === 0 || !MODEL_ID_RE.test(id)) {
+        issues.push(role);
+      }
+    }
+    if (issues.length > 0) {
+      throw new Error(`resolveModelRoles: required role(s) missing or invalid: ${issues.join(", ")}`);
+    }
+    return { planner: cfg.models.planner, builder: cfg.models.builder, finalReviewer: cfg.models.finalReviewer };
+  }
+  const out = { ...DEFAULTS };
+  if (cfg && cfg.models) {
+    for (const [role, id] of Object.entries(cfg.models)) {
+      if (id && typeof id === "string" && id.length > 0) {
+        out[role] = id;
+      } else if (strict && Object.prototype.hasOwnProperty.call(cfg.models, role)) {
+        throw new Error(`resolveModelRoles: user provided empty model id for '${role}'`);
+      }
+    }
+  }
+  if (allowDeferred) {
+    return { planner: out.planner ?? null, builder: out.builder ?? null, finalReviewer: out.finalReviewer ?? null };
+  }
+  for (const role of REQUIRED) {
+    if (!out[role]) {
+      throw new Error(`resolveModelRoles: required role '${role}' missing and no default available`);
+    }
+  }
+  return out;
+}
+
 // src/tools/ship-plan-start.js
+import { join as join13 } from "node:path";
+import { mkdir as mkdir8, writeFile as writeFile6 } from "node:fs/promises";
 function normalizeWorkflowId(issueNumber) {
   return `wf-${issueNumber}`;
 }
@@ -15919,7 +16470,7 @@ function createPlanStartTool(deps) {
     const repoRoot = deps.repoRoot;
     try {
       const commonDir = await resolveGitCommonDir(repoRoot);
-      const wfDir = join10(opencodeShipStateDir(commonDir), "plans", workflowId);
+      const wfDir = join13(opencodeShipStateDir(commonDir), "plans", workflowId);
       await mkdir8(wfDir, { recursive: true });
       await issueControllerLease(repoRoot, workflowId, ctx.sessionID);
       const matchingManifests = (await listManifests(repoRoot)).filter((manifest) => manifest.issueNumber === issueNumber);
@@ -15962,7 +16513,7 @@ function createPlanStartTool(deps) {
         createdAt: (/* @__PURE__ */ new Date()).toISOString(),
         state: "drafting"
       };
-      await writeFile6(join10(wfDir, "index.json"), JSON.stringify(indexRecord, null, 2), "utf8");
+      await writeFile6(join13(wfDir, "index.json"), JSON.stringify(indexRecord, null, 2), "utf8");
       return success2("plan-start", {
         workflowId,
         issueNumber,
@@ -15982,7 +16533,7 @@ function createPlanStartTool(deps) {
 }
 
 // src/workflow/plan.js
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 function isPlainObject2(v) {
   return v !== null && typeof v === "object" && !Array.isArray(v);
 }
@@ -16239,21 +16790,21 @@ function computePlanHash(plan) {
   return sha2563(json2);
 }
 function sha2563(text) {
-  return createHash9("sha256").update(text, "utf8").digest("hex");
+  return createHash10("sha256").update(text, "utf8").digest("hex");
 }
 
 // src/workflow/plan-store.js
-import { readFile as readFile9, writeFile as writeFile7, mkdir as mkdir9, readdir as readdir5, unlink as unlink4 } from "node:fs/promises";
-import { existsSync as existsSync9 } from "node:fs";
-import { join as join11, dirname as dirname5 } from "node:path";
+import { readFile as readFile11, writeFile as writeFile7, mkdir as mkdir9, readdir as readdir5, unlink as unlink4 } from "node:fs/promises";
+import { existsSync as existsSync11 } from "node:fs";
+import { join as join14, dirname as dirname6 } from "node:path";
 init_durable_store();
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 function revisionsDir(commonDir, workflowId) {
-  return join11(opencodeShipStateDir(commonDir), "plans", workflowId, "revisions");
+  return join14(opencodeShipStateDir(commonDir), "plans", workflowId, "revisions");
 }
 function revisionDir(commonDir, workflowId, revision) {
   const n = String(revision).padStart(6, "0");
-  return join11(revisionsDir(commonDir, workflowId), n);
+  return join14(revisionsDir(commonDir, workflowId), n);
 }
 async function resolveCommon(repoRoot) {
   return resolveGitCommonDir(repoRoot);
@@ -16267,9 +16818,9 @@ async function publishPlanRevision(repoRoot, plan) {
   const common = await resolveCommon(repoRoot);
   const dir = revisionDir(common, plan.workflowId, plan.revision);
   await mkdir9(dir, { recursive: true });
-  const planPath = join11(dir, "plan.json");
-  if (existsSync9(planPath)) {
-    const existing = JSON.parse(await readFile9(planPath, "utf8"));
+  const planPath = join14(dir, "plan.json");
+  if (existsSync11(planPath)) {
+    const existing = JSON.parse(await readFile11(planPath, "utf8"));
     if (existing?.plan?.workflowId !== plan.workflowId) {
       throw new Error(`publishPlanRevision: workflowId mismatch on existing record at ${planPath}`);
     }
@@ -16299,15 +16850,15 @@ async function publishApproval(repoRoot, approval) {
   const common = await resolveCommon(repoRoot);
   const dir = revisionDir(common, approval.workflowId, approval.revision);
   await mkdir9(dir, { recursive: true });
-  const path = join11(dir, "approval.json");
-  const planPath = join11(dir, "plan.json");
-  if (existsSync9(planPath)) {
-    const planRecord = JSON.parse(await readFile9(planPath, "utf8"));
+  const path = join14(dir, "approval.json");
+  const planPath = join14(dir, "plan.json");
+  if (existsSync11(planPath)) {
+    const planRecord = JSON.parse(await readFile11(planPath, "utf8"));
     if (planRecord.hash !== approval.sha256) {
       throw new Error(`publishApproval: sha256 mismatch with plan record (plan ${planRecord.hash?.slice(0, 8)}, approval ${approval.sha256.slice(0, 8)})`);
     }
   }
-  if (existsSync9(path)) {
+  if (existsSync11(path)) {
     return { recorded: false, path };
   }
   await publishImmutableJson(path, { ...approval, publishedAt: (/* @__PURE__ */ new Date()).toISOString() });
@@ -16315,10 +16866,10 @@ async function publishApproval(repoRoot, approval) {
 }
 async function readPlanRevision(repoRoot, workflowId, revision) {
   const common = await resolveCommon(repoRoot);
-  const path = join11(revisionDir(common, workflowId, revision), "plan.json");
-  if (!existsSync9(path)) return null;
+  const path = join14(revisionDir(common, workflowId, revision), "plan.json");
+  if (!existsSync11(path)) return null;
   try {
-    const raw = await readFile9(path, "utf8");
+    const raw = await readFile11(path, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -16326,14 +16877,14 @@ async function readPlanRevision(repoRoot, workflowId, revision) {
 }
 
 // src/tools/ship-plan-submit.js
-var SAFE_ID_RE3 = /^[A-Za-z0-9._-]{1,128}$/;
+var SAFE_ID_RE4 = /^[A-Za-z0-9._-]{1,128}$/;
 function createPlanSubmitTool(deps) {
   return async function planSubmit(input) {
     const opId = input.operationId ?? `plan-submit-${Date.now().toString(36)}`;
     const workflowId = String(input.workflowId ?? "");
     const revision = Number(input.revision);
     const plan = input.plan;
-    if (!workflowId || !SAFE_ID_RE3.test(workflowId)) {
+    if (!workflowId || !SAFE_ID_RE4.test(workflowId)) {
       return failure("plan-submit", "workflowId required (safe id)", { operationId: opId, retryable: false });
     }
     if (!Number.isInteger(revision) || revision <= 0) {
@@ -16384,7 +16935,7 @@ function createPlanSubmitTool(deps) {
 }
 
 // src/tools/ship-plan-approve.js
-var SAFE_ID_RE4 = /^[A-Za-z0-9._-]{1,128}$/;
+var SAFE_ID_RE5 = /^[A-Za-z0-9._-]{1,128}$/;
 function createPlanApproveTool(deps) {
   return async function planApprove(input) {
     const opId = input.operationId ?? `plan-approve-${Date.now().toString(36)}`;
@@ -16392,7 +16943,7 @@ function createPlanApproveTool(deps) {
     const revision = Number(input.revision);
     const sha2565 = String(input.sha256 ?? "");
     const subject = String(input.subject ?? "");
-    if (!workflowId || !SAFE_ID_RE4.test(workflowId)) {
+    if (!workflowId || !SAFE_ID_RE5.test(workflowId)) {
       return failure("plan-approve", "workflowId required (safe id)", { operationId: opId, retryable: false });
     }
     if (!Number.isInteger(revision) || revision <= 0) {
@@ -16440,20 +16991,20 @@ function createPlanApproveTool(deps) {
 }
 
 // src/tools/ship-run-start.js
-import { readFile as readFile10 } from "node:fs/promises";
-import { join as join12 } from "node:path";
-import { execFile } from "node:child_process";
-var SAFE_ID_RE5 = /^[A-Za-z0-9._-]{1,128}$/;
+import { readFile as readFile12 } from "node:fs/promises";
+import { join as join15 } from "node:path";
+import { execFile as execFile2 } from "node:child_process";
+var SAFE_ID_RE6 = /^[A-Za-z0-9._-]{1,128}$/;
 async function readRevisionRecord(repoRoot, workflowId, revision) {
   const commonDir = await resolveGitCommonDir(repoRoot);
   const rev = String(revision).padStart(6, "0");
-  const dir = join12(opencodeShipStateDir(commonDir), "plans", workflowId, "revisions", rev);
-  const planRaw = await readFile10(join12(dir, "plan.json"), "utf8");
+  const dir = join15(opencodeShipStateDir(commonDir), "plans", workflowId, "revisions", rev);
+  const planRaw = await readFile12(join15(dir, "plan.json"), "utf8");
   const plan = JSON.parse(planRaw);
-  const approvalPath = join12(dir, "approval.json");
+  const approvalPath = join15(dir, "approval.json");
   let approval = null;
   try {
-    approval = JSON.parse(await readFile10(approvalPath, "utf8"));
+    approval = JSON.parse(await readFile12(approvalPath, "utf8"));
   } catch {
     approval = null;
   }
@@ -16463,7 +17014,7 @@ function createRunStartTool(deps) {
   return async function runStart(input) {
     const opId = input.operationId ?? `run-start-${Date.now().toString(36)}`;
     const workflowId = String(input.workflowId ?? "");
-    if (!workflowId || !SAFE_ID_RE5.test(workflowId)) {
+    if (!workflowId || !SAFE_ID_RE6.test(workflowId)) {
       return failure("run-start", "workflowId required (safe id)", { operationId: opId, retryable: false });
     }
     const ctx = input.ctx ?? deps.ctx ?? null;
@@ -16521,7 +17072,7 @@ function createRunStartTool(deps) {
 }
 function gitHead(cwd) {
   return new Promise((resolveP, rejectP) => {
-    execFile("git", ["-C", cwd, "rev-parse", "HEAD"], { cwd, shell: false }, (err, stdout, stderr) => {
+    execFile2("git", ["-C", cwd, "rev-parse", "HEAD"], { cwd, shell: false }, (err, stdout, stderr) => {
       if (err) return rejectP(new Error(stderr || err.message));
       resolveP(String(stdout).trim());
     });
@@ -16530,19 +17081,93 @@ function gitHead(cwd) {
 
 // src/tools/ship-task-start.js
 import { mkdir as mkdir10 } from "node:fs/promises";
-import { join as join13 } from "node:path";
+import { join as join16 } from "node:path";
 init_durable_store();
-import { createHash as createHash11 } from "node:crypto";
-var SAFE_ID_RE6 = /^[A-Za-z0-9._-]{1,128}$/;
+import { createHash as createHash12 } from "node:crypto";
+
+// src/workflow/worktree-resolver.js
+function failureRecord(kind, details = {}) {
+  return { ok: false, kind, ...details };
+}
+async function resolveWorkflowWorktree(repoRoot, workflowId) {
+  const runState = await readRunState(repoRoot, workflowId);
+  if (!runState) {
+    return failureRecord("missing-workflow-run", { workflowId });
+  }
+  const planRecord = await readPlanRevision(repoRoot, workflowId, runState.revision);
+  if (!planRecord) {
+    return failureRecord("missing-workflow-plan", {
+      workflowId,
+      revision: runState.revision
+    });
+  }
+  if (planRecord.hash !== runState.sha256) {
+    return failureRecord("workflow-plan-mismatch", {
+      workflowId,
+      revision: runState.revision,
+      expected: runState.sha256,
+      received: planRecord.hash
+    });
+  }
+  const issueNumber = planRecord.plan?.source?.issueNumber;
+  if (!Number.isInteger(issueNumber) || issueNumber <= 0) {
+    return failureRecord("missing-workflow-issue", {
+      workflowId,
+      revision: runState.revision
+    });
+  }
+  const matches = (await listManifests(repoRoot)).filter((manifest2) => manifest2.issueNumber === issueNumber);
+  if (matches.length !== 1) {
+    return failureRecord("ambiguous-workflow-manifest", {
+      issueNumber,
+      count: matches.length
+    });
+  }
+  const manifest = matches[0];
+  if (manifest.schemaVersion !== 2) {
+    return failureRecord("workflow-mismatch", {
+      expectedSchema: 2,
+      receivedSchema: manifest.schemaVersion
+    });
+  }
+  if (manifest.workflowId !== workflowId) {
+    return failureRecord("workflow-mismatch", {
+      expected: workflowId,
+      received: manifest.workflowId
+    });
+  }
+  if (!manifest.worktreePath) {
+    return failureRecord("missing-worktree-path", { taskId: manifest.taskId });
+  }
+  const linked = await validateLinkedWorktree(repoRoot, manifest.worktreePath, {
+    allowCurrentLinked: true
+  });
+  if (!linked.ok) {
+    return failureRecord("invalid-worktree", {
+      reason: linked.kind,
+      message: linked.message
+    });
+  }
+  return {
+    ok: true,
+    workflowId,
+    issueNumber,
+    manifest,
+    worktreePath: linked.path
+  };
+}
+
+// src/tools/ship-task-start.js
+var SAFE_ID_RE7 = /^[A-Za-z0-9._-]{1,128}$/;
 function createTaskStartTool(deps) {
   return async function taskStart(input) {
     const opId = input.operationId ?? `task-start-${Date.now().toString(36)}`;
     const workflowId = String(input.workflowId ?? "");
     const taskId = String(input.taskId ?? "");
-    if (!workflowId || !SAFE_ID_RE6.test(workflowId)) {
+    if (!workflowId || !SAFE_ID_RE7.test(workflowId)) {
       return failure("task-start", "workflowId required (safe id)", { operationId: opId, retryable: false });
     }
-    if (!taskId || !SAFE_ID_RE6.test(taskId)) {
+    if (!taskId || !SAFE_ID_RE7.test(taskId)) {
       return failure("task-start", "taskId required (safe id)", { operationId: opId, retryable: false });
     }
     const ctx = input.ctx ?? deps.ctx ?? null;
@@ -16582,13 +17207,21 @@ function createTaskStartTool(deps) {
     if (unsatisfied.length > 0) {
       return failure("task-start", `task dependencies are incomplete: ${unsatisfied.join(", ")}`, { operationId: opId, retryable: false });
     }
-    const briefHash = createHash11("sha256").update(canonicalJson(task), "utf8").digest("hex");
+    const briefHash = createHash12("sha256").update(canonicalJson(task), "utf8").digest("hex");
     const round = runState.round > 0 ? runState.round : 1;
     try {
+      const resolved = await resolveWorkflowWorktree(deps.repoRoot, workflowId);
+      if (!resolved.ok) {
+        return failure("task-start", `workflow worktree resolution failed: ${resolved.kind}`, {
+          operationId: opId,
+          retryable: false,
+          details: resolved
+        });
+      }
       let dispatchResult = null;
       if (deps.opencodeClient) {
         dispatchResult = await dispatchWorker({
-          repoRoot: deps.repoRoot,
+          repoRoot: resolved.worktreePath,
           workflowId,
           role: ROLES.BUILDER,
           keyInput: { taskId, round },
@@ -16608,7 +17241,7 @@ ${JSON.stringify(task, null, 2)}`
         });
       }
       const commonDir = await resolveGitCommonDir(deps.repoRoot);
-      const dispatchDir2 = join13(
+      const dispatchDir2 = join16(
         opencodeShipStateDir(commonDir),
         "runs",
         workflowId,
@@ -16631,7 +17264,7 @@ ${JSON.stringify(task, null, 2)}`
         task,
         dispatchedAt: (/* @__PURE__ */ new Date()).toISOString()
       };
-      await publishImmutableJson(join13(dispatchDir2, "dispatch.json"), record2);
+      await publishImmutableJson(join16(dispatchDir2, "dispatch.json"), record2);
       const { state, event } = await appendRunEvent(
         deps.repoRoot,
         workflowId,
@@ -16657,15 +17290,15 @@ ${JSON.stringify(task, null, 2)}`
 }
 
 // src/tools/ship-task-commit.js
-import { execFile as execFile2 } from "node:child_process";
-import { mkdir as mkdir11, readFile as readFile11 } from "node:fs/promises";
-import { existsSync as existsSync10 } from "node:fs";
-import { join as join14 } from "node:path";
+import { execFile as execFile3 } from "node:child_process";
+import { mkdir as mkdir11, readFile as readFile13 } from "node:fs/promises";
+import { existsSync as existsSync12 } from "node:fs";
+import { join as join17 } from "node:path";
 init_durable_store();
-var SAFE_ID_RE7 = /^[A-Za-z0-9._-]{1,128}$/;
+var SAFE_ID_RE8 = /^[A-Za-z0-9._-]{1,128}$/;
 function spawn5(cmd, args, cwd) {
   return new Promise((resolveP, rejectP) => {
-    execFile2(cmd, args, { cwd, shell: false }, (err, stdout, stderr) => {
+    execFile3(cmd, args, { cwd, shell: false }, (err, stdout, stderr) => {
       if (err) {
         const msg = typeof stderr === "string" ? stderr : stderr ? String(stderr) : err.message;
         return rejectP(new Error(`${cmd} failed: ${msg}`));
@@ -16684,10 +17317,10 @@ function createTaskCommitTool(deps) {
     const planHash = String(input.planHash ?? "");
     const reviewHash = String(input.reviewHash ?? "");
     const round = Number(input.round ?? 1);
-    if (!workflowId || !SAFE_ID_RE7.test(workflowId)) {
+    if (!workflowId || !SAFE_ID_RE8.test(workflowId)) {
       return failure("task-commit", "workflowId required (safe id)", { operationId: opId, retryable: false });
     }
-    if (!taskId || !SAFE_ID_RE7.test(taskId)) {
+    if (!taskId || !SAFE_ID_RE8.test(taskId)) {
       return failure("task-commit", "taskId required (safe id)", { operationId: opId, retryable: false });
     }
     if (!/^[0-9a-f]{40}$/.test(expectedHead)) {
@@ -16749,19 +17382,27 @@ function createTaskCommitTool(deps) {
       return failure("task-commit", `round does not match the active run (${runState.round})`, { operationId: opId, retryable: false });
     }
     try {
-      const actualHead = (await spawn5("git", ["-C", deps.repoRoot, "rev-parse", "HEAD"], deps.repoRoot)).trim();
+      const resolved = await resolveWorkflowWorktree(deps.repoRoot, workflowId);
+      if (!resolved.ok) {
+        return failure("task-commit", `workflow worktree resolution failed: ${resolved.kind}`, {
+          operationId: opId,
+          retryable: false,
+          details: resolved
+        });
+      }
+      const actualHead = (await spawn5("git", ["-C", resolved.worktreePath, "rev-parse", "HEAD"], resolved.worktreePath)).trim();
       if (actualHead !== expectedHead) {
         return failure("task-commit", `HEAD drift (expected ${expectedHead.slice(0, 8)}, got ${actualHead.slice(0, 8)})`, { operationId: opId, retryable: false });
       }
       const trailers = buildCommitTrailers({ workflowId, planHash, taskId, round, reviewHash });
-      const message = await spawn5("git", ["-C", deps.repoRoot, "log", "-1", "--format=%B", expectedHead], deps.repoRoot);
+      const message = await spawn5("git", ["-C", resolved.worktreePath, "log", "-1", "--format=%B", expectedHead], resolved.worktreePath);
       const trailerLines = trailers.map((t) => `  ${t}`).join("\n");
       const missingTrailer = trailers.find((trailer) => !message.includes(trailer));
       if (missingTrailer) {
         return failure("task-commit", `commit ${expectedHead.slice(0, 8)} missing trailer: ${missingTrailer}`, { operationId: opId, retryable: false });
       }
       const commonDir = await resolveGitCommonDir(deps.repoRoot);
-      const commitDir = join14(opencodeShipStateDir(commonDir), "runs", workflowId, "tasks", taskId, "commit");
+      const commitDir = join17(opencodeShipStateDir(commonDir), "runs", workflowId, "tasks", taskId, "commit");
       await mkdir11(commitDir, { recursive: true });
       const record2 = {
         workflowId,
@@ -16774,9 +17415,9 @@ function createTaskCommitTool(deps) {
         trailerBlock: trailerLines,
         committedAt: (/* @__PURE__ */ new Date()).toISOString()
       };
-      const commitPath = join14(commitDir, "commit.json");
-      if (existsSync10(commitPath)) {
-        const existing = JSON.parse(await readFile11(commitPath, "utf8"));
+      const commitPath = join17(commitDir, "commit.json");
+      if (existsSync12(commitPath)) {
+        const existing = JSON.parse(await readFile13(commitPath, "utf8"));
         if (existing.workflowId !== workflowId || existing.taskId !== taskId || existing.round !== round || existing.commitSha !== commitSha || existing.planHash !== planHash || existing.reviewHash !== reviewHash) {
           return failure("task-commit", "immutable task commit conflicts with retry", { operationId: opId, retryable: false });
         }
@@ -16797,13 +17438,13 @@ function createTaskCommitTool(deps) {
 }
 
 // src/tools/ship-task-complete.js
-import { mkdir as mkdir12, readFile as readFile12 } from "node:fs/promises";
-import { existsSync as existsSync11 } from "node:fs";
-import { join as join15 } from "node:path";
-import { execFile as execFile3 } from "node:child_process";
-import { createHash as createHash12 } from "node:crypto";
+import { mkdir as mkdir12, readFile as readFile14 } from "node:fs/promises";
+import { existsSync as existsSync13 } from "node:fs";
+import { join as join18 } from "node:path";
+import { execFile as execFile4 } from "node:child_process";
+import { createHash as createHash13 } from "node:crypto";
 init_durable_store();
-var SAFE_ID_RE8 = /^[A-Za-z0-9._-]{1,128}$/;
+var SAFE_ID_RE9 = /^[A-Za-z0-9._-]{1,128}$/;
 function createTaskCompleteTool(deps) {
   return async function taskComplete(input) {
     const opId = input.operationId ?? `task-complete-${Date.now().toString(36)}`;
@@ -16812,16 +17453,16 @@ function createTaskCompleteTool(deps) {
     const moreTasks = input.moreTasks === false ? false : input.moreTasks === true ? true : null;
     const nextTaskId = input.nextTaskId ? String(input.nextTaskId) : null;
     const expectedHead = String(input.expectedHead ?? "");
-    if (!workflowId || !SAFE_ID_RE8.test(workflowId)) {
+    if (!workflowId || !SAFE_ID_RE9.test(workflowId)) {
       return failure("task-complete", "workflowId required (safe id)", { operationId: opId, retryable: false });
     }
-    if (!taskId || !SAFE_ID_RE8.test(taskId)) {
+    if (!taskId || !SAFE_ID_RE9.test(taskId)) {
       return failure("task-complete", "taskId required (safe id)", { operationId: opId, retryable: false });
     }
     if (moreTasks === null) {
       return failure("task-complete", "moreTasks must be explicitly true or false", { operationId: opId, retryable: false });
     }
-    if (moreTasks && (!nextTaskId || !SAFE_ID_RE8.test(nextTaskId))) {
+    if (moreTasks && (!nextTaskId || !SAFE_ID_RE9.test(nextTaskId))) {
       return failure("task-complete", "nextTaskId required when moreTasks=true", { operationId: opId, retryable: false });
     }
     if (!moreTasks && !/^[0-9a-f]{40}$/.test(expectedHead)) {
@@ -16864,6 +17505,14 @@ function createTaskCompleteTool(deps) {
       return failure("task-complete", `plan still has incomplete tasks: ${remainingTasks.map((task) => task.id).join(", ")}`, { operationId: opId, retryable: false });
     }
     try {
+      const resolved = await resolveWorkflowWorktree(deps.repoRoot, workflowId);
+      if (!resolved.ok) {
+        return failure("task-complete", `workflow worktree resolution failed: ${resolved.kind}`, {
+          operationId: opId,
+          retryable: false,
+          details: resolved
+        });
+      }
       const gateEvidence = moreTasks ? null : await loadTrustedGateEvidence({
         repoRoot: deps.repoRoot,
         repoSlug: deps.repoSlug,
@@ -16875,7 +17524,7 @@ function createTaskCompleteTool(deps) {
       });
       const commonDir = await resolveGitCommonDir(deps.repoRoot);
       const finalPackage = moreTasks ? null : await loadOrBuildFinalPackage({
-        repoRoot: deps.repoRoot,
+        repoRoot: resolved.worktreePath,
         commonDir,
         workflowId,
         runState,
@@ -16885,7 +17534,7 @@ function createTaskCompleteTool(deps) {
         ciHash: gateEvidence?.ciHash ?? "",
         gateTaskId: gateEvidence?.taskId ?? ""
       });
-      const completeDir = join15(opencodeShipStateDir(commonDir), "runs", workflowId, "tasks", taskId, "complete");
+      const completeDir = join18(opencodeShipStateDir(commonDir), "runs", workflowId, "tasks", taskId, "complete");
       await mkdir12(completeDir, { recursive: true });
       const record2 = {
         workflowId,
@@ -16895,9 +17544,9 @@ function createTaskCompleteTool(deps) {
         finalReview: finalPackage,
         completedAt: (/* @__PURE__ */ new Date()).toISOString()
       };
-      const completePath = join15(completeDir, "complete.json");
-      if (existsSync11(completePath)) {
-        const existing = JSON.parse(await readFile12(completePath, "utf8"));
+      const completePath = join18(completeDir, "complete.json");
+      if (existsSync13(completePath)) {
+        const existing = JSON.parse(await readFile14(completePath, "utf8"));
         if (existing.workflowId !== workflowId || existing.taskId !== taskId || existing.moreTasks !== moreTasks || (existing.nextTaskId ?? null) !== (nextTaskId ?? null) || (existing.finalReview?.packageHash ?? null) !== (finalPackage?.packageHash ?? null)) {
           return failure("task-complete", "immutable task completion conflicts with retry", { operationId: opId, retryable: false });
         }
@@ -16924,7 +17573,7 @@ function createTaskCompleteTool(deps) {
       if (!moreTasks && deps.opencodeClient) {
         const models = resolveModelRoles(deps.config?.workflow, { strict: true });
         const packageHash = finalPackage.packageHash;
-        const packagePath = join15(opencodeShipStateDir(commonDir), "runs", workflowId, "final-review", "package.json");
+        const packagePath = join18(opencodeShipStateDir(commonDir), "runs", workflowId, "final-review", "package.json");
         const promptText = [
           `Review workflow ${workflowId} package ${packageHash} at HEAD ${finalPackage.headSha} against merge base ${finalPackage.mergeBaseSha}.`,
           `Canonical package path: ${packagePath}`,
@@ -16933,7 +17582,7 @@ ${JSON.stringify(finalPackage, null, 2)}`
         ].join("\n\n");
         const [standards, spec] = await Promise.all([
           dispatchWorker({
-            repoRoot: deps.repoRoot,
+            repoRoot: resolved.worktreePath,
             workflowId,
             role: ROLES.FINAL_STANDARDS,
             keyInput: { packageHash },
@@ -16945,7 +17594,7 @@ ${JSON.stringify(finalPackage, null, 2)}`
             model: models.finalReviewer
           }),
           dispatchWorker({
-            repoRoot: deps.repoRoot,
+            repoRoot: resolved.worktreePath,
             workflowId,
             role: ROLES.FINAL_SPEC,
             keyInput: { packageHash },
@@ -16983,7 +17632,7 @@ async function loadTrustedGateEvidence({ repoRoot, repoSlug, driver, adapter, wo
   const manifests = (await listManifests(repoRoot)).filter((manifest2) => manifest2.issueNumber === issueNumber);
   if (manifests.length !== 1) throw new Error(`expected one delivery manifest for issue #${issueNumber}, found ${manifests.length}`);
   const manifest = manifests[0];
-  if (manifest.schemaVersion < 2 || manifest.workflowId !== workflowId) {
+  if (manifest.schemaVersion !== 2 || manifest.workflowId !== workflowId) {
     throw new Error("delivery manifest is not linked to the current workflow");
   }
   if (manifest.lastVerifierSha !== expectedHead || !/^[0-9a-f]{64}$/.test(manifest.lastVerificationHash ?? "")) {
@@ -17019,10 +17668,10 @@ async function loadTrustedGateEvidence({ repoRoot, repoSlug, driver, adapter, wo
   return { verificationHash: verification.receiptHash, ciHash: ci.receiptHash, taskId: manifest.taskId };
 }
 async function loadOrBuildFinalPackage({ repoRoot, commonDir, workflowId, runState, planRecord, expectedHead, verificationHash, ciHash, gateTaskId }) {
-  const reviewDir = join15(opencodeShipStateDir(commonDir), "runs", workflowId, "final-review");
-  const packagePath = join15(reviewDir, "package.json");
-  if (existsSync11(packagePath)) {
-    const existing = JSON.parse(await readFile12(packagePath, "utf8"));
+  const reviewDir = join18(opencodeShipStateDir(commonDir), "runs", workflowId, "final-review");
+  const packagePath = join18(reviewDir, "package.json");
+  if (existsSync13(packagePath)) {
+    const existing = JSON.parse(await readFile14(packagePath, "utf8"));
     if (existing.headSha !== expectedHead || existing.verificationHash !== verificationHash || existing.ciHash !== ciHash || existing.gateTaskId !== gateTaskId) {
       throw new Error("final review package already exists with different gate evidence");
     }
@@ -17039,10 +17688,10 @@ async function loadOrBuildFinalPackage({ repoRoot, commonDir, workflowId, runSta
     throw new Error(`approved base ${mergeBaseSha.slice(0, 8)} is not the merge base of final HEAD`);
   }
   const revision = String(runState.revision).padStart(6, "0");
-  const approvalRaw = await readFile12(join15(opencodeShipStateDir(commonDir), "plans", workflowId, "revisions", revision, "approval.json"), "utf8");
+  const approvalRaw = await readFile14(join18(opencodeShipStateDir(commonDir), "plans", workflowId, "revisions", revision, "approval.json"), "utf8");
   const tasks = [];
   for (const completedTaskId of runState.completedTasks ?? []) {
-    const commitRaw = await readFile12(join15(opencodeShipStateDir(commonDir), "runs", workflowId, "tasks", completedTaskId, "commit", "commit.json"), "utf8");
+    const commitRaw = await readFile14(join18(opencodeShipStateDir(commonDir), "runs", workflowId, "tasks", completedTaskId, "commit", "commit.json"), "utf8");
     const commit = JSON.parse(commitRaw);
     tasks.push({
       taskId: completedTaskId,
@@ -17069,23 +17718,23 @@ async function loadOrBuildFinalPackage({ repoRoot, commonDir, workflowId, runSta
 }
 function git(cwd, args) {
   return new Promise((resolveP, rejectP) => {
-    execFile3("git", ["-C", cwd, ...args], { cwd, shell: false }, (err, stdout, stderr) => {
+    execFile4("git", ["-C", cwd, ...args], { cwd, shell: false }, (err, stdout, stderr) => {
       if (err) return rejectP(new Error(`git ${args[0]} failed: ${stderr || err.message}`));
       resolveP(String(stdout));
     });
   });
 }
 function sha2564(value) {
-  return createHash12("sha256").update(value, "utf8").digest("hex");
+  return createHash13("sha256").update(value, "utf8").digest("hex");
 }
 
 // src/tools/ship-task-report.js
-import { mkdir as mkdir13, readFile as readFile13 } from "node:fs/promises";
-import { existsSync as existsSync12 } from "node:fs";
-import { createHash as createHash13 } from "node:crypto";
-import { join as join16 } from "node:path";
+import { mkdir as mkdir13, readFile as readFile15 } from "node:fs/promises";
+import { existsSync as existsSync14 } from "node:fs";
+import { createHash as createHash14 } from "node:crypto";
+import { join as join19 } from "node:path";
 init_durable_store();
-var SAFE_ID_RE9 = /^[A-Za-z0-9._-]{1,128}$/;
+var SAFE_ID_RE10 = /^[A-Za-z0-9._-]{1,128}$/;
 function createTaskReportTool(deps) {
   return async function taskReport(input) {
     const opId = input.operationId ?? `task-report-${Date.now().toString(36)}`;
@@ -17093,10 +17742,10 @@ function createTaskReportTool(deps) {
     const taskId = String(input.taskId ?? "");
     const round = Number(input.round ?? 1);
     const summary = String(input.summary ?? "");
-    if (!workflowId || !SAFE_ID_RE9.test(workflowId)) {
+    if (!workflowId || !SAFE_ID_RE10.test(workflowId)) {
       return failure("task-report", "workflowId required (safe id)", { operationId: opId, retryable: false });
     }
-    if (!taskId || !SAFE_ID_RE9.test(taskId)) {
+    if (!taskId || !SAFE_ID_RE10.test(taskId)) {
       return failure("task-report", "taskId required (safe id)", { operationId: opId, retryable: false });
     }
     if (!Number.isInteger(round) || round <= 0) {
@@ -17131,8 +17780,16 @@ function createTaskReportTool(deps) {
       return failure("task-report", `another task is already active (${runState.activeTask})`, { operationId: opId, retryable: false });
     }
     try {
+      const resolved = await resolveWorkflowWorktree(deps.repoRoot, workflowId);
+      if (!resolved.ok) {
+        return failure("task-report", `workflow worktree resolution failed: ${resolved.kind}`, {
+          operationId: opId,
+          retryable: false,
+          details: resolved
+        });
+      }
       const commonDir = await resolveGitCommonDir(deps.repoRoot);
-      const reportDir = join16(opencodeShipStateDir(commonDir), "runs", workflowId, "tasks", taskId, "rounds", `${String(round).padStart(4, "0")}`);
+      const reportDir = join19(opencodeShipStateDir(commonDir), "runs", workflowId, "tasks", taskId, "rounds", `${String(round).padStart(4, "0")}`);
       await mkdir13(reportDir, { recursive: true });
       const record2 = {
         workflowId,
@@ -17144,12 +17801,12 @@ function createTaskReportTool(deps) {
         tests: Array.isArray(input.tests) ? input.tests : [],
         submittedAt: (/* @__PURE__ */ new Date()).toISOString()
       };
-      const reportPath = join16(reportDir, "implementer-report.json");
+      const reportPath = join19(reportDir, "implementer-report.json");
       let state = runState;
       let event = runState.events.at(-1) ?? { sequence: 0 };
       let persistedRecord = record2;
-      if (existsSync12(reportPath)) {
-        persistedRecord = JSON.parse(await readFile13(reportPath, "utf8"));
+      if (existsSync14(reportPath)) {
+        persistedRecord = JSON.parse(await readFile15(reportPath, "utf8"));
         if (!sameReport(persistedRecord, record2)) {
           return failure("task-report", "immutable report already exists with different content", { operationId: opId, retryable: false });
         }
@@ -17180,7 +17837,7 @@ function createTaskReportTool(deps) {
       if (deps.opencodeClient) {
         try {
           reviewerDispatch = await dispatchWorker({
-            repoRoot: deps.repoRoot,
+            repoRoot: resolved.worktreePath,
             workflowId,
             role: ROLES.TASK_REVIEWER,
             keyInput: { taskId, round },
@@ -17224,7 +17881,7 @@ function reportHash(record2) {
   const sorted = Object.keys(record2).sort();
   const ordered = {};
   for (const k of sorted) ordered[k] = record2[k];
-  return createHash13("sha256").update(JSON.stringify(ordered), "utf8").digest("hex");
+  return createHash14("sha256").update(JSON.stringify(ordered), "utf8").digest("hex");
 }
 function sameReport(left, right) {
   for (const field of ["workflowId", "taskId", "round", "builderSessionID", "summary"]) {
@@ -17234,12 +17891,12 @@ function sameReport(left, right) {
 }
 
 // src/tools/ship-task-review.js
-import { createHash as createHash14 } from "node:crypto";
-import { mkdir as mkdir14, readFile as readFile14 } from "node:fs/promises";
-import { existsSync as existsSync13 } from "node:fs";
-import { join as join17 } from "node:path";
+import { createHash as createHash15 } from "node:crypto";
+import { mkdir as mkdir14, readFile as readFile16 } from "node:fs/promises";
+import { existsSync as existsSync15 } from "node:fs";
+import { join as join20 } from "node:path";
 init_durable_store();
-var SAFE_ID_RE10 = /^[A-Za-z0-9._-]{1,128}$/;
+var SAFE_ID_RE11 = /^[A-Za-z0-9._-]{1,128}$/;
 var VERDICT_VALUES = /* @__PURE__ */ new Set(["pass", "fail", "none"]);
 function createTaskReviewTool(deps) {
   return async function taskReview(input) {
@@ -17249,10 +17906,10 @@ function createTaskReviewTool(deps) {
     const round = Number(input.round ?? 1);
     const spec = input.spec;
     const quality = input.quality;
-    if (!workflowId || !SAFE_ID_RE10.test(workflowId)) {
+    if (!workflowId || !SAFE_ID_RE11.test(workflowId)) {
       return failure("task-review", "workflowId required (safe id)", { operationId: opId, retryable: false });
     }
-    if (!taskId || !SAFE_ID_RE10.test(taskId)) {
+    if (!taskId || !SAFE_ID_RE11.test(taskId)) {
       return failure("task-review", "taskId required (safe id)", { operationId: opId, retryable: false });
     }
     if (!Number.isInteger(round) || round <= 0) {
@@ -17308,7 +17965,7 @@ function createTaskReviewTool(deps) {
       const specPass = String(spec.verdict) === "pass";
       const qualityPass = String(quality.verdict) === "pass";
       const commonDir = await resolveGitCommonDir(deps.repoRoot);
-      const reviewDir = join17(opencodeShipStateDir(commonDir), "runs", workflowId, "tasks", taskId, "rounds", `${String(round).padStart(4, "0")}`);
+      const reviewDir = join20(opencodeShipStateDir(commonDir), "runs", workflowId, "tasks", taskId, "rounds", `${String(round).padStart(4, "0")}`);
       await mkdir14(reviewDir, { recursive: true });
       const record2 = {
         workflowId,
@@ -17320,9 +17977,9 @@ function createTaskReviewTool(deps) {
         state: specPass && qualityPass ? "commit-pending" : "fix-pending",
         reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
       };
-      const reviewPath = join17(reviewDir, "review.json");
-      if (existsSync13(reviewPath)) {
-        const existing = JSON.parse(await readFile14(reviewPath, "utf8"));
+      const reviewPath = join20(reviewDir, "review.json");
+      if (existsSync15(reviewPath)) {
+        const existing = JSON.parse(await readFile16(reviewPath, "utf8"));
         if (existing.workflowId !== workflowId || existing.taskId !== taskId || existing.round !== round || existing.reviewerSessionID !== auth.sessionID || JSON.stringify(existing.spec) !== JSON.stringify(spec) || JSON.stringify(existing.quality) !== JSON.stringify(quality)) {
           return failure("task-review", "immutable task review conflicts with retry", { operationId: opId, retryable: false });
         }
@@ -17357,15 +18014,15 @@ function verdictHash(record2) {
   const sorted = Object.keys(record2).sort();
   const ordered = {};
   for (const k of sorted) ordered[k] = record2[k];
-  return createHash14("sha256").update(JSON.stringify(ordered), "utf8").digest("hex");
+  return createHash15("sha256").update(JSON.stringify(ordered), "utf8").digest("hex");
 }
 
 // src/tools/ship-final-review.js
-import { mkdir as mkdir15, readFile as readFile15 } from "node:fs/promises";
-import { existsSync as existsSync14 } from "node:fs";
-import { join as join18 } from "node:path";
+import { mkdir as mkdir15, readFile as readFile17 } from "node:fs/promises";
+import { existsSync as existsSync16 } from "node:fs";
+import { join as join21 } from "node:path";
 init_durable_store();
-var SAFE_ID_RE11 = /^[A-Za-z0-9._-]{1,128}$/;
+var SAFE_ID_RE12 = /^[A-Za-z0-9._-]{1,128}$/;
 var AXES = /* @__PURE__ */ new Set(["standards", "spec"]);
 var VERDICTS = /* @__PURE__ */ new Set(["pass", "fail", "blocked"]);
 var ROLE_FOR_AXIS = {
@@ -17382,7 +18039,7 @@ function createFinalReviewTool(deps) {
     const mergeBaseSha = String(input.mergeBaseSha ?? "");
     const packageHash = String(input.packageHash ?? "");
     const findings = Array.isArray(input.findings) ? input.findings : [];
-    if (!workflowId || !SAFE_ID_RE11.test(workflowId)) {
+    if (!workflowId || !SAFE_ID_RE12.test(workflowId)) {
       return failure("final-review", "workflowId required (safe id)", { operationId: opId, retryable: false });
     }
     if (!AXES.has(axis)) {
@@ -17429,18 +18086,18 @@ function createFinalReviewTool(deps) {
     }
     try {
       const commonDir = await resolveGitCommonDir(deps.repoRoot);
-      const packagePath = join18(opencodeShipStateDir(commonDir), "runs", workflowId, "final-review", "package.json");
-      if (!existsSync14(packagePath)) {
+      const packagePath = join21(opencodeShipStateDir(commonDir), "runs", workflowId, "final-review", "package.json");
+      if (!existsSync16(packagePath)) {
         return failure("final-review", "canonical final review package is missing", { operationId: opId, retryable: false });
       }
-      const finalPackage = JSON.parse(await readFile15(packagePath, "utf8"));
+      const finalPackage = JSON.parse(await readFile17(packagePath, "utf8"));
       if (hashFinalReviewPackage(finalPackage) !== finalPackage.packageHash) {
         return failure("final-review", "canonical final review package hash is invalid", { operationId: opId, retryable: false });
       }
       if (finalPackage.packageHash !== packageHash || finalPackage.headSha !== headSha || finalPackage.mergeBaseSha !== mergeBaseSha) {
         return failure("final-review", "review input does not match the canonical final review package", { operationId: opId, retryable: false });
       }
-      const reviewDir = join18(opencodeShipStateDir(commonDir), "runs", workflowId, "final-review", axis);
+      const reviewDir = join21(opencodeShipStateDir(commonDir), "runs", workflowId, "final-review", axis);
       await mkdir15(reviewDir, { recursive: true });
       let record2 = {
         workflowId,
@@ -17454,9 +18111,9 @@ function createFinalReviewTool(deps) {
         findings,
         reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
       };
-      const reviewPath = join18(reviewDir, "review.json");
-      if (existsSync14(reviewPath)) {
-        record2 = JSON.parse(await readFile15(reviewPath, "utf8"));
+      const reviewPath = join21(reviewDir, "review.json");
+      if (existsSync16(reviewPath)) {
+        record2 = JSON.parse(await readFile17(reviewPath, "utf8"));
         if (record2.axis !== axis || record2.verdict !== verdict || record2.headSha !== headSha || record2.mergeBaseSha !== mergeBaseSha || record2.packageHash !== packageHash || record2.reviewerSessionID !== auth.sessionID || hashAxisRecord(
           /** @type {any} */
           record2
@@ -17517,8 +18174,8 @@ function createFinalReviewTool(deps) {
 
 // src/workflow/resume.js
 import { readdir as readdir6, mkdir as mkdir16 } from "node:fs/promises";
-import { existsSync as existsSync15 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync17 } from "node:fs";
+import { join as join22 } from "node:path";
 init_durable_store();
 function parseTrailer(text, key) {
   if (typeof text !== "string") return null;
@@ -17593,12 +18250,12 @@ async function resumeRun(repoRoot, workflowId) {
 }
 
 // src/tools/ship-resume.js
-var SAFE_ID_RE12 = /^[A-Za-z0-9._-]{1,128}$/;
+var SAFE_ID_RE13 = /^[A-Za-z0-9._-]{1,128}$/;
 function createResumeTool(deps) {
   return async function resume(input) {
     const opId = input.operationId ?? `resume-${Date.now().toString(36)}`;
     const workflowId = String(input.workflowId ?? "");
-    if (!workflowId || !SAFE_ID_RE12.test(workflowId)) {
+    if (!workflowId || !SAFE_ID_RE13.test(workflowId)) {
       return failure("resume", "workflowId required (safe id)", { operationId: opId, retryable: false });
     }
     const ctx = input.ctx ?? deps.ctx ?? null;
@@ -17625,9 +18282,9 @@ function createResumeTool(deps) {
 }
 
 // src/tools/ship-status.js
-import { readFile as readFile16, readdir as readdir7 } from "node:fs/promises";
-import { existsSync as existsSync16 } from "node:fs";
-import { join as join20 } from "node:path";
+import { readFile as readFile18, readdir as readdir7 } from "node:fs/promises";
+import { existsSync as existsSync18 } from "node:fs";
+import { join as join23 } from "node:path";
 function createStatusTool(deps) {
   return async function status(input) {
     const opId = input.operationId ?? `status-${Date.now().toString(36)}`;
@@ -17635,21 +18292,21 @@ function createStatusTool(deps) {
     if (!workflowId) return failure("status", "workflowId required", { operationId: opId, retryable: false });
     try {
       const commonDir = await resolveGitCommonDir(deps.repoRoot);
-      const planRoot = join20(opencodeShipStateDir(commonDir), "plans", workflowId);
-      const runRoot = join20(opencodeShipStateDir(commonDir), "runs", workflowId);
-      const indexPath = join20(planRoot, "index.json");
-      if (!existsSync16(indexPath)) return failure("status", "no workflow record", { operationId: opId, retryable: false });
-      const index = JSON.parse(await readFile16(indexPath, "utf8"));
+      const planRoot = join23(opencodeShipStateDir(commonDir), "plans", workflowId);
+      const runRoot = join23(opencodeShipStateDir(commonDir), "runs", workflowId);
+      const indexPath = join23(planRoot, "index.json");
+      if (!existsSync18(indexPath)) return failure("status", "no workflow record", { operationId: opId, retryable: false });
+      const index = JSON.parse(await readFile18(indexPath, "utf8"));
       let run = null;
-      const runPath = join20(runRoot, "run.json");
-      if (existsSync16(runPath)) run = JSON.parse(await readFile16(runPath, "utf8"));
+      const runPath = join23(runRoot, "run.json");
+      if (existsSync18(runPath)) run = JSON.parse(await readFile18(runPath, "utf8"));
       let lastEvent = null;
-      const eventsDir = join20(runRoot, "events");
-      if (existsSync16(eventsDir)) {
+      const eventsDir = join23(runRoot, "events");
+      if (existsSync18(eventsDir)) {
         const events = await readdir7(eventsDir);
         const sorted = events.filter((n) => n.endsWith(".json")).sort();
         if (sorted.length > 0) {
-          lastEvent = JSON.parse(await readFile16(join20(eventsDir, sorted[sorted.length - 1]), "utf8"));
+          lastEvent = JSON.parse(await readFile18(join23(eventsDir, sorted[sorted.length - 1]), "utf8"));
         }
       }
       return success2("status", { workflowId, index, run, lastEvent }, { operationId: opId });
@@ -17661,14 +18318,14 @@ function createStatusTool(deps) {
 
 // src/skills/registry.js
 import { spawn as spawn7 } from "node:child_process";
-import { readFile as readFile17, writeFile as writeFile8, mkdir as mkdir17 } from "node:fs/promises";
-import { resolve as resolve11, dirname as dirname7 } from "node:path";
-import { createHash as createHash15 } from "node:crypto";
+import { readFile as readFile19, writeFile as writeFile8, mkdir as mkdir17 } from "node:fs/promises";
+import { resolve as resolve12, dirname as dirname8 } from "node:path";
+import { createHash as createHash16 } from "node:crypto";
 
 // src/tools/skill-discovery.js
 import { spawn as spawn6 } from "node:child_process";
-import { existsSync as existsSync17, readFileSync, writeFileSync, mkdirSync, readdirSync, statSync } from "node:fs";
-import { dirname as dirname6, join as join21, normalize, resolve as resolve10, sep } from "node:path";
+import { existsSync as existsSync19, readFileSync, writeFileSync, mkdirSync, readdirSync, statSync } from "node:fs";
+import { dirname as dirname7, join as join24, normalize, resolve as resolve11, sep as sep2 } from "node:path";
 var DEFAULT_TRUSTED_OWNERS = Object.freeze([
   "vercel-labs",
   "anthropics",
@@ -17736,9 +18393,9 @@ async function listSkills({ repoRoot, query, npmBin = "npx" }) {
 }
 
 // src/skills/policy.js
-import { readFile as readFile18, writeFile as writeFile9 } from "node:fs/promises";
-import { existsSync as existsSync18 } from "node:fs";
-import { resolve as resolve12 } from "node:path";
+import { readFile as readFile20, writeFile as writeFile9 } from "node:fs/promises";
+import { existsSync as existsSync20 } from "node:fs";
+import { resolve as resolve13 } from "node:path";
 var DEFAULT_TRUSTED_OWNERS2 = Object.freeze([
   "vercel-labs",
   "anthropics",
@@ -17750,7 +18407,7 @@ var DEFAULT_MIN_INSTALLS = 1e3;
 var MAX_TRUSTED_PER_RUN = 5;
 var POLICY_PATH = ".opencode/ship.skills.policy.json";
 function policyPath(repoRoot) {
-  return resolve12(repoRoot, POLICY_PATH);
+  return resolve13(repoRoot, POLICY_PATH);
 }
 function defaultPolicy() {
   return {
@@ -17762,9 +18419,9 @@ function defaultPolicy() {
 }
 async function readPolicy(repoRoot) {
   const path = policyPath(repoRoot);
-  if (!existsSync18(path)) return defaultPolicy();
+  if (!existsSync20(path)) return defaultPolicy();
   try {
-    const raw = await readFile18(path, "utf8");
+    const raw = await readFile20(path, "utf8");
     const parsed = JSON.parse(raw);
     return mergePolicy(defaultPolicy(), parsed);
   } catch {
@@ -17851,33 +18508,33 @@ function createSkillDiscoverTool(deps) {
 }
 
 // src/tools/ship-skill-install.js
-import { readFile as readFile20, writeFile as writeFile11, mkdir as mkdir19, rm, rename as rename5, stat as stat2 } from "node:fs/promises";
-import { existsSync as existsSync21 } from "node:fs";
-import { resolve as resolve15, join as join23, dirname as dirname10, sep as sep3, isAbsolute as isAbsolute3 } from "node:path";
-import { createHash as createHash17 } from "node:crypto";
+import { readFile as readFile22, writeFile as writeFile11, mkdir as mkdir19, rm, rename as rename5, stat as stat2 } from "node:fs/promises";
+import { existsSync as existsSync22 } from "node:fs";
+import { resolve as resolve15, join as join25, dirname as dirname10, sep as sep3, isAbsolute as isAbsolute3 } from "node:path";
+import { createHash as createHash18 } from "node:crypto";
 import { execFile as execFile5 } from "node:child_process";
 import { mkdtemp } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { randomBytes as randomBytes3 } from "node:crypto";
 
 // src/skills/inventory.js
-import { readFile as readFile19, writeFile as writeFile10, mkdir as mkdir18, rename as rename4 } from "node:fs/promises";
-import { existsSync as existsSync19 } from "node:fs";
-import { resolve as resolve13, dirname as dirname8, isAbsolute, posix as posix2 } from "node:path";
-import { createHash as createHash16 } from "node:crypto";
+import { readFile as readFile21, writeFile as writeFile10, mkdir as mkdir18, rename as rename4 } from "node:fs/promises";
+import { existsSync as existsSync21 } from "node:fs";
+import { resolve as resolve14, dirname as dirname9, isAbsolute as isAbsolute2, posix as posix2 } from "node:path";
+import { createHash as createHash17 } from "node:crypto";
 var INVENTORY_PATH = ".opencode/ship.skills.lock.json";
 var INVENTORY_SCHEMA = 2;
 function inventoryPath(repoRoot) {
-  return resolve13(repoRoot, INVENTORY_PATH);
+  return resolve14(repoRoot, INVENTORY_PATH);
 }
 async function readInventory(repoRoot) {
   const path = inventoryPath(repoRoot);
-  if (!existsSync19(path)) {
+  if (!existsSync21(path)) {
     return { schemaVersion: INVENTORY_SCHEMA, events: [] };
   }
   let raw;
   try {
-    raw = await readFile19(path, "utf8");
+    raw = await readFile21(path, "utf8");
   } catch (err) {
     return { schemaVersion: INVENTORY_SCHEMA, events: [], parseError: `read failed: ${err?.message ?? err}` };
   }
@@ -17904,7 +18561,7 @@ async function readInventory(repoRoot) {
 }
 async function writeInventory(repoRoot, inventory) {
   const path = inventoryPath(repoRoot);
-  await mkdir18(dirname8(path), { recursive: true });
+  await mkdir18(dirname9(path), { recursive: true });
   const tmp = `${path}.${Date.now().toString(36)}.tmp`;
   await writeFile10(tmp, JSON.stringify({ schemaVersion: INVENTORY_SCHEMA, events: inventory.events }, null, 2) + "\n", "utf8");
   await rename4(tmp, path);
@@ -17924,7 +18581,7 @@ function canonicalize3(value) {
   return JSON.stringify(sort(value));
 }
 function hashEvent(event) {
-  return createHash16("sha256").update(canonicalize3(event), "utf8").digest("hex");
+  return createHash17("sha256").update(canonicalize3(event), "utf8").digest("hex");
 }
 async function appendEvent2(repoRoot, eventInput) {
   const inventory = await readInventory(repoRoot);
@@ -17937,7 +18594,7 @@ async function appendEvent2(repoRoot, eventInput) {
   }
   const previousHash = inventory.events.length > 0 ? inventory.events[inventory.events.length - 1].hash : "0".repeat(64);
   const sequence = inventory.events.length + 1;
-  if (eventInput.destination && isAbsolute(eventInput.destination)) {
+  if (eventInput.destination && isAbsolute2(eventInput.destination)) {
     throw new Error(`inventory refuses absolute destination: ${eventInput.destination}`);
   }
   const base = {
@@ -18037,146 +18694,8 @@ async function findActiveInstall(repoRoot, skillName) {
   return { ok: true, install: null, uninstallHash: null };
 }
 
-// src/skills/worktree.js
-import { execFile as execFile4 } from "node:child_process";
-import { promises as fs, existsSync as existsSync20 } from "node:fs";
-import { resolve as resolve14, dirname as dirname9, sep as sep2, isAbsolute as isAbsolute2, join as join22 } from "node:path";
-function listRegisteredWorktrees(mainRepo) {
-  return new Promise((resolveP, rejectP) => {
-    execFile4(
-      "git",
-      ["-C", mainRepo, "worktree", "list", "--porcelain", "-z"],
-      { shell: false, maxBuffer: 1024 * 1024 },
-      (err, stdout) => {
-        if (err) return rejectP(err);
-        const records = parsePorcelain(stdout);
-        const mainRecord = records.shift();
-        const mainPath = mainRecord?.worktree ? resolve14(mainRecord.worktree) : null;
-        const linked = [];
-        for (const r of records) {
-          if (!r.worktree) continue;
-          const p = resolve14(r.worktree);
-          if (mainPath && p === mainPath) continue;
-          linked.push({ path: p, branch: r.HEAD ?? null });
-        }
-        resolveP(linked);
-      }
-    );
-  });
-}
-function parsePorcelain(text) {
-  const tokens = text.split("\0");
-  const out = [];
-  let current = {};
-  for (const tok of tokens) {
-    if (tok.length === 0) {
-      if (Object.keys(current).length > 0) {
-        out.push(current);
-        current = {};
-      }
-      continue;
-    }
-    const idx = tok.indexOf(" ");
-    const key = idx === -1 ? tok : tok.slice(0, idx);
-    const value = idx === -1 ? "" : tok.slice(idx + 1);
-    if (key === "branch") {
-      current.HEAD = value.startsWith("refs/heads/") ? value : `refs/heads/${value}`;
-    } else {
-      current[key] = value;
-    }
-  }
-  if (Object.keys(current).length > 0) out.push(current);
-  return out;
-}
-async function validateLinkedWorktree(mainRepo, worktreePath) {
-  const main = resolve14(mainRepo);
-  if (!existsSync20(main)) {
-    return { ok: false, kind: "missing", message: `main repository ${main} does not exist` };
-  }
-  if (!worktreePath) {
-    return { ok: false, kind: "unlinked", message: "worktreePath is required" };
-  }
-  const wt = resolve14(worktreePath);
-  if (!existsSync20(wt)) {
-    return { ok: false, kind: "missing", message: `worktree ${wt} does not exist` };
-  }
-  if (wt === main) {
-    return { ok: false, kind: "main", message: "installs into the main worktree are forbidden" };
-  }
-  let cursor = wt;
-  while (cursor !== dirname9(cursor)) {
-    const stat3 = await fs.lstat(cursor).catch(() => null);
-    if (stat3?.isSymbolicLink()) {
-      return {
-        ok: false,
-        kind: "ancestor-symlink",
-        message: `worktree path contains a symlink at ${cursor}`
-      };
-    }
-    cursor = dirname9(cursor);
-  }
-  const real = await fs.realpath(wt).catch(() => null);
-  if (real && real !== wt) {
-    return {
-      ok: false,
-      kind: "symlink",
-      message: `worktree ${wt} resolves through a symlink to ${real}`
-    };
-  }
-  const linked = await listRegisteredWorktrees(main);
-  const matched = linked.find((entry) => entry.path === wt);
-  if (!matched) {
-    return {
-      ok: false,
-      kind: "unlinked",
-      message: `worktree ${wt} is not registered (git worktree list)`
-    };
-  }
-  return { ok: true, path: wt, registered: !!matched };
-}
-function validateRelativeInstallPath(destRel) {
-  if (typeof destRel !== "string" || destRel.length === 0) {
-    return { ok: false, kind: "absolute", message: "destination path required" };
-  }
-  if (isAbsolute2(destRel)) {
-    return { ok: false, kind: "absolute", message: `destination must be relative: ${destRel}` };
-  }
-  if (destRel.includes("\\")) {
-    return { ok: false, kind: "parent-relative", message: `destination must use POSIX separators: ${destRel}` };
-  }
-  const parts = destRel.split("/");
-  for (const p of parts) {
-    if (p === "" || p === "." || p === "..") {
-      return { ok: false, kind: "parent-relative", message: `destination escapes worktree: ${destRel}` };
-    }
-  }
-  return { ok: true };
-}
-async function validateInstallDestination(worktreeRoot, destRel) {
-  const relativeCheck = validateRelativeInstallPath(destRel);
-  if (!relativeCheck.ok) return relativeCheck;
-  const root = resolve14(worktreeRoot);
-  const destination = resolve14(root, ...destRel.split("/"));
-  if (destination !== root && !destination.startsWith(root + sep2)) {
-    return { ok: false, kind: "escape", message: `destination escapes worktree: ${destRel}` };
-  }
-  let cursor = root;
-  for (const part of destRel.split("/")) {
-    cursor = join22(cursor, part);
-    const entry = await fs.lstat(cursor).catch(() => null);
-    if (!entry) continue;
-    if (entry.isSymbolicLink()) {
-      return { ok: false, kind: "symlink", message: `destination path contains a symlink at ${cursor}` };
-    }
-    if (cursor !== destination && !entry.isDirectory()) {
-      return { ok: false, kind: "not-directory", message: `destination ancestor is not a directory: ${cursor}` };
-    }
-  }
-  return { ok: true, path: destination };
-}
-
 // src/tools/ship-skill-install.js
-var SAFE_ID_RE13 = /^[A-Za-z0-9._-]{1,128}$/;
+var SAFE_ID_RE14 = /^[A-Za-z0-9._-]{1,128}$/;
 var SAFE_NAME_RE = /^[A-Za-z0-9._/-]{1,160}$/;
 var SAFE_VERSION_RE = /^[A-Za-z0-9._+-]{1,64}$/;
 var SKILLS_CLI_VERSION = "1.0.4";
@@ -18193,7 +18712,7 @@ function createSkillInstallTool(deps) {
     if (!worktreePath) {
       return failure("skill-install", "worktreePath required (must be the active issue worktree)", { operationId: opId, retryable: false });
     }
-    if (!skillName || !SAFE_ID_RE13.test(skillName)) {
+    if (!skillName || !SAFE_ID_RE14.test(skillName)) {
       return failure("skill-install", "skillName required (safe id)", { operationId: opId, retryable: false });
     }
     if (version2 && !SAFE_VERSION_RE.test(version2)) {
@@ -18223,7 +18742,7 @@ function createSkillInstallTool(deps) {
       return failure("skill-install", `destination rejected: ${destinationCheck.message}`, { operationId: opId, retryable: false });
     }
     const destAbs = destinationCheck.path;
-    if (existsSync21(destAbs)) {
+    if (existsSync22(destAbs)) {
       return failure("skill-install", "destination already exists; use ship_skill_audit to detect drift", { operationId: opId, retryable: false });
     }
     const managedCatalog = (deps.config?.value?.skills ?? []).map((s) => s?.name).filter(Boolean);
@@ -18243,7 +18762,7 @@ function createSkillInstallTool(deps) {
     if (!decision.ok) {
       return failure("skill-install", `policy forbids install: ${decision.reason}`, { operationId: opId, retryable: false });
     }
-    const stage = await mkdtemp(join23(tmpdir(), `ship-skill-stage-${randomBytes3(4).toString("hex")}-`));
+    const stage = await mkdtemp(join25(tmpdir(), `ship-skill-stage-${randomBytes3(4).toString("hex")}-`));
     let installedFiles;
     try {
       const materialise = deps.materialiseFromSkillsCli ?? materialiseFromSkillsCli;
@@ -18294,7 +18813,7 @@ function createSkillInstallTool(deps) {
         sequence: recorded.sequence
       }, { operationId: opId });
     } catch (err) {
-      if (existsSync21(destAbs)) {
+      if (existsSync22(destAbs)) {
         await rm(destAbs, { recursive: true, force: true }).catch(() => null);
       }
       return failure("skill-install", String(err?.message ?? err), { operationId: opId, retryable: true });
@@ -18340,16 +18859,16 @@ async function materialiseFromSkillsCli({ packageSpec, skillName, version: versi
     );
   });
   if (!result.ok) return result;
-  const stagedDir = join23(stageDir, ".opencode", "skills", skillName);
-  if (!existsSync21(stagedDir)) {
+  const stagedDir = join25(stageDir, ".opencode", "skills", skillName);
+  if (!existsSync22(stagedDir)) {
     return {
       ok: false,
       retryable: false,
       message: `skills CLI did not produce ${stagedDir}`
     };
   }
-  const skillMd = join23(stagedDir, "SKILL.md");
-  if (!existsSync21(skillMd)) {
+  const skillMd = join25(stagedDir, "SKILL.md");
+  if (!existsSync22(skillMd)) {
     return {
       ok: false,
       retryable: false,
@@ -18381,25 +18900,25 @@ async function walk(rootDir, currentDir, out) {
   const { readdir: readdir10 } = await import("node:fs/promises");
   const entries = await readdir10(currentDir, { withFileTypes: true });
   for (const e of entries) {
-    const abs = join23(currentDir, e.name);
+    const abs = join25(currentDir, e.name);
     if (e.isDirectory()) {
       if (e.name === ".git") continue;
       await walk(rootDir, abs, out);
       continue;
     }
     if (!e.isFile()) continue;
-    const raw = await readFile20(abs);
+    const raw = await readFile22(abs);
     const fileStat = await stat2(abs);
     out.push({
       path: abs.slice(rootDir.length + 1).split(sep3).join("/"),
-      sha256: createHash17("sha256").update(raw).digest("hex"),
+      sha256: createHash18("sha256").update(raw).digest("hex"),
       mode: fileStat.mode & 511,
       size: fileStat.size
     });
   }
 }
 function hashBytes(bytes) {
-  return createHash17("sha256").update(bytes).digest("hex");
+  return createHash18("sha256").update(bytes).digest("hex");
 }
 function hashesEqual(a, b) {
   if (a.length !== b.length) return false;
@@ -18414,23 +18933,23 @@ async function copyDir(srcDir, destDir) {
   const { readdir: readdir10 } = await import("node:fs/promises");
   const entries = await readdir10(srcDir, { withFileTypes: true });
   for (const e of entries) {
-    const src = join23(srcDir, e.name);
-    const dest = join23(destDir, e.name);
+    const src = join25(srcDir, e.name);
+    const dest = join25(destDir, e.name);
     if (e.isDirectory()) {
       if (e.name === ".git") continue;
       await copyDir(src, dest);
     } else if (e.isFile()) {
-      const raw = await readFile20(src);
+      const raw = await readFile22(src);
       await writeFile11(dest, raw, { mode: 420 });
     }
   }
 }
 
 // src/tools/ship-skill-audit.js
-import { readdir as readdir8, readFile as readFile21 } from "node:fs/promises";
-import { existsSync as existsSync22 } from "node:fs";
-import { resolve as resolve16, join as join24, isAbsolute as isAbsolute4 } from "node:path";
-import { createHash as createHash18 } from "node:crypto";
+import { readdir as readdir8, readFile as readFile23 } from "node:fs/promises";
+import { existsSync as existsSync23 } from "node:fs";
+import { resolve as resolve16, join as join26, isAbsolute as isAbsolute4 } from "node:path";
+import { createHash as createHash19 } from "node:crypto";
 function createSkillAuditTool(deps) {
   return async function skillAudit(input) {
     const opId = input.operationId ?? `skill-audit-${Date.now().toString(36)}`;
@@ -18471,21 +18990,21 @@ function createSkillAuditTool(deps) {
         continue;
       }
       for (const f of ev.files ?? []) {
-        const filePath = join24(installRoot, ev.destination, f.path);
-        if (!existsSync22(filePath)) {
+        const filePath = join26(installRoot, ev.destination, f.path);
+        if (!existsSync23(filePath)) {
           missing.push({ skill: ev.skill, path: f.path, sequence: ev.sequence });
           continue;
         }
-        const raw = await readFile21(filePath);
-        const sha = createHash18("sha256").update(raw).digest("hex");
+        const raw = await readFile23(filePath);
+        const sha = createHash19("sha256").update(raw).digest("hex");
         if (sha !== f.sha256) {
           drifted.push({ skill: ev.skill, path: f.path, expected: f.sha256, actual: sha, sequence: ev.sequence });
         }
       }
     }
     const untracked = [];
-    const opencodeDir = join24(inventoryRoot, ".opencode", "skills");
-    if (existsSync22(opencodeDir)) {
+    const opencodeDir = join26(inventoryRoot, ".opencode", "skills");
+    if (existsSync23(opencodeDir)) {
       const entries = await readdir8(opencodeDir, { withFileTypes: true }).catch(() => []);
       for (const e of entries) {
         if (!e.isDirectory()) continue;
@@ -18507,16 +19026,16 @@ function createSkillAuditTool(deps) {
 }
 
 // src/tools/ship-skill-uninstall.js
-import { readFile as readFile22, unlink as unlink5, rm as rm2, readdir as readdir9, lstat } from "node:fs/promises";
-import { existsSync as existsSync23 } from "node:fs";
-import { resolve as resolve17, join as join25 } from "node:path";
-import { createHash as createHash19 } from "node:crypto";
-var SAFE_ID_RE14 = /^[A-Za-z0-9._-]{1,128}$/;
+import { readFile as readFile24, unlink as unlink5, rm as rm2, readdir as readdir9, lstat } from "node:fs/promises";
+import { existsSync as existsSync24 } from "node:fs";
+import { resolve as resolve17, join as join27 } from "node:path";
+import { createHash as createHash20 } from "node:crypto";
+var SAFE_ID_RE15 = /^[A-Za-z0-9._-]{1,128}$/;
 function createSkillUninstallTool(deps) {
   return async function skillUninstall(input) {
     const opId = input.operationId ?? `skill-uninstall-${Date.now().toString(36)}`;
     const skillName = String(input.skill ?? "");
-    if (!skillName || !SAFE_ID_RE14.test(skillName)) {
+    if (!skillName || !SAFE_ID_RE15.test(skillName)) {
       return failure("skill-uninstall", "skill required (safe id)", { operationId: opId, retryable: false });
     }
     const repoRoot = resolve17(deps.repoRoot);
@@ -18557,20 +19076,20 @@ function createSkillUninstallTool(deps) {
         return failure("skill-uninstall", `recorded file rejected: ${fileCheck.message}`, { operationId: opId, retryable: false });
       }
       const filePath = fileCheck.path;
-      if (!existsSync23(filePath)) {
+      if (!existsSync24(filePath)) {
         return failure("skill-uninstall", `recorded file missing: ${f.path}`, { operationId: opId, retryable: false });
       }
-      const raw = await readFile22(filePath);
-      const sha = createHash19("sha256").update(raw).digest("hex");
+      const raw = await readFile24(filePath);
+      const sha = createHash20("sha256").update(raw).digest("hex");
       if (sha !== f.sha256) {
         return failure("skill-uninstall", `recorded file drifted: ${f.path}`, { operationId: opId, retryable: false });
       }
     }
     for (const f of found.install.files ?? []) {
-      const filePath = join25(skillDir, ...f.path.split("/"));
+      const filePath = join27(skillDir, ...f.path.split("/"));
       await unlink5(filePath).catch(() => null);
     }
-    if (existsSync23(skillDir)) {
+    if (existsSync24(skillDir)) {
       await rm2(skillDir, { recursive: true, force: true });
     }
     const recorded = await appendEvent2(inventoryRoot, {
@@ -18589,12 +19108,12 @@ function createSkillUninstallTool(deps) {
   };
 }
 async function listInstalledFiles(root) {
-  if (!existsSync23(root)) return { ok: true, paths: [] };
+  if (!existsSync24(root)) return { ok: true, paths: [] };
   const paths = [];
   const walk2 = async (dir, prefix = "") => {
     for (const entry of await readdir9(dir, { withFileTypes: true })) {
       const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
-      const absolute = join25(dir, entry.name);
+      const absolute = join27(dir, entry.name);
       const info = await lstat(absolute);
       if (info.isSymbolicLink()) return { ok: false, message: `symlinked content present: ${relative}` };
       if (info.isDirectory()) {
@@ -18618,9 +19137,9 @@ function recoverManifestAfterCrash(manifest) {
 }
 
 // src/installer/plugin-owner.js
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawnSync as spawnSync5 } from "node:child_process";
 async function reconcileOwner(repoRoot, adapter) {
-  const r = spawnSync4("git", ["-C", repoRoot, "config", "--get", "user.name"], {
+  const r = spawnSync5("git", ["-C", repoRoot, "config", "--get", "user.name"], {
     encoding: "utf8"
   });
   if (r.status === 0 && r.stdout.trim()) return r.stdout.trim();
@@ -18628,8 +19147,8 @@ async function reconcileOwner(repoRoot, adapter) {
 }
 
 // src/installer/config.js
-import { readFile as readFile23, writeFile as writeFile12, rename as rename6, mkdir as mkdir20 } from "node:fs/promises";
-import { existsSync as existsSync24 } from "node:fs";
+import { readFile as readFile25, writeFile as writeFile12, rename as rename6, mkdir as mkdir20 } from "node:fs/promises";
+import { existsSync as existsSync25 } from "node:fs";
 import { dirname as dirname11, resolve as resolve18 } from "node:path";
 
 // schema/ship-config.schema.json
@@ -18941,8 +19460,8 @@ function configPath(repoRoot) {
 }
 async function loadConfig(repoRoot) {
   const path = configPath(repoRoot);
-  if (!existsSync24(path)) return null;
-  const raw = await readFile23(path, "utf8");
+  if (!existsSync25(path)) return null;
+  const raw = await readFile25(path, "utf8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -19007,26 +19526,26 @@ function renderDefaultConfig(detection, overrides = {}) {
 }
 
 // src/installer/detection/project.js
-import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync25, readFileSync as readFileSync2 } from "node:fs";
-import { resolve as resolve19, join as join26 } from "node:path";
-function runGit2(cwd, args) {
-  const r = spawnSync5("git", ["-C", cwd, ...args], {
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { existsSync as existsSync26, readFileSync as readFileSync2 } from "node:fs";
+import { resolve as resolve19, join as join28 } from "node:path";
+function runGit3(cwd, args) {
+  const r = spawnSync6("git", ["-C", cwd, ...args], {
     stdio: ["ignore", "pipe", "pipe"],
     encoding: "utf8"
   });
   return { status: r.status ?? -1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
 }
 function detectPackageManager(repoRoot) {
-  if (existsSync25(join26(repoRoot, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync25(join26(repoRoot, "yarn.lock"))) return "yarn";
-  if (existsSync25(join26(repoRoot, "bun.lockb"))) return "bun";
-  if (existsSync25(join26(repoRoot, "package-lock.json"))) return "npm";
+  if (existsSync26(join28(repoRoot, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync26(join28(repoRoot, "yarn.lock"))) return "yarn";
+  if (existsSync26(join28(repoRoot, "bun.lockb"))) return "bun";
+  if (existsSync26(join28(repoRoot, "package-lock.json"))) return "npm";
   return null;
 }
 function readPackageJson(repoRoot) {
-  const path = join26(repoRoot, "package.json");
-  if (!existsSync25(path)) return null;
+  const path = join28(repoRoot, "package.json");
+  if (!existsSync26(path)) return null;
   try {
     return JSON.parse(readFileSync2(path, "utf8"));
   } catch {
@@ -19064,7 +19583,7 @@ function parseRepoSlugFromRemote(url2) {
   return null;
 }
 function detectRemote(repoRoot) {
-  const remotes = runGit2(repoRoot, ["remote", "-v"]);
+  const remotes = runGit3(repoRoot, ["remote", "-v"]);
   if (remotes.status !== 0) return { candidates: [], primary: null };
   const lines = remotes.stdout.split("\n").filter(Boolean);
   const map2 = /* @__PURE__ */ new Map();
@@ -19080,23 +19599,23 @@ function detectRemote(repoRoot) {
   return { candidates: list, primary: origin };
 }
 function detectDefaultBranch(repoRoot, remoteName) {
-  const head = runGit2(repoRoot, ["symbolic-ref", `refs/remotes/${remoteName}/HEAD`]);
+  const head = runGit3(repoRoot, ["symbolic-ref", `refs/remotes/${remoteName}/HEAD`]);
   if (head.status === 0) {
     const ref = head.stdout.trim();
     const match = ref.match(/^refs\/remotes\/[^/]+\/(.+)$/);
     if (match) return match[1];
   }
-  const local = runGit2(repoRoot, ["remote", "show", remoteName]);
+  const local = runGit3(repoRoot, ["remote", "show", remoteName]);
   if (local.status === 0) {
     const match = local.stdout.match(/HEAD branch:\s*(\S+)/);
     if (match) return match[1];
   }
-  const branch = runGit2(repoRoot, ["branch", "--list"]);
+  const branch = runGit3(repoRoot, ["branch", "--list"]);
   if (branch.status === 0 && /\*\s*main\b/.test(branch.stdout)) return "main";
   return null;
 }
 function detectOwner(repoRoot) {
-  const user = runGit2(repoRoot, ["config", "--get", "user.name"]);
+  const user = runGit3(repoRoot, ["config", "--get", "user.name"]);
   if (user.status === 0 && user.stdout.trim()) return user.stdout.trim();
   const fallback = process.env.USER ?? process.env.USERNAME ?? "opencode-ship";
   return fallback;
@@ -19104,13 +19623,13 @@ function detectOwner(repoRoot) {
 function detectProject(repoRoot = process.cwd()) {
   const errors = [];
   const cwd = resolve19(repoRoot);
-  const inside = runGit2(cwd, ["rev-parse", "--show-toplevel"]);
+  const inside = runGit3(cwd, ["rev-parse", "--show-toplevel"]);
   if (inside.status !== 0) {
     errors.push({ kind: "not-a-git-repo", path: cwd, detail: inside.stderr.trim() });
     return { repoRoot: cwd, errors };
   }
   const repoRootActual = inside.stdout.trim();
-  const headBranch = runGit2(repoRootActual, ["symbolic-ref", "--short", "HEAD"]);
+  const headBranch = runGit3(repoRootActual, ["symbolic-ref", "--short", "HEAD"]);
   if (headBranch.status !== 0 || headBranch.stdout.trim().length === 0) {
     errors.push({ kind: "detached-head", path: repoRootActual, detail: headBranch.stderr.trim() });
   }
@@ -19150,21 +19669,19 @@ function detectProject(repoRoot = process.cwd()) {
 }
 
 // src/installer/cleanup.js
-import { spawnSync as spawnSync6 } from "node:child_process";
+import { spawnSync as spawnSync7 } from "node:child_process";
 import { resolve as pathResolve } from "node:path";
-import { existsSync as existsSync26, readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "node:fs";
+import { existsSync as existsSync27, readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "node:fs";
 function spawn8(repoRoot, args) {
-  const r = spawnSync6("git", ["-C", repoRoot, ...args], { encoding: "utf8" });
+  const r = spawnSync7("git", ["-C", repoRoot, ...args], { encoding: "utf8" });
   return { status: r.status ?? -1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
 }
 function casDeleteBranch2(repoRoot, branch, expectedSha) {
-  const argv = ["update-ref", "-d"];
-  if (expectedSha && /^[0-9f]{7,}$/i.test(expectedSha)) {
-    argv.push(`refs/heads/${branch}`, expectedSha);
-  } else {
-    argv.push(`refs/heads/${branch}`);
-  }
-  return spawn8(repoRoot, argv).status ?? -1;
+  if (!isValidExpectedSha(expectedSha)) return -1;
+  return spawn8(repoRoot, ["update-ref", "-d", `refs/heads/${branch}`, expectedSha]).status ?? -1;
+}
+function isValidExpectedSha(value) {
+  return typeof value === "string" && /^[0-9a-f]{7,}$/i.test(value);
 }
 function safeRemoveWorktree2(repoRoot, target) {
   const r = spawn8(repoRoot, ["worktree", "remove", target]);
@@ -19179,7 +19696,7 @@ async function cleanupPendingPath(repoRoot) {
 }
 async function loadCleanupPending(repoRoot) {
   const path = await cleanupPendingPath(repoRoot);
-  if (!existsSync26(path)) return [];
+  if (!existsSync27(path)) return [];
   try {
     const raw = await readFileSync3(path, "utf8");
     const parsed = JSON.parse(raw);
@@ -19191,19 +19708,16 @@ async function loadCleanupPending(repoRoot) {
 async function saveCleanupPending(repoRoot, entries) {
   const path = await cleanupPendingPath(repoRoot);
   const dir = pathResolve(path, "..");
-  if (!existsSync26(dir)) mkdirSync2(dir, { recursive: true });
+  if (!existsSync27(dir)) mkdirSync2(dir, { recursive: true });
   writeFileSync2(path, JSON.stringify(dedupePending(entries), null, 2) + "\n", "utf8");
 }
 function dedupePending(entries) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
+  const byTask = /* @__PURE__ */ new Map();
   for (const e of entries) {
     if (!e || !e.taskId) continue;
-    if (seen.has(e.taskId)) continue;
-    seen.add(e.taskId);
-    out.push(e);
+    byTask.set(e.taskId, e);
   }
-  return out;
+  return [...byTask.values()];
 }
 async function appendCleanupPending(repoRoot, entry) {
   const current = await loadCleanupPending(repoRoot);
@@ -19211,13 +19725,28 @@ async function appendCleanupPending(repoRoot, entry) {
   await saveCleanupPending(repoRoot, next);
   return next;
 }
+async function clearCleanupPending(repoRoot, taskId) {
+  const current = await loadCleanupPending(repoRoot);
+  await saveCleanupPending(repoRoot, current.filter((entry) => entry.taskId !== taskId));
+}
 function reject(reason, extra = {}) {
   return { ok: false, reason, ...extra };
 }
 async function tryImmediateCleanup({ repoRoot, taskId, adapter }) {
   if (!repoRoot || !taskId) return reject("missing-args");
+  const pending = (await loadCleanupPending(repoRoot)).find((entry) => entry.taskId === taskId);
+  const stage = pending?.stage ?? "worktree-remove";
+  if (!["worktree-remove", "branch-delete", "manifest-seal"].includes(stage)) {
+    return reject("cleanup-stage", { stage });
+  }
   const m = await readManifest(repoRoot, taskId);
-  if (!m) return reject("missing-manifest");
+  if (!m) {
+    if (pending && stage === "manifest-seal") {
+      await clearCleanupPending(repoRoot, taskId);
+      return { ok: true, removedPath: null, sealed: true };
+    }
+    return reject("missing-manifest");
+  }
   if (m.state !== "merged" && m.state !== "cleanup-pending") {
     return reject("manifest-state", { state: m.state });
   }
@@ -19229,36 +19758,68 @@ async function tryImmediateCleanup({ repoRoot, taskId, adapter }) {
   if (!wtPath.startsWith(rootAbs + "/")) {
     return reject("worktree-out-of-root", { expected: rootAbs, got: wtPath });
   }
-  const status = spawn8(wtPath, ["status", "--porcelain"]);
-  if (status.status === 0 && status.stdout.trim().length > 0) return reject("dirty-worktree");
-  const rebase = spawn8(wtPath, ["rev-parse", "--verify", "--quiet", "REBASE_HEAD"]);
-  if (rebase.status === 0) return reject("rebase-in-progress");
-  const head = spawn8(wtPath, ["rev-parse", "HEAD"]);
-  if (head.status !== 0) return reject("no-head");
-  const headSha = head.stdout.trim();
-  if (m.lastPrHeadSha && headSha !== m.lastPrHeadSha) {
-    return reject("head-mismatch", { expected: m.lastPrHeadSha, actual: headSha });
-  }
-  const removed = safeRemoveWorktree2(repoRoot, wtPath);
-  if (removed.status !== 0) {
+  let headSha = isValidExpectedSha(pending?.expectedHeadSha) ? pending.expectedHeadSha : isValidExpectedSha(m.lastPrHeadSha) ? m.lastPrHeadSha : "";
+  if (stage === "worktree-remove") {
+    const status = spawn8(wtPath, ["status", "--porcelain"]);
+    if (status.status === 0) {
+      if (status.stdout.trim().length > 0) return reject("dirty-worktree");
+      const rebase = spawn8(wtPath, ["rev-parse", "--verify", "--quiet", "REBASE_HEAD"]);
+      if (rebase.status === 0) return reject("rebase-in-progress");
+      const head = spawn8(wtPath, ["rev-parse", "HEAD"]);
+      if (head.status !== 0) return reject("no-head");
+      headSha = head.stdout.trim();
+      if (m.lastPrHeadSha && headSha !== m.lastPrHeadSha) {
+        return reject("head-mismatch", { expected: m.lastPrHeadSha, actual: headSha });
+      }
+      await appendCleanupPending(repoRoot, {
+        taskId,
+        failedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        stage: "worktree-remove",
+        expectedHeadSha: headSha,
+        reason: "worktree head validated"
+      });
+      const removed = safeRemoveWorktree2(repoRoot, wtPath);
+      if (removed.status !== 0) {
+        await appendCleanupPending(repoRoot, {
+          taskId,
+          failedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          stage: "worktree-remove",
+          expectedHeadSha: headSha,
+          reason: removed.stderr ?? "non-zero exit"
+        });
+        return reject("remove-failed", { detail: removed.stderr });
+      }
+    } else if (!headSha) {
+      return reject("no-head");
+    }
     await appendCleanupPending(repoRoot, {
       taskId,
       failedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      stage: "worktree-remove",
-      reason: removed.stderr ?? "non-zero exit"
+      stage: "branch-delete",
+      expectedHeadSha: headSha,
+      reason: "resume cleanup"
     });
-    return reject("remove-failed", { detail: removed.stderr });
   }
-  const branchDelete = casDeleteBranch2(repoRoot, m.branch, headSha);
-  const branchStillThere = spawn8(repoRoot, ["show-ref", "--verify", "--quiet", `refs/heads/${m.branch}`]);
-  if (branchDelete !== 0 && branchStillThere.status === 0) {
+  if (stage !== "manifest-seal") {
+    if (!isValidExpectedSha(headSha)) return reject("no-head");
+    const branchDelete = casDeleteBranch2(repoRoot, m.branch, headSha);
+    const branchStillThere = spawn8(repoRoot, ["show-ref", "--verify", "--quiet", `refs/heads/${m.branch}`]);
+    if (branchDelete !== 0 && branchStillThere.status === 0) {
+      await appendCleanupPending(repoRoot, {
+        taskId,
+        failedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        stage: "branch-delete",
+        expectedHeadSha: headSha,
+        reason: "git update-ref failed"
+      });
+      return reject("branch-delete-failed");
+    }
     await appendCleanupPending(repoRoot, {
       taskId,
       failedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      stage: "branch-delete",
-      reason: "git update-ref failed"
+      stage: "manifest-seal",
+      reason: "resume cleanup"
     });
-    return reject("branch-delete-failed");
   }
   const next = {
     ...m,
@@ -19271,11 +19832,18 @@ async function tryImmediateCleanup({ repoRoot, taskId, adapter }) {
   };
   await writeManifest(repoRoot, next).catch(() => null);
   await deleteManifest(repoRoot, taskId);
+  await clearCleanupPending(repoRoot, taskId);
   return { ok: true, removedPath: wtPath, sealed: true };
 }
 async function listPending(repoRoot) {
   const all = await listManifests(repoRoot).catch(() => []);
-  return all.filter((m) => m.state === "merged" || m.state === "cleanup-pending");
+  const manifests = all.filter((m) => m.state === "merged" || m.state === "cleanup-pending");
+  const queued = await loadCleanupPending(repoRoot);
+  const byTask = new Map(manifests.map((manifest) => [manifest.taskId, manifest]));
+  for (const entry of queued) {
+    if (!byTask.has(entry.taskId)) byTask.set(entry.taskId, entry);
+  }
+  return [...byTask.values()];
 }
 
 // src/installer/ship-adapter.js
@@ -19325,10 +19893,10 @@ function selectRuntimeAdapter({ config: config2, shipAdapter, legacyAdapter }) {
 }
 
 // src/version.js
-import { readFileSync as readFileSync4, existsSync as existsSync27 } from "node:fs";
+import { readFileSync as readFileSync4, existsSync as existsSync28 } from "node:fs";
 import { dirname as dirname12, resolve as resolve21 } from "node:path";
 import { fileURLToPath } from "node:url";
-var PACKAGE_VERSION = "1.1.5";
+var PACKAGE_VERSION = "1.1.8";
 var TEMPLATE_SET = `v${PACKAGE_VERSION}`;
 
 // src/plugin.js
@@ -19342,6 +19910,7 @@ var toolDefs = [
   ["delivery_ready", "Mark the PR ready after every required gate has passed.", "ready"],
   ["delivery_merge", "Squash merge the PR after an explicit user request.", "merge"],
   ["delivery_cleanup", "Remove the agent-owned worktree and branch after merge.", "cleanup"],
+  ["delivery_abandon", "Abandon a closed unmerged delivery attempt after explicit approval.", "abandon"],
   ["delivery_github_read", "Typed read of issue, PR, or check data.", "githubRead"],
   ["delivery_issue_comment", "Idempotent typed comment on an issue.", "issueComment"],
   ["delivery_issue_labels", "Idempotent label add/remove on an issue.", "issueLabels"],
@@ -19349,6 +19918,7 @@ var toolDefs = [
   ["delivery_issue_close", "Close an issue with a recorded user permission subject.", "issueClose"],
   ["delivery_sync", "Fetch and merge base into the feature branch.", "sync"],
   ["delivery_publish", "Push the manifest branch to origin with HEAD verification.", "publish"],
+  ["ship_deliver", "Dispatch durable delivery for an issue to the controller.", "deliver"],
   ["ship_plan_start", "Create a workflow and dispatch the configured planner.", "planStart"],
   ["ship_plan_submit", "Planner-only immutable PlanV2 submission.", "planSubmit"],
   ["ship_plan_approve", "Interactive approval + immutable local seal.", "planApprove"],
@@ -19417,7 +19987,7 @@ async function resolveRepoSlug(repoRoot, detection, config2) {
   const fromConfig = config2?.value?.project?.repository;
   if (typeof fromConfig === "string" && fromConfig.includes("/")) return fromConfig;
   if (detection?.repository) return detection.repository;
-  const gitConfig = await readFile24(resolve22(repoRoot, ".git/config"), "utf8").catch(() => null);
+  const gitConfig = await readFile26(resolve22(repoRoot, ".git/config"), "utf8").catch(() => null);
   if (gitConfig) {
     const m = gitConfig.match(/url\s*=\s*.*?github\.com[:/]([^/]+)\/([^/\s]+?)(?:\.git)?\b/);
     if (m) return `${m[1]}/${m[2]}`;
@@ -19602,6 +20172,21 @@ var factories = {
       remote: "origin"
     })
   },
+  abandon: {
+    args: {
+      taskId: tool.schema.string(),
+      subject: tool.schema.string(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt) => createAbandonTool({
+      driver: rt.driver,
+      repoRoot: rt.repoRoot,
+      repoSlug: rt.repoSlug,
+      owner: rt.owner,
+      adapter: rt.adapter,
+      remote: "origin"
+    })
+  },
   githubRead: {
     args: {
       resource: tool.schema.enum(["issue", "pr", "checks"]),
@@ -19697,6 +20282,17 @@ var factories = {
       owner: rt.owner
     })
   },
+  deliver: {
+    args: {
+      issueNumber: tool.schema.number(),
+      operationId: tool.schema.string().optional()
+    },
+    build: (rt, ctx) => createDeliverTool({
+      repoRoot: rt.repoRoot,
+      opencodeClient: rt.opencodeClient,
+      ctx
+    })
+  },
   planStart: {
     args: {
       issueNumber: tool.schema.number(),