opencode-ship 1.1.7 → 1.1.9-rc.1

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// opencode-ship CLI v1.1.7
+// opencode-ship CLI v1.1.9-rc.1
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -110,11 +110,108 @@ import { fileURLToPath as fileURLToPath2 } from "node:url";
 var PACKAGE_VERSION, TEMPLATE_SET;
 var init_version = __esm({
   "src/version.js"() {
-    PACKAGE_VERSION = "1.1.7";
+    PACKAGE_VERSION = "1.1.9-rc.1";
     TEMPLATE_SET = `v${PACKAGE_VERSION}`;
   }
 });
 
+// src/installer/workflow-models.js
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
+import { resolve as resolve3 } from "node:path";
+function failDefaults(message) {
+  const err = new Error(message);
+  err.catalogValidation = true;
+  throw err;
+}
+function readJson(path) {
+  if (!existsSync3(path)) {
+    failDefaults(`defaults file missing: ${path}`);
+  }
+  let raw;
+  try {
+    raw = readFileSync3(path, "utf8");
+  } catch (e) {
+    failDefaults(`defaults file unreadable: ${path}: ${e?.message ?? e}`);
+  }
+  if (raw.trim().length === 0) {
+    failDefaults(`defaults file empty: ${path}`);
+  }
+  try {
+    return JSON.parse(raw);
+  } catch (e) {
+    failDefaults(`defaults file is not JSON: ${path}: ${e?.message ?? e}`);
+  }
+}
+function assertRoles(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    failDefaults(`${label} must be an object with planner, builder, finalReviewer`);
+  }
+  for (const role of MODEL_ROLES) {
+    if (typeof value[role] !== "string" || value[role].length === 0) {
+      failDefaults(`${label} missing role: ${role}`);
+    }
+  }
+}
+function loadWorkflowModelDefaults() {
+  const root = resolvePackageRoot(import.meta.url);
+  const current = readJson(resolve3(root, "assets/defaults/workflow-models.json"));
+  const history = readJson(resolve3(root, "assets/defaults/workflow-models.history.json"));
+  assertRoles(current, "workflow-models.json");
+  if (!Array.isArray(history)) {
+    failDefaults("workflow-models.history.json must be a JSON array");
+  }
+  for (let i = 0; i < history.length; i++) {
+    assertRoles(history[i], `workflow-models.history.json[${i}]`);
+  }
+  return { current, history };
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function resolveWorkflowModels({ configModels, lockModels, cliModels, current, history }) {
+  const config = configModels && typeof configModels === "object" ? configModels : {};
+  const lock = lockModels && typeof lockModels === "object" ? lockModels : {};
+  const cli = cliModels && typeof cliModels === "object" ? cliModels : {};
+  const hist = Array.isArray(history) ? history : [];
+  const models = {};
+  const provenance = {};
+  const changedRoles = [];
+  for (const role of MODEL_ROLES) {
+    let id;
+    let source;
+    if (isNonEmptyString(cli[role])) {
+      source = "override";
+      id = cli[role];
+    } else if (lock[role]?.source === "override") {
+      source = "override";
+      id = isNonEmptyString(config[role]) ? config[role] : lock[role].applied;
+    } else if (lock[role]?.source === "default") {
+      source = "default";
+      id = current[role];
+    } else if (!isNonEmptyString(config[role])) {
+      source = "default";
+      id = current[role];
+    } else if (config[role] === current[role] || hist.some((entry) => entry?.[role] === config[role])) {
+      source = "default";
+      id = current[role];
+    } else {
+      source = "override";
+      id = config[role];
+    }
+    models[role] = id;
+    provenance[role] = { source, applied: id };
+    if (id !== config[role]) changedRoles.push(role);
+  }
+  return { models, provenance, changedRoles };
+}
+var MODEL_ROLES;
+var init_workflow_models = __esm({
+  "src/installer/workflow-models.js"() {
+    init_package_root();
+    MODEL_ROLES = ["planner", "builder", "finalReviewer"];
+  }
+});
+
 // src/installer/catalog.js
 var catalog_exports = {};
 __export(catalog_exports, {
@@ -125,8 +222,8 @@ __export(catalog_exports, {
   filterCatalogByProfile: () => filterCatalogByProfile,
   validateCatalog: () => validateCatalog
 });
-import { resolve as resolve3, relative, sep } from "node:path";
-import { existsSync as existsSync3, statSync } from "node:fs";
+import { resolve as resolve4, relative, sep } from "node:path";
+import { existsSync as existsSync4, statSync } from "node:fs";
 function filterCatalogByProfile(catalog, profile) {
   const effective = profile === void 0 || profile === null ? DEFAULT_PROFILE : isValidProfile(profile) ? profile : profile === "core" ? DEFAULT_PROFILE : null;
   if (effective === null) {
@@ -166,7 +263,7 @@ function validateCatalog({ catalog = CATALOG } = {}) {
     }
     if (typeof source !== "string" || source.length === 0) {
       issues.push({ id, kind: "source", message: `source path missing: ${id}` });
-    } else if (!existsSync3(source)) {
+    } else if (!existsSync4(source)) {
       issues.push({ id, kind: "source-missing", message: `source file not found: ${source}` });
     } else {
       try {
@@ -204,6 +301,7 @@ function validateCatalog({ catalog = CATALOG } = {}) {
     err.catalogValidation = true;
     throw err;
   }
+  loadWorkflowModelDefaults();
   return catalog;
 }
 var TEMPLATE_SET_ID, packageRoot, PACKAGE_ROOT, MATT_SKILLS, SUPER_SKILLS, ENGINEERING_AGENTS, ENGINEERING_COMMANDS, CATALOG, ALLOWED_KINDS;
@@ -212,6 +310,7 @@ var init_catalog = __esm({
     init_package_root();
     init_version();
     init_profile();
+    init_workflow_models();
     TEMPLATE_SET_ID = TEMPLATE_SET;
     packageRoot = resolvePackageRoot(import.meta.url);
     PACKAGE_ROOT = packageRoot;
@@ -261,7 +360,23 @@ var init_catalog = __esm({
         id: "plugin:opencode-ship",
         kind: "plugin",
         path: ".opencode/plugins/opencode-ship.js",
-        source: resolve3(packageRoot, "dist/plugin.js"),
+        source: resolve4(packageRoot, "dist/plugin.js"),
+        mode: 420,
+        profiles: ["engineering"]
+      },
+      {
+        id: "agent:ship-reviewer",
+        kind: "agent",
+        path: ".opencode/agents/ship-reviewer.md",
+        source: resolve4(packageRoot, "assets/agents/ship-reviewer.md"),
+        mode: 420,
+        profiles: ["engineering"]
+      },
+      {
+        id: "agent:ship-verifier",
+        kind: "agent",
+        path: ".opencode/agents/ship-verifier.md",
+        source: resolve4(packageRoot, "assets/agents/ship-verifier.md"),
         mode: 420,
         profiles: ["engineering"]
       },
@@ -269,23 +384,25 @@ var init_catalog = __esm({
         id: "agent:delivery-reviewer",
         kind: "agent",
         path: ".opencode/agents/delivery-reviewer.md",
-        source: resolve3(packageRoot, "assets/agents/delivery-reviewer.md"),
+        source: resolve4(packageRoot, "assets/agents/ship-reviewer.md"),
         mode: 420,
-        profiles: ["engineering"]
+        profiles: ["engineering"],
+        legacy: true
       },
       {
         id: "agent:delivery-verifier",
         kind: "agent",
         path: ".opencode/agents/delivery-verifier.md",
-        source: resolve3(packageRoot, "assets/agents/delivery-verifier.md"),
+        source: resolve4(packageRoot, "assets/agents/ship-verifier.md"),
         mode: 420,
-        profiles: ["engineering"]
+        profiles: ["engineering"],
+        legacy: true
       },
       ...ENGINEERING_AGENTS.map((name) => ({
         id: `agent:${name}`,
         kind: "agent",
         path: `.opencode/agents/${name}.md`,
-        source: resolve3(packageRoot, `assets/agents/${name}.md`),
+        source: resolve4(packageRoot, `assets/agents/${name}.md`),
         mode: 420,
         profiles: ["engineering"]
       })),
@@ -293,23 +410,32 @@ var init_catalog = __esm({
         id: `command:${name}`,
         kind: "support",
         path: `.opencode/commands/${name}.md`,
-        source: resolve3(packageRoot, `assets/commands/${name}.md`),
+        source: resolve4(packageRoot, `assets/commands/${name}.md`),
         mode: 420,
         profiles: ["engineering"]
       })),
+      {
+        id: "skill:ship-workflow",
+        kind: "skill",
+        path: ".opencode/skills/ship-workflow/SKILL.md",
+        source: resolve4(packageRoot, "assets/skills/ship-workflow/SKILL.md"),
+        mode: 420,
+        profiles: ["engineering"]
+      },
       {
         id: "skill:delivery-workflow",
         kind: "skill",
         path: ".opencode/skills/delivery-workflow/SKILL.md",
-        source: resolve3(packageRoot, "assets/skills/delivery-workflow/SKILL.md"),
+        source: resolve4(packageRoot, "assets/skills/ship-workflow/SKILL.md"),
         mode: 420,
-        profiles: ["engineering"]
+        profiles: ["engineering"],
+        legacy: true
       },
       {
         id: "skill:planning-research-checkpoint",
         kind: "skill",
         path: ".opencode/skills/planning-research-checkpoint/SKILL.md",
-        source: resolve3(packageRoot, "assets/skills/planning-research-checkpoint/SKILL.md"),
+        source: resolve4(packageRoot, "assets/skills/planning-research-checkpoint/SKILL.md"),
         mode: 420,
         profiles: ["engineering"]
       },
@@ -317,7 +443,7 @@ var init_catalog = __esm({
         id: `skill:matt:${name}`,
         kind: "skill",
         path: `.opencode/skills/${name}/SKILL.md`,
-        source: resolve3(packageRoot, `assets/skills/${name}/SKILL.md`),
+        source: resolve4(packageRoot, `assets/skills/${name}/SKILL.md`),
         mode: 420,
         profiles: ["engineering"]
       })),
@@ -325,7 +451,7 @@ var init_catalog = __esm({
         id: `skill:super:${name}`,
         kind: "skill",
         path: `.opencode/skills/${name}/SKILL.md`,
-        source: resolve3(packageRoot, `assets/skills/${name}/SKILL.md`),
+        source: resolve4(packageRoot, `assets/skills/${name}/SKILL.md`),
         mode: 420,
         profiles: ["engineering"]
       })),
@@ -333,7 +459,7 @@ var init_catalog = __esm({
         id: "skill:setup-ship-workflow",
         kind: "skill",
         path: ".opencode/skills/setup-ship-workflow/SKILL.md",
-        source: resolve3(packageRoot, "assets/skills/setup-ship-workflow/SKILL.md"),
+        source: resolve4(packageRoot, "assets/skills/setup-ship-workflow/SKILL.md"),
         mode: 420,
         profiles: ["engineering"]
       },
@@ -341,7 +467,7 @@ var init_catalog = __esm({
         id: "skill:skill-discovery",
         kind: "skill",
         path: ".opencode/skills/skill-discovery/SKILL.md",
-        source: resolve3(packageRoot, "assets/skills/skill-discovery/SKILL.md"),
+        source: resolve4(packageRoot, "assets/skills/skill-discovery/SKILL.md"),
         mode: 420,
         profiles: ["engineering"]
       },
@@ -349,7 +475,7 @@ var init_catalog = __esm({
         id: "command:setup-ship-workflow",
         kind: "support",
         path: ".opencode/commands/setup-ship-workflow.md",
-        source: resolve3(packageRoot, "assets/commands/setup-ship-workflow.md"),
+        source: resolve4(packageRoot, "assets/commands/setup-ship-workflow.md"),
         mode: 420,
         profiles: ["engineering"]
       }
@@ -772,14 +898,14 @@ __export(config_exports, {
   writeConfig: () => writeConfig
 });
 import { readFile, writeFile, rename, mkdir } from "node:fs/promises";
-import { existsSync as existsSync4 } from "node:fs";
-import { dirname as dirname3, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync5 } from "node:fs";
+import { dirname as dirname3, resolve as resolve5 } from "node:path";
 function configPath(repoRoot) {
-  return resolve4(repoRoot, ".opencode", "ship.config.json");
+  return resolve5(repoRoot, ".opencode", "ship.config.json");
 }
 async function loadConfig(repoRoot) {
   const path = configPath(repoRoot);
-  if (!existsSync4(path)) return null;
+  if (!existsSync5(path)) return null;
   const raw = await readFile(path, "utf8");
   let parsed;
   try {
@@ -835,10 +961,10 @@ function renderDefaultConfig(detection, overrides = {}) {
         requireCleanDiffAfter: true,
         invalidateOnHeadChange: true
       },
-      review: { agent: "delivery-reviewer", required: true, invalidateOnHeadChange: true },
+      review: { agent: "ship-reviewer", required: true, invalidateOnHeadChange: true },
       ci: {
         driver: "github-status-checks",
-        requiredChecks: ["delivery-verify"],
+        requiredChecks: ["opencode-ship-verify"],
         wait: true,
         flakyRetry: 1
       },
@@ -869,10 +995,10 @@ var init_config = __esm({
 
 // src/installer/lock.js
 import { readFile as readFile2, writeFile as writeFile2, rename as rename2, mkdir as mkdir2 } from "node:fs/promises";
-import { existsSync as existsSync5 } from "node:fs";
-import { dirname as dirname4, resolve as resolve5, posix } from "node:path";
+import { existsSync as existsSync6 } from "node:fs";
+import { dirname as dirname4, resolve as resolve6, posix } from "node:path";
 function lockPath(repoRoot) {
-  return resolve5(repoRoot, ".opencode", "ship.lock.json");
+  return resolve6(repoRoot, ".opencode", "ship.lock.json");
 }
 function computeIntegrity(lock) {
   const { integrity: _ignored, ...without } = lock ?? {};
@@ -896,8 +1022,8 @@ function validateLock(rawLock) {
   }
   const issues = [];
   let kind = "ok";
-  if (rawLock.contractVersion !== CURRENT_LOCK_SCHEMA && rawLock.contractVersion !== 3 && rawLock.contractVersion !== 2 && rawLock.contractVersion !== 1) {
-    issues.push(`unsupported contractVersion: ${JSON.stringify(rawLock.contractVersion)} (expected ${CURRENT_LOCK_SCHEMA}, 3, 2, or 1)`);
+  if (rawLock.contractVersion !== CURRENT_LOCK_SCHEMA && rawLock.contractVersion !== 4 && rawLock.contractVersion !== 3 && rawLock.contractVersion !== 2 && rawLock.contractVersion !== 1) {
+    issues.push(`unsupported contractVersion: ${JSON.stringify(rawLock.contractVersion)} (expected ${CURRENT_LOCK_SCHEMA}, 4, 3, 2, or 1)`);
     kind = "schema";
   }
   const manager = rawLock.manager;
@@ -907,8 +1033,8 @@ function validateLock(rawLock) {
   } else if (typeof manager !== "object" || manager === null) {
     issues.push("manager section must be an object");
     kind = kind === "ok" ? "shape" : kind;
-  } else if (manager.schemaVersion !== CURRENT_LOCK_SCHEMA && manager.schemaVersion !== 3 && manager.schemaVersion !== 2 && manager.schemaVersion !== 1) {
-    issues.push(`unsupported manager.schemaVersion: ${JSON.stringify(manager.schemaVersion)} (expected ${CURRENT_LOCK_SCHEMA}, 3, 2, or 1)`);
+  } else if (manager.schemaVersion !== CURRENT_LOCK_SCHEMA && manager.schemaVersion !== 4 && manager.schemaVersion !== 3 && manager.schemaVersion !== 2 && manager.schemaVersion !== 1) {
+    issues.push(`unsupported manager.schemaVersion: ${JSON.stringify(manager.schemaVersion)} (expected ${CURRENT_LOCK_SCHEMA}, 4, 3, 2, or 1)`);
     kind = "schema";
   } else if (manager.name !== "opencode-ship") {
     issues.push(`unknown manager.name: ${JSON.stringify(manager.name)}`);
@@ -947,7 +1073,7 @@ function isSafeManagedPath(value) {
 }
 async function readValidatedLock(repoRoot) {
   const path = lockPath(repoRoot);
-  if (!existsSync5(path)) {
+  if (!existsSync6(path)) {
     return { kind: "missing", lock: null, issues: [] };
   }
   let raw;
@@ -983,7 +1109,7 @@ var init_lock = __esm({
     init_hash();
     init_json_pointer();
     init_profile();
-    CURRENT_LOCK_SCHEMA = 4;
+    CURRENT_LOCK_SCHEMA = 5;
   }
 });
 
@@ -1007,7 +1133,16 @@ function planModePermissions() {
       delivery_pr: DENY_DEFAULT,
       delivery_ready: DENY_DEFAULT,
       delivery_merge: DENY_DEFAULT,
-      delivery_cleanup: DENY_DEFAULT
+      delivery_cleanup: DENY_DEFAULT,
+      ship_inspect: DENY_DEFAULT,
+      ship_issue: DENY_DEFAULT,
+      ship_worktree: DENY_DEFAULT,
+      ship_verify: DENY_DEFAULT,
+      ship_review: DENY_DEFAULT,
+      ship_pr: DENY_DEFAULT,
+      ship_ready: DENY_DEFAULT,
+      ship_merge: DENY_DEFAULT,
+      ship_cleanup: DENY_DEFAULT
     }
   };
 }
@@ -1089,24 +1224,24 @@ __export(root_config_exports, {
   readRootConfig: () => readRootConfig,
   synthesizeDefaultRootConfig: () => synthesizeDefaultRootConfig
 });
-import { existsSync as existsSync6, readFileSync as readFileSync3 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync4 } from "node:fs";
 import { readFile as readFile3 } from "node:fs/promises";
-import { resolve as resolve6 } from "node:path";
+import { resolve as resolve7 } from "node:path";
 function findRootConfig(repoRoot) {
   for (const rel of ROOT_PATH_CANDIDATES) {
-    const abs = resolve6(repoRoot, rel);
-    if (existsSync6(abs)) return { path: abs, relative: rel, format: rel.endsWith(".jsonc") ? "jsonc" : "json" };
+    const abs = resolve7(repoRoot, rel);
+    if (existsSync7(abs)) return { path: abs, relative: rel, format: rel.endsWith(".jsonc") ? "jsonc" : "json" };
   }
   return { path: null, relative: ROOT_PATH_CANDIDATES[0], format: "json" };
 }
 function defaultRootConfigPath(repoRoot) {
-  return resolve6(repoRoot, ROOT_PATH_CANDIDATES[0]);
+  return resolve7(repoRoot, ROOT_PATH_CANDIDATES[0]);
 }
 function readRootConfig(absPath) {
-  if (!existsSync6(absPath)) {
+  if (!existsSync7(absPath)) {
     return { ok: false, error: { kind: "missing", path: absPath } };
   }
-  const raw = readFileSync3(absPath, "utf8");
+  const raw = readFileSync4(absPath, "utf8");
   const stripped = stripJsonc(raw);
   try {
     const value = JSON.parse(stripped);
@@ -1320,6 +1455,61 @@ var init_root_config = __esm({
         strategy: "value",
         value: "allow"
       },
+      {
+        pointer: "/agent/build/permission/ship_inspect",
+        strategy: "value",
+        value: "allow"
+      },
+      {
+        pointer: "/agent/build/permission/ship_issue",
+        strategy: "value",
+        value: "allow"
+      },
+      {
+        pointer: "/agent/build/permission/ship_worktree",
+        strategy: "value",
+        value: "allow"
+      },
+      {
+        pointer: "/agent/build/permission/ship_verify",
+        strategy: "value",
+        value: "deny"
+      },
+      {
+        pointer: "/agent/build/permission/ship_review",
+        strategy: "value",
+        value: "deny"
+      },
+      {
+        pointer: "/agent/build/permission/ship_pr",
+        strategy: "value",
+        value: "allow"
+      },
+      {
+        pointer: "/agent/build/permission/ship_ready",
+        strategy: "value",
+        value: "allow"
+      },
+      {
+        pointer: "/agent/build/permission/ship_merge",
+        strategy: "value",
+        value: "ask"
+      },
+      {
+        pointer: "/agent/build/permission/ship_cleanup",
+        strategy: "value",
+        value: "allow"
+      },
+      {
+        pointer: "/agent/build/permission/task/ship-reviewer",
+        strategy: "value",
+        value: "allow"
+      },
+      {
+        pointer: "/agent/build/permission/task/ship-verifier",
+        strategy: "value",
+        value: "allow"
+      },
       // Build -> ship-controller delegation so the deep plan/build/review
       // chain works with subagent_depth=2.
       {
@@ -1556,9 +1746,9 @@ __export(setup_state_exports, {
   modelsComplete: () => modelsComplete,
   setupComplete: () => setupComplete
 });
-import { existsSync as existsSync14 } from "node:fs";
+import { existsSync as existsSync15 } from "node:fs";
 import { readFile as readFile10 } from "node:fs/promises";
-import { resolve as resolve13 } from "node:path";
+import { resolve as resolve14 } from "node:path";
 function modelsComplete(repoRoot, configValue) {
   if (configValue === void 0) return false;
   return hasCompletedModels(configValue);
@@ -1566,12 +1756,12 @@ function modelsComplete(repoRoot, configValue) {
 async function setupComplete(repoRoot, configValue) {
   const missing = [];
   for (const rel of REQUIRED_DOCS) {
-    const path = resolve13(repoRoot, rel);
-    if (!existsSync14(path)) missing.push(rel);
+    const path = resolve14(repoRoot, rel);
+    if (!existsSync15(path)) missing.push(rel);
   }
-  const agentsPath = resolve13(repoRoot, "AGENTS.md");
+  const agentsPath = resolve14(repoRoot, "AGENTS.md");
   let agentsOk = false;
-  if (existsSync14(agentsPath)) {
+  if (existsSync15(agentsPath)) {
     try {
       const raw = await readFile10(agentsPath, "utf8");
       agentsOk = /##\s+Ship workflow\b/.test(raw);
@@ -1611,6 +1801,840 @@ var init_setup_state = __esm({
   }
 });
 
+// src/tools/skill-discovery.js
+import { spawn as spawn2 } from "node:child_process";
+import { existsSync as existsSync18, readFileSync as readFileSync8, writeFileSync, mkdirSync, readdirSync, statSync as statSync2 } from "node:fs";
+import { dirname as dirname10, join as join7, normalize, resolve as resolve17, sep as sep3 } from "node:path";
+function parseFindOutput(text) {
+  if (typeof text !== "string") return [];
+  const stripped = text.replace(ANSI_RE, "");
+  const lines = stripped.split(/\r?\n/);
+  const candidates = [];
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!line) continue;
+    const match = line.match(/^([a-zA-Z0-9_.\-]+)\/([a-zA-Z0-9_.\-]+)@([a-zA-Z0-9_.\-]+)\s+([0-9]+(?:\.[0-9]+)?)([KM]?)\s+installs\b/i);
+    if (!match) continue;
+    const num = Number.parseFloat(match[4]);
+    if (!Number.isFinite(num)) continue;
+    let installs = Math.round(num);
+    const suffix = match[5].toUpperCase();
+    if (suffix === "K") installs = Math.round(num * 1e3);
+    else if (suffix === "M") installs = Math.round(num * 1e6);
+    candidates.push({
+      package: `${match[1]}/${match[2]}`,
+      skill: match[3],
+      installs
+    });
+  }
+  return candidates;
+}
+function discoverSkillsWithStdout(text) {
+  const raw = typeof text === "string" ? text : "";
+  const candidates = parseFindOutput(raw);
+  if (candidates.length > 0) {
+    return { ok: true, candidates, raw };
+  }
+  if (raw.trim().length === 0) {
+    return { ok: true, candidates, raw };
+  }
+  return {
+    ok: false,
+    error: { kind: "registry-contract-mismatch", raw }
+  };
+}
+function runCapture(cmd, args, options) {
+  const cwd = options?.cwd;
+  const timeoutMs = options?.timeoutMs ?? 6e4;
+  return new Promise((resolveP, rejectP) => {
+    const child = spawn2(cmd, args, { cwd, shell: false, stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      rejectP(new Error(`skill-discovery: timeout running '${cmd} ${args.join(" ")}'`));
+    }, timeoutMs);
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString("utf8");
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString("utf8");
+    });
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      rejectP(err);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      resolveP({ code, stdout, stderr });
+    });
+  });
+}
+async function discoverSkills({ repoRoot, query, npmBin = "npx" }) {
+  if (!repoRoot || !query) {
+    return { ok: false, error: { kind: "missing-args" } };
+  }
+  const r = await runCapture(npmBin, ["skills", "find", query], { cwd: repoRoot, timeoutMs: 6e4 });
+  if (r.code !== 0 && !r.stdout.trim()) {
+    return { ok: false, error: { kind: "registry-unavailable", stderr: r.stderr } };
+  }
+  return discoverSkillsWithStdout(r.stdout);
+}
+var DEFAULT_TRUSTED_OWNERS, ANSI_RE;
+var init_skill_discovery = __esm({
+  "src/tools/skill-discovery.js"() {
+    DEFAULT_TRUSTED_OWNERS = Object.freeze([
+      "vercel-labs",
+      "anthropics",
+      "obra",
+      "mattpocock",
+      "ComposioHQ"
+    ]);
+    ANSI_RE = /\x1B\[[0-9;]*m/g;
+  }
+});
+
+// src/skills/registry.js
+import { spawn as spawn3 } from "node:child_process";
+import { readFile as readFile11, writeFile as writeFile8, mkdir as mkdir7 } from "node:fs/promises";
+import { resolve as resolve18, dirname as dirname11 } from "node:path";
+import { createHash as createHash3 } from "node:crypto";
+async function listSkills({ repoRoot, query, npmBin = "npx" }) {
+  return discoverSkills({ repoRoot, query, npmBin });
+}
+var SKILLS_CLI_TIMEOUT_MS, SKILLS_INSTALL_TIMEOUT_MS;
+var init_registry = __esm({
+  "src/skills/registry.js"() {
+    init_skill_discovery();
+    SKILLS_CLI_TIMEOUT_MS = 60 * 1e3;
+    SKILLS_INSTALL_TIMEOUT_MS = 120 * 1e3;
+  }
+});
+
+// src/skills/policy.js
+import { readFile as readFile12, writeFile as writeFile9 } from "node:fs/promises";
+import { existsSync as existsSync19 } from "node:fs";
+import { resolve as resolve19 } from "node:path";
+function policyPath(repoRoot) {
+  return resolve19(repoRoot, POLICY_PATH);
+}
+function defaultPolicy() {
+  return {
+    trustedOwners: [...DEFAULT_TRUSTED_OWNERS2],
+    minInstalls: DEFAULT_MIN_INSTALLS,
+    blocklist: [],
+    maxTrustedPerRun: MAX_TRUSTED_PER_RUN
+  };
+}
+async function readPolicy(repoRoot) {
+  const path = policyPath(repoRoot);
+  if (!existsSync19(path)) return defaultPolicy();
+  try {
+    const raw = await readFile12(path, "utf8");
+    const parsed = JSON.parse(raw);
+    return mergePolicy(defaultPolicy(), parsed);
+  } catch {
+    return defaultPolicy();
+  }
+}
+function mergePolicy(base, override) {
+  const out = { ...base };
+  if (Array.isArray(override?.trustedOwners)) {
+    out.trustedOwners = [...new Set(override.trustedOwners)];
+  }
+  if (Number.isInteger(override?.minInstalls)) {
+    out.minInstalls = override.minInstalls;
+  }
+  if (Array.isArray(override?.blocklist)) {
+    out.blocklist = [...new Set(override.blocklist)];
+  }
+  if (Number.isInteger(override?.maxTrustedPerRun)) {
+    out.maxTrustedPerRun = override.maxTrustedPerRun;
+  }
+  return out;
+}
+function isAutoInstallable(candidate, policy) {
+  if (!candidate || typeof candidate !== "object") {
+    return { ok: false, reason: "missing-candidate" };
+  }
+  if ((policy.blocklist ?? []).includes(candidate.package)) {
+    return { ok: false, reason: "blocked" };
+  }
+  const owner = String(candidate.package).split("/")[0];
+  if (!(policy.trustedOwners ?? []).includes(owner)) {
+    return { ok: false, reason: "untrusted-owner" };
+  }
+  if (candidate.installs < (policy.minInstalls ?? DEFAULT_MIN_INSTALLS)) {
+    return { ok: false, reason: "below-threshold" };
+  }
+  return { ok: true };
+}
+var DEFAULT_TRUSTED_OWNERS2, DEFAULT_MIN_INSTALLS, MAX_TRUSTED_PER_RUN, POLICY_PATH;
+var init_policy = __esm({
+  "src/skills/policy.js"() {
+    init_hash();
+    DEFAULT_TRUSTED_OWNERS2 = Object.freeze([
+      "vercel-labs",
+      "anthropics",
+      "obra",
+      "mattpocock",
+      "ComposioHQ"
+    ]);
+    DEFAULT_MIN_INSTALLS = 1e3;
+    MAX_TRUSTED_PER_RUN = 5;
+    POLICY_PATH = ".opencode/ship.skills.policy.json";
+  }
+});
+
+// src/tools/envelope.js
+import { randomBytes as randomBytes2 } from "node:crypto";
+function operationId(prefix = "op") {
+  return `${prefix}-${Date.now().toString(36)}-${randomBytes2(4).toString("hex")}`;
+}
+function success(kind, data, options = {}) {
+  if (typeof kind !== "string" || kind.length === 0) {
+    throw new Error("envelope.success: kind must be a non-empty string");
+  }
+  return {
+    contractVersion: CONTRACT_VERSION,
+    ok: true,
+    kind,
+    operationId: options.operationId ?? operationId(kind),
+    idempotent: options.idempotent !== false,
+    data
+  };
+}
+function failure(kind, message, options = {}) {
+  if (typeof kind !== "string" || kind.length === 0) {
+    throw new Error("envelope.failure: kind must be a non-empty string");
+  }
+  if (typeof message !== "string" || message.length === 0) {
+    throw new Error("envelope.failure: message must be a non-empty string");
+  }
+  const details = options.details ?? {};
+  return {
+    contractVersion: CONTRACT_VERSION,
+    ok: false,
+    kind,
+    operationId: options.operationId ?? operationId(`${kind}-err`),
+    retryable: options.retryable === true,
+    message,
+    details
+  };
+}
+var CONTRACT_VERSION;
+var init_envelope = __esm({
+  "src/tools/envelope.js"() {
+    CONTRACT_VERSION = 2;
+  }
+});
+
+// src/skills/inventory.js
+import { readFile as readFile13, writeFile as writeFile10, mkdir as mkdir8, rename as rename6 } from "node:fs/promises";
+import { existsSync as existsSync20 } from "node:fs";
+import { resolve as resolve20, dirname as dirname12, isAbsolute, posix as posix2 } from "node:path";
+import { createHash as createHash4 } from "node:crypto";
+function inventoryPath(repoRoot) {
+  return resolve20(repoRoot, INVENTORY_PATH);
+}
+async function readInventory(repoRoot) {
+  const path = inventoryPath(repoRoot);
+  if (!existsSync20(path)) {
+    return { schemaVersion: INVENTORY_SCHEMA, events: [] };
+  }
+  let raw;
+  try {
+    raw = await readFile13(path, "utf8");
+  } catch (err) {
+    return { schemaVersion: INVENTORY_SCHEMA, events: [], parseError: `read failed: ${err?.message ?? err}` };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    return { schemaVersion: INVENTORY_SCHEMA, events: [], parseError: `malformed JSON: ${err?.message ?? err}` };
+  }
+  if (!parsed || typeof parsed !== "object") {
+    return { schemaVersion: INVENTORY_SCHEMA, events: [], parseError: "inventory root is not an object" };
+  }
+  if (!Array.isArray(parsed.events)) {
+    return { schemaVersion: INVENTORY_SCHEMA, events: [], parseError: "inventory.events is not an array" };
+  }
+  if (parsed.schemaVersion !== INVENTORY_SCHEMA) {
+    return {
+      schemaVersion: parsed.schemaVersion,
+      events: [],
+      parseError: `unsupported inventory schemaVersion ${parsed.schemaVersion} (expected ${INVENTORY_SCHEMA})`
+    };
+  }
+  return { schemaVersion: INVENTORY_SCHEMA, events: parsed.events };
+}
+async function writeInventory(repoRoot, inventory) {
+  const path = inventoryPath(repoRoot);
+  await mkdir8(dirname12(path), { recursive: true });
+  const tmp = `${path}.${Date.now().toString(36)}.tmp`;
+  await writeFile10(tmp, JSON.stringify({ schemaVersion: INVENTORY_SCHEMA, events: inventory.events }, null, 2) + "\n", "utf8");
+  await rename6(tmp, path);
+  return path;
+}
+function canonicalize2(value) {
+  const seen = /* @__PURE__ */ new WeakSet();
+  const sort = (v) => {
+    if (v === null || typeof v !== "object") return v;
+    if (seen.has(v)) return null;
+    seen.add(v);
+    if (Array.isArray(v)) return v.map(sort);
+    const out = {};
+    for (const k of Object.keys(v).sort()) out[k] = sort(v[k]);
+    return out;
+  };
+  return JSON.stringify(sort(value));
+}
+function hashEvent(event) {
+  return createHash4("sha256").update(canonicalize2(event), "utf8").digest("hex");
+}
+async function appendEvent(repoRoot, eventInput) {
+  const inventory = await readInventory(repoRoot);
+  if (inventory.parseError) {
+    throw new Error(`inventory is unreadable: ${inventory.parseError}`);
+  }
+  const existingChain = await verifyInventory(repoRoot);
+  if (!existingChain.ok) {
+    throw new Error(`inventory chain invalid: ${existingChain.reason}`);
+  }
+  const previousHash = inventory.events.length > 0 ? inventory.events[inventory.events.length - 1].hash : "0".repeat(64);
+  const sequence = inventory.events.length + 1;
+  if (eventInput.destination && isAbsolute(eventInput.destination)) {
+    throw new Error(`inventory refuses absolute destination: ${eventInput.destination}`);
+  }
+  const base = {
+    sequence,
+    type: eventInput.type,
+    previousHash,
+    recordedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const {
+    hash: _hash,
+    sequence: _sequence,
+    previousHash: _previousHash,
+    recordedAt: _recordedAt,
+    payload: legacyPayload,
+    type: _type,
+    ...fields
+  } = eventInput;
+  const payload = { ...legacyPayload ?? {}, ...fields, ...base };
+  const shape = validateEventShape(payload);
+  if (!shape.ok) throw new Error(shape.reason);
+  delete payload.hash;
+  const stamped = { ...payload, hash: hashEvent(payload) };
+  inventory.events.push(stamped);
+  await writeInventory(repoRoot, inventory);
+  return stamped;
+}
+async function verifyInventory(repoRoot) {
+  const inventory = await readInventory(repoRoot);
+  if (inventory.parseError) {
+    return { ok: false, reason: inventory.parseError };
+  }
+  if (inventory.events.length === 0) return { ok: true, count: 0 };
+  let prev = "0".repeat(64);
+  for (const ev of inventory.events) {
+    const shape = validateEventShape(ev);
+    if (!shape.ok) {
+      return { ok: false, reason: shape.reason, sequence: ev.sequence };
+    }
+    if (ev.sequence !== inventory.events.indexOf(ev) + 1) {
+      return { ok: false, reason: "sequence-gap", sequence: ev.sequence };
+    }
+    if (ev.previousHash !== prev) {
+      return { ok: false, reason: "chain-break", sequence: ev.sequence };
+    }
+    const { hash: _h, ...rest } = ev;
+    const recomputed = hashEvent(rest);
+    if (recomputed !== ev.hash) {
+      return { ok: false, reason: "hash-mismatch", sequence: ev.sequence };
+    }
+    prev = ev.hash;
+  }
+  return { ok: true, count: inventory.events.length };
+}
+function validateEventShape(event) {
+  if (event?.type !== "install" && event?.type !== "uninstall") {
+    return { ok: false, reason: `unsupported inventory event type: ${JSON.stringify(event?.type)}` };
+  }
+  if (typeof event.skill !== "string" || !/^[A-Za-z0-9._-]{1,128}$/.test(event.skill)) {
+    return { ok: false, reason: `invalid skill id: ${JSON.stringify(event.skill)}` };
+  }
+  if (!isSafeRelativePosix(event.destination)) {
+    return { ok: false, reason: `unsafe destination: ${JSON.stringify(event.destination)}` };
+  }
+  if (event.type === "install") {
+    if (!Array.isArray(event.files)) return { ok: false, reason: "install event files must be an array" };
+    for (const file of event.files) {
+      if (!file || !isSafeRelativePosix(file.path)) {
+        return { ok: false, reason: `unsafe file path: ${JSON.stringify(file?.path)}` };
+      }
+      if (typeof file.sha256 !== "string" || !/^[0-9a-f]{64}$/.test(file.sha256)) {
+        return { ok: false, reason: `invalid file sha256: ${JSON.stringify(file.sha256)}` };
+      }
+    }
+  }
+  return { ok: true };
+}
+function isSafeRelativePosix(value) {
+  if (typeof value !== "string" || value.length === 0 || value.includes("\\")) return false;
+  if (posix2.isAbsolute(value) || posix2.normalize(value) !== value) return false;
+  return value.split("/").every((part) => part !== "" && part !== "." && part !== "..");
+}
+var INVENTORY_PATH, INVENTORY_SCHEMA;
+var init_inventory = __esm({
+  "src/skills/inventory.js"() {
+    INVENTORY_PATH = ".opencode/ship.skills.lock.json";
+    INVENTORY_SCHEMA = 2;
+  }
+});
+
+// src/skills/worktree.js
+import { execFile } from "node:child_process";
+import { promises as fs, existsSync as existsSync21 } from "node:fs";
+import { resolve as resolve21, dirname as dirname13, sep as sep4, isAbsolute as isAbsolute2, join as join9 } from "node:path";
+function listRegisteredWorktrees(mainRepo) {
+  return new Promise((resolveP, rejectP) => {
+    execFile(
+      "git",
+      ["-C", mainRepo, "worktree", "list", "--porcelain", "-z"],
+      { shell: false, maxBuffer: 1024 * 1024 },
+      (err, stdout) => {
+        if (err) return rejectP(err);
+        const records = parsePorcelain(stdout);
+        const mainRecord = records.shift();
+        const mainPath = mainRecord?.worktree ? resolve21(mainRecord.worktree) : null;
+        const linked = [];
+        for (const r of records) {
+          if (!r.worktree) continue;
+          const p = resolve21(r.worktree);
+          if (mainPath && p === mainPath) continue;
+          linked.push({ path: p, branch: r.HEAD ?? null });
+        }
+        resolveP(linked);
+      }
+    );
+  });
+}
+function parsePorcelain(text) {
+  const tokens = text.split("\0");
+  const out = [];
+  let current = {};
+  for (const tok of tokens) {
+    if (tok.length === 0) {
+      if (Object.keys(current).length > 0) {
+        out.push(current);
+        current = {};
+      }
+      continue;
+    }
+    const idx = tok.indexOf(" ");
+    const key = idx === -1 ? tok : tok.slice(0, idx);
+    const value = idx === -1 ? "" : tok.slice(idx + 1);
+    if (key === "branch") {
+      current.HEAD = value.startsWith("refs/heads/") ? value : `refs/heads/${value}`;
+    } else {
+      current[key] = value;
+    }
+  }
+  if (Object.keys(current).length > 0) out.push(current);
+  return out;
+}
+async function validateLinkedWorktree(mainRepo, worktreePath, options = {}) {
+  const main2 = resolve21(mainRepo);
+  if (!existsSync21(main2)) {
+    return { ok: false, kind: "missing", message: `main repository ${main2} does not exist` };
+  }
+  if (!worktreePath) {
+    return { ok: false, kind: "unlinked", message: "worktreePath is required" };
+  }
+  const wt = resolve21(worktreePath);
+  if (!existsSync21(wt)) {
+    return { ok: false, kind: "missing", message: `worktree ${wt} does not exist` };
+  }
+  const isCurrent = wt === main2;
+  if (isCurrent) {
+    const gitEntry = options.allowCurrentLinked ? await fs.lstat(join9(main2, ".git")).catch(() => null) : null;
+    if (!gitEntry?.isFile()) {
+      return { ok: false, kind: "main", message: "installs into the main worktree are forbidden" };
+    }
+  }
+  let cursor = wt;
+  while (cursor !== dirname13(cursor)) {
+    const stat5 = await fs.lstat(cursor).catch(() => null);
+    if (stat5?.isSymbolicLink()) {
+      return {
+        ok: false,
+        kind: "ancestor-symlink",
+        message: `worktree path contains a symlink at ${cursor}`
+      };
+    }
+    cursor = dirname13(cursor);
+  }
+  const real = await fs.realpath(wt).catch(() => null);
+  if (real && real !== wt) {
+    return {
+      ok: false,
+      kind: "symlink",
+      message: `worktree ${wt} resolves through a symlink to ${real}`
+    };
+  }
+  const linked = await listRegisteredWorktrees(main2);
+  const matched = linked.find((entry) => entry.path === wt);
+  if (!matched) {
+    return {
+      ok: false,
+      kind: "unlinked",
+      message: `worktree ${wt} is not registered (git worktree list)`
+    };
+  }
+  return { ok: true, path: wt, registered: !!matched };
+}
+function isProjectSkillDest(destRel) {
+  return PROJECT_SKILL_DEST_RE.test(String(destRel ?? ""));
+}
+function validateRelativeInstallPath(destRel) {
+  if (typeof destRel !== "string" || destRel.length === 0) {
+    return { ok: false, kind: "absolute", message: "destination path required" };
+  }
+  if (isAbsolute2(destRel)) {
+    return { ok: false, kind: "absolute", message: `destination must be relative: ${destRel}` };
+  }
+  if (destRel.includes("\\")) {
+    return { ok: false, kind: "parent-relative", message: `destination must use POSIX separators: ${destRel}` };
+  }
+  const parts = destRel.split("/");
+  for (const p of parts) {
+    if (p === "" || p === "." || p === "..") {
+      return { ok: false, kind: "parent-relative", message: `destination escapes worktree: ${destRel}` };
+    }
+  }
+  return { ok: true };
+}
+async function validateInstallDestination(worktreeRoot, destRel) {
+  const relativeCheck = validateRelativeInstallPath(destRel);
+  if (!relativeCheck.ok) return relativeCheck;
+  const root = resolve21(worktreeRoot);
+  const destination = resolve21(root, ...destRel.split("/"));
+  if (destination !== root && !destination.startsWith(root + sep4)) {
+    return { ok: false, kind: "escape", message: `destination escapes worktree: ${destRel}` };
+  }
+  let cursor = root;
+  for (const part of destRel.split("/")) {
+    cursor = join9(cursor, part);
+    const entry = await fs.lstat(cursor).catch(() => null);
+    if (!entry) continue;
+    if (entry.isSymbolicLink()) {
+      return { ok: false, kind: "symlink", message: `destination path contains a symlink at ${cursor}` };
+    }
+    if (cursor !== destination && !entry.isDirectory()) {
+      return { ok: false, kind: "not-directory", message: `destination ancestor is not a directory: ${cursor}` };
+    }
+  }
+  return { ok: true, path: destination };
+}
+var PROJECT_SKILL_DEST_RE;
+var init_worktree = __esm({
+  "src/skills/worktree.js"() {
+    PROJECT_SKILL_DEST_RE = /^\.opencode\/skills\/[A-Za-z0-9._-]{1,128}$/;
+  }
+});
+
+// src/tools/ship-skill-install.js
+var ship_skill_install_exports = {};
+__export(ship_skill_install_exports, {
+  createSkillInstallTool: () => createSkillInstallTool,
+  findStagedSkillDir: () => findStagedSkillDir
+});
+import { readFile as readFile14, writeFile as writeFile11, mkdir as mkdir9, rm, rename as rename7, stat as stat4 } from "node:fs/promises";
+import { existsSync as existsSync22 } from "node:fs";
+import { resolve as resolve22, join as join10, dirname as dirname14, sep as sep5, isAbsolute as isAbsolute3 } from "node:path";
+import { createHash as createHash5 } from "node:crypto";
+import { execFile as execFile2 } from "node:child_process";
+import { mkdtemp } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { randomBytes as randomBytes3 } from "node:crypto";
+function createSkillInstallTool(deps) {
+  return async function skillInstall(input) {
+    const opId = input.operationId ?? `skill-install-${Date.now().toString(36)}`;
+    const packageSpec = String(input.package ?? "");
+    const worktreePath = input.worktreePath == null ? "" : String(input.worktreePath);
+    const skillName = String(input.skillName ?? "");
+    const version = String(input.version ?? "");
+    if (!packageSpec || !SAFE_NAME_RE.test(packageSpec)) {
+      return failure("skill-install", "package required (safe npm spec)", { operationId: opId, retryable: false });
+    }
+    if (!skillName || !SAFE_ID_RE.test(skillName)) {
+      return failure("skill-install", "skillName required (safe id)", { operationId: opId, retryable: false });
+    }
+    if (version && !SAFE_VERSION_RE.test(version)) {
+      return failure("skill-install", "version must match a safe semver spec", { operationId: opId, retryable: false });
+    }
+    const destRel = `.opencode/skills/${skillName}`;
+    if (!isProjectSkillDest(destRel)) {
+      return failure("skill-install", `destination rejected: ${destRel}`, { operationId: opId, retryable: false });
+    }
+    const policy = await readPolicy(deps.repoRoot);
+    const ownerCandidate = {
+      package: packageSpec,
+      skill: skillName,
+      installs: Number.MAX_SAFE_INTEGER
+    };
+    const ownerDecision = isAutoInstallable(ownerCandidate, policy);
+    if (!ownerDecision.ok) {
+      return failure("skill-install", `policy forbids install: ${ownerDecision.reason}`, { operationId: opId, retryable: false });
+    }
+    const requested = worktreePath ? resolve22(worktreePath) : resolve22(deps.repoRoot);
+    const main2 = resolve22(deps.repoRoot);
+    let installRoot;
+    if (requested === main2) {
+      installRoot = main2;
+    } else {
+      const wtCheck = await validateLinkedWorktree(deps.repoRoot, worktreePath);
+      if (!wtCheck.ok) {
+        return failure("skill-install", `worktree rejected: ${wtCheck.message}`, { operationId: opId, retryable: false });
+      }
+      installRoot = wtCheck.path;
+    }
+    const pathCheck = validateRelativeInstallPath(destRel);
+    if (!pathCheck.ok) {
+      return failure("skill-install", `destination rejected: ${pathCheck.message}`, { operationId: opId, retryable: false });
+    }
+    const destinationCheck = await validateInstallDestination(installRoot, destRel);
+    if (!destinationCheck.ok) {
+      return failure("skill-install", `destination rejected: ${destinationCheck.message}`, { operationId: opId, retryable: false });
+    }
+    const destAbs = destinationCheck.path;
+    if (existsSync22(destAbs)) {
+      return failure("skill-install", "destination already exists; use ship_skill_audit to detect drift", { operationId: opId, retryable: false });
+    }
+    const managedCatalog = (deps.config?.value?.skills ?? []).map((s) => s?.name).filter(Boolean);
+    if (managedCatalog.includes(skillName)) {
+      return failure("skill-install", "candidate shadows a managed skill", { operationId: opId, retryable: false });
+    }
+    const discover = deps.discoverSkills ?? listSkills;
+    const discovery = await discover({ repoRoot: deps.repoRoot, query: packageSpec });
+    if (!discovery?.ok) {
+      return failure("skill-install", "registry metadata unavailable; refusing unverified install", { operationId: opId, retryable: true });
+    }
+    const candidate = discovery.candidates?.find((entry) => entry.package === packageSpec && entry.skill === skillName);
+    if (!candidate) {
+      return failure("skill-install", "exact skill package was not found in registry metadata", { operationId: opId, retryable: false });
+    }
+    const decision = isAutoInstallable(candidate, policy);
+    if (!decision.ok) {
+      return failure("skill-install", `policy forbids install: ${decision.reason}`, { operationId: opId, retryable: false });
+    }
+    const stage = await mkdtemp(join10(tmpdir(), `ship-skill-stage-${randomBytes3(4).toString("hex")}-`));
+    let installedFiles;
+    try {
+      const materialise = deps.materialiseFromSkillsCli ?? materialiseFromSkillsCli;
+      installedFiles = await materialise({
+        packageSpec,
+        skillName,
+        version,
+        stageDir: stage
+      });
+      if (!installedFiles.ok) {
+        return failure("skill-install", installedFiles.message, { operationId: opId, retryable: installedFiles.retryable ?? false });
+      }
+      const fileRecords = await hashDir(installedFiles.stagedDir);
+      if (fileRecords.length === 0) {
+        return failure("skill-install", "skills CLI produced an empty staging directory", { operationId: opId, retryable: false });
+      }
+      await mkdir9(dirname14(destAbs), { recursive: true });
+      const destTmp = `${destAbs}.${randomBytes3(4).toString("hex")}.tmp`;
+      await copyDir(installedFiles.stagedDir, destTmp);
+      const finalDestinationCheck = await validateInstallDestination(installRoot, destRel);
+      if (!finalDestinationCheck.ok) {
+        await rm(destTmp, { recursive: true, force: true });
+        return failure("skill-install", `destination rejected: ${finalDestinationCheck.message}`, { operationId: opId, retryable: false });
+      }
+      await rename7(destTmp, destAbs);
+      const onDisk = await hashDir(destAbs);
+      if (!hashesEqual(fileRecords, onDisk)) {
+        await rm(destAbs, { recursive: true, force: true });
+        return failure("skill-install", "drift detected after copy; rolled back", { operationId: opId, retryable: false });
+      }
+      const recorded = await appendEvent(installRoot, {
+        type: "install",
+        skill: skillName,
+        package: packageSpec,
+        version: version || null,
+        source: installedFiles.source,
+        destination: destRel,
+        files: fileRecords
+      });
+      return success("skill-install", {
+        skill: skillName,
+        package: packageSpec,
+        version: version || null,
+        destination: destRel,
+        worktree: installRoot,
+        source: installedFiles.source,
+        files: fileRecords,
+        sequence: recorded.sequence
+      }, { operationId: opId });
+    } catch (err) {
+      if (existsSync22(destAbs)) {
+        await rm(destAbs, { recursive: true, force: true }).catch(() => null);
+      }
+      return failure("skill-install", String(err?.message ?? err), { operationId: opId, retryable: true });
+    } finally {
+      await rm(stage, { recursive: true, force: true }).catch(() => null);
+    }
+  };
+}
+function findStagedSkillDir(stageDir, skillName) {
+  const candidates = [
+    join10(stageDir, ".opencode", "skills", skillName),
+    join10(stageDir, ".agents", "skills", skillName),
+    join10(stageDir, "skills", skillName)
+  ];
+  return candidates.find((path) => existsSync22(path)) ?? null;
+}
+async function materialiseFromSkillsCli({ packageSpec, skillName, version, stageDir }) {
+  const cliPkg = `skills@${SKILLS_CLI_VERSION}`;
+  const resolvedPackageSpec = version ? `${packageSpec}@${version}` : packageSpec;
+  const args = [
+    "exec",
+    "--yes",
+    `--package=${cliPkg}`,
+    "--",
+    "skills",
+    "add",
+    resolvedPackageSpec,
+    "--skill",
+    skillName,
+    "--agent",
+    "opencode",
+    "--copy",
+    "-y"
+  ];
+  const result = await new Promise((resolveP, rejectP) => {
+    execFile2(
+      "npm",
+      args,
+      { cwd: stageDir, shell: false, maxBuffer: 1024 * 1024, timeout: SKILLS_INSTALL_TIMEOUT_MS },
+      (err, stdout, stderr) => {
+        if (err) {
+          const code = typeof err?.code === "number" ? err.code : -1;
+          return resolveP({
+            ok: false,
+            retryable: code === -2 || code === 124,
+            message: `skills CLI failed (code ${code}): ${(stderr || stdout || "").toString().trim().split("\n").slice(-5).join(" | ")}`
+          });
+        }
+        resolveP({ ok: true, stdout: stdout?.toString?.() ?? "", stderr: stderr?.toString?.() ?? "" });
+      }
+    );
+  });
+  if (!result.ok) return result;
+  const stagedDir = findStagedSkillDir(stageDir, skillName);
+  if (!stagedDir) {
+    return {
+      ok: false,
+      retryable: false,
+      message: `skills CLI did not produce any of: ${[".opencode/skills", ".agents/skills", "skills"].map((p) => join10(stageDir, p, skillName)).join(", ")}`
+    };
+  }
+  const skillMd = join10(stagedDir, "SKILL.md");
+  if (!existsSync22(skillMd)) {
+    return {
+      ok: false,
+      retryable: false,
+      message: "skills CLI did not produce a SKILL.md"
+    };
+  }
+  return {
+    ok: true,
+    stagedDir,
+    source: {
+      packageSpec: resolvedPackageSpec,
+      skillName,
+      cliPackage: cliPkg,
+      registryId: `${resolvedPackageSpec}/${skillName}`,
+      // The CLI does not currently expose a registry snapshot
+      // hash; we record the staged directory's hash instead so
+      // the audit tool can prove the staged bytes equal the
+      // installed bytes.
+      registrySnapshotHash: hashBytes(Buffer.from(result.stdout + "\n" + result.stderr, "utf8"))
+    }
+  };
+}
+async function hashDir(rootDir) {
+  const out = [];
+  await walk(rootDir, rootDir, out);
+  return out;
+}
+async function walk(rootDir, currentDir, out) {
+  const { readdir: readdir2 } = await import("node:fs/promises");
+  const entries = await readdir2(currentDir, { withFileTypes: true });
+  for (const e of entries) {
+    const abs = join10(currentDir, e.name);
+    if (e.isDirectory()) {
+      if (e.name === ".git") continue;
+      await walk(rootDir, abs, out);
+      continue;
+    }
+    if (!e.isFile()) continue;
+    const raw = await readFile14(abs);
+    const fileStat = await stat4(abs);
+    out.push({
+      path: abs.slice(rootDir.length + 1).split(sep5).join("/"),
+      sha256: createHash5("sha256").update(raw).digest("hex"),
+      mode: fileStat.mode & 511,
+      size: fileStat.size
+    });
+  }
+}
+function hashBytes(bytes) {
+  return createHash5("sha256").update(bytes).digest("hex");
+}
+function hashesEqual(a, b) {
+  if (a.length !== b.length) return false;
+  const map = new Map(a.map((f) => [f.path, f.sha256]));
+  for (const f of b) {
+    if (map.get(f.path) !== f.sha256) return false;
+  }
+  return true;
+}
+async function copyDir(srcDir, destDir) {
+  await mkdir9(destDir, { recursive: true });
+  const { readdir: readdir2 } = await import("node:fs/promises");
+  const entries = await readdir2(srcDir, { withFileTypes: true });
+  for (const e of entries) {
+    const src = join10(srcDir, e.name);
+    const dest = join10(destDir, e.name);
+    if (e.isDirectory()) {
+      if (e.name === ".git") continue;
+      await copyDir(src, dest);
+    } else if (e.isFile()) {
+      const raw = await readFile14(src);
+      await writeFile11(dest, raw, { mode: 420 });
+    }
+  }
+}
+var SAFE_ID_RE, SAFE_NAME_RE, SAFE_VERSION_RE, SKILLS_CLI_VERSION;
+var init_ship_skill_install = __esm({
+  "src/tools/ship-skill-install.js"() {
+    init_envelope();
+    init_policy();
+    init_inventory();
+    init_worktree();
+    init_registry();
+    SAFE_ID_RE = /^[A-Za-z0-9._-]{1,128}$/;
+    SAFE_NAME_RE = /^[A-Za-z0-9._/-]{1,160}$/;
+    SAFE_VERSION_RE = /^[A-Za-z0-9._+-]{1,64}$/;
+    SKILLS_CLI_VERSION = "1.0.4";
+  }
+});
+
 // src/installer/cli-args.js
 init_profile();
 var USAGE = `opencode-ship <command> [options]
@@ -1725,24 +2749,25 @@ function helpText() {
 
 // src/installer/commands/init.js
 import { promisify as promisify2 } from "node:util";
-import { writeFile as writeFile8, mkdir as mkdirAsync2 } from "node:fs/promises";
-import { dirname as dirname10, resolve as resolvePath } from "node:path";
+import { writeFile as writeFile12, mkdir as mkdirAsync2 } from "node:fs/promises";
+import { dirname as dirname15, resolve as resolvePath } from "node:path";
 
 // src/installer/executor.js
 init_catalog();
 init_version();
-import { existsSync as existsSync13 } from "node:fs";
+import { existsSync as existsSync14 } from "node:fs";
 import { mkdir as mkdir6, readFile as readFile9, rename as rename5, unlink as unlink3, writeFile as writeFile6 } from "node:fs/promises";
-import { dirname as dirname8, relative as relative2, resolve as resolve12, sep as sep2 } from "node:path";
+import { dirname as dirname8, relative as relative2, resolve as resolve13, sep as sep2 } from "node:path";
 
 // src/installer/planner.js
 init_catalog();
 init_hash();
 init_config();
 init_lock();
+init_workflow_models();
 init_json_pointer();
 init_root_config();
-import { existsSync as existsSync8 } from "node:fs";
+import { existsSync as existsSync9 } from "node:fs";
 import { readFile as readFile4, stat } from "node:fs/promises";
 
 // src/installer/root-reconciliation.js
@@ -1750,7 +2775,7 @@ init_root_config();
 init_json_pointer();
 init_hash();
 init_plan_mode_permissions();
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 import { join } from "node:path";
 
 // src/installer/root-permissions.js
@@ -1760,15 +2785,30 @@ var ASK = "ask";
 var ALLOW = "allow";
 var DENY = "deny";
 var SUBAGENT_DEPTH = 2;
+function withShipAliases(ids) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const id of ids) {
+    const extras = id.startsWith("delivery_") ? [`ship_${id.slice("delivery_".length)}`] : [];
+    for (const candidate of [id, ...extras]) {
+      if (seen.has(candidate)) continue;
+      seen.add(candidate);
+      out.push(candidate);
+    }
+  }
+  return out;
+}
 var CONTROLLER_TASK_ALLOW = [
   "ship-planner",
   "ship-task-builder",
   "ship-task-reviewer",
   "ship-final-standards-reviewer",
   "ship-final-spec-reviewer",
+  "ship-verifier",
   "delivery-verifier"
 ];
-var PUBLIC_TOOL_IDS = [
+var PUBLIC_TOOL_IDS = withShipAliases([
+  "delivery_abandon",
   "delivery_cleanup",
   "delivery_github_read",
   "delivery_inspect",
@@ -1785,6 +2825,7 @@ var PUBLIC_TOOL_IDS = [
   "delivery_sync",
   "delivery_verify",
   "delivery_worktree",
+  "ship_deliver",
   "ship_final_review",
   "ship_plan_approve",
   "ship_plan_start",
@@ -1801,24 +2842,26 @@ var PUBLIC_TOOL_IDS = [
   "ship_task_report",
   "ship_task_review",
   "ship_task_start"
-];
-var BUILD_TOOL_ALLOW = [
+]);
+var BUILD_TOOL_ALLOW = withShipAliases([
   "delivery_cleanup",
   "delivery_inspect",
   "delivery_issue",
   "delivery_pr",
   "delivery_ready",
   "delivery_worktree",
+  "ship_deliver",
   "ship_status",
   "ship_resume"
-];
-var BUILD_TOOL_ASK = [
+]);
+var BUILD_TOOL_ASK = withShipAliases([
   "ship_plan_approve",
   "delivery_merge",
   "delivery_issue_close",
+  "delivery_abandon",
   "ship_skill_install"
-];
-var CONTROLLER_TOOL_ALLOW = [
+]);
+var CONTROLLER_TOOL_ALLOW = withShipAliases([
   "delivery_inspect",
   "delivery_cleanup",
   "delivery_github_read",
@@ -1842,12 +2885,13 @@ var CONTROLLER_TOOL_ALLOW = [
   "ship_skill_install",
   "ship_skill_audit",
   "ship_skill_uninstall"
-];
-var CONTROLLER_TOOL_ASK = [
+]);
+var CONTROLLER_TOOL_ASK = withShipAliases([
   "ship_plan_approve",
   "delivery_merge",
-  "delivery_issue_close"
-];
+  "delivery_issue_close",
+  "delivery_abandon"
+]);
 var H = "git";
 var RESET = "--hard";
 var PUSH = "--force";
@@ -1891,6 +2935,8 @@ function rootPermissionMatrix() {
           "ship-controller": "allow",
           "general": "allow",
           "plan": "deny",
+          "ship-reviewer": "allow",
+          "ship-verifier": "allow",
           "delivery-reviewer": "allow",
           "delivery-verifier": "allow"
         },
@@ -2736,11 +3782,11 @@ function parseTree(text, errors = [], options = ParseOptions.DEFAULT) {
       onValue({ type: getNodeType(value), offset, length, parent: currentParent, value });
       ensurePropertyComplete(offset + length);
     },
-    onSeparator: (sep3, offset, length) => {
+    onSeparator: (sep6, offset, length) => {
       if (currentParent.type === "property") {
-        if (sep3 === ":") {
+        if (sep6 === ":") {
           currentParent.colonOffset = offset;
-        } else if (sep3 === ",") {
+        } else if (sep6 === ",") {
           ensurePropertyComplete(offset);
         }
       }
@@ -3453,7 +4499,7 @@ async function planRootReconciliation(input) {
       previousDocument: input.previousDocument
     });
   }
-  const fileMissing = !existsSync7(target);
+  const fileMissing = !existsSync8(target);
   if (fileMissing && !input.forceRepair) {
     if (mode === "profile-transition") {
       return {
@@ -4100,13 +5146,13 @@ function mergePointerRecords(descriptors, previousRecords, result, beforeSnapsho
 
 // src/installer/planner.js
 async function readBytes(path) {
-  if (!existsSync8(path)) return null;
+  if (!existsSync9(path)) return null;
   const buf = await readFile4(path);
   const fileStat = await stat(path);
   return { bytes: buf, hash: bytesHashString(buf.toString("utf8")), mode: fileStat.mode & 511 };
 }
 async function readDesiredBytes(source) {
-  if (!source || !existsSync8(source)) return null;
+  if (!source || !existsSync9(source)) return null;
   const buf = await readFile4(source);
   return { bytes: buf, hash: bytesHashString(buf.toString("utf8")) };
 }
@@ -4309,7 +5355,15 @@ async function planUninstall({ repoRoot, lock }) {
 async function planConfigSynthesis({ repoRoot, detection, lock, forceOverwrite, migrationSeed = null, models = null }) {
   const existing = await loadConfig(repoRoot);
   const hasModelFlags = Boolean(models && (models.planner || models.builder || models.finalReviewer));
-  if (existing?.ok && !forceOverwrite && !hasModelFlags) {
+  const { current, history } = loadWorkflowModelDefaults();
+  const resolved = resolveWorkflowModels({
+    configModels: existing?.ok ? existing.value.workflow?.models ?? {} : {},
+    lockModels: lock?.manager?.models ?? null,
+    cliModels: models,
+    current,
+    history
+  });
+  if (existing?.ok && !forceOverwrite && resolved.changedRoles.length === 0) {
     return {
       kind: "noop",
       op: "config",
@@ -4318,35 +5372,34 @@ async function planConfigSynthesis({ repoRoot, detection, lock, forceOverwrite,
       currentSha: existing.sha256,
       desiredSha: existing.sha256,
       configValue: existing.value,
+      modelsProvenance: resolved.provenance,
       reason: "user config already present"
     };
   }
   let desiredValue = migrationSeed ?? (existing?.ok ? structuredClone(existing.value) : renderDefaultConfig(detection));
-  if (hasModelFlags) {
-    desiredValue = {
-      ...desiredValue,
-      schemaVersion: 2,
-      profile: "engineering",
-      workflow: {
-        ...desiredValue.workflow ?? {},
-        models: {
-          planner: models.planner ?? desiredValue?.workflow?.models?.planner,
-          builder: models.builder ?? desiredValue?.workflow?.models?.builder,
-          finalReviewer: models.finalReviewer ?? desiredValue?.workflow?.models?.finalReviewer
-        },
-        approval: {
-          mirrorToIssue: true,
-          maxFailedRounds: 3,
-          ...desiredValue?.workflow?.approval ?? {}
-        }
-      }
-    };
-  }
   if (desiredValue.profile === "core") desiredValue.profile = "engineering";
+  desiredValue.workflow = {
+    ...desiredValue.workflow ?? {},
+    models: resolved.models,
+    approval: {
+      mirrorToIssue: true,
+      maxFailedRounds: 3,
+      ...desiredValue.workflow?.approval ?? {}
+    }
+  };
   const desiredJson = JSON.stringify(desiredValue, null, 2) + "\n";
   const desiredSha = bytesHashString(desiredJson);
-  const kind = existing?.ok && (forceOverwrite || hasModelFlags) ? "update" : "create";
-  const reason = existing?.ok ? hasModelFlags && !forceOverwrite ? "patching workflow.models from CLI model flags" : "user config overwritten via --force-config" : migrationSeed ? "synthesising a default config from legacy adapter migration" : "synthesising a default config from detection";
+  const kind = existing?.ok ? "update" : "create";
+  let reason;
+  if (!existing?.ok) {
+    reason = migrationSeed ? "synthesising a default config from legacy adapter migration" : "synthesising a default config from detection";
+  } else if (forceOverwrite) {
+    reason = "user config overwritten via --force-config";
+  } else if (hasModelFlags) {
+    reason = "patching workflow.models from CLI model flags";
+  } else {
+    reason = "applying packaged workflow model defaults";
+  }
   return {
     kind,
     op: "config",
@@ -4356,6 +5409,7 @@ async function planConfigSynthesis({ repoRoot, detection, lock, forceOverwrite,
     desiredSha,
     bytes: Buffer.from(desiredJson, "utf8"),
     configValue: desiredValue,
+    modelsProvenance: resolved.provenance,
     reason
   };
 }
@@ -4382,8 +5436,8 @@ init_json_pointer();
 
 // src/installer/detection/project.js
 import { spawnSync } from "node:child_process";
-import { existsSync as existsSync9, readFileSync as readFileSync4 } from "node:fs";
-import { resolve as resolve7, join as join2 } from "node:path";
+import { existsSync as existsSync10, readFileSync as readFileSync5 } from "node:fs";
+import { resolve as resolve8, join as join2 } from "node:path";
 function runGit(cwd, args) {
   const r = spawnSync("git", ["-C", cwd, ...args], {
     stdio: ["ignore", "pipe", "pipe"],
@@ -4392,17 +5446,17 @@ function runGit(cwd, args) {
   return { status: r.status ?? -1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
 }
 function detectPackageManager(repoRoot) {
-  if (existsSync9(join2(repoRoot, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync9(join2(repoRoot, "yarn.lock"))) return "yarn";
-  if (existsSync9(join2(repoRoot, "bun.lockb"))) return "bun";
-  if (existsSync9(join2(repoRoot, "package-lock.json"))) return "npm";
+  if (existsSync10(join2(repoRoot, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync10(join2(repoRoot, "yarn.lock"))) return "yarn";
+  if (existsSync10(join2(repoRoot, "bun.lockb"))) return "bun";
+  if (existsSync10(join2(repoRoot, "package-lock.json"))) return "npm";
   return null;
 }
 function readPackageJson(repoRoot) {
   const path = join2(repoRoot, "package.json");
-  if (!existsSync9(path)) return null;
+  if (!existsSync10(path)) return null;
   try {
-    return JSON.parse(readFileSync4(path, "utf8"));
+    return JSON.parse(readFileSync5(path, "utf8"));
   } catch {
     return null;
   }
@@ -4477,7 +5531,7 @@ function detectOwner(repoRoot) {
 }
 function detectProject(repoRoot = process.cwd()) {
   const errors = [];
-  const cwd = resolve7(repoRoot);
+  const cwd = resolve8(repoRoot);
   const inside = runGit(cwd, ["rev-parse", "--show-toplevel"]);
   if (inside.status !== 0) {
     errors.push({ kind: "not-a-git-repo", path: cwd, detail: inside.stderr.trim() });
@@ -4539,12 +5593,12 @@ import {
   stat as stat3,
   open
 } from "node:fs/promises";
-import { existsSync as existsSync11 } from "node:fs";
-import { dirname as dirname6, resolve as resolve10, join as join5 } from "node:path";
+import { existsSync as existsSync12 } from "node:fs";
+import { dirname as dirname6, resolve as resolve11, join as join5 } from "node:path";
 
 // src/state/git-common-dir.js
 import { spawn } from "node:child_process";
-import { resolve as resolve8, join as join3 } from "node:path";
+import { resolve as resolve9, join as join3 } from "node:path";
 var STATE_DIRNAME = "opencode-ship";
 async function resolveGitCommonDir(repoRoot) {
   if (typeof repoRoot !== "string" || repoRoot.length === 0) {
@@ -4577,7 +5631,7 @@ async function resolveGitCommonDir(repoRoot) {
         reject(new Error("git rev-parse --git-common-dir returned an empty path"));
         return;
       }
-      resolveP(resolve8(repoRoot, trimmed));
+      resolveP(resolve9(repoRoot, trimmed));
     });
   });
 }
@@ -4600,8 +5654,8 @@ import {
   unlink,
   stat as stat2
 } from "node:fs/promises";
-import { existsSync as existsSync10 } from "node:fs";
-import { dirname as dirname5, join as join4, resolve as resolve9 } from "node:path";
+import { existsSync as existsSync11 } from "node:fs";
+import { dirname as dirname5, join as join4, resolve as resolve10 } from "node:path";
 import { createHash as createHash2, randomBytes } from "node:crypto";
 import { hostname as osHostname } from "node:os";
 var STALE_LOCK_MS = 120 * 1e3;
@@ -4626,7 +5680,7 @@ async function atomicReplaceJson(path, value) {
   if (typeof path !== "string" || path.length === 0) {
     throw new Error("atomicReplaceJson: path must be a non-empty string");
   }
-  const target = resolve9(path);
+  const target = resolve10(path);
   const parent = dirname5(target);
   await mkdir3(parent, { recursive: true });
   const tmp = `${target}.${randomToken()}.tmp`;
@@ -4650,10 +5704,10 @@ async function lockDirForRepo(repoRoot) {
   return lockDirFromCommonDir(commonDir);
 }
 function transactionLockPath(lockDir) {
-  return resolve10(lockDir, ".txn.lock");
+  return resolve11(lockDir, ".txn.lock");
 }
 function journalPath(lockDir, txnId) {
-  return resolve10(lockDir, `.txn-${txnId}.journal`);
+  return resolve11(lockDir, `.txn-${txnId}.journal`);
 }
 function backupPath(target, token) {
   return `${target}.txn-${token}-backup`;
@@ -4688,7 +5742,7 @@ async function releaseLock(lockDir) {
 }
 async function liveLockOwner(lockDir) {
   const path = transactionLockPath(lockDir);
-  if (!existsSync11(path)) return false;
+  if (!existsSync12(path)) return false;
   try {
     const lock = JSON.parse(await readFile6(path, "utf8"));
     if (!Number.isInteger(lock?.pid) || lock.pid <= 0) return false;
@@ -4734,7 +5788,7 @@ async function clearJournal(lockDir, txnId) {
   }
 }
 async function readJournal(lockDir, name) {
-  const path = resolve10(lockDir, name);
+  const path = resolve11(lockDir, name);
   let raw;
   try {
     raw = await readFile6(path, "utf8");
@@ -4755,7 +5809,7 @@ async function readJournal(lockDir, name) {
 async function isCommitted(journal) {
   if (journal.committed) return true;
   const marker = journal.ledger?.find((entry) => entry.commitMarker);
-  if (!marker?.target || !marker.installedSha256 || !existsSync11(marker.target)) return false;
+  if (!marker?.target || !marker.installedSha256 || !existsSync12(marker.target)) return false;
   try {
     return bytesHashString(await readFile6(marker.target, "utf8")) === marker.installedSha256;
   } catch {
@@ -4764,13 +5818,13 @@ async function isCommitted(journal) {
 }
 async function restoreEntry(entry) {
   if (entry.op === "write") {
-    if (entry.backup && existsSync11(entry.backup)) {
+    if (entry.backup && existsSync12(entry.backup)) {
       await rename4(entry.backup, entry.target);
-    } else if (entry.hadOriginal === false && existsSync11(entry.target)) {
+    } else if (entry.hadOriginal === false && existsSync12(entry.target)) {
       await unlink2(entry.target);
     }
-    if (entry.staged && existsSync11(entry.staged)) await unlink2(entry.staged);
-  } else if (entry.op === "delete" && entry.backup && existsSync11(entry.backup)) {
+    if (entry.staged && existsSync12(entry.staged)) await unlink2(entry.staged);
+  } else if (entry.op === "delete" && entry.backup && existsSync12(entry.backup)) {
     await rename4(entry.backup, entry.target);
   }
   await fsyncDir2(dirname6(entry.target));
@@ -4793,11 +5847,11 @@ async function recoverJournal(lockDir, name) {
       complete = false;
     }
   }
-  if (complete) await unlink2(resolve10(lockDir, name)).catch(() => null);
+  if (complete) await unlink2(resolve11(lockDir, name)).catch(() => null);
   return { ok: complete };
 }
 async function recover(repoRoot, lockDir) {
-  if (!existsSync11(lockDir)) return { recovered: false, recoveredCount: 0 };
+  if (!existsSync12(lockDir)) return { recovered: false, recoveredCount: 0 };
   if (await liveLockOwner(lockDir)) {
     return { recovered: false, recoveredCount: 0, blocked: true };
   }
@@ -4831,11 +5885,11 @@ async function recover(repoRoot, lockDir) {
 }
 async function commitEntry(entry) {
   let changed = false;
-  if (entry.backup && existsSync11(entry.backup)) {
+  if (entry.backup && existsSync12(entry.backup)) {
     await unlink2(entry.backup);
     changed = true;
   }
-  if (entry.staged && existsSync11(entry.staged)) {
+  if (entry.staged && existsSync12(entry.staged)) {
     await unlink2(entry.staged);
     changed = true;
   }
@@ -4865,7 +5919,7 @@ async function executePlan({ repoRoot, plan, newLockBuilder }) {
       const backup = backupPath(op.target, token);
       const staged = stagedPath(op.target, token);
       if (op.kind === "delete") {
-        if (!existsSync11(op.target)) continue;
+        if (!existsSync12(op.target)) continue;
         journal.entries.push({
           op: "delete",
           target: op.target,
@@ -4878,7 +5932,7 @@ async function executePlan({ repoRoot, plan, newLockBuilder }) {
         await rename4(op.target, backup);
       } else {
         await mkdirp(dirname6(op.target));
-        const hadOriginal = existsSync11(op.target);
+        const hadOriginal = existsSync12(op.target);
         journal.entries.push({
           op: "write",
           target: op.target,
@@ -4904,7 +5958,7 @@ async function executePlan({ repoRoot, plan, newLockBuilder }) {
       const token = randomToken2();
       const backup = backupPath(lockPathTarget, token);
       const staged = stagedPath(lockPathTarget, token);
-      const hadOriginal = existsSync11(lockPathTarget);
+      const hadOriginal = existsSync12(lockPathTarget);
       const finalLock = { ...lockValue, integrity: computeIntegrity(lockValue) };
       const lockBytes = JSON.stringify(finalLock, null, 2) + "\n";
       journal.entries.push({
@@ -4968,16 +6022,16 @@ async function rollback(lockDir, journal) {
 init_lock();
 init_config();
 import { readFile as readFile7 } from "node:fs/promises";
-import { existsSync as existsSync12 } from "node:fs";
-import { resolve as resolve11 } from "node:path";
+import { existsSync as existsSync13 } from "node:fs";
+import { resolve as resolve12 } from "node:path";
 function legacyAdapterPath(repoRoot) {
-  return resolve11(repoRoot, ".opencode", "delivery.json");
+  return resolve12(repoRoot, ".opencode", "delivery.json");
 }
 function legacyLockPath(repoRoot) {
-  return resolve11(repoRoot, ".opencode", "delivery.lock.json");
+  return resolve12(repoRoot, ".opencode", "delivery.lock.json");
 }
 function legacyPluginPath(repoRoot) {
-  return resolve11(repoRoot, ".opencode", "plugin", "delivery.ts");
+  return resolve12(repoRoot, ".opencode", "plugin", "delivery.ts");
 }
 async function detectLegacyShapes(repoRoot) {
   const out = {
@@ -4988,17 +6042,17 @@ async function detectLegacyShapes(repoRoot) {
     reviewer: false,
     verifier: false
   };
-  if (existsSync12(legacyAdapterPath(repoRoot))) out.adapter = true;
-  if (existsSync12(legacyLockPath(repoRoot))) out.legacyLock = true;
-  if (existsSync12(legacyPluginPath(repoRoot))) out.plugin = true;
-  if (existsSync12(resolve11(repoRoot, ".opencode/plugin/opencode-ship.js"))) out.pluginOld = true;
-  if (existsSync12(resolve11(repoRoot, ".opencode/agents/delivery-reviewer.md"))) out.reviewer = true;
-  if (existsSync12(resolve11(repoRoot, ".opencode/agents/delivery-verifier.md"))) out.verifier = true;
+  if (existsSync13(legacyAdapterPath(repoRoot))) out.adapter = true;
+  if (existsSync13(legacyLockPath(repoRoot))) out.legacyLock = true;
+  if (existsSync13(legacyPluginPath(repoRoot))) out.plugin = true;
+  if (existsSync13(resolve12(repoRoot, ".opencode/plugin/opencode-ship.js"))) out.pluginOld = true;
+  if (existsSync13(resolve12(repoRoot, ".opencode/agents/delivery-reviewer.md"))) out.reviewer = true;
+  if (existsSync13(resolve12(repoRoot, ".opencode/agents/delivery-verifier.md"))) out.verifier = true;
   return out;
 }
 async function readLegacyAdapter(repoRoot) {
   const path = legacyAdapterPath(repoRoot);
-  if (!existsSync12(path)) return null;
+  if (!existsSync13(path)) return null;
   try {
     const raw = await readFile7(path, "utf8");
     return { path, raw, value: JSON.parse(raw) };
@@ -5019,13 +6073,13 @@ async function migration({ repoRoot, lock, forceRepair, detection = null }) {
   if (legacy && shapes.legacyLock && !lock?.manager) {
     actions.push({ kind: "kept-legacy-lock", path: legacyLockPath(repoRoot) });
   }
-  if (shapes.plugin && existsSync12(resolve11(repoRoot, ".opencode/plugins/opencode-ship.js"))) {
+  if (shapes.plugin && existsSync13(resolve12(repoRoot, ".opencode/plugins/opencode-ship.js"))) {
     if (!forceRepair) {
       actions.push({ kind: "candidate-remove-legacy-plugin", path: legacyPluginPath(repoRoot) });
     }
   }
   if (shapes.pluginOld) {
-    actions.push({ kind: "candidate-remove-legacy-plugin-path", path: resolve11(repoRoot, ".opencode/plugin/opencode-ship.js") });
+    actions.push({ kind: "candidate-remove-legacy-plugin-path", path: resolve12(repoRoot, ".opencode/plugin/opencode-ship.js") });
   }
   return { shapes, actions, legacyPresent: Boolean(legacy), proposedConfigSeed };
 }
@@ -5073,7 +6127,7 @@ function legacyToShipConfig(legacy, detection = null) {
 // src/installer/executor.js
 init_profile();
 async function readCurrentBytes(targetPath) {
-  if (!existsSync13(targetPath)) return null;
+  if (!existsSync14(targetPath)) return null;
   const buf = await readFile9(targetPath);
   return { bytes: buf, hash: bytesHashString(buf.toString("utf8")) };
 }
@@ -5164,7 +6218,7 @@ async function previewInstall({ rootPath, profile = null, replaceManaged, forceC
   });
   const planMode = null;
   const rootPlan = await planRootConfigApply({ repoRoot, lock, forceRepair: Boolean(forceRootConfig), planMode });
-  const setupPending = resolved.profile === "engineering" && !hasCompletedModels(configValue);
+  const setupPending = resolved.profile === "engineering" && !hasCompletedModels(configPlan.configValue);
   const plan = [...filePlan ?? [], ...staleFilePlan, ...migrationPlan, configPlan, rootPlan];
   const conflicts = plan.filter((p) => p && p.kind === "conflict");
   const summary = summarise(plan);
@@ -5180,7 +6234,8 @@ async function previewInstall({ rootPath, profile = null, replaceManaged, forceC
     conflicts,
     summary,
     migrationReport,
-    setupPending
+    setupPending,
+    modelsProvenance: configPlan.modelsProvenance
   };
 }
 async function previewUninstall({ rootPath }) {
@@ -5215,7 +6270,7 @@ function summarise(plan) {
   }
   return counts;
 }
-async function assembleLock({ repoRoot, plan, lock, configPlan, rootPlan, profile = null, models = null, fullSetupComplete = false }) {
+async function assembleLock({ repoRoot, plan, lock, configPlan, rootPlan, profile = null, models = null, modelsProvenance = null, fullSetupComplete = false }) {
   const files = [];
   const remain = lock?.files?.filter((f) => !plan.some((op) => op?.relPath === f.path)) ?? [];
   for (const op of plan) {
@@ -5251,7 +6306,7 @@ async function assembleLock({ repoRoot, plan, lock, configPlan, rootPlan, profil
     manager: {
       schemaVersion: CURRENT_LOCK_SCHEMA,
       name: "opencode-ship",
-      version: "1.1.7",
+      version: "1.1.9-rc.1",
       templateSet: TEMPLATE_SET_ID,
       profile: resolvedProfile,
       appliedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -5261,6 +6316,7 @@ async function assembleLock({ repoRoot, plan, lock, configPlan, rootPlan, profil
         sha256: configSha ?? lock?.manager?.config?.sha256 ?? "",
         existed: Boolean(lock?.manager?.config?.existed)
       },
+      ...modelsProvenance ? { models: modelsProvenance } : {},
       rootDocuments: hasRootDocuments && (hasRootPlan || (lock?.manager?.rootDocuments?.length ?? 0) > 0) ? [{
         path: rootPlan?.relPath ?? lock?.manager?.rootDocuments?.[0]?.path ?? "opencode.json",
         format: rootPlan?.format ?? lock?.manager?.rootDocuments?.[0]?.format ?? "json",
@@ -5307,6 +6363,7 @@ async function commitInstall(preview, { json, command, fullSetupComplete = false
     configPlan,
     rootPlan,
     profile: preview.profile?.profile,
+    modelsProvenance: preview.modelsProvenance,
     fullSetupComplete
   });
   const txPlan = await stageFiles(fileOnly, repoRoot);
@@ -5398,12 +6455,12 @@ function relativeTemplate(source) {
 // src/installer/commands/doctor.js
 init_lock();
 init_config();
-import { existsSync as existsSync15, readFileSync as readFileSync5 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync6 } from "node:fs";
 import { spawnSync as spawnSync2 } from "node:child_process";
 init_hash();
 init_catalog();
 init_root_config();
-import { resolve as resolve14 } from "node:path";
+import { resolve as resolve15 } from "node:path";
 
 // src/installer/report.js
 var REPORT_VERSION = 1;
@@ -5454,6 +6511,7 @@ function renderJson({ command, plan, conflicts, summary, diagnostics = [], exitC
 
 // src/installer/commands/doctor.js
 init_profile();
+init_workflow_models();
 function checkNode() {
   return { name: "node>=22.6.0", ok: /^v2[2-9]/.test(process.version), detail: process.version };
 }
@@ -5492,9 +6550,9 @@ function checkPackageIntegrity() {
 function buildSourceHashIndex() {
   const idx = /* @__PURE__ */ new Map();
   for (const entry of CATALOG) {
-    if (!existsSync15(entry.source)) continue;
+    if (!existsSync16(entry.source)) continue;
     try {
-      const buf = readFileSync5(entry.source, "utf8");
+      const buf = readFileSync6(entry.source, "utf8");
       idx.set(entry.source, bytesHashString(buf));
     } catch {
     }
@@ -5505,13 +6563,13 @@ async function checkCatalogInstall(repoRoot, sourceHashes, profile, renderedAgen
   const rows = [];
   const scoped = profile ? filterCatalogByProfile(CATALOG, profile) : CATALOG;
   for (const entry of scoped) {
-    const target = resolve14(repoRoot, entry.path);
-    if (!existsSync15(target)) {
+    const target = resolve15(repoRoot, entry.path);
+    if (!existsSync16(target)) {
       rows.push(`${entry.id}: missing`);
       continue;
     }
     try {
-      const buf = readFileSync5(target, "utf8");
+      const buf = readFileSync6(target, "utf8");
       const actual = bytesHashString(buf);
       const rendered = renderedAgentMap.get(entry.path);
       const expected = rendered ? rendered.sha256 : sourceHashes.get(entry.source);
@@ -5567,12 +6625,12 @@ async function checkManagedHashes(repoRoot, validatedLock) {
   const drift = [];
   const renderedAgents = await loadRenderedAgentOverrides(repoRoot);
   for (const entry of validatedLock.lock.files ?? []) {
-    const p = resolve14(repoRoot, entry.path);
-    if (!existsSync15(p)) {
+    const p = resolve15(repoRoot, entry.path);
+    if (!existsSync16(p)) {
       drift.push(`missing:${entry.path}`);
       continue;
     }
-    const buf = readFileSync5(p, "utf8");
+    const buf = readFileSync6(p, "utf8");
     const actual = bytesHashString(buf);
     if (actual !== entry.sha256) drift.push(`drift:${entry.path}`);
   }
@@ -5622,6 +6680,41 @@ async function checkRootConfig(repoRoot) {
     detail: conflict ? `conflict on ${conflict.pointer}` : `applied=${r.applied.length}, skipped=${r.skipped.length}`
   };
 }
+async function checkWorkflowModelDefaults(repoRoot) {
+  const cfg = await loadConfig(repoRoot);
+  const lockResult = await readValidatedLock(repoRoot);
+  if (!cfg?.ok) {
+    return { name: "workflow model defaults", ok: true, detail: "no config; n/a" };
+  }
+  const { current, history } = loadWorkflowModelDefaults();
+  const resolved = resolveWorkflowModels({
+    configModels: cfg.value.workflow?.models ?? {},
+    lockModels: lockResult.kind === "ok" ? lockResult.lock.manager?.models ?? null : null,
+    cliModels: null,
+    current,
+    history
+  });
+  const stale = [];
+  const parts = [];
+  for (const role of ["planner", "builder", "finalReviewer"]) {
+    parts.push(`${role}=${resolved.provenance[role].source}`);
+    if (resolved.provenance[role].source === "default" && resolved.models[role] !== current[role]) {
+      stale.push(role);
+    }
+    const live = cfg.value.workflow?.models?.[role];
+    if (resolved.provenance[role].source === "default" && live && live !== current[role]) {
+      if (!stale.includes(role)) stale.push(role);
+    }
+  }
+  if (stale.length) {
+    return {
+      name: "workflow model defaults",
+      ok: false,
+      detail: `stale default; run update (${stale.join(", ")}); ${parts.join(",")}`
+    };
+  }
+  return { name: "workflow model defaults", ok: true, detail: parts.join(",") };
+}
 async function checkSetupState(repoRoot, configValue) {
   const { setupComplete: setupComplete2 } = await Promise.resolve().then(() => (init_setup_state(), setup_state_exports));
   const state = await setupComplete2(repoRoot, configValue);
@@ -5682,7 +6775,8 @@ async function runDoctor({ rootPath, profile, json, writeOutput = true }) {
     await checkManagedHashes(repoRoot, validatedLock),
     await checkActiveProfileFootprint(repoRoot, validatedLock, resolved.profile),
     await checkRootConfig(repoRoot),
-    await checkSetupState(repoRoot, configValue)
+    await checkSetupState(repoRoot, configValue),
+    await checkWorkflowModelDefaults(repoRoot)
   ];
   const issues = checks.filter((c) => !c.ok).map((c) => `${c.name}: ${c.detail}`);
   const plan = checks.map((c) => ({
@@ -5704,20 +6798,19 @@ async function runDoctor({ rootPath, profile, json, writeOutput = true }) {
 
 // src/installer/commands/init.js
 init_catalog();
-init_config();
 
 // src/installer/setup-pending.js
-import { existsSync as existsSync16, readFileSync as readFileSync6, unlinkSync, writeFile as writeFile7, mkdir as mkdirAsync } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync7, unlinkSync, writeFile as writeFile7, mkdir as mkdirAsync } from "node:fs";
 import { promisify } from "node:util";
-import { resolve as resolve15, dirname as dirname9 } from "node:path";
+import { resolve as resolve16, dirname as dirname9 } from "node:path";
 var writeFileAsync = promisify(writeFile7);
 var mkdirAsyncAsync = promisify(mkdirAsync);
 var REL_PATH = ".opencode/ship.setup-pending.json";
 function setupPendingPath(repoRoot) {
-  return resolve15(repoRoot, REL_PATH);
+  return resolve16(repoRoot, REL_PATH);
 }
 function isSetupPending(repoRoot) {
-  return existsSync16(setupPendingPath(repoRoot));
+  return existsSync17(setupPendingPath(repoRoot));
 }
 async function writeSetupPending(repoRoot, payload) {
   const path = setupPendingPath(repoRoot);
@@ -5726,8 +6819,161 @@ async function writeSetupPending(repoRoot, payload) {
 }
 var SETUP_PENDING_REL_PATH2 = REL_PATH;
 
+// src/skills/sync.js
+init_registry();
+init_policy();
+
+// src/skills/stack-queries.js
+import { readFileSync as readFileSync9 } from "node:fs";
+import { join as join8 } from "node:path";
+var STACK_DEP_QUERIES = {
+  react: "react",
+  "react-dom": "react",
+  next: "nextjs",
+  vitest: "vitest",
+  playwright: "playwright",
+  tailwindcss: "tailwind",
+  express: "express",
+  fastify: "fastify",
+  prisma: "prisma",
+  "drizzle-orm": "drizzle"
+};
+function stackQueries({ packageJson, issueText } = {}) {
+  const found = [];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (q) => {
+    if (!q || seen.has(q) || found.length >= 5) return;
+    seen.add(q);
+    found.push(q);
+  };
+  const deps = {
+    ...packageJson?.dependencies ?? {},
+    ...packageJson?.devDependencies ?? {}
+  };
+  for (const name of Object.keys(deps)) {
+    add(STACK_DEP_QUERIES[name]);
+  }
+  const text = String(issueText ?? "");
+  if (/playwright/i.test(text)) add("playwright");
+  if (/\breact\b/i.test(text)) add("react");
+  if (/nextjs|next\.js|\bnext\b/i.test(text)) add("nextjs");
+  if (/vitest|testing library/i.test(text)) add("vitest");
+  if (/tailwind/i.test(text)) add("tailwind");
+  return found;
+}
+function readPackageJson2(repoRoot) {
+  try {
+    const raw = readFileSync9(join8(repoRoot, "package.json"), "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+// src/skills/sync.js
+var MANAGED_SKILL_NAMES = /* @__PURE__ */ new Set([
+  "ship-workflow",
+  "delivery-workflow",
+  "planning-research-checkpoint",
+  "skill-discovery",
+  "setup-ship-workflow"
+]);
+async function syncSkills({
+  repoRoot,
+  mode: _mode,
+  issueText = "",
+  listSkillsFn,
+  installFn,
+  policy
+} = {}) {
+  const queries = stackQueries({
+    packageJson: readPackageJson2(repoRoot),
+    issueText
+  });
+  const installed = [];
+  const skippedUntrusted = [];
+  const skippedPolicy = [];
+  const errors = [];
+  let registryUnavailable = false;
+  const seen = /* @__PURE__ */ new Set();
+  const resolvedPolicy = policy ?? await readPolicy(repoRoot);
+  const listFn = listSkillsFn ?? listSkills;
+  const cap = resolvedPolicy.maxTrustedPerRun ?? 5;
+  for (const query of queries) {
+    let result;
+    try {
+      result = await listFn({ repoRoot, query });
+    } catch (err) {
+      registryUnavailable = true;
+      errors.push(String(err?.message ?? err));
+      continue;
+    }
+    if (!result?.ok) {
+      registryUnavailable = true;
+      errors.push(result?.error?.kind ?? "registry-unavailable");
+      continue;
+    }
+    for (const candidate of result.candidates ?? []) {
+      const skillName = candidate.skill;
+      const pkg = candidate.package;
+      if (!skillName || seen.has(skillName)) continue;
+      if (MANAGED_SKILL_NAMES.has(skillName)) {
+        skippedPolicy.push({ package: pkg, skillName, reason: "managed-skill" });
+        seen.add(skillName);
+        continue;
+      }
+      const decision = isAutoInstallable(candidate, resolvedPolicy);
+      if (!decision.ok) {
+        const entry = { package: pkg, skillName, reason: decision.reason };
+        if (decision.reason === "untrusted-owner") skippedUntrusted.push(entry);
+        else skippedPolicy.push(entry);
+        seen.add(skillName);
+        continue;
+      }
+      if (installed.length >= cap) {
+        skippedPolicy.push({ package: pkg, skillName, reason: "max-per-run" });
+        seen.add(skillName);
+        continue;
+      }
+      if (typeof installFn !== "function") {
+        errors.push(`installFn missing for ${skillName}`);
+        continue;
+      }
+      let outcome;
+      try {
+        outcome = await installFn({ package: pkg, skillName, version: candidate.version });
+      } catch (err) {
+        errors.push(String(err?.message ?? err));
+        continue;
+      }
+      if (outcome?.ok) {
+        installed.push({ package: pkg, skillName });
+        seen.add(skillName);
+        continue;
+      }
+      const message = String(outcome?.message ?? "");
+      if (/already exists/i.test(message)) {
+        skippedPolicy.push({ package: pkg, skillName, reason: "destination-exists" });
+        seen.add(skillName);
+        continue;
+      }
+      errors.push(message || `install failed: ${skillName}`);
+    }
+  }
+  return {
+    queries,
+    installed,
+    skippedUntrusted,
+    skippedPolicy,
+    errors,
+    registryUnavailable
+  };
+}
+
 // src/installer/commands/init.js
-var writeFileAsync2 = promisify2(writeFile8);
+var writeFileAsync2 = promisify2(writeFile12);
 var mkdirAsyncAsync2 = promisify2(mkdirAsync2);
 async function runInit(options) {
   try {
@@ -5771,6 +7017,28 @@ async function runInit(options) {
     if (exitCode === 4) return emitFailure(4, committed?.diagnostics?.[0] ?? "transaction failure", options.json, "init");
     return emitFailure(exitCode, committed?.diagnostics?.[0] ?? "unknown", options.json, "init");
   }
+  let skillsReport = { installed: [], skippedUntrusted: [], skippedPolicy: [], registryUnavailable: false, errors: [] };
+  try {
+    const syncFn = options.syncSkills ?? syncSkills;
+    skillsReport = await syncFn({
+      repoRoot: preview.repoRoot,
+      mode: "init",
+      installFn: async ({ package: pkg, skillName, version }) => {
+        const { createSkillInstallTool: createSkillInstallTool2 } = await Promise.resolve().then(() => (init_ship_skill_install(), ship_skill_install_exports));
+        const tool = createSkillInstallTool2({ repoRoot: preview.repoRoot, config: { value: { skills: [] } } });
+        return tool({ package: pkg, skillName, version });
+      }
+    });
+  } catch (err) {
+    skillsReport = {
+      installed: [],
+      skippedUntrusted: [],
+      skippedPolicy: [],
+      registryUnavailable: true,
+      errors: [String(err?.message ?? err)]
+    };
+  }
+  committed.extra = { ...committed.extra ?? {}, skills: skillsReport };
   const doctor = await runDoctor({
     rootPath: options.rootPath ?? null,
     profile: options.profile ?? null,
@@ -5789,7 +7057,7 @@ async function runInit(options) {
   if (setupPending && preview.repoRoot) {
     await writeSetupPending(preview.repoRoot, {
       profile: preview.profile?.profile ?? "engineering",
-      reason: "workflow.models is empty; run /setup-ship-workflow to fill in model roles",
+      reason: "docs/AGENTS.md setup incomplete; run /setup-ship-workflow",
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     });
   }
@@ -5814,19 +7082,38 @@ async function runInit(options) {
       prefix: "opencode-ship",
       exitCode,
       doctorIssues: doctor.issues,
-      setupPending
+      setupPending,
+      skillsReport
     });
   }
   process.exitCode = exitCode;
-  return { ok: exitCode === 0, exitCode, setupPending };
+  return { ok: exitCode === 0, exitCode, setupPending, extra: committed.extra };
 }
-function printHumanResult({ prefix, exitCode, doctorIssues, setupPending }) {
+function printHumanResult({ prefix, exitCode, doctorIssues, setupPending, skillsReport }) {
   const lines = [];
   if (exitCode === 0) {
     lines.push(`${prefix}: installed; doctor OK`);
   } else {
     lines.push(`${prefix}: installed with warnings`);
   }
+  const installed = Array.isArray(skillsReport?.installed) ? skillsReport.installed : [];
+  if (installed.length > 0) {
+    lines.push(`Skill discovery: ${installed.length} installed (${installed.map((i) => i.skillName).join(", ")}).`);
+  } else {
+    lines.push("Skill discovery: 0 installed, continuing with catalog skills only.");
+  }
+  const untrusted = Array.isArray(skillsReport?.skippedUntrusted) ? skillsReport.skippedUntrusted : [];
+  if (untrusted.length > 0) {
+    lines.push(`Untrusted skill candidates: ${untrusted.map((s) => `${s.package}/${s.skillName}`).join(", ")}`);
+  }
+  if (skillsReport?.registryUnavailable) {
+    lines.push("Skill registry: unavailable; trusted skill discovery skipped this run.");
+  }
+  const errors = Array.isArray(skillsReport?.errors) ? skillsReport.errors : [];
+  if (errors.length > 0) {
+    lines.push("Skill discovery errors:");
+    for (const err of errors) lines.push(`  - ${err}`);
+  }
   if (Array.isArray(doctorIssues) && doctorIssues.length > 0) {
     lines.push("");
     lines.push("Doctor reported:");
@@ -6000,15 +7287,11 @@ async function runUpdate(options) {
     }
     throw e;
   }
-  const hasExplicitModels = options.models && (options.models.planner || options.models.builder || options.models.finalReviewer);
   const preview = await previewInstall({
     rootPath: options.rootPath,
     profile: options.profile ?? null,
     replaceManaged: options.replaceManaged,
-    // If the user passes model flags, the run is explicitly
-    // populating workflow.models. We must rewrite the config in
-    // that case even when the existing config is otherwise valid.
-    forceConfig: Boolean(options.forceConfig || hasExplicitModels),
+    forceConfig: Boolean(options.forceConfig),
     forceRootConfig: options.forceRootConfig,
     models: options.models ?? null
   });
@@ -6025,6 +7308,30 @@ async function runUpdate(options) {
     return emitFailure2(3, "modified managed files; rerun with --replace-managed", options.json, "update");
   }
   const committed = await commitInstall(preview, { json: options.json, command: "update" });
+  if (committed.extra?.exitCode === 0 && preview.repoRoot) {
+    let skillsReport = { installed: [], skippedUntrusted: [], skippedPolicy: [], registryUnavailable: false, errors: [] };
+    try {
+      const syncFn = options.syncSkills ?? syncSkills;
+      skillsReport = await syncFn({
+        repoRoot: preview.repoRoot,
+        mode: "deliver",
+        installFn: async ({ package: pkg, skillName, version }) => {
+          const { createSkillInstallTool: createSkillInstallTool2 } = await Promise.resolve().then(() => (init_ship_skill_install(), ship_skill_install_exports));
+          const tool = createSkillInstallTool2({ repoRoot: preview.repoRoot, config: { value: { skills: [] } } });
+          return tool({ package: pkg, skillName, version });
+        }
+      });
+    } catch (err) {
+      skillsReport = {
+        installed: [],
+        skippedUntrusted: [],
+        skippedPolicy: [],
+        registryUnavailable: true,
+        errors: [String(err?.message ?? err)]
+      };
+    }
+    committed.extra = { ...committed.extra ?? {}, skills: skillsReport };
+  }
   if (options.json) {
     process.stdout.write(JSON.stringify({
       reportVersion: 1,
@@ -6068,11 +7375,11 @@ function emitFailure2(code, message, json, command) {
 // src/installer/commands/setup-complete.js
 init_config();
 init_setup_state();
-import { existsSync as existsSync17 } from "node:fs";
-import { resolve as resolve16 } from "node:path";
+import { existsSync as existsSync23 } from "node:fs";
+import { resolve as resolve23 } from "node:path";
 async function runSetupComplete(options) {
   const repoRoot = options.rootPath ?? process.cwd();
-  if (!existsSync17(resolve16(repoRoot, ".git"))) {
+  if (!existsSync23(resolve23(repoRoot, ".git"))) {
     return emitFailure3(2, "not a git repository", options.json);
   }
   const config = await loadConfig(repoRoot);