website-build-skill 0.1.4 → 0.1.5

package/docs/evidence/host-trial-claude-code-2026-09-24.json

@@ -0,0 +1,57 @@
+{
+  "status": "PASS (native loading only)",
+  "packageCommit": "c5ab86a70f76dd37b266081d511475dd942e0a1d",
+  "packageVersion": "0.1.4 (npm, installed with npx website-build-skill@0.1.4)",
+  "mode": "solo",
+  "scope": "Native skill discovery and loading in a clean temporary project with a synthetic brief. No website was built; research, mockup, build, review and handoff boundaries were not exercised.",
+  "negativeTrials": [],
+  "review": {
+    "candidateSha256": null,
+    "modelFamily": null,
+    "findings": [],
+    "dispositions": []
+  },
+  "trialId": "2026-09-24-claude-code-solo-load",
+  "client": {
+    "host": "Claude Code",
+    "version": "2.1.281",
+    "os": "macOS 26.6.2 arm64",
+    "modelFamily": "Anthropic Claude (claude-opus-5-5)"
+  },
+  "invocation": "native project skill: installer wrote .claude/skills/website-build-skill/; headless claude -p asked to list project skills and invoke website-build-skill through its native skill mechanism",
+  "startedAt": "2026-09-24T02:13:07Z",
+  "finishedAt": "2026-09-24T02:14:32Z",
+  "commands": [
+    "npx --yes website-build-skill@0.1.4 --solo --target claude-code --dir <trial-project> --output-dir <trial-output> --receipt <trial-output>/install-receipt.json --yes",
+    "claude -p '<synthetic loading brief>' --output-format json"
+  ],
+  "artifacts": [
+    "installed SKILL.md sha256 ed1c909f9946de0fa7a43364c84efc837b6644c0dc8334b81ddfaf031db156e1",
+    "57 files installed under .claude/skills/website-build-skill/"
+  ],
+  "boundaries": [
+    {
+      "boundary": "Load",
+      "result": "PASS",
+      "observed": "Listed website-build-skill as the only project-scoped skill; entrypoint <trial-project>/.claude/skills/website-build-skill/SKILL.md; manifest, 14 prompts, playbooks/research-and-memory.md, 8 checklists and 8 templates READ; roles/, references/stacks/ and examples/ listed but not opened; docs/COMPATIBILITY.md UNREADABLE (source-repo file referenced from SKILL.md, absent from the installed skill)."
+    },
+    {
+      "boundary": "First job",
+      "result": "PASS",
+      "observed": "Named Researcher first: evidenced ASK DATE, saved library under site-work/research/library/ with source receipts, gate AD01-AD08 and R01-R06 plus check-library before any other job."
+    }
+  ],
+  "limitations": [
+    "The client ran with the operator's user-level configuration (about 200 other skills and hooks loaded), so this is not a clean-client install.",
+    "SOLO loading only: TEAM, research, build and release boundaries are untested.",
+    "One run; no negative trials."
+  ],
+  "transcriptExcerpt": "## 1. Skills\n\n- **Project-scoped** (`proj/.claude/skills/`): `website-build-skill` (the only one there).\n- **Session-wide**: about 200 more user, plugin and built-in skills are also loaded. I left them out to stay under 300 words and can list them if you want.\n\n## 2. Invocation\n\n- **Entrypoint**: `<trial-project>/.claude/skills/website-build-skill/SKILL.md`\n- **How I checked**: I opened each file and read its first 3 lines. I read `prompts/00-start.md` in full.\n\n**Asset files it names:**\n- **READ**: `manifest.json`\n- **READ**: `prompts/00-start.md`, `01-website-deep-research.md`, `03-extract-brand-kit.md`, `04-three-mockups.md`, `05-stack-and-build.md`, `06-site-audit.md`, `07-accessibility-contrast.md`, `08-seo-aeo.md`, `09-security-headers.md`, `10-adversarial-pre-ship.md`, `11-ship-and-verify.md`, `12-web-design-team.md`, `13-coding-research.md`\n- **READ**: `playbooks/research-and-memory.md`\n- **READ**: `checklists/research.md`, `brand-and-mockups.md`, `build.md`, `code-quality.md`, `accessibility.md`, `performance-seo.md`, `security.md`, `ship.md`\n- **READ**: `templates/brief.md`, `brand.md`, `tokens.json`, `evidence.md`, `handoff.yaml`, `audit-brief.md`, `site-operations.md`, `status.md`\n- **UNREADABLE**: `docs/COMPATIBILITY.md`. The file isn't in the package. SKILL.md says it lives in the source repository.\n- **Not opened**: SKILL.md points to three folders without naming the files: the seven role files (`roles/`), `references/stacks/` and `examples/`. The files exist (I listed them) but I didn't read them.\n\n## 3. First job\n\n- **Researcher** goes first.\n- **Step one**: set the ASK DATE (the date the work starts). It must not come from asking you or from model knowledge. The rule and the fallback steps for finding it are in `playbooks/research-and-memory.md#ask-date-rule`. The date, which step found it and the raw evidence go in `site-work/research/library/scope.md`.\n- **Must produce first**: the saved research library at `site-work/research/library/`, with a receipt for each source fetched. Its gate (research.md AD01-AD08, R01-R06, plus a `check-library` pass) must pass before any other job starts.\n\nI wrote nothing, as you asked. That includes the session's decision-log entry, which I skipped.\n\n<!-- route: main inline | inspection and briefing, no build -->",
+  "reproduction": "docs/evaluation/host-trial.md steps 1-4 with the loading brief recorded in this receipt",
+  "command": "claude -p '<synthetic loading brief>' --output-format json (after npx --yes website-build-skill@0.1.4 --solo --target claude-code)",
+  "environment": "Claude Code 2.1.281, macOS 26.6.2 arm64, Node v22.22.3",
+  "date": "2026-09-24",
+  "exitCode": 0,
+  "artifactSha256": "ed1c909f9946de0fa7a43364c84efc837b6644c0dc8334b81ddfaf031db156e1",
+  "observed": "website-build-skill listed as the project skill and invoked natively; entrypoint .claude/skills/website-build-skill/SKILL.md; manifest, prompts, playbook, checklists and templates read; Researcher named as the first job"
+}

package/docs/evidence/host-trial-codex-2026-09-24.json

@@ -0,0 +1,58 @@
+{
+  "status": "PASS (native loading only)",
+  "packageCommit": "c5ab86a70f76dd37b266081d511475dd942e0a1d",
+  "packageVersion": "0.1.4 (npm, installed with npx website-build-skill@0.1.4)",
+  "mode": "solo",
+  "scope": "Native skill discovery and loading in a clean temporary project with a synthetic brief. No website was built; research, mockup, build, review and handoff boundaries were not exercised.",
+  "negativeTrials": [],
+  "review": {
+    "candidateSha256": null,
+    "modelFamily": null,
+    "findings": [],
+    "dispositions": []
+  },
+  "trialId": "2026-09-24-codex-solo-load",
+  "client": {
+    "host": "Codex CLI",
+    "version": "codex-cli 0.154.0",
+    "os": "macOS 26.6.2 arm64",
+    "modelFamily": "OpenAI GPT (gpt-6-astra, effort medium)"
+  },
+  "invocation": "native project skill: installer wrote .agents/skills/website-build-skill/; headless codex exec (read-only sandbox) asked to list project skills and load website-build-skill through its native skill mechanism",
+  "startedAt": "2026-09-24T02:16:00Z",
+  "finishedAt": "2026-09-24T02:16:56Z",
+  "commands": [
+    "npx --yes website-build-skill@0.1.4 --solo --target codex --dir <trial-project> --output-dir <trial-output> --receipt <trial-output>/install-receipt.json --yes",
+    "codex exec --sandbox read-only '<synthetic loading brief>'"
+  ],
+  "artifacts": [
+    "installed SKILL.md sha256 ed1c909f9946de0fa7a43364c84efc837b6644c0dc8334b81ddfaf031db156e1",
+    "57 files installed under .agents/skills/website-build-skill/"
+  ],
+  "boundaries": [
+    {
+      "boundary": "Load",
+      "result": "PASS",
+      "observed": "Reported website-build-skill offered natively in the available-skills catalog with no path guessing; entrypoint <trial-project>/.agents/skills/website-build-skill/SKILL.md; all 57 manifest assets READ; docs/COMPATIBILITY.md UNREADABLE (absent from the installed skill)."
+    },
+    {
+      "boundary": "First job",
+      "result": "PASS",
+      "observed": "Named Researcher first: evidenced ASK DATE, saved and reopened research library, researcher handoff, AD01-AD08 and R01-R06 before downstream work."
+    }
+  ],
+  "limitations": [
+    "Run through the operator's cli-run wrapper, which adds a task-bundle frame to the prompt.",
+    "SOLO loading only: TEAM, research, build and release boundaries are untested.",
+    "One run; no negative trials.",
+    "finishedAt is approximate to the minute (wrapper reported 56.0s)."
+  ],
+  "transcriptExcerpt": "1. **Project skill:** `website-build-skill`. It was offered natively in the available-skills catalog; no path guessing was needed.\n\n2. **Loaded entrypoint:** `<trial-project>/.agents/skills/website-build-skill/SKILL.md`\n\nComplete manifest asset list, relative to that directory:\n\n- READ `SKILL.md`\n- READ `manifest.json`\n- READ `prompts/00-start.md`\n- READ `prompts/01-website-deep-research.md`\n- READ `archive/graphics-design-original.md`\n- READ `prompts/03-extract-brand-kit.md`\n- READ `prompts/04-three-mockups.md`\n- READ `prompts/05-stack-and-build.md`\n- READ `prompts/06-site-audit.md`\n- READ `prompts/07-accessibility-contrast.md`\n- READ `prompts/08-seo-aeo.md`\n- READ `prompts/09-security-headers.md`\n- READ `prompts/10-adversarial-pre-ship.md`\n- READ `prompts/11-ship-and-verify.md`\n- READ `prompts/12-web-design-team.md`\n- READ `prompts/13-coding-research.md`\n- READ `roles/researcher.md`\n- READ `roles/coordinator.md`\n- READ `roles/designer.md`\n- READ `roles/graphics.md`\n- READ `roles/builder.md`\n- READ `roles/optimizer.md`\n- READ `roles/reviewer.md`\n- READ `playbooks/choose-stack.md`\n- READ `playbooks/data-and-templates.md`\n- READ `playbooks/image-pipeline.md`\n- READ `playbooks/self-hosted-fonts.md`\n- READ `playbooks/embed-facades.md`\n- READ `playbooks/security-headers.md`\n- READ `playbooks/structured-data-and-llms.md`\n- READ `playbooks/performance-budgets.md`\n- READ `playbooks/accessibility.md`\n- READ `playbooks/research-and-memory.md`\n- READ `playbooks/deploy-and-operate.md`\n- READ `checklists/research.md`\n- READ `checklists/brand-and-mockups.md`\n- READ `checklists/build.md`\n- READ `checklists/code-quality.md`\n- READ `checklists/accessibility.md`\n- READ `checklists/performance-seo.md`\n- READ `checklists/security.md`\n- READ `checklists/ship.md`\n- READ `references/stacks/static-html.md`\n- READ `references/stacks/scripted-static.md`\n- READ `references/stacks/framework.md`\n- READ `templates/install-choice.txt`\n- READ `templates/brief.md`\n- READ `templates/brand.md`\n- READ `templates/tokens.json`\n- READ `templates/evidence.md`\n- READ `templates/handoff.yaml`\n- READ `templates/audit-brief.md`\n- READ `templates/site-operations.md`\n- READ `templates/status.md`\n- READ `examples/fictional-studio-brief.md`\n- READ `examples/fictional-studio-handoff.md`\n- READ `examples/audit-cases.md`\n\nAdditional entrypoint reference:\n\n- UNREADABLE `docs/COMPATIBILITY.md`: absent from installed skill.\n\n3. **First job: Researcher.** Establish evidenced ASK DATE, then produce and reopen `site-work/research/library/`: sourced research, domain checklists, coverage, freshness, learning, and evidence receipts. Produce the researcher handoff and pass AD01–AD08 and R01–R06 before downstream work; Coordinator verifies acceptance. No website work was performed.\n",
+  "reproduction": "docs/evaluation/host-trial.md steps 1-4 with the loading brief recorded in this receipt",
+  "command": "codex exec --sandbox read-only '<synthetic loading brief>' (after npx --yes website-build-skill@0.1.4 --solo --target codex)",
+  "environment": "Codex CLI 0.154.0 (gpt-6-astra), macOS 26.6.2 arm64, Node v22.22.3",
+  "date": "2026-09-24",
+  "exitCode": 0,
+  "artifactSha256": "ed1c909f9946de0fa7a43364c84efc837b6644c0dc8334b81ddfaf031db156e1",
+  "observed": "website-build-skill offered natively in the available-skills catalog; entrypoint .agents/skills/website-build-skill/SKILL.md; all 57 manifest assets read; Researcher named as the first job"
+}

package/llms.txt

@@ -11,6 +11,8 @@ Generated from skills/website-build-skill/manifest.json. Repository: https://git
 - [Compatibility](docs/COMPATIBILITY.md): host setup routes and the evidence for each
 - [Documentation](docs/README.md): method, tips, provenance and evaluation
 
+TEAM: one command installs the seven workers' files; you open each session yourself and carry the handoffs between them. Researcher goes first.
+
 ## Active sources
 
 - [SKILL.md](skills/website-build-skill/SKILL.md): Website Build Skill

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "website-build-skill",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Skills that make your AI an expert website builder: current research, design, accessibility, performance, SEO, security and code, for any LLM or agent.",
   "type": "module",
   "license": "MIT",

package/skills/website-build-skill/SKILL.md

@@ -40,7 +40,8 @@ true as of the date of your ask, not from what its model happens to remember.
 This question is for the human at install, displayed by the README or installer.
 Follow the recorded --solo / --team choice or the option named in the user's setup prompt.
 Do not repeat it during the method. If no choice exists, return to the install entrypoint.
-Option 2 requires Claude Code, Codex, Hermes, Antigravity, or Grok Bot; its setup checks actual workers.
+TEAM: one command installs the seven workers' files; you open each session yourself and carry the handoffs between them. Researcher goes first.
+Option 2 uses Claude Code, Codex, Hermes, Antigravity, or Grok Bot; the human checks each session.
 Both options use the same gates. Solo review is INTERNAL until a different family reviews.
 
 Read prompts/00-start.md to give Researcher the request and available tools.
@@ -92,7 +93,7 @@ The graphics original is inactive provenance, excluded from every active stage r
 | Protect | Builder | 09-security-headers | security.md |
 | Challenge | Different-family Reviewer | 10-adversarial-pre-ship | research.md AD09; [code-quality.md](checklists/code-quality.md); ship.md SH01-SH03 |
 | Ship | Coordinator acceptance, Builder release | 11-ship-and-verify | ship.md, pre-promotion then live checks |
-| Team setup | Human or installer | 12-web-design-team | Seven route acknowledgements; no downstream work yet |
+| Team setup | Human opens sessions and carries handoffs | 12-web-design-team | Seven route acknowledgements; no downstream work yet |
 
 Use full filenames and asset order from manifest.json; the table abbreviates prompt suffixes.
 For limited audits, load the relevant current research and checks without inventing redesign work.

package/skills/website-build-skill/manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "packageVersion": "0.1.4",
+  "packageVersion": "0.1.5",
   "skillName": "website-build-skill",
   "pathBase": "All asset paths resolve from this manifest directory; runtime paths resolve in the authorized user project.",
   "assets": [
@@ -17,7 +17,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "ed1c909f9946de0fa7a43364c84efc837b6644c0dc8334b81ddfaf031db156e1"
+      "sha256": "71cb5b229d68ae1b91a11d4168c6093a88d0c0f7da2dbcab0c933cb6a333c81b"
     },
     {
       "path": "manifest.json",
@@ -45,7 +45,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "d5ed2a92d5bd7071895658ebbf4d7d696aeddb3735aa8d9153d0405c517f7b9c"
+      "sha256": "9de537723108ad71b608c467d78c7ba6edb54880d0429f5321d490cba9c900cb"
     },
     {
       "path": "prompts/01-website-deep-research.md",
@@ -225,7 +225,7 @@
         "skill-zip",
         "native-skill"
       ],
-      "sha256": "58a53b49b1da1039195d0ecaa24dff296668d9c4c4a52545d40836ddf8d6d388"
+      "sha256": "a1b1460deea3520d25245d805521019f758b905b97e73ac97e7020cead861837"
     },
     {
       "path": "prompts/13-coding-research.md",

package/skills/website-build-skill/prompts/00-start.md

@@ -15,10 +15,11 @@ Do not repeat the install question mid-method. If no choice is recorded, return
 its install entrypoint to the human before starting work.
 
 TEAM SETUP
+TEAM: one command installs the seven workers' files; you open each session yourself and carry the handoffs between them. Researcher goes first.
 - Read roles/researcher.md, roles/coordinator.md, roles/designer.md, roles/graphics.md, roles/builder.md,
   roles/optimizer.md, and roles/reviewer.md.
-- Run prompts/12-web-design-team.md to establish workers, ownership, and handoffs.
-- Installer or human checks routes during setup; create Researcher first. Coordinator
+- Follow prompts/12-web-design-team.md while the human opens the sessions and carries handoffs.
+- The human checks session references during setup and opens Researcher first. Coordinator
   records families and working readiness after the research gate passes.
 - Role labels within one conversation are option 1; if separate workers are unavailable,
   say so, record SOLO, and continue below. Missing independent review alone blocks

package/skills/website-build-skill/prompts/12-web-design-team.md

@@ -4,6 +4,7 @@ Never ask the user for the date or infer it from model knowledge. Apply the
 same source, two-date, freshness, reuse, and blocked-gate rules to this stage.
 
 Run option 2, Give me the team, using the human's recorded install choice.
+TEAM: one command installs the seven workers' files; you open each session yourself and carry the handoffs between them. Researcher goes first.
 Needs Claude Code, Codex, Hermes, Antigravity, or Grok Bot. Follow the setup line for that host.
 
 Every agent runs its own research pass before it touches your site, so it works from what is
@@ -16,22 +17,21 @@ SET UP
 - Read roles/researcher.md first, then roles/coordinator.md, roles/designer.md,
   roles/graphics.md, roles/builder.md, roles/optimizer.md, roles/reviewer.md,
   and templates/handoff.yaml. Use each complete body, not these short summaries.
-- Create or identify Website Researcher first, then Website Coordinator,
+- The human opens Website Researcher first, then Website Coordinator,
   Website Designer, Website Graphics, Website Builder, Website Optimizer, and
-  Website Reviewer as separate sessions, Bots, or terminals. Parent may coordinate
-  only after the research gate. Use supported setup mechanisms, not invented imports.
-- Installer or human checks routes and obtains seven setup acknowledgements.
+  Website Reviewer as separate sessions, Bots, or terminals. Coordinator works
+  only after the research gate. Use available session controls and complete role files.
+- The human checks each session reference and obtains seven setup acknowledgements.
   These confirm receipt of instructions, not permission to start downstream work.
 - A role label in one conversation is option 1. Record SOLO and use prompts/00-start.md
   if separate workers cannot be reached. A same-family team remains a team but
   cannot pass independent review. Respect host concurrency limits.
-- Antigravity setup uses generated agent definitions and per-role tool declarations;
-  Hermes setup uses the verified definition branch or generated session packets and
-  bundle alias. Read the host adapter and receipt; pending discovery, trust, tools,
-  or independent review checks cannot be reported as a ready team.
+- Read the host adapter and receipt. The installer supplies role files and bundles;
+  the human opens sessions, checks trust and tools, and supplies each worker's files.
+  Pending discovery, trust, tools or independent review checks remain explicit limits.
 - Supply the request, authorized workspace, source assets, and tools to Researcher.
-  All other roles wait. Use the manual fallback in the team bundle if setup cannot
-  be automated; actual package integration remains UNVERIFIED until tested.
+  All other roles wait. Carry the complete packets using the manual setup below;
+  actual host loading remains UNVERIFIED until tested.
 
 RESEARCHER
 - Own site-work/research/library/ and handoffs/researcher/; own both research resources.
@@ -114,9 +114,9 @@ Never report a measured, saved, installed, or deployed result without evidence.
 Apply checklists/research.md before downstream dispatch and checklists/ship.md before release.
 
 PORTABLE MANUAL SETUP
-Use this fallback when native adapters or generated bundles are not supplied.
-Native loading, automatic worker creation, routing, tool enforcement and different-family
-availability are UNVERIFIED until the actual host/session checks succeed.
+Use this setup for TEAM on every host. You open each session and carry every handoff.
+Host loading, file access, tool enforcement and different-family availability remain
+UNVERIFIED until the actual host/session checks succeed.
 A missing host adapter does not authorize inventing a native file format or import API.
 
 1. Open the host's verified worker/session creation surface, if available.
@@ -128,8 +128,8 @@ A missing host adapter does not authorize inventing a native file format or impo
    with evidence, tools, inaccessible files, and owned paths. Keep downstream work pending.
 5. Give Reviewer a read-only candidate packet or verified read-only session. Broad
    inherited tools do not become restricted because role prose says read-only.
-6. Verify a bounded setup message reaches each intended route through supported controls.
-   When group automation is absent, the human can relay addressed packets and attachments.
+6. Deliver a bounded setup message to each session yourself. Relay addressed packets
+   and attachments, and verify each receiving worker can open them.
 7. Give the user's actual request, authorized workspace, assets and constraints to
    Researcher alone. It establishes ASK DATE and completes the library and gate first.
 8. Relay its complete passing receipt and readable library to Coordinator. Coordinator
@@ -138,7 +138,7 @@ A missing host adapter does not authorize inventing a native file format or impo
 Preserve seven acknowledgements separately from research and work-readiness receipts.
 A text-only group requires direct image attachments to each receiving visual reviewer.
 Inaccessible files or routes keep the relevant handoff BLOCKED.
-No automatic creation support means a manual setup limit, not a claimed ready team.
+Completed file installation means the files are available; session setup is the human's next step.
 No separate workers means SOLO; no independent family means independent review BLOCKED.
 Never invent a platform capability to fill a setup gap.
 

package/src/bundle.mjs

@@ -140,6 +140,7 @@ export function generated(root) {
   index += '- [Installer](docs/INSTALLER.md): headless setup, destinations, receipts, exit codes and uninstall\n';
   index += '- [Compatibility](docs/COMPATIBILITY.md): host setup routes and the evidence for each\n';
   index += '- [Documentation](docs/README.md): method, tips, provenance and evaluation\n\n';
+  index += "TEAM: one command installs the seven workers' files; you open each session yourself and carry the handoffs between them. Researcher goes first.\n\n";
   index += '## Active sources\n\n';
   for (const asset of m.assets.filter(a => a.active)) index += `- [${asset.path}](${CORE}/${asset.path}): ${describe(root, asset)}\n`;
   index += '\n## Bundles\n\n';

package/src/install.mjs

@@ -1,5 +1,5 @@
 import fs from 'node:fs';
-import { resolve, relative, dirname, basename, sep } from 'node:path';
+import { resolve, relative, dirname, basename, join, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { randomUUID } from 'node:crypto';
 import { CORE, files, owned, digest } from './bundle.mjs';
@@ -59,6 +59,22 @@ export function safePath(root, name) {
 const receiptName = '.website-build-skill-receipt.json';
 const result = (code, message) => ({ code, message });
 
+function canonicalReceipt(path, root, destination, outputRoot) {
+  const boundaries = [destination, outputRoot].filter(Boolean);
+  // Resolve the user's root spelling, but inspect its suffix before using the canonical
+  // receipt parent: otherwise a planted link below an output or destination root disappears.
+  // An ancestor that resolves anywhere INSIDE a root (an alias to a subdirectory, not only
+  // to the root itself) is walked from that root, so no link below it is skipped.
+  for (let parent = dirname(path); ; parent = dirname(parent)) {
+    const base = canonical(parent);
+    for (const boundary of boundaries) {
+      if (inside(boundary, base)) safePath(boundary, join(relative(boundary, base), relative(parent, path)));
+    }
+    if (dirname(parent) === parent) break;
+  }
+  return safePath(root, resolve(root, basename(path)));
+}
+
 function validate(request) {
   if (!Object.hasOwn(targets, request.target)) throw Error('Unknown or missing target');
   if (!['solo', 'team'].includes(request.mode)) throw Error('Mode must be solo or team');
@@ -240,11 +256,12 @@ export function install(request = {}) {
       destination = resolve(project, targets[request.target]);
       receiptPath = resolve(request.receipt ?? resolve(destination, receiptName));
       receiptRoot = request.receipt ? canonical(dirname(receiptPath)) : destination;
-      outputRoot = request.outputDir === undefined ? null : canonical(request.outputDir);
     }
+    outputRoot = request.outputDir === undefined ? null : canonical(request.outputDir);
   } catch (error) { return result(2, error.message); }
-  if (request.uninstall) return uninstall(request, destination, receiptPath, receiptRoot);
   try {
+    if (request.receipt) receiptPath = canonicalReceipt(receiptPath, receiptRoot, destination, outputRoot);
+    if (request.uninstall) return uninstall(request, destination, receiptPath, receiptRoot);
     safePath(project, targets[request.target]);
     if (request.receipt) safePath(receiptRoot, receiptPath);
     if (inside(destination, receiptPath) && receiptPath === destination) throw Error('Receipt collides with destination');
@@ -274,7 +291,7 @@ export function install(request = {}) {
       if (info && entry.wrote) conflicts.push(entry.path);
     }
     if (conflicts.length) return result(3, `Preflight conflicts; nothing written:\n${conflicts.join('\n')}`);
-  } catch (error) { return result(3, `Preflight refused; nothing written: ${error.message}`); }
+  } catch (error) { return request.uninstall ? result(2, error.message) : result(3, `Preflight refused; nothing written: ${error.message}`); }
   const receipt = {
     schemaVersion: 1, package: packageInfo, date: new Date().toISOString(), mode: request.mode,
     target: request.target, scope: request.scope ?? 'project', destination, outputRoot,