@uzysjung/agent-harness 26.131.1 → 26.133.0

package/dist/index.js

@@ -712,7 +712,7 @@ var cac = (name = "") => new CAC(name);
 // package.json
 var package_default = {
   name: "@uzysjung/agent-harness",
-  version: "26.131.1",
+  version: "26.133.0",
   description: "Curate vetted AI-coding skills & plugins by your tech stack \u2014 install only what you need, across Claude Code, Codex, OpenCode & Antigravity",
   type: "module",
   publishConfig: {
@@ -906,18 +906,18 @@ function padDisplay(s, width) {
 init_esm_shims();
 import {
   chmodSync as chmodSync2,
-  existsSync as existsSync12,
-  mkdirSync as mkdirSync5,
+  existsSync as existsSync13,
+  mkdirSync as mkdirSync6,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync11,
-  writeFileSync as writeFileSync9
+  readFileSync as readFileSync12,
+  writeFileSync as writeFileSync7
 } from "fs";
-import { basename as basename4, dirname as dirname5, join as join11, resolve } from "path";
+import { basename as basename4, dirname as dirname6, join as join11, resolve } from "path";
 
 // src/antigravity/transform.ts
 init_esm_shims();
-import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { basename, join as join2 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { basename, join as join3 } from "path";
 
 // src/codex/agents-md.ts
 init_esm_shims();
@@ -960,6 +960,11 @@ function portBody(body) {
   return renameSlashes(body).replace(/CLAUDE_PROJECT_DIR/g, "CODEX_PROJECT_DIR").trimEnd();
 }
 
+// src/owned-write.ts
+init_esm_shims();
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname3, relative, sep } from "path";
+
 // src/fs-ops.ts
 init_esm_shims();
 import {
@@ -1050,6 +1055,218 @@ function ensureProjectSkeleton(projectDir) {
   }
 }
 
+// src/install-log.ts
+init_esm_shims();
+import { createHash } from "crypto";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { dirname as dirname2, join as join2 } from "path";
+var INSTALL_LOG_FILENAME = ".harness-install.json";
+var INSTALL_LOG_VERSION = 1;
+var POLICY_DIRS = [
+  { dir: "rules", ext: ".md" },
+  { dir: "agents", ext: ".md" },
+  { dir: "commands/uzys", ext: ".md" },
+  { dir: "hooks", ext: ".sh" }
+];
+function buildAssetEntries(report, scope) {
+  if (!report) return [];
+  return report.attempted.filter((r) => r.ok).map((r) => assetToLogEntry(r.asset, scope, r.version));
+}
+function assetToLogEntry(asset, scope, version) {
+  const detail = methodDetail(asset.method);
+  const entry = {
+    id: asset.id,
+    category: asset.category,
+    method: asset.method.kind,
+    scope,
+    detail
+  };
+  if (version) entry.version = version;
+  return entry;
+}
+function methodDetail(method) {
+  switch (method.kind) {
+    case "plugin":
+      return { marketplace: method.marketplace, pluginId: method.pluginId };
+    case "skill":
+      return { source: method.source, ...method.skill ? { skill: method.skill } : {} };
+    case "npm":
+      return { pkg: method.pkg };
+    case "npx-run":
+      return { cmd: method.cmd, args: (method.args ?? []).join(" ") };
+    case "shell-script":
+      return { script: method.script, args: method.args.join(" ") };
+    case "internal":
+      return { key: method.key };
+  }
+}
+function buildInstallLog(spec, external, scope, rootClaudeMd, previous, claudeDirMovedAside = false, rootFiles = []) {
+  const templates = {
+    claudeDir: ".claude/",
+    ...spec.cli.includes("codex") ? { codexDir: ".codex/" } : {},
+    ...spec.cli.includes("opencode") ? { opencodeDir: ".opencode/" } : {},
+    ...rootClaudeMd ? { rootClaudeMd } : {}
+  };
+  const log = {
+    schemaVersion: INSTALL_LOG_VERSION,
+    installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    scope,
+    spec: {
+      tracks: spec.tracks,
+      cli: spec.cli
+    },
+    // 이번 설치가 만든 항목이 이기고, 이번에 안 만든 항목은 이전 값을 그대로 둔다.
+    // (예: claude 로 깔고 나중에 codex 만 추가 설치해도 root CLAUDE.md 기록이 살아남는다)
+    templates: { ...previous?.templates, ...templates },
+    assets: mergeAssets(
+      claudeDirMovedAside ? previous?.assets?.filter(survivesClaudeDirRename) : previous?.assets,
+      buildAssetEntries(external, scope)
+    )
+  };
+  const mergedRootFiles = mergeRootFiles(previous?.rootFiles, rootFiles);
+  if (mergedRootFiles.length > 0) log.rootFiles = mergedRootFiles;
+  return log;
+}
+function mergeRootFiles(previous, current) {
+  const byPath = /* @__PURE__ */ new Map();
+  for (const file of [...previous ?? [], ...current]) {
+    const prior = byPath.get(file.path);
+    byPath.set(
+      file.path,
+      prior ? {
+        path: file.path,
+        change: prior.change === "created" ? "created" : file.change,
+        notes: [.../* @__PURE__ */ new Set([...prior.notes, ...file.notes])]
+      } : file
+    );
+  }
+  return [...byPath.values()];
+}
+function survivesClaudeDirRename(asset) {
+  if (asset.scope === "global") return true;
+  switch (asset.method) {
+    case "plugin":
+      return true;
+    // `~/.claude/plugins/cache` — 프로젝트 밖
+    case "npm":
+      return true;
+    // `node_modules/`
+    case "skill":
+      return false;
+    // `npx skills add` project scope → `.claude/skills/`
+    case "shell-script":
+      return false;
+    // ecc-prune → `.claude/local-plugins/`
+    case "npx-run":
+      return false;
+    case "internal":
+      return false;
+  }
+}
+function mergeAssets(previous, current) {
+  if (!previous || previous.length === 0) return [...current];
+  const currentById = new Map(current.map((a) => [a.id, a]));
+  const previousIds = new Set(previous.map((a) => a.id));
+  return [
+    ...previous.map((a) => currentById.get(a.id) ?? a),
+    ...current.filter((a) => !previousIds.has(a.id))
+  ];
+}
+function hashContent(content) {
+  return createHash("sha256").update(content, "utf8").digest("hex");
+}
+function isHarnessOwned(baseline, key, current) {
+  const recorded = baseline.get(key);
+  return recorded !== void 0 && recorded === hashContent(current);
+}
+function mergeExternalFiles(projectDir, previous, current) {
+  const byPath = /* @__PURE__ */ new Map();
+  for (const file of [...previous ?? [], ...current]) byPath.set(file.path, file);
+  return [...byPath.values()].filter((f) => existsSync2(join2(projectDir, f.path)));
+}
+function collectSkillHashes(projectDir) {
+  const skillsDir = join2(projectDir, ".claude/skills");
+  return listFilesRecursive(skillsDir).map((rel) => ({
+    path: rel,
+    sha256: hashContent(readFileSync2(join2(skillsDir, rel), "utf8"))
+  }));
+}
+function collectPolicyHashes(projectDir, templatesDir) {
+  const out = [];
+  for (const { dir, ext } of POLICY_DIRS) {
+    const targetDir = join2(projectDir, ".claude", dir);
+    const sourceDir = join2(templatesDir, dir);
+    for (const rel of listFilesRecursive(targetDir)) {
+      if (!rel.endsWith(ext)) continue;
+      if (!existsSync2(join2(sourceDir, rel))) continue;
+      out.push({
+        path: `${dir}/${rel}`,
+        sha256: hashContent(readFileSync2(join2(targetDir, rel), "utf8"))
+      });
+    }
+  }
+  return out;
+}
+function writeInstallLog(projectDir, log) {
+  const path = join2(projectDir, ".claude", INSTALL_LOG_FILENAME);
+  mkdirSync2(dirname2(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(log, null, 2)}
+`, "utf8");
+  return path;
+}
+function readInstallLog(projectDir) {
+  const path = join2(projectDir, ".claude", INSTALL_LOG_FILENAME);
+  if (!existsSync2(path)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    if (Array.isArray(parsed.assets)) {
+      parsed.assets = parsed.assets.map(
+        (a) => a.method === "npm-global" ? { ...a, method: "npm" } : a
+      );
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function installLogPath(projectDir) {
+  return join2(projectDir, ".claude", INSTALL_LOG_FILENAME);
+}
+
+// src/owned-write.ts
+function createOwnedWriter(projectDir, baseline, now = /* @__PURE__ */ new Date()) {
+  const written = /* @__PURE__ */ new Map();
+  const backedUp = [];
+  const backupPaths = [];
+  return {
+    write(absPath, content) {
+      const rel = relative(projectDir, absPath).split(sep).join("/");
+      const digest = hashContent(content);
+      if (!existsSync3(absPath)) {
+        mkdirSync3(dirname3(absPath), { recursive: true });
+        writeFileSync2(absPath, content);
+      } else {
+        const current = readFileSync3(absPath, "utf8");
+        if (current !== content) {
+          if (!isHarnessOwned(baseline, rel, current)) {
+            backupPaths.push(backupFile(absPath, now));
+            backedUp.push(rel);
+          }
+          writeFileSync2(absPath, content);
+        }
+      }
+      written.set(rel, digest);
+    },
+    result() {
+      return {
+        files: [...written].map(([path, sha256]) => ({ path, sha256 })),
+        backedUp: [...backedUp],
+        backupPaths: [...backupPaths]
+      };
+    }
+  };
+}
+
 // src/project-claude-merge.ts
 init_esm_shims();
 var TRACK_DISPLAY_NAMES = {
@@ -1144,48 +1361,48 @@ function expandTracks(tracks) {
 
 // src/antigravity/transform.ts
 function runAntigravityTransform(params) {
-  const { harnessRoot, projectDir, selectedInternalSkills = [] } = params;
-  const rulesFile = writeRules(harnessRoot, projectDir);
+  const { harnessRoot, projectDir, selectedInternalSkills = [], baseline } = params;
+  const writer = createOwnedWriter(projectDir, baseline);
+  const rulesFile = writeRules(harnessRoot, projectDir, writer);
   const skillFiles = [];
   for (const id of selectedInternalSkills) {
-    const src = join2(harnessRoot, "templates/skills", id, "SKILL.md");
-    if (!existsSync2(src)) {
+    const src = join3(harnessRoot, "templates/skills", id, "SKILL.md");
+    if (!existsSync4(src)) {
       continue;
     }
-    const skillDir = join2(projectDir, ".agents", "skills", id);
-    ensureDir(skillDir);
-    const target = join2(skillDir, "SKILL.md");
-    writeFileSync(target, renderBundledSkill(readFileSync2(src, "utf8")));
+    const target = join3(projectDir, ".agents", "skills", id, "SKILL.md");
+    writer.write(target, renderBundledSkill(readFileSync4(src, "utf8")));
     skillFiles.push(target);
   }
-  return { rulesFile, skillFiles };
+  return {
+    rulesFile,
+    skillFiles,
+    ownership: writer.result()
+  };
 }
-function writeRules(harnessRoot, projectDir) {
-  const claudeMdPath = join2(harnessRoot, "templates/CLAUDE.md");
-  const templatePath = join2(harnessRoot, "templates/antigravity/AGENTS.md.template");
-  if (!existsSync2(claudeMdPath) || !existsSync2(templatePath)) {
+function writeRules(harnessRoot, projectDir, writer) {
+  const claudeMdPath = join3(harnessRoot, "templates/CLAUDE.md");
+  const templatePath = join3(harnessRoot, "templates/antigravity/AGENTS.md.template");
+  if (!existsSync4(claudeMdPath) || !existsSync4(templatePath)) {
     return null;
   }
-  const claudeMd = readFileSync2(claudeMdPath, "utf8");
-  const template = readFileSync2(templatePath, "utf8");
-  const rulesDir = join2(projectDir, ".agents", "rules");
-  ensureDir(rulesDir);
-  const target = join2(rulesDir, "uzys-harness.md");
+  const claudeMd = readFileSync4(claudeMdPath, "utf8");
+  const template = readFileSync4(templatePath, "utf8");
+  const target = join3(projectDir, ".agents", "rules", "uzys-harness.md");
   const rulesOut = renderAgentsMd({
     template,
     claudeMd,
     projectName: basename(projectDir),
     projectContext: renderFillScaffold()
   });
-  backupFileIfChanged(target, rulesOut);
-  writeFileSync(target, rulesOut);
+  writer.write(target, rulesOut);
   return target;
 }
 
 // src/ci-scaffold.ts
 init_esm_shims();
-import { existsSync as existsSync3 } from "fs";
-import { join as join3 } from "path";
+import { existsSync as existsSync5 } from "fs";
+import { join as join4 } from "path";
 var PYTHON_TRACKS = "data|csr-fastapi|full";
 var VARIANTS = [
   {
@@ -1209,12 +1426,12 @@ function installCiScaffold(ctx) {
   for (const v2 of VARIANTS) {
     if (!v2.applies(ctx.tracks)) continue;
     const relTarget = `.github/workflows/${v2.target}`;
-    const target = join3(ctx.projectDir, relTarget);
-    if (existsSync3(target)) {
+    const target = join4(ctx.projectDir, relTarget);
+    if (existsSync5(target)) {
       report.skippedExisting.push(relTarget);
       continue;
     }
-    copyFile(join3(ctx.harnessRoot, "templates/github-workflows", v2.source), target);
+    copyFile(join4(ctx.harnessRoot, "templates/github-workflows", v2.source), target);
     report.written.push(relTarget);
   }
   return report;
@@ -1223,18 +1440,18 @@ function installCiScaffold(ctx) {
 // src/codex/opt-in.ts
 init_esm_shims();
 import { homedir } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 
 // src/codex/trust-entry.ts
 init_esm_shims();
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname4 } from "path";
 var TRUST_BLOCK_REGEX = /\[projects\."([^"]+)"\]/g;
 function registerTrustEntry(opts) {
   const { configPath, projectDir } = opts;
   try {
-    mkdirSync2(dirname2(configPath), { recursive: true });
-    const existing = existsSync4(configPath) ? readFileSync3(configPath, "utf8") : "";
+    mkdirSync4(dirname4(configPath), { recursive: true });
+    const existing = existsSync6(configPath) ? readFileSync5(configPath, "utf8") : "";
     if (hasTrustEntry(existing, projectDir)) {
       return { status: "already-present" };
     }
@@ -1242,7 +1459,7 @@ function registerTrustEntry(opts) {
 [projects."${projectDir}"]
 trust_level = "trusted"
 `;
-    writeFileSync2(configPath, existing + block);
+    writeFileSync3(configPath, existing + block);
     return { status: "registered" };
   } catch (e2) {
     return {
@@ -1258,8 +1475,8 @@ function hasTrustEntry(configContent, projectDir) {
 
 // src/codex/opt-in.ts
 function runCodexOptIn(ctx) {
-  const codexHome = ctx.codexHome ?? join4(homedir(), ".codex");
-  const configPath = join4(codexHome, "config.toml");
+  const codexHome = ctx.codexHome ?? join5(homedir(), ".codex");
+  const configPath = join5(codexHome, "config.toml");
   const result = registerTrustEntry({ configPath, projectDir: ctx.projectDir });
   return {
     trustEntry: {
@@ -1272,8 +1489,8 @@ function runCodexOptIn(ctx) {
 
 // src/codex/transform.ts
 init_esm_shims();
-import { chmodSync, existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
-import { basename as basename2, join as join5 } from "path";
+import { chmodSync, existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
+import { basename as basename2, join as join6 } from "path";
 
 // src/codex/config-toml.ts
 init_esm_shims();
@@ -1341,13 +1558,14 @@ function quoteIfNeeded(name) {
 var HOOK_NAMES = ["session-start"];
 var ENV_VAR_RENAME = /CLAUDE_PROJECT_DIR/g;
 function runCodexTransform(params) {
-  const { harnessRoot, projectDir, selectedInternalSkills = [] } = params;
-  const claudeMd = readRequired(join5(harnessRoot, "templates/CLAUDE.md"));
-  const agentsTemplate = readRequired(join5(harnessRoot, "templates/codex/AGENTS.md.template"));
-  const configTemplate = readRequired(join5(harnessRoot, "templates/codex/config.toml.template"));
+  const { harnessRoot, projectDir, selectedInternalSkills = [], baseline } = params;
+  const writer = createOwnedWriter(projectDir, baseline);
+  const claudeMd = readRequired(join6(harnessRoot, "templates/CLAUDE.md"));
+  const agentsTemplate = readRequired(join6(harnessRoot, "templates/codex/AGENTS.md.template"));
+  const configTemplate = readRequired(join6(harnessRoot, "templates/codex/config.toml.template"));
   const projectName = basename2(projectDir);
-  const mcp = readOptionalJson(join5(harnessRoot, ".mcp.json"));
-  const agentsMdPath = join5(projectDir, "AGENTS.md");
+  const mcp = readOptionalJson(join6(harnessRoot, ".mcp.json"));
+  const agentsMdPath = join6(projectDir, "AGENTS.md");
   ensureDir(projectDir);
   const agentsMdOut = renderAgentsMd({
     template: agentsTemplate,
@@ -1355,11 +1573,9 @@ function runCodexTransform(params) {
     projectName,
     projectContext: renderFillScaffold()
   });
-  backupFileIfChanged(agentsMdPath, agentsMdOut);
-  writeFileSync3(agentsMdPath, agentsMdOut);
-  const configTomlPath = join5(projectDir, ".codex/config.toml");
-  ensureDir(join5(projectDir, ".codex"));
-  writeFileSync3(
+  writer.write(agentsMdPath, agentsMdOut);
+  const configTomlPath = join6(projectDir, ".codex/config.toml");
+  writer.write(
     configTomlPath,
     renderConfigToml({
       template: configTemplate,
@@ -1368,46 +1584,49 @@ function runCodexTransform(params) {
       mcp
     })
   );
-  const hookDir = join5(projectDir, ".codex/hooks");
-  ensureDir(hookDir);
+  const hookDir = join6(projectDir, ".codex/hooks");
   const hookFiles = [];
   for (const hook of HOOK_NAMES) {
-    const src = join5(harnessRoot, "templates/hooks", `${hook}.sh`);
-    if (!existsSync5(src)) {
+    const src = join6(harnessRoot, "templates/hooks", `${hook}.sh`);
+    if (!existsSync7(src)) {
       continue;
     }
-    const ported = readFileSync4(src, "utf8").replace(ENV_VAR_RENAME, "CODEX_PROJECT_DIR");
-    const target = join5(hookDir, `${hook}.sh`);
-    writeFileSync3(target, ported);
+    const ported = readFileSync6(src, "utf8").replace(ENV_VAR_RENAME, "CODEX_PROJECT_DIR");
+    const target = join6(hookDir, `${hook}.sh`);
+    writer.write(target, ported);
     chmodSync(target, 493);
     hookFiles.push(target);
   }
   const skillFiles = [];
   for (const id of selectedInternalSkills) {
-    const src = join5(harnessRoot, "templates/skills", id, "SKILL.md");
-    if (!existsSync5(src)) {
+    const src = join6(harnessRoot, "templates/skills", id, "SKILL.md");
+    if (!existsSync7(src)) {
       continue;
     }
-    const skillDir = join5(projectDir, ".agents", "skills", id);
-    ensureDir(skillDir);
-    const target = join5(skillDir, "SKILL.md");
-    writeFileSync3(target, renderBundledSkill(readFileSync4(src, "utf8")));
+    const target = join6(projectDir, ".agents", "skills", id, "SKILL.md");
+    writer.write(target, renderBundledSkill(readFileSync6(src, "utf8")));
     skillFiles.push(target);
   }
-  return { agentsMdPath, configTomlPath, hookFiles, skillFiles };
+  return {
+    agentsMdPath,
+    configTomlPath,
+    hookFiles,
+    skillFiles,
+    ownership: writer.result()
+  };
 }
 function readRequired(path) {
-  if (!existsSync5(path)) {
+  if (!existsSync7(path)) {
     throw new Error(`Codex transform: required source missing: ${path}`);
   }
-  return readFileSync4(path, "utf8");
+  return readFileSync6(path, "utf8");
 }
 function readOptionalJson(path) {
-  if (!existsSync5(path)) {
+  if (!existsSync7(path)) {
     return null;
   }
   try {
-    return JSON.parse(readFileSync4(path, "utf8"));
+    return JSON.parse(readFileSync6(path, "utf8"));
   } catch {
     return null;
   }
@@ -1415,8 +1634,8 @@ function readOptionalJson(path) {
 
 // src/env-files.ts
 init_esm_shims();
-import { appendFileSync, existsSync as existsSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { join as join6 } from "path";
+import { appendFileSync, existsSync as existsSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
+import { join as join7 } from "path";
 var ENV_EXAMPLE_BODY = `# .env.example \u2014 csr-supabase Track
 # Copy to .env (gitignored) and fill in values: cp .env.example .env
 
@@ -1453,24 +1672,24 @@ function writeEnvExample(projectDir, tracks) {
   if (!tracks.some((t) => ENV_EXAMPLE_TRACKS.includes(t))) {
     return false;
   }
-  const path = join6(projectDir, ".env.example");
-  if (existsSync6(path)) {
+  const path = join7(projectDir, ".env.example");
+  if (existsSync8(path)) {
     return false;
   }
   writeFileSync4(path, ENV_EXAMPLE_BODY);
   return true;
 }
 function addGitignoreEnv(projectDir) {
-  const path = join6(projectDir, ".gitignore");
-  if (!existsSync6(path)) {
+  const path = join7(projectDir, ".gitignore");
+  if (!existsSync8(path)) {
     return false;
   }
-  const content = readFileSync5(path, "utf8");
+  const content = readFileSync7(path, "utf8");
   if (GITIGNORE_ENV_PATTERN.test(content)) {
     return false;
   }
-  const sep = content.endsWith("\n") ? "" : "\n";
-  appendFileSync(path, `${sep}
+  const sep2 = content.endsWith("\n") ? "" : "\n";
+  appendFileSync(path, `${sep2}
 # Secret env (auto-added by agent-harness install)
 .env
 `);
@@ -1479,11 +1698,11 @@ function addGitignoreEnv(projectDir) {
 var NPX_SKILLS_AGENT_DIRS = [".factory/", ".goose/"];
 var GITIGNORE_NPX_SKILLS_HEADER = "# npx skills add multi-CLI cache (auto-added by agent-harness)";
 function addGitignoreNpxSkillsAgents(projectDir) {
-  const path = join6(projectDir, ".gitignore");
-  if (!existsSync6(path)) {
+  const path = join7(projectDir, ".gitignore");
+  if (!existsSync8(path)) {
     return [];
   }
-  const content = readFileSync5(path, "utf8");
+  const content = readFileSync7(path, "utf8");
   const missing = NPX_SKILLS_AGENT_DIRS.filter((pattern) => {
     const lineRegex = new RegExp(`^${pattern.replace(/\./g, "\\.").replace(/\//g, "/")}\\s*$`, "m");
     return !lineRegex.test(content);
@@ -1491,25 +1710,25 @@ function addGitignoreNpxSkillsAgents(projectDir) {
   if (missing.length === 0) {
     return [];
   }
-  const sep = content.endsWith("\n") ? "" : "\n";
+  const sep2 = content.endsWith("\n") ? "" : "\n";
   const block = [GITIGNORE_NPX_SKILLS_HEADER, ...missing].join("\n");
-  appendFileSync(path, `${sep}
+  appendFileSync(path, `${sep2}
 ${block}
 `);
   return [...missing];
 }
 function writeMcpAllowlist(projectDir) {
-  const allowlistPath = join6(projectDir, ".mcp-allowlist");
-  if (existsSync6(allowlistPath)) {
+  const allowlistPath = join7(projectDir, ".mcp-allowlist");
+  if (existsSync8(allowlistPath)) {
     return null;
   }
-  const mcpPath = join6(projectDir, ".mcp.json");
-  if (!existsSync6(mcpPath)) {
+  const mcpPath = join7(projectDir, ".mcp.json");
+  if (!existsSync8(mcpPath)) {
     return null;
   }
   let names = [];
   try {
-    const parsed = JSON.parse(readFileSync5(mcpPath, "utf8"));
+    const parsed = JSON.parse(readFileSync7(mcpPath, "utf8"));
     names = Object.keys(parsed.mcpServers ?? {}).sort();
   } catch {
     return null;
@@ -1532,9 +1751,9 @@ function writeMcpAllowlist(projectDir) {
 // src/external-installer.ts
 init_esm_shims();
 import { spawnSync } from "child_process";
-import { existsSync as existsSync7, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync9, readdirSync as readdirSync2, readFileSync as readFileSync8 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 var DEFAULT_SPAWN_TIMEOUT_MS = 12e4;
 function selectExternalTargets(assets, ctx) {
   const conditionPassed = filterApplicableAssets(assets, ctx).filter(
@@ -1610,8 +1829,8 @@ function installOne(asset, ctx) {
         cwd
       );
     case "shell-script": {
-      const scriptPath = join7(ctx.harnessRoot, method.script);
-      if (!existsSync7(scriptPath)) {
+      const scriptPath = join8(ctx.harnessRoot, method.script);
+      if (!existsSync9(scriptPath)) {
         return {
           asset,
           ok: false,
@@ -1701,17 +1920,17 @@ function detectVersion(method, spawn) {
         if (at2 <= 0) return void 0;
         const plugin = method.pluginId.slice(0, at2);
         const marketplaceShort = method.pluginId.slice(at2 + 1);
-        const cacheBase = join7(homedir2(), ".claude/plugins/cache", marketplaceShort, plugin);
-        if (!existsSync7(cacheBase)) return void 0;
+        const cacheBase = join8(homedir2(), ".claude/plugins/cache", marketplaceShort, plugin);
+        if (!existsSync9(cacheBase)) return void 0;
         const versions = readdirSync2(cacheBase).filter((v2) => /^\d/.test(v2)).sort();
         return versions.at(-1);
       }
       case "npm": {
         const npmRoot = getNpmGlobalRoot(spawn);
         if (!npmRoot) return void 0;
-        const pkgJson = join7(npmRoot, method.pkg, "package.json");
-        if (!existsSync7(pkgJson)) return void 0;
-        const parsed = JSON.parse(readFileSync6(pkgJson, "utf8"));
+        const pkgJson = join8(npmRoot, method.pkg, "package.json");
+        if (!existsSync9(pkgJson)) return void 0;
+        const parsed = JSON.parse(readFileSync8(pkgJson, "utf8"));
         return parsed.version;
       }
       default:
@@ -1736,156 +1955,9 @@ function getNpmGlobalRoot(spawn) {
   return void 0;
 }
 
-// src/install-log.ts
-init_esm_shims();
-import { createHash } from "crypto";
-import { existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname3, join as join8 } from "path";
-var INSTALL_LOG_FILENAME = ".harness-install.json";
-var INSTALL_LOG_VERSION = 1;
-function buildAssetEntries(report, scope) {
-  if (!report) return [];
-  return report.attempted.filter((r) => r.ok).map((r) => assetToLogEntry(r.asset, scope, r.version));
-}
-function assetToLogEntry(asset, scope, version) {
-  const detail = methodDetail(asset.method);
-  const entry = {
-    id: asset.id,
-    category: asset.category,
-    method: asset.method.kind,
-    scope,
-    detail
-  };
-  if (version) entry.version = version;
-  return entry;
-}
-function methodDetail(method) {
-  switch (method.kind) {
-    case "plugin":
-      return { marketplace: method.marketplace, pluginId: method.pluginId };
-    case "skill":
-      return { source: method.source, ...method.skill ? { skill: method.skill } : {} };
-    case "npm":
-      return { pkg: method.pkg };
-    case "npx-run":
-      return { cmd: method.cmd, args: (method.args ?? []).join(" ") };
-    case "shell-script":
-      return { script: method.script, args: method.args.join(" ") };
-    case "internal":
-      return { key: method.key };
-  }
-}
-function buildInstallLog(spec, external, scope, rootClaudeMd, previous, claudeDirMovedAside = false, rootFiles = []) {
-  const templates = {
-    claudeDir: ".claude/",
-    ...spec.cli.includes("codex") ? { codexDir: ".codex/" } : {},
-    ...spec.cli.includes("opencode") ? { opencodeDir: ".opencode/" } : {},
-    ...rootClaudeMd ? { rootClaudeMd } : {}
-  };
-  const log = {
-    schemaVersion: INSTALL_LOG_VERSION,
-    installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    scope,
-    spec: {
-      tracks: spec.tracks,
-      cli: spec.cli
-    },
-    // 이번 설치가 만든 항목이 이기고, 이번에 안 만든 항목은 이전 값을 그대로 둔다.
-    // (예: claude 로 깔고 나중에 codex 만 추가 설치해도 root CLAUDE.md 기록이 살아남는다)
-    templates: { ...previous?.templates, ...templates },
-    assets: mergeAssets(
-      claudeDirMovedAside ? previous?.assets?.filter(survivesClaudeDirRename) : previous?.assets,
-      buildAssetEntries(external, scope)
-    )
-  };
-  const mergedRootFiles = mergeRootFiles(previous?.rootFiles, rootFiles);
-  if (mergedRootFiles.length > 0) log.rootFiles = mergedRootFiles;
-  return log;
-}
-function mergeRootFiles(previous, current) {
-  const byPath = /* @__PURE__ */ new Map();
-  for (const file of [...previous ?? [], ...current]) {
-    const prior = byPath.get(file.path);
-    byPath.set(
-      file.path,
-      prior ? {
-        path: file.path,
-        change: prior.change === "created" ? "created" : file.change,
-        notes: [.../* @__PURE__ */ new Set([...prior.notes, ...file.notes])]
-      } : file
-    );
-  }
-  return [...byPath.values()];
-}
-function survivesClaudeDirRename(asset) {
-  if (asset.scope === "global") return true;
-  switch (asset.method) {
-    case "plugin":
-      return true;
-    // `~/.claude/plugins/cache` — 프로젝트 밖
-    case "npm":
-      return true;
-    // `node_modules/`
-    case "skill":
-      return false;
-    // `npx skills add` project scope → `.claude/skills/`
-    case "shell-script":
-      return false;
-    // ecc-prune → `.claude/local-plugins/`
-    case "npx-run":
-      return false;
-    case "internal":
-      return false;
-  }
-}
-function mergeAssets(previous, current) {
-  if (!previous || previous.length === 0) return [...current];
-  const currentById = new Map(current.map((a) => [a.id, a]));
-  const previousIds = new Set(previous.map((a) => a.id));
-  return [
-    ...previous.map((a) => currentById.get(a.id) ?? a),
-    ...current.filter((a) => !previousIds.has(a.id))
-  ];
-}
-function hashContent(content) {
-  return createHash("sha256").update(content, "utf8").digest("hex");
-}
-function collectSkillHashes(projectDir) {
-  const skillsDir = join8(projectDir, ".claude/skills");
-  return listFilesRecursive(skillsDir).map((rel) => ({
-    path: rel,
-    sha256: hashContent(readFileSync7(join8(skillsDir, rel), "utf8"))
-  }));
-}
-function writeInstallLog(projectDir, log) {
-  const path = join8(projectDir, ".claude", INSTALL_LOG_FILENAME);
-  mkdirSync3(dirname3(path), { recursive: true });
-  writeFileSync5(path, `${JSON.stringify(log, null, 2)}
-`, "utf8");
-  return path;
-}
-function readInstallLog(projectDir) {
-  const path = join8(projectDir, ".claude", INSTALL_LOG_FILENAME);
-  if (!existsSync8(path)) return null;
-  try {
-    const parsed = JSON.parse(readFileSync7(path, "utf8"));
-    if (Array.isArray(parsed.assets)) {
-      parsed.assets = parsed.assets.map(
-        (a) => a.method === "npm-global" ? { ...a, method: "npm" } : a
-      );
-    }
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function installLogPath(projectDir) {
-  return join8(projectDir, ".claude", INSTALL_LOG_FILENAME);
-}
-
 // src/mcp-merge.ts
 init_esm_shims();
-import { existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "fs";
 function parseTrackMcpMap(raw) {
   const rows = [];
   for (const line of raw.split(/\r?\n/)) {
@@ -1936,15 +2008,15 @@ function mergeMcpServers(base, rows, tracks) {
   return out;
 }
 function composeMcpJson(opts) {
-  const base = JSON.parse(readFileSync8(opts.templateMcpPath, "utf8"));
-  const merged = opts.existingPath && existsSync9(opts.existingPath) ? mergeUserBase(base, opts.existingPath) : base;
-  const mapRaw = existsSync9(opts.trackMapPath) ? readFileSync8(opts.trackMapPath, "utf8") : "";
+  const base = JSON.parse(readFileSync9(opts.templateMcpPath, "utf8"));
+  const merged = opts.existingPath && existsSync10(opts.existingPath) ? mergeUserBase(base, opts.existingPath) : base;
+  const mapRaw = existsSync10(opts.trackMapPath) ? readFileSync9(opts.trackMapPath, "utf8") : "";
   const rows = parseTrackMcpMap(mapRaw);
   return mergeMcpServers(merged, rows, opts.tracks);
 }
 function mergeUserBase(base, existingPath) {
   try {
-    const existing = JSON.parse(readFileSync8(existingPath, "utf8"));
+    const existing = JSON.parse(readFileSync9(existingPath, "utf8"));
     return {
       ...base,
       mcpServers: { ...base.mcpServers, ...existing.mcpServers }
@@ -1954,13 +2026,13 @@ function mergeUserBase(base, existingPath) {
   }
 }
 function writeMcpJson(path, mcp) {
-  writeFileSync6(path, `${JSON.stringify(mcp, null, 2)}
+  writeFileSync5(path, `${JSON.stringify(mcp, null, 2)}
 `);
 }
 
 // src/opencode/transform.ts
 init_esm_shims();
-import { existsSync as existsSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
 import { basename as basename3, join as join9 } from "path";
 
 // src/opencode/agents-md.ts
@@ -2061,7 +2133,8 @@ function parseTemplate(template) {
 
 // src/opencode/transform.ts
 function runOpencodeTransform(params) {
-  const { harnessRoot, projectDir, selectedInternalSkills = [] } = params;
+  const { harnessRoot, projectDir, selectedInternalSkills = [], baseline } = params;
+  const writer = createOwnedWriter(projectDir, baseline);
   const claudeMd = readRequired2(join9(harnessRoot, "templates/CLAUDE.md"));
   const agentsTemplate = readRequired2(join9(harnessRoot, "templates/opencode/AGENTS.md.template"));
   const opencodeTemplate = readRequired2(
@@ -2077,40 +2150,41 @@ function runOpencodeTransform(params) {
     projectName,
     projectContext: renderFillScaffold()
   });
-  backupFileIfChanged(agentsMdPath, agentsMdOut);
-  writeFileSync7(agentsMdPath, agentsMdOut);
+  writer.write(agentsMdPath, agentsMdOut);
   const opencodeJsonPath = join9(projectDir, "opencode.json");
-  writeFileSync7(opencodeJsonPath, renderOpencodeJson({ template: opencodeTemplate, mcp }));
+  writer.write(opencodeJsonPath, renderOpencodeJson({ template: opencodeTemplate, mcp }));
   const cmdDir = join9(projectDir, ".opencode/commands");
   ensureDir(cmdDir);
   const commandFiles = [];
   for (const id of selectedInternalSkills) {
     const src = join9(harnessRoot, "templates/skills", id, "SKILL.md");
-    if (!existsSync10(src)) {
+    if (!existsSync11(src)) {
       continue;
     }
     const target = join9(cmdDir, `${id}.md`);
-    const shellDependent = existsSync10(join9(harnessRoot, "templates/skills", id, "scripts"));
-    writeFileSync7(
-      target,
-      renderCommandFromSkill(readFileSync9(src, "utf8"), id, { shellDependent })
-    );
+    const shellDependent = existsSync11(join9(harnessRoot, "templates/skills", id, "scripts"));
+    writer.write(target, renderCommandFromSkill(readFileSync10(src, "utf8"), id, { shellDependent }));
     commandFiles.push(target);
   }
-  return { agentsMdPath, opencodeJsonPath, commandFiles };
+  return {
+    agentsMdPath,
+    opencodeJsonPath,
+    commandFiles,
+    ownership: writer.result()
+  };
 }
 function readRequired2(path) {
-  if (!existsSync10(path)) {
+  if (!existsSync11(path)) {
     throw new Error(`OpenCode transform: required source missing: ${path}`);
   }
-  return readFileSync9(path, "utf8");
+  return readFileSync10(path, "utf8");
 }
 function readOptionalJson2(path) {
-  if (!existsSync10(path)) {
+  if (!existsSync11(path)) {
     return null;
   }
   try {
-    return JSON.parse(readFileSync9(path, "utf8"));
+    return JSON.parse(readFileSync10(path, "utf8"));
   } catch {
     return null;
   }
@@ -2144,14 +2218,14 @@ function addPreToolUseHook(settings, matcher, command) {
 init_esm_shims();
 import {
   copyFileSync as copyFileSync2,
-  existsSync as existsSync11,
-  mkdirSync as mkdirSync4,
+  existsSync as existsSync12,
+  mkdirSync as mkdirSync5,
   readdirSync as readdirSync3,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync11,
   unlinkSync,
-  writeFileSync as writeFileSync8
+  writeFileSync as writeFileSync6
 } from "fs";
-import { dirname as dirname4, join as join10 } from "path";
+import { dirname as dirname5, join as join10 } from "path";
 function buildUpdateSpec(projectDir, tracks) {
   return {
     tracks: [...tracks],
@@ -2167,38 +2241,21 @@ function runUpdateMode(projectDir, templatesDir) {
     pruned: {},
     staleHookRefs: [],
     claudeMdUpdated: false,
-    skillsBackedUp: []
+    skillsBackedUp: [],
+    policyBackedUp: []
   };
-  const targets = [
-    {
-      target: join10(claudeDir, "rules"),
-      source: join10(templatesDir, "rules"),
-      pattern: ".md",
-      label: ".claude/rules"
-    },
-    {
-      target: join10(claudeDir, "agents"),
-      source: join10(templatesDir, "agents"),
-      pattern: ".md",
-      label: ".claude/agents"
-    },
-    {
-      target: join10(claudeDir, "commands/uzys"),
-      source: join10(templatesDir, "commands/uzys"),
-      pattern: ".md",
-      label: ".claude/commands/uzys"
-    },
-    {
-      target: join10(claudeDir, "hooks"),
-      source: join10(templatesDir, "hooks"),
-      pattern: ".sh",
-      label: ".claude/hooks"
-    }
-  ];
-  for (const t of targets) {
-    report.updated[t.label] = updateDir(t.target, t.source, t.pattern);
-    report.pruned[t.label] = pruneOrphans(t.target, t.source, t.pattern);
-  }
+  const policyBase = policyBaseline(projectDir);
+  for (const { dir, ext } of POLICY_DIRS) {
+    const target = join10(claudeDir, dir);
+    const source = join10(templatesDir, dir);
+    const label = `.claude/${dir}`;
+    const ctx = { prefix: dir, baseline: policyBase };
+    const synced = updateDir(target, source, ext, ctx);
+    report.updated[label] = synced.updated;
+    report.policyBackedUp.push(...synced.backedUp);
+    report.pruned[label] = pruneOrphans(target, source, ext, ctx);
+  }
+  refreshPolicyBaseline(projectDir, templatesDir);
   const skillSync = syncSkills(
     join10(claudeDir, "skills"),
     join10(templatesDir, "skills"),
@@ -2209,55 +2266,66 @@ function runUpdateMode(projectDir, templatesDir) {
   refreshSkillBaseline(projectDir);
   const claudeMd = join10(claudeDir, "CLAUDE.md");
   const templateMd = join10(templatesDir, "CLAUDE.md");
-  if (existsSync11(claudeMd) && existsSync11(templateMd)) {
+  if (existsSync12(claudeMd) && existsSync12(templateMd)) {
     copyFileSync2(templateMd, claudeMd);
     report.claudeMdUpdated = true;
   }
   const settingsPath = join10(claudeDir, "settings.json");
-  if (existsSync11(settingsPath)) {
+  if (existsSync12(settingsPath)) {
     report.staleHookRefs = cleanStaleHookRefs(settingsPath, join10(claudeDir, "hooks"));
   }
   return report;
 }
-function updateDir(target, source, ext) {
-  if (!existsSync11(target) || !existsSync11(source)) return 0;
-  let count = 0;
+function isHarnessOwned2(ctx, rel, current) {
+  const recorded = ctx.baseline.get(`${ctx.prefix}/${rel}`);
+  return recorded !== void 0 && recorded === hashContent(current);
+}
+function updateDir(target, source, ext, ctx, now = /* @__PURE__ */ new Date()) {
+  if (!existsSync12(target) || !existsSync12(source)) return { updated: 0, backedUp: [] };
+  let updated = 0;
+  const backedUp = [];
   for (const file of readdirSync3(target)) {
     if (!file.endsWith(ext)) continue;
     const targetFile = join10(target, file);
     const sourceFile = join10(source, file);
-    if (existsSync11(sourceFile)) {
-      copyFileSync2(sourceFile, targetFile);
-      count++;
+    if (!existsSync12(sourceFile)) continue;
+    const next = readFileSync11(sourceFile, "utf8");
+    const current = readFileSync11(targetFile, "utf8");
+    if (current === next) continue;
+    if (!isHarnessOwned2(ctx, file, current)) {
+      backupFile(targetFile, now);
+      backedUp.push(`${ctx.prefix}/${file}`);
     }
+    writeFileSync6(targetFile, next);
+    updated++;
   }
-  return count;
+  return { updated, backedUp };
 }
 function syncSkills(targetDir, sourceDir, baseline, now = /* @__PURE__ */ new Date()) {
-  if (!existsSync11(targetDir) || !existsSync11(sourceDir)) return { updated: 0, backedUp: [] };
+  if (!existsSync12(targetDir) || !existsSync12(sourceDir)) return { updated: 0, backedUp: [] };
   let updated = 0;
   const backedUp = [];
   for (const skill of readdirSync3(sourceDir, { withFileTypes: true })) {
     if (!skill.isDirectory()) continue;
     const targetSkill = join10(targetDir, skill.name);
-    if (!existsSync11(targetSkill)) continue;
+    if (!existsSync12(targetSkill)) continue;
     for (const rel of listFilesRecursive(join10(sourceDir, skill.name))) {
       const targetFile = join10(targetSkill, rel);
-      const next = readFileSync10(join10(sourceDir, skill.name, rel), "utf8");
-      if (!existsSync11(targetFile)) {
-        mkdirSync4(dirname4(targetFile), { recursive: true });
-        writeFileSync8(targetFile, next);
+      const next = readFileSync11(join10(sourceDir, skill.name, rel), "utf8");
+      if (!existsSync12(targetFile)) {
+        mkdirSync5(dirname5(targetFile), { recursive: true });
+        writeFileSync6(targetFile, next);
         updated++;
         continue;
       }
-      const current = readFileSync10(targetFile, "utf8");
+      const current = readFileSync11(targetFile, "utf8");
       if (current === next) continue;
       const recorded = baseline.get(`${skill.name}/${rel}`);
       if (recorded === void 0 || hashContent(current) !== recorded) {
         backupFile(targetFile, now);
         backedUp.push(`${skill.name}/${rel}`);
       }
-      writeFileSync8(targetFile, next);
+      writeFileSync6(targetFile, next);
       updated++;
     }
   }
@@ -2267,6 +2335,22 @@ function skillBaseline(projectDir) {
   const log = readInstallLog(projectDir);
   return new Map((log?.skillFiles ?? []).map((f) => [f.path, f.sha256]));
 }
+function policyBaseline(projectDir) {
+  const log = readInstallLog(projectDir);
+  return new Map((log?.policyFiles ?? []).map((f) => [f.path, f.sha256]));
+}
+function refreshPolicyBaseline(projectDir, templatesDir) {
+  const log = readInstallLog(projectDir);
+  if (!log) return;
+  const policyFiles = collectPolicyHashes(projectDir, templatesDir);
+  const next = { ...log };
+  if (policyFiles.length > 0) next.policyFiles = policyFiles;
+  else delete next.policyFiles;
+  try {
+    writeInstallLog(projectDir, next);
+  } catch {
+  }
+}
 function refreshSkillBaseline(projectDir) {
   const log = readInstallLog(projectDir);
   if (!log) return;
@@ -2279,15 +2363,18 @@ function refreshSkillBaseline(projectDir) {
   } catch {
   }
 }
-function pruneOrphans(target, source, ext) {
-  if (!existsSync11(target) || !existsSync11(source)) return [];
+function pruneOrphans(target, source, ext, ctx, now = /* @__PURE__ */ new Date()) {
+  if (!existsSync12(target) || !existsSync12(source)) return [];
   const removed = [];
   for (const file of readdirSync3(target)) {
     if (!file.endsWith(ext)) continue;
     const sourceFile = join10(source, file);
-    if (!existsSync11(sourceFile)) {
+    if (!existsSync12(sourceFile)) {
       const targetFile = join10(target, file);
+      if (!ctx.baseline.has(`${ctx.prefix}/${file}`)) continue;
       try {
+        const current = readFileSync11(targetFile, "utf8");
+        if (!isHarnessOwned2(ctx, file, current)) backupFile(targetFile, now);
         unlinkSync(targetFile);
         removed.push(file);
       } catch {
@@ -2299,7 +2386,7 @@ function pruneOrphans(target, source, ext) {
 function cleanStaleHookRefs(settingsPath, hooksDir) {
   let settings;
   try {
-    settings = JSON.parse(readFileSync10(settingsPath, "utf8"));
+    settings = JSON.parse(readFileSync11(settingsPath, "utf8"));
   } catch {
     return [];
   }
@@ -2318,7 +2405,7 @@ function cleanStaleHookRefs(settingsPath, hooksDir) {
   }
   if (removed.length > 0) {
     const next = { ...settings, hooks: cleanedHooks };
-    writeFileSync8(settingsPath, `${JSON.stringify(next, null, 2)}
+    writeFileSync6(settingsPath, `${JSON.stringify(next, null, 2)}
 `);
   }
   return removed;
@@ -2327,7 +2414,7 @@ function keepHookRef(hook, hooksDir, removed) {
   const refMatch = (hook?.command ?? "").match(/\/\.claude\/hooks\/([^"\s/]+\.sh)/);
   if (!refMatch?.[1]) return true;
   const fname = refMatch[1];
-  const exists = existsSync11(join10(hooksDir, fname));
+  const exists = existsSync12(join10(hooksDir, fname));
   if (!exists && !removed.includes(fname)) removed.push(fname);
   return exists;
 }
@@ -2340,11 +2427,11 @@ function runInstall(ctx) {
   const { harnessRoot, projectDir, spec } = ctx;
   const mode = ctx.mode ?? "fresh";
   const templatesDir = join11(harnessRoot, "templates");
-  if (!existsSync12(templatesDir)) {
+  if (!existsSync13(templatesDir)) {
     throw new Error(`Templates dir not found: ${templatesDir}`);
   }
   const claudeDir = join11(projectDir, ".claude");
-  if (mode === "update" && !existsSync12(claudeDir)) {
+  if (mode === "update" && !existsSync13(claudeDir)) {
     throw new Error(`Update mode requires existing .claude/ at ${claudeDir}`);
   }
   const previousLog = readInstallLog(projectDir);
@@ -2353,13 +2440,21 @@ function runInstall(ctx) {
     return runUpdateInstall(ctx, templatesDir, backupPath);
   }
   const manifestSpec = buildManifestSpec(spec);
-  const base = spec.cli.includes("claude") ? installClaudeBaseline(manifestSpec, projectDir, templatesDir) : emptyClaudeBaseline();
+  const policyBase = new Map((previousLog?.policyFiles ?? []).map((f) => [f.path, f.sha256]));
+  const base = spec.cli.includes("claude") ? installClaudeBaseline(manifestSpec, projectDir, templatesDir, policyBase) : emptyClaudeBaseline();
   const mcpResult = composeAndWriteMcp(harnessRoot, projectDir, spec);
   const ciScaffold = isAssetSelected("ci-scaffold", {
     tracks: spec.tracks,
     options: spec.options,
     ...spec.userOverride ? { userOverride: spec.userOverride } : {}
   }) ? installCiScaffold({ harnessRoot, projectDir, tracks: spec.tracks }) : null;
+  const { externalFiles, externalBackups, ...cliTransforms } = runCliTransforms(
+    spec,
+    harnessRoot,
+    projectDir,
+    manifestSpec.selectedInternalSkills,
+    previousLog?.externalFiles ?? []
+  );
   const baseline = {
     filesCopied: base.filesCopied,
     dirsCopied: base.dirsCopied,
@@ -2367,20 +2462,23 @@ function runInstall(ctx) {
     backup: backupPath,
     installedTracks: [...spec.tracks].sort(),
     mcpServers: Object.keys(mcpResult.mcpServers).sort(),
-    ...runCliTransforms(spec, harnessRoot, projectDir, manifestSpec.selectedInternalSkills),
+    ...cliTransforms,
     ciScaffold,
     updateMode: null,
     mode,
     envFiles: writeEnvironmentFiles(projectDir, spec.tracks),
     categories: base.categories,
     rootClaudeMd: base.rootClaudeMd,
-    backups: base.backups
+    // 외부 CLI 백업도 같은 줄에 노출한다 — 백업이 화면에 안 보이면 사용자는 자기 편집분이
+    // 어디 갔는지 알 수 없고, 그러면 백업은 있어도 없는 것과 같다 (ADR-046/047 과 같은 이유).
+    backups: [...base.backups, ...externalBackups]
   };
   ctx.onProgress?.({ type: "baseline-complete", baseline });
   const external = runExternalPhase(ctx);
   const karpathyHook = wireKarpathyHook(spec, external, harnessRoot, projectDir);
   writeInstallLogSafe(
     ctx,
+    externalFiles,
     external,
     base.rootClaudeMdLog,
     previousLog,
@@ -2453,7 +2551,21 @@ function emptyClaudeBaseline() {
     backups: []
   };
 }
-function installClaudeBaseline(manifestSpec, projectDir, templatesDir) {
+function backupEditedPolicyFile(entryTarget, target, source, baseline) {
+  const prefix = ".claude/";
+  if (!entryTarget.startsWith(prefix)) return null;
+  const rel = entryTarget.slice(prefix.length);
+  if (!POLICY_DIRS.some(({ dir, ext }) => rel.startsWith(`${dir}/`) && rel.endsWith(ext))) {
+    return null;
+  }
+  if (!existsSync13(target)) return null;
+  const current = readFileSync12(target, "utf-8");
+  if (current === readFileSync12(source, "utf-8")) return null;
+  const recorded = baseline.get(rel);
+  if (recorded !== void 0 && recorded === hashContent(current)) return null;
+  return backupFile(target);
+}
+function installClaudeBaseline(manifestSpec, projectDir, templatesDir, policyBase) {
   ensureProjectSkeleton(projectDir);
   const result = emptyClaudeBaseline();
   const manifest = buildManifest(manifestSpec);
@@ -2463,13 +2575,18 @@ function installClaudeBaseline(manifestSpec, projectDir, templatesDir) {
     }
     const source = join11(templatesDir, entry.source);
     const target = join11(projectDir, entry.target);
-    if (!existsSync12(source)) {
+    if (!existsSync13(source)) {
       result.skipped += 1;
       continue;
     }
     if (entry.type === "file") {
       if (entry.target === ".claude/settings.json") {
-        const backup = backupFileIfChanged(target, readFileSync11(source, "utf-8"));
+        const backup = backupFileIfChanged(target, readFileSync12(source, "utf-8"));
+        if (backup) {
+          result.backups.push(backup);
+        }
+      } else {
+        const backup = backupEditedPolicyFile(entry.target, target, source, policyBase);
         if (backup) {
           result.backups.push(backup);
         }
@@ -2483,7 +2600,7 @@ function installClaudeBaseline(manifestSpec, projectDir, templatesDir) {
     accumulateCategory(result.categories, entry);
   }
   const hookDir = join11(projectDir, ".claude/hooks");
-  if (existsSync12(hookDir)) {
+  if (existsSync13(hookDir)) {
     chmodHooksSync(hookDir);
   }
   writeInstalledTracks(projectDir, manifestSpec.tracks);
@@ -2504,15 +2621,27 @@ function writeEnvironmentFiles(projectDir, tracks) {
     gitignoreNpxSkillsAdded: addGitignoreNpxSkillsAgents(projectDir)
   };
 }
-function runCliTransforms(spec, harnessRoot, projectDir, selectedInternalSkills) {
+function runCliTransforms(spec, harnessRoot, projectDir, selectedInternalSkills, previousExternal) {
+  const baseline = new Map(previousExternal.map((f) => [f.path, f.sha256]));
+  const externalFiles = [];
+  const externalBackups = [];
+  const absorb = (report) => {
+    for (const f of report.ownership.files) {
+      baseline.set(f.path, f.sha256);
+      externalFiles.push(f);
+    }
+    externalBackups.push(...report.ownership.backupPaths);
+  };
   let codex = null;
   let codexOptIn = null;
   if (spec.cli.includes("codex")) {
     codex = runCodexTransform({
       harnessRoot,
       projectDir,
-      selectedInternalSkills
+      selectedInternalSkills,
+      baseline
     });
+    absorb(codex);
     const installScope = spec.scope ?? "project";
     if (installScope === "global" && spec.options.withCodexTrust) {
       codexOptIn = runCodexOptIn({ projectDir });
@@ -2520,17 +2649,20 @@ function runCliTransforms(spec, harnessRoot, projectDir, selectedInternalSkills)
   }
   let opencode = null;
   if (spec.cli.includes("opencode")) {
-    opencode = runOpencodeTransform({ harnessRoot, projectDir, selectedInternalSkills });
+    opencode = runOpencodeTransform({ harnessRoot, projectDir, selectedInternalSkills, baseline });
+    absorb(opencode);
   }
   let antigravity = null;
   if (spec.cli.includes("antigravity")) {
     antigravity = runAntigravityTransform({
       harnessRoot,
       projectDir,
-      selectedInternalSkills
+      selectedInternalSkills,
+      baseline
     });
+    absorb(antigravity);
   }
-  return { codex, codexOptIn, opencode, antigravity };
+  return { codex, codexOptIn, opencode, antigravity, externalFiles, externalBackups };
 }
 function runExternalPhase(ctx) {
   if (ctx.runExternal === null) {
@@ -2568,7 +2700,7 @@ function runExternalPhase(ctx) {
   ctx.onProgress?.({ type: "external-complete", report: external });
   return external;
 }
-function writeInstallLogSafe(ctx, external, rootClaudeMdLog, previousLog, claudeDirMovedAside, rootFiles) {
+function writeInstallLogSafe(ctx, externalFiles, external, rootClaudeMdLog, previousLog, claudeDirMovedAside, rootFiles) {
   try {
     const log = buildInstallLog(
       ctx.spec,
@@ -2580,7 +2712,14 @@ function writeInstallLogSafe(ctx, external, rootClaudeMdLog, previousLog, claude
       rootFiles
     );
     const skillFiles = collectSkillHashes(ctx.projectDir);
-    writeInstallLog(ctx.projectDir, skillFiles.length > 0 ? { ...log, skillFiles } : log);
+    const policyFiles = collectPolicyHashes(ctx.projectDir, join11(ctx.harnessRoot, "templates"));
+    const merged = mergeExternalFiles(ctx.projectDir, previousLog?.externalFiles, externalFiles);
+    writeInstallLog(ctx.projectDir, {
+      ...log,
+      ...skillFiles.length > 0 ? { skillFiles } : {},
+      ...policyFiles.length > 0 ? { policyFiles } : {},
+      ...merged.length > 0 ? { externalFiles: merged } : {}
+    });
   } catch (e2) {
     ctx.onProgress?.({
       type: "install-log-error",
@@ -2605,7 +2744,7 @@ function wireKarpathyHook(spec, external, harnessRoot, projectDir) {
   const sourceHook = join11(harnessRoot, "templates/hooks/karpathy-gate.sh");
   const targetHook = join11(projectDir, KARPATHY_HOOK_RELPATH);
   let hookScriptCopied = false;
-  if (existsSync12(sourceHook)) {
+  if (existsSync13(sourceHook)) {
     copyFile(sourceHook, targetHook);
     try {
       chmodSync2(targetHook, 493);
@@ -2615,8 +2754,8 @@ function wireKarpathyHook(spec, external, harnessRoot, projectDir) {
   }
   const settingsPath = join11(projectDir, ".claude/settings.json");
   let settingsUpdated = false;
-  if (existsSync12(settingsPath)) {
-    const raw = readFileSync11(settingsPath, "utf8");
+  if (existsSync13(settingsPath)) {
+    const raw = readFileSync12(settingsPath, "utf8");
     let before;
     try {
       before = JSON.parse(raw);
@@ -2627,7 +2766,7 @@ function wireKarpathyHook(spec, external, harnessRoot, projectDir) {
     const beforeStr = JSON.stringify(before);
     const afterStr = JSON.stringify(after);
     if (beforeStr !== afterStr) {
-      writeFileSync9(settingsPath, `${JSON.stringify(after, null, 2)}
+      writeFileSync7(settingsPath, `${JSON.stringify(after, null, 2)}
 `);
       settingsUpdated = true;
     }
@@ -2636,7 +2775,7 @@ function wireKarpathyHook(spec, external, harnessRoot, projectDir) {
 }
 function composeAndWriteMcp(harnessRoot, projectDir, spec) {
   const mcpPath = join11(projectDir, ".mcp.json");
-  const created = !existsSync12(mcpPath);
+  const created = !existsSync13(mcpPath);
   const composed = composeMcpJson({
     templateMcpPath: join11(harnessRoot, "templates/mcp.json"),
     trackMapPath: join11(harnessRoot, "templates/track-mcp-map.tsv"),
@@ -2700,16 +2839,16 @@ function accumulateCategory(cats, entry) {
 }
 function writeInstalledTracks(projectDir, tracks) {
   const path = join11(projectDir, ".claude/.installed-tracks");
-  mkdirSync5(dirname5(path), { recursive: true });
+  mkdirSync6(dirname6(path), { recursive: true });
   const sorted = [...new Set(tracks)].sort().join("\n");
-  writeFileSync9(path, `${sorted}
+  writeFileSync7(path, `${sorted}
 `);
 }
 function writeRootClaudeMd(projectDir, tracks) {
   const content = mergeProjectClaude(tracks, { projectName: basename4(projectDir) });
   const target = join11(projectDir, "CLAUDE.md");
   const backup = backupFileIfChanged(target, content);
-  writeFileSync9(target, content);
+  writeFileSync7(target, content);
   return { content, backup };
 }
 function chmodHooksSync(hookDir) {
@@ -3033,6 +3172,15 @@ function renderPhase1Rows(log, baseline, verbose = false, withEcc = false, claud
         )
       );
     }
+    if (baseline.updateMode.policyBackedUp.length > 0) {
+      log(
+        assetRow(
+          "skip",
+          "edited policy files",
+          `${baseline.updateMode.policyBackedUp.length} backed up as *.backup-<time>`
+        )
+      );
+    }
     if (baseline.updateMode.staleHookRefs.length > 0) {
       log(
         assetRow(
@@ -3381,7 +3529,7 @@ function registerInstallCommand(cli2) {
 
 // src/commands/list.ts
 init_esm_shims();
-import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
 import { join as join12, resolve as resolve3 } from "path";
 function listAction(options = {}, deps = {}) {
   const log = deps.log ?? console.log;
@@ -3446,7 +3594,7 @@ function formatTemplateRows(log, projectDir) {
   const rootMd = log.templates.rootClaudeMd;
   if (rootMd) {
     const path = join12(projectDir, rootMd.path);
-    const modified = existsSync13(path) && hashContent(readFileSync12(path, "utf8")) !== rootMd.sha256;
+    const modified = existsSync14(path) && hashContent(readFileSync13(path, "utf8")) !== rootMd.sha256;
     rows.push(
       modified ? `    ${c.dim(rootMd.path)}  ${c.yellow("(\uC218\uC815\uB428 \u2014 uninstall \uC2DC \uBCF4\uC874)")}` : `    ${c.dim(rootMd.path)}`
     );
@@ -3454,7 +3602,7 @@ function formatTemplateRows(log, projectDir) {
   return rows;
 }
 function formatRootFileRows(rootFiles, projectDir) {
-  const present = rootFiles.filter((f) => existsSync13(join12(projectDir, f.path)));
+  const present = rootFiles.filter((f) => existsSync14(join12(projectDir, f.path)));
   const width = Math.max(0, ...present.map((f) => f.path.length));
   return present.map(
     (f) => `    ${c.dim(padDisplay(f.path, width))}  ${c.dim(f.change === "created" ? "\uC0DD\uC131" : "\uBCD1\uD569")}  ${c.dim(f.notes.join(" / "))}`
@@ -3471,7 +3619,7 @@ function registerListCommand(cli2) {
 // src/commands/uninstall.ts
 init_esm_shims();
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync14, readFileSync as readFileSync13, rmSync } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync14, rmSync } from "fs";
 import { join as join13, resolve as resolve4 } from "path";
 
 // src/uninstall-interactive.ts
@@ -4757,7 +4905,7 @@ function advisoryLines(plan, targetAssets, projectDir, templatesKept, rootFiles)
   return lines;
 }
 function rootFileAdvisoryLines(rootFiles, projectDir) {
-  const present = rootFiles.filter((f) => existsSync14(join13(projectDir, f.path)));
+  const present = rootFiles.filter((f) => existsSync15(join13(projectDir, f.path)));
   if (present.length === 0) return [];
   return [
     "",
@@ -4830,9 +4978,9 @@ function buildProjectReverseStep(asset, spawn) {
 }
 function settingsHasHookCommand(projectDir, command) {
   const path = join13(projectDir, ".claude", "settings.json");
-  if (!existsSync14(path)) return false;
+  if (!existsSync15(path)) return false;
   try {
-    const parsed = JSON.parse(readFileSync13(path, "utf8"));
+    const parsed = JSON.parse(readFileSync14(path, "utf8"));
     return Object.values(parsed.hooks ?? {}).some(
       (matchers) => matchers.some((m) => m.hooks?.some((h2) => h2.command === command))
     );
@@ -4857,7 +5005,7 @@ function manualAdvisoryLines(targetAssets, projectDir) {
       `.claude/settings.json \u2014 hooks.PreToolUse \uC5D0\uC11C \uB2E4\uC74C command \uD56D\uBAA9 \uC0AD\uC81C:
       ${KARPATHY_HOOK_COMMAND}`
     );
-  if (existsSync14(join13(projectDir, KARPATHY_HOOK_RELPATH)))
+  if (existsSync15(join13(projectDir, KARPATHY_HOOK_RELPATH)))
     items.push(`\`${KARPATHY_HOOK_RELPATH}\` \u2014 \uC0AD\uC81C`);
   if (items.length === 0) return [];
   return [
@@ -4901,8 +5049,8 @@ function rootClaudeMdModified(log, projectDir) {
   const rootMd = log.templates.rootClaudeMd;
   if (!rootMd) return false;
   const path = join13(projectDir, rootMd.path);
-  if (!existsSync14(path)) return false;
-  return hashContent(readFileSync13(path, "utf8")) !== rootMd.sha256;
+  if (!existsSync15(path)) return false;
+  return hashContent(readFileSync14(path, "utf8")) !== rootMd.sha256;
 }
 function formatTemplateList(log) {
   const items = [log.templates.claudeDir];
@@ -4914,7 +5062,7 @@ function defaultSpawn2(cmd, args) {
   return spawnSync2(cmd, [...args], { encoding: "utf8", stdio: "pipe", timeout: 12e4 });
 }
 function defaultRm(path) {
-  if (existsSync14(path)) {
+  if (existsSync15(path)) {
     rmSync(path, { recursive: true, force: true });
   }
 }
@@ -4962,7 +5110,7 @@ import { resolve as resolve5 } from "path";
 
 // src/state.ts
 init_esm_shims();
-import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync15 } from "fs";
 import { join as join14 } from "path";
 var META_FILE = ".claude/.installed-tracks";
 var LEGACY_SIGNATURES = [
@@ -4974,12 +5122,12 @@ var LEGACY_SIGNATURES = [
 ];
 function detectInstallState(projectDir) {
   const claudeDir = join14(projectDir, ".claude");
-  const hasClaudeDir = existsSync15(claudeDir);
+  const hasClaudeDir = existsSync16(claudeDir);
   if (!hasClaudeDir) {
     return { state: "new", tracks: [], source: "none", hasClaudeDir: false };
   }
   const metaPath = join14(projectDir, META_FILE);
-  if (existsSync15(metaPath)) {
+  if (existsSync16(metaPath)) {
     const tracks2 = readMetafile(metaPath);
     return { state: "existing", tracks: tracks2, source: "metafile", hasClaudeDir: true };
   }
@@ -4987,7 +5135,7 @@ function detectInstallState(projectDir) {
   return { state: "existing", tracks, source: "legacy", hasClaudeDir: true };
 }
 function readMetafile(path) {
-  const raw = readFileSync14(path, "utf8");
+  const raw = readFileSync15(path, "utf8");
   const seen = /* @__PURE__ */ new Set();
   for (const line of raw.split(/\s+/)) {
     const trimmed = line.trim();
@@ -4999,12 +5147,12 @@ function readMetafile(path) {
 }
 function inferFromLegacySignatures(projectDir) {
   const rulesDir = join14(projectDir, ".claude/rules");
-  if (!existsSync15(rulesDir)) {
+  if (!existsSync16(rulesDir)) {
     return [];
   }
   const found = /* @__PURE__ */ new Set();
   for (const sig of LEGACY_SIGNATURES) {
-    if (existsSync15(join14(rulesDir, sig.rule))) {
+    if (existsSync16(join14(rulesDir, sig.rule))) {
       found.add(sig.track);
     }
   }