@uzysjung/agent-harness 26.146.0 → 26.147.0

package/dist/index.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import {
+  ALL_RULES,
   CATEGORIES,
   CATEGORY_TITLES,
   CLI_BASES,
@@ -8,7 +9,9 @@ import {
   EXTERNAL_ASSETS,
   HARNESS_ANCHOR_FILE,
   HARNESS_IMPORT_LINE,
+  INSTALL_LOG_DIR,
   INTERNAL_BUNDLED_SKILL_IDS,
+  POLICY_DIRS,
   TRACKS,
   __commonJS,
   __toESM,
@@ -16,23 +19,44 @@ import {
   assetCliSupport,
   assetReachesCli,
   assetTrustTier,
+  backupDir,
+  backupFile,
+  backupFileIfChanged,
+  buildInstallLog,
   buildManifest,
+  collectPolicyHashes,
+  collectSkillHashes,
+  copyBackupDir,
+  copyDir,
+  copyFile,
+  ensureDir,
+  ensureProjectSkeleton,
   experimentalOptInCandidates,
   filterApplicableAssets,
   formatResidentCostLine,
   hasUiTrack,
+  hashContent,
   init_esm_shims,
+  installLogPath,
   isAssetSelected,
   isCliBase,
+  isCliNeutralTarget,
+  isHarnessOwned,
   isInstallScope,
   isTrack,
+  legacyInstallLogPath,
+  listFilesRecursive,
+  mergeExternalFiles,
+  readInstallLog,
   renderFillScaffold,
   residentCost,
+  resolveRules,
   resolveScope,
   stripHarnessImport,
   summarizeContextCost,
-  upsertHarnessImport
-} from "./chunk-OEIGA5IL.js";
+  upsertHarnessImport,
+  writeInstallLog
+} from "./chunk-GPH5AWLX.js";
 
 // node_modules/sisteransi/src/index.js
 var require_src = __commonJS({
@@ -717,7 +741,7 @@ var cac = (name = "") => new CAC(name);
 // package.json
 var package_default = {
   name: "@uzysjung/agent-harness",
-  version: "26.146.0",
+  version: "26.147.0",
   description: "Curate vetted AI-coding skills & plugins by your tech stack \u2014 install only what you need, across Claude Code, Codex, OpenCode & Antigravity",
   type: "module",
   publishConfig: {
@@ -750,7 +774,9 @@ var package_default = {
     ci: "npm run typecheck && npm run lint && npm run test:coverage && npm run build",
     prepare: "[ -d dist ] || npm run build",
     "cost:report": "npm run build && node scripts/context-cost-report.mjs",
-    "cost:baseline": "npm run build && node scripts/context-cost-baseline.mjs"
+    "cost:baseline": "npm run build && node scripts/context-cost-baseline.mjs",
+    security: "npm audit --omit=dev --audit-level=high && npx --yes ecc-agentshield@1.4.0 scan --baseline security-baseline.json --gate",
+    "security:baseline": "npx --yes ecc-agentshield@1.4.0 scan --save-baseline security-baseline.json"
   },
   dependencies: {
     "@clack/prompts": "^1.3.0",
@@ -776,6 +802,46 @@ init_esm_shims();
 import { resolve as resolve2 } from "path";
 import { fileURLToPath } from "url";
 
+// src/baseline-targets.ts
+init_esm_shims();
+var BASELINE_KINDS = ["rules", "agents", "hooks", "skills"];
+var BASELINE_PREFIX = "baseline:";
+var PREFIX_BY_KIND = [
+  ["rules", ".claude/rules/"],
+  ["agents", ".claude/agents/"],
+  ["hooks", ".claude/hooks/"],
+  ["skills", ".claude/skills/"]
+];
+function classifyBaselineTarget(target) {
+  for (const [kind, prefix] of PREFIX_BY_KIND) {
+    if (!target.startsWith(prefix)) continue;
+    const rest = target.slice(prefix.length);
+    if (rest === "") return null;
+    const first = rest.split("/")[0] ?? "";
+    const name = kind === "skills" ? first : first.replace(/\.(md|sh)$/, "");
+    if (name === "") return null;
+    return { id: `${BASELINE_PREFIX}${kind}/${name}`, kind, name };
+  }
+  return null;
+}
+function listBaselineTargets(spec) {
+  const byId = /* @__PURE__ */ new Map();
+  for (const entry of buildManifest(spec)) {
+    if (!entry.applies(spec)) continue;
+    const t = classifyBaselineTarget(entry.target);
+    if (t && !byId.has(t.id)) byId.set(t.id, t);
+  }
+  const order = new Map(BASELINE_KINDS.map((k2, i) => [k2, i]));
+  return [...byId.values()].sort(
+    (a, b2) => (order.get(a.kind) ?? 0) - (order.get(b2.kind) ?? 0) || a.name.localeCompare(b2.name)
+  );
+}
+function isBaselineExcluded(target, excluded) {
+  if (excluded.size === 0) return false;
+  const t = classifyBaselineTarget(target);
+  return t !== null && excluded.has(t.id);
+}
+
 // src/cli-targets.ts
 init_esm_shims();
 var CLI_BASE_SORT_ORDER = {
@@ -913,127 +979,18 @@ init_esm_shims();
 import {
   chmodSync as chmodSync2,
   existsSync as existsSync13,
-  mkdirSync as mkdirSync6,
-  readdirSync as readdirSync4,
+  mkdirSync as mkdirSync4,
+  readdirSync as readdirSync3,
   readFileSync as readFileSync12,
-  writeFileSync as writeFileSync7
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync6
 } from "fs";
-import { basename as basename5, dirname as dirname6, join as join11, resolve } from "path";
+import { basename as basename5, dirname as dirname4, join as join11, resolve } from "path";
 
 // src/ci-scaffold.ts
 init_esm_shims();
-import { existsSync as existsSync2 } from "fs";
-import { join as join2 } from "path";
-
-// src/fs-ops.ts
-init_esm_shims();
-import {
-  copyFileSync,
-  cpSync,
-  existsSync,
-  constants as fsConstants,
-  mkdirSync,
-  readdirSync,
-  readFileSync,
-  realpathSync,
-  renameSync,
-  rmdirSync
-} from "fs";
-import { dirname, join } from "path";
-function ensureDir(path) {
-  mkdirSync(path, { recursive: true });
-}
-function copyFile(source, target) {
-  if (!existsSync(source)) {
-    throw new Error(`Source not found: ${source}`);
-  }
-  mkdirSync(dirname(target), { recursive: true });
-  copyFileSync(source, target);
-}
-function copyDir(source, target) {
-  if (!existsSync(source)) {
-    throw new Error(`Source dir not found: ${source}`);
-  }
-  mkdirSync(target, { recursive: true });
-  cpSync(source, target, { recursive: true, force: true });
-}
-var MAX_BACKUP_CLAIMS = 100;
-function claimBackupPath(base, claim) {
-  for (let n = 1; n <= MAX_BACKUP_CLAIMS; n++) {
-    const candidate = n === 1 ? base : `${base}-${n}`;
-    try {
-      claim(candidate);
-      return candidate;
-    } catch (err) {
-      if (err.code !== "EEXIST") throw err;
-    }
-  }
-  throw new Error(`Cannot allocate a backup path for ${base} (${MAX_BACKUP_CLAIMS} taken)`);
-}
-function backupDir(target, now = /* @__PURE__ */ new Date()) {
-  if (!existsSync(target)) {
-    return null;
-  }
-  const backup = claimBackupPath(`${target}.backup-${formatStamp(now)}`, (c3) => mkdirSync(c3));
-  rmdirSync(backup);
-  renameSync(target, backup);
-  return backup;
-}
-function copyBackupDir(target, now = /* @__PURE__ */ new Date()) {
-  if (!existsSync(target)) {
-    return null;
-  }
-  const backup = claimBackupPath(`${target}.backup-${formatStamp(now)}`, (c3) => mkdirSync(c3));
-  cpSync(realpathSync(target), backup, { recursive: true });
-  return backup;
-}
-function backupFileIfChanged(target, newContent, now = /* @__PURE__ */ new Date()) {
-  if (!existsSync(target)) {
-    return null;
-  }
-  if (readFileSync(target, "utf-8") === newContent) {
-    return null;
-  }
-  return backupFile(target, now);
-}
-function backupFile(target, now = /* @__PURE__ */ new Date()) {
-  return claimBackupPath(
-    `${target}.backup-${formatStamp(now)}`,
-    (c3) => copyFileSync(target, c3, fsConstants.COPYFILE_EXCL)
-  );
-}
-function listFilesRecursive(dir, prefix = "") {
-  if (!existsSync(dir)) return [];
-  const out = [];
-  for (const entry of readdirSync(dir, { withFileTypes: true })) {
-    const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
-    if (entry.isDirectory()) {
-      out.push(...listFilesRecursive(join(dir, entry.name), rel));
-    } else if (entry.isFile()) {
-      out.push(rel);
-    }
-  }
-  return out;
-}
-function formatStamp(now) {
-  return now.toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z").slice(0, 15);
-}
-function ensureProjectSkeleton(projectDir) {
-  const dirs = [
-    ".claude/commands/uzys",
-    ".claude/commands/ecc",
-    ".claude/rules",
-    ".claude/skills",
-    ".claude/agents",
-    ".claude/hooks",
-    "docs/decisions"
-  ];
-  for (const d2 of dirs) {
-    mkdirSync(join(projectDir, d2), { recursive: true });
-  }
-}
-
-// src/ci-scaffold.ts
+import { existsSync } from "fs";
+import { join } from "path";
 var PYTHON_TRACKS = "data|csr-fastapi|full";
 var VARIANTS = [
   {
@@ -1057,12 +1014,12 @@ function installCiScaffold(ctx) {
   for (const v2 of VARIANTS) {
     if (!v2.applies(ctx.tracks)) continue;
     const relTarget = `.github/workflows/${v2.target}`;
-    const target = join2(ctx.projectDir, relTarget);
-    if (existsSync2(target)) {
+    const target = join(ctx.projectDir, relTarget);
+    if (existsSync(target)) {
       report.skippedExisting.push(relTarget);
       continue;
     }
-    copyFile(join2(ctx.harnessRoot, "templates/github-workflows", v2.source), target);
+    copyFile(join(ctx.harnessRoot, "templates/github-workflows", v2.source), target);
     report.written.push(relTarget);
   }
   return report;
@@ -1073,8 +1030,8 @@ init_esm_shims();
 
 // src/antigravity/transform.ts
 init_esm_shims();
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { basename, join as join4 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { basename, join as join3 } from "path";
 
 // src/codex/agents-md.ts
 init_esm_shims();
@@ -1083,7 +1040,7 @@ function renameSlashes(text) {
 }
 function renderAgentsMd(params) {
   const body = params.claudeMd.replace(/^#\s+.*\r?\n/, "").trim();
-  const replaced = params.template.replaceAll("{PROJECT_NAME}", params.projectName).replaceAll("{PROJECT_RULES}", body).replaceAll("{PROJECT_CONTEXT}", params.projectContext);
+  const replaced = params.template.replaceAll("{PROJECT_NAME}", params.projectName).replaceAll("{PROJECT_RULES}", body).replaceAll("{PROJECT_CONTEXT}", params.projectContext).replaceAll("{HARNESS_RULES}", params.harnessRules ?? "");
   return renameSlashes(replaced);
 }
 
@@ -1119,204 +1076,8 @@ function portBody(body) {
 
 // src/owned-write.ts
 init_esm_shims();
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname3, relative, sep } from "path";
-
-// src/install-log.ts
-init_esm_shims();
-import { createHash } from "crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs";
-import { dirname as dirname2, join as join3 } from "path";
-var INSTALL_LOG_FILENAME = ".harness-install.json";
-var INSTALL_LOG_DIR = ".uzys-agent-harness";
-var LEGACY_INSTALL_LOG_DIR = ".claude";
-var INSTALL_LOG_VERSION = 1;
-var POLICY_DIRS = [
-  { dir: "rules", ext: ".md" },
-  { dir: "agents", ext: ".md" },
-  { dir: "commands/uzys", ext: ".md" },
-  { dir: "hooks", ext: ".sh" }
-];
-function buildAssetEntries(report, scope) {
-  if (!report) return [];
-  return report.attempted.filter((r) => r.ok).map((r) => assetToLogEntry(r.asset, scope, r.version));
-}
-function assetToLogEntry(asset, scope, version) {
-  const detail = methodDetail(asset.method);
-  const entry = {
-    id: asset.id,
-    category: asset.category,
-    method: asset.method.kind,
-    scope,
-    detail
-  };
-  if (version) entry.version = version;
-  return entry;
-}
-function methodDetail(method) {
-  switch (method.kind) {
-    case "plugin":
-      return { marketplace: method.marketplace, pluginId: method.pluginId };
-    case "skill":
-      return { source: method.source, ...method.skill ? { skill: method.skill } : {} };
-    case "npm":
-      return { pkg: method.pkg };
-    case "npx-run":
-      return { cmd: method.cmd, args: (method.args ?? []).join(" ") };
-    case "shell-script":
-      return { script: method.script, args: method.args.join(" ") };
-    case "internal":
-      return { key: method.key };
-  }
-}
-function buildInstallLog(spec, external, scope, rootClaudeMd, previous, claudeDirMovedAside = false, rootFiles = []) {
-  const templates = {
-    claudeDir: ".claude/",
-    ...spec.cli.includes("codex") ? { codexDir: ".codex/" } : {},
-    ...spec.cli.includes("opencode") ? { opencodeDir: ".opencode/" } : {},
-    ...rootClaudeMd ? { rootClaudeMd } : {}
-  };
-  const log = {
-    schemaVersion: INSTALL_LOG_VERSION,
-    installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    scope,
-    spec: {
-      tracks: spec.tracks,
-      cli: spec.cli
-    },
-    // 이번 설치가 만든 항목이 이기고, 이번에 안 만든 항목은 이전 값을 그대로 둔다.
-    // (예: claude 로 깔고 나중에 codex 만 추가 설치해도 root CLAUDE.md 기록이 살아남는다)
-    templates: { ...previous?.templates, ...templates },
-    assets: mergeAssets(
-      claudeDirMovedAside ? previous?.assets?.filter(survivesClaudeDirRename) : previous?.assets,
-      buildAssetEntries(external, scope)
-    )
-  };
-  const mergedRootFiles = mergeRootFiles(previous?.rootFiles, rootFiles);
-  if (mergedRootFiles.length > 0) log.rootFiles = mergedRootFiles;
-  return log;
-}
-function mergeRootFiles(previous, current) {
-  const byPath = /* @__PURE__ */ new Map();
-  for (const file of [...previous ?? [], ...current]) {
-    const prior = byPath.get(file.path);
-    byPath.set(
-      file.path,
-      prior ? {
-        path: file.path,
-        change: prior.change === "created" ? "created" : file.change,
-        notes: [.../* @__PURE__ */ new Set([...prior.notes, ...file.notes])]
-      } : file
-    );
-  }
-  return [...byPath.values()];
-}
-function survivesClaudeDirRename(asset) {
-  if (asset.scope === "global") return true;
-  switch (asset.method) {
-    case "plugin":
-      return true;
-    // `~/.claude/plugins/cache` — 프로젝트 밖
-    case "npm":
-      return true;
-    // `node_modules/`
-    case "skill":
-      return false;
-    // `npx skills add` project scope → `.claude/skills/`
-    case "shell-script":
-      return false;
-    // ecc-prune → `.claude/local-plugins/`
-    case "npx-run":
-      return false;
-    case "internal":
-      return false;
-  }
-}
-function mergeAssets(previous, current) {
-  if (!previous || previous.length === 0) return [...current];
-  const currentById = new Map(current.map((a) => [a.id, a]));
-  const previousIds = new Set(previous.map((a) => a.id));
-  return [
-    ...previous.map((a) => currentById.get(a.id) ?? a),
-    ...current.filter((a) => !previousIds.has(a.id))
-  ];
-}
-function hashContent(content) {
-  return createHash("sha256").update(content, "utf8").digest("hex");
-}
-function isHarnessOwned(baseline, key, current) {
-  const recorded = baseline.get(key);
-  return recorded !== void 0 && recorded === hashContent(current);
-}
-function mergeExternalFiles(projectDir, previous, current) {
-  const byPath = /* @__PURE__ */ new Map();
-  for (const file of [...previous ?? [], ...current]) byPath.set(file.path, file);
-  return [...byPath.values()].filter((f) => existsSync3(join3(projectDir, f.path)));
-}
-function collectSkillHashes(projectDir) {
-  const skillsDir = join3(projectDir, ".claude/skills");
-  return listFilesRecursive(skillsDir).map((rel) => ({
-    path: rel,
-    sha256: hashContent(readFileSync2(join3(skillsDir, rel), "utf8"))
-  }));
-}
-function collectPolicyHashes(projectDir, templatesDir) {
-  const out = [];
-  for (const { dir, ext } of POLICY_DIRS) {
-    const targetDir = join3(projectDir, ".claude", dir);
-    const sourceDir = join3(templatesDir, dir);
-    for (const rel of listFilesRecursive(targetDir)) {
-      if (!rel.endsWith(ext)) continue;
-      if (!existsSync3(join3(sourceDir, rel))) continue;
-      out.push({
-        path: `${dir}/${rel}`,
-        sha256: hashContent(readFileSync2(join3(targetDir, rel), "utf8"))
-      });
-    }
-  }
-  return out;
-}
-function writeInstallLog(projectDir, log) {
-  const path = installLogPath(projectDir);
-  mkdirSync2(dirname2(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(log, null, 2)}
-`, "utf8");
-  migrateAwayLegacyLog(projectDir);
-  return path;
-}
-function migrateAwayLegacyLog(projectDir) {
-  const legacy = legacyInstallLogPath(projectDir);
-  if (!existsSync3(legacy)) return;
-  try {
-    rmSync(legacy);
-  } catch {
-  }
-}
-function readInstallLog(projectDir) {
-  const path = [installLogPath(projectDir), legacyInstallLogPath(projectDir)].find(
-    (p2) => existsSync3(p2)
-  );
-  if (!path) return null;
-  try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    if (Array.isArray(parsed.assets)) {
-      parsed.assets = parsed.assets.map(
-        (a) => a.method === "npm-global" ? { ...a, method: "npm" } : a
-      );
-    }
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function installLogPath(projectDir) {
-  return join3(projectDir, INSTALL_LOG_DIR, INSTALL_LOG_FILENAME);
-}
-function legacyInstallLogPath(projectDir) {
-  return join3(projectDir, LEGACY_INSTALL_LOG_DIR, INSTALL_LOG_FILENAME);
-}
-
-// src/owned-write.ts
+import { existsSync as existsSync2, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { dirname, relative, sep } from "path";
 function createOwnedWriter(projectDir, baseline, options = {}) {
   const { now = /* @__PURE__ */ new Date(), refreshOnly = false } = options;
   const written = /* @__PURE__ */ new Map();
@@ -1324,22 +1085,22 @@ function createOwnedWriter(projectDir, baseline, options = {}) {
   const backupPaths = [];
   let updated = 0;
   return {
-    write(absPath, content) {
+    write(absPath, content, opts) {
       const rel = relative(projectDir, absPath).split(sep).join("/");
       const digest = hashContent(content);
-      if (!existsSync4(absPath)) {
-        if (refreshOnly) return false;
-        mkdirSync3(dirname3(absPath), { recursive: true });
-        writeFileSync2(absPath, content);
+      if (!existsSync2(absPath)) {
+        if (refreshOnly && !opts?.createInRefresh) return false;
+        mkdirSync(dirname(absPath), { recursive: true });
+        writeFileSync(absPath, content);
         updated++;
       } else {
-        const current = readFileSync3(absPath, "utf8");
+        const current = readFileSync(absPath, "utf8");
         if (current !== content) {
           if (!isHarnessOwned(baseline, rel, current)) {
             backupPaths.push(backupFile(absPath, now));
             backedUp.push(rel);
           }
-          writeFileSync2(absPath, content);
+          writeFileSync(absPath, content);
           updated++;
         }
       }
@@ -1357,36 +1118,78 @@ function createOwnedWriter(projectDir, baseline, options = {}) {
   };
 }
 
+// src/rules-port.ts
+init_esm_shims();
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+function stripClaudeFrontmatter(source) {
+  if (!source.startsWith("---\n")) return source.trim();
+  const end = source.indexOf("\n---", 4);
+  if (end === -1) return source.trim();
+  return source.slice(end + 4).trim();
+}
+function portRules(harnessRoot, ruleNames) {
+  const ported = [];
+  for (const name of ruleNames) {
+    const src = join2(harnessRoot, "templates/rules", `${name}.md`);
+    if (!existsSync3(src)) continue;
+    ported.push({ name, body: stripClaudeFrontmatter(readFileSync2(src, "utf8")) });
+  }
+  return ported;
+}
+function renderRulesBlock(rules) {
+  if (rules.length === 0) return "";
+  return rules.map((r) => r.body.replace(/^#\s+/, "## ")).join("\n\n---\n\n");
+}
+
 // src/antigravity/transform.ts
 function runAntigravityTransform(params) {
-  const { harnessRoot, projectDir, selectedInternalSkills = [], baseline, refreshOnly } = params;
+  const {
+    harnessRoot,
+    projectDir,
+    selectedInternalSkills = [],
+    rules = [],
+    baseline,
+    refreshOnly
+  } = params;
   const writer = createOwnedWriter(projectDir, baseline, { refreshOnly: refreshOnly ?? false });
   const rulesFile = writeRules(harnessRoot, projectDir, writer);
+  const antigravityInstalled = rulesFile !== null;
+  const harnessRuleFiles = [];
+  for (const rule of portRules(harnessRoot, rules)) {
+    const target = join3(projectDir, ".agents", "rules", `${rule.name}.md`);
+    if (!writer.write(target, `${rule.body}
+`, { createInRefresh: antigravityInstalled })) {
+      continue;
+    }
+    harnessRuleFiles.push(target);
+  }
   const skillFiles = [];
   for (const id of selectedInternalSkills) {
-    const src = join4(harnessRoot, "templates/skills", id, "SKILL.md");
-    if (!existsSync5(src)) {
+    const src = join3(harnessRoot, "templates/skills", id, "SKILL.md");
+    if (!existsSync4(src)) {
       continue;
     }
-    const target = join4(projectDir, ".agents", "skills", id, "SKILL.md");
-    if (!writer.write(target, renderBundledSkill(readFileSync4(src, "utf8")))) continue;
+    const target = join3(projectDir, ".agents", "skills", id, "SKILL.md");
+    if (!writer.write(target, renderBundledSkill(readFileSync3(src, "utf8")))) continue;
     skillFiles.push(target);
   }
   return {
     rulesFile,
+    harnessRuleFiles,
     skillFiles,
     ownership: writer.result()
   };
 }
 function writeRules(harnessRoot, projectDir, writer) {
-  const claudeMdPath = join4(harnessRoot, "templates/CLAUDE.md");
-  const templatePath = join4(harnessRoot, "templates/antigravity/AGENTS.md.template");
-  if (!existsSync5(claudeMdPath) || !existsSync5(templatePath)) {
+  const claudeMdPath = join3(harnessRoot, "templates/CLAUDE.md");
+  const templatePath = join3(harnessRoot, "templates/antigravity/AGENTS.md.template");
+  if (!existsSync4(claudeMdPath) || !existsSync4(templatePath)) {
     return null;
   }
-  const claudeMd = readFileSync4(claudeMdPath, "utf8");
-  const template = readFileSync4(templatePath, "utf8");
-  const target = join4(projectDir, ".agents", "rules", "uzys-harness.md");
+  const claudeMd = readFileSync3(claudeMdPath, "utf8");
+  const template = readFileSync3(templatePath, "utf8");
+  const target = join3(projectDir, ".agents", "rules", "uzys-harness.md");
   const rulesOut = renderAgentsMd({
     template,
     claudeMd,
@@ -1399,18 +1202,18 @@ function writeRules(harnessRoot, projectDir, writer) {
 // src/codex/opt-in.ts
 init_esm_shims();
 import { homedir } from "os";
-import { join as join5 } from "path";
+import { join as join4 } from "path";
 
 // src/codex/trust-entry.ts
 init_esm_shims();
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname4 } from "path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2 } from "path";
 var TRUST_BLOCK_REGEX = /\[projects\."([^"]+)"\]/g;
 function registerTrustEntry(opts) {
   const { configPath, projectDir } = opts;
   try {
-    mkdirSync4(dirname4(configPath), { recursive: true });
-    const existing = existsSync6(configPath) ? readFileSync5(configPath, "utf8") : "";
+    mkdirSync2(dirname2(configPath), { recursive: true });
+    const existing = existsSync5(configPath) ? readFileSync4(configPath, "utf8") : "";
     if (hasTrustEntry(existing, projectDir)) {
       return { status: "already-present" };
     }
@@ -1418,7 +1221,7 @@ function registerTrustEntry(opts) {
 [projects."${projectDir}"]
 trust_level = "trusted"
 `;
-    writeFileSync3(configPath, existing + block);
+    writeFileSync2(configPath, existing + block);
     return { status: "registered" };
   } catch (e2) {
     return {
@@ -1434,8 +1237,8 @@ function hasTrustEntry(configContent, projectDir) {
 
 // src/codex/opt-in.ts
 function runCodexOptIn(ctx) {
-  const codexHome = ctx.codexHome ?? join5(homedir(), ".codex");
-  const configPath = join5(codexHome, "config.toml");
+  const codexHome = ctx.codexHome ?? join4(homedir(), ".codex");
+  const configPath = join4(codexHome, "config.toml");
   const result = registerTrustEntry({ configPath, projectDir: ctx.projectDir });
   return {
     trustEntry: {
@@ -1448,8 +1251,8 @@ function runCodexOptIn(ctx) {
 
 // src/codex/transform.ts
 init_esm_shims();
-import { chmodSync, existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
-import { basename as basename2, join as join6 } from "path";
+import { chmodSync, existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+import { basename as basename2, join as join5 } from "path";
 
 // src/codex/config-toml.ts
 init_esm_shims();
@@ -1517,23 +1320,32 @@ function quoteIfNeeded(name) {
 var HOOK_NAMES = ["session-start"];
 var ENV_VAR_RENAME = /CLAUDE_PROJECT_DIR/g;
 function runCodexTransform(params) {
-  const { harnessRoot, projectDir, selectedInternalSkills = [], baseline, refreshOnly } = params;
+  const {
+    harnessRoot,
+    projectDir,
+    selectedInternalSkills = [],
+    rules = [],
+    baseline,
+    refreshOnly
+  } = params;
   const writer = createOwnedWriter(projectDir, baseline, { refreshOnly: refreshOnly ?? false });
-  const claudeMd = readRequired(join6(harnessRoot, "templates/CLAUDE.md"));
-  const agentsTemplate = readRequired(join6(harnessRoot, "templates/codex/AGENTS.md.template"));
-  const configTemplate = readRequired(join6(harnessRoot, "templates/codex/config.toml.template"));
+  const claudeMd = readRequired(join5(harnessRoot, "templates/CLAUDE.md"));
+  const agentsTemplate = readRequired(join5(harnessRoot, "templates/codex/AGENTS.md.template"));
+  const configTemplate = readRequired(join5(harnessRoot, "templates/codex/config.toml.template"));
   const projectName = basename2(projectDir);
-  const mcp = readOptionalJson(join6(harnessRoot, ".mcp.json"));
-  const agentsMdPath = join6(projectDir, "AGENTS.md");
+  const mcp = readOptionalJson(join5(harnessRoot, ".mcp.json"));
+  const agentsMdPath = join5(projectDir, "AGENTS.md");
   ensureDir(projectDir);
   const agentsMdOut = renderAgentsMd({
     template: agentsTemplate,
     claudeMd,
     projectName,
-    projectContext: renderFillScaffold()
+    projectContext: renderFillScaffold(),
+    // Codex 는 룰 디렉터리가 없다 — 룰이 AGENTS.md 본문에 들어가야 도달한다(§Harness Rules).
+    harnessRules: renderRulesBlock(portRules(harnessRoot, rules))
   });
   writer.write(agentsMdPath, agentsMdOut);
-  const configTomlPath = join6(projectDir, ".codex/config.toml");
+  const configTomlPath = join5(projectDir, ".codex/config.toml");
   writer.write(
     configTomlPath,
     renderConfigToml({
@@ -1543,27 +1355,27 @@ function runCodexTransform(params) {
       mcp
     })
   );
-  const hookDir = join6(projectDir, ".codex/hooks");
+  const hookDir = join5(projectDir, ".codex/hooks");
   const hookFiles = [];
   for (const hook of HOOK_NAMES) {
-    const src = join6(harnessRoot, "templates/hooks", `${hook}.sh`);
-    if (!existsSync7(src)) {
+    const src = join5(harnessRoot, "templates/hooks", `${hook}.sh`);
+    if (!existsSync6(src)) {
       continue;
     }
-    const ported = readFileSync6(src, "utf8").replace(ENV_VAR_RENAME, "CODEX_PROJECT_DIR");
-    const target = join6(hookDir, `${hook}.sh`);
+    const ported = readFileSync5(src, "utf8").replace(ENV_VAR_RENAME, "CODEX_PROJECT_DIR");
+    const target = join5(hookDir, `${hook}.sh`);
     if (!writer.write(target, ported)) continue;
     chmodSync(target, 493);
     hookFiles.push(target);
   }
   const skillFiles = [];
   for (const id of selectedInternalSkills) {
-    const src = join6(harnessRoot, "templates/skills", id, "SKILL.md");
-    if (!existsSync7(src)) {
+    const src = join5(harnessRoot, "templates/skills", id, "SKILL.md");
+    if (!existsSync6(src)) {
       continue;
     }
-    const target = join6(projectDir, ".agents", "skills", id, "SKILL.md");
-    if (!writer.write(target, renderBundledSkill(readFileSync6(src, "utf8")))) continue;
+    const target = join5(projectDir, ".agents", "skills", id, "SKILL.md");
+    if (!writer.write(target, renderBundledSkill(readFileSync5(src, "utf8")))) continue;
     skillFiles.push(target);
   }
   return {
@@ -1575,17 +1387,17 @@ function runCodexTransform(params) {
   };
 }
 function readRequired(path) {
-  if (!existsSync7(path)) {
+  if (!existsSync6(path)) {
     throw new Error(`Codex transform: required source missing: ${path}`);
   }
-  return readFileSync6(path, "utf8");
+  return readFileSync5(path, "utf8");
 }
 function readOptionalJson(path) {
-  if (!existsSync7(path)) {
+  if (!existsSync6(path)) {
     return null;
   }
   try {
-    return JSON.parse(readFileSync6(path, "utf8"));
+    return JSON.parse(readFileSync5(path, "utf8"));
   } catch {
     return null;
   }
@@ -1593,8 +1405,8 @@ function readOptionalJson(path) {
 
 // src/opencode/transform.ts
 init_esm_shims();
-import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
-import { basename as basename3, join as join7 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
+import { basename as basename3, join as join6 } from "path";
 
 // src/opencode/agents-md.ts
 init_esm_shims();
@@ -1603,7 +1415,7 @@ function renameSlashes2(text) {
 }
 function renderAgentsMd2(params) {
   const body = params.claudeMd.replace(/^#\s+.*\r?\n/, "").trim();
-  const replaced = params.template.replaceAll("{PROJECT_NAME}", params.projectName).replaceAll("{PROJECT_RULES}", body).replaceAll("{PROJECT_CONTEXT}", params.projectContext);
+  const replaced = params.template.replaceAll("{PROJECT_NAME}", params.projectName).replaceAll("{PROJECT_RULES}", body).replaceAll("{PROJECT_CONTEXT}", params.projectContext).replaceAll("{HARNESS_RULES}", params.harnessRules ?? "");
   return renameSlashes2(replaced);
 }
 
@@ -1694,39 +1506,50 @@ function parseTemplate(template) {
 
 // src/opencode/transform.ts
 function runOpencodeTransform(params) {
-  const { harnessRoot, projectDir, selectedInternalSkills = [], baseline, refreshOnly } = params;
+  const {
+    harnessRoot,
+    projectDir,
+    selectedInternalSkills = [],
+    rules = [],
+    baseline,
+    refreshOnly
+  } = params;
   const writer = createOwnedWriter(projectDir, baseline, { refreshOnly: refreshOnly ?? false });
-  const claudeMd = readRequired2(join7(harnessRoot, "templates/CLAUDE.md"));
-  const agentsTemplate = readRequired2(join7(harnessRoot, "templates/opencode/AGENTS.md.template"));
+  const claudeMd = readRequired2(join6(harnessRoot, "templates/CLAUDE.md"));
+  const agentsTemplate = readRequired2(join6(harnessRoot, "templates/opencode/AGENTS.md.template"));
   const opencodeTemplate = readRequired2(
-    join7(harnessRoot, "templates/opencode/opencode.json.template")
+    join6(harnessRoot, "templates/opencode/opencode.json.template")
   );
   const projectName = basename3(projectDir);
-  const mcp = readOptionalJson2(join7(harnessRoot, ".mcp.json"));
+  const mcp = readOptionalJson2(join6(harnessRoot, ".mcp.json"));
   ensureDir(projectDir);
-  const agentsMdPath = join7(projectDir, "AGENTS.md");
+  const agentsMdPath = join6(projectDir, "AGENTS.md");
   const agentsMdOut = renderAgentsMd2({
     template: agentsTemplate,
     claudeMd,
     projectName,
-    projectContext: renderFillScaffold()
+    projectContext: renderFillScaffold(),
+    // codex 와 **같은 파일**(프로젝트 루트 `AGENTS.md`)이다. 두 transform 이 서로 다른 본문을
+    // 쓰면 나중에 도는 쪽이 앞선 쪽을 덮어써, codex+opencode 조합에서 룰이 통째로 사라진다
+    // (독립 검증 C-1 실측). 같은 내용을 쓰면 순서가 결과를 바꾸지 않는다.
+    harnessRules: renderRulesBlock(portRules(harnessRoot, rules))
   });
   writer.write(agentsMdPath, agentsMdOut);
-  const opencodeJsonPath = join7(projectDir, "opencode.json");
+  const opencodeJsonPath = join6(projectDir, "opencode.json");
   writer.write(opencodeJsonPath, renderOpencodeJson({ template: opencodeTemplate, mcp }));
-  const cmdDir = join7(projectDir, ".opencode/commands");
+  const cmdDir = join6(projectDir, ".opencode/commands");
   if (!refreshOnly) ensureDir(cmdDir);
   const commandFiles = [];
   for (const id of selectedInternalSkills) {
-    const src = join7(harnessRoot, "templates/skills", id, "SKILL.md");
-    if (!existsSync8(src)) {
+    const src = join6(harnessRoot, "templates/skills", id, "SKILL.md");
+    if (!existsSync7(src)) {
       continue;
     }
-    const target = join7(cmdDir, `${id}.md`);
-    const shellDependent = existsSync8(join7(harnessRoot, "templates/skills", id, "scripts"));
+    const target = join6(cmdDir, `${id}.md`);
+    const shellDependent = existsSync7(join6(harnessRoot, "templates/skills", id, "scripts"));
     const wrote = writer.write(
       target,
-      renderCommandFromSkill(readFileSync7(src, "utf8"), id, { shellDependent })
+      renderCommandFromSkill(readFileSync6(src, "utf8"), id, { shellDependent })
     );
     if (!wrote) continue;
     commandFiles.push(target);
@@ -1739,17 +1562,17 @@ function runOpencodeTransform(params) {
   };
 }
 function readRequired2(path) {
-  if (!existsSync8(path)) {
+  if (!existsSync7(path)) {
     throw new Error(`OpenCode transform: required source missing: ${path}`);
   }
-  return readFileSync7(path, "utf8");
+  return readFileSync6(path, "utf8");
 }
 function readOptionalJson2(path) {
-  if (!existsSync8(path)) {
+  if (!existsSync7(path)) {
     return null;
   }
   try {
-    return JSON.parse(readFileSync7(path, "utf8"));
+    return JSON.parse(readFileSync6(path, "utf8"));
   } catch {
     return null;
   }
@@ -1763,6 +1586,7 @@ function runCliTransforms(params) {
     projectDir,
     cli: cli2,
     selectedInternalSkills,
+    rules,
     previousExternal,
     refreshOnly = false,
     codexTrust = false
@@ -1788,6 +1612,7 @@ function runCliTransforms(params) {
       harnessRoot,
       projectDir,
       selectedInternalSkills,
+      rules,
       baseline,
       refreshOnly
     });
@@ -1802,6 +1627,7 @@ function runCliTransforms(params) {
       harnessRoot,
       projectDir,
       selectedInternalSkills,
+      rules,
       baseline,
       refreshOnly
     });
@@ -1813,6 +1639,7 @@ function runCliTransforms(params) {
       harnessRoot,
       projectDir,
       selectedInternalSkills,
+      rules,
       baseline,
       refreshOnly
     });
@@ -1832,8 +1659,8 @@ function runCliTransforms(params) {
 
 // src/env-files.ts
 init_esm_shims();
-import { appendFileSync, existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
-import { join as join8 } from "path";
+import { appendFileSync, existsSync as existsSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "fs";
+import { join as join7 } from "path";
 var ENV_EXAMPLE_BODY = `# .env.example \u2014 csr-supabase Track
 # Copy to .env (gitignored) and fill in values: cp .env.example .env
 
@@ -1870,19 +1697,19 @@ function writeEnvExample(projectDir, tracks) {
   if (!tracks.some((t) => ENV_EXAMPLE_TRACKS.includes(t))) {
     return false;
   }
-  const path = join8(projectDir, ".env.example");
-  if (existsSync9(path)) {
+  const path = join7(projectDir, ".env.example");
+  if (existsSync8(path)) {
     return false;
   }
-  writeFileSync4(path, ENV_EXAMPLE_BODY);
+  writeFileSync3(path, ENV_EXAMPLE_BODY);
   return true;
 }
 function addGitignoreEnv(projectDir) {
-  const path = join8(projectDir, ".gitignore");
-  if (!existsSync9(path)) {
+  const path = join7(projectDir, ".gitignore");
+  if (!existsSync8(path)) {
     return false;
   }
-  const content = readFileSync8(path, "utf8");
+  const content = readFileSync7(path, "utf8");
   if (GITIGNORE_ENV_PATTERN.test(content)) {
     return false;
   }
@@ -1896,11 +1723,11 @@ function addGitignoreEnv(projectDir) {
 var AGENT_ARTIFACT_DIRS = [".factory/", ".goose/", ".uzys-agent-harness/"];
 var GITIGNORE_AGENT_ARTIFACT_HEADER = "# agent CLI / harness \uC790\uB3D9 \uC0DD\uC131\uBB3C (auto-added by agent-harness)";
 function addGitignoreAgentArtifacts(projectDir) {
-  const path = join8(projectDir, ".gitignore");
-  if (!existsSync9(path)) {
+  const path = join7(projectDir, ".gitignore");
+  if (!existsSync8(path)) {
     return [];
   }
-  const content = readFileSync8(path, "utf8");
+  const content = readFileSync7(path, "utf8");
   const missing = AGENT_ARTIFACT_DIRS.filter((pattern) => {
     const lineRegex = new RegExp(`^${pattern.replace(/\./g, "\\.").replace(/\//g, "/")}\\s*$`, "m");
     return !lineRegex.test(content);
@@ -1915,43 +1742,13 @@ ${block}
 `);
   return [...missing];
 }
-function writeMcpAllowlist(projectDir) {
-  const allowlistPath = join8(projectDir, ".mcp-allowlist");
-  if (existsSync9(allowlistPath)) {
-    return null;
-  }
-  const mcpPath = join8(projectDir, ".mcp.json");
-  if (!existsSync9(mcpPath)) {
-    return null;
-  }
-  let names = [];
-  try {
-    const parsed = JSON.parse(readFileSync8(mcpPath, "utf8"));
-    names = Object.keys(parsed.mcpServers ?? {}).sort();
-  } catch {
-    return null;
-  }
-  if (names.length === 0) {
-    return [];
-  }
-  const body = [
-    "# MCP Server Allowlist \u2014 auto-generated by agent-harness install",
-    "# Referenced by mcp-pre-exec.sh hook. Remove or '#' comment any server you want to block.",
-    "# Deleting this file disables the gate (allows all MCP calls).",
-    "",
-    ...names,
-    ""
-  ].join("\n");
-  writeFileSync4(allowlistPath, body);
-  return names;
-}
 
 // src/external-installer.ts
 init_esm_shims();
 import { spawnSync } from "child_process";
-import { existsSync as existsSync10, readdirSync as readdirSync2, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync9, readdirSync, readFileSync as readFileSync8 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join9 } from "path";
+import { join as join8 } from "path";
 var DEFAULT_SPAWN_TIMEOUT_MS = 12e4;
 function selectExternalTargets(assets, ctx) {
   const conditionPassed = filterApplicableAssets(assets, ctx).filter(
@@ -2027,8 +1824,8 @@ function installOne(asset, ctx) {
         cwd
       );
     case "shell-script": {
-      const scriptPath = join9(ctx.harnessRoot, method.script);
-      if (!existsSync10(scriptPath)) {
+      const scriptPath = join8(ctx.harnessRoot, method.script);
+      if (!existsSync9(scriptPath)) {
         return {
           asset,
           ok: false,
@@ -2118,17 +1915,17 @@ function detectVersion(method, spawn) {
         if (at2 <= 0) return void 0;
         const plugin = method.pluginId.slice(0, at2);
         const marketplaceShort = method.pluginId.slice(at2 + 1);
-        const cacheBase = join9(homedir2(), ".claude/plugins/cache", marketplaceShort, plugin);
-        if (!existsSync10(cacheBase)) return void 0;
-        const versions = readdirSync2(cacheBase).filter((v2) => /^\d/.test(v2)).sort();
+        const cacheBase = join8(homedir2(), ".claude/plugins/cache", marketplaceShort, plugin);
+        if (!existsSync9(cacheBase)) return void 0;
+        const versions = readdirSync(cacheBase).filter((v2) => /^\d/.test(v2)).sort();
         return versions.at(-1);
       }
       case "npm": {
         const npmRoot = getNpmGlobalRoot(spawn);
         if (!npmRoot) return void 0;
-        const pkgJson = join9(npmRoot, method.pkg, "package.json");
-        if (!existsSync10(pkgJson)) return void 0;
-        const parsed = JSON.parse(readFileSync9(pkgJson, "utf8"));
+        const pkgJson = join8(npmRoot, method.pkg, "package.json");
+        if (!existsSync9(pkgJson)) return void 0;
+        const parsed = JSON.parse(readFileSync8(pkgJson, "utf8"));
         return parsed.version;
       }
       default:
@@ -2155,7 +1952,7 @@ function getNpmGlobalRoot(spawn) {
 
 // src/mcp-merge.ts
 init_esm_shims();
-import { existsSync as existsSync11, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "fs";
 function parseTrackMcpMap(raw) {
   const rows = [];
   for (const line of raw.split(/\r?\n/)) {
@@ -2206,15 +2003,15 @@ function mergeMcpServers(base, rows, tracks) {
   return out;
 }
 function composeMcpJson(opts) {
-  const base = JSON.parse(readFileSync10(opts.templateMcpPath, "utf8"));
-  const merged = opts.existingPath && existsSync11(opts.existingPath) ? mergeUserBase(base, opts.existingPath) : base;
-  const mapRaw = existsSync11(opts.trackMapPath) ? readFileSync10(opts.trackMapPath, "utf8") : "";
+  const base = JSON.parse(readFileSync9(opts.templateMcpPath, "utf8"));
+  const merged = opts.existingPath && existsSync10(opts.existingPath) ? mergeUserBase(base, opts.existingPath) : base;
+  const mapRaw = existsSync10(opts.trackMapPath) ? readFileSync9(opts.trackMapPath, "utf8") : "";
   const rows = parseTrackMcpMap(mapRaw);
   return mergeMcpServers(merged, rows, opts.tracks);
 }
 function mergeUserBase(base, existingPath) {
   try {
-    const existing = JSON.parse(readFileSync10(existingPath, "utf8"));
+    const existing = JSON.parse(readFileSync9(existingPath, "utf8"));
     return {
       ...base,
       mcpServers: { ...base.mcpServers, ...existing.mcpServers }
@@ -2224,23 +2021,58 @@ function mergeUserBase(base, existingPath) {
   }
 }
 function writeMcpJson(path, mcp) {
-  writeFileSync5(path, `${JSON.stringify(mcp, null, 2)}
+  writeFileSync4(path, `${JSON.stringify(mcp, null, 2)}
 `);
 }
 
+// src/superseded.ts
+init_esm_shims();
+import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
+import { join as join9 } from "path";
+function sameTracks(a, b2) {
+  if (a.length !== b2.length) return false;
+  const sa = [...a].sort();
+  const sb = [...b2].sort();
+  return sa.every((t, i) => t === sb[i]);
+}
+function policyKey(claudeRelative) {
+  return POLICY_DIRS.some(
+    ({ dir, ext }) => claudeRelative.startsWith(`${dir}/`) && claudeRelative.endsWith(ext)
+  ) ? claudeRelative : null;
+}
+function findSuperseded(projectDir, spec, previous) {
+  if (!previous) return [];
+  if (!sameTracks(previous.spec.tracks, spec.tracks)) return [];
+  const baseline = new Map((previous.policyFiles ?? []).map((f) => [f.path, f.sha256]));
+  if (baseline.size === 0) return [];
+  const out = [];
+  for (const entry of buildManifest(spec)) {
+    if (entry.applies(spec)) continue;
+    const id = classifyBaselineTarget(entry.target)?.id;
+    if (!id) continue;
+    const key = policyKey(entry.target.slice(".claude/".length));
+    if (!key) continue;
+    const abs = join9(projectDir, entry.target);
+    if (!existsSync11(abs)) continue;
+    if (!isHarnessOwned(baseline, key, readFileSync10(abs, "utf-8"))) continue;
+    out.push({ target: entry.target, id, source: entry.source });
+  }
+  return out;
+}
+
 // src/update-mode.ts
 init_esm_shims();
 import {
-  copyFileSync as copyFileSync2,
+  copyFileSync,
   existsSync as existsSync12,
   lstatSync,
-  mkdirSync as mkdirSync5,
-  readdirSync as readdirSync3,
+  mkdirSync as mkdirSync3,
+  readdirSync as readdirSync2,
   readFileSync as readFileSync11,
   unlinkSync,
-  writeFileSync as writeFileSync6
+  writeFileSync as writeFileSync5
 } from "fs";
-import { basename as basename4, dirname as dirname5, join as join10 } from "path";
+import { basename as basename4, dirname as dirname3, join as join10 } from "path";
 var LEGACY_ANCHOR_FILE = ".claude/CLAUDE.md";
 function buildUpdateSpec(projectDir, tracks) {
   return {
@@ -2267,7 +2099,8 @@ function runUpdateMode(projectDir, templatesDir, harnessRoot) {
     externalBackedUp: [],
     installedNew: [],
     restored: [],
-    needsReinstall: []
+    needsReinstall: [],
+    mcpAllowlistRetired: null
   };
   const fresh = installNewAssets(projectDir, templatesDir);
   report.installedNew = fresh.installed;
@@ -2294,11 +2127,15 @@ function runUpdateMode(projectDir, templatesDir, harnessRoot) {
   report.skillsBackedUp = skillSync.backedUp;
   report.skillsSkippedLinks = skillSync.skippedLinks;
   refreshSkillBaseline(projectDir);
-  syncHarnessAnchor(projectDir, templatesDir, report);
+  const installLog = readInstallLog(projectDir);
+  if (existsSync12(claudeDir) && (installLog === null || installLog.spec.cli.includes("claude"))) {
+    syncHarnessAnchor(projectDir, templatesDir, report);
+  }
   const settingsPath = join10(claudeDir, "settings.json");
   if (existsSync12(settingsPath)) {
     report.staleHookRefs = cleanStaleHookRefs(settingsPath, claudeDir);
   }
+  report.mcpAllowlistRetired = retireMcpAllowlist(projectDir);
   const external = refreshExternalCli(projectDir, harnessRoot);
   report.externalUpdated = external.externalUpdated;
   report.externalBackedUp = external.externalBackedUp;
@@ -2308,10 +2145,13 @@ function installNewAssets(projectDir, templatesDir) {
   const installed = [];
   const restored = [];
   const needsReinstall = [];
-  const claudeSelected = readInstallLog(projectDir)?.spec.cli.includes("claude") ?? false;
+  const log = readInstallLog(projectDir);
+  const claudeSelected = log?.spec.cli.includes("claude") ?? false;
+  const baselineExcluded = new Set(log?.spec.baselineExclude ?? []);
   const priorBaseline = policyBaseline(projectDir);
   for (const entry of trackOnlyFileAssets(installedTracks(projectDir))) {
     if (entry.target === HARNESS_ANCHOR_FILE) continue;
+    if (isBaselineExcluded(entry.target, baselineExcluded)) continue;
     const target = join10(projectDir, entry.target);
     if (existsSync12(target)) continue;
     const source = join10(templatesDir, entry.source);
@@ -2323,8 +2163,8 @@ function installNewAssets(projectDir, templatesDir) {
         continue;
       }
     }
-    mkdirSync5(dirname5(target), { recursive: true });
-    copyFileSync2(source, target);
+    mkdirSync3(dirname3(target), { recursive: true });
+    copyFileSync(source, target);
     const recordedAs = entry.target.startsWith(".claude/") ? entry.target.slice(8) : entry.target;
     if (priorBaseline.has(recordedAs)) restored.push(entry.target);
     else installed.push(entry.target);
@@ -2347,7 +2187,7 @@ function syncHarnessAnchor(projectDir, templatesDir, report) {
   if (!existsSync12(templateMd)) return;
   const anchor = join10(projectDir, HARNESS_ANCHOR_FILE);
   const existed = existsSync12(anchor);
-  copyFileSync2(templateMd, anchor);
+  copyFileSync(templateMd, anchor);
   if (existed) {
     report.claudeMdUpdated = true;
     return;
@@ -2364,7 +2204,7 @@ function upsertRootImport(projectDir) {
     tracks: installedTracks(projectDir)
   });
   if (next === existing) return false;
-  writeFileSync6(target, next);
+  writeFileSync5(target, next);
   return true;
 }
 function installedTracks(projectDir) {
@@ -2391,11 +2231,14 @@ function recordAnchorBaseline(projectDir, anchor) {
 }
 function refreshExternalCli(projectDir, harnessRoot) {
   const log = readInstallLog(projectDir);
+  const baselineExcluded = new Set(log?.spec.baselineExclude ?? []);
   const result = runCliTransforms({
     harnessRoot,
     projectDir,
     cli: ALL_CLI_TARGETS,
     selectedInternalSkills: INTERNAL_BUNDLED_SKILL_IDS,
+    // 스킬은 **전부** 넘긴다 — 안 깔린 스킬은 대상 파일이 없어 refreshOnly 가 건너뛴다.
+    rules: ALL_RULES.filter((r) => !isBaselineExcluded(`.claude/rules/${r}.md`, baselineExcluded)),
     previousExternal: log?.externalFiles ?? [],
     refreshOnly: true
   });
@@ -2421,7 +2264,7 @@ function updateDir(target, source, ext, ctx, now = /* @__PURE__ */ new Date()) {
   if (!existsSync12(target) || !existsSync12(source)) return { updated: 0, backedUp: [] };
   let updated = 0;
   const backedUp = [];
-  for (const file of readdirSync3(target)) {
+  for (const file of readdirSync2(target)) {
     if (!file.endsWith(ext)) continue;
     const targetFile = join10(target, file);
     const sourceFile = join10(source, file);
@@ -2433,7 +2276,7 @@ function updateDir(target, source, ext, ctx, now = /* @__PURE__ */ new Date()) {
       backupFile(targetFile, now);
       backedUp.push(`${ctx.prefix}/${file}`);
     }
-    writeFileSync6(targetFile, next);
+    writeFileSync5(targetFile, next);
     updated++;
   }
   return { updated, backedUp };
@@ -2444,7 +2287,7 @@ function syncSkills(targetDir, sourceDir, baseline, now = /* @__PURE__ */ new Da
   let updated = 0;
   const backedUp = [];
   const skippedLinks = [];
-  for (const skill of readdirSync3(sourceDir, { withFileTypes: true })) {
+  for (const skill of readdirSync2(sourceDir, { withFileTypes: true })) {
     if (!skill.isDirectory()) continue;
     const targetSkill = join10(targetDir, skill.name);
     if (!existsSync12(targetSkill)) continue;
@@ -2456,8 +2299,8 @@ function syncSkills(targetDir, sourceDir, baseline, now = /* @__PURE__ */ new Da
       const targetFile = join10(targetSkill, rel);
       const next = readFileSync11(join10(sourceDir, skill.name, rel), "utf8");
       if (!existsSync12(targetFile)) {
-        mkdirSync5(dirname5(targetFile), { recursive: true });
-        writeFileSync6(targetFile, next);
+        mkdirSync3(dirname3(targetFile), { recursive: true });
+        writeFileSync5(targetFile, next);
         updated++;
         continue;
       }
@@ -2468,7 +2311,7 @@ function syncSkills(targetDir, sourceDir, baseline, now = /* @__PURE__ */ new Da
         backupFile(targetFile, now);
         backedUp.push(`${skill.name}/${rel}`);
       }
-      writeFileSync6(targetFile, next);
+      writeFileSync5(targetFile, next);
       updated++;
     }
   }
@@ -2509,7 +2352,7 @@ function refreshSkillBaseline(projectDir) {
 function pruneOrphans(target, source, ext, ctx, now = /* @__PURE__ */ new Date()) {
   if (!existsSync12(target) || !existsSync12(source)) return [];
   const removed = [];
-  for (const file of readdirSync3(target)) {
+  for (const file of readdirSync2(target)) {
     if (!file.endsWith(ext)) continue;
     const sourceFile = join10(source, file);
     if (!existsSync12(sourceFile)) {
@@ -2526,6 +2369,17 @@ function pruneOrphans(target, source, ext, ctx, now = /* @__PURE__ */ new Date()
   }
   return removed;
 }
+function retireMcpAllowlist(projectDir, now = /* @__PURE__ */ new Date()) {
+  const target = join10(projectDir, ".mcp-allowlist");
+  if (!existsSync12(target)) return null;
+  try {
+    const backup = backupFile(target, now);
+    unlinkSync(target);
+    return backup;
+  } catch {
+    return null;
+  }
+}
 function cleanStaleHookRefs(settingsPath, claudeDir) {
   let settings;
   try {
@@ -2548,7 +2402,7 @@ function cleanStaleHookRefs(settingsPath, claudeDir) {
   }
   if (removed.length > 0) {
     const next = { ...settings, hooks: cleanedHooks };
-    writeFileSync6(settingsPath, `${JSON.stringify(next, null, 2)}
+    writeFileSync5(settingsPath, `${JSON.stringify(next, null, 2)}
 `);
   }
   return removed;
@@ -2588,17 +2442,27 @@ function runInstall(ctx) {
     throw new Error(`Templates dir not found: ${templatesDir}`);
   }
   const claudeDir = join11(projectDir, ".claude");
-  if (mode === "update" && !existsSync13(claudeDir)) {
-    throw new Error(`Update mode requires existing .claude/ at ${claudeDir}`);
-  }
   const previousLog = readInstallLog(projectDir);
+  const claudeWasSelected = previousLog?.spec.cli.includes("claude") ?? false;
+  if (mode === "update" && !existsSync13(claudeDir) && (previousLog === null || claudeWasSelected)) {
+    throw new Error(
+      claudeWasSelected ? `Update mode found a broken install at ${projectDir} \u2014 this project installed Claude Code assets but \`.claude/\` is gone. Reinstall instead: agent-harness install --track <name>` : `Update mode requires an existing install at ${projectDir}`
+    );
+  }
   const backupPath = resolveBackupPath(ctx, mode, claudeDir);
   if (mode === "update") {
     return runUpdateInstall(ctx, templatesDir, backupPath);
   }
   const manifestSpec = buildManifestSpec(spec);
   const policyBase = new Map((previousLog?.policyFiles ?? []).map((f) => [f.path, f.sha256]));
-  const base = spec.cli.includes("claude") ? installClaudeBaseline(manifestSpec, projectDir, templatesDir, policyBase) : emptyClaudeBaseline();
+  const baselineExcluded = new Set(spec.baselineExclude ?? []);
+  const supersededFound = findSuperseded(projectDir, manifestSpec, previousLog);
+  const base = spec.cli.includes("claude") ? installClaudeBaseline(manifestSpec, projectDir, templatesDir, policyBase, baselineExcluded) : (
+    // claude 미선택이어도 CLI 중립 자산은 깔린다. manifest 전체가 `.claude/` baseline 안에서만
+    // 돌던 탓에 이 자산들이 claude 설치에만 도달했는데, **배포 룰 본문이 이 스크립트들을
+    // 호출 지점으로 지목한다** — 즉 없는 도구를 있다고 안내하고 있었다(#300 과 같은 형태).
+    installCliNeutralAssets(manifestSpec, projectDir, templatesDir, baselineExcluded)
+  );
   const mcpResult = composeAndWriteMcp(harnessRoot, projectDir, spec);
   const ciScaffold = isAssetSelected("ci-scaffold", {
     tracks: spec.tracks,
@@ -2616,6 +2480,11 @@ function runInstall(ctx) {
     projectDir,
     cli: spec.cli,
     selectedInternalSkills: manifestSpec.selectedInternalSkills,
+    // 룰 목록의 SSOT 는 하나다 — `.claude/rules/` 를 채우는 것과 같은 `resolveRules` 결과가
+    // 나머지 세 CLI 로도 간다. 여기서 다시 고르면 CLI 마다 다른 룰이 깔린다.
+    rules: resolveRules(manifestSpec).filter(
+      (r) => !isBaselineExcluded(`.claude/rules/${r}.md`, baselineExcluded)
+    ),
     previousExternal: previousLog?.externalFiles ?? [],
     codexTrust: (spec.scope ?? "project") === "global" && spec.options.withCodexTrust
   });
@@ -2635,7 +2504,12 @@ function runInstall(ctx) {
     rootClaudeMd: base.rootClaudeMd,
     // 외부 CLI 백업도 같은 줄에 노출한다 — 백업이 화면에 안 보이면 사용자는 자기 편집분이
     // 어디 갔는지 알 수 없고, 그러면 백업은 있어도 없는 것과 같다 (ADR-046/047 과 같은 이유).
-    backups: [...base.backups, ...externalBackups]
+    backups: [...base.backups, ...externalBackups],
+    baselineExcluded: base.excluded,
+    baselineExcludedOnDisk: base.excludedOnDisk,
+    // 밀려난 자산 정리는 **manifest 복사가 끝난 뒤**에 한다. 앞에서 지우면 이번 설치가 다시
+    // 깔 수도 있는 파일을 지웠다 되돌리는 셈이라, 무엇이 최종 상태인지 보고가 흐려진다.
+    superseded: applySupersededCleanup(spec, projectDir, supersededFound)
   };
   ctx.onProgress?.({ type: "baseline-complete", baseline });
   const external = runExternalPhase(ctx);
@@ -2651,6 +2525,21 @@ function runInstall(ctx) {
   );
   return { ...baseline, external, staleHookRefs };
 }
+function applySupersededCleanup(spec, projectDir, found) {
+  if (found.length === 0) return { removed: [], kept: [] };
+  if (!spec.cleanSuperseded) return { removed: [], kept: found.map((f) => f.target) };
+  const removed = [];
+  const kept = [];
+  for (const asset of found) {
+    try {
+      unlinkSync2(join11(projectDir, asset.target));
+      removed.push(asset.target);
+    } catch {
+      kept.push(asset.target);
+    }
+  }
+  return { removed, kept };
+}
 function healStaleHookRefs(spec, projectDir) {
   if (!spec.cli.includes("claude")) return [];
   const settingsPath = join11(projectDir, ".claude/settings.json");
@@ -2668,6 +2557,11 @@ function runUpdateInstall(ctx, templatesDir, backupPath) {
     filesCopied: 0,
     dirsCopied: 0,
     skipped: 0,
+    baselineExcluded: [],
+    baselineExcludedOnDisk: [],
+    // update 는 밀려난 자산을 다루지 않는다 — 그 판정은 사용자가 옵션을 고르는 설치 경로의
+    // 것이고, update 는 무엇을 골랐는지 다시 묻지 않는다.
+    superseded: { removed: [], kept: [] },
     backup: backupPath,
     installedTracks: [...ctx.spec.tracks].sort(),
     mcpServers: [],
@@ -2681,7 +2575,6 @@ function runUpdateInstall(ctx, templatesDir, backupPath) {
     envFiles: {
       envExampleCreated: false,
       gitignoreEnvAdded: false,
-      mcpAllowlist: null,
       gitignoreNpxSkillsAdded: []
     },
     rootClaudeMd: null
@@ -2718,9 +2611,30 @@ function emptyClaudeBaseline() {
     categories: { rules: [], agents: [], hooks: [], commands: 0, skills: [] },
     rootClaudeMd: null,
     rootClaudeMdLog: null,
-    backups: []
+    backups: [],
+    excluded: [],
+    excludedOnDisk: []
   };
 }
+function installCliNeutralAssets(manifestSpec, projectDir, templatesDir, baselineExcluded) {
+  const result = emptyClaudeBaseline();
+  for (const entry of buildManifest(manifestSpec)) {
+    if (!entry.applies(manifestSpec)) continue;
+    if (entry.target.startsWith(".claude/rules/") && isBaselineExcluded(entry.target, baselineExcluded)) {
+      result.excluded.push(entry.target);
+      continue;
+    }
+    if (!isCliNeutralTarget(entry.target)) continue;
+    const source = join11(templatesDir, entry.source);
+    if (!existsSync13(source)) {
+      result.skipped += 1;
+      continue;
+    }
+    copyFile(source, join11(projectDir, entry.target));
+    result.filesCopied += 1;
+  }
+  return result;
+}
 function backupEditedPolicyFile(entryTarget, target, source, baseline) {
   const prefix = ".claude/";
   if (!entryTarget.startsWith(prefix)) return null;
@@ -2735,7 +2649,7 @@ function backupEditedPolicyFile(entryTarget, target, source, baseline) {
   if (recorded !== void 0 && recorded === hashContent(current)) return null;
   return backupFile(target);
 }
-function installClaudeBaseline(manifestSpec, projectDir, templatesDir, policyBase) {
+function installClaudeBaseline(manifestSpec, projectDir, templatesDir, policyBase, baselineExcluded) {
   ensureProjectSkeleton(projectDir);
   const result = emptyClaudeBaseline();
   const manifest = buildManifest(manifestSpec);
@@ -2743,8 +2657,13 @@ function installClaudeBaseline(manifestSpec, projectDir, templatesDir, policyBas
     if (!entry.applies(manifestSpec)) {
       continue;
     }
-    const source = join11(templatesDir, entry.source);
     const target = join11(projectDir, entry.target);
+    if (isBaselineExcluded(entry.target, baselineExcluded)) {
+      result.excluded.push(entry.target);
+      if (existsSync13(target)) result.excludedOnDisk.push(entry.target);
+      continue;
+    }
+    const source = join11(templatesDir, entry.source);
     if (!existsSync13(source)) {
       result.skipped += 1;
       continue;
@@ -2788,7 +2707,6 @@ function writeEnvironmentFiles(projectDir, tracks) {
   return {
     envExampleCreated: writeEnvExample(projectDir, tracks),
     gitignoreEnvAdded: addGitignoreEnv(projectDir),
-    mcpAllowlist: writeMcpAllowlist(projectDir),
     // v0.8.0 — `.factory/`, `.goose/` ignore (npx skills universal install 사용자 #3).
     // 2026-08-02 — `.uzys-agent-harness/` 합류 (설치 로그 + 훅 차단 로그).
     gitignoreNpxSkillsAdded: addGitignoreAgentArtifacts(projectDir)
@@ -2880,13 +2798,6 @@ function collectRootFiles(envFiles, ciScaffold, mcpCreated) {
   if (envFiles.envExampleCreated) {
     files.push({ path: ".env.example", change: "created", notes: ["Supabase \uD1A0\uD070 \uAC00\uC774\uB4DC"] });
   }
-  if (envFiles.mcpAllowlist && envFiles.mcpAllowlist.length > 0) {
-    files.push({
-      path: ".mcp-allowlist",
-      change: "created",
-      notes: [`MCP allowlist (${envFiles.mcpAllowlist.length} server)`]
-    });
-  }
   const gitignoreAdded = [
     ...envFiles.gitignoreEnvAdded ? [".env"] : [],
     ...envFiles.gitignoreNpxSkillsAdded
@@ -2923,9 +2834,9 @@ function accumulateCategory(cats, entry) {
 }
 function writeInstalledTracks(projectDir, tracks) {
   const path = join11(projectDir, ".claude/.installed-tracks");
-  mkdirSync6(dirname6(path), { recursive: true });
+  mkdirSync4(dirname4(path), { recursive: true });
   const sorted = [...new Set(tracks)].sort().join("\n");
-  writeFileSync7(path, `${sorted}
+  writeFileSync6(path, `${sorted}
 `);
 }
 function writeRootClaudeMd(projectDir, tracks) {
@@ -2933,7 +2844,7 @@ function writeRootClaudeMd(projectDir, tracks) {
   const existing = existsSync13(target) ? readFileSync12(target, "utf-8") : null;
   const content = upsertHarnessImport(existing, { projectName: basename5(projectDir), tracks });
   if (content !== existing) {
-    writeFileSync7(target, content);
+    writeFileSync6(target, content);
   }
   return { created: existing === null };
 }
@@ -2946,7 +2857,7 @@ function chmodHooksSync(hookDir) {
   }
 }
 function listHookFiles(hookDir) {
-  return readdirSync4(hookDir, { withFileTypes: true }).filter((e2) => e2.isFile() && e2.name.endsWith(".sh")).map((e2) => resolve(hookDir, e2.name));
+  return readdirSync3(hookDir, { withFileTypes: true }).filter((e2) => e2.isFile() && e2.name.endsWith(".sh")).map((e2) => resolve(hookDir, e2.name));
 }
 
 // src/commands/install-render.ts
@@ -3299,6 +3210,15 @@ function renderPhase1Rows(log, baseline, verbose = false, withEcc = false, claud
         )
       );
     }
+    if (baseline.updateMode.mcpAllowlistRetired) {
+      log(
+        assetRow(
+          "skip",
+          ".mcp-allowlist",
+          `retired \xB7 the hook that read it is gone \u2014 backed up as ${shortenPath(baseline.updateMode.mcpAllowlistRetired)}`
+        )
+      );
+    }
     if (baseline.updateMode.policyBackedUp.length > 0) {
       log(
         assetRow(
@@ -3373,12 +3293,12 @@ function renderPhase1Rows(log, baseline, verbose = false, withEcc = false, claud
       phase1Row(
         "hooks",
         cats.hooks.length,
-        "session-start \xB7 protect-files \xB7 mcp-pre-exec (security) \xB7 task-brief-nudge",
+        "session-start \xB7 protect-files \xB7 task-brief-nudge",
         cats.hooks
       );
     }
     if (cats.commands > 0) {
-      phase1Row("commands", cats.commands, "/ecc:* (ECC plugin OFF fallback)");
+      phase1Row("commands", cats.commands, "slash commands");
     }
     if (cats.skills.length > 0) {
       phase1Row(
@@ -3392,6 +3312,38 @@ function renderPhase1Rows(log, baseline, verbose = false, withEcc = false, claud
     log(assetRow("success", "rules + hooks + commands + agents", `${baseline.filesCopied} files`));
     log(assetRow("success", "skeleton", `${baseline.dirsCopied} dirs`));
   }
+  if (baseline.baselineExcluded.length > 0) {
+    const onDisk = new Set(baseline.baselineExcludedOnDisk);
+    const names = baseline.baselineExcluded.map((t) => {
+      const name = t.replace(/^\.claude\//, "");
+      return onDisk.has(t) ? `${name} (still on disk)` : name;
+    });
+    log(
+      assetRow(
+        "skip",
+        "excluded by you",
+        onDisk.size > 0 ? `${names.length} \u2014 ${names.join(", ")} \xB7 "still on disk" = \uC774\uC804 \uC124\uCE58\uBCF8\uC774\uB77C \uC9C0\uC6B0\uC9C0 \uC54A\uB294\uB2E4 (\uC81C\uAC70: agent-harness uninstall)` : `${names.length} \u2014 ${names.join(", ")}`
+      )
+    );
+  }
+  if (baseline.superseded.removed.length > 0) {
+    log(
+      assetRow(
+        "success",
+        "superseded \u2014 cleaned",
+        `${baseline.superseded.removed.length} \u2014 ${baseline.superseded.removed.map((t) => t.replace(/^\.claude\//, "")).join(", ")} \xB7 \uB418\uB3CC\uB9AC\uB824\uBA74 \uADF8 \uC790\uC0B0 \uC5C6\uC774 \uC7AC\uC124\uCE58`
+      )
+    );
+  }
+  if (baseline.superseded.kept.length > 0) {
+    log(
+      assetRow(
+        "skip",
+        "superseded \u2014 kept",
+        `${baseline.superseded.kept.length} \u2014 ${baseline.superseded.kept.map((t) => t.replace(/^\.claude\//, "")).join(", ")} \xB7 \uC774\uBC88 \uC120\uD0DD\uC774 \uB300\uCCB4\uD588\uC9C0\uB9CC \uC9C0\uC6B0\uC9C0 \uC54A\uC558\uB2E4 (\uC81C\uAC70: agent-harness uninstall)`
+      )
+    );
+  }
   const TEMPLATES_COL = 28;
   if (baseline.rootClaudeMd) {
     const n = baseline.rootClaudeMd.tracks.length;
@@ -3427,16 +3379,6 @@ function renderPhase1Rows(log, baseline, verbose = false, withEcc = false, claud
   }
   const mcpList = baseline.mcpServers.join(", ") || "(none)";
   log(assetRow("success", ".mcp.json", mcpList, TEMPLATES_COL));
-  if (baseline.envFiles.mcpAllowlist) {
-    log(
-      assetRow(
-        "success",
-        ".mcp-allowlist",
-        `${baseline.envFiles.mcpAllowlist.length} servers (D35 opt-in gate)`,
-        TEMPLATES_COL
-      )
-    );
-  }
   if (!withEcc && baseline.categories) {
     log("");
     log(
@@ -3548,15 +3490,26 @@ function installAction(options, deps = {}) {
   }
   const forceInclude = normalizeRepeatable(options.with);
   const forceExclude = normalizeRepeatable(options.without);
+  const baselineIds = new Set(
+    listBaselineTargets({ tracks: options.track ?? [] }).map((t) => t.id)
+  );
+  const baselineExclude = forceExclude.filter((id) => baselineIds.has(id));
   const validIds = new Set(EXTERNAL_ASSETS.map((a) => a.id));
-  for (const id of [...forceInclude, ...forceExclude]) {
-    if (!validIds.has(id)) {
-      err(
-        c.yellow(
-          `[WARN] Unknown asset id '${id}' (--with/--without). Skipping. Use one of: ${[...validIds].sort().join(", ")}`
-        )
-      );
-    }
+  for (const id of forceInclude) {
+    if (validIds.has(id)) continue;
+    err(
+      c.yellow(
+        id.startsWith(BASELINE_PREFIX) ? `[WARN] '${id}' cannot be used with --with \u2014 track baseline assets install by default. Use --without to drop one.` : `[WARN] Unknown asset id '${id}' (--with). Skipping. Use one of: ${[...validIds].sort().join(", ")}`
+      )
+    );
+  }
+  for (const id of forceExclude) {
+    if (validIds.has(id) || baselineIds.has(id)) continue;
+    err(
+      c.yellow(
+        id.startsWith(BASELINE_PREFIX) ? `[WARN] '${id}' is not installed by the selected track(s) \u2014 nothing to exclude. Available: ${[...baselineIds].sort().join(", ")}` : `[WARN] Unknown asset id '${id}' (--without). Skipping. Use one of: ${[...validIds].sort().join(", ")}`
+      )
+    );
   }
   const filteredInclude = forceInclude.filter((id) => validIds.has(id));
   const filteredExclude = forceExclude.filter((id) => validIds.has(id));
@@ -3564,6 +3517,7 @@ function installAction(options, deps = {}) {
   const spec = {
     tracks: options.track ?? [],
     ...userOverride ? { userOverride } : {},
+    ...baselineExclude.length > 0 ? { baselineExclude } : {},
     // v26.81.0 (ADR-022, BREAKING) — 자산 1:1 boolean 13종 삭제. 자산 선택은 위
     //   userOverride(--with <id>)로 일원화. 잔존 = 설치 동작 옵션만.
     options: {
@@ -3761,7 +3715,7 @@ function registerListCommand(cli2) {
 // src/commands/uninstall.ts
 init_esm_shims();
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync14, rmSync as rmSync2, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync14, rmSync, writeFileSync as writeFileSync7 } from "fs";
 import { join as join13, resolve as resolve4 } from "path";
 
 // src/uninstall-interactive.ts
@@ -5163,7 +5117,7 @@ function stripRootImport(projectDir) {
   const stripped = current === null ? null : stripHarnessImport(current);
   if (stripped === null) return false;
   try {
-    writeFileSync8(join13(projectDir, "CLAUDE.md"), stripped, "utf8");
+    writeFileSync7(join13(projectDir, "CLAUDE.md"), stripped, "utf8");
     return true;
   } catch {
     return false;
@@ -5200,7 +5154,7 @@ function defaultSpawn2(cmd, args) {
 }
 function defaultRm(path) {
   if (existsSync15(path)) {
-    rmSync2(path, { recursive: true, force: true });
+    rmSync(path, { recursive: true, force: true });
   }
 }
 function registerUninstallCommand(cli2) {
@@ -5428,6 +5382,18 @@ var CLI_BASE_LABELS = {
   antigravity: "Antigravity (Google)"
 };
 var INSTALL_TARGET_PAGES = [
+  // 2026-08-16 — 트랙이 고르는 자산을 **맨 앞에서** 전부 보여준다. 그전까지 이 항목들은 화면에
+  // 한 번도 안 나온 채 깔렸고, 사용자는 설치가 끝난 뒤 요약에서 처음 봤다.
+  //
+  // 2페이지로 나눈 근거는 실측이다: 최대 트랙(`full`)이 32항목(rules 6 · agents 9 · hooks 3 ·
+  // skills 14)이라 clack groupMultiselect 의 "페이지당 ≤ ~30행" 제약을 한 페이지로는 못 지킨다.
+  // 가르는 축은 역할이다 — 정책·가드가 한쪽, 실행 능력이 다른 쪽.
+  { label: "Track baseline \u2014 Rules & Hooks (\uC815\uCC45\xB7\uAC00\uB4DC)", cats: [], baseline: ["rules", "hooks"] },
+  {
+    label: "Track baseline \u2014 Agents & Skills (\uC5D0\uC774\uC804\uD2B8\xB7\uC2A4\uD0AC)",
+    cats: [],
+    baseline: ["agents", "skills"]
+  },
   { label: "Dev Core (Frontend \xB7 Backend \xB7 Data)", cats: ["frontend", "backend", "data"] },
   { label: "Dev Tools (Security \xB7 Quality \xB7 Understanding)", cats: ["dev-tools", "understanding"] },
   { label: "Business (PM \xB7 Executive \xB7 Documents)", cats: ["business"] },
@@ -5448,10 +5414,25 @@ function expandDevMethodBundle(ids) {
   const rest = ids.filter((v2) => v2 !== DEV_METHOD_BUNDLE_VALUE);
   return ids.includes(DEV_METHOD_BUNDLE_VALUE) ? [...rest, ...bundleMemberValues()] : rest;
 }
-function buildPageGroups(cats, initialSet, installedSet = /* @__PURE__ */ new Set()) {
+var BASELINE_TITLES = {
+  rules: "Rules \u2014 \uC0C1\uC2DC \uC0C1\uC8FC\uD558\uB294 \uB300\uC6D0\uCE59 (4 CLI \uC804\uBD80\uC5D0 \uC124\uCE58)",
+  hooks: "Hooks \u2014 \uACB0\uC815\uB860\uC801 \uAC00\uB4DC (\uD574\uC81C\uD558\uBA74 settings.json \uBC30\uC120\uB3C4 \uD568\uAED8 \uBE60\uC9C4\uB2E4)",
+  agents: "Agents \u2014 \uB3C5\uB9BD \uB808\uC778 (\uB9AC\uBDF0\xB7\uAC80\uC99D)",
+  skills: "Skills \u2014 \uD544\uC694\uD560 \uB54C \uC5F4\uB9AC\uB294 \uC791\uC5C5 \uC808\uCC28"
+};
+function buildPageGroups(cats, initialSet, installedSet = /* @__PURE__ */ new Set(), baselineKinds = [], baselineTargets = []) {
   const installedMark = (value) => installedSet.has(value) ? "  \u25CF installed" : "";
   const groups = {};
   const flatItems = [];
+  for (const kind of baselineKinds) {
+    const items = baselineTargets.filter((t) => t.kind === kind).map((t) => ({
+      value: t.id,
+      label: `    ${t.name}${installedMark(t.id)}`
+    }));
+    if (items.length === 0) continue;
+    groups[BASELINE_TITLES[kind]] = items;
+    flatItems.push(...items);
+  }
   for (const cat of cats) {
     const items = [];
     for (const o of VISIBLE_OPTION_DEFS.filter((d2) => d2.category === cat)) {
@@ -5586,8 +5567,26 @@ Proceed?`,
     });
     return q(result) ? null : result;
   },
+  confirmSupersededCleanup: async (items, context) => {
+    const names = items.map((i) => i.target.replace(/^\.claude\//, "")).join("\n      ");
+    const result = await ue({
+      message: [
+        `${context.by.join(" \xB7 ")} \uC744(\uB97C) \uACE8\uB77C\uC11C \uC544\uB798 ${items.length}\uAC1C\uAC00 \uC124\uCE58 \uB300\uC0C1\uC5D0\uC11C \uBE60\uC84C\uC2B5\uB2C8\uB2E4.`,
+        "\uADF8\uB7F0\uB370 \uC774\uC804 \uC124\uCE58\uBCF8\uC774 \uB514\uC2A4\uD06C\uC5D0 \uADF8\uB300\uB85C \uB0A8\uC544 \uC788\uC2B5\uB2C8\uB2E4:",
+        `      ${names}`,
+        "",
+        `\uADF8\uB300\uB85C \uB450\uBA74 \uAC19\uC740 \uC77C\uC744 \uD558\uB294 \uC5D0\uC774\uC804\uD2B8\uAC00 \uB450 \uBC8C\uC774\uACE0, \uB9E4 \uC138\uC158 ~${context.tokens} tok \uB97C \uACC4\uC18D \uBB45\uB2C8\uB2E4.`,
+        "(\uD558\uB124\uC2A4\uAC00 \uAE54\uC558\uACE0 \uC218\uC815\uB418\uC9C0 \uC54A\uC740 \uD30C\uC77C\uB9CC \uB300\uC0C1\uC785\uB2C8\uB2E4 \u2014 \uC9C1\uC811 \uACE0\uCE5C \uD30C\uC77C\uC740 \uAC74\uB4DC\uB9AC\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4)",
+        "",
+        "\uC815\uB9AC\uD560\uAE4C\uC694?"
+      ].join("\n"),
+      initialValue: true
+    });
+    return q(result) ? null : result;
+  },
   selectInstallTargets: async (initialChecked, step, recap) => {
     const pages = INSTALL_TARGET_PAGES;
+    const baselineTargets = listBaselineTargets({ tracks: recap?.tracks ?? [] });
     const displayInitial = collapseDevMethodBundle(initialChecked);
     const initialSet = new Set(displayInitial);
     const collected = new Set(displayInitial);
@@ -5600,10 +5599,25 @@ Proceed?`,
     let aborted = false;
     try {
       let pageIdx = 0;
+      let dir = 1;
       while (pageIdx < pages.length) {
         const page = pages[pageIdx];
         if (!page) break;
-        const { groups, flatItems } = buildPageGroups(page.cats, initialSet, installedSet);
+        const { groups, flatItems } = buildPageGroups(
+          page.cats,
+          initialSet,
+          installedSet,
+          page.baseline ?? [],
+          baselineTargets
+        );
+        if (flatItems.length === 0) {
+          pageIdx += dir;
+          if (pageIdx < 0) {
+            aborted = true;
+            break;
+          }
+          continue;
+        }
         const selectedNow = flatItems.filter((it3) => collected.has(it3.value)).map((it3) => it3.value);
         const pageDefault = flatItems.filter((it3) => initialSet.has(it3.value)).length;
         const totalSelected = collected.size;
@@ -5629,11 +5643,13 @@ Proceed?`,
             aborted = true;
             break;
           }
+          dir = -1;
           pageIdx--;
           continue;
         }
         for (const it3 of flatItems) collected.delete(it3.value);
         for (const v2 of result) collected.add(v2);
+        dir = 1;
         pageIdx++;
       }
       if (!aborted) {
@@ -5657,14 +5673,21 @@ Proceed?`,
 function splitInstallTargets(targets) {
   const optionKeys = [];
   const assetIds = [];
+  const baselineIds = [];
   for (const t of targets) {
     if (t.startsWith("option:")) {
       optionKeys.push(t.slice("option:".length));
     } else if (t.startsWith("asset:")) {
       assetIds.push(t.slice("asset:".length));
+    } else if (t.startsWith(BASELINE_PREFIX)) {
+      baselineIds.push(t);
     }
   }
-  return { optionKeys, assetIds };
+  return { optionKeys, assetIds, baselineIds };
+}
+function baselineExcludeFrom(offered, checked) {
+  const keep = new Set(checked);
+  return offered.filter((t) => !keep.has(t.id)).map((t) => t.id);
 }
 function toOptionFlags(keys) {
   const picked = new Set(keys);
@@ -5684,7 +5707,9 @@ function installedTargetState(projectDir) {
 function initialTargetSelection(tracks, installedProjectAssetIds) {
   const ids = new Set(recommendedExternalAssets(tracks));
   for (const id of installedProjectAssetIds) ids.add(id);
-  return [...ids].map((id) => `asset:${id}`);
+  const assets = [...ids].map((id) => `asset:${id}`);
+  const baseline = listBaselineTargets({ tracks }).map((t) => t.id);
+  return [...assets, ...baseline];
 }
 async function runInteractive(projectDir, deps = {}) {
   const prompts = deps.prompts ?? defaultPrompts;
@@ -5786,16 +5811,21 @@ ${formatSummary(spec)}`
     } else {
       const finalTracks = tracks;
       const finalCli = cli2;
-      const { optionKeys, assetIds } = splitInstallTargets(targetSelections ?? []);
+      const { optionKeys, assetIds, baselineIds } = splitInstallTargets(targetSelections ?? []);
       const options = toOptionFlags(optionKeys);
       const userOverride = targetSelections === null ? void 0 : computeUserOverride(finalTracks, assetIds);
+      const baselineExclude = targetSelections === null ? [] : baselineExcludeFrom(listBaselineTargets({ tracks: finalTracks }), baselineIds);
       const scopeLabel = scope === "global" ? "Global (writes to ~/.claude/, ~/.codex/, npm -g)" : "Project (current directory only)";
       const summary = `${formatSummary({
         tracks: finalTracks,
         options,
         cli: finalCli,
         projectDir,
-        ...userOverride ? { userOverride } : {}
+        ...userOverride ? { userOverride } : {},
+        // 해제 목록을 안 넘기면 이 화면이 **제외 유무와 문자열이 완전히 같아진다** — 같은 화면이
+        // 외부 자산 제거는 `-User removed:` 로 이미 보고하므로, 없음은 "아무것도 안 빠졌다"로
+        // 읽힌다. 상주 비용을 줄이려고 20개를 푼 사용자가 그대로인 숫자를 보게 된다.
+        ...baselineExclude.length > 0 ? { baselineExclude } : {}
       })}
   SCOPE     ${scopeLabel}`;
       const confirmed = await prompts.confirmInstall(
@@ -5810,22 +5840,59 @@ ${summary}`
         prompts.outro("Cancelled by user.");
         return { ok: false, reason: "cancelled" };
       }
+      const spec = {
+        tracks: finalTracks,
+        options,
+        cli: finalCli,
+        projectDir,
+        scope,
+        ...userOverride ? { userOverride } : {},
+        ...baselineExclude.length > 0 ? { baselineExclude } : {}
+      };
+      const superseded = findSuperseded(
+        projectDir,
+        buildManifestSpec(spec),
+        readInstallLog(projectDir)
+      );
+      let cleanSuperseded = false;
+      if (superseded.length > 0) {
+        const cause = supersededCause(projectDir, spec, readInstallLog(projectDir), superseded);
+        const answer = await prompts.confirmSupersededCleanup(superseded, {
+          by: cause.length > 0 ? cause : ["\uC774\uBC88 \uC120\uD0DD"],
+          tokens: supersededTokens(superseded)
+        });
+        if (answer === null) {
+          step = "confirm";
+          continue;
+        }
+        cleanSuperseded = answer;
+      }
       prompts.outro(stepLabel(WIZARD.INSTALL, "Installing..."));
       return {
         ok: true,
         mode,
-        spec: {
-          tracks: finalTracks,
-          options,
-          cli: finalCli,
-          projectDir,
-          scope,
-          ...userOverride ? { userOverride } : {}
-        }
+        spec: { ...spec, ...cleanSuperseded ? { cleanSuperseded } : {} }
       };
     }
   }
 }
+function supersededTokens(items) {
+  const r = residentCost(items.map((i) => ({ source: i.source, target: i.target })));
+  return r.rules + r.agentDescriptors + r.skillDescriptors;
+}
+function supersededCause(projectDir, spec, log, found) {
+  const selected = spec.userOverride?.forceInclude ?? [];
+  return selected.filter((id) => {
+    const without = {
+      ...spec,
+      userOverride: {
+        forceInclude: selected.filter((x) => x !== id),
+        forceExclude: [...spec.userOverride?.forceExclude ?? [], id]
+      }
+    };
+    return findSuperseded(projectDir, buildManifestSpec(without), log).length < found.length;
+  });
+}
 function tracksEqual(a, b2) {
   if (a.length !== b2.length) return false;
   const sortedA = [...a].sort();
@@ -5841,6 +5908,7 @@ function computeUserOverride(tracks, assetIds) {
   return { forceInclude, forceExclude };
 }
 function formatSummary(spec) {
+  const baselineExcluded = new Set(spec.baselineExclude ?? []);
   const opts = Object.keys(spec.options).filter((k2) => spec.options[k2]).map((k2) => k2.replace(/^with/, "").toLowerCase());
   const optsLabel = opts.length > 0 ? opts.join(", ") : "(none added)";
   const lines = [
@@ -5862,7 +5930,11 @@ function formatSummary(spec) {
       lines.push(`  \xB7 ${cat}: ${ids.join(", ")}`);
     }
     const cost = formatResidentCostLine(
-      residentCost(buildManifest(spec).filter((e2) => e2.applies(spec))),
+      residentCost(
+        buildManifest(spec).filter(
+          (e2) => e2.applies(spec) && !isBaselineExcluded(e2.target, baselineExcluded)
+        )
+      ),
       summarizeContextCost(finalAssets).unmeasuredCount
     );
     if (cost) lines.push(`  \xB7 ${cost}`);
@@ -5875,6 +5947,11 @@ function formatSummary(spec) {
       lines.push(`  -User removed: ${spec.userOverride.forceExclude.join(", ")}`);
     }
   }
+  if (baselineExcluded.size > 0) {
+    lines.push(
+      `  -Excluded by you: ${baselineExcluded.size} \u2014 ${[...baselineExcluded].map((id) => id.replace(BASELINE_PREFIX, "")).join(", ")}`
+    );
+  }
   return lines.join("\n");
 }