@uzysjung/agent-harness 26.162.1 → 26.164.0

package/dist/{chunk-3G34MEGZ.js → chunk-X7NSQHXL.js}

@@ -103,7 +103,7 @@ function globToRegex(pattern) {
 }
 
 // src/external-assets.ts
-var DEV_TRACKS_WITH_STACK = TRACKS.filter((t) => t !== "base" && hasDevTrack([t]));
+var UI_TRACKS = TRACKS.filter((t) => hasUiTrack([t]));
 var CSR_SSR_NEXTJS_FULL = [
   "csr-supabase",
   "csr-fastify",
@@ -156,6 +156,22 @@ var EXTERNAL_ASSETS = [
   // === Repo-bundled internal skills (uzys 1st-party, v26.87.0) ===
   // 2026-08-02 복원 (ADR-062) — 이관(ADR-060) 후 감사에서 본문 열화 104건(dropped 76 ·
   //   damaged 28)이 확인돼 9종을 이 리포 번들로 되돌렸다. 아래 10종 전부 `kind: "internal"`.
+  // #602 — ui-visual-review: TRACKS.md 가 말하는 트랙 추종 번들 스킬("follows the track, not
+  // the catalog"). internal 카탈로그 자산으로 등록해 selectedInternalSkills 흐름에 태우면
+  // .agents/skills(비-Claude 자리)에도 깔린다 — 종전의 .claude/ 전용 배선과 어긋나던 것.
+  {
+    id: "ui-visual-review",
+    tier: "official",
+    // uzys 자사 스킬
+    description: "UI visual review \u2014 screenshot capture, baseline diff, and a review gate for UI changes (ships with UI tracks; ssr-htmx excluded)",
+    category: "frontend",
+    source: "uzys",
+    condition: {
+      kind: "any-track",
+      tracks: ["csr-supabase", "csr-fastify", "csr-fastapi", "ssr-nextjs", "full"]
+    },
+    method: { kind: "internal", key: "ui-visual-review" }
+  },
   {
     id: "compaction-handoff",
     tier: "official",
@@ -379,15 +395,34 @@ var EXTERNAL_ASSETS = [
       pluginId: "railway@railway-skills"
     }
   },
+  // #709 (ADR-101) — Railway MCP 서버의 **선택** 경로. 서버 정의는 트랙 표(`templates/track-mcp-map.tsv`)의 같은 이름
+  //   행 하나다(key === 행 이름). 그 행의 패턴이 기본 트랙(csr-* · ssr-htmx · full)을 정하고, 이 항목은 그 밖의 트랙
+  //   (ssr-nextjs 등)에서 위저드 체크 · `--with` 로 고르게 한다. experimental 이라 조건으로는 미리 체크되지 않는다.
+  //   상류 repo 는 archived — Railway 의 현행 경로(`railway mcp`)로 행 명령을 바꾸는 일은 별도 이슈.
+  {
+    id: "railway-mcp-server",
+    tier: "experimental",
+    // railwayapp/railway-mcp-server 190★ · archived (월간 trust-tier-drift 가 REPO_OVERRIDE 로 감시)
+    description: "Railway MCP server (`npx -y @railway/mcp-server`) in `.mcp.json` \u2014 already on by default on csr-*, ssr-htmx and full; check it to add it on any other track (e.g. ssr-nextjs). Upstream repo is archived; Railway's current route is `railway mcp` (opt-in)",
+    category: "backend",
+    source: "railwayapp",
+    condition: { kind: "opt-in" },
+    // #709 리뷰 NOTE 3 — `.mcp.json` · Codex `[mcp_servers]` · `opencode.json` `mcp` 만 받는다. Antigravity 변환에는 MCP 가 없다
+    //   (internal 기본값 = 4 CLI 는 과대 표기).
+    cliSupportOverride: ["claude", "codex", "opencode"],
+    method: { kind: "internal", key: "railway-mcp-server" }
+  },
   // === csr-supabase|full CLI ===
   {
     id: "vercel-cli",
     tier: "vetted",
     // vercel/vercel 15k
-    description: "Vercel CLI \u2014 the real deploy tool as a devDependency (global under --scope global). Only if this project deploys to Vercel",
+    description: "Vercel CLI \u2014 the real deploy tool as a devDependency (global under --scope global). Only if this project deploys to Vercel. `vercel mcp` then wires Vercel's official MCP (OAuth) into Claude Code",
     category: "backend",
     source: "vercel",
-    // 2026-08-02 사용자 결정: 트랙 기본 → opt-in (ADR-063)
+    // 2026-08-02 사용자 결정: 트랙 기본 → opt-in (ADR-063). #709 가 ssr-nextjs 기본으로 바꿨다가 #715 에서 되돌렸다 —
+    //   설치자 package.json 에 의존성을 더하고(에이전트는 npx 로 쓸 수 있다) login 없이는 쓸 것이 없으며 핀이 낡는다.
+    //   Next.js 의 Vercel 기본은 공식 MCP(#711)로 채운다.
     condition: { kind: "opt-in" },
     method: { kind: "npm", pkg: "vercel", version: "54.17.3" }
   },
@@ -417,6 +452,7 @@ var EXTERNAL_ASSETS = [
   // === UI tracks (csr-*|ssr-*|full) ===
   // v26.92.0 — frontend-design (Anthropic official).
   //   사용자 결정: has-dev-track 기본추천 (모든 개발 트랙, executive 제외).
+  //   #709 (ADR-101) — UI 가 있는 트랙만(`UI_TRACKS`). data · tooling 은 미리 체크하지 않는다.
   //   category=frontend (UI 자산, wizard 그룹).
   //
   // 2026-08-26 (#344) — **plugin → skill.** 배달 방식이 도달 CLI 를 정한다(assetCliSupport):
@@ -432,7 +468,7 @@ var EXTERNAL_ASSETS = [
     description: "frontend-design \u2014 visual direction, typography, and anti-generic UI guidance (Anthropic official). For new UI or an explicit redesign; do not let it override an existing design system",
     category: "frontend",
     source: "anthropics",
-    condition: { kind: "any-track", tracks: DEV_TRACKS_WITH_STACK },
+    condition: { kind: "any-track", tracks: UI_TRACKS },
     method: { kind: "skill", source: "anthropics/skills", skill: "frontend-design" }
   },
   // 2026-08-02 정비 — 프론트엔드 품질 3종 (사용자 지시). 전부 opt-in: frontend-design 이 기본
@@ -484,9 +520,11 @@ var EXTERNAL_ASSETS = [
   // found" 가 됐다(#420) — 지금은 SKILL.md 의 `name:`(`preline-theme-generator`)으로 맞춘다(실측
   // 2026-09-20: 옛 이름 exit 1 · 새 이름 설치 완료). 이름이 바뀌면 월 1회 catalog-verify 가 잡는다.
   //
-  // 같은 날 조사한 flowbite 는 **넣지 않는다**: 에이전트용 제공물이 MCP 서버뿐인데, 이 저장소의
-  // `.mcp.json` 조립은 트랙 조건만 읽어 opt-in 경로가 없다 — 넣으면 해당 트랙 전원에게 항상
+  // 같은 날 조사한 flowbite 는 **넣지 않는다**: 에이전트용 제공물이 MCP 서버뿐인데, 그때 이 저장소의
+  // `.mcp.json` 조립은 트랙 조건만 읽어 opt-in 경로가 없었다 — 넣으면 해당 트랙 전원에게 항상
   // 켜진다. 안 쓰는 사람에게 MCP 툴 스키마만큼의 상주 비용을 물리는 형태라 기각(사용자 확정).
+  // #709 (ADR-101) 부터는 카탈로그 `internal` 항목으로 opt-in 경로가 있다(`railway-mcp-server`). flowbite 는
+  // 그 경로로 다시 심사할 수 있다 — 이 변경은 넣지 않는다.
   {
     id: "preline",
     tier: "vetted",
@@ -870,6 +908,10 @@ var DEV_METHOD_SKILL_IDS = [
 ];
 var INTERNAL_BUNDLED_SKILL_IDS = [
   ...DEV_METHOD_SKILL_IDS,
+  // #602 — 트랙을 따라가는 번들 스킬(csr-*·ssr-*·full). selectedInternalSkills 로 흘러야
+  // .agents/skills(비-Claude 자리)에도 깔린다 — manifest 의 UI_SKILL_DIRS 배선은 .claude/ 만
+  // 알아 TRACKS.md 와 어긋났다. 조건은 buildAssetSpec 이 UI 트랙으로 건다.
+  "ui-visual-review",
   "north-star",
   "gh-issue-workflow",
   "objective-brief",
@@ -975,470 +1017,265 @@ function filterApplicableAssets(assets, ctx) {
   return assets.filter((a) => shouldInstallAsset(a, ctx));
 }
 
-// src/context-cost.ts
+// src/manifest.ts
 init_esm_shims();
-import { existsSync, readFileSync } from "fs";
-import { join, resolve } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
 
-// src/project-claude-merge.ts
+// src/install-log.ts
 init_esm_shims();
-var HARNESS_ANCHOR_FILE = "CLAUDE-uzys-harness.md";
-var HARNESS_IMPORT_LINE = `@${HARNESS_ANCHOR_FILE}`;
-var IMPORT_MARKER_START = "<!-- uzys-harness:import:start -->";
-var IMPORT_MARKER_END = "<!-- uzys-harness:import:end -->";
-var CONTINUOUS_SKILLS_HEADING = "## Skills that apply continuously";
-function renderContinuousSkillsNote(selectedInternalSkills) {
-  const lines = CONTINUOUS_SKILLS.filter((s) => selectedInternalSkills.includes(s.id)).map(
-    (s) => `- \`${s.id}\` \u2014 ${s.whenToApply}.`
-  );
-  if (lines.length === 0) return "";
-  return [
-    CONTINUOUS_SKILLS_HEADING,
-    "",
-    "These installed skills apply to every response or delegation; no prompt ever looks like their job, so open them from this list:",
-    "",
-    ...lines
-  ].join("\n");
-}
-function withContinuousSkillsNote(scaffold, selectedInternalSkills) {
-  const note = renderContinuousSkillsNote(selectedInternalSkills);
-  return note ? `${scaffold}
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, rmSync as rmSync2, statSync, writeFileSync } from "fs";
+import { dirname as dirname3, join as join4 } from "path";
 
-${note}` : scaffold;
-}
-function importBlock(continuousSkills) {
-  const note = renderContinuousSkillsNote(continuousSkills);
-  const body = note ? `${HARNESS_IMPORT_LINE}
-
-${note}` : HARNESS_IMPORT_LINE;
-  return `${IMPORT_MARKER_START}
-${body}
-${IMPORT_MARKER_END}`;
-}
-var TRACK_DISPLAY_NAMES = {
-  base: "Base",
-  tooling: "Tooling",
-  "csr-supabase": "CSR Supabase",
-  "csr-fastify": "CSR Fastify",
-  "csr-fastapi": "CSR FastAPI",
-  "ssr-htmx": "SSR HTMX",
-  "ssr-nextjs": "SSR Next.js",
-  data: "Data",
-  executive: "Executive",
-  full: "Full",
-  "project-management": "Project Management",
-  "growth-marketing": "Growth Marketing"
-};
-var FULL_EXPANSION = TRACKS.filter((t) => t !== "full");
-var FILL_SECTIONS = [
-  "identity",
-  "stack",
-  "architecture",
-  "installed-assets",
-  "boundaries",
-  "verify"
-];
-var FILL_SPECS = {
-  identity: {
-    title: "Identity & Purpose",
-    prompt: `Replace the H1 title above with this project's real name, then state in 1-2 plain sentences what it does, who uses it, and why it exists. Sources: README.md, the package.json / pyproject.toml "description", docs/. Do NOT describe the harness itself. Delete this comment when done.`,
-    placeholder: "what this project is, who it is for, and why it exists"
+// package.json
+var package_default = {
+  name: "@uzysjung/agent-harness",
+  version: "26.164.0",
+  description: "Curate vetted AI-coding skills & plugins by your tech stack \u2014 install only what you need, across Claude Code, Codex, OpenCode & Antigravity",
+  type: "module",
+  publishConfig: {
+    access: "public"
   },
-  stack: {
-    title: "Stack & Commands",
-    prompt: "Replace the list below with this project's REAL stack. Inspect package.json / pyproject.toml / go.mod / Cargo.toml / Gemfile + lockfiles and any Makefile/justfile/package scripts. List the language(s)+versions, framework(s), package manager, and the exact install/build/test/run commands. Verify each command exists before writing it \u2014 never guess. Delete lines that do not apply, then delete this comment.",
-    placeholder: "languages, runtimes, package manager, and the install/build/test/run commands"
+  engines: {
+    node: ">=20.12.0"
   },
-  architecture: {
-    title: "Architecture & Layout",
-    prompt: "Map this repository. List each top-level source directory and what it holds, the entry point(s), the 3-5 files a newcomer reads first, and how data/requests flow between the main layers. View the real tree (e.g. `git ls-files | sed 's#/.*##' | sort -u`) \u2014 do not assume a framework's conventional layout. Flag any generated/vendored directories that must never be hand-edited. If this is a single small module, say so in one line. Delete this comment when done.",
-    placeholder: "where things live, the entry points, and how data flows between layers"
+  bin: {
+    "agent-harness": "./dist/index.js"
   },
-  "installed-assets": {
-    title: "Installed Harness Assets",
-    prompt: "List the harness assets installed in this project (rules / skills / agents / commands) and add one line each on when to reach for it here. Verify against .claude/rules/*.md, .claude/skills/, .claude/agents/, .claude/commands/ (or this CLI's equivalent) and list ONLY assets whose file exists on disk \u2014 do not invent any. Do NOT restate the harness's working principles (they live in this project's harness anchor and rules layer) \u2014 cross-reference them instead. Delete this comment when done.",
-    placeholder: "the installed rules/skills/agents/commands and when to use each"
+  files: [
+    "dist",
+    "templates",
+    "README.md",
+    "LICENSE"
+  ],
+  scripts: {
+    build: "tsup",
+    dev: "tsup --watch",
+    "gen:compat": "npm run build && node scripts/gen-compatibility.mjs",
+    test: "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    typecheck: "tsc --noEmit",
+    lint: "biome check src tests",
+    "lint:fix": "biome check --write src tests",
+    format: "biome format --write src tests",
+    ci: "npm run typecheck && npm run lint && npm run test:coverage && npm run build",
+    prepare: "[ -d dist ] || npm run build",
+    "cost:report": "npm run build && node scripts/context-cost-report.mjs",
+    "cost:baseline": "npm run build && node scripts/context-cost-baseline.mjs",
+    "assets:history": "bash scripts/asset-history.sh",
+    "release:audit": "node scripts/release-audit.mjs",
+    security: "npm audit --omit=dev --audit-level=high && npx --yes ecc-agentshield@1.4.0 scan --baseline security-baseline.json --gate",
+    "security:baseline": "npx --yes ecc-agentshield@1.4.0 scan --save-baseline security-baseline.json"
   },
-  boundaries: {
-    title: "Boundaries \u2014 Always / Ask First / Never",
-    prompt: `Fill the Always / Ask First / Never lists with this repo's real red lines. Read the CI config, CODEOWNERS, .gitignore, and release/deploy scripts. Never must include secrets, generated files, force-push, and direct commits to the default branch, plus any repo-specific "do not touch" directories. Every entry must be specific and enforceable here. Delete this comment when done.`,
-    placeholder: "what to always do, ask before doing, and never do in this repo"
+  dependencies: {
+    "@clack/prompts": "^1.3.0",
+    cac: "^7.0.0",
+    "smol-toml": "^1.9.0"
   },
-  verify: {
-    title: "Verification Gate",
-    prompt: 'State the single command (or short sequence) that PROVES a change is safe here \u2014 the test/lint/typecheck/build gate you run before committing \u2014 plus the coverage/CI threshold and what "done" means. Sources: package scripts, CI workflow files, CONTRIBUTING. An agent must be able to self-verify without guessing. Delete this comment when done.',
-    placeholder: "the single command that proves a change is safe, and the done bar"
+  devDependencies: {
+    "@biomejs/biome": "^2.4.13",
+    "@types/node": "^25.6.0",
+    "@vitest/coverage-v8": "^4.1.11",
+    tsup: "^8.3.0",
+    typescript: "^5.6.0",
+    vitest: "^4.1.11"
+  },
+  license: "MIT",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/uzysjung/uzys-agent-harness.git"
   }
 };
-function anchorLine(surface) {
-  if (surface === "claude") {
-    return `> The working principles live in this project's harness anchor \`${HARNESS_ANCHOR_FILE}\`, imported at the bottom of this file. Everything above that import is **project-specific context only**.`;
-  }
-  const self = surface === "antigravity-rule" ? "`.agents/rules/uzys-harness.md`" : "`AGENTS.md`";
-  return `> **This file (${self}) is the harness anchor** \u2014 it carries the working principles in full, further down. Only the \`## \u2026\` sections immediately below are project-specific context for you to fill in.`;
-}
-function scaffoldBanner(surface) {
-  return [
-    "> \u2699\uFE0F **SCAFFOLD \u2014 not filled in yet.** The sections below are a fill-in template for THIS project, not verified facts.",
-    "> To fill: open this file and paste each `<!-- FILL: \u2026 -->` comment's instruction into your coding agent (e.g. Claude Code) \u2014 it will inspect the real repo and write the section. You can also fill them by hand; the comments are the instructions.",
-    anchorLine(surface)
-  ].join("\n");
-}
-function renderFillScaffold(surface = "claude") {
-  const blocks = FILL_SECTIONS.map((id) => {
-    const spec = FILL_SPECS[id];
-    return `## ${spec.title}
-
-<!-- FILL:${id} \u2014 ${spec.prompt} -->
 
-_(not filled yet \u2014 ${spec.placeholder})_`;
-  });
-  return `${scaffoldBanner(surface)}
-
-${blocks.join("\n\n")}`;
+// src/adapters/shared-files.ts
+init_esm_shims();
+var SHARED_FILES = {
+  "CLAUDE.md": { adapter: "marker-md", prefix: "claude-md:" },
+  "AGENTS.md": { adapter: "marker-md", prefix: "agents-md:" },
+  ".claude/settings.json": { adapter: "json-keys", prefix: "settings:" },
+  ".mcp.json": { adapter: "json-keys", prefix: "mcp:", strip: "mcpServers." },
+  "opencode.json": { adapter: "json-keys", prefix: "opencode:" },
+  ".codex/config.toml": { adapter: "toml-region", prefix: "codex:" },
+  ".gitignore": { adapter: "lines", prefix: "gitignore:" }
+};
+var KEY_ID_PREFIXES = Object.values(SHARED_FILES).map(
+  (f) => f.prefix
+);
+function isKeyId(id) {
+  return KEY_ID_PREFIXES.some((p) => id.startsWith(p));
 }
-function mergeProjectClaude(opts) {
-  const expanded = expandTracks(opts.tracks);
-  const trackList = expanded.map((t) => TRACK_DISPLAY_NAMES[t]).join(", ");
-  const header = `# ${opts.projectName}
-
-> Active track(s): ${trackList}`;
-  return `${header}
-
-${opts.projectContext ?? renderFillScaffold()}
-`;
+function sharedPathOfKeyId(id) {
+  for (const [path2, file] of Object.entries(SHARED_FILES))
+    if (id.startsWith(file.prefix)) return path2;
+  return null;
 }
-function upsertHarnessImport(existing, opts) {
-  const block = importBlock(opts.continuousSkills ?? []);
-  if (existing === null) {
-    return `${mergeProjectClaude(opts)}
-${block}
-`;
+
+// src/cli-targets.ts
+init_esm_shims();
+var CLI_BASE_SORT_ORDER = {
+  claude: 0,
+  codex: 1,
+  opencode: 2,
+  antigravity: 3
+};
+function parseCliTargets(input) {
+  const items = normalizeInput(input);
+  if (items.length === 0) {
+    return { ok: true, targets: ["claude"], warnings: [] };
   }
-  const start = existing.indexOf(IMPORT_MARKER_START);
-  if (start !== -1) {
-    const endAt = existing.indexOf(IMPORT_MARKER_END, start);
-    if (endAt === -1) return existing;
-    const current = existing.slice(start, endAt + IMPORT_MARKER_END.length);
-    if (current === block) return existing;
-    return `${existing.slice(0, start)}${block}${existing.slice(endAt + IMPORT_MARKER_END.length)}`;
+  const collected = /* @__PURE__ */ new Set();
+  const warnings = [];
+  for (const item of items) {
+    if (!isCliBase(item)) {
+      let hint = "";
+      if (item === "both") {
+        hint = "\n         v0.8.0 removed 'both' alias. Use --cli claude --cli codex.";
+      } else if (item === "all") {
+        hint = "\n         v0.8.0 removed 'all' alias. Use --cli claude --cli codex --cli opencode.";
+      } else if (item.includes(",")) {
+        hint = "\n         Tip: comma-separated not supported. Use --cli A --cli B for multiple.";
+      }
+      return {
+        ok: false,
+        targets: ["claude"],
+        warnings,
+        error: `Invalid --cli value: ${item}. Must be one of: ${CLI_BASES.join(" | ")}${hint}`
+      };
+    }
+    collected.add(item);
   }
-  if (hasHarnessImport(existing)) {
-    return existing;
+  const targets = [...collected].sort((a, b) => CLI_BASE_SORT_ORDER[a] - CLI_BASE_SORT_ORDER[b]);
+  return { ok: true, targets, warnings };
+}
+function normalizeInput(input) {
+  if (input === void 0 || input === null) return [];
+  if (typeof input === "string") {
+    const trimmed = input.trim();
+    return trimmed === "" ? [] : [trimmed];
   }
-  const body = existing.endsWith("\n") ? existing : `${existing}
-`;
-  return `${body}
-${block}
-`;
+  return input.filter((s) => typeof s === "string" && s.trim() !== "").map((s) => s.trim());
 }
-function stripHarnessImport(text) {
-  const start = text.indexOf(IMPORT_MARKER_START);
-  if (start === -1) return null;
-  const endAt = text.indexOf(IMPORT_MARKER_END, start);
-  if (endAt === -1) return null;
-  const before = text.slice(0, start).replace(/\n+$/, "\n");
-  const after = text.slice(endAt + IMPORT_MARKER_END.length).replace(/^\n+/, "");
-  return `${before}${after}`;
+function targetsInclude(targets, base) {
+  return targets.includes(base);
 }
-function hasHarnessImport(text) {
-  if (text.includes(IMPORT_MARKER_START)) return true;
-  let inFence = false;
-  for (const line of text.split("\n")) {
-    if (/^\s*(?:```|~~~)/.test(line)) {
-      inFence = !inFence;
+
+// src/fs-ops.ts
+init_esm_shims();
+import { createHash } from "crypto";
+import {
+  copyFileSync,
+  existsSync,
+  constants as fsConstants,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  readlinkSync as readlinkSync2,
+  realpathSync as realpathSync2,
+  renameSync,
+  rmdirSync,
+  rmSync,
+  symlinkSync
+} from "fs";
+import { dirname as dirname2, join as join2 } from "path";
+
+// src/outside-project.ts
+init_esm_shims();
+import { lstatSync, readlinkSync, realpathSync } from "fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "path";
+function isOutsideProject(projectDir, target) {
+  const root = resolveWriteTarget(projectDir) ?? projectDir;
+  const rel = relative(root, target);
+  return rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel);
+}
+function resolveWriteTarget(abs) {
+  const tail = [];
+  const hops = /* @__PURE__ */ new Set();
+  let path2 = abs;
+  for (; ; ) {
+    try {
+      return join(realpathSync(path2), ...tail);
+    } catch {
+    }
+    let isLink = false;
+    try {
+      const st = lstatSync(path2, { throwIfNoEntry: false });
+      if (st !== void 0 && !st.isSymbolicLink()) return null;
+      isLink = st !== void 0;
+    } catch {
+      return null;
+    }
+    if (isLink) {
+      if (hops.has(path2)) return null;
+      hops.add(path2);
+      path2 = resolve(dirname(path2), readlinkSync(path2));
       continue;
     }
-    if (!inFence && line.trim() === HARNESS_IMPORT_LINE) return true;
+    const parent = dirname(path2);
+    if (parent === path2) return null;
+    tail.unshift(basename(path2));
+    path2 = parent;
   }
-  return false;
 }
-function expandTracks(tracks) {
-  if (tracks.includes("full")) {
-    return FULL_EXPANSION;
+function outsideProjectTarget(projectDir, abs) {
+  const target = resolveWriteTarget(abs);
+  if (target === null || !isOutsideProject(projectDir, target)) return null;
+  const rel = relative(projectDir, abs);
+  const parts = rel.split(sep);
+  let link = rel;
+  let linkTarget = target;
+  for (let i = 1; i <= parts.length; i++) {
+    const prefix = join(projectDir, ...parts.slice(0, i));
+    const st = lstatSync(prefix, { throwIfNoEntry: false });
+    if (st?.isSymbolicLink() !== true) continue;
+    const resolved = resolveWriteTarget(prefix);
+    if (resolved === null || !isOutsideProject(projectDir, resolved)) continue;
+    link = parts.slice(0, i).join(sep);
+    linkTarget = resolved;
+    break;
   }
-  return tracks;
+  const slash = (p) => p.split(sep).join("/");
+  return { path: slash(rel), target, link: slash(link), linkTarget };
 }
-
-// src/context-cost.ts
-var CHARS_PER_TOKEN = 4;
-function estimateTokens(chars) {
-  return Math.ceil(chars / CHARS_PER_TOKEN);
-}
-function resolveBundleRoot() {
-  return resolve(fileURLToPath2(new URL(".", import.meta.url)), "..");
+function outsideLinkAt(projectDir, rel) {
+  const abs = join(projectDir, rel);
+  try {
+    if (!lstatSync(abs, { throwIfNoEntry: false })?.isSymbolicLink()) return null;
+  } catch {
+    return null;
+  }
+  return outsideProjectTarget(projectDir, abs);
 }
-function extractFrontmatter(content) {
-  const m = content.match(/^?---\r?\n([\s\S]*?)\r?\n---/);
-  return m?.[1] ?? null;
+function createOutsideGuard(projectDir) {
+  const seen = /* @__PURE__ */ new Map();
+  return {
+    skip(abs) {
+      const hit = outsideProjectTarget(projectDir, abs);
+      if (hit === null) return false;
+      if (!seen.has(hit.path)) seen.set(hit.path, hit);
+      return true;
+    },
+    list: () => [...seen.values()]
+  };
 }
-function assetDescriptorTokens(assetId, root = resolveBundleRoot()) {
-  const asset = EXTERNAL_ASSETS.find((a) => a.id === assetId);
-  if (!asset || asset.method.kind !== "internal") return null;
-  const skillMd = join(root, "templates", "skills", asset.method.key, "SKILL.md");
-  if (!existsSync(skillMd)) return null;
-  const fm = extractFrontmatter(readFileSync(skillMd, "utf8"));
-  return fm === null ? null : estimateTokens(fm.length);
-}
-function assetBodyTokens(assetId, root = resolveBundleRoot()) {
-  const asset = EXTERNAL_ASSETS.find((a) => a.id === assetId);
-  if (!asset || asset.method.kind !== "internal") return null;
-  const skillMd = join(root, "templates", "skills", asset.method.key, "SKILL.md");
-  if (!existsSync(skillMd)) return null;
-  const content = readFileSync(skillMd, "utf8");
-  const fm = extractFrontmatter(content);
-  if (fm === null) return estimateTokens(content.length);
-  const close = content.indexOf("\n---", content.indexOf(fm) + fm.length);
-  const body = close === -1 ? "" : content.slice(close + "\n---".length);
-  return estimateTokens(body.trim().length);
-}
-function assetCostRows(assetIds, root = resolveBundleRoot()) {
-  return assetIds.map((id) => ({
-    id,
-    descriptorTokens: assetDescriptorTokens(id, root),
-    bodyTokens: assetBodyTokens(id, root)
-  })).sort((a, b) => (b.bodyTokens ?? -1) - (a.bodyTokens ?? -1));
-}
-function makeResidentCost(base) {
-  return {
-    ...base,
-    perSkillDescriptor: base.perSkillDescriptor ?? {},
-    total: base.rules + base.projectClaudeMd + base.skillDescriptors + base.agentDescriptors,
-    directive: {
-      items: base.items.rules + base.items.claudeMd,
-      tokens: base.rules + base.projectClaudeMd
-    },
-    firing: {
-      items: base.items.skills + base.items.agents,
-      tokens: base.skillDescriptors + base.agentDescriptors
-    }
-  };
-}
-function fileTokens(path2) {
-  return existsSync(path2) ? estimateTokens(readFileSync(path2, "utf8").trim().length) : 0;
-}
-function descriptorTokens(path2) {
-  if (!existsSync(path2)) return 0;
-  const fm = extractFrontmatter(readFileSync(path2, "utf8"));
-  return fm === null ? 0 : estimateTokens(fm.length);
-}
-function landsOnDisk(target, cli) {
-  if (target.startsWith(".claude/agents/")) return cli.includes("claude");
-  return true;
-}
-function residentCost(entries, root = resolveBundleRoot()) {
-  const tpl = (source) => join(root, "templates", source);
-  const measured = (e) => e.file ?? tpl(e.source);
-  const perSkill = {};
-  let rules = 0;
-  let skillDescriptors = 0;
-  let agentDescriptors = 0;
-  let ruleItems = 0;
-  let skillItems = 0;
-  let agentItems = 0;
-  for (const e of entries) {
-    if (e.target.startsWith(".claude/rules/")) {
-      rules += fileTokens(measured(e));
-      ruleItems += 1;
-    } else if (e.target.startsWith(".claude/agents/")) {
-      agentDescriptors += descriptorTokens(measured(e));
-      agentItems += 1;
-    } else if (e.target.startsWith(".claude/skills/")) {
-      const t = descriptorTokens(join(measured(e), "SKILL.md"));
-      skillDescriptors += t;
-      skillItems += 1;
-      const id = /\.claude\/skills\/([^/]+)/.exec(e.target)?.[1];
-      if (id !== void 0) perSkill[id] = (perSkill[id] ?? 0) + t;
-    }
-  }
-  const harnessAnchor = fileTokens(join(root, "templates", "CLAUDE.md"));
-  const projectScaffold = estimateTokens(
-    withContinuousSkillsNote(
-      renderFillScaffold(),
-      CONTINUOUS_SKILLS.map((s) => s.id)
-    ).trim().length
-  );
-  const projectClaudeMd = harnessAnchor + projectScaffold;
-  const claudeMdItems = (harnessAnchor > 0 ? 1 : 0) + (projectScaffold > 0 ? 1 : 0);
-  return makeResidentCost({
-    rules,
-    projectClaudeMd,
-    skillDescriptors,
-    agentDescriptors,
-    perSkillDescriptor: perSkill,
-    items: {
-      rules: ruleItems,
-      skills: skillItems,
-      agents: agentItems,
-      claudeMd: claudeMdItems,
-      total: ruleItems + skillItems + agentItems + claudeMdItems
-    }
-  });
-}
-function summarizeContextCost(assetIds, root = resolveBundleRoot()) {
-  let measuredTokens = 0;
-  let measuredCount = 0;
-  let unmeasuredCount = 0;
-  for (const id of assetIds) {
-    const tokens = assetDescriptorTokens(id, root);
-    if (tokens === null) unmeasuredCount += 1;
-    else {
-      measuredTokens += tokens;
-      measuredCount += 1;
-    }
-  }
-  return { measuredTokens, measuredCount, unmeasuredCount };
-}
-function formatResidentCostLine(r, unmeasuredCount) {
-  if (r.total === 0) return null;
-  const parts = [
-    `directives ${r.directive.items} ~${r.directive.tokens}`,
-    `[rules ${r.items.rules} ~${r.rules} \xB7 CLAUDE.md ${r.items.claudeMd} ~${r.projectClaudeMd}]`,
-    `triggers ${r.firing.items} ~${r.firing.tokens}`,
-    `[skills ${r.items.skills} ~${r.skillDescriptors} \xB7 agents ${r.items.agents} ~${r.agentDescriptors}]`
-  ].join(" \xB7 ");
-  const external = unmeasuredCount > 0 ? ` \xB7 ${unmeasuredCount} external asset${unmeasuredCount === 1 ? "" : "s"} unmeasured` : "";
-  return `session-start context cost: ${r.items.total} items resident \xB7 ~${r.total} tokens/session (${parts}${external})`;
-}
-var RESIDENT_ROWS = [
-  {
-    // ADR-083 — 축 소계를 **행으로** 낸다. 소계가 없으면 읽는 사람이 네 줄을 머리로 더해야
-    // 하고, 그러면 "무엇을 줄여야 하나"가 표에서 안 보인다.
-    label: "\uC9C0\uC2DC\uBB38",
-    gap: 13,
-    count: (r) => r.directive.items,
-    tokens: (r) => r.directive.tokens
-  },
-  { label: "  rules", gap: 12, count: (r) => r.items.rules, tokens: (r) => r.rules },
-  {
-    // 한 행에 두 파일(앵커 + 스캐폴드). 개수 열이 2 를 뱉어 그 사실을 드러낸다 — 라벨로
-    // 하나만 이름 붙이면 v26.140.0 이전과 같은 거짓 라벨이 된다.
-    label: "  CLAUDE.md",
-    gap: 8,
-    count: (r) => r.items.claudeMd,
-    tokens: (r) => r.projectClaudeMd
-  },
-  {
-    label: "\uBC1C\uD654 \uD45C\uBA74",
-    gap: 10,
-    count: (r) => r.firing.items,
-    tokens: (r) => r.firing.tokens
-  },
-  {
-    label: "  skill descriptors",
-    gap: 0,
-    count: (r) => r.items.skills,
-    tokens: (r) => r.skillDescriptors
-  },
-  {
-    label: "  agent descriptors",
-    gap: 0,
-    count: (r) => r.items.agents,
-    tokens: (r) => r.agentDescriptors
-  }
-];
-function formatResidentCostBlock(r) {
-  const n = (v) => String(v).padStart(3);
-  return [
-    "                       \uAC1C\uC218    \uD1A0\uD070",
-    ...RESIDENT_ROWS.map(
-      (row) => `  ${row.label}${" ".repeat(row.gap)}${n(row.count(r))}\uAC1C  ~${row.tokens(r)}`
-    ),
-    "  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
-    `  \uC0C1\uC8FC \uD569\uACC4          ${n(r.items.total)}\uAC1C \uC0C1\uC8FC \xB7 ~${r.total} tokens/\uC138\uC158`,
-    "",
-    "  \uC9C0\uC2DC\uBB38 = \uC6B0\uB9AC\uAC00 \uD56D\uC0C1 \uC77D\uD788\uAC8C \uB123\uC740 \uAC83. **\uC791\uC744\uC218\uB85D \uC88B\uC740 \uAC12\uC774 \uC544\uB2C8\uB2E4** \u2014 \uD310\uB2E8\uC740",
-    "           '\uBD88\uD544\uC694\uD55C \uC9C0\uC2DC\uBB38\uC774 \uC788\uB098'\uB85C \uD55C\uB2E4. ratchet \uC740 \uC870\uC6A9\uD55C \uC99D\uAC00\uB9CC \uB9C9\uB294\uB2E4.",
-    "  \uBC1C\uD654 \uD45C\uBA74 = \uC2A4\uD0AC\xB7\uC5D0\uC774\uC804\uD2B8\uAC00 \uBD88\uB9AC\uB824\uACE0 \uC0C1\uC8FC\uC2DC\uD0A4\uB294 descriptor. \uAE4E\uC73C\uBA74 \uC548 \uBD88\uB9B0\uB2E4."
-  ];
-}
-
-// src/manifest.ts
-init_esm_shims();
-
-// src/install-log.ts
-init_esm_shims();
-import { createHash } from "crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, rmSync, writeFileSync } from "fs";
-import { dirname as dirname2, join as join3 } from "path";
-
-// src/cli-targets.ts
-init_esm_shims();
-var CLI_BASE_SORT_ORDER = {
-  claude: 0,
-  codex: 1,
-  opencode: 2,
-  antigravity: 3
-};
-function parseCliTargets(input) {
-  const items = normalizeInput(input);
-  if (items.length === 0) {
-    return { ok: true, targets: ["claude"], warnings: [] };
-  }
-  const collected = /* @__PURE__ */ new Set();
-  const warnings = [];
-  for (const item of items) {
-    if (!isCliBase(item)) {
-      let hint = "";
-      if (item === "both") {
-        hint = "\n         v0.8.0 removed 'both' alias. Use --cli claude --cli codex.";
-      } else if (item === "all") {
-        hint = "\n         v0.8.0 removed 'all' alias. Use --cli claude --cli codex --cli opencode.";
-      } else if (item.includes(",")) {
-        hint = "\n         Tip: comma-separated not supported. Use --cli A --cli B for multiple.";
-      }
-      return {
-        ok: false,
-        targets: ["claude"],
-        warnings,
-        error: `Invalid --cli value: ${item}. Must be one of: ${CLI_BASES.join(" | ")}${hint}`
-      };
-    }
-    collected.add(item);
-  }
-  const targets = [...collected].sort((a, b) => CLI_BASE_SORT_ORDER[a] - CLI_BASE_SORT_ORDER[b]);
-  return { ok: true, targets, warnings };
-}
-function normalizeInput(input) {
-  if (input === void 0 || input === null) return [];
-  if (typeof input === "string") {
-    const trimmed = input.trim();
-    return trimmed === "" ? [] : [trimmed];
-  }
-  return input.filter((s) => typeof s === "string" && s.trim() !== "").map((s) => s.trim());
-}
-function targetsInclude(targets, base) {
-  return targets.includes(base);
+function mergeOutside(...lists) {
+  const out = /* @__PURE__ */ new Map();
+  for (const list of lists) for (const o of list) if (!out.has(o.path)) out.set(o.path, o);
+  return [...out.values()];
 }
 
 // src/fs-ops.ts
-init_esm_shims();
-import {
-  copyFileSync,
-  cpSync,
-  existsSync as existsSync2,
-  constants as fsConstants,
-  mkdirSync,
-  readdirSync,
-  readFileSync as readFileSync2,
-  realpathSync,
-  renameSync,
-  rmdirSync
-} from "fs";
-import { dirname, join as join2 } from "path";
 function ensureDir(path2) {
   mkdirSync(path2, { recursive: true });
 }
 function copyFile(source, target) {
-  if (!existsSync2(source)) {
+  if (!existsSync(source)) {
     throw new Error(`Source not found: ${source}`);
   }
-  mkdirSync(dirname(target), { recursive: true });
+  mkdirSync(dirname2(target), { recursive: true });
   copyFileSync(source, target);
 }
 function copyDir(source, target, foreignOf) {
-  if (!existsSync2(source)) {
+  if (!existsSync(source)) {
     throw new Error(`Source dir not found: ${source}`);
   }
   mkdirSync(target, { recursive: true });
@@ -1467,7 +1304,7 @@ function claimBackupPath(base, claim) {
   throw new Error(`Cannot allocate a backup path for ${base} (${MAX_BACKUP_CLAIMS} taken)`);
 }
 function backupDir(target, now = /* @__PURE__ */ new Date()) {
-  if (!existsSync2(target)) {
+  if (!existsSync(target)) {
     return null;
   }
   const backup = claimBackupPath(`${target}.backup-${formatStamp(now)}`, (c) => mkdirSync(c));
@@ -1476,21 +1313,44 @@ function backupDir(target, now = /* @__PURE__ */ new Date()) {
   return backup;
 }
 function copyBackupDir(target, now = /* @__PURE__ */ new Date()) {
-  if (!existsSync2(target)) {
+  if (!existsSync(target)) {
     return null;
   }
   const backup = claimBackupPath(`${target}.backup-${formatStamp(now)}`, (c) => mkdirSync(c));
-  cpSync(realpathSync(target), backup, { recursive: true });
+  try {
+    copyTreePreservingLinks(realpathSync2(target), backup);
+  } catch (e) {
+    rmSync(backup, { recursive: true, force: true });
+    const detail = e instanceof Error ? e.message : String(e);
+    throw new Error(`backup of ${target} failed, partial copy removed \u2014 ${detail}`);
+  }
   return backup;
 }
+function copyTreePreservingLinks(source, target) {
+  mkdirSync(target, { recursive: true });
+  for (const entry of readdirSync(source, { withFileTypes: true })) {
+    const src = join2(source, entry.name);
+    const dst = join2(target, entry.name);
+    if (entry.isSymbolicLink()) {
+      symlinkSync(readlinkSync2(src), dst);
+      continue;
+    }
+    if (entry.isDirectory()) copyTreePreservingLinks(src, dst);
+    else if (entry.isFile()) copyFile(src, dst);
+  }
+}
 function backupFile(target, now = /* @__PURE__ */ new Date()) {
   return claimBackupPath(
     `${target}.backup-${formatStamp(now)}`,
     (c) => copyFileSync(target, c, fsConstants.COPYFILE_EXCL)
   );
 }
+function backupOriginal(backupPath) {
+  const m = /^(.+)\.backup-\d{8}T\d{6}(?:-\d+)?$/.exec(backupPath);
+  return m?.[1] ?? null;
+}
 function listFilesRecursive(dir, prefix = "") {
-  if (!existsSync2(dir)) return [];
+  if (!existsSync(dir)) return [];
   const out = [];
   for (const entry of readdirSync(dir, { withFileTypes: true })) {
     const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
@@ -1515,9 +1375,93 @@ function ensureProjectSkeleton(projectDir) {
     "docs/decisions"
   ];
   for (const d of dirs) {
+    if (outsideProjectTarget(projectDir, join2(projectDir, d)) !== null) continue;
     mkdirSync(join2(projectDir, d), { recursive: true });
   }
 }
+function dirTreesIdentical(a, b) {
+  if (!existsSync(a) || !existsSync(b)) return false;
+  const signature = (root, rel = "", out = /* @__PURE__ */ new Map()) => {
+    for (const e of readdirSync(join2(root, rel), { withFileTypes: true })) {
+      const r = rel === "" ? e.name : `${rel}/${e.name}`;
+      if (e.isSymbolicLink()) out.set(r, `link:${readlinkSync2(join2(root, r))}`);
+      else if (e.isDirectory()) signature(root, r, out);
+      else if (e.isFile()) {
+        out.set(
+          r,
+          createHash("sha256").update(readFileSync(join2(root, r))).digest("hex")
+        );
+      }
+    }
+    return out;
+  };
+  const sa = signature(a);
+  const sb = signature(b);
+  if (sa.size !== sb.size) return false;
+  for (const [rel, sha] of sa) {
+    if (sb.get(rel) !== sha) return false;
+  }
+  return true;
+}
+function backupIfLossyUtf8(target, now = /* @__PURE__ */ new Date()) {
+  if (!existsSync(target)) return null;
+  let raw;
+  try {
+    raw = readFileSync(target);
+  } catch {
+    return null;
+  }
+  if (Buffer.from(raw.toString("utf8")).equals(raw)) return null;
+  const backup = backupFile(target, now);
+  console.error(
+    `\u26A0 ${target} contains bytes that are not valid UTF-8 \u2014 rewriting would alter them permanently. Original bytes saved as ${backup}`
+  );
+  return backup;
+}
+
+// src/track-heal.ts
+init_esm_shims();
+import { lstatSync as lstatSync2, readFileSync as readFileSync2 } from "fs";
+import { join as join3 } from "path";
+var META_FILE = ".claude/.installed-tracks";
+var META_KEY = ".installed-tracks";
+function memoTargets(render) {
+  const cache = /* @__PURE__ */ new Map();
+  return (tracks) => {
+    const key = [...tracks].sort().join(",");
+    const hit = cache.get(key) ?? new Set(render(tracks));
+    cache.set(key, hit);
+    return hit;
+  };
+}
+var claudeTargets = memoTargets((tracks) => {
+  const spec = buildAssetSpec({ tracks, options: DEFAULT_OPTIONS });
+  return buildManifest(spec).filter((e) => e.applies(spec) && (e.type === "file" || e.target.startsWith(".claude/skills/"))).map((e) => e.target);
+});
+function claudeRecorded(log) {
+  return /* @__PURE__ */ new Set([
+    ...(log.policyFiles ?? []).map((f) => `.claude/${f.path}`),
+    ...(log.skillFiles ?? []).map((f) => `.claude/skills/${f.path.split("/")[0] ?? ""}`)
+  ]);
+}
+function healRecordedTracks(log, projectDir, clis) {
+  if (!clis.includes("claude")) return log;
+  const recorded = log.spec.tracks.filter(isTrack);
+  const added = metafileTracks(log, projectDir).filter((t) => !recorded.includes(t));
+  if (added.length === 0) return log;
+  return {
+    ...log,
+    spec: { ...log.spec, tracks: [.../* @__PURE__ */ new Set([...log.spec.tracks, ...added])].sort() }
+  };
+}
+function metafileTracks(log, projectDir) {
+  const abs = join3(projectDir, META_FILE);
+  if (lstatSync2(abs, { throwIfNoEntry: false })?.isFile() !== true) return [];
+  const content = readFileSync2(abs, "utf8");
+  const sha = log.policyFiles?.find((f) => f.path === META_KEY)?.sha256;
+  if (sha === void 0 || hashContent(content) !== sha) return [];
+  return content.split("\n").map((l) => l.trim()).filter(isTrack);
+}
 
 // src/install-log.ts
 var INSTALL_LOG_FILENAME = ".harness-install.json";
@@ -1546,9 +1490,22 @@ function installedClis(log) {
 function sortClis(clis) {
   return [...new Set(clis)].filter(isCliBase).sort((a, b) => CLI_BASE_SORT_ORDER[a] - CLI_BASE_SORT_ORDER[b]);
 }
-function buildAssetEntries(report, scope) {
+function buildAssetEntries(report, scope, previous) {
   if (!report) return [];
-  return report.attempted.filter((r) => r.ok).map((r) => assetToLogEntry(r.asset, scope, r.version));
+  return report.attempted.filter((r) => r.ok).map((r) => {
+    const entry = assetToLogEntry(r.asset, scope, r.version);
+    if (r.files === void 0) return entry;
+    const recordedBefore = previous?.find((a) => a.id === r.asset.id);
+    if (recordedBefore !== void 0 && recordedBefore.files === void 0) return entry;
+    return { ...entry, files: mergeToolFiles(recordedBefore?.files, r.files) };
+  });
+}
+function mergeToolFiles(prior, run) {
+  const changed = new Map(run.changed.map((f) => [f.path, f.sha256]));
+  const byPath = /* @__PURE__ */ new Map();
+  for (const f of prior ?? []) byPath.set(f.path, changed.get(f.path) ?? f.sha256);
+  for (const f of run.created) byPath.set(f.path, f.sha256);
+  return [...byPath].map(([path2, sha256]) => ({ path: path2, sha256 }));
 }
 function assetToLogEntry(asset, scope, version) {
   const detail = methodDetail(asset.method);
@@ -1577,7 +1534,7 @@ function methodDetail(method) {
   }
 }
 var BUNDLED_SKILL_IDS = new Set(INTERNAL_BUNDLED_SKILL_IDS);
-function buildInstallLog(spec, external, scope, rootClaudeMd, previous, claudeDirMovedAside = false, rootFiles = []) {
+function buildInstallLog(spec, external, scope, rootClaudeMd, previous, claudeDirMovedAside = false, rootFiles = [], codexTrust) {
   const skillExclude = (spec.userOverride?.forceExclude ?? []).filter(
     (id) => BUNDLED_SKILL_IDS.has(id)
   );
@@ -1588,12 +1545,15 @@ function buildInstallLog(spec, external, scope, rootClaudeMd, previous, claudeDi
     ...rootClaudeMd ? { rootClaudeMd } : {}
   };
   const clis = sortClis([...installedClis(previous ?? null), ...spec.cli.filter(isCliBase)]);
+  const tracks = [
+    .../* @__PURE__ */ new Set([...(previous?.spec.tracks ?? []).filter(isTrack), ...spec.tracks])
+  ].sort();
   const log = {
     schemaVersion: INSTALL_LOG_VERSION,
     installedAt: (/* @__PURE__ */ new Date()).toISOString(),
     scope,
     spec: {
-      tracks: spec.tracks,
+      tracks,
       cli: spec.cli,
       clis,
       ...spec.baselineExclude && spec.baselineExclude.length > 0 ? { baselineExclude: spec.baselineExclude } : {},
@@ -1604,11 +1564,13 @@ function buildInstallLog(spec, external, scope, rootClaudeMd, previous, claudeDi
     templates: { ...previous?.templates, ...templates },
     assets: mergeAssets(
       claudeDirMovedAside ? previous?.assets?.filter(survivesClaudeDirRename) : previous?.assets,
-      buildAssetEntries(external, scope)
+      buildAssetEntries(external, scope, previous?.assets)
     )
   };
   const mergedRootFiles = mergeRootFiles(previous?.rootFiles, rootFiles);
   if (mergedRootFiles.length > 0) log.rootFiles = mergedRootFiles;
+  const trust = codexTrust ?? previous?.codexTrust;
+  if (trust) log.codexTrust = trust;
   return log;
 }
 function mergeRootFiles(previous, current) {
@@ -1657,35 +1619,35 @@ function mergeAssets(previous, current) {
   ];
 }
 function hashContent(content) {
-  return createHash("sha256").update(content, "utf8").digest("hex");
+  return createHash2("sha256").update(content, "utf8").digest("hex");
 }
 function isHarnessOwned(baseline, key, current) {
   const recorded = baseline.get(key);
   return recorded !== void 0 && recorded === hashContent(current);
 }
-function mergeExternalFiles(projectDir, previous, current) {
+function mergeExternalFiles(previous, current) {
   const byPath = /* @__PURE__ */ new Map();
   for (const file of [...previous ?? [], ...current]) byPath.set(file.path, file);
-  return [...byPath.values()].filter((f) => existsSync3(join3(projectDir, f.path)));
+  return [...byPath.values()];
 }
 function collectSkillHashes(projectDir, templatesDir) {
-  const skillsDir = join3(projectDir, ".claude/skills");
-  return listFilesRecursive(skillsDir).filter((rel) => existsSync3(join3(templatesDir, "skills", rel))).map((rel) => ({
+  const skillsDir = join4(projectDir, ".claude/skills");
+  return listFilesRecursive(skillsDir).filter((rel) => existsSync2(join4(templatesDir, "skills", rel))).map((rel) => ({
     path: rel,
-    sha256: hashContent(readFileSync3(join3(skillsDir, rel), "utf8"))
+    sha256: hashContent(readFileSync3(join4(skillsDir, rel), "utf8"))
   }));
 }
 function collectPolicyHashes(projectDir, templatesDir) {
   const out = [];
   for (const { dir, ext } of POLICY_DIRS) {
-    const targetDir = join3(projectDir, ".claude", dir);
-    const sourceDir = join3(templatesDir, dir);
+    const targetDir = join4(projectDir, ".claude", dir);
+    const sourceDir = join4(templatesDir, dir);
     for (const rel of listFilesRecursive(targetDir)) {
       if (!rel.endsWith(ext)) continue;
-      if (!existsSync3(join3(sourceDir, rel))) continue;
+      if (!existsSync2(join4(sourceDir, rel))) continue;
       out.push({
         path: `${dir}/${rel}`,
-        sha256: hashContent(readFileSync3(join3(targetDir, rel), "utf8"))
+        sha256: hashContent(readFileSync3(join4(targetDir, rel), "utf8"))
       });
     }
   }
@@ -1693,42 +1655,371 @@ function collectPolicyHashes(projectDir, templatesDir) {
 }
 function writeInstallLog(projectDir, log) {
   const path2 = installLogPath(projectDir);
-  mkdirSync2(dirname2(path2), { recursive: true });
-  writeFileSync(path2, `${JSON.stringify(log, null, 2)}
+  mkdirSync2(dirname3(path2), { recursive: true });
+  const marked = { ...normalizeLogOrder(log), excludedKeysMigrated: true };
+  writeFileSync(path2, `${JSON.stringify(marked, null, 2)}
 `, "utf8");
   migrateAwayLegacyLog(projectDir);
   return path2;
 }
+function normalizeLogOrder(log) {
+  const cmp = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+  const byPath = (xs) => [...xs].sort((a, b) => cmp(a.path, b.path));
+  const out = { ...log };
+  if (log.policyFiles !== void 0) out.policyFiles = byPath(log.policyFiles);
+  if (log.skillFiles !== void 0) out.skillFiles = byPath(log.skillFiles);
+  if (log.externalFiles !== void 0) out.externalFiles = byPath(log.externalFiles);
+  if (log.rootFiles !== void 0) out.rootFiles = byPath(log.rootFiles);
+  if (log.portions !== void 0) {
+    out.portions = [...log.portions].sort((a, b) => cmp(a.path, b.path) || cmp(a.key, b.key));
+  }
+  return out;
+}
 function migrateAwayLegacyLog(projectDir) {
   const legacy = legacyInstallLogPath(projectDir);
-  if (!existsSync3(legacy)) return;
+  if (!existsSync2(legacy)) return;
   try {
-    rmSync(legacy);
+    rmSync2(legacy);
   } catch {
   }
 }
 function readInstallLog(projectDir) {
+  return readInstallLogStatus(projectDir).log;
+}
+function readInstallLogStatus(projectDir) {
   const path2 = [installLogPath(projectDir), legacyInstallLogPath(projectDir)].find(
-    (p) => existsSync3(p)
+    (p) => existsSync2(p)
   );
-  if (!path2) return null;
+  if (!path2) return { status: "missing", log: null };
+  let parsed;
   try {
-    const parsed = JSON.parse(readFileSync3(path2, "utf8"));
-    if (Array.isArray(parsed.assets)) {
-      parsed.assets = parsed.assets.map(
-        (a) => a.method === "npm-global" ? { ...a, method: "npm" } : a
-      );
+    parsed = JSON.parse(readFileSync3(path2, "utf8"));
+  } catch {
+    return { status: "corrupted", log: null };
+  }
+  if (!isValidInstallLogShape(parsed)) return { status: "corrupted", log: null };
+  const log = parsed;
+  if (Array.isArray(log.assets)) {
+    log.assets = log.assets.map(
+      (a) => a.method === "npm-global" ? { ...a, method: "npm" } : a
+    );
+  }
+  const migrated = migrateExcluded(log, projectDir);
+  if (migrated.droppedKeys.length > 0) {
+    LEGACY_RELEASED.set(migrated.log, {
+      released: migrated.droppedKeys,
+      catalog: migrated.releasedCatalog
+    });
+  }
+  return {
+    status: "ok",
+    log: healRecordedTracks(migrated.log, projectDir, installedClis(migrated.log))
+  };
+}
+var LEGACY_RELEASED = /* @__PURE__ */ new WeakMap();
+function legacyDroppedKeys(log) {
+  return log === null ? [] : LEGACY_RELEASED.get(log)?.released ?? [];
+}
+function legacyReleasedCatalog(log) {
+  return log === null ? [] : LEGACY_RELEASED.get(log)?.catalog ?? [];
+}
+var SELECTIONS_MAX = 100;
+var HARNESS_VERSION = package_default.version;
+function appendSelection(log, ev) {
+  const empty = (a) => a === void 0 || a.length === 0;
+  if (empty(ev.with) && empty(ev.without) && empty(ev.released) && empty(ev.kept)) return log;
+  const clean = {
+    at: ev.at,
+    harness: ev.harness,
+    by: ev.by,
+    ...ev.via !== void 0 ? { via: ev.via } : {},
+    ...empty(ev.with) ? {} : { with: [...ev.with ?? []] },
+    ...empty(ev.without) ? {} : { without: [...ev.without ?? []] },
+    ...empty(ev.released) ? {} : { released: [...ev.released ?? []] },
+    ...empty(ev.kept) ? {} : { kept: [...ev.kept ?? []] },
+    ...ev.interrupted ? { interrupted: true } : {}
+  };
+  return { ...log, selections: [...log.selections ?? [], clean].slice(-SELECTIONS_MAX) };
+}
+var LEGACY_REINSTALL_WINDOW_MS = 6e5;
+function assetFiles(projectDir, asset) {
+  if (asset.files !== void 0) {
+    return asset.files.map((f) => join4(projectDir, f.path)).filter((p) => existsSync2(p));
+  }
+  const dir = asset.detail.skill ?? asset.id;
+  return [".claude/skills", ".agents/skills"].flatMap(
+    (d) => listFilesRecursive(join4(projectDir, d, dir)).map((rel) => join4(projectDir, d, dir, rel))
+  );
+}
+function legacyCatalogReleased(projectDir, log, asset) {
+  if (asset.method !== "skill" || asset.scope === "global") return false;
+  const files = assetFiles(projectDir, asset);
+  if (files.length === 0) return false;
+  const t = Date.parse(log.installedAt);
+  if (Number.isNaN(t)) return false;
+  const m = Math.max(...files.map((f) => statSync(f).mtimeMs));
+  return m <= t && m >= t - LEGACY_REINSTALL_WINDOW_MS;
+}
+function migrateExcluded(log, projectDir) {
+  if (log.excludedKeysMigrated === true) return { log, droppedKeys: [], releasedCatalog: [] };
+  const baseline = new Set(log.spec.baselineExclude ?? []);
+  const skills = new Set(log.spec.skillExclude ?? []);
+  const released = [];
+  const releasedCatalog = [];
+  const keptCatalog = [];
+  const kept = [];
+  for (const id of log.excluded ?? []) {
+    if (isKeyId(id)) {
+      released.push(id);
+      continue;
+    }
+    if (id.startsWith("baseline:") && !baseline.has(id)) {
+      released.push(id);
+      continue;
+    }
+    if (BUNDLED_SKILL_IDS.has(id) && !skills.has(id)) {
+      released.push(id);
+      continue;
+    }
+    const asset = log.assets.find((a) => a.id === id);
+    if (asset !== void 0 && !BUNDLED_SKILL_IDS.has(id) && !id.startsWith("baseline:")) {
+      if (projectDir !== void 0 && legacyCatalogReleased(projectDir, log, asset)) {
+        released.push(id);
+        releasedCatalog.push(id);
+        continue;
+      }
+      keptCatalog.push(id);
+    }
+    kept.push(id);
+  }
+  let next = { ...log, excludedKeysMigrated: true };
+  if (kept.length > 0) next.excluded = kept;
+  else delete next.excluded;
+  next = appendSelection(next, {
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    harness: HARNESS_VERSION,
+    by: "migration",
+    released,
+    kept: keptCatalog
+  });
+  return { log: next, droppedKeys: released, releasedCatalog };
+}
+function isValidInstallLogShape(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  const spec = v.spec;
+  if (typeof spec !== "object" || spec === null) return false;
+  if (!Array.isArray(spec.tracks)) return false;
+  if (!Array.isArray(v.assets)) return false;
+  if (typeof v.templates !== "object" || v.templates === null) return false;
+  return true;
+}
+function corruptedInstallLogMessage(projectDir) {
+  return `install log is corrupted at ${installLogPath(projectDir)} \u2014 if it holds git conflict markers, take one side whole; otherwise run install --reinstall (it forgets recorded exclusions and external assets)`;
+}
+function installLogPath(projectDir) {
+  return join4(projectDir, INSTALL_LOG_DIR, INSTALL_LOG_FILENAME);
+}
+function legacyInstallLogPath(projectDir) {
+  return join4(projectDir, LEGACY_INSTALL_LOG_DIR, INSTALL_LOG_FILENAME);
+}
+
+// src/project-claude-merge.ts
+init_esm_shims();
+var HARNESS_ANCHOR_FILE = "CLAUDE-uzys-harness.md";
+var HARNESS_IMPORT_LINE = `@${HARNESS_ANCHOR_FILE}`;
+var IMPORT_MARKER_START = "<!-- uzys-harness:import:start -->";
+var IMPORT_MARKER_END = "<!-- uzys-harness:import:end -->";
+var CONTINUOUS_SKILLS_HEADING = "## Skills that apply continuously";
+function renderContinuousSkillsNote(selectedInternalSkills) {
+  const lines = CONTINUOUS_SKILLS.filter((s) => selectedInternalSkills.includes(s.id)).map(
+    (s) => `- \`${s.id}\` \u2014 ${s.whenToApply}.`
+  );
+  if (lines.length === 0) return "";
+  return [
+    CONTINUOUS_SKILLS_HEADING,
+    "",
+    "These installed skills apply to every response or delegation; no prompt ever looks like their job, so open them from this list:",
+    "",
+    ...lines
+  ].join("\n");
+}
+function withContinuousSkillsNote(scaffold, selectedInternalSkills) {
+  const note = renderContinuousSkillsNote(selectedInternalSkills);
+  return note ? `${scaffold}
+
+${note}` : scaffold;
+}
+function importBlock(continuousSkills) {
+  const note = renderContinuousSkillsNote(continuousSkills);
+  const body = note ? `${HARNESS_IMPORT_LINE}
+
+${note}` : HARNESS_IMPORT_LINE;
+  return `${IMPORT_MARKER_START}
+${body}
+${IMPORT_MARKER_END}`;
+}
+var TRACK_DISPLAY_NAMES = {
+  base: "Base",
+  tooling: "Tooling",
+  "csr-supabase": "CSR Supabase",
+  "csr-fastify": "CSR Fastify",
+  "csr-fastapi": "CSR FastAPI",
+  "ssr-htmx": "SSR HTMX",
+  "ssr-nextjs": "SSR Next.js",
+  data: "Data",
+  executive: "Executive",
+  full: "Full",
+  "project-management": "Project Management",
+  "growth-marketing": "Growth Marketing"
+};
+var FULL_EXPANSION = TRACKS.filter((t) => t !== "full");
+var FILL_SECTIONS = [
+  "identity",
+  "stack",
+  "architecture",
+  "installed-assets",
+  "boundaries",
+  "verify"
+];
+var FILL_SPECS = {
+  identity: {
+    title: "Identity & Purpose",
+    prompt: `Replace the H1 title above with this project's real name, then state in 1-2 plain sentences what it does, who uses it, and why it exists. Sources: README.md, the package.json / pyproject.toml "description", docs/. Do NOT describe the harness itself. Delete this comment when done.`,
+    placeholder: "what this project is, who it is for, and why it exists"
+  },
+  stack: {
+    title: "Stack & Commands",
+    prompt: "Replace the list below with this project's REAL stack. Inspect package.json / pyproject.toml / go.mod / Cargo.toml / Gemfile + lockfiles and any Makefile/justfile/package scripts. List the language(s)+versions, framework(s), package manager, and the exact install/build/test/run commands. Verify each command exists before writing it \u2014 never guess. Delete lines that do not apply, then delete this comment.",
+    placeholder: "languages, runtimes, package manager, and the install/build/test/run commands"
+  },
+  architecture: {
+    title: "Architecture & Layout",
+    prompt: "Map this repository. List each top-level source directory and what it holds, the entry point(s), the 3-5 files a newcomer reads first, and how data/requests flow between the main layers. View the real tree (e.g. `git ls-files | sed 's#/.*##' | sort -u`) \u2014 do not assume a framework's conventional layout. Flag any generated/vendored directories that must never be hand-edited. If this is a single small module, say so in one line. Delete this comment when done.",
+    placeholder: "where things live, the entry points, and how data flows between layers"
+  },
+  "installed-assets": {
+    title: "Installed Harness Assets",
+    prompt: "List the harness assets installed in this project (rules / skills / agents / commands) and add one line each on when to reach for it here. Verify against .claude/rules/*.md, .claude/skills/, .claude/agents/, .claude/commands/ (or this CLI's equivalent) and list ONLY assets whose file exists on disk \u2014 do not invent any. Do NOT restate the harness's working principles (they live in this project's harness anchor and rules layer) \u2014 cross-reference them instead. Delete this comment when done.",
+    placeholder: "the installed rules/skills/agents/commands and when to use each"
+  },
+  boundaries: {
+    title: "Boundaries \u2014 Always / Ask First / Never",
+    prompt: `Fill the Always / Ask First / Never lists with this repo's real red lines. Read the CI config, CODEOWNERS, .gitignore, and release/deploy scripts. Never must include secrets, generated files, force-push, and direct commits to the default branch, plus any repo-specific "do not touch" directories. Every entry must be specific and enforceable here. Delete this comment when done.`,
+    placeholder: "what to always do, ask before doing, and never do in this repo"
+  },
+  verify: {
+    title: "Verification Gate",
+    prompt: 'State the single command (or short sequence) that PROVES a change is safe here \u2014 the test/lint/typecheck/build gate you run before committing \u2014 plus the coverage/CI threshold and what "done" means. Sources: package scripts, CI workflow files, CONTRIBUTING. An agent must be able to self-verify without guessing. Delete this comment when done.',
+    placeholder: "the single command that proves a change is safe, and the done bar"
+  }
+};
+function anchorLine(surface) {
+  if (surface === "claude") {
+    return `> The working principles live in this project's harness anchor \`${HARNESS_ANCHOR_FILE}\`, imported at the bottom of this file. Everything above that import is **project-specific context only**.`;
+  }
+  const self = surface === "antigravity-rule" ? "`.agents/rules/uzys-harness.md`" : "`AGENTS.md`";
+  return `> **This file (${self}) is the harness anchor** \u2014 it carries the working principles in full, further down. Only the \`## \u2026\` sections immediately below are project-specific context for you to fill in.`;
+}
+function scaffoldBanner(surface) {
+  return [
+    "> \u2699\uFE0F **SCAFFOLD \u2014 not filled in yet.** The sections below are a fill-in template for THIS project, not verified facts.",
+    "> To fill: open this file and paste each `<!-- FILL: \u2026 -->` comment's instruction into your coding agent (e.g. Claude Code) \u2014 it will inspect the real repo and write the section. You can also fill them by hand; the comments are the instructions.",
+    anchorLine(surface)
+  ].join("\n");
+}
+function renderFillScaffold(surface = "claude") {
+  const blocks = FILL_SECTIONS.map((id) => {
+    const spec = FILL_SPECS[id];
+    return `## ${spec.title}
+
+<!-- FILL:${id} \u2014 ${spec.prompt} -->
+
+_(not filled yet \u2014 ${spec.placeholder})_`;
+  });
+  return `${scaffoldBanner(surface)}
+
+${blocks.join("\n\n")}`;
+}
+function mergeProjectClaude(opts) {
+  const expanded = expandTracks(opts.tracks);
+  const trackList = expanded.map((t) => TRACK_DISPLAY_NAMES[t]).join(", ");
+  const header = `# ${opts.projectName}
+
+> Active track(s): ${trackList}`;
+  return `${header}
+
+${opts.projectContext ?? renderFillScaffold()}
+`;
+}
+function upsertHarnessImport(existing, opts) {
+  const block = importBlock(opts.continuousSkills ?? []);
+  if (existing === null) {
+    return `${mergeProjectClaude(opts)}
+${block}
+`;
+  }
+  const start = existing.indexOf(IMPORT_MARKER_START);
+  if (start !== -1) {
+    const endAt = existing.indexOf(IMPORT_MARKER_END, start);
+    if (endAt === -1) return existing;
+    const current = existing.slice(start, endAt + IMPORT_MARKER_END.length);
+    if (current === block) return existing;
+    return `${existing.slice(0, start)}${block}${existing.slice(endAt + IMPORT_MARKER_END.length)}`;
+  }
+  if (hasHarnessImport(existing)) {
+    return existing;
+  }
+  const body = existing.endsWith("\n") ? existing : `${existing}
+`;
+  return `${body}
+${block}
+`;
+}
+function stripHarnessImport(text) {
+  if (!text.includes(IMPORT_MARKER_START) && !text.includes(IMPORT_MARKER_END)) return null;
+  const endsWithNewline = text.endsWith("\n");
+  const out = [];
+  const lines = text.split("\n");
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i] ?? "";
+    if (line.includes(IMPORT_MARKER_START)) {
+      let j = i;
+      while (j < lines.length && !(lines[j] ?? "").includes(IMPORT_MARKER_END)) j++;
+      i = j < lines.length ? j + 1 : i + 1;
+      if (out.length > 0 && out[out.length - 1] === "") out.pop();
+      continue;
+    }
+    if (line.includes(IMPORT_MARKER_END) || line.trim() === HARNESS_IMPORT_LINE) {
+      i++;
+      continue;
+    }
+    out.push(line);
+    i++;
+  }
+  let result = out.join("\n");
+  if (endsWithNewline && result !== "" && !result.endsWith("\n")) result += "\n";
+  if (!endsWithNewline && result.endsWith("\n")) result = result.slice(0, -1);
+  return result === text ? null : result;
+}
+function hasHarnessImport(text) {
+  if (text.includes(IMPORT_MARKER_START)) return true;
+  let inFence = false;
+  for (const line of text.split("\n")) {
+    if (/^\s*(?:```|~~~)/.test(line)) {
+      inFence = !inFence;
+      continue;
     }
-    return parsed;
-  } catch {
-    return null;
+    if (!inFence && line.trim() === HARNESS_IMPORT_LINE) return true;
   }
+  return false;
 }
-function installLogPath(projectDir) {
-  return join3(projectDir, INSTALL_LOG_DIR, INSTALL_LOG_FILENAME);
-}
-function legacyInstallLogPath(projectDir) {
-  return join3(projectDir, LEGACY_INSTALL_LOG_DIR, INSTALL_LOG_FILENAME);
+function expandTracks(tracks) {
+  if (tracks.includes("full")) {
+    return FULL_EXPANSION;
+  }
+  return tracks;
 }
 
 // src/manifest.ts
@@ -1743,7 +2034,6 @@ function buildAssetSpec(ctx) {
 }
 var all = () => true;
 var dev = (s) => hasDevTrack(s.tracks);
-var ui = (s) => hasUiTrack(s.tracks);
 var onTracks = (pattern) => (s) => anyTrack(s.tracks, pattern);
 var COMMON_RULES = ["git-policy", "change-management", "doc-governance"];
 var DEV_RULES = ["test-policy", "ship-checklist"];
@@ -1856,7 +2146,6 @@ var RETIRED_AGENT_IDS = RETIRED_PATHS.filter(
 var ALWAYS_HOOKS = ["session-start.sh", "protect-files.sh"];
 var COMMON_SKILL_DIRS = [];
 var DEV_SKILL_DIRS = [];
-var UI_SKILL_DIRS = ["ui-visual-review"];
 function isCliNeutralTarget(target) {
   return target.startsWith(`${INSTALL_LOG_DIR}/`);
 }
@@ -1931,7 +2220,14 @@ function buildManifest(spec) {
       source: `skills/${sd}`,
       target: `.claude/skills/${sd}`,
       type: "dir",
-      applies: (s) => (s.selectedInternalSkills ?? []).includes(sd)
+      // #602 — selectedInternalSkills 가 SSOT(위저드 해제·--without 반영). `tracks` 만 담긴
+      // 스펙(listBaselineTargets·위저드 1단계 등)에서는 카탈로그 조건으로 판정한다 —
+      // buildAssetSpec 와 같은 isAssetSelected 라 두 번 적는 사본이 아니라 같은 원천이다.
+      applies: (s) => s.selectedInternalSkills !== void 0 ? s.selectedInternalSkills.includes(sd) : (
+        // #602 폴백은 트랙 추종 번들 스킬 한정 — 카탈로그 옵트인(compaction-handoff 등)은
+        // 선택 목록 없이는 깔리지 않는다(위저드 해제·--without 의 SSOT 를 우회하는 금이 된다).
+        sd === "ui-visual-review" && isAssetSelected(sd, { tracks: s.tracks, options: { withCodexTrust: false } })
+      )
     });
   }
   for (const sd of DEV_SKILL_DIRS) {
@@ -1942,14 +2238,6 @@ function buildManifest(spec) {
       applies: dev
     });
   }
-  for (const sd of UI_SKILL_DIRS) {
-    m.push({
-      source: `skills/${sd}`,
-      target: `.claude/skills/${sd}`,
-      type: "dir",
-      applies: ui
-    });
-  }
   for (const h of ALWAYS_HOOKS) {
     m.push({
       source: `hooks/${h}`,
@@ -1967,6 +2255,212 @@ function buildManifest(spec) {
   return m;
 }
 
+// src/context-cost.ts
+init_esm_shims();
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
+import { join as join5, resolve as resolve2 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var CHARS_PER_TOKEN = 4;
+function estimateTokens(chars) {
+  return Math.ceil(chars / CHARS_PER_TOKEN);
+}
+function resolveBundleRoot() {
+  return resolve2(fileURLToPath2(new URL(".", import.meta.url)), "..");
+}
+function extractFrontmatter(content) {
+  const m = content.match(/^?---\r?\n([\s\S]*?)\r?\n---/);
+  return m?.[1] ?? null;
+}
+function assetDescriptorTokens(assetId, root = resolveBundleRoot()) {
+  const asset = EXTERNAL_ASSETS.find((a) => a.id === assetId);
+  if (!asset || asset.method.kind !== "internal") return null;
+  const skillMd = join5(root, "templates", "skills", asset.method.key, "SKILL.md");
+  if (!existsSync3(skillMd)) return null;
+  const fm = extractFrontmatter(readFileSync4(skillMd, "utf8"));
+  return fm === null ? null : estimateTokens(fm.length);
+}
+function assetBodyTokens(assetId, root = resolveBundleRoot()) {
+  const asset = EXTERNAL_ASSETS.find((a) => a.id === assetId);
+  if (!asset || asset.method.kind !== "internal") return null;
+  const skillMd = join5(root, "templates", "skills", asset.method.key, "SKILL.md");
+  if (!existsSync3(skillMd)) return null;
+  const content = readFileSync4(skillMd, "utf8");
+  const fm = extractFrontmatter(content);
+  if (fm === null) return estimateTokens(content.length);
+  const close = content.indexOf("\n---", content.indexOf(fm) + fm.length);
+  const body = close === -1 ? "" : content.slice(close + "\n---".length);
+  return estimateTokens(body.trim().length);
+}
+function assetCostRows(assetIds, root = resolveBundleRoot()) {
+  return assetIds.map((id) => ({
+    id,
+    descriptorTokens: assetDescriptorTokens(id, root),
+    bodyTokens: assetBodyTokens(id, root)
+  })).sort((a, b) => (b.bodyTokens ?? -1) - (a.bodyTokens ?? -1));
+}
+function makeResidentCost(base) {
+  return {
+    ...base,
+    contextFile: base.contextFile ?? "CLAUDE.md",
+    perSkillDescriptor: base.perSkillDescriptor ?? {},
+    total: base.rules + base.projectClaudeMd + base.skillDescriptors + base.agentDescriptors,
+    directive: {
+      items: base.items.rules + base.items.claudeMd,
+      tokens: base.rules + base.projectClaudeMd
+    },
+    firing: {
+      items: base.items.skills + base.items.agents,
+      tokens: base.skillDescriptors + base.agentDescriptors
+    }
+  };
+}
+function fileTokens(path2) {
+  return existsSync3(path2) ? estimateTokens(readFileSync4(path2, "utf8").trim().length) : 0;
+}
+function descriptorTokens(path2) {
+  if (!existsSync3(path2)) return 0;
+  const fm = extractFrontmatter(readFileSync4(path2, "utf8"));
+  return fm === null ? 0 : estimateTokens(fm.length);
+}
+function anchorSurface(cli) {
+  if (cli.includes("claude") || cli.length === 0) {
+    return { label: "CLAUDE.md", files: 2, scaffold: "claude" };
+  }
+  if (cli.includes("codex") || cli.includes("opencode")) {
+    return { label: "AGENTS.md", files: 1, scaffold: "agents-md" };
+  }
+  return { label: ".agents/rules/uzys-harness.md", files: 1, scaffold: "antigravity-rule" };
+}
+function residentCost(entries, root = resolveBundleRoot(), cli = ["claude"], contextFiles) {
+  const tpl = (source) => join5(root, "templates", source);
+  const measured = (e) => e.file ?? tpl(e.source);
+  const perSkill = {};
+  let rules = 0;
+  let skillDescriptors = 0;
+  let agentDescriptors = 0;
+  let ruleItems = 0;
+  let skillItems = 0;
+  let agentItems = 0;
+  for (const e of entries) {
+    if (e.target.startsWith(".claude/rules/")) {
+      rules += fileTokens(measured(e));
+      ruleItems += 1;
+    } else if (e.target.startsWith(".claude/agents/")) {
+      agentDescriptors += descriptorTokens(measured(e));
+      agentItems += 1;
+    } else if (e.target.startsWith(".claude/skills/")) {
+      const t = descriptorTokens(join5(measured(e), "SKILL.md"));
+      skillDescriptors += t;
+      skillItems += 1;
+      const id = /\.claude\/skills\/([^/]+)/.exec(e.target)?.[1];
+      if (id !== void 0) perSkill[id] = (perSkill[id] ?? 0) + t;
+    }
+  }
+  const harnessAnchor = fileTokens(join5(root, "templates", "CLAUDE.md"));
+  const surface = anchorSurface(cli);
+  const projectScaffold = estimateTokens(
+    withContinuousSkillsNote(
+      renderFillScaffold(surface.scaffold),
+      CONTINUOUS_SKILLS.map((s) => s.id)
+    ).trim().length
+  );
+  const onDisk = contextFiles?.map(fileTokens).filter((t) => t > 0);
+  const projectClaudeMd = onDisk === void 0 ? harnessAnchor + projectScaffold : onDisk.reduce((a, b) => a + b, 0);
+  const claudeMdItems = onDisk !== void 0 ? onDisk.length : surface.files === 1 ? 1 : (harnessAnchor > 0 ? 1 : 0) + (projectScaffold > 0 ? 1 : 0);
+  return makeResidentCost({
+    rules,
+    projectClaudeMd,
+    skillDescriptors,
+    agentDescriptors,
+    perSkillDescriptor: perSkill,
+    contextFile: surface.label,
+    items: {
+      rules: ruleItems,
+      skills: skillItems,
+      agents: agentItems,
+      claudeMd: claudeMdItems,
+      total: ruleItems + skillItems + agentItems + claudeMdItems
+    }
+  });
+}
+function summarizeContextCost(assetIds, root = resolveBundleRoot()) {
+  let measuredTokens = 0;
+  let measuredCount = 0;
+  let unmeasuredCount = 0;
+  for (const id of assetIds) {
+    const tokens = assetDescriptorTokens(id, root);
+    if (tokens === null) unmeasuredCount += 1;
+    else {
+      measuredTokens += tokens;
+      measuredCount += 1;
+    }
+  }
+  return { measuredTokens, measuredCount, unmeasuredCount };
+}
+function formatResidentCostLine(r, unmeasuredCount) {
+  if (r.total === 0) return null;
+  const parts = [
+    `directives ${r.directive.items} ~${r.directive.tokens}`,
+    `[rules ${r.items.rules} ~${r.rules} \xB7 ${r.contextFile} ${r.items.claudeMd} ~${r.projectClaudeMd}]`,
+    `triggers ${r.firing.items} ~${r.firing.tokens}`,
+    `[skills ${r.items.skills} ~${r.skillDescriptors} \xB7 agents ${r.items.agents} ~${r.agentDescriptors}]`
+  ].join(" \xB7 ");
+  const external = unmeasuredCount > 0 ? ` \xB7 ${unmeasuredCount} external asset${unmeasuredCount === 1 ? "" : "s"} unmeasured` : "";
+  return `session-start context cost: ${r.items.total} items resident \xB7 ~${r.total} tokens/session (${parts}${external})`;
+}
+var RESIDENT_ROWS = [
+  {
+    // ADR-083 — 축 소계를 **행으로** 낸다. 소계가 없으면 읽는 사람이 네 줄을 머리로 더해야
+    // 하고, 그러면 "무엇을 줄여야 하나"가 표에서 안 보인다.
+    label: "\uC9C0\uC2DC\uBB38",
+    gap: 13,
+    count: (r) => r.directive.items,
+    tokens: (r) => r.directive.tokens
+  },
+  { label: "  rules", gap: 12, count: (r) => r.items.rules, tokens: (r) => r.rules },
+  {
+    // 한 행에 두 파일(앵커 + 스캐폴드). 개수 열이 2 를 뱉어 그 사실을 드러낸다 — 라벨로
+    // 하나만 이름 붙이면 v26.140.0 이전과 같은 거짓 라벨이 된다.
+    label: "  CLAUDE.md",
+    gap: 8,
+    count: (r) => r.items.claudeMd,
+    tokens: (r) => r.projectClaudeMd
+  },
+  {
+    label: "\uBC1C\uD654 \uD45C\uBA74",
+    gap: 10,
+    count: (r) => r.firing.items,
+    tokens: (r) => r.firing.tokens
+  },
+  {
+    label: "  skill descriptors",
+    gap: 0,
+    count: (r) => r.items.skills,
+    tokens: (r) => r.skillDescriptors
+  },
+  {
+    label: "  agent descriptors",
+    gap: 0,
+    count: (r) => r.items.agents,
+    tokens: (r) => r.agentDescriptors
+  }
+];
+function formatResidentCostBlock(r) {
+  const n = (v) => String(v).padStart(3);
+  return [
+    "                       \uAC1C\uC218    \uD1A0\uD070",
+    ...RESIDENT_ROWS.map(
+      (row) => `  ${row.label}${" ".repeat(row.gap)}${n(row.count(r))}\uAC1C  ~${row.tokens(r)}`
+    ),
+    "  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
+    `  \uC0C1\uC8FC \uD569\uACC4          ${n(r.items.total)}\uAC1C \uC0C1\uC8FC \xB7 ~${r.total} tokens/\uC138\uC158`,
+    "",
+    "  \uC9C0\uC2DC\uBB38 = \uC6B0\uB9AC\uAC00 \uD56D\uC0C1 \uC77D\uD788\uAC8C \uB123\uC740 \uAC83. **\uC791\uC744\uC218\uB85D \uC88B\uC740 \uAC12\uC774 \uC544\uB2C8\uB2E4** \u2014 \uD310\uB2E8\uC740",
+    "           '\uBD88\uD544\uC694\uD55C \uC9C0\uC2DC\uBB38\uC774 \uC788\uB098'\uB85C \uD55C\uB2E4. ratchet \uC740 \uC870\uC6A9\uD55C \uC99D\uAC00\uB9CC \uB9C9\uB294\uB2E4.",
+    "  \uBC1C\uD654 \uD45C\uBA74 = \uC2A4\uD0AC\xB7\uC5D0\uC774\uC804\uD2B8\uAC00 \uBD88\uB9AC\uB824\uACE0 \uC0C1\uC8FC\uC2DC\uD0A4\uB294 descriptor. \uAE4E\uC73C\uBA74 \uC548 \uBD88\uB9B0\uB2E4."
+  ];
+}
+
 // src/categories.ts
 init_esm_shims();
 var CATEGORIES = [
@@ -1996,8 +2490,10 @@ export {
   __commonJS,
   __toESM,
   init_esm_shims,
-  anyTrack,
-  hasUiTrack,
+  package_default,
+  SHARED_FILES,
+  isKeyId,
+  sharedPathOfKeyId,
   TRACKS,
   isTrack,
   CLI_BASES,
@@ -2006,6 +2502,11 @@ export {
   resolveScope,
   DEFAULT_OPTIONS,
   UPDATE_GROUPS,
+  CLI_BASE_SORT_ORDER,
+  parseCliTargets,
+  targetsInclude,
+  anyTrack,
+  hasUiTrack,
   EXTERNAL_ASSETS,
   DEV_METHOD_SKILL_IDS,
   INTERNAL_BUNDLED_SKILL_IDS,
@@ -2019,6 +2520,22 @@ export {
   assetCliSupport,
   assetReachesCli,
   filterApplicableAssets,
+  isOutsideProject,
+  outsideProjectTarget,
+  outsideLinkAt,
+  createOutsideGuard,
+  mergeOutside,
+  ensureDir,
+  copyFile,
+  copyDir,
+  backupDir,
+  copyBackupDir,
+  backupFile,
+  backupOriginal,
+  listFilesRecursive,
+  ensureProjectSkeleton,
+  dirTreesIdentical,
+  backupIfLossyUtf8,
   HARNESS_ANCHOR_FILE,
   HARNESS_IMPORT_LINE,
   CONTINUOUS_SKILLS_HEADING,
@@ -2028,31 +2545,24 @@ export {
   renderFillScaffold,
   upsertHarnessImport,
   stripHarnessImport,
-  estimateTokens,
-  resolveBundleRoot,
-  extractFrontmatter,
-  assetCostRows,
-  landsOnDisk,
-  residentCost,
-  summarizeContextCost,
-  formatResidentCostLine,
-  formatResidentCostBlock,
-  CLI_BASE_SORT_ORDER,
-  parseCliTargets,
-  targetsInclude,
-  ensureDir,
-  copyFile,
-  copyDir,
-  backupDir,
-  copyBackupDir,
-  backupFile,
-  listFilesRecursive,
-  ensureProjectSkeleton,
+  buildAssetSpec,
+  resolveRules,
+  TRACK_AGENTS,
+  RETIRED_AGENTS,
+  RETIRED_PATHS,
+  RETIRED_AGENT_IDS,
+  isCliNeutralTarget,
+  buildManifest,
+  memoTargets,
+  claudeTargets,
+  claudeRecorded,
   INSTALL_LOG_FILENAME,
   INSTALL_LOG_DIR,
+  LEGACY_INSTALL_LOG_DIR,
   POLICY_DIRS,
   installedClis,
   buildInstallLog,
+  mergeRootFiles,
   hashContent,
   isHarnessOwned,
   mergeExternalFiles,
@@ -2060,18 +2570,23 @@ export {
   collectPolicyHashes,
   writeInstallLog,
   readInstallLog,
+  readInstallLogStatus,
+  legacyDroppedKeys,
+  legacyReleasedCatalog,
+  HARNESS_VERSION,
+  appendSelection,
+  corruptedInstallLogMessage,
   installLogPath,
   legacyInstallLogPath,
-  buildAssetSpec,
-  resolveRules,
-  ALL_RULES,
-  TRACK_AGENTS,
-  RETIRED_AGENTS,
-  RETIRED_PATHS,
-  RETIRED_AGENT_IDS,
-  isCliNeutralTarget,
-  buildManifest,
+  estimateTokens,
+  resolveBundleRoot,
+  extractFrontmatter,
+  assetCostRows,
+  residentCost,
+  summarizeContextCost,
+  formatResidentCostLine,
+  formatResidentCostBlock,
   CATEGORIES,
   CATEGORY_TITLES
 };
-//# sourceMappingURL=chunk-3G34MEGZ.js.map
+//# sourceMappingURL=chunk-X7NSQHXL.js.map