@vaubaan/harness 1.3.0 → 1.4.0

package/dist/index.js

@@ -1,186 +1,217 @@
 // src/version.ts
-var VERSION = "1.3.0";
+var VERSION = "1.4.0";
 
 // src/cli/init.ts
-import { existsSync as existsSync6, mkdirSync, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname3, join as join7, resolve as resolve3 } from "path";
-import { fileURLToPath } from "url";
-
-// src/loader.ts
-import { existsSync, readFileSync as readFileSync2 } from "fs";
-import { join } from "path";
-import fg from "fast-glob";
-import { z as z2 } from "zod";
-
-// src/parser/common.ts
-import { readFileSync } from "fs";
-import matter from "gray-matter";
-
-// src/parser/schemas.ts
-import { z } from "zod";
-
-// src/types.ts
-var AGENT_IDS = ["coding", "review", "merge", "planning"];
-var ENGINES = ["claude-code", "codex-cli", "opencode"];
-var CAPABILITIES = ["multi-step", "slash-command", "inline-exec"];
-var CAPABILITIES_MATRIX = {
-  "claude-code": ["multi-step", "slash-command", "inline-exec"],
-  "codex-cli": ["multi-step", "slash-command", "inline-exec"],
-  opencode: ["multi-step", "slash-command", "inline-exec"]
-};
-var DEGRADED_CAPABILITIES = {
-  "codex-cli": ["multi-step"]
-};
+import { existsSync as existsSync9, mkdirSync as mkdirSync2, rmSync, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname5, join as join11, resolve as resolve6 } from "path";
 
-// src/parser/schemas.ts
-var IdSchema = z.string().min(1).regex(/^[a-z][a-z0-9-]*$/, "id must be kebab-case (lowercase + digits + hyphens)");
-var SkillFrontmatterSchema = z.object({
-  id: IdSchema,
-  description: z.string().min(1),
-  engines: z.array(z.enum(ENGINES)).min(1).optional(),
-  requires: z.array(z.enum(CAPABILITIES)).optional(),
-  tags: z.array(z.string()).optional()
-}).strict();
-var CmdArgEnumSchema = z.object({
-  name: z.string().min(1),
-  type: z.literal("enum"),
-  values: z.array(z.string()).min(1),
-  default: z.string().optional()
-}).strict();
-var CmdArgStringSchema = z.object({
-  name: z.string().min(1),
-  type: z.literal("string"),
-  default: z.string().optional()
-}).strict();
-var CmdArgSchema = z.discriminatedUnion("type", [CmdArgEnumSchema, CmdArgStringSchema]);
-var CmdFrontmatterSchema = z.object({
-  id: IdSchema,
-  trigger: z.string().regex(/^\/[a-z][a-z0-9-]*$/, "trigger must be /kebab-case"),
-  invokes_skill: IdSchema,
-  args: z.array(CmdArgSchema).optional(),
-  description: z.string().min(1)
-}).strict();
-var AgentFrontmatterSchema = z.object({
-  id: z.enum(AGENT_IDS),
-  description: z.string().min(1)
-}).strict();
-var Schemas = {
-  Skill: SkillFrontmatterSchema,
-  Cmd: CmdFrontmatterSchema,
-  Agent: AgentFrontmatterSchema
-};
-var ParseError = class extends Error {
-  constructor(file, issues) {
-    const messages = issues.map((i) => `  - ${i.path.join(".") || "<root>"}: ${i.message}`).join("\n");
-    super(`Frontmatter validation failed for ${file}:
-${messages}`);
-    this.file = file;
-    this.issues = issues;
-    this.name = "ParseError";
+// src/cli/managed-paths.ts
+import { lstatSync, realpathSync, statSync } from "fs";
+import { basename, dirname, isAbsolute, join, resolve, win32 } from "path";
+var MANAGED_FILES = /* @__PURE__ */ new Set([
+  "AGENTS.md",
+  "CLAUDE.md",
+  ".mcp.json",
+  ".harness-manifest.json",
+  ".claude/settings.json",
+  ".codex/config.toml",
+  ".codex/hooks.json",
+  ".opencode/opencode.json",
+  ".opencode/mcp.json"
+]);
+var MANAGED_DIRECTORIES = [
+  ".claude/agents/",
+  ".claude/commands/",
+  ".claude/skills/",
+  ".codex/agents/",
+  ".codex/commands/",
+  ".codex/skills/",
+  ".agents/skills/",
+  ".opencode/agents/",
+  ".opencode/commands/",
+  ".opencode/skills/",
+  ".opencode/plugins/"
+];
+function canonicalTargetRoot(root) {
+  let ancestor = resolve(root);
+  const missing = [];
+  while (!lstatSync(ancestor, { throwIfNoEntry: false })) {
+    missing.unshift(basename(ancestor));
+    ancestor = dirname(ancestor);
   }
-  file;
-  issues;
-};
-
-// src/parser/common.ts
-function parseWithSchema(filePath, source, schema) {
-  const parsed = matter(source);
-  const result = schema.safeParse(parsed.data);
-  if (!result.success) {
-    throw new ParseError(filePath, result.error.issues);
+  const canonical = realpathSync(ancestor);
+  if (!statSync(canonical).isDirectory()) {
+    throw new Error(`harness target is not a directory: ${root}`);
   }
-  return {
-    meta: result.data,
-    body: parsed.content.trim(),
-    sourcePath: filePath
-  };
+  return join(canonical, ...missing);
 }
-
-// src/parser/agent.ts
-function parseAgent(filePath, source) {
-  return parseWithSchema(filePath, source, Schemas.Agent);
+function assertManagedLocation(path) {
+  const invalidSegment = path.split("/").some((part) => part === "" || part === "." || part === "..");
+  if (isAbsolute(path) || win32.isAbsolute(path) || path.includes("\\") || path.includes("\0") || invalidSegment) {
+    throw new Error(`unsafe harness path: ${path}`);
+  }
+  if (!MANAGED_FILES.has(path) && !MANAGED_DIRECTORIES.some((prefix) => path.startsWith(prefix))) {
+    throw new Error(`path is outside harness-managed locations: ${path}`);
+  }
 }
-
-// src/parser/cmd.ts
-function parseCmd(filePath, source) {
-  return parseWithSchema(filePath, source, Schemas.Cmd);
+function assertNoSymbolicComponents(root, path) {
+  const parts = path.split("/");
+  let current = root;
+  for (const [index, part] of parts.entries()) {
+    current = join(current, part);
+    const info = lstatSync(current, { throwIfNoEntry: false });
+    if (!info) return;
+    if (info.isSymbolicLink()) {
+      throw new Error(`symbolic link in harness path: ${path}`);
+    }
+    const isLeaf = index === parts.length - 1;
+    if (isLeaf ? !info.isFile() : !info.isDirectory()) {
+      throw new Error(`unexpected file type in harness path: ${path}`);
+    }
+  }
 }
-
-// src/parser/skill.ts
-function parseSkill(filePath, source) {
-  return parseWithSchema(filePath, source, Schemas.Skill);
+function assertManagedPaths(root, files) {
+  for (const path of files) assertManagedLocation(path);
+  const canonicalRoot2 = canonicalTargetRoot(root);
+  for (const path of files) assertNoSymbolicComponents(canonicalRoot2, path);
 }
 
-// src/util/yaml.ts
-import { parse as yamlParse } from "yaml";
-function parseYAML(source) {
-  return yamlParse(source);
-}
+// src/cli/manifest.ts
+import { createHash } from "crypto";
+import { chmodSync, existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync } from "fs";
+import { join as join4 } from "path";
+import { z as z3 } from "zod";
 
-// src/loader.ts
-var DisableYamlSchema = z2.object({ disable: z2.array(z2.string()).optional() }).passthrough();
-function loadHarness(packageDir, opts = {}) {
-  const agentsDir = opts.agentsDir ?? join(packageDir, "agents");
-  const skillsDir = opts.skillsDir ?? join(packageDir, "skills");
-  const commandsDir = opts.commandsDir ?? join(packageDir, "commands");
-  const agentFiles = fg.sync("*.agent.md", { cwd: agentsDir, absolute: true });
-  const skillFiles = fg.sync("*.skill.md", { cwd: skillsDir, absolute: true });
-  const cmdFiles = fg.sync("*.cmd.md", { cwd: commandsDir, absolute: true });
-  return {
-    agents: agentFiles.map((f) => parseAgent(f, readFileSync2(f, "utf8"))),
-    skills: skillFiles.map((f) => parseSkill(f, readFileSync2(f, "utf8"))),
-    cmds: cmdFiles.map((f) => parseCmd(f, readFileSync2(f, "utf8")))
-  };
+// src/cli/opencode-config.ts
+import { existsSync, readFileSync } from "fs";
+import { join as join2 } from "path";
+import { isDeepStrictEqual } from "util";
+import { z } from "zod";
+var OPENCODE_CONFIG_PATH = ".opencode/opencode.json";
+var CLAUDE_MCP_PATH = ".mcp.json";
+var OPENCODE_SCHEMA = "https://opencode.ai/config.json";
+var ObjectSchema = z.record(z.unknown());
+var OPENCODE_TARGET = {
+  path: OPENCODE_CONFIG_PATH,
+  key: "mcp",
+  label: "OpenCode",
+  schema: OPENCODE_SCHEMA
+};
+var CLAUDE_TARGET = {
+  path: CLAUDE_MCP_PATH,
+  key: "mcpServers",
+  label: "Claude Code"
+};
+var OpenCodeConfigOwnershipSchema = z.object({
+  createdFile: z.boolean(),
+  addedMcp: z.boolean(),
+  addedSchema: z.boolean(),
+  entries: z.record(ObjectSchema)
+});
+function parseConfig(target, content) {
+  try {
+    const config = ObjectSchema.parse(JSON.parse(content));
+    if (Object.hasOwn(config, target.key)) ObjectSchema.parse(config[target.key]);
+    return config;
+  } catch {
+    throw new Error(`invalid ${target.path}: expected a JSON object with an MCP object`);
+  }
 }
-function loadProjectSkills(targetDir) {
-  const skillsDir = join(targetDir, "docs", "skills");
-  if (!existsSync(skillsDir)) return [];
-  const skillFiles = fg.sync("*.skill.md", { cwd: skillsDir, absolute: true });
-  return skillFiles.map((f) => parseSkill(f, readFileSync2(f, "utf8")));
+function removeOwnedEntries(target, config, ownership, warnings) {
+  if (Object.hasOwn(config, target.key)) {
+    const mcp = ObjectSchema.parse(config[target.key]);
+    for (const [id, installed] of Object.entries(ownership.entries)) {
+      if (!Object.hasOwn(mcp, id)) continue;
+      if (isDeepStrictEqual(mcp[id], installed)) delete mcp[id];
+      else warnings.push(`preserved modified ${target.label} MCP server: ${id}`);
+    }
+    config[target.key] = mcp;
+    if (ownership.addedMcp && Object.keys(mcp).length === 0)
+      Reflect.deleteProperty(config, target.key);
+  }
+  if (target.schema && ownership.addedSchema && config.$schema === target.schema)
+    Reflect.deleteProperty(config, "$schema");
 }
-function loadOverrides(worktreeDir) {
-  const overridesDir = join(worktreeDir, ".harness-overrides");
-  if (!existsSync(overridesDir)) return void 0;
-  const added = loadHarness(overridesDir, {
-    agentsDir: join(overridesDir, "agents"),
-    skillsDir: join(overridesDir, "skills"),
-    commandsDir: join(overridesDir, "commands")
-  });
-  const disablePath = join(overridesDir, "disable.yaml");
-  let disable = [];
-  if (existsSync(disablePath)) {
-    try {
-      const parsed = DisableYamlSchema.safeParse(parseYAML(readFileSync2(disablePath, "utf8")));
-      if (parsed.success && parsed.data.disable) {
-        disable = parsed.data.disable;
+function addMissingEntries(target, config, desired, createdFile, warnings) {
+  const requested = ObjectSchema.parse(parseConfig(target, desired.content)[target.key]);
+  const mcp = ObjectSchema.parse(config[target.key] ?? {});
+  const entries = {};
+  for (const [id, entry] of Object.entries(requested)) {
+    if (Object.hasOwn(mcp, id)) {
+      if (!isDeepStrictEqual(mcp[id], entry)) {
+        warnings.push(
+          `preserved existing ${target.label} MCP server instead of replacing it: ${id}`
+        );
       }
-    } catch {
+      continue;
     }
+    entries[id] = ObjectSchema.parse(entry);
+    mcp[id] = entry;
   }
-  return { add: added, disable };
+  if (Object.keys(entries).length === 0) return void 0;
+  const ownership = {
+    createdFile,
+    addedMcp: !Object.hasOwn(config, target.key),
+    addedSchema: target.schema !== void 0 && !Object.hasOwn(config, "$schema"),
+    entries
+  };
+  config[target.key] = mcp;
+  if (target.schema && ownership.addedSchema) config.$schema = target.schema;
+  return ownership;
 }
-
-// src/mcp.ts
-var MCP_SERVER_IDS = ["context7"];
-var MCP_SERVERS = {
-  context7: {
-    id: "context7",
-    description: "Upstash Context7 \u2014 fetches up-to-date library docs via resolve-library-id + get-library-docs.",
-    command: "npx",
-    args: ["-y", "@upstash/context7-mcp"]
+function planMcpJson(target, root, desired, previous) {
+  const warnings = [];
+  if (!desired && !previous) return { remove: false, warnings };
+  const path = join2(root, target.path);
+  const existed = existsSync(path);
+  if (!existed && !desired) return { remove: false, warnings };
+  const original = existed ? readFileSync(path, "utf8") : void 0;
+  const config = original === void 0 ? {} : parseConfig(target, original);
+  const before = structuredClone(config);
+  if (previous) removeOwnedEntries(target, config, previous, warnings);
+  const createdFile = !existed || previous?.createdFile === true;
+  const ownership = desired ? addMissingEntries(target, config, desired, createdFile, warnings) : void 0;
+  if (!ownership && createdFile && Object.keys(config).length === 0) {
+    return { remove: existed, warnings };
   }
-};
-function resolveMcpIds(requested) {
-  return requested.map((id) => {
-    if (!MCP_SERVER_IDS.includes(id)) {
-      throw new Error(`unknown MCP server: ${id} (expected one of ${MCP_SERVER_IDS.join(", ")})`);
-    }
-    return id;
-  });
+  return {
+    remove: false,
+    ownership,
+    warnings,
+    ...!existed || !isDeepStrictEqual(before, config) ? { write: { path: target.path, content: `${JSON.stringify(config, null, 2)}
+` } } : {}
+  };
+}
+function planOpenCodeConfig(root, desired, previous) {
+  return planMcpJson(OPENCODE_TARGET, root, desired, previous);
+}
+function planClaudeMcpConfig(root, desired, previous) {
+  return planMcpJson(CLAUDE_TARGET, root, desired, previous);
 }
 
+// src/cli/update-config.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { join as join3 } from "path";
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+import { z as z2 } from "zod";
+
 // src/renderers/common.ts
 import { stringify as yamlStringify } from "yaml";
+
+// src/types.ts
+var AGENT_IDS = ["coding", "review", "merge", "planning"];
+var ENGINES = ["claude-code", "codex-cli", "opencode"];
+var CAPABILITIES = ["multi-step", "slash-command", "inline-exec"];
+var CAPABILITIES_MATRIX = {
+  "claude-code": ["multi-step", "slash-command", "inline-exec"],
+  "codex-cli": ["multi-step", "slash-command", "inline-exec"],
+  opencode: ["multi-step", "slash-command", "inline-exec"]
+};
+var DEGRADED_CAPABILITIES = {
+  "codex-cli": ["multi-step"]
+};
+
+// src/renderers/common.ts
 var STOP_HOOK_PACKAGE = "@vaubaan/harness";
 function checkSkillCapabilities(skill, engine) {
   const blockingWarnings = [];
@@ -546,18 +577,26 @@ ${body}` });
   renderStopHook() {
     const content = `import { spawnSync } from "node:child_process";
 
-export const HarnessStopHook = async ({ client, directory }) => ({
+// Runs the harness lint and returns the report to inject, or "" when the
+// turn may end.
+const lintReport = (directory, sessionID) => {
+  const r = spawnSync(
+    "npx",
+    ["-y", "${STOP_HOOK_PACKAGE}", "stop-hook", "--engine", "opencode", "--cwd", directory],
+    { input: JSON.stringify({ sessionID }), encoding: "utf-8" },
+  );
+  const report = (r.stderr ?? "").trim();
+  return r.status === 2 ? report : "";
+};
+
+// OpenCode 1.x entry point, exposed as server() below.
+const HarnessStopHook = async ({ client, directory }) => ({
   event: async ({ event }) => {
     if (event.type !== "session.idle") return;
     const sessionID = event.properties?.sessionID;
     if (!sessionID) return;
-    const r = spawnSync(
-      "npx",
-      ["-y", "${STOP_HOOK_PACKAGE}", "stop-hook", "--engine", "opencode", "--cwd", directory],
-      { input: JSON.stringify({ sessionID }), encoding: "utf-8" },
-    );
-    const report = (r.stderr ?? "").trim();
-    if (r.status !== 2 || report === "") return;
+    const report = lintReport(directory, sessionID);
+    if (report === "") return;
     // OpenCode defaults to its build agent when a prompt omits agent.
     // Preserve the last conversation persona, excluding compaction summaries.
     const history = await client.session.messages({ path: { id: sessionID } }).catch(() => undefined);
@@ -573,6 +612,31 @@ export const HarnessStopHook = async ({ client, directory }) => ({
     });
   },
 });
+
+// One default export for both majors: OpenCode 1.x calls server(),
+// OpenCode 2.x calls setup(). A V2 session keeps its agent, so the report
+// is sent without naming the persona.
+export default {
+  id: "vaubaan-harness-stop-hook",
+  server: HarnessStopHook,
+  setup(context) {
+    const directory = context.location.directory;
+    const controller = new AbortController();
+    const listen = async () => {
+      for await (const event of context.event.subscribe({ signal: controller.signal })) {
+        if (event.type !== "session.idle") continue;
+        if (event.location?.directory && event.location.directory !== directory) continue;
+        const sessionID = event.data?.sessionID;
+        if (!sessionID) continue;
+        const report = lintReport(directory, sessionID);
+        if (report === "") continue;
+        await context.session.prompt({ sessionID, text: report }).catch(() => undefined);
+      }
+    };
+    listen().catch(() => undefined);
+    return () => controller.abort();
+  },
+};
 `;
     return {
       files: [{ path: `${BASE3}/plugins/harness-stop-hook.ts`, content }],
@@ -591,274 +655,7 @@ function getRenderer(engine) {
   return RENDERERS[engine];
 }
 
-// src/render.ts
-var RenderError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "RenderError";
-  }
-};
-function mergeById(stock, added) {
-  const result = /* @__PURE__ */ new Map();
-  for (const item of stock) result.set(item.meta.id, item);
-  if (added) {
-    for (const item of added) result.set(item.meta.id, item);
-  }
-  return Array.from(result.values());
-}
-function removeByIds(items, disabled) {
-  if (disabled.length === 0) return [...items];
-  const disabledSet = new Set(disabled);
-  return items.filter((item) => !disabledSet.has(item.meta.id));
-}
-function applyOverrides(harness, overrides) {
-  const disabled = overrides?.disable ?? [];
-  return {
-    agents: removeByIds(mergeById(harness.agents, overrides?.add?.agents), disabled),
-    skills: removeByIds(mergeById(harness.skills, overrides?.add?.skills), disabled),
-    cmds: removeByIds(mergeById(harness.cmds, overrides?.add?.cmds), disabled)
-  };
-}
-var CLAUDE_MD_STUB = "@AGENTS.md\n";
-function opencodeLast(engines) {
-  return [...engines].sort((a, b) => Number(a === "opencode") - Number(b === "opencode"));
-}
-function render(input) {
-  const { engines } = input;
-  if (engines.length === 0) {
-    throw new RenderError("at least one engine must be selected");
-  }
-  const base = input.projectSkills?.length ? { ...input.harness, skills: mergeById(input.harness.skills, input.projectSkills) } : input.harness;
-  const harness = applyOverrides(base, input.overrides);
-  if (harness.agents.length === 0) {
-    throw new RenderError("No agents found in harness");
-  }
-  const files = [];
-  const warnings = [];
-  const exposedSkills = /* @__PURE__ */ new Map();
-  const exposedCmds = /* @__PURE__ */ new Map();
-  for (const engine of opencodeLast(engines)) {
-    const renderer = getRenderer(engine);
-    const renderedSkills = [];
-    for (const skill of harness.skills) {
-      const result = renderer.renderSkill(skill);
-      warnings.push(...result.warnings);
-      if (result.files.length > 0) {
-        const alreadyVisible = engine === "opencode" && exposedSkills.has(skill.meta.id);
-        if (!alreadyVisible) files.push(...result.files);
-        renderedSkills.push(skill);
-        exposedSkills.set(skill.meta.id, skill);
-      }
-    }
-    const renderedSkillIds = new Set(renderedSkills.map((s) => s.meta.id));
-    const renderedCmds = [];
-    for (const cmd of harness.cmds) {
-      if (!renderedSkillIds.has(cmd.meta.invokes_skill)) continue;
-      const result = renderer.renderCmd(cmd);
-      warnings.push(...result.warnings);
-      if (result.files.length > 0) {
-        files.push(...result.files);
-        renderedCmds.push(cmd);
-        exposedCmds.set(cmd.meta.id, cmd);
-      }
-    }
-    const agentsResult = renderer.renderAgents(harness.agents);
-    warnings.push(...agentsResult.warnings);
-    files.push(...agentsResult.files);
-    if (input.mcpServers && input.mcpServers.length > 0) {
-      const specs = input.mcpServers.map((id) => MCP_SERVERS[id]);
-      const mcpResult = renderer.renderMcp(specs);
-      warnings.push(...mcpResult.warnings);
-      files.push(...mcpResult.files);
-    }
-    if (input.withStopHook !== false) {
-      const hookResult = renderer.renderStopHook();
-      warnings.push(...hookResult.warnings);
-      files.push(...hookResult.files);
-    }
-  }
-  const hasProjectSkills = (input.projectSkills?.length ?? 0) > 0;
-  const umbrellaContent = buildUmbrellaBody(harness.agents, {
-    availableSkills: Array.from(exposedSkills.values()),
-    availableCommands: Array.from(exposedCmds.values()),
-    hasProjectSkills,
-    hasQualityDoc: input.hasQualityDoc === true
-  });
-  files.push({ path: "AGENTS.md", content: umbrellaContent });
-  if (engines.includes("claude-code")) {
-    files.push({ path: "CLAUDE.md", content: CLAUDE_MD_STUB });
-  }
-  return { files, warnings };
-}
-
-// src/cli/managed-paths.ts
-import { lstatSync, realpathSync, statSync } from "fs";
-import { basename, dirname, isAbsolute, join as join2, resolve, win32 } from "path";
-var MANAGED_FILES = /* @__PURE__ */ new Set([
-  "AGENTS.md",
-  "CLAUDE.md",
-  ".mcp.json",
-  ".harness-manifest.json",
-  ".claude/settings.json",
-  ".codex/config.toml",
-  ".codex/hooks.json",
-  ".opencode/opencode.json",
-  ".opencode/mcp.json"
-]);
-var MANAGED_DIRECTORIES = [
-  ".claude/agents/",
-  ".claude/commands/",
-  ".claude/skills/",
-  ".codex/agents/",
-  ".codex/commands/",
-  ".codex/skills/",
-  ".agents/skills/",
-  ".opencode/agents/",
-  ".opencode/commands/",
-  ".opencode/skills/",
-  ".opencode/plugins/"
-];
-function canonicalTargetRoot(root) {
-  let ancestor = resolve(root);
-  const missing = [];
-  while (!lstatSync(ancestor, { throwIfNoEntry: false })) {
-    missing.unshift(basename(ancestor));
-    ancestor = dirname(ancestor);
-  }
-  const canonical = realpathSync(ancestor);
-  if (!statSync(canonical).isDirectory()) {
-    throw new Error(`harness target is not a directory: ${root}`);
-  }
-  return join2(canonical, ...missing);
-}
-function assertManagedLocation(path) {
-  const invalidSegment = path.split("/").some((part) => part === "" || part === "." || part === "..");
-  if (isAbsolute(path) || win32.isAbsolute(path) || path.includes("\\") || path.includes("\0") || invalidSegment) {
-    throw new Error(`unsafe harness path: ${path}`);
-  }
-  if (!MANAGED_FILES.has(path) && !MANAGED_DIRECTORIES.some((prefix) => path.startsWith(prefix))) {
-    throw new Error(`path is outside harness-managed locations: ${path}`);
-  }
-}
-function assertNoSymbolicComponents(root, path) {
-  const parts = path.split("/");
-  let current = root;
-  for (const [index, part] of parts.entries()) {
-    current = join2(current, part);
-    const info = lstatSync(current, { throwIfNoEntry: false });
-    if (!info) return;
-    if (info.isSymbolicLink()) {
-      throw new Error(`symbolic link in harness path: ${path}`);
-    }
-    const isLeaf = index === parts.length - 1;
-    if (isLeaf ? !info.isFile() : !info.isDirectory()) {
-      throw new Error(`unexpected file type in harness path: ${path}`);
-    }
-  }
-}
-function assertManagedPaths(root, files) {
-  for (const path of files) assertManagedLocation(path);
-  const canonicalRoot2 = canonicalTargetRoot(root);
-  for (const path of files) assertNoSymbolicComponents(canonicalRoot2, path);
-}
-
-// src/cli/manifest.ts
-import { createHash } from "crypto";
-import { chmodSync, existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync } from "fs";
-import { join as join5 } from "path";
-import { z as z5 } from "zod";
-
-// src/cli/opencode-config.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
-import { join as join3 } from "path";
-import { isDeepStrictEqual } from "util";
-import { z as z3 } from "zod";
-var OPENCODE_CONFIG_PATH = ".opencode/opencode.json";
-var OPENCODE_SCHEMA = "https://opencode.ai/config.json";
-var ObjectSchema = z3.record(z3.unknown());
-var OpenCodeConfigOwnershipSchema = z3.object({
-  createdFile: z3.boolean(),
-  addedMcp: z3.boolean(),
-  addedSchema: z3.boolean(),
-  entries: z3.record(ObjectSchema)
-});
-function parseConfig(content) {
-  try {
-    const config = ObjectSchema.parse(JSON.parse(content));
-    if (Object.hasOwn(config, "mcp")) ObjectSchema.parse(config.mcp);
-    return config;
-  } catch {
-    throw new Error(`invalid ${OPENCODE_CONFIG_PATH}: expected a JSON object with an MCP object`);
-  }
-}
-function removeOwnedEntries(config, ownership, warnings) {
-  if (Object.hasOwn(config, "mcp")) {
-    const mcp = ObjectSchema.parse(config.mcp);
-    for (const [id, installed] of Object.entries(ownership.entries)) {
-      if (!Object.hasOwn(mcp, id)) continue;
-      if (isDeepStrictEqual(mcp[id], installed)) delete mcp[id];
-      else warnings.push(`preserved modified OpenCode MCP server: ${id}`);
-    }
-    config.mcp = mcp;
-    if (ownership.addedMcp && Object.keys(mcp).length === 0) Reflect.deleteProperty(config, "mcp");
-  }
-  if (ownership.addedSchema && config.$schema === OPENCODE_SCHEMA)
-    Reflect.deleteProperty(config, "$schema");
-}
-function addMissingEntries(config, desired, createdFile, warnings) {
-  const requested = ObjectSchema.parse(parseConfig(desired.content).mcp);
-  const mcp = ObjectSchema.parse(config.mcp ?? {});
-  const entries = {};
-  for (const [id, entry] of Object.entries(requested)) {
-    if (Object.hasOwn(mcp, id)) {
-      if (!isDeepStrictEqual(mcp[id], entry)) {
-        warnings.push(`preserved existing OpenCode MCP server instead of replacing it: ${id}`);
-      }
-      continue;
-    }
-    entries[id] = ObjectSchema.parse(entry);
-    mcp[id] = entry;
-  }
-  if (Object.keys(entries).length === 0) return void 0;
-  const ownership = {
-    createdFile,
-    addedMcp: !Object.hasOwn(config, "mcp"),
-    addedSchema: !Object.hasOwn(config, "$schema"),
-    entries
-  };
-  config.mcp = mcp;
-  if (ownership.addedSchema) config.$schema = OPENCODE_SCHEMA;
-  return ownership;
-}
-function planOpenCodeConfig(root, desired, previous) {
-  const warnings = [];
-  if (!desired && !previous) return { remove: false, warnings };
-  const path = join3(root, OPENCODE_CONFIG_PATH);
-  const existed = existsSync2(path);
-  if (!existed && !desired) return { remove: false, warnings };
-  const original = existed ? readFileSync3(path, "utf8") : void 0;
-  const config = original === void 0 ? {} : parseConfig(original);
-  const before = structuredClone(config);
-  if (previous) removeOwnedEntries(config, previous, warnings);
-  const createdFile = !existed || previous?.createdFile === true;
-  const ownership = desired ? addMissingEntries(config, desired, createdFile, warnings) : void 0;
-  if (!ownership && createdFile && Object.keys(config).length === 0) {
-    return { remove: existed, warnings };
-  }
-  return {
-    remove: false,
-    ownership,
-    warnings,
-    ...!existed || !isDeepStrictEqual(before, config) ? { write: { path: OPENCODE_CONFIG_PATH, content: `${JSON.stringify(config, null, 2)}
-` } } : {}
-  };
-}
-
 // src/cli/update-config.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
-import { join as join4 } from "path";
-import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
-import { z as z4 } from "zod";
 var LEGACY_OPENCODE_CONFIG = ".opencode/mcp.json";
 var SHARED_CONFIG_PATHS = [
   ".mcp.json",
@@ -868,15 +665,15 @@ var SHARED_CONFIG_PATHS = [
   ".claude/settings.json",
   ".codex/hooks.json"
 ];
-var ObjectSchema2 = z4.record(z4.unknown());
-var HookEntrySchema = z4.object({ group: ObjectSchema2, hook: ObjectSchema2 });
-var HookConfigOwnershipSchema = z4.object({
-  createdFile: z4.boolean(),
-  addedHooks: z4.boolean(),
-  addedStop: z4.boolean(),
-  entries: z4.array(HookEntrySchema)
+var ObjectSchema2 = z2.record(z2.unknown());
+var HookEntrySchema = z2.object({ group: ObjectSchema2, hook: ObjectSchema2 });
+var HookConfigOwnershipSchema = z2.object({
+  createdFile: z2.boolean(),
+  addedHooks: z2.boolean(),
+  addedStop: z2.boolean(),
+  entries: z2.array(HookEntrySchema)
 });
-var HookConfigsOwnershipSchema = z4.object({
+var HookConfigsOwnershipSchema = z2.object({
   ".claude/settings.json": HookConfigOwnershipSchema.optional(),
   ".codex/hooks.json": HookConfigOwnershipSchema.optional()
 }).strict();
@@ -1000,8 +797,8 @@ function planHookConfigCleanup(root, ownership) {
   assertManagedPaths(root, Object.keys(validated));
   for (const path of Object.keys(HOOK_ENGINES)) {
     const owned = validated[path];
-    if (!owned || !existsSync3(join4(root, path))) continue;
-    const before = parseObject(readFileSync4(join4(root, path), "utf8"), path);
+    if (!owned || !existsSync2(join3(root, path))) continue;
+    const before = parseObject(readFileSync2(join3(root, path), "utf8"), path);
     const config = structuredClone(before);
     removeOwnedHooks(config, owned, path, plan.warnings);
     recordMutation(plan, path, before, config, owned.createdFile);
@@ -1010,12 +807,12 @@ function planHookConfigCleanup(root, ownership) {
 }
 function planActiveHook(root, path, previous, claimExisting, plan) {
   assertManagedPaths(root, [path]);
-  const existed = existsSync3(join4(root, path));
+  const existed = existsSync2(join3(root, path));
   if (!existed && previous?.entries.length) {
     plan.warnings.push(`preserved removed harness Stop hook configuration: ${path}`);
     return previous;
   }
-  const before = existed ? parseObject(readFileSync4(join4(root, path), "utf8"), path) : void 0;
+  const before = existed ? parseObject(readFileSync2(join3(root, path), "utf8"), path) : void 0;
   const config = structuredClone(before ?? {});
   const groups = stopHooks(config, path);
   const hooks = asObject(config.hooks) ?? {};
@@ -1027,10 +824,11 @@ function planActiveHook(root, path, previous, claimExisting, plan) {
     plan.warnings,
     path
   );
+  const legacyWholeFile = !previous && claimExisting && existed;
   const ownership = {
-    createdFile: !existed || previous?.createdFile === true,
-    addedHooks: previous?.addedHooks ?? !Object.hasOwn(config, "hooks"),
-    addedStop: previous?.addedStop ?? !Object.hasOwn(hooks, "Stop"),
+    createdFile: !existed || previous?.createdFile === true || legacyWholeFile,
+    addedHooks: previous?.addedHooks ?? (legacyWholeFile || !Object.hasOwn(config, "hooks")),
+    addedStop: previous?.addedStop ?? (legacyWholeFile || !Object.hasOwn(hooks, "Stop")),
     entries: normalized.entries
   };
   if (!isDeepStrictEqual2(groups, normalized.groups)) {
@@ -1041,10 +839,10 @@ function planActiveHook(root, path, previous, claimExisting, plan) {
 }
 function planLegacyOpenCode(root, previous, plan) {
   if (!previous.files.includes(LEGACY_OPENCODE_CONFIG)) return;
-  const legacyPath = join4(root, LEGACY_OPENCODE_CONFIG);
-  if (!existsSync3(legacyPath)) return;
+  const legacyPath = join3(root, LEGACY_OPENCODE_CONFIG);
+  if (!existsSync2(legacyPath)) return;
   assertManagedPaths(root, [LEGACY_OPENCODE_CONFIG, OPENCODE_CONFIG_PATH]);
-  const legacy = parseObject(readFileSync4(legacyPath, "utf8"), LEGACY_OPENCODE_CONFIG);
+  const legacy = parseObject(readFileSync2(legacyPath, "utf8"), LEGACY_OPENCODE_CONFIG);
   if (!asObject(legacy.mcp)) {
     throw new Error(
       `invalid shared configuration ${LEGACY_OPENCODE_CONFIG}: expected an MCP object`
@@ -1108,45 +906,24 @@ function planUpdateConfigs(root, previous, hookEngines) {
 // src/cli/manifest.ts
 var MANIFEST_FILENAME = ".harness-manifest.json";
 var MANIFEST_VERSION = "6";
-var ManifestSchema = z5.object({
-  version: z5.enum(["4", "5", MANIFEST_VERSION]),
-  engines: z5.array(z5.string()),
-  renderedAt: z5.string(),
-  files: z5.array(z5.string()),
-  stopHookInstalled: z5.boolean().optional(),
-  stopHookEngines: z5.array(z5.string()).optional(),
+var ManifestSchema = z3.object({
+  version: z3.enum(["4", "5", MANIFEST_VERSION]),
+  engines: z3.array(z3.string()),
+  renderedAt: z3.string(),
+  files: z3.array(z3.string()),
+  stopHookInstalled: z3.boolean().optional(),
+  stopHookEngines: z3.array(z3.string()).optional(),
   opencodeConfig: OpenCodeConfigOwnershipSchema.optional(),
+  /** Entries the harness added to `.mcp.json` (Claude Code). */
+  mcpConfig: OpenCodeConfigOwnershipSchema.optional(),
   hookConfigs: HookConfigsOwnershipSchema.optional(),
-  harnessVersion: z5.string().optional(),
-  overridesDir: z5.string().optional(),
-  fileHashes: z5.record(z5.string().regex(/^[a-f0-9]{64}$/)).optional(),
-  preservedFiles: z5.array(z5.string()).optional()
+  harnessVersion: z3.string().optional(),
+  overridesDir: z3.string().optional(),
+  fileHashes: z3.record(z3.string().regex(/^[a-f0-9]{64}$/)).optional(),
+  preservedFiles: z3.array(z3.string()).optional()
 });
 function manifestPath(targetDir) {
-  return join5(targetDir, MANIFEST_FILENAME);
-}
-function writeManifest(targetDir, engines, files, extras = {}) {
-  assertManagedPaths(targetDir, [MANIFEST_FILENAME]);
-  const manifest = {
-    version: MANIFEST_VERSION,
-    harnessVersion: VERSION,
-    engines: [...engines].sort(),
-    renderedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    files: [...files].sort(),
-    fileHashes: Object.fromEntries(
-      files.filter((file) => existsSync4(join5(targetDir, file))).sort().map((file) => [file, hashContent(readFileSync5(join5(targetDir, file)))])
-    ),
-    ...extras.overridesDir ? { overridesDir: extras.overridesDir } : {},
-    ...extras.preservedFiles ? { preservedFiles: extras.preservedFiles } : {},
-    ...extras.hookConfigs ? { hookConfigs: extras.hookConfigs } : {},
-    ...extras.opencodeConfig ? { opencodeConfig: extras.opencodeConfig } : {},
-    ...extras.stopHookInstalled !== void 0 ? { stopHookInstalled: extras.stopHookInstalled } : {},
-    ...extras.stopHookEngines !== void 0 ? { stopHookEngines: [...extras.stopHookEngines].sort() } : {}
-  };
-  const path = manifestPath(targetDir);
-  if (existsSync4(path)) chmodSync(path, 384);
-  writeFileSync(path, `${JSON.stringify(manifest, null, 2)}
-`, { mode: 384 });
+  return join4(targetDir, MANIFEST_FILENAME);
 }
 function hashContent(content) {
   return createHash("sha256").update(content).digest("hex");
@@ -1154,66 +931,291 @@ function hashContent(content) {
 function readManifest(targetDir) {
   assertManagedPaths(targetDir, [MANIFEST_FILENAME]);
   const path = manifestPath(targetDir);
-  if (!existsSync4(path)) return null;
-  const raw = JSON.parse(readFileSync5(path, "utf8"));
+  if (!existsSync3(path)) return null;
+  const raw = JSON.parse(readFileSync3(path, "utf8"));
   return ManifestSchema.parse(raw);
 }
 
-// src/cli/uninstall.ts
-import { existsSync as existsSync5, readdirSync, rmdirSync, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2, join as join6, relative, resolve as resolve2 } from "path";
-function removeRenderedFiles(root, files) {
-  assertManagedPaths(root, files);
-  const filesRemoved = [];
-  const missing = [];
-  const dirsToConsider = /* @__PURE__ */ new Set();
-  for (const rel of files) {
-    const full = join6(root, rel);
-    if (existsSync5(full)) {
-      unlinkSync(full);
-      filesRemoved.push(rel);
-      dirsToConsider.add(dirname2(full));
-    } else {
-      missing.push(rel);
+// src/cli/plan-render.ts
+import { existsSync as existsSync5 } from "fs";
+import { dirname as dirname2, join as join6, resolve as resolve2 } from "path";
+import { fileURLToPath } from "url";
+
+// src/loader.ts
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
+import { join as join5 } from "path";
+import fg from "fast-glob";
+import { z as z5 } from "zod";
+
+// src/parser/common.ts
+import { readFileSync as readFileSync4 } from "fs";
+import matter from "gray-matter";
+
+// src/parser/schemas.ts
+import { z as z4 } from "zod";
+var IdSchema = z4.string().min(1).regex(/^[a-z][a-z0-9-]*$/, "id must be kebab-case (lowercase + digits + hyphens)");
+var SkillFrontmatterSchema = z4.object({
+  id: IdSchema,
+  description: z4.string().min(1),
+  engines: z4.array(z4.enum(ENGINES)).min(1).optional(),
+  requires: z4.array(z4.enum(CAPABILITIES)).optional(),
+  tags: z4.array(z4.string()).optional()
+}).strict();
+var CmdArgEnumSchema = z4.object({
+  name: z4.string().min(1),
+  type: z4.literal("enum"),
+  values: z4.array(z4.string()).min(1),
+  default: z4.string().optional()
+}).strict();
+var CmdArgStringSchema = z4.object({
+  name: z4.string().min(1),
+  type: z4.literal("string"),
+  default: z4.string().optional()
+}).strict();
+var CmdArgSchema = z4.discriminatedUnion("type", [CmdArgEnumSchema, CmdArgStringSchema]);
+var CmdFrontmatterSchema = z4.object({
+  id: IdSchema,
+  trigger: z4.string().regex(/^\/[a-z][a-z0-9-]*$/, "trigger must be /kebab-case"),
+  invokes_skill: IdSchema,
+  args: z4.array(CmdArgSchema).optional(),
+  description: z4.string().min(1)
+}).strict();
+var AgentFrontmatterSchema = z4.object({
+  id: z4.enum(AGENT_IDS),
+  description: z4.string().min(1)
+}).strict();
+var Schemas = {
+  Skill: SkillFrontmatterSchema,
+  Cmd: CmdFrontmatterSchema,
+  Agent: AgentFrontmatterSchema
+};
+var ParseError = class extends Error {
+  constructor(file, issues) {
+    const messages = issues.map((i) => `  - ${i.path.join(".") || "<root>"}: ${i.message}`).join("\n");
+    super(`Frontmatter validation failed for ${file}:
+${messages}`);
+    this.file = file;
+    this.issues = issues;
+    this.name = "ParseError";
+  }
+  file;
+  issues;
+};
+
+// src/parser/common.ts
+function parseWithSchema(filePath, source, schema) {
+  const parsed = matter(source);
+  const result = schema.safeParse(parsed.data);
+  if (!result.success) {
+    throw new ParseError(filePath, result.error.issues);
+  }
+  return {
+    meta: result.data,
+    body: parsed.content.trim(),
+    sourcePath: filePath
+  };
+}
+
+// src/parser/agent.ts
+function parseAgent(filePath, source) {
+  return parseWithSchema(filePath, source, Schemas.Agent);
+}
+
+// src/parser/cmd.ts
+function parseCmd(filePath, source) {
+  return parseWithSchema(filePath, source, Schemas.Cmd);
+}
+
+// src/parser/skill.ts
+function parseSkill(filePath, source) {
+  return parseWithSchema(filePath, source, Schemas.Skill);
+}
+
+// src/util/yaml.ts
+import { parse as yamlParse } from "yaml";
+function parseYAML(source) {
+  return yamlParse(source);
+}
+
+// src/loader.ts
+var DisableYamlSchema = z5.object({ disable: z5.array(z5.string()).optional() }).passthrough();
+function loadHarness(packageDir, opts = {}) {
+  const agentsDir = opts.agentsDir ?? join5(packageDir, "agents");
+  const skillsDir = opts.skillsDir ?? join5(packageDir, "skills");
+  const commandsDir = opts.commandsDir ?? join5(packageDir, "commands");
+  const agentFiles = fg.sync("*.agent.md", { cwd: agentsDir, absolute: true });
+  const skillFiles = fg.sync("*.skill.md", { cwd: skillsDir, absolute: true });
+  const cmdFiles = fg.sync("*.cmd.md", { cwd: commandsDir, absolute: true });
+  return {
+    agents: agentFiles.map((f) => parseAgent(f, readFileSync5(f, "utf8"))),
+    skills: skillFiles.map((f) => parseSkill(f, readFileSync5(f, "utf8"))),
+    cmds: cmdFiles.map((f) => parseCmd(f, readFileSync5(f, "utf8")))
+  };
+}
+function loadProjectSkills(targetDir) {
+  const skillsDir = join5(targetDir, "docs", "skills");
+  if (!existsSync4(skillsDir)) return [];
+  const skillFiles = fg.sync("*.skill.md", { cwd: skillsDir, absolute: true });
+  return skillFiles.map((f) => parseSkill(f, readFileSync5(f, "utf8")));
+}
+function loadOverrides(worktreeDir) {
+  const overridesDir = join5(worktreeDir, ".harness-overrides");
+  if (!existsSync4(overridesDir)) return void 0;
+  const added = loadHarness(overridesDir, {
+    agentsDir: join5(overridesDir, "agents"),
+    skillsDir: join5(overridesDir, "skills"),
+    commandsDir: join5(overridesDir, "commands")
+  });
+  const disablePath = join5(overridesDir, "disable.yaml");
+  let disable = [];
+  if (existsSync4(disablePath)) {
+    try {
+      const parsed = DisableYamlSchema.safeParse(parseYAML(readFileSync5(disablePath, "utf8")));
+      if (parsed.success && parsed.data.disable) {
+        disable = parsed.data.disable;
+      }
+    } catch {
     }
   }
-  return { filesRemoved, dirsPruned: pruneEmptyDirs(root, dirsToConsider), missing };
-}
-function pruneEmptyDirs(root, leaves) {
-  const candidates = /* @__PURE__ */ new Set();
-  for (const leaf of leaves) {
-    let cur = leaf;
-    while (cur !== root && cur.startsWith(`${root}/`)) {
-      candidates.add(cur);
-      cur = dirname2(cur);
+  return { add: added, disable };
+}
+
+// src/mcp.ts
+var MCP_SERVER_IDS = ["context7"];
+var MCP_SERVERS = {
+  context7: {
+    id: "context7",
+    description: "Upstash Context7 \u2014 fetches up-to-date library docs via resolve-library-id + get-library-docs.",
+    command: "npx",
+    args: ["-y", "@upstash/context7-mcp"]
+  }
+};
+function resolveMcpIds(requested) {
+  return requested.map((id) => {
+    if (!MCP_SERVER_IDS.includes(id)) {
+      throw new Error(`unknown MCP server: ${id} (expected one of ${MCP_SERVER_IDS.join(", ")})`);
+    }
+    return id;
+  });
+}
+
+// src/render.ts
+var RenderError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "RenderError";
+  }
+};
+function mergeById(stock, added) {
+  const result = /* @__PURE__ */ new Map();
+  for (const item of stock) result.set(item.meta.id, item);
+  if (added) {
+    for (const item of added) result.set(item.meta.id, item);
+  }
+  return Array.from(result.values());
+}
+function removeByIds(items, disabled) {
+  if (disabled.length === 0) return [...items];
+  const disabledSet = new Set(disabled);
+  return items.filter((item) => !disabledSet.has(item.meta.id));
+}
+function applyOverrides(harness, overrides) {
+  const disabled = overrides?.disable ?? [];
+  return {
+    agents: removeByIds(mergeById(harness.agents, overrides?.add?.agents), disabled),
+    skills: removeByIds(mergeById(harness.skills, overrides?.add?.skills), disabled),
+    cmds: removeByIds(mergeById(harness.cmds, overrides?.add?.cmds), disabled)
+  };
+}
+var CLAUDE_MD_STUB = "@AGENTS.md\n";
+function opencodeLast(engines) {
+  return [...engines].sort((a, b) => Number(a === "opencode") - Number(b === "opencode"));
+}
+function render(input) {
+  const { engines } = input;
+  if (engines.length === 0) {
+    throw new RenderError("at least one engine must be selected");
+  }
+  const base = input.projectSkills?.length ? { ...input.harness, skills: mergeById(input.harness.skills, input.projectSkills) } : input.harness;
+  const harness = applyOverrides(base, input.overrides);
+  if (harness.agents.length === 0) {
+    throw new RenderError("No agents found in harness");
+  }
+  const files = [];
+  const warnings = [];
+  const exposedSkills = /* @__PURE__ */ new Map();
+  const exposedCmds = /* @__PURE__ */ new Map();
+  for (const engine of opencodeLast(engines)) {
+    const renderer = getRenderer(engine);
+    const renderedSkills = [];
+    for (const skill of harness.skills) {
+      const result = renderer.renderSkill(skill);
+      warnings.push(...result.warnings);
+      if (result.files.length > 0) {
+        const alreadyVisible = engine === "opencode" && exposedSkills.has(skill.meta.id);
+        if (!alreadyVisible) files.push(...result.files);
+        renderedSkills.push(skill);
+        exposedSkills.set(skill.meta.id, skill);
+      }
+    }
+    const renderedSkillIds = new Set(renderedSkills.map((s) => s.meta.id));
+    const renderedCmds = [];
+    for (const cmd of harness.cmds) {
+      if (!renderedSkillIds.has(cmd.meta.invokes_skill)) continue;
+      const result = renderer.renderCmd(cmd);
+      warnings.push(...result.warnings);
+      if (result.files.length > 0) {
+        files.push(...result.files);
+        renderedCmds.push(cmd);
+        exposedCmds.set(cmd.meta.id, cmd);
+      }
+    }
+    const agentsResult = renderer.renderAgents(harness.agents);
+    warnings.push(...agentsResult.warnings);
+    files.push(...agentsResult.files);
+    if (input.mcpServers && input.mcpServers.length > 0) {
+      const specs = input.mcpServers.map((id) => MCP_SERVERS[id]);
+      const mcpResult = renderer.renderMcp(specs);
+      warnings.push(...mcpResult.warnings);
+      files.push(...mcpResult.files);
+    }
+    if (input.withStopHook !== false) {
+      const hookResult = renderer.renderStopHook();
+      warnings.push(...hookResult.warnings);
+      files.push(...hookResult.files);
     }
   }
-  const pruned = [];
-  const sorted = [...candidates].sort((a, b) => b.length - a.length);
-  for (const dir of sorted) {
-    if (!existsSync5(dir)) continue;
-    if (readdirSync(dir).length > 0) continue;
-    rmdirSync(dir);
-    pruned.push(relative(root, dir));
+  const hasProjectSkills = (input.projectSkills?.length ?? 0) > 0;
+  const umbrellaContent = buildUmbrellaBody(harness.agents, {
+    availableSkills: Array.from(exposedSkills.values()),
+    availableCommands: Array.from(exposedCmds.values()),
+    hasProjectSkills,
+    hasQualityDoc: input.hasQualityDoc === true
+  });
+  files.push({ path: "AGENTS.md", content: umbrellaContent });
+  if (engines.includes("claude-code")) {
+    files.push({ path: "CLAUDE.md", content: CLAUDE_MD_STUB });
   }
-  return pruned;
+  return { files, warnings };
 }
 
-// src/cli/init.ts
+// src/cli/plan-render.ts
 var QUALITY_DOC_PATH = "docs/quality/code-quality.md";
 function resolveEngineList(requested) {
-  if (!requested || requested.length === 0) return [...ENGINES];
-  return requested.map((e) => {
+  if (!requested) return [...ENGINES];
+  if (requested.length === 0) throw new Error("no engine selected");
+  const engines = requested.map((e) => {
     if (!ENGINES.includes(e)) {
       throw new Error(`unknown engine: ${e} (expected one of ${ENGINES.join(", ")})`);
     }
     return e;
   });
+  return [...new Set(engines)];
 }
 function defaultPackageDir() {
-  const here = dirname3(fileURLToPath(import.meta.url));
-  if (existsSync6(join7(here, "agents"))) return here;
-  return resolve3(here, "..");
+  const here = dirname2(fileURLToPath(import.meta.url));
+  if (existsSync5(join6(here, "agents"))) return here;
+  return resolve2(here, "..");
 }
 function planInit(args) {
   const engines = resolveEngineList(args.engines);
@@ -1221,7 +1223,7 @@ function planInit(args) {
   const harness = loadHarness(packageDir);
   const overrides = args.overridesDir ? loadOverrides(args.overridesDir) : void 0;
   const projectSkills = loadProjectSkills(args.targetDir);
-  const hasQualityDoc = existsSync6(join7(args.targetDir, QUALITY_DOC_PATH));
+  const hasQualityDoc = existsSync5(join6(args.targetDir, QUALITY_DOC_PATH));
   const mcpServers = args.mcpServers ? resolveMcpIds(args.mcpServers) : void 0;
   const stopHookInstalled = args.withStopHook !== false;
   const output = render({
@@ -1235,107 +1237,35 @@ function planInit(args) {
   });
   return { engines, output, stopHookInstalled };
 }
-function writeFilesToTarget(files, targetDir) {
-  assertManagedPaths(
-    targetDir,
-    files.map((file) => file.path)
-  );
-  const written = [];
-  for (const f of files) {
-    const full = join7(targetDir, f.path);
-    mkdirSync(dirname3(full), { recursive: true });
-    writeFileSync3(full, f.content);
-    written.push(f.path);
-  }
-  return written;
-}
-function initCommand(args) {
-  const { engines, output, stopHookInstalled } = planInit(args);
-  const previous = readManifest(args.targetDir);
-  assertManagedPaths(args.targetDir, [
-    MANIFEST_FILENAME,
-    ...previous?.files ?? [],
-    ...output.files.map((file) => file.path),
-    ...previous?.opencodeConfig ? [OPENCODE_CONFIG_PATH] : []
-  ]);
-  const desiredConfig = output.files.find((file) => file.path === OPENCODE_CONFIG_PATH);
-  const config = planOpenCodeConfig(args.targetDir, desiredConfig, previous?.opencodeConfig);
-  const next = new Set(output.files.map((f) => f.path));
-  const stale = (previous?.files ?? []).filter((f) => !next.has(f) && f !== OPENCODE_CONFIG_PATH);
-  if (config.remove) stale.push(OPENCODE_CONFIG_PATH);
-  const staleFilesRemoved = removeRenderedFiles(resolve3(args.targetDir), stale).filesRemoved;
-  const ownedFiles = output.files.filter((file) => file.path !== OPENCODE_CONFIG_PATH);
-  const filesWritten = writeFilesToTarget(ownedFiles, args.targetDir);
-  if (config.write) writeFilesToTarget([config.write], args.targetDir);
-  writeManifest(args.targetDir, engines, filesWritten, {
-    stopHookInstalled,
-    stopHookEngines: stopHookInstalled ? engines : void 0,
-    opencodeConfig: config.ownership,
-    overridesDir: args.overridesDir ? resolve3(args.overridesDir) === resolve3(args.targetDir) ? "." : resolve3(args.overridesDir) : void 0
-  });
-  if (config.write) filesWritten.push(OPENCODE_CONFIG_PATH);
-  const warnings = [...output.warnings, ...config.warnings];
-  if (previous?.files.includes(OPENCODE_CONFIG_PATH) && !previous.opencodeConfig) {
-    warnings.push(`preserved legacy shared configuration: ${OPENCODE_CONFIG_PATH}`);
-  }
-  return { filesWritten, staleFilesRemoved, warnings, stopHookInstalled };
-}
-
-// src/cli/update.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
-import { join as join10, resolve as resolve5 } from "path";
-import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
 
-// src/cli/update-manifest.ts
-import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
-import { join as join8 } from "path";
-import { z as z6 } from "zod";
-var EngineSchema = z6.enum(ENGINES);
-var LegacySchema = z6.object({
-  version: z6.enum(["1", "2", "3"]),
-  engine: EngineSchema.optional(),
-  engines: z6.array(EngineSchema).nonempty().optional(),
-  renderedAt: z6.string(),
-  files: z6.array(z6.string())
-});
-var HOOK_PATHS = {
-  "claude-code": [".claude/settings.json"],
-  "codex-cli": [".codex/hooks.json"],
-  opencode: [
-    ".opencode/plugins/harness-stop-hook/index.ts",
-    ".opencode/plugins/harness-stop-hook.ts"
-  ]
-};
-function readUpdateInstallation(root) {
-  assertManagedPaths(root, [MANIFEST_FILENAME]);
-  if (!existsSync7(join8(root, MANIFEST_FILENAME))) {
-    throw new Error("no harness manifest found; use init for a new installation");
-  }
-  const raw = JSON.parse(readFileSync6(join8(root, MANIFEST_FILENAME), "utf8"));
-  const sourceVersion = String(raw?.version);
-  let manifest;
-  if (["1", "2", "3"].includes(sourceVersion)) {
-    const legacy = LegacySchema.parse(raw);
-    const engines2 = legacy.version === "1" ? [EngineSchema.parse(legacy.engine)] : legacy.engines;
-    manifest = {
-      version: "4",
-      engines: z6.array(EngineSchema).nonempty().parse(engines2),
-      files: legacy.files,
-      renderedAt: legacy.renderedAt
-    };
-  } else {
-    const current = readManifest(root);
-    if (!current) throw new Error("harness manifest disappeared during planning");
-    manifest = current;
+// src/cli/uninstall.ts
+import {
+  existsSync as existsSync6,
+  readFileSync as readFileSync6,
+  readdirSync,
+  rmdirSync,
+  unlinkSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { dirname as dirname3, join as join7, relative, resolve as resolve3 } from "path";
+function pruneEmptyDirs(root, leaves) {
+  const candidates = /* @__PURE__ */ new Set();
+  for (const leaf of leaves) {
+    let cur = leaf;
+    while (cur !== root && cur.startsWith(`${root}/`)) {
+      candidates.add(cur);
+      cur = dirname3(cur);
+    }
   }
-  const engines = [...new Set(z6.array(EngineSchema).nonempty().parse(manifest.engines))];
-  const hookEngines = manifest.stopHookInstalled === false ? [] : manifest.stopHookEngines !== void 0 ? z6.array(EngineSchema).parse(manifest.stopHookEngines) : manifest.stopHookInstalled === true ? engines : engines.filter(
-    (engine) => HOOK_PATHS[engine].some((path) => manifest.files.includes(path))
-  );
-  if (hookEngines.some((engine) => !engines.includes(engine))) {
-    throw new Error("manifest stopHookEngines must be a subset of installed engines");
+  const pruned = [];
+  const sorted = [...candidates].sort((a, b) => b.length - a.length);
+  for (const dir of sorted) {
+    if (!existsSync6(dir)) continue;
+    if (readdirSync(dir).length > 0) continue;
+    rmdirSync(dir);
+    pruned.push(relative(root, dir));
   }
-  return { manifest, sourceVersion, engines, hookEngines: [...new Set(hookEngines)] };
+  return pruned;
 }
 
 // src/cli/update-transaction.ts
@@ -1345,17 +1275,17 @@ import {
   closeSync,
   fsyncSync,
   lstatSync as lstatSync2,
-  mkdirSync as mkdirSync2,
+  mkdirSync,
   openSync,
   readFileSync as readFileSync7,
   readdirSync as readdirSync2,
   realpathSync as realpathSync2,
   rmdirSync as rmdirSync2,
   unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync4
+  writeFileSync as writeFileSync3
 } from "fs";
 import { homedir } from "os";
-import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute2, join as join9, relative as relative2, resolve as resolve4, sep } from "path";
+import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute2, join as join8, relative as relative2, resolve as resolve4, sep } from "path";
 var MANIFEST_PATH = ".harness-manifest.json";
 var PRIVATE_FILES = /* @__PURE__ */ new Set([
   MANIFEST_PATH,
@@ -1373,7 +1303,7 @@ function canonicalRoot(root) {
     missing.unshift(basename2(ancestor));
     ancestor = dirname4(ancestor);
   }
-  return join9(realpathSync2(ancestor), ...missing);
+  return join8(realpathSync2(ancestor), ...missing);
 }
 function contains(parent, child) {
   const path = relative2(parent, child);
@@ -1405,7 +1335,7 @@ function createDirectories(path, created, mode = 511) {
     missing.unshift(current);
   }
   for (const directory of missing) {
-    mkdirSync2(directory, { mode });
+    mkdirSync(directory, { mode });
     created.push(directory);
   }
 }
@@ -1413,7 +1343,7 @@ function writeBackupFile(path, content) {
   createDirectories(dirname4(path), [], 448);
   const fd = openSync(path, "wx", 384);
   try {
-    writeFileSync4(fd, content);
+    writeFileSync3(fd, content);
     fsyncSync(fd);
   } finally {
     closeSync(fd);
@@ -1422,16 +1352,16 @@ function writeBackupFile(path, content) {
 function saveSnapshot(root, paths, backup) {
   const entries = [];
   createDirectories(dirname4(backup), [], 448);
-  mkdirSync2(backup, { mode: 448 });
+  mkdirSync(backup, { mode: 448 });
   for (const path of paths) {
-    const full = join9(root, path);
+    const full = join8(root, path);
     const info = lstatSync2(full, { throwIfNoEntry: false });
     if (!info) {
       entries.push({ path, exists: false });
       continue;
     }
     const content = readFileSync7(full);
-    writeBackupFile(join9(backup, "files", path), content);
+    writeBackupFile(join8(backup, "files", path), content);
     entries.push({
       path,
       exists: true,
@@ -1440,7 +1370,7 @@ function saveSnapshot(root, paths, backup) {
     });
   }
   writeBackupFile(
-    join9(backup, "snapshot.json"),
+    join8(backup, "snapshot.json"),
     `${JSON.stringify({ version: 1, root, createdAt: (/* @__PURE__ */ new Date()).toISOString(), entries }, null, 2)}
 `
   );
@@ -1455,16 +1385,16 @@ function rollback(root, backup, entries, touched, createdDirectories) {
     try {
       assertManagedPaths(root, [path]);
       const entry = entries.get(path);
-      const full = join9(root, path);
+      const full = join8(root, path);
       const current = lstatSync2(full, { throwIfNoEntry: false });
       if (!entry?.exists) {
         if (current) unlinkSync2(full);
         continue;
       }
-      const original = readFileSync7(join9(backup, "files", path));
+      const original = readFileSync7(join8(backup, "files", path));
       if (!current || !readFileSync7(full).equals(original)) {
         if (current) unlinkSync2(full);
-        writeFileSync4(full, original, { mode: 384 });
+        writeFileSync3(full, original, { mode: 384 });
       }
       chmodSync2(full, entry.mode);
     } catch (error) {
@@ -1485,7 +1415,7 @@ function applyUpdateTransaction(root, writes, removals, backupDir) {
   assertManagedPaths(root, paths);
   const target = canonicalRoot(root);
   const backup = resolve4(
-    backupDir ?? join9(homedir(), ".local", "state", "vaubaan-harness", "backups", randomUUID())
+    backupDir ?? join8(homedir(), ".local", "state", "vaubaan-harness", "backups", randomUUID())
   );
   assertBackupLocation(target, backup);
   let snapshot;
@@ -1503,18 +1433,18 @@ function applyUpdateTransaction(root, writes, removals, backupDir) {
   try {
     assertManagedPaths(target, paths);
     for (const path of removals) {
-      if (!lstatSync2(join9(target, path), { throwIfNoEntry: false })) continue;
+      if (!lstatSync2(join8(target, path), { throwIfNoEntry: false })) continue;
       touched.add(path);
-      unlinkSync2(join9(target, path));
+      unlinkSync2(join8(target, path));
     }
     for (const file of writes) {
-      const full = join9(target, file.path);
+      const full = join8(target, file.path);
       createDirectories(dirname4(full), createdDirectories);
       touched.add(file.path);
       const entry = entries.get(file.path);
       const mode = file.path === MANIFEST_PATH ? 384 : entry?.exists ? entry.mode : PRIVATE_FILES.has(file.path) ? 384 : 420;
       if (entry?.exists && file.path === MANIFEST_PATH) chmodSync2(full, mode);
-      writeFileSync4(full, file.content, { mode });
+      writeFileSync3(full, file.content, { mode });
       if (entry?.exists) chmodSync2(full, mode);
     }
   } catch (error) {
@@ -1528,29 +1458,159 @@ function applyUpdateTransaction(root, writes, removals, backupDir) {
 }
 
 // src/cli/update.ts
+import { existsSync as existsSync8, readFileSync as readFileSync9 } from "fs";
+import { join as join10, resolve as resolve5 } from "path";
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
+
+// src/cli/update-manifest.ts
+import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
+import { join as join9 } from "path";
+import { z as z6 } from "zod";
+var EngineSchema = z6.enum(ENGINES);
+var LegacySchema = z6.object({
+  version: z6.enum(["1", "2", "3"]),
+  engine: EngineSchema.optional(),
+  engines: z6.array(EngineSchema).nonempty().optional(),
+  renderedAt: z6.string(),
+  files: z6.array(z6.string())
+});
+var HOOK_PATHS = {
+  "claude-code": [".claude/settings.json"],
+  "codex-cli": [".codex/hooks.json"],
+  opencode: [
+    ".opencode/plugins/harness-stop-hook/index.ts",
+    ".opencode/plugins/harness-stop-hook.ts"
+  ]
+};
+function readUpdateInstallation(root) {
+  assertManagedPaths(root, [MANIFEST_FILENAME]);
+  if (!existsSync7(join9(root, MANIFEST_FILENAME))) {
+    throw new Error("no harness manifest found; use init for a new installation");
+  }
+  const raw = JSON.parse(readFileSync8(join9(root, MANIFEST_FILENAME), "utf8"));
+  const sourceVersion = String(raw?.version);
+  let manifest;
+  if (["1", "2", "3"].includes(sourceVersion)) {
+    const legacy = LegacySchema.parse(raw);
+    const engines2 = legacy.version === "1" ? [EngineSchema.parse(legacy.engine)] : legacy.engines;
+    manifest = {
+      version: "4",
+      engines: z6.array(EngineSchema).nonempty().parse(engines2),
+      files: legacy.files,
+      renderedAt: legacy.renderedAt
+    };
+  } else {
+    const current = readManifest(root);
+    if (!current) throw new Error("harness manifest disappeared during planning");
+    manifest = current;
+  }
+  const engines = [...new Set(z6.array(EngineSchema).nonempty().parse(manifest.engines))];
+  const hookEngines = manifest.stopHookInstalled === false ? [] : manifest.stopHookEngines !== void 0 ? z6.array(EngineSchema).parse(manifest.stopHookEngines) : manifest.stopHookInstalled === true ? engines : engines.filter(
+    (engine) => HOOK_PATHS[engine].some((path) => manifest.files.includes(path))
+  );
+  if (hookEngines.some((engine) => !engines.includes(engine))) {
+    throw new Error("manifest stopHookEngines must be a subset of installed engines");
+  }
+  return { manifest, sourceVersion, engines, hookEngines: [...new Set(hookEngines)] };
+}
+
+// src/cli/update.ts
+var CODEX_CONFIG_PATH = ".codex/config.toml";
 function currentContent(root, path) {
-  return existsSync8(join10(root, path)) ? readFileSync8(join10(root, path), "utf8") : void 0;
+  return existsSync8(join10(root, path)) ? readFileSync9(join10(root, path), "utf8") : void 0;
+}
+function ownedUnchanged(root, previous, path) {
+  const content = currentContent(root, path);
+  if (content === void 0 || !previous.files.includes(path)) return false;
+  const hash = previous.fileHashes?.[path];
+  return hash === void 0 || hash === hashContent(content);
 }
 function checkArtifactConflicts(root, previous, writes, removals) {
   const desired = new Map(writes.map((file) => [file.path, file.content]));
+  const conflicts = [];
   for (const path of [...desired.keys(), ...removals]) {
     if (SHARED_CONFIG_PATHS.includes(path)) continue;
     const content = currentContent(root, path);
-    if (content === void 0) continue;
+    if (content === void 0 || content === desired.get(path)) continue;
     if (!previous.files.includes(path)) {
-      throw new Error(
-        `existing file outside harness manifest: ${path}; use overrides or --preserve`
-      );
+      conflicts.push(`existing file outside harness manifest: ${path}`);
+      continue;
     }
     const hash = previous.fileHashes?.[path];
-    if (hash && hash !== hashContent(content) && content !== desired.get(path)) {
-      throw new Error(`modified harness file: ${path}; move edits to overrides or use --preserve`);
+    if (hash && hash !== hashContent(content)) conflicts.push(`modified harness file: ${path}`);
+  }
+  if (conflicts.length) {
+    throw new Error(
+      `${conflicts.join("\n")}
+move their content to docs/ or .harness-overrides/, or keep them as yours with --preserve <path>`
+    );
+  }
+}
+function legacyMcpOwnership(root, previous) {
+  if (!ownedUnchanged(root, previous, CLAUDE_MCP_PATH)) return void 0;
+  try {
+    const servers = JSON.parse(currentContent(root, CLAUDE_MCP_PATH) ?? "").mcpServers;
+    if (!servers || typeof servers !== "object" || Array.isArray(servers)) return void 0;
+    return { createdFile: true, addedMcp: true, addedSchema: false, entries: servers };
+  } catch {
+    return void 0;
+  }
+}
+function planMcp(root, settings, rendered, pendingWrites) {
+  const { previous } = settings;
+  const plan = {
+    writes: [],
+    removals: [],
+    owned: [],
+    plannedOpenCode: false,
+    warnings: []
+  };
+  const claudeOwnership = previous.mcpConfig ?? legacyMcpOwnership(root, previous);
+  const codexOwned = ownedUnchanged(root, previous, CODEX_CONFIG_PATH);
+  if (settings.mcpServers === void 0) {
+    if (codexOwned) plan.owned.push(CODEX_CONFIG_PATH);
+    plan.mcpConfig = claudeOwnership;
+    return plan;
+  }
+  const desired = (path) => rendered.find((file) => file.path === path);
+  if (!pendingWrites.some((file) => file.path === OPENCODE_CONFIG_PATH)) {
+    plan.plannedOpenCode = true;
+    if (previous.files.includes(OPENCODE_CONFIG_PATH) && !previous.opencodeConfig) {
+      plan.warnings.push(`preserved legacy shared configuration: ${OPENCODE_CONFIG_PATH}`);
     }
+    const opencode = planOpenCodeConfig(
+      root,
+      desired(OPENCODE_CONFIG_PATH),
+      previous.opencodeConfig
+    );
+    if (opencode.write) plan.writes.push(opencode.write);
+    if (opencode.remove) plan.removals.push(OPENCODE_CONFIG_PATH);
+    plan.opencodeConfig = opencode.ownership;
+    plan.warnings.push(...opencode.warnings);
+  }
+  const claude = planClaudeMcpConfig(root, desired(CLAUDE_MCP_PATH), claudeOwnership);
+  if (claude.write) plan.writes.push(claude.write);
+  if (claude.remove) plan.removals.push(CLAUDE_MCP_PATH);
+  plan.mcpConfig = claude.ownership;
+  plan.warnings.push(...claude.warnings);
+  const codex = desired(CODEX_CONFIG_PATH);
+  const codexExists = existsSync8(join10(root, CODEX_CONFIG_PATH));
+  if (codex && (!codexExists || codexOwned)) {
+    plan.writes.push(codex);
+    plan.owned.push(CODEX_CONFIG_PATH);
+  } else if (codex) {
+    plan.warnings.push(
+      `left ${CODEX_CONFIG_PATH} unchanged; add this block to it to enable MCP in Codex:
+${codex.content.trimEnd()}`
+    );
+  } else if (codexOwned) {
+    plan.removals.push(CODEX_CONFIG_PATH);
   }
+  return plan;
 }
-function planUpdate(args) {
+function planInstallation(args, settings) {
   const root = resolve5(args.targetDir);
-  const { manifest: previous, sourceVersion, engines, hookEngines } = readUpdateInstallation(root);
+  const { previous, engines, hookEngines } = settings;
   const preserved = [
     .../* @__PURE__ */ new Set([...previous.preservedFiles ?? [], ...args.preserveFiles ?? []])
   ].sort();
@@ -1571,7 +1631,7 @@ function planUpdate(args) {
   const disablePath = join10(overridesDir, ".harness-overrides", "disable.yaml");
   if (existsSync8(disablePath)) {
     try {
-      DisableYamlSchema.parse(parseYAML(readFileSync8(disablePath, "utf8")));
+      DisableYamlSchema.parse(parseYAML(readFileSync9(disablePath, "utf8")));
     } catch {
       throw new Error(`invalid override selection: ${disablePath}`);
     }
@@ -1581,21 +1641,27 @@ function planUpdate(args) {
     packageDir: args.packageDir,
     engines,
     overridesDir: hasOverrides ? overridesDir : void 0,
+    mcpServers: settings.mcpServers,
     withStopHook: false
   });
+  const generated = rendered.output.files.filter(
+    (file) => !SHARED_CONFIG_PATHS.includes(file.path)
+  );
   const config = planUpdateConfigs(root, previous, hookEngines);
-  const output = [...rendered.output.files, ...config.writes].filter(
+  const mcp = planMcp(root, settings, rendered.output.files, config.writes);
+  const output = [...generated, ...config.writes, ...mcp.writes].filter(
     (file) => !preserved.includes(file.path)
   );
   const owned = [
-    .../* @__PURE__ */ new Set([...rendered.output.files.map((file) => file.path), ...config.ownedFiles])
+    .../* @__PURE__ */ new Set([...generated.map((file) => file.path), ...config.ownedFiles, ...mcp.owned])
   ].filter((file) => !preserved.includes(file)).sort();
   const removals = [
     .../* @__PURE__ */ new Set([
       ...previous.files.filter(
         (file) => !owned.includes(file) && !SHARED_CONFIG_PATHS.includes(file)
       ),
-      ...config.removals
+      ...config.removals,
+      ...mcp.removals
     ])
   ].filter((file) => !preserved.includes(file));
   assertManagedPaths(root, [...output.map((file) => file.path), ...removals]);
@@ -1607,6 +1673,7 @@ function planUpdate(args) {
       return [path, hashContent(content)];
     })
   );
+  const opencodeConfig = mcp.plannedOpenCode ? mcp.opencodeConfig : config.opencodeConfig;
   const manifest = {
     version: MANIFEST_VERSION,
     harnessVersion: VERSION,
@@ -1618,7 +1685,8 @@ function planUpdate(args) {
     stopHookEngines: [...hookEngines].sort(),
     ...hasOverrides ? { overridesDir: overridesDir === root ? "." : overridesDir } : {},
     ...preserved.length ? { preservedFiles: preserved } : {},
-    ...config.opencodeConfig ? { opencodeConfig: config.opencodeConfig } : {},
+    ...opencodeConfig ? { opencodeConfig } : {},
+    ...mcp.mcpConfig ? { mcpConfig: mcp.mcpConfig } : {},
     ...config.hookConfigs ? { hookConfigs: config.hookConfigs } : {}
   };
   const writes = output.filter((file) => currentContent(root, file.path) !== file.content);
@@ -1628,25 +1696,33 @@ function planUpdate(args) {
     writes.push({ path: MANIFEST_FILENAME, content: `${JSON.stringify(manifest, null, 2)}
 ` });
   }
-  const warnings = [...rendered.output.warnings, ...config.warnings];
+  const warnings = [...rendered.output.warnings, ...config.warnings, ...mcp.warnings];
+  if (preserved.length) warnings.push(`preserved user-owned artifacts: ${preserved.join(", ")}`);
+  return { writes, removals: existingRemovals, owned, manifest, warnings };
+}
+function planUpdate(args) {
+  const root = resolve5(args.targetDir);
+  const { manifest: previous, sourceVersion, engines, hookEngines } = readUpdateInstallation(root);
+  const plan = planInstallation(args, { previous, sourceVersion, engines, hookEngines });
+  const warnings = [...plan.warnings];
   if (!previous.fileHashes) {
     warnings.push(
       "legacy manifest has no file fingerprints: managed artifacts will be regenerated; backup preserves their previous contents"
     );
   }
-  if (preserved.length) warnings.push(`preserved user-owned artifacts: ${preserved.join(", ")}`);
   if (engines.includes("codex-cli"))
     warnings.push("ensure .agents/ is ignored by Git (run harness check)");
   return {
-    writes,
-    removals: existingRemovals,
+    writes: plan.writes,
+    removals: plan.removals,
+    owned: plan.owned,
     result: {
       version: VERSION,
       fromManifestVersion: sourceVersion,
       dryRun: args.dryRun === true,
-      upToDate: writes.length === 0 && existingRemovals.length === 0,
-      filesToWrite: writes.map((file) => file.path),
-      filesToRemove: existingRemovals,
+      upToDate: plan.writes.length === 0 && plan.removals.length === 0,
+      filesToWrite: plan.writes.map((file) => file.path),
+      filesToRemove: plan.removals,
       warnings
     }
   };
@@ -1662,6 +1738,67 @@ function updateCommand(args) {
   );
   return { ...plan.result, backupDir };
 }
+
+// src/cli/init.ts
+function writeFilesToTarget(files, targetDir) {
+  assertManagedPaths(
+    targetDir,
+    files.map((file) => file.path)
+  );
+  const written = [];
+  for (const f of files) {
+    const full = join11(targetDir, f.path);
+    mkdirSync2(dirname5(full), { recursive: true });
+    writeFileSync4(full, f.content);
+    written.push(f.path);
+  }
+  return written;
+}
+function emptyManifest(engines) {
+  return { version: MANIFEST_VERSION, engines: [...engines], renderedAt: "", files: [] };
+}
+function initCommand(args) {
+  const root = resolve6(args.targetDir);
+  const engines = resolveEngineList(args.engines);
+  const stopHookInstalled = args.withStopHook !== false;
+  const previous = readManifest(root) ?? emptyManifest(engines);
+  const plan = planInstallation(
+    {
+      targetDir: root,
+      packageDir: args.packageDir,
+      overridesDir: args.overridesDir,
+      preserveFiles: args.preserveFiles
+    },
+    {
+      previous,
+      sourceVersion: previous.version,
+      engines,
+      hookEngines: stopHookInstalled ? engines : [],
+      mcpServers: args.mcpServers ?? []
+    }
+  );
+  const touchedExisting = [...plan.writes.map((file) => file.path), ...plan.removals].some(
+    (path) => path !== MANIFEST_FILENAME && existsSync9(join11(root, path))
+  );
+  let backupDir;
+  if (plan.writes.length || plan.removals.length) {
+    backupDir = applyUpdateTransaction(root, plan.writes, plan.removals, args.backupDir).backupDir;
+    if (!touchedExisting && !args.backupDir) {
+      rmSync(backupDir, { recursive: true, force: true });
+      backupDir = void 0;
+    }
+    pruneEmptyDirs(root, new Set(plan.removals.map((path) => dirname5(join11(root, path)))));
+  }
+  const sharedWritten = plan.writes.map((file) => file.path).filter((path) => SHARED_CONFIG_PATHS.includes(path) && !plan.owned.includes(path));
+  return {
+    filesWritten: [...plan.owned, ...sharedWritten],
+    staleFilesRemoved: plan.removals,
+    warnings: plan.warnings,
+    stopHookInstalled,
+    engines,
+    ...backupDir ? { backupDir } : {}
+  };
+}
 export {
   VERSION,
   initCommand,