hunter-harness 0.1.0

package/dist/bin.js

@@ -0,0 +1,3356 @@
+#!/usr/bin/env node
+
+// src/bin.ts
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { createInterface } from "node:readline/promises";
+import { Command, CommanderError } from "commander";
+
+// ../contracts/dist/ai-config.js
+import { z as z4 } from "zod";
+
+// ../contracts/dist/registry.js
+import { z as z3 } from "zod";
+
+// ../contracts/dist/protocol.js
+import { z as z2 } from "zod";
+
+// ../contracts/dist/file-policy.js
+import { z } from "zod";
+var fileKindSchema = z.enum([
+  "user_editable",
+  "generated_reviewable",
+  "internal_state",
+  "generated_cache",
+  "external_unmanaged"
+]);
+var editPolicySchema = z.enum([
+  "allow",
+  "managed-block-only",
+  "discourage",
+  "protocol-only",
+  "external"
+]);
+var pushPolicySchema = z.enum([
+  "diff-proposal",
+  "full-diff-proposal",
+  "confirm-before-proposal",
+  "never"
+]);
+var updatePolicySchema = z.enum([
+  "managed-block-only",
+  "skip-if-local-dirty",
+  "replace-if-baseline-clean",
+  "protocol-only",
+  "protocol-rebuild-only",
+  "never"
+]);
+var conflictPolicySchema = z.enum([
+  "skip-and-report",
+  "managed-block-skip",
+  "transactional-replace",
+  "protocol-recover",
+  "ignore"
+]);
+var filePolicySchema = z.object({
+  file_kind: fileKindSchema,
+  edit_policy: editPolicySchema,
+  push_policy: pushPolicySchema,
+  update_policy: updatePolicySchema,
+  conflict_policy: conflictPolicySchema
+}).strict();
+
+// ../contracts/dist/protocol.js
+var sha256Schema = z2.string().regex(/^sha256:[a-f0-9]{64}$/);
+var relativePathSchema = z2.string().min(1).refine((path) => !path.startsWith("/") && !path.startsWith("\\") && !/^[A-Za-z]:/.test(path), "path must be relative");
+var commonFileFields = {
+  file_kind: fileKindSchema
+};
+var addOperationSchema = z2.object({
+  ...commonFileFields,
+  operation: z2.literal("add"),
+  path: relativePathSchema,
+  content_sha256: sha256Schema,
+  size_bytes: z2.number().int().nonnegative(),
+  block_id: z2.string().optional()
+  // Y-1 per-id managed block（COM-005 决策 B：前向兼容，当前 CLI 已接受；旧 CLI 反向拒绝分支不可达，不实现 MANIFEST_PROTOCOL_UNSUPPORTED）
+}).strict();
+var modifyOperationSchema = z2.object({
+  ...commonFileFields,
+  operation: z2.literal("modify"),
+  path: relativePathSchema,
+  base_content_sha256: sha256Schema,
+  content_sha256: sha256Schema,
+  size_bytes: z2.number().int().nonnegative(),
+  block_id: z2.string().optional()
+  // Y-1 per-id managed block（COM-005 决策 B：前向兼容，当前 CLI 已接受；旧 CLI 反向拒绝分支不可达，不实现 MANIFEST_PROTOCOL_UNSUPPORTED）
+}).strict();
+var deleteOperationSchema = z2.object({
+  ...commonFileFields,
+  operation: z2.literal("delete"),
+  path: relativePathSchema,
+  base_content_sha256: sha256Schema,
+  tombstone: z2.object({
+    deleted_at: z2.iso.datetime(),
+    reason: z2.string().min(1),
+    previous_sha256: sha256Schema
+  }).strict()
+}).strict();
+var renameOperationSchema = z2.object({
+  ...commonFileFields,
+  operation: z2.literal("rename"),
+  from_path: relativePathSchema,
+  to_path: relativePathSchema,
+  base_content_sha256: sha256Schema,
+  content_sha256: sha256Schema,
+  size_bytes: z2.number().int().nonnegative()
+}).strict();
+var fileOperationSchema = z2.discriminatedUnion("operation", [
+  addOperationSchema,
+  modifyOperationSchema,
+  deleteOperationSchema,
+  renameOperationSchema
+]);
+var artifactManifestSchema = z2.object({
+  schema_version: z2.literal(1),
+  project_id: z2.string().regex(/^prj_/),
+  project_version: z2.string().regex(/^pv_/).nullable(),
+  artifact_id: z2.string().regex(/^art_/),
+  files: z2.array(fileOperationSchema),
+  manifest_sha256: sha256Schema
+}).strict();
+var baselineFileSchema = z2.object({
+  baseline_hash: sha256Schema.nullable(),
+  local_hash_at_apply: sha256Schema.nullable(),
+  file_kind: fileKindSchema,
+  adapter: z2.string().optional(),
+  canonical_target: z2.string().optional(),
+  managed_block_hash: sha256Schema.optional(),
+  last_applied_version: z2.string().nullable(),
+  deleted: z2.boolean()
+}).strict();
+var baselineManifestSchema = z2.object({
+  schema_version: z2.literal(1),
+  project_id: z2.string().regex(/^prj_/).nullable(),
+  complete_project_version: z2.string().regex(/^pv_/).nullable(),
+  artifact_manifest_hash: sha256Schema.nullable(),
+  files: z2.record(z2.string(), baselineFileSchema)
+}).strict();
+var requestMetadataSchema = z2.object({
+  request_id: z2.uuid(),
+  idempotency_key: z2.uuid(),
+  project_id: z2.string().regex(/^prj_/),
+  client_id: z2.string().regex(/^cli_/),
+  base_project_version: z2.string().regex(/^pv_/).nullable(),
+  base_manifest_hash: sha256Schema,
+  protocol_version: z2.literal(1)
+}).strict();
+
+// ../contracts/dist/registry.js
+var registryAgentSchema = z3.enum(["claude-code", "codex", "cursor", "generic", "mcp"]);
+var registrySkillStatusSchema = z3.enum([
+  "draft",
+  "pending_review",
+  "published",
+  "rejected",
+  "deprecated"
+]);
+var registrySkillProposalStatusSchema = z3.enum([
+  "pending_review",
+  "approved",
+  "rejected"
+]);
+var registrySemverSchema = z3.string().regex(/^\d+\.\d+\.\d+$/);
+var registrySlugSchema = z3.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/);
+var checkStatusSchema = z3.enum(["green", "yellow", "red"]);
+var sourceFileSchema = z3.object({
+  path: z3.string(),
+  content: z3.string()
+}).strict();
+var SKILL_NAME_REGEX = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var skillNameSchema = z3.string().regex(SKILL_NAME_REGEX, "name must be lowercase alphanumeric with single hyphens between segments, at most 64 chars").max(64);
+var skillFrontmatterSchema = z3.object({
+  name: skillNameSchema,
+  description: z3.string().min(1),
+  kind: z3.enum(["workflow", "tooling", "migration", "governance"]).optional(),
+  triggers: z3.array(z3.string()).optional(),
+  inputs: z3.array(z3.string()).optional(),
+  outputs: z3.array(z3.string()).optional(),
+  forbidden_actions: z3.array(z3.string()).optional(),
+  required_context: z3.array(z3.string()).optional(),
+  version: z3.string().optional()
+}).passthrough();
+var skillUsageExampleSchema = z3.object({
+  title: z3.string(),
+  description: z3.string(),
+  request: z3.string(),
+  result: z3.string(),
+  files: z3.array(z3.string()).default([])
+}).strict();
+var agentSkillConfigSchema = z3.object({
+  agent: registryAgentSchema,
+  enabled: z3.boolean(),
+  isDefault: z3.boolean(),
+  installTarget: z3.string(),
+  // per-agent 独立版本已启用：每个 agent 持独立 latestVersion/draftVersion/draft 文件包；
+  // publish 只前进当前 agent 的 latestVersion，不影响其他 agent（见 server store.agentsFor/publish）。
+  latestVersion: registrySemverSchema.nullable(),
+  draftVersion: registrySemverSchema.nullable(),
+  sourcePackagePath: z3.string().nullable()
+}).strict();
+var skillCheckItemSchema = z3.object({
+  id: z3.string(),
+  label: z3.string(),
+  status: checkStatusSchema,
+  message: z3.string(),
+  filePath: z3.string().nullable(),
+  fixable: z3.boolean()
+}).strip();
+var skillCheckResultSchema = z3.object({
+  items: z3.array(skillCheckItemSchema),
+  summary: z3.object({
+    green: z3.number().int(),
+    yellow: z3.number().int(),
+    red: z3.number().int()
+  }).strip(),
+  checkedAt: z3.string()
+}).strip();
+var draftStateSchema = z3.object({
+  slug: z3.string(),
+  agent: registryAgentSchema,
+  sourceFiles: z3.array(sourceFileSchema),
+  ir: z3.unknown().optional(),
+  examples: z3.array(skillUsageExampleSchema).default([]),
+  draftVersion: registrySemverSchema.nullable(),
+  checks: skillCheckResultSchema.nullable(),
+  aiChecks: skillCheckResultSchema.nullable().default(null),
+  releaseNote: z3.string().nullable(),
+  revision: z3.number().int(),
+  created_at: z3.string(),
+  updated_at: z3.string()
+}).strict();
+var publishSkillRequestSchema = z3.object({
+  version: registrySemverSchema,
+  releaseNote: z3.string().optional()
+}).strict();
+var setDefaultAgentRequestSchema = z3.object({
+  defaultAgent: registryAgentSchema,
+  revision: z3.number().int().positive()
+}).strict();
+var skillDiffFileSchema = z3.object({
+  path: z3.string(),
+  status: z3.enum(["modified", "added", "removed"]),
+  publishedContent: z3.string().nullable(),
+  draftContent: z3.string().nullable()
+}).strict();
+var registryValidationSchema = z3.object({
+  schema_valid: z3.boolean(),
+  sensitive_findings: z3.number().int().nonnegative(),
+  // Y-4：语义已扩展为"任一 installable adapter 可编译"（非仅 claude-code；store.ts createProposal/publish 验 buildArtifacts.length>0）。
+  // 字段名保留以维持已发布契约稳定（schemas.test.ts 引用，改名=破坏性）。
+  claude_compilable: z3.boolean()
+}).strict();
+var registryArtifactSchema = z3.object({
+  artifact_id: z3.string().regex(/^ska_/),
+  skill_slug: registrySlugSchema,
+  version: registrySemverSchema,
+  agent: registryAgentSchema,
+  content_sha256: sha256Schema,
+  size_bytes: z3.number().int().nonnegative(),
+  source_proposal_id: z3.string().regex(/^skp_/).nullable(),
+  created_at: z3.iso.datetime()
+}).strict();
+var registrySkillVersionSchema = z3.object({
+  skill_slug: registrySlugSchema,
+  version: registrySemverSchema,
+  agent: registryAgentSchema,
+  ir: z3.unknown().optional(),
+  artifacts: z3.array(registryArtifactSchema),
+  source_proposal_id: z3.string().regex(/^skp_/).nullable(),
+  sourceFiles: z3.array(sourceFileSchema).default([]),
+  examples: z3.array(skillUsageExampleSchema).default([]),
+  changeNote: z3.string().nullable(),
+  created_at: z3.iso.datetime()
+}).strict();
+var registrySkillSummarySchema = z3.object({
+  skill_id: z3.string().regex(/^skl_/),
+  slug: registrySlugSchema,
+  name: z3.string().min(1),
+  description: z3.string().min(1),
+  // kind 从 entry frontmatter 反范式化（与 description 同理），供 dashboard 分类分布。
+  // nullable：新 skill 无 kind 时为 null（overview 回退 "unknown"）；optional：兼容旧数据无此字段。
+  kind: z3.enum(["workflow", "tooling", "migration", "governance"]).nullable().optional(),
+  tags: z3.array(registrySlugSchema),
+  status: registrySkillStatusSchema,
+  latest_version: registrySemverSchema.nullable(),
+  defaultAgent: registryAgentSchema.nullable(),
+  agents: z3.array(agentSkillConfigSchema),
+  revision: z3.number().int().positive(),
+  created_at: z3.iso.datetime(),
+  updated_at: z3.iso.datetime()
+}).strict();
+var registrySkillDetailSchema = registrySkillSummarySchema.extend({
+  ir: z3.unknown().optional(),
+  sourceFiles: z3.array(sourceFileSchema).default([]),
+  examples: z3.array(skillUsageExampleSchema).default([])
+}).strict();
+var registrySkillProposalSchema = z3.object({
+  proposal_id: z3.string().regex(/^skp_/),
+  skill_slug: registrySlugSchema,
+  proposed_ir: z3.unknown().optional(),
+  status: registrySkillProposalStatusSchema,
+  created_by: z3.string().min(1),
+  validation: registryValidationSchema,
+  created_at: z3.iso.datetime(),
+  reviewed_at: z3.iso.datetime().nullable()
+}).strict();
+var registryTagSchema = z3.object({
+  tag_id: z3.string().regex(/^tag_/),
+  slug: registrySlugSchema,
+  label: z3.string().min(1).max(80),
+  active: z3.boolean(),
+  revision: z3.number().int().positive(),
+  usageCount: z3.number().int().nonnegative(),
+  created_at: z3.iso.datetime(),
+  updated_at: z3.iso.datetime()
+}).strict();
+var registryWorkflowSchema = z3.object({
+  workflow_id: z3.string().regex(/^wf_/),
+  key: registrySlugSchema,
+  name: z3.string().min(1).max(120),
+  description: z3.string().min(1).max(1e3),
+  profile: registrySlugSchema,
+  default_agent: registryAgentSchema,
+  enabled: z3.boolean(),
+  skill_slugs: z3.array(registrySlugSchema),
+  revision: z3.number().int().positive(),
+  created_at: z3.iso.datetime(),
+  updated_at: z3.iso.datetime()
+}).strict();
+var registryWorkflowMutationSchema = z3.object({
+  key: registrySlugSchema,
+  name: z3.string().min(1).max(120),
+  description: z3.string().min(1).max(1e3),
+  profile: registrySlugSchema,
+  default_agent: registryAgentSchema,
+  enabled: z3.boolean(),
+  skill_slugs: z3.array(registrySlugSchema)
+}).strict();
+var registryProjectWorkflowBindingSchema = z3.object({
+  project_id: z3.string().regex(/^prj_/),
+  workflow_id: z3.string().regex(/^wf_/),
+  revision: z3.number().int().positive(),
+  updated_at: z3.iso.datetime()
+}).strict();
+
+// ../contracts/dist/ai-config.js
+var aiProviderApiFormatSchema = z4.enum(["openai", "anthropic", "custom"]);
+var providerModelSchema = z4.object({
+  id: z4.string(),
+  display_model: z4.string(),
+  request_model: z4.string(),
+  input_cost: z4.number().nonnegative().default(0),
+  output_cost: z4.number().nonnegative().default(0),
+  cache_hit_cost: z4.number().nonnegative().default(0),
+  cache_create_cost: z4.number().nonnegative().default(0)
+}).strict();
+var aiProviderConfigSchema = z4.object({
+  provider_id: z4.string(),
+  label: z4.string(),
+  base_url: z4.url(),
+  model: z4.string(),
+  enabled: z4.boolean(),
+  is_default: z4.boolean(),
+  api_key_env: z4.string(),
+  revision: z4.number().int(),
+  daily_request_limit: z4.number().int().nonnegative().nullable().default(null),
+  daily_token_limit: z4.number().int().nonnegative().nullable().default(null),
+  created_at: z4.iso.datetime(),
+  updated_at: z4.iso.datetime(),
+  models: z4.array(providerModelSchema).default([]),
+  api_format: aiProviderApiFormatSchema.default("openai"),
+  note: z4.string().default(""),
+  website: z4.string().default(""),
+  selected_model_id: z4.string().nullable().default(null),
+  sort_order: z4.number().int().nonnegative().default(0)
+}).strict();
+var aiProviderWithKeySetSchema = aiProviderConfigSchema.extend({
+  key_set: z4.boolean()
+}).strict();
+var aiQuotaUsageSchema = z4.object({
+  provider_id: z4.string(),
+  date: z4.string(),
+  requests: z4.number().int().nonnegative(),
+  tokens: z4.number().int().nonnegative(),
+  model: z4.string().default(""),
+  input_tokens: z4.number().int().nonnegative().default(0),
+  output_tokens: z4.number().int().nonnegative().default(0),
+  cache_hit_tokens: z4.number().int().nonnegative().default(0),
+  cache_create_tokens: z4.number().int().nonnegative().default(0),
+  cost: z4.number().nonnegative().default(0)
+}).strict();
+var aiConfigStateSchema = z4.object({
+  defaultProvider: z4.string().nullable(),
+  providers: z4.array(aiProviderConfigSchema),
+  usage: z4.array(aiQuotaUsageSchema).default([])
+}).strict();
+var aiProviderReorderRequestSchema = z4.object({
+  schema_version: z4.literal(1),
+  provider_ids: z4.array(z4.string().min(1)).min(1)
+}).strict();
+var aiJobStateSchema = z4.object({
+  jobId: z4.string(),
+  slug: z4.string(),
+  agent: registryAgentSchema,
+  status: z4.enum(["pending", "running", "completed", "failed"]),
+  result: skillCheckResultSchema.nullable(),
+  error: z4.string().nullable(),
+  createdAt: z4.iso.datetime(),
+  expiresAt: z4.iso.datetime()
+}).strict();
+
+// ../contracts/dist/canonical-json.js
+function normalize(value) {
+  if (Array.isArray(value)) {
+    return value.map(normalize);
+  }
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => [key, normalize(item)]));
+  }
+  return value;
+}
+function canonicalJson(value) {
+  return JSON.stringify(normalize(value));
+}
+
+// ../contracts/dist/errors.js
+import { z as z5 } from "zod";
+var apiErrorCodeSchema = z5.enum([
+  "VALIDATION_FAILED",
+  "INVALID_CURSOR",
+  "INVALID_PATH",
+  "AUTH_REQUIRED",
+  "TOKEN_INVALID",
+  "AUTH_FORBIDDEN",
+  "PROJECT_BIND_FORBIDDEN",
+  "PROJECT_NOT_FOUND",
+  "PROPOSAL_NOT_FOUND",
+  "ARTIFACT_NOT_FOUND",
+  "IDEMPOTENCY_KEY_REUSED",
+  "PROJECT_BINDING_CONFLICT",
+  "PROJECT_VERSION_CONFLICT",
+  "BLOB_NOT_DECLARED",
+  "UPLOAD_SESSION_EXPIRED",
+  "FILE_TOO_LARGE",
+  "PROPOSAL_TOO_LARGE",
+  "UPLOAD_CHUNK_HASH_MISMATCH",
+  "ARTIFACT_HASH_MISMATCH",
+  "POLICY_PATH_FORBIDDEN",
+  "SENSITIVE_CONTENT_BLOCKED",
+  "RATE_LIMITED",
+  "INTERNAL_ERROR",
+  "SERVICE_UNAVAILABLE",
+  "CONFLICT_LOCAL_DIRTY",
+  "LOCAL_LOCKED",
+  "LOCAL_TRANSACTION_RECOVERY_REQUIRED",
+  "SKILL_VALIDATION_FAILED",
+  "SKILL_ENTRY_NOT_FOUND",
+  "SKILL_NOT_FOUND",
+  "DRAFT_NOT_FOUND",
+  "REVISION_CONFLICT",
+  "ADAPTER_NOT_INSTALLABLE",
+  "WORKFLOW_PACKAGE_REDIRECT"
+]);
+var apiErrorEnvelopeSchema = z5.object({
+  error: z5.object({
+    code: apiErrorCodeSchema,
+    message: z5.string().min(1),
+    request_id: z5.uuid(),
+    details: z5.record(z5.string(), z5.unknown())
+  }).strict()
+}).strict();
+var cliExitCodeSchema = z5.union([
+  z5.literal(0),
+  z5.literal(1),
+  z5.literal(2),
+  z5.literal(3),
+  z5.literal(4),
+  z5.literal(5),
+  z5.literal(6),
+  z5.literal(7),
+  z5.literal(8)
+]);
+
+// ../contracts/dist/fix.js
+import { z as z6 } from "zod";
+var fixActionSchema = z6.enum(["auto", "confirm", "suggest"]);
+var fixPlanItemSchema = z6.object({
+  checkId: z6.string(),
+  action: fixActionSchema,
+  label: z6.string(),
+  affectedPaths: z6.array(z6.string()),
+  riskDelta: z6.string().nullable(),
+  message: z6.string(),
+  // AI 内容生成切片：fix-suggestions 端点填充（fixer.buildFixPatch 填的 item 不带，向后兼容）
+  suggestedContent: z6.string().nullable().optional(),
+  explanation: z6.string().nullable().optional(),
+  appliesTo: z6.enum(["examples", "allowed_capabilities", "instructions", "description", "tags"]).nullable().optional(),
+  generatedAt: z6.string().nullable().optional()
+}).strict();
+var fixPlanSchema = z6.object({
+  items: z6.array(fixPlanItemSchema),
+  mergedFiles: z6.array(skillDiffFileSchema),
+  summary: z6.object({
+    autoCount: z6.number().int(),
+    confirmCount: z6.number().int(),
+    suggestCount: z6.number().int(),
+    changedFiles: z6.number().int(),
+    changedLines: z6.number().int()
+  })
+}).strict();
+
+// ../contracts/dist/knowledge.js
+import { z as z7 } from "zod";
+var knowledgeStatusSchema = z7.enum([
+  "candidate",
+  "active",
+  "stale",
+  "deprecated",
+  "superseded"
+]);
+var knowledgeFrontmatterSchema = z7.object({
+  id: z7.string().regex(/^knowledge\.[a-z0-9.-]+$/),
+  type: z7.enum([
+    "business",
+    "architecture",
+    "decision",
+    "pitfall",
+    "api",
+    "glossary",
+    "project-local"
+  ]),
+  scope: z7.enum([
+    "global",
+    "project",
+    "module",
+    "feature",
+    "api",
+    "business-domain",
+    "local"
+  ]),
+  confidence: z7.enum(["verified", "inferred", "unverified", "low"]),
+  status: knowledgeStatusSchema,
+  domains: z7.array(z7.string()),
+  modules: z7.array(z7.string()),
+  related_paths: z7.array(z7.string()),
+  source: z7.object({
+    kind: z7.enum(["manual", "archive", "review", "imported", "test", "design"]),
+    ref: z7.string().min(1)
+  }).strict(),
+  created_at: z7.iso.datetime(),
+  updated_at: z7.iso.datetime(),
+  last_verified_at: z7.iso.datetime().nullable(),
+  expires_at: z7.iso.datetime().nullable(),
+  supersedes: z7.array(z7.string()),
+  superseded_by: z7.array(z7.string())
+}).strict();
+
+// ../contracts/dist/mcp-contract.js
+import { z as z8 } from "zod";
+var mcpToolContractSchema = z8.object({
+  tool_name: z8.string(),
+  description: z8.string(),
+  input_schema: z8.record(z8.string(), z8.unknown())
+}).strict();
+
+// ../contracts/dist/project.js
+import { z as z9 } from "zod";
+var projectIdSchema = z9.string().regex(/^prj_[A-Za-z0-9_-]+$/);
+var tokenEnvSchema = z9.string().regex(/^[A-Z_][A-Z0-9_]*$/);
+var httpsUrlSchema = z9.url().refine((value) => new URL(value).protocol === "https:", "server URL must use HTTPS");
+var adapterNameSchema = z9.enum([
+  "claude-code",
+  "codex",
+  "cursor",
+  "generic",
+  "mcp"
+]);
+var initConfigSchema = z9.object({
+  adapter: adapterNameSchema,
+  profile: z9.enum(["general", "java"]),
+  server_url: httpsUrlSchema.nullable().optional(),
+  token_env: tokenEnvSchema.nullable().optional(),
+  project_id: projectIdSchema.nullable().optional(),
+  features: z9.object({
+    codegraph_check: z9.boolean().default(true),
+    superpowers_check: z9.boolean().default(true)
+  }).strict().optional()
+}).strict();
+var projectConfigSchema = z9.object({
+  harness: z9.object({
+    name: z9.literal("hunter-harness"),
+    schema_version: z9.literal(1)
+  }).strict(),
+  project: z9.object({
+    name: z9.string().min(1),
+    root: z9.literal("."),
+    local_project_key: z9.uuid(),
+    project_id: projectIdSchema.nullable(),
+    profiles: z9.array(z9.string().min(1)).min(1)
+  }).strict(),
+  server: z9.object({
+    url: httpsUrlSchema.nullable(),
+    token_env: tokenEnvSchema
+  }).strict(),
+  adapters: z9.object({
+    enabled: z9.array(adapterNameSchema).min(1)
+  }).strict()
+}).strict();
+
+// ../contracts/dist/dashboard.js
+import { z as z10 } from "zod";
+var dashboardHealthStatusSchema = z10.enum(["healthy", "attention", "unavailable"]);
+var dashboardServiceStatusSchema = z10.enum(["operational", "degraded", "unavailable"]);
+var dashboardTrendPointSchema = z10.object({
+  date: z10.string().regex(/^\d{4}-\d{2}-\d{2}$/),
+  submitted: z10.number().int().nonnegative(),
+  approved: z10.number().int().nonnegative(),
+  rejected: z10.number().int().nonnegative(),
+  pending: z10.number().int().nonnegative()
+}).strict();
+var dashboardDistributionItemSchema = z10.object({
+  key: z10.string().min(1),
+  count: z10.number().int().nonnegative()
+}).strict();
+var dashboardHealthItemSchema = z10.object({
+  key: z10.string().min(1),
+  label: z10.string().min(1),
+  status: dashboardHealthStatusSchema,
+  value: z10.string().min(1),
+  detail: z10.string().min(1)
+}).strict();
+var dashboardServiceItemSchema = z10.object({
+  key: z10.string().min(1),
+  label: z10.string().min(1),
+  status: dashboardServiceStatusSchema,
+  detail: z10.string().min(1),
+  checked_at: z10.iso.datetime()
+}).strict();
+var dashboardActivitySchema = z10.object({
+  event_id: z10.string().min(1),
+  action: z10.string().min(1),
+  target_id: z10.string().min(1),
+  project_id: z10.string().nullable(),
+  actor_id: z10.string().min(1),
+  created_at: z10.iso.datetime()
+}).strict();
+var dashboardOverviewSchema = z10.object({
+  generated_at: z10.iso.datetime(),
+  window: z10.object({
+    days: z10.number().int().min(7).max(30),
+    starts_at: z10.iso.datetime(),
+    ends_at: z10.iso.datetime()
+  }).strict(),
+  metrics: z10.object({
+    projects: z10.number().int().nonnegative(),
+    workflows: z10.number().int().nonnegative(),
+    skills: z10.number().int().nonnegative(),
+    published_skills: z10.number().int().nonnegative(),
+    pending_reviews: z10.number().int().nonnegative(),
+    approved_proposals: z10.number().int().nonnegative(),
+    rejected_proposals: z10.number().int().nonnegative(),
+    artifacts: z10.number().int().nonnegative(),
+    project_artifacts: z10.number().int().nonnegative(),
+    skill_artifacts: z10.number().int().nonnegative()
+  }).strict(),
+  trend: z10.array(dashboardTrendPointSchema),
+  distributions: z10.object({
+    skill_categories: z10.array(dashboardDistributionItemSchema),
+    workflow_profiles: z10.array(dashboardDistributionItemSchema)
+  }).strict(),
+  health: z10.array(dashboardHealthItemSchema),
+  services: z10.array(dashboardServiceItemSchema),
+  activity: z10.array(dashboardActivitySchema)
+}).strict();
+
+// ../contracts/dist/workflow-package.js
+import { z as z11 } from "zod";
+var workflowPackageManifestSchema = z11.object({
+  key: registrySlugSchema,
+  name: z11.string().min(1).max(120),
+  description: z11.string().min(1).max(1e3),
+  profile: registrySlugSchema,
+  skills: z11.array(z11.object({
+    slug: registrySlugSchema,
+    ref: z11.string()
+  }).strict()),
+  agents: z11.array(z11.object({
+    path: z11.string(),
+    ref: z11.string()
+  }).strict()),
+  protocols: z11.array(z11.object({
+    path: z11.string(),
+    ref: z11.string()
+  }).strict()),
+  templates: z11.array(z11.object({
+    path: z11.string(),
+    ref: z11.string()
+  }).strict()),
+  execution_order: z11.array(z11.string()),
+  strategy: z11.enum(["sequential", "parallel", "manual"])
+}).strict();
+var workflowPackageArtifactSchema = z11.object({
+  artifact_id: z11.string().regex(/^wfa_/),
+  package_key: registrySlugSchema,
+  version: registrySemverSchema,
+  content_sha256: sha256Schema,
+  size_bytes: z11.number().int().nonnegative(),
+  created_at: z11.iso.datetime()
+}).strict();
+var workflowPackageVersionSchema = z11.object({
+  package_key: registrySlugSchema,
+  version: registrySemverSchema,
+  manifest: workflowPackageManifestSchema,
+  artifacts: z11.array(workflowPackageArtifactSchema),
+  sourceFiles: z11.array(sourceFileSchema).default([]),
+  changeNote: z11.string().nullable(),
+  created_at: z11.iso.datetime()
+}).strict();
+var workflowPackageDraftStateSchema = z11.object({
+  key: registrySlugSchema,
+  manifest: workflowPackageManifestSchema,
+  sourceFiles: z11.array(sourceFileSchema),
+  draftVersion: registrySemverSchema.nullable(),
+  checks: skillCheckResultSchema.nullable(),
+  releaseNote: z11.string().nullable(),
+  revision: z11.number().int(),
+  created_at: z11.string(),
+  updated_at: z11.string()
+}).strict();
+var workflowPackageSchema = z11.object({
+  package_id: z11.string().regex(/^wfp_/),
+  key: registrySlugSchema,
+  manifest: workflowPackageManifestSchema,
+  latestVersion: registrySemverSchema.nullable(),
+  revision: z11.number().int().positive(),
+  created_at: z11.iso.datetime(),
+  updated_at: z11.iso.datetime()
+}).strict();
+var publishWorkflowPackageRequestSchema = z11.object({
+  version: registrySemverSchema,
+  releaseNote: z11.string().optional()
+}).strict();
+
+// ../core/dist/fs/hash.js
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+function sha256Bytes(content) {
+  return "sha256:" + createHash("sha256").update(content).digest("hex");
+}
+async function sha256File(path) {
+  return sha256Bytes(await readFile(path));
+}
+
+// ../core/dist/fs/path-safety.js
+import { lstat } from "node:fs/promises";
+import { isAbsolute, join, posix, resolve, win32 } from "node:path";
+var WINDOWS_RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i;
+var WINDOWS_ILLEGAL = /[<>:"|?*]/;
+var MAX_MANAGED_PATH = 240;
+var UnsafePathError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "UnsafePathError";
+  }
+};
+function hasIllegalWindowsCharacter(segment) {
+  return WINDOWS_ILLEGAL.test(segment) || Array.from(segment).some((character) => character.charCodeAt(0) <= 31);
+}
+function normalizeManagedPath(input) {
+  if (input.length === 0 || input.length > MAX_MANAGED_PATH) {
+    throw new UnsafePathError("path is empty or exceeds the managed path limit");
+  }
+  if (input.includes("\\") || isAbsolute(input) || win32.isAbsolute(input)) {
+    throw new UnsafePathError("absolute paths and backslashes are not allowed");
+  }
+  const rawSegments = input.split("/");
+  if (rawSegments.some((segment) => segment === "..")) {
+    throw new UnsafePathError("path traversal is not allowed");
+  }
+  const normalized = posix.normalize(input).replace(/^\.\/+/, "").replace(/\/+/g, "/");
+  if (normalized === "." || normalized.startsWith("../")) {
+    throw new UnsafePathError("path must resolve inside the project");
+  }
+  for (const segment of normalized.split("/")) {
+    if (segment.length === 0 || segment.endsWith(".") || segment.endsWith(" ") || WINDOWS_RESERVED.test(segment) || hasIllegalWindowsCharacter(segment)) {
+      throw new UnsafePathError("path contains an illegal cross-platform segment");
+    }
+  }
+  return normalized;
+}
+function assertNoCaseCollisions(paths) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const item of paths) {
+    const normalized = normalizeManagedPath(item);
+    const folded = normalized.toLocaleLowerCase("en-US");
+    const existing = seen.get(folded);
+    if (existing !== void 0 && existing !== normalized) {
+      throw new UnsafePathError("case-insensitive path collision: " + existing + " and " + normalized);
+    }
+    seen.set(folded, normalized);
+  }
+}
+function volumeRoot(path) {
+  const windowsRoot = win32.parse(path).root;
+  if (windowsRoot !== "") {
+    return windowsRoot.toLocaleLowerCase("en-US");
+  }
+  return resolve(path).slice(0, 1);
+}
+function assertSameVolume(first, second) {
+  if (volumeRoot(first) !== volumeRoot(second)) {
+    throw new UnsafePathError("atomic rename requires the same filesystem volume");
+  }
+}
+async function assertNoSymlinks(root, relativePath) {
+  const normalized = normalizeManagedPath(relativePath);
+  let current = resolve(root);
+  for (const segment of normalized.split("/")) {
+    current = join(current, segment);
+    try {
+      const stat5 = await lstat(current);
+      if (stat5.isSymbolicLink()) {
+        throw new UnsafePathError("symbolic links are not managed");
+      }
+    } catch (error) {
+      if (error instanceof UnsafePathError || !(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") {
+        throw error;
+      }
+      break;
+    }
+  }
+}
+
+// ../core/dist/api/retry.js
+async function withRetry(action, options) {
+  const attempts = options.attempts ?? 3;
+  const sleep = options.sleep ?? (async (milliseconds) => {
+    await new Promise((resolve6) => setTimeout(resolve6, milliseconds));
+  });
+  let lastError;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    try {
+      return await action(attempt);
+    } catch (error) {
+      lastError = error;
+      if (attempt === attempts || !options.shouldRetry(error, attempt)) {
+        throw error;
+      }
+      await sleep((options.baseDelayMs ?? 100) * 2 ** (attempt - 1));
+    }
+  }
+  throw lastError;
+}
+
+// ../core/dist/api/client.js
+var ApiError = class extends Error {
+  status;
+  code;
+  requestId;
+  details;
+  constructor(status, code, message, requestId, details) {
+    super(message);
+    this.name = "ApiError";
+    this.status = status;
+    this.code = code;
+    this.requestId = requestId;
+    this.details = details;
+  }
+};
+var RetryableResponseError = class extends Error {
+  response;
+  constructor(response) {
+    super("retryable HTTP response: " + response.status);
+    this.response = response;
+  }
+};
+var HunterHarnessApiClient = class {
+  serverUrl;
+  fetch;
+  token;
+  sleep;
+  retryAttempts;
+  constructor(options) {
+    const url = new URL(options.serverUrl);
+    if (url.protocol !== "https:") {
+      throw new Error("server URL must use HTTPS");
+    }
+    if (options.token.trim() === "") {
+      throw new Error("API token is required");
+    }
+    this.serverUrl = url.toString().replace(/\/$/, "");
+    this.token = options.token;
+    this.fetch = options.fetch ?? globalThis.fetch;
+    this.sleep = options.sleep;
+    this.retryAttempts = options.retryAttempts ?? 3;
+  }
+  async request(method, path, options) {
+    const headers = new Headers({
+      Accept: "application/json",
+      Authorization: "Bearer " + this.token,
+      "X-Request-Id": options.requestId,
+      ...options.headers
+    });
+    if (options.idempotencyKey !== void 0) {
+      headers.set("Idempotency-Key", options.idempotencyKey);
+    }
+    let body;
+    if (options.rawBody !== void 0) {
+      body = options.rawBody;
+    } else if (options.body !== void 0) {
+      headers.set("Content-Type", "application/json");
+      body = JSON.stringify(options.body);
+    }
+    let response;
+    try {
+      response = await withRetry(async () => {
+        const value = await this.fetch(this.serverUrl + path, {
+          method,
+          headers,
+          ...body === void 0 ? {} : { body }
+        });
+        if (value.status === 429 || value.status >= 500) {
+          throw new RetryableResponseError(value);
+        }
+        return value;
+      }, {
+        attempts: this.retryAttempts,
+        ...this.sleep === void 0 ? {} : { sleep: this.sleep },
+        shouldRetry: () => true
+      });
+    } catch (error) {
+      if (error instanceof RetryableResponseError) {
+        response = error.response;
+      } else {
+        throw error;
+      }
+    }
+    const text = await response.text();
+    const payload = text === "" ? {} : JSON.parse(text);
+    if (!response.ok) {
+      const envelope = payload.error;
+      throw new ApiError(response.status, typeof envelope?.code === "string" ? envelope.code : "HTTP_ERROR", typeof envelope?.message === "string" ? envelope.message : "server request failed", typeof envelope?.request_id === "string" ? envelope.request_id : null, envelope?.details ?? {});
+    }
+    return payload;
+  }
+  async resolveProject(body, requestId, idempotencyKey) {
+    return this.request("POST", "/api/v1/projects:resolve", {
+      requestId,
+      idempotencyKey,
+      body
+    });
+  }
+  async createProposalSession(projectId, body, requestId, idempotencyKey) {
+    return this.request("POST", "/api/v1/projects/" + encodeURIComponent(projectId) + "/proposal-sessions", { requestId, idempotencyKey, body });
+  }
+  async queryBlobs(sessionId, hashes, requestId, idempotencyKey) {
+    return this.request("POST", "/api/v1/proposal-sessions/" + encodeURIComponent(sessionId) + "/blobs:query", { requestId, idempotencyKey, body: { content_sha256: hashes } });
+  }
+  async uploadBlobChunk(options) {
+    const end = options.start + options.chunk.byteLength - 1;
+    return this.request("PUT", "/api/v1/proposal-sessions/" + encodeURIComponent(options.sessionId) + "/blobs/" + encodeURIComponent(options.contentSha256), {
+      requestId: options.requestId,
+      idempotencyKey: options.idempotencyKey,
+      rawBody: options.chunk,
+      headers: {
+        "Content-Type": "application/octet-stream",
+        "Content-Range": "bytes " + options.start + "-" + end + "/" + options.total,
+        "X-Chunk-SHA256": sha256Bytes(options.chunk)
+      }
+    });
+  }
+  async finalizeProposal(sessionId, body, requestId, idempotencyKey) {
+    return this.request("POST", "/api/v1/proposal-sessions/" + encodeURIComponent(sessionId) + ":finalize", { requestId, idempotencyKey, body });
+  }
+  async getUpdateManifest(projectId, query, requestId) {
+    const parameters = new URLSearchParams({
+      base_project_version: query.base_project_version ?? "",
+      base_manifest_hash: query.base_manifest_hash,
+      adapter: query.adapter,
+      profile: query.profile
+    });
+    return this.request("GET", "/api/v1/projects/" + encodeURIComponent(projectId) + "/update-manifest?" + parameters.toString(), { requestId });
+  }
+  async getArtifactManifest(artifactId, requestId) {
+    return this.request("GET", "/api/v1/artifacts/" + encodeURIComponent(artifactId) + "/manifest", { requestId });
+  }
+  async downloadArtifactBlob(artifactId, contentSha256, requestId) {
+    const response = await withRetry(async () => {
+      const value = await this.fetch(this.serverUrl + "/api/v1/artifacts/" + encodeURIComponent(artifactId) + "/blobs/" + encodeURIComponent(contentSha256), {
+        headers: {
+          Accept: "application/octet-stream",
+          Authorization: "Bearer " + this.token,
+          "X-Request-Id": requestId
+        }
+      });
+      if (value.status === 429 || value.status >= 500) {
+        throw new RetryableResponseError(value);
+      }
+      return value;
+    }, {
+      attempts: this.retryAttempts,
+      ...this.sleep === void 0 ? {} : { sleep: this.sleep },
+      shouldRetry: () => true
+    });
+    if (!response.ok) {
+      const payload = await response.json();
+      throw new ApiError(response.status, payload.error?.code ?? "HTTP_ERROR", payload.error?.message ?? "artifact download failed", payload.error?.request_id ?? null, payload.error?.details ?? {});
+    }
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    if (response.headers.get("X-Content-SHA256") !== contentSha256 || sha256Bytes(bytes) !== contentSha256) {
+      throw new ApiError(422, "ARTIFACT_HASH_MISMATCH", "artifact blob integrity check failed", response.headers.get("X-Request-Id"), {});
+    }
+    return bytes;
+  }
+};
+
+// ../core/dist/knowledge/frontmatter.js
+import { parse as parseYaml } from "yaml";
+
+// ../core/dist/state/atomic.js
+import { mkdir, rename, rm, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { randomUUID } from "node:crypto";
+async function atomicWriteFile(target, content) {
+  await mkdir(dirname(target), { recursive: true });
+  const temporary = target + ".tmp-" + randomUUID();
+  await writeFile(temporary, content, { flag: "wx" });
+  try {
+    await rename(temporary, target);
+  } catch {
+    await rm(target, { force: true });
+    await rename(temporary, target);
+  }
+}
+async function atomicWriteJson(target, value) {
+  await atomicWriteFile(target, JSON.stringify(value, null, 2) + "\n");
+}
+
+// ../core/dist/knowledge/index.js
+var MAX_ENTRY_BYTES = 64 * 1024;
+
+// ../core/dist/managed/managed-block.js
+var MANAGED_BLOCK_START = "<!-- hunter-harness:start -->";
+var MANAGED_BLOCK_END = "<!-- hunter-harness:end -->";
+function markerCount(content, marker) {
+  return content.split(marker).length - 1;
+}
+function validateMarkers(content) {
+  const starts = markerCount(content, MANAGED_BLOCK_START);
+  const ends = markerCount(content, MANAGED_BLOCK_END);
+  if (starts === 0 && ends === 0) {
+    return "absent";
+  }
+  if (starts !== 1 || ends !== 1) {
+    throw new Error("managed block markers are malformed or duplicated");
+  }
+  if (content.indexOf(MANAGED_BLOCK_START) > content.indexOf(MANAGED_BLOCK_END)) {
+    throw new Error("managed block markers are out of order");
+  }
+  return "present";
+}
+function renderBlock(content, newline) {
+  const normalized = content.replace(/\r\n/g, "\n").replace(/\n/g, newline);
+  return MANAGED_BLOCK_START + newline + normalized + newline + MANAGED_BLOCK_END;
+}
+function extractManagedBlock(content) {
+  if (validateMarkers(content) === "absent") {
+    return null;
+  }
+  const start = content.indexOf(MANAGED_BLOCK_START) + MANAGED_BLOCK_START.length;
+  const end = content.indexOf(MANAGED_BLOCK_END);
+  return content.slice(start, end).replace(/^\r?\n/, "").replace(/\r?\n$/, "");
+}
+function upsertManagedBlock(original, content) {
+  const newline = original.includes("\r\n") ? "\r\n" : "\n";
+  const block = renderBlock(content, newline);
+  if (validateMarkers(original) === "absent") {
+    if (original.length === 0) {
+      return block + newline;
+    }
+    const separator = original.endsWith(newline) ? newline : newline + newline;
+    return original + separator + block + newline;
+  }
+  const start = original.indexOf(MANAGED_BLOCK_START);
+  const end = original.indexOf(MANAGED_BLOCK_END) + MANAGED_BLOCK_END.length;
+  return original.slice(0, start) + block + original.slice(end);
+}
+function removeManagedBlock(original) {
+  if (validateMarkers(original) === "absent") {
+    return original;
+  }
+  const start = original.indexOf(MANAGED_BLOCK_START);
+  const end = original.indexOf(MANAGED_BLOCK_END) + MANAGED_BLOCK_END.length;
+  const before = original.slice(0, start).replace(/(?:\r?\n){2}$/, "\n");
+  const after = original.slice(end).replace(/^(?:\r?\n){1,2}/, "");
+  return before + after;
+}
+function escapeRe(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var startById = (id) => `<!-- hunter-harness:start id=${id} -->`;
+var endById = (id) => `<!-- hunter-harness:end id=${id} -->`;
+function upsertManagedBlockById(original, id, content) {
+  const newline = original.includes("\r\n") ? "\r\n" : "\n";
+  const block = startById(id) + newline + content + newline + endById(id);
+  const re = new RegExp(escapeRe(startById(id)) + "[\\s\\S]*?" + escapeRe(endById(id)));
+  if (re.test(original)) {
+    return original.replace(re, block);
+  }
+  const separator = original.length === 0 ? "" : original.endsWith(newline) ? newline : newline + newline;
+  return original + separator + block + newline;
+}
+
+// ../core/dist/policy/file-policy.js
+var USER_MANAGED_BLOCK = {
+  file_kind: "user_editable",
+  edit_policy: "managed-block-only",
+  push_policy: "diff-proposal",
+  update_policy: "managed-block-only",
+  conflict_policy: "managed-block-skip"
+};
+var USER_DIFF = {
+  file_kind: "user_editable",
+  edit_policy: "allow",
+  push_policy: "diff-proposal",
+  update_policy: "skip-if-local-dirty",
+  conflict_policy: "skip-and-report"
+};
+var USER_FULL = {
+  file_kind: "user_editable",
+  edit_policy: "allow",
+  push_policy: "full-diff-proposal",
+  update_policy: "skip-if-local-dirty",
+  conflict_policy: "skip-and-report"
+};
+var PROJECT_LOCAL = {
+  file_kind: "user_editable",
+  edit_policy: "allow",
+  push_policy: "confirm-before-proposal",
+  update_policy: "never",
+  conflict_policy: "ignore"
+};
+var GENERATED_REVIEWABLE = {
+  file_kind: "generated_reviewable",
+  edit_policy: "discourage",
+  push_policy: "full-diff-proposal",
+  update_policy: "skip-if-local-dirty",
+  conflict_policy: "skip-and-report"
+};
+var CONTEXT_INDEX = {
+  file_kind: "generated_reviewable",
+  edit_policy: "discourage",
+  push_policy: "diff-proposal",
+  update_policy: "replace-if-baseline-clean",
+  conflict_policy: "skip-and-report"
+};
+var INTERNAL_STATE = {
+  file_kind: "internal_state",
+  edit_policy: "protocol-only",
+  push_policy: "never",
+  update_policy: "protocol-only",
+  conflict_policy: "protocol-recover"
+};
+var GENERATED_CACHE = {
+  file_kind: "generated_cache",
+  edit_policy: "protocol-only",
+  push_policy: "never",
+  update_policy: "protocol-rebuild-only",
+  conflict_policy: "protocol-recover"
+};
+var REPORT_CACHE = {
+  file_kind: "generated_cache",
+  edit_policy: "discourage",
+  push_policy: "never",
+  update_policy: "never",
+  conflict_policy: "ignore"
+};
+var EXTERNAL = {
+  file_kind: "external_unmanaged",
+  edit_policy: "external",
+  push_policy: "never",
+  update_policy: "never",
+  conflict_policy: "ignore"
+};
+function under(path, prefix) {
+  return path === prefix.slice(0, -1) || path.startsWith(prefix);
+}
+function classifyFile(input) {
+  const path = normalizeManagedPath(input);
+  if (path === "CLAUDE.md" || path === "AGENTS.md") {
+    return USER_MANAGED_BLOCK;
+  }
+  if (under(path, ".claude/rules/") || under(path, ".claude/skills/harness-")) {
+    return USER_DIFF;
+  }
+  if (under(path, ".cursor/rules/") || under(path, ".agent-skills/")) {
+    return USER_DIFF;
+  }
+  if (under(path, ".harness/knowledge/project-local/")) {
+    return PROJECT_LOCAL;
+  }
+  if (under(path, ".harness/knowledge/")) {
+    return USER_FULL;
+  }
+  if (under(path, ".harness/codebase/map/") || path === ".harness/codebase/map-summary.md" || path === ".harness/codebase/map-manifest.json") {
+    return GENERATED_REVIEWABLE;
+  }
+  if (path === ".harness/context-index.json") {
+    return CONTEXT_INDEX;
+  }
+  if (under(path, ".harness/reports/")) {
+    return REPORT_CACHE;
+  }
+  if (under(path, ".harness/state/") || under(path, ".harness/rules/")) {
+    return INTERNAL_STATE;
+  }
+  if (under(path, ".harness/generated/") || under(path, ".harness/cache/")) {
+    return GENERATED_CACHE;
+  }
+  if (path === ".harness/project.yaml") {
+    return USER_DIFF;
+  }
+  return EXTERNAL;
+}
+function decidePush(policy, confirmed) {
+  if (policy.push_policy === "never") {
+    return { include: false, reason: "policy-never" };
+  }
+  if (policy.push_policy === "confirm-before-proposal" && !confirmed) {
+    return { include: false, reason: "confirmation-required" };
+  }
+  return { include: true };
+}
+function decideUpdate(policy, dirty) {
+  if (policy.update_policy === "never") {
+    return { apply: false, reason: "policy-never" };
+  }
+  if (policy.update_policy === "protocol-only" || policy.update_policy === "protocol-rebuild-only") {
+    return { apply: false, reason: "protocol-only" };
+  }
+  if (dirty) {
+    return { apply: false, reason: "local-dirty" };
+  }
+  return { apply: true };
+}
+
+// ../core/dist/project/initialize.js
+import { createHash as createHash2 } from "node:crypto";
+import { readFile as readFile3, stat as stat2 } from "node:fs/promises";
+import { basename, join as join4, resolve as resolve3 } from "node:path";
+import { parse as parseYaml2, stringify as stringifyYaml } from "yaml";
+
+// ../core/dist/transaction/transaction.js
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { copyFile, mkdir as mkdir3, readFile as readFile2, rename as rename2, rm as rm2, stat, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname as dirname2, join as join3 } from "node:path";
+
+// ../core/dist/state/layout.js
+import { mkdir as mkdir2 } from "node:fs/promises";
+import { join as join2, resolve as resolve2 } from "node:path";
+function stateLayout(projectRoot) {
+  const root = resolve2(projectRoot);
+  const harness = join2(root, ".harness");
+  return {
+    root,
+    harness,
+    baseline: join2(harness, "state", "baseline"),
+    transactions: join2(harness, "state", "transactions"),
+    locks: join2(harness, "state", "locks"),
+    local: join2(harness, "state", "local"),
+    serverArtifacts: join2(harness, "cache", "server-artifacts"),
+    reports: join2(harness, "reports")
+  };
+}
+async function ensureStateLayout(projectRoot) {
+  const layout = stateLayout(projectRoot);
+  await Promise.all([
+    mkdir2(layout.baseline, { recursive: true }),
+    mkdir2(layout.transactions, { recursive: true }),
+    mkdir2(layout.locks, { recursive: true }),
+    mkdir2(layout.local, { recursive: true }),
+    mkdir2(layout.serverArtifacts, { recursive: true }),
+    mkdir2(layout.reports, { recursive: true })
+  ]);
+  return layout;
+}
+
+// ../core/dist/transaction/transaction.js
+var InterruptedTransactionError = class extends Error {
+  constructor() {
+    super("transaction interrupted by failure injection");
+    this.name = "InterruptedTransactionError";
+  }
+};
+function encodePath(path) {
+  return Buffer.from(path).toString("base64url");
+}
+async function exists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+function affectedPaths(operation) {
+  if (operation.operation === "rename") {
+    return [operation.from_path, operation.to_path];
+  }
+  return [operation.path];
+}
+async function writeJournal(transactionRoot, journal) {
+  await atomicWriteJson(join3(transactionRoot, "journal.json"), journal);
+  await atomicWriteJson(join3(transactionRoot, "status.json"), {
+    schema_version: 1,
+    transaction_id: journal.transaction_id,
+    state: journal.state,
+    applied_count: journal.applied_count,
+    failure: journal.failure,
+    updated_at: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+async function snapshotPaths(projectRoot, transactionRoot, paths) {
+  const snapshots = [];
+  for (const path of paths) {
+    const target = join3(projectRoot, path);
+    const present = await exists(target);
+    const snapshotName = present ? encodePath(path) : null;
+    if (snapshotName !== null) {
+      await copyFile(target, join3(transactionRoot, "before", snapshotName));
+    }
+    snapshots.push({ path, existed: present, snapshot_name: snapshotName });
+  }
+  return snapshots;
+}
+async function stageOperations(transactionRoot, operations) {
+  for (let index = 0; index < operations.length; index += 1) {
+    const operation = operations[index];
+    if (operation?.operation === "add" || operation?.operation === "modify" || operation?.operation === "rename") {
+      await writeFile2(join3(transactionRoot, "staged", String(index)), operation.content);
+    }
+  }
+}
+async function installStaged(staged, target, transactionId) {
+  await mkdir3(dirname2(target), { recursive: true });
+  assertSameVolume(staged, target);
+  const temporary = join3(dirname2(target), ".hunter-" + transactionId + "-" + randomUUID2() + ".tmp");
+  await copyFile(staged, temporary);
+  await rm2(target, { force: true });
+  await rename2(temporary, target);
+}
+async function applyOperation(projectRoot, transactionRoot, operation, index, transactionId) {
+  if (operation.operation === "delete") {
+    await rm2(join3(projectRoot, operation.path), { force: true });
+    return;
+  }
+  if (operation.operation === "rename") {
+    await rm2(join3(projectRoot, operation.from_path), { force: true });
+    await installStaged(join3(transactionRoot, "staged", String(index)), join3(projectRoot, operation.to_path), transactionId);
+    return;
+  }
+  await installStaged(join3(transactionRoot, "staged", String(index)), join3(projectRoot, operation.path), transactionId);
+}
+async function rollbackTransaction(projectRoot, transactionId) {
+  const transactionRoot = join3(stateLayout(projectRoot).transactions, transactionId);
+  const journal = JSON.parse(await readFile2(join3(transactionRoot, "journal.json"), "utf8"));
+  if (journal.state === "committed") {
+    return { transactionId, status: "committed" };
+  }
+  journal.state = "rolling_back";
+  await writeJournal(transactionRoot, journal);
+  try {
+    for (const snapshot of [...journal.snapshots].reverse()) {
+      const target = join3(projectRoot, snapshot.path);
+      await rm2(target, { force: true, recursive: true });
+      if (snapshot.existed && snapshot.snapshot_name !== null) {
+        await mkdir3(dirname2(target), { recursive: true });
+        await copyFile(join3(transactionRoot, "before", snapshot.snapshot_name), target);
+      }
+    }
+    journal.state = "rolled_back";
+    await writeJournal(transactionRoot, journal);
+    return { transactionId, status: "rolled_back" };
+  } catch (error) {
+    journal.state = "recovery_required";
+    journal.failure = error instanceof Error ? error.message : String(error);
+    await writeJournal(transactionRoot, journal);
+    throw error;
+  }
+}
+async function runTransaction(projectRoot, rawOperations, options = {}) {
+  const layout = await ensureStateLayout(projectRoot);
+  const transactionId = options.id ?? "tx_" + Date.now() + "_" + randomUUID2();
+  const transactionRoot = join3(layout.transactions, transactionId);
+  await Promise.all([
+    mkdir3(join3(transactionRoot, "before"), { recursive: true }),
+    mkdir3(join3(transactionRoot, "after"), { recursive: true }),
+    mkdir3(join3(transactionRoot, "staged"), { recursive: true })
+  ]);
+  const operations = rawOperations.map((operation) => {
+    if (operation.operation === "rename") {
+      return {
+        ...operation,
+        from_path: normalizeManagedPath(operation.from_path),
+        to_path: normalizeManagedPath(operation.to_path)
+      };
+    }
+    return { ...operation, path: normalizeManagedPath(operation.path) };
+  });
+  const paths = operations.flatMap(affectedPaths);
+  assertNoCaseCollisions(paths);
+  for (const path of paths) {
+    await assertNoSymlinks(projectRoot, path);
+  }
+  const snapshots = await snapshotPaths(projectRoot, transactionRoot, paths);
+  await stageOperations(transactionRoot, operations);
+  const journal = {
+    schema_version: 1,
+    transaction_id: transactionId,
+    ...options.kind === void 0 ? {} : { kind: options.kind },
+    state: "prepared",
+    created_at: (/* @__PURE__ */ new Date()).toISOString(),
+    operations,
+    snapshots,
+    applied_count: 0,
+    failure: null
+  };
+  await writeJournal(transactionRoot, journal);
+  try {
+    journal.state = "applying";
+    await writeJournal(transactionRoot, journal);
+    for (let index = 0; index < operations.length; index += 1) {
+      const operation = operations[index];
+      if (operation === void 0) {
+        continue;
+      }
+      await applyOperation(projectRoot, transactionRoot, operation, index, transactionId);
+      journal.applied_count = index + 1;
+      await writeJournal(transactionRoot, journal);
+      if (options.interruptAfterApply === journal.applied_count) {
+        journal.state = "interrupted";
+        journal.failure = "injected interruption";
+        await writeJournal(transactionRoot, journal);
+        throw new InterruptedTransactionError();
+      }
+      if (options.failAfterApply === journal.applied_count) {
+        throw new Error("injected transaction failure");
+      }
+    }
+    const after = [];
+    for (const path of paths) {
+      const target = join3(projectRoot, path);
+      after.push({
+        path,
+        exists: await exists(target),
+        hash: await exists(target) ? await sha256File(target) : null
+      });
+    }
+    await atomicWriteJson(join3(transactionRoot, "after", "manifest.json"), after);
+    journal.state = "committed";
+    await writeJournal(transactionRoot, journal);
+    return { transactionId, status: "committed" };
+  } catch (error) {
+    if (error instanceof InterruptedTransactionError) {
+      throw error;
+    }
+    journal.failure = error instanceof Error ? error.message : String(error);
+    await writeJournal(transactionRoot, journal);
+    await rollbackTransaction(projectRoot, transactionId);
+    throw error;
+  }
+}
+
+// ../core/dist/project/uuid-v7.js
+import { randomBytes } from "node:crypto";
+function uuidV7(now = Date.now()) {
+  const bytes = randomBytes(16);
+  const timestamp = BigInt(now);
+  for (let index = 5; index >= 0; index -= 1) {
+    bytes[index] = Number(timestamp >> BigInt((5 - index) * 8) & 0xffn);
+  }
+  const byte6 = bytes[6] ?? 0;
+  const byte8 = bytes[8] ?? 0;
+  bytes[6] = byte6 & 15 | 112;
+  bytes[8] = byte8 & 63 | 128;
+  const hex = bytes.toString("hex");
+  return [
+    hex.slice(0, 8),
+    hex.slice(8, 12),
+    hex.slice(12, 16),
+    hex.slice(16, 20),
+    hex.slice(20)
+  ].join("-");
+}
+
+// ../core/dist/project/initialize.js
+async function readOptional(path) {
+  try {
+    return await readFile3(path, "utf8");
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return "";
+    }
+    throw error;
+  }
+}
+async function exists2(path) {
+  try {
+    await stat2(path);
+    return true;
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+async function existingProjectConfig(root) {
+  const path = join4(root, ".harness", "project.yaml");
+  const content = await readOptional(path);
+  return content === "" ? null : projectConfigSchema.parse(parseYaml2(content));
+}
+async function operationFor(root, path, content) {
+  return await exists2(join4(root, path)) ? { operation: "modify", path, content } : { operation: "add", path, content };
+}
+async function readProfileBundle(resourcesRoot, profile) {
+  const manifest = JSON.parse(await readFile3(join4(resourcesRoot, "harness", "manifests", `${profile}.json`), "utf8"));
+  if (manifest.schema_version !== 1 || manifest.profile !== profile) {
+    throw new Error(`invalid ${profile} Harness Bundle manifest`);
+  }
+  const files = /* @__PURE__ */ new Map();
+  for (const item of manifest.files) {
+    const bytes = await readFile3(join4(resourcesRoot, "harness", profile, item.path));
+    if (createHash2("sha256").update(bytes).digest("hex") !== item.sha256) {
+      throw new Error(`Harness Bundle hash mismatch: ${item.path}`);
+    }
+    files.set(item.path, bytes);
+  }
+  return { manifest, files };
+}
+function bundleTargets(bundleFiles) {
+  const targets = /* @__PURE__ */ new Map();
+  for (const [path, bytes] of bundleFiles) {
+    targets.set(`.claude/skills/${path}`, bytes);
+    const agent = /^agents\/([^/]+\.md)$/.exec(path);
+    if (agent?.[1] !== void 0)
+      targets.set(`.claude/agents/${agent[1]}`, bytes);
+  }
+  return targets;
+}
+var INSTALLED_BUNDLE_PATH = ".harness/state/local/installed-harness-bundle.json";
+async function previousInstalledFiles(root) {
+  const content = await readOptional(join4(root, INSTALLED_BUNDLE_PATH));
+  if (content === "")
+    return [];
+  const parsed = JSON.parse(content);
+  return parsed.schema_version === 1 && Array.isArray(parsed.files) ? parsed.files : [];
+}
+async function initializeProject(options) {
+  const root = resolve3(options.projectRoot);
+  const config = initConfigSchema.parse(options.config);
+  const existing = await existingProjectConfig(root);
+  const profile = config.profile;
+  const bundle = await readProfileBundle(options.resourcesRoot, profile);
+  const bundleFiles = bundleTargets(bundle.files);
+  const bundleHash = sha256Bytes(canonicalJson(bundle.manifest.files));
+  const projectConfig = projectConfigSchema.parse({
+    harness: { name: "hunter-harness", schema_version: 1 },
+    project: {
+      name: existing?.project.name ?? basename(root),
+      root: ".",
+      local_project_key: existing?.project.local_project_key ?? uuidV7(),
+      project_id: config.project_id ?? existing?.project.project_id ?? null,
+      profiles: [config.profile]
+    },
+    server: {
+      url: config.server_url ?? existing?.server.url ?? null,
+      token_env: config.token_env ?? existing?.server.token_env ?? "HUNTER_HARNESS_TOKEN"
+    },
+    adapters: { enabled: [config.adapter] }
+  });
+  const baseline = baselineManifestSchema.parse({
+    schema_version: 1,
+    project_id: projectConfig.project.project_id,
+    complete_project_version: null,
+    artifact_manifest_hash: null,
+    files: {}
+  });
+  const agentsContent = upsertManagedBlock(await readOptional(join4(root, "AGENTS.md")), [
+    "# Hunter Harness",
+    "",
+    "Use .harness/context-index.json to route rules, Knowledge, and codebase maps.",
+    "Treat .claude/skills/harness-* as editable adapter working copies.",
+    "Do not modify .harness/state or .harness/cache directly."
+  ].join("\n"));
+  const claudeContent = upsertManagedBlock(await readOptional(join4(root, "CLAUDE.md")), [
+    "@AGENTS.md",
+    "",
+    "# Hunter Harness",
+    "",
+    "- Rules: .claude/rules/",
+    "- Skills: .claude/skills/harness-*/",
+    "- Knowledge: .harness/knowledge/",
+    "- Codebase map: .harness/codebase/map/"
+  ].join("\n"));
+  const files = /* @__PURE__ */ new Map([
+    [
+      ".harness/project.yaml",
+      stringifyYaml(projectConfig, { sortMapEntries: true })
+    ],
+    [
+      ".harness/state/baseline/manifest.json",
+      JSON.stringify(baseline, null, 2) + "\n"
+    ],
+    [
+      ".harness/context-index.json",
+      JSON.stringify({
+        schema_version: 1,
+        project: { claude_md: "CLAUDE.md", agents_md: "AGENTS.md" },
+        rules: [".claude/rules/harness-general.md"],
+        knowledge: { index: ".harness/knowledge/index.json" },
+        codebase: { map: ".harness/codebase/map", status: "missing" },
+        skill_bundle: {
+          registry_version: bundle.manifest.bundle_version,
+          bundle_hash: bundleHash
+        }
+      }, null, 2) + "\n"
+    ],
+    [
+      ".harness/knowledge/index.json",
+      JSON.stringify({ schema_version: 1, generated_at: null, entries: [] }, null, 2) + "\n"
+    ],
+    [".harness/knowledge/_candidates/.gitkeep", ""],
+    [".harness/knowledge/project-local/.gitkeep", ""],
+    [".harness/codebase/map/.gitkeep", ""],
+    [".harness/state/local/.gitkeep", ""],
+    [".harness/cache/server-artifacts/.gitkeep", ""],
+    [".harness/reports/.gitkeep", ""],
+    [
+      ".harness/README.md",
+      "# Hunter Harness\n\nUse npx hunter-harness, update, and push.\n"
+    ],
+    ["AGENTS.md", agentsContent],
+    ["CLAUDE.md", claudeContent],
+    [
+      ".claude/rules/harness-general.md",
+      "# Hunter Harness Rules\n\n- Report evidence honestly.\n- Do not execute destructive actions without confirmation.\n"
+    ]
+  ]);
+  if (config.profile === "java") {
+    files.set(".claude/rules/harness-profile-java.md", "# Java Profile\n\n- Verify builds and tests with the project build tool.\n");
+  }
+  for (const [targetPath, bytes] of bundleFiles) {
+    files.set(targetPath, bytes);
+  }
+  const installedFileList = [...bundleFiles.keys()].sort();
+  if (profile === "java")
+    installedFileList.push(".claude/rules/harness-profile-java.md");
+  const installedManifest = {
+    schema_version: 1,
+    profile,
+    files: installedFileList.sort()
+  };
+  files.set(INSTALLED_BUNDLE_PATH, JSON.stringify(installedManifest, null, 2) + "\n");
+  const newManaged = new Set(installedManifest.files);
+  const deleteOperations = (await previousInstalledFiles(root)).filter((path) => !newManaged.has(path)).map((path) => ({ operation: "delete", path }));
+  const paths = [...files.keys()].sort((left, right) => left.localeCompare(right));
+  if (!options.dryRun) {
+    const writeOperations = await Promise.all([...files.entries()].map(async ([path, content]) => operationFor(root, path, content)));
+    await runTransaction(root, [...deleteOperations, ...writeOperations], { kind: "init" });
+  }
+  return {
+    projectConfig,
+    paths,
+    bundleHash,
+    registryVersion: bundle.manifest.bundle_version
+  };
+}
+
+// ../core/dist/proposal/diff.js
+function operationPath(operation) {
+  return operation.operation === "rename" ? operation.to_path : operation.path;
+}
+function buildProposalDiff(input) {
+  const confirmed = new Set(input.confirmedProjectLocal.map(normalizeManagedPath));
+  const skipped = [];
+  const current = /* @__PURE__ */ new Map();
+  for (const [rawPath, content] of Object.entries(input.files)) {
+    const path = normalizeManagedPath(rawPath);
+    const policy = classifyFile(path);
+    const decision = decidePush(policy, confirmed.has(path));
+    if (!decision.include) {
+      skipped.push({ path, reason: decision.reason });
+      continue;
+    }
+    current.set(path, {
+      path,
+      content,
+      hash: sha256Bytes(content),
+      size: Buffer.byteLength(content),
+      fileKind: policy.file_kind
+    });
+  }
+  const baseline = /* @__PURE__ */ new Map();
+  for (const [rawPath, entry] of Object.entries(input.baseline)) {
+    const path = normalizeManagedPath(rawPath);
+    const policy = classifyFile(path);
+    const decision = decidePush(policy, confirmed.has(path));
+    if (!decision.include) {
+      if (!current.has(path)) {
+        skipped.push({ path, reason: decision.reason });
+      }
+      continue;
+    }
+    baseline.set(path, entry);
+  }
+  const additions = [...current.values()].filter((entry) => !baseline.has(entry.path));
+  const deletions = [...baseline.entries()].filter(([path]) => !current.has(path));
+  const consumedAdditions = /* @__PURE__ */ new Set();
+  const consumedDeletions = /* @__PURE__ */ new Set();
+  const operations = [];
+  const blobs = {};
+  for (const [fromPath, previous] of deletions) {
+    const renamed = additions.find((entry) => !consumedAdditions.has(entry.path) && entry.hash === previous.content_sha256 && entry.fileKind === classifyFile(fromPath).file_kind);
+    if (renamed === void 0) {
+      continue;
+    }
+    operations.push({
+      operation: "rename",
+      from_path: fromPath,
+      to_path: renamed.path,
+      file_kind: renamed.fileKind,
+      base_content_sha256: previous.content_sha256,
+      content_sha256: renamed.hash,
+      size_bytes: renamed.size
+    });
+    blobs[renamed.hash] = renamed.content;
+    consumedAdditions.add(renamed.path);
+    consumedDeletions.add(fromPath);
+  }
+  for (const entry of current.values()) {
+    const previous = baseline.get(entry.path);
+    if (previous === void 0 || previous.content_sha256 === entry.hash) {
+      if (previous !== void 0) {
+        skipped.push({ path: entry.path, reason: "unchanged" });
+      }
+      continue;
+    }
+    operations.push({
+      operation: "modify",
+      path: entry.path,
+      file_kind: entry.fileKind,
+      base_content_sha256: previous.content_sha256,
+      content_sha256: entry.hash,
+      size_bytes: entry.size
+    });
+    blobs[entry.hash] = entry.content;
+  }
+  for (const entry of additions) {
+    if (consumedAdditions.has(entry.path)) {
+      continue;
+    }
+    operations.push({
+      operation: "add",
+      path: entry.path,
+      file_kind: entry.fileKind,
+      content_sha256: entry.hash,
+      size_bytes: entry.size
+    });
+    blobs[entry.hash] = entry.content;
+  }
+  for (const [path, previous] of deletions) {
+    if (consumedDeletions.has(path)) {
+      continue;
+    }
+    operations.push({
+      operation: "delete",
+      path,
+      file_kind: classifyFile(path).file_kind,
+      base_content_sha256: previous.content_sha256,
+      tombstone: {
+        deleted_at: input.deletedAt,
+        reason: input.deleteReason,
+        previous_sha256: previous.content_sha256
+      }
+    });
+  }
+  operations.sort((left, right) => operationPath(left).localeCompare(operationPath(right)));
+  skipped.sort((left, right) => left.path.localeCompare(right.path));
+  return { operations, blobs, skipped };
+}
+
+// ../core/dist/security/allowlist.js
+function parseInlineIgnores(content) {
+  return [...content.matchAll(/hunter-harness-ignore:\s*([A-Z0-9_]+)\s+reason=([A-Za-z0-9._-]+)/g)].map((match) => ({
+    ruleId: match[1] ?? "",
+    reason: match[2] ?? "unspecified"
+  }));
+}
+
+// ../core/dist/security/entropy.js
+function shannonEntropy(value) {
+  if (value.length === 0) {
+    return 0;
+  }
+  const counts = /* @__PURE__ */ new Map();
+  for (const character of value) {
+    counts.set(character, (counts.get(character) ?? 0) + 1);
+  }
+  let entropy = 0;
+  for (const count of counts.values()) {
+    const probability = count / value.length;
+    entropy -= probability * Math.log2(probability);
+  }
+  return entropy;
+}
+function highEntropyCandidates(content) {
+  const matches = content.matchAll(/\b[A-Za-z0-9_+/.=-]{24,}\b/g);
+  return [...matches].map((match) => ({
+    value: match[0],
+    offset: match.index,
+    entropy: shannonEntropy(match[0])
+  })).filter((item) => item.entropy >= 4.5);
+}
+
+// ../core/dist/security/scanner.js
+var SENSITIVE_SCANNER_VERSION = "1.0.0";
+var RULES = [
+  {
+    id: "HH_PRIVATE_KEY",
+    severity: "high",
+    pattern: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g
+  },
+  {
+    id: "HH_GITHUB_TOKEN",
+    severity: "high",
+    pattern: /\bgh[pousr]_[A-Za-z0-9]{36,255}\b/g
+  },
+  {
+    id: "HH_AWS_ACCESS_KEY",
+    severity: "high",
+    pattern: /\bAKIA[0-9A-Z]{16}\b/g
+  },
+  {
+    id: "HH_AUTHORIZATION_BEARER",
+    severity: "high",
+    pattern: /Authorization\s*:\s*Bearer\s+([A-Za-z0-9._~+/-]{12,})/gi,
+    valueGroup: 1
+  },
+  {
+    id: "HH_DATABASE_URL",
+    severity: "high",
+    pattern: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?):\/\/[^\s"']+/gi
+  },
+  {
+    id: "HH_PASSWORD_VALUE",
+    severity: "medium",
+    pattern: /(?:password|passwd|pwd)\s*[:=]\s*["']?([^\s"'<>]{8,})/gi,
+    valueGroup: 1
+  },
+  {
+    id: "HH_INTERNAL_ADDRESS",
+    severity: "medium",
+    pattern: /\b(?:10\.(?:\d{1,3}\.){2}\d{1,3}|192\.168\.(?:\d{1,3}\.)\d{1,3})\b/g
+  },
+  {
+    id: "HH_WINDOWS_ABSOLUTE_PATH",
+    severity: "low",
+    pattern: /\b[A-Za-z]:\\(?:[^\s<>:"|?*]+\\)*[^\s<>:"|?*]*/g
+  }
+];
+function location(content, offset) {
+  const prefix = content.slice(0, offset);
+  const lines = prefix.split("\n");
+  return { line: lines.length, column: (lines.at(-1)?.length ?? 0) + 1 };
+}
+function rawFindings(content) {
+  const findings = [];
+  for (const rule of RULES) {
+    for (const match of content.matchAll(rule.pattern)) {
+      const value = match[rule.valueGroup ?? 0] ?? match[0];
+      const relative2 = match[0].indexOf(value);
+      findings.push({
+        ruleId: rule.id,
+        severity: rule.severity,
+        offset: match.index + Math.max(0, relative2),
+        value
+      });
+    }
+  }
+  for (const candidate of highEntropyCandidates(content)) {
+    findings.push({
+      ruleId: "HH_HIGH_ENTROPY",
+      severity: "high",
+      offset: candidate.offset,
+      value: candidate.value
+    });
+  }
+  return findings;
+}
+function scanSensitiveFiles(files, options = {}) {
+  const findings = [];
+  const evidence = [];
+  const recordedAt = (options.now ?? /* @__PURE__ */ new Date()).toISOString();
+  for (const [inputPath, content] of Object.entries(files).sort(([a], [b]) => a.localeCompare(b))) {
+    const path = normalizeManagedPath(inputPath);
+    const ignores = parseInlineIgnores(content);
+    for (const raw of rawFindings(content)) {
+      const position = location(content, raw.offset);
+      const fingerprint = sha256Bytes([
+        SENSITIVE_SCANNER_VERSION,
+        raw.ruleId,
+        path,
+        String(position.line),
+        String(position.column),
+        sha256Bytes(raw.value)
+      ].join("\0"));
+      const overridable = raw.severity !== "high";
+      const explicit = options.overrides?.find((item) => item.finding_fingerprint === fingerprint);
+      const inline = ignores.find((item) => item.ruleId === raw.ruleId);
+      const override = overridable ? explicit ?? (inline === void 0 ? void 0 : {
+        finding_fingerprint: fingerprint,
+        actor: "inline-annotation",
+        reason: inline.reason
+      }) : void 0;
+      if (override !== void 0) {
+        evidence.push(Object.freeze({
+          finding_fingerprint: fingerprint,
+          rule_id: raw.ruleId,
+          path,
+          actor: override.actor,
+          reason: override.reason,
+          source: explicit === void 0 ? "inline-annotation" : "explicit-confirmation",
+          scanner_version: SENSITIVE_SCANNER_VERSION,
+          recorded_at: recordedAt
+        }));
+      }
+      findings.push({
+        rule_id: raw.ruleId,
+        severity: raw.severity,
+        path,
+        line: position.line,
+        column: position.column,
+        fingerprint,
+        redacted_preview: "[REDACTED:" + raw.ruleId + "]",
+        overridable,
+        disposition: override === void 0 ? "blocked" : "overridden"
+      });
+    }
+  }
+  return {
+    scanner_version: SENSITIVE_SCANNER_VERSION,
+    blocked: findings.some((finding) => finding.disposition === "blocked"),
+    findings,
+    override_evidence: Object.freeze(evidence)
+  };
+}
+
+// ../core/dist/proposal/preview.js
+function generateProposalPreview(input, scanOptions = {}) {
+  const diff = buildProposalDiff(input);
+  const includedFiles = Object.fromEntries(Object.values(diff.operations).filter((operation) => operation.operation !== "delete").map((operation) => {
+    const hash = operation.content_sha256;
+    const path = operation.operation === "rename" ? operation.to_path : operation.path;
+    return [path, diff.blobs[hash] ?? ""];
+  }));
+  const security = scanSensitiveFiles(includedFiles, scanOptions);
+  return {
+    blocked: security.blocked,
+    operations: diff.operations,
+    skipped: diff.skipped,
+    blobs: diff.blobs,
+    security
+  };
+}
+
+// ../core/dist/push/push.js
+import { lstat as lstat2, readFile as readFile6, readdir, rm as rm4 } from "node:fs/promises";
+import { join as join7, relative, resolve as resolve4 } from "node:path";
+import { parse as parseYaml3, stringify as stringifyYaml2 } from "yaml";
+
+// ../core/dist/state/baseline.js
+import { readFile as readFile4 } from "node:fs/promises";
+import { join as join5 } from "node:path";
+async function readBaseline(projectRoot) {
+  const content = await readFile4(join5(stateLayout(projectRoot).baseline, "manifest.json"), "utf8");
+  return baselineManifestSchema.parse(JSON.parse(content));
+}
+
+// ../core/dist/state/locks.js
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { readFile as readFile5, rename as rename3, rm as rm3, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join6 } from "node:path";
+async function readLock(path) {
+  return JSON.parse(await readFile5(path, "utf8"));
+}
+async function acquireProtocolLock(projectRoot, operation, options = {}) {
+  const layout = await ensureStateLayout(projectRoot);
+  const lockPath = join6(layout.locks, "protocol.lock");
+  const now = options.now ?? Date.now();
+  const staleAfterMs = options.staleAfterMs ?? 15 * 60 * 1e3;
+  const record = {
+    operation,
+    request_id: options.requestId ?? randomUUID3(),
+    nonce: randomUUID3(),
+    pid: process.pid,
+    started_at_ms: now,
+    heartbeat_at_ms: now
+  };
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      await writeFile3(lockPath, JSON.stringify(record, null, 2), { flag: "wx" });
+      return {
+        path: lockPath,
+        operation,
+        async release() {
+          try {
+            const current = await readLock(lockPath);
+            if (current.nonce === record.nonce) {
+              await rm3(lockPath, { force: true });
+            }
+          } catch {
+          }
+        }
+      };
+    } catch (error) {
+      if (!(error instanceof Error) || !("code" in error) || error.code !== "EEXIST") {
+        throw error;
+      }
+      const current = await readLock(lockPath);
+      if (now - current.heartbeat_at_ms <= staleAfterMs) {
+        throw new Error("protocol lock is active for operation " + current.operation, { cause: error });
+      }
+      await rename3(lockPath, lockPath + ".stale-" + randomUUID3());
+    }
+  }
+  throw new Error("unable to acquire protocol lock");
+}
+
+// ../core/dist/push/push.js
+var PushWorkflowError = class extends Error {
+  exitCode;
+  code;
+  constructor(message, exitCode, code) {
+    super(message);
+    this.name = "PushWorkflowError";
+    this.exitCode = exitCode;
+    this.code = code;
+  }
+};
+var MANAGED_ROOTS = [
+  ".claude/rules",
+  ".harness/knowledge",
+  ".harness/codebase"
+];
+var MANAGED_FILES = [
+  "CLAUDE.md",
+  "AGENTS.md",
+  ".harness/project.yaml",
+  ".harness/context-index.json"
+];
+var INSTALLED_BUNDLE_PATH2 = ".harness/state/local/installed-harness-bundle.json";
+async function installedBundlePaths(root) {
+  try {
+    const content = await readFile6(join7(root, INSTALLED_BUNDLE_PATH2), "utf8");
+    const parsed = JSON.parse(content);
+    if (parsed.schema_version === 1 && Array.isArray(parsed.files)) {
+      return new Set(parsed.files);
+    }
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return /* @__PURE__ */ new Set();
+    }
+    throw error;
+  }
+  return /* @__PURE__ */ new Set();
+}
+async function exists3(path) {
+  try {
+    await lstat2(path);
+    return true;
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+async function walkFiles(root, current, output) {
+  if (!await exists3(current)) {
+    return;
+  }
+  for (const item of await readdir(current, { withFileTypes: true })) {
+    const path = join7(current, item.name);
+    if (item.isSymbolicLink()) {
+      throw new PushWorkflowError("symlink is not pushable", 6, "UNSAFE_SYMLINK");
+    }
+    if (item.isDirectory()) {
+      await walkFiles(root, path, output);
+    } else if (item.isFile()) {
+      output.push(normalizeManagedPath(relative(root, path).replaceAll("\\", "/")));
+    }
+  }
+}
+async function managedFiles(projectRoot) {
+  const root = resolve4(projectRoot);
+  const paths = [];
+  for (const path of MANAGED_FILES) {
+    if (await exists3(join7(root, path))) {
+      paths.push(path);
+    }
+  }
+  for (const path of MANAGED_ROOTS) {
+    await walkFiles(root, join7(root, path), paths);
+  }
+  const skillsRoot = join7(root, ".claude", "skills");
+  if (await exists3(skillsRoot)) {
+    for (const item of await readdir(skillsRoot, { withFileTypes: true })) {
+      if (item.isDirectory() && item.name.startsWith("harness-")) {
+        await walkFiles(root, join7(skillsRoot, item.name), paths);
+      }
+    }
+  }
+  const result = {};
+  for (const path of [...new Set(paths)].sort()) {
+    result[path] = await readFile6(join7(root, path), "utf8");
+  }
+  return result;
+}
+function proposalBaseline(baseline) {
+  return Object.fromEntries(Object.entries(baseline.files).filter(([, entry]) => entry.baseline_hash !== null && !entry.deleted).map(([path, entry]) => [path, { content_sha256: entry.baseline_hash ?? "" }]));
+}
+async function readProject(root) {
+  try {
+    return projectConfigSchema.parse(parseYaml3(await readFile6(join7(root, ".harness", "project.yaml"), "utf8")));
+  } catch {
+    throw new PushWorkflowError("project configuration is missing or invalid", 3, "PROJECT_CONFIG_INVALID");
+  }
+}
+async function readOptionalJson(path) {
+  try {
+    return JSON.parse(await readFile6(path, "utf8"));
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  }
+}
+async function clientIdFor(root, explicit) {
+  if (explicit !== void 0) {
+    return explicit;
+  }
+  const path = join7(root, ".harness", "state", "local", "client.json");
+  const existing = await readOptionalJson(path);
+  if (typeof existing?.client_id === "string" && /^cli_[A-Za-z0-9_-]+$/.test(existing.client_id)) {
+    return existing.client_id;
+  }
+  const clientId = "cli_" + uuidV7().replaceAll("-", "");
+  await atomicWriteJson(path, {
+    schema_version: 1,
+    client_id: clientId,
+    created_at: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  return clientId;
+}
+function newWorkflowState(project, clientId) {
+  return {
+    schema_version: 1,
+    local_project_key: project.project.local_project_key,
+    project_id: project.project.project_id,
+    request_id: uuidV7(),
+    created_at: (/* @__PURE__ */ new Date()).toISOString(),
+    client_id: clientId,
+    resolve_idempotency_key: uuidV7(),
+    proposal_manifest_hash: null,
+    session_id: null,
+    session_expires_at: null,
+    max_chunk_bytes: null,
+    session_idempotency_key: uuidV7(),
+    query_idempotency_key: uuidV7(),
+    finalize_idempotency_key: uuidV7(),
+    chunk_idempotency_keys: {}
+  };
+}
+function resetSession(state, proposalManifestHash) {
+  return {
+    ...state,
+    proposal_manifest_hash: proposalManifestHash,
+    session_id: null,
+    session_expires_at: null,
+    max_chunk_bytes: null,
+    session_idempotency_key: uuidV7(),
+    query_idempotency_key: uuidV7(),
+    finalize_idempotency_key: uuidV7(),
+    chunk_idempotency_keys: {}
+  };
+}
+function makePreview(baseline, files, confirmedProjectLocal, ignorePaths, deletedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+  const filteredFiles = {};
+  for (const [path, content] of Object.entries(files)) {
+    if (!ignorePaths.has(path))
+      filteredFiles[path] = content;
+  }
+  return generateProposalPreview({
+    baseline: proposalBaseline(baseline),
+    files: filteredFiles,
+    deletedAt,
+    deleteReason: "removed from local managed working copy",
+    confirmedProjectLocal
+  });
+}
+async function bindProject(root, project, baseline, projectId) {
+  const nextProject = projectConfigSchema.parse({
+    ...project,
+    project: { ...project.project, project_id: projectId }
+  });
+  const nextBaseline = baselineManifestSchema.parse({
+    ...baseline,
+    project_id: projectId
+  });
+  await runTransaction(root, [
+    {
+      operation: "modify",
+      path: ".harness/project.yaml",
+      content: stringifyYaml2(nextProject, { sortMapEntries: true })
+    },
+    {
+      operation: "modify",
+      path: ".harness/state/baseline/manifest.json",
+      content: JSON.stringify(nextBaseline, null, 2) + "\n"
+    }
+  ]);
+  return { project: nextProject, baseline: nextBaseline };
+}
+async function pushProject(options) {
+  const root = resolve4(options.projectRoot);
+  let project = await readProject(root);
+  let baseline = await readBaseline(root);
+  const installedPaths = await installedBundlePaths(root);
+  let preview = makePreview(baseline, await managedFiles(root), options.confirmedProjectLocal ?? [], installedPaths);
+  if (preview.blocked) {
+    throw new PushWorkflowError("sensitive information scan blocked the proposal", 6, "SENSITIVE_CONTENT_BLOCKED");
+  }
+  if (options.dryRun) {
+    return { preview, proposalId: null, projectId: project.project.project_id };
+  }
+  if (options.confirmProposal !== void 0 && !await options.confirmProposal(preview)) {
+    return { preview, proposalId: null, projectId: project.project.project_id, cancelled: true };
+  }
+  const serverUrl = options.serverUrl ?? project.server.url;
+  if (serverUrl === null || serverUrl === void 0) {
+    throw new PushWorkflowError("server_url is required", 3, "SERVER_URL_REQUIRED");
+  }
+  const tokenEnv = options.tokenEnv ?? project.server.token_env;
+  const token = options.env[tokenEnv];
+  if (token === void 0 || token.trim() === "") {
+    throw new PushWorkflowError("API token environment variable is unset", 8, "TOKEN_INVALID");
+  }
+  if (!/^[A-Z_][A-Z0-9_]*$/.test(tokenEnv)) {
+    throw new PushWorkflowError("token_env is invalid", 3, "TOKEN_ENV_INVALID");
+  }
+  let parsedServerUrl;
+  try {
+    parsedServerUrl = new URL(serverUrl);
+  } catch {
+    throw new PushWorkflowError("server_url is invalid", 3, "SERVER_URL_INVALID");
+  }
+  if (parsedServerUrl.protocol !== "https:") {
+    throw new PushWorkflowError("server_url must use HTTPS", 3, "SERVER_URL_INVALID");
+  }
+  const workflowPath = join7(root, ".harness", "state", "local", "push-workflow.json");
+  const priorWorkflow = await readOptionalJson(workflowPath);
+  const provisionalRequestId = priorWorkflow?.local_project_key === project.project.local_project_key ? priorWorkflow.request_id : uuidV7();
+  const lock = await acquireProtocolLock(root, "push", { requestId: provisionalRequestId });
+  try {
+    const clientId = await clientIdFor(root, options.clientId);
+    let workflow = priorWorkflow?.local_project_key === project.project.local_project_key ? priorWorkflow : newWorkflowState(project, clientId);
+    workflow.client_id = clientId;
+    await atomicWriteJson(workflowPath, workflow);
+    preview = makePreview(baseline, await managedFiles(root), options.confirmedProjectLocal ?? [], installedPaths, workflow.created_at);
+    const requestId = workflow.request_id;
+    const client = new HunterHarnessApiClient({
+      serverUrl: parsedServerUrl.toString(),
+      token,
+      ...options.fetch === void 0 ? {} : { fetch: options.fetch }
+    });
+    if (project.project.project_id === null) {
+      const resolved = await client.resolveProject({
+        schema_version: 1,
+        local_project_key: project.project.local_project_key,
+        display_name: project.project.name,
+        requested_project_id: null,
+        client_id: clientId
+      }, requestId, workflow.resolve_idempotency_key);
+      ({ project, baseline } = await bindProject(root, project, baseline, resolved.project_id));
+      workflow.project_id = resolved.project_id;
+      await atomicWriteJson(workflowPath, workflow);
+      preview = makePreview(baseline, await managedFiles(root), options.confirmedProjectLocal ?? [], installedPaths, workflow.created_at);
+      if (preview.blocked) {
+        throw new PushWorkflowError("sensitive information scan blocked the proposal", 6, "SENSITIVE_CONTENT_BLOCKED");
+      }
+    }
+    const projectId = project.project.project_id;
+    if (projectId === null) {
+      throw new PushWorkflowError("project binding failed", 4, "PROJECT_BIND_FAILED");
+    }
+    const baseManifestHash = sha256Bytes(canonicalJson(baseline));
+    const proposalManifestHash = sha256Bytes(canonicalJson(preview.operations));
+    if (workflow.proposal_manifest_hash !== proposalManifestHash || workflow.session_expires_at !== null && Date.parse(workflow.session_expires_at) <= Date.now()) {
+      workflow = resetSession(workflow, proposalManifestHash);
+      await atomicWriteJson(workflowPath, workflow);
+    }
+    let session;
+    if (workflow.session_id === null || workflow.max_chunk_bytes === null || workflow.session_expires_at === null) {
+      session = await client.createProposalSession(projectId, {
+        schema_version: 1,
+        request_id: requestId,
+        client_id: clientId,
+        base_project_version: baseline.complete_project_version,
+        base_manifest_hash: baseManifestHash,
+        proposal_manifest: { files: preview.operations },
+        artifact_manifest: { schema_version: 1, files: preview.operations }
+      }, requestId, workflow.session_idempotency_key);
+      workflow.session_id = session.session_id;
+      workflow.session_expires_at = session.expires_at;
+      workflow.max_chunk_bytes = session.max_chunk_bytes;
+      await atomicWriteJson(workflowPath, workflow);
+    } else {
+      session = {
+        session_id: workflow.session_id,
+        expires_at: workflow.session_expires_at,
+        missing_blobs: [],
+        max_chunk_bytes: workflow.max_chunk_bytes,
+        request_id: requestId
+      };
+    }
+    const hashes = Object.keys(preview.blobs).sort();
+    const query = await client.queryBlobs(session.session_id, hashes, requestId, workflow.query_idempotency_key);
+    const missing = /* @__PURE__ */ new Set([...session.missing_blobs, ...query.missing]);
+    for (const hash of missing) {
+      const content = preview.blobs[hash];
+      if (content === void 0) {
+        throw new PushWorkflowError("server requested undeclared blob", 4, "BLOB_NOT_DECLARED");
+      }
+      const bytes = new TextEncoder().encode(content);
+      for (let start = 0; start < bytes.byteLength; start += session.max_chunk_bytes) {
+        const chunkKey = hash + ":" + start;
+        workflow.chunk_idempotency_keys[chunkKey] ??= uuidV7();
+        await atomicWriteJson(workflowPath, workflow);
+        await client.uploadBlobChunk({
+          sessionId: session.session_id,
+          contentSha256: hash,
+          chunk: bytes.slice(start, Math.min(bytes.byteLength, start + session.max_chunk_bytes)),
+          start,
+          total: bytes.byteLength,
+          requestId,
+          idempotencyKey: workflow.chunk_idempotency_keys[chunkKey] ?? uuidV7()
+        });
+      }
+    }
+    const finalized = await client.finalizeProposal(session.session_id, { schema_version: 1, manifest_sha256: proposalManifestHash }, requestId, workflow.finalize_idempotency_key);
+    await atomicWriteJson(join7(root, ".harness", "state", "local", "push-results", finalized.proposal_id + ".json"), {
+      schema_version: 1,
+      request_id: requestId,
+      project_id: projectId,
+      proposal_id: finalized.proposal_id,
+      status: finalized.status,
+      operation_count: preview.operations.length,
+      recorded_at: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    await rm4(workflowPath, { force: true });
+    return { preview, proposalId: finalized.proposal_id, projectId };
+  } catch (error) {
+    if (error instanceof PushWorkflowError) {
+      throw error;
+    }
+    if (error instanceof ApiError) {
+      const exitCode = error.status === 401 ? 8 : error.status === 409 ? 5 : 4;
+      throw new PushWorkflowError(error.message, exitCode, error.code);
+    }
+    throw new PushWorkflowError(error instanceof Error ? error.message : "push failed", 4, "NETWORK_OR_SERVER_ERROR");
+  } finally {
+    await lock.release();
+  }
+}
+
+// ../core/dist/skill/frontmatter.js
+import { parse as parseYaml4 } from "yaml";
+import { z as z12 } from "zod";
+
+// ../core/dist/skill/fixer.js
+import { parse as parseYaml5, stringify as stringifyYaml3 } from "yaml";
+
+// ../core/dist/skill/agents.js
+var AGENT_DESCRIPTORS = {
+  "claude-code": {
+    agent: "claude-code",
+    installable: true,
+    installTarget: (slug) => `.claude/skills/${slug}/`,
+    installMode: "folder"
+  },
+  codex: {
+    agent: "codex",
+    installable: true,
+    installTarget: () => "AGENTS.md",
+    installMode: "managed_block",
+    blockId: (slug) => `harness-skill-${slug}`
+  },
+  cursor: {
+    agent: "cursor",
+    installable: true,
+    installTarget: (slug) => `.cursor/rules/${slug}.mdc`,
+    installMode: "file"
+  },
+  generic: {
+    agent: "generic",
+    installable: true,
+    installTarget: (slug) => `.agent-skills/${slug}.md`,
+    installMode: "file"
+  },
+  mcp: {
+    agent: "mcp",
+    installable: false,
+    installTarget: () => "",
+    installMode: "file"
+  }
+};
+var INSTALLABLE_AGENTS = Object.keys(AGENT_DESCRIPTORS).filter((agent) => AGENT_DESCRIPTORS[agent]?.installable === true);
+
+// ../core/dist/transaction/recovery.js
+import { readFile as readFile7, readdir as readdir2, rm as rm5, stat as stat3 } from "node:fs/promises";
+import { join as join8 } from "node:path";
+async function recoverTransaction(projectRoot, transactionId) {
+  const journal = JSON.parse(await readFile7(join8(stateLayout(projectRoot).transactions, transactionId, "journal.json"), "utf8"));
+  if (journal.state === "committed") {
+    return { transactionId, status: "committed" };
+  }
+  return rollbackTransaction(projectRoot, transactionId);
+}
+var RECOVERY_STATES = /* @__PURE__ */ new Set([
+  "prepared",
+  "applying",
+  "interrupted",
+  "rolling_back",
+  "recovery_required"
+]);
+async function listTransactions(projectRoot) {
+  const root = stateLayout(projectRoot).transactions;
+  let names;
+  try {
+    names = await readdir2(root);
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+  const transactions = [];
+  for (const transactionId of names) {
+    try {
+      const journal = JSON.parse(await readFile7(join8(root, transactionId, "journal.json"), "utf8"));
+      transactions.push({
+        transactionId,
+        kind: journal.kind,
+        state: journal.state,
+        createdAt: journal.created_at
+      });
+    } catch {
+    }
+  }
+  return transactions.sort((left, right) => right.createdAt.localeCompare(left.createdAt));
+}
+async function pendingTransactions(projectRoot) {
+  return (await listTransactions(projectRoot)).filter((item) => RECOVERY_STATES.has(item.state));
+}
+async function pathExists(path) {
+  try {
+    await stat3(path);
+    return true;
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+async function rollbackLatestCommittedUpdate(projectRoot) {
+  const latest = (await listTransactions(projectRoot)).find((item) => item.kind === "update" && item.state === "committed");
+  if (latest === void 0) {
+    throw new Error("no committed update transaction is available for rollback");
+  }
+  const transactionRoot = join8(stateLayout(projectRoot).transactions, latest.transactionId);
+  const journal = JSON.parse(await readFile7(join8(transactionRoot, "journal.json"), "utf8"));
+  const after = JSON.parse(await readFile7(join8(transactionRoot, "after", "manifest.json"), "utf8"));
+  for (const entry of after) {
+    const target = join8(projectRoot, entry.path);
+    const exists5 = await pathExists(target);
+    if (exists5 !== entry.exists || exists5 && await sha256File(target) !== entry.hash) {
+      throw new Error("cannot rollback dirty path: " + entry.path);
+    }
+  }
+  const operations = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const snapshot of journal.snapshots) {
+    if (seen.has(snapshot.path)) {
+      continue;
+    }
+    seen.add(snapshot.path);
+    const target = join8(projectRoot, snapshot.path);
+    const exists5 = await pathExists(target);
+    if (snapshot.existed && snapshot.snapshot_name !== null) {
+      const content = await readFile7(join8(transactionRoot, "before", snapshot.snapshot_name));
+      operations.push({
+        operation: exists5 ? "modify" : "add",
+        path: snapshot.path,
+        content
+      });
+    } else if (exists5) {
+      operations.push({ operation: "delete", path: snapshot.path });
+    }
+  }
+  return runTransaction(projectRoot, operations, {
+    id: "tx_rollback_" + Date.now() + "_" + uuidV7(),
+    kind: "rollback"
+  });
+}
+async function cleanupOldTransactions(projectRoot, now = /* @__PURE__ */ new Date()) {
+  const transactions = await listTransactions(projectRoot);
+  const committedUpdates = transactions.filter((item) => item.kind === "update" && item.state === "committed");
+  const keepCommitted = new Set(committedUpdates.slice(0, 10).map((item) => item.transactionId));
+  const removed = [];
+  for (const item of transactions) {
+    if (RECOVERY_STATES.has(item.state) || keepCommitted.has(item.transactionId)) {
+      continue;
+    }
+    const ageDays = (now.getTime() - Date.parse(item.createdAt)) / 864e5;
+    const removable = item.state === "rolled_back" ? ageDays > 7 : item.state === "committed" && ageDays > 30;
+    if (!removable) {
+      continue;
+    }
+    await rm5(join8(stateLayout(projectRoot).transactions, item.transactionId), {
+      recursive: true,
+      force: true
+    });
+    removed.push(item.transactionId);
+  }
+  return removed;
+}
+
+// ../core/dist/update/conflicts.js
+function operationTargetPath(operation) {
+  return operation.operation === "rename" ? operation.to_path : operation.path;
+}
+function operationSourcePath(operation) {
+  return operation.operation === "rename" ? operation.from_path : operation.path;
+}
+function operationAlreadyApplied(operation, baseline, projectVersion) {
+  const target = baseline.files[operationTargetPath(operation)];
+  if (operation.operation === "delete") {
+    return target?.deleted === true && target.last_applied_version === projectVersion;
+  }
+  return target?.deleted === false && target?.last_applied_version === projectVersion && target.baseline_hash === operation.content_sha256;
+}
+function managedBlockDirty(currentContent, managedBlockHash) {
+  if (managedBlockHash === void 0) {
+    return true;
+  }
+  const block = extractManagedBlock(currentContent);
+  return block === null || sha256Bytes(block) !== managedBlockHash;
+}
+
+// ../core/dist/update/update.js
+import { lstat as lstat3, readFile as readFile8, rm as rm6 } from "node:fs/promises";
+import { join as join9, resolve as resolve5 } from "node:path";
+import { parse as parseYaml6 } from "yaml";
+var UpdateWorkflowError = class extends Error {
+  exitCode;
+  code;
+  constructor(message, exitCode, code) {
+    super(message);
+    this.name = "UpdateWorkflowError";
+    this.exitCode = exitCode;
+    this.code = code;
+  }
+};
+async function pathExists2(path) {
+  try {
+    await lstat3(path);
+    return true;
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+async function optionalContent(path) {
+  return await pathExists2(path) ? readFile8(path, "utf8") : null;
+}
+function manifestPayloadHash(manifest) {
+  const payload = { ...manifest };
+  delete payload.manifest_sha256;
+  return sha256Bytes(canonicalJson(payload));
+}
+function expectedBase(operation) {
+  return operation.operation === "add" ? null : operation.base_content_sha256;
+}
+function contentHash(operation) {
+  return operation.operation === "delete" ? null : operation.content_sha256;
+}
+async function loadBlob(root, client, artifactId, operation, requestId, dryRun) {
+  if (operation.operation === "delete") {
+    return null;
+  }
+  const hash = operation.content_sha256;
+  const cacheRoot = join9(root, ".harness", "cache", "server-artifacts", artifactId);
+  const cachePath = join9(cacheRoot, "blobs", hash.replace(":", "_"));
+  if (await pathExists2(cachePath) && await sha256File(cachePath) === hash) {
+    return readFile8(cachePath, "utf8");
+  }
+  const bytes = await client.downloadArtifactBlob(artifactId, hash, requestId);
+  if (bytes.byteLength !== operation.size_bytes || sha256Bytes(bytes) !== hash) {
+    await rm6(cachePath, { force: true });
+    throw new UpdateWorkflowError("artifact blob size or hash mismatch", 4, "ARTIFACT_HASH_MISMATCH");
+  }
+  if (!dryRun) {
+    await atomicWriteFile(cachePath, bytes);
+  }
+  return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+}
+function nextBaselineEntry(operation, finalContent, projectVersion) {
+  const block = finalContent === null ? null : extractManagedBlock(finalContent);
+  return {
+    baseline_hash: contentHash(operation),
+    local_hash_at_apply: finalContent === null ? null : sha256Bytes(finalContent),
+    file_kind: operation.file_kind,
+    last_applied_version: projectVersion,
+    deleted: operation.operation === "delete",
+    ...block === null ? {} : { managed_block_hash: sha256Bytes(block) }
+  };
+}
+function transactionOperation(item) {
+  if (item.equivalent) {
+    return null;
+  }
+  const operation = item.operation;
+  const target = operationTargetPath(operation);
+  if (operation.operation === "delete") {
+    return item.finalContent === null ? { operation: "delete", path: target } : { operation: "modify", path: target, content: item.finalContent };
+  }
+  if (operation.operation === "rename") {
+    return {
+      operation: "rename",
+      from_path: operation.from_path,
+      to_path: operation.to_path,
+      content: item.finalContent ?? item.content ?? ""
+    };
+  }
+  return {
+    operation: "modify",
+    path: target,
+    content: item.finalContent ?? item.content ?? ""
+  };
+}
+async function updateProject(options) {
+  const root = resolve5(options.projectRoot);
+  let project;
+  try {
+    project = projectConfigSchema.parse(parseYaml6(await readFile8(join9(root, ".harness", "project.yaml"), "utf8")));
+  } catch {
+    throw new UpdateWorkflowError("project configuration is invalid", 3, "PROJECT_CONFIG_INVALID");
+  }
+  if (project.project.project_id === null) {
+    throw new UpdateWorkflowError("project is not bound to a server", 3, "PROJECT_NOT_BOUND");
+  }
+  const serverUrl = options.serverUrl ?? project.server.url;
+  const tokenEnv = options.tokenEnv ?? project.server.token_env;
+  if (serverUrl === null || serverUrl === void 0) {
+    throw new UpdateWorkflowError("server_url is required", 3, "SERVER_URL_REQUIRED");
+  }
+  if (!/^[A-Z_][A-Z0-9_]*$/.test(tokenEnv)) {
+    throw new UpdateWorkflowError("token_env is invalid", 3, "TOKEN_ENV_INVALID");
+  }
+  const token = options.env[tokenEnv];
+  if (token === void 0 || token.trim() === "") {
+    throw new UpdateWorkflowError("API token environment variable is unset", 8, "TOKEN_INVALID");
+  }
+  const requestId = uuidV7();
+  const baseline = await readBaseline(root);
+  let parsedServerUrl;
+  try {
+    parsedServerUrl = new URL(serverUrl);
+  } catch {
+    throw new UpdateWorkflowError("server_url is invalid", 3, "SERVER_URL_INVALID");
+  }
+  if (parsedServerUrl.protocol !== "https:") {
+    throw new UpdateWorkflowError("server_url must use HTTPS", 3, "SERVER_URL_INVALID");
+  }
+  const client = new HunterHarnessApiClient({
+    serverUrl: parsedServerUrl.toString(),
+    token,
+    ...options.fetch === void 0 ? {} : { fetch: options.fetch }
+  });
+  try {
+    const discovery = await client.getUpdateManifest(project.project.project_id, {
+      base_project_version: baseline.complete_project_version,
+      base_manifest_hash: sha256Bytes(canonicalJson(baseline)),
+      adapter: project.adapters.enabled[0] ?? "claude-code",
+      profile: project.project.profiles[0] ?? "general"
+    }, requestId);
+    if (!discovery.delta_available || discovery.artifact_id === null) {
+      return {
+        requestId,
+        projectId: project.project.project_id,
+        artifactId: null,
+        observedProjectVersion: discovery.observed_project_version,
+        operations: [],
+        applied: [],
+        skipped: [],
+        transactionId: null,
+        dryRun: options.dryRun
+      };
+    }
+    const manifest = artifactManifestSchema.parse(await client.getArtifactManifest(discovery.artifact_id, requestId));
+    if (manifest.artifact_id !== discovery.artifact_id || manifest.project_id !== project.project.project_id || manifest.project_version === null || manifestPayloadHash(manifest) !== manifest.manifest_sha256) {
+      throw new UpdateWorkflowError("artifact manifest integrity check failed", 4, "ARTIFACT_HASH_MISMATCH");
+    }
+    const blobs = /* @__PURE__ */ new Map();
+    for (const operation of manifest.files) {
+      const policy = classifyFile(operationTargetPath(operation));
+      if (decideUpdate(policy, false).apply) {
+        blobs.set(operation, await loadBlob(root, client, manifest.artifact_id, operation, requestId, options.dryRun));
+      }
+    }
+    const prepared = [];
+    const skipped = [];
+    for (const operation of manifest.files) {
+      if (operationAlreadyApplied(operation, baseline, manifest.project_version)) {
+        continue;
+      }
+      const source = operationSourcePath(operation);
+      const target = operationTargetPath(operation);
+      const policy = classifyFile(target);
+      const staticDecision = decideUpdate(policy, false);
+      if (!staticDecision.apply) {
+        skipped.push({ path: target, operation: operation.operation, reason: staticDecision.reason });
+        continue;
+      }
+      const previous = baseline.files[source];
+      if (expectedBase(operation) !== (previous?.baseline_hash ?? null)) {
+        skipped.push({ path: target, operation: operation.operation, reason: "baseline-diverged" });
+        continue;
+      }
+      const sourceContent = await optionalContent(join9(root, source));
+      const targetContent = target === source ? sourceContent : await optionalContent(join9(root, target));
+      const incoming = blobs.get(operation) ?? null;
+      const incomingHash = contentHash(operation);
+      let equivalent = incomingHash !== null && targetContent !== null && sha256Bytes(targetContent) === incomingHash;
+      let dirty = false;
+      if (operation.operation === "add") {
+        if (targetContent !== null && !equivalent) {
+          if (policy.update_policy === "managed-block-only" && incoming !== null) {
+            const incomingBlock = extractManagedBlock(incoming) ?? incoming.trim();
+            equivalent = extractManagedBlock(targetContent) === incomingBlock;
+            dirty = !equivalent;
+          } else {
+            dirty = true;
+          }
+        }
+      } else if (sourceContent === null) {
+        dirty = operation.operation !== "delete";
+      } else if (policy.update_policy === "managed-block-only") {
+        dirty = previous?.managed_block_hash === void 0 ? (previous?.local_hash_at_apply ?? previous?.baseline_hash) !== sha256Bytes(sourceContent) : managedBlockDirty(sourceContent, previous.managed_block_hash);
+      } else {
+        dirty = (previous?.local_hash_at_apply ?? previous?.baseline_hash) !== sha256Bytes(sourceContent);
+      }
+      if (operation.operation === "rename" && targetContent !== null && !equivalent) {
+        dirty = true;
+      }
+      if (dirty) {
+        skipped.push({ path: target, operation: operation.operation, reason: "local-dirty" });
+        continue;
+      }
+      let finalContent = incoming;
+      if (policy.update_policy === "managed-block-only") {
+        if (operation.operation === "delete") {
+          finalContent = sourceContent === null ? null : removeManagedBlock(sourceContent);
+          equivalent = finalContent === sourceContent;
+        } else if (incoming !== null) {
+          const incomingBlock = extractManagedBlock(incoming) ?? incoming.trim();
+          const blockId = operation.operation === "add" || operation.operation === "modify" ? operation.block_id : void 0;
+          finalContent = blockId !== void 0 ? upsertManagedBlockById(targetContent ?? "", blockId, incomingBlock) : upsertManagedBlock(targetContent ?? "", incomingBlock);
+          equivalent = finalContent === targetContent;
+        }
+      } else if (operation.operation === "delete" && sourceContent === null) {
+        equivalent = true;
+      }
+      prepared.push({ operation, content: incoming, finalContent, equivalent });
+    }
+    const applied = prepared.map((item) => operationTargetPath(item.operation));
+    if (options.dryRun) {
+      return {
+        requestId,
+        projectId: project.project.project_id,
+        artifactId: manifest.artifact_id,
+        observedProjectVersion: manifest.project_version,
+        operations: manifest.files,
+        applied,
+        skipped,
+        transactionId: null,
+        dryRun: true
+      };
+    }
+    await atomicWriteJson(join9(root, ".harness", "cache", "server-artifacts", manifest.artifact_id, "manifest.json"), manifest);
+    const lock = await acquireProtocolLock(root, "update", { requestId });
+    try {
+      const nextBaseline = baselineManifestSchema.parse(structuredClone(baseline));
+      for (const item of prepared) {
+        const target = operationTargetPath(item.operation);
+        nextBaseline.files[target] = nextBaselineEntry(item.operation, item.finalContent, manifest.project_version);
+        if (item.operation.operation === "rename") {
+          nextBaseline.files[item.operation.from_path] = {
+            baseline_hash: null,
+            local_hash_at_apply: null,
+            file_kind: item.operation.file_kind,
+            last_applied_version: manifest.project_version,
+            deleted: true
+          };
+        }
+      }
+      if (skipped.length === 0) {
+        nextBaseline.complete_project_version = manifest.project_version;
+        nextBaseline.artifact_manifest_hash = manifest.manifest_sha256;
+      }
+      const transactionId = "tx_update_" + Date.now() + "_" + uuidV7();
+      const reportPath = ".harness/reports/update-" + requestId + ".json";
+      const report = {
+        schema_version: 1,
+        request_id: requestId,
+        artifact_id: manifest.artifact_id,
+        observed_project_version: manifest.project_version,
+        status: skipped.length === 0 ? "applied" : "partial_due_to_dirty",
+        applied,
+        skipped,
+        transaction_id: transactionId
+      };
+      const operations = prepared.map((item) => transactionOperation(item)).filter((item) => item !== null);
+      operations.push({
+        operation: "modify",
+        path: ".harness/state/baseline/manifest.json",
+        content: JSON.stringify(nextBaseline, null, 2) + "\n"
+      }, {
+        operation: "add",
+        path: reportPath,
+        content: JSON.stringify(report, null, 2) + "\n"
+      }, {
+        operation: "modify",
+        path: ".harness/state/local/last-update.json",
+        content: JSON.stringify(report, null, 2) + "\n"
+      });
+      await runTransaction(root, operations, {
+        id: transactionId,
+        kind: "update",
+        ...options.transactionOptions ?? {}
+      });
+      return {
+        requestId,
+        projectId: project.project.project_id,
+        artifactId: manifest.artifact_id,
+        observedProjectVersion: manifest.project_version,
+        operations: manifest.files,
+        applied,
+        skipped,
+        transactionId,
+        dryRun: false
+      };
+    } finally {
+      await lock.release();
+    }
+  } catch (error) {
+    if (error instanceof UpdateWorkflowError) {
+      throw error;
+    }
+    if (error instanceof ApiError) {
+      throw new UpdateWorkflowError(error.message, error.status === 401 || error.status === 403 ? 8 : error.status === 409 ? 5 : 4, error.code);
+    }
+    if (error instanceof Error && error.name === "ZodError") {
+      throw new UpdateWorkflowError("artifact schema validation failed", 7, "SCHEMA_VALIDATION_FAILED");
+    }
+    throw new UpdateWorkflowError(error instanceof Error ? error.message : "update failed", 4, "NETWORK_OR_SERVER_ERROR");
+  }
+}
+
+// src/config/init-config.ts
+import { isAbsolute as isAbsolute2, join as join10 } from "node:path";
+import { readFile as readFile9 } from "node:fs/promises";
+var InitConfigurationError = class extends Error {
+  exitCode;
+  constructor(message, exitCode = 3, options) {
+    super(message, options);
+    this.name = "InitConfigurationError";
+    this.exitCode = exitCode;
+  }
+};
+function normalizeProfile(value) {
+  if (value === void 0) return void 0;
+  if (value === "" || value === "1" || value === "general") return "general";
+  if (value === "2" || value === "java") return "java";
+  throw new InitConfigurationError("profile must be general or java");
+}
+async function resolveInitConfig(cwd, flags, promptMissing) {
+  let fileConfig = {};
+  if (flags.config !== void 0) {
+    const path = isAbsolute2(flags.config) ? flags.config : join10(cwd, flags.config);
+    try {
+      fileConfig = JSON.parse(await readFile9(path, "utf8"));
+    } catch (error) {
+      throw new InitConfigurationError(
+        "unable to read init config: " + (error instanceof Error ? error.message : String(error)),
+        3,
+        { cause: error }
+      );
+    }
+  }
+  const configuredAdapter = fileConfig.adapter ?? flags.adapter ?? "claude-code";
+  if (configuredAdapter !== "claude-code") {
+    throw new InitConfigurationError("only claude-code is supported");
+  }
+  const profile = normalizeProfile(
+    fileConfig.profile ?? flags.profile ?? (promptMissing === void 0 ? void 0 : await promptMissing())
+  );
+  const candidate = {
+    adapter: "claude-code",
+    profile,
+    server_url: fileConfig.server_url ?? flags.serverUrl ?? null,
+    token_env: fileConfig.token_env ?? flags.tokenEnv ?? "HUNTER_HARNESS_TOKEN",
+    project_id: fileConfig.project_id ?? null,
+    features: fileConfig.features
+  };
+  if (candidate.profile === void 0) {
+    throw new InitConfigurationError("profile is required");
+  }
+  const parsed = initConfigSchema.safeParse(candidate);
+  if (!parsed.success) {
+    throw new InitConfigurationError(
+      "init config schema validation failed: " + parsed.error.message,
+      7
+    );
+  }
+  return parsed.data;
+}
+
+// src/output/json.ts
+function serializeCliResult(result) {
+  return JSON.stringify(result) + "\n";
+}
+
+// src/commands/configure.ts
+async function runConfigure(options, dependencies) {
+  const requestId = uuidV7();
+  try {
+    const config = await resolveInitConfig(
+      dependencies.cwd,
+      options,
+      options.nonInteractive === true ? void 0 : () => dependencies.prompt(
+        "\u8BF7\u9009\u62E9 Harness \u7C7B\u578B\uFF1A\n1. \u901A\u7528\uFF08\u9ED8\u8BA4\uFF09\n2. Java\n\u8BF7\u8F93\u5165 1 \u6216 2 [1]: "
+      ).then((answer) => answer.trim())
+    );
+    if (options.nonInteractive === true && options.yes !== true && options.dryRun !== true) {
+      dependencies.stderr("non-interactive writes require --yes\n");
+      return 2;
+    }
+    const result = await initializeProject({
+      projectRoot: dependencies.cwd,
+      resourcesRoot: dependencies.resourcesRoot,
+      config,
+      dryRun: options.dryRun === true
+    });
+    const output = {
+      schema_version: 1,
+      command: "configure",
+      request_id: requestId,
+      dry_run: options.dryRun === true,
+      ok: true,
+      exit_code: 0,
+      project_id: result.projectConfig.project.project_id,
+      summary: { planned: result.paths.length, applied: options.dryRun === true ? 0 : result.paths.length },
+      items: result.paths.map((path) => ({ path, status: options.dryRun === true ? "planned" : "applied" })),
+      warnings: [],
+      errors: []
+    };
+    dependencies.stdout(options.json === true ? serializeCliResult(output) : "Hunter Harness initialized " + result.paths.length + " files.\n");
+    return 0;
+  } catch (error) {
+    const exitCode = error instanceof InitConfigurationError ? error.exitCode : 1;
+    const message = error instanceof Error ? error.message : String(error);
+    dependencies.stderr(message + "\n");
+    if (options.json === true) {
+      dependencies.stdout(serializeCliResult({
+        schema_version: 1,
+        command: "configure",
+        request_id: requestId,
+        dry_run: options.dryRun === true,
+        ok: false,
+        exit_code: exitCode,
+        project_id: null,
+        summary: { planned: 0, applied: 0 },
+        items: [],
+        warnings: [],
+        errors: [{ message }]
+      }));
+    }
+    return exitCode;
+  }
+}
+
+// src/commands/push.ts
+async function runPush(options, dependencies) {
+  const requestId = uuidV7();
+  if (options.nonInteractive === true && options.yes !== true && options.dryRun !== true) {
+    dependencies.stderr("non-interactive push requires --yes\n");
+    return 2;
+  }
+  try {
+    const result = await pushProject({
+      projectRoot: dependencies.cwd,
+      ...options.serverUrl === void 0 ? {} : { serverUrl: options.serverUrl },
+      ...options.tokenEnv === void 0 ? {} : { tokenEnv: options.tokenEnv },
+      env: dependencies.env,
+      dryRun: options.dryRun === true,
+      fetch: dependencies.fetch,
+      ...options.yes === true || options.nonInteractive === true ? {} : { confirmProposal: async () => {
+        const answer = await dependencies.prompt("Create this proposal? [y/N]: ");
+        return /^(?:y|yes)$/i.test(answer.trim());
+      } }
+    });
+    if ("cancelled" in result && result.cancelled === true) {
+      return 2;
+    }
+    const items = result.preview.operations.map((operation) => ({
+      path: operation.operation === "rename" ? operation.to_path : operation.path,
+      operation: operation.operation,
+      file_kind: operation.file_kind,
+      status: options.dryRun === true ? "planned" : "submitted",
+      reason: null,
+      size_bytes: "size_bytes" in operation ? operation.size_bytes : 0,
+      content_sha256: "content_sha256" in operation ? operation.content_sha256 : operation.tombstone.previous_sha256
+    }));
+    const output = {
+      schema_version: 1,
+      command: "push",
+      request_id: requestId,
+      dry_run: options.dryRun === true,
+      ok: true,
+      exit_code: 0,
+      project_id: result.projectId,
+      summary: {
+        planned: result.preview.operations.length,
+        submitted: options.dryRun === true ? 0 : result.preview.operations.length,
+        skipped: result.preview.skipped.length,
+        findings: result.preview.security.findings.length
+      },
+      items,
+      warnings: result.preview.skipped,
+      errors: []
+    };
+    dependencies.stdout(options.json === true ? serializeCliResult(output) : options.dryRun === true ? "Push preview contains " + items.length + " operations.\n" : "Proposal " + result.proposalId + " created.\n");
+    return 0;
+  } catch (error) {
+    const exitCode = error instanceof PushWorkflowError ? error.exitCode : 1;
+    const message = error instanceof Error ? error.message : String(error);
+    dependencies.stderr(message + "\n");
+    if (options.json === true) {
+      dependencies.stdout(serializeCliResult({
+        schema_version: 1,
+        command: "push",
+        request_id: requestId,
+        dry_run: options.dryRun === true,
+        ok: false,
+        exit_code: exitCode,
+        project_id: null,
+        summary: { planned: 0, submitted: 0 },
+        items: [],
+        warnings: [],
+        errors: [{
+          code: error instanceof PushWorkflowError ? error.code : "GENERAL_FAILURE",
+          message
+        }]
+      }));
+    }
+    return exitCode;
+  }
+}
+
+// src/commands/update.ts
+async function runUpdate(options, dependencies) {
+  const requestId = uuidV7();
+  if (options.nonInteractive === true && options.yes !== true && options.dryRun !== true) {
+    dependencies.stderr("non-interactive update requires --yes\n");
+    return 2;
+  }
+  const execute = async (dryRun) => updateProject({
+    projectRoot: dependencies.cwd,
+    ...options.serverUrl === void 0 ? {} : { serverUrl: options.serverUrl },
+    ...options.tokenEnv === void 0 ? {} : { tokenEnv: options.tokenEnv },
+    env: dependencies.env,
+    dryRun,
+    fetch: dependencies.fetch
+  });
+  try {
+    let result;
+    if (options.dryRun !== true && options.yes !== true && options.nonInteractive !== true) {
+      const preview = await execute(true);
+      const answer = await dependencies.prompt(
+        "Apply " + preview.applied.length + " eligible update items? [y/N]: "
+      );
+      if (!/^(?:y|yes)$/i.test(answer.trim())) {
+        return 2;
+      }
+      result = await execute(false);
+    } else {
+      result = await execute(options.dryRun === true);
+    }
+    const applied = new Set(result.applied);
+    const skippedByPath = new Map(result.skipped.map((item) => [item.path, item]));
+    const items = result.operations.map((operation) => {
+      const path = operation.operation === "rename" ? operation.to_path : operation.path;
+      const skipped = skippedByPath.get(path);
+      return {
+        path,
+        operation: operation.operation,
+        file_kind: operation.file_kind,
+        policy: "update",
+        status: skipped !== void 0 ? "skipped" : applied.has(path) ? options.dryRun === true ? "planned" : "applied" : "already-applied",
+        reason: skipped?.reason ?? null,
+        size_bytes: "size_bytes" in operation ? operation.size_bytes : 0
+      };
+    });
+    const exitCode = result.skipped.length > 0 ? 5 : 0;
+    const output = {
+      schema_version: 1,
+      command: "update",
+      request_id: requestId,
+      dry_run: options.dryRun === true,
+      ok: exitCode === 0,
+      exit_code: exitCode,
+      project_id: result.projectId,
+      summary: {
+        discovered: result.operations.length,
+        applied: options.dryRun === true ? 0 : result.applied.length,
+        planned: options.dryRun === true ? result.applied.length : 0,
+        skipped: result.skipped.length
+      },
+      items,
+      warnings: result.skipped,
+      errors: []
+    };
+    dependencies.stdout(options.json === true ? serializeCliResult(output) : result.artifactId === null ? "No approved updates are available.\n" : "Update applied " + result.applied.length + " items; skipped " + result.skipped.length + ".\n");
+    return exitCode;
+  } catch (error) {
+    const exitCode = error instanceof UpdateWorkflowError ? error.exitCode : 1;
+    const message = error instanceof Error ? error.message : String(error);
+    dependencies.stderr(message + "\n");
+    if (options.json === true) {
+      dependencies.stdout(serializeCliResult({
+        schema_version: 1,
+        command: "update",
+        request_id: requestId,
+        dry_run: options.dryRun === true,
+        ok: false,
+        exit_code: exitCode,
+        project_id: null,
+        summary: { discovered: 0, applied: 0, skipped: 0 },
+        items: [],
+        warnings: [],
+        errors: [{
+          code: error instanceof UpdateWorkflowError ? error.code : "GENERAL_FAILURE",
+          message
+        }]
+      }));
+    }
+    return exitCode;
+  }
+}
+
+// src/commands/recovery.ts
+import { stat as stat4 } from "node:fs/promises";
+import { join as join11 } from "node:path";
+async function exists4(path) {
+  try {
+    await stat4(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function explicitConfigure(options) {
+  return options.adapter !== void 0 || options.profile !== void 0 || options.config !== void 0 || options.serverUrl !== void 0 || options.tokenEnv !== void 0;
+}
+async function runRecoveryMenuIfApplicable(options, dependencies) {
+  const pending = await pendingTransactions(dependencies.cwd);
+  if (pending.length > 0) {
+    if (options.nonInteractive === true) {
+      dependencies.stderr("unfinished transaction requires interactive recovery\n");
+      return 5;
+    }
+    const answer2 = await dependencies.prompt([
+      "Unfinished Hunter Harness transaction detected.",
+      "1. Recover last failed update",
+      "2. Roll back last committed update",
+      "3. View transaction status",
+      "4. Clean old transactions",
+      "Choose [1-4]: "
+    ].join("\n"));
+    try {
+      if (answer2.trim() === "1") {
+        const result = await recoverTransaction(
+          dependencies.cwd,
+          pending[0]?.transactionId ?? ""
+        );
+        dependencies.stdout("Recovery completed: " + result.status + ".\n");
+        return 0;
+      }
+      if (answer2.trim() === "2") {
+        const result = await rollbackLatestCommittedUpdate(dependencies.cwd);
+        dependencies.stdout("Rollback completed: " + result.status + ".\n");
+        return 0;
+      }
+      if (answer2.trim() === "3") {
+        dependencies.stdout(JSON.stringify(
+          await listTransactions(dependencies.cwd),
+          null,
+          2
+        ) + "\n");
+        return 0;
+      }
+      if (answer2.trim() === "4") {
+        const removed = await cleanupOldTransactions(dependencies.cwd);
+        dependencies.stdout("Cleaned " + removed.length + " old transactions.\n");
+        return 0;
+      }
+      return 2;
+    } catch (error) {
+      dependencies.stderr((error instanceof Error ? error.message : String(error)) + "\n");
+      return 5;
+    }
+  }
+  const initialized = await exists4(join11(dependencies.cwd, ".harness", "project.yaml"));
+  if (!initialized || options.nonInteractive === true || explicitConfigure(options)) {
+    return null;
+  }
+  const answer = await dependencies.prompt([
+    "Hunter Harness project menu.",
+    "1. Configure project",
+    "2. Roll back last update",
+    "3. Clean old transactions",
+    "4. View transaction status",
+    "5. Exit",
+    "Choose [1-5]: "
+  ].join("\n"));
+  try {
+    if (answer.trim() === "1") {
+      return null;
+    }
+    if (answer.trim() === "2") {
+      const result = await rollbackLatestCommittedUpdate(dependencies.cwd);
+      dependencies.stdout("Rollback completed: " + result.status + ".\n");
+      return 0;
+    }
+    if (answer.trim() === "3") {
+      const removed = await cleanupOldTransactions(dependencies.cwd);
+      dependencies.stdout("Cleaned " + removed.length + " old transactions.\n");
+      return 0;
+    }
+    if (answer.trim() === "4") {
+      dependencies.stdout(JSON.stringify(
+        await listTransactions(dependencies.cwd),
+        null,
+        2
+      ) + "\n");
+      return 0;
+    }
+    return answer.trim() === "5" ? 0 : 2;
+  } catch (error) {
+    dependencies.stderr((error instanceof Error ? error.message : String(error)) + "\n");
+    return 5;
+  }
+}
+
+// src/bin.ts
+function defaultDependencies(overrides) {
+  return {
+    cwd: overrides.cwd ?? process.cwd(),
+    resourcesRoot: overrides.resourcesRoot ?? fileURLToPath(
+      new URL("../resources", import.meta.url)
+    ),
+    stdout: overrides.stdout ?? ((value) => process.stdout.write(value)),
+    stderr: overrides.stderr ?? ((value) => process.stderr.write(value)),
+    prompt: overrides.prompt ?? (async (question) => {
+      const terminal = createInterface({ input: process.stdin, output: process.stdout });
+      try {
+        return await terminal.question(question);
+      } finally {
+        terminal.close();
+      }
+    }),
+    fetch: overrides.fetch ?? globalThis.fetch,
+    env: overrides.env ?? process.env
+  };
+}
+function addCommonOptions(command) {
+  return command.option("--dry-run").option("--yes").option("--json").option("--server-url <url>").option("--token-env <ENV_NAME>").option("--non-interactive");
+}
+async function runCli(argv, overrides = {}) {
+  const dependencies = defaultDependencies(overrides);
+  const program = addCommonOptions(new Command()).name("hunter-harness").description("Local-first, server-governed agent harness").option("--profile <name>").option("--config <file>").showHelpAfterError().exitOverride().configureOutput({
+    writeOut: dependencies.stdout,
+    writeErr: dependencies.stderr
+  });
+  let exitCode = 0;
+  program.action(async (options) => {
+    const recoveryResult = await runRecoveryMenuIfApplicable(options, dependencies);
+    if (recoveryResult !== null) {
+      exitCode = recoveryResult;
+      return;
+    }
+    exitCode = await runConfigure(options, dependencies);
+  });
+  addCommonOptions(program.command("update")).description("Apply approved server artifacts").action(async (options) => {
+    exitCode = await runUpdate(
+      { ...program.opts(), ...options },
+      dependencies
+    );
+  });
+  addCommonOptions(program.command("push")).description("Create a governed proposal").action(async (options) => {
+    exitCode = await runPush({ ...program.opts(), ...options }, dependencies);
+  });
+  try {
+    await program.parseAsync(["node", "hunter-harness", ...argv]);
+    return exitCode;
+  } catch (error) {
+    if (error instanceof CommanderError) {
+      return error.code === "commander.helpDisplayed" ? 0 : 3;
+    }
+    throw error;
+  }
+}
+if (process.argv[1] !== void 0 && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  process.exitCode = await runCli(process.argv.slice(2));
+}
+export {
+  runCli
+};