hunter-harness 0.1.1 → 0.1.2

package/dist/bin.js

@@ -414,7 +414,7 @@ function normalize(value) {
     return value.map(normalize);
   }
   if (value !== null && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => [key, normalize(item)]));
+    return Object.fromEntries(Object.entries(value).filter(([, item2]) => item2 !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, item2]) => [key, normalize(item2)]));
   }
   return value;
 }
@@ -789,8 +789,8 @@ function normalizeManagedPath(input) {
 }
 function assertNoCaseCollisions(paths) {
   const seen = /* @__PURE__ */ new Map();
-  for (const item of paths) {
-    const normalized = normalizeManagedPath(item);
+  for (const item2 of paths) {
+    const normalized = normalizeManagedPath(item2);
     const folded = normalized.toLocaleLowerCase("en-US");
     const existing = seen.get(folded);
     if (existing !== void 0 && existing !== normalized) {
@@ -817,8 +817,8 @@ async function assertNoSymlinks(root, relativePath) {
   for (const segment of normalized.split("/")) {
     current = join(current, segment);
     try {
-      const stat5 = await lstat(current);
-      if (stat5.isSymbolicLink()) {
+      const stat6 = await lstat(current);
+      if (stat6.isSymbolicLink()) {
         throw new UnsafePathError("symbolic links are not managed");
       }
     } catch (error) {
@@ -834,7 +834,7 @@ async function assertNoSymlinks(root, relativePath) {
 async function withRetry(action, options) {
   const attempts = options.attempts ?? 3;
   const sleep = options.sleep ?? (async (milliseconds) => {
-    await new Promise((resolve6) => setTimeout(resolve6, milliseconds));
+    await new Promise((resolve7) => setTimeout(resolve7, milliseconds));
   });
   let lastError;
   for (let attempt = 1; attempt <= attempts; attempt += 1) {
@@ -1094,6 +1094,17 @@ function removeManagedBlock(original) {
   const after = original.slice(end).replace(/^(?:\r?\n){1,2}/, "");
   return before + after;
 }
+function refreshManagedBlock(original, blockContent) {
+  const starts = markerCount(original, MANAGED_BLOCK_START);
+  const ends = markerCount(original, MANAGED_BLOCK_END);
+  const absent = starts === 0 && ends === 0;
+  const malformed = !absent && (starts !== 1 || ends !== 1 || original.indexOf(MANAGED_BLOCK_START) > original.indexOf(MANAGED_BLOCK_END));
+  if (malformed) {
+    return { content: original, action: "preserved_conflict", conflict: true };
+  }
+  const action = absent ? "appended" : "refreshed";
+  return { content: upsertManagedBlock(original, blockContent), action, conflict: false };
+}
 function escapeRe(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -1250,7 +1261,7 @@ import { parse as parseYaml2, stringify as stringifyYaml } from "yaml";
 
 // ../core/dist/transaction/transaction.js
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { copyFile, mkdir as mkdir3, readFile as readFile2, rename as rename2, rm as rm2, stat, writeFile as writeFile2 } from "node:fs/promises";
+import { copyFile, mkdir as mkdir3, readFile as readFile2, readdir, rename as rename2, rm as rm2, stat, writeFile as writeFile2 } from "node:fs/promises";
 import { dirname as dirname2, join as join3 } from "node:path";
 
 // ../core/dist/state/layout.js
@@ -1276,9 +1287,7 @@ async function ensureStateLayout(projectRoot) {
     mkdir2(layout.baseline, { recursive: true }),
     mkdir2(layout.transactions, { recursive: true }),
     mkdir2(layout.locks, { recursive: true }),
-    mkdir2(layout.local, { recursive: true }),
-    mkdir2(layout.serverArtifacts, { recursive: true }),
-    mkdir2(layout.reports, { recursive: true })
+    mkdir2(layout.local, { recursive: true })
   ]);
   return layout;
 }
@@ -1321,6 +1330,31 @@ async function writeJournal(transactionRoot, journal) {
     updated_at: (/* @__PURE__ */ new Date()).toISOString()
   });
 }
+async function pruneOlderSuccessful(layout, currentId, kind) {
+  if (kind === void 0)
+    return;
+  let entries;
+  try {
+    entries = await readdir(layout.transactions);
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT")
+      return;
+    throw error;
+  }
+  for (const name of entries) {
+    if (name === currentId)
+      continue;
+    const txRoot = join3(layout.transactions, name);
+    try {
+      const journal = JSON.parse(await readFile2(join3(txRoot, "journal.json"), "utf8"));
+      if (journal.state === "committed" && journal.kind === kind) {
+        await rm2(txRoot, { recursive: true, force: true });
+      }
+    } catch {
+      continue;
+    }
+  }
+}
 async function snapshotPaths(projectRoot, transactionRoot, paths) {
   const snapshots = [];
   for (const path of paths) {
@@ -1460,7 +1494,6 @@ async function runTransaction(projectRoot, rawOperations, options = {}) {
     await atomicWriteJson(join3(transactionRoot, "after", "manifest.json"), after);
     journal.state = "committed";
     await writeJournal(transactionRoot, journal);
-    return { transactionId, status: "committed" };
   } catch (error) {
     if (error instanceof InterruptedTransactionError) {
       throw error;
@@ -1470,11 +1503,35 @@ async function runTransaction(projectRoot, rawOperations, options = {}) {
     await rollbackTransaction(projectRoot, transactionId);
     throw error;
   }
+  await rm2(join3(transactionRoot, "staged"), { recursive: true, force: true });
+  await pruneOlderSuccessful(layout, transactionId, options.kind);
+  return { transactionId, status: "committed" };
 }
 
+// ../core/dist/project/managed-content.js
+var AGENTS_MANAGED_BLOCK_CONTENT = [
+  "# Hunter Harness",
+  "",
+  "Use .harness/context-index.json to route rules, Knowledge, and codebase maps.",
+  "Treat .claude/skills/harness-* as editable adapter working copies.",
+  "Do not modify .harness/state or .harness/cache directly."
+].join("\n");
+var CLAUDE_MANAGED_BLOCK_CONTENT = [
+  "@AGENTS.md",
+  "",
+  "# Hunter Harness",
+  "",
+  "- Rules: .claude/rules/",
+  "- Skills: .claude/skills/harness-*/",
+  "- Knowledge: .harness/knowledge/",
+  "- Codebase map: .harness/codebase/map/"
+].join("\n");
+var HARNESS_GENERAL_RULES_CONTENT = "# Hunter Harness Rules\n\n- Report evidence honestly.\n- Do not execute destructive actions without confirmation.\n";
+var HARNESS_JAVA_RULES_CONTENT = "# Java Profile\n\n- Verify builds and tests with the project build tool.\n";
+
 // ../core/dist/project/profile-bundle.js
 import { createHash as createHash2 } from "node:crypto";
-import { readFile as readFile3 } from "node:fs/promises";
+import { readFile as readFile3, readdir as readdir2 } from "node:fs/promises";
 import { join as join4 } from "node:path";
 function isProfile(value) {
   return value === "general" || value === "java";
@@ -1490,16 +1547,16 @@ async function loadProfileBundle(resourcesRoot, profile) {
     throw new Error(`invalid ${profile} Harness Bundle manifest`);
   }
   const files = /* @__PURE__ */ new Map();
-  for (const item of raw.files) {
-    validateRelativeBundlePath(item.path);
-    if (typeof item.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(item.sha256) || files.has(item.path)) {
+  for (const item2 of raw.files) {
+    validateRelativeBundlePath(item2.path);
+    if (typeof item2.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(item2.sha256) || files.has(item2.path)) {
       throw new Error(`invalid ${profile} Harness Bundle manifest entry`);
     }
-    const bytes = await readFile3(join4(resourcesRoot, "harness", profile, item.path));
-    if (createHash2("sha256").update(bytes).digest("hex") !== item.sha256) {
-      throw new Error(`Harness Bundle hash mismatch: ${item.path}`);
+    const bytes = await readFile3(join4(resourcesRoot, "harness", profile, item2.path));
+    if (createHash2("sha256").update(bytes).digest("hex") !== item2.sha256) {
+      throw new Error(`Harness Bundle hash mismatch: ${item2.path}`);
     }
-    files.set(item.path, bytes);
+    files.set(item2.path, bytes);
   }
   return { manifest: raw, files };
 }
@@ -1510,22 +1567,123 @@ async function managedBundleTargets(resourcesRoot, profile) {
     targets.add(".claude/rules/harness-profile-java.md");
   return targets;
 }
-function bundleTargetContents(bundle) {
-  const contents = /* @__PURE__ */ new Map();
-  for (const [path, bytes] of bundle.files) {
-    const skillTarget = `.claude/skills/${path}`;
-    contents.set(skillTarget, bytes);
-    const agent = /^agents\/([^/]+\.md)$/.exec(path);
-    if (agent?.[1] !== void 0) {
-      const agentTarget = `.claude/agents/${agent[1]}`;
-      contents.set(agentTarget, bytes);
+var AGENT_SOURCE_PATH = /^agents\/([^/]+\.md)$/;
+function projectBundle(bundle) {
+  const records = [];
+  for (const [sourcePath, bytes] of bundle.files) {
+    validateRelativeBundlePath(sourcePath);
+    const agent = AGENT_SOURCE_PATH.exec(sourcePath);
+    const projectedTarget = agent?.[1] !== void 0 ? `.claude/agents/${agent[1]}` : `.claude/skills/${sourcePath}`;
+    const manifestEntry = bundle.manifest.files.find((entry) => entry.path === sourcePath);
+    if (manifestEntry === void 0) {
+      throw new Error(`Harness Bundle missing manifest entry: ${sourcePath}`);
     }
+    records.push({
+      source_path: sourcePath,
+      target_path: normalizeManagedPath(projectedTarget),
+      sha256: manifestEntry.sha256,
+      bytes
+    });
   }
-  return contents;
+  assertNoCaseCollisions(records.map((record) => record.target_path));
+  return records.sort((left, right) => left.target_path.localeCompare(right.target_path));
+}
+function bundleTargetContents(bundle) {
+  return new Map(projectBundle(bundle).map((record) => [record.target_path, record.bytes]));
+}
+function ruleTarget(sourcePath, targetPath, content) {
+  return {
+    source_path: sourcePath,
+    target_path: targetPath,
+    sha256: createHash2("sha256").update(content).digest("hex"),
+    bytes: new TextEncoder().encode(content)
+  };
+}
+async function managedTargets(resourcesRoot, profile) {
+  const bundle = await loadProfileBundle(resourcesRoot, profile);
+  const records = projectBundle(bundle).map((record) => ({
+    source_path: record.source_path,
+    target_path: record.target_path,
+    sha256: record.sha256,
+    bytes: record.bytes
+  }));
+  records.push(ruleTarget("rules/harness-general.md", ".claude/rules/harness-general.md", HARNESS_GENERAL_RULES_CONTENT));
+  if (profile === "java") {
+    records.push(ruleTarget("rules/harness-profile-java.md", ".claude/rules/harness-profile-java.md", HARNESS_JAVA_RULES_CONTENT));
+  }
+  assertNoCaseCollisions(records.map((record) => record.target_path));
+  return records.sort((left, right) => left.target_path.localeCompare(right.target_path));
 }
 function parseHarnessProfile(value) {
   return isProfile(value) ? value : null;
 }
+function parseMigrationManifest(raw) {
+  if (raw === null || typeof raw !== "object") {
+    throw new Error("invalid Harness migration manifest");
+  }
+  const record = raw;
+  if (record.schema_version !== 1 || !isProfile(record.profile) || typeof record.bundle_version !== "string" || !/^sha256:[a-f0-9]{64}$/.test(String(record.bundle_manifest_hash)) || !Array.isArray(record.projection)) {
+    throw new Error("invalid Harness migration manifest");
+  }
+  const projection = [];
+  for (const entry of record.projection) {
+    if (entry === null || typeof entry !== "object") {
+      throw new Error("invalid Harness migration manifest entry");
+    }
+    const item2 = entry;
+    validateRelativeBundlePath(item2.source_path);
+    if (typeof item2.target_path !== "string" || typeof item2.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(item2.sha256)) {
+      throw new Error("invalid Harness migration manifest entry");
+    }
+    const targetPath = normalizeManagedPath(item2.target_path);
+    if (!targetPath.startsWith(".claude/")) {
+      throw new Error("invalid Harness migration manifest target");
+    }
+    projection.push({
+      source_path: item2.source_path,
+      target_path: targetPath,
+      sha256: item2.sha256
+    });
+  }
+  assertNoCaseCollisions(projection.map((item2) => item2.target_path));
+  return {
+    schema_version: 1,
+    profile: record.profile,
+    bundle_version: record.bundle_version,
+    bundle_manifest_hash: record.bundle_manifest_hash,
+    projection
+  };
+}
+async function loadMigrationManifests(resourcesRoot) {
+  const migrationsRoot = join4(resourcesRoot, "harness", "migrations");
+  let versionDirs;
+  try {
+    versionDirs = await readdir2(migrationsRoot);
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+  const manifests = [];
+  for (const versionDir of versionDirs) {
+    let files;
+    try {
+      files = await readdir2(join4(migrationsRoot, versionDir));
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+        continue;
+      }
+      throw error;
+    }
+    for (const file of files) {
+      if (!file.endsWith(".json"))
+        continue;
+      manifests.push(parseMigrationManifest(JSON.parse(await readFile3(join4(migrationsRoot, versionDir, file), "utf8"))));
+    }
+  }
+  return manifests;
+}
 
 // ../core/dist/project/uuid-v7.js
 import { randomBytes } from "node:crypto";
@@ -1580,24 +1738,13 @@ async function operationFor(root, path, content) {
   return await exists2(join5(root, path)) ? { operation: "modify", path, content } : { operation: "add", path, content };
 }
 var INSTALLED_BUNDLE_PATH = ".harness/state/local/installed-harness-bundle.json";
-async function previousInstalledProfile(root) {
-  const content = await readOptional(join5(root, INSTALLED_BUNDLE_PATH));
-  if (content === "")
-    return null;
-  try {
-    const parsed = JSON.parse(content);
-    return parsed.schema_version === 1 ? parseHarnessProfile(parsed.profile) : null;
-  } catch {
-    return null;
-  }
-}
 async function initializeProject(options) {
   const root = resolve3(options.projectRoot);
   const config = initConfigSchema.parse(options.config);
   const existing = await existingProjectConfig(root);
   const profile = config.profile;
   const bundle = await loadProfileBundle(options.resourcesRoot, profile);
-  const bundleFiles = bundleTargetContents(bundle);
+  const managed = await managedTargets(options.resourcesRoot, profile);
   const bundleHash = sha256Bytes(canonicalJson(bundle.manifest.files));
   const projectConfig = projectConfigSchema.parse({
     harness: { name: "hunter-harness", schema_version: 1 },
@@ -1621,23 +1768,8 @@ async function initializeProject(options) {
     artifact_manifest_hash: null,
     files: {}
   });
-  const agentsContent = upsertManagedBlock(await readOptional(join5(root, "AGENTS.md")), [
-    "# Hunter Harness",
-    "",
-    "Use .harness/context-index.json to route rules, Knowledge, and codebase maps.",
-    "Treat .claude/skills/harness-* as editable adapter working copies.",
-    "Do not modify .harness/state or .harness/cache directly."
-  ].join("\n"));
-  const claudeContent = upsertManagedBlock(await readOptional(join5(root, "CLAUDE.md")), [
-    "@AGENTS.md",
-    "",
-    "# Hunter Harness",
-    "",
-    "- Rules: .claude/rules/",
-    "- Skills: .claude/skills/harness-*/",
-    "- Knowledge: .harness/knowledge/",
-    "- Codebase map: .harness/codebase/map/"
-  ].join("\n"));
+  const agentsContent = upsertManagedBlock(await readOptional(join5(root, "AGENTS.md")), AGENTS_MANAGED_BLOCK_CONTENT);
+  const claudeContent = upsertManagedBlock(await readOptional(join5(root, "CLAUDE.md")), CLAUDE_MANAGED_BLOCK_CONTENT);
   const files = /* @__PURE__ */ new Map([
     [
       ".harness/project.yaml",
@@ -1665,46 +1797,29 @@ async function initializeProject(options) {
       ".harness/knowledge/index.json",
       JSON.stringify({ schema_version: 1, generated_at: null, entries: [] }, null, 2) + "\n"
     ],
-    [".harness/knowledge/_candidates/.gitkeep", ""],
-    [".harness/knowledge/project-local/.gitkeep", ""],
-    [".harness/codebase/map/.gitkeep", ""],
-    [".harness/state/local/.gitkeep", ""],
-    [".harness/cache/server-artifacts/.gitkeep", ""],
-    [".harness/reports/.gitkeep", ""],
-    [
-      ".harness/README.md",
-      "# Hunter Harness\n\nUse npx hunter-harness, update, and push.\n"
-    ],
     ["AGENTS.md", agentsContent],
-    ["CLAUDE.md", claudeContent],
-    [
-      ".claude/rules/harness-general.md",
-      "# Hunter Harness Rules\n\n- Report evidence honestly.\n- Do not execute destructive actions without confirmation.\n"
-    ]
+    ["CLAUDE.md", claudeContent]
   ]);
-  if (config.profile === "java") {
-    files.set(".claude/rules/harness-profile-java.md", "# Java Profile\n\n- Verify builds and tests with the project build tool.\n");
-  }
-  for (const [targetPath, bytes] of bundleFiles) {
-    files.set(targetPath, bytes);
+  for (const target of managed) {
+    files.set(target.target_path, target.bytes);
   }
-  const installedFileList = [...bundleFiles.keys()].sort();
-  if (profile === "java")
-    installedFileList.push(".claude/rules/harness-profile-java.md");
-  const installedManifest = {
-    schema_version: 1,
+  const installedState = {
+    schema_version: 2,
     profile,
-    files: installedFileList.sort()
+    bundle_version: bundle.manifest.bundle_version,
+    bundle_manifest_hash: bundleHash,
+    installed_at: (/* @__PURE__ */ new Date()).toISOString(),
+    files: managed.map((target) => ({
+      source_path: target.source_path,
+      target_path: target.target_path,
+      sha256: target.sha256
+    })).sort((left, right) => left.target_path.localeCompare(right.target_path))
   };
-  files.set(INSTALLED_BUNDLE_PATH, JSON.stringify(installedManifest, null, 2) + "\n");
-  const newManaged = await managedBundleTargets(options.resourcesRoot, profile);
-  const oldProfile = await previousInstalledProfile(root);
-  const oldManaged = oldProfile === null ? /* @__PURE__ */ new Set() : await managedBundleTargets(options.resourcesRoot, oldProfile);
-  const deleteOperations = [...oldManaged].filter((path) => !newManaged.has(path)).map((path) => ({ operation: "delete", path }));
+  files.set(INSTALLED_BUNDLE_PATH, JSON.stringify(installedState, null, 2) + "\n");
   const paths = [...files.keys()].sort((left, right) => left.localeCompare(right));
   if (!options.dryRun) {
     const writeOperations = await Promise.all([...files.entries()].map(async ([path, content]) => operationFor(root, path, content)));
-    await runTransaction(root, [...deleteOperations, ...writeOperations], { kind: "init" });
+    await runTransaction(root, writeOperations, { kind: "init" });
   }
   return {
     projectConfig,
@@ -1714,6 +1829,325 @@ async function initializeProject(options) {
   };
 }
 
+// ../core/dist/project/refresh.js
+import { createHash as createHash3 } from "node:crypto";
+import { readFile as readFile5, readdir as readdir3, rmdir, stat as stat3 } from "node:fs/promises";
+import { dirname as dirname3, join as join6, resolve as resolve4 } from "node:path";
+import { parse as parseYaml3, stringify as stringifyYaml2 } from "yaml";
+var INSTALLED_STATE_PATH = ".harness/state/local/installed-harness-bundle.json";
+var CONTEXT_INDEX_PATH = ".harness/context-index.json";
+async function exists3(path) {
+  try {
+    await stat3(path);
+    return true;
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+async function fileHex(path) {
+  try {
+    return createHash3("sha256").update(await readFile5(path)).digest("hex");
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  }
+}
+async function readOptionalText(path) {
+  try {
+    return await readFile5(path, "utf8");
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return "";
+    }
+    throw error;
+  }
+}
+async function readInstalledState(root) {
+  const content = await readOptionalText(join6(root, INSTALLED_STATE_PATH));
+  if (content === "") {
+    return { profile: null, schemaVersion: null, trusted: /* @__PURE__ */ new Map() };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    return { profile: null, schemaVersion: null, trusted: /* @__PURE__ */ new Map() };
+  }
+  const profile = parseHarnessProfile(parsed.profile);
+  const trusted = /* @__PURE__ */ new Map();
+  if (parsed.schema_version === 2 && Array.isArray(parsed.files)) {
+    for (const entry of parsed.files) {
+      if (entry !== null && typeof entry === "object" && "target_path" in entry && "sha256" in entry) {
+        const target = entry.target_path;
+        const sha = entry.sha256;
+        if (typeof target === "string" && typeof sha === "string") {
+          trusted.set(target, sha);
+        }
+      }
+    }
+  }
+  return { profile, schemaVersion: typeof parsed.schema_version === "number" ? parsed.schema_version : null, trusted };
+}
+async function readContextIndexBundleHash(root) {
+  const content = await readOptionalText(join6(root, CONTEXT_INDEX_PATH));
+  if (content === "")
+    return null;
+  try {
+    const record = JSON.parse(content);
+    const hash = record.skill_bundle?.bundle_hash;
+    return typeof hash === "string" ? hash : null;
+  } catch {
+    return null;
+  }
+}
+async function pruneEmptyParentDirs(root, deletedPaths) {
+  const claudeRoot = join6(root, ".claude");
+  const boundaries = /* @__PURE__ */ new Set([
+    claudeRoot,
+    join6(claudeRoot, "skills"),
+    join6(claudeRoot, "agents")
+  ]);
+  for (const deleted of deletedPaths) {
+    let dir = dirname3(join6(root, deleted));
+    while (dir.startsWith(claudeRoot) && !boundaries.has(dir)) {
+      let entries;
+      try {
+        entries = await readdir3(dir);
+      } catch {
+        break;
+      }
+      if (entries.length > 0)
+        break;
+      try {
+        await rmdir(dir);
+      } catch {
+        break;
+      }
+      dir = dirname3(dir);
+    }
+  }
+}
+function item(target, action, reason, oldSha, incomingSha) {
+  return {
+    source_path: target.source_path,
+    target_path: target.target_path,
+    action,
+    reason,
+    old_sha256: oldSha,
+    incoming_sha256: incomingSha
+  };
+}
+function conflict(target, reason, oldSha, incomingSha) {
+  return {
+    source_path: target.source_path,
+    target_path: target.target_path,
+    reason,
+    old_sha256: oldSha,
+    incoming_sha256: incomingSha
+  };
+}
+function sortByTarget(items) {
+  return [...items].sort((left, right) => left.target_path.localeCompare(right.target_path));
+}
+async function refreshMarkdownBlock(root, fileName, blockContent, ops, conflicts, preserved) {
+  const original = await readOptionalText(join6(root, fileName));
+  const current = original === "" ? null : createHash3("sha256").update(original).digest("hex");
+  const refresh = refreshManagedBlock(original, blockContent);
+  const synthetic = {
+    source_path: fileName,
+    target_path: fileName,
+    sha256: createHash3("sha256").update(blockContent).digest("hex"),
+    bytes: new TextEncoder().encode(blockContent)
+  };
+  if (refresh.conflict) {
+    preserved.push(item(synthetic, "preserve", "MALFORMED_MANAGED_BLOCK", current, synthetic.sha256));
+    conflicts.push(conflict(synthetic, "MALFORMED_MANAGED_BLOCK", current, synthetic.sha256));
+    return;
+  }
+  if (refresh.content === original) {
+    return;
+  }
+  ops.push({
+    operation: original === "" ? "add" : "modify",
+    path: fileName,
+    content: refresh.content
+  });
+}
+async function reconcileContextIndex(root, bundleVersion, bundleManifestHash) {
+  const existing = await readOptionalText(join6(root, CONTEXT_INDEX_PATH));
+  let record = {};
+  if (existing !== "") {
+    try {
+      record = JSON.parse(existing);
+    } catch {
+      record = {};
+    }
+  }
+  if (Object.keys(record).length === 0) {
+    record = {
+      schema_version: 1,
+      project: { claude_md: "CLAUDE.md", agents_md: "AGENTS.md" },
+      rules: [".claude/rules/harness-general.md"],
+      knowledge: { index: ".harness/knowledge/index.json" },
+      codebase: { map: ".harness/codebase/map", status: "missing" }
+    };
+  }
+  record.skill_bundle = {
+    registry_version: bundleVersion,
+    bundle_hash: bundleManifestHash
+  };
+  return {
+    operation: existing === "" ? "add" : "modify",
+    path: CONTEXT_INDEX_PATH,
+    content: JSON.stringify(record, null, 2) + "\n"
+  };
+}
+async function profileTransitionOperation(root, previousProfile, profile) {
+  if (previousProfile === null || previousProfile === profile)
+    return null;
+  const path = ".harness/project.yaml";
+  const content = await readOptionalText(join6(root, path));
+  const project = projectConfigSchema.parse(parseYaml3(content));
+  return {
+    operation: "modify",
+    path,
+    content: stringifyYaml2({
+      ...project,
+      project: { ...project.project, profiles: [profile] }
+    }, { sortMapEntries: true })
+  };
+}
+async function refreshProject(options) {
+  const root = resolve4(options.projectRoot);
+  const profile = options.profile;
+  const newManaged = await managedTargets(options.resourcesRoot, profile);
+  const newBundle = await loadProfileBundle(options.resourcesRoot, profile);
+  const bundleManifestHash = sha256Bytes(canonicalJson(newBundle.manifest.files));
+  const installed = await readInstalledState(root);
+  const previousProfile = installed.profile;
+  let trusted = installed.trusted;
+  let migrationOldPaths = null;
+  if (installed.schemaVersion === 1) {
+    const contextHash = await readContextIndexBundleHash(root);
+    if (contextHash !== null) {
+      const migrations = await loadMigrationManifests(options.resourcesRoot);
+      const match = migrations.find((m) => m.bundle_manifest_hash === contextHash && m.profile === installed.profile);
+      if (match !== void 0) {
+        trusted = new Map(match.projection.map((entry) => [entry.target_path, entry.sha256]));
+        migrationOldPaths = new Set(match.projection.map((entry) => entry.target_path));
+      }
+    }
+  }
+  const newTargetSet = new Set(newManaged.map((target) => target.target_path));
+  let oldOnly = [];
+  if (migrationOldPaths !== null) {
+    for (const targetPath of migrationOldPaths) {
+      if (!newTargetSet.has(targetPath)) {
+        oldOnly.push({
+          source_path: targetPath,
+          target_path: targetPath,
+          sha256: trusted.get(targetPath) ?? "",
+          bytes: new Uint8Array()
+        });
+      }
+    }
+  } else if (previousProfile !== null && previousProfile !== profile) {
+    const oldManaged = await managedTargets(options.resourcesRoot, previousProfile);
+    oldOnly = oldManaged.filter((target) => !newTargetSet.has(target.target_path));
+  }
+  const applied = [];
+  const removed = [];
+  const preserved = [];
+  const unchanged = [];
+  const conflicts = [];
+  const ops = [];
+  const newStateFiles = [];
+  for (const target of newManaged) {
+    const incoming = target.sha256;
+    const current = await fileHex(join6(root, target.target_path));
+    if (current === null) {
+      applied.push(item(target, "add", "MISSING_TARGET", null, incoming));
+      ops.push({ operation: "add", path: target.target_path, content: target.bytes });
+      newStateFiles.push({ source_path: target.source_path, target_path: target.target_path, sha256: incoming });
+      continue;
+    }
+    if (current === incoming) {
+      unchanged.push(item(target, "unchanged", "ALREADY_CURRENT", current, incoming));
+      newStateFiles.push({ source_path: target.source_path, target_path: target.target_path, sha256: incoming });
+      continue;
+    }
+    const trustedHash = trusted.get(target.target_path);
+    if (trustedHash !== void 0 && current === trustedHash || options.forceManaged) {
+      const reason = options.forceManaged ? "FORCE_MANAGED" : "BASELINE_CLEAN";
+      applied.push(item(target, "replace", reason, current, incoming));
+      ops.push({ operation: "modify", path: target.target_path, content: target.bytes });
+      newStateFiles.push({ source_path: target.source_path, target_path: target.target_path, sha256: incoming });
+    } else {
+      const reason = trustedHash === void 0 ? "LEGACY_BASELINE_UNKNOWN" : "LOCAL_MODIFICATION";
+      preserved.push(item(target, "preserve", reason, current, incoming));
+      conflicts.push(conflict(target, reason, current, incoming));
+      if (trustedHash !== void 0) {
+        newStateFiles.push({ source_path: target.source_path, target_path: target.target_path, sha256: trustedHash });
+      }
+    }
+  }
+  for (const target of oldOnly) {
+    const current = await fileHex(join6(root, target.target_path));
+    if (current === null) {
+      continue;
+    }
+    const trustedHash = trusted.get(target.target_path);
+    const clean = trustedHash !== void 0 && current === trustedHash;
+    if (clean || options.forceManaged) {
+      const reason = clean ? "BASELINE_CLEAN" : "FORCE_MANAGED";
+      removed.push(item(target, "delete", reason, current, null));
+      ops.push({ operation: "delete", path: target.target_path });
+    } else {
+      const reason = trustedHash === void 0 ? "LEGACY_BASELINE_UNKNOWN" : "LEGACY_PROFILE_FILE_MODIFIED";
+      preserved.push(item(target, "preserve", reason, current, null));
+      conflicts.push(conflict(target, reason, current, null));
+    }
+  }
+  await refreshMarkdownBlock(root, "AGENTS.md", AGENTS_MANAGED_BLOCK_CONTENT, ops, conflicts, preserved);
+  await refreshMarkdownBlock(root, "CLAUDE.md", CLAUDE_MANAGED_BLOCK_CONTENT, ops, conflicts, preserved);
+  const profileOperation = await profileTransitionOperation(root, previousProfile, profile);
+  if (profileOperation !== null)
+    ops.push(profileOperation);
+  ops.push(await reconcileContextIndex(root, newBundle.manifest.bundle_version, bundleManifestHash));
+  const installedState = {
+    schema_version: 2,
+    profile,
+    bundle_version: newBundle.manifest.bundle_version,
+    bundle_manifest_hash: bundleManifestHash,
+    installed_at: (/* @__PURE__ */ new Date()).toISOString(),
+    files: newStateFiles.sort((left, right) => left.target_path.localeCompare(right.target_path))
+  };
+  ops.push({
+    operation: await exists3(join6(root, INSTALLED_STATE_PATH)) ? "modify" : "add",
+    path: INSTALLED_STATE_PATH,
+    content: JSON.stringify(installedState, null, 2) + "\n"
+  });
+  if (!options.dryRun) {
+    await runTransaction(root, ops, { kind: "refresh" });
+    await pruneEmptyParentDirs(root, removed.map((item2) => item2.target_path));
+  }
+  return {
+    profile,
+    previous_profile: previousProfile,
+    dry_run: options.dryRun,
+    applied: sortByTarget(applied),
+    removed: sortByTarget(removed),
+    preserved: sortByTarget(preserved),
+    unchanged: sortByTarget(unchanged),
+    conflicts: sortByTarget(conflicts)
+  };
+}
+
 // ../core/dist/proposal/diff.js
 function operationPath(operation) {
   return operation.operation === "rename" ? operation.to_path : operation.path;
@@ -1857,7 +2291,7 @@ function highEntropyCandidates(content) {
     value: match[0],
     offset: match.index,
     entropy: shannonEntropy(match[0])
-  })).filter((item) => item.entropy >= 4.5);
+  })).filter((item2) => item2.entropy >= 4.5);
 }
 
 // ../core/dist/security/scanner.js
@@ -1953,8 +2387,8 @@ function scanSensitiveFiles(files, options = {}) {
         sha256Bytes(raw.value)
       ].join("\0"));
       const overridable = raw.severity !== "high";
-      const explicit = options.overrides?.find((item) => item.finding_fingerprint === fingerprint);
-      const inline = ignores.find((item) => item.ruleId === raw.ruleId);
+      const explicit = options.overrides?.find((item2) => item2.finding_fingerprint === fingerprint);
+      const inline = ignores.find((item2) => item2.ruleId === raw.ruleId);
       const override = overridable ? explicit ?? (inline === void 0 ? void 0 : {
         finding_fingerprint: fingerprint,
         actor: "inline-annotation",
@@ -2012,28 +2446,28 @@ function generateProposalPreview(input, scanOptions = {}) {
 }
 
 // ../core/dist/push/push.js
-import { lstat as lstat2, readFile as readFile7, readdir, rm as rm4 } from "node:fs/promises";
-import { join as join8, relative, resolve as resolve4 } from "node:path";
-import { parse as parseYaml3, stringify as stringifyYaml2 } from "yaml";
+import { lstat as lstat2, readFile as readFile8, readdir as readdir4, rm as rm4 } from "node:fs/promises";
+import { join as join9, relative, resolve as resolve5 } from "node:path";
+import { parse as parseYaml4, stringify as stringifyYaml3 } from "yaml";
 
 // ../core/dist/state/baseline.js
-import { readFile as readFile5 } from "node:fs/promises";
-import { join as join6 } from "node:path";
+import { readFile as readFile6 } from "node:fs/promises";
+import { join as join7 } from "node:path";
 async function readBaseline(projectRoot) {
-  const content = await readFile5(join6(stateLayout(projectRoot).baseline, "manifest.json"), "utf8");
+  const content = await readFile6(join7(stateLayout(projectRoot).baseline, "manifest.json"), "utf8");
   return baselineManifestSchema.parse(JSON.parse(content));
 }
 
 // ../core/dist/state/locks.js
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { readFile as readFile6, rename as rename3, rm as rm3, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join7 } from "node:path";
+import { readFile as readFile7, rename as rename3, rm as rm3, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join8 } from "node:path";
 async function readLock(path) {
-  return JSON.parse(await readFile6(path, "utf8"));
+  return JSON.parse(await readFile7(path, "utf8"));
 }
 async function acquireProtocolLock(projectRoot, operation, options = {}) {
   const layout = await ensureStateLayout(projectRoot);
-  const lockPath = join7(layout.locks, "protocol.lock");
+  const lockPath = join8(layout.locks, "protocol.lock");
   const now = options.now ?? Date.now();
   const staleAfterMs = options.staleAfterMs ?? 15 * 60 * 1e3;
   const record = {
@@ -2096,7 +2530,7 @@ var MANAGED_FILES = [
   ".harness/project.yaml",
   ".harness/context-index.json"
 ];
-async function exists3(path) {
+async function exists4(path) {
   try {
     await lstat2(path);
     return true;
@@ -2108,43 +2542,43 @@ async function exists3(path) {
   }
 }
 async function walkFiles(root, current, output) {
-  if (!await exists3(current)) {
+  if (!await exists4(current)) {
     return;
   }
-  for (const item of await readdir(current, { withFileTypes: true })) {
-    const path = join8(current, item.name);
-    if (item.isSymbolicLink()) {
+  for (const item2 of await readdir4(current, { withFileTypes: true })) {
+    const path = join9(current, item2.name);
+    if (item2.isSymbolicLink()) {
       throw new PushWorkflowError("symlink is not pushable", 6, "UNSAFE_SYMLINK");
     }
-    if (item.isDirectory()) {
+    if (item2.isDirectory()) {
       await walkFiles(root, path, output);
-    } else if (item.isFile()) {
+    } else if (item2.isFile()) {
       output.push(normalizeManagedPath(relative(root, path).replaceAll("\\", "/")));
     }
   }
 }
 async function managedFiles(projectRoot) {
-  const root = resolve4(projectRoot);
+  const root = resolve5(projectRoot);
   const paths = [];
   for (const path of MANAGED_FILES) {
-    if (await exists3(join8(root, path))) {
+    if (await exists4(join9(root, path))) {
       paths.push(path);
     }
   }
   for (const path of MANAGED_ROOTS) {
-    await walkFiles(root, join8(root, path), paths);
+    await walkFiles(root, join9(root, path), paths);
   }
-  const skillsRoot = join8(root, ".claude", "skills");
-  if (await exists3(skillsRoot)) {
-    for (const item of await readdir(skillsRoot, { withFileTypes: true })) {
-      if (item.isDirectory() && item.name.startsWith("harness-")) {
-        await walkFiles(root, join8(skillsRoot, item.name), paths);
+  const skillsRoot = join9(root, ".claude", "skills");
+  if (await exists4(skillsRoot)) {
+    for (const item2 of await readdir4(skillsRoot, { withFileTypes: true })) {
+      if (item2.isDirectory() && item2.name.startsWith("harness-")) {
+        await walkFiles(root, join9(skillsRoot, item2.name), paths);
       }
     }
   }
   const result = {};
   for (const path of [...new Set(paths)].sort()) {
-    result[path] = await readFile7(join8(root, path), "utf8");
+    result[path] = await readFile8(join9(root, path), "utf8");
   }
   return result;
 }
@@ -2153,14 +2587,14 @@ function proposalBaseline(baseline) {
 }
 async function readProject(root) {
   try {
-    return projectConfigSchema.parse(parseYaml3(await readFile7(join8(root, ".harness", "project.yaml"), "utf8")));
+    return projectConfigSchema.parse(parseYaml4(await readFile8(join9(root, ".harness", "project.yaml"), "utf8")));
   } catch {
     throw new PushWorkflowError("project configuration is missing or invalid", 3, "PROJECT_CONFIG_INVALID");
   }
 }
 async function readOptionalJson(path) {
   try {
-    return JSON.parse(await readFile7(path, "utf8"));
+    return JSON.parse(await readFile8(path, "utf8"));
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return null;
@@ -2172,7 +2606,7 @@ async function clientIdFor(root, explicit) {
   if (explicit !== void 0) {
     return explicit;
   }
-  const path = join8(root, ".harness", "state", "local", "client.json");
+  const path = join9(root, ".harness", "state", "local", "client.json");
   const existing = await readOptionalJson(path);
   if (typeof existing?.client_id === "string" && /^cli_[A-Za-z0-9_-]+$/.test(existing.client_id)) {
     return existing.client_id;
@@ -2244,7 +2678,7 @@ async function bindProject(root, project, baseline, projectId) {
     {
       operation: "modify",
       path: ".harness/project.yaml",
-      content: stringifyYaml2(nextProject, { sortMapEntries: true })
+      content: stringifyYaml3(nextProject, { sortMapEntries: true })
     },
     {
       operation: "modify",
@@ -2255,7 +2689,7 @@ async function bindProject(root, project, baseline, projectId) {
   return { project: nextProject, baseline: nextBaseline };
 }
 async function pushProject(options) {
-  const root = resolve4(options.projectRoot);
+  const root = resolve5(options.projectRoot);
   let project = await readProject(root);
   let baseline = await readBaseline(root);
   const profile = parseHarnessProfile(project.project.profiles[0]);
@@ -2291,7 +2725,7 @@ async function pushProject(options) {
   if (parsedServerUrl.protocol !== "https:") {
     throw new PushWorkflowError("server_url must use HTTPS", 3, "SERVER_URL_INVALID");
   }
-  const workflowPath = join8(root, ".harness", "state", "local", "push-workflow.json");
+  const workflowPath = join9(root, ".harness", "state", "local", "push-workflow.json");
   const priorWorkflow = await readOptionalJson(workflowPath);
   const provisionalRequestId = priorWorkflow?.local_project_key === project.project.local_project_key ? priorWorkflow.request_id : uuidV7();
   const lock = await acquireProtocolLock(root, "push", { requestId: provisionalRequestId });
@@ -2382,7 +2816,7 @@ async function pushProject(options) {
       }
     }
     const finalized = await client.finalizeProposal(session.session_id, { schema_version: 1, manifest_sha256: proposalManifestHash }, requestId, workflow.finalize_idempotency_key);
-    await atomicWriteJson(join8(root, ".harness", "state", "local", "push-results", finalized.proposal_id + ".json"), {
+    await atomicWriteJson(join9(root, ".harness", "state", "local", "push-results", finalized.proposal_id + ".json"), {
       schema_version: 1,
       request_id: requestId,
       project_id: projectId,
@@ -2407,12 +2841,75 @@ async function pushProject(options) {
   }
 }
 
+// ../core/dist/state/cleanup.js
+import { readFile as readFile9, readdir as readdir5, rm as rm5 } from "node:fs/promises";
+import { join as join10 } from "node:path";
+function isSafeEntryName(name) {
+  return name.length > 0 && !name.includes("/") && !name.includes("\\") && name !== "." && name !== ".." && !name.includes("\0");
+}
+async function listDir(path) {
+  try {
+    return await readdir5(path);
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+}
+async function cleanupProject(options) {
+  const layout = stateLayout(options.projectRoot);
+  const pruned = [];
+  const removedCache = [];
+  const committedByKind = /* @__PURE__ */ new Map();
+  for (const name of await listDir(layout.transactions)) {
+    if (!isSafeEntryName(name))
+      continue;
+    let journal;
+    try {
+      journal = JSON.parse(await readFile9(join10(layout.transactions, name, "journal.json"), "utf8"));
+    } catch {
+      continue;
+    }
+    if (journal.state === "committed" && typeof journal.kind === "string") {
+      const arr = committedByKind.get(journal.kind) ?? [];
+      arr.push({ id: name, createdAt: typeof journal.created_at === "string" ? journal.created_at : "" });
+      committedByKind.set(journal.kind, arr);
+    }
+  }
+  for (const arr of committedByKind.values()) {
+    arr.sort((left, right) => right.createdAt.localeCompare(left.createdAt));
+    for (let index = 1; index < arr.length; index += 1) {
+      const entry = arr[index];
+      if (entry === void 0)
+        continue;
+      pruned.push(entry.id);
+      if (!options.dryRun) {
+        await rm5(join10(layout.transactions, entry.id), { recursive: true, force: true });
+      }
+    }
+  }
+  for (const name of await listDir(layout.serverArtifacts)) {
+    if (!isSafeEntryName(name))
+      continue;
+    removedCache.push(name);
+    if (!options.dryRun) {
+      await rm5(join10(layout.serverArtifacts, name), { recursive: true, force: true });
+    }
+  }
+  return {
+    dry_run: options.dryRun,
+    pruned_transactions: pruned.sort(),
+    removed_cache: removedCache.sort()
+  };
+}
+
 // ../core/dist/skill/frontmatter.js
-import { parse as parseYaml4 } from "yaml";
+import { parse as parseYaml5 } from "yaml";
 import { z as z12 } from "zod";
 
 // ../core/dist/skill/fixer.js
-import { parse as parseYaml5, stringify as stringifyYaml3 } from "yaml";
+import { parse as parseYaml6, stringify as stringifyYaml4 } from "yaml";
 
 // ../core/dist/skill/agents.js
 var AGENT_DESCRIPTORS = {
@@ -2451,10 +2948,10 @@ var AGENT_DESCRIPTORS = {
 var INSTALLABLE_AGENTS = Object.keys(AGENT_DESCRIPTORS).filter((agent) => AGENT_DESCRIPTORS[agent]?.installable === true);
 
 // ../core/dist/transaction/recovery.js
-import { readFile as readFile8, readdir as readdir2, rm as rm5, stat as stat3 } from "node:fs/promises";
-import { join as join9 } from "node:path";
+import { readFile as readFile10, readdir as readdir6, rm as rm6, stat as stat4 } from "node:fs/promises";
+import { join as join11 } from "node:path";
 async function recoverTransaction(projectRoot, transactionId) {
-  const journal = JSON.parse(await readFile8(join9(stateLayout(projectRoot).transactions, transactionId, "journal.json"), "utf8"));
+  const journal = JSON.parse(await readFile10(join11(stateLayout(projectRoot).transactions, transactionId, "journal.json"), "utf8"));
   if (journal.state === "committed") {
     return { transactionId, status: "committed" };
   }
@@ -2471,7 +2968,7 @@ async function listTransactions(projectRoot) {
   const root = stateLayout(projectRoot).transactions;
   let names;
   try {
-    names = await readdir2(root);
+    names = await readdir6(root);
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return [];
@@ -2481,7 +2978,7 @@ async function listTransactions(projectRoot) {
   const transactions = [];
   for (const transactionId of names) {
     try {
-      const journal = JSON.parse(await readFile8(join9(root, transactionId, "journal.json"), "utf8"));
+      const journal = JSON.parse(await readFile10(join11(root, transactionId, "journal.json"), "utf8"));
       transactions.push({
         transactionId,
         kind: journal.kind,
@@ -2494,11 +2991,11 @@ async function listTransactions(projectRoot) {
   return transactions.sort((left, right) => right.createdAt.localeCompare(left.createdAt));
 }
 async function pendingTransactions(projectRoot) {
-  return (await listTransactions(projectRoot)).filter((item) => RECOVERY_STATES.has(item.state));
+  return (await listTransactions(projectRoot)).filter((item2) => RECOVERY_STATES.has(item2.state));
 }
 async function pathExists(path) {
   try {
-    await stat3(path);
+    await stat4(path);
     return true;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -2508,17 +3005,17 @@ async function pathExists(path) {
   }
 }
 async function rollbackLatestCommittedUpdate(projectRoot) {
-  const latest = (await listTransactions(projectRoot)).find((item) => item.kind === "update" && item.state === "committed");
+  const latest = (await listTransactions(projectRoot)).find((item2) => item2.kind === "update" && item2.state === "committed");
   if (latest === void 0) {
     throw new Error("no committed update transaction is available for rollback");
   }
-  const transactionRoot = join9(stateLayout(projectRoot).transactions, latest.transactionId);
-  const journal = JSON.parse(await readFile8(join9(transactionRoot, "journal.json"), "utf8"));
-  const after = JSON.parse(await readFile8(join9(transactionRoot, "after", "manifest.json"), "utf8"));
+  const transactionRoot = join11(stateLayout(projectRoot).transactions, latest.transactionId);
+  const journal = JSON.parse(await readFile10(join11(transactionRoot, "journal.json"), "utf8"));
+  const after = JSON.parse(await readFile10(join11(transactionRoot, "after", "manifest.json"), "utf8"));
   for (const entry of after) {
-    const target = join9(projectRoot, entry.path);
-    const exists5 = await pathExists(target);
-    if (exists5 !== entry.exists || exists5 && await sha256File(target) !== entry.hash) {
+    const target = join11(projectRoot, entry.path);
+    const exists6 = await pathExists(target);
+    if (exists6 !== entry.exists || exists6 && await sha256File(target) !== entry.hash) {
       throw new Error("cannot rollback dirty path: " + entry.path);
     }
   }
@@ -2529,16 +3026,16 @@ async function rollbackLatestCommittedUpdate(projectRoot) {
       continue;
     }
     seen.add(snapshot.path);
-    const target = join9(projectRoot, snapshot.path);
-    const exists5 = await pathExists(target);
+    const target = join11(projectRoot, snapshot.path);
+    const exists6 = await pathExists(target);
     if (snapshot.existed && snapshot.snapshot_name !== null) {
-      const content = await readFile8(join9(transactionRoot, "before", snapshot.snapshot_name));
+      const content = await readFile10(join11(transactionRoot, "before", snapshot.snapshot_name));
       operations.push({
-        operation: exists5 ? "modify" : "add",
+        operation: exists6 ? "modify" : "add",
         path: snapshot.path,
         content
       });
-    } else if (exists5) {
+    } else if (exists6) {
       operations.push({ operation: "delete", path: snapshot.path });
     }
   }
@@ -2549,23 +3046,23 @@ async function rollbackLatestCommittedUpdate(projectRoot) {
 }
 async function cleanupOldTransactions(projectRoot, now = /* @__PURE__ */ new Date()) {
   const transactions = await listTransactions(projectRoot);
-  const committedUpdates = transactions.filter((item) => item.kind === "update" && item.state === "committed");
-  const keepCommitted = new Set(committedUpdates.slice(0, 10).map((item) => item.transactionId));
+  const committedUpdates = transactions.filter((item2) => item2.kind === "update" && item2.state === "committed");
+  const keepCommitted = new Set(committedUpdates.slice(0, 10).map((item2) => item2.transactionId));
   const removed = [];
-  for (const item of transactions) {
-    if (RECOVERY_STATES.has(item.state) || keepCommitted.has(item.transactionId)) {
+  for (const item2 of transactions) {
+    if (RECOVERY_STATES.has(item2.state) || keepCommitted.has(item2.transactionId)) {
       continue;
     }
-    const ageDays = (now.getTime() - Date.parse(item.createdAt)) / 864e5;
-    const removable = item.state === "rolled_back" ? ageDays > 7 : item.state === "committed" && ageDays > 30;
+    const ageDays = (now.getTime() - Date.parse(item2.createdAt)) / 864e5;
+    const removable = item2.state === "rolled_back" ? ageDays > 7 : item2.state === "committed" && ageDays > 30;
     if (!removable) {
       continue;
     }
-    await rm5(join9(stateLayout(projectRoot).transactions, item.transactionId), {
+    await rm6(join11(stateLayout(projectRoot).transactions, item2.transactionId), {
       recursive: true,
       force: true
     });
-    removed.push(item.transactionId);
+    removed.push(item2.transactionId);
   }
   return removed;
 }
@@ -2593,9 +3090,9 @@ function managedBlockDirty(currentContent, managedBlockHash) {
 }
 
 // ../core/dist/update/update.js
-import { lstat as lstat3, readFile as readFile9, rm as rm6 } from "node:fs/promises";
-import { join as join10, resolve as resolve5 } from "node:path";
-import { parse as parseYaml6 } from "yaml";
+import { lstat as lstat3, readFile as readFile11, rm as rm7 } from "node:fs/promises";
+import { join as join12, resolve as resolve6 } from "node:path";
+import { parse as parseYaml7 } from "yaml";
 var UpdateWorkflowError = class extends Error {
   exitCode;
   code;
@@ -2618,7 +3115,7 @@ async function pathExists2(path) {
   }
 }
 async function optionalContent(path) {
-  return await pathExists2(path) ? readFile9(path, "utf8") : null;
+  return await pathExists2(path) ? readFile11(path, "utf8") : null;
 }
 function manifestPayloadHash(manifest) {
   const payload = { ...manifest };
@@ -2636,14 +3133,14 @@ async function loadBlob(root, client, artifactId, operation, requestId, dryRun)
     return null;
   }
   const hash = operation.content_sha256;
-  const cacheRoot = join10(root, ".harness", "cache", "server-artifacts", artifactId);
-  const cachePath = join10(cacheRoot, "blobs", hash.replace(":", "_"));
+  const cacheRoot = join12(root, ".harness", "cache", "server-artifacts", artifactId);
+  const cachePath = join12(cacheRoot, "blobs", hash.replace(":", "_"));
   if (await pathExists2(cachePath) && await sha256File(cachePath) === hash) {
-    return readFile9(cachePath, "utf8");
+    return readFile11(cachePath, "utf8");
   }
   const bytes = await client.downloadArtifactBlob(artifactId, hash, requestId);
   if (bytes.byteLength !== operation.size_bytes || sha256Bytes(bytes) !== hash) {
-    await rm6(cachePath, { force: true });
+    await rm7(cachePath, { force: true });
     throw new UpdateWorkflowError("artifact blob size or hash mismatch", 4, "ARTIFACT_HASH_MISMATCH");
   }
   if (!dryRun) {
@@ -2662,34 +3159,34 @@ function nextBaselineEntry(operation, finalContent, projectVersion) {
     ...block === null ? {} : { managed_block_hash: sha256Bytes(block) }
   };
 }
-function transactionOperation(item) {
-  if (item.equivalent) {
+function transactionOperation(item2) {
+  if (item2.equivalent) {
     return null;
   }
-  const operation = item.operation;
+  const operation = item2.operation;
   const target = operationTargetPath(operation);
   if (operation.operation === "delete") {
-    return item.finalContent === null ? { operation: "delete", path: target } : { operation: "modify", path: target, content: item.finalContent };
+    return item2.finalContent === null ? { operation: "delete", path: target } : { operation: "modify", path: target, content: item2.finalContent };
   }
   if (operation.operation === "rename") {
     return {
       operation: "rename",
       from_path: operation.from_path,
       to_path: operation.to_path,
-      content: item.finalContent ?? item.content ?? ""
+      content: item2.finalContent ?? item2.content ?? ""
     };
   }
   return {
     operation: "modify",
     path: target,
-    content: item.finalContent ?? item.content ?? ""
+    content: item2.finalContent ?? item2.content ?? ""
   };
 }
 async function updateProject(options) {
-  const root = resolve5(options.projectRoot);
+  const root = resolve6(options.projectRoot);
   let project;
   try {
-    project = projectConfigSchema.parse(parseYaml6(await readFile9(join10(root, ".harness", "project.yaml"), "utf8")));
+    project = projectConfigSchema.parse(parseYaml7(await readFile11(join12(root, ".harness", "project.yaml"), "utf8")));
   } catch {
     throw new UpdateWorkflowError("project configuration is invalid", 3, "PROJECT_CONFIG_INVALID");
   }
@@ -2774,8 +3271,8 @@ async function updateProject(options) {
         skipped.push({ path: target, operation: operation.operation, reason: "baseline-diverged" });
         continue;
       }
-      const sourceContent = await optionalContent(join10(root, source));
-      const targetContent = target === source ? sourceContent : await optionalContent(join10(root, target));
+      const sourceContent = await optionalContent(join12(root, source));
+      const targetContent = target === source ? sourceContent : await optionalContent(join12(root, target));
       const incoming = blobs.get(operation) ?? null;
       const incomingHash = contentHash(operation);
       let equivalent = incomingHash !== null && targetContent !== null && sha256Bytes(targetContent) === incomingHash;
@@ -2820,7 +3317,7 @@ async function updateProject(options) {
       }
       prepared.push({ operation, content: incoming, finalContent, equivalent });
     }
-    const applied = prepared.map((item) => operationTargetPath(item.operation));
+    const applied = prepared.map((item2) => operationTargetPath(item2.operation));
     if (options.dryRun) {
       return {
         requestId,
@@ -2834,18 +3331,18 @@ async function updateProject(options) {
         dryRun: true
       };
     }
-    await atomicWriteJson(join10(root, ".harness", "cache", "server-artifacts", manifest.artifact_id, "manifest.json"), manifest);
+    await atomicWriteJson(join12(root, ".harness", "cache", "server-artifacts", manifest.artifact_id, "manifest.json"), manifest);
     const lock = await acquireProtocolLock(root, "update", { requestId });
     try {
       const nextBaseline = baselineManifestSchema.parse(structuredClone(baseline));
-      for (const item of prepared) {
-        const target = operationTargetPath(item.operation);
-        nextBaseline.files[target] = nextBaselineEntry(item.operation, item.finalContent, manifest.project_version);
-        if (item.operation.operation === "rename") {
-          nextBaseline.files[item.operation.from_path] = {
+      for (const item2 of prepared) {
+        const target = operationTargetPath(item2.operation);
+        nextBaseline.files[target] = nextBaselineEntry(item2.operation, item2.finalContent, manifest.project_version);
+        if (item2.operation.operation === "rename") {
+          nextBaseline.files[item2.operation.from_path] = {
             baseline_hash: null,
             local_hash_at_apply: null,
-            file_kind: item.operation.file_kind,
+            file_kind: item2.operation.file_kind,
             last_applied_version: manifest.project_version,
             deleted: true
           };
@@ -2867,7 +3364,7 @@ async function updateProject(options) {
         skipped,
         transaction_id: transactionId
       };
-      const operations = prepared.map((item) => transactionOperation(item)).filter((item) => item !== null);
+      const operations = prepared.map((item2) => transactionOperation(item2)).filter((item2) => item2 !== null);
       operations.push({
         operation: "modify",
         path: ".harness/state/baseline/manifest.json",
@@ -2915,8 +3412,8 @@ async function updateProject(options) {
 }
 
 // src/config/init-config.ts
-import { isAbsolute as isAbsolute2, join as join11 } from "node:path";
-import { readFile as readFile10 } from "node:fs/promises";
+import { isAbsolute as isAbsolute2, join as join13 } from "node:path";
+import { readFile as readFile12 } from "node:fs/promises";
 var InitConfigurationError = class extends Error {
   exitCode;
   constructor(message, exitCode = 3, options) {
@@ -2934,9 +3431,9 @@ function normalizeProfile(value) {
 async function resolveInitConfig(cwd, flags, promptMissing) {
   let fileConfig = {};
   if (flags.config !== void 0) {
-    const path = isAbsolute2(flags.config) ? flags.config : join11(cwd, flags.config);
+    const path = isAbsolute2(flags.config) ? flags.config : join13(cwd, flags.config);
     try {
-      fileConfig = JSON.parse(await readFile10(path, "utf8"));
+      fileConfig = JSON.parse(await readFile12(path, "utf8"));
     } catch (error) {
       throw new InitConfigurationError(
         "unable to read init config: " + (error instanceof Error ? error.message : String(error)),
@@ -2978,8 +3475,175 @@ function serializeCliResult(result) {
   return JSON.stringify(result) + "\n";
 }
 
+// src/commands/refresh.ts
+import { readFile as readFile13 } from "node:fs/promises";
+import { join as join14 } from "node:path";
+import { parse as parseYaml8 } from "yaml";
+async function detectProject(root) {
+  let content;
+  try {
+    content = await readFile13(join14(root, ".harness", "project.yaml"), "utf8");
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return { status: "absent" };
+    }
+    throw error;
+  }
+  const parsed = projectConfigSchema.safeParse(parseYaml8(content));
+  if (!parsed.success) {
+    return { status: "invalid" };
+  }
+  return { status: "valid", config: parsed.data };
+}
+function parseProfile(value, current) {
+  if (value === void 0 || value === "") {
+    return current;
+  }
+  if (value === "1" || value === "general") return "general";
+  if (value === "2" || value === "java") return "java";
+  throw new Error("profile must be general or java");
+}
+function summarize(result) {
+  const items = [
+    ...result.applied.map((item2) => ({ ...item2, status: result.dry_run ? "planned" : "applied" })),
+    ...result.removed.map((item2) => ({ ...item2, status: result.dry_run ? "planned" : "removed" })),
+    ...result.preserved.map((item2) => ({ ...item2, status: "preserved" })),
+    ...result.unchanged.map((item2) => ({ ...item2, status: "unchanged" }))
+  ];
+  const exitCode = result.conflicts.length > 0 ? 5 : 0;
+  return {
+    schema_version: 1,
+    command: "refresh",
+    request_id: uuidV7(),
+    dry_run: result.dry_run,
+    ok: exitCode === 0,
+    exit_code: exitCode,
+    project_id: null,
+    summary: {
+      applied: result.dry_run ? 0 : result.applied.length,
+      removed: result.dry_run ? 0 : result.removed.length,
+      preserved: result.preserved.length,
+      unchanged: result.unchanged.length,
+      conflicts: result.conflicts.length
+    },
+    items,
+    warnings: result.conflicts,
+    errors: []
+  };
+}
+function renderProfileTransitionPreview(result) {
+  const items = [
+    ...result.applied,
+    ...result.removed,
+    ...result.preserved,
+    ...result.unchanged
+  ];
+  return "Preview profile transition:\n" + items.map((item2) => `- ${item2.action}: ${item2.target_path} (${item2.reason})`).join("\n") + "\n";
+}
+async function runRefresh(options, dependencies) {
+  const requestId = uuidV7();
+  const detection = await detectProject(dependencies.cwd);
+  if (detection.status === "absent") {
+    dependencies.stderr("Hunter Harness is not initialized; run `hunter-harness` first.\n");
+    return 3;
+  }
+  if (detection.status === "invalid") {
+    dependencies.stderr("PROJECT_CONFIG_INVALID: .harness/project.yaml is invalid\n");
+    return 3;
+  }
+  const currentProfile = detection.config.project.profiles[0] ?? "general";
+  let targetProfile;
+  try {
+    targetProfile = parseProfile(options.profile, currentProfile);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    dependencies.stderr(message + "\n");
+    return 3;
+  }
+  const dryRun = options.dryRun === true;
+  if (targetProfile !== currentProfile && !dryRun) {
+    try {
+      const preview = await refreshProject({
+        projectRoot: dependencies.cwd,
+        resourcesRoot: dependencies.resourcesRoot,
+        profile: targetProfile,
+        dryRun: true,
+        forceManaged: options.forceManaged === true
+      });
+      const rendered = renderProfileTransitionPreview(preview);
+      if (options.json === true) {
+        dependencies.stderr(rendered);
+      } else {
+        dependencies.stdout(rendered);
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      dependencies.stderr(message + "\n");
+      return 1;
+    }
+  }
+  if (options.confirmed !== true) {
+    if (options.nonInteractive === true) {
+      if (!options.yes && !dryRun) {
+        dependencies.stderr("non-interactive refresh requires --yes\n");
+        return 2;
+      }
+    } else if (!options.yes && !dryRun) {
+      const label = targetProfile === currentProfile ? `Refresh current profile (${currentProfile})` : `Switch profile ${currentProfile} -> ${targetProfile}`;
+      const answer = await dependencies.prompt(`${label}? [y/N]: `);
+      if (!/^(?:y|yes)$/i.test(answer.trim())) {
+        return 2;
+      }
+    }
+  }
+  try {
+    const result = await refreshProject({
+      projectRoot: dependencies.cwd,
+      resourcesRoot: dependencies.resourcesRoot,
+      profile: targetProfile,
+      dryRun,
+      forceManaged: options.forceManaged === true
+    });
+    const output = summarize(result);
+    if (options.json === true) {
+      dependencies.stdout(serializeCliResult({ ...output, request_id: requestId }));
+    } else {
+      const parts = [];
+      if (result.applied.length > 0) parts.push(`applied ${result.applied.length}`);
+      if (result.removed.length > 0) parts.push(`removed ${result.removed.length}`);
+      if (result.preserved.length > 0) parts.push(`preserved ${result.preserved.length}`);
+      if (result.unchanged.length > 0) parts.push(`unchanged ${result.unchanged.length}`);
+      dependencies.stdout(`Harness refresh (${targetProfile}): ${parts.join(", ") || "no changes"}.
+`);
+    }
+    return output.exit_code;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    dependencies.stderr(message + "\n");
+    if (options.json === true) {
+      dependencies.stdout(serializeCliResult({
+        schema_version: 1,
+        command: "refresh",
+        request_id: requestId,
+        dry_run: dryRun,
+        ok: false,
+        exit_code: 1,
+        project_id: null,
+        summary: { applied: 0, removed: 0, preserved: 0, unchanged: 0, conflicts: 0 },
+        items: [],
+        warnings: [],
+        errors: [{ message }]
+      }));
+    }
+    return 1;
+  }
+}
+
 // src/commands/configure.ts
-async function runConfigure(options, dependencies) {
+function otherProfile(current) {
+  return current === "general" ? "java" : "general";
+}
+async function runFirstInstall(options, dependencies) {
   const requestId = uuidV7();
   try {
     const config = await resolveInitConfig(
@@ -3036,6 +3700,123 @@ async function runConfigure(options, dependencies) {
     return exitCode;
   }
 }
+async function runExistingProject(options, dependencies, currentProfile) {
+  const refreshOptions = {};
+  if (options.profile !== void 0) refreshOptions.profile = options.profile;
+  if (options.nonInteractive !== void 0) refreshOptions.nonInteractive = options.nonInteractive;
+  if (options.yes !== void 0) refreshOptions.yes = options.yes;
+  if (options.dryRun !== void 0) refreshOptions.dryRun = options.dryRun;
+  if (options.json !== void 0) refreshOptions.json = options.json;
+  if (options.forceManaged !== void 0) refreshOptions.forceManaged = options.forceManaged;
+  if (options.nonInteractive === true) {
+    return runRefresh(refreshOptions, dependencies);
+  }
+  const menu = await dependencies.prompt(
+    `Hunter Harness \u5DF2\u521D\u59CB\u5316\uFF08profile: ${currentProfile}\uFF09\u3002
+1. Refresh current profile\uFF08\u9ED8\u8BA4\u4E14\u63A8\u8350\uFF09
+2. Switch to the other profile
+3. Cancel
+\u8BF7\u9009\u62E9 [1]: `
+  );
+  const choice = menu.trim();
+  if (choice === "3" || /^c/i.test(choice)) {
+    return 2;
+  }
+  if (choice === "2" || /^s/i.test(choice)) {
+    refreshOptions.profile = otherProfile(currentProfile);
+  } else {
+    refreshOptions.profile = currentProfile;
+  }
+  refreshOptions.confirmed = true;
+  return runRefresh(refreshOptions, dependencies);
+}
+async function runConfigure(options, dependencies) {
+  const detection = await detectProject(dependencies.cwd);
+  if (detection.status === "invalid") {
+    dependencies.stderr("PROJECT_CONFIG_INVALID: .harness/project.yaml is invalid; not initializing over it.\n");
+    if (options.json === true) {
+      dependencies.stdout(serializeCliResult({
+        schema_version: 1,
+        command: "configure",
+        request_id: uuidV7(),
+        dry_run: options.dryRun === true,
+        ok: false,
+        exit_code: 3,
+        project_id: null,
+        summary: { planned: 0, applied: 0 },
+        items: [],
+        warnings: [],
+        errors: [{ code: "PROJECT_CONFIG_INVALID", message: "project.yaml is invalid" }]
+      }));
+    }
+    return 3;
+  }
+  if (detection.status === "valid") {
+    const currentProfile = detection.config.project.profiles[0] ?? "general";
+    return runExistingProject(options, dependencies, currentProfile);
+  }
+  return runFirstInstall(options, dependencies);
+}
+
+// src/commands/cleanup.ts
+async function runCleanup(options, dependencies) {
+  const requestId = uuidV7();
+  const dryRun = options.dryRun === true;
+  if (options.nonInteractive === true && options.yes !== true && !dryRun) {
+    dependencies.stderr("non-interactive cleanup requires --yes\n");
+    return 2;
+  }
+  try {
+    const result = await cleanupProject({ projectRoot: dependencies.cwd, dryRun });
+    const output = {
+      schema_version: 1,
+      command: "cleanup",
+      request_id: requestId,
+      dry_run: result.dry_run,
+      ok: true,
+      exit_code: 0,
+      project_id: null,
+      summary: {
+        pruned_transactions: result.pruned_transactions.length,
+        removed_cache: result.removed_cache.length
+      },
+      items: [
+        ...result.pruned_transactions.map((id) => ({ path: id, status: "pruned" })),
+        ...result.removed_cache.map((id) => ({ path: id, status: "removed" }))
+      ],
+      warnings: [],
+      errors: []
+    };
+    if (options.json === true) {
+      dependencies.stdout(serializeCliResult(output));
+    } else {
+      dependencies.stdout(
+        `Harness cleanup: pruned ${result.pruned_transactions.length} transaction(s), removed ${result.removed_cache.length} cache entr(ies).
+`
+      );
+    }
+    return 0;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    dependencies.stderr(message + "\n");
+    if (options.json === true) {
+      dependencies.stdout(serializeCliResult({
+        schema_version: 1,
+        command: "cleanup",
+        request_id: requestId,
+        dry_run: dryRun,
+        ok: false,
+        exit_code: 1,
+        project_id: null,
+        summary: { pruned_transactions: 0, removed_cache: 0 },
+        items: [],
+        warnings: [],
+        errors: [{ message }]
+      }));
+    }
+    return 1;
+  }
+}
 
 // src/commands/push.ts
 async function runPush(options, dependencies) {
@@ -3146,7 +3927,7 @@ async function runUpdate(options, dependencies) {
       result = await execute(options.dryRun === true);
     }
     const applied = new Set(result.applied);
-    const skippedByPath = new Map(result.skipped.map((item) => [item.path, item]));
+    const skippedByPath = new Map(result.skipped.map((item2) => [item2.path, item2]));
     const items = result.operations.map((operation) => {
       const path = operation.operation === "rename" ? operation.to_path : operation.path;
       const skipped = skippedByPath.get(path);
@@ -3208,11 +3989,11 @@ async function runUpdate(options, dependencies) {
 }
 
 // src/commands/recovery.ts
-import { stat as stat4 } from "node:fs/promises";
-import { join as join12 } from "node:path";
-async function exists4(path) {
+import { stat as stat5 } from "node:fs/promises";
+import { join as join15 } from "node:path";
+async function exists5(path) {
   try {
-    await stat4(path);
+    await stat5(path);
     return true;
   } catch {
     return false;
@@ -3269,7 +4050,7 @@ async function runRecoveryMenuIfApplicable(options, dependencies) {
       return 5;
     }
   }
-  const initialized = await exists4(join12(dependencies.cwd, ".harness", "project.yaml"));
+  const initialized = await exists5(join15(dependencies.cwd, ".harness", "project.yaml"));
   if (!initialized || options.nonInteractive === true || explicitConfigure(options)) {
     return null;
   }
@@ -3337,7 +4118,7 @@ function addCommonOptions(command) {
 }
 async function runCli(argv, overrides = {}) {
   const dependencies = defaultDependencies(overrides);
-  const program = addCommonOptions(new Command()).name("hunter-harness").description("Local-first, server-governed agent harness").option("--profile <name>").option("--config <file>").showHelpAfterError().exitOverride().configureOutput({
+  const program = addCommonOptions(new Command()).name("hunter-harness").description("Local-first, server-governed agent harness").option("--profile <name>").option("--config <file>").option("--force-managed").showHelpAfterError().exitOverride().configureOutput({
     writeOut: dependencies.stdout,
     writeErr: dependencies.stderr
   });
@@ -3350,6 +4131,12 @@ async function runCli(argv, overrides = {}) {
     }
     exitCode = await runConfigure(options, dependencies);
   });
+  addCommonOptions(program.command("refresh")).description("Local Conservative Refresh of an installed Harness project").option("--profile <name>").option("--force-managed").action(async (options) => {
+    exitCode = await runRefresh(
+      { ...program.opts(), ...options },
+      dependencies
+    );
+  });
   addCommonOptions(program.command("update")).description("Apply approved server artifacts").action(async (options) => {
     exitCode = await runUpdate(
       { ...program.opts(), ...options },
@@ -3359,6 +4146,12 @@ async function runCli(argv, overrides = {}) {
   addCommonOptions(program.command("push")).description("Create a governed proposal").action(async (options) => {
     exitCode = await runPush({ ...program.opts(), ...options }, dependencies);
   });
+  addCommonOptions(program.command("cleanup")).description("Prune completed transactions and obsolete server cache").action(async (options) => {
+    exitCode = await runCleanup(
+      { ...program.opts(), ...options },
+      dependencies
+    );
+  });
   try {
     await program.parseAsync(["node", "hunter-harness", ...argv]);
     return exitCode;