hunter-harness 0.2.0 → 0.2.2

package/dist/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/bin.ts
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { pathToFileURL } from "node:url";
 import { createInterface } from "node:readline/promises";
 import { Command, CommanderError } from "commander";
 
@@ -133,8 +133,14 @@ var baselineManifestSchema = z2.object({
   project_id: z2.string().regex(/^prj_/).nullable(),
   complete_project_version: z2.string().regex(/^pv_/).nullable(),
   artifact_manifest_hash: sha256Schema.nullable(),
+  latest_artifact_id: z2.string().regex(/^art_/).nullable().optional(),
   files: z2.record(z2.string(), baselineFileSchema)
 }).strict();
+var finalizeProposalSchema = z2.object({
+  schema_version: z2.literal(1),
+  manifest_sha256: sha256Schema,
+  base_artifact_id: z2.string().regex(/^art_/).nullable()
+}).strict();
 var requestMetadataSchema = z2.object({
   request_id: z2.uuid(),
   idempotency_key: z2.uuid(),
@@ -286,7 +292,21 @@ var registrySkillSummarySchema = z3.object({
   agents: z3.array(agentSkillConfigSchema),
   revision: z3.number().int().positive(),
   created_at: z3.iso.datetime(),
-  updated_at: z3.iso.datetime()
+  updated_at: z3.iso.datetime(),
+  // npm 发布记录（registry snapshot 可选字段，旧快照缺省为 []）
+  npmReleases: z3.array(z3.lazy(() => npmReleaseRecordSchema)).optional().default([])
+}).strict();
+var npmReleaseStatusSchema = z3.enum(["published", "failed", "conflict"]);
+var npmReleaseRecordSchema = z3.object({
+  version: registrySemverSchema,
+  packageName: z3.string().min(1),
+  status: npmReleaseStatusSchema,
+  publishedAt: z3.iso.datetime(),
+  error: z3.string().nullable().optional().default(null)
+}).strict();
+var npmReleaseResponseSchema = z3.object({
+  slug: registrySlugSchema,
+  release: npmReleaseRecordSchema
 }).strict();
 var registrySkillDetailSchema = registrySkillSummarySchema.extend({
   ir: z3.unknown().optional(),
@@ -313,34 +333,6 @@ var registryTagSchema = z3.object({
   created_at: z3.iso.datetime(),
   updated_at: z3.iso.datetime()
 }).strict();
-var registryWorkflowSchema = z3.object({
-  workflow_id: z3.string().regex(/^wf_/),
-  key: registrySlugSchema,
-  name: z3.string().min(1).max(120),
-  description: z3.string().min(1).max(1e3),
-  profile: registrySlugSchema,
-  default_agent: registryAgentSchema,
-  enabled: z3.boolean(),
-  skill_slugs: z3.array(registrySlugSchema),
-  revision: z3.number().int().positive(),
-  created_at: z3.iso.datetime(),
-  updated_at: z3.iso.datetime()
-}).strict();
-var registryWorkflowMutationSchema = z3.object({
-  key: registrySlugSchema,
-  name: z3.string().min(1).max(120),
-  description: z3.string().min(1).max(1e3),
-  profile: registrySlugSchema,
-  default_agent: registryAgentSchema,
-  enabled: z3.boolean(),
-  skill_slugs: z3.array(registrySlugSchema)
-}).strict();
-var registryProjectWorkflowBindingSchema = z3.object({
-  project_id: z3.string().regex(/^prj_/),
-  workflow_id: z3.string().regex(/^wf_/),
-  revision: z3.number().int().positive(),
-  updated_at: z3.iso.datetime()
-}).strict();
 
 // ../contracts/dist/ai-config.js
 var aiProviderApiFormatSchema = z4.enum(["openai", "anthropic", "custom"]);
@@ -458,7 +450,10 @@ var apiErrorCodeSchema = z5.enum([
   "DRAFT_NOT_FOUND",
   "REVISION_CONFLICT",
   "ADAPTER_NOT_INSTALLABLE",
-  "WORKFLOW_PACKAGE_REDIRECT"
+  "WORKFLOW_PACKAGE_REDIRECT",
+  "NPM_PUBLISH_NOT_CONFIGURED",
+  "NPM_PUBLISH_NOT_PUBLISHED",
+  "NPM_PUBLISH_CONFLICT"
 ]);
 var apiErrorEnvelopeSchema = z5.object({
   error: z5.object({
@@ -480,46 +475,90 @@ var cliExitCodeSchema = z5.union([
   z5.literal(8)
 ]);
 
-// ../contracts/dist/fix.js
+// ../contracts/dist/external-skill.js
 import { z as z6 } from "zod";
-var fixActionSchema = z6.enum(["auto", "confirm", "suggest"]);
-var fixPlanItemSchema = z6.object({
-  checkId: z6.string(),
+var externalSkillSourceTypeSchema = z6.enum(["npm", "github"]);
+var externalSkillSourceSchema = z6.object({
+  type: externalSkillSourceTypeSchema,
+  /** npm 包名，或规范化后的 `owner/repo` */
+  ref: z6.string().min(1)
+}).strict();
+var externalSkillSnapshotSchema = z6.object({
+  name: z6.string(),
+  description: z6.string(),
+  version: z6.string().nullable(),
+  readme: z6.string().nullable(),
+  installCommand: z6.string(),
+  license: z6.string().nullable(),
+  homepage: z6.string().nullable(),
+  releaseUrl: z6.string().nullable(),
+  fetchedAt: z6.string()
+}).strict();
+var externalSkillSchema = z6.object({
+  id: z6.string().regex(/^ext_/),
+  source: externalSkillSourceSchema,
+  snapshot: externalSkillSnapshotSchema,
+  curationNote: z6.string(),
+  tags: z6.array(z6.string()),
+  updateAvailable: z6.boolean(),
+  lastCheckedAt: z6.string(),
+  revision: z6.number().int().positive(),
+  created_at: z6.string(),
+  updated_at: z6.string()
+}).strict();
+var createExternalSkillRequestSchema = z6.object({
+  source: externalSkillSourceSchema,
+  curationNote: z6.string().default(""),
+  tags: z6.array(z6.string()).default([])
+}).strict();
+var patchExternalSkillRequestSchema = z6.object({
+  curationNote: z6.string().optional(),
+  tags: z6.array(z6.string()).optional(),
+  /** 清除「有更新」徽章（不改变 curationNote / snapshot） */
+  acknowledgeUpdate: z6.boolean().optional(),
+  revision: z6.number().int().positive()
+}).strict();
+
+// ../contracts/dist/fix.js
+import { z as z7 } from "zod";
+var fixActionSchema = z7.enum(["auto", "confirm", "suggest"]);
+var fixPlanItemSchema = z7.object({
+  checkId: z7.string(),
   action: fixActionSchema,
-  label: z6.string(),
-  affectedPaths: z6.array(z6.string()),
-  riskDelta: z6.string().nullable(),
-  message: z6.string(),
+  label: z7.string(),
+  affectedPaths: z7.array(z7.string()),
+  riskDelta: z7.string().nullable(),
+  message: z7.string(),
   // AI 内容生成切片：fix-suggestions 端点填充（fixer.buildFixPatch 填的 item 不带，向后兼容）
-  suggestedContent: z6.string().nullable().optional(),
-  explanation: z6.string().nullable().optional(),
-  appliesTo: z6.enum(["examples", "allowed_capabilities", "instructions", "description", "tags"]).nullable().optional(),
-  generatedAt: z6.string().nullable().optional()
+  suggestedContent: z7.string().nullable().optional(),
+  explanation: z7.string().nullable().optional(),
+  appliesTo: z7.enum(["examples", "allowed_capabilities", "instructions", "description", "tags"]).nullable().optional(),
+  generatedAt: z7.string().nullable().optional()
 }).strict();
-var fixPlanSchema = z6.object({
-  items: z6.array(fixPlanItemSchema),
-  mergedFiles: z6.array(skillDiffFileSchema),
-  summary: z6.object({
-    autoCount: z6.number().int(),
-    confirmCount: z6.number().int(),
-    suggestCount: z6.number().int(),
-    changedFiles: z6.number().int(),
-    changedLines: z6.number().int()
+var fixPlanSchema = z7.object({
+  items: z7.array(fixPlanItemSchema),
+  mergedFiles: z7.array(skillDiffFileSchema),
+  summary: z7.object({
+    autoCount: z7.number().int(),
+    confirmCount: z7.number().int(),
+    suggestCount: z7.number().int(),
+    changedFiles: z7.number().int(),
+    changedLines: z7.number().int()
   })
 }).strict();
 
 // ../contracts/dist/knowledge.js
-import { z as z7 } from "zod";
-var knowledgeStatusSchema = z7.enum([
+import { z as z8 } from "zod";
+var knowledgeStatusSchema = z8.enum([
   "candidate",
   "active",
   "stale",
   "deprecated",
   "superseded"
 ]);
-var knowledgeFrontmatterSchema = z7.object({
-  id: z7.string().regex(/^knowledge\.[a-z0-9.-]+$/),
-  type: z7.enum([
+var knowledgeFrontmatterSchema = z8.object({
+  id: z8.string().regex(/^knowledge\.[a-z0-9.-]+$/),
+  type: z8.enum([
     "business",
     "architecture",
     "decision",
@@ -528,7 +567,7 @@ var knowledgeFrontmatterSchema = z7.object({
     "glossary",
     "project-local"
   ]),
-  scope: z7.enum([
+  scope: z8.enum([
     "global",
     "project",
     "module",
@@ -537,48 +576,178 @@ var knowledgeFrontmatterSchema = z7.object({
     "business-domain",
     "local"
   ]),
-  confidence: z7.enum(["verified", "inferred", "unverified", "low"]),
+  confidence: z8.enum(["verified", "inferred", "unverified", "low"]),
   status: knowledgeStatusSchema,
-  domains: z7.array(z7.string()),
-  modules: z7.array(z7.string()),
-  related_paths: z7.array(z7.string()),
-  source: z7.object({
-    kind: z7.enum(["manual", "archive", "review", "imported", "test", "design"]),
-    ref: z7.string().min(1)
+  domains: z8.array(z8.string()),
+  modules: z8.array(z8.string()),
+  related_paths: z8.array(z8.string()),
+  source: z8.object({
+    kind: z8.enum(["manual", "archive", "review", "imported", "test", "design"]),
+    ref: z8.string().min(1)
   }).strict(),
-  created_at: z7.iso.datetime(),
-  updated_at: z7.iso.datetime(),
-  last_verified_at: z7.iso.datetime().nullable(),
-  expires_at: z7.iso.datetime().nullable(),
-  supersedes: z7.array(z7.string()),
-  superseded_by: z7.array(z7.string())
+  created_at: z8.iso.datetime(),
+  updated_at: z8.iso.datetime(),
+  last_verified_at: z8.iso.datetime().nullable(),
+  expires_at: z8.iso.datetime().nullable(),
+  supersedes: z8.array(z8.string()),
+  superseded_by: z8.array(z8.string())
+}).strict();
+var knowledgeMarkdownIndexSchema = z8.object({
+  schema_version: z8.literal(1),
+  generated_at: z8.iso.datetime(),
+  entries: z8.array(z8.object({
+    id: z8.string(),
+    type: z8.string(),
+    scope: z8.string(),
+    confidence: z8.string(),
+    status: knowledgeStatusSchema,
+    domains: z8.array(z8.string()),
+    modules: z8.array(z8.string()),
+    related_paths: z8.array(z8.string()),
+    source: knowledgeFrontmatterSchema.shape.source,
+    created_at: z8.iso.datetime(),
+    updated_at: z8.iso.datetime(),
+    last_verified_at: z8.iso.datetime().nullable(),
+    expires_at: z8.iso.datetime().nullable(),
+    supersedes: z8.array(z8.string()),
+    superseded_by: z8.array(z8.string()),
+    path: z8.string(),
+    content_sha256: z8.string(),
+    summary: z8.string(),
+    local: z8.boolean()
+  }).strict())
+}).strict();
+var knowledgeIngestTimestampSchema = z8.string().min(1);
+var knowledgeIngestEntryTypeSchema = z8.enum([
+  "requirement",
+  "decision",
+  "implementation",
+  "risk",
+  "test-evidence",
+  "pitfall",
+  "api-contract"
+]);
+var knowledgeIngestEntryStatusSchema = z8.enum([
+  "candidate",
+  "active",
+  "stale",
+  "superseded",
+  "deprecated",
+  "conflicted"
+]);
+var knowledgeConfidenceScoreSchema = z8.object({
+  score: z8.number(),
+  level: z8.string(),
+  signals: z8.array(z8.string()),
+  lastCalculatedAt: knowledgeIngestTimestampSchema
+}).strict();
+var knowledgeIngestEntryLifecycleSchema = z8.object({
+  createdAt: knowledgeIngestTimestampSchema,
+  verifiedAt: knowledgeIngestTimestampSchema,
+  lastCheckedAt: knowledgeIngestTimestampSchema,
+  confidence: z8.string(),
+  supersedes: z8.array(z8.string()),
+  supersededBy: z8.string().nullable(),
+  conflictsWith: z8.array(z8.string()),
+  staleReasons: z8.array(z8.string()),
+  promotedAt: knowledgeIngestTimestampSchema.optional(),
+  promotionNote: z8.string().optional(),
+  demotedAt: knowledgeIngestTimestampSchema.optional(),
+  validation: z8.object({
+    validatedAt: knowledgeIngestTimestampSchema,
+    status: z8.enum(["passed", "failed", "skipped"]),
+    results: z8.array(z8.record(z8.string(), z8.unknown()))
+  }).strict().optional()
+}).strict();
+var knowledgeIngestEntrySourceSchema = z8.object({
+  archive: z8.string(),
+  summaryData: z8.string(),
+  summarySha256: z8.string(),
+  sourceCommit: z8.string(),
+  baseCommit: z8.string(),
+  changeName: z8.string(),
+  finalStatus: z8.string()
+}).strict();
+var knowledgeIngestEntrySchema = z8.object({
+  schemaVersion: z8.literal(1),
+  id: z8.string().min(1),
+  projectId: z8.string().min(1),
+  type: knowledgeIngestEntryTypeSchema,
+  status: knowledgeIngestEntryStatusSchema,
+  title: z8.string(),
+  summary: z8.string(),
+  body: z8.string(),
+  keywords: z8.array(z8.string()),
+  source: knowledgeIngestEntrySourceSchema,
+  scope: z8.object({
+    sourceFiles: z8.array(z8.string()),
+    staleIfPathsChanged: z8.array(z8.string()).optional()
+  }).strict(),
+  lifecycle: knowledgeIngestEntryLifecycleSchema,
+  confidence: knowledgeConfidenceScoreSchema.optional(),
+  validators: z8.array(z8.record(z8.string(), z8.unknown())).optional(),
+  reviewReasons: z8.array(z8.string()).optional()
+}).strict();
+var knowledgeIngestIndexEntryRefSchema = z8.object({
+  id: z8.string(),
+  type: knowledgeIngestEntryTypeSchema,
+  status: knowledgeIngestEntryStatusSchema,
+  title: z8.string(),
+  sourceArchive: z8.string(),
+  sourceCommit: z8.string(),
+  sourceFiles: z8.array(z8.string()),
+  confidence: z8.union([knowledgeConfidenceScoreSchema, z8.object({}).strict()])
+}).strict();
+var knowledgeIngestIndexSchema = z8.object({
+  schemaVersion: z8.literal(1),
+  generatedAt: knowledgeIngestTimestampSchema,
+  projectId: z8.string(),
+  projectRoot: z8.string(),
+  headCommit: z8.string().nullable().optional(),
+  archives: z8.object({
+    scanned: z8.number().int().nonnegative(),
+    indexed: z8.number().int().nonnegative(),
+    failed: z8.number().int().nonnegative(),
+    items: z8.array(z8.object({
+      archive: z8.string(),
+      summaryData: z8.string(),
+      summarySha256: z8.string(),
+      mtime: knowledgeIngestTimestampSchema
+    }).strict())
+  }).strict(),
+  stats: z8.record(z8.string(), z8.number().int().nonnegative()),
+  byType: z8.record(z8.string(), z8.number().int().nonnegative()),
+  duplicatesSkipped: z8.number().int().nonnegative(),
+  ingestMode: z8.record(z8.string(), z8.unknown()),
+  failures: z8.array(z8.record(z8.string(), z8.string())),
+  entries: z8.array(knowledgeIngestIndexEntryRefSchema)
 }).strict();
 
 // ../contracts/dist/mcp-contract.js
-import { z as z8 } from "zod";
-var mcpToolContractSchema = z8.object({
-  tool_name: z8.string(),
-  description: z8.string(),
-  input_schema: z8.record(z8.string(), z8.unknown())
+import { z as z9 } from "zod";
+var mcpToolContractSchema = z9.object({
+  tool_name: z9.string(),
+  description: z9.string(),
+  input_schema: z9.record(z9.string(), z9.unknown())
 }).strict();
 
 // ../contracts/dist/project.js
-import { z as z9 } from "zod";
-var projectIdSchema = z9.string().regex(/^prj_[A-Za-z0-9_-]+$/);
-var tokenEnvSchema = z9.string().regex(/^[A-Z_][A-Z0-9_]*$/);
-var httpsUrlSchema = z9.url().refine((value) => new URL(value).protocol === "https:", "server URL must use HTTPS");
+import { z as z10 } from "zod";
+var projectIdSchema = z10.string().regex(/^prj_[A-Za-z0-9_-]+$/);
+var tokenEnvSchema = z10.string().regex(/^[A-Z_][A-Z0-9_]*$/);
+var httpsUrlSchema = z10.url().refine((value) => new URL(value).protocol === "https:", "server URL must use HTTPS");
 var HARNESS_AGENT_ORDER = [
   "claude-code",
   "codex",
   "cursor",
   "codebuddy"
 ];
-var harnessAgentSchema = z9.enum(HARNESS_AGENT_ORDER);
-var codebuddySurfaceSchema = z9.enum(["both", "ide", "cli"]);
+var harnessAgentSchema = z10.enum(HARNESS_AGENT_ORDER);
+var codebuddySurfaceSchema = z10.enum(["both", "ide", "cli"]);
 function sortHarnessAgents(agents) {
   return HARNESS_AGENT_ORDER.filter((agent) => agents.includes(agent));
 }
-var adapterNameSchema = z9.enum([
+var adapterNameSchema = z10.enum([
   "claude-code",
   "codex",
   "cursor",
@@ -586,176 +755,256 @@ var adapterNameSchema = z9.enum([
   "generic",
   "mcp"
 ]);
-var initConfigSchema = z9.object({
-  agents: z9.array(harnessAgentSchema).min(1),
-  profile: z9.enum(["general", "java"]),
+var initConfigSchema = z10.object({
+  agents: z10.array(harnessAgentSchema).min(1),
+  profile: z10.enum(["general", "java"]),
   codebuddy_surface: codebuddySurfaceSchema.default("both"),
   server_url: httpsUrlSchema.nullable().optional(),
   token_env: tokenEnvSchema.nullable().optional(),
   project_id: projectIdSchema.nullable().optional(),
-  features: z9.object({
-    codegraph_check: z9.boolean().default(true),
-    superpowers_check: z9.boolean().default(true)
+  features: z10.object({
+    codegraph_check: z10.boolean().default(true),
+    superpowers_check: z10.boolean().default(true)
   }).strict().optional()
 }).strict();
-var projectConfigSchema = z9.object({
-  harness: z9.object({
-    name: z9.literal("hunter-harness"),
-    schema_version: z9.literal(1)
+var projectConfigSchema = z10.object({
+  harness: z10.object({
+    name: z10.literal("hunter-harness"),
+    schema_version: z10.literal(1)
   }).strict(),
-  project: z9.object({
-    name: z9.string().min(1),
-    root: z9.literal("."),
-    local_project_key: z9.uuid(),
+  project: z10.object({
+    name: z10.string().min(1),
+    root: z10.literal("."),
+    local_project_key: z10.uuid(),
     project_id: projectIdSchema.nullable(),
-    profiles: z9.array(z9.string().min(1)).min(1)
+    profiles: z10.array(z10.string().min(1)).min(1)
   }).strict(),
-  server: z9.object({
+  server: z10.object({
     url: httpsUrlSchema.nullable(),
     token_env: tokenEnvSchema
   }).strict(),
-  adapters: z9.object({
-    enabled: z9.array(adapterNameSchema).min(1)
+  adapters: z10.object({
+    enabled: z10.array(adapterNameSchema).min(1)
   }).strict(),
-  adapter_options: z9.object({
-    codebuddy: z9.object({
+  adapter_options: z10.object({
+    codebuddy: z10.object({
       surface: codebuddySurfaceSchema
     }).strict()
   }).strict().optional()
 }).strict();
 
 // ../contracts/dist/dashboard.js
-import { z as z10 } from "zod";
-var dashboardHealthStatusSchema = z10.enum(["healthy", "attention", "unavailable"]);
-var dashboardServiceStatusSchema = z10.enum(["operational", "degraded", "unavailable"]);
-var dashboardTrendPointSchema = z10.object({
-  date: z10.string().regex(/^\d{4}-\d{2}-\d{2}$/),
-  submitted: z10.number().int().nonnegative(),
-  approved: z10.number().int().nonnegative(),
-  rejected: z10.number().int().nonnegative(),
-  pending: z10.number().int().nonnegative()
+import { z as z11 } from "zod";
+var dashboardHealthStatusSchema = z11.enum(["healthy", "attention", "unavailable"]);
+var dashboardServiceStatusSchema = z11.enum(["operational", "degraded", "unavailable"]);
+var dashboardTrendPointSchema = z11.object({
+  date: z11.string().regex(/^\d{4}-\d{2}-\d{2}$/),
+  submitted: z11.number().int().nonnegative(),
+  approved: z11.number().int().nonnegative(),
+  rejected: z11.number().int().nonnegative(),
+  pending: z11.number().int().nonnegative()
 }).strict();
-var dashboardDistributionItemSchema = z10.object({
-  key: z10.string().min(1),
-  count: z10.number().int().nonnegative()
+var dashboardDistributionItemSchema = z11.object({
+  key: z11.string().min(1),
+  count: z11.number().int().nonnegative()
 }).strict();
-var dashboardHealthItemSchema = z10.object({
-  key: z10.string().min(1),
-  label: z10.string().min(1),
+var dashboardHealthItemSchema = z11.object({
+  key: z11.string().min(1),
+  label: z11.string().min(1),
   status: dashboardHealthStatusSchema,
-  value: z10.string().min(1),
-  detail: z10.string().min(1)
+  value: z11.string().min(1),
+  detail: z11.string().min(1)
 }).strict();
-var dashboardServiceItemSchema = z10.object({
-  key: z10.string().min(1),
-  label: z10.string().min(1),
+var dashboardServiceItemSchema = z11.object({
+  key: z11.string().min(1),
+  label: z11.string().min(1),
   status: dashboardServiceStatusSchema,
-  detail: z10.string().min(1),
-  checked_at: z10.iso.datetime()
+  detail: z11.string().min(1),
+  checked_at: z11.iso.datetime()
 }).strict();
-var dashboardActivitySchema = z10.object({
-  event_id: z10.string().min(1),
-  action: z10.string().min(1),
-  target_id: z10.string().min(1),
-  project_id: z10.string().nullable(),
-  actor_id: z10.string().min(1),
-  created_at: z10.iso.datetime()
+var dashboardActivitySchema = z11.object({
+  event_id: z11.string().min(1),
+  action: z11.string().min(1),
+  target_id: z11.string().min(1),
+  project_id: z11.string().nullable(),
+  actor_id: z11.string().min(1),
+  created_at: z11.iso.datetime()
 }).strict();
-var dashboardOverviewSchema = z10.object({
-  generated_at: z10.iso.datetime(),
-  window: z10.object({
-    days: z10.number().int().min(7).max(30),
-    starts_at: z10.iso.datetime(),
-    ends_at: z10.iso.datetime()
+var dashboardOverviewSchema = z11.object({
+  generated_at: z11.iso.datetime(),
+  window: z11.object({
+    days: z11.number().int().min(7).max(30),
+    starts_at: z11.iso.datetime(),
+    ends_at: z11.iso.datetime()
   }).strict(),
-  metrics: z10.object({
-    projects: z10.number().int().nonnegative(),
-    workflows: z10.number().int().nonnegative(),
-    skills: z10.number().int().nonnegative(),
-    published_skills: z10.number().int().nonnegative(),
-    pending_reviews: z10.number().int().nonnegative(),
-    approved_proposals: z10.number().int().nonnegative(),
-    rejected_proposals: z10.number().int().nonnegative(),
-    artifacts: z10.number().int().nonnegative(),
-    project_artifacts: z10.number().int().nonnegative(),
-    skill_artifacts: z10.number().int().nonnegative()
+  metrics: z11.object({
+    projects: z11.number().int().nonnegative(),
+    workflows: z11.number().int().nonnegative(),
+    skills: z11.number().int().nonnegative(),
+    published_skills: z11.number().int().nonnegative(),
+    pending_reviews: z11.number().int().nonnegative(),
+    approved_proposals: z11.number().int().nonnegative(),
+    rejected_proposals: z11.number().int().nonnegative(),
+    artifacts: z11.number().int().nonnegative(),
+    project_artifacts: z11.number().int().nonnegative(),
+    skill_artifacts: z11.number().int().nonnegative()
   }).strict(),
-  trend: z10.array(dashboardTrendPointSchema),
-  distributions: z10.object({
-    skill_categories: z10.array(dashboardDistributionItemSchema),
-    workflow_profiles: z10.array(dashboardDistributionItemSchema)
+  trend: z11.array(dashboardTrendPointSchema),
+  distributions: z11.object({
+    skill_categories: z11.array(dashboardDistributionItemSchema),
+    workflow_profiles: z11.array(dashboardDistributionItemSchema)
   }).strict(),
-  health: z10.array(dashboardHealthItemSchema),
-  services: z10.array(dashboardServiceItemSchema),
-  activity: z10.array(dashboardActivitySchema)
+  health: z11.array(dashboardHealthItemSchema),
+  services: z11.array(dashboardServiceItemSchema),
+  activity: z11.array(dashboardActivitySchema)
 }).strict();
 
-// ../contracts/dist/workflow-package.js
-import { z as z11 } from "zod";
-var workflowPackageManifestSchema = z11.object({
-  key: registrySlugSchema,
-  name: z11.string().min(1).max(120),
-  description: z11.string().min(1).max(1e3),
+// ../contracts/dist/semantic.js
+import { z as z12 } from "zod";
+var semanticDocumentKindSchema = z12.enum([
+  "knowledge_entry",
+  "knowledge_markdown",
+  "rule",
+  "archive_record",
+  "agent_instruction"
+]);
+var semanticEdgeKindSchema = z12.enum([
+  "references_path",
+  "supersedes",
+  "related_archive",
+  "tag_cooccurrence"
+]);
+var semanticDocumentSchema = z12.object({
+  document_id: z12.string(),
+  project_id: z12.string(),
+  artifact_id: z12.string(),
+  kind: semanticDocumentKindSchema,
+  source_path: z12.string(),
+  title: z12.string(),
+  body: z12.string(),
+  metadata: z12.record(z12.string(), z12.unknown()),
+  content_sha256: z12.string()
+}).strict();
+var semanticEdgeSchema = z12.object({
+  edge_id: z12.string(),
+  project_id: z12.string(),
+  artifact_id: z12.string(),
+  from_document_id: z12.string(),
+  to_document_id: z12.string(),
+  kind: semanticEdgeKindSchema,
+  metadata: z12.record(z12.string(), z12.unknown())
+}).strict();
+var semanticIndexBuildSchema = z12.object({
+  project_id: z12.string(),
+  artifact_id: z12.string(),
+  documents: z12.array(semanticDocumentSchema),
+  edges: z12.array(semanticEdgeSchema)
+}).strict();
+var semanticOverviewSchema = z12.object({
+  project_id: z12.string(),
+  artifact_id: z12.string().nullable(),
+  counts: z12.object({
+    documents: z12.number().int().nonnegative(),
+    knowledge: z12.number().int().nonnegative(),
+    rules: z12.number().int().nonnegative(),
+    changes: z12.number().int().nonnegative(),
+    agent_instructions: z12.number().int().nonnegative(),
+    edges: z12.number().int().nonnegative()
+  }).strict()
+}).strict();
+var semanticSearchHitSchema = z12.object({
+  document: semanticDocumentSchema,
+  project_id: z12.string()
+}).strict();
+
+// ../contracts/dist/workflow-family.js
+import { z as z13 } from "zod";
+var workflowBundleManifestSchema = z13.object({
+  schema_version: z13.literal(1),
   profile: registrySlugSchema,
-  skills: z11.array(z11.object({
-    slug: registrySlugSchema,
-    ref: z11.string()
-  }).strict()),
-  agents: z11.array(z11.object({
-    path: z11.string(),
-    ref: z11.string()
-  }).strict()),
-  protocols: z11.array(z11.object({
-    path: z11.string(),
-    ref: z11.string()
-  }).strict()),
-  templates: z11.array(z11.object({
-    path: z11.string(),
-    ref: z11.string()
-  }).strict()),
-  execution_order: z11.array(z11.string()),
-  strategy: z11.enum(["sequential", "parallel", "manual"])
+  files: z13.array(z13.object({
+    path: z13.string().min(1),
+    sha256: sha256Schema
+  }).strict()).min(1)
 }).strict();
-var workflowPackageArtifactSchema = z11.object({
-  artifact_id: z11.string().regex(/^wfa_/),
-  package_key: registrySlugSchema,
+var workflowFamilyBundleArtifactSchema = z13.object({
+  artifact_id: z13.string().regex(/^wfb_/),
+  family_slug: registrySlugSchema,
+  profile: registrySlugSchema,
   version: registrySemverSchema,
   content_sha256: sha256Schema,
-  size_bytes: z11.number().int().nonnegative(),
-  created_at: z11.iso.datetime()
+  size_bytes: z13.number().int().nonnegative(),
+  bundle_manifest: workflowBundleManifestSchema,
+  created_at: z13.iso.datetime()
 }).strict();
-var workflowPackageVersionSchema = z11.object({
-  package_key: registrySlugSchema,
+var workflowFamilyVersionProfileSchema = z13.object({
+  profile: registrySlugSchema,
+  bundle_manifest: workflowBundleManifestSchema,
+  artifact_id: z13.string().regex(/^wfb_/),
+  sourceFiles: z13.array(sourceFileSchema).default([])
+}).strict();
+var workflowFamilyVersionSchema = z13.object({
+  family_slug: registrySlugSchema,
   version: registrySemverSchema,
-  manifest: workflowPackageManifestSchema,
-  artifacts: z11.array(workflowPackageArtifactSchema),
-  sourceFiles: z11.array(sourceFileSchema).default([]),
-  changeNote: z11.string().nullable(),
-  created_at: z11.iso.datetime()
+  profiles: z13.array(workflowFamilyVersionProfileSchema).min(1),
+  artifacts: z13.array(workflowFamilyBundleArtifactSchema),
+  changeNote: z13.string().nullable(),
+  created_at: z13.iso.datetime()
 }).strict();
-var workflowPackageDraftStateSchema = z11.object({
-  key: registrySlugSchema,
-  manifest: workflowPackageManifestSchema,
-  sourceFiles: z11.array(sourceFileSchema),
+var workflowFamilyDraftProfileSchema = z13.object({
+  profile: registrySlugSchema,
+  sourceFiles: z13.array(sourceFileSchema),
+  bundle_manifest: workflowBundleManifestSchema
+}).strict();
+var workflowFamilyDraftStateSchema = z13.object({
+  family_slug: registrySlugSchema,
+  profiles: z13.array(workflowFamilyDraftProfileSchema),
+  required_profiles: z13.array(registrySlugSchema),
   draftVersion: registrySemverSchema.nullable(),
   checks: skillCheckResultSchema.nullable(),
-  releaseNote: z11.string().nullable(),
-  revision: z11.number().int(),
-  created_at: z11.string(),
-  updated_at: z11.string()
+  releaseNote: z13.string().nullable(),
+  revision: z13.number().int(),
+  created_at: z13.string(),
+  updated_at: z13.string()
 }).strict();
-var workflowPackageSchema = z11.object({
-  package_id: z11.string().regex(/^wfp_/),
-  key: registrySlugSchema,
-  manifest: workflowPackageManifestSchema,
-  latestVersion: registrySemverSchema.nullable(),
-  revision: z11.number().int().positive(),
-  created_at: z11.iso.datetime(),
-  updated_at: z11.iso.datetime()
+var workflowFamilySchema = z13.object({
+  family_id: z13.string().regex(/^wff_/),
+  slug: registrySlugSchema,
+  displayName: z13.string().min(1).max(120),
+  description: z13.string().min(1).max(1e3),
+  tags: z13.array(registrySlugSchema).default([]),
+  latest_version: registrySemverSchema.nullable(),
+  required_profiles: z13.array(registrySlugSchema).min(1),
+  revision: z13.number().int().positive(),
+  npmReleases: z13.array(npmReleaseRecordSchema).optional().default([]),
+  created_at: z13.iso.datetime(),
+  updated_at: z13.iso.datetime()
+}).strict();
+var workflowFamilyMutationSchema = z13.object({
+  slug: registrySlugSchema,
+  displayName: z13.string().min(1).max(120),
+  description: z13.string().min(1).max(1e3),
+  tags: z13.array(registrySlugSchema).default([]),
+  required_profiles: z13.array(registrySlugSchema).min(1)
 }).strict();
-var publishWorkflowPackageRequestSchema = z11.object({
+var publishWorkflowFamilyRequestSchema = z13.object({
   version: registrySemverSchema,
-  releaseNote: z11.string().optional()
+  releaseNote: z13.string().optional()
+}).strict();
+var registryProjectWorkflowBindingSchema = z13.object({
+  project_id: z13.string().regex(/^prj_/),
+  family_slug: registrySlugSchema,
+  profile: registrySlugSchema,
+  version: registrySemverSchema.nullable().optional(),
+  revision: z13.number().int().positive(),
+  updated_at: z13.iso.datetime()
+}).strict();
+var bindProjectWorkflowFamilyRequestSchema = z13.object({
+  schema_version: z13.literal(1),
+  family_slug: registrySlugSchema,
+  profile: registrySlugSchema,
+  version: registrySemverSchema.nullable().optional(),
+  revision: z13.number().int().nullable()
 }).strict();
 
 // ../core/dist/fs/hash.js
@@ -835,8 +1084,8 @@ async function assertNoSymlinks(root, relativePath) {
   for (const segment of normalized.split("/")) {
     current = join(current, segment);
     try {
-      const stat5 = await lstat(current);
-      if (stat5.isSymbolicLink()) {
+      const stat6 = await lstat(current);
+      if (stat6.isSymbolicLink()) {
         throw new UnsafePathError("symbolic links are not managed");
       }
     } catch (error) {
@@ -1225,13 +1474,6 @@ var USER_DIFF = {
   update_policy: "skip-if-local-dirty",
   conflict_policy: "skip-and-report"
 };
-var USER_FULL = {
-  file_kind: "user_editable",
-  edit_policy: "allow",
-  push_policy: "full-diff-proposal",
-  update_policy: "skip-if-local-dirty",
-  conflict_policy: "skip-and-report"
-};
 var PROJECT_LOCAL = {
   file_kind: "user_editable",
   edit_policy: "allow",
@@ -1298,8 +1540,14 @@ function classifyFile(input) {
   if (under(path, ".harness/knowledge/project-local/")) {
     return PROJECT_LOCAL;
   }
+  if (path === ".harness/knowledge/index.sqlite" || under(path, ".harness/knowledge/cache/") || under(path, ".harness/knowledge/views/") || under(path, ".harness/knowledge/context-packs/")) {
+    return GENERATED_CACHE;
+  }
+  if (under(path, ".harness/knowledge/reports/")) {
+    return REPORT_CACHE;
+  }
   if (under(path, ".harness/knowledge/")) {
-    return USER_FULL;
+    return USER_DIFF;
   }
   if (under(path, ".harness/codebase/map/") || path === ".harness/codebase/map-summary.md" || path === ".harness/codebase/map-manifest.json") {
     return GENERATED_REVIEWABLE;
@@ -2121,6 +2369,7 @@ async function initializeProject(options) {
     project_id: projectConfig.project.project_id,
     complete_project_version: null,
     artifact_manifest_hash: null,
+    latest_artifact_id: null,
     files: {}
   });
   const managedBlocks = [];
@@ -2744,13 +2993,27 @@ function shannonEntropy(value) {
   }
   return entropy;
 }
+var HEX_DIGEST = /^(?:[a-fA-F0-9]{32}|[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/;
+var STRUCTURED_LOWERCASE_ID = /^[a-z0-9]+(?:[.-][a-z0-9]+)+$/;
+function isBenignHighEntropyLookalike(value) {
+  if (HEX_DIGEST.test(value)) {
+    return true;
+  }
+  if (value.includes("/")) {
+    return true;
+  }
+  if (STRUCTURED_LOWERCASE_ID.test(value) && (value.match(/\./g) ?? []).length >= 2) {
+    return true;
+  }
+  return false;
+}
 function highEntropyCandidates(content) {
-  const matches = content.matchAll(/\b[A-Za-z0-9_+/.=-]{24,}\b/g);
+  const matches = content.matchAll(/\b[A-Za-z0-9_+.=\-]{24,}\b/g);
   return [...matches].map((match) => ({
     value: match[0],
     offset: match.index,
     entropy: shannonEntropy(match[0])
-  })).filter((item2) => item2.entropy >= 4.5);
+  })).filter((item2) => item2.entropy >= 4.5 && !isBenignHighEntropyLookalike(item2.value));
 }
 
 // ../core/dist/security/scanner.js
@@ -2809,11 +3072,11 @@ function rawFindings(content) {
   for (const rule of RULES) {
     for (const match of content.matchAll(rule.pattern)) {
       const value = match[rule.valueGroup ?? 0] ?? match[0];
-      const relative2 = match[0].indexOf(value);
+      const relative3 = match[0].indexOf(value);
       findings.push({
         ruleId: rule.id,
         severity: rule.severity,
-        offset: match.index + Math.max(0, relative2),
+        offset: match.index + Math.max(0, relative3),
         value
       });
     }
@@ -2835,7 +3098,11 @@ function scanSensitiveFiles(files, options = {}) {
   for (const [inputPath, content] of Object.entries(files).sort(([a], [b]) => a.localeCompare(b))) {
     const path = normalizeManagedPath(inputPath);
     const ignores = parseInlineIgnores(content);
+    const knowledgeMetadata = path === ".harness/knowledge" || path.startsWith(".harness/knowledge/");
     for (const raw of rawFindings(content)) {
+      if (knowledgeMetadata && raw.ruleId === "HH_WINDOWS_ABSOLUTE_PATH") {
+        continue;
+      }
       const position = location(content, raw.offset);
       const fingerprint = sha256Bytes([
         SENSITIVE_SCANNER_VERSION,
@@ -3299,23 +3566,31 @@ async function pushProject(options) {
         });
       }
     }
-    const finalized = await client.finalizeProposal(session.session_id, { schema_version: 1, manifest_sha256: proposalManifestHash }, requestId, workflow.finalize_idempotency_key);
+    const finalized = await client.finalizeProposal(session.session_id, {
+      schema_version: 1,
+      manifest_sha256: proposalManifestHash,
+      base_artifact_id: baseline.latest_artifact_id ?? null
+    }, requestId, workflow.finalize_idempotency_key);
     await atomicWriteJson(join9(root, ".harness", "state", "local", "push-results", finalized.proposal_id + ".json"), {
       schema_version: 1,
       request_id: requestId,
       project_id: projectId,
       proposal_id: finalized.proposal_id,
       status: finalized.status,
+      artifact_id: finalized.artifact_id,
       operation_count: preview.operations.length,
       recorded_at: (/* @__PURE__ */ new Date()).toISOString()
     });
     await rm4(workflowPath, { force: true });
-    return { preview, proposalId: finalized.proposal_id, projectId };
+    return { preview, proposalId: finalized.proposal_id, projectId, artifactId: finalized.artifact_id };
   } catch (error) {
     if (error instanceof PushWorkflowError) {
       throw error;
     }
     if (error instanceof ApiError) {
+      if (error.code === "STALE_PUSH") {
+        throw new PushWorkflowError("\u670D\u52A1\u7AEF\u5DF2\u6709\u66F4\u65B0\u7684\u63A8\u9001\uFF0C\u8BF7\u5148 git pull \u540E\u6267\u884C npx hunter-harness update \u518D\u63A8", 5, "STALE_PUSH");
+      }
       const exitCode = error.status === 401 ? 8 : error.status === 409 ? 5 : 4;
       throw new PushWorkflowError(error.message, exitCode, error.code);
     }
@@ -3390,7 +3665,7 @@ async function cleanupProject(options) {
 
 // ../core/dist/skill/frontmatter.js
 import { parse as parseYaml5 } from "yaml";
-import { z as z12 } from "zod";
+import { z as z14 } from "zod";
 
 // ../core/dist/skill/fixer.js
 import { parse as parseYaml6, stringify as stringifyYaml4 } from "yaml";
@@ -3836,6 +4111,7 @@ async function updateProject(options) {
       if (skipped.length === 0) {
         nextBaseline.complete_project_version = manifest.project_version;
         nextBaseline.artifact_manifest_hash = manifest.manifest_sha256;
+        nextBaseline.latest_artifact_id = manifest.artifact_id;
       }
       const transactionId = "tx_update_" + Date.now() + "_" + uuidV7();
       const reportPath = ".harness/reports/update-" + requestId + ".json";
@@ -4506,7 +4782,7 @@ async function runPush(options, dependencies) {
       warnings: result.preview.skipped,
       errors: []
     };
-    dependencies.stdout(options.json === true ? serializeCliResult(output) : options.dryRun === true ? "Push preview contains " + items.length + " operations.\n" : "Proposal " + result.proposalId + " created.\n");
+    dependencies.stdout(options.json === true ? serializeCliResult(output) : options.dryRun === true ? "Push preview contains " + items.length + " operations.\n" : "Pushed artifact " + result.artifactId + " (proposal " + result.proposalId + ").\n");
     return 0;
   } catch (error) {
     const exitCode = error instanceof PushWorkflowError ? error.exitCode : 1;
@@ -4729,13 +5005,167 @@ async function runRecoveryMenuIfApplicable(options, dependencies) {
   }
 }
 
+// src/workflow-data/resolve.ts
+import { cp, mkdir as mkdir4, readdir as readdir7, readFile as readFile14, stat as stat5 } from "node:fs/promises";
+import { dirname as dirname4, join as join16, relative as relative2 } from "node:path";
+import { fileURLToPath } from "node:url";
+var WorkflowDataResolutionError = class extends Error {
+  code;
+  exitCode;
+  constructor(message, code = "WORKFLOW_DATA_UNAVAILABLE", exitCode = 4) {
+    super(message);
+    this.name = "WorkflowDataResolutionError";
+    this.code = code;
+    this.exitCode = exitCode;
+  }
+};
+async function pathExists3(path) {
+  try {
+    await stat5(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function readOption(argv, name) {
+  const flag = `--${name}`;
+  const index = argv.indexOf(flag);
+  if (index >= 0) return argv[index + 1];
+  const prefixed = argv.find((value) => value.startsWith(`${flag}=`));
+  if (prefixed !== void 0) return prefixed.slice(flag.length + 1);
+  return void 0;
+}
+function workflowPackageName(family, env) {
+  const scope = (env.HUNTER_HARNESS_NPM_SCOPE ?? "@hunter-harness").replace(/\/$/, "");
+  if (family === "harness") return `${scope}/workflow-harness`;
+  return `${scope}/workflow-${family}`;
+}
+async function listFilesRecursive(root, base = root) {
+  const entries = await readdir7(root, { withFileTypes: true });
+  const files = [];
+  for (const entry of entries) {
+    const absolute = join16(root, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...await listFilesRecursive(absolute, base));
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    const rel = relative2(base, absolute).replaceAll("\\", "/");
+    files.push({ path: rel, content: await readFile14(absolute, "utf8") });
+  }
+  return files;
+}
+function sha256Canonical(files) {
+  return sha256Bytes(canonicalJson(
+    [...files].sort((left, right) => left.path.localeCompare(right.path)).map((file) => ({ path: file.path, content: file.content }))
+  ));
+}
+async function verifyWorkflowPackageIntegrity(resourcesRoot) {
+  const manifest = await readWorkflowFamilyManifest(resourcesRoot);
+  const expected = manifest.content_sha256;
+  if (typeof expected !== "string" || expected.length === 0) return;
+  const harnessRoot = join16(resourcesRoot, "harness");
+  if (!await pathExists3(harnessRoot)) {
+    throw new WorkflowDataResolutionError(
+      "\u5DE5\u4F5C\u6D41\u6570\u636E\u5305\u7F3A\u5C11 harness/\uFF0C\u65E0\u6CD5\u6821\u9A8C SHA-256",
+      "WORKFLOW_DATA_INTEGRITY",
+      7
+    );
+  }
+  const files = await listFilesRecursive(harnessRoot, resourcesRoot);
+  const actual = sha256Canonical(files);
+  if (actual !== expected) {
+    throw new WorkflowDataResolutionError(
+      `\u5DE5\u4F5C\u6D41\u6570\u636E\u5305 SHA-256 \u6821\u9A8C\u5931\u8D25\uFF08\u671F\u671B ${expected}\uFF0C\u5B9E\u9645 ${actual}\uFF09`,
+      "WORKFLOW_DATA_INTEGRITY",
+      7
+    );
+  }
+}
+async function monorepoResourcesRoot() {
+  const candidates = [
+    fileURLToPath(new URL("../../../resources", import.meta.url)),
+    fileURLToPath(new URL("../../../workflow-data-harness", import.meta.url)),
+    fileURLToPath(new URL("../../../../resources", import.meta.url))
+  ];
+  for (const candidate of candidates) {
+    if (await pathExists3(join16(candidate, "harness", "manifests"))) return candidate;
+  }
+  return null;
+}
+async function siblingWorkflowPackage(cwd) {
+  const candidates = [
+    join16(cwd, "node_modules", "@hunter-harness", "workflow-harness"),
+    join16(dirname4(fileURLToPath(import.meta.url)), "..", "..", "workflow-data-harness")
+  ];
+  for (const candidate of candidates) {
+    if (await pathExists3(join16(candidate, "harness", "manifests"))) return candidate;
+  }
+  return null;
+}
+async function resolveWorkflowResourcesRoot(options, argv = []) {
+  if (options.override !== void 0) return options.override;
+  const envRoot = options.env.HUNTER_HARNESS_RESOURCES_ROOT?.trim();
+  if (envRoot !== void 0 && envRoot.length > 0) return envRoot;
+  const sibling = await siblingWorkflowPackage(options.cwd);
+  if (sibling !== null) {
+    await verifyWorkflowPackageIntegrity(sibling);
+    return sibling;
+  }
+  const monorepo = await monorepoResourcesRoot();
+  if (monorepo !== null) {
+    await verifyWorkflowPackageIntegrity(monorepo);
+    return monorepo;
+  }
+  const family = options.workflowFamily ?? readOption(argv, "workflow-family") ?? options.env.HUNTER_HARNESS_WORKFLOW_FAMILY ?? "harness";
+  const version = options.workflowVersion ?? readOption(argv, "workflow-version") ?? options.env.HUNTER_HARNESS_WORKFLOW_VERSION ?? "latest";
+  const packageName = workflowPackageName(family, options.env);
+  const packageSpec = version === "latest" ? packageName : `${packageName}@${version}`;
+  const cacheKey = packageSpec.replace("/", "+");
+  const cacheRoot = join16(options.cwd, ".harness", "cache", "workflow-packages", cacheKey);
+  if (await pathExists3(join16(cacheRoot, "harness", "manifests"))) {
+    await verifyWorkflowPackageIntegrity(cacheRoot);
+    return cacheRoot;
+  }
+  try {
+    await mkdir4(cacheRoot, { recursive: true });
+    const extract = options.pacoteExtract ?? (async (spec, destination) => {
+      const pacote = await import("pacote");
+      await pacote.default.extract(spec, destination);
+    });
+    const staging = join16(cacheRoot, ".extract");
+    await mkdir4(staging, { recursive: true });
+    await extract(packageSpec, staging);
+    const packageDir = await pathExists3(join16(staging, "harness", "manifests")) ? staging : join16(staging, "package");
+    if (!await pathExists3(join16(packageDir, "harness", "manifests"))) {
+      throw new WorkflowDataResolutionError(
+        "\u5DE5\u4F5C\u6D41\u6570\u636E\u5305\u5185\u5BB9\u65E0\u6548\uFF1A\u7F3A\u5C11 harness/manifests",
+        "WORKFLOW_DATA_INVALID",
+        7
+      );
+    }
+    await cp(packageDir, cacheRoot, { recursive: true });
+    await verifyWorkflowPackageIntegrity(cacheRoot);
+    return cacheRoot;
+  } catch (error) {
+    if (error instanceof WorkflowDataResolutionError) throw error;
+    throw new WorkflowDataResolutionError(
+      "\u65E0\u6CD5\u83B7\u53D6\u5DE5\u4F5C\u6D41\u6570\u636E\u5305\uFF1A\u65E0\u7F51\u7EDC\u4E14\u672C\u5730\u7F13\u5B58\u4E0D\u5B58\u5728\u3002\u8BF7\u5148\u5728\u6709\u7F51\u7EDC\u7684\u73AF\u5883\u8FD0\u884C hunter-harness\uFF0C\u6216\u8BBE\u7F6E HUNTER_HARNESS_RESOURCES_ROOT \u6307\u5411\u542B harness/ \u7684\u76EE\u5F55\u3002",
+      "WORKFLOW_DATA_UNAVAILABLE"
+    );
+  }
+}
+async function readWorkflowFamilyManifest(resourcesRoot) {
+  const manifestPath = join16(resourcesRoot, "hunter-workflow-family.json");
+  if (!await pathExists3(manifestPath)) return {};
+  return JSON.parse(await readFile14(manifestPath, "utf8"));
+}
+
 // src/bin.ts
 function defaultDependencies(overrides) {
   return {
     cwd: overrides.cwd ?? process.cwd(),
-    resourcesRoot: overrides.resourcesRoot ?? fileURLToPath(
-      new URL("../resources", import.meta.url)
-    ),
+    resourcesRoot: overrides.resourcesRoot ?? "",
     stdout: overrides.stdout ?? ((value) => process.stdout.write(value)),
     stderr: overrides.stderr ?? ((value) => process.stderr.write(value)),
     prompt: overrides.prompt ?? (async (question) => {
@@ -4751,10 +5181,27 @@ function defaultDependencies(overrides) {
   };
 }
 function addCommonOptions(command) {
-  return command.option("--dry-run").option("--yes").option("--json").option("--server-url <url>").option("--token-env <ENV_NAME>").option("--non-interactive").option("--agents <csv>").option("--codebuddy-surface <surface>");
+  return command.option("--dry-run").option("--yes").option("--json").option("--server-url <url>").option("--token-env <ENV_NAME>").option("--non-interactive").option("--agents <csv>").option("--codebuddy-surface <surface>").option("--workflow-family <slug>").option("--workflow-version <version>");
 }
 async function runCli(argv, overrides = {}) {
   const dependencies = defaultDependencies(overrides);
+  try {
+    const resolveOptions = {
+      cwd: dependencies.cwd,
+      env: dependencies.env,
+      override: overrides.resourcesRoot
+    };
+    if (overrides.pacoteExtract !== void 0) {
+      resolveOptions.pacoteExtract = overrides.pacoteExtract;
+    }
+    dependencies.resourcesRoot = await resolveWorkflowResourcesRoot(resolveOptions, argv);
+  } catch (error) {
+    if (error instanceof WorkflowDataResolutionError) {
+      dependencies.stderr(error.message + "\n");
+      return error.exitCode;
+    }
+    throw error;
+  }
   const program = addCommonOptions(new Command()).name("hunter-harness").description("Local-first, server-governed agent harness").option("--profile <name>").option("--config <file>").option("--force-managed").showHelpAfterError().exitOverride().configureOutput({
     writeOut: dependencies.stdout,
     writeErr: dependencies.stderr