hunter-harness 0.2.11 → 0.2.13

package/dist/bin.js

@@ -1115,7 +1115,7 @@ async function assertNoSymlinks(root, relativePath) {
 async function withRetry(action, options) {
   const attempts = options.attempts ?? 3;
   const sleep = options.sleep ?? (async (milliseconds) => {
-    await new Promise((resolve7) => setTimeout(resolve7, milliseconds));
+    await new Promise((resolve8) => setTimeout(resolve8, milliseconds));
   });
   let lastError;
   for (let attempt = 1; attempt <= attempts; attempt += 1) {
@@ -1230,6 +1230,9 @@ var HunterHarnessApiClient = class {
       body
     });
   }
+  async getProject(projectId, requestId) {
+    return this.request("GET", "/api/v1/projects/" + encodeURIComponent(projectId), { requestId });
+  }
   async createProposalSession(projectId, body, requestId, idempotencyKey) {
     return this.request("POST", "/api/v1/projects/" + encodeURIComponent(projectId) + "/proposal-sessions", { requestId, idempotencyKey, body });
   }
@@ -3454,8 +3457,8 @@ function resolvePushAuth(input) {
 }
 
 // ../core/dist/push/push.js
-import { lstat as lstat2, readFile as readFile9, readdir as readdir4, rm as rm4 } from "node:fs/promises";
-import { join as join10, relative, resolve as resolve5 } from "node:path";
+import { lstat as lstat3, readFile as readFile10, readdir as readdir4, rm as rm5 } from "node:fs/promises";
+import { join as join11, relative, resolve as resolve6 } from "node:path";
 import { parse as parseYaml5, stringify as stringifyYaml4 } from "yaml";
 
 // ../core/dist/state/baseline.js
@@ -3516,6 +3519,659 @@ async function acquireProtocolLock(projectRoot, operation, options = {}) {
   throw new Error("unable to acquire protocol lock");
 }
 
+// ../core/dist/sync/synchronize.js
+import { lstat as lstat2, readFile as readFile9, rm as rm4 } from "node:fs/promises";
+import { join as join10, resolve as resolve5 } from "node:path";
+
+// ../core/dist/update/conflicts.js
+function operationTargetPath(operation) {
+  return operation.operation === "rename" ? operation.to_path : operation.path;
+}
+function operationSourcePath(operation) {
+  return operation.operation === "rename" ? operation.from_path : operation.path;
+}
+function operationAlreadyApplied(operation, baseline, projectVersion) {
+  const target = baseline.files[operationTargetPath(operation)];
+  if (operation.operation === "delete") {
+    return target?.deleted === true && target.last_applied_version === projectVersion;
+  }
+  return target?.deleted === false && target?.last_applied_version === projectVersion && target.baseline_hash === operation.content_sha256;
+}
+function managedBlockDirty(currentContent, managedBlockHash) {
+  if (managedBlockHash === void 0) {
+    return true;
+  }
+  const block = extractManagedBlock(currentContent);
+  return block === null || sha256Bytes(block) !== managedBlockHash;
+}
+
+// ../core/dist/sync/artifact-rebase.js
+function expectedBase(operation) {
+  return operation.operation === "add" ? null : operation.base_content_sha256;
+}
+function contentHash(operation) {
+  return operation.operation === "delete" ? null : operation.content_sha256;
+}
+function baselineEntryFor(operation, finalContent, projectVersion) {
+  const block = finalContent === null ? null : extractManagedBlock(finalContent);
+  const remoteHash = contentHash(operation);
+  const localHash = finalContent === null ? null : sha256Bytes(finalContent);
+  return {
+    baseline_hash: remoteHash,
+    local_hash_at_apply: localHash,
+    file_kind: operation.file_kind,
+    last_applied_version: projectVersion,
+    deleted: operation.operation === "delete",
+    ...block === null ? {} : { managed_block_hash: sha256Bytes(block) }
+  };
+}
+function acknowledgedEntry(operation, context, projectVersion, reason) {
+  void reason;
+  const localContent = operation.operation === "delete" ? context.sourceContent : context.targetContent ?? context.sourceContent;
+  const block = localContent === null ? null : extractManagedBlock(localContent);
+  return {
+    baseline_hash: contentHash(operation),
+    local_hash_at_apply: localContent === null ? null : sha256Bytes(localContent),
+    file_kind: operation.file_kind,
+    last_applied_version: projectVersion,
+    deleted: operation.operation === "delete",
+    ...block === null ? {} : { managed_block_hash: sha256Bytes(block) }
+  };
+}
+function deletedSourceEntry(operation, projectVersion) {
+  return {
+    baseline_hash: null,
+    local_hash_at_apply: null,
+    file_kind: operation.file_kind,
+    last_applied_version: projectVersion,
+    deleted: true
+  };
+}
+function isRenameTargetCollision(operation, targetContent, incomingHash) {
+  if (operation.operation !== "rename" || targetContent === null) {
+    return false;
+  }
+  return incomingHash === null || sha256Bytes(targetContent) !== incomingHash;
+}
+function resolveDecision(path, reason, operation, conflictStrategy, resolveOverrides) {
+  if (reason === "target-collision") {
+    return "conflict";
+  }
+  if (reason === "local-dirty" && operation.operation === "rename") {
+    return "conflict";
+  }
+  const override = resolveOverrides?.get(path);
+  if (override !== void 0) {
+    return override;
+  }
+  if (conflictStrategy === "keep-local") {
+    return "keep-local";
+  }
+  if (conflictStrategy === "accept-remote") {
+    return "accept-remote";
+  }
+  return "conflict";
+}
+function computeFinalContent(operation, policy, targetContent, sourceContent, incoming) {
+  const incomingHash = contentHash(operation);
+  let equivalent = incomingHash !== null && targetContent !== null && sha256Bytes(targetContent) === incomingHash;
+  let finalContent = incoming;
+  if (policy.update_policy === "managed-block-only") {
+    if (operation.operation === "delete") {
+      finalContent = sourceContent === null ? null : removeManagedBlock(sourceContent);
+      equivalent = finalContent === sourceContent;
+    } else if (incoming !== null) {
+      const incomingBlock = extractManagedBlock(incoming) ?? incoming.trim();
+      const incomingId = extractSingleManagedBlockById(incoming)?.id;
+      const blockId = operation.operation === "add" || operation.operation === "modify" ? operation.block_id ?? incomingId : void 0;
+      finalContent = blockId !== void 0 ? upsertManagedBlockById(targetContent ?? "", blockId, incomingBlock) : upsertManagedBlock(targetContent ?? "", incomingBlock);
+      equivalent = finalContent === targetContent;
+    }
+  } else if (operation.operation === "delete" && sourceContent === null) {
+    equivalent = true;
+    finalContent = null;
+  } else if (equivalent) {
+    finalContent = targetContent;
+  }
+  return { finalContent, equivalent };
+}
+function isDirty(operation, policy, previous, sourceContent, targetContent, incoming) {
+  const incomingHash = contentHash(operation);
+  let equivalent = incomingHash !== null && targetContent !== null && sha256Bytes(targetContent) === incomingHash;
+  let dirty = false;
+  if (operation.operation === "add") {
+    if (targetContent !== null && !equivalent) {
+      if (policy.update_policy === "managed-block-only" && incoming !== null) {
+        const incomingBlock = extractManagedBlock(incoming) ?? incoming.trim();
+        equivalent = extractManagedBlock(targetContent) === incomingBlock;
+        dirty = !equivalent;
+      } else {
+        dirty = true;
+      }
+    }
+  } else if (equivalent) {
+    dirty = false;
+  } else if (sourceContent === null) {
+    dirty = operation.operation !== "delete";
+  } else if (policy.update_policy === "managed-block-only") {
+    dirty = previous?.managed_block_hash === void 0 ? (previous?.local_hash_at_apply ?? previous?.baseline_hash) !== sha256Bytes(sourceContent) : managedBlockDirty(sourceContent, previous.managed_block_hash);
+  } else {
+    dirty = (previous?.local_hash_at_apply ?? previous?.baseline_hash) !== sha256Bytes(sourceContent);
+  }
+  if (operation.operation === "rename" && targetContent !== null && !equivalent) {
+    dirty = true;
+  }
+  return { dirty, equivalent };
+}
+function pushBaselineUpdates(plan, operation, target, entry) {
+  plan.baselineUpdates.push({ path: target, entry });
+  if (operation.operation === "rename") {
+    plan.baselineUpdates.push({
+      path: operation.from_path,
+      entry: deletedSourceEntry(operation, entry.last_applied_version ?? null)
+    });
+  }
+}
+function recordWrite(plan, bucket, operation, target, content, equivalent, entry) {
+  const write = { operation, path: target, content, equivalent };
+  plan[bucket].push(write);
+  pushBaselineUpdates(plan, operation, target, entry);
+}
+function planArtifactRebase(input) {
+  const plan = {
+    applied: [],
+    acknowledged: [],
+    resolvedKeepLocal: [],
+    resolvedAcceptRemote: [],
+    alreadyApplied: [],
+    conflicts: [],
+    baselineUpdates: [],
+    baselineAdvanced: false
+  };
+  for (const context of input.contexts) {
+    const operation = context.operation;
+    const incoming = context.incomingContent;
+    const source = operationSourcePath(operation);
+    const target = operationTargetPath(operation);
+    const policy = classifyFile(target);
+    const incomingHash = contentHash(operation);
+    if (operationAlreadyApplied(operation, input.baseline, input.projectVersion)) {
+      plan.alreadyApplied.push({ path: target, operation });
+      continue;
+    }
+    const staticDecision = decideUpdate(policy, false);
+    if (!staticDecision.apply) {
+      const acknowledgeReason = staticDecision.reason === "protocol-only" ? "protocol-only" : "policy-never";
+      const entry2 = acknowledgedEntry(operation, context, input.projectVersion, acknowledgeReason);
+      plan.acknowledged.push({
+        operation,
+        path: target,
+        content: null,
+        equivalent: true,
+        acknowledgeReason
+      });
+      pushBaselineUpdates(plan, operation, target, entry2);
+      continue;
+    }
+    const previous = input.baseline.files[source];
+    const expected = expectedBase(operation);
+    const actualBaseline = previous?.baseline_hash ?? null;
+    if (expected !== actualBaseline) {
+      const decision = resolveDecision(target, "baseline-diverged", operation, input.conflictStrategy, input.resolveOverrides);
+      if (decision === "conflict") {
+        const conflict2 = {
+          path: target,
+          operation: operation.operation,
+          reason: "baseline-diverged",
+          actualBaselineHash: actualBaseline
+        };
+        if (expected !== null) {
+          conflict2.expectedBaselineHash = expected;
+        }
+        plan.conflicts.push(conflict2);
+        continue;
+      }
+      if (decision === "keep-local") {
+        const localContent = operation.operation === "rename" ? context.sourceContent : context.targetContent ?? context.sourceContent;
+        const entry2 = baselineEntryFor(operation, localContent, input.projectVersion);
+        recordWrite(plan, "resolvedKeepLocal", operation, target, localContent, true, entry2);
+        continue;
+      }
+      if (decision === "accept-remote") {
+        const { finalContent: finalContent2, equivalent: equivalent2 } = computeFinalContent(operation, policy, context.targetContent, context.sourceContent, incoming);
+        const entry2 = baselineEntryFor(operation, finalContent2, input.projectVersion);
+        recordWrite(plan, "resolvedAcceptRemote", operation, target, finalContent2, equivalent2, entry2);
+        continue;
+      }
+    }
+    const targetCollision = isRenameTargetCollision(operation, context.targetContent, incomingHash);
+    if (targetCollision) {
+      plan.conflicts.push({
+        path: target,
+        operation: operation.operation,
+        reason: "target-collision"
+      });
+      continue;
+    }
+    const { dirty, equivalent: preEquivalent } = isDirty(operation, policy, previous, context.sourceContent, context.targetContent, incoming);
+    if (dirty) {
+      const reason = operation.operation === "rename" && context.targetContent !== null && !preEquivalent ? "target-collision" : "local-dirty";
+      const decision = resolveDecision(target, reason, operation, input.conflictStrategy, input.resolveOverrides);
+      if (decision === "conflict") {
+        plan.conflicts.push({
+          path: target,
+          operation: operation.operation,
+          reason
+        });
+        continue;
+      }
+      if (decision === "keep-local") {
+        const localContent = operation.operation === "delete" ? context.sourceContent : operation.operation === "rename" ? context.sourceContent : context.targetContent ?? context.sourceContent;
+        const entry3 = baselineEntryFor(operation, localContent, input.projectVersion);
+        recordWrite(plan, "resolvedKeepLocal", operation, target, localContent, true, entry3);
+        continue;
+      }
+      const { finalContent: finalContent2, equivalent: equivalent2 } = computeFinalContent(operation, policy, context.targetContent, context.sourceContent, incoming);
+      const entry2 = baselineEntryFor(operation, finalContent2, input.projectVersion);
+      recordWrite(plan, "resolvedAcceptRemote", operation, target, finalContent2, equivalent2, entry2);
+      continue;
+    }
+    const { finalContent, equivalent } = computeFinalContent(operation, policy, context.targetContent, context.sourceContent, incoming);
+    const entry = baselineEntryFor(operation, finalContent, input.projectVersion);
+    if (equivalent) {
+      plan.alreadyApplied.push({ path: target, operation });
+      pushBaselineUpdates(plan, operation, target, entry);
+      continue;
+    }
+    recordWrite(plan, "applied", operation, target, finalContent, equivalent, entry);
+  }
+  plan.baselineAdvanced = plan.conflicts.length === 0;
+  return plan;
+}
+
+// ../core/dist/sync/synchronize.js
+var MAX_SYNC_ARTIFACT_ITERATIONS = 50;
+async function pathExists(path) {
+  try {
+    await lstat2(path);
+    return true;
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+async function optionalContent(root, path) {
+  const full = join10(root, path);
+  return await pathExists(full) ? readFile9(full, "utf8") : null;
+}
+function manifestPayloadHash(manifest) {
+  const payload = { ...manifest };
+  delete payload.manifest_sha256;
+  return sha256Bytes(canonicalJson(payload));
+}
+async function loadBlob(root, client, artifactId, operation, requestId, dryRun) {
+  if (operation.operation === "delete") {
+    return null;
+  }
+  const hash = operation.content_sha256;
+  const cacheRoot = join10(root, ".harness", "cache", "server-artifacts", artifactId);
+  const cachePath = join10(cacheRoot, "blobs", hash.replace(":", "_"));
+  if (await pathExists(cachePath) && await sha256File(cachePath) === hash) {
+    return readFile9(cachePath, "utf8");
+  }
+  const bytes = await client.downloadArtifactBlob(artifactId, hash, requestId);
+  if (bytes.byteLength !== operation.size_bytes || sha256Bytes(bytes) !== hash) {
+    await rm4(cachePath, { force: true });
+    throw new Error("ARTIFACT_HASH_MISMATCH");
+  }
+  if (!dryRun) {
+    await atomicWriteFile(cachePath, bytes);
+  }
+  return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+}
+function writeFromPlan(item2, keepLocalNoWrite) {
+  if (keepLocalNoWrite || item2.equivalent) {
+    return null;
+  }
+  const operation = item2.operation;
+  const target = operationTargetPath(operation);
+  if (operation.operation === "delete") {
+    return { operation: "delete", path: target };
+  }
+  if (operation.operation === "rename") {
+    return {
+      operation: "rename",
+      from_path: operation.from_path,
+      to_path: operation.to_path,
+      content: item2.content ?? ""
+    };
+  }
+  return {
+    operation: "modify",
+    path: target,
+    content: item2.content ?? ""
+  };
+}
+function collectWrites(plan) {
+  const ops = [];
+  for (const item2 of plan.applied) {
+    const op = writeFromPlan(item2, false);
+    if (op !== null)
+      ops.push(op);
+  }
+  for (const item2 of plan.resolvedAcceptRemote) {
+    const op = writeFromPlan(item2, false);
+    if (op !== null)
+      ops.push(op);
+  }
+  for (const item2 of plan.resolvedKeepLocal) {
+    const op = writeFromPlan(item2, true);
+    if (op !== null)
+      ops.push(op);
+  }
+  return ops;
+}
+function pathsFromPlan(plan) {
+  const applied = plan.applied.map((item2) => item2.path);
+  const acknowledged = plan.acknowledged.map((item2) => ({
+    path: item2.path,
+    operation: item2.operation.operation,
+    reason: item2.acknowledgeReason ?? "policy-never"
+  }));
+  return {
+    applied,
+    acknowledged,
+    resolvedKeepLocal: plan.resolvedKeepLocal.map((item2) => item2.path),
+    resolvedAcceptRemote: plan.resolvedAcceptRemote.map((item2) => item2.path),
+    alreadyApplied: plan.alreadyApplied.map((item2) => item2.path)
+  };
+}
+async function buildContexts(root, manifest, client, requestId, dryRun) {
+  const contexts = [];
+  for (const operation of manifest.files) {
+    const source = operationSourcePath(operation);
+    const target = operationTargetPath(operation);
+    const incoming = await loadBlob(root, client, manifest.artifact_id, operation, requestId, dryRun);
+    contexts.push({
+      operation,
+      incomingContent: incoming,
+      sourceContent: await optionalContent(root, source),
+      targetContent: target === source ? await optionalContent(root, source) : await optionalContent(root, target)
+    });
+  }
+  return contexts;
+}
+function applyBaselineUpdates(baseline, plan) {
+  const next = baselineManifestSchema.parse(structuredClone(baseline));
+  for (const update of plan.baselineUpdates) {
+    next.files[update.path] = update.entry;
+  }
+  return next;
+}
+async function planSingleArtifact(root, baseline, manifest, client, requestId, dryRun, conflictStrategy, resolveOverrides) {
+  if (manifest.project_version === null) {
+    throw new Error("artifact manifest missing project_version");
+  }
+  const contexts = await buildContexts(root, manifest, client, requestId, dryRun);
+  return planArtifactRebase({
+    baseline,
+    projectVersion: manifest.project_version,
+    contexts,
+    conflictStrategy,
+    ...resolveOverrides === void 0 ? {} : { resolveOverrides }
+  });
+}
+async function saveConflictReport(root, requestId, manifest, plan) {
+  const reportPath = join10(root, ".harness", "reports", "conflicts-" + requestId + ".json");
+  await atomicWriteJson(reportPath, {
+    schema_version: 1,
+    request_id: requestId,
+    artifact_id: manifest.artifact_id,
+    project_version: manifest.project_version,
+    conflicts: plan.conflicts,
+    resolve_hint: "npx hunter-harness update --resolve <path>=keep-local|accept-remote"
+  });
+}
+async function synchronizeArtifacts(options, initialBaseline) {
+  const root = resolve5(options.projectRoot);
+  const projectId = options.project.project.project_id;
+  if (projectId === null) {
+    throw new Error("PROJECT_NOT_BOUND");
+  }
+  let baseline = initialBaseline;
+  const seenArtifactIds = /* @__PURE__ */ new Set();
+  const aggregate = {
+    requestId: options.requestId,
+    projectId,
+    artifactsProcessed: 0,
+    applied: [],
+    acknowledged: [],
+    resolvedKeepLocal: [],
+    resolvedAcceptRemote: [],
+    alreadyApplied: [],
+    conflicts: [],
+    skipped: [],
+    operations: [],
+    artifactId: null,
+    observedProjectVersion: null,
+    transactionId: null,
+    dryRun: options.dryRun,
+    baselineAdvanced: false
+  };
+  const conflictStrategy = options.conflictStrategy ?? "manual";
+  for (let iteration = 0; iteration < MAX_SYNC_ARTIFACT_ITERATIONS; iteration++) {
+    const discovery = await options.client.getUpdateManifest(projectId, {
+      base_project_version: baseline.complete_project_version,
+      base_manifest_hash: sha256Bytes(canonicalJson(baseline)),
+      adapter: options.project.adapters.enabled[0] ?? "claude-code",
+      profile: options.project.project.profiles[0] ?? "general"
+    }, options.requestId);
+    aggregate.observedProjectVersion = discovery.observed_project_version;
+    if (!discovery.delta_available || discovery.artifact_id === null) {
+      aggregate.baselineAdvanced = aggregate.conflicts.length === 0;
+      return aggregate;
+    }
+    if (seenArtifactIds.has(discovery.artifact_id)) {
+      throw new Error("DUPLICATE_ARTIFACT_ID:" + discovery.artifact_id);
+    }
+    seenArtifactIds.add(discovery.artifact_id);
+    if (options.stopAfterArtifactId === discovery.artifact_id) {
+      return aggregate;
+    }
+    const manifest = artifactManifestSchema.parse(await options.client.getArtifactManifest(discovery.artifact_id, options.requestId));
+    if (manifest.artifact_id !== discovery.artifact_id || manifest.project_id !== projectId || manifest.project_version === null || manifestPayloadHash(manifest) !== manifest.manifest_sha256) {
+      throw new Error("ARTIFACT_HASH_MISMATCH");
+    }
+    let plan = await planSingleArtifact(root, baseline, manifest, options.client, options.requestId, options.dryRun, conflictStrategy, options.resolveOverrides);
+    if (plan.conflicts.length > 0 && options.confirmConflictStrategy !== void 0) {
+      const confirmed = await options.confirmConflictStrategy(plan.conflicts);
+      if (confirmed === false) {
+        aggregate.conflicts = plan.conflicts;
+        aggregate.skipped = plan.conflicts.map((item2) => ({
+          path: item2.path,
+          operation: item2.operation,
+          reason: item2.reason
+        }));
+        aggregate.operations = manifest.files;
+        aggregate.artifactId = manifest.artifact_id;
+        return aggregate;
+      }
+      plan = await planSingleArtifact(root, baseline, manifest, options.client, options.requestId, options.dryRun, confirmed, options.resolveOverrides);
+    }
+    const paths = pathsFromPlan(plan);
+    aggregate.applied.push(...paths.applied);
+    aggregate.acknowledged.push(...paths.acknowledged);
+    aggregate.resolvedKeepLocal.push(...paths.resolvedKeepLocal);
+    aggregate.resolvedAcceptRemote.push(...paths.resolvedAcceptRemote);
+    aggregate.alreadyApplied.push(...paths.alreadyApplied);
+    aggregate.operations = manifest.files;
+    aggregate.artifactId = manifest.artifact_id;
+    aggregate.artifactsProcessed += 1;
+    if (plan.conflicts.length > 0) {
+      aggregate.conflicts = plan.conflicts;
+      aggregate.skipped = plan.conflicts.map((item2) => ({
+        path: item2.path,
+        operation: item2.operation,
+        reason: item2.reason
+      }));
+      if (conflictStrategy !== "manual") {
+        if (!options.dryRun) {
+          await saveConflictReport(root, options.requestId, manifest, plan);
+        }
+        return aggregate;
+      }
+    }
+    const hasApplicableWork = plan.applied.length > 0 || plan.acknowledged.length > 0 || plan.resolvedKeepLocal.length > 0 || plan.resolvedAcceptRemote.length > 0 || plan.baselineUpdates.length > 0;
+    if (plan.conflicts.length > 0 && !hasApplicableWork) {
+      if (!options.dryRun) {
+        await saveConflictReport(root, options.requestId, manifest, plan);
+      }
+      return aggregate;
+    }
+    if (options.dryRun) {
+      baseline = applyBaselineUpdates(baseline, plan);
+      if (plan.baselineAdvanced && plan.conflicts.length === 0) {
+        baseline.complete_project_version = manifest.project_version;
+        baseline.artifact_manifest_hash = manifest.manifest_sha256;
+        baseline.latest_artifact_id = manifest.artifact_id;
+      }
+      if (plan.conflicts.length > 0) {
+        return aggregate;
+      }
+      continue;
+    }
+    await atomicWriteJson(join10(root, ".harness", "cache", "server-artifacts", manifest.artifact_id, "manifest.json"), manifest);
+    const lock = await acquireProtocolLock(root, "update", { requestId: options.requestId });
+    try {
+      const nextBaseline = applyBaselineUpdates(baseline, plan);
+      if (plan.baselineAdvanced && plan.conflicts.length === 0) {
+        nextBaseline.complete_project_version = manifest.project_version;
+        nextBaseline.artifact_manifest_hash = manifest.manifest_sha256;
+        nextBaseline.latest_artifact_id = manifest.artifact_id;
+      }
+      const transactionId = "tx_sync_" + Date.now() + "_" + options.requestId;
+      const reportPath = ".harness/reports/update-" + options.requestId + ".json";
+      const report = {
+        schema_version: 2,
+        request_id: options.requestId,
+        artifact_id: manifest.artifact_id,
+        observed_project_version: manifest.project_version,
+        status: plan.conflicts.length === 0 ? "applied" : "partial_due_to_conflicts",
+        applied: paths.applied,
+        acknowledged: paths.acknowledged,
+        resolved_keep_local: paths.resolvedKeepLocal,
+        resolved_accept_remote: paths.resolvedAcceptRemote,
+        already_applied: paths.alreadyApplied,
+        conflicts: plan.conflicts,
+        skipped: aggregate.skipped,
+        transaction_id: transactionId
+      };
+      const fileOps = collectWrites(plan);
+      fileOps.push({
+        operation: "modify",
+        path: ".harness/state/baseline/manifest.json",
+        content: JSON.stringify(nextBaseline, null, 2) + "\n"
+      }, {
+        operation: "add",
+        path: reportPath,
+        content: JSON.stringify(report, null, 2) + "\n"
+      }, {
+        operation: "modify",
+        path: ".harness/state/local/last-update.json",
+        content: JSON.stringify(report, null, 2) + "\n"
+      });
+      await runTransaction(root, fileOps, {
+        id: transactionId,
+        kind: "update",
+        ...options.transactionOptions ?? {}
+      });
+      aggregate.transactionId = transactionId;
+      baseline = nextBaseline;
+      if (plan.conflicts.length > 0) {
+        await saveConflictReport(root, options.requestId, manifest, plan);
+        aggregate.baselineAdvanced = false;
+        return aggregate;
+      }
+    } finally {
+      await lock.release();
+    }
+  }
+  throw new Error("MAX_SYNC_ARTIFACT_ITERATIONS_EXCEEDED");
+}
+function baselineEntryFromOperation(manifest, operation, localContent) {
+  const block = localContent === null ? null : extractManagedBlock(localContent);
+  return {
+    baseline_hash: operation.operation === "delete" ? null : operation.content_sha256,
+    local_hash_at_apply: localContent === null ? null : sha256Bytes(localContent),
+    file_kind: operation.file_kind,
+    last_applied_version: manifest.project_version,
+    deleted: operation.operation === "delete",
+    ...block === null ? {} : { managed_block_hash: sha256Bytes(block) }
+  };
+}
+async function advanceBaselineFromArtifact(options, baseline) {
+  const root = resolve5(options.projectRoot);
+  if (options.manifest.project_version === null) {
+    throw new Error("artifact manifest missing project_version");
+  }
+  let localChanged = false;
+  for (const operation of options.manifest.files) {
+    const source = operationSourcePath(operation);
+    const target = operationTargetPath(operation);
+    const sourceContent = await optionalContent(root, source);
+    const targetContent = target === source ? sourceContent : await optionalContent(root, target);
+    if (operation.operation === "delete") {
+      if (sourceContent !== null) {
+        localChanged = true;
+      }
+      continue;
+    }
+    const expectedHash = operation.content_sha256;
+    const actualContent = targetContent ?? sourceContent;
+    const actualHash = actualContent === null ? null : sha256Bytes(actualContent);
+    if (actualHash !== expectedHash) {
+      localChanged = true;
+    }
+  }
+  if (localChanged) {
+    return { baseline, localChanged: true, transactionId: null };
+  }
+  const nextBaseline = baselineManifestSchema.parse(structuredClone(baseline));
+  for (const operation of options.manifest.files) {
+    const source = operationSourcePath(operation);
+    const target = operationTargetPath(operation);
+    const sourceContent = await optionalContent(root, source);
+    const targetContent = target === source ? sourceContent : await optionalContent(root, target);
+    const localContent = operation.operation === "delete" ? null : targetContent ?? sourceContent;
+    nextBaseline.files[target] = baselineEntryFromOperation(options.manifest, operation, localContent);
+    if (operation.operation === "rename") {
+      nextBaseline.files[operation.from_path] = {
+        baseline_hash: null,
+        local_hash_at_apply: null,
+        file_kind: operation.file_kind,
+        last_applied_version: options.manifest.project_version,
+        deleted: true
+      };
+    }
+  }
+  nextBaseline.complete_project_version = options.manifest.project_version;
+  nextBaseline.artifact_manifest_hash = options.manifest.manifest_sha256;
+  nextBaseline.latest_artifact_id = options.manifest.artifact_id;
+  const transactionId = "tx_push_baseline_" + Date.now();
+  await runTransaction(root, [{
+    operation: "modify",
+    path: ".harness/state/baseline/manifest.json",
+    content: JSON.stringify(nextBaseline, null, 2) + "\n"
+  }], {
+    id: transactionId,
+    kind: "update",
+    ...options.transactionOptions ?? {}
+  });
+  return { baseline: nextBaseline, localChanged: false, transactionId };
+}
+
 // ../core/dist/push/push.js
 var PushWorkflowError = class extends Error {
   exitCode;
@@ -3542,7 +4198,7 @@ var SHARED_MANAGED_FILES = [
 ];
 async function exists3(path) {
   try {
-    await lstat2(path);
+    await lstat3(path);
     return true;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -3556,7 +4212,7 @@ async function walkFiles(root, current, output) {
     return;
   }
   for (const item2 of await readdir4(current, { withFileTypes: true })) {
-    const path = join10(current, item2.name);
+    const path = join11(current, item2.name);
     if (item2.isSymbolicLink()) {
       throw new PushWorkflowError("symlink is not pushable", 6, "UNSAFE_SYMLINK");
     }
@@ -3578,7 +4234,7 @@ async function walkHarnessEntries(root, directory, output) {
     return;
   for (const item2 of await readdir4(directory, { withFileTypes: true })) {
     if (item2.name.startsWith("harness-")) {
-      const path = join10(directory, item2.name);
+      const path = join11(directory, item2.name);
       if (item2.isDirectory()) {
         await walkFiles(root, path, output);
       } else if (item2.isFile()) {
@@ -3588,7 +4244,7 @@ async function walkHarnessEntries(root, directory, output) {
   }
 }
 async function managedFiles(projectRoot, project) {
-  const root = resolve5(projectRoot);
+  const root = resolve6(projectRoot);
   const paths = [];
   const adapters = getAdapters(enabledHarnessAgents(project));
   const managedFiles2 = [
@@ -3597,25 +4253,25 @@ async function managedFiles(projectRoot, project) {
     ...adapters.some((adapter) => adapter.name === "codebuddy") ? ["CODEBUDDY.md"] : []
   ];
   for (const path of managedFiles2) {
-    if (await exists3(join10(root, path))) {
+    if (await exists3(join11(root, path))) {
       paths.push(path);
     }
   }
   for (const path of SHARED_MANAGED_ROOTS) {
-    await walkFiles(root, join10(root, path), paths);
+    await walkFiles(root, join11(root, path), paths);
   }
   for (const adapter of adapters) {
     if (adapter.rulesRoot !== null) {
-      await walkFiles(root, join10(root, adapter.rulesRoot), paths);
+      await walkFiles(root, join11(root, adapter.rulesRoot), paths);
     }
-    await walkHarnessEntries(root, join10(root, adapter.skillsRoot), paths);
+    await walkHarnessEntries(root, join11(root, adapter.skillsRoot), paths);
     if (adapter.agentsRoot !== null) {
-      await walkHarnessEntries(root, join10(root, adapter.agentsRoot), paths);
+      await walkHarnessEntries(root, join11(root, adapter.agentsRoot), paths);
     }
   }
   const result = {};
   for (const path of [...new Set(paths)].sort()) {
-    result[path] = await readFile9(join10(root, path), "utf8");
+    result[path] = await readFile10(join11(root, path), "utf8");
   }
   return result;
 }
@@ -3624,14 +4280,14 @@ function proposalBaseline(baseline) {
 }
 async function readProject(root) {
   try {
-    return projectConfigSchema.parse(parseYaml5(await readFile9(join10(root, ".harness", "project.yaml"), "utf8")));
+    return projectConfigSchema.parse(parseYaml5(await readFile10(join11(root, ".harness", "project.yaml"), "utf8")));
   } catch {
     throw new PushWorkflowError("project configuration is missing or invalid", 3, "PROJECT_CONFIG_INVALID");
   }
 }
 async function readOptionalJson(path) {
   try {
-    return JSON.parse(await readFile9(path, "utf8"));
+    return JSON.parse(await readFile10(path, "utf8"));
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return null;
@@ -3643,7 +4299,7 @@ async function clientIdFor(root, explicit) {
   if (explicit !== void 0) {
     return explicit;
   }
-  const path = join10(root, ".harness", "state", "local", "client.json");
+  const path = join11(root, ".harness", "state", "local", "client.json");
   const existing = await readOptionalJson(path);
   if (typeof existing?.client_id === "string" && /^cli_[A-Za-z0-9_-]+$/.test(existing.client_id)) {
     return existing.client_id;
@@ -3732,6 +4388,35 @@ function assertPreviewAllowed(preview, skip) {
   }
 }
 var CREDENTIALS_HINT = "\u53EF\u5728\u4EA4\u4E92\u6A21\u5F0F\u4E0B\u5F55\u5165\uFF0C\u6216\u5199\u5165 .harness/credentials.local.yaml\uFF08\u52FF\u63D0\u4EA4 git\uFF09";
+var STALE_BASELINE_MESSAGE = "\u670D\u52A1\u7AEF artifact \u5DF2\u66F4\u65B0\uFF0C\u8BF7\u5148\u6267\u884C npx hunter-harness update\uFF08\u51B2\u7A81\u53EF\u7528 update --resolve <path>=keep-local|accept-remote\uFF09\u518D\u63A8";
+function staleBaselineError(code, conflicts) {
+  const conflictHint = conflicts !== void 0 && conflicts.length > 0 ? " \u51B2\u7A81\u6587\u4EF6\uFF1A" + conflicts.map((item2) => item2.path).join(", ") : "";
+  return new PushWorkflowError(STALE_BASELINE_MESSAGE + conflictHint, 5, code);
+}
+async function syncToLatest(root, project, baseline, client) {
+  const syncResult = await synchronizeArtifacts({
+    projectRoot: root,
+    project,
+    client,
+    requestId: uuidV7(),
+    dryRun: false,
+    conflictStrategy: "manual"
+  }, baseline);
+  if (syncResult.conflicts.length > 0) {
+    throw staleBaselineError("PROJECT_VERSION_CONFLICT", syncResult.conflicts);
+  }
+  return await readBaseline(root);
+}
+async function autoRebaseIfServerAdvanced(root, project, baseline, client, remoteVersion) {
+  if (remoteVersion === baseline.complete_project_version) {
+    return baseline;
+  }
+  const updated = await syncToLatest(root, project, baseline, client);
+  if (remoteVersion !== null && updated.complete_project_version !== remoteVersion) {
+    throw staleBaselineError("PROJECT_VERSION_CONFLICT");
+  }
+  return updated;
+}
 function makePreview(baseline, files, confirmedProjectLocal, ignorePaths, deletedAt = (/* @__PURE__ */ new Date()).toISOString()) {
   const filteredFiles = {};
   for (const [path, content] of Object.entries(files)) {
@@ -3770,20 +4455,18 @@ async function bindProject(root, project, baseline, projectId) {
   return { project: nextProject, baseline: nextBaseline };
 }
 async function pushProject(options) {
-  const root = resolve5(options.projectRoot);
+  const root = resolve6(options.projectRoot);
   let project = await readProject(root);
   let baseline = await readBaseline(root);
   const profile = parseHarnessProfile(project.project.profiles[0]);
   const installedPaths = profile === null ? /* @__PURE__ */ new Set() : new Set(await Promise.all(enabledHarnessAgents(project).map((agent) => managedBundleTargets(options.resourcesRoot, profile, agent))).then((targets) => targets.flatMap((target) => [...target])));
   let preview = makePreview(baseline, await managedFiles(root, project), options.confirmedProjectLocal ?? [], installedPaths);
-  const initialSkip = await resolveSensitiveScanSkip(preview, options);
-  if (initialSkip.cancelled === true) {
-    return { preview, proposalId: null, projectId: project.project.project_id, cancelled: true };
-  }
-  let sensitiveScanSkip = initialSkip.skip;
-  let sensitiveScanSkipReason = initialSkip.reason;
-  assertPreviewAllowed(preview, sensitiveScanSkip);
   if (options.dryRun) {
+    const drySkip = await resolveSensitiveScanSkip(preview, options);
+    if (drySkip.cancelled === true) {
+      return { preview, proposalId: null, projectId: project.project.project_id, cancelled: true };
+    }
+    assertPreviewAllowed(preview, drySkip.skip);
     return { preview, proposalId: null, projectId: project.project.project_id };
   }
   const localCredentials = await readLocalCredentials(root);
@@ -3817,10 +4500,28 @@ async function pushProject(options) {
   if (parsedServerUrl.protocol !== "https:") {
     throw new PushWorkflowError("server_url must use HTTPS", 3, "SERVER_URL_INVALID");
   }
+  const client = new HunterHarnessApiClient({
+    serverUrl: parsedServerUrl.toString(),
+    token,
+    ...options.fetch === void 0 ? {} : { fetch: options.fetch }
+  });
+  const boundAtStart = project.project.project_id;
+  if (boundAtStart !== null) {
+    const remote = await client.getProject(boundAtStart, uuidV7());
+    baseline = await autoRebaseIfServerAdvanced(root, project, baseline, client, remote.latest_project_version);
+    preview = makePreview(baseline, await managedFiles(root, project), options.confirmedProjectLocal ?? [], installedPaths);
+  }
+  const initialSkip = await resolveSensitiveScanSkip(preview, options);
+  if (initialSkip.cancelled === true) {
+    return { preview, proposalId: null, projectId: project.project.project_id, cancelled: true };
+  }
+  let sensitiveScanSkip = initialSkip.skip;
+  let sensitiveScanSkipReason = initialSkip.reason;
+  assertPreviewAllowed(preview, sensitiveScanSkip);
   if (options.confirmProposal !== void 0 && !await options.confirmProposal(preview)) {
     return { preview, proposalId: null, projectId: project.project.project_id, cancelled: true };
   }
-  const workflowPath = join10(root, ".harness", "state", "local", "push-workflow.json");
+  const workflowPath = join11(root, ".harness", "state", "local", "push-workflow.json");
   const priorWorkflow = await readOptionalJson(workflowPath);
   const provisionalRequestId = priorWorkflow?.local_project_key === project.project.local_project_key ? priorWorkflow.request_id : uuidV7();
   const lock = await acquireProtocolLock(root, "push", { requestId: provisionalRequestId });
@@ -3831,11 +4532,6 @@ async function pushProject(options) {
     await atomicWriteJson(workflowPath, workflow);
     preview = makePreview(baseline, await managedFiles(root, project), options.confirmedProjectLocal ?? [], installedPaths, workflow.created_at);
     const requestId = workflow.request_id;
-    const client = new HunterHarnessApiClient({
-      serverUrl: parsedServerUrl.toString(),
-      token,
-      ...options.fetch === void 0 ? {} : { fetch: options.fetch }
-    });
     if (project.project.project_id === null) {
       const resolved = await client.resolveProject({
         schema_version: 1,
@@ -3916,7 +4612,9 @@ async function pushProject(options) {
         });
       }
     }
-    const finalized = await client.finalizeProposal(session.session_id, {
+    let finalizeRetried = false;
+    let finalized;
+    const finalizeOnce = async () => client.finalizeProposal(session.session_id, {
       schema_version: 1,
       manifest_sha256: proposalManifestHash,
       base_artifact_id: baseline.latest_artifact_id ?? null,
@@ -3925,7 +4623,60 @@ async function pushProject(options) {
         ...sensitiveScanSkipReason === void 0 ? {} : { sensitive_scan_skip_reason: sensitiveScanSkipReason }
       } : {}
     }, requestId, workflow.finalize_idempotency_key);
-    await atomicWriteJson(join10(root, ".harness", "state", "local", "push-results", finalized.proposal_id + ".json"), {
+    try {
+      finalized = await finalizeOnce();
+    } catch (error) {
+      if (error instanceof ApiError && (error.code === "STALE_PUSH" || error.code === "PROJECT_VERSION_CONFLICT") && !finalizeRetried) {
+        finalizeRetried = true;
+        baseline = await syncToLatest(root, project, baseline, client);
+        workflow = resetSession(workflow, proposalManifestHash);
+        await atomicWriteJson(workflowPath, workflow);
+        session = await client.createProposalSession(projectId, {
+          schema_version: 1,
+          request_id: requestId,
+          client_id: clientId,
+          base_project_version: baseline.complete_project_version,
+          base_manifest_hash: sha256Bytes(canonicalJson(baseline)),
+          proposal_manifest: { files: preview.operations },
+          artifact_manifest: { schema_version: 1, files: preview.operations }
+        }, requestId, workflow.session_idempotency_key);
+        workflow.session_id = session.session_id;
+        workflow.session_expires_at = session.expires_at;
+        workflow.max_chunk_bytes = session.max_chunk_bytes;
+        await atomicWriteJson(workflowPath, workflow);
+        try {
+          finalized = await finalizeOnce();
+        } catch (retryError) {
+          if (retryError instanceof ApiError && (retryError.code === "STALE_PUSH" || retryError.code === "PROJECT_VERSION_CONFLICT")) {
+            throw staleBaselineError(retryError.code);
+          }
+          throw retryError;
+        }
+      } else if (error instanceof ApiError && (error.code === "STALE_PUSH" || error.code === "PROJECT_VERSION_CONFLICT")) {
+        throw staleBaselineError(error.code);
+      } else {
+        throw error;
+      }
+    }
+    let pushWarning;
+    if (finalized.artifact_id !== null) {
+      try {
+        const publishedManifest = artifactManifestSchema.parse(await client.getArtifactManifest(finalized.artifact_id, requestId));
+        const advanced = await advanceBaselineFromArtifact({
+          projectRoot: root,
+          manifest: publishedManifest,
+          requestId
+        }, baseline);
+        if (advanced.localChanged) {
+          pushWarning = "LOCAL_CHANGED_DURING_PUSH";
+        } else {
+          baseline = advanced.baseline;
+        }
+      } catch {
+        pushWarning = "BASELINE_ADVANCE_DEFERRED";
+      }
+    }
+    await atomicWriteJson(join11(root, ".harness", "state", "local", "push-results", finalized.proposal_id + ".json"), {
       schema_version: 1,
       request_id: requestId,
       project_id: projectId,
@@ -3933,17 +4684,24 @@ async function pushProject(options) {
       status: finalized.status,
       artifact_id: finalized.artifact_id,
       operation_count: preview.operations.length,
+      warning: pushWarning ?? null,
       recorded_at: (/* @__PURE__ */ new Date()).toISOString()
     });
-    await rm4(workflowPath, { force: true });
-    return { preview, proposalId: finalized.proposal_id, projectId, artifactId: finalized.artifact_id };
+    await rm5(workflowPath, { force: true });
+    return {
+      preview,
+      proposalId: finalized.proposal_id,
+      projectId,
+      artifactId: finalized.artifact_id,
+      ...pushWarning === void 0 ? {} : { warning: pushWarning }
+    };
   } catch (error) {
     if (error instanceof PushWorkflowError) {
       throw error;
     }
     if (error instanceof ApiError) {
-      if (error.code === "STALE_PUSH") {
-        throw new PushWorkflowError("\u670D\u52A1\u7AEF\u5DF2\u6709\u66F4\u65B0\u7684\u63A8\u9001\uFF0C\u8BF7\u5148 git pull \u540E\u6267\u884C npx hunter-harness update \u518D\u63A8", 5, "STALE_PUSH");
+      if (error.code === "STALE_PUSH" || error.code === "PROJECT_VERSION_CONFLICT") {
+        throw staleBaselineError(error.code);
       }
       if (error.code === "SENSITIVE_CONTENT_BLOCKED") {
         const details = error.details;
@@ -3963,8 +4721,8 @@ async function pushProject(options) {
 }
 
 // ../core/dist/state/cleanup.js
-import { readFile as readFile10, readdir as readdir5, rm as rm5 } from "node:fs/promises";
-import { join as join11 } from "node:path";
+import { readFile as readFile11, readdir as readdir5, rm as rm6 } from "node:fs/promises";
+import { join as join12 } from "node:path";
 function isSafeEntryName(name) {
   return name.length > 0 && !name.includes("/") && !name.includes("\\") && name !== "." && name !== ".." && !name.includes("\0");
 }
@@ -3988,7 +4746,7 @@ async function cleanupProject(options) {
       continue;
     let journal;
     try {
-      journal = JSON.parse(await readFile10(join11(layout.transactions, name, "journal.json"), "utf8"));
+      journal = JSON.parse(await readFile11(join12(layout.transactions, name, "journal.json"), "utf8"));
     } catch {
       continue;
     }
@@ -4006,7 +4764,7 @@ async function cleanupProject(options) {
         continue;
       pruned.push(entry.id);
       if (!options.dryRun) {
-        await rm5(join11(layout.transactions, entry.id), { recursive: true, force: true });
+        await rm6(join12(layout.transactions, entry.id), { recursive: true, force: true });
       }
     }
   }
@@ -4015,7 +4773,7 @@ async function cleanupProject(options) {
       continue;
     removedCache.push(name);
     if (!options.dryRun) {
-      await rm5(join11(layout.serverArtifacts, name), { recursive: true, force: true });
+      await rm6(join12(layout.serverArtifacts, name), { recursive: true, force: true });
     }
   }
   return {
@@ -4069,10 +4827,10 @@ var AGENT_DESCRIPTORS = {
 var INSTALLABLE_AGENTS = Object.keys(AGENT_DESCRIPTORS).filter((agent) => AGENT_DESCRIPTORS[agent]?.installable === true);
 
 // ../core/dist/transaction/recovery.js
-import { readFile as readFile11, readdir as readdir6, rm as rm6, stat as stat3 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { readFile as readFile12, readdir as readdir6, rm as rm7, stat as stat3 } from "node:fs/promises";
+import { join as join13 } from "node:path";
 async function recoverTransaction(projectRoot, transactionId) {
-  const journal = JSON.parse(await readFile11(join12(stateLayout(projectRoot).transactions, transactionId, "journal.json"), "utf8"));
+  const journal = JSON.parse(await readFile12(join13(stateLayout(projectRoot).transactions, transactionId, "journal.json"), "utf8"));
   if (journal.state === "committed") {
     return { transactionId, status: "committed" };
   }
@@ -4099,7 +4857,7 @@ async function listTransactions(projectRoot) {
   const transactions = [];
   for (const transactionId of names) {
     try {
-      const journal = JSON.parse(await readFile11(join12(root, transactionId, "journal.json"), "utf8"));
+      const journal = JSON.parse(await readFile12(join13(root, transactionId, "journal.json"), "utf8"));
       transactions.push({
         transactionId,
         kind: journal.kind,
@@ -4114,7 +4872,7 @@ async function listTransactions(projectRoot) {
 async function pendingTransactions(projectRoot) {
   return (await listTransactions(projectRoot)).filter((item2) => RECOVERY_STATES.has(item2.state));
 }
-async function pathExists(path) {
+async function pathExists2(path) {
   try {
     await stat3(path);
     return true;
@@ -4130,12 +4888,12 @@ async function rollbackLatestCommittedUpdate(projectRoot) {
   if (latest === void 0) {
     throw new Error("no committed update transaction is available for rollback");
   }
-  const transactionRoot = join12(stateLayout(projectRoot).transactions, latest.transactionId);
-  const journal = JSON.parse(await readFile11(join12(transactionRoot, "journal.json"), "utf8"));
-  const after = JSON.parse(await readFile11(join12(transactionRoot, "after", "manifest.json"), "utf8"));
+  const transactionRoot = join13(stateLayout(projectRoot).transactions, latest.transactionId);
+  const journal = JSON.parse(await readFile12(join13(transactionRoot, "journal.json"), "utf8"));
+  const after = JSON.parse(await readFile12(join13(transactionRoot, "after", "manifest.json"), "utf8"));
   for (const entry of after) {
-    const target = join12(projectRoot, entry.path);
-    const exists6 = await pathExists(target);
+    const target = join13(projectRoot, entry.path);
+    const exists6 = await pathExists2(target);
     if (exists6 !== entry.exists || exists6 && await sha256File(target) !== entry.hash) {
       throw new Error("cannot rollback dirty path: " + entry.path);
     }
@@ -4147,10 +4905,10 @@ async function rollbackLatestCommittedUpdate(projectRoot) {
       continue;
     }
     seen.add(snapshot.path);
-    const target = join12(projectRoot, snapshot.path);
-    const exists6 = await pathExists(target);
+    const target = join13(projectRoot, snapshot.path);
+    const exists6 = await pathExists2(target);
     if (snapshot.existed && snapshot.snapshot_name !== null) {
-      const content = await readFile11(join12(transactionRoot, "before", snapshot.snapshot_name));
+      const content = await readFile12(join13(transactionRoot, "before", snapshot.snapshot_name));
       operations.push({
         operation: exists6 ? "modify" : "add",
         path: snapshot.path,
@@ -4179,7 +4937,7 @@ async function cleanupOldTransactions(projectRoot, now = /* @__PURE__ */ new Dat
     if (!removable) {
       continue;
     }
-    await rm6(join12(stateLayout(projectRoot).transactions, item2.transactionId), {
+    await rm7(join13(stateLayout(projectRoot).transactions, item2.transactionId), {
       recursive: true,
       force: true
     });
@@ -4188,31 +4946,9 @@ async function cleanupOldTransactions(projectRoot, now = /* @__PURE__ */ new Dat
   return removed;
 }
 
-// ../core/dist/update/conflicts.js
-function operationTargetPath(operation) {
-  return operation.operation === "rename" ? operation.to_path : operation.path;
-}
-function operationSourcePath(operation) {
-  return operation.operation === "rename" ? operation.from_path : operation.path;
-}
-function operationAlreadyApplied(operation, baseline, projectVersion) {
-  const target = baseline.files[operationTargetPath(operation)];
-  if (operation.operation === "delete") {
-    return target?.deleted === true && target.last_applied_version === projectVersion;
-  }
-  return target?.deleted === false && target?.last_applied_version === projectVersion && target.baseline_hash === operation.content_sha256;
-}
-function managedBlockDirty(currentContent, managedBlockHash) {
-  if (managedBlockHash === void 0) {
-    return true;
-  }
-  const block = extractManagedBlock(currentContent);
-  return block === null || sha256Bytes(block) !== managedBlockHash;
-}
-
 // ../core/dist/update/update.js
-import { lstat as lstat3, readFile as readFile12, rm as rm7 } from "node:fs/promises";
-import { join as join13, resolve as resolve6 } from "node:path";
+import { readFile as readFile13 } from "node:fs/promises";
+import { join as join14, resolve as resolve7 } from "node:path";
 import { parse as parseYaml8 } from "yaml";
 var UpdateWorkflowError = class extends Error {
   exitCode;
@@ -4224,107 +4960,31 @@ var UpdateWorkflowError = class extends Error {
     this.code = code;
   }
 };
-async function pathExists2(path) {
-  try {
-    await lstat3(path);
-    return true;
-  } catch (error) {
-    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-      return false;
-    }
-    throw error;
-  }
-}
-async function optionalContent(path) {
-  return await pathExists2(path) ? readFile12(path, "utf8") : null;
-}
-function manifestPayloadHash(manifest) {
-  const payload = { ...manifest };
-  delete payload.manifest_sha256;
-  return sha256Bytes(canonicalJson(payload));
-}
-function expectedBase(operation) {
-  return operation.operation === "add" ? null : operation.base_content_sha256;
-}
-function contentHash(operation) {
-  return operation.operation === "delete" ? null : operation.content_sha256;
-}
-async function loadBlob(root, client, artifactId, operation, requestId, dryRun) {
-  if (operation.operation === "delete") {
-    return null;
-  }
-  const hash = operation.content_sha256;
-  const cacheRoot = join13(root, ".harness", "cache", "server-artifacts", artifactId);
-  const cachePath = join13(cacheRoot, "blobs", hash.replace(":", "_"));
-  if (await pathExists2(cachePath) && await sha256File(cachePath) === hash) {
-    return readFile12(cachePath, "utf8");
-  }
-  const bytes = await client.downloadArtifactBlob(artifactId, hash, requestId);
-  if (bytes.byteLength !== operation.size_bytes || sha256Bytes(bytes) !== hash) {
-    await rm7(cachePath, { force: true });
-    throw new UpdateWorkflowError("artifact blob size or hash mismatch", 4, "ARTIFACT_HASH_MISMATCH");
-  }
-  if (!dryRun) {
-    await atomicWriteFile(cachePath, bytes);
-  }
-  return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-}
-function nextBaselineEntry(operation, finalContent, projectVersion) {
-  const block = finalContent === null ? null : extractManagedBlock(finalContent);
-  return {
-    baseline_hash: contentHash(operation),
-    local_hash_at_apply: finalContent === null ? null : sha256Bytes(finalContent),
-    file_kind: operation.file_kind,
-    last_applied_version: projectVersion,
-    deleted: operation.operation === "delete",
-    ...block === null ? {} : { managed_block_hash: sha256Bytes(block) }
-  };
-}
-function transactionOperation(item2) {
-  if (item2.equivalent) {
-    return null;
-  }
-  const operation = item2.operation;
-  const target = operationTargetPath(operation);
-  if (operation.operation === "delete") {
-    return item2.finalContent === null ? { operation: "delete", path: target } : { operation: "modify", path: target, content: item2.finalContent };
-  }
-  if (operation.operation === "rename") {
-    return {
-      operation: "rename",
-      from_path: operation.from_path,
-      to_path: operation.to_path,
-      content: item2.finalContent ?? item2.content ?? ""
-    };
-  }
-  return {
-    operation: "modify",
-    path: target,
-    content: item2.finalContent ?? item2.content ?? ""
-  };
-}
 async function updateProject(options) {
-  const root = resolve6(options.projectRoot);
+  const root = resolve7(options.projectRoot);
   let project;
   try {
-    project = projectConfigSchema.parse(parseYaml8(await readFile12(join13(root, ".harness", "project.yaml"), "utf8")));
+    project = projectConfigSchema.parse(parseYaml8(await readFile13(join14(root, ".harness", "project.yaml"), "utf8")));
   } catch {
     throw new UpdateWorkflowError("project configuration is invalid", 3, "PROJECT_CONFIG_INVALID");
   }
   if (project.project.project_id === null) {
     throw new UpdateWorkflowError("project is not bound to a server", 3, "PROJECT_NOT_BOUND");
   }
-  const serverUrl = options.serverUrl ?? project.server.url;
   const tokenEnv = options.tokenEnv ?? project.server.token_env;
-  if (serverUrl === null || serverUrl === void 0) {
-    throw new UpdateWorkflowError("server_url is required", 3, "SERVER_URL_REQUIRED");
-  }
   if (!/^[A-Z_][A-Z0-9_]*$/.test(tokenEnv)) {
     throw new UpdateWorkflowError("token_env is invalid", 3, "TOKEN_ENV_INVALID");
   }
-  const token = options.env[tokenEnv];
-  if (token === void 0 || token.trim() === "") {
-    throw new UpdateWorkflowError("API token environment variable is unset", 8, "TOKEN_INVALID");
+  const local = await readLocalCredentials(root);
+  const serverUrl = options.serverUrl ?? local?.server_url ?? project.server.url;
+  if (serverUrl === null || serverUrl === void 0) {
+    throw new UpdateWorkflowError("server_url is required", 3, "SERVER_URL_REQUIRED");
+  }
+  const envToken = options.env[tokenEnv]?.trim();
+  const localToken = local?.token?.trim();
+  const token = envToken !== void 0 && envToken !== "" ? envToken : localToken !== void 0 && localToken !== "" ? localToken : void 0;
+  if (token === void 0) {
+    throw new UpdateWorkflowError(`API token \u672A\u914D\u7F6E\uFF1A\u8BF7\u8BBE\u7F6E\u73AF\u5883\u53D8\u91CF ${tokenEnv}\uFF0C\u6216\u5728 .harness/credentials.local.yaml \u914D\u7F6E token\uFF08\u53EF\u901A\u8FC7 npx hunter-harness push \u5F15\u5BFC\u5199\u5165\uFF09`, 8, "TOKEN_INVALID");
   }
   const requestId = uuidV7();
   const baseline = await readBaseline(root);
@@ -4343,183 +5003,18 @@ async function updateProject(options) {
     ...options.fetch === void 0 ? {} : { fetch: options.fetch }
   });
   try {
-    const discovery = await client.getUpdateManifest(project.project.project_id, {
-      base_project_version: baseline.complete_project_version,
-      base_manifest_hash: sha256Bytes(canonicalJson(baseline)),
-      adapter: project.adapters.enabled[0] ?? "claude-code",
-      profile: project.project.profiles[0] ?? "general"
-    }, requestId);
-    if (!discovery.delta_available || discovery.artifact_id === null) {
-      return {
-        requestId,
-        projectId: project.project.project_id,
-        artifactId: null,
-        observedProjectVersion: discovery.observed_project_version,
-        operations: [],
-        applied: [],
-        skipped: [],
-        transactionId: null,
-        dryRun: options.dryRun
-      };
-    }
-    const manifest = artifactManifestSchema.parse(await client.getArtifactManifest(discovery.artifact_id, requestId));
-    if (manifest.artifact_id !== discovery.artifact_id || manifest.project_id !== project.project.project_id || manifest.project_version === null || manifestPayloadHash(manifest) !== manifest.manifest_sha256) {
-      throw new UpdateWorkflowError("artifact manifest integrity check failed", 4, "ARTIFACT_HASH_MISMATCH");
-    }
-    const blobs = /* @__PURE__ */ new Map();
-    for (const operation of manifest.files) {
-      const policy = classifyFile(operationTargetPath(operation));
-      if (decideUpdate(policy, false).apply) {
-        blobs.set(operation, await loadBlob(root, client, manifest.artifact_id, operation, requestId, options.dryRun));
-      }
-    }
-    const prepared = [];
-    const skipped = [];
-    for (const operation of manifest.files) {
-      if (operationAlreadyApplied(operation, baseline, manifest.project_version)) {
-        continue;
-      }
-      const source = operationSourcePath(operation);
-      const target = operationTargetPath(operation);
-      const policy = classifyFile(target);
-      const staticDecision = decideUpdate(policy, false);
-      if (!staticDecision.apply) {
-        skipped.push({ path: target, operation: operation.operation, reason: staticDecision.reason });
-        continue;
-      }
-      const previous = baseline.files[source];
-      if (expectedBase(operation) !== (previous?.baseline_hash ?? null)) {
-        skipped.push({ path: target, operation: operation.operation, reason: "baseline-diverged" });
-        continue;
-      }
-      const sourceContent = await optionalContent(join13(root, source));
-      const targetContent = target === source ? sourceContent : await optionalContent(join13(root, target));
-      const incoming = blobs.get(operation) ?? null;
-      const incomingHash = contentHash(operation);
-      let equivalent = incomingHash !== null && targetContent !== null && sha256Bytes(targetContent) === incomingHash;
-      let dirty = false;
-      if (operation.operation === "add") {
-        if (targetContent !== null && !equivalent) {
-          if (policy.update_policy === "managed-block-only" && incoming !== null) {
-            const incomingBlock = extractManagedBlock(incoming) ?? incoming.trim();
-            equivalent = extractManagedBlock(targetContent) === incomingBlock;
-            dirty = !equivalent;
-          } else {
-            dirty = true;
-          }
-        }
-      } else if (sourceContent === null) {
-        dirty = operation.operation !== "delete";
-      } else if (policy.update_policy === "managed-block-only") {
-        dirty = previous?.managed_block_hash === void 0 ? (previous?.local_hash_at_apply ?? previous?.baseline_hash) !== sha256Bytes(sourceContent) : managedBlockDirty(sourceContent, previous.managed_block_hash);
-      } else {
-        dirty = (previous?.local_hash_at_apply ?? previous?.baseline_hash) !== sha256Bytes(sourceContent);
-      }
-      if (operation.operation === "rename" && targetContent !== null && !equivalent) {
-        dirty = true;
-      }
-      if (dirty) {
-        skipped.push({ path: target, operation: operation.operation, reason: "local-dirty" });
-        continue;
-      }
-      let finalContent = incoming;
-      if (policy.update_policy === "managed-block-only") {
-        if (operation.operation === "delete") {
-          finalContent = sourceContent === null ? null : removeManagedBlock(sourceContent);
-          equivalent = finalContent === sourceContent;
-        } else if (incoming !== null) {
-          const incomingBlock = extractManagedBlock(incoming) ?? incoming.trim();
-          const incomingId = extractSingleManagedBlockById(incoming)?.id;
-          const blockId = operation.operation === "add" || operation.operation === "modify" ? operation.block_id ?? incomingId : void 0;
-          finalContent = blockId !== void 0 ? upsertManagedBlockById(targetContent ?? "", blockId, incomingBlock) : upsertManagedBlock(targetContent ?? "", incomingBlock);
-          equivalent = finalContent === targetContent;
-        }
-      } else if (operation.operation === "delete" && sourceContent === null) {
-        equivalent = true;
-      }
-      prepared.push({ operation, content: incoming, finalContent, equivalent });
-    }
-    const applied = prepared.map((item2) => operationTargetPath(item2.operation));
-    if (options.dryRun) {
-      return {
-        requestId,
-        projectId: project.project.project_id,
-        artifactId: manifest.artifact_id,
-        observedProjectVersion: manifest.project_version,
-        operations: manifest.files,
-        applied,
-        skipped,
-        transactionId: null,
-        dryRun: true
-      };
-    }
-    await atomicWriteJson(join13(root, ".harness", "cache", "server-artifacts", manifest.artifact_id, "manifest.json"), manifest);
-    const lock = await acquireProtocolLock(root, "update", { requestId });
-    try {
-      const nextBaseline = baselineManifestSchema.parse(structuredClone(baseline));
-      for (const item2 of prepared) {
-        const target = operationTargetPath(item2.operation);
-        nextBaseline.files[target] = nextBaselineEntry(item2.operation, item2.finalContent, manifest.project_version);
-        if (item2.operation.operation === "rename") {
-          nextBaseline.files[item2.operation.from_path] = {
-            baseline_hash: null,
-            local_hash_at_apply: null,
-            file_kind: item2.operation.file_kind,
-            last_applied_version: manifest.project_version,
-            deleted: true
-          };
-        }
-      }
-      if (skipped.length === 0) {
-        nextBaseline.complete_project_version = manifest.project_version;
-        nextBaseline.artifact_manifest_hash = manifest.manifest_sha256;
-        nextBaseline.latest_artifact_id = manifest.artifact_id;
-      }
-      const transactionId = "tx_update_" + Date.now() + "_" + uuidV7();
-      const reportPath = ".harness/reports/update-" + requestId + ".json";
-      const report = {
-        schema_version: 1,
-        request_id: requestId,
-        artifact_id: manifest.artifact_id,
-        observed_project_version: manifest.project_version,
-        status: skipped.length === 0 ? "applied" : "partial_due_to_dirty",
-        applied,
-        skipped,
-        transaction_id: transactionId
-      };
-      const operations = prepared.map((item2) => transactionOperation(item2)).filter((item2) => item2 !== null);
-      operations.push({
-        operation: "modify",
-        path: ".harness/state/baseline/manifest.json",
-        content: JSON.stringify(nextBaseline, null, 2) + "\n"
-      }, {
-        operation: "add",
-        path: reportPath,
-        content: JSON.stringify(report, null, 2) + "\n"
-      }, {
-        operation: "modify",
-        path: ".harness/state/local/last-update.json",
-        content: JSON.stringify(report, null, 2) + "\n"
-      });
-      await runTransaction(root, operations, {
-        id: transactionId,
-        kind: "update",
-        ...options.transactionOptions ?? {}
-      });
-      return {
-        requestId,
-        projectId: project.project.project_id,
-        artifactId: manifest.artifact_id,
-        observedProjectVersion: manifest.project_version,
-        operations: manifest.files,
-        applied,
-        skipped,
-        transactionId,
-        dryRun: false
-      };
-    } finally {
-      await lock.release();
-    }
+    const result = await synchronizeArtifacts({
+      projectRoot: root,
+      project,
+      client,
+      requestId,
+      dryRun: options.dryRun,
+      ...options.conflictStrategy === void 0 ? {} : { conflictStrategy: options.conflictStrategy },
+      ...options.resolveOverrides === void 0 ? {} : { resolveOverrides: options.resolveOverrides },
+      ...options.confirmConflictStrategy === void 0 ? {} : { confirmConflictStrategy: options.confirmConflictStrategy },
+      ...options.transactionOptions === void 0 ? {} : { transactionOptions: options.transactionOptions }
+    }, baseline);
+    return result;
   } catch (error) {
     if (error instanceof UpdateWorkflowError) {
       throw error;
@@ -4527,16 +5022,25 @@ async function updateProject(options) {
     if (error instanceof ApiError) {
       throw new UpdateWorkflowError(error.message, error.status === 401 || error.status === 403 ? 8 : error.status === 409 ? 5 : 4, error.code);
     }
+    if (error instanceof Error && error.message === "ARTIFACT_HASH_MISMATCH") {
+      throw new UpdateWorkflowError("artifact blob size or hash mismatch", 4, "ARTIFACT_HASH_MISMATCH");
+    }
     if (error instanceof Error && error.name === "ZodError") {
       throw new UpdateWorkflowError("artifact schema validation failed", 7, "SCHEMA_VALIDATION_FAILED");
     }
+    if (error instanceof Error && error.message.startsWith("DUPLICATE_ARTIFACT_ID")) {
+      throw new UpdateWorkflowError(error.message, 4, "DUPLICATE_ARTIFACT_ID");
+    }
+    if (error instanceof Error && error.message === "MAX_SYNC_ARTIFACT_ITERATIONS_EXCEEDED") {
+      throw new UpdateWorkflowError(error.message, 4, "SYNC_ITERATION_LIMIT");
+    }
     throw new UpdateWorkflowError(error instanceof Error ? error.message : "update failed", 4, "NETWORK_OR_SERVER_ERROR");
   }
 }
 
 // src/config/init-config.ts
-import { isAbsolute as isAbsolute2, join as join14 } from "node:path";
-import { readFile as readFile13 } from "node:fs/promises";
+import { isAbsolute as isAbsolute2, join as join15 } from "node:path";
+import { readFile as readFile14 } from "node:fs/promises";
 var InitConfigurationError = class extends Error {
   exitCode;
   code;
@@ -4569,13 +5073,15 @@ function normalizeProfile(value) {
   if (value === "2" || value === "java") return "java";
   throw new InitConfigurationError("\u914D\u7F6E\u7C7B\u578B\u5FC5\u987B\u4E3A general \u6216 java");
 }
+var ALL_AGENT_TOKENS = /* @__PURE__ */ new Set(["all", "5"]);
 function parseAgentsInput(raw) {
   const trimmed = raw.trim();
   if (trimmed === "") return ["claude-code"];
-  if (trimmed === "all") return [...HARNESS_AGENT_ORDER];
+  if (ALL_AGENT_TOKENS.has(trimmed)) return [...HARNESS_AGENT_ORDER];
   const agents = [];
   for (const token of trimmed.split(",")) {
     const value = token.trim();
+    if (ALL_AGENT_TOKENS.has(value)) return [...HARNESS_AGENT_ORDER];
     const byIndex = AGENT_BY_INDEX[value];
     if (byIndex !== void 0) {
       agents.push(byIndex);
@@ -4617,9 +5123,9 @@ function hasOwn(record, key) {
 async function resolveInitConfig(cwd, flags, prompts = {}, warnings = []) {
   let fileConfig = {};
   if (flags.config !== void 0) {
-    const path = isAbsolute2(flags.config) ? flags.config : join14(cwd, flags.config);
+    const path = isAbsolute2(flags.config) ? flags.config : join15(cwd, flags.config);
     try {
-      fileConfig = JSON.parse(await readFile13(path, "utf8"));
+      fileConfig = JSON.parse(await readFile14(path, "utf8"));
     } catch (error) {
       throw new InitConfigurationError(
         "unable to read init config: " + (error instanceof Error ? error.message : String(error)),
@@ -4701,8 +5207,8 @@ function serializeCliResult(result) {
 }
 
 // src/config/codebuddy-setup.ts
-import { mkdir as mkdir4, readFile as readFile14, readdir as readdir7, stat as stat4, writeFile as writeFile5 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname4, extname, join as join15 } from "node:path";
+import { mkdir as mkdir4, readFile as readFile15, readdir as readdir7, stat as stat4, writeFile as writeFile5 } from "node:fs/promises";
+import { basename as basename2, dirname as dirname4, extname, join as join16 } from "node:path";
 var MANAGED_RULE_NAMES = /* @__PURE__ */ new Set([
   "harness-general.md",
   "harness-general.mdc",
@@ -4721,7 +5227,7 @@ async function exists4(path) {
 }
 async function readJsonObject(path) {
   try {
-    const parsed = JSON.parse(await readFile14(path, "utf8"));
+    const parsed = JSON.parse(await readFile15(path, "utf8"));
     return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") return {};
@@ -4729,27 +5235,27 @@ async function readJsonObject(path) {
   }
 }
 async function inspectCodeBuddySetup(projectRoot) {
-  const rulesRoot = join15(projectRoot, ".claude", "rules");
+  const rulesRoot = join16(projectRoot, ".claude", "rules");
   let claudeRules = [];
   try {
     claudeRules = (await readdir7(rulesRoot, { withFileTypes: true })).filter((entry) => entry.isFile() && [".md", ".mdc"].includes(extname(entry.name).toLowerCase())).map((entry) => entry.name).filter((name) => !MANAGED_RULE_NAMES.has(name)).sort();
   } catch (error) {
     if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
   }
-  const mcp = await readJsonObject(join15(projectRoot, ".mcp.json"));
+  const mcp = await readJsonObject(join16(projectRoot, ".mcp.json"));
   const servers = mcp?.mcpServers;
   const configured = servers !== null && typeof servers === "object" && !Array.isArray(servers) && Object.prototype.hasOwnProperty.call(servers, "codegraph");
   return {
     claudeRules,
-    hasCodeGraphIndex: await exists4(join15(projectRoot, ".codegraph")),
+    hasCodeGraphIndex: await exists4(join16(projectRoot, ".codegraph")),
     codeGraphConfigured: configured
   };
 }
 function destinationTargets(root, surface, name) {
   const stem = basename2(name, extname(name));
   const targets = [];
-  if (surface !== "cli") targets.push(join15(root, ".codebuddy", ".rules", `${stem}.mdc`));
-  if (surface !== "ide") targets.push(join15(root, ".codebuddy", "rules", `${stem}.md`));
+  if (surface !== "cli") targets.push(join16(root, ".codebuddy", ".rules", `${stem}.mdc`));
+  if (surface !== "ide") targets.push(join16(root, ".codebuddy", "rules", `${stem}.md`));
   return targets;
 }
 async function applyCodeBuddySetup(options) {
@@ -4763,8 +5269,8 @@ async function applyCodeBuddySetup(options) {
   if (options.syncClaudeRules) {
     const plan = await inspectCodeBuddySetup(options.projectRoot);
     for (const name of plan.claudeRules) {
-      const source = join15(options.projectRoot, ".claude", "rules", name);
-      const content = await readFile14(source, "utf8");
+      const source = join16(options.projectRoot, ".claude", "rules", name);
+      const content = await readFile15(source, "utf8");
       if (SENSITIVE_ASSIGNMENT.test(content) || PRIVATE_KEY_BLOCK.test(content)) {
         result.skippedSensitive.push(name);
         continue;
@@ -4781,7 +5287,7 @@ async function applyCodeBuddySetup(options) {
     }
   }
   if (options.configureCodeGraph) {
-    const path = join15(options.projectRoot, ".mcp.json");
+    const path = join16(options.projectRoot, ".mcp.json");
     const current = await readJsonObject(path);
     if (current === null) {
       result.warnings.push(".mcp.json \u4E0D\u662F\u6709\u6548 JSON\uFF0C\u5DF2\u4FDD\u7559\u539F\u6587\u4EF6\u5E76\u8DF3\u8FC7 CodeGraph MCP \u914D\u7F6E");
@@ -4805,13 +5311,13 @@ async function applyCodeBuddySetup(options) {
 }
 
 // src/commands/refresh.ts
-import { readFile as readFile15 } from "node:fs/promises";
-import { join as join16 } from "node:path";
+import { readFile as readFile16 } from "node:fs/promises";
+import { join as join17 } from "node:path";
 import { parse as parseYaml9 } from "yaml";
 async function detectProject(root) {
   let content;
   try {
-    content = await readFile15(join16(root, ".harness", "project.yaml"), "utf8");
+    content = await readFile16(join17(root, ".harness", "project.yaml"), "utf8");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return { status: "absent" };
@@ -5018,6 +5524,14 @@ var AGENT_LABELS = {
   cursor: "Cursor",
   codebuddy: "CodeBuddy"
 };
+function agentMenuLines(installedProfiles) {
+  const lines = HARNESS_AGENT_ORDER.map((agent, index) => {
+    const profile = installedProfiles?.[agent];
+    const suffix = profile === void 0 ? "" : `\uFF08\u5DF2\u5B89\u88C5\uFF1A${profile}\uFF09`;
+    return `  ${index + 1}. ${AGENT_LABELS[agent]}${suffix}`;
+  }).join("\n");
+  return lines + "\n  5. \u5168\u90E8";
+}
 async function configureCodeBuddyExtras(agents, surface, options, dependencies) {
   if (!agents.includes("codebuddy")) return;
   const plan = await inspectCodeBuddySetup(dependencies.cwd);
@@ -5067,7 +5581,7 @@ async function runFirstInstall(options, dependencies) {
       options,
       options.nonInteractive === true ? {} : {
         agents: () => dependencies.prompt(
-          "\u8BF7\u9009\u62E9\u76EE\u6807 Agent\uFF08\u53EF\u591A\u9009\uFF0C\u4F7F\u7528\u9017\u53F7\u5206\u9694\uFF09\n  1. Claude Code\n  2. Codex\n  3. Cursor\n  4. CodeBuddy\n\u8BF7\u8F93\u5165\u7F16\u53F7 [1]: "
+          "\u8BF7\u9009\u62E9\u76EE\u6807 Agent\uFF08\u53EF\u591A\u9009\uFF0C\u4F7F\u7528\u9017\u53F7\u5206\u9694\uFF09\n" + agentMenuLines() + "\n\u8BF7\u8F93\u5165\u7F16\u53F7 [1]: "
         ).then((answer) => answer.trim()),
         profile: () => dependencies.prompt(
           "\u8BF7\u9009\u62E9 Harness \u7C7B\u578B\uFF1A\n1. \u901A\u7528\uFF08\u9ED8\u8BA4\uFF09\n2. Java\n\u8BF7\u8F93\u5165 1 \u6216 2 [1]: "
@@ -5165,10 +5679,7 @@ async function runExistingProject(options, dependencies, currentProfile, current
       `Hunter Harness \u5F53\u524D\u914D\u7F6E\uFF1A
 ${currentLines}
 \u8BF7\u9009\u62E9\u672C\u6B21\u8981\u65B0\u589E\u6216\u5237\u65B0\u7684\u5DE5\u5177\uFF08\u53EF\u591A\u9009\uFF0C\u9017\u53F7\u5206\u9694\uFF1B\u672A\u9009\u62E9\u7684\u5DE5\u5177\u4FDD\u6301\u4E0D\u53D8\uFF09\uFF1A
-  1. Claude Code
-  2. Codex
-  3. Cursor
-  4. CodeBuddy
+` + agentMenuLines(installed.profiles) + `
 \u8BF7\u8F93\u5165\u7F16\u53F7 [${defaultSelection}]\uFF0C\u6216\u8F93\u5165 0 \u53D6\u6D88\uFF1A`
     );
     if (answer.trim() === "0" || /^c/i.test(answer.trim())) return 2;
@@ -5420,7 +5931,7 @@ async function runPush(options, dependencies) {
         warnings: result.preview.skipped,
         errors: []
       };
-      dependencies.stdout(options.json === true ? serializeCliResult(output) : options.dryRun === true ? "Push preview contains " + items.length + " operations.\n" : "Pushed artifact " + result.artifactId + " (proposal " + result.proposalId + ").\n");
+      dependencies.stdout(options.json === true ? serializeCliResult(output) : options.dryRun === true ? "Push preview contains " + items.length + " operations.\n" : "Pushed artifact " + ("artifactId" in result ? String(result.artifactId) : "unknown") + " (proposal " + result.proposalId + ").\n");
       return 0;
     } catch (error) {
       if (attempt === 0 && options.nonInteractive !== true && options.dryRun !== true && error instanceof PushWorkflowError && (error.code === "SERVER_URL_REQUIRED" || error.code === "TOKEN_INVALID")) {
@@ -5480,19 +5991,46 @@ async function runPush(options, dependencies) {
 }
 
 // src/commands/update.ts
+function parseResolveOverrides(entries) {
+  const map = /* @__PURE__ */ new Map();
+  for (const entry of entries ?? []) {
+    const eq = entry.indexOf("=");
+    if (eq <= 0) {
+      throw new UpdateWorkflowError(
+        "invalid --resolve value; expected path=keep-local|accept-remote",
+        3,
+        "RESOLVE_OPTION_INVALID"
+      );
+    }
+    const path = entry.slice(0, eq).trim();
+    const strategy = entry.slice(eq + 1).trim();
+    if (path.length === 0 || strategy !== "keep-local" && strategy !== "accept-remote") {
+      throw new UpdateWorkflowError(
+        "invalid --resolve value; expected path=keep-local|accept-remote",
+        3,
+        "RESOLVE_OPTION_INVALID"
+      );
+    }
+    map.set(path, strategy);
+  }
+  return map;
+}
 async function runUpdate(options, dependencies) {
   const requestId = uuidV7();
   if (options.nonInteractive === true && options.yes !== true && options.dryRun !== true) {
     dependencies.stderr("\u975E\u4EA4\u4E92\u6A21\u5F0F\u66F4\u65B0\u9700\u8981 --yes\n");
     return 2;
   }
+  const resolveOverrides = parseResolveOverrides(options.resolve);
   const execute = async (dryRun) => updateProject({
     projectRoot: dependencies.cwd,
     ...options.serverUrl === void 0 ? {} : { serverUrl: options.serverUrl },
     ...options.tokenEnv === void 0 ? {} : { tokenEnv: options.tokenEnv },
     env: dependencies.env,
     dryRun,
-    fetch: dependencies.fetch
+    fetch: dependencies.fetch,
+    ...options.conflictStrategy === void 0 ? {} : { conflictStrategy: options.conflictStrategy },
+    ...resolveOverrides.size === 0 ? {} : { resolveOverrides }
   });
   try {
     let result;
@@ -5510,22 +6048,24 @@ async function runUpdate(options, dependencies) {
     }
     const applied = new Set(result.applied);
     const skippedByPath = new Map(result.skipped.map((item2) => [item2.path, item2]));
+    const acknowledgedByPath = new Map(result.acknowledged.map((item2) => [item2.path, item2]));
     const items = result.operations.map((operation) => {
       const path = operation.operation === "rename" ? operation.to_path : operation.path;
       const skipped = skippedByPath.get(path);
+      const acknowledged = acknowledgedByPath.get(path);
       return {
         path,
         operation: operation.operation,
         file_kind: operation.file_kind,
         policy: "update",
-        status: skipped !== void 0 ? "skipped" : applied.has(path) ? options.dryRun === true ? "planned" : "applied" : "already-applied",
-        reason: skipped?.reason ?? null,
+        status: skipped !== void 0 ? "skipped" : acknowledged !== void 0 ? "acknowledged" : applied.has(path) ? options.dryRun === true ? "planned" : "applied" : "already-applied",
+        reason: skipped?.reason ?? acknowledged?.reason ?? null,
         size_bytes: "size_bytes" in operation ? operation.size_bytes : 0
       };
     });
-    const exitCode = result.skipped.length > 0 ? 5 : 0;
+    const exitCode = result.conflicts.length > 0 ? 5 : 0;
     const output = {
-      schema_version: 1,
+      schema_version: 2,
       command: "update",
       request_id: requestId,
       dry_run: options.dryRun === true,
@@ -5536,13 +6076,15 @@ async function runUpdate(options, dependencies) {
         discovered: result.operations.length,
         applied: options.dryRun === true ? 0 : result.applied.length,
         planned: options.dryRun === true ? result.applied.length : 0,
+        acknowledged: result.acknowledged.length,
+        resolved: result.resolvedKeepLocal.length + result.resolvedAcceptRemote.length,
         skipped: result.skipped.length
       },
       items,
-      warnings: result.skipped,
+      warnings: [...result.acknowledged, ...result.skipped],
       errors: []
     };
-    dependencies.stdout(options.json === true ? serializeCliResult(output) : result.artifactId === null ? "\u6CA1\u6709\u53EF\u5E94\u7528\u7684\u5DF2\u6279\u51C6\u66F4\u65B0\u3002\n" : "\u66F4\u65B0\u5B8C\u6210\uFF1A\u5DF2\u5E94\u7528 " + result.applied.length + " \u4E2A\u6761\u76EE\uFF0C\u8DF3\u8FC7 " + result.skipped.length + " \u4E2A\u3002\n");
+    dependencies.stdout(options.json === true ? serializeCliResult(output) : result.artifactId === null ? "\u6CA1\u6709\u53EF\u5E94\u7528\u7684\u5DF2\u6279\u51C6\u66F4\u65B0\u3002\n" : "\u66F4\u65B0\u5B8C\u6210\uFF1A\u5DF2\u5E94\u7528 " + result.applied.length + " \u4E2A\u6761\u76EE\uFF0C\u5DF2\u786E\u8BA4 " + result.acknowledged.length + " \u4E2A\uFF0C\u51B2\u7A81 " + result.conflicts.length + " \u4E2A\u3002\n");
     return exitCode;
   } catch (error) {
     const exitCode = error instanceof UpdateWorkflowError ? error.exitCode : 1;
@@ -5572,7 +6114,7 @@ async function runUpdate(options, dependencies) {
 
 // src/commands/recovery.ts
 import { stat as stat5 } from "node:fs/promises";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 async function exists5(path) {
   try {
     await stat5(path);
@@ -5632,7 +6174,7 @@ async function runRecoveryMenuIfApplicable(options, dependencies) {
       return 5;
     }
   }
-  const initialized = await exists5(join17(dependencies.cwd, ".harness", "project.yaml"));
+  const initialized = await exists5(join18(dependencies.cwd, ".harness", "project.yaml"));
   if (!initialized || options.nonInteractive === true || explicitConfigure(options)) {
     return null;
   }
@@ -5675,8 +6217,8 @@ async function runRecoveryMenuIfApplicable(options, dependencies) {
 }
 
 // src/workflow-data/resolve.ts
-import { cp, mkdir as mkdir5, readdir as readdir8, readFile as readFile16, rm as rm8, stat as stat6 } from "node:fs/promises";
-import { dirname as dirname5, join as join18, relative as relative2 } from "node:path";
+import { cp, mkdir as mkdir5, readdir as readdir8, readFile as readFile17, rm as rm8, stat as stat6 } from "node:fs/promises";
+import { dirname as dirname5, join as join19, relative as relative2 } from "node:path";
 import { fileURLToPath } from "node:url";
 var WorkflowDataResolutionError = class extends Error {
   code;
@@ -5713,14 +6255,14 @@ async function listFilesRecursive(root, base = root) {
   const entries = await readdir8(root, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const absolute = join18(root, entry.name);
+    const absolute = join19(root, entry.name);
     if (entry.isDirectory()) {
       files.push(...await listFilesRecursive(absolute, base));
       continue;
     }
     if (!entry.isFile()) continue;
     const rel = relative2(base, absolute).replaceAll("\\", "/");
-    files.push({ path: rel, content: await readFile16(absolute, "utf8") });
+    files.push({ path: rel, content: await readFile17(absolute, "utf8") });
   }
   return files;
 }
@@ -5733,7 +6275,7 @@ async function verifyWorkflowPackageIntegrity(resourcesRoot) {
   const manifest = await readWorkflowFamilyManifest(resourcesRoot);
   const expected = manifest.content_sha256;
   if (typeof expected !== "string" || expected.length === 0) return;
-  const harnessRoot = join18(resourcesRoot, "harness");
+  const harnessRoot = join19(resourcesRoot, "harness");
   if (!await pathExists3(harnessRoot)) {
     throw new WorkflowDataResolutionError(
       "\u5DE5\u4F5C\u6D41\u6570\u636E\u5305\u7F3A\u5C11 harness/\uFF0C\u65E0\u6CD5\u6821\u9A8C SHA-256",
@@ -5755,37 +6297,37 @@ async function monorepoResourcesRoot() {
   const here = dirname5(fileURLToPath(import.meta.url));
   const candidates = [
     // TypeScript source: packages/cli/src/workflow-data -> packages/workflow-data-harness.
-    join18(here, "../../../workflow-data-harness"),
+    join19(here, "../../../workflow-data-harness"),
     // Bundled CLI: packages/cli/dist -> packages/workflow-data-harness.
-    join18(here, "../../workflow-data-harness"),
+    join19(here, "../../workflow-data-harness"),
     // Test/build layouts that preserve additional source directory levels.
-    join18(here, "../../../../packages/workflow-data-harness")
+    join19(here, "../../../../packages/workflow-data-harness")
   ];
   for (const candidate of candidates) {
-    if (await pathExists3(join18(candidate, "harness", "manifests"))) return candidate;
+    if (await pathExists3(join19(candidate, "harness", "manifests"))) return candidate;
   }
   return null;
 }
 async function siblingWorkflowPackage(cwd) {
   const here = dirname5(fileURLToPath(import.meta.url));
   const candidates = [
-    join18(cwd, "node_modules", "@hunter-harness", "workflow-harness"),
+    join19(cwd, "node_modules", "@hunter-harness", "workflow-harness"),
     // Published layout: node_modules/hunter-harness/dist/bin.js alongside the
     // scoped workflow package in node_modules/@hunter-harness/workflow-harness.
-    join18(here, "..", "..", "@hunter-harness", "workflow-harness"),
+    join19(here, "..", "..", "@hunter-harness", "workflow-harness"),
     // Monorepo bundled layout: packages/cli/dist/bin.js.
-    join18(here, "..", "..", "workflow-data-harness")
+    join19(here, "..", "..", "workflow-data-harness")
   ];
   for (const candidate of candidates) {
-    if (await pathExists3(join18(candidate, "harness", "manifests"))) return candidate;
+    if (await pathExists3(join19(candidate, "harness", "manifests"))) return candidate;
   }
   return null;
 }
 async function readCachedNpmPackageVersion(cacheRoot) {
-  const manifestPath = join18(cacheRoot, "package.json");
+  const manifestPath = join19(cacheRoot, "package.json");
   if (!await pathExists3(manifestPath)) return null;
   try {
-    const pkg = JSON.parse(await readFile16(manifestPath, "utf8"));
+    const pkg = JSON.parse(await readFile17(manifestPath, "utf8"));
     return typeof pkg.version === "string" && pkg.version.length > 0 ? pkg.version : null;
   } catch {
     return null;
@@ -5808,12 +6350,12 @@ async function latestWorkflowCacheIsStale(cacheRoot, packageName, resolveManifes
 }
 async function materializeWorkflowPackageCache(cacheRoot, packageSpec, extract) {
   await mkdir5(cacheRoot, { recursive: true });
-  const staging = join18(cacheRoot, ".extract");
+  const staging = join19(cacheRoot, ".extract");
   await rm8(staging, { recursive: true, force: true });
   await mkdir5(staging, { recursive: true });
   await extract(packageSpec, staging);
-  const packageDir = await pathExists3(join18(staging, "harness", "manifests")) ? staging : join18(staging, "package");
-  if (!await pathExists3(join18(packageDir, "harness", "manifests"))) {
+  const packageDir = await pathExists3(join19(staging, "harness", "manifests")) ? staging : join19(staging, "package");
+  if (!await pathExists3(join19(packageDir, "harness", "manifests"))) {
     throw new WorkflowDataResolutionError(
       "\u5DE5\u4F5C\u6D41\u6570\u636E\u5305\u5185\u5BB9\u65E0\u6548\uFF1A\u7F3A\u5C11 harness/manifests",
       "WORKFLOW_DATA_INVALID",
@@ -5842,8 +6384,8 @@ async function resolveWorkflowResourcesRoot(options, argv = []) {
   const packageName = workflowPackageName(family, options.env);
   const packageSpec = version === "latest" ? packageName : `${packageName}@${version}`;
   const cacheKey = packageSpec.replace("/", "+");
-  const cacheRoot = join18(options.cwd, ".harness", "cache", "workflow-packages", cacheKey);
-  if (await pathExists3(join18(cacheRoot, "harness", "manifests"))) {
+  const cacheRoot = join19(options.cwd, ".harness", "cache", "workflow-packages", cacheKey);
+  if (await pathExists3(join19(cacheRoot, "harness", "manifests"))) {
     if (version === "latest") {
       const stale = await latestWorkflowCacheIsStale(cacheRoot, packageName, options.pacoteManifest);
       if (stale) {
@@ -5889,9 +6431,9 @@ function describeWorkflowDataFetchFailure(error, packageSpec) {
   return `\u65E0\u6CD5\u83B7\u53D6\u5DE5\u4F5C\u6D41\u6570\u636E\u5305 ${packageSpec}\uFF1A\u672C\u5730\u7F13\u5B58\u4E0D\u5B58\u5728\u4E14\u83B7\u53D6\u5931\u8D25\u3002\u53EF${hintRoot}\u3002\u539F\u56E0\uFF1A${code !== "" ? code + " " : ""}${detail}`;
 }
 async function readWorkflowFamilyManifest(resourcesRoot) {
-  const manifestPath = join18(resourcesRoot, "hunter-workflow-family.json");
+  const manifestPath = join19(resourcesRoot, "hunter-workflow-family.json");
   if (!await pathExists3(manifestPath)) return {};
-  return JSON.parse(await readFile16(manifestPath, "utf8"));
+  return JSON.parse(await readFile17(manifestPath, "utf8"));
 }
 
 // src/bin.ts
@@ -5982,7 +6524,15 @@ async function runCli(argv, overrides = {}) {
       dependencies
     );
   });
-  addCommonOptions(program.command("update")).description("\u5E94\u7528\u5DF2\u6279\u51C6\u7684\u670D\u52A1\u7AEF\u4EA7\u7269").action(async (options) => {
+  addCommonOptions(program.command("update")).description("\u5E94\u7528\u5DF2\u6279\u51C6\u7684\u670D\u52A1\u7AEF\u4EA7\u7269").option(
+    "--conflict-strategy <strategy>",
+    "manual | keep-local | accept-remote\uFF08\u9ED8\u8BA4 manual\uFF1Brename \u51B2\u7A81\u59CB\u7EC8 manual\uFF09"
+  ).option(
+    "--resolve <path=strategy>",
+    "\u5355\u8DEF\u5F84\u8986\u76D6 keep-local|accept-remote\uFF08\u53EF\u91CD\u590D\uFF09",
+    (value, previous) => [...previous, value],
+    []
+  ).action(async (options) => {
     exitCode = await runUpdate(
       { ...program.opts(), ...options },
       dependencies