hunter-harness 0.2.26 → 0.2.28

package/dist/bin.js

@@ -1233,7 +1233,7 @@ async function assertNoSymlinks(root, relativePath) {
 async function withRetry(action, options) {
   const attempts = options.attempts ?? 3;
   const sleep = options.sleep ?? (async (milliseconds) => {
-    await new Promise((resolve9) => setTimeout(resolve9, milliseconds));
+    await new Promise((resolve10) => setTimeout(resolve10, milliseconds));
   });
   let lastError;
   for (let attempt = 1; attempt <= attempts; attempt += 1) {
@@ -1684,6 +1684,9 @@ function classifyFile(input) {
   if (under(path, ".harness/knowledge/")) {
     return USER_DIFF;
   }
+  if (under(path, ".harness/rules/")) {
+    return USER_DIFF;
+  }
   if (/^\.harness\/archive\/[^/]+\/reports\/final\/summary-data\.json$/u.test(path)) {
     return GENERATED_REVIEWABLE;
   }
@@ -1696,7 +1699,7 @@ function classifyFile(input) {
   if (under(path, ".harness/reports/")) {
     return REPORT_CACHE;
   }
-  if (under(path, ".harness/state/") || under(path, ".harness/rules/")) {
+  if (under(path, ".harness/state/")) {
     return INTERNAL_STATE;
   }
   if (under(path, ".harness/generated/") || under(path, ".harness/cache/")) {
@@ -1730,9 +1733,9 @@ function decideUpdate(policy, dirty) {
 }
 
 // ../core/dist/project/initialize.js
-import { createHash as createHash4 } from "node:crypto";
-import { readFile as readFile4, stat as stat2, writeFile as writeFile3 } from "node:fs/promises";
-import { basename, join as join5, resolve as resolve4 } from "node:path";
+import { createHash as createHash5 } from "node:crypto";
+import { readFile as readFile5, stat as stat2, writeFile as writeFile4 } from "node:fs/promises";
+import { basename as basename2, join as join6, resolve as resolve5 } from "node:path";
 import { parse as parseYaml2, stringify as stringifyYaml } from "yaml";
 
 // ../core/dist/transaction/transaction.js
@@ -2247,10 +2250,178 @@ function managedTargetsFor(adapter, bundle, context) {
   return records.sort((left, right) => left.target_path.localeCompare(right.target_path));
 }
 
-// ../core/dist/project/profile-bundle.js
+// ../core/dist/project/project-rules.js
 import { createHash as createHash3 } from "node:crypto";
-import { readFile as readFile3, readdir as readdir2 } from "node:fs/promises";
-import { join as join4, resolve as resolve3 } from "node:path";
+import { mkdir as mkdir4, readFile as readFile3, readdir as readdir2, rename as rename3, unlink, writeFile as writeFile3 } from "node:fs/promises";
+import { basename, dirname as dirname3, extname, join as join4, resolve as resolve3 } from "node:path";
+var RULES_ROOT = ".harness/rules";
+var RECEIPT_PATH = ".harness/state/local/rule-projections.json";
+var CODEX_BLOCK_ID = "hunter-harness-project-rules";
+var MANAGED_NAMES = /* @__PURE__ */ new Set([
+  "harness-general.md",
+  "harness-general.mdc",
+  "harness-profile-java.md",
+  "harness-profile-java.mdc"
+]);
+function sha256(content) {
+  return createHash3("sha256").update(content).digest("hex");
+}
+async function optionalText(path) {
+  try {
+    return await readFile3(path, "utf8");
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT")
+      return null;
+    throw error;
+  }
+}
+async function readReceipt(root) {
+  try {
+    const parsed = JSON.parse(await readFile3(join4(root, RECEIPT_PATH), "utf8"));
+    if (parsed.schema_version === 1 && parsed.targets && parsed.source_hashes)
+      return parsed;
+  } catch {
+  }
+  return { schema_version: 1, source_hashes: {}, targets: {} };
+}
+async function markdownFiles(root) {
+  try {
+    return (await readdir2(root, { withFileTypes: true })).filter((entry) => entry.isFile() && [".md", ".mdc"].includes(extname(entry.name).toLowerCase())).map((entry) => entry.name).filter((name) => !MANAGED_NAMES.has(name)).sort();
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT")
+      return [];
+    throw error;
+  }
+}
+function targetsFor(name, agents, surface) {
+  const stem = basename(name, extname(name));
+  const targets = [];
+  if (agents.includes("claude-code"))
+    targets.push(`.claude/rules/${stem}.md`);
+  if (agents.includes("cursor"))
+    targets.push(`.cursor/rules/${stem}.mdc`);
+  if (agents.includes("codebuddy") && surface !== "cli") {
+    targets.push(`.codebuddy/.rules/${stem}.mdc`);
+  }
+  if (agents.includes("codebuddy") && surface !== "ide") {
+    targets.push(`.codebuddy/rules/${stem}.md`);
+  }
+  return targets;
+}
+async function atomicWrite(path, content) {
+  await mkdir4(dirname3(path), { recursive: true });
+  const temporary = `${path}.${process.pid}.tmp`;
+  await writeFile3(temporary, content, "utf8");
+  await rename3(temporary, path);
+}
+async function synchronizeProjectRules(projectRoot, agents, surface = "both") {
+  const root = resolve3(projectRoot);
+  const canonicalRoot = join4(root, RULES_ROOT);
+  const result = {
+    migrated: [],
+    written: [],
+    removed: [],
+    unchanged: [],
+    conflicts: []
+  };
+  await mkdir4(canonicalRoot, { recursive: true });
+  if ((await markdownFiles(canonicalRoot)).length === 0) {
+    for (const name of await markdownFiles(join4(root, ".claude", "rules"))) {
+      const destination = join4(canonicalRoot, `${basename(name, extname(name))}.md`);
+      if (await optionalText(destination) !== null)
+        continue;
+      const content = await readFile3(join4(root, ".claude", "rules", name), "utf8");
+      await atomicWrite(destination, content);
+      result.migrated.push(`${RULES_ROOT}/${basename(destination)}`);
+    }
+  }
+  const previous = await readReceipt(root);
+  const next = { schema_version: 1, source_hashes: {}, targets: {} };
+  const desired = /* @__PURE__ */ new Map();
+  for (const name of await markdownFiles(canonicalRoot)) {
+    const sourcePath = `${RULES_ROOT}/${name}`;
+    const content = await readFile3(join4(canonicalRoot, name), "utf8");
+    next.source_hashes[sourcePath] = sha256(content);
+    for (const target of targetsFor(name, agents, surface))
+      desired.set(target, content);
+  }
+  for (const [target, content] of desired) {
+    const path = join4(root, target);
+    const current = await optionalText(path);
+    const incomingHash = sha256(content);
+    if (current === content) {
+      result.unchanged.push(target);
+      next.targets[target] = incomingHash;
+    } else if (current === null || previous.targets[target] === sha256(current)) {
+      await atomicWrite(path, content);
+      result.written.push(target);
+      next.targets[target] = incomingHash;
+    } else {
+      result.conflicts.push(target);
+      next.targets[target] = previous.targets[target] ?? sha256(current);
+    }
+  }
+  for (const [target, trustedHash] of Object.entries(previous.targets)) {
+    if (target === "AGENTS.md")
+      continue;
+    if (desired.has(target))
+      continue;
+    const path = join4(root, target);
+    const current = await optionalText(path);
+    if (current === null)
+      continue;
+    if (sha256(current) === trustedHash) {
+      await unlink(path);
+      result.removed.push(target);
+    } else {
+      result.conflicts.push(target);
+      next.targets[target] = trustedHash;
+    }
+  }
+  if (agents.includes("codex")) {
+    const rules = Object.keys(next.source_hashes).sort();
+    const body = [
+      "Before project work, read and follow these shared project rules:",
+      ...rules.map((path) => `- \`${path}\``)
+    ].join("\n");
+    const agentsPath = join4(root, "AGENTS.md");
+    const current = await optionalText(agentsPath) ?? "";
+    const updated = rules.length > 0 ? upsertManagedBlockById(current, CODEX_BLOCK_ID, body) : removeManagedBlockById(current, CODEX_BLOCK_ID);
+    const target = "AGENTS.md";
+    const semanticallyEqual = updated.replace(/\r\n/g, "\n").trimEnd() === current.replace(/\r\n/g, "\n").trimEnd();
+    if (semanticallyEqual)
+      result.unchanged.push(target);
+    else {
+      await atomicWrite(agentsPath, updated);
+      result.written.push(target);
+    }
+    if (rules.length > 0) {
+      next.targets[target] = sha256(semanticallyEqual ? current : updated);
+    }
+  } else if (Object.prototype.hasOwnProperty.call(previous.targets, "AGENTS.md")) {
+    const agentsPath = join4(root, "AGENTS.md");
+    const current = await optionalText(agentsPath);
+    if (current !== null) {
+      const updated = removeManagedBlockById(current, CODEX_BLOCK_ID);
+      if (updated !== current) {
+        await atomicWrite(agentsPath, updated);
+        result.written.push("AGENTS.md");
+      }
+    }
+  }
+  await atomicWrite(join4(root, RECEIPT_PATH), JSON.stringify(next, null, 2) + "\n");
+  result.migrated.sort();
+  result.written.sort();
+  result.removed.sort();
+  result.unchanged.sort();
+  result.conflicts = [...new Set(result.conflicts)].sort();
+  return result;
+}
+
+// ../core/dist/project/profile-bundle.js
+import { createHash as createHash4 } from "node:crypto";
+import { readFile as readFile4, readdir as readdir3 } from "node:fs/promises";
+import { join as join5, resolve as resolve4 } from "node:path";
 var AdapterBundleError = class extends Error {
   code;
   exitCode = 7;
@@ -2276,15 +2447,15 @@ function validateRelativeBundlePath2(path) {
 }
 var bundleCache = /* @__PURE__ */ new Map();
 async function loadAgentBundle(resourcesRoot, profile, agent) {
-  const cacheKey = `${resolve3(resourcesRoot)}:${profile}:${agent}`;
+  const cacheKey = `${resolve4(resourcesRoot)}:${profile}:${agent}`;
   const cached = bundleCache.get(cacheKey);
   if (cached) {
     return { manifest: cached.manifest, files: new Map(cached.files) };
   }
-  const manifestPath = join4(resourcesRoot, "harness", "manifests", profile, `${agent}.json`);
+  const manifestPath = join5(resourcesRoot, "harness", "manifests", profile, `${agent}.json`);
   let manifestText;
   try {
-    manifestText = await readFile3(manifestPath, "utf8");
+    manifestText = await readFile4(manifestPath, "utf8");
   } catch (error) {
     if (isEnoent(error)) {
       throw new AdapterBundleError("ADAPTER_BUNDLE_MISSING", `offline Harness Bundle manifest missing: ${profile}/${agent}`);
@@ -2312,14 +2483,14 @@ async function loadAgentBundle(resourcesRoot, profile, agent) {
     }
     let bytes;
     try {
-      bytes = await readFile3(join4(resourcesRoot, "harness", "bundles", profile, agent, item2.path));
+      bytes = await readFile4(join5(resourcesRoot, "harness", "bundles", profile, agent, item2.path));
     } catch (error) {
       if (isEnoent(error)) {
         throw new AdapterBundleError("ADAPTER_BUNDLE_MISSING", `offline Harness Bundle file missing: ${profile}/${agent}/${item2.path}`);
       }
       throw error;
     }
-    if (createHash3("sha256").update(bytes).digest("hex") !== item2.sha256) {
+    if (createHash4("sha256").update(bytes).digest("hex") !== item2.sha256) {
       throw new AdapterBundleError("ADAPTER_BUNDLE_INVALID", `Harness Bundle hash mismatch: ${profile}/${agent}/${item2.path}`);
     }
     files.set(item2.path, bytes);
@@ -2384,10 +2555,10 @@ function parseMigrationManifest(raw) {
   };
 }
 async function loadMigrationManifests(resourcesRoot) {
-  const migrationsRoot = join4(resourcesRoot, "harness", "migrations");
+  const migrationsRoot = join5(resourcesRoot, "harness", "migrations");
   let versionDirs;
   try {
-    versionDirs = await readdir2(migrationsRoot);
+    versionDirs = await readdir3(migrationsRoot);
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return [];
@@ -2398,7 +2569,7 @@ async function loadMigrationManifests(resourcesRoot) {
   for (const versionDir of versionDirs) {
     let files;
     try {
-      files = await readdir2(join4(migrationsRoot, versionDir));
+      files = await readdir3(join5(migrationsRoot, versionDir));
     } catch (error) {
       if (error instanceof Error && "code" in error && error.code === "ENOENT") {
         continue;
@@ -2408,7 +2579,7 @@ async function loadMigrationManifests(resourcesRoot) {
     for (const file of files) {
       if (!file.endsWith(".json"))
         continue;
-      manifests.push(parseMigrationManifest(JSON.parse(await readFile3(join4(migrationsRoot, versionDir, file), "utf8"))));
+      manifests.push(parseMigrationManifest(JSON.parse(await readFile4(join5(migrationsRoot, versionDir, file), "utf8"))));
     }
   }
   return manifests;
@@ -2440,14 +2611,14 @@ function uuidV7(now = Date.now()) {
 var CONTEXT_INDEX_PATH = ".harness/context-index.json";
 async function fileHex(path) {
   try {
-    const data = await readFile4(path);
-    return createHash4("sha256").update(data).digest("hex");
+    const data = await readFile5(path);
+    return createHash5("sha256").update(data).digest("hex");
   } catch {
     return null;
   }
 }
 async function readExistingSkillBundles(root) {
-  const text = await readOptional(join5(root, CONTEXT_INDEX_PATH));
+  const text = await readOptional(join6(root, CONTEXT_INDEX_PATH));
   if (text === "")
     return /* @__PURE__ */ new Map();
   try {
@@ -2467,7 +2638,7 @@ var TargetCollisionError = class extends Error {
   }
 };
 function hex(bytes) {
-  return createHash4("sha256").update(bytes).digest("hex");
+  return createHash5("sha256").update(bytes).digest("hex");
 }
 function bytesEqual(left, right) {
   if (left.byteLength !== right.byteLength)
@@ -2480,7 +2651,7 @@ function bytesEqual(left, right) {
 }
 async function readOptional(path) {
   try {
-    return await readFile4(path, "utf8");
+    return await readFile5(path, "utf8");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return "";
@@ -2500,12 +2671,12 @@ async function exists2(path) {
   }
 }
 async function existingProjectConfig(root) {
-  const path = join5(root, ".harness", "project.yaml");
+  const path = join6(root, ".harness", "project.yaml");
   const content = await readOptional(path);
   return content === "" ? null : projectConfigSchema.parse(parseYaml2(content));
 }
 async function operationFor(root, path, content) {
-  return await exists2(join5(root, path)) ? { operation: "modify", path, content } : { operation: "add", path, content };
+  return await exists2(join6(root, path)) ? { operation: "modify", path, content } : { operation: "add", path, content };
 }
 var INSTALLED_BUNDLE_PATH = ".harness/state/local/installed-harness-bundle.json";
 function mergeOwnedTargets(owned) {
@@ -2541,7 +2712,7 @@ function mergeOwnedTargets(owned) {
   });
 }
 async function initializeProject(options) {
-  const root = resolve4(options.projectRoot);
+  const root = resolve5(options.projectRoot);
   const config = initConfigSchema.parse(options.config);
   const existing = await existingProjectConfig(root);
   const profile = config.profile;
@@ -2584,7 +2755,7 @@ async function initializeProject(options) {
   const projectConfig = projectConfigSchema.parse({
     harness: { name: "hunter-harness", schema_version: 1 },
     project: {
-      name: existing?.project.name ?? basename(root),
+      name: existing?.project.name ?? basename2(root),
       root: ".",
       local_project_key: existing?.project.local_project_key ?? uuidV7(),
       project_id: config.project_id ?? existing?.project.project_id ?? null,
@@ -2606,7 +2777,7 @@ async function initializeProject(options) {
     files: {}
   });
   const managedBlocks = [];
-  let agentsContent = await readOptional(join5(root, "AGENTS.md"));
+  let agentsContent = await readOptional(join6(root, "AGENTS.md"));
   agentsContent = upsertManagedBlockById(agentsContent, AGENTS_CORE_BLOCK_ID, AGENTS_MANAGED_BLOCK_CONTENT);
   managedBlocks.push({
     owner: "shared",
@@ -2643,7 +2814,7 @@ async function initializeProject(options) {
     ["AGENTS.md", agentsContent]
   ]);
   if (enabledAgents.includes("claude-code")) {
-    let claudeContent = await readOptional(join5(root, "CLAUDE.md"));
+    let claudeContent = await readOptional(join6(root, "CLAUDE.md"));
     claudeContent = upsertManagedBlockById(claudeContent, CLAUDE_BLOCK_ID, CLAUDE_MANAGED_BLOCK_CONTENT);
     files.set("CLAUDE.md", claudeContent);
     managedBlocks.push({
@@ -2654,7 +2825,7 @@ async function initializeProject(options) {
     });
   }
   if (enabledAgents.includes("codebuddy")) {
-    let codebuddyContent = await readOptional(join5(root, "CODEBUDDY.md"));
+    let codebuddyContent = await readOptional(join6(root, "CODEBUDDY.md"));
     codebuddyContent = upsertManagedBlockById(codebuddyContent, CODEBUDDY_BLOCK_ID, CODEBUDDY_MANAGED_BLOCK_CONTENT);
     files.set("CODEBUDDY.md", codebuddyContent);
     managedBlocks.push({
@@ -2691,6 +2862,7 @@ async function initializeProject(options) {
     const writeOperations = await Promise.all([...files.entries()].map(async ([path, content]) => operationFor(root, path, content)));
     await runTransaction(root, writeOperations, { kind: "init" });
     await enrichContextIndexWithVerification(root, enabledAgents, profile, options.resourcesRoot, adapterContext);
+    await synchronizeProjectRules(root, enabledAgents, surface);
   }
   return {
     projectConfig,
@@ -2700,8 +2872,8 @@ async function initializeProject(options) {
   };
 }
 async function enrichContextIndexWithVerification(root, agents, profile, resourcesRoot, adapterContext) {
-  const contextPath = join5(root, CONTEXT_INDEX_PATH);
-  const existing = await readOptional(join5(contextPath));
+  const contextPath = join6(root, CONTEXT_INDEX_PATH);
+  const existing = await readOptional(join6(contextPath));
   if (existing === "")
     return;
   let parsed;
@@ -2726,7 +2898,7 @@ async function enrichContextIndexWithVerification(root, agents, profile, resourc
     const entries = [];
     for (const target of targets) {
       const rel = target.target_path.replace(/\\/g, "/");
-      const actual = await fileHex(join5(root, target.target_path));
+      const actual = await fileHex(join6(root, target.target_path));
       entries.push({ relpath: rel, sha256: actual ?? "" });
       if (actual === null) {
         mismatches.push({ relpath: rel, expected: target.sha256, actual: "<missing>" });
@@ -2743,19 +2915,19 @@ async function enrichContextIndexWithVerification(root, agents, profile, resourc
     entry.verificationStatus = newStatus;
     entry.mismatchDetails = mismatches;
   }
-  await writeFile3(contextPath, JSON.stringify(parsed, null, 2) + "\n", "utf8");
+  await writeFile4(contextPath, JSON.stringify(parsed, null, 2) + "\n", "utf8");
 }
 
 // ../core/dist/project/refresh.js
-import { createHash as createHash5 } from "node:crypto";
-import { readFile as readFile5, readdir as readdir3, rmdir } from "node:fs/promises";
-import { dirname as dirname3, join as join6, resolve as resolve5 } from "node:path";
+import { createHash as createHash6 } from "node:crypto";
+import { readFile as readFile6, readdir as readdir4, rmdir } from "node:fs/promises";
+import { dirname as dirname4, join as join7, resolve as resolve6 } from "node:path";
 import { parse as parseYaml3, stringify as stringifyYaml2 } from "yaml";
 var INSTALLED_STATE_PATH = ".harness/state/local/installed-harness-bundle.json";
 var CONTEXT_INDEX_PATH2 = ".harness/context-index.json";
 async function fileHex2(path) {
   try {
-    return createHash5("sha256").update(await readFile5(path)).digest("hex");
+    return createHash6("sha256").update(await readFile6(path)).digest("hex");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return null;
@@ -2765,7 +2937,7 @@ async function fileHex2(path) {
 }
 async function readOptionalText(path) {
   try {
-    return await readFile5(path, "utf8");
+    return await readFile6(path, "utf8");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return "";
@@ -2774,7 +2946,7 @@ async function readOptionalText(path) {
   }
 }
 async function readInstalledState(root) {
-  const content = await readOptionalText(join6(root, INSTALLED_STATE_PATH));
+  const content = await readOptionalText(join7(root, INSTALLED_STATE_PATH));
   if (content === "") {
     return {
       profile: null,
@@ -2844,7 +3016,7 @@ async function readInstalledState(root) {
   };
 }
 async function readInstalledAgentConfiguration(projectRoot) {
-  const installed = await readInstalledState(resolve5(projectRoot));
+  const installed = await readInstalledState(resolve6(projectRoot));
   return {
     agents: installed.adapters,
     profiles: Object.fromEntries(installed.adapters.map((agent) => [
@@ -2854,7 +3026,7 @@ async function readInstalledAgentConfiguration(projectRoot) {
   };
 }
 async function readContextIndexBundleHash(root) {
-  const content = await readOptionalText(join6(root, CONTEXT_INDEX_PATH2));
+  const content = await readOptionalText(join7(root, CONTEXT_INDEX_PATH2));
   if (content === "")
     return null;
   try {
@@ -2866,13 +3038,13 @@ async function readContextIndexBundleHash(root) {
   }
 }
 async function pruneEmptyParentDirs(root, deletedPaths, boundaryPaths) {
-  const boundaries = new Set(boundaryPaths.map((path) => join6(root, path)));
+  const boundaries = new Set(boundaryPaths.map((path) => join7(root, path)));
   for (const deleted of deletedPaths) {
-    let dir = dirname3(join6(root, deleted));
+    let dir = dirname4(join7(root, deleted));
     while (dir.startsWith(root) && !boundaries.has(dir)) {
       let entries;
       try {
-        entries = await readdir3(dir);
+        entries = await readdir4(dir);
       } catch {
         break;
       }
@@ -2883,7 +3055,7 @@ async function pruneEmptyParentDirs(root, deletedPaths, boundaryPaths) {
       } catch {
         break;
       }
-      dir = dirname3(dir);
+      dir = dirname4(dir);
     }
   }
 }
@@ -2910,7 +3082,7 @@ function sortByTarget(items) {
   return [...items].sort((left, right) => left.target_path.localeCompare(right.target_path));
 }
 async function reconcileContextIndex(root, agents, profiles, manifests, codebuddySurface2, verifications) {
-  const existing = await readOptionalText(join6(root, CONTEXT_INDEX_PATH2));
+  const existing = await readOptionalText(join7(root, CONTEXT_INDEX_PATH2));
   let codebase = {
     map: ".harness/codebase/map",
     status: "missing"
@@ -2963,7 +3135,7 @@ async function reconcileContextIndex(root, agents, profiles, manifests, codebudd
 }
 async function projectTransitionOperation(root, agents, profiles, codebuddySurface2) {
   const path = ".harness/project.yaml";
-  const content = await readOptionalText(join6(root, path));
+  const content = await readOptionalText(join7(root, path));
   if (content === "")
     return null;
   const project = parseYaml3(content);
@@ -2998,11 +3170,11 @@ function mergeTargets(targets) {
   }).sort((left, right) => left.target_path.localeCompare(right.target_path));
 }
 async function reconcileMarkdownBlock(root, fileName, blockId, content, remove, ops, conflicts, preserved) {
-  const original = await readOptionalText(join6(root, fileName));
+  const original = await readOptionalText(join7(root, fileName));
   const synthetic = {
     source_path: fileName,
     target_path: fileName,
-    sha256: createHash5("sha256").update(content).digest("hex"),
+    sha256: createHash6("sha256").update(content).digest("hex"),
     bytes: new TextEncoder().encode(content)
   };
   let next;
@@ -3017,7 +3189,7 @@ async function reconcileMarkdownBlock(root, fileName, blockId, content, remove,
       next = refreshed.content;
     }
   } catch {
-    const current = original === "" ? null : createHash5("sha256").update(original).digest("hex");
+    const current = original === "" ? null : createHash6("sha256").update(original).digest("hex");
     preserved.push(item(synthetic, "preserve", "MALFORMED_MANAGED_BLOCK", current, synthetic.sha256));
     conflicts.push(conflict(synthetic, "MALFORMED_MANAGED_BLOCK", current, synthetic.sha256));
     return;
@@ -3037,7 +3209,7 @@ function stateWithoutInstalledAt(value) {
   return copy;
 }
 async function refreshProject(options) {
-  const root = resolve5(options.projectRoot);
+  const root = resolve6(options.projectRoot);
   const installed = await readInstalledState(root);
   const oldAgents = installed.adapters.length > 0 ? installed.adapters : ["claude-code"];
   const selectedAgents = sortHarnessAgents(options.agents);
@@ -3121,7 +3293,7 @@ async function refreshProject(options) {
   const newStateFiles = installed.files.filter((entry) => entry.owner === "shared" || !selectedSet.has(entry.owner));
   for (const target of newManaged) {
     const incoming = target.sha256;
-    const current = await fileHex2(join6(root, target.target_path));
+    const current = await fileHex2(join7(root, target.target_path));
     if (current === null) {
       applied.push(item(target, "add", "MISSING_TARGET", null, incoming));
       ops.push({ operation: "add", path: target.target_path, content: target.bytes });
@@ -3149,7 +3321,7 @@ async function refreshProject(options) {
     }
   }
   for (const target of oldOnly) {
-    const current = await fileHex2(join6(root, target.target_path));
+    const current = await fileHex2(join7(root, target.target_path));
     if (current === null) {
       continue;
     }
@@ -3192,7 +3364,7 @@ async function refreshProject(options) {
     const verifyEntries = [];
     for (const target of verifyTargets) {
       const rel = target.target_path.replace(/\\/g, "/");
-      const actual = await fileHex2(join6(root, target.target_path));
+      const actual = await fileHex2(join7(root, target.target_path));
       verifyEntries.push({ relpath: rel, sha256: actual ?? "" });
       if (actual === null) {
         verifyMismatches.push({ relpath: rel, expected: target.sha256, actual: "<missing>" });
@@ -3225,19 +3397,19 @@ async function refreshProject(options) {
       owner: "shared",
       target_path: "AGENTS.md",
       block_id: AGENTS_CORE_BLOCK_ID,
-      content_sha256: createHash5("sha256").update(AGENTS_MANAGED_BLOCK_CONTENT).digest("hex")
+      content_sha256: createHash6("sha256").update(AGENTS_MANAGED_BLOCK_CONTENT).digest("hex")
     },
     ...selectedSet.has("claude-code") ? [{
       owner: "claude-code",
       target_path: "CLAUDE.md",
       block_id: CLAUDE_BLOCK_ID,
-      content_sha256: createHash5("sha256").update(CLAUDE_MANAGED_BLOCK_CONTENT).digest("hex")
+      content_sha256: createHash6("sha256").update(CLAUDE_MANAGED_BLOCK_CONTENT).digest("hex")
     }] : [],
     ...selectedSet.has("codebuddy") ? [{
       owner: "codebuddy",
       target_path: "CODEBUDDY.md",
       block_id: CODEBUDDY_BLOCK_ID,
-      content_sha256: createHash5("sha256").update(CODEBUDDY_MANAGED_BLOCK_CONTENT).digest("hex")
+      content_sha256: createHash6("sha256").update(CODEBUDDY_MANAGED_BLOCK_CONTENT).digest("hex")
     }] : []
   ].sort((left, right) => left.target_path.localeCompare(right.target_path) || left.block_id.localeCompare(right.block_id));
   const filesByTarget = new Map(newStateFiles.map((entry) => [entry.target_path, entry]));
@@ -3253,7 +3425,7 @@ async function refreshProject(options) {
     files: [...filesByTarget.values()].sort((left, right) => left.target_path.localeCompare(right.target_path) || left.source_path.localeCompare(right.source_path)),
     managed_blocks: managedBlocks
   };
-  const existingState = await readOptionalText(join6(root, INSTALLED_STATE_PATH));
+  const existingState = await readOptionalText(join7(root, INSTALLED_STATE_PATH));
   let existingParsed = null;
   try {
     existingParsed = existingState === "" ? null : JSON.parse(existingState);
@@ -3268,6 +3440,7 @@ async function refreshProject(options) {
   }
   if (!options.dryRun) {
     await runTransaction(root, ops, { kind: "refresh" });
+    await synchronizeProjectRules(root, agents, codebuddySurface2);
     await pruneEmptyParentDirs(root, removed.map((item2) => item2.target_path), getAdapters(selectedAgents).flatMap((adapter) => adapter.pruneBoundaries({
       profile: profiles.get(adapter.name) ?? profile,
       codebuddySurface: codebuddySurface2
@@ -3307,7 +3480,7 @@ function buildMarkerCoreHash(text) {
   }
 }
 async function collectFreshness(options) {
-  const root = resolve5(options.projectRoot);
+  const root = resolve6(options.projectRoot);
   const installed = await readInstalledState(root);
   const codebuddySurface2 = options.codebuddySurface ?? "both";
   const agents = [];
@@ -3352,18 +3525,18 @@ async function collectFreshness(options) {
     identity.adapterHash = sha256Bytes(canonicalJson(targets.map((target) => ({ path: target.target_path.replace(/\\/g, "/"), sha256: target.sha256 })).sort((a, b) => a.path.localeCompare(b.path))));
     const installedProjection = await Promise.all(targets.map(async (target) => ({
       path: target.target_path.replace(/\\/g, "/"),
-      sha256: await fileHex2(join6(root, target.target_path))
+      sha256: await fileHex2(join7(root, target.target_path))
     })));
     identity.installedAdapterHash = sha256Bytes(canonicalJson(installedProjection.sort((a, b) => a.path.localeCompare(b.path))));
     const markerTarget = targets.find((target) => target.target_path.replace(/\\/g, "/").endsWith(`/${BUILD_MARKER_BUNDLE_PATH}`) || target.target_path === BUILD_MARKER_BUNDLE_PATH);
     if (markerTarget !== void 0) {
-      identity.installedCoreHash = buildMarkerCoreHash(await readOptionalText(join6(root, markerTarget.target_path)));
+      identity.installedCoreHash = buildMarkerCoreHash(await readOptionalText(join7(root, markerTarget.target_path)));
     }
     const mismatchDetails = [];
     const contentEntries = [];
     for (const target of targets) {
       const rel = target.target_path.replace(/\\/g, "/");
-      const actual = await fileHex2(join6(root, target.target_path));
+      const actual = await fileHex2(join7(root, target.target_path));
       contentEntries.push({ relpath: rel, sha256: actual ?? "" });
       if (actual === null) {
         mismatchDetails.push({ relpath: rel, expected: target.sha256, actual: "<missing>" });
@@ -3386,7 +3559,7 @@ async function collectFreshness(options) {
     const drifted = [];
     const missing = [];
     for (const target of targets) {
-      const current = await fileHex2(join6(root, target.target_path));
+      const current = await fileHex2(join7(root, target.target_path));
       if (current === null) {
         missing.push(target.target_path);
       } else if (current !== target.sha256) {
@@ -3750,8 +3923,8 @@ function generateProposalPreview(input, scanOptions = {}) {
 }
 
 // ../core/dist/push/credentials.js
-import { readFile as readFile6, writeFile as writeFile4 } from "node:fs/promises";
-import { join as join7 } from "node:path";
+import { readFile as readFile7, writeFile as writeFile5 } from "node:fs/promises";
+import { join as join8 } from "node:path";
 import { parse as parseYaml4, stringify as stringifyYaml3 } from "yaml";
 var CREDENTIALS_LOCAL_RELATIVE = ".harness/credentials.local.yaml";
 var CREDENTIALS_GITIGNORE_LINES = [
@@ -3821,7 +3994,7 @@ function mergeLocalCredentials(existing, patch) {
 }
 async function readLocalCredentials(projectRoot) {
   try {
-    const raw = await readFile6(join7(projectRoot, CREDENTIALS_LOCAL_RELATIVE), "utf8");
+    const raw = await readFile7(join8(projectRoot, CREDENTIALS_LOCAL_RELATIVE), "utf8");
     return parseLocalCredentials(parseYaml4(raw));
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -3832,13 +4005,13 @@ async function readLocalCredentials(projectRoot) {
 }
 async function writeLocalCredentials(projectRoot, credentials) {
   const normalized = validateLocalCredentials(credentials);
-  await writeFile4(join7(projectRoot, CREDENTIALS_LOCAL_RELATIVE), stringifyYaml3(normalized, { sortMapEntries: true }) + "\n", "utf8");
+  await writeFile5(join8(projectRoot, CREDENTIALS_LOCAL_RELATIVE), stringifyYaml3(normalized, { sortMapEntries: true }) + "\n", "utf8");
 }
 async function ensureCredentialsGitignore(projectRoot) {
-  const gitignorePath = join7(projectRoot, ".gitignore");
+  const gitignorePath = join8(projectRoot, ".gitignore");
   let content = "";
   try {
-    content = await readFile6(gitignorePath, "utf8");
+    content = await readFile7(gitignorePath, "utf8");
   } catch (error) {
     if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) {
       throw error;
@@ -3861,7 +4034,7 @@ async function ensureCredentialsGitignore(projectRoot) {
     return;
   }
   const suffix = content.length === 0 || content.endsWith("\n") ? "" : "\n";
-  await writeFile4(gitignorePath, content + suffix + missing.join("\n") + "\n", "utf8");
+  await writeFile5(gitignorePath, content + suffix + missing.join("\n") + "\n", "utf8");
 }
 function resolvePushAuth(input) {
   const tokenEnv = input.tokenEnv ?? input.projectTokenEnv;
@@ -3889,28 +4062,28 @@ function resolvePushAuth(input) {
 }
 
 // ../core/dist/push/push.js
-import { lstat as lstat3, readFile as readFile10, readdir as readdir4, rm as rm5 } from "node:fs/promises";
-import { join as join11, relative, resolve as resolve7 } from "node:path";
+import { lstat as lstat3, readFile as readFile11, readdir as readdir5, rm as rm5 } from "node:fs/promises";
+import { join as join12, relative, resolve as resolve8 } from "node:path";
 import { parse as parseYaml5, stringify as stringifyYaml4 } from "yaml";
 
 // ../core/dist/state/baseline.js
-import { readFile as readFile7 } from "node:fs/promises";
-import { join as join8 } from "node:path";
+import { readFile as readFile8 } from "node:fs/promises";
+import { join as join9 } from "node:path";
 async function readBaseline(projectRoot) {
-  const content = await readFile7(join8(stateLayout(projectRoot).baseline, "manifest.json"), "utf8");
+  const content = await readFile8(join9(stateLayout(projectRoot).baseline, "manifest.json"), "utf8");
   return baselineManifestSchema.parse(JSON.parse(content));
 }
 
 // ../core/dist/state/locks.js
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { readFile as readFile8, rename as rename3, rm as rm3, writeFile as writeFile5 } from "node:fs/promises";
-import { join as join9 } from "node:path";
+import { readFile as readFile9, rename as rename4, rm as rm3, writeFile as writeFile6 } from "node:fs/promises";
+import { join as join10 } from "node:path";
 async function readLock(path) {
-  return JSON.parse(await readFile8(path, "utf8"));
+  return JSON.parse(await readFile9(path, "utf8"));
 }
 async function acquireProtocolLock(projectRoot, operation, options = {}) {
   const layout = await ensureStateLayout(projectRoot);
-  const lockPath = join9(layout.locks, "protocol.lock");
+  const lockPath = join10(layout.locks, "protocol.lock");
   const now = options.now ?? Date.now();
   const staleAfterMs = options.staleAfterMs ?? 15 * 60 * 1e3;
   const record = {
@@ -3923,7 +4096,7 @@ async function acquireProtocolLock(projectRoot, operation, options = {}) {
   };
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      await writeFile5(lockPath, JSON.stringify(record, null, 2), { flag: "wx" });
+      await writeFile6(lockPath, JSON.stringify(record, null, 2), { flag: "wx" });
       return {
         path: lockPath,
         operation,
@@ -3945,15 +4118,15 @@ async function acquireProtocolLock(projectRoot, operation, options = {}) {
       if (now - current.heartbeat_at_ms <= staleAfterMs) {
         throw new Error("protocol lock is active for operation " + current.operation, { cause: error });
       }
-      await rename3(lockPath, lockPath + ".stale-" + randomUUID3());
+      await rename4(lockPath, lockPath + ".stale-" + randomUUID3());
     }
   }
   throw new Error("unable to acquire protocol lock");
 }
 
 // ../core/dist/sync/synchronize.js
-import { lstat as lstat2, readFile as readFile9, rm as rm4 } from "node:fs/promises";
-import { join as join10, resolve as resolve6 } from "node:path";
+import { lstat as lstat2, readFile as readFile10, rm as rm4 } from "node:fs/promises";
+import { join as join11, resolve as resolve7 } from "node:path";
 
 // ../core/dist/update/conflicts.js
 function operationTargetPath(operation) {
@@ -4235,8 +4408,8 @@ async function pathExists(path) {
   }
 }
 async function optionalContent(root, path) {
-  const full = join10(root, path);
-  return await pathExists(full) ? readFile9(full, "utf8") : null;
+  const full = join11(root, path);
+  return await pathExists(full) ? readFile10(full, "utf8") : null;
 }
 function manifestPayloadHash(manifest) {
   const payload = { ...manifest };
@@ -4248,10 +4421,10 @@ async function loadBlob(root, client, artifactId, operation, requestId, dryRun)
     return null;
   }
   const hash = operation.content_sha256;
-  const cacheRoot = join10(root, ".harness", "cache", "server-artifacts", artifactId);
-  const cachePath = join10(cacheRoot, "blobs", hash.replace(":", "_"));
+  const cacheRoot = join11(root, ".harness", "cache", "server-artifacts", artifactId);
+  const cachePath = join11(cacheRoot, "blobs", hash.replace(":", "_"));
   if (await pathExists(cachePath) && await sha256File(cachePath) === hash) {
-    return readFile9(cachePath, "utf8");
+    return readFile10(cachePath, "utf8");
   }
   const bytes = await client.downloadArtifactBlob(artifactId, hash, requestId);
   if (bytes.byteLength !== operation.size_bytes || sha256Bytes(bytes) !== hash) {
@@ -4356,7 +4529,7 @@ async function planSingleArtifact(root, baseline, manifest, client, requestId, d
   });
 }
 async function saveConflictReport(root, requestId, manifest, plan) {
-  const reportPath = join10(root, ".harness", "reports", "conflicts-" + requestId + ".json");
+  const reportPath = join11(root, ".harness", "reports", "conflicts-" + requestId + ".json");
   await atomicWriteJson(reportPath, {
     schema_version: 1,
     request_id: requestId,
@@ -4367,7 +4540,7 @@ async function saveConflictReport(root, requestId, manifest, plan) {
   });
 }
 async function synchronizeArtifacts(options, initialBaseline) {
-  const root = resolve6(options.projectRoot);
+  const root = resolve7(options.projectRoot);
   const projectId = options.project.project.project_id;
   if (projectId === null) {
     throw new Error("PROJECT_NOT_BOUND");
@@ -4474,7 +4647,7 @@ async function synchronizeArtifacts(options, initialBaseline) {
       }
       continue;
     }
-    await atomicWriteJson(join10(root, ".harness", "cache", "server-artifacts", manifest.artifact_id, "manifest.json"), manifest);
+    await atomicWriteJson(join11(root, ".harness", "cache", "server-artifacts", manifest.artifact_id, "manifest.json"), manifest);
     const lock = await acquireProtocolLock(root, "update", { requestId: options.requestId });
     try {
       const nextBaseline = applyBaselineUpdates(baseline, plan);
@@ -4544,7 +4717,7 @@ function baselineEntryFromOperation(manifest, operation, localContent) {
   };
 }
 async function advanceBaselineFromArtifact(options, baseline) {
-  const root = resolve6(options.projectRoot);
+  const root = resolve7(options.projectRoot);
   if (options.manifest.project_version === null) {
     throw new Error("artifact manifest missing project_version");
   }
@@ -4621,7 +4794,8 @@ var PushWorkflowError = class extends Error {
 };
 var SHARED_MANAGED_ROOTS = [
   ".harness/knowledge",
-  ".harness/codebase"
+  ".harness/codebase",
+  ".harness/rules"
 ];
 var SHARED_MANAGED_FILES = [
   "AGENTS.md",
@@ -4644,8 +4818,8 @@ async function walkFiles(root, current, output) {
   if (!await exists3(current)) {
     return;
   }
-  for (const item2 of await readdir4(current, { withFileTypes: true })) {
-    const path = join11(current, item2.name);
+  for (const item2 of await readdir5(current, { withFileTypes: true })) {
+    const path = join12(current, item2.name);
     if (item2.isSymbolicLink()) {
       throw new PushWorkflowError("symlink is not pushable", 6, "UNSAFE_SYMLINK");
     }
@@ -4657,16 +4831,16 @@ async function walkFiles(root, current, output) {
   }
 }
 async function walkArchiveSummaries(root, output) {
-  const archiveRoot = join11(root, ".harness", "archive");
+  const archiveRoot = join12(root, ".harness", "archive");
   if (!await exists3(archiveRoot))
     return;
-  for (const item2 of await readdir4(archiveRoot, { withFileTypes: true })) {
+  for (const item2 of await readdir5(archiveRoot, { withFileTypes: true })) {
     if (item2.isSymbolicLink()) {
       throw new PushWorkflowError("symlink is not pushable", 6, "UNSAFE_SYMLINK");
     }
     if (!item2.isDirectory())
       continue;
-    const summaryPath = join11(archiveRoot, item2.name, "reports", "final", "summary-data.json");
+    const summaryPath = join12(archiveRoot, item2.name, "reports", "final", "summary-data.json");
     try {
       const stats = await lstat3(summaryPath);
       if (stats.isSymbolicLink()) {
@@ -4694,9 +4868,9 @@ function enabledHarnessAgents(project) {
 async function walkHarnessEntries(root, directory, output) {
   if (!await exists3(directory))
     return;
-  for (const item2 of await readdir4(directory, { withFileTypes: true })) {
+  for (const item2 of await readdir5(directory, { withFileTypes: true })) {
     if (item2.name.startsWith("harness-")) {
-      const path = join11(directory, item2.name);
+      const path = join12(directory, item2.name);
       if (item2.isDirectory()) {
         await walkFiles(root, path, output);
       } else if (item2.isFile()) {
@@ -4706,7 +4880,7 @@ async function walkHarnessEntries(root, directory, output) {
   }
 }
 async function managedFiles(projectRoot, project) {
-  const root = resolve7(projectRoot);
+  const root = resolve8(projectRoot);
   const paths = [];
   const adapters = getAdapters(enabledHarnessAgents(project));
   const managedFiles2 = [
@@ -4715,26 +4889,26 @@ async function managedFiles(projectRoot, project) {
     ...adapters.some((adapter) => adapter.name === "codebuddy") ? ["CODEBUDDY.md"] : []
   ];
   for (const path of managedFiles2) {
-    if (await exists3(join11(root, path))) {
+    if (await exists3(join12(root, path))) {
       paths.push(path);
     }
   }
   for (const path of SHARED_MANAGED_ROOTS) {
-    await walkFiles(root, join11(root, path), paths);
+    await walkFiles(root, join12(root, path), paths);
   }
   await walkArchiveSummaries(root, paths);
   for (const adapter of adapters) {
     if (adapter.rulesRoot !== null) {
-      await walkFiles(root, join11(root, adapter.rulesRoot), paths);
+      await walkHarnessEntries(root, join12(root, adapter.rulesRoot), paths);
     }
-    await walkHarnessEntries(root, join11(root, adapter.skillsRoot), paths);
+    await walkHarnessEntries(root, join12(root, adapter.skillsRoot), paths);
     if (adapter.agentsRoot !== null) {
-      await walkHarnessEntries(root, join11(root, adapter.agentsRoot), paths);
+      await walkHarnessEntries(root, join12(root, adapter.agentsRoot), paths);
     }
   }
   const result = {};
   for (const path of [...new Set(paths)].sort()) {
-    result[path] = await readFile10(join11(root, path), "utf8");
+    result[path] = await readFile11(join12(root, path), "utf8");
   }
   return result;
 }
@@ -4743,14 +4917,14 @@ function proposalBaseline(baseline) {
 }
 async function readProject(root) {
   try {
-    return projectConfigSchema.parse(parseYaml5(await readFile10(join11(root, ".harness", "project.yaml"), "utf8")));
+    return projectConfigSchema.parse(parseYaml5(await readFile11(join12(root, ".harness", "project.yaml"), "utf8")));
   } catch {
     throw new PushWorkflowError("project configuration is missing or invalid", 3, "PROJECT_CONFIG_INVALID");
   }
 }
 async function readOptionalJson(path) {
   try {
-    return JSON.parse(await readFile10(path, "utf8"));
+    return JSON.parse(await readFile11(path, "utf8"));
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return null;
@@ -4762,7 +4936,7 @@ async function clientIdFor(root, explicit) {
   if (explicit !== void 0) {
     return explicit;
   }
-  const path = join11(root, ".harness", "state", "local", "client.json");
+  const path = join12(root, ".harness", "state", "local", "client.json");
   const existing = await readOptionalJson(path);
   if (typeof existing?.client_id === "string" && /^cli_[A-Za-z0-9_-]+$/.test(existing.client_id)) {
     return existing.client_id;
@@ -4958,7 +5132,7 @@ async function bindProject(root, project, baseline, projectId) {
   return { project: nextProject, baseline: nextBaseline };
 }
 async function pushProject(options) {
-  const root = resolve7(options.projectRoot);
+  const root = resolve8(options.projectRoot);
   let project = await readProject(root);
   let baseline = await readBaseline(root);
   const profile = parseHarnessProfile(project.project.profiles[0]);
@@ -5024,7 +5198,7 @@ async function pushProject(options) {
   if (options.confirmProposal !== void 0 && !await options.confirmProposal(preview)) {
     return { preview, proposalId: null, projectId: project.project.project_id, cancelled: true };
   }
-  const workflowPath = join11(root, ".harness", "state", "local", "push-workflow.json");
+  const workflowPath = join12(root, ".harness", "state", "local", "push-workflow.json");
   const priorWorkflow = await readOptionalJson(workflowPath);
   const provisionalRequestId = priorWorkflow?.local_project_key === project.project.local_project_key ? priorWorkflow.request_id : uuidV7();
   const lock = await acquireProtocolLock(root, "push", { requestId: provisionalRequestId });
@@ -5179,7 +5353,7 @@ async function pushProject(options) {
         pushWarning = "BASELINE_ADVANCE_DEFERRED";
       }
     }
-    await atomicWriteJson(join11(root, ".harness", "state", "local", "push-results", finalized.proposal_id + ".json"), {
+    await atomicWriteJson(join12(root, ".harness", "state", "local", "push-results", finalized.proposal_id + ".json"), {
       schema_version: 1,
       request_id: requestId,
       project_id: projectId,
@@ -5224,14 +5398,14 @@ async function pushProject(options) {
 }
 
 // ../core/dist/state/cleanup.js
-import { readFile as readFile11, readdir as readdir5, rm as rm6 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { readFile as readFile12, readdir as readdir6, rm as rm6 } from "node:fs/promises";
+import { join as join13 } from "node:path";
 function isSafeEntryName(name) {
   return name.length > 0 && !name.includes("/") && !name.includes("\\") && name !== "." && name !== ".." && !name.includes("\0");
 }
 async function listDir(path) {
   try {
-    return await readdir5(path);
+    return await readdir6(path);
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return [];
@@ -5249,7 +5423,7 @@ async function cleanupProject(options) {
       continue;
     let journal;
     try {
-      journal = JSON.parse(await readFile11(join12(layout.transactions, name, "journal.json"), "utf8"));
+      journal = JSON.parse(await readFile12(join13(layout.transactions, name, "journal.json"), "utf8"));
     } catch {
       continue;
     }
@@ -5267,7 +5441,7 @@ async function cleanupProject(options) {
         continue;
       pruned.push(entry.id);
       if (!options.dryRun) {
-        await rm6(join12(layout.transactions, entry.id), { recursive: true, force: true });
+        await rm6(join13(layout.transactions, entry.id), { recursive: true, force: true });
       }
     }
   }
@@ -5276,7 +5450,7 @@ async function cleanupProject(options) {
       continue;
     removedCache.push(name);
     if (!options.dryRun) {
-      await rm6(join12(layout.serverArtifacts, name), { recursive: true, force: true });
+      await rm6(join13(layout.serverArtifacts, name), { recursive: true, force: true });
     }
   }
   return {
@@ -5336,10 +5510,10 @@ var SKILL_TARGET_AGENTS = Object.freeze([
 ]);
 
 // ../core/dist/transaction/recovery.js
-import { readFile as readFile12, readdir as readdir6, rm as rm7, stat as stat3 } from "node:fs/promises";
-import { join as join13 } from "node:path";
+import { readFile as readFile13, readdir as readdir7, rm as rm7, stat as stat3 } from "node:fs/promises";
+import { join as join14 } from "node:path";
 async function recoverTransaction(projectRoot, transactionId) {
-  const journal = JSON.parse(await readFile12(join13(stateLayout(projectRoot).transactions, transactionId, "journal.json"), "utf8"));
+  const journal = JSON.parse(await readFile13(join14(stateLayout(projectRoot).transactions, transactionId, "journal.json"), "utf8"));
   if (journal.state === "committed") {
     return { transactionId, status: "committed" };
   }
@@ -5356,7 +5530,7 @@ async function listTransactions(projectRoot) {
   const root = stateLayout(projectRoot).transactions;
   let names;
   try {
-    names = await readdir6(root);
+    names = await readdir7(root);
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return [];
@@ -5366,7 +5540,7 @@ async function listTransactions(projectRoot) {
   const transactions = [];
   for (const transactionId of names) {
     try {
-      const journal = JSON.parse(await readFile12(join13(root, transactionId, "journal.json"), "utf8"));
+      const journal = JSON.parse(await readFile13(join14(root, transactionId, "journal.json"), "utf8"));
       transactions.push({
         transactionId,
         kind: journal.kind,
@@ -5397,11 +5571,11 @@ async function rollbackLatestCommittedUpdate(projectRoot) {
   if (latest === void 0) {
     throw new Error("no committed update transaction is available for rollback");
   }
-  const transactionRoot = join13(stateLayout(projectRoot).transactions, latest.transactionId);
-  const journal = JSON.parse(await readFile12(join13(transactionRoot, "journal.json"), "utf8"));
-  const after = JSON.parse(await readFile12(join13(transactionRoot, "after", "manifest.json"), "utf8"));
+  const transactionRoot = join14(stateLayout(projectRoot).transactions, latest.transactionId);
+  const journal = JSON.parse(await readFile13(join14(transactionRoot, "journal.json"), "utf8"));
+  const after = JSON.parse(await readFile13(join14(transactionRoot, "after", "manifest.json"), "utf8"));
   for (const entry of after) {
-    const target = join13(projectRoot, entry.path);
+    const target = join14(projectRoot, entry.path);
     const exists6 = await pathExists2(target);
     if (exists6 !== entry.exists || exists6 && await sha256File(target) !== entry.hash) {
       throw new Error("cannot rollback dirty path: " + entry.path);
@@ -5414,10 +5588,10 @@ async function rollbackLatestCommittedUpdate(projectRoot) {
       continue;
     }
     seen.add(snapshot.path);
-    const target = join13(projectRoot, snapshot.path);
+    const target = join14(projectRoot, snapshot.path);
     const exists6 = await pathExists2(target);
     if (snapshot.existed && snapshot.snapshot_name !== null) {
-      const content = await readFile12(join13(transactionRoot, "before", snapshot.snapshot_name));
+      const content = await readFile13(join14(transactionRoot, "before", snapshot.snapshot_name));
       operations.push({
         operation: exists6 ? "modify" : "add",
         path: snapshot.path,
@@ -5446,7 +5620,7 @@ async function cleanupOldTransactions(projectRoot, now = /* @__PURE__ */ new Dat
     if (!removable) {
       continue;
     }
-    await rm7(join13(stateLayout(projectRoot).transactions, item2.transactionId), {
+    await rm7(join14(stateLayout(projectRoot).transactions, item2.transactionId), {
       recursive: true,
       force: true
     });
@@ -5456,8 +5630,8 @@ async function cleanupOldTransactions(projectRoot, now = /* @__PURE__ */ new Dat
 }
 
 // ../core/dist/update/update.js
-import { readFile as readFile13 } from "node:fs/promises";
-import { join as join14, resolve as resolve8 } from "node:path";
+import { readFile as readFile14 } from "node:fs/promises";
+import { join as join15, resolve as resolve9 } from "node:path";
 import { parse as parseYaml8 } from "yaml";
 var UpdateWorkflowError = class extends Error {
   exitCode;
@@ -5470,10 +5644,10 @@ var UpdateWorkflowError = class extends Error {
   }
 };
 async function updateProject(options) {
-  const root = resolve8(options.projectRoot);
+  const root = resolve9(options.projectRoot);
   let project;
   try {
-    project = projectConfigSchema.parse(parseYaml8(await readFile13(join14(root, ".harness", "project.yaml"), "utf8")));
+    project = projectConfigSchema.parse(parseYaml8(await readFile14(join15(root, ".harness", "project.yaml"), "utf8")));
   } catch {
     throw new UpdateWorkflowError("project configuration is invalid", 3, "PROJECT_CONFIG_INVALID");
   }
@@ -5523,6 +5697,13 @@ async function updateProject(options) {
       ...options.confirmConflictStrategy === void 0 ? {} : { confirmConflictStrategy: options.confirmConflictStrategy },
       ...options.transactionOptions === void 0 ? {} : { transactionOptions: options.transactionOptions }
     }, baseline);
+    if (!options.dryRun) {
+      const agents = project.adapters.enabled.flatMap((agent) => {
+        const parsed = harnessAgentSchema.safeParse(agent);
+        return parsed.success ? [parsed.data] : [];
+      });
+      await synchronizeProjectRules(root, agents, project.adapter_options?.codebuddy?.surface ?? "both");
+    }
     return result;
   } catch (error) {
     if (error instanceof UpdateWorkflowError) {
@@ -5548,8 +5729,8 @@ async function updateProject(options) {
 }
 
 // src/config/init-config.ts
-import { isAbsolute as isAbsolute2, join as join15 } from "node:path";
-import { readFile as readFile14 } from "node:fs/promises";
+import { isAbsolute as isAbsolute2, join as join16 } from "node:path";
+import { readFile as readFile15 } from "node:fs/promises";
 var InitConfigurationError = class extends Error {
   exitCode;
   code;
@@ -5632,9 +5813,9 @@ function hasOwn(record, key) {
 async function resolveInitConfig(cwd, flags, prompts = {}, warnings = []) {
   let fileConfig = {};
   if (flags.config !== void 0) {
-    const path = isAbsolute2(flags.config) ? flags.config : join15(cwd, flags.config);
+    const path = isAbsolute2(flags.config) ? flags.config : join16(cwd, flags.config);
     try {
-      fileConfig = JSON.parse(await readFile14(path, "utf8"));
+      fileConfig = JSON.parse(await readFile15(path, "utf8"));
     } catch (error) {
       throw new InitConfigurationError(
         "unable to read init config: " + (error instanceof Error ? error.message : String(error)),
@@ -5716,8 +5897,8 @@ function serializeCliResult(result) {
 }
 
 // src/config/codebuddy-setup.ts
-import { mkdir as mkdir4, readFile as readFile15, readdir as readdir7, stat as stat4, writeFile as writeFile6 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname4, extname, join as join16 } from "node:path";
+import { mkdir as mkdir5, readFile as readFile16, readdir as readdir8, stat as stat4, writeFile as writeFile7 } from "node:fs/promises";
+import { basename as basename3, dirname as dirname5, extname as extname2, join as join17 } from "node:path";
 var MANAGED_RULE_NAMES = /* @__PURE__ */ new Set([
   "harness-general.md",
   "harness-general.mdc",
@@ -5736,35 +5917,59 @@ async function exists4(path) {
 }
 async function readJsonObject(path) {
   try {
-    const parsed = JSON.parse(await readFile15(path, "utf8"));
+    const parsed = JSON.parse(await readFile16(path, "utf8"));
     return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") return {};
     return null;
   }
 }
-async function inspectCodeBuddySetup(projectRoot) {
-  const rulesRoot = join16(projectRoot, ".claude", "rules");
-  let claudeRules = [];
+async function inspectCodeBuddySetup(projectRoot, surface = "both") {
+  const rulesRoot = join17(projectRoot, ".claude", "rules");
+  let ruleNames = [];
   try {
-    claudeRules = (await readdir7(rulesRoot, { withFileTypes: true })).filter((entry) => entry.isFile() && [".md", ".mdc"].includes(extname(entry.name).toLowerCase())).map((entry) => entry.name).filter((name) => !MANAGED_RULE_NAMES.has(name)).sort();
+    ruleNames = (await readdir8(rulesRoot, { withFileTypes: true })).filter((entry) => entry.isFile() && [".md", ".mdc"].includes(extname2(entry.name).toLowerCase())).map((entry) => entry.name).filter((name) => !MANAGED_RULE_NAMES.has(name)).sort();
   } catch (error) {
     if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
   }
-  const mcp = await readJsonObject(join16(projectRoot, ".mcp.json"));
+  const claudeRules = [];
+  const currentClaudeRules = [];
+  const conflictingClaudeRules = [];
+  for (const name of ruleNames) {
+    const sourceContent = await readFile16(join17(rulesRoot, name), "utf8");
+    const targetContents = await Promise.all(
+      destinationTargets(projectRoot, surface, name).map(async (target) => {
+        try {
+          return await readFile16(target, "utf8");
+        } catch (error) {
+          if (error instanceof Error && "code" in error && error.code === "ENOENT") return null;
+          throw error;
+        }
+      })
+    );
+    if (targetContents.some((content) => content === null)) claudeRules.push(name);
+    if (targetContents.some((content) => content !== null && content !== sourceContent)) {
+      conflictingClaudeRules.push(name);
+    } else if (targetContents.length > 0 && targetContents.every((content) => content === sourceContent)) {
+      currentClaudeRules.push(name);
+    }
+  }
+  const mcp = await readJsonObject(join17(projectRoot, ".mcp.json"));
   const servers = mcp?.mcpServers;
   const configured = servers !== null && typeof servers === "object" && !Array.isArray(servers) && Object.prototype.hasOwnProperty.call(servers, "codegraph");
   return {
     claudeRules,
-    hasCodeGraphIndex: await exists4(join16(projectRoot, ".codegraph")),
+    currentClaudeRules,
+    conflictingClaudeRules,
+    hasCodeGraphIndex: await exists4(join17(projectRoot, ".codegraph")),
     codeGraphConfigured: configured
   };
 }
 function destinationTargets(root, surface, name) {
-  const stem = basename2(name, extname(name));
+  const stem = basename3(name, extname2(name));
   const targets = [];
-  if (surface !== "cli") targets.push(join16(root, ".codebuddy", ".rules", `${stem}.mdc`));
-  if (surface !== "ide") targets.push(join16(root, ".codebuddy", "rules", `${stem}.md`));
+  if (surface !== "cli") targets.push(join17(root, ".codebuddy", ".rules", `${stem}.mdc`));
+  if (surface !== "ide") targets.push(join17(root, ".codebuddy", "rules", `${stem}.md`));
   return targets;
 }
 async function applyCodeBuddySetup(options) {
@@ -5776,10 +5981,10 @@ async function applyCodeBuddySetup(options) {
     warnings: []
   };
   if (options.syncClaudeRules) {
-    const plan = await inspectCodeBuddySetup(options.projectRoot);
+    const plan = await inspectCodeBuddySetup(options.projectRoot, options.surface);
     for (const name of plan.claudeRules) {
-      const source = join16(options.projectRoot, ".claude", "rules", name);
-      const content = await readFile15(source, "utf8");
+      const source = join17(options.projectRoot, ".claude", "rules", name);
+      const content = await readFile16(source, "utf8");
       if (SENSITIVE_ASSIGNMENT.test(content) || PRIVATE_KEY_BLOCK.test(content)) {
         result.skippedSensitive.push(name);
         continue;
@@ -5789,14 +5994,14 @@ async function applyCodeBuddySetup(options) {
           result.preserved.push(target);
           continue;
         }
-        await mkdir4(dirname4(target), { recursive: true });
-        await writeFile6(target, content, { encoding: "utf8", flag: "wx" });
+        await mkdir5(dirname5(target), { recursive: true });
+        await writeFile7(target, content, { encoding: "utf8", flag: "wx" });
         result.copied.push(target);
       }
     }
   }
   if (options.configureCodeGraph) {
-    const path = join16(options.projectRoot, ".mcp.json");
+    const path = join17(options.projectRoot, ".mcp.json");
     const current = await readJsonObject(path);
     if (current === null) {
       result.warnings.push(".mcp.json \u4E0D\u662F\u6709\u6548 JSON\uFF0C\u5DF2\u4FDD\u7559\u539F\u6587\u4EF6\u5E76\u8DF3\u8FC7 CodeGraph MCP \u914D\u7F6E");
@@ -5811,7 +6016,7 @@ async function applyCodeBuddySetup(options) {
             codegraph: { command: "codegraph", args: ["serve", "--mcp"] }
           }
         };
-        await writeFile6(path, JSON.stringify(next, null, 2) + "\n", "utf8");
+        await writeFile7(path, JSON.stringify(next, null, 2) + "\n", "utf8");
         result.mcpUpdated = true;
       }
     }
@@ -5820,13 +6025,13 @@ async function applyCodeBuddySetup(options) {
 }
 
 // src/commands/refresh.ts
-import { readFile as readFile16 } from "node:fs/promises";
-import { join as join17 } from "node:path";
+import { readFile as readFile17 } from "node:fs/promises";
+import { join as join18 } from "node:path";
 import { parse as parseYaml9 } from "yaml";
 async function detectProject(root) {
   let content;
   try {
-    content = await readFile16(join17(root, ".harness", "project.yaml"), "utf8");
+    content = await readFile17(join18(root, ".harness", "project.yaml"), "utf8");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return { status: "absent" };
@@ -6055,7 +6260,13 @@ function agentMenuLines(installedProfiles) {
 }
 async function configureCodeBuddyExtras(agents, surface, options, dependencies) {
   if (!agents.includes("codebuddy")) return;
-  const plan = await inspectCodeBuddySetup(dependencies.cwd);
+  const plan = await inspectCodeBuddySetup(dependencies.cwd, surface);
+  if (plan.conflictingClaudeRules.length > 0) {
+    dependencies.stderr(
+      `\u4EE5\u4E0B CodeBuddy \u89C4\u5219\u4E0E Claude \u6E90\u89C4\u5219\u5185\u5BB9\u4E0D\u540C\uFF0C\u5DF2\u4FDD\u7559\u76EE\u6807\u6587\u4EF6\uFF1A${plan.conflictingClaudeRules.join(", ")}
+`
+    );
+  }
   let syncClaudeRules = false;
   let configureCodeGraph = false;
   if (plan.claudeRules.length > 0) {
@@ -6654,7 +6865,7 @@ async function runUpdate(options, dependencies) {
 
 // src/commands/recovery.ts
 import { stat as stat5 } from "node:fs/promises";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 async function exists5(path) {
   try {
     await stat5(path);
@@ -6714,7 +6925,7 @@ async function runRecoveryMenuIfApplicable(options, dependencies) {
       return 5;
     }
   }
-  const initialized = await exists5(join18(dependencies.cwd, ".harness", "project.yaml"));
+  const initialized = await exists5(join19(dependencies.cwd, ".harness", "project.yaml"));
   if (!initialized || options.nonInteractive === true || explicitConfigure(options)) {
     return null;
   }
@@ -6757,8 +6968,8 @@ async function runRecoveryMenuIfApplicable(options, dependencies) {
 }
 
 // src/workflow-data/resolve.ts
-import { cp, mkdir as mkdir5, readdir as readdir8, readFile as readFile17, rm as rm8, stat as stat6 } from "node:fs/promises";
-import { dirname as dirname5, join as join19, relative as relative2 } from "node:path";
+import { cp, mkdir as mkdir6, readdir as readdir9, readFile as readFile18, rm as rm8, stat as stat6 } from "node:fs/promises";
+import { dirname as dirname6, join as join20, relative as relative2 } from "node:path";
 import { fileURLToPath } from "node:url";
 var WorkflowDataResolutionError = class extends Error {
   code;
@@ -6792,17 +7003,17 @@ function workflowPackageName(family, env) {
   return `${scope}/workflow-${family}`;
 }
 async function listFilesRecursive(root, base = root) {
-  const entries = await readdir8(root, { withFileTypes: true });
+  const entries = await readdir9(root, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const absolute = join19(root, entry.name);
+    const absolute = join20(root, entry.name);
     if (entry.isDirectory()) {
       files.push(...await listFilesRecursive(absolute, base));
       continue;
     }
     if (!entry.isFile()) continue;
     const rel = relative2(base, absolute).replaceAll("\\", "/");
-    files.push({ path: rel, content: await readFile17(absolute, "utf8") });
+    files.push({ path: rel, content: await readFile18(absolute, "utf8") });
   }
   return files;
 }
@@ -6815,7 +7026,7 @@ async function verifyWorkflowPackageIntegrity(resourcesRoot) {
   const manifest = await readWorkflowFamilyManifest(resourcesRoot);
   const expected = manifest.content_sha256;
   if (typeof expected !== "string" || expected.length === 0) return;
-  const harnessRoot = join19(resourcesRoot, "harness");
+  const harnessRoot = join20(resourcesRoot, "harness");
   if (!await pathExists3(harnessRoot)) {
     throw new WorkflowDataResolutionError(
       "\u5DE5\u4F5C\u6D41\u6570\u636E\u5305\u7F3A\u5C11 harness/\uFF0C\u65E0\u6CD5\u6821\u9A8C SHA-256",
@@ -6834,40 +7045,40 @@ async function verifyWorkflowPackageIntegrity(resourcesRoot) {
   }
 }
 async function monorepoResourcesRoot() {
-  const here = dirname5(fileURLToPath(import.meta.url));
+  const here = dirname6(fileURLToPath(import.meta.url));
   const candidates = [
     // TypeScript source: packages/cli/src/workflow-data -> packages/workflow-data-harness.
-    join19(here, "../../../workflow-data-harness"),
+    join20(here, "../../../workflow-data-harness"),
     // Bundled CLI: packages/cli/dist -> packages/workflow-data-harness.
-    join19(here, "../../workflow-data-harness"),
+    join20(here, "../../workflow-data-harness"),
     // Test/build layouts that preserve additional source directory levels.
-    join19(here, "../../../../packages/workflow-data-harness")
+    join20(here, "../../../../packages/workflow-data-harness")
   ];
   for (const candidate of candidates) {
-    if (await pathExists3(join19(candidate, "harness", "manifests"))) return candidate;
+    if (await pathExists3(join20(candidate, "harness", "manifests"))) return candidate;
   }
   return null;
 }
 async function siblingWorkflowPackage(cwd) {
-  const here = dirname5(fileURLToPath(import.meta.url));
+  const here = dirname6(fileURLToPath(import.meta.url));
   const candidates = [
-    join19(cwd, "node_modules", "@hunter-harness", "workflow-harness"),
+    join20(cwd, "node_modules", "@hunter-harness", "workflow-harness"),
     // Published layout: node_modules/hunter-harness/dist/bin.js alongside the
     // scoped workflow package in node_modules/@hunter-harness/workflow-harness.
-    join19(here, "..", "..", "@hunter-harness", "workflow-harness"),
+    join20(here, "..", "..", "@hunter-harness", "workflow-harness"),
     // Monorepo bundled layout: packages/cli/dist/bin.js.
-    join19(here, "..", "..", "workflow-data-harness")
+    join20(here, "..", "..", "workflow-data-harness")
   ];
   for (const candidate of candidates) {
-    if (await pathExists3(join19(candidate, "harness", "manifests"))) return candidate;
+    if (await pathExists3(join20(candidate, "harness", "manifests"))) return candidate;
   }
   return null;
 }
 async function readCachedNpmPackageVersion(cacheRoot) {
-  const manifestPath = join19(cacheRoot, "package.json");
+  const manifestPath = join20(cacheRoot, "package.json");
   if (!await pathExists3(manifestPath)) return null;
   try {
-    const pkg = JSON.parse(await readFile17(manifestPath, "utf8"));
+    const pkg = JSON.parse(await readFile18(manifestPath, "utf8"));
     return typeof pkg.version === "string" && pkg.version.length > 0 ? pkg.version : null;
   } catch {
     return null;
@@ -6889,13 +7100,13 @@ async function latestWorkflowCacheIsStale(cacheRoot, packageName, resolveManifes
   }
 }
 async function materializeWorkflowPackageCache(cacheRoot, packageSpec, extract) {
-  await mkdir5(cacheRoot, { recursive: true });
-  const staging = join19(cacheRoot, ".extract");
+  await mkdir6(cacheRoot, { recursive: true });
+  const staging = join20(cacheRoot, ".extract");
   await rm8(staging, { recursive: true, force: true });
-  await mkdir5(staging, { recursive: true });
+  await mkdir6(staging, { recursive: true });
   await extract(packageSpec, staging);
-  const packageDir = await pathExists3(join19(staging, "harness", "manifests")) ? staging : join19(staging, "package");
-  if (!await pathExists3(join19(packageDir, "harness", "manifests"))) {
+  const packageDir = await pathExists3(join20(staging, "harness", "manifests")) ? staging : join20(staging, "package");
+  if (!await pathExists3(join20(packageDir, "harness", "manifests"))) {
     throw new WorkflowDataResolutionError(
       "\u5DE5\u4F5C\u6D41\u6570\u636E\u5305\u5185\u5BB9\u65E0\u6548\uFF1A\u7F3A\u5C11 harness/manifests",
       "WORKFLOW_DATA_INVALID",
@@ -6924,8 +7135,8 @@ async function resolveWorkflowResourcesRoot(options, argv = []) {
   const packageName = workflowPackageName(family, options.env);
   const packageSpec = version === "latest" ? packageName : `${packageName}@${version}`;
   const cacheKey = packageSpec.replace("/", "+");
-  const cacheRoot = join19(options.cwd, ".harness", "cache", "workflow-packages", cacheKey);
-  if (await pathExists3(join19(cacheRoot, "harness", "manifests"))) {
+  const cacheRoot = join20(options.cwd, ".harness", "cache", "workflow-packages", cacheKey);
+  if (await pathExists3(join20(cacheRoot, "harness", "manifests"))) {
     if (version === "latest") {
       const stale = await latestWorkflowCacheIsStale(cacheRoot, packageName, options.pacoteManifest);
       if (stale) {
@@ -6971,9 +7182,9 @@ function describeWorkflowDataFetchFailure(error, packageSpec) {
   return `\u65E0\u6CD5\u83B7\u53D6\u5DE5\u4F5C\u6D41\u6570\u636E\u5305 ${packageSpec}\uFF1A\u672C\u5730\u7F13\u5B58\u4E0D\u5B58\u5728\u4E14\u83B7\u53D6\u5931\u8D25\u3002\u53EF${hintRoot}\u3002\u539F\u56E0\uFF1A${code !== "" ? code + " " : ""}${detail}`;
 }
 async function readWorkflowFamilyManifest(resourcesRoot) {
-  const manifestPath = join19(resourcesRoot, "hunter-workflow-family.json");
+  const manifestPath = join20(resourcesRoot, "hunter-workflow-family.json");
   if (!await pathExists3(manifestPath)) return {};
-  return JSON.parse(await readFile17(manifestPath, "utf8"));
+  return JSON.parse(await readFile18(manifestPath, "utf8"));
 }
 
 // src/bin.ts