hunter-harness 0.2.27 → 0.2.29

package/dist/bin.js

@@ -1216,8 +1216,8 @@ async function assertNoSymlinks(root, relativePath) {
   for (const segment of normalized.split("/")) {
     current = join(current, segment);
     try {
-      const stat7 = await lstat(current);
-      if (stat7.isSymbolicLink()) {
+      const stat8 = await lstat(current);
+      if (stat8.isSymbolicLink()) {
         throw new UnsafePathError("symbolic links are not managed");
       }
     } catch (error) {
@@ -1233,7 +1233,7 @@ async function assertNoSymlinks(root, relativePath) {
 async function withRetry(action, options) {
   const attempts = options.attempts ?? 3;
   const sleep = options.sleep ?? (async (milliseconds) => {
-    await new Promise((resolve9) => setTimeout(resolve9, milliseconds));
+    await new Promise((resolve11) => setTimeout(resolve11, milliseconds));
   });
   let lastError;
   for (let attempt = 1; attempt <= attempts; attempt += 1) {
@@ -1684,6 +1684,9 @@ function classifyFile(input) {
   if (under(path, ".harness/knowledge/")) {
     return USER_DIFF;
   }
+  if (under(path, ".harness/rules/")) {
+    return USER_DIFF;
+  }
   if (/^\.harness\/archive\/[^/]+\/reports\/final\/summary-data\.json$/u.test(path)) {
     return GENERATED_REVIEWABLE;
   }
@@ -1696,7 +1699,7 @@ function classifyFile(input) {
   if (under(path, ".harness/reports/")) {
     return REPORT_CACHE;
   }
-  if (under(path, ".harness/state/") || under(path, ".harness/rules/")) {
+  if (under(path, ".harness/state/")) {
     return INTERNAL_STATE;
   }
   if (under(path, ".harness/generated/") || under(path, ".harness/cache/")) {
@@ -1730,9 +1733,9 @@ function decideUpdate(policy, dirty) {
 }
 
 // ../core/dist/project/initialize.js
-import { createHash as createHash4 } from "node:crypto";
-import { readFile as readFile4, stat as stat2, writeFile as writeFile3 } from "node:fs/promises";
-import { basename, join as join5, resolve as resolve4 } from "node:path";
+import { createHash as createHash5 } from "node:crypto";
+import { readFile as readFile5, stat as stat2, writeFile as writeFile4 } from "node:fs/promises";
+import { basename as basename2, join as join6, resolve as resolve5 } from "node:path";
 import { parse as parseYaml2, stringify as stringifyYaml } from "yaml";
 
 // ../core/dist/transaction/transaction.js
@@ -2247,10 +2250,244 @@ function managedTargetsFor(adapter, bundle, context) {
   return records.sort((left, right) => left.target_path.localeCompare(right.target_path));
 }
 
-// ../core/dist/project/profile-bundle.js
+// ../core/dist/project/project-rules.js
 import { createHash as createHash3 } from "node:crypto";
-import { readFile as readFile3, readdir as readdir2 } from "node:fs/promises";
-import { join as join4, resolve as resolve3 } from "node:path";
+import { mkdir as mkdir4, readFile as readFile3, readdir as readdir2, rename as rename3, unlink, writeFile as writeFile3 } from "node:fs/promises";
+import { basename, dirname as dirname3, extname, join as join4, resolve as resolve3 } from "node:path";
+var RULES_ROOT = ".harness/rules";
+var RECEIPT_PATH = ".harness/state/local/rule-projections.json";
+var CODEX_BLOCK_ID = "hunter-harness-project-rules";
+var MANAGED_NAMES = /* @__PURE__ */ new Set([
+  "harness-general.md",
+  "harness-general.mdc",
+  "harness-profile-java.md",
+  "harness-profile-java.mdc"
+]);
+var AGENT_RULE_ROOTS = [
+  ".claude/rules",
+  ".cursor/rules",
+  ".codebuddy/.rules",
+  ".codebuddy/rules"
+];
+function sha256(content) {
+  return createHash3("sha256").update(content).digest("hex");
+}
+async function optionalText(path) {
+  try {
+    return await readFile3(path, "utf8");
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT")
+      return null;
+    throw error;
+  }
+}
+async function readReceipt(root) {
+  try {
+    const parsed = JSON.parse(await readFile3(join4(root, RECEIPT_PATH), "utf8"));
+    if (parsed.schema_version === 1 && parsed.targets && parsed.source_hashes)
+      return parsed;
+  } catch {
+  }
+  return { schema_version: 1, source_hashes: {}, targets: {} };
+}
+async function markdownFiles(root) {
+  try {
+    return (await readdir2(root, { withFileTypes: true })).filter((entry) => entry.isFile() && [".md", ".mdc"].includes(extname(entry.name).toLowerCase())).map((entry) => entry.name).filter((name) => !MANAGED_NAMES.has(name)).sort();
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT")
+      return [];
+    throw error;
+  }
+}
+function portable(path) {
+  return path.replaceAll("\\", "/");
+}
+function normalizeRuleContent(content) {
+  return content.replace(/\r\n/g, "\n").trimEnd() + "\n";
+}
+function canonicalImportContent(content) {
+  const normalized = content.replace(/\r\n/g, "\n");
+  if (!normalized.startsWith("---\n"))
+    return normalizeRuleContent(normalized);
+  const closing = normalized.indexOf("\n---\n", 4);
+  if (closing < 0)
+    return null;
+  const frontmatter = normalized.slice(4, closing);
+  if (/^\s*(?:globs?|paths?)\s*:/im.test(frontmatter) || /^\s*alwaysApply\s*:\s*false\s*$/im.test(frontmatter)) {
+    return null;
+  }
+  return normalizeRuleContent(normalized.slice(closing + 5));
+}
+async function collectImportCandidates(root, previous, result) {
+  const candidates = [];
+  for (const ruleRoot of AGENT_RULE_ROOTS) {
+    for (const name of await markdownFiles(join4(root, ...ruleRoot.split("/")))) {
+      const source = portable(`${ruleRoot}/${name}`);
+      const content = await readFile3(join4(root, ...source.split("/")), "utf8");
+      if (previous.targets[source] === sha256(content))
+        continue;
+      const canonical = canonicalImportContent(content);
+      if (canonical === null) {
+        result.agent_specific.push(source);
+        continue;
+      }
+      candidates.push({
+        source,
+        destination: `${RULES_ROOT}/${basename(name, extname(name))}.md`,
+        content: canonical
+      });
+    }
+  }
+  return candidates;
+}
+async function importAgentRules(root, canonicalRoot, previous, result) {
+  const grouped = /* @__PURE__ */ new Map();
+  for (const candidate of await collectImportCandidates(root, previous, result)) {
+    const values = grouped.get(candidate.destination) ?? [];
+    values.push(candidate);
+    grouped.set(candidate.destination, values);
+  }
+  for (const [destination, candidates] of [...grouped].sort(([a], [b]) => a.localeCompare(b))) {
+    const destinationPath = join4(canonicalRoot, basename(destination));
+    const current = await optionalText(destinationPath);
+    const distinct = new Set(candidates.map((candidate) => candidate.content));
+    const representative = candidates.at(0);
+    if (representative === void 0)
+      continue;
+    if (current === null && distinct.size === 1) {
+      await atomicWrite(destinationPath, representative.content);
+      result.migrated.push(destination);
+      continue;
+    }
+    if (current !== null && distinct.size === 1 && normalizeRuleContent(current) === representative.content) {
+      continue;
+    }
+    result.conflicts.push(...candidates.map((candidate) => candidate.source));
+  }
+}
+function targetsFor(name, agents, surface) {
+  const stem = basename(name, extname(name));
+  const targets = [];
+  if (agents.includes("claude-code"))
+    targets.push(`.claude/rules/${stem}.md`);
+  if (agents.includes("cursor"))
+    targets.push(`.cursor/rules/${stem}.mdc`);
+  if (agents.includes("codebuddy") && surface !== "cli") {
+    targets.push(`.codebuddy/.rules/${stem}.mdc`);
+  }
+  if (agents.includes("codebuddy") && surface !== "ide") {
+    targets.push(`.codebuddy/rules/${stem}.md`);
+  }
+  return targets;
+}
+async function atomicWrite(path, content) {
+  await mkdir4(dirname3(path), { recursive: true });
+  const temporary = `${path}.${process.pid}.tmp`;
+  await writeFile3(temporary, content, "utf8");
+  await rename3(temporary, path);
+}
+async function synchronizeProjectRules(projectRoot, agents, surface = "both") {
+  const root = resolve3(projectRoot);
+  const canonicalRoot = join4(root, RULES_ROOT);
+  const result = {
+    migrated: [],
+    agent_specific: [],
+    written: [],
+    removed: [],
+    unchanged: [],
+    conflicts: []
+  };
+  await mkdir4(canonicalRoot, { recursive: true });
+  const previous = await readReceipt(root);
+  await importAgentRules(root, canonicalRoot, previous, result);
+  const next = { schema_version: 1, source_hashes: {}, targets: {} };
+  const desired = /* @__PURE__ */ new Map();
+  for (const name of await markdownFiles(canonicalRoot)) {
+    const sourcePath = `${RULES_ROOT}/${name}`;
+    const content = await readFile3(join4(canonicalRoot, name), "utf8");
+    next.source_hashes[sourcePath] = sha256(content);
+    for (const target of targetsFor(name, agents, surface))
+      desired.set(target, content);
+  }
+  for (const [target, content] of desired) {
+    const path = join4(root, target);
+    const current = await optionalText(path);
+    const incomingHash = sha256(content);
+    const canonicalCurrent = current === null ? null : canonicalImportContent(current);
+    if (current === content || canonicalCurrent === content) {
+      result.unchanged.push(target);
+      next.targets[target] = current === null ? incomingHash : sha256(current);
+    } else if (current === null || previous.targets[target] === sha256(current)) {
+      await atomicWrite(path, content);
+      result.written.push(target);
+      next.targets[target] = incomingHash;
+    } else {
+      result.conflicts.push(target);
+      next.targets[target] = previous.targets[target] ?? sha256(current);
+    }
+  }
+  for (const [target, trustedHash] of Object.entries(previous.targets)) {
+    if (target === "AGENTS.md")
+      continue;
+    if (desired.has(target))
+      continue;
+    const path = join4(root, target);
+    const current = await optionalText(path);
+    if (current === null)
+      continue;
+    if (sha256(current) === trustedHash) {
+      await unlink(path);
+      result.removed.push(target);
+    } else {
+      result.conflicts.push(target);
+      next.targets[target] = trustedHash;
+    }
+  }
+  if (agents.includes("codex")) {
+    const rules = Object.keys(next.source_hashes).sort();
+    const body = [
+      "Before project work, read and follow these shared project rules:",
+      ...rules.map((path) => `- \`${path}\``)
+    ].join("\n");
+    const agentsPath = join4(root, "AGENTS.md");
+    const current = await optionalText(agentsPath) ?? "";
+    const updated = rules.length > 0 ? upsertManagedBlockById(current, CODEX_BLOCK_ID, body) : removeManagedBlockById(current, CODEX_BLOCK_ID);
+    const target = "AGENTS.md";
+    const semanticallyEqual = updated.replace(/\r\n/g, "\n").trimEnd() === current.replace(/\r\n/g, "\n").trimEnd();
+    if (semanticallyEqual)
+      result.unchanged.push(target);
+    else {
+      await atomicWrite(agentsPath, updated);
+      result.written.push(target);
+    }
+    if (rules.length > 0) {
+      next.targets[target] = sha256(semanticallyEqual ? current : updated);
+    }
+  } else if (Object.prototype.hasOwnProperty.call(previous.targets, "AGENTS.md")) {
+    const agentsPath = join4(root, "AGENTS.md");
+    const current = await optionalText(agentsPath);
+    if (current !== null) {
+      const updated = removeManagedBlockById(current, CODEX_BLOCK_ID);
+      if (updated !== current) {
+        await atomicWrite(agentsPath, updated);
+        result.written.push("AGENTS.md");
+      }
+    }
+  }
+  await atomicWrite(join4(root, RECEIPT_PATH), JSON.stringify(next, null, 2) + "\n");
+  result.migrated.sort();
+  result.agent_specific.sort();
+  result.written.sort();
+  result.removed.sort();
+  result.unchanged.sort();
+  result.conflicts = [...new Set(result.conflicts)].sort();
+  return result;
+}
+
+// ../core/dist/project/profile-bundle.js
+import { createHash as createHash4 } from "node:crypto";
+import { readFile as readFile4, readdir as readdir3 } from "node:fs/promises";
+import { join as join5, resolve as resolve4 } from "node:path";
 var AdapterBundleError = class extends Error {
   code;
   exitCode = 7;
@@ -2276,15 +2513,15 @@ function validateRelativeBundlePath2(path) {
 }
 var bundleCache = /* @__PURE__ */ new Map();
 async function loadAgentBundle(resourcesRoot, profile, agent) {
-  const cacheKey = `${resolve3(resourcesRoot)}:${profile}:${agent}`;
+  const cacheKey = `${resolve4(resourcesRoot)}:${profile}:${agent}`;
   const cached = bundleCache.get(cacheKey);
   if (cached) {
     return { manifest: cached.manifest, files: new Map(cached.files) };
   }
-  const manifestPath = join4(resourcesRoot, "harness", "manifests", profile, `${agent}.json`);
+  const manifestPath = join5(resourcesRoot, "harness", "manifests", profile, `${agent}.json`);
   let manifestText;
   try {
-    manifestText = await readFile3(manifestPath, "utf8");
+    manifestText = await readFile4(manifestPath, "utf8");
   } catch (error) {
     if (isEnoent(error)) {
       throw new AdapterBundleError("ADAPTER_BUNDLE_MISSING", `offline Harness Bundle manifest missing: ${profile}/${agent}`);
@@ -2312,14 +2549,14 @@ async function loadAgentBundle(resourcesRoot, profile, agent) {
     }
     let bytes;
     try {
-      bytes = await readFile3(join4(resourcesRoot, "harness", "bundles", profile, agent, item2.path));
+      bytes = await readFile4(join5(resourcesRoot, "harness", "bundles", profile, agent, item2.path));
     } catch (error) {
       if (isEnoent(error)) {
         throw new AdapterBundleError("ADAPTER_BUNDLE_MISSING", `offline Harness Bundle file missing: ${profile}/${agent}/${item2.path}`);
       }
       throw error;
     }
-    if (createHash3("sha256").update(bytes).digest("hex") !== item2.sha256) {
+    if (createHash4("sha256").update(bytes).digest("hex") !== item2.sha256) {
       throw new AdapterBundleError("ADAPTER_BUNDLE_INVALID", `Harness Bundle hash mismatch: ${profile}/${agent}/${item2.path}`);
     }
     files.set(item2.path, bytes);
@@ -2384,10 +2621,10 @@ function parseMigrationManifest(raw) {
   };
 }
 async function loadMigrationManifests(resourcesRoot) {
-  const migrationsRoot = join4(resourcesRoot, "harness", "migrations");
+  const migrationsRoot = join5(resourcesRoot, "harness", "migrations");
   let versionDirs;
   try {
-    versionDirs = await readdir2(migrationsRoot);
+    versionDirs = await readdir3(migrationsRoot);
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return [];
@@ -2398,7 +2635,7 @@ async function loadMigrationManifests(resourcesRoot) {
   for (const versionDir of versionDirs) {
     let files;
     try {
-      files = await readdir2(join4(migrationsRoot, versionDir));
+      files = await readdir3(join5(migrationsRoot, versionDir));
     } catch (error) {
       if (error instanceof Error && "code" in error && error.code === "ENOENT") {
         continue;
@@ -2408,7 +2645,7 @@ async function loadMigrationManifests(resourcesRoot) {
     for (const file of files) {
       if (!file.endsWith(".json"))
         continue;
-      manifests.push(parseMigrationManifest(JSON.parse(await readFile3(join4(migrationsRoot, versionDir, file), "utf8"))));
+      manifests.push(parseMigrationManifest(JSON.parse(await readFile4(join5(migrationsRoot, versionDir, file), "utf8"))));
     }
   }
   return manifests;
@@ -2440,14 +2677,14 @@ function uuidV7(now = Date.now()) {
 var CONTEXT_INDEX_PATH = ".harness/context-index.json";
 async function fileHex(path) {
   try {
-    const data = await readFile4(path);
-    return createHash4("sha256").update(data).digest("hex");
+    const data = await readFile5(path);
+    return createHash5("sha256").update(data).digest("hex");
   } catch {
     return null;
   }
 }
 async function readExistingSkillBundles(root) {
-  const text = await readOptional(join5(root, CONTEXT_INDEX_PATH));
+  const text = await readOptional(join6(root, CONTEXT_INDEX_PATH));
   if (text === "")
     return /* @__PURE__ */ new Map();
   try {
@@ -2467,7 +2704,7 @@ var TargetCollisionError = class extends Error {
   }
 };
 function hex(bytes) {
-  return createHash4("sha256").update(bytes).digest("hex");
+  return createHash5("sha256").update(bytes).digest("hex");
 }
 function bytesEqual(left, right) {
   if (left.byteLength !== right.byteLength)
@@ -2480,7 +2717,7 @@ function bytesEqual(left, right) {
 }
 async function readOptional(path) {
   try {
-    return await readFile4(path, "utf8");
+    return await readFile5(path, "utf8");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return "";
@@ -2500,12 +2737,12 @@ async function exists2(path) {
   }
 }
 async function existingProjectConfig(root) {
-  const path = join5(root, ".harness", "project.yaml");
+  const path = join6(root, ".harness", "project.yaml");
   const content = await readOptional(path);
   return content === "" ? null : projectConfigSchema.parse(parseYaml2(content));
 }
 async function operationFor(root, path, content) {
-  return await exists2(join5(root, path)) ? { operation: "modify", path, content } : { operation: "add", path, content };
+  return await exists2(join6(root, path)) ? { operation: "modify", path, content } : { operation: "add", path, content };
 }
 var INSTALLED_BUNDLE_PATH = ".harness/state/local/installed-harness-bundle.json";
 function mergeOwnedTargets(owned) {
@@ -2541,7 +2778,7 @@ function mergeOwnedTargets(owned) {
   });
 }
 async function initializeProject(options) {
-  const root = resolve4(options.projectRoot);
+  const root = resolve5(options.projectRoot);
   const config = initConfigSchema.parse(options.config);
   const existing = await existingProjectConfig(root);
   const profile = config.profile;
@@ -2584,7 +2821,7 @@ async function initializeProject(options) {
   const projectConfig = projectConfigSchema.parse({
     harness: { name: "hunter-harness", schema_version: 1 },
     project: {
-      name: existing?.project.name ?? basename(root),
+      name: existing?.project.name ?? basename2(root),
       root: ".",
       local_project_key: existing?.project.local_project_key ?? uuidV7(),
       project_id: config.project_id ?? existing?.project.project_id ?? null,
@@ -2606,7 +2843,7 @@ async function initializeProject(options) {
     files: {}
   });
   const managedBlocks = [];
-  let agentsContent = await readOptional(join5(root, "AGENTS.md"));
+  let agentsContent = await readOptional(join6(root, "AGENTS.md"));
   agentsContent = upsertManagedBlockById(agentsContent, AGENTS_CORE_BLOCK_ID, AGENTS_MANAGED_BLOCK_CONTENT);
   managedBlocks.push({
     owner: "shared",
@@ -2643,7 +2880,7 @@ async function initializeProject(options) {
     ["AGENTS.md", agentsContent]
   ]);
   if (enabledAgents.includes("claude-code")) {
-    let claudeContent = await readOptional(join5(root, "CLAUDE.md"));
+    let claudeContent = await readOptional(join6(root, "CLAUDE.md"));
     claudeContent = upsertManagedBlockById(claudeContent, CLAUDE_BLOCK_ID, CLAUDE_MANAGED_BLOCK_CONTENT);
     files.set("CLAUDE.md", claudeContent);
     managedBlocks.push({
@@ -2654,7 +2891,7 @@ async function initializeProject(options) {
     });
   }
   if (enabledAgents.includes("codebuddy")) {
-    let codebuddyContent = await readOptional(join5(root, "CODEBUDDY.md"));
+    let codebuddyContent = await readOptional(join6(root, "CODEBUDDY.md"));
     codebuddyContent = upsertManagedBlockById(codebuddyContent, CODEBUDDY_BLOCK_ID, CODEBUDDY_MANAGED_BLOCK_CONTENT);
     files.set("CODEBUDDY.md", codebuddyContent);
     managedBlocks.push({
@@ -2691,6 +2928,7 @@ async function initializeProject(options) {
     const writeOperations = await Promise.all([...files.entries()].map(async ([path, content]) => operationFor(root, path, content)));
     await runTransaction(root, writeOperations, { kind: "init" });
     await enrichContextIndexWithVerification(root, enabledAgents, profile, options.resourcesRoot, adapterContext);
+    await synchronizeProjectRules(root, enabledAgents, surface);
   }
   return {
     projectConfig,
@@ -2700,8 +2938,8 @@ async function initializeProject(options) {
   };
 }
 async function enrichContextIndexWithVerification(root, agents, profile, resourcesRoot, adapterContext) {
-  const contextPath = join5(root, CONTEXT_INDEX_PATH);
-  const existing = await readOptional(join5(contextPath));
+  const contextPath = join6(root, CONTEXT_INDEX_PATH);
+  const existing = await readOptional(join6(contextPath));
   if (existing === "")
     return;
   let parsed;
@@ -2726,7 +2964,7 @@ async function enrichContextIndexWithVerification(root, agents, profile, resourc
     const entries = [];
     for (const target of targets) {
       const rel = target.target_path.replace(/\\/g, "/");
-      const actual = await fileHex(join5(root, target.target_path));
+      const actual = await fileHex(join6(root, target.target_path));
       entries.push({ relpath: rel, sha256: actual ?? "" });
       if (actual === null) {
         mismatches.push({ relpath: rel, expected: target.sha256, actual: "<missing>" });
@@ -2743,19 +2981,240 @@ async function enrichContextIndexWithVerification(root, agents, profile, resourc
     entry.verificationStatus = newStatus;
     entry.mismatchDetails = mismatches;
   }
-  await writeFile3(contextPath, JSON.stringify(parsed, null, 2) + "\n", "utf8");
+  await writeFile4(contextPath, JSON.stringify(parsed, null, 2) + "\n", "utf8");
+}
+
+// ../core/dist/project/rule-candidates.js
+import { createHash as createHash6 } from "node:crypto";
+import { mkdir as mkdir5, readFile as readFile6, readdir as readdir4, rename as rename4, stat as stat3, writeFile as writeFile5 } from "node:fs/promises";
+import { basename as basename3, dirname as dirname4, join as join7, relative, resolve as resolve6 } from "node:path";
+var ARCHIVE_ROOT = ".harness/archive";
+var CANDIDATE_PATH = ".harness/knowledge/rule-candidates.json";
+var MAX_EVIDENCE_BYTES = 2 * 1024 * 1024;
+var EVIDENCE_NAMES = [
+  /^review-findings.*\.json$/i,
+  /^test-(?:report|results?|failures?).*\.json$/i,
+  /^summary-data\.json$/i
+];
+function sha2562(content) {
+  return createHash6("sha256").update(content).digest("hex");
+}
+function portable2(path) {
+  return path.replaceAll("\\", "/");
+}
+function normalizeText(value) {
+  return value.replace(/\s+/g, " ").trim();
+}
+function safeText(value, limit = 500) {
+  if (typeof value !== "string")
+    return null;
+  const normalized = normalizeText(value).slice(0, limit);
+  if (normalized.length < 8)
+    return null;
+  if (/(?:ignore|disregard)\s+(?:all\s+)?previous|system\s+prompt|developer\s+message/i.test(normalized)) {
+    return null;
+  }
+  if (/-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|gh[pousr]_[A-Za-z0-9]{20,}|(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?):\/\//i.test(normalized)) {
+    return null;
+  }
+  return normalized;
+}
+function stringField(record, names) {
+  for (const name of names) {
+    const value = safeText(record[name]);
+    if (value !== null)
+      return value;
+  }
+  return null;
+}
+function severityOf(record) {
+  const value = record.severity ?? record.level ?? record.priority ?? "unknown";
+  return typeof value === "string" ? value.toLowerCase() : "unknown";
+}
+function highSeverity(severity) {
+  return /^(?:red|critical|high|error|blocker|p0|p1)$/.test(severity);
+}
+function evidenceKind(path) {
+  const name = basename3(path).toLowerCase();
+  if (name.startsWith("review-"))
+    return "review";
+  if (name.startsWith("test-"))
+    return "test";
+  return "validation";
+}
+function observationFrom(record, path, archive) {
+  const severity = severityOf(record);
+  const suggestion = stringField(record, [
+    "proposed_rule",
+    "proposedRule",
+    "suggestion",
+    "recommendation",
+    "remediation"
+  ]);
+  const issue = stringField(record, ["issue", "message", "error", "failure"]);
+  const title = stringField(record, ["title", "name", "id", "code"]) ?? issue;
+  let proposedRule = suggestion;
+  if (proposedRule === null && issue !== null && highSeverity(severity)) {
+    proposedRule = `\u5FC5\u987B\u589E\u52A0\u53EF\u91CD\u590D\u9A8C\u8BC1\uFF0C\u9632\u6B62\u4EE5\u4E0B\u95EE\u9898\u518D\u6B21\u51FA\u73B0\uFF1A${issue}`;
+  }
+  if (proposedRule === null || title === null)
+    return null;
+  const recordId = record.id ?? record.code ?? record.name ?? null;
+  return {
+    title,
+    proposedRule,
+    severity,
+    evidence: {
+      archive,
+      path,
+      kind: evidenceKind(path),
+      record_id: typeof recordId === "string" ? recordId.slice(0, 120) : null
+    }
+  };
+}
+function collectObservations(value, path, archive, output, rejected) {
+  if (Array.isArray(value)) {
+    for (const item2 of value)
+      collectObservations(item2, path, archive, output, rejected);
+    return;
+  }
+  if (value === null || typeof value !== "object")
+    return;
+  const record = value;
+  const candidate = observationFrom(record, path, archive);
+  if (candidate !== null)
+    output.push(candidate);
+  else if (Object.keys(record).some((key) => ["suggestion", "recommendation", "proposed_rule", "proposedRule"].includes(key)))
+    rejected.count += 1;
+  for (const nested of Object.values(record)) {
+    if (nested !== null && typeof nested === "object") {
+      collectObservations(nested, path, archive, output, rejected);
+    }
+  }
+}
+async function evidenceFiles(root) {
+  const archiveRoot = join7(root, ...ARCHIVE_ROOT.split("/"));
+  const output = [];
+  async function walk(directory) {
+    let entries;
+    try {
+      entries = await readdir4(directory, { withFileTypes: true });
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "ENOENT")
+        return;
+      throw error;
+    }
+    for (const entry of entries) {
+      const path = join7(directory, entry.name);
+      if (entry.isDirectory())
+        await walk(path);
+      else if (entry.isFile() && EVIDENCE_NAMES.some((pattern) => pattern.test(entry.name))) {
+        if ((await stat3(path)).size <= MAX_EVIDENCE_BYTES)
+          output.push(path);
+      }
+    }
+  }
+  await walk(archiveRoot);
+  return output.sort();
+}
+function candidateKey(rule) {
+  return normalizeText(rule).toLocaleLowerCase();
+}
+function buildCandidates(observations) {
+  const grouped = /* @__PURE__ */ new Map();
+  for (const observation of observations) {
+    const key = candidateKey(observation.proposedRule);
+    const values = grouped.get(key) ?? [];
+    values.push(observation);
+    grouped.set(key, values);
+  }
+  const candidates = [];
+  for (const [key, values] of grouped) {
+    const archives = new Set(values.map((value) => value.evidence.archive));
+    const highest = values.find((value) => highSeverity(value.severity));
+    if (archives.size < 2 && highest === void 0)
+      continue;
+    const representative = highest ?? values.at(0);
+    if (representative === void 0)
+      continue;
+    const evidence = [...new Map(values.map((value) => [
+      `${value.evidence.path}\0${value.evidence.record_id ?? ""}`,
+      value.evidence
+    ])).values()].sort((a, b) => a.path.localeCompare(b.path));
+    candidates.push({
+      id: `rule_${sha2562(key).slice(0, 16)}`,
+      status: "candidate",
+      title: representative.title,
+      proposed_rule: representative.proposedRule,
+      confidence: archives.size >= 2 && highest !== void 0 ? "high" : "medium",
+      severity: representative.severity,
+      occurrences: evidence.length,
+      evidence
+    });
+  }
+  return candidates.sort((a, b) => a.id.localeCompare(b.id));
+}
+async function atomicWrite2(path, content) {
+  await mkdir5(dirname4(path), { recursive: true });
+  const temporary = `${path}.${process.pid}.tmp`;
+  await writeFile5(temporary, content, "utf8");
+  await rename4(temporary, path);
+}
+async function synchronizeRuleCandidates(projectRoot, options = {}) {
+  const root = resolve6(projectRoot);
+  const files = await evidenceFiles(root);
+  const sourceHashes = {};
+  const observations = [];
+  const rejected = { count: 0 };
+  for (const path of files) {
+    const relativePath = portable2(relative(root, path));
+    const content2 = await readFile6(path, "utf8");
+    sourceHashes[relativePath] = sha2562(content2);
+    let parsed;
+    try {
+      parsed = JSON.parse(content2);
+    } catch {
+      continue;
+    }
+    const archive = relativePath.split("/")[2] ?? "unknown";
+    collectObservations(parsed, relativePath, archive, observations, rejected);
+  }
+  const manifest = {
+    schema_version: 1,
+    source_hashes: sourceHashes,
+    candidates: buildCandidates(observations)
+  };
+  const content = JSON.stringify(manifest, null, 2) + "\n";
+  const destination = join7(root, ...CANDIDATE_PATH.split("/"));
+  let current = null;
+  try {
+    current = await readFile6(destination, "utf8");
+  } catch (error) {
+    if (!(error instanceof Error && "code" in error && error.code === "ENOENT"))
+      throw error;
+  }
+  const changed = current !== content;
+  if (changed && options.dryRun !== true)
+    await atomicWrite2(destination, content);
+  return {
+    path: CANDIDATE_PATH,
+    scanned: files.length,
+    candidates: manifest.candidates.length,
+    changed,
+    rejected_untrusted: rejected.count
+  };
 }
 
 // ../core/dist/project/refresh.js
-import { createHash as createHash5 } from "node:crypto";
-import { readFile as readFile5, readdir as readdir3, rmdir } from "node:fs/promises";
-import { dirname as dirname3, join as join6, resolve as resolve5 } from "node:path";
+import { createHash as createHash7 } from "node:crypto";
+import { readFile as readFile7, readdir as readdir5, rmdir } from "node:fs/promises";
+import { dirname as dirname5, join as join8, resolve as resolve7 } from "node:path";
 import { parse as parseYaml3, stringify as stringifyYaml2 } from "yaml";
 var INSTALLED_STATE_PATH = ".harness/state/local/installed-harness-bundle.json";
 var CONTEXT_INDEX_PATH2 = ".harness/context-index.json";
 async function fileHex2(path) {
   try {
-    return createHash5("sha256").update(await readFile5(path)).digest("hex");
+    return createHash7("sha256").update(await readFile7(path)).digest("hex");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return null;
@@ -2765,7 +3224,7 @@ async function fileHex2(path) {
 }
 async function readOptionalText(path) {
   try {
-    return await readFile5(path, "utf8");
+    return await readFile7(path, "utf8");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return "";
@@ -2774,7 +3233,7 @@ async function readOptionalText(path) {
   }
 }
 async function readInstalledState(root) {
-  const content = await readOptionalText(join6(root, INSTALLED_STATE_PATH));
+  const content = await readOptionalText(join8(root, INSTALLED_STATE_PATH));
   if (content === "") {
     return {
       profile: null,
@@ -2844,7 +3303,7 @@ async function readInstalledState(root) {
   };
 }
 async function readInstalledAgentConfiguration(projectRoot) {
-  const installed = await readInstalledState(resolve5(projectRoot));
+  const installed = await readInstalledState(resolve7(projectRoot));
   return {
     agents: installed.adapters,
     profiles: Object.fromEntries(installed.adapters.map((agent) => [
@@ -2854,7 +3313,7 @@ async function readInstalledAgentConfiguration(projectRoot) {
   };
 }
 async function readContextIndexBundleHash(root) {
-  const content = await readOptionalText(join6(root, CONTEXT_INDEX_PATH2));
+  const content = await readOptionalText(join8(root, CONTEXT_INDEX_PATH2));
   if (content === "")
     return null;
   try {
@@ -2866,13 +3325,13 @@ async function readContextIndexBundleHash(root) {
   }
 }
 async function pruneEmptyParentDirs(root, deletedPaths, boundaryPaths) {
-  const boundaries = new Set(boundaryPaths.map((path) => join6(root, path)));
+  const boundaries = new Set(boundaryPaths.map((path) => join8(root, path)));
   for (const deleted of deletedPaths) {
-    let dir = dirname3(join6(root, deleted));
+    let dir = dirname5(join8(root, deleted));
     while (dir.startsWith(root) && !boundaries.has(dir)) {
       let entries;
       try {
-        entries = await readdir3(dir);
+        entries = await readdir5(dir);
       } catch {
         break;
       }
@@ -2883,7 +3342,7 @@ async function pruneEmptyParentDirs(root, deletedPaths, boundaryPaths) {
       } catch {
         break;
       }
-      dir = dirname3(dir);
+      dir = dirname5(dir);
     }
   }
 }
@@ -2910,7 +3369,7 @@ function sortByTarget(items) {
   return [...items].sort((left, right) => left.target_path.localeCompare(right.target_path));
 }
 async function reconcileContextIndex(root, agents, profiles, manifests, codebuddySurface2, verifications) {
-  const existing = await readOptionalText(join6(root, CONTEXT_INDEX_PATH2));
+  const existing = await readOptionalText(join8(root, CONTEXT_INDEX_PATH2));
   let codebase = {
     map: ".harness/codebase/map",
     status: "missing"
@@ -2963,7 +3422,7 @@ async function reconcileContextIndex(root, agents, profiles, manifests, codebudd
 }
 async function projectTransitionOperation(root, agents, profiles, codebuddySurface2) {
   const path = ".harness/project.yaml";
-  const content = await readOptionalText(join6(root, path));
+  const content = await readOptionalText(join8(root, path));
   if (content === "")
     return null;
   const project = parseYaml3(content);
@@ -2998,11 +3457,11 @@ function mergeTargets(targets) {
   }).sort((left, right) => left.target_path.localeCompare(right.target_path));
 }
 async function reconcileMarkdownBlock(root, fileName, blockId, content, remove, ops, conflicts, preserved) {
-  const original = await readOptionalText(join6(root, fileName));
+  const original = await readOptionalText(join8(root, fileName));
   const synthetic = {
     source_path: fileName,
     target_path: fileName,
-    sha256: createHash5("sha256").update(content).digest("hex"),
+    sha256: createHash7("sha256").update(content).digest("hex"),
     bytes: new TextEncoder().encode(content)
   };
   let next;
@@ -3017,7 +3476,7 @@ async function reconcileMarkdownBlock(root, fileName, blockId, content, remove,
       next = refreshed.content;
     }
   } catch {
-    const current = original === "" ? null : createHash5("sha256").update(original).digest("hex");
+    const current = original === "" ? null : createHash7("sha256").update(original).digest("hex");
     preserved.push(item(synthetic, "preserve", "MALFORMED_MANAGED_BLOCK", current, synthetic.sha256));
     conflicts.push(conflict(synthetic, "MALFORMED_MANAGED_BLOCK", current, synthetic.sha256));
     return;
@@ -3037,7 +3496,7 @@ function stateWithoutInstalledAt(value) {
   return copy;
 }
 async function refreshProject(options) {
-  const root = resolve5(options.projectRoot);
+  const root = resolve7(options.projectRoot);
   const installed = await readInstalledState(root);
   const oldAgents = installed.adapters.length > 0 ? installed.adapters : ["claude-code"];
   const selectedAgents = sortHarnessAgents(options.agents);
@@ -3121,7 +3580,7 @@ async function refreshProject(options) {
   const newStateFiles = installed.files.filter((entry) => entry.owner === "shared" || !selectedSet.has(entry.owner));
   for (const target of newManaged) {
     const incoming = target.sha256;
-    const current = await fileHex2(join6(root, target.target_path));
+    const current = await fileHex2(join8(root, target.target_path));
     if (current === null) {
       applied.push(item(target, "add", "MISSING_TARGET", null, incoming));
       ops.push({ operation: "add", path: target.target_path, content: target.bytes });
@@ -3149,7 +3608,7 @@ async function refreshProject(options) {
     }
   }
   for (const target of oldOnly) {
-    const current = await fileHex2(join6(root, target.target_path));
+    const current = await fileHex2(join8(root, target.target_path));
     if (current === null) {
       continue;
     }
@@ -3192,7 +3651,7 @@ async function refreshProject(options) {
     const verifyEntries = [];
     for (const target of verifyTargets) {
       const rel = target.target_path.replace(/\\/g, "/");
-      const actual = await fileHex2(join6(root, target.target_path));
+      const actual = await fileHex2(join8(root, target.target_path));
       verifyEntries.push({ relpath: rel, sha256: actual ?? "" });
       if (actual === null) {
         verifyMismatches.push({ relpath: rel, expected: target.sha256, actual: "<missing>" });
@@ -3225,19 +3684,19 @@ async function refreshProject(options) {
       owner: "shared",
       target_path: "AGENTS.md",
       block_id: AGENTS_CORE_BLOCK_ID,
-      content_sha256: createHash5("sha256").update(AGENTS_MANAGED_BLOCK_CONTENT).digest("hex")
+      content_sha256: createHash7("sha256").update(AGENTS_MANAGED_BLOCK_CONTENT).digest("hex")
     },
     ...selectedSet.has("claude-code") ? [{
       owner: "claude-code",
       target_path: "CLAUDE.md",
       block_id: CLAUDE_BLOCK_ID,
-      content_sha256: createHash5("sha256").update(CLAUDE_MANAGED_BLOCK_CONTENT).digest("hex")
+      content_sha256: createHash7("sha256").update(CLAUDE_MANAGED_BLOCK_CONTENT).digest("hex")
     }] : [],
     ...selectedSet.has("codebuddy") ? [{
       owner: "codebuddy",
       target_path: "CODEBUDDY.md",
       block_id: CODEBUDDY_BLOCK_ID,
-      content_sha256: createHash5("sha256").update(CODEBUDDY_MANAGED_BLOCK_CONTENT).digest("hex")
+      content_sha256: createHash7("sha256").update(CODEBUDDY_MANAGED_BLOCK_CONTENT).digest("hex")
     }] : []
   ].sort((left, right) => left.target_path.localeCompare(right.target_path) || left.block_id.localeCompare(right.block_id));
   const filesByTarget = new Map(newStateFiles.map((entry) => [entry.target_path, entry]));
@@ -3253,7 +3712,7 @@ async function refreshProject(options) {
     files: [...filesByTarget.values()].sort((left, right) => left.target_path.localeCompare(right.target_path) || left.source_path.localeCompare(right.source_path)),
     managed_blocks: managedBlocks
   };
-  const existingState = await readOptionalText(join6(root, INSTALLED_STATE_PATH));
+  const existingState = await readOptionalText(join8(root, INSTALLED_STATE_PATH));
   let existingParsed = null;
   try {
     existingParsed = existingState === "" ? null : JSON.parse(existingState);
@@ -3268,6 +3727,7 @@ async function refreshProject(options) {
   }
   if (!options.dryRun) {
     await runTransaction(root, ops, { kind: "refresh" });
+    await synchronizeProjectRules(root, agents, codebuddySurface2);
     await pruneEmptyParentDirs(root, removed.map((item2) => item2.target_path), getAdapters(selectedAgents).flatMap((adapter) => adapter.pruneBoundaries({
       profile: profiles.get(adapter.name) ?? profile,
       codebuddySurface: codebuddySurface2
@@ -3307,7 +3767,7 @@ function buildMarkerCoreHash(text) {
   }
 }
 async function collectFreshness(options) {
-  const root = resolve5(options.projectRoot);
+  const root = resolve7(options.projectRoot);
   const installed = await readInstalledState(root);
   const codebuddySurface2 = options.codebuddySurface ?? "both";
   const agents = [];
@@ -3352,18 +3812,18 @@ async function collectFreshness(options) {
     identity.adapterHash = sha256Bytes(canonicalJson(targets.map((target) => ({ path: target.target_path.replace(/\\/g, "/"), sha256: target.sha256 })).sort((a, b) => a.path.localeCompare(b.path))));
     const installedProjection = await Promise.all(targets.map(async (target) => ({
       path: target.target_path.replace(/\\/g, "/"),
-      sha256: await fileHex2(join6(root, target.target_path))
+      sha256: await fileHex2(join8(root, target.target_path))
     })));
     identity.installedAdapterHash = sha256Bytes(canonicalJson(installedProjection.sort((a, b) => a.path.localeCompare(b.path))));
     const markerTarget = targets.find((target) => target.target_path.replace(/\\/g, "/").endsWith(`/${BUILD_MARKER_BUNDLE_PATH}`) || target.target_path === BUILD_MARKER_BUNDLE_PATH);
     if (markerTarget !== void 0) {
-      identity.installedCoreHash = buildMarkerCoreHash(await readOptionalText(join6(root, markerTarget.target_path)));
+      identity.installedCoreHash = buildMarkerCoreHash(await readOptionalText(join8(root, markerTarget.target_path)));
     }
     const mismatchDetails = [];
     const contentEntries = [];
     for (const target of targets) {
       const rel = target.target_path.replace(/\\/g, "/");
-      const actual = await fileHex2(join6(root, target.target_path));
+      const actual = await fileHex2(join8(root, target.target_path));
       contentEntries.push({ relpath: rel, sha256: actual ?? "" });
       if (actual === null) {
         mismatchDetails.push({ relpath: rel, expected: target.sha256, actual: "<missing>" });
@@ -3386,7 +3846,7 @@ async function collectFreshness(options) {
     const drifted = [];
     const missing = [];
     for (const target of targets) {
-      const current = await fileHex2(join6(root, target.target_path));
+      const current = await fileHex2(join8(root, target.target_path));
       if (current === null) {
         missing.push(target.target_path);
       } else if (current !== target.sha256) {
@@ -3634,11 +4094,11 @@ function rawFindings(content) {
       if (rule.id === "HH_PASSWORD_VALUE" && isObviousPlaceholder(value)) {
         continue;
       }
-      const relative3 = match[0].indexOf(value);
+      const relative4 = match[0].indexOf(value);
       findings.push({
         ruleId: rule.id,
         severity: rule.severity,
-        offset: match.index + Math.max(0, relative3),
+        offset: match.index + Math.max(0, relative4),
         value
       });
     }
@@ -3750,8 +4210,8 @@ function generateProposalPreview(input, scanOptions = {}) {
 }
 
 // ../core/dist/push/credentials.js
-import { readFile as readFile6, writeFile as writeFile4 } from "node:fs/promises";
-import { join as join7 } from "node:path";
+import { readFile as readFile8, writeFile as writeFile6 } from "node:fs/promises";
+import { join as join9 } from "node:path";
 import { parse as parseYaml4, stringify as stringifyYaml3 } from "yaml";
 var CREDENTIALS_LOCAL_RELATIVE = ".harness/credentials.local.yaml";
 var CREDENTIALS_GITIGNORE_LINES = [
@@ -3821,7 +4281,7 @@ function mergeLocalCredentials(existing, patch) {
 }
 async function readLocalCredentials(projectRoot) {
   try {
-    const raw = await readFile6(join7(projectRoot, CREDENTIALS_LOCAL_RELATIVE), "utf8");
+    const raw = await readFile8(join9(projectRoot, CREDENTIALS_LOCAL_RELATIVE), "utf8");
     return parseLocalCredentials(parseYaml4(raw));
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -3832,13 +4292,13 @@ async function readLocalCredentials(projectRoot) {
 }
 async function writeLocalCredentials(projectRoot, credentials) {
   const normalized = validateLocalCredentials(credentials);
-  await writeFile4(join7(projectRoot, CREDENTIALS_LOCAL_RELATIVE), stringifyYaml3(normalized, { sortMapEntries: true }) + "\n", "utf8");
+  await writeFile6(join9(projectRoot, CREDENTIALS_LOCAL_RELATIVE), stringifyYaml3(normalized, { sortMapEntries: true }) + "\n", "utf8");
 }
 async function ensureCredentialsGitignore(projectRoot) {
-  const gitignorePath = join7(projectRoot, ".gitignore");
+  const gitignorePath = join9(projectRoot, ".gitignore");
   let content = "";
   try {
-    content = await readFile6(gitignorePath, "utf8");
+    content = await readFile8(gitignorePath, "utf8");
   } catch (error) {
     if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) {
       throw error;
@@ -3861,7 +4321,7 @@ async function ensureCredentialsGitignore(projectRoot) {
     return;
   }
   const suffix = content.length === 0 || content.endsWith("\n") ? "" : "\n";
-  await writeFile4(gitignorePath, content + suffix + missing.join("\n") + "\n", "utf8");
+  await writeFile6(gitignorePath, content + suffix + missing.join("\n") + "\n", "utf8");
 }
 function resolvePushAuth(input) {
   const tokenEnv = input.tokenEnv ?? input.projectTokenEnv;
@@ -3889,28 +4349,28 @@ function resolvePushAuth(input) {
 }
 
 // ../core/dist/push/push.js
-import { lstat as lstat3, readFile as readFile10, readdir as readdir4, rm as rm5 } from "node:fs/promises";
-import { join as join11, relative, resolve as resolve7 } from "node:path";
+import { lstat as lstat3, readFile as readFile12, readdir as readdir6, rm as rm5 } from "node:fs/promises";
+import { join as join13, relative as relative2, resolve as resolve9 } from "node:path";
 import { parse as parseYaml5, stringify as stringifyYaml4 } from "yaml";
 
 // ../core/dist/state/baseline.js
-import { readFile as readFile7 } from "node:fs/promises";
-import { join as join8 } from "node:path";
+import { readFile as readFile9 } from "node:fs/promises";
+import { join as join10 } from "node:path";
 async function readBaseline(projectRoot) {
-  const content = await readFile7(join8(stateLayout(projectRoot).baseline, "manifest.json"), "utf8");
+  const content = await readFile9(join10(stateLayout(projectRoot).baseline, "manifest.json"), "utf8");
   return baselineManifestSchema.parse(JSON.parse(content));
 }
 
 // ../core/dist/state/locks.js
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { readFile as readFile8, rename as rename3, rm as rm3, writeFile as writeFile5 } from "node:fs/promises";
-import { join as join9 } from "node:path";
+import { readFile as readFile10, rename as rename5, rm as rm3, writeFile as writeFile7 } from "node:fs/promises";
+import { join as join11 } from "node:path";
 async function readLock(path) {
-  return JSON.parse(await readFile8(path, "utf8"));
+  return JSON.parse(await readFile10(path, "utf8"));
 }
 async function acquireProtocolLock(projectRoot, operation, options = {}) {
   const layout = await ensureStateLayout(projectRoot);
-  const lockPath = join9(layout.locks, "protocol.lock");
+  const lockPath = join11(layout.locks, "protocol.lock");
   const now = options.now ?? Date.now();
   const staleAfterMs = options.staleAfterMs ?? 15 * 60 * 1e3;
   const record = {
@@ -3923,7 +4383,7 @@ async function acquireProtocolLock(projectRoot, operation, options = {}) {
   };
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      await writeFile5(lockPath, JSON.stringify(record, null, 2), { flag: "wx" });
+      await writeFile7(lockPath, JSON.stringify(record, null, 2), { flag: "wx" });
       return {
         path: lockPath,
         operation,
@@ -3945,15 +4405,15 @@ async function acquireProtocolLock(projectRoot, operation, options = {}) {
       if (now - current.heartbeat_at_ms <= staleAfterMs) {
         throw new Error("protocol lock is active for operation " + current.operation, { cause: error });
       }
-      await rename3(lockPath, lockPath + ".stale-" + randomUUID3());
+      await rename5(lockPath, lockPath + ".stale-" + randomUUID3());
     }
   }
   throw new Error("unable to acquire protocol lock");
 }
 
 // ../core/dist/sync/synchronize.js
-import { lstat as lstat2, readFile as readFile9, rm as rm4 } from "node:fs/promises";
-import { join as join10, resolve as resolve6 } from "node:path";
+import { lstat as lstat2, readFile as readFile11, rm as rm4 } from "node:fs/promises";
+import { join as join12, resolve as resolve8 } from "node:path";
 
 // ../core/dist/update/conflicts.js
 function operationTargetPath(operation) {
@@ -4235,8 +4695,8 @@ async function pathExists(path) {
   }
 }
 async function optionalContent(root, path) {
-  const full = join10(root, path);
-  return await pathExists(full) ? readFile9(full, "utf8") : null;
+  const full = join12(root, path);
+  return await pathExists(full) ? readFile11(full, "utf8") : null;
 }
 function manifestPayloadHash(manifest) {
   const payload = { ...manifest };
@@ -4248,10 +4708,10 @@ async function loadBlob(root, client, artifactId, operation, requestId, dryRun)
     return null;
   }
   const hash = operation.content_sha256;
-  const cacheRoot = join10(root, ".harness", "cache", "server-artifacts", artifactId);
-  const cachePath = join10(cacheRoot, "blobs", hash.replace(":", "_"));
+  const cacheRoot = join12(root, ".harness", "cache", "server-artifacts", artifactId);
+  const cachePath = join12(cacheRoot, "blobs", hash.replace(":", "_"));
   if (await pathExists(cachePath) && await sha256File(cachePath) === hash) {
-    return readFile9(cachePath, "utf8");
+    return readFile11(cachePath, "utf8");
   }
   const bytes = await client.downloadArtifactBlob(artifactId, hash, requestId);
   if (bytes.byteLength !== operation.size_bytes || sha256Bytes(bytes) !== hash) {
@@ -4356,7 +4816,7 @@ async function planSingleArtifact(root, baseline, manifest, client, requestId, d
   });
 }
 async function saveConflictReport(root, requestId, manifest, plan) {
-  const reportPath = join10(root, ".harness", "reports", "conflicts-" + requestId + ".json");
+  const reportPath = join12(root, ".harness", "reports", "conflicts-" + requestId + ".json");
   await atomicWriteJson(reportPath, {
     schema_version: 1,
     request_id: requestId,
@@ -4367,7 +4827,7 @@ async function saveConflictReport(root, requestId, manifest, plan) {
   });
 }
 async function synchronizeArtifacts(options, initialBaseline) {
-  const root = resolve6(options.projectRoot);
+  const root = resolve8(options.projectRoot);
   const projectId = options.project.project.project_id;
   if (projectId === null) {
     throw new Error("PROJECT_NOT_BOUND");
@@ -4474,7 +4934,7 @@ async function synchronizeArtifacts(options, initialBaseline) {
       }
       continue;
     }
-    await atomicWriteJson(join10(root, ".harness", "cache", "server-artifacts", manifest.artifact_id, "manifest.json"), manifest);
+    await atomicWriteJson(join12(root, ".harness", "cache", "server-artifacts", manifest.artifact_id, "manifest.json"), manifest);
     const lock = await acquireProtocolLock(root, "update", { requestId: options.requestId });
     try {
       const nextBaseline = applyBaselineUpdates(baseline, plan);
@@ -4544,7 +5004,7 @@ function baselineEntryFromOperation(manifest, operation, localContent) {
   };
 }
 async function advanceBaselineFromArtifact(options, baseline) {
-  const root = resolve6(options.projectRoot);
+  const root = resolve8(options.projectRoot);
   if (options.manifest.project_version === null) {
     throw new Error("artifact manifest missing project_version");
   }
@@ -4621,7 +5081,8 @@ var PushWorkflowError = class extends Error {
 };
 var SHARED_MANAGED_ROOTS = [
   ".harness/knowledge",
-  ".harness/codebase"
+  ".harness/codebase",
+  ".harness/rules"
 ];
 var SHARED_MANAGED_FILES = [
   "AGENTS.md",
@@ -4644,29 +5105,29 @@ async function walkFiles(root, current, output) {
   if (!await exists3(current)) {
     return;
   }
-  for (const item2 of await readdir4(current, { withFileTypes: true })) {
-    const path = join11(current, item2.name);
+  for (const item2 of await readdir6(current, { withFileTypes: true })) {
+    const path = join13(current, item2.name);
     if (item2.isSymbolicLink()) {
       throw new PushWorkflowError("symlink is not pushable", 6, "UNSAFE_SYMLINK");
     }
     if (item2.isDirectory()) {
       await walkFiles(root, path, output);
     } else if (item2.isFile()) {
-      output.push(normalizeManagedPath(relative(root, path).replaceAll("\\", "/")));
+      output.push(normalizeManagedPath(relative2(root, path).replaceAll("\\", "/")));
     }
   }
 }
 async function walkArchiveSummaries(root, output) {
-  const archiveRoot = join11(root, ".harness", "archive");
+  const archiveRoot = join13(root, ".harness", "archive");
   if (!await exists3(archiveRoot))
     return;
-  for (const item2 of await readdir4(archiveRoot, { withFileTypes: true })) {
+  for (const item2 of await readdir6(archiveRoot, { withFileTypes: true })) {
     if (item2.isSymbolicLink()) {
       throw new PushWorkflowError("symlink is not pushable", 6, "UNSAFE_SYMLINK");
     }
     if (!item2.isDirectory())
       continue;
-    const summaryPath = join11(archiveRoot, item2.name, "reports", "final", "summary-data.json");
+    const summaryPath = join13(archiveRoot, item2.name, "reports", "final", "summary-data.json");
     try {
       const stats = await lstat3(summaryPath);
       if (stats.isSymbolicLink()) {
@@ -4679,7 +5140,7 @@ async function walkArchiveSummaries(root, output) {
         continue;
       throw error;
     }
-    const relativePath = normalizeManagedPath(relative(root, summaryPath).replaceAll("\\", "/"));
+    const relativePath = normalizeManagedPath(relative2(root, summaryPath).replaceAll("\\", "/"));
     if (ARCHIVE_SUMMARY_PATH.test(relativePath)) {
       output.push(relativePath);
     }
@@ -4694,19 +5155,19 @@ function enabledHarnessAgents(project) {
 async function walkHarnessEntries(root, directory, output) {
   if (!await exists3(directory))
     return;
-  for (const item2 of await readdir4(directory, { withFileTypes: true })) {
+  for (const item2 of await readdir6(directory, { withFileTypes: true })) {
     if (item2.name.startsWith("harness-")) {
-      const path = join11(directory, item2.name);
+      const path = join13(directory, item2.name);
       if (item2.isDirectory()) {
         await walkFiles(root, path, output);
       } else if (item2.isFile()) {
-        output.push(normalizeManagedPath(relative(root, path).replaceAll("\\", "/")));
+        output.push(normalizeManagedPath(relative2(root, path).replaceAll("\\", "/")));
       }
     }
   }
 }
 async function managedFiles(projectRoot, project) {
-  const root = resolve7(projectRoot);
+  const root = resolve9(projectRoot);
   const paths = [];
   const adapters = getAdapters(enabledHarnessAgents(project));
   const managedFiles2 = [
@@ -4715,26 +5176,26 @@ async function managedFiles(projectRoot, project) {
     ...adapters.some((adapter) => adapter.name === "codebuddy") ? ["CODEBUDDY.md"] : []
   ];
   for (const path of managedFiles2) {
-    if (await exists3(join11(root, path))) {
+    if (await exists3(join13(root, path))) {
       paths.push(path);
     }
   }
   for (const path of SHARED_MANAGED_ROOTS) {
-    await walkFiles(root, join11(root, path), paths);
+    await walkFiles(root, join13(root, path), paths);
   }
   await walkArchiveSummaries(root, paths);
   for (const adapter of adapters) {
     if (adapter.rulesRoot !== null) {
-      await walkFiles(root, join11(root, adapter.rulesRoot), paths);
+      await walkHarnessEntries(root, join13(root, adapter.rulesRoot), paths);
     }
-    await walkHarnessEntries(root, join11(root, adapter.skillsRoot), paths);
+    await walkHarnessEntries(root, join13(root, adapter.skillsRoot), paths);
     if (adapter.agentsRoot !== null) {
-      await walkHarnessEntries(root, join11(root, adapter.agentsRoot), paths);
+      await walkHarnessEntries(root, join13(root, adapter.agentsRoot), paths);
     }
   }
   const result = {};
   for (const path of [...new Set(paths)].sort()) {
-    result[path] = await readFile10(join11(root, path), "utf8");
+    result[path] = await readFile12(join13(root, path), "utf8");
   }
   return result;
 }
@@ -4743,14 +5204,14 @@ function proposalBaseline(baseline) {
 }
 async function readProject(root) {
   try {
-    return projectConfigSchema.parse(parseYaml5(await readFile10(join11(root, ".harness", "project.yaml"), "utf8")));
+    return projectConfigSchema.parse(parseYaml5(await readFile12(join13(root, ".harness", "project.yaml"), "utf8")));
   } catch {
     throw new PushWorkflowError("project configuration is missing or invalid", 3, "PROJECT_CONFIG_INVALID");
   }
 }
 async function readOptionalJson(path) {
   try {
-    return JSON.parse(await readFile10(path, "utf8"));
+    return JSON.parse(await readFile12(path, "utf8"));
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return null;
@@ -4762,7 +5223,7 @@ async function clientIdFor(root, explicit) {
   if (explicit !== void 0) {
     return explicit;
   }
-  const path = join11(root, ".harness", "state", "local", "client.json");
+  const path = join13(root, ".harness", "state", "local", "client.json");
   const existing = await readOptionalJson(path);
   if (typeof existing?.client_id === "string" && /^cli_[A-Za-z0-9_-]+$/.test(existing.client_id)) {
     return existing.client_id;
@@ -4958,7 +5419,7 @@ async function bindProject(root, project, baseline, projectId) {
   return { project: nextProject, baseline: nextBaseline };
 }
 async function pushProject(options) {
-  const root = resolve7(options.projectRoot);
+  const root = resolve9(options.projectRoot);
   let project = await readProject(root);
   let baseline = await readBaseline(root);
   const profile = parseHarnessProfile(project.project.profiles[0]);
@@ -5024,7 +5485,7 @@ async function pushProject(options) {
   if (options.confirmProposal !== void 0 && !await options.confirmProposal(preview)) {
     return { preview, proposalId: null, projectId: project.project.project_id, cancelled: true };
   }
-  const workflowPath = join11(root, ".harness", "state", "local", "push-workflow.json");
+  const workflowPath = join13(root, ".harness", "state", "local", "push-workflow.json");
   const priorWorkflow = await readOptionalJson(workflowPath);
   const provisionalRequestId = priorWorkflow?.local_project_key === project.project.local_project_key ? priorWorkflow.request_id : uuidV7();
   const lock = await acquireProtocolLock(root, "push", { requestId: provisionalRequestId });
@@ -5179,7 +5640,7 @@ async function pushProject(options) {
         pushWarning = "BASELINE_ADVANCE_DEFERRED";
       }
     }
-    await atomicWriteJson(join11(root, ".harness", "state", "local", "push-results", finalized.proposal_id + ".json"), {
+    await atomicWriteJson(join13(root, ".harness", "state", "local", "push-results", finalized.proposal_id + ".json"), {
       schema_version: 1,
       request_id: requestId,
       project_id: projectId,
@@ -5224,14 +5685,14 @@ async function pushProject(options) {
 }
 
 // ../core/dist/state/cleanup.js
-import { readFile as readFile11, readdir as readdir5, rm as rm6 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { readFile as readFile13, readdir as readdir7, rm as rm6 } from "node:fs/promises";
+import { join as join14 } from "node:path";
 function isSafeEntryName(name) {
   return name.length > 0 && !name.includes("/") && !name.includes("\\") && name !== "." && name !== ".." && !name.includes("\0");
 }
 async function listDir(path) {
   try {
-    return await readdir5(path);
+    return await readdir7(path);
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return [];
@@ -5249,7 +5710,7 @@ async function cleanupProject(options) {
       continue;
     let journal;
     try {
-      journal = JSON.parse(await readFile11(join12(layout.transactions, name, "journal.json"), "utf8"));
+      journal = JSON.parse(await readFile13(join14(layout.transactions, name, "journal.json"), "utf8"));
     } catch {
       continue;
     }
@@ -5267,7 +5728,7 @@ async function cleanupProject(options) {
         continue;
       pruned.push(entry.id);
       if (!options.dryRun) {
-        await rm6(join12(layout.transactions, entry.id), { recursive: true, force: true });
+        await rm6(join14(layout.transactions, entry.id), { recursive: true, force: true });
       }
     }
   }
@@ -5276,7 +5737,7 @@ async function cleanupProject(options) {
       continue;
     removedCache.push(name);
     if (!options.dryRun) {
-      await rm6(join12(layout.serverArtifacts, name), { recursive: true, force: true });
+      await rm6(join14(layout.serverArtifacts, name), { recursive: true, force: true });
     }
   }
   return {
@@ -5336,10 +5797,10 @@ var SKILL_TARGET_AGENTS = Object.freeze([
 ]);
 
 // ../core/dist/transaction/recovery.js
-import { readFile as readFile12, readdir as readdir6, rm as rm7, stat as stat3 } from "node:fs/promises";
-import { join as join13 } from "node:path";
+import { readFile as readFile14, readdir as readdir8, rm as rm7, stat as stat4 } from "node:fs/promises";
+import { join as join15 } from "node:path";
 async function recoverTransaction(projectRoot, transactionId) {
-  const journal = JSON.parse(await readFile12(join13(stateLayout(projectRoot).transactions, transactionId, "journal.json"), "utf8"));
+  const journal = JSON.parse(await readFile14(join15(stateLayout(projectRoot).transactions, transactionId, "journal.json"), "utf8"));
   if (journal.state === "committed") {
     return { transactionId, status: "committed" };
   }
@@ -5356,7 +5817,7 @@ async function listTransactions(projectRoot) {
   const root = stateLayout(projectRoot).transactions;
   let names;
   try {
-    names = await readdir6(root);
+    names = await readdir8(root);
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return [];
@@ -5366,7 +5827,7 @@ async function listTransactions(projectRoot) {
   const transactions = [];
   for (const transactionId of names) {
     try {
-      const journal = JSON.parse(await readFile12(join13(root, transactionId, "journal.json"), "utf8"));
+      const journal = JSON.parse(await readFile14(join15(root, transactionId, "journal.json"), "utf8"));
       transactions.push({
         transactionId,
         kind: journal.kind,
@@ -5383,7 +5844,7 @@ async function pendingTransactions(projectRoot) {
 }
 async function pathExists2(path) {
   try {
-    await stat3(path);
+    await stat4(path);
     return true;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -5397,11 +5858,11 @@ async function rollbackLatestCommittedUpdate(projectRoot) {
   if (latest === void 0) {
     throw new Error("no committed update transaction is available for rollback");
   }
-  const transactionRoot = join13(stateLayout(projectRoot).transactions, latest.transactionId);
-  const journal = JSON.parse(await readFile12(join13(transactionRoot, "journal.json"), "utf8"));
-  const after = JSON.parse(await readFile12(join13(transactionRoot, "after", "manifest.json"), "utf8"));
+  const transactionRoot = join15(stateLayout(projectRoot).transactions, latest.transactionId);
+  const journal = JSON.parse(await readFile14(join15(transactionRoot, "journal.json"), "utf8"));
+  const after = JSON.parse(await readFile14(join15(transactionRoot, "after", "manifest.json"), "utf8"));
   for (const entry of after) {
-    const target = join13(projectRoot, entry.path);
+    const target = join15(projectRoot, entry.path);
     const exists6 = await pathExists2(target);
     if (exists6 !== entry.exists || exists6 && await sha256File(target) !== entry.hash) {
       throw new Error("cannot rollback dirty path: " + entry.path);
@@ -5414,10 +5875,10 @@ async function rollbackLatestCommittedUpdate(projectRoot) {
       continue;
     }
     seen.add(snapshot.path);
-    const target = join13(projectRoot, snapshot.path);
+    const target = join15(projectRoot, snapshot.path);
     const exists6 = await pathExists2(target);
     if (snapshot.existed && snapshot.snapshot_name !== null) {
-      const content = await readFile12(join13(transactionRoot, "before", snapshot.snapshot_name));
+      const content = await readFile14(join15(transactionRoot, "before", snapshot.snapshot_name));
       operations.push({
         operation: exists6 ? "modify" : "add",
         path: snapshot.path,
@@ -5446,7 +5907,7 @@ async function cleanupOldTransactions(projectRoot, now = /* @__PURE__ */ new Dat
     if (!removable) {
       continue;
     }
-    await rm7(join13(stateLayout(projectRoot).transactions, item2.transactionId), {
+    await rm7(join15(stateLayout(projectRoot).transactions, item2.transactionId), {
       recursive: true,
       force: true
     });
@@ -5456,8 +5917,8 @@ async function cleanupOldTransactions(projectRoot, now = /* @__PURE__ */ new Dat
 }
 
 // ../core/dist/update/update.js
-import { readFile as readFile13 } from "node:fs/promises";
-import { join as join14, resolve as resolve8 } from "node:path";
+import { readFile as readFile15 } from "node:fs/promises";
+import { join as join16, resolve as resolve10 } from "node:path";
 import { parse as parseYaml8 } from "yaml";
 var UpdateWorkflowError = class extends Error {
   exitCode;
@@ -5470,10 +5931,10 @@ var UpdateWorkflowError = class extends Error {
   }
 };
 async function updateProject(options) {
-  const root = resolve8(options.projectRoot);
+  const root = resolve10(options.projectRoot);
   let project;
   try {
-    project = projectConfigSchema.parse(parseYaml8(await readFile13(join14(root, ".harness", "project.yaml"), "utf8")));
+    project = projectConfigSchema.parse(parseYaml8(await readFile15(join16(root, ".harness", "project.yaml"), "utf8")));
   } catch {
     throw new UpdateWorkflowError("project configuration is invalid", 3, "PROJECT_CONFIG_INVALID");
   }
@@ -5523,6 +5984,13 @@ async function updateProject(options) {
       ...options.confirmConflictStrategy === void 0 ? {} : { confirmConflictStrategy: options.confirmConflictStrategy },
       ...options.transactionOptions === void 0 ? {} : { transactionOptions: options.transactionOptions }
     }, baseline);
+    if (!options.dryRun) {
+      const agents = project.adapters.enabled.flatMap((agent) => {
+        const parsed = harnessAgentSchema.safeParse(agent);
+        return parsed.success ? [parsed.data] : [];
+      });
+      await synchronizeProjectRules(root, agents, project.adapter_options?.codebuddy?.surface ?? "both");
+    }
     return result;
   } catch (error) {
     if (error instanceof UpdateWorkflowError) {
@@ -5548,8 +6016,8 @@ async function updateProject(options) {
 }
 
 // src/config/init-config.ts
-import { isAbsolute as isAbsolute2, join as join15 } from "node:path";
-import { readFile as readFile14 } from "node:fs/promises";
+import { isAbsolute as isAbsolute2, join as join17 } from "node:path";
+import { readFile as readFile16 } from "node:fs/promises";
 var InitConfigurationError = class extends Error {
   exitCode;
   code;
@@ -5632,9 +6100,9 @@ function hasOwn(record, key) {
 async function resolveInitConfig(cwd, flags, prompts = {}, warnings = []) {
   let fileConfig = {};
   if (flags.config !== void 0) {
-    const path = isAbsolute2(flags.config) ? flags.config : join15(cwd, flags.config);
+    const path = isAbsolute2(flags.config) ? flags.config : join17(cwd, flags.config);
     try {
-      fileConfig = JSON.parse(await readFile14(path, "utf8"));
+      fileConfig = JSON.parse(await readFile16(path, "utf8"));
     } catch (error) {
       throw new InitConfigurationError(
         "unable to read init config: " + (error instanceof Error ? error.message : String(error)),
@@ -5716,8 +6184,8 @@ function serializeCliResult(result) {
 }
 
 // src/config/codebuddy-setup.ts
-import { mkdir as mkdir4, readFile as readFile15, readdir as readdir7, stat as stat4, writeFile as writeFile6 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname4, extname, join as join16 } from "node:path";
+import { mkdir as mkdir6, readFile as readFile17, readdir as readdir9, stat as stat5, writeFile as writeFile8 } from "node:fs/promises";
+import { basename as basename4, dirname as dirname6, extname as extname2, join as join18 } from "node:path";
 var MANAGED_RULE_NAMES = /* @__PURE__ */ new Set([
   "harness-general.md",
   "harness-general.mdc",
@@ -5728,7 +6196,7 @@ var SENSITIVE_ASSIGNMENT = /(?:password|passwd|token|secret|access[_-]?key|priva
 var PRIVATE_KEY_BLOCK = /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/i;
 async function exists4(path) {
   try {
-    await stat4(path);
+    await stat5(path);
     return true;
   } catch {
     return false;
@@ -5736,35 +6204,59 @@ async function exists4(path) {
 }
 async function readJsonObject(path) {
   try {
-    const parsed = JSON.parse(await readFile15(path, "utf8"));
+    const parsed = JSON.parse(await readFile17(path, "utf8"));
     return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") return {};
     return null;
   }
 }
-async function inspectCodeBuddySetup(projectRoot) {
-  const rulesRoot = join16(projectRoot, ".claude", "rules");
-  let claudeRules = [];
+async function inspectCodeBuddySetup(projectRoot, surface = "both") {
+  const rulesRoot = join18(projectRoot, ".claude", "rules");
+  let ruleNames = [];
   try {
-    claudeRules = (await readdir7(rulesRoot, { withFileTypes: true })).filter((entry) => entry.isFile() && [".md", ".mdc"].includes(extname(entry.name).toLowerCase())).map((entry) => entry.name).filter((name) => !MANAGED_RULE_NAMES.has(name)).sort();
+    ruleNames = (await readdir9(rulesRoot, { withFileTypes: true })).filter((entry) => entry.isFile() && [".md", ".mdc"].includes(extname2(entry.name).toLowerCase())).map((entry) => entry.name).filter((name) => !MANAGED_RULE_NAMES.has(name)).sort();
   } catch (error) {
     if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
   }
-  const mcp = await readJsonObject(join16(projectRoot, ".mcp.json"));
+  const claudeRules = [];
+  const currentClaudeRules = [];
+  const conflictingClaudeRules = [];
+  for (const name of ruleNames) {
+    const sourceContent = await readFile17(join18(rulesRoot, name), "utf8");
+    const targetContents = await Promise.all(
+      destinationTargets(projectRoot, surface, name).map(async (target) => {
+        try {
+          return await readFile17(target, "utf8");
+        } catch (error) {
+          if (error instanceof Error && "code" in error && error.code === "ENOENT") return null;
+          throw error;
+        }
+      })
+    );
+    if (targetContents.some((content) => content === null)) claudeRules.push(name);
+    if (targetContents.some((content) => content !== null && content !== sourceContent)) {
+      conflictingClaudeRules.push(name);
+    } else if (targetContents.length > 0 && targetContents.every((content) => content === sourceContent)) {
+      currentClaudeRules.push(name);
+    }
+  }
+  const mcp = await readJsonObject(join18(projectRoot, ".mcp.json"));
   const servers = mcp?.mcpServers;
   const configured = servers !== null && typeof servers === "object" && !Array.isArray(servers) && Object.prototype.hasOwnProperty.call(servers, "codegraph");
   return {
     claudeRules,
-    hasCodeGraphIndex: await exists4(join16(projectRoot, ".codegraph")),
+    currentClaudeRules,
+    conflictingClaudeRules,
+    hasCodeGraphIndex: await exists4(join18(projectRoot, ".codegraph")),
     codeGraphConfigured: configured
   };
 }
 function destinationTargets(root, surface, name) {
-  const stem = basename2(name, extname(name));
+  const stem = basename4(name, extname2(name));
   const targets = [];
-  if (surface !== "cli") targets.push(join16(root, ".codebuddy", ".rules", `${stem}.mdc`));
-  if (surface !== "ide") targets.push(join16(root, ".codebuddy", "rules", `${stem}.md`));
+  if (surface !== "cli") targets.push(join18(root, ".codebuddy", ".rules", `${stem}.mdc`));
+  if (surface !== "ide") targets.push(join18(root, ".codebuddy", "rules", `${stem}.md`));
   return targets;
 }
 async function applyCodeBuddySetup(options) {
@@ -5776,10 +6268,10 @@ async function applyCodeBuddySetup(options) {
     warnings: []
   };
   if (options.syncClaudeRules) {
-    const plan = await inspectCodeBuddySetup(options.projectRoot);
+    const plan = await inspectCodeBuddySetup(options.projectRoot, options.surface);
     for (const name of plan.claudeRules) {
-      const source = join16(options.projectRoot, ".claude", "rules", name);
-      const content = await readFile15(source, "utf8");
+      const source = join18(options.projectRoot, ".claude", "rules", name);
+      const content = await readFile17(source, "utf8");
       if (SENSITIVE_ASSIGNMENT.test(content) || PRIVATE_KEY_BLOCK.test(content)) {
         result.skippedSensitive.push(name);
         continue;
@@ -5789,14 +6281,14 @@ async function applyCodeBuddySetup(options) {
           result.preserved.push(target);
           continue;
         }
-        await mkdir4(dirname4(target), { recursive: true });
-        await writeFile6(target, content, { encoding: "utf8", flag: "wx" });
+        await mkdir6(dirname6(target), { recursive: true });
+        await writeFile8(target, content, { encoding: "utf8", flag: "wx" });
         result.copied.push(target);
       }
     }
   }
   if (options.configureCodeGraph) {
-    const path = join16(options.projectRoot, ".mcp.json");
+    const path = join18(options.projectRoot, ".mcp.json");
     const current = await readJsonObject(path);
     if (current === null) {
       result.warnings.push(".mcp.json \u4E0D\u662F\u6709\u6548 JSON\uFF0C\u5DF2\u4FDD\u7559\u539F\u6587\u4EF6\u5E76\u8DF3\u8FC7 CodeGraph MCP \u914D\u7F6E");
@@ -5811,7 +6303,7 @@ async function applyCodeBuddySetup(options) {
             codegraph: { command: "codegraph", args: ["serve", "--mcp"] }
           }
         };
-        await writeFile6(path, JSON.stringify(next, null, 2) + "\n", "utf8");
+        await writeFile8(path, JSON.stringify(next, null, 2) + "\n", "utf8");
         result.mcpUpdated = true;
       }
     }
@@ -5820,13 +6312,13 @@ async function applyCodeBuddySetup(options) {
 }
 
 // src/commands/refresh.ts
-import { readFile as readFile16 } from "node:fs/promises";
-import { join as join17 } from "node:path";
+import { readFile as readFile18 } from "node:fs/promises";
+import { join as join19 } from "node:path";
 import { parse as parseYaml9 } from "yaml";
 async function detectProject(root) {
   let content;
   try {
-    content = await readFile16(join17(root, ".harness", "project.yaml"), "utf8");
+    content = await readFile18(join19(root, ".harness", "project.yaml"), "utf8");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return { status: "absent" };
@@ -6055,7 +6547,13 @@ function agentMenuLines(installedProfiles) {
 }
 async function configureCodeBuddyExtras(agents, surface, options, dependencies) {
   if (!agents.includes("codebuddy")) return;
-  const plan = await inspectCodeBuddySetup(dependencies.cwd);
+  const plan = await inspectCodeBuddySetup(dependencies.cwd, surface);
+  if (plan.conflictingClaudeRules.length > 0) {
+    dependencies.stderr(
+      `\u4EE5\u4E0B CodeBuddy \u89C4\u5219\u4E0E Claude \u6E90\u89C4\u5219\u5185\u5BB9\u4E0D\u540C\uFF0C\u5DF2\u4FDD\u7559\u76EE\u6807\u6587\u4EF6\uFF1A${plan.conflictingClaudeRules.join(", ")}
+`
+    );
+  }
   let syncClaudeRules = false;
   let configureCodeGraph = false;
   if (plan.claudeRules.length > 0) {
@@ -6652,12 +7150,94 @@ async function runUpdate(options, dependencies) {
   }
 }
 
+// src/commands/rules-sync.ts
+function configuredAgents(config) {
+  const agents = config.adapters.enabled.flatMap((value) => {
+    const parsed = harnessAgentSchema.safeParse(value);
+    return parsed.success ? [parsed.data] : [];
+  });
+  return sortHarnessAgents(agents.length > 0 ? agents : ["claude-code"]);
+}
+function configuredSurface(config, override) {
+  const value = override ?? config.adapter_options?.codebuddy?.surface ?? "both";
+  if (value === "both" || value === "ide" || value === "cli") return value;
+  throw new Error("codebuddy surface \u5FC5\u987B\u4E3A both\u3001ide \u6216 cli");
+}
+async function runRulesSync(options, dependencies) {
+  const detection = await detectProject(dependencies.cwd);
+  if (detection.status === "absent") {
+    dependencies.stderr("\u5C1A\u672A\u521D\u59CB\u5316 Hunter Harness\uFF1B\u8BF7\u5148\u8FD0\u884C `hunter-harness`\u3002\n");
+    return 3;
+  }
+  if (detection.status === "invalid") {
+    dependencies.stderr("PROJECT_CONFIG_INVALID\uFF1A.harness/project.yaml \u65E0\u6548\n");
+    return 3;
+  }
+  try {
+    const agents = options.agents === void 0 ? configuredAgents(detection.config) : parseAgentsInput(options.agents);
+    const projections = await synchronizeProjectRules(
+      dependencies.cwd,
+      agents,
+      configuredSurface(detection.config, options.codebuddySurface)
+    );
+    const learning = options.learn === false ? null : await synchronizeRuleCandidates(dependencies.cwd);
+    const exitCode = projections.conflicts.length > 0 ? 5 : 0;
+    const payload = {
+      schema_version: 1,
+      command: "rules-sync",
+      request_id: uuidV7(),
+      dry_run: false,
+      ok: exitCode === 0,
+      exit_code: exitCode,
+      project_id: detection.config.project.project_id,
+      summary: {
+        migrated: projections.migrated.length,
+        projected: projections.written.length,
+        removed: projections.removed.length,
+        unchanged: projections.unchanged.length,
+        conflicts: projections.conflicts.length,
+        agent_specific: projections.agent_specific.length,
+        rule_candidates: learning?.candidates ?? 0
+      },
+      items: [
+        ...projections.migrated.map((path) => ({ path, status: "migrated" })),
+        ...projections.written.map((path) => ({ path, status: "projected" })),
+        ...projections.agent_specific.map((path) => ({ path, status: "agent-specific" })),
+        ...learning === null ? [] : [{
+          path: learning.path,
+          status: learning.changed ? "updated" : "unchanged",
+          candidates: learning.candidates,
+          scanned: learning.scanned
+        }]
+      ],
+      warnings: [
+        ...projections.conflicts.map((path) => `\u89C4\u5219\u5206\u6B67\u672A\u8986\u76D6\uFF1A${path}`),
+        ...projections.agent_specific.map((path) => `\u4FDD\u7559 Agent \u4E13\u5C5E\u89C4\u5219\uFF1A${path}`)
+      ],
+      errors: []
+    };
+    if (options.json === true) {
+      dependencies.stdout(serializeCliResult(payload));
+    } else {
+      dependencies.stdout(
+        `\u89C4\u5219\u540C\u6B65\uFF1A\u8FC1\u79FB ${payload.summary.migrated}\uFF0C\u6295\u5F71 ${payload.summary.projected}\uFF0C\u51B2\u7A81 ${payload.summary.conflicts}\uFF0C\u5019\u9009 ${payload.summary.rule_candidates}\u3002
+`
+      );
+      for (const warning of payload.warnings) dependencies.stderr(warning + "\n");
+    }
+    return exitCode;
+  } catch (error) {
+    dependencies.stderr((error instanceof Error ? error.message : String(error)) + "\n");
+    return 1;
+  }
+}
+
 // src/commands/recovery.ts
-import { stat as stat5 } from "node:fs/promises";
-import { join as join18 } from "node:path";
+import { stat as stat6 } from "node:fs/promises";
+import { join as join20 } from "node:path";
 async function exists5(path) {
   try {
-    await stat5(path);
+    await stat6(path);
     return true;
   } catch {
     return false;
@@ -6714,7 +7294,7 @@ async function runRecoveryMenuIfApplicable(options, dependencies) {
       return 5;
     }
   }
-  const initialized = await exists5(join18(dependencies.cwd, ".harness", "project.yaml"));
+  const initialized = await exists5(join20(dependencies.cwd, ".harness", "project.yaml"));
   if (!initialized || options.nonInteractive === true || explicitConfigure(options)) {
     return null;
   }
@@ -6757,8 +7337,8 @@ async function runRecoveryMenuIfApplicable(options, dependencies) {
 }
 
 // src/workflow-data/resolve.ts
-import { cp, mkdir as mkdir5, readdir as readdir8, readFile as readFile17, rm as rm8, stat as stat6 } from "node:fs/promises";
-import { dirname as dirname5, join as join19, relative as relative2 } from "node:path";
+import { cp, mkdir as mkdir7, readdir as readdir10, readFile as readFile19, rm as rm8, stat as stat7 } from "node:fs/promises";
+import { dirname as dirname7, join as join21, relative as relative3 } from "node:path";
 import { fileURLToPath } from "node:url";
 var WorkflowDataResolutionError = class extends Error {
   code;
@@ -6772,7 +7352,7 @@ var WorkflowDataResolutionError = class extends Error {
 };
 async function pathExists3(path) {
   try {
-    await stat6(path);
+    await stat7(path);
     return true;
   } catch {
     return false;
@@ -6792,17 +7372,17 @@ function workflowPackageName(family, env) {
   return `${scope}/workflow-${family}`;
 }
 async function listFilesRecursive(root, base = root) {
-  const entries = await readdir8(root, { withFileTypes: true });
+  const entries = await readdir10(root, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const absolute = join19(root, entry.name);
+    const absolute = join21(root, entry.name);
     if (entry.isDirectory()) {
       files.push(...await listFilesRecursive(absolute, base));
       continue;
     }
     if (!entry.isFile()) continue;
-    const rel = relative2(base, absolute).replaceAll("\\", "/");
-    files.push({ path: rel, content: await readFile17(absolute, "utf8") });
+    const rel = relative3(base, absolute).replaceAll("\\", "/");
+    files.push({ path: rel, content: await readFile19(absolute, "utf8") });
   }
   return files;
 }
@@ -6815,7 +7395,7 @@ async function verifyWorkflowPackageIntegrity(resourcesRoot) {
   const manifest = await readWorkflowFamilyManifest(resourcesRoot);
   const expected = manifest.content_sha256;
   if (typeof expected !== "string" || expected.length === 0) return;
-  const harnessRoot = join19(resourcesRoot, "harness");
+  const harnessRoot = join21(resourcesRoot, "harness");
   if (!await pathExists3(harnessRoot)) {
     throw new WorkflowDataResolutionError(
       "\u5DE5\u4F5C\u6D41\u6570\u636E\u5305\u7F3A\u5C11 harness/\uFF0C\u65E0\u6CD5\u6821\u9A8C SHA-256",
@@ -6834,40 +7414,40 @@ async function verifyWorkflowPackageIntegrity(resourcesRoot) {
   }
 }
 async function monorepoResourcesRoot() {
-  const here = dirname5(fileURLToPath(import.meta.url));
+  const here = dirname7(fileURLToPath(import.meta.url));
   const candidates = [
     // TypeScript source: packages/cli/src/workflow-data -> packages/workflow-data-harness.
-    join19(here, "../../../workflow-data-harness"),
+    join21(here, "../../../workflow-data-harness"),
     // Bundled CLI: packages/cli/dist -> packages/workflow-data-harness.
-    join19(here, "../../workflow-data-harness"),
+    join21(here, "../../workflow-data-harness"),
     // Test/build layouts that preserve additional source directory levels.
-    join19(here, "../../../../packages/workflow-data-harness")
+    join21(here, "../../../../packages/workflow-data-harness")
   ];
   for (const candidate of candidates) {
-    if (await pathExists3(join19(candidate, "harness", "manifests"))) return candidate;
+    if (await pathExists3(join21(candidate, "harness", "manifests"))) return candidate;
   }
   return null;
 }
 async function siblingWorkflowPackage(cwd) {
-  const here = dirname5(fileURLToPath(import.meta.url));
+  const here = dirname7(fileURLToPath(import.meta.url));
   const candidates = [
-    join19(cwd, "node_modules", "@hunter-harness", "workflow-harness"),
+    join21(cwd, "node_modules", "@hunter-harness", "workflow-harness"),
     // Published layout: node_modules/hunter-harness/dist/bin.js alongside the
     // scoped workflow package in node_modules/@hunter-harness/workflow-harness.
-    join19(here, "..", "..", "@hunter-harness", "workflow-harness"),
+    join21(here, "..", "..", "@hunter-harness", "workflow-harness"),
     // Monorepo bundled layout: packages/cli/dist/bin.js.
-    join19(here, "..", "..", "workflow-data-harness")
+    join21(here, "..", "..", "workflow-data-harness")
   ];
   for (const candidate of candidates) {
-    if (await pathExists3(join19(candidate, "harness", "manifests"))) return candidate;
+    if (await pathExists3(join21(candidate, "harness", "manifests"))) return candidate;
   }
   return null;
 }
 async function readCachedNpmPackageVersion(cacheRoot) {
-  const manifestPath = join19(cacheRoot, "package.json");
+  const manifestPath = join21(cacheRoot, "package.json");
   if (!await pathExists3(manifestPath)) return null;
   try {
-    const pkg = JSON.parse(await readFile17(manifestPath, "utf8"));
+    const pkg = JSON.parse(await readFile19(manifestPath, "utf8"));
     return typeof pkg.version === "string" && pkg.version.length > 0 ? pkg.version : null;
   } catch {
     return null;
@@ -6889,13 +7469,13 @@ async function latestWorkflowCacheIsStale(cacheRoot, packageName, resolveManifes
   }
 }
 async function materializeWorkflowPackageCache(cacheRoot, packageSpec, extract) {
-  await mkdir5(cacheRoot, { recursive: true });
-  const staging = join19(cacheRoot, ".extract");
+  await mkdir7(cacheRoot, { recursive: true });
+  const staging = join21(cacheRoot, ".extract");
   await rm8(staging, { recursive: true, force: true });
-  await mkdir5(staging, { recursive: true });
+  await mkdir7(staging, { recursive: true });
   await extract(packageSpec, staging);
-  const packageDir = await pathExists3(join19(staging, "harness", "manifests")) ? staging : join19(staging, "package");
-  if (!await pathExists3(join19(packageDir, "harness", "manifests"))) {
+  const packageDir = await pathExists3(join21(staging, "harness", "manifests")) ? staging : join21(staging, "package");
+  if (!await pathExists3(join21(packageDir, "harness", "manifests"))) {
     throw new WorkflowDataResolutionError(
       "\u5DE5\u4F5C\u6D41\u6570\u636E\u5305\u5185\u5BB9\u65E0\u6548\uFF1A\u7F3A\u5C11 harness/manifests",
       "WORKFLOW_DATA_INVALID",
@@ -6924,8 +7504,8 @@ async function resolveWorkflowResourcesRoot(options, argv = []) {
   const packageName = workflowPackageName(family, options.env);
   const packageSpec = version === "latest" ? packageName : `${packageName}@${version}`;
   const cacheKey = packageSpec.replace("/", "+");
-  const cacheRoot = join19(options.cwd, ".harness", "cache", "workflow-packages", cacheKey);
-  if (await pathExists3(join19(cacheRoot, "harness", "manifests"))) {
+  const cacheRoot = join21(options.cwd, ".harness", "cache", "workflow-packages", cacheKey);
+  if (await pathExists3(join21(cacheRoot, "harness", "manifests"))) {
     if (version === "latest") {
       const stale = await latestWorkflowCacheIsStale(cacheRoot, packageName, options.pacoteManifest);
       if (stale) {
@@ -6971,9 +7551,9 @@ function describeWorkflowDataFetchFailure(error, packageSpec) {
   return `\u65E0\u6CD5\u83B7\u53D6\u5DE5\u4F5C\u6D41\u6570\u636E\u5305 ${packageSpec}\uFF1A\u672C\u5730\u7F13\u5B58\u4E0D\u5B58\u5728\u4E14\u83B7\u53D6\u5931\u8D25\u3002\u53EF${hintRoot}\u3002\u539F\u56E0\uFF1A${code !== "" ? code + " " : ""}${detail}`;
 }
 async function readWorkflowFamilyManifest(resourcesRoot) {
-  const manifestPath = join19(resourcesRoot, "hunter-workflow-family.json");
+  const manifestPath = join21(resourcesRoot, "hunter-workflow-family.json");
   if (!await pathExists3(manifestPath)) return {};
-  return JSON.parse(await readFile17(manifestPath, "utf8"));
+  return JSON.parse(await readFile19(manifestPath, "utf8"));
 }
 
 // src/bin.ts
@@ -7087,6 +7667,12 @@ async function runCli(argv, overrides = {}) {
       dependencies
     );
   });
+  program.command("rules-sync").description("\u6536\u655B\u516C\u5171\u89C4\u5219\u3001\u5237\u65B0 Agent \u6295\u5F71\u5E76\u63D0\u70BC\u5386\u53F2\u89C4\u5219\u5019\u9009").option("--agents <csv>").option("--codebuddy-surface <surface>").option("--no-learn", "\u53EA\u540C\u6B65\u89C4\u5219\uFF0C\u4E0D\u8BFB\u53D6\u5386\u53F2 review/test \u8BC1\u636E").option("--json").action(async (options) => {
+    exitCode = await runRulesSync(
+      { ...program.opts(), ...options },
+      dependencies
+    );
+  });
   try {
     await program.parseAsync(["node", "hunter-harness", ...argv]);
     return exitCode;