hunter-harness 0.2.28 → 0.2.30

package/dist/bin.js

@@ -1216,8 +1216,8 @@ async function assertNoSymlinks(root, relativePath) {
   for (const segment of normalized.split("/")) {
     current = join(current, segment);
     try {
-      const stat7 = await lstat(current);
-      if (stat7.isSymbolicLink()) {
+      const stat8 = await lstat(current);
+      if (stat8.isSymbolicLink()) {
         throw new UnsafePathError("symbolic links are not managed");
       }
     } catch (error) {
@@ -1233,7 +1233,7 @@ async function assertNoSymlinks(root, relativePath) {
 async function withRetry(action, options) {
   const attempts = options.attempts ?? 3;
   const sleep = options.sleep ?? (async (milliseconds) => {
-    await new Promise((resolve10) => setTimeout(resolve10, milliseconds));
+    await new Promise((resolve11) => setTimeout(resolve11, milliseconds));
   });
   let lastError;
   for (let attempt = 1; attempt <= attempts; attempt += 1) {
@@ -2263,6 +2263,12 @@ var MANAGED_NAMES = /* @__PURE__ */ new Set([
   "harness-profile-java.md",
   "harness-profile-java.mdc"
 ]);
+var AGENT_RULE_ROOTS = [
+  ".claude/rules",
+  ".cursor/rules",
+  ".codebuddy/.rules",
+  ".codebuddy/rules"
+];
 function sha256(content) {
   return createHash3("sha256").update(content).digest("hex");
 }
@@ -2284,6 +2290,10 @@ async function readReceipt(root) {
   }
   return { schema_version: 1, source_hashes: {}, targets: {} };
 }
+async function readManagedProjectRuleProjectionPaths(projectRoot) {
+  const receipt = await readReceipt(resolve3(projectRoot));
+  return new Set(Object.keys(receipt.targets).filter((target) => AGENT_RULE_ROOTS.some((ruleRoot) => target.startsWith(`${ruleRoot}/`))));
+}
 async function markdownFiles(root) {
   try {
     return (await readdir2(root, { withFileTypes: true })).filter((entry) => entry.isFile() && [".md", ".mdc"].includes(extname(entry.name).toLowerCase())).map((entry) => entry.name).filter((name) => !MANAGED_NAMES.has(name)).sort();
@@ -2293,6 +2303,72 @@ async function markdownFiles(root) {
     throw error;
   }
 }
+function portable(path) {
+  return path.replaceAll("\\", "/");
+}
+function normalizeRuleContent(content) {
+  return content.replace(/\r\n/g, "\n").trimEnd() + "\n";
+}
+function canonicalImportContent(content) {
+  const normalized = content.replace(/\r\n/g, "\n");
+  if (!normalized.startsWith("---\n"))
+    return normalizeRuleContent(normalized);
+  const closing = normalized.indexOf("\n---\n", 4);
+  if (closing < 0)
+    return null;
+  const frontmatter = normalized.slice(4, closing);
+  if (/^\s*(?:globs?|paths?)\s*:/im.test(frontmatter) || /^\s*alwaysApply\s*:\s*false\s*$/im.test(frontmatter)) {
+    return null;
+  }
+  return normalizeRuleContent(normalized.slice(closing + 5));
+}
+async function collectImportCandidates(root, previous, result) {
+  const candidates = [];
+  for (const ruleRoot of AGENT_RULE_ROOTS) {
+    for (const name of await markdownFiles(join4(root, ...ruleRoot.split("/")))) {
+      const source = portable(`${ruleRoot}/${name}`);
+      const content = await readFile3(join4(root, ...source.split("/")), "utf8");
+      if (previous.targets[source] === sha256(content))
+        continue;
+      const canonical = canonicalImportContent(content);
+      if (canonical === null) {
+        result.agent_specific.push(source);
+        continue;
+      }
+      candidates.push({
+        source,
+        destination: `${RULES_ROOT}/${basename(name, extname(name))}.md`,
+        content: canonical
+      });
+    }
+  }
+  return candidates;
+}
+async function importAgentRules(root, canonicalRoot, previous, result) {
+  const grouped = /* @__PURE__ */ new Map();
+  for (const candidate of await collectImportCandidates(root, previous, result)) {
+    const values = grouped.get(candidate.destination) ?? [];
+    values.push(candidate);
+    grouped.set(candidate.destination, values);
+  }
+  for (const [destination, candidates] of [...grouped].sort(([a], [b]) => a.localeCompare(b))) {
+    const destinationPath = join4(canonicalRoot, basename(destination));
+    const current = await optionalText(destinationPath);
+    const distinct = new Set(candidates.map((candidate) => candidate.content));
+    const representative = candidates.at(0);
+    if (representative === void 0)
+      continue;
+    if (current === null && distinct.size === 1) {
+      await atomicWrite(destinationPath, representative.content);
+      result.migrated.push(destination);
+      continue;
+    }
+    if (current !== null && distinct.size === 1 && normalizeRuleContent(current) === representative.content) {
+      continue;
+    }
+    result.conflicts.push(...candidates.map((candidate) => candidate.source));
+  }
+}
 function targetsFor(name, agents, surface) {
   const stem = basename(name, extname(name));
   const targets = [];
@@ -2319,23 +2395,15 @@ async function synchronizeProjectRules(projectRoot, agents, surface = "both") {
   const canonicalRoot = join4(root, RULES_ROOT);
   const result = {
     migrated: [],
+    agent_specific: [],
     written: [],
     removed: [],
     unchanged: [],
     conflicts: []
   };
   await mkdir4(canonicalRoot, { recursive: true });
-  if ((await markdownFiles(canonicalRoot)).length === 0) {
-    for (const name of await markdownFiles(join4(root, ".claude", "rules"))) {
-      const destination = join4(canonicalRoot, `${basename(name, extname(name))}.md`);
-      if (await optionalText(destination) !== null)
-        continue;
-      const content = await readFile3(join4(root, ".claude", "rules", name), "utf8");
-      await atomicWrite(destination, content);
-      result.migrated.push(`${RULES_ROOT}/${basename(destination)}`);
-    }
-  }
   const previous = await readReceipt(root);
+  await importAgentRules(root, canonicalRoot, previous, result);
   const next = { schema_version: 1, source_hashes: {}, targets: {} };
   const desired = /* @__PURE__ */ new Map();
   for (const name of await markdownFiles(canonicalRoot)) {
@@ -2349,9 +2417,10 @@ async function synchronizeProjectRules(projectRoot, agents, surface = "both") {
     const path = join4(root, target);
     const current = await optionalText(path);
     const incomingHash = sha256(content);
-    if (current === content) {
+    const canonicalCurrent = current === null ? null : canonicalImportContent(current);
+    if (current === content || canonicalCurrent === content) {
       result.unchanged.push(target);
-      next.targets[target] = incomingHash;
+      next.targets[target] = current === null ? incomingHash : sha256(current);
     } else if (current === null || previous.targets[target] === sha256(current)) {
       await atomicWrite(path, content);
       result.written.push(target);
@@ -2411,6 +2480,7 @@ async function synchronizeProjectRules(projectRoot, agents, surface = "both") {
   }
   await atomicWrite(join4(root, RECEIPT_PATH), JSON.stringify(next, null, 2) + "\n");
   result.migrated.sort();
+  result.agent_specific.sort();
   result.written.sort();
   result.removed.sort();
   result.unchanged.sort();
@@ -2918,16 +2988,237 @@ async function enrichContextIndexWithVerification(root, agents, profile, resourc
   await writeFile4(contextPath, JSON.stringify(parsed, null, 2) + "\n", "utf8");
 }
 
-// ../core/dist/project/refresh.js
+// ../core/dist/project/rule-candidates.js
 import { createHash as createHash6 } from "node:crypto";
-import { readFile as readFile6, readdir as readdir4, rmdir } from "node:fs/promises";
-import { dirname as dirname4, join as join7, resolve as resolve6 } from "node:path";
+import { mkdir as mkdir5, readFile as readFile6, readdir as readdir4, rename as rename4, stat as stat3, writeFile as writeFile5 } from "node:fs/promises";
+import { basename as basename3, dirname as dirname4, join as join7, relative, resolve as resolve6 } from "node:path";
+var ARCHIVE_ROOT = ".harness/archive";
+var CANDIDATE_PATH = ".harness/knowledge/rule-candidates.json";
+var MAX_EVIDENCE_BYTES = 2 * 1024 * 1024;
+var EVIDENCE_NAMES = [
+  /^review-findings.*\.json$/i,
+  /^test-(?:report|results?|failures?).*\.json$/i,
+  /^summary-data\.json$/i
+];
+function sha2562(content) {
+  return createHash6("sha256").update(content).digest("hex");
+}
+function portable2(path) {
+  return path.replaceAll("\\", "/");
+}
+function normalizeText(value) {
+  return value.replace(/\s+/g, " ").trim();
+}
+function safeText(value, limit = 500) {
+  if (typeof value !== "string")
+    return null;
+  const normalized = normalizeText(value).slice(0, limit);
+  if (normalized.length < 8)
+    return null;
+  if (/(?:ignore|disregard)\s+(?:all\s+)?previous|system\s+prompt|developer\s+message/i.test(normalized)) {
+    return null;
+  }
+  if (/-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|gh[pousr]_[A-Za-z0-9]{20,}|(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?):\/\//i.test(normalized)) {
+    return null;
+  }
+  return normalized;
+}
+function stringField(record, names) {
+  for (const name of names) {
+    const value = safeText(record[name]);
+    if (value !== null)
+      return value;
+  }
+  return null;
+}
+function severityOf(record) {
+  const value = record.severity ?? record.level ?? record.priority ?? "unknown";
+  return typeof value === "string" ? value.toLowerCase() : "unknown";
+}
+function highSeverity(severity) {
+  return /^(?:red|critical|high|error|blocker|p0|p1)$/.test(severity);
+}
+function evidenceKind(path) {
+  const name = basename3(path).toLowerCase();
+  if (name.startsWith("review-"))
+    return "review";
+  if (name.startsWith("test-"))
+    return "test";
+  return "validation";
+}
+function observationFrom(record, path, archive) {
+  const severity = severityOf(record);
+  const suggestion = stringField(record, [
+    "proposed_rule",
+    "proposedRule",
+    "suggestion",
+    "recommendation",
+    "remediation"
+  ]);
+  const issue = stringField(record, ["issue", "message", "error", "failure"]);
+  const title = stringField(record, ["title", "name", "id", "code"]) ?? issue;
+  let proposedRule = suggestion;
+  if (proposedRule === null && issue !== null && highSeverity(severity)) {
+    proposedRule = `\u5FC5\u987B\u589E\u52A0\u53EF\u91CD\u590D\u9A8C\u8BC1\uFF0C\u9632\u6B62\u4EE5\u4E0B\u95EE\u9898\u518D\u6B21\u51FA\u73B0\uFF1A${issue}`;
+  }
+  if (proposedRule === null || title === null)
+    return null;
+  const recordId = record.id ?? record.code ?? record.name ?? null;
+  return {
+    title,
+    proposedRule,
+    severity,
+    evidence: {
+      archive,
+      path,
+      kind: evidenceKind(path),
+      record_id: typeof recordId === "string" ? recordId.slice(0, 120) : null
+    }
+  };
+}
+function collectObservations(value, path, archive, output, rejected) {
+  if (Array.isArray(value)) {
+    for (const item2 of value)
+      collectObservations(item2, path, archive, output, rejected);
+    return;
+  }
+  if (value === null || typeof value !== "object")
+    return;
+  const record = value;
+  const candidate = observationFrom(record, path, archive);
+  if (candidate !== null)
+    output.push(candidate);
+  else if (Object.keys(record).some((key) => ["suggestion", "recommendation", "proposed_rule", "proposedRule"].includes(key)))
+    rejected.count += 1;
+  for (const nested of Object.values(record)) {
+    if (nested !== null && typeof nested === "object") {
+      collectObservations(nested, path, archive, output, rejected);
+    }
+  }
+}
+async function evidenceFiles(root) {
+  const archiveRoot = join7(root, ...ARCHIVE_ROOT.split("/"));
+  const output = [];
+  async function walk(directory) {
+    let entries;
+    try {
+      entries = await readdir4(directory, { withFileTypes: true });
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "ENOENT")
+        return;
+      throw error;
+    }
+    for (const entry of entries) {
+      const path = join7(directory, entry.name);
+      if (entry.isDirectory())
+        await walk(path);
+      else if (entry.isFile() && EVIDENCE_NAMES.some((pattern) => pattern.test(entry.name))) {
+        if ((await stat3(path)).size <= MAX_EVIDENCE_BYTES)
+          output.push(path);
+      }
+    }
+  }
+  await walk(archiveRoot);
+  return output.sort();
+}
+function candidateKey(rule) {
+  return normalizeText(rule).toLocaleLowerCase();
+}
+function buildCandidates(observations) {
+  const grouped = /* @__PURE__ */ new Map();
+  for (const observation of observations) {
+    const key = candidateKey(observation.proposedRule);
+    const values = grouped.get(key) ?? [];
+    values.push(observation);
+    grouped.set(key, values);
+  }
+  const candidates = [];
+  for (const [key, values] of grouped) {
+    const archives = new Set(values.map((value) => value.evidence.archive));
+    const highest = values.find((value) => highSeverity(value.severity));
+    if (archives.size < 2 && highest === void 0)
+      continue;
+    const representative = highest ?? values.at(0);
+    if (representative === void 0)
+      continue;
+    const evidence = [...new Map(values.map((value) => [
+      `${value.evidence.path}\0${value.evidence.record_id ?? ""}`,
+      value.evidence
+    ])).values()].sort((a, b) => a.path.localeCompare(b.path));
+    candidates.push({
+      id: `rule_${sha2562(key).slice(0, 16)}`,
+      status: "candidate",
+      title: representative.title,
+      proposed_rule: representative.proposedRule,
+      confidence: archives.size >= 2 && highest !== void 0 ? "high" : "medium",
+      severity: representative.severity,
+      occurrences: evidence.length,
+      evidence
+    });
+  }
+  return candidates.sort((a, b) => a.id.localeCompare(b.id));
+}
+async function atomicWrite2(path, content) {
+  await mkdir5(dirname4(path), { recursive: true });
+  const temporary = `${path}.${process.pid}.tmp`;
+  await writeFile5(temporary, content, "utf8");
+  await rename4(temporary, path);
+}
+async function synchronizeRuleCandidates(projectRoot, options = {}) {
+  const root = resolve6(projectRoot);
+  const files = await evidenceFiles(root);
+  const sourceHashes = {};
+  const observations = [];
+  const rejected = { count: 0 };
+  for (const path of files) {
+    const relativePath = portable2(relative(root, path));
+    const content2 = await readFile6(path, "utf8");
+    sourceHashes[relativePath] = sha2562(content2);
+    let parsed;
+    try {
+      parsed = JSON.parse(content2);
+    } catch {
+      continue;
+    }
+    const archive = relativePath.split("/")[2] ?? "unknown";
+    collectObservations(parsed, relativePath, archive, observations, rejected);
+  }
+  const manifest = {
+    schema_version: 1,
+    source_hashes: sourceHashes,
+    candidates: buildCandidates(observations)
+  };
+  const content = JSON.stringify(manifest, null, 2) + "\n";
+  const destination = join7(root, ...CANDIDATE_PATH.split("/"));
+  let current = null;
+  try {
+    current = await readFile6(destination, "utf8");
+  } catch (error) {
+    if (!(error instanceof Error && "code" in error && error.code === "ENOENT"))
+      throw error;
+  }
+  const changed = current !== content;
+  if (changed && options.dryRun !== true)
+    await atomicWrite2(destination, content);
+  return {
+    path: CANDIDATE_PATH,
+    scanned: files.length,
+    candidates: manifest.candidates.length,
+    changed,
+    rejected_untrusted: rejected.count
+  };
+}
+
+// ../core/dist/project/refresh.js
+import { createHash as createHash7 } from "node:crypto";
+import { readFile as readFile7, readdir as readdir5, rmdir } from "node:fs/promises";
+import { dirname as dirname5, join as join8, resolve as resolve7 } from "node:path";
 import { parse as parseYaml3, stringify as stringifyYaml2 } from "yaml";
 var INSTALLED_STATE_PATH = ".harness/state/local/installed-harness-bundle.json";
 var CONTEXT_INDEX_PATH2 = ".harness/context-index.json";
 async function fileHex2(path) {
   try {
-    return createHash6("sha256").update(await readFile6(path)).digest("hex");
+    return createHash7("sha256").update(await readFile7(path)).digest("hex");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return null;
@@ -2937,7 +3228,7 @@ async function fileHex2(path) {
 }
 async function readOptionalText(path) {
   try {
-    return await readFile6(path, "utf8");
+    return await readFile7(path, "utf8");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return "";
@@ -2946,7 +3237,7 @@ async function readOptionalText(path) {
   }
 }
 async function readInstalledState(root) {
-  const content = await readOptionalText(join7(root, INSTALLED_STATE_PATH));
+  const content = await readOptionalText(join8(root, INSTALLED_STATE_PATH));
   if (content === "") {
     return {
       profile: null,
@@ -3016,7 +3307,7 @@ async function readInstalledState(root) {
   };
 }
 async function readInstalledAgentConfiguration(projectRoot) {
-  const installed = await readInstalledState(resolve6(projectRoot));
+  const installed = await readInstalledState(resolve7(projectRoot));
   return {
     agents: installed.adapters,
     profiles: Object.fromEntries(installed.adapters.map((agent) => [
@@ -3026,7 +3317,7 @@ async function readInstalledAgentConfiguration(projectRoot) {
   };
 }
 async function readContextIndexBundleHash(root) {
-  const content = await readOptionalText(join7(root, CONTEXT_INDEX_PATH2));
+  const content = await readOptionalText(join8(root, CONTEXT_INDEX_PATH2));
   if (content === "")
     return null;
   try {
@@ -3038,13 +3329,13 @@ async function readContextIndexBundleHash(root) {
   }
 }
 async function pruneEmptyParentDirs(root, deletedPaths, boundaryPaths) {
-  const boundaries = new Set(boundaryPaths.map((path) => join7(root, path)));
+  const boundaries = new Set(boundaryPaths.map((path) => join8(root, path)));
   for (const deleted of deletedPaths) {
-    let dir = dirname4(join7(root, deleted));
+    let dir = dirname5(join8(root, deleted));
     while (dir.startsWith(root) && !boundaries.has(dir)) {
       let entries;
       try {
-        entries = await readdir4(dir);
+        entries = await readdir5(dir);
       } catch {
         break;
       }
@@ -3055,7 +3346,7 @@ async function pruneEmptyParentDirs(root, deletedPaths, boundaryPaths) {
       } catch {
         break;
       }
-      dir = dirname4(dir);
+      dir = dirname5(dir);
     }
   }
 }
@@ -3082,7 +3373,7 @@ function sortByTarget(items) {
   return [...items].sort((left, right) => left.target_path.localeCompare(right.target_path));
 }
 async function reconcileContextIndex(root, agents, profiles, manifests, codebuddySurface2, verifications) {
-  const existing = await readOptionalText(join7(root, CONTEXT_INDEX_PATH2));
+  const existing = await readOptionalText(join8(root, CONTEXT_INDEX_PATH2));
   let codebase = {
     map: ".harness/codebase/map",
     status: "missing"
@@ -3135,7 +3426,7 @@ async function reconcileContextIndex(root, agents, profiles, manifests, codebudd
 }
 async function projectTransitionOperation(root, agents, profiles, codebuddySurface2) {
   const path = ".harness/project.yaml";
-  const content = await readOptionalText(join7(root, path));
+  const content = await readOptionalText(join8(root, path));
   if (content === "")
     return null;
   const project = parseYaml3(content);
@@ -3170,11 +3461,11 @@ function mergeTargets(targets) {
   }).sort((left, right) => left.target_path.localeCompare(right.target_path));
 }
 async function reconcileMarkdownBlock(root, fileName, blockId, content, remove, ops, conflicts, preserved) {
-  const original = await readOptionalText(join7(root, fileName));
+  const original = await readOptionalText(join8(root, fileName));
   const synthetic = {
     source_path: fileName,
     target_path: fileName,
-    sha256: createHash6("sha256").update(content).digest("hex"),
+    sha256: createHash7("sha256").update(content).digest("hex"),
     bytes: new TextEncoder().encode(content)
   };
   let next;
@@ -3189,7 +3480,7 @@ async function reconcileMarkdownBlock(root, fileName, blockId, content, remove,
       next = refreshed.content;
     }
   } catch {
-    const current = original === "" ? null : createHash6("sha256").update(original).digest("hex");
+    const current = original === "" ? null : createHash7("sha256").update(original).digest("hex");
     preserved.push(item(synthetic, "preserve", "MALFORMED_MANAGED_BLOCK", current, synthetic.sha256));
     conflicts.push(conflict(synthetic, "MALFORMED_MANAGED_BLOCK", current, synthetic.sha256));
     return;
@@ -3209,7 +3500,7 @@ function stateWithoutInstalledAt(value) {
   return copy;
 }
 async function refreshProject(options) {
-  const root = resolve6(options.projectRoot);
+  const root = resolve7(options.projectRoot);
   const installed = await readInstalledState(root);
   const oldAgents = installed.adapters.length > 0 ? installed.adapters : ["claude-code"];
   const selectedAgents = sortHarnessAgents(options.agents);
@@ -3293,7 +3584,7 @@ async function refreshProject(options) {
   const newStateFiles = installed.files.filter((entry) => entry.owner === "shared" || !selectedSet.has(entry.owner));
   for (const target of newManaged) {
     const incoming = target.sha256;
-    const current = await fileHex2(join7(root, target.target_path));
+    const current = await fileHex2(join8(root, target.target_path));
     if (current === null) {
       applied.push(item(target, "add", "MISSING_TARGET", null, incoming));
       ops.push({ operation: "add", path: target.target_path, content: target.bytes });
@@ -3321,7 +3612,7 @@ async function refreshProject(options) {
     }
   }
   for (const target of oldOnly) {
-    const current = await fileHex2(join7(root, target.target_path));
+    const current = await fileHex2(join8(root, target.target_path));
     if (current === null) {
       continue;
     }
@@ -3364,7 +3655,7 @@ async function refreshProject(options) {
     const verifyEntries = [];
     for (const target of verifyTargets) {
       const rel = target.target_path.replace(/\\/g, "/");
-      const actual = await fileHex2(join7(root, target.target_path));
+      const actual = await fileHex2(join8(root, target.target_path));
       verifyEntries.push({ relpath: rel, sha256: actual ?? "" });
       if (actual === null) {
         verifyMismatches.push({ relpath: rel, expected: target.sha256, actual: "<missing>" });
@@ -3397,19 +3688,19 @@ async function refreshProject(options) {
       owner: "shared",
       target_path: "AGENTS.md",
       block_id: AGENTS_CORE_BLOCK_ID,
-      content_sha256: createHash6("sha256").update(AGENTS_MANAGED_BLOCK_CONTENT).digest("hex")
+      content_sha256: createHash7("sha256").update(AGENTS_MANAGED_BLOCK_CONTENT).digest("hex")
     },
     ...selectedSet.has("claude-code") ? [{
       owner: "claude-code",
       target_path: "CLAUDE.md",
       block_id: CLAUDE_BLOCK_ID,
-      content_sha256: createHash6("sha256").update(CLAUDE_MANAGED_BLOCK_CONTENT).digest("hex")
+      content_sha256: createHash7("sha256").update(CLAUDE_MANAGED_BLOCK_CONTENT).digest("hex")
     }] : [],
     ...selectedSet.has("codebuddy") ? [{
       owner: "codebuddy",
       target_path: "CODEBUDDY.md",
       block_id: CODEBUDDY_BLOCK_ID,
-      content_sha256: createHash6("sha256").update(CODEBUDDY_MANAGED_BLOCK_CONTENT).digest("hex")
+      content_sha256: createHash7("sha256").update(CODEBUDDY_MANAGED_BLOCK_CONTENT).digest("hex")
     }] : []
   ].sort((left, right) => left.target_path.localeCompare(right.target_path) || left.block_id.localeCompare(right.block_id));
   const filesByTarget = new Map(newStateFiles.map((entry) => [entry.target_path, entry]));
@@ -3425,7 +3716,7 @@ async function refreshProject(options) {
     files: [...filesByTarget.values()].sort((left, right) => left.target_path.localeCompare(right.target_path) || left.source_path.localeCompare(right.source_path)),
     managed_blocks: managedBlocks
   };
-  const existingState = await readOptionalText(join7(root, INSTALLED_STATE_PATH));
+  const existingState = await readOptionalText(join8(root, INSTALLED_STATE_PATH));
   let existingParsed = null;
   try {
     existingParsed = existingState === "" ? null : JSON.parse(existingState);
@@ -3480,7 +3771,7 @@ function buildMarkerCoreHash(text) {
   }
 }
 async function collectFreshness(options) {
-  const root = resolve6(options.projectRoot);
+  const root = resolve7(options.projectRoot);
   const installed = await readInstalledState(root);
   const codebuddySurface2 = options.codebuddySurface ?? "both";
   const agents = [];
@@ -3525,18 +3816,18 @@ async function collectFreshness(options) {
     identity.adapterHash = sha256Bytes(canonicalJson(targets.map((target) => ({ path: target.target_path.replace(/\\/g, "/"), sha256: target.sha256 })).sort((a, b) => a.path.localeCompare(b.path))));
     const installedProjection = await Promise.all(targets.map(async (target) => ({
       path: target.target_path.replace(/\\/g, "/"),
-      sha256: await fileHex2(join7(root, target.target_path))
+      sha256: await fileHex2(join8(root, target.target_path))
     })));
     identity.installedAdapterHash = sha256Bytes(canonicalJson(installedProjection.sort((a, b) => a.path.localeCompare(b.path))));
     const markerTarget = targets.find((target) => target.target_path.replace(/\\/g, "/").endsWith(`/${BUILD_MARKER_BUNDLE_PATH}`) || target.target_path === BUILD_MARKER_BUNDLE_PATH);
     if (markerTarget !== void 0) {
-      identity.installedCoreHash = buildMarkerCoreHash(await readOptionalText(join7(root, markerTarget.target_path)));
+      identity.installedCoreHash = buildMarkerCoreHash(await readOptionalText(join8(root, markerTarget.target_path)));
     }
     const mismatchDetails = [];
     const contentEntries = [];
     for (const target of targets) {
       const rel = target.target_path.replace(/\\/g, "/");
-      const actual = await fileHex2(join7(root, target.target_path));
+      const actual = await fileHex2(join8(root, target.target_path));
       contentEntries.push({ relpath: rel, sha256: actual ?? "" });
       if (actual === null) {
         mismatchDetails.push({ relpath: rel, expected: target.sha256, actual: "<missing>" });
@@ -3559,7 +3850,7 @@ async function collectFreshness(options) {
     const drifted = [];
     const missing = [];
     for (const target of targets) {
-      const current = await fileHex2(join7(root, target.target_path));
+      const current = await fileHex2(join8(root, target.target_path));
       if (current === null) {
         missing.push(target.target_path);
       } else if (current !== target.sha256) {
@@ -3807,11 +4098,11 @@ function rawFindings(content) {
       if (rule.id === "HH_PASSWORD_VALUE" && isObviousPlaceholder(value)) {
         continue;
       }
-      const relative3 = match[0].indexOf(value);
+      const relative4 = match[0].indexOf(value);
       findings.push({
         ruleId: rule.id,
         severity: rule.severity,
-        offset: match.index + Math.max(0, relative3),
+        offset: match.index + Math.max(0, relative4),
         value
       });
     }
@@ -3923,8 +4214,8 @@ function generateProposalPreview(input, scanOptions = {}) {
 }
 
 // ../core/dist/push/credentials.js
-import { readFile as readFile7, writeFile as writeFile5 } from "node:fs/promises";
-import { join as join8 } from "node:path";
+import { readFile as readFile8, writeFile as writeFile6 } from "node:fs/promises";
+import { join as join9 } from "node:path";
 import { parse as parseYaml4, stringify as stringifyYaml3 } from "yaml";
 var CREDENTIALS_LOCAL_RELATIVE = ".harness/credentials.local.yaml";
 var CREDENTIALS_GITIGNORE_LINES = [
@@ -3994,7 +4285,7 @@ function mergeLocalCredentials(existing, patch) {
 }
 async function readLocalCredentials(projectRoot) {
   try {
-    const raw = await readFile7(join8(projectRoot, CREDENTIALS_LOCAL_RELATIVE), "utf8");
+    const raw = await readFile8(join9(projectRoot, CREDENTIALS_LOCAL_RELATIVE), "utf8");
     return parseLocalCredentials(parseYaml4(raw));
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -4005,13 +4296,13 @@ async function readLocalCredentials(projectRoot) {
 }
 async function writeLocalCredentials(projectRoot, credentials) {
   const normalized = validateLocalCredentials(credentials);
-  await writeFile5(join8(projectRoot, CREDENTIALS_LOCAL_RELATIVE), stringifyYaml3(normalized, { sortMapEntries: true }) + "\n", "utf8");
+  await writeFile6(join9(projectRoot, CREDENTIALS_LOCAL_RELATIVE), stringifyYaml3(normalized, { sortMapEntries: true }) + "\n", "utf8");
 }
 async function ensureCredentialsGitignore(projectRoot) {
-  const gitignorePath = join8(projectRoot, ".gitignore");
+  const gitignorePath = join9(projectRoot, ".gitignore");
   let content = "";
   try {
-    content = await readFile7(gitignorePath, "utf8");
+    content = await readFile8(gitignorePath, "utf8");
   } catch (error) {
     if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) {
       throw error;
@@ -4034,7 +4325,7 @@ async function ensureCredentialsGitignore(projectRoot) {
     return;
   }
   const suffix = content.length === 0 || content.endsWith("\n") ? "" : "\n";
-  await writeFile5(gitignorePath, content + suffix + missing.join("\n") + "\n", "utf8");
+  await writeFile6(gitignorePath, content + suffix + missing.join("\n") + "\n", "utf8");
 }
 function resolvePushAuth(input) {
   const tokenEnv = input.tokenEnv ?? input.projectTokenEnv;
@@ -4062,28 +4353,28 @@ function resolvePushAuth(input) {
 }
 
 // ../core/dist/push/push.js
-import { lstat as lstat3, readFile as readFile11, readdir as readdir5, rm as rm5 } from "node:fs/promises";
-import { join as join12, relative, resolve as resolve8 } from "node:path";
+import { lstat as lstat3, readFile as readFile12, readdir as readdir6, rm as rm5 } from "node:fs/promises";
+import { join as join13, relative as relative2, resolve as resolve9 } from "node:path";
 import { parse as parseYaml5, stringify as stringifyYaml4 } from "yaml";
 
 // ../core/dist/state/baseline.js
-import { readFile as readFile8 } from "node:fs/promises";
-import { join as join9 } from "node:path";
+import { readFile as readFile9 } from "node:fs/promises";
+import { join as join10 } from "node:path";
 async function readBaseline(projectRoot) {
-  const content = await readFile8(join9(stateLayout(projectRoot).baseline, "manifest.json"), "utf8");
+  const content = await readFile9(join10(stateLayout(projectRoot).baseline, "manifest.json"), "utf8");
   return baselineManifestSchema.parse(JSON.parse(content));
 }
 
 // ../core/dist/state/locks.js
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { readFile as readFile9, rename as rename4, rm as rm3, writeFile as writeFile6 } from "node:fs/promises";
-import { join as join10 } from "node:path";
+import { readFile as readFile10, rename as rename5, rm as rm3, writeFile as writeFile7 } from "node:fs/promises";
+import { join as join11 } from "node:path";
 async function readLock(path) {
-  return JSON.parse(await readFile9(path, "utf8"));
+  return JSON.parse(await readFile10(path, "utf8"));
 }
 async function acquireProtocolLock(projectRoot, operation, options = {}) {
   const layout = await ensureStateLayout(projectRoot);
-  const lockPath = join10(layout.locks, "protocol.lock");
+  const lockPath = join11(layout.locks, "protocol.lock");
   const now = options.now ?? Date.now();
   const staleAfterMs = options.staleAfterMs ?? 15 * 60 * 1e3;
   const record = {
@@ -4096,7 +4387,7 @@ async function acquireProtocolLock(projectRoot, operation, options = {}) {
   };
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      await writeFile6(lockPath, JSON.stringify(record, null, 2), { flag: "wx" });
+      await writeFile7(lockPath, JSON.stringify(record, null, 2), { flag: "wx" });
       return {
         path: lockPath,
         operation,
@@ -4118,15 +4409,15 @@ async function acquireProtocolLock(projectRoot, operation, options = {}) {
       if (now - current.heartbeat_at_ms <= staleAfterMs) {
         throw new Error("protocol lock is active for operation " + current.operation, { cause: error });
       }
-      await rename4(lockPath, lockPath + ".stale-" + randomUUID3());
+      await rename5(lockPath, lockPath + ".stale-" + randomUUID3());
     }
   }
   throw new Error("unable to acquire protocol lock");
 }
 
 // ../core/dist/sync/synchronize.js
-import { lstat as lstat2, readFile as readFile10, rm as rm4 } from "node:fs/promises";
-import { join as join11, resolve as resolve7 } from "node:path";
+import { lstat as lstat2, readFile as readFile11, rm as rm4 } from "node:fs/promises";
+import { join as join12, resolve as resolve8 } from "node:path";
 
 // ../core/dist/update/conflicts.js
 function operationTargetPath(operation) {
@@ -4304,7 +4595,8 @@ function planArtifactRebase(input) {
       plan.alreadyApplied.push({ path: target, operation });
       continue;
     }
-    const staticDecision = decideUpdate(policy, false);
+    const projectionManaged = input.protocolOnlyPaths?.has(source) === true || input.protocolOnlyPaths?.has(target) === true;
+    const staticDecision = projectionManaged ? { apply: false, reason: "protocol-only" } : decideUpdate(policy, false);
     if (!staticDecision.apply) {
       const acknowledgeReason = staticDecision.reason === "protocol-only" ? "protocol-only" : "policy-never";
       const entry2 = acknowledgedEntry(operation, context, input.projectVersion, acknowledgeReason);
@@ -4408,8 +4700,8 @@ async function pathExists(path) {
   }
 }
 async function optionalContent(root, path) {
-  const full = join11(root, path);
-  return await pathExists(full) ? readFile10(full, "utf8") : null;
+  const full = join12(root, path);
+  return await pathExists(full) ? readFile11(full, "utf8") : null;
 }
 function manifestPayloadHash(manifest) {
   const payload = { ...manifest };
@@ -4421,10 +4713,10 @@ async function loadBlob(root, client, artifactId, operation, requestId, dryRun)
     return null;
   }
   const hash = operation.content_sha256;
-  const cacheRoot = join11(root, ".harness", "cache", "server-artifacts", artifactId);
-  const cachePath = join11(cacheRoot, "blobs", hash.replace(":", "_"));
+  const cacheRoot = join12(root, ".harness", "cache", "server-artifacts", artifactId);
+  const cachePath = join12(cacheRoot, "blobs", hash.replace(":", "_"));
   if (await pathExists(cachePath) && await sha256File(cachePath) === hash) {
-    return readFile10(cachePath, "utf8");
+    return readFile11(cachePath, "utf8");
   }
   const bytes = await client.downloadArtifactBlob(artifactId, hash, requestId);
   if (bytes.byteLength !== operation.size_bytes || sha256Bytes(bytes) !== hash) {
@@ -4515,7 +4807,7 @@ function applyBaselineUpdates(baseline, plan) {
   }
   return next;
 }
-async function planSingleArtifact(root, baseline, manifest, client, requestId, dryRun, conflictStrategy, resolveOverrides) {
+async function planSingleArtifact(root, baseline, manifest, client, requestId, dryRun, conflictStrategy, resolveOverrides, protocolOnlyPaths) {
   if (manifest.project_version === null) {
     throw new Error("artifact manifest missing project_version");
   }
@@ -4525,11 +4817,12 @@ async function planSingleArtifact(root, baseline, manifest, client, requestId, d
     projectVersion: manifest.project_version,
     contexts,
     conflictStrategy,
-    ...resolveOverrides === void 0 ? {} : { resolveOverrides }
+    ...resolveOverrides === void 0 ? {} : { resolveOverrides },
+    ...protocolOnlyPaths === void 0 ? {} : { protocolOnlyPaths }
   });
 }
 async function saveConflictReport(root, requestId, manifest, plan) {
-  const reportPath = join11(root, ".harness", "reports", "conflicts-" + requestId + ".json");
+  const reportPath = join12(root, ".harness", "reports", "conflicts-" + requestId + ".json");
   await atomicWriteJson(reportPath, {
     schema_version: 1,
     request_id: requestId,
@@ -4540,7 +4833,7 @@ async function saveConflictReport(root, requestId, manifest, plan) {
   });
 }
 async function synchronizeArtifacts(options, initialBaseline) {
-  const root = resolve7(options.projectRoot);
+  const root = resolve8(options.projectRoot);
   const projectId = options.project.project.project_id;
   if (projectId === null) {
     throw new Error("PROJECT_NOT_BOUND");
@@ -4589,7 +4882,7 @@ async function synchronizeArtifacts(options, initialBaseline) {
     if (manifest.artifact_id !== discovery.artifact_id || manifest.project_id !== projectId || manifest.project_version === null || manifestPayloadHash(manifest) !== manifest.manifest_sha256) {
       throw new Error("ARTIFACT_HASH_MISMATCH");
     }
-    let plan = await planSingleArtifact(root, baseline, manifest, options.client, options.requestId, options.dryRun, conflictStrategy, options.resolveOverrides);
+    let plan = await planSingleArtifact(root, baseline, manifest, options.client, options.requestId, options.dryRun, conflictStrategy, options.resolveOverrides, options.protocolOnlyPaths);
     if (plan.conflicts.length > 0 && options.confirmConflictStrategy !== void 0) {
       const confirmed = await options.confirmConflictStrategy(plan.conflicts);
       if (confirmed === false) {
@@ -4603,7 +4896,7 @@ async function synchronizeArtifacts(options, initialBaseline) {
         aggregate.artifactId = manifest.artifact_id;
         return aggregate;
       }
-      plan = await planSingleArtifact(root, baseline, manifest, options.client, options.requestId, options.dryRun, confirmed, options.resolveOverrides);
+      plan = await planSingleArtifact(root, baseline, manifest, options.client, options.requestId, options.dryRun, confirmed, options.resolveOverrides, options.protocolOnlyPaths);
     }
     const paths = pathsFromPlan(plan);
     aggregate.applied.push(...paths.applied);
@@ -4647,7 +4940,7 @@ async function synchronizeArtifacts(options, initialBaseline) {
       }
       continue;
     }
-    await atomicWriteJson(join11(root, ".harness", "cache", "server-artifacts", manifest.artifact_id, "manifest.json"), manifest);
+    await atomicWriteJson(join12(root, ".harness", "cache", "server-artifacts", manifest.artifact_id, "manifest.json"), manifest);
     const lock = await acquireProtocolLock(root, "update", { requestId: options.requestId });
     try {
       const nextBaseline = applyBaselineUpdates(baseline, plan);
@@ -4717,7 +5010,7 @@ function baselineEntryFromOperation(manifest, operation, localContent) {
   };
 }
 async function advanceBaselineFromArtifact(options, baseline) {
-  const root = resolve7(options.projectRoot);
+  const root = resolve8(options.projectRoot);
   if (options.manifest.project_version === null) {
     throw new Error("artifact manifest missing project_version");
   }
@@ -4818,29 +5111,29 @@ async function walkFiles(root, current, output) {
   if (!await exists3(current)) {
     return;
   }
-  for (const item2 of await readdir5(current, { withFileTypes: true })) {
-    const path = join12(current, item2.name);
+  for (const item2 of await readdir6(current, { withFileTypes: true })) {
+    const path = join13(current, item2.name);
     if (item2.isSymbolicLink()) {
       throw new PushWorkflowError("symlink is not pushable", 6, "UNSAFE_SYMLINK");
     }
     if (item2.isDirectory()) {
       await walkFiles(root, path, output);
     } else if (item2.isFile()) {
-      output.push(normalizeManagedPath(relative(root, path).replaceAll("\\", "/")));
+      output.push(normalizeManagedPath(relative2(root, path).replaceAll("\\", "/")));
     }
   }
 }
 async function walkArchiveSummaries(root, output) {
-  const archiveRoot = join12(root, ".harness", "archive");
+  const archiveRoot = join13(root, ".harness", "archive");
   if (!await exists3(archiveRoot))
     return;
-  for (const item2 of await readdir5(archiveRoot, { withFileTypes: true })) {
+  for (const item2 of await readdir6(archiveRoot, { withFileTypes: true })) {
     if (item2.isSymbolicLink()) {
       throw new PushWorkflowError("symlink is not pushable", 6, "UNSAFE_SYMLINK");
     }
     if (!item2.isDirectory())
       continue;
-    const summaryPath = join12(archiveRoot, item2.name, "reports", "final", "summary-data.json");
+    const summaryPath = join13(archiveRoot, item2.name, "reports", "final", "summary-data.json");
     try {
       const stats = await lstat3(summaryPath);
       if (stats.isSymbolicLink()) {
@@ -4853,7 +5146,7 @@ async function walkArchiveSummaries(root, output) {
         continue;
       throw error;
     }
-    const relativePath = normalizeManagedPath(relative(root, summaryPath).replaceAll("\\", "/"));
+    const relativePath = normalizeManagedPath(relative2(root, summaryPath).replaceAll("\\", "/"));
     if (ARCHIVE_SUMMARY_PATH.test(relativePath)) {
       output.push(relativePath);
     }
@@ -4868,19 +5161,19 @@ function enabledHarnessAgents(project) {
 async function walkHarnessEntries(root, directory, output) {
   if (!await exists3(directory))
     return;
-  for (const item2 of await readdir5(directory, { withFileTypes: true })) {
+  for (const item2 of await readdir6(directory, { withFileTypes: true })) {
     if (item2.name.startsWith("harness-")) {
-      const path = join12(directory, item2.name);
+      const path = join13(directory, item2.name);
       if (item2.isDirectory()) {
         await walkFiles(root, path, output);
       } else if (item2.isFile()) {
-        output.push(normalizeManagedPath(relative(root, path).replaceAll("\\", "/")));
+        output.push(normalizeManagedPath(relative2(root, path).replaceAll("\\", "/")));
       }
     }
   }
 }
 async function managedFiles(projectRoot, project) {
-  const root = resolve8(projectRoot);
+  const root = resolve9(projectRoot);
   const paths = [];
   const adapters = getAdapters(enabledHarnessAgents(project));
   const managedFiles2 = [
@@ -4889,26 +5182,26 @@ async function managedFiles(projectRoot, project) {
     ...adapters.some((adapter) => adapter.name === "codebuddy") ? ["CODEBUDDY.md"] : []
   ];
   for (const path of managedFiles2) {
-    if (await exists3(join12(root, path))) {
+    if (await exists3(join13(root, path))) {
       paths.push(path);
     }
   }
   for (const path of SHARED_MANAGED_ROOTS) {
-    await walkFiles(root, join12(root, path), paths);
+    await walkFiles(root, join13(root, path), paths);
   }
   await walkArchiveSummaries(root, paths);
   for (const adapter of adapters) {
     if (adapter.rulesRoot !== null) {
-      await walkHarnessEntries(root, join12(root, adapter.rulesRoot), paths);
+      await walkHarnessEntries(root, join13(root, adapter.rulesRoot), paths);
     }
-    await walkHarnessEntries(root, join12(root, adapter.skillsRoot), paths);
+    await walkHarnessEntries(root, join13(root, adapter.skillsRoot), paths);
     if (adapter.agentsRoot !== null) {
-      await walkHarnessEntries(root, join12(root, adapter.agentsRoot), paths);
+      await walkHarnessEntries(root, join13(root, adapter.agentsRoot), paths);
     }
   }
   const result = {};
   for (const path of [...new Set(paths)].sort()) {
-    result[path] = await readFile11(join12(root, path), "utf8");
+    result[path] = await readFile12(join13(root, path), "utf8");
   }
   return result;
 }
@@ -4917,14 +5210,14 @@ function proposalBaseline(baseline) {
 }
 async function readProject(root) {
   try {
-    return projectConfigSchema.parse(parseYaml5(await readFile11(join12(root, ".harness", "project.yaml"), "utf8")));
+    return projectConfigSchema.parse(parseYaml5(await readFile12(join13(root, ".harness", "project.yaml"), "utf8")));
   } catch {
     throw new PushWorkflowError("project configuration is missing or invalid", 3, "PROJECT_CONFIG_INVALID");
   }
 }
 async function readOptionalJson(path) {
   try {
-    return JSON.parse(await readFile11(path, "utf8"));
+    return JSON.parse(await readFile12(path, "utf8"));
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return null;
@@ -4936,7 +5229,7 @@ async function clientIdFor(root, explicit) {
   if (explicit !== void 0) {
     return explicit;
   }
-  const path = join12(root, ".harness", "state", "local", "client.json");
+  const path = join13(root, ".harness", "state", "local", "client.json");
   const existing = await readOptionalJson(path);
   if (typeof existing?.client_id === "string" && /^cli_[A-Za-z0-9_-]+$/.test(existing.client_id)) {
     return existing.client_id;
@@ -5132,7 +5425,7 @@ async function bindProject(root, project, baseline, projectId) {
   return { project: nextProject, baseline: nextBaseline };
 }
 async function pushProject(options) {
-  const root = resolve8(options.projectRoot);
+  const root = resolve9(options.projectRoot);
   let project = await readProject(root);
   let baseline = await readBaseline(root);
   const profile = parseHarnessProfile(project.project.profiles[0]);
@@ -5198,7 +5491,7 @@ async function pushProject(options) {
   if (options.confirmProposal !== void 0 && !await options.confirmProposal(preview)) {
     return { preview, proposalId: null, projectId: project.project.project_id, cancelled: true };
   }
-  const workflowPath = join12(root, ".harness", "state", "local", "push-workflow.json");
+  const workflowPath = join13(root, ".harness", "state", "local", "push-workflow.json");
   const priorWorkflow = await readOptionalJson(workflowPath);
   const provisionalRequestId = priorWorkflow?.local_project_key === project.project.local_project_key ? priorWorkflow.request_id : uuidV7();
   const lock = await acquireProtocolLock(root, "push", { requestId: provisionalRequestId });
@@ -5353,7 +5646,7 @@ async function pushProject(options) {
         pushWarning = "BASELINE_ADVANCE_DEFERRED";
       }
     }
-    await atomicWriteJson(join12(root, ".harness", "state", "local", "push-results", finalized.proposal_id + ".json"), {
+    await atomicWriteJson(join13(root, ".harness", "state", "local", "push-results", finalized.proposal_id + ".json"), {
       schema_version: 1,
       request_id: requestId,
       project_id: projectId,
@@ -5398,14 +5691,14 @@ async function pushProject(options) {
 }
 
 // ../core/dist/state/cleanup.js
-import { readFile as readFile12, readdir as readdir6, rm as rm6 } from "node:fs/promises";
-import { join as join13 } from "node:path";
+import { readFile as readFile13, readdir as readdir7, rm as rm6 } from "node:fs/promises";
+import { join as join14 } from "node:path";
 function isSafeEntryName(name) {
   return name.length > 0 && !name.includes("/") && !name.includes("\\") && name !== "." && name !== ".." && !name.includes("\0");
 }
 async function listDir(path) {
   try {
-    return await readdir6(path);
+    return await readdir7(path);
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return [];
@@ -5423,7 +5716,7 @@ async function cleanupProject(options) {
       continue;
     let journal;
     try {
-      journal = JSON.parse(await readFile12(join13(layout.transactions, name, "journal.json"), "utf8"));
+      journal = JSON.parse(await readFile13(join14(layout.transactions, name, "journal.json"), "utf8"));
     } catch {
       continue;
     }
@@ -5441,7 +5734,7 @@ async function cleanupProject(options) {
         continue;
       pruned.push(entry.id);
       if (!options.dryRun) {
-        await rm6(join13(layout.transactions, entry.id), { recursive: true, force: true });
+        await rm6(join14(layout.transactions, entry.id), { recursive: true, force: true });
       }
     }
   }
@@ -5450,7 +5743,7 @@ async function cleanupProject(options) {
       continue;
     removedCache.push(name);
     if (!options.dryRun) {
-      await rm6(join13(layout.serverArtifacts, name), { recursive: true, force: true });
+      await rm6(join14(layout.serverArtifacts, name), { recursive: true, force: true });
     }
   }
   return {
@@ -5510,10 +5803,10 @@ var SKILL_TARGET_AGENTS = Object.freeze([
 ]);
 
 // ../core/dist/transaction/recovery.js
-import { readFile as readFile13, readdir as readdir7, rm as rm7, stat as stat3 } from "node:fs/promises";
-import { join as join14 } from "node:path";
+import { readFile as readFile14, readdir as readdir8, rm as rm7, stat as stat4 } from "node:fs/promises";
+import { join as join15 } from "node:path";
 async function recoverTransaction(projectRoot, transactionId) {
-  const journal = JSON.parse(await readFile13(join14(stateLayout(projectRoot).transactions, transactionId, "journal.json"), "utf8"));
+  const journal = JSON.parse(await readFile14(join15(stateLayout(projectRoot).transactions, transactionId, "journal.json"), "utf8"));
   if (journal.state === "committed") {
     return { transactionId, status: "committed" };
   }
@@ -5530,7 +5823,7 @@ async function listTransactions(projectRoot) {
   const root = stateLayout(projectRoot).transactions;
   let names;
   try {
-    names = await readdir7(root);
+    names = await readdir8(root);
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return [];
@@ -5540,7 +5833,7 @@ async function listTransactions(projectRoot) {
   const transactions = [];
   for (const transactionId of names) {
     try {
-      const journal = JSON.parse(await readFile13(join14(root, transactionId, "journal.json"), "utf8"));
+      const journal = JSON.parse(await readFile14(join15(root, transactionId, "journal.json"), "utf8"));
       transactions.push({
         transactionId,
         kind: journal.kind,
@@ -5557,7 +5850,7 @@ async function pendingTransactions(projectRoot) {
 }
 async function pathExists2(path) {
   try {
-    await stat3(path);
+    await stat4(path);
     return true;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -5571,11 +5864,11 @@ async function rollbackLatestCommittedUpdate(projectRoot) {
   if (latest === void 0) {
     throw new Error("no committed update transaction is available for rollback");
   }
-  const transactionRoot = join14(stateLayout(projectRoot).transactions, latest.transactionId);
-  const journal = JSON.parse(await readFile13(join14(transactionRoot, "journal.json"), "utf8"));
-  const after = JSON.parse(await readFile13(join14(transactionRoot, "after", "manifest.json"), "utf8"));
+  const transactionRoot = join15(stateLayout(projectRoot).transactions, latest.transactionId);
+  const journal = JSON.parse(await readFile14(join15(transactionRoot, "journal.json"), "utf8"));
+  const after = JSON.parse(await readFile14(join15(transactionRoot, "after", "manifest.json"), "utf8"));
   for (const entry of after) {
-    const target = join14(projectRoot, entry.path);
+    const target = join15(projectRoot, entry.path);
     const exists6 = await pathExists2(target);
     if (exists6 !== entry.exists || exists6 && await sha256File(target) !== entry.hash) {
       throw new Error("cannot rollback dirty path: " + entry.path);
@@ -5588,10 +5881,10 @@ async function rollbackLatestCommittedUpdate(projectRoot) {
       continue;
     }
     seen.add(snapshot.path);
-    const target = join14(projectRoot, snapshot.path);
+    const target = join15(projectRoot, snapshot.path);
     const exists6 = await pathExists2(target);
     if (snapshot.existed && snapshot.snapshot_name !== null) {
-      const content = await readFile13(join14(transactionRoot, "before", snapshot.snapshot_name));
+      const content = await readFile14(join15(transactionRoot, "before", snapshot.snapshot_name));
       operations.push({
         operation: exists6 ? "modify" : "add",
         path: snapshot.path,
@@ -5620,7 +5913,7 @@ async function cleanupOldTransactions(projectRoot, now = /* @__PURE__ */ new Dat
     if (!removable) {
       continue;
     }
-    await rm7(join14(stateLayout(projectRoot).transactions, item2.transactionId), {
+    await rm7(join15(stateLayout(projectRoot).transactions, item2.transactionId), {
       recursive: true,
       force: true
     });
@@ -5630,8 +5923,8 @@ async function cleanupOldTransactions(projectRoot, now = /* @__PURE__ */ new Dat
 }
 
 // ../core/dist/update/update.js
-import { readFile as readFile14 } from "node:fs/promises";
-import { join as join15, resolve as resolve9 } from "node:path";
+import { readFile as readFile15 } from "node:fs/promises";
+import { join as join16, resolve as resolve10 } from "node:path";
 import { parse as parseYaml8 } from "yaml";
 var UpdateWorkflowError = class extends Error {
   exitCode;
@@ -5644,10 +5937,10 @@ var UpdateWorkflowError = class extends Error {
   }
 };
 async function updateProject(options) {
-  const root = resolve9(options.projectRoot);
+  const root = resolve10(options.projectRoot);
   let project;
   try {
-    project = projectConfigSchema.parse(parseYaml8(await readFile14(join15(root, ".harness", "project.yaml"), "utf8")));
+    project = projectConfigSchema.parse(parseYaml8(await readFile15(join16(root, ".harness", "project.yaml"), "utf8")));
   } catch {
     throw new UpdateWorkflowError("project configuration is invalid", 3, "PROJECT_CONFIG_INVALID");
   }
@@ -5671,6 +5964,7 @@ async function updateProject(options) {
   }
   const requestId = uuidV7();
   const baseline = await readBaseline(root);
+  const protocolOnlyPaths = await readManagedProjectRuleProjectionPaths(root);
   let parsedServerUrl;
   try {
     parsedServerUrl = new URL(serverUrl);
@@ -5692,6 +5986,7 @@ async function updateProject(options) {
       client,
       requestId,
       dryRun: options.dryRun,
+      protocolOnlyPaths,
       ...options.conflictStrategy === void 0 ? {} : { conflictStrategy: options.conflictStrategy },
       ...options.resolveOverrides === void 0 ? {} : { resolveOverrides: options.resolveOverrides },
       ...options.confirmConflictStrategy === void 0 ? {} : { confirmConflictStrategy: options.confirmConflictStrategy },
@@ -5702,7 +5997,13 @@ async function updateProject(options) {
         const parsed = harnessAgentSchema.safeParse(agent);
         return parsed.success ? [parsed.data] : [];
       });
-      await synchronizeProjectRules(root, agents, project.adapter_options?.codebuddy?.surface ?? "both");
+      const projections = await synchronizeProjectRules(root, agents, project.adapter_options?.codebuddy?.surface ?? "both");
+      for (const path of projections.conflicts) {
+        result.conflicts.push({ path, operation: "modify", reason: "local-dirty" });
+        if (!result.skipped.some((item2) => item2.path === path)) {
+          result.skipped.push({ path, operation: "modify", reason: "local-dirty" });
+        }
+      }
     }
     return result;
   } catch (error) {
@@ -5729,8 +6030,8 @@ async function updateProject(options) {
 }
 
 // src/config/init-config.ts
-import { isAbsolute as isAbsolute2, join as join16 } from "node:path";
-import { readFile as readFile15 } from "node:fs/promises";
+import { isAbsolute as isAbsolute2, join as join17 } from "node:path";
+import { readFile as readFile16 } from "node:fs/promises";
 var InitConfigurationError = class extends Error {
   exitCode;
   code;
@@ -5813,9 +6114,9 @@ function hasOwn(record, key) {
 async function resolveInitConfig(cwd, flags, prompts = {}, warnings = []) {
   let fileConfig = {};
   if (flags.config !== void 0) {
-    const path = isAbsolute2(flags.config) ? flags.config : join16(cwd, flags.config);
+    const path = isAbsolute2(flags.config) ? flags.config : join17(cwd, flags.config);
     try {
-      fileConfig = JSON.parse(await readFile15(path, "utf8"));
+      fileConfig = JSON.parse(await readFile16(path, "utf8"));
     } catch (error) {
       throw new InitConfigurationError(
         "unable to read init config: " + (error instanceof Error ? error.message : String(error)),
@@ -5897,8 +6198,8 @@ function serializeCliResult(result) {
 }
 
 // src/config/codebuddy-setup.ts
-import { mkdir as mkdir5, readFile as readFile16, readdir as readdir8, stat as stat4, writeFile as writeFile7 } from "node:fs/promises";
-import { basename as basename3, dirname as dirname5, extname as extname2, join as join17 } from "node:path";
+import { mkdir as mkdir6, readFile as readFile17, readdir as readdir9, stat as stat5, writeFile as writeFile8 } from "node:fs/promises";
+import { basename as basename4, dirname as dirname6, extname as extname2, join as join18 } from "node:path";
 var MANAGED_RULE_NAMES = /* @__PURE__ */ new Set([
   "harness-general.md",
   "harness-general.mdc",
@@ -5909,7 +6210,7 @@ var SENSITIVE_ASSIGNMENT = /(?:password|passwd|token|secret|access[_-]?key|priva
 var PRIVATE_KEY_BLOCK = /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/i;
 async function exists4(path) {
   try {
-    await stat4(path);
+    await stat5(path);
     return true;
   } catch {
     return false;
@@ -5917,7 +6218,7 @@ async function exists4(path) {
 }
 async function readJsonObject(path) {
   try {
-    const parsed = JSON.parse(await readFile16(path, "utf8"));
+    const parsed = JSON.parse(await readFile17(path, "utf8"));
     return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") return {};
@@ -5925,10 +6226,10 @@ async function readJsonObject(path) {
   }
 }
 async function inspectCodeBuddySetup(projectRoot, surface = "both") {
-  const rulesRoot = join17(projectRoot, ".claude", "rules");
+  const rulesRoot = join18(projectRoot, ".claude", "rules");
   let ruleNames = [];
   try {
-    ruleNames = (await readdir8(rulesRoot, { withFileTypes: true })).filter((entry) => entry.isFile() && [".md", ".mdc"].includes(extname2(entry.name).toLowerCase())).map((entry) => entry.name).filter((name) => !MANAGED_RULE_NAMES.has(name)).sort();
+    ruleNames = (await readdir9(rulesRoot, { withFileTypes: true })).filter((entry) => entry.isFile() && [".md", ".mdc"].includes(extname2(entry.name).toLowerCase())).map((entry) => entry.name).filter((name) => !MANAGED_RULE_NAMES.has(name)).sort();
   } catch (error) {
     if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
   }
@@ -5936,11 +6237,11 @@ async function inspectCodeBuddySetup(projectRoot, surface = "both") {
   const currentClaudeRules = [];
   const conflictingClaudeRules = [];
   for (const name of ruleNames) {
-    const sourceContent = await readFile16(join17(rulesRoot, name), "utf8");
+    const sourceContent = await readFile17(join18(rulesRoot, name), "utf8");
     const targetContents = await Promise.all(
       destinationTargets(projectRoot, surface, name).map(async (target) => {
         try {
-          return await readFile16(target, "utf8");
+          return await readFile17(target, "utf8");
         } catch (error) {
           if (error instanceof Error && "code" in error && error.code === "ENOENT") return null;
           throw error;
@@ -5954,22 +6255,22 @@ async function inspectCodeBuddySetup(projectRoot, surface = "both") {
       currentClaudeRules.push(name);
     }
   }
-  const mcp = await readJsonObject(join17(projectRoot, ".mcp.json"));
+  const mcp = await readJsonObject(join18(projectRoot, ".mcp.json"));
   const servers = mcp?.mcpServers;
   const configured = servers !== null && typeof servers === "object" && !Array.isArray(servers) && Object.prototype.hasOwnProperty.call(servers, "codegraph");
   return {
     claudeRules,
     currentClaudeRules,
     conflictingClaudeRules,
-    hasCodeGraphIndex: await exists4(join17(projectRoot, ".codegraph")),
+    hasCodeGraphIndex: await exists4(join18(projectRoot, ".codegraph")),
     codeGraphConfigured: configured
   };
 }
 function destinationTargets(root, surface, name) {
-  const stem = basename3(name, extname2(name));
+  const stem = basename4(name, extname2(name));
   const targets = [];
-  if (surface !== "cli") targets.push(join17(root, ".codebuddy", ".rules", `${stem}.mdc`));
-  if (surface !== "ide") targets.push(join17(root, ".codebuddy", "rules", `${stem}.md`));
+  if (surface !== "cli") targets.push(join18(root, ".codebuddy", ".rules", `${stem}.mdc`));
+  if (surface !== "ide") targets.push(join18(root, ".codebuddy", "rules", `${stem}.md`));
   return targets;
 }
 async function applyCodeBuddySetup(options) {
@@ -5983,8 +6284,8 @@ async function applyCodeBuddySetup(options) {
   if (options.syncClaudeRules) {
     const plan = await inspectCodeBuddySetup(options.projectRoot, options.surface);
     for (const name of plan.claudeRules) {
-      const source = join17(options.projectRoot, ".claude", "rules", name);
-      const content = await readFile16(source, "utf8");
+      const source = join18(options.projectRoot, ".claude", "rules", name);
+      const content = await readFile17(source, "utf8");
       if (SENSITIVE_ASSIGNMENT.test(content) || PRIVATE_KEY_BLOCK.test(content)) {
         result.skippedSensitive.push(name);
         continue;
@@ -5994,14 +6295,14 @@ async function applyCodeBuddySetup(options) {
           result.preserved.push(target);
           continue;
         }
-        await mkdir5(dirname5(target), { recursive: true });
-        await writeFile7(target, content, { encoding: "utf8", flag: "wx" });
+        await mkdir6(dirname6(target), { recursive: true });
+        await writeFile8(target, content, { encoding: "utf8", flag: "wx" });
         result.copied.push(target);
       }
     }
   }
   if (options.configureCodeGraph) {
-    const path = join17(options.projectRoot, ".mcp.json");
+    const path = join18(options.projectRoot, ".mcp.json");
     const current = await readJsonObject(path);
     if (current === null) {
       result.warnings.push(".mcp.json \u4E0D\u662F\u6709\u6548 JSON\uFF0C\u5DF2\u4FDD\u7559\u539F\u6587\u4EF6\u5E76\u8DF3\u8FC7 CodeGraph MCP \u914D\u7F6E");
@@ -6016,7 +6317,7 @@ async function applyCodeBuddySetup(options) {
             codegraph: { command: "codegraph", args: ["serve", "--mcp"] }
           }
         };
-        await writeFile7(path, JSON.stringify(next, null, 2) + "\n", "utf8");
+        await writeFile8(path, JSON.stringify(next, null, 2) + "\n", "utf8");
         result.mcpUpdated = true;
       }
     }
@@ -6025,13 +6326,13 @@ async function applyCodeBuddySetup(options) {
 }
 
 // src/commands/refresh.ts
-import { readFile as readFile17 } from "node:fs/promises";
-import { join as join18 } from "node:path";
+import { readFile as readFile18 } from "node:fs/promises";
+import { join as join19 } from "node:path";
 import { parse as parseYaml9 } from "yaml";
 async function detectProject(root) {
   let content;
   try {
-    content = await readFile17(join18(root, ".harness", "project.yaml"), "utf8");
+    content = await readFile18(join19(root, ".harness", "project.yaml"), "utf8");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return { status: "absent" };
@@ -6863,12 +7164,94 @@ async function runUpdate(options, dependencies) {
   }
 }
 
+// src/commands/rules-sync.ts
+function configuredAgents(config) {
+  const agents = config.adapters.enabled.flatMap((value) => {
+    const parsed = harnessAgentSchema.safeParse(value);
+    return parsed.success ? [parsed.data] : [];
+  });
+  return sortHarnessAgents(agents.length > 0 ? agents : ["claude-code"]);
+}
+function configuredSurface(config, override) {
+  const value = override ?? config.adapter_options?.codebuddy?.surface ?? "both";
+  if (value === "both" || value === "ide" || value === "cli") return value;
+  throw new Error("codebuddy surface \u5FC5\u987B\u4E3A both\u3001ide \u6216 cli");
+}
+async function runRulesSync(options, dependencies) {
+  const detection = await detectProject(dependencies.cwd);
+  if (detection.status === "absent") {
+    dependencies.stderr("\u5C1A\u672A\u521D\u59CB\u5316 Hunter Harness\uFF1B\u8BF7\u5148\u8FD0\u884C `hunter-harness`\u3002\n");
+    return 3;
+  }
+  if (detection.status === "invalid") {
+    dependencies.stderr("PROJECT_CONFIG_INVALID\uFF1A.harness/project.yaml \u65E0\u6548\n");
+    return 3;
+  }
+  try {
+    const agents = options.agents === void 0 ? configuredAgents(detection.config) : parseAgentsInput(options.agents);
+    const projections = await synchronizeProjectRules(
+      dependencies.cwd,
+      agents,
+      configuredSurface(detection.config, options.codebuddySurface)
+    );
+    const learning = options.learn === false ? null : await synchronizeRuleCandidates(dependencies.cwd);
+    const exitCode = projections.conflicts.length > 0 ? 5 : 0;
+    const payload = {
+      schema_version: 1,
+      command: "rules-sync",
+      request_id: uuidV7(),
+      dry_run: false,
+      ok: exitCode === 0,
+      exit_code: exitCode,
+      project_id: detection.config.project.project_id,
+      summary: {
+        migrated: projections.migrated.length,
+        projected: projections.written.length,
+        removed: projections.removed.length,
+        unchanged: projections.unchanged.length,
+        conflicts: projections.conflicts.length,
+        agent_specific: projections.agent_specific.length,
+        rule_candidates: learning?.candidates ?? 0
+      },
+      items: [
+        ...projections.migrated.map((path) => ({ path, status: "migrated" })),
+        ...projections.written.map((path) => ({ path, status: "projected" })),
+        ...projections.agent_specific.map((path) => ({ path, status: "agent-specific" })),
+        ...learning === null ? [] : [{
+          path: learning.path,
+          status: learning.changed ? "updated" : "unchanged",
+          candidates: learning.candidates,
+          scanned: learning.scanned
+        }]
+      ],
+      warnings: [
+        ...projections.conflicts.map((path) => `\u89C4\u5219\u5206\u6B67\u672A\u8986\u76D6\uFF1A${path}`),
+        ...projections.agent_specific.map((path) => `\u4FDD\u7559 Agent \u4E13\u5C5E\u89C4\u5219\uFF1A${path}`)
+      ],
+      errors: []
+    };
+    if (options.json === true) {
+      dependencies.stdout(serializeCliResult(payload));
+    } else {
+      dependencies.stdout(
+        `\u89C4\u5219\u540C\u6B65\uFF1A\u8FC1\u79FB ${payload.summary.migrated}\uFF0C\u6295\u5F71 ${payload.summary.projected}\uFF0C\u51B2\u7A81 ${payload.summary.conflicts}\uFF0C\u5019\u9009 ${payload.summary.rule_candidates}\u3002
+`
+      );
+      for (const warning of payload.warnings) dependencies.stderr(warning + "\n");
+    }
+    return exitCode;
+  } catch (error) {
+    dependencies.stderr((error instanceof Error ? error.message : String(error)) + "\n");
+    return 1;
+  }
+}
+
 // src/commands/recovery.ts
-import { stat as stat5 } from "node:fs/promises";
-import { join as join19 } from "node:path";
+import { stat as stat6 } from "node:fs/promises";
+import { join as join20 } from "node:path";
 async function exists5(path) {
   try {
-    await stat5(path);
+    await stat6(path);
     return true;
   } catch {
     return false;
@@ -6925,7 +7308,7 @@ async function runRecoveryMenuIfApplicable(options, dependencies) {
       return 5;
     }
   }
-  const initialized = await exists5(join19(dependencies.cwd, ".harness", "project.yaml"));
+  const initialized = await exists5(join20(dependencies.cwd, ".harness", "project.yaml"));
   if (!initialized || options.nonInteractive === true || explicitConfigure(options)) {
     return null;
   }
@@ -6968,8 +7351,8 @@ async function runRecoveryMenuIfApplicable(options, dependencies) {
 }
 
 // src/workflow-data/resolve.ts
-import { cp, mkdir as mkdir6, readdir as readdir9, readFile as readFile18, rm as rm8, stat as stat6 } from "node:fs/promises";
-import { dirname as dirname6, join as join20, relative as relative2 } from "node:path";
+import { cp, mkdir as mkdir7, readdir as readdir10, readFile as readFile19, rm as rm8, stat as stat7 } from "node:fs/promises";
+import { dirname as dirname7, join as join21, relative as relative3 } from "node:path";
 import { fileURLToPath } from "node:url";
 var WorkflowDataResolutionError = class extends Error {
   code;
@@ -6983,7 +7366,7 @@ var WorkflowDataResolutionError = class extends Error {
 };
 async function pathExists3(path) {
   try {
-    await stat6(path);
+    await stat7(path);
     return true;
   } catch {
     return false;
@@ -7003,17 +7386,17 @@ function workflowPackageName(family, env) {
   return `${scope}/workflow-${family}`;
 }
 async function listFilesRecursive(root, base = root) {
-  const entries = await readdir9(root, { withFileTypes: true });
+  const entries = await readdir10(root, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const absolute = join20(root, entry.name);
+    const absolute = join21(root, entry.name);
     if (entry.isDirectory()) {
       files.push(...await listFilesRecursive(absolute, base));
       continue;
     }
     if (!entry.isFile()) continue;
-    const rel = relative2(base, absolute).replaceAll("\\", "/");
-    files.push({ path: rel, content: await readFile18(absolute, "utf8") });
+    const rel = relative3(base, absolute).replaceAll("\\", "/");
+    files.push({ path: rel, content: await readFile19(absolute, "utf8") });
   }
   return files;
 }
@@ -7026,7 +7409,7 @@ async function verifyWorkflowPackageIntegrity(resourcesRoot) {
   const manifest = await readWorkflowFamilyManifest(resourcesRoot);
   const expected = manifest.content_sha256;
   if (typeof expected !== "string" || expected.length === 0) return;
-  const harnessRoot = join20(resourcesRoot, "harness");
+  const harnessRoot = join21(resourcesRoot, "harness");
   if (!await pathExists3(harnessRoot)) {
     throw new WorkflowDataResolutionError(
       "\u5DE5\u4F5C\u6D41\u6570\u636E\u5305\u7F3A\u5C11 harness/\uFF0C\u65E0\u6CD5\u6821\u9A8C SHA-256",
@@ -7045,40 +7428,40 @@ async function verifyWorkflowPackageIntegrity(resourcesRoot) {
   }
 }
 async function monorepoResourcesRoot() {
-  const here = dirname6(fileURLToPath(import.meta.url));
+  const here = dirname7(fileURLToPath(import.meta.url));
   const candidates = [
     // TypeScript source: packages/cli/src/workflow-data -> packages/workflow-data-harness.
-    join20(here, "../../../workflow-data-harness"),
+    join21(here, "../../../workflow-data-harness"),
     // Bundled CLI: packages/cli/dist -> packages/workflow-data-harness.
-    join20(here, "../../workflow-data-harness"),
+    join21(here, "../../workflow-data-harness"),
     // Test/build layouts that preserve additional source directory levels.
-    join20(here, "../../../../packages/workflow-data-harness")
+    join21(here, "../../../../packages/workflow-data-harness")
   ];
   for (const candidate of candidates) {
-    if (await pathExists3(join20(candidate, "harness", "manifests"))) return candidate;
+    if (await pathExists3(join21(candidate, "harness", "manifests"))) return candidate;
   }
   return null;
 }
 async function siblingWorkflowPackage(cwd) {
-  const here = dirname6(fileURLToPath(import.meta.url));
+  const here = dirname7(fileURLToPath(import.meta.url));
   const candidates = [
-    join20(cwd, "node_modules", "@hunter-harness", "workflow-harness"),
+    join21(cwd, "node_modules", "@hunter-harness", "workflow-harness"),
     // Published layout: node_modules/hunter-harness/dist/bin.js alongside the
     // scoped workflow package in node_modules/@hunter-harness/workflow-harness.
-    join20(here, "..", "..", "@hunter-harness", "workflow-harness"),
+    join21(here, "..", "..", "@hunter-harness", "workflow-harness"),
     // Monorepo bundled layout: packages/cli/dist/bin.js.
-    join20(here, "..", "..", "workflow-data-harness")
+    join21(here, "..", "..", "workflow-data-harness")
   ];
   for (const candidate of candidates) {
-    if (await pathExists3(join20(candidate, "harness", "manifests"))) return candidate;
+    if (await pathExists3(join21(candidate, "harness", "manifests"))) return candidate;
   }
   return null;
 }
 async function readCachedNpmPackageVersion(cacheRoot) {
-  const manifestPath = join20(cacheRoot, "package.json");
+  const manifestPath = join21(cacheRoot, "package.json");
   if (!await pathExists3(manifestPath)) return null;
   try {
-    const pkg = JSON.parse(await readFile18(manifestPath, "utf8"));
+    const pkg = JSON.parse(await readFile19(manifestPath, "utf8"));
     return typeof pkg.version === "string" && pkg.version.length > 0 ? pkg.version : null;
   } catch {
     return null;
@@ -7100,13 +7483,13 @@ async function latestWorkflowCacheIsStale(cacheRoot, packageName, resolveManifes
   }
 }
 async function materializeWorkflowPackageCache(cacheRoot, packageSpec, extract) {
-  await mkdir6(cacheRoot, { recursive: true });
-  const staging = join20(cacheRoot, ".extract");
+  await mkdir7(cacheRoot, { recursive: true });
+  const staging = join21(cacheRoot, ".extract");
   await rm8(staging, { recursive: true, force: true });
-  await mkdir6(staging, { recursive: true });
+  await mkdir7(staging, { recursive: true });
   await extract(packageSpec, staging);
-  const packageDir = await pathExists3(join20(staging, "harness", "manifests")) ? staging : join20(staging, "package");
-  if (!await pathExists3(join20(packageDir, "harness", "manifests"))) {
+  const packageDir = await pathExists3(join21(staging, "harness", "manifests")) ? staging : join21(staging, "package");
+  if (!await pathExists3(join21(packageDir, "harness", "manifests"))) {
     throw new WorkflowDataResolutionError(
       "\u5DE5\u4F5C\u6D41\u6570\u636E\u5305\u5185\u5BB9\u65E0\u6548\uFF1A\u7F3A\u5C11 harness/manifests",
       "WORKFLOW_DATA_INVALID",
@@ -7135,8 +7518,8 @@ async function resolveWorkflowResourcesRoot(options, argv = []) {
   const packageName = workflowPackageName(family, options.env);
   const packageSpec = version === "latest" ? packageName : `${packageName}@${version}`;
   const cacheKey = packageSpec.replace("/", "+");
-  const cacheRoot = join20(options.cwd, ".harness", "cache", "workflow-packages", cacheKey);
-  if (await pathExists3(join20(cacheRoot, "harness", "manifests"))) {
+  const cacheRoot = join21(options.cwd, ".harness", "cache", "workflow-packages", cacheKey);
+  if (await pathExists3(join21(cacheRoot, "harness", "manifests"))) {
     if (version === "latest") {
       const stale = await latestWorkflowCacheIsStale(cacheRoot, packageName, options.pacoteManifest);
       if (stale) {
@@ -7182,9 +7565,9 @@ function describeWorkflowDataFetchFailure(error, packageSpec) {
   return `\u65E0\u6CD5\u83B7\u53D6\u5DE5\u4F5C\u6D41\u6570\u636E\u5305 ${packageSpec}\uFF1A\u672C\u5730\u7F13\u5B58\u4E0D\u5B58\u5728\u4E14\u83B7\u53D6\u5931\u8D25\u3002\u53EF${hintRoot}\u3002\u539F\u56E0\uFF1A${code !== "" ? code + " " : ""}${detail}`;
 }
 async function readWorkflowFamilyManifest(resourcesRoot) {
-  const manifestPath = join20(resourcesRoot, "hunter-workflow-family.json");
+  const manifestPath = join21(resourcesRoot, "hunter-workflow-family.json");
   if (!await pathExists3(manifestPath)) return {};
-  return JSON.parse(await readFile18(manifestPath, "utf8"));
+  return JSON.parse(await readFile19(manifestPath, "utf8"));
 }
 
 // src/bin.ts
@@ -7298,6 +7681,12 @@ async function runCli(argv, overrides = {}) {
       dependencies
     );
   });
+  program.command("rules-sync").description("\u6536\u655B\u516C\u5171\u89C4\u5219\u3001\u5237\u65B0 Agent \u6295\u5F71\u5E76\u63D0\u70BC\u5386\u53F2\u89C4\u5219\u5019\u9009").option("--agents <csv>").option("--codebuddy-surface <surface>").option("--no-learn", "\u53EA\u540C\u6B65\u89C4\u5219\uFF0C\u4E0D\u8BFB\u53D6\u5386\u53F2 review/test \u8BC1\u636E").option("--json").action(async (options) => {
+    exitCode = await runRulesSync(
+      { ...program.opts(), ...options },
+      dependencies
+    );
+  });
   try {
     await program.parseAsync(["node", "hunter-harness", ...argv]);
     return exitCode;