hunter-harness 0.2.29 → 0.2.31

package/dist/bin.js

@@ -1233,7 +1233,7 @@ async function assertNoSymlinks(root, relativePath) {
 async function withRetry(action, options) {
   const attempts = options.attempts ?? 3;
   const sleep = options.sleep ?? (async (milliseconds) => {
-    await new Promise((resolve11) => setTimeout(resolve11, milliseconds));
+    await new Promise((resolve13) => setTimeout(resolve13, milliseconds));
   });
   let lastError;
   for (let attempt = 1; attempt <= attempts; attempt += 1) {
@@ -2290,6 +2290,10 @@ async function readReceipt(root) {
   }
   return { schema_version: 1, source_hashes: {}, targets: {} };
 }
+async function readManagedProjectRuleProjectionPaths(projectRoot) {
+  const receipt = await readReceipt(resolve3(projectRoot));
+  return new Set(Object.keys(receipt.targets).filter((target) => AGENT_RULE_ROOTS.some((ruleRoot) => target.startsWith(`${ruleRoot}/`))));
+}
 async function markdownFiles(root) {
   try {
     return (await readdir2(root, { withFileTypes: true })).filter((entry) => entry.isFile() && [".md", ".mdc"].includes(extname(entry.name).toLowerCase())).map((entry) => entry.name).filter((name) => !MANAGED_NAMES.has(name)).sort();
@@ -2305,18 +2309,39 @@ function portable(path) {
 function normalizeRuleContent(content) {
   return content.replace(/\r\n/g, "\n").trimEnd() + "\n";
 }
-function canonicalImportContent(content) {
+function parseAgentRule(content) {
   const normalized = content.replace(/\r\n/g, "\n");
-  if (!normalized.startsWith("---\n"))
-    return normalizeRuleContent(normalized);
+  if (!normalized.startsWith("---\n")) {
+    return {
+      canonical: normalizeRuleContent(normalized),
+      globalFrontmatterPrefix: null
+    };
+  }
   const closing = normalized.indexOf("\n---\n", 4);
-  if (closing < 0)
-    return null;
+  if (closing < 0) {
+    return { canonical: null, globalFrontmatterPrefix: null };
+  }
   const frontmatter = normalized.slice(4, closing);
   if (/^\s*(?:globs?|paths?)\s*:/im.test(frontmatter) || /^\s*alwaysApply\s*:\s*false\s*$/im.test(frontmatter)) {
-    return null;
+    return { canonical: null, globalFrontmatterPrefix: null };
   }
-  return normalizeRuleContent(normalized.slice(closing + 5));
+  const bodyStart = closing + 5;
+  return {
+    canonical: normalizeRuleContent(normalized.slice(bodyStart).replace(/^\n+/, "")),
+    globalFrontmatterPrefix: normalized.slice(0, bodyStart)
+  };
+}
+function canonicalImportContent(content) {
+  return parseAgentRule(content).canonical;
+}
+function projectionContent(target, current, canonical) {
+  if (current === null || !target.toLowerCase().endsWith(".mdc"))
+    return canonical;
+  const parsed = parseAgentRule(current);
+  if (parsed.globalFrontmatterPrefix === null)
+    return canonical;
+  return `${parsed.globalFrontmatterPrefix}
+${canonical}`;
 }
 async function collectImportCandidates(root, previous, result) {
   const candidates = [];
@@ -2418,9 +2443,10 @@ async function synchronizeProjectRules(projectRoot, agents, surface = "both") {
       result.unchanged.push(target);
       next.targets[target] = current === null ? incomingHash : sha256(current);
     } else if (current === null || previous.targets[target] === sha256(current)) {
-      await atomicWrite(path, content);
+      const projected = projectionContent(target, current, content);
+      await atomicWrite(path, projected);
       result.written.push(target);
-      next.targets[target] = incomingHash;
+      next.targets[target] = sha256(projected);
     } else {
       result.conflicts.push(target);
       next.targets[target] = previous.targets[target] ?? sha256(current);
@@ -3205,16 +3231,157 @@ async function synchronizeRuleCandidates(projectRoot, options = {}) {
   };
 }
 
-// ../core/dist/project/refresh.js
+// ../core/dist/project/rule-review.js
 import { createHash as createHash7 } from "node:crypto";
-import { readFile as readFile7, readdir as readdir5, rmdir } from "node:fs/promises";
-import { dirname as dirname5, join as join8, resolve as resolve7 } from "node:path";
+import { mkdir as mkdir6, readFile as readFile7, rename as rename5, writeFile as writeFile6 } from "node:fs/promises";
+import { basename as basename4, dirname as dirname5, join as join8, relative as relative2, resolve as resolve7 } from "node:path";
+var CANDIDATE_PATH2 = ".harness/knowledge/rule-candidates.json";
+var DECISION_PATH = ".harness/knowledge/rule-decisions.json";
+var RULES_ROOT2 = ".harness/rules";
+function sha2563(content) {
+  return createHash7("sha256").update(content).digest("hex");
+}
+async function readOptional2(path) {
+  try {
+    return await readFile7(path, "utf8");
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT")
+      return null;
+    throw error;
+  }
+}
+async function readJson(path, fallback) {
+  const content = await readOptional2(path);
+  if (content === null)
+    return fallback;
+  return JSON.parse(content);
+}
+async function atomicWrite3(path, content) {
+  await mkdir6(dirname5(path), { recursive: true });
+  const temporary = `${path}.${process.pid}.tmp`;
+  await writeFile6(temporary, content, "utf8");
+  await rename5(temporary, path);
+}
+function candidateRevision(candidate) {
+  return sha2563(JSON.stringify(candidate));
+}
+function portable3(path) {
+  return path.replaceAll("\\", "/");
+}
+function ruleTarget2(root, input) {
+  const portablePath = portable3(input);
+  if (!portablePath.startsWith(`${RULES_ROOT2}/`) || !portablePath.toLowerCase().endsWith(".md") || basename4(portablePath) === "") {
+    throw new Error(`RULE_PATCH_PATH_INVALID: ${input}`);
+  }
+  const target = resolve7(root, ...portablePath.split("/"));
+  const rulesRoot = resolve7(root, ...RULES_ROOT2.split("/"));
+  const relativePath = portable3(relative2(rulesRoot, target));
+  if (relativePath === ".." || relativePath.startsWith("../")) {
+    throw new Error(`RULE_PATCH_PATH_INVALID: ${input}`);
+  }
+  return target;
+}
+function validateDecision(decision, candidates) {
+  const candidate = candidates.get(decision.candidate_id);
+  if (candidate === void 0) {
+    throw new Error(`RULE_CANDIDATE_UNKNOWN: ${decision.candidate_id}`);
+  }
+  if (candidateRevision(candidate) !== decision.candidate_revision) {
+    throw new Error(`RULE_CANDIDATE_STALE: ${decision.candidate_id}`);
+  }
+  if (decision.dispositions.length === 0 || decision.reason.trim().length < 8) {
+    throw new Error(`RULE_DECISION_INVALID: ${decision.candidate_id}`);
+  }
+  if (decision.dispositions.includes("defer") && decision.review_after === void 0) {
+    throw new Error(`RULE_DECISION_REVIEW_AFTER_REQUIRED: ${decision.candidate_id}`);
+  }
+  if (decision.dispositions.includes("public-rule") !== (decision.rule_patch !== void 0)) {
+    throw new Error(`RULE_PATCH_REQUIRED: ${decision.candidate_id}`);
+  }
+  return candidate;
+}
+async function readCandidates(root) {
+  return readJson(join8(root, ...CANDIDATE_PATH2.split("/")), { schema_version: 1, source_hashes: {}, candidates: [] });
+}
+async function readDecisions(root) {
+  return readJson(join8(root, ...DECISION_PATH.split("/")), { schema_version: 1, decisions: [] });
+}
+async function exportRuleReviewQueue(projectRoot) {
+  const root = resolve7(projectRoot);
+  const candidates = await readCandidates(root);
+  const decisions = await readDecisions(root);
+  const decided = new Set(decisions.decisions.map((decision) => `${decision.candidate_id}\0${decision.candidate_revision}`));
+  const pending = candidates.candidates.flatMap((candidate) => {
+    const revision = candidateRevision(candidate);
+    return decided.has(`${candidate.id}\0${revision}`) ? [] : [{
+      candidate_id: candidate.id,
+      candidate_revision: revision,
+      candidate
+    }];
+  });
+  return {
+    schema_version: 1,
+    pending,
+    decided: candidates.candidates.length - pending.length
+  };
+}
+async function applyRuleReviewDecisions(projectRoot, input) {
+  if (input.schema_version !== 1 || !Array.isArray(input.decisions)) {
+    throw new Error("RULE_DECISIONS_INVALID");
+  }
+  const root = resolve7(projectRoot);
+  const candidateManifest = await readCandidates(root);
+  const candidates = new Map(candidateManifest.candidates.map((candidate) => [
+    candidate.id,
+    candidate
+  ]));
+  const plannedPatches = [];
+  for (const decision of input.decisions) {
+    validateDecision(decision, candidates);
+    if (decision.rule_patch === void 0)
+      continue;
+    const target = ruleTarget2(root, decision.rule_patch.target_path);
+    const current = await readOptional2(target);
+    const currentHash = current === null ? null : sha2563(current);
+    if (currentHash !== decision.rule_patch.expected_sha256) {
+      throw new Error(`RULE_PATCH_STALE: ${decision.rule_patch.target_path}`);
+    }
+    plannedPatches.push({ path: target, content: decision.rule_patch.content });
+  }
+  const currentManifest = await readDecisions(root);
+  const replacements = new Map(input.decisions.map((decision) => [
+    `${decision.candidate_id}\0${decision.candidate_revision}`,
+    decision
+  ]));
+  for (const decision of currentManifest.decisions) {
+    const key = `${decision.candidate_id}\0${decision.candidate_revision}`;
+    if (!replacements.has(key))
+      replacements.set(key, decision);
+  }
+  const next = {
+    schema_version: 1,
+    decisions: [...replacements.values()].sort((left, right) => left.candidate_id.localeCompare(right.candidate_id) || left.candidate_revision.localeCompare(right.candidate_revision))
+  };
+  for (const patch of plannedPatches)
+    await atomicWrite3(patch.path, patch.content);
+  await atomicWrite3(join8(root, ...DECISION_PATH.split("/")), JSON.stringify(next, null, 2) + "\n");
+  return {
+    applied: plannedPatches.length,
+    recorded: input.decisions.length,
+    path: DECISION_PATH
+  };
+}
+
+// ../core/dist/project/refresh.js
+import { createHash as createHash8 } from "node:crypto";
+import { readFile as readFile8, readdir as readdir5, rmdir } from "node:fs/promises";
+import { dirname as dirname6, join as join9, resolve as resolve8 } from "node:path";
 import { parse as parseYaml3, stringify as stringifyYaml2 } from "yaml";
 var INSTALLED_STATE_PATH = ".harness/state/local/installed-harness-bundle.json";
 var CONTEXT_INDEX_PATH2 = ".harness/context-index.json";
 async function fileHex2(path) {
   try {
-    return createHash7("sha256").update(await readFile7(path)).digest("hex");
+    return createHash8("sha256").update(await readFile8(path)).digest("hex");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return null;
@@ -3224,7 +3391,7 @@ async function fileHex2(path) {
 }
 async function readOptionalText(path) {
   try {
-    return await readFile7(path, "utf8");
+    return await readFile8(path, "utf8");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return "";
@@ -3233,7 +3400,7 @@ async function readOptionalText(path) {
   }
 }
 async function readInstalledState(root) {
-  const content = await readOptionalText(join8(root, INSTALLED_STATE_PATH));
+  const content = await readOptionalText(join9(root, INSTALLED_STATE_PATH));
   if (content === "") {
     return {
       profile: null,
@@ -3303,7 +3470,7 @@ async function readInstalledState(root) {
   };
 }
 async function readInstalledAgentConfiguration(projectRoot) {
-  const installed = await readInstalledState(resolve7(projectRoot));
+  const installed = await readInstalledState(resolve8(projectRoot));
   return {
     agents: installed.adapters,
     profiles: Object.fromEntries(installed.adapters.map((agent) => [
@@ -3313,7 +3480,7 @@ async function readInstalledAgentConfiguration(projectRoot) {
   };
 }
 async function readContextIndexBundleHash(root) {
-  const content = await readOptionalText(join8(root, CONTEXT_INDEX_PATH2));
+  const content = await readOptionalText(join9(root, CONTEXT_INDEX_PATH2));
   if (content === "")
     return null;
   try {
@@ -3325,9 +3492,9 @@ async function readContextIndexBundleHash(root) {
   }
 }
 async function pruneEmptyParentDirs(root, deletedPaths, boundaryPaths) {
-  const boundaries = new Set(boundaryPaths.map((path) => join8(root, path)));
+  const boundaries = new Set(boundaryPaths.map((path) => join9(root, path)));
   for (const deleted of deletedPaths) {
-    let dir = dirname5(join8(root, deleted));
+    let dir = dirname6(join9(root, deleted));
     while (dir.startsWith(root) && !boundaries.has(dir)) {
       let entries;
       try {
@@ -3342,7 +3509,7 @@ async function pruneEmptyParentDirs(root, deletedPaths, boundaryPaths) {
       } catch {
         break;
       }
-      dir = dirname5(dir);
+      dir = dirname6(dir);
     }
   }
 }
@@ -3369,7 +3536,7 @@ function sortByTarget(items) {
   return [...items].sort((left, right) => left.target_path.localeCompare(right.target_path));
 }
 async function reconcileContextIndex(root, agents, profiles, manifests, codebuddySurface2, verifications) {
-  const existing = await readOptionalText(join8(root, CONTEXT_INDEX_PATH2));
+  const existing = await readOptionalText(join9(root, CONTEXT_INDEX_PATH2));
   let codebase = {
     map: ".harness/codebase/map",
     status: "missing"
@@ -3422,7 +3589,7 @@ async function reconcileContextIndex(root, agents, profiles, manifests, codebudd
 }
 async function projectTransitionOperation(root, agents, profiles, codebuddySurface2) {
   const path = ".harness/project.yaml";
-  const content = await readOptionalText(join8(root, path));
+  const content = await readOptionalText(join9(root, path));
   if (content === "")
     return null;
   const project = parseYaml3(content);
@@ -3457,11 +3624,11 @@ function mergeTargets(targets) {
   }).sort((left, right) => left.target_path.localeCompare(right.target_path));
 }
 async function reconcileMarkdownBlock(root, fileName, blockId, content, remove, ops, conflicts, preserved) {
-  const original = await readOptionalText(join8(root, fileName));
+  const original = await readOptionalText(join9(root, fileName));
   const synthetic = {
     source_path: fileName,
     target_path: fileName,
-    sha256: createHash7("sha256").update(content).digest("hex"),
+    sha256: createHash8("sha256").update(content).digest("hex"),
     bytes: new TextEncoder().encode(content)
   };
   let next;
@@ -3476,7 +3643,7 @@ async function reconcileMarkdownBlock(root, fileName, blockId, content, remove,
       next = refreshed.content;
     }
   } catch {
-    const current = original === "" ? null : createHash7("sha256").update(original).digest("hex");
+    const current = original === "" ? null : createHash8("sha256").update(original).digest("hex");
     preserved.push(item(synthetic, "preserve", "MALFORMED_MANAGED_BLOCK", current, synthetic.sha256));
     conflicts.push(conflict(synthetic, "MALFORMED_MANAGED_BLOCK", current, synthetic.sha256));
     return;
@@ -3496,7 +3663,7 @@ function stateWithoutInstalledAt(value) {
   return copy;
 }
 async function refreshProject(options) {
-  const root = resolve7(options.projectRoot);
+  const root = resolve8(options.projectRoot);
   const installed = await readInstalledState(root);
   const oldAgents = installed.adapters.length > 0 ? installed.adapters : ["claude-code"];
   const selectedAgents = sortHarnessAgents(options.agents);
@@ -3580,7 +3747,7 @@ async function refreshProject(options) {
   const newStateFiles = installed.files.filter((entry) => entry.owner === "shared" || !selectedSet.has(entry.owner));
   for (const target of newManaged) {
     const incoming = target.sha256;
-    const current = await fileHex2(join8(root, target.target_path));
+    const current = await fileHex2(join9(root, target.target_path));
     if (current === null) {
       applied.push(item(target, "add", "MISSING_TARGET", null, incoming));
       ops.push({ operation: "add", path: target.target_path, content: target.bytes });
@@ -3608,7 +3775,7 @@ async function refreshProject(options) {
     }
   }
   for (const target of oldOnly) {
-    const current = await fileHex2(join8(root, target.target_path));
+    const current = await fileHex2(join9(root, target.target_path));
     if (current === null) {
       continue;
     }
@@ -3651,7 +3818,7 @@ async function refreshProject(options) {
     const verifyEntries = [];
     for (const target of verifyTargets) {
       const rel = target.target_path.replace(/\\/g, "/");
-      const actual = await fileHex2(join8(root, target.target_path));
+      const actual = await fileHex2(join9(root, target.target_path));
       verifyEntries.push({ relpath: rel, sha256: actual ?? "" });
       if (actual === null) {
         verifyMismatches.push({ relpath: rel, expected: target.sha256, actual: "<missing>" });
@@ -3684,19 +3851,19 @@ async function refreshProject(options) {
       owner: "shared",
       target_path: "AGENTS.md",
       block_id: AGENTS_CORE_BLOCK_ID,
-      content_sha256: createHash7("sha256").update(AGENTS_MANAGED_BLOCK_CONTENT).digest("hex")
+      content_sha256: createHash8("sha256").update(AGENTS_MANAGED_BLOCK_CONTENT).digest("hex")
     },
     ...selectedSet.has("claude-code") ? [{
       owner: "claude-code",
       target_path: "CLAUDE.md",
       block_id: CLAUDE_BLOCK_ID,
-      content_sha256: createHash7("sha256").update(CLAUDE_MANAGED_BLOCK_CONTENT).digest("hex")
+      content_sha256: createHash8("sha256").update(CLAUDE_MANAGED_BLOCK_CONTENT).digest("hex")
     }] : [],
     ...selectedSet.has("codebuddy") ? [{
       owner: "codebuddy",
       target_path: "CODEBUDDY.md",
       block_id: CODEBUDDY_BLOCK_ID,
-      content_sha256: createHash7("sha256").update(CODEBUDDY_MANAGED_BLOCK_CONTENT).digest("hex")
+      content_sha256: createHash8("sha256").update(CODEBUDDY_MANAGED_BLOCK_CONTENT).digest("hex")
     }] : []
   ].sort((left, right) => left.target_path.localeCompare(right.target_path) || left.block_id.localeCompare(right.block_id));
   const filesByTarget = new Map(newStateFiles.map((entry) => [entry.target_path, entry]));
@@ -3712,7 +3879,7 @@ async function refreshProject(options) {
     files: [...filesByTarget.values()].sort((left, right) => left.target_path.localeCompare(right.target_path) || left.source_path.localeCompare(right.source_path)),
     managed_blocks: managedBlocks
   };
-  const existingState = await readOptionalText(join8(root, INSTALLED_STATE_PATH));
+  const existingState = await readOptionalText(join9(root, INSTALLED_STATE_PATH));
   let existingParsed = null;
   try {
     existingParsed = existingState === "" ? null : JSON.parse(existingState);
@@ -3767,7 +3934,7 @@ function buildMarkerCoreHash(text) {
   }
 }
 async function collectFreshness(options) {
-  const root = resolve7(options.projectRoot);
+  const root = resolve8(options.projectRoot);
   const installed = await readInstalledState(root);
   const codebuddySurface2 = options.codebuddySurface ?? "both";
   const agents = [];
@@ -3812,18 +3979,18 @@ async function collectFreshness(options) {
     identity.adapterHash = sha256Bytes(canonicalJson(targets.map((target) => ({ path: target.target_path.replace(/\\/g, "/"), sha256: target.sha256 })).sort((a, b) => a.path.localeCompare(b.path))));
     const installedProjection = await Promise.all(targets.map(async (target) => ({
       path: target.target_path.replace(/\\/g, "/"),
-      sha256: await fileHex2(join8(root, target.target_path))
+      sha256: await fileHex2(join9(root, target.target_path))
     })));
     identity.installedAdapterHash = sha256Bytes(canonicalJson(installedProjection.sort((a, b) => a.path.localeCompare(b.path))));
     const markerTarget = targets.find((target) => target.target_path.replace(/\\/g, "/").endsWith(`/${BUILD_MARKER_BUNDLE_PATH}`) || target.target_path === BUILD_MARKER_BUNDLE_PATH);
     if (markerTarget !== void 0) {
-      identity.installedCoreHash = buildMarkerCoreHash(await readOptionalText(join8(root, markerTarget.target_path)));
+      identity.installedCoreHash = buildMarkerCoreHash(await readOptionalText(join9(root, markerTarget.target_path)));
     }
     const mismatchDetails = [];
     const contentEntries = [];
     for (const target of targets) {
       const rel = target.target_path.replace(/\\/g, "/");
-      const actual = await fileHex2(join8(root, target.target_path));
+      const actual = await fileHex2(join9(root, target.target_path));
       contentEntries.push({ relpath: rel, sha256: actual ?? "" });
       if (actual === null) {
         mismatchDetails.push({ relpath: rel, expected: target.sha256, actual: "<missing>" });
@@ -3846,7 +4013,7 @@ async function collectFreshness(options) {
     const drifted = [];
     const missing = [];
     for (const target of targets) {
-      const current = await fileHex2(join8(root, target.target_path));
+      const current = await fileHex2(join9(root, target.target_path));
       if (current === null) {
         missing.push(target.target_path);
       } else if (current !== target.sha256) {
@@ -4094,11 +4261,11 @@ function rawFindings(content) {
       if (rule.id === "HH_PASSWORD_VALUE" && isObviousPlaceholder(value)) {
         continue;
       }
-      const relative4 = match[0].indexOf(value);
+      const relative5 = match[0].indexOf(value);
       findings.push({
         ruleId: rule.id,
         severity: rule.severity,
-        offset: match.index + Math.max(0, relative4),
+        offset: match.index + Math.max(0, relative5),
         value
       });
     }
@@ -4210,8 +4377,8 @@ function generateProposalPreview(input, scanOptions = {}) {
 }
 
 // ../core/dist/push/credentials.js
-import { readFile as readFile8, writeFile as writeFile6 } from "node:fs/promises";
-import { join as join9 } from "node:path";
+import { readFile as readFile9, writeFile as writeFile7 } from "node:fs/promises";
+import { join as join10 } from "node:path";
 import { parse as parseYaml4, stringify as stringifyYaml3 } from "yaml";
 var CREDENTIALS_LOCAL_RELATIVE = ".harness/credentials.local.yaml";
 var CREDENTIALS_GITIGNORE_LINES = [
@@ -4281,7 +4448,7 @@ function mergeLocalCredentials(existing, patch) {
 }
 async function readLocalCredentials(projectRoot) {
   try {
-    const raw = await readFile8(join9(projectRoot, CREDENTIALS_LOCAL_RELATIVE), "utf8");
+    const raw = await readFile9(join10(projectRoot, CREDENTIALS_LOCAL_RELATIVE), "utf8");
     return parseLocalCredentials(parseYaml4(raw));
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -4292,13 +4459,13 @@ async function readLocalCredentials(projectRoot) {
 }
 async function writeLocalCredentials(projectRoot, credentials) {
   const normalized = validateLocalCredentials(credentials);
-  await writeFile6(join9(projectRoot, CREDENTIALS_LOCAL_RELATIVE), stringifyYaml3(normalized, { sortMapEntries: true }) + "\n", "utf8");
+  await writeFile7(join10(projectRoot, CREDENTIALS_LOCAL_RELATIVE), stringifyYaml3(normalized, { sortMapEntries: true }) + "\n", "utf8");
 }
 async function ensureCredentialsGitignore(projectRoot) {
-  const gitignorePath = join9(projectRoot, ".gitignore");
+  const gitignorePath = join10(projectRoot, ".gitignore");
   let content = "";
   try {
-    content = await readFile8(gitignorePath, "utf8");
+    content = await readFile9(gitignorePath, "utf8");
   } catch (error) {
     if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) {
       throw error;
@@ -4321,7 +4488,7 @@ async function ensureCredentialsGitignore(projectRoot) {
     return;
   }
   const suffix = content.length === 0 || content.endsWith("\n") ? "" : "\n";
-  await writeFile6(gitignorePath, content + suffix + missing.join("\n") + "\n", "utf8");
+  await writeFile7(gitignorePath, content + suffix + missing.join("\n") + "\n", "utf8");
 }
 function resolvePushAuth(input) {
   const tokenEnv = input.tokenEnv ?? input.projectTokenEnv;
@@ -4349,28 +4516,28 @@ function resolvePushAuth(input) {
 }
 
 // ../core/dist/push/push.js
-import { lstat as lstat3, readFile as readFile12, readdir as readdir6, rm as rm5 } from "node:fs/promises";
-import { join as join13, relative as relative2, resolve as resolve9 } from "node:path";
+import { lstat as lstat3, readFile as readFile13, readdir as readdir6, rm as rm5 } from "node:fs/promises";
+import { join as join14, relative as relative3, resolve as resolve10 } from "node:path";
 import { parse as parseYaml5, stringify as stringifyYaml4 } from "yaml";
 
 // ../core/dist/state/baseline.js
-import { readFile as readFile9 } from "node:fs/promises";
-import { join as join10 } from "node:path";
+import { readFile as readFile10 } from "node:fs/promises";
+import { join as join11 } from "node:path";
 async function readBaseline(projectRoot) {
-  const content = await readFile9(join10(stateLayout(projectRoot).baseline, "manifest.json"), "utf8");
+  const content = await readFile10(join11(stateLayout(projectRoot).baseline, "manifest.json"), "utf8");
   return baselineManifestSchema.parse(JSON.parse(content));
 }
 
 // ../core/dist/state/locks.js
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { readFile as readFile10, rename as rename5, rm as rm3, writeFile as writeFile7 } from "node:fs/promises";
-import { join as join11 } from "node:path";
+import { readFile as readFile11, rename as rename6, rm as rm3, writeFile as writeFile8 } from "node:fs/promises";
+import { join as join12 } from "node:path";
 async function readLock(path) {
-  return JSON.parse(await readFile10(path, "utf8"));
+  return JSON.parse(await readFile11(path, "utf8"));
 }
 async function acquireProtocolLock(projectRoot, operation, options = {}) {
   const layout = await ensureStateLayout(projectRoot);
-  const lockPath = join11(layout.locks, "protocol.lock");
+  const lockPath = join12(layout.locks, "protocol.lock");
   const now = options.now ?? Date.now();
   const staleAfterMs = options.staleAfterMs ?? 15 * 60 * 1e3;
   const record = {
@@ -4383,7 +4550,7 @@ async function acquireProtocolLock(projectRoot, operation, options = {}) {
   };
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      await writeFile7(lockPath, JSON.stringify(record, null, 2), { flag: "wx" });
+      await writeFile8(lockPath, JSON.stringify(record, null, 2), { flag: "wx" });
       return {
         path: lockPath,
         operation,
@@ -4405,15 +4572,15 @@ async function acquireProtocolLock(projectRoot, operation, options = {}) {
       if (now - current.heartbeat_at_ms <= staleAfterMs) {
         throw new Error("protocol lock is active for operation " + current.operation, { cause: error });
       }
-      await rename5(lockPath, lockPath + ".stale-" + randomUUID3());
+      await rename6(lockPath, lockPath + ".stale-" + randomUUID3());
     }
   }
   throw new Error("unable to acquire protocol lock");
 }
 
 // ../core/dist/sync/synchronize.js
-import { lstat as lstat2, readFile as readFile11, rm as rm4 } from "node:fs/promises";
-import { join as join12, resolve as resolve8 } from "node:path";
+import { lstat as lstat2, readFile as readFile12, rm as rm4 } from "node:fs/promises";
+import { join as join13, resolve as resolve9 } from "node:path";
 
 // ../core/dist/update/conflicts.js
 function operationTargetPath(operation) {
@@ -4591,7 +4758,8 @@ function planArtifactRebase(input) {
       plan.alreadyApplied.push({ path: target, operation });
       continue;
     }
-    const staticDecision = decideUpdate(policy, false);
+    const projectionManaged = input.protocolOnlyPaths?.has(source) === true || input.protocolOnlyPaths?.has(target) === true;
+    const staticDecision = projectionManaged ? { apply: false, reason: "protocol-only" } : decideUpdate(policy, false);
     if (!staticDecision.apply) {
       const acknowledgeReason = staticDecision.reason === "protocol-only" ? "protocol-only" : "policy-never";
       const entry2 = acknowledgedEntry(operation, context, input.projectVersion, acknowledgeReason);
@@ -4695,8 +4863,8 @@ async function pathExists(path) {
   }
 }
 async function optionalContent(root, path) {
-  const full = join12(root, path);
-  return await pathExists(full) ? readFile11(full, "utf8") : null;
+  const full = join13(root, path);
+  return await pathExists(full) ? readFile12(full, "utf8") : null;
 }
 function manifestPayloadHash(manifest) {
   const payload = { ...manifest };
@@ -4708,10 +4876,10 @@ async function loadBlob(root, client, artifactId, operation, requestId, dryRun)
     return null;
   }
   const hash = operation.content_sha256;
-  const cacheRoot = join12(root, ".harness", "cache", "server-artifacts", artifactId);
-  const cachePath = join12(cacheRoot, "blobs", hash.replace(":", "_"));
+  const cacheRoot = join13(root, ".harness", "cache", "server-artifacts", artifactId);
+  const cachePath = join13(cacheRoot, "blobs", hash.replace(":", "_"));
   if (await pathExists(cachePath) && await sha256File(cachePath) === hash) {
-    return readFile11(cachePath, "utf8");
+    return readFile12(cachePath, "utf8");
   }
   const bytes = await client.downloadArtifactBlob(artifactId, hash, requestId);
   if (bytes.byteLength !== operation.size_bytes || sha256Bytes(bytes) !== hash) {
@@ -4802,7 +4970,7 @@ function applyBaselineUpdates(baseline, plan) {
   }
   return next;
 }
-async function planSingleArtifact(root, baseline, manifest, client, requestId, dryRun, conflictStrategy, resolveOverrides) {
+async function planSingleArtifact(root, baseline, manifest, client, requestId, dryRun, conflictStrategy, resolveOverrides, protocolOnlyPaths) {
   if (manifest.project_version === null) {
     throw new Error("artifact manifest missing project_version");
   }
@@ -4812,11 +4980,12 @@ async function planSingleArtifact(root, baseline, manifest, client, requestId, d
     projectVersion: manifest.project_version,
     contexts,
     conflictStrategy,
-    ...resolveOverrides === void 0 ? {} : { resolveOverrides }
+    ...resolveOverrides === void 0 ? {} : { resolveOverrides },
+    ...protocolOnlyPaths === void 0 ? {} : { protocolOnlyPaths }
   });
 }
 async function saveConflictReport(root, requestId, manifest, plan) {
-  const reportPath = join12(root, ".harness", "reports", "conflicts-" + requestId + ".json");
+  const reportPath = join13(root, ".harness", "reports", "conflicts-" + requestId + ".json");
   await atomicWriteJson(reportPath, {
     schema_version: 1,
     request_id: requestId,
@@ -4827,7 +4996,7 @@ async function saveConflictReport(root, requestId, manifest, plan) {
   });
 }
 async function synchronizeArtifacts(options, initialBaseline) {
-  const root = resolve8(options.projectRoot);
+  const root = resolve9(options.projectRoot);
   const projectId = options.project.project.project_id;
   if (projectId === null) {
     throw new Error("PROJECT_NOT_BOUND");
@@ -4876,7 +5045,7 @@ async function synchronizeArtifacts(options, initialBaseline) {
     if (manifest.artifact_id !== discovery.artifact_id || manifest.project_id !== projectId || manifest.project_version === null || manifestPayloadHash(manifest) !== manifest.manifest_sha256) {
       throw new Error("ARTIFACT_HASH_MISMATCH");
     }
-    let plan = await planSingleArtifact(root, baseline, manifest, options.client, options.requestId, options.dryRun, conflictStrategy, options.resolveOverrides);
+    let plan = await planSingleArtifact(root, baseline, manifest, options.client, options.requestId, options.dryRun, conflictStrategy, options.resolveOverrides, options.protocolOnlyPaths);
     if (plan.conflicts.length > 0 && options.confirmConflictStrategy !== void 0) {
       const confirmed = await options.confirmConflictStrategy(plan.conflicts);
       if (confirmed === false) {
@@ -4890,7 +5059,7 @@ async function synchronizeArtifacts(options, initialBaseline) {
         aggregate.artifactId = manifest.artifact_id;
         return aggregate;
       }
-      plan = await planSingleArtifact(root, baseline, manifest, options.client, options.requestId, options.dryRun, confirmed, options.resolveOverrides);
+      plan = await planSingleArtifact(root, baseline, manifest, options.client, options.requestId, options.dryRun, confirmed, options.resolveOverrides, options.protocolOnlyPaths);
     }
     const paths = pathsFromPlan(plan);
     aggregate.applied.push(...paths.applied);
@@ -4934,7 +5103,7 @@ async function synchronizeArtifacts(options, initialBaseline) {
       }
       continue;
     }
-    await atomicWriteJson(join12(root, ".harness", "cache", "server-artifacts", manifest.artifact_id, "manifest.json"), manifest);
+    await atomicWriteJson(join13(root, ".harness", "cache", "server-artifacts", manifest.artifact_id, "manifest.json"), manifest);
     const lock = await acquireProtocolLock(root, "update", { requestId: options.requestId });
     try {
       const nextBaseline = applyBaselineUpdates(baseline, plan);
@@ -5004,7 +5173,7 @@ function baselineEntryFromOperation(manifest, operation, localContent) {
   };
 }
 async function advanceBaselineFromArtifact(options, baseline) {
-  const root = resolve8(options.projectRoot);
+  const root = resolve9(options.projectRoot);
   if (options.manifest.project_version === null) {
     throw new Error("artifact manifest missing project_version");
   }
@@ -5106,19 +5275,19 @@ async function walkFiles(root, current, output) {
     return;
   }
   for (const item2 of await readdir6(current, { withFileTypes: true })) {
-    const path = join13(current, item2.name);
+    const path = join14(current, item2.name);
     if (item2.isSymbolicLink()) {
       throw new PushWorkflowError("symlink is not pushable", 6, "UNSAFE_SYMLINK");
     }
     if (item2.isDirectory()) {
       await walkFiles(root, path, output);
     } else if (item2.isFile()) {
-      output.push(normalizeManagedPath(relative2(root, path).replaceAll("\\", "/")));
+      output.push(normalizeManagedPath(relative3(root, path).replaceAll("\\", "/")));
     }
   }
 }
 async function walkArchiveSummaries(root, output) {
-  const archiveRoot = join13(root, ".harness", "archive");
+  const archiveRoot = join14(root, ".harness", "archive");
   if (!await exists3(archiveRoot))
     return;
   for (const item2 of await readdir6(archiveRoot, { withFileTypes: true })) {
@@ -5127,7 +5296,7 @@ async function walkArchiveSummaries(root, output) {
     }
     if (!item2.isDirectory())
       continue;
-    const summaryPath = join13(archiveRoot, item2.name, "reports", "final", "summary-data.json");
+    const summaryPath = join14(archiveRoot, item2.name, "reports", "final", "summary-data.json");
     try {
       const stats = await lstat3(summaryPath);
       if (stats.isSymbolicLink()) {
@@ -5140,7 +5309,7 @@ async function walkArchiveSummaries(root, output) {
         continue;
       throw error;
     }
-    const relativePath = normalizeManagedPath(relative2(root, summaryPath).replaceAll("\\", "/"));
+    const relativePath = normalizeManagedPath(relative3(root, summaryPath).replaceAll("\\", "/"));
     if (ARCHIVE_SUMMARY_PATH.test(relativePath)) {
       output.push(relativePath);
     }
@@ -5157,17 +5326,17 @@ async function walkHarnessEntries(root, directory, output) {
     return;
   for (const item2 of await readdir6(directory, { withFileTypes: true })) {
     if (item2.name.startsWith("harness-")) {
-      const path = join13(directory, item2.name);
+      const path = join14(directory, item2.name);
       if (item2.isDirectory()) {
         await walkFiles(root, path, output);
       } else if (item2.isFile()) {
-        output.push(normalizeManagedPath(relative2(root, path).replaceAll("\\", "/")));
+        output.push(normalizeManagedPath(relative3(root, path).replaceAll("\\", "/")));
       }
     }
   }
 }
 async function managedFiles(projectRoot, project) {
-  const root = resolve9(projectRoot);
+  const root = resolve10(projectRoot);
   const paths = [];
   const adapters = getAdapters(enabledHarnessAgents(project));
   const managedFiles2 = [
@@ -5176,26 +5345,26 @@ async function managedFiles(projectRoot, project) {
     ...adapters.some((adapter) => adapter.name === "codebuddy") ? ["CODEBUDDY.md"] : []
   ];
   for (const path of managedFiles2) {
-    if (await exists3(join13(root, path))) {
+    if (await exists3(join14(root, path))) {
       paths.push(path);
     }
   }
   for (const path of SHARED_MANAGED_ROOTS) {
-    await walkFiles(root, join13(root, path), paths);
+    await walkFiles(root, join14(root, path), paths);
   }
   await walkArchiveSummaries(root, paths);
   for (const adapter of adapters) {
     if (adapter.rulesRoot !== null) {
-      await walkHarnessEntries(root, join13(root, adapter.rulesRoot), paths);
+      await walkHarnessEntries(root, join14(root, adapter.rulesRoot), paths);
     }
-    await walkHarnessEntries(root, join13(root, adapter.skillsRoot), paths);
+    await walkHarnessEntries(root, join14(root, adapter.skillsRoot), paths);
     if (adapter.agentsRoot !== null) {
-      await walkHarnessEntries(root, join13(root, adapter.agentsRoot), paths);
+      await walkHarnessEntries(root, join14(root, adapter.agentsRoot), paths);
     }
   }
   const result = {};
   for (const path of [...new Set(paths)].sort()) {
-    result[path] = await readFile12(join13(root, path), "utf8");
+    result[path] = await readFile13(join14(root, path), "utf8");
   }
   return result;
 }
@@ -5204,14 +5373,14 @@ function proposalBaseline(baseline) {
 }
 async function readProject(root) {
   try {
-    return projectConfigSchema.parse(parseYaml5(await readFile12(join13(root, ".harness", "project.yaml"), "utf8")));
+    return projectConfigSchema.parse(parseYaml5(await readFile13(join14(root, ".harness", "project.yaml"), "utf8")));
   } catch {
     throw new PushWorkflowError("project configuration is missing or invalid", 3, "PROJECT_CONFIG_INVALID");
   }
 }
 async function readOptionalJson(path) {
   try {
-    return JSON.parse(await readFile12(path, "utf8"));
+    return JSON.parse(await readFile13(path, "utf8"));
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return null;
@@ -5223,7 +5392,7 @@ async function clientIdFor(root, explicit) {
   if (explicit !== void 0) {
     return explicit;
   }
-  const path = join13(root, ".harness", "state", "local", "client.json");
+  const path = join14(root, ".harness", "state", "local", "client.json");
   const existing = await readOptionalJson(path);
   if (typeof existing?.client_id === "string" && /^cli_[A-Za-z0-9_-]+$/.test(existing.client_id)) {
     return existing.client_id;
@@ -5419,7 +5588,7 @@ async function bindProject(root, project, baseline, projectId) {
   return { project: nextProject, baseline: nextBaseline };
 }
 async function pushProject(options) {
-  const root = resolve9(options.projectRoot);
+  const root = resolve10(options.projectRoot);
   let project = await readProject(root);
   let baseline = await readBaseline(root);
   const profile = parseHarnessProfile(project.project.profiles[0]);
@@ -5485,7 +5654,7 @@ async function pushProject(options) {
   if (options.confirmProposal !== void 0 && !await options.confirmProposal(preview)) {
     return { preview, proposalId: null, projectId: project.project.project_id, cancelled: true };
   }
-  const workflowPath = join13(root, ".harness", "state", "local", "push-workflow.json");
+  const workflowPath = join14(root, ".harness", "state", "local", "push-workflow.json");
   const priorWorkflow = await readOptionalJson(workflowPath);
   const provisionalRequestId = priorWorkflow?.local_project_key === project.project.local_project_key ? priorWorkflow.request_id : uuidV7();
   const lock = await acquireProtocolLock(root, "push", { requestId: provisionalRequestId });
@@ -5640,7 +5809,7 @@ async function pushProject(options) {
         pushWarning = "BASELINE_ADVANCE_DEFERRED";
       }
     }
-    await atomicWriteJson(join13(root, ".harness", "state", "local", "push-results", finalized.proposal_id + ".json"), {
+    await atomicWriteJson(join14(root, ".harness", "state", "local", "push-results", finalized.proposal_id + ".json"), {
       schema_version: 1,
       request_id: requestId,
       project_id: projectId,
@@ -5685,8 +5854,8 @@ async function pushProject(options) {
 }
 
 // ../core/dist/state/cleanup.js
-import { readFile as readFile13, readdir as readdir7, rm as rm6 } from "node:fs/promises";
-import { join as join14 } from "node:path";
+import { readFile as readFile14, readdir as readdir7, rm as rm6 } from "node:fs/promises";
+import { join as join15 } from "node:path";
 function isSafeEntryName(name) {
   return name.length > 0 && !name.includes("/") && !name.includes("\\") && name !== "." && name !== ".." && !name.includes("\0");
 }
@@ -5710,7 +5879,7 @@ async function cleanupProject(options) {
       continue;
     let journal;
     try {
-      journal = JSON.parse(await readFile13(join14(layout.transactions, name, "journal.json"), "utf8"));
+      journal = JSON.parse(await readFile14(join15(layout.transactions, name, "journal.json"), "utf8"));
     } catch {
       continue;
     }
@@ -5728,7 +5897,7 @@ async function cleanupProject(options) {
         continue;
       pruned.push(entry.id);
       if (!options.dryRun) {
-        await rm6(join14(layout.transactions, entry.id), { recursive: true, force: true });
+        await rm6(join15(layout.transactions, entry.id), { recursive: true, force: true });
       }
     }
   }
@@ -5737,7 +5906,7 @@ async function cleanupProject(options) {
       continue;
     removedCache.push(name);
     if (!options.dryRun) {
-      await rm6(join14(layout.serverArtifacts, name), { recursive: true, force: true });
+      await rm6(join15(layout.serverArtifacts, name), { recursive: true, force: true });
     }
   }
   return {
@@ -5797,10 +5966,10 @@ var SKILL_TARGET_AGENTS = Object.freeze([
 ]);
 
 // ../core/dist/transaction/recovery.js
-import { readFile as readFile14, readdir as readdir8, rm as rm7, stat as stat4 } from "node:fs/promises";
-import { join as join15 } from "node:path";
+import { readFile as readFile15, readdir as readdir8, rm as rm7, stat as stat4 } from "node:fs/promises";
+import { join as join16 } from "node:path";
 async function recoverTransaction(projectRoot, transactionId) {
-  const journal = JSON.parse(await readFile14(join15(stateLayout(projectRoot).transactions, transactionId, "journal.json"), "utf8"));
+  const journal = JSON.parse(await readFile15(join16(stateLayout(projectRoot).transactions, transactionId, "journal.json"), "utf8"));
   if (journal.state === "committed") {
     return { transactionId, status: "committed" };
   }
@@ -5827,7 +5996,7 @@ async function listTransactions(projectRoot) {
   const transactions = [];
   for (const transactionId of names) {
     try {
-      const journal = JSON.parse(await readFile14(join15(root, transactionId, "journal.json"), "utf8"));
+      const journal = JSON.parse(await readFile15(join16(root, transactionId, "journal.json"), "utf8"));
       transactions.push({
         transactionId,
         kind: journal.kind,
@@ -5858,11 +6027,11 @@ async function rollbackLatestCommittedUpdate(projectRoot) {
   if (latest === void 0) {
     throw new Error("no committed update transaction is available for rollback");
   }
-  const transactionRoot = join15(stateLayout(projectRoot).transactions, latest.transactionId);
-  const journal = JSON.parse(await readFile14(join15(transactionRoot, "journal.json"), "utf8"));
-  const after = JSON.parse(await readFile14(join15(transactionRoot, "after", "manifest.json"), "utf8"));
+  const transactionRoot = join16(stateLayout(projectRoot).transactions, latest.transactionId);
+  const journal = JSON.parse(await readFile15(join16(transactionRoot, "journal.json"), "utf8"));
+  const after = JSON.parse(await readFile15(join16(transactionRoot, "after", "manifest.json"), "utf8"));
   for (const entry of after) {
-    const target = join15(projectRoot, entry.path);
+    const target = join16(projectRoot, entry.path);
     const exists6 = await pathExists2(target);
     if (exists6 !== entry.exists || exists6 && await sha256File(target) !== entry.hash) {
       throw new Error("cannot rollback dirty path: " + entry.path);
@@ -5875,10 +6044,10 @@ async function rollbackLatestCommittedUpdate(projectRoot) {
       continue;
     }
     seen.add(snapshot.path);
-    const target = join15(projectRoot, snapshot.path);
+    const target = join16(projectRoot, snapshot.path);
     const exists6 = await pathExists2(target);
     if (snapshot.existed && snapshot.snapshot_name !== null) {
-      const content = await readFile14(join15(transactionRoot, "before", snapshot.snapshot_name));
+      const content = await readFile15(join16(transactionRoot, "before", snapshot.snapshot_name));
       operations.push({
         operation: exists6 ? "modify" : "add",
         path: snapshot.path,
@@ -5907,7 +6076,7 @@ async function cleanupOldTransactions(projectRoot, now = /* @__PURE__ */ new Dat
     if (!removable) {
       continue;
     }
-    await rm7(join15(stateLayout(projectRoot).transactions, item2.transactionId), {
+    await rm7(join16(stateLayout(projectRoot).transactions, item2.transactionId), {
       recursive: true,
       force: true
     });
@@ -5917,8 +6086,8 @@ async function cleanupOldTransactions(projectRoot, now = /* @__PURE__ */ new Dat
 }
 
 // ../core/dist/update/update.js
-import { readFile as readFile15 } from "node:fs/promises";
-import { join as join16, resolve as resolve10 } from "node:path";
+import { readFile as readFile16 } from "node:fs/promises";
+import { join as join17, resolve as resolve11 } from "node:path";
 import { parse as parseYaml8 } from "yaml";
 var UpdateWorkflowError = class extends Error {
   exitCode;
@@ -5931,10 +6100,10 @@ var UpdateWorkflowError = class extends Error {
   }
 };
 async function updateProject(options) {
-  const root = resolve10(options.projectRoot);
+  const root = resolve11(options.projectRoot);
   let project;
   try {
-    project = projectConfigSchema.parse(parseYaml8(await readFile15(join16(root, ".harness", "project.yaml"), "utf8")));
+    project = projectConfigSchema.parse(parseYaml8(await readFile16(join17(root, ".harness", "project.yaml"), "utf8")));
   } catch {
     throw new UpdateWorkflowError("project configuration is invalid", 3, "PROJECT_CONFIG_INVALID");
   }
@@ -5958,6 +6127,7 @@ async function updateProject(options) {
   }
   const requestId = uuidV7();
   const baseline = await readBaseline(root);
+  const protocolOnlyPaths = await readManagedProjectRuleProjectionPaths(root);
   let parsedServerUrl;
   try {
     parsedServerUrl = new URL(serverUrl);
@@ -5979,6 +6149,7 @@ async function updateProject(options) {
       client,
       requestId,
       dryRun: options.dryRun,
+      protocolOnlyPaths,
       ...options.conflictStrategy === void 0 ? {} : { conflictStrategy: options.conflictStrategy },
       ...options.resolveOverrides === void 0 ? {} : { resolveOverrides: options.resolveOverrides },
       ...options.confirmConflictStrategy === void 0 ? {} : { confirmConflictStrategy: options.confirmConflictStrategy },
@@ -5989,7 +6160,13 @@ async function updateProject(options) {
         const parsed = harnessAgentSchema.safeParse(agent);
         return parsed.success ? [parsed.data] : [];
       });
-      await synchronizeProjectRules(root, agents, project.adapter_options?.codebuddy?.surface ?? "both");
+      const projections = await synchronizeProjectRules(root, agents, project.adapter_options?.codebuddy?.surface ?? "both");
+      for (const path of projections.conflicts) {
+        result.conflicts.push({ path, operation: "modify", reason: "local-dirty" });
+        if (!result.skipped.some((item2) => item2.path === path)) {
+          result.skipped.push({ path, operation: "modify", reason: "local-dirty" });
+        }
+      }
     }
     return result;
   } catch (error) {
@@ -6016,8 +6193,8 @@ async function updateProject(options) {
 }
 
 // src/config/init-config.ts
-import { isAbsolute as isAbsolute2, join as join17 } from "node:path";
-import { readFile as readFile16 } from "node:fs/promises";
+import { isAbsolute as isAbsolute2, join as join18 } from "node:path";
+import { readFile as readFile17 } from "node:fs/promises";
 var InitConfigurationError = class extends Error {
   exitCode;
   code;
@@ -6100,9 +6277,9 @@ function hasOwn(record, key) {
 async function resolveInitConfig(cwd, flags, prompts = {}, warnings = []) {
   let fileConfig = {};
   if (flags.config !== void 0) {
-    const path = isAbsolute2(flags.config) ? flags.config : join17(cwd, flags.config);
+    const path = isAbsolute2(flags.config) ? flags.config : join18(cwd, flags.config);
     try {
-      fileConfig = JSON.parse(await readFile16(path, "utf8"));
+      fileConfig = JSON.parse(await readFile17(path, "utf8"));
     } catch (error) {
       throw new InitConfigurationError(
         "unable to read init config: " + (error instanceof Error ? error.message : String(error)),
@@ -6184,8 +6361,8 @@ function serializeCliResult(result) {
 }
 
 // src/config/codebuddy-setup.ts
-import { mkdir as mkdir6, readFile as readFile17, readdir as readdir9, stat as stat5, writeFile as writeFile8 } from "node:fs/promises";
-import { basename as basename4, dirname as dirname6, extname as extname2, join as join18 } from "node:path";
+import { mkdir as mkdir7, readFile as readFile18, readdir as readdir9, stat as stat5, writeFile as writeFile9 } from "node:fs/promises";
+import { basename as basename5, dirname as dirname7, extname as extname2, join as join19 } from "node:path";
 var MANAGED_RULE_NAMES = /* @__PURE__ */ new Set([
   "harness-general.md",
   "harness-general.mdc",
@@ -6204,7 +6381,7 @@ async function exists4(path) {
 }
 async function readJsonObject(path) {
   try {
-    const parsed = JSON.parse(await readFile17(path, "utf8"));
+    const parsed = JSON.parse(await readFile18(path, "utf8"));
     return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") return {};
@@ -6212,7 +6389,7 @@ async function readJsonObject(path) {
   }
 }
 async function inspectCodeBuddySetup(projectRoot, surface = "both") {
-  const rulesRoot = join18(projectRoot, ".claude", "rules");
+  const rulesRoot = join19(projectRoot, ".claude", "rules");
   let ruleNames = [];
   try {
     ruleNames = (await readdir9(rulesRoot, { withFileTypes: true })).filter((entry) => entry.isFile() && [".md", ".mdc"].includes(extname2(entry.name).toLowerCase())).map((entry) => entry.name).filter((name) => !MANAGED_RULE_NAMES.has(name)).sort();
@@ -6223,11 +6400,11 @@ async function inspectCodeBuddySetup(projectRoot, surface = "both") {
   const currentClaudeRules = [];
   const conflictingClaudeRules = [];
   for (const name of ruleNames) {
-    const sourceContent = await readFile17(join18(rulesRoot, name), "utf8");
+    const sourceContent = await readFile18(join19(rulesRoot, name), "utf8");
     const targetContents = await Promise.all(
       destinationTargets(projectRoot, surface, name).map(async (target) => {
         try {
-          return await readFile17(target, "utf8");
+          return await readFile18(target, "utf8");
         } catch (error) {
           if (error instanceof Error && "code" in error && error.code === "ENOENT") return null;
           throw error;
@@ -6241,22 +6418,22 @@ async function inspectCodeBuddySetup(projectRoot, surface = "both") {
       currentClaudeRules.push(name);
     }
   }
-  const mcp = await readJsonObject(join18(projectRoot, ".mcp.json"));
+  const mcp = await readJsonObject(join19(projectRoot, ".mcp.json"));
   const servers = mcp?.mcpServers;
   const configured = servers !== null && typeof servers === "object" && !Array.isArray(servers) && Object.prototype.hasOwnProperty.call(servers, "codegraph");
   return {
     claudeRules,
     currentClaudeRules,
     conflictingClaudeRules,
-    hasCodeGraphIndex: await exists4(join18(projectRoot, ".codegraph")),
+    hasCodeGraphIndex: await exists4(join19(projectRoot, ".codegraph")),
     codeGraphConfigured: configured
   };
 }
 function destinationTargets(root, surface, name) {
-  const stem = basename4(name, extname2(name));
+  const stem = basename5(name, extname2(name));
   const targets = [];
-  if (surface !== "cli") targets.push(join18(root, ".codebuddy", ".rules", `${stem}.mdc`));
-  if (surface !== "ide") targets.push(join18(root, ".codebuddy", "rules", `${stem}.md`));
+  if (surface !== "cli") targets.push(join19(root, ".codebuddy", ".rules", `${stem}.mdc`));
+  if (surface !== "ide") targets.push(join19(root, ".codebuddy", "rules", `${stem}.md`));
   return targets;
 }
 async function applyCodeBuddySetup(options) {
@@ -6270,8 +6447,8 @@ async function applyCodeBuddySetup(options) {
   if (options.syncClaudeRules) {
     const plan = await inspectCodeBuddySetup(options.projectRoot, options.surface);
     for (const name of plan.claudeRules) {
-      const source = join18(options.projectRoot, ".claude", "rules", name);
-      const content = await readFile17(source, "utf8");
+      const source = join19(options.projectRoot, ".claude", "rules", name);
+      const content = await readFile18(source, "utf8");
       if (SENSITIVE_ASSIGNMENT.test(content) || PRIVATE_KEY_BLOCK.test(content)) {
         result.skippedSensitive.push(name);
         continue;
@@ -6281,14 +6458,14 @@ async function applyCodeBuddySetup(options) {
           result.preserved.push(target);
           continue;
         }
-        await mkdir6(dirname6(target), { recursive: true });
-        await writeFile8(target, content, { encoding: "utf8", flag: "wx" });
+        await mkdir7(dirname7(target), { recursive: true });
+        await writeFile9(target, content, { encoding: "utf8", flag: "wx" });
         result.copied.push(target);
       }
     }
   }
   if (options.configureCodeGraph) {
-    const path = join18(options.projectRoot, ".mcp.json");
+    const path = join19(options.projectRoot, ".mcp.json");
     const current = await readJsonObject(path);
     if (current === null) {
       result.warnings.push(".mcp.json \u4E0D\u662F\u6709\u6548 JSON\uFF0C\u5DF2\u4FDD\u7559\u539F\u6587\u4EF6\u5E76\u8DF3\u8FC7 CodeGraph MCP \u914D\u7F6E");
@@ -6303,7 +6480,7 @@ async function applyCodeBuddySetup(options) {
             codegraph: { command: "codegraph", args: ["serve", "--mcp"] }
           }
         };
-        await writeFile8(path, JSON.stringify(next, null, 2) + "\n", "utf8");
+        await writeFile9(path, JSON.stringify(next, null, 2) + "\n", "utf8");
         result.mcpUpdated = true;
       }
     }
@@ -6312,13 +6489,13 @@ async function applyCodeBuddySetup(options) {
 }
 
 // src/commands/refresh.ts
-import { readFile as readFile18 } from "node:fs/promises";
-import { join as join19 } from "node:path";
+import { readFile as readFile19 } from "node:fs/promises";
+import { join as join20 } from "node:path";
 import { parse as parseYaml9 } from "yaml";
 async function detectProject(root) {
   let content;
   try {
-    content = await readFile18(join19(root, ".harness", "project.yaml"), "utf8");
+    content = await readFile19(join20(root, ".harness", "project.yaml"), "utf8");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return { status: "absent" };
@@ -7181,6 +7358,7 @@ async function runRulesSync(options, dependencies) {
       configuredSurface(detection.config, options.codebuddySurface)
     );
     const learning = options.learn === false ? null : await synchronizeRuleCandidates(dependencies.cwd);
+    const ruleReview = learning === null ? null : await exportRuleReviewQueue(dependencies.cwd);
     const exitCode = projections.conflicts.length > 0 ? 5 : 0;
     const payload = {
       schema_version: 1,
@@ -7197,7 +7375,8 @@ async function runRulesSync(options, dependencies) {
         unchanged: projections.unchanged.length,
         conflicts: projections.conflicts.length,
         agent_specific: projections.agent_specific.length,
-        rule_candidates: learning?.candidates ?? 0
+        rule_candidates: learning?.candidates ?? 0,
+        rule_review_pending: ruleReview?.pending.length ?? 0
       },
       items: [
         ...projections.migrated.map((path) => ({ path, status: "migrated" })),
@@ -7208,6 +7387,12 @@ async function runRulesSync(options, dependencies) {
           status: learning.changed ? "updated" : "unchanged",
           candidates: learning.candidates,
           scanned: learning.scanned
+        }],
+        ...ruleReview === null ? [] : [{
+          path: ".harness/knowledge/rule-decisions.json",
+          status: ruleReview.pending.length > 0 ? "pending-review" : "current",
+          pending: ruleReview.pending.length,
+          decided: ruleReview.decided
         }]
       ],
       warnings: [
@@ -7232,9 +7417,69 @@ async function runRulesSync(options, dependencies) {
   }
 }
 
+// src/commands/rules-review.ts
+import { readFile as readFile20 } from "node:fs/promises";
+import { resolve as resolve12 } from "node:path";
+async function runRulesReview(options, dependencies) {
+  const detection = await detectProject(dependencies.cwd);
+  if (detection.status === "absent") {
+    dependencies.stderr("\u5C1A\u672A\u521D\u59CB\u5316 Hunter Harness\uFF1B\u8BF7\u5148\u8FD0\u884C `hunter-harness`\u3002\n");
+    return 3;
+  }
+  if (detection.status === "invalid") {
+    dependencies.stderr("PROJECT_CONFIG_INVALID\uFF1A.harness/project.yaml \u65E0\u6548\n");
+    return 3;
+  }
+  try {
+    const queue = await exportRuleReviewQueue(dependencies.cwd);
+    let summary;
+    let items;
+    if (options.apply === void 0) {
+      summary = { pending: queue.pending.length, decided: queue.decided };
+      items = queue.pending;
+    } else {
+      const input = JSON.parse(
+        await readFile20(resolve12(dependencies.cwd, options.apply), "utf8")
+      );
+      const result = await applyRuleReviewDecisions(dependencies.cwd, input);
+      summary = { applied: result.applied, recorded: result.recorded };
+      items = [{ path: result.path, status: "updated" }];
+    }
+    const payload = {
+      schema_version: 1,
+      command: "rules-review",
+      request_id: uuidV7(),
+      dry_run: false,
+      ok: true,
+      exit_code: 0,
+      project_id: detection.config.project.project_id,
+      summary,
+      items,
+      warnings: [],
+      errors: []
+    };
+    if (options.json === true) dependencies.stdout(serializeCliResult(payload));
+    else if (options.apply === void 0) {
+      dependencies.stdout(
+        `\u516C\u5171\u89C4\u5219\u5019\u9009\uFF1A\u5F85\u8BC4\u5BA1 ${summary.pending ?? 0}\uFF0C\u5DF2\u51B3\u5B9A ${summary.decided ?? 0}\u3002
+`
+      );
+    } else {
+      dependencies.stdout(
+        `\u516C\u5171\u89C4\u5219\u51B3\u7B56\uFF1A\u5E94\u7528 ${summary.applied ?? 0}\uFF0C\u8BB0\u5F55 ${summary.recorded ?? 0}\u3002
+`
+      );
+    }
+    return 0;
+  } catch (error) {
+    dependencies.stderr((error instanceof Error ? error.message : String(error)) + "\n");
+    return 1;
+  }
+}
+
 // src/commands/recovery.ts
 import { stat as stat6 } from "node:fs/promises";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 async function exists5(path) {
   try {
     await stat6(path);
@@ -7294,7 +7539,7 @@ async function runRecoveryMenuIfApplicable(options, dependencies) {
       return 5;
     }
   }
-  const initialized = await exists5(join20(dependencies.cwd, ".harness", "project.yaml"));
+  const initialized = await exists5(join21(dependencies.cwd, ".harness", "project.yaml"));
   if (!initialized || options.nonInteractive === true || explicitConfigure(options)) {
     return null;
   }
@@ -7337,8 +7582,8 @@ async function runRecoveryMenuIfApplicable(options, dependencies) {
 }
 
 // src/workflow-data/resolve.ts
-import { cp, mkdir as mkdir7, readdir as readdir10, readFile as readFile19, rm as rm8, stat as stat7 } from "node:fs/promises";
-import { dirname as dirname7, join as join21, relative as relative3 } from "node:path";
+import { cp, mkdir as mkdir8, readdir as readdir10, readFile as readFile21, rm as rm8, stat as stat7 } from "node:fs/promises";
+import { dirname as dirname8, join as join22, relative as relative4 } from "node:path";
 import { fileURLToPath } from "node:url";
 var WorkflowDataResolutionError = class extends Error {
   code;
@@ -7375,14 +7620,14 @@ async function listFilesRecursive(root, base = root) {
   const entries = await readdir10(root, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const absolute = join21(root, entry.name);
+    const absolute = join22(root, entry.name);
     if (entry.isDirectory()) {
       files.push(...await listFilesRecursive(absolute, base));
       continue;
     }
     if (!entry.isFile()) continue;
-    const rel = relative3(base, absolute).replaceAll("\\", "/");
-    files.push({ path: rel, content: await readFile19(absolute, "utf8") });
+    const rel = relative4(base, absolute).replaceAll("\\", "/");
+    files.push({ path: rel, content: await readFile21(absolute, "utf8") });
   }
   return files;
 }
@@ -7395,7 +7640,7 @@ async function verifyWorkflowPackageIntegrity(resourcesRoot) {
   const manifest = await readWorkflowFamilyManifest(resourcesRoot);
   const expected = manifest.content_sha256;
   if (typeof expected !== "string" || expected.length === 0) return;
-  const harnessRoot = join21(resourcesRoot, "harness");
+  const harnessRoot = join22(resourcesRoot, "harness");
   if (!await pathExists3(harnessRoot)) {
     throw new WorkflowDataResolutionError(
       "\u5DE5\u4F5C\u6D41\u6570\u636E\u5305\u7F3A\u5C11 harness/\uFF0C\u65E0\u6CD5\u6821\u9A8C SHA-256",
@@ -7414,40 +7659,40 @@ async function verifyWorkflowPackageIntegrity(resourcesRoot) {
   }
 }
 async function monorepoResourcesRoot() {
-  const here = dirname7(fileURLToPath(import.meta.url));
+  const here = dirname8(fileURLToPath(import.meta.url));
   const candidates = [
     // TypeScript source: packages/cli/src/workflow-data -> packages/workflow-data-harness.
-    join21(here, "../../../workflow-data-harness"),
+    join22(here, "../../../workflow-data-harness"),
     // Bundled CLI: packages/cli/dist -> packages/workflow-data-harness.
-    join21(here, "../../workflow-data-harness"),
+    join22(here, "../../workflow-data-harness"),
     // Test/build layouts that preserve additional source directory levels.
-    join21(here, "../../../../packages/workflow-data-harness")
+    join22(here, "../../../../packages/workflow-data-harness")
   ];
   for (const candidate of candidates) {
-    if (await pathExists3(join21(candidate, "harness", "manifests"))) return candidate;
+    if (await pathExists3(join22(candidate, "harness", "manifests"))) return candidate;
   }
   return null;
 }
 async function siblingWorkflowPackage(cwd) {
-  const here = dirname7(fileURLToPath(import.meta.url));
+  const here = dirname8(fileURLToPath(import.meta.url));
   const candidates = [
-    join21(cwd, "node_modules", "@hunter-harness", "workflow-harness"),
+    join22(cwd, "node_modules", "@hunter-harness", "workflow-harness"),
     // Published layout: node_modules/hunter-harness/dist/bin.js alongside the
     // scoped workflow package in node_modules/@hunter-harness/workflow-harness.
-    join21(here, "..", "..", "@hunter-harness", "workflow-harness"),
+    join22(here, "..", "..", "@hunter-harness", "workflow-harness"),
     // Monorepo bundled layout: packages/cli/dist/bin.js.
-    join21(here, "..", "..", "workflow-data-harness")
+    join22(here, "..", "..", "workflow-data-harness")
   ];
   for (const candidate of candidates) {
-    if (await pathExists3(join21(candidate, "harness", "manifests"))) return candidate;
+    if (await pathExists3(join22(candidate, "harness", "manifests"))) return candidate;
   }
   return null;
 }
 async function readCachedNpmPackageVersion(cacheRoot) {
-  const manifestPath = join21(cacheRoot, "package.json");
+  const manifestPath = join22(cacheRoot, "package.json");
   if (!await pathExists3(manifestPath)) return null;
   try {
-    const pkg = JSON.parse(await readFile19(manifestPath, "utf8"));
+    const pkg = JSON.parse(await readFile21(manifestPath, "utf8"));
     return typeof pkg.version === "string" && pkg.version.length > 0 ? pkg.version : null;
   } catch {
     return null;
@@ -7469,13 +7714,13 @@ async function latestWorkflowCacheIsStale(cacheRoot, packageName, resolveManifes
   }
 }
 async function materializeWorkflowPackageCache(cacheRoot, packageSpec, extract) {
-  await mkdir7(cacheRoot, { recursive: true });
-  const staging = join21(cacheRoot, ".extract");
+  await mkdir8(cacheRoot, { recursive: true });
+  const staging = join22(cacheRoot, ".extract");
   await rm8(staging, { recursive: true, force: true });
-  await mkdir7(staging, { recursive: true });
+  await mkdir8(staging, { recursive: true });
   await extract(packageSpec, staging);
-  const packageDir = await pathExists3(join21(staging, "harness", "manifests")) ? staging : join21(staging, "package");
-  if (!await pathExists3(join21(packageDir, "harness", "manifests"))) {
+  const packageDir = await pathExists3(join22(staging, "harness", "manifests")) ? staging : join22(staging, "package");
+  if (!await pathExists3(join22(packageDir, "harness", "manifests"))) {
     throw new WorkflowDataResolutionError(
       "\u5DE5\u4F5C\u6D41\u6570\u636E\u5305\u5185\u5BB9\u65E0\u6548\uFF1A\u7F3A\u5C11 harness/manifests",
       "WORKFLOW_DATA_INVALID",
@@ -7504,8 +7749,8 @@ async function resolveWorkflowResourcesRoot(options, argv = []) {
   const packageName = workflowPackageName(family, options.env);
   const packageSpec = version === "latest" ? packageName : `${packageName}@${version}`;
   const cacheKey = packageSpec.replace("/", "+");
-  const cacheRoot = join21(options.cwd, ".harness", "cache", "workflow-packages", cacheKey);
-  if (await pathExists3(join21(cacheRoot, "harness", "manifests"))) {
+  const cacheRoot = join22(options.cwd, ".harness", "cache", "workflow-packages", cacheKey);
+  if (await pathExists3(join22(cacheRoot, "harness", "manifests"))) {
     if (version === "latest") {
       const stale = await latestWorkflowCacheIsStale(cacheRoot, packageName, options.pacoteManifest);
       if (stale) {
@@ -7551,9 +7796,9 @@ function describeWorkflowDataFetchFailure(error, packageSpec) {
   return `\u65E0\u6CD5\u83B7\u53D6\u5DE5\u4F5C\u6D41\u6570\u636E\u5305 ${packageSpec}\uFF1A\u672C\u5730\u7F13\u5B58\u4E0D\u5B58\u5728\u4E14\u83B7\u53D6\u5931\u8D25\u3002\u53EF${hintRoot}\u3002\u539F\u56E0\uFF1A${code !== "" ? code + " " : ""}${detail}`;
 }
 async function readWorkflowFamilyManifest(resourcesRoot) {
-  const manifestPath = join21(resourcesRoot, "hunter-workflow-family.json");
+  const manifestPath = join22(resourcesRoot, "hunter-workflow-family.json");
   if (!await pathExists3(manifestPath)) return {};
-  return JSON.parse(await readFile19(manifestPath, "utf8"));
+  return JSON.parse(await readFile21(manifestPath, "utf8"));
 }
 
 // src/bin.ts
@@ -7673,6 +7918,12 @@ async function runCli(argv, overrides = {}) {
       dependencies
     );
   });
+  program.command("rules-review").description("\u5BFC\u51FA\u5F85\u8BC4\u5BA1\u516C\u5171\u89C4\u5219\u5019\u9009\uFF0C\u6216\u5E94\u7528\u7ECF\u7528\u6237\u786E\u8BA4\u7684\u89C4\u5219\u51B3\u7B56").option("--apply <file>", "\u5E94\u7528\u5305\u542B\u5019\u9009 revision \u548C\u76EE\u6807 hash \u7684\u51B3\u7B56 JSON").option("--json").action(async (options) => {
+    exitCode = await runRulesReview(
+      { ...program.opts(), ...options },
+      dependencies
+    );
+  });
   try {
     await program.parseAsync(["node", "hunter-harness", ...argv]);
     return exitCode;