hunter-harness 0.2.5 → 0.2.7

package/dist/bin.js

@@ -140,8 +140,18 @@ var baselineManifestSchema = z2.object({
 var finalizeProposalSchema = z2.object({
   schema_version: z2.literal(1),
   manifest_sha256: sha256Schema,
-  base_artifact_id: z2.string().regex(/^art_/).nullable()
-}).strict();
+  base_artifact_id: z2.string().regex(/^art_/).nullable(),
+  sensitive_scan_skip: z2.literal(true).optional(),
+  sensitive_scan_skip_reason: z2.string().max(500).optional()
+}).strict().superRefine((value, ctx) => {
+  if (value.sensitive_scan_skip_reason !== void 0 && value.sensitive_scan_skip !== true) {
+    ctx.addIssue({
+      code: "custom",
+      message: "sensitive_scan_skip_reason requires sensitive_scan_skip",
+      path: ["sensitive_scan_skip_reason"]
+    });
+  }
+});
 var requestMetadataSchema = z2.object({
   request_id: z2.uuid(),
   idempotency_key: z2.uuid(),
@@ -1660,6 +1670,9 @@ function affectedPaths(operation) {
 }
 async function writeJournal(transactionRoot, journal) {
   await atomicWriteJson(join3(transactionRoot, "journal.json"), journal);
+  await writeStatus(transactionRoot, journal);
+}
+async function writeStatus(transactionRoot, journal) {
   await atomicWriteJson(join3(transactionRoot, "status.json"), {
     schema_version: 1,
     transaction_id: journal.transaction_id,
@@ -1669,6 +1682,16 @@ async function writeJournal(transactionRoot, journal) {
     updated_at: (/* @__PURE__ */ new Date()).toISOString()
   });
 }
+function journalOperation(operation) {
+  if (operation.operation === "rename") {
+    return {
+      operation: "rename",
+      from_path: operation.from_path,
+      to_path: operation.to_path
+    };
+  }
+  return { operation: operation.operation, path: operation.path };
+}
 async function pruneOlderSuccessful(layout, currentId, kind) {
   if (kind === void 0)
     return;
@@ -1789,12 +1812,12 @@ async function runTransaction(projectRoot, rawOperations, options = {}) {
   const snapshots = await snapshotPaths(projectRoot, transactionRoot, paths);
   await stageOperations(transactionRoot, operations);
   const journal = {
-    schema_version: 1,
+    schema_version: 2,
     transaction_id: transactionId,
     ...options.kind === void 0 ? {} : { kind: options.kind },
     state: "prepared",
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
-    operations,
+    operations: operations.map(journalOperation),
     snapshots,
     applied_count: 0,
     failure: null
@@ -1810,7 +1833,7 @@ async function runTransaction(projectRoot, rawOperations, options = {}) {
       }
       await applyOperation(projectRoot, transactionRoot, operation, index, transactionId);
       journal.applied_count = index + 1;
-      await writeJournal(transactionRoot, journal);
+      await writeStatus(transactionRoot, journal);
       if (options.interruptAfterApply === journal.applied_count) {
         journal.state = "interrupted";
         journal.failure = "injected interruption";
@@ -2336,6 +2359,7 @@ async function initializeProject(options) {
     }
     manifests.push({
       adapter: agent,
+      profile,
       bundle_version: bundle.manifest.bundle_version,
       bundle_manifest_hash: bundleHash
     });
@@ -2440,9 +2464,9 @@ async function initializeProject(options) {
     return byTarget !== 0 ? byTarget : left.block_id.localeCompare(right.block_id);
   });
   const installedState = {
-    schema_version: 3,
-    profile,
+    schema_version: 4,
     adapters: enabledAgents,
+    profiles: Object.fromEntries(enabledAgents.map((agent) => [agent, profile])),
     installed_at: (/* @__PURE__ */ new Date()).toISOString(),
     manifests,
     files: mergedTargets.map((target) => ({
@@ -2497,17 +2521,35 @@ async function readOptionalText(path) {
 async function readInstalledState(root) {
   const content = await readOptionalText(join6(root, INSTALLED_STATE_PATH));
   if (content === "") {
-    return { profile: null, schemaVersion: null, adapters: [], trusted: /* @__PURE__ */ new Map() };
+    return {
+      profile: null,
+      schemaVersion: null,
+      adapters: [],
+      profiles: /* @__PURE__ */ new Map(),
+      trusted: /* @__PURE__ */ new Map(),
+      files: [],
+      manifests: [],
+      managedBlocks: []
+    };
   }
   let parsed;
   try {
     parsed = JSON.parse(content);
   } catch {
-    return { profile: null, schemaVersion: null, adapters: [], trusted: /* @__PURE__ */ new Map() };
+    return {
+      profile: null,
+      schemaVersion: null,
+      adapters: [],
+      profiles: /* @__PURE__ */ new Map(),
+      trusted: /* @__PURE__ */ new Map(),
+      files: [],
+      manifests: [],
+      managedBlocks: []
+    };
   }
   const profile = parseHarnessProfile(parsed.profile);
   const trusted = /* @__PURE__ */ new Map();
-  if ((parsed.schema_version === 2 || parsed.schema_version === 3) && Array.isArray(parsed.files)) {
+  if ((parsed.schema_version === 2 || parsed.schema_version === 3 || parsed.schema_version === 4) && Array.isArray(parsed.files)) {
     for (const entry of parsed.files) {
       if (entry !== null && typeof entry === "object" && "target_path" in entry && "sha256" in entry) {
         const target = entry.target_path;
@@ -2519,8 +2561,42 @@ async function readInstalledState(root) {
     }
   }
   const schemaVersion = typeof parsed.schema_version === "number" ? parsed.schema_version : null;
-  const adapters = schemaVersion === 3 && Array.isArray(parsed.adapters) ? sortHarnessAgents(parsed.adapters.filter((value) => value === "claude-code" || value === "codex" || value === "cursor" || value === "codebuddy")) : schemaVersion === 1 || schemaVersion === 2 ? ["claude-code"] : [];
-  return { profile, schemaVersion, adapters, trusted };
+  const adapters = (schemaVersion === 3 || schemaVersion === 4) && Array.isArray(parsed.adapters) ? sortHarnessAgents(parsed.adapters.filter((value) => value === "claude-code" || value === "codex" || value === "cursor" || value === "codebuddy")) : schemaVersion === 1 || schemaVersion === 2 ? ["claude-code"] : [];
+  const profiles = /* @__PURE__ */ new Map();
+  if (schemaVersion === 4 && parsed.profiles !== null && typeof parsed.profiles === "object" && !Array.isArray(parsed.profiles)) {
+    for (const agent of adapters) {
+      const value = parsed.profiles[agent];
+      const agentProfile = parseHarnessProfile(value);
+      if (agentProfile !== null)
+        profiles.set(agent, agentProfile);
+    }
+  } else if (profile !== null) {
+    for (const agent of adapters)
+      profiles.set(agent, profile);
+  }
+  const files = Array.isArray(parsed.files) ? parsed.files.filter((entry) => entry !== null && typeof entry === "object" && typeof entry.target_path === "string" && typeof entry.source_path === "string" && typeof entry.sha256 === "string" && "owner" in entry) : [];
+  const manifests = schemaVersion === 4 && Array.isArray(parsed.manifests) ? parsed.manifests.filter((entry) => entry !== null && typeof entry === "object" && typeof entry.adapter === "string" && typeof entry.profile === "string") : [];
+  const managedBlocks = Array.isArray(parsed.managed_blocks) ? parsed.managed_blocks.filter((entry) => entry !== null && typeof entry === "object" && typeof entry.target_path === "string" && typeof entry.block_id === "string") : [];
+  return {
+    profile,
+    schemaVersion,
+    adapters,
+    profiles,
+    trusted,
+    files,
+    manifests,
+    managedBlocks
+  };
+}
+async function readInstalledAgentConfiguration(projectRoot) {
+  const installed = await readInstalledState(resolve4(projectRoot));
+  return {
+    agents: installed.adapters,
+    profiles: Object.fromEntries(installed.adapters.map((agent) => [
+      agent,
+      installed.profiles.get(agent) ?? installed.profile ?? "general"
+    ]))
+  };
 }
 async function readContextIndexBundleHash(root) {
   const content = await readOptionalText(join6(root, CONTEXT_INDEX_PATH));
@@ -2578,16 +2654,18 @@ function conflict(target, reason, oldSha, incomingSha) {
 function sortByTarget(items) {
   return [...items].sort((left, right) => left.target_path.localeCompare(right.target_path));
 }
-async function reconcileContextIndex(root, profile, agents, manifests, codebuddySurface2) {
+async function reconcileContextIndex(root, agents, profiles, manifests, codebuddySurface2) {
   const existing = await readOptionalText(join6(root, CONTEXT_INDEX_PATH));
-  const context = { profile, codebuddySurface: codebuddySurface2 };
   const record = {
     schema_version: 2,
     project: {
       shared_instructions: "AGENTS.md",
       adapters: Object.fromEntries(agents.map((agent) => [
         agent,
-        getAdapter(agent).contextIndex(context)
+        getAdapter(agent).contextIndex({
+          profile: profiles.get(agent) ?? "general",
+          codebuddySurface: codebuddySurface2
+        })
       ]))
     },
     knowledge: { index: ".harness/knowledge/index.json" },
@@ -2606,23 +2684,25 @@ async function reconcileContextIndex(root, profile, agents, manifests, codebuddy
     content: next
   };
 }
-async function projectTransitionOperation(root, previousProfile, profile, oldAgents, agents, codebuddySurface2) {
-  if (previousProfile === profile && oldAgents.length === agents.length && oldAgents.every((agent, index) => agent === agents[index]))
-    return null;
+async function projectTransitionOperation(root, agents, profiles, codebuddySurface2) {
   const path = ".harness/project.yaml";
   const content = await readOptionalText(join6(root, path));
   if (content === "")
     return null;
   const project = parseYaml3(content);
+  const activeProfiles = [...new Set(agents.map((agent) => profiles.get(agent) ?? "general"))].sort();
+  const next = stringifyYaml2({
+    ...project,
+    project: { ...project.project, profiles: activeProfiles },
+    adapters: { enabled: agents },
+    ...agents.includes("codebuddy") ? { adapter_options: { codebuddy: { surface: codebuddySurface2 } } } : { adapter_options: void 0 }
+  }, { sortMapEntries: true });
+  if (next === content)
+    return null;
   return {
     operation: "modify",
     path,
-    content: stringifyYaml2({
-      ...project,
-      project: { ...project.project, profiles: [profile] },
-      adapters: { enabled: agents },
-      ...agents.includes("codebuddy") ? { adapter_options: { codebuddy: { surface: codebuddySurface2 } } } : { adapter_options: void 0 }
-    }, { sortMapEntries: true })
+    content: next
   };
 }
 function mergeTargets(targets) {
@@ -2681,30 +2761,42 @@ function stateWithoutInstalledAt(value) {
 }
 async function refreshProject(options) {
   const root = resolve4(options.projectRoot);
-  const profile = options.profile;
   const installed = await readInstalledState(root);
-  const previousProfile = installed.profile;
-  const agents = sortHarnessAgents(options.agents);
   const oldAgents = installed.adapters.length > 0 ? installed.adapters : ["claude-code"];
+  const selectedAgents = sortHarnessAgents(options.agents);
+  const selectedSet = new Set(selectedAgents);
+  const agents = sortHarnessAgents([...oldAgents, ...selectedAgents]);
+  const profiles = new Map(installed.profiles);
+  if (options.profile !== void 0) {
+    for (const agent of selectedAgents)
+      profiles.set(agent, options.profile);
+  }
+  const profile = options.profile ?? selectedAgents.map((agent) => profiles.get(agent)).find((value) => value !== void 0) ?? installed.profile ?? "general";
+  const previousProfile = selectedAgents.map((agent) => installed.profiles.get(agent)).find((value) => value !== void 0) ?? installed.profile;
   const codebuddySurface2 = options.codebuddySurface ?? "both";
-  const context = { profile, codebuddySurface: codebuddySurface2 };
   const owned = [];
   const manifests = [];
   for (const agent of agents) {
-    const bundle = await loadAgentBundle(options.resourcesRoot, profile, agent);
+    const agentProfile = profiles.get(agent) ?? profile;
+    profiles.set(agent, agentProfile);
+    const bundle = await loadAgentBundle(options.resourcesRoot, agentProfile, agent);
     manifests.push({
       adapter: agent,
+      profile: agentProfile,
       bundle_version: bundle.manifest.bundle_version,
       bundle_manifest_hash: sha256Bytes(canonicalJson(bundle.manifest.files))
     });
-    for (const target of managedTargetsFor(getAdapter(agent), bundle, context)) {
-      owned.push({ ...target, owner: agent });
+    if (selectedSet.has(agent)) {
+      const context = { profile: agentProfile, codebuddySurface: codebuddySurface2 };
+      for (const target of managedTargetsFor(getAdapter(agent), bundle, context)) {
+        owned.push({ ...target, owner: agent });
+      }
     }
   }
   const newManaged = mergeTargets(owned);
   let trusted = installed.trusted;
   let migrationOldPaths = null;
-  if (installed.schemaVersion === 1) {
+  if (installed.schemaVersion === 1 && selectedSet.has("claude-code")) {
     const contextHash = await readContextIndexBundleHash(root);
     if (contextHash !== null) {
       const migrations = await loadMigrationManifests(options.resourcesRoot);
@@ -2728,12 +2820,18 @@ async function refreshProject(options) {
         });
       }
     }
-  } else if (previousProfile !== null) {
-    const oldContext = { profile: previousProfile, codebuddySurface: codebuddySurface2 };
+  } else {
     const oldTargets = [];
-    for (const agent of oldAgents) {
-      const bundle = await loadAgentBundle(options.resourcesRoot, previousProfile, agent);
-      oldTargets.push(...managedTargetsFor(getAdapter(agent), bundle, oldContext));
+    for (const agent of selectedAgents) {
+      const oldProfile = installed.profiles.get(agent) ?? installed.profile;
+      if (!oldAgents.includes(agent) || oldProfile === null || oldProfile === void 0) {
+        continue;
+      }
+      const bundle = await loadAgentBundle(options.resourcesRoot, oldProfile, agent);
+      oldTargets.push(...managedTargetsFor(getAdapter(agent), bundle, {
+        profile: oldProfile,
+        codebuddySurface: codebuddySurface2
+      }));
     }
     oldOnly = oldTargets.filter((target) => !newTargetSet.has(target.target_path));
   }
@@ -2743,7 +2841,7 @@ async function refreshProject(options) {
   const unchanged = [];
   const conflicts = [];
   const ops = [];
-  const newStateFiles = [];
+  const newStateFiles = installed.files.filter((entry) => entry.owner === "shared" || !selectedSet.has(entry.owner));
   for (const target of newManaged) {
     const incoming = target.sha256;
     const current = await fileHex(join6(root, target.target_path));
@@ -2791,41 +2889,50 @@ async function refreshProject(options) {
     }
   }
   await reconcileMarkdownBlock(root, "AGENTS.md", AGENTS_CORE_BLOCK_ID, AGENTS_MANAGED_BLOCK_CONTENT, false, ops, conflicts, preserved);
-  await reconcileMarkdownBlock(root, "CLAUDE.md", CLAUDE_BLOCK_ID, CLAUDE_MANAGED_BLOCK_CONTENT, !agents.includes("claude-code"), ops, conflicts, preserved);
-  await reconcileMarkdownBlock(root, "CODEBUDDY.md", CODEBUDDY_BLOCK_ID, CODEBUDDY_MANAGED_BLOCK_CONTENT, !agents.includes("codebuddy"), ops, conflicts, preserved);
-  const projectOperation = await projectTransitionOperation(root, previousProfile, profile, oldAgents, agents, codebuddySurface2);
+  if (selectedSet.has("claude-code")) {
+    await reconcileMarkdownBlock(root, "CLAUDE.md", CLAUDE_BLOCK_ID, CLAUDE_MANAGED_BLOCK_CONTENT, false, ops, conflicts, preserved);
+  }
+  if (selectedSet.has("codebuddy")) {
+    await reconcileMarkdownBlock(root, "CODEBUDDY.md", CODEBUDDY_BLOCK_ID, CODEBUDDY_MANAGED_BLOCK_CONTENT, false, ops, conflicts, preserved);
+  }
+  const projectOperation = await projectTransitionOperation(root, agents, profiles, codebuddySurface2);
   if (projectOperation !== null)
     ops.push(projectOperation);
-  const contextOperation = await reconcileContextIndex(root, profile, agents, manifests, codebuddySurface2);
+  const contextOperation = await reconcileContextIndex(root, agents, profiles, manifests, codebuddySurface2);
   if (contextOperation !== null)
     ops.push(contextOperation);
   const managedBlocks = [
+    ...installed.managedBlocks.filter((entry) => entry.owner !== "shared" && !selectedSet.has(entry.owner)),
     {
       owner: "shared",
       target_path: "AGENTS.md",
       block_id: AGENTS_CORE_BLOCK_ID,
       content_sha256: createHash5("sha256").update(AGENTS_MANAGED_BLOCK_CONTENT).digest("hex")
     },
-    ...agents.includes("claude-code") ? [{
+    ...selectedSet.has("claude-code") ? [{
       owner: "claude-code",
       target_path: "CLAUDE.md",
       block_id: CLAUDE_BLOCK_ID,
       content_sha256: createHash5("sha256").update(CLAUDE_MANAGED_BLOCK_CONTENT).digest("hex")
     }] : [],
-    ...agents.includes("codebuddy") ? [{
+    ...selectedSet.has("codebuddy") ? [{
       owner: "codebuddy",
       target_path: "CODEBUDDY.md",
       block_id: CODEBUDDY_BLOCK_ID,
       content_sha256: createHash5("sha256").update(CODEBUDDY_MANAGED_BLOCK_CONTENT).digest("hex")
     }] : []
   ].sort((left, right) => left.target_path.localeCompare(right.target_path) || left.block_id.localeCompare(right.block_id));
+  const filesByTarget = new Map(newStateFiles.map((entry) => [entry.target_path, entry]));
   const installedState = {
-    schema_version: 3,
-    profile,
+    schema_version: 4,
     adapters: agents,
+    profiles: Object.fromEntries(agents.map((agent) => [
+      agent,
+      profiles.get(agent) ?? "general"
+    ])),
     installed_at: (/* @__PURE__ */ new Date()).toISOString(),
-    manifests,
-    files: newStateFiles.sort((left, right) => left.target_path.localeCompare(right.target_path) || left.source_path.localeCompare(right.source_path)),
+    manifests: manifests.sort((left, right) => left.adapter.localeCompare(right.adapter)),
+    files: [...filesByTarget.values()].sort((left, right) => left.target_path.localeCompare(right.target_path) || left.source_path.localeCompare(right.source_path)),
     managed_blocks: managedBlocks
   };
   const existingState = await readOptionalText(join6(root, INSTALLED_STATE_PATH));
@@ -2843,7 +2950,10 @@ async function refreshProject(options) {
   }
   if (!options.dryRun) {
     await runTransaction(root, ops, { kind: "refresh" });
-    await pruneEmptyParentDirs(root, removed.map((item2) => item2.target_path), getAdapters([.../* @__PURE__ */ new Set([...agents, ...oldAgents])]).flatMap((adapter) => adapter.pruneBoundaries(context)));
+    await pruneEmptyParentDirs(root, removed.map((item2) => item2.target_path), getAdapters(selectedAgents).flatMap((adapter) => adapter.pruneBoundaries({
+      profile: profiles.get(adapter.name) ?? profile,
+      codebuddySurface: codebuddySurface2
+    })));
   }
   return {
     profile,
@@ -3100,8 +3210,9 @@ function scanSensitiveFiles(files, options = {}) {
     const path = normalizeManagedPath(inputPath);
     const ignores = parseInlineIgnores(content);
     const knowledgeMetadata = path === ".harness/knowledge" || path.startsWith(".harness/knowledge/");
+    const archiveMetadata = path === ".harness/archive" || path.startsWith(".harness/archive/");
     for (const raw of rawFindings(content)) {
-      if (knowledgeMetadata && raw.ruleId === "HH_WINDOWS_ABSOLUTE_PATH") {
+      if ((knowledgeMetadata || archiveMetadata) && raw.ruleId === "HH_WINDOWS_ABSOLUTE_PATH") {
         continue;
       }
       const position = location(content, raw.offset);
@@ -3172,29 +3283,147 @@ function generateProposalPreview(input, scanOptions = {}) {
   };
 }
 
-// ../core/dist/push/push.js
-import { lstat as lstat2, readFile as readFile8, readdir as readdir4, rm as rm4 } from "node:fs/promises";
-import { join as join9, relative, resolve as resolve5 } from "node:path";
+// ../core/dist/push/credentials.js
+import { readFile as readFile6, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join7 } from "node:path";
 import { parse as parseYaml4, stringify as stringifyYaml3 } from "yaml";
+var CREDENTIALS_LOCAL_RELATIVE = ".harness/credentials.local.yaml";
+var CREDENTIALS_GITIGNORE_LINES = [
+  ".harness/credentials.local.yaml",
+  ".harness/credentials.local.*"
+];
+var InvalidCredentialsError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "InvalidCredentialsError";
+  }
+};
+function assertHttpsServerUrl(url) {
+  try {
+    const parsed = new URL(url.trim());
+    if (parsed.protocol !== "https:") {
+      throw new InvalidCredentialsError("server_url must use HTTPS");
+    }
+    return parsed.toString().replace(/\/$/, "");
+  } catch (error) {
+    if (error instanceof InvalidCredentialsError) {
+      throw error;
+    }
+    throw new InvalidCredentialsError("server_url is invalid");
+  }
+}
+function validateLocalCredentials(credentials) {
+  const token = typeof credentials.token === "string" && credentials.token.trim().length > 0 ? credentials.token.trim() : void 0;
+  const serverUrl = typeof credentials.server_url === "string" && credentials.server_url.trim().length > 0 ? assertHttpsServerUrl(credentials.server_url) : void 0;
+  if (token === void 0 && serverUrl === void 0) {
+    throw new InvalidCredentialsError("credentials.local must include token and/or server_url");
+  }
+  return {
+    ...token === void 0 ? {} : { token },
+    ...serverUrl === void 0 ? {} : { server_url: serverUrl }
+  };
+}
+function parseLocalCredentials(raw) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    return null;
+  }
+  const record = raw;
+  const token = typeof record.token === "string" && record.token.trim().length > 0 ? record.token.trim() : void 0;
+  const serverUrlRaw = typeof record.server_url === "string" && record.server_url.trim().length > 0 ? record.server_url.trim() : void 0;
+  let serverUrl;
+  if (serverUrlRaw !== void 0) {
+    try {
+      serverUrl = assertHttpsServerUrl(serverUrlRaw);
+    } catch {
+      return null;
+    }
+  }
+  if (token === void 0 && serverUrl === void 0) {
+    return null;
+  }
+  return {
+    ...token === void 0 ? {} : { token },
+    ...serverUrl === void 0 ? {} : { server_url: serverUrl }
+  };
+}
+function mergeLocalCredentials(existing, patch) {
+  return validateLocalCredentials({
+    ...existing?.token === void 0 ? {} : { token: existing.token },
+    ...existing?.server_url === void 0 ? {} : { server_url: existing.server_url },
+    ...patch
+  });
+}
+async function readLocalCredentials(projectRoot) {
+  try {
+    const raw = await readFile6(join7(projectRoot, CREDENTIALS_LOCAL_RELATIVE), "utf8");
+    return parseLocalCredentials(parseYaml4(raw));
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  }
+}
+async function writeLocalCredentials(projectRoot, credentials) {
+  const normalized = validateLocalCredentials(credentials);
+  await writeFile3(join7(projectRoot, CREDENTIALS_LOCAL_RELATIVE), stringifyYaml3(normalized, { sortMapEntries: true }) + "\n", "utf8");
+}
+async function ensureCredentialsGitignore(projectRoot) {
+  const gitignorePath = join7(projectRoot, ".gitignore");
+  let content = "";
+  try {
+    content = await readFile6(gitignorePath, "utf8");
+  } catch (error) {
+    if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) {
+      throw error;
+    }
+  }
+  const existing = new Set(content.split("\n").map((line) => line.trim()));
+  const missing = CREDENTIALS_GITIGNORE_LINES.filter((line) => !existing.has(line));
+  if (missing.length === 0) {
+    return;
+  }
+  const suffix = content.length === 0 || content.endsWith("\n") ? "" : "\n";
+  await writeFile3(gitignorePath, content + suffix + missing.join("\n") + "\n", "utf8");
+}
+function resolvePushAuth(input) {
+  const tokenEnv = input.tokenEnv ?? input.projectTokenEnv;
+  const envToken = input.env[tokenEnv]?.trim();
+  const localToken = input.local?.token?.trim();
+  const token = envToken && envToken.length > 0 ? envToken : localToken && localToken.length > 0 ? localToken : void 0;
+  const serverUrl = input.serverUrlFlag ?? input.local?.server_url ?? input.projectUrl ?? void 0;
+  if (serverUrl === void 0 || serverUrl === null || serverUrl.trim() === "") {
+    return { code: "SERVER_URL_REQUIRED" };
+  }
+  if (token === void 0) {
+    return { code: "TOKEN_INVALID" };
+  }
+  return { serverUrl, token };
+}
+
+// ../core/dist/push/push.js
+import { lstat as lstat2, readFile as readFile9, readdir as readdir4, rm as rm4 } from "node:fs/promises";
+import { join as join10, relative, resolve as resolve5 } from "node:path";
+import { parse as parseYaml5, stringify as stringifyYaml4 } from "yaml";
 
 // ../core/dist/state/baseline.js
-import { readFile as readFile6 } from "node:fs/promises";
-import { join as join7 } from "node:path";
+import { readFile as readFile7 } from "node:fs/promises";
+import { join as join8 } from "node:path";
 async function readBaseline(projectRoot) {
-  const content = await readFile6(join7(stateLayout(projectRoot).baseline, "manifest.json"), "utf8");
+  const content = await readFile7(join8(stateLayout(projectRoot).baseline, "manifest.json"), "utf8");
   return baselineManifestSchema.parse(JSON.parse(content));
 }
 
 // ../core/dist/state/locks.js
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { readFile as readFile7, rename as rename3, rm as rm3, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join8 } from "node:path";
+import { readFile as readFile8, rename as rename3, rm as rm3, writeFile as writeFile4 } from "node:fs/promises";
+import { join as join9 } from "node:path";
 async function readLock(path) {
-  return JSON.parse(await readFile7(path, "utf8"));
+  return JSON.parse(await readFile8(path, "utf8"));
 }
 async function acquireProtocolLock(projectRoot, operation, options = {}) {
   const layout = await ensureStateLayout(projectRoot);
-  const lockPath = join8(layout.locks, "protocol.lock");
+  const lockPath = join9(layout.locks, "protocol.lock");
   const now = options.now ?? Date.now();
   const staleAfterMs = options.staleAfterMs ?? 15 * 60 * 1e3;
   const record = {
@@ -3207,7 +3436,7 @@ async function acquireProtocolLock(projectRoot, operation, options = {}) {
   };
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      await writeFile3(lockPath, JSON.stringify(record, null, 2), { flag: "wx" });
+      await writeFile4(lockPath, JSON.stringify(record, null, 2), { flag: "wx" });
       return {
         path: lockPath,
         operation,
@@ -3239,11 +3468,15 @@ async function acquireProtocolLock(projectRoot, operation, options = {}) {
 var PushWorkflowError = class extends Error {
   exitCode;
   code;
-  constructor(message, exitCode, code) {
+  details;
+  constructor(message, exitCode, code, details) {
     super(message);
     this.name = "PushWorkflowError";
     this.exitCode = exitCode;
     this.code = code;
+    if (details !== void 0) {
+      this.details = details;
+    }
   }
 };
 var SHARED_MANAGED_ROOTS = [
@@ -3271,7 +3504,7 @@ async function walkFiles(root, current, output) {
     return;
   }
   for (const item2 of await readdir4(current, { withFileTypes: true })) {
-    const path = join9(current, item2.name);
+    const path = join10(current, item2.name);
     if (item2.isSymbolicLink()) {
       throw new PushWorkflowError("symlink is not pushable", 6, "UNSAFE_SYMLINK");
     }
@@ -3293,7 +3526,7 @@ async function walkHarnessEntries(root, directory, output) {
     return;
   for (const item2 of await readdir4(directory, { withFileTypes: true })) {
     if (item2.name.startsWith("harness-")) {
-      const path = join9(directory, item2.name);
+      const path = join10(directory, item2.name);
       if (item2.isDirectory()) {
         await walkFiles(root, path, output);
       } else if (item2.isFile()) {
@@ -3312,25 +3545,25 @@ async function managedFiles(projectRoot, project) {
     ...adapters.some((adapter) => adapter.name === "codebuddy") ? ["CODEBUDDY.md"] : []
   ];
   for (const path of managedFiles2) {
-    if (await exists3(join9(root, path))) {
+    if (await exists3(join10(root, path))) {
       paths.push(path);
     }
   }
   for (const path of SHARED_MANAGED_ROOTS) {
-    await walkFiles(root, join9(root, path), paths);
+    await walkFiles(root, join10(root, path), paths);
   }
   for (const adapter of adapters) {
     if (adapter.rulesRoot !== null) {
-      await walkFiles(root, join9(root, adapter.rulesRoot), paths);
+      await walkFiles(root, join10(root, adapter.rulesRoot), paths);
     }
-    await walkHarnessEntries(root, join9(root, adapter.skillsRoot), paths);
+    await walkHarnessEntries(root, join10(root, adapter.skillsRoot), paths);
     if (adapter.agentsRoot !== null) {
-      await walkHarnessEntries(root, join9(root, adapter.agentsRoot), paths);
+      await walkHarnessEntries(root, join10(root, adapter.agentsRoot), paths);
     }
   }
   const result = {};
   for (const path of [...new Set(paths)].sort()) {
-    result[path] = await readFile8(join9(root, path), "utf8");
+    result[path] = await readFile9(join10(root, path), "utf8");
   }
   return result;
 }
@@ -3339,14 +3572,14 @@ function proposalBaseline(baseline) {
 }
 async function readProject(root) {
   try {
-    return projectConfigSchema.parse(parseYaml4(await readFile8(join9(root, ".harness", "project.yaml"), "utf8")));
+    return projectConfigSchema.parse(parseYaml5(await readFile9(join10(root, ".harness", "project.yaml"), "utf8")));
   } catch {
     throw new PushWorkflowError("project configuration is missing or invalid", 3, "PROJECT_CONFIG_INVALID");
   }
 }
 async function readOptionalJson(path) {
   try {
-    return JSON.parse(await readFile8(path, "utf8"));
+    return JSON.parse(await readFile9(path, "utf8"));
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return null;
@@ -3358,7 +3591,7 @@ async function clientIdFor(root, explicit) {
   if (explicit !== void 0) {
     return explicit;
   }
-  const path = join9(root, ".harness", "state", "local", "client.json");
+  const path = join10(root, ".harness", "state", "local", "client.json");
   const existing = await readOptionalJson(path);
   if (typeof existing?.client_id === "string" && /^cli_[A-Za-z0-9_-]+$/.test(existing.client_id)) {
     return existing.client_id;
@@ -3403,6 +3636,50 @@ function resetSession(state, proposalManifestHash) {
     chunk_idempotency_keys: {}
   };
 }
+function summarizeFindings(security) {
+  const blocked = security.findings.filter((finding) => finding.disposition === "blocked");
+  return {
+    findings: blocked.map((finding) => ({
+      path: finding.path,
+      rule_id: finding.rule_id,
+      severity: finding.severity,
+      overridable: finding.overridable,
+      fingerprint: finding.fingerprint,
+      line: finding.line,
+      column: finding.column
+    })),
+    finding_count: blocked.length,
+    scanner_version: security.scanner_version
+  };
+}
+function sensitiveBlockedError(preview) {
+  return new PushWorkflowError("sensitive information scan blocked the proposal", 6, "SENSITIVE_CONTENT_BLOCKED", summarizeFindings(preview.security));
+}
+async function resolveSensitiveScanSkip(preview, options) {
+  if (!preview.blocked) {
+    return { skip: false };
+  }
+  if (options.sensitiveScanSkip === true) {
+    return {
+      skip: true,
+      ...options.sensitiveScanSkipReason === void 0 ? {} : { reason: options.sensitiveScanSkipReason }
+    };
+  }
+  if (options.confirmSensitiveScanSkip !== void 0) {
+    const answer = await options.confirmSensitiveScanSkip(preview);
+    if (answer === "cancelled") {
+      return { skip: false, cancelled: true };
+    }
+    return answer.skip ? { skip: true, ...answer.reason === void 0 ? {} : { reason: answer.reason } } : { skip: false };
+  }
+  throw sensitiveBlockedError(preview);
+}
+function assertPreviewAllowed(preview, skip) {
+  if (preview.blocked && !skip) {
+    throw sensitiveBlockedError(preview);
+  }
+}
+var CREDENTIALS_HINT = "\u53EF\u5728\u4EA4\u4E92\u6A21\u5F0F\u4E0B\u5F55\u5165\uFF0C\u6216\u5199\u5165 .harness/credentials.local.yaml\uFF08\u52FF\u63D0\u4EA4 git\uFF09";
 function makePreview(baseline, files, confirmedProjectLocal, ignorePaths, deletedAt = (/* @__PURE__ */ new Date()).toISOString()) {
   const filteredFiles = {};
   for (const [path, content] of Object.entries(files)) {
@@ -3430,7 +3707,7 @@ async function bindProject(root, project, baseline, projectId) {
     {
       operation: "modify",
       path: ".harness/project.yaml",
-      content: stringifyYaml3(nextProject, { sortMapEntries: true })
+      content: stringifyYaml4(nextProject, { sortMapEntries: true })
     },
     {
       operation: "modify",
@@ -3447,24 +3724,38 @@ async function pushProject(options) {
   const profile = parseHarnessProfile(project.project.profiles[0]);
   const installedPaths = profile === null ? /* @__PURE__ */ new Set() : new Set(await Promise.all(enabledHarnessAgents(project).map((agent) => managedBundleTargets(options.resourcesRoot, profile, agent))).then((targets) => targets.flatMap((target) => [...target])));
   let preview = makePreview(baseline, await managedFiles(root, project), options.confirmedProjectLocal ?? [], installedPaths);
-  if (preview.blocked) {
-    throw new PushWorkflowError("sensitive information scan blocked the proposal", 6, "SENSITIVE_CONTENT_BLOCKED");
+  const initialSkip = await resolveSensitiveScanSkip(preview, options);
+  if (initialSkip.cancelled === true) {
+    return { preview, proposalId: null, projectId: project.project.project_id, cancelled: true };
   }
+  let sensitiveScanSkip = initialSkip.skip;
+  let sensitiveScanSkipReason = initialSkip.reason;
+  assertPreviewAllowed(preview, sensitiveScanSkip);
   if (options.dryRun) {
     return { preview, proposalId: null, projectId: project.project.project_id };
   }
   if (options.confirmProposal !== void 0 && !await options.confirmProposal(preview)) {
     return { preview, proposalId: null, projectId: project.project.project_id, cancelled: true };
   }
-  const serverUrl = options.serverUrl ?? project.server.url;
-  if (serverUrl === null || serverUrl === void 0) {
-    throw new PushWorkflowError("server_url is required", 3, "SERVER_URL_REQUIRED");
+  const localCredentials = await readLocalCredentials(root);
+  const auth = resolvePushAuth({
+    ...options.serverUrl === void 0 ? {} : { serverUrlFlag: options.serverUrl },
+    ...options.tokenEnv === void 0 ? {} : { tokenEnv: options.tokenEnv },
+    env: options.env,
+    local: localCredentials,
+    projectUrl: project.server.url,
+    projectTokenEnv: project.server.token_env
+  });
+  if ("code" in auth) {
+    if (auth.code === "SERVER_URL_REQUIRED") {
+      throw new PushWorkflowError("server_url is required; use --server-url, project.yaml server.url, or " + CREDENTIALS_HINT, 3, "SERVER_URL_REQUIRED");
+    }
+    const tokenEnv2 = options.tokenEnv ?? project.server.token_env;
+    throw new PushWorkflowError("API token is unset; set " + tokenEnv2 + " or " + CREDENTIALS_HINT, 8, "TOKEN_INVALID");
   }
+  const serverUrl = auth.serverUrl;
+  const token = auth.token;
   const tokenEnv = options.tokenEnv ?? project.server.token_env;
-  const token = options.env[tokenEnv];
-  if (token === void 0 || token.trim() === "") {
-    throw new PushWorkflowError("API token environment variable is unset", 8, "TOKEN_INVALID");
-  }
   if (!/^[A-Z_][A-Z0-9_]*$/.test(tokenEnv)) {
     throw new PushWorkflowError("token_env is invalid", 3, "TOKEN_ENV_INVALID");
   }
@@ -3477,7 +3768,7 @@ async function pushProject(options) {
   if (parsedServerUrl.protocol !== "https:") {
     throw new PushWorkflowError("server_url must use HTTPS", 3, "SERVER_URL_INVALID");
   }
-  const workflowPath = join9(root, ".harness", "state", "local", "push-workflow.json");
+  const workflowPath = join10(root, ".harness", "state", "local", "push-workflow.json");
   const priorWorkflow = await readOptionalJson(workflowPath);
   const provisionalRequestId = priorWorkflow?.local_project_key === project.project.local_project_key ? priorWorkflow.request_id : uuidV7();
   const lock = await acquireProtocolLock(root, "push", { requestId: provisionalRequestId });
@@ -3505,9 +3796,15 @@ async function pushProject(options) {
       workflow.project_id = resolved.project_id;
       await atomicWriteJson(workflowPath, workflow);
       preview = makePreview(baseline, await managedFiles(root, project), options.confirmedProjectLocal ?? [], installedPaths, workflow.created_at);
-      if (preview.blocked) {
-        throw new PushWorkflowError("sensitive information scan blocked the proposal", 6, "SENSITIVE_CONTENT_BLOCKED");
+      if (!sensitiveScanSkip) {
+        const reboundSkip = await resolveSensitiveScanSkip(preview, options);
+        if (reboundSkip.cancelled === true) {
+          return { preview, proposalId: null, projectId: project.project.project_id, cancelled: true };
+        }
+        sensitiveScanSkip = reboundSkip.skip;
+        sensitiveScanSkipReason = reboundSkip.reason;
       }
+      assertPreviewAllowed(preview, sensitiveScanSkip);
     }
     const projectId = project.project.project_id;
     if (projectId === null) {
@@ -3570,9 +3867,13 @@ async function pushProject(options) {
     const finalized = await client.finalizeProposal(session.session_id, {
       schema_version: 1,
       manifest_sha256: proposalManifestHash,
-      base_artifact_id: baseline.latest_artifact_id ?? null
+      base_artifact_id: baseline.latest_artifact_id ?? null,
+      ...sensitiveScanSkip ? {
+        sensitive_scan_skip: true,
+        ...sensitiveScanSkipReason === void 0 ? {} : { sensitive_scan_skip_reason: sensitiveScanSkipReason }
+      } : {}
     }, requestId, workflow.finalize_idempotency_key);
-    await atomicWriteJson(join9(root, ".harness", "state", "local", "push-results", finalized.proposal_id + ".json"), {
+    await atomicWriteJson(join10(root, ".harness", "state", "local", "push-results", finalized.proposal_id + ".json"), {
       schema_version: 1,
       request_id: requestId,
       project_id: projectId,
@@ -3592,6 +3893,14 @@ async function pushProject(options) {
       if (error.code === "STALE_PUSH") {
         throw new PushWorkflowError("\u670D\u52A1\u7AEF\u5DF2\u6709\u66F4\u65B0\u7684\u63A8\u9001\uFF0C\u8BF7\u5148 git pull \u540E\u6267\u884C npx hunter-harness update \u518D\u63A8", 5, "STALE_PUSH");
       }
+      if (error.code === "SENSITIVE_CONTENT_BLOCKED") {
+        const details = error.details;
+        throw new PushWorkflowError(error.message, 6, "SENSITIVE_CONTENT_BLOCKED", details === null || typeof details !== "object" ? void 0 : {
+          ...typeof details.finding_count === "number" ? { finding_count: details.finding_count } : {},
+          ...typeof details.scanner_version === "string" ? { scanner_version: details.scanner_version } : {},
+          ...Array.isArray(details.findings) ? { findings: details.findings } : {}
+        });
+      }
       const exitCode = error.status === 401 ? 8 : error.status === 409 ? 5 : 4;
       throw new PushWorkflowError(error.message, exitCode, error.code);
     }
@@ -3602,8 +3911,8 @@ async function pushProject(options) {
 }
 
 // ../core/dist/state/cleanup.js
-import { readFile as readFile9, readdir as readdir5, rm as rm5 } from "node:fs/promises";
-import { join as join10 } from "node:path";
+import { readFile as readFile10, readdir as readdir5, rm as rm5 } from "node:fs/promises";
+import { join as join11 } from "node:path";
 function isSafeEntryName(name) {
   return name.length > 0 && !name.includes("/") && !name.includes("\\") && name !== "." && name !== ".." && !name.includes("\0");
 }
@@ -3627,7 +3936,7 @@ async function cleanupProject(options) {
       continue;
     let journal;
     try {
-      journal = JSON.parse(await readFile9(join10(layout.transactions, name, "journal.json"), "utf8"));
+      journal = JSON.parse(await readFile10(join11(layout.transactions, name, "journal.json"), "utf8"));
     } catch {
       continue;
     }
@@ -3645,7 +3954,7 @@ async function cleanupProject(options) {
         continue;
       pruned.push(entry.id);
       if (!options.dryRun) {
-        await rm5(join10(layout.transactions, entry.id), { recursive: true, force: true });
+        await rm5(join11(layout.transactions, entry.id), { recursive: true, force: true });
       }
     }
   }
@@ -3654,7 +3963,7 @@ async function cleanupProject(options) {
       continue;
     removedCache.push(name);
     if (!options.dryRun) {
-      await rm5(join10(layout.serverArtifacts, name), { recursive: true, force: true });
+      await rm5(join11(layout.serverArtifacts, name), { recursive: true, force: true });
     }
   }
   return {
@@ -3665,11 +3974,11 @@ async function cleanupProject(options) {
 }
 
 // ../core/dist/skill/frontmatter.js
-import { parse as parseYaml5 } from "yaml";
+import { parse as parseYaml6 } from "yaml";
 import { z as z14 } from "zod";
 
 // ../core/dist/skill/fixer.js
-import { parse as parseYaml6, stringify as stringifyYaml4 } from "yaml";
+import { parse as parseYaml7, stringify as stringifyYaml5 } from "yaml";
 
 // ../core/dist/skill/agents.js
 var AGENT_DESCRIPTORS = {
@@ -3708,10 +4017,10 @@ var AGENT_DESCRIPTORS = {
 var INSTALLABLE_AGENTS = Object.keys(AGENT_DESCRIPTORS).filter((agent) => AGENT_DESCRIPTORS[agent]?.installable === true);
 
 // ../core/dist/transaction/recovery.js
-import { readFile as readFile10, readdir as readdir6, rm as rm6, stat as stat3 } from "node:fs/promises";
-import { join as join11 } from "node:path";
+import { readFile as readFile11, readdir as readdir6, rm as rm6, stat as stat3 } from "node:fs/promises";
+import { join as join12 } from "node:path";
 async function recoverTransaction(projectRoot, transactionId) {
-  const journal = JSON.parse(await readFile10(join11(stateLayout(projectRoot).transactions, transactionId, "journal.json"), "utf8"));
+  const journal = JSON.parse(await readFile11(join12(stateLayout(projectRoot).transactions, transactionId, "journal.json"), "utf8"));
   if (journal.state === "committed") {
     return { transactionId, status: "committed" };
   }
@@ -3738,7 +4047,7 @@ async function listTransactions(projectRoot) {
   const transactions = [];
   for (const transactionId of names) {
     try {
-      const journal = JSON.parse(await readFile10(join11(root, transactionId, "journal.json"), "utf8"));
+      const journal = JSON.parse(await readFile11(join12(root, transactionId, "journal.json"), "utf8"));
       transactions.push({
         transactionId,
         kind: journal.kind,
@@ -3769,11 +4078,11 @@ async function rollbackLatestCommittedUpdate(projectRoot) {
   if (latest === void 0) {
     throw new Error("no committed update transaction is available for rollback");
   }
-  const transactionRoot = join11(stateLayout(projectRoot).transactions, latest.transactionId);
-  const journal = JSON.parse(await readFile10(join11(transactionRoot, "journal.json"), "utf8"));
-  const after = JSON.parse(await readFile10(join11(transactionRoot, "after", "manifest.json"), "utf8"));
+  const transactionRoot = join12(stateLayout(projectRoot).transactions, latest.transactionId);
+  const journal = JSON.parse(await readFile11(join12(transactionRoot, "journal.json"), "utf8"));
+  const after = JSON.parse(await readFile11(join12(transactionRoot, "after", "manifest.json"), "utf8"));
   for (const entry of after) {
-    const target = join11(projectRoot, entry.path);
+    const target = join12(projectRoot, entry.path);
     const exists5 = await pathExists(target);
     if (exists5 !== entry.exists || exists5 && await sha256File(target) !== entry.hash) {
       throw new Error("cannot rollback dirty path: " + entry.path);
@@ -3786,10 +4095,10 @@ async function rollbackLatestCommittedUpdate(projectRoot) {
       continue;
     }
     seen.add(snapshot.path);
-    const target = join11(projectRoot, snapshot.path);
+    const target = join12(projectRoot, snapshot.path);
     const exists5 = await pathExists(target);
     if (snapshot.existed && snapshot.snapshot_name !== null) {
-      const content = await readFile10(join11(transactionRoot, "before", snapshot.snapshot_name));
+      const content = await readFile11(join12(transactionRoot, "before", snapshot.snapshot_name));
       operations.push({
         operation: exists5 ? "modify" : "add",
         path: snapshot.path,
@@ -3818,7 +4127,7 @@ async function cleanupOldTransactions(projectRoot, now = /* @__PURE__ */ new Dat
     if (!removable) {
       continue;
     }
-    await rm6(join11(stateLayout(projectRoot).transactions, item2.transactionId), {
+    await rm6(join12(stateLayout(projectRoot).transactions, item2.transactionId), {
       recursive: true,
       force: true
     });
@@ -3850,9 +4159,9 @@ function managedBlockDirty(currentContent, managedBlockHash) {
 }
 
 // ../core/dist/update/update.js
-import { lstat as lstat3, readFile as readFile11, rm as rm7 } from "node:fs/promises";
-import { join as join12, resolve as resolve6 } from "node:path";
-import { parse as parseYaml7 } from "yaml";
+import { lstat as lstat3, readFile as readFile12, rm as rm7 } from "node:fs/promises";
+import { join as join13, resolve as resolve6 } from "node:path";
+import { parse as parseYaml8 } from "yaml";
 var UpdateWorkflowError = class extends Error {
   exitCode;
   code;
@@ -3875,7 +4184,7 @@ async function pathExists2(path) {
   }
 }
 async function optionalContent(path) {
-  return await pathExists2(path) ? readFile11(path, "utf8") : null;
+  return await pathExists2(path) ? readFile12(path, "utf8") : null;
 }
 function manifestPayloadHash(manifest) {
   const payload = { ...manifest };
@@ -3893,10 +4202,10 @@ async function loadBlob(root, client, artifactId, operation, requestId, dryRun)
     return null;
   }
   const hash = operation.content_sha256;
-  const cacheRoot = join12(root, ".harness", "cache", "server-artifacts", artifactId);
-  const cachePath = join12(cacheRoot, "blobs", hash.replace(":", "_"));
+  const cacheRoot = join13(root, ".harness", "cache", "server-artifacts", artifactId);
+  const cachePath = join13(cacheRoot, "blobs", hash.replace(":", "_"));
   if (await pathExists2(cachePath) && await sha256File(cachePath) === hash) {
-    return readFile11(cachePath, "utf8");
+    return readFile12(cachePath, "utf8");
   }
   const bytes = await client.downloadArtifactBlob(artifactId, hash, requestId);
   if (bytes.byteLength !== operation.size_bytes || sha256Bytes(bytes) !== hash) {
@@ -3946,7 +4255,7 @@ async function updateProject(options) {
   const root = resolve6(options.projectRoot);
   let project;
   try {
-    project = projectConfigSchema.parse(parseYaml7(await readFile11(join12(root, ".harness", "project.yaml"), "utf8")));
+    project = projectConfigSchema.parse(parseYaml8(await readFile12(join13(root, ".harness", "project.yaml"), "utf8")));
   } catch {
     throw new UpdateWorkflowError("project configuration is invalid", 3, "PROJECT_CONFIG_INVALID");
   }
@@ -4031,8 +4340,8 @@ async function updateProject(options) {
         skipped.push({ path: target, operation: operation.operation, reason: "baseline-diverged" });
         continue;
       }
-      const sourceContent = await optionalContent(join12(root, source));
-      const targetContent = target === source ? sourceContent : await optionalContent(join12(root, target));
+      const sourceContent = await optionalContent(join13(root, source));
+      const targetContent = target === source ? sourceContent : await optionalContent(join13(root, target));
       const incoming = blobs.get(operation) ?? null;
       const incomingHash = contentHash(operation);
       let equivalent = incomingHash !== null && targetContent !== null && sha256Bytes(targetContent) === incomingHash;
@@ -4092,7 +4401,7 @@ async function updateProject(options) {
         dryRun: true
       };
     }
-    await atomicWriteJson(join12(root, ".harness", "cache", "server-artifacts", manifest.artifact_id, "manifest.json"), manifest);
+    await atomicWriteJson(join13(root, ".harness", "cache", "server-artifacts", manifest.artifact_id, "manifest.json"), manifest);
     const lock = await acquireProtocolLock(root, "update", { requestId });
     try {
       const nextBaseline = baselineManifestSchema.parse(structuredClone(baseline));
@@ -4174,8 +4483,8 @@ async function updateProject(options) {
 }
 
 // src/config/init-config.ts
-import { isAbsolute as isAbsolute2, join as join13 } from "node:path";
-import { readFile as readFile12 } from "node:fs/promises";
+import { isAbsolute as isAbsolute2, join as join14 } from "node:path";
+import { readFile as readFile13 } from "node:fs/promises";
 var InitConfigurationError = class extends Error {
   exitCode;
   code;
@@ -4256,9 +4565,9 @@ function hasOwn(record, key) {
 async function resolveInitConfig(cwd, flags, prompts = {}, warnings = []) {
   let fileConfig = {};
   if (flags.config !== void 0) {
-    const path = isAbsolute2(flags.config) ? flags.config : join13(cwd, flags.config);
+    const path = isAbsolute2(flags.config) ? flags.config : join14(cwd, flags.config);
     try {
-      fileConfig = JSON.parse(await readFile12(path, "utf8"));
+      fileConfig = JSON.parse(await readFile13(path, "utf8"));
     } catch (error) {
       throw new InitConfigurationError(
         "unable to read init config: " + (error instanceof Error ? error.message : String(error)),
@@ -4340,28 +4649,28 @@ function serializeCliResult(result) {
 }
 
 // src/commands/refresh.ts
-import { readFile as readFile13 } from "node:fs/promises";
-import { join as join14 } from "node:path";
-import { parse as parseYaml8 } from "yaml";
+import { readFile as readFile14 } from "node:fs/promises";
+import { join as join15 } from "node:path";
+import { parse as parseYaml9 } from "yaml";
 async function detectProject(root) {
   let content;
   try {
-    content = await readFile13(join14(root, ".harness", "project.yaml"), "utf8");
+    content = await readFile14(join15(root, ".harness", "project.yaml"), "utf8");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return { status: "absent" };
     }
     throw error;
   }
-  const parsed = projectConfigSchema.safeParse(parseYaml8(content));
+  const parsed = projectConfigSchema.safeParse(parseYaml9(content));
   if (!parsed.success) {
     return { status: "invalid" };
   }
   return { status: "valid", config: parsed.data };
 }
-function parseProfile(value, current) {
+function parseProfile(value) {
   if (value === void 0 || value === "") {
-    return current;
+    return void 0;
   }
   if (value === "1" || value === "general") return "general";
   if (value === "2" || value === "java") return "java";
@@ -4446,7 +4755,7 @@ async function runRefresh(options, dependencies) {
   let targetProfile;
   let targetAgents;
   try {
-    targetProfile = parseProfile(options.profile, currentProfile);
+    targetProfile = parseProfile(options.profile);
     targetAgents = options.agents === void 0 ? refreshAgents(detection.config) : parseAgentsInput(options.agents);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -4455,12 +4764,12 @@ async function runRefresh(options, dependencies) {
     return error instanceof InitConfigurationError ? error.exitCode : 3;
   }
   const dryRun = options.dryRun === true;
-  if ((targetProfile !== currentProfile || targetAgents.some((agent, index) => agent !== refreshAgents(detection.config)[index]) || targetAgents.length !== refreshAgents(detection.config).length) && !dryRun) {
+  if ((targetProfile !== void 0 && targetProfile !== currentProfile || targetAgents.some((agent, index) => agent !== refreshAgents(detection.config)[index]) || targetAgents.length !== refreshAgents(detection.config).length) && !dryRun) {
     try {
       const preview = await refreshProject({
         projectRoot: dependencies.cwd,
         resourcesRoot: dependencies.resourcesRoot,
-        profile: targetProfile,
+        ...targetProfile === void 0 ? {} : { profile: targetProfile },
         agents: targetAgents,
         codebuddySurface: codebuddySurface(detection.config),
         dryRun: true,
@@ -4485,7 +4794,7 @@ async function runRefresh(options, dependencies) {
         return 2;
       }
     } else if (!options.yes && !dryRun) {
-      const label = targetProfile === currentProfile ? `\u5237\u65B0\u5F53\u524D\u914D\u7F6E\uFF08${currentProfile}\uFF09` : `\u5207\u6362\u914D\u7F6E\uFF1A${currentProfile} \u2192 ${targetProfile}`;
+      const label = targetProfile === currentProfile ? `\u5237\u65B0\u5F53\u524D\u914D\u7F6E\uFF08${currentProfile}\uFF09` : targetProfile === void 0 ? "\u5237\u65B0\u6240\u9009\u5DE5\u5177\u7684\u5F53\u524D\u914D\u7F6E" : `\u66F4\u65B0\u6240\u9009\u5DE5\u5177\u914D\u7F6E\uFF1A${currentProfile} \u2192 ${targetProfile}`;
       const answer = await dependencies.prompt(`${label}\uFF1F[y/N]\uFF1A`);
       if (!/^(?:y|yes)$/i.test(answer.trim())) {
         return 2;
@@ -4496,7 +4805,7 @@ async function runRefresh(options, dependencies) {
     const result = await refreshProject({
       projectRoot: dependencies.cwd,
       resourcesRoot: dependencies.resourcesRoot,
-      profile: targetProfile,
+      ...targetProfile === void 0 ? {} : { profile: targetProfile },
       agents: targetAgents,
       codebuddySurface: codebuddySurface(detection.config),
       dryRun,
@@ -4511,7 +4820,7 @@ async function runRefresh(options, dependencies) {
       if (result.removed.length > 0) parts.push(`\u5DF2\u5220\u9664 ${result.removed.length} \u4E2A`);
       if (result.preserved.length > 0) parts.push(`\u5DF2\u4FDD\u7559 ${result.preserved.length} \u4E2A`);
       if (result.unchanged.length > 0) parts.push(`\u65E0\u9700\u53D8\u66F4 ${result.unchanged.length} \u4E2A`);
-      dependencies.stdout(`Harness \u5237\u65B0\uFF08${targetProfile}\uFF09\uFF1A${parts.join("\uFF0C") || "\u6CA1\u6709\u53D8\u66F4"}\u3002
+      dependencies.stdout(`Harness \u5237\u65B0\uFF08${result.profile}\uFF09\uFF1A${parts.join("\uFF0C") || "\u6CA1\u6709\u53D8\u66F4"}\u3002
 `);
     }
     return output.exit_code;
@@ -4541,9 +4850,12 @@ async function runRefresh(options, dependencies) {
 }
 
 // src/commands/configure.ts
-function otherProfile(current) {
-  return current === "general" ? "java" : "general";
-}
+var AGENT_LABELS = {
+  "claude-code": "Claude Code",
+  codex: "Codex",
+  cursor: "Cursor",
+  codebuddy: "CodeBuddy"
+};
 async function runFirstInstall(options, dependencies) {
   const requestId = uuidV7();
   try {
@@ -4625,21 +4937,40 @@ async function runExistingProject(options, dependencies, currentProfile) {
   if (options.nonInteractive === true) {
     return runRefresh(refreshOptions, dependencies);
   }
-  const menu = await dependencies.prompt(
-    `Hunter Harness \u5DF2\u521D\u59CB\u5316\uFF08profile: ${currentProfile}\uFF09\u3002
-1. \u5237\u65B0\u5F53\u524D\u914D\u7F6E\uFF08\u9ED8\u8BA4\u4E14\u63A8\u8350\uFF09
-2. \u5207\u6362\u5230\u53E6\u4E00\u79CD\u914D\u7F6E
-3. \u53D6\u6D88
-\u8BF7\u9009\u62E9 [1]: `
-  );
-  const choice = menu.trim();
-  if (choice === "3" || /^c/i.test(choice)) {
-    return 2;
-  }
-  if (choice === "2" || /^s/i.test(choice)) {
-    refreshOptions.profile = otherProfile(currentProfile);
-  } else {
-    refreshOptions.profile = currentProfile;
+  const installed = await readInstalledAgentConfiguration(dependencies.cwd);
+  const currentAgents = installed.agents.length > 0 ? installed.agents : ["claude-code"];
+  const currentLines = currentAgents.map(
+    (agent) => `- ${AGENT_LABELS[agent]}\uFF1A${installed.profiles[agent] ?? currentProfile}`
+  ).join("\n");
+  if (refreshOptions.agents === void 0) {
+    const defaultSelection = currentAgents.map((agent) => String(HARNESS_AGENT_ORDER.indexOf(agent) + 1)).join(",");
+    const answer = await dependencies.prompt(
+      `Hunter Harness \u5F53\u524D\u914D\u7F6E\uFF1A
+${currentLines}
+\u8BF7\u9009\u62E9\u672C\u6B21\u8981\u65B0\u589E\u6216\u5237\u65B0\u7684\u5DE5\u5177\uFF08\u53EF\u591A\u9009\uFF0C\u9017\u53F7\u5206\u9694\uFF1B\u672A\u9009\u62E9\u7684\u5DE5\u5177\u4FDD\u6301\u4E0D\u53D8\uFF09\uFF1A
+  1. Claude Code
+  2. Codex
+  3. Cursor
+  4. CodeBuddy
+\u8BF7\u8F93\u5165\u7F16\u53F7 [${defaultSelection}]\uFF0C\u6216\u8F93\u5165 0 \u53D6\u6D88\uFF1A`
+    );
+    if (answer.trim() === "0" || /^c/i.test(answer.trim())) return 2;
+    refreshOptions.agents = answer.trim() === "" ? currentAgents.join(",") : answer.trim();
+  }
+  if (refreshOptions.profile === void 0) {
+    const selected = parseAgentsInput(refreshOptions.agents);
+    const selectedProfiles = new Set(selected.flatMap((agent) => {
+      const profile = installed.profiles[agent];
+      return profile === void 0 ? [] : [profile];
+    }));
+    const defaultProfile = selectedProfiles.size === 1 ? [...selectedProfiles][0] ?? currentProfile : currentProfile;
+    const answer = await dependencies.prompt(
+      `\u8BF7\u9009\u62E9\u6240\u9009\u5DE5\u5177\u4F7F\u7528\u7684 Harness \u914D\u7F6E\uFF1A
+  1. \u901A\u7528
+  2. Java
+\u8BF7\u8F93\u5165\u7F16\u53F7 [${defaultProfile === "java" ? "2" : "1"}]\uFF1A`
+    );
+    refreshOptions.profile = answer.trim() === "" ? defaultProfile : answer.trim();
   }
   refreshOptions.confirmed = true;
   return runRefresh(refreshOptions, dependencies);
@@ -4733,82 +5064,192 @@ async function runCleanup(options, dependencies) {
 }
 
 // src/commands/push.ts
+function formatFindings(details) {
+  if (details?.findings === void 0 || details.findings.length === 0) {
+    return "";
+  }
+  const lines = [
+    "\u654F\u611F\u4FE1\u606F\u626B\u63CF\u53D1\u73B0 " + details.findings.length + " \u4E2A\u95EE\u9898\uFF1A"
+  ];
+  for (const finding of details.findings) {
+    lines.push(
+      "  - " + finding.path + ":" + finding.line + " " + finding.rule_id + " (" + finding.severity + (finding.overridable ? ", \u53EF\u8986\u76D6" : ", \u4E0D\u53EF\u8986\u76D6") + ")"
+    );
+  }
+  return lines.join("\n") + "\n";
+}
+function errorPayload(error) {
+  const exitCode = error instanceof PushWorkflowError ? error.exitCode : 1;
+  const message = error instanceof Error ? error.message : String(error);
+  const code = error instanceof PushWorkflowError ? error.code : "GENERAL_FAILURE";
+  if (error instanceof PushWorkflowError && error.details !== void 0) {
+    return { exitCode, message, code, details: error.details };
+  }
+  return { exitCode, message, code };
+}
+async function promptForCredentials(dependencies, missing) {
+  const serverUrl = missing === "token" ? void 0 : (await dependencies.prompt("\u670D\u52A1\u7AEF URL (https://...): ")).trim();
+  const token = missing === "url" ? void 0 : (await dependencies.prompt("API Token: ")).trim();
+  if ((missing === "url" || missing === "both") && (serverUrl === void 0 || serverUrl === "")) {
+    return null;
+  }
+  if ((missing === "token" || missing === "both") && (token === void 0 || token === "")) {
+    return null;
+  }
+  if (serverUrl !== void 0 && serverUrl !== "") {
+    try {
+      assertHttpsServerUrl(serverUrl);
+    } catch (error) {
+      if (error instanceof InvalidCredentialsError) {
+        dependencies.stderr(error.message + "\n");
+        return null;
+      }
+      throw error;
+    }
+  }
+  return {
+    ...serverUrl === void 0 ? {} : { serverUrl },
+    ...token === void 0 ? {} : { token }
+  };
+}
 async function runPush(options, dependencies) {
   const requestId = uuidV7();
   if (options.nonInteractive === true && options.yes !== true && options.dryRun !== true) {
     dependencies.stderr("\u975E\u4EA4\u4E92\u6A21\u5F0F\u63A8\u9001\u9700\u8981 --yes\n");
     return 2;
   }
-  try {
-    const result = await pushProject({
-      projectRoot: dependencies.cwd,
-      resourcesRoot: dependencies.resourcesRoot,
-      ...options.serverUrl === void 0 ? {} : { serverUrl: options.serverUrl },
-      ...options.tokenEnv === void 0 ? {} : { tokenEnv: options.tokenEnv },
-      env: dependencies.env,
-      dryRun: options.dryRun === true,
-      fetch: dependencies.fetch,
-      ...options.yes === true || options.nonInteractive === true ? {} : { confirmProposal: async () => {
-        const answer = await dependencies.prompt("Create this proposal? [y/N]: ");
-        return /^(?:y|yes)$/i.test(answer.trim());
-      } }
-    });
-    if ("cancelled" in result && result.cancelled === true) {
-      return 2;
-    }
-    const items = result.preview.operations.map((operation) => ({
-      path: operation.operation === "rename" ? operation.to_path : operation.path,
-      operation: operation.operation,
-      file_kind: operation.file_kind,
-      status: options.dryRun === true ? "planned" : "submitted",
-      reason: null,
-      size_bytes: "size_bytes" in operation ? operation.size_bytes : 0,
-      content_sha256: "content_sha256" in operation ? operation.content_sha256 : operation.tombstone.previous_sha256
-    }));
-    const output = {
-      schema_version: 1,
-      command: "push",
-      request_id: requestId,
-      dry_run: options.dryRun === true,
-      ok: true,
-      exit_code: 0,
-      project_id: result.projectId,
-      summary: {
-        planned: result.preview.operations.length,
-        submitted: options.dryRun === true ? 0 : result.preview.operations.length,
-        skipped: result.preview.skipped.length,
-        findings: result.preview.security.findings.length
-      },
-      items,
-      warnings: result.preview.skipped,
-      errors: []
-    };
-    dependencies.stdout(options.json === true ? serializeCliResult(output) : options.dryRun === true ? "Push preview contains " + items.length + " operations.\n" : "Pushed artifact " + result.artifactId + " (proposal " + result.proposalId + ").\n");
-    return 0;
-  } catch (error) {
-    const exitCode = error instanceof PushWorkflowError ? error.exitCode : 1;
-    const message = error instanceof Error ? error.message : String(error);
-    dependencies.stderr(message + "\n");
-    if (options.json === true) {
-      dependencies.stdout(serializeCliResult({
+  if (options.nonInteractive === true && options.skipSensitiveScan === true && options.yes !== true) {
+    dependencies.stderr("\u975E\u4EA4\u4E92\u8DF3\u8FC7\u654F\u611F\u626B\u63CF\u9700\u8981 --yes\n");
+    return 2;
+  }
+  async function executePush(attempt = 0) {
+    try {
+      const result = await pushProject({
+        projectRoot: dependencies.cwd,
+        resourcesRoot: dependencies.resourcesRoot,
+        ...options.serverUrl === void 0 ? {} : { serverUrl: options.serverUrl },
+        ...options.tokenEnv === void 0 ? {} : { tokenEnv: options.tokenEnv },
+        env: dependencies.env,
+        dryRun: options.dryRun === true,
+        fetch: dependencies.fetch,
+        ...options.skipSensitiveScan === true ? { sensitiveScanSkip: true } : {},
+        ...options.yes === true || options.nonInteractive === true ? {} : { confirmProposal: async () => {
+          const answer = await dependencies.prompt("Create this proposal? [y/N]: ");
+          return /^(?:y|yes)$/i.test(answer.trim());
+        } },
+        ...options.yes === true || options.nonInteractive === true || options.skipSensitiveScan === true ? {} : { confirmSensitiveScanSkip: async (preview) => {
+          dependencies.stderr(formatFindings({
+            findings: preview.security.findings.filter((finding) => finding.disposition === "blocked").map((finding) => ({
+              path: finding.path,
+              rule_id: finding.rule_id,
+              severity: finding.severity,
+              overridable: finding.overridable,
+              fingerprint: finding.fingerprint,
+              line: finding.line,
+              column: finding.column
+            })),
+            finding_count: preview.security.findings.filter(
+              (finding) => finding.disposition === "blocked"
+            ).length,
+            scanner_version: preview.security.scanner_version
+          }));
+          const answer = await dependencies.prompt(
+            "\u654F\u611F\u626B\u63CF\u5DF2\u963B\u65AD\u63A8\u9001\u3002\u662F\u5426\u663E\u5F0F\u8DF3\u8FC7\u5E76\u7EE7\u7EED\uFF1F[y/N]: "
+          );
+          if (!/^(?:y|yes)$/i.test(answer.trim())) {
+            return "cancelled";
+          }
+          const reasonAnswer = await dependencies.prompt("\u8DF3\u8FC7\u539F\u56E0\uFF08\u53EF\u9009\uFF0C\u56DE\u8F66\u8DF3\u8FC7\uFF09: ");
+          const reason = reasonAnswer.trim();
+          return reason === "" ? { skip: true } : { skip: true, reason };
+        } }
+      });
+      if ("cancelled" in result && result.cancelled === true) {
+        return 2;
+      }
+      const items = result.preview.operations.map((operation) => ({
+        path: operation.operation === "rename" ? operation.to_path : operation.path,
+        operation: operation.operation,
+        file_kind: operation.file_kind,
+        status: options.dryRun === true ? "planned" : "submitted",
+        reason: null,
+        size_bytes: "size_bytes" in operation ? operation.size_bytes : 0,
+        content_sha256: "content_sha256" in operation ? operation.content_sha256 : operation.tombstone.previous_sha256
+      }));
+      const output = {
         schema_version: 1,
         command: "push",
         request_id: requestId,
         dry_run: options.dryRun === true,
-        ok: false,
-        exit_code: exitCode,
-        project_id: null,
-        summary: { planned: 0, submitted: 0 },
-        items: [],
-        warnings: [],
-        errors: [{
-          code: error instanceof PushWorkflowError ? error.code : "GENERAL_FAILURE",
-          message
-        }]
-      }));
+        ok: true,
+        exit_code: 0,
+        project_id: result.projectId,
+        summary: {
+          planned: result.preview.operations.length,
+          submitted: options.dryRun === true ? 0 : result.preview.operations.length,
+          skipped: result.preview.skipped.length,
+          findings: result.preview.security.findings.length
+        },
+        items,
+        warnings: result.preview.skipped,
+        errors: []
+      };
+      dependencies.stdout(options.json === true ? serializeCliResult(output) : options.dryRun === true ? "Push preview contains " + items.length + " operations.\n" : "Pushed artifact " + result.artifactId + " (proposal " + result.proposalId + ").\n");
+      return 0;
+    } catch (error) {
+      if (attempt === 0 && options.nonInteractive !== true && options.dryRun !== true && error instanceof PushWorkflowError && (error.code === "SERVER_URL_REQUIRED" || error.code === "TOKEN_INVALID")) {
+        const missing = error.code === "SERVER_URL_REQUIRED" ? "url" : error.code === "TOKEN_INVALID" ? "token" : "both";
+        dependencies.stderr(
+          error.message + "\n\u53EF\u5728\u4E0B\u65B9\u5F55\u5165\u5E76\u5199\u5165 .harness/credentials.local.yaml\u3002\n"
+        );
+        const entered = await promptForCredentials(dependencies, missing);
+        if (entered !== null) {
+          const existing = await readLocalCredentials(dependencies.cwd);
+          try {
+            await writeLocalCredentials(dependencies.cwd, mergeLocalCredentials(existing, {
+              ...entered.serverUrl === void 0 ? {} : { server_url: entered.serverUrl },
+              ...entered.token === void 0 ? {} : { token: entered.token }
+            }));
+          } catch (error2) {
+            if (error2 instanceof InvalidCredentialsError) {
+              dependencies.stderr(error2.message + "\n");
+              return 3;
+            }
+            throw error2;
+          }
+          await ensureCredentialsGitignore(dependencies.cwd);
+          dependencies.stderr(
+            "\u5DF2\u5199\u5165 .harness/credentials.local.yaml\uFF1Bupload session \u7531 CLI \u81EA\u52A8\u7BA1\u7406\uFF0C\u65E0\u9700\u624B\u914D\u3002\n"
+          );
+          return executePush(attempt + 1);
+        }
+      }
+      const payload = errorPayload(error);
+      dependencies.stderr(payload.message + "\n");
+      dependencies.stderr(formatFindings(payload.details));
+      if (options.json === true) {
+        dependencies.stdout(serializeCliResult({
+          schema_version: 1,
+          command: "push",
+          request_id: requestId,
+          dry_run: options.dryRun === true,
+          ok: false,
+          exit_code: payload.exitCode,
+          project_id: null,
+          summary: { planned: 0, submitted: 0 },
+          items: [],
+          warnings: [],
+          errors: [{
+            code: payload.code,
+            message: payload.message,
+            ...payload.details === void 0 ? {} : { details: payload.details }
+          }]
+        }));
+      }
+      return payload.exitCode;
     }
-    return exitCode;
   }
+  return executePush();
 }
 
 // src/commands/update.ts
@@ -4904,7 +5345,7 @@ async function runUpdate(options, dependencies) {
 
 // src/commands/recovery.ts
 import { stat as stat4 } from "node:fs/promises";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 async function exists4(path) {
   try {
     await stat4(path);
@@ -4964,7 +5405,7 @@ async function runRecoveryMenuIfApplicable(options, dependencies) {
       return 5;
     }
   }
-  const initialized = await exists4(join15(dependencies.cwd, ".harness", "project.yaml"));
+  const initialized = await exists4(join16(dependencies.cwd, ".harness", "project.yaml"));
   if (!initialized || options.nonInteractive === true || explicitConfigure(options)) {
     return null;
   }
@@ -5007,8 +5448,8 @@ async function runRecoveryMenuIfApplicable(options, dependencies) {
 }
 
 // src/workflow-data/resolve.ts
-import { cp, mkdir as mkdir4, readdir as readdir7, readFile as readFile14, rm as rm8, stat as stat5 } from "node:fs/promises";
-import { dirname as dirname4, join as join16, relative as relative2 } from "node:path";
+import { cp, mkdir as mkdir4, readdir as readdir7, readFile as readFile15, rm as rm8, stat as stat5 } from "node:fs/promises";
+import { dirname as dirname4, join as join17, relative as relative2 } from "node:path";
 import { fileURLToPath } from "node:url";
 var WorkflowDataResolutionError = class extends Error {
   code;
@@ -5045,14 +5486,14 @@ async function listFilesRecursive(root, base = root) {
   const entries = await readdir7(root, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const absolute = join16(root, entry.name);
+    const absolute = join17(root, entry.name);
     if (entry.isDirectory()) {
       files.push(...await listFilesRecursive(absolute, base));
       continue;
     }
     if (!entry.isFile()) continue;
     const rel = relative2(base, absolute).replaceAll("\\", "/");
-    files.push({ path: rel, content: await readFile14(absolute, "utf8") });
+    files.push({ path: rel, content: await readFile15(absolute, "utf8") });
   }
   return files;
 }
@@ -5065,7 +5506,7 @@ async function verifyWorkflowPackageIntegrity(resourcesRoot) {
   const manifest = await readWorkflowFamilyManifest(resourcesRoot);
   const expected = manifest.content_sha256;
   if (typeof expected !== "string" || expected.length === 0) return;
-  const harnessRoot = join16(resourcesRoot, "harness");
+  const harnessRoot = join17(resourcesRoot, "harness");
   if (!await pathExists3(harnessRoot)) {
     throw new WorkflowDataResolutionError(
       "\u5DE5\u4F5C\u6D41\u6570\u636E\u5305\u7F3A\u5C11 harness/\uFF0C\u65E0\u6CD5\u6821\u9A8C SHA-256",
@@ -5084,31 +5525,40 @@ async function verifyWorkflowPackageIntegrity(resourcesRoot) {
   }
 }
 async function monorepoResourcesRoot() {
+  const here = dirname4(fileURLToPath(import.meta.url));
   const candidates = [
-    fileURLToPath(new URL("../../../resources", import.meta.url)),
-    fileURLToPath(new URL("../../../workflow-data-harness", import.meta.url)),
-    fileURLToPath(new URL("../../../../resources", import.meta.url))
+    // TypeScript source: packages/cli/src/workflow-data -> packages/workflow-data-harness.
+    join17(here, "../../../workflow-data-harness"),
+    // Bundled CLI: packages/cli/dist -> packages/workflow-data-harness.
+    join17(here, "../../workflow-data-harness"),
+    // Test/build layouts that preserve additional source directory levels.
+    join17(here, "../../../../packages/workflow-data-harness")
   ];
   for (const candidate of candidates) {
-    if (await pathExists3(join16(candidate, "harness", "manifests"))) return candidate;
+    if (await pathExists3(join17(candidate, "harness", "manifests"))) return candidate;
   }
   return null;
 }
 async function siblingWorkflowPackage(cwd) {
+  const here = dirname4(fileURLToPath(import.meta.url));
   const candidates = [
-    join16(cwd, "node_modules", "@hunter-harness", "workflow-harness"),
-    join16(dirname4(fileURLToPath(import.meta.url)), "..", "..", "workflow-data-harness")
+    join17(cwd, "node_modules", "@hunter-harness", "workflow-harness"),
+    // Published layout: node_modules/hunter-harness/dist/bin.js alongside the
+    // scoped workflow package in node_modules/@hunter-harness/workflow-harness.
+    join17(here, "..", "..", "@hunter-harness", "workflow-harness"),
+    // Monorepo bundled layout: packages/cli/dist/bin.js.
+    join17(here, "..", "..", "workflow-data-harness")
   ];
   for (const candidate of candidates) {
-    if (await pathExists3(join16(candidate, "harness", "manifests"))) return candidate;
+    if (await pathExists3(join17(candidate, "harness", "manifests"))) return candidate;
   }
   return null;
 }
 async function readCachedNpmPackageVersion(cacheRoot) {
-  const manifestPath = join16(cacheRoot, "package.json");
+  const manifestPath = join17(cacheRoot, "package.json");
   if (!await pathExists3(manifestPath)) return null;
   try {
-    const pkg = JSON.parse(await readFile14(manifestPath, "utf8"));
+    const pkg = JSON.parse(await readFile15(manifestPath, "utf8"));
     return typeof pkg.version === "string" && pkg.version.length > 0 ? pkg.version : null;
   } catch {
     return null;
@@ -5131,12 +5581,12 @@ async function latestWorkflowCacheIsStale(cacheRoot, packageName, resolveManifes
 }
 async function materializeWorkflowPackageCache(cacheRoot, packageSpec, extract) {
   await mkdir4(cacheRoot, { recursive: true });
-  const staging = join16(cacheRoot, ".extract");
+  const staging = join17(cacheRoot, ".extract");
   await rm8(staging, { recursive: true, force: true });
   await mkdir4(staging, { recursive: true });
   await extract(packageSpec, staging);
-  const packageDir = await pathExists3(join16(staging, "harness", "manifests")) ? staging : join16(staging, "package");
-  if (!await pathExists3(join16(packageDir, "harness", "manifests"))) {
+  const packageDir = await pathExists3(join17(staging, "harness", "manifests")) ? staging : join17(staging, "package");
+  if (!await pathExists3(join17(packageDir, "harness", "manifests"))) {
     throw new WorkflowDataResolutionError(
       "\u5DE5\u4F5C\u6D41\u6570\u636E\u5305\u5185\u5BB9\u65E0\u6548\uFF1A\u7F3A\u5C11 harness/manifests",
       "WORKFLOW_DATA_INVALID",
@@ -5165,8 +5615,8 @@ async function resolveWorkflowResourcesRoot(options, argv = []) {
   const packageName = workflowPackageName(family, options.env);
   const packageSpec = version === "latest" ? packageName : `${packageName}@${version}`;
   const cacheKey = packageSpec.replace("/", "+");
-  const cacheRoot = join16(options.cwd, ".harness", "cache", "workflow-packages", cacheKey);
-  if (await pathExists3(join16(cacheRoot, "harness", "manifests"))) {
+  const cacheRoot = join17(options.cwd, ".harness", "cache", "workflow-packages", cacheKey);
+  if (await pathExists3(join17(cacheRoot, "harness", "manifests"))) {
     if (version === "latest") {
       const stale = await latestWorkflowCacheIsStale(cacheRoot, packageName, options.pacoteManifest);
       if (stale) {
@@ -5212,9 +5662,9 @@ function describeWorkflowDataFetchFailure(error, packageSpec) {
   return `\u65E0\u6CD5\u83B7\u53D6\u5DE5\u4F5C\u6D41\u6570\u636E\u5305 ${packageSpec}\uFF1A\u672C\u5730\u7F13\u5B58\u4E0D\u5B58\u5728\u4E14\u83B7\u53D6\u5931\u8D25\u3002\u53EF${hintRoot}\u3002\u539F\u56E0\uFF1A${code !== "" ? code + " " : ""}${detail}`;
 }
 async function readWorkflowFamilyManifest(resourcesRoot) {
-  const manifestPath = join16(resourcesRoot, "hunter-workflow-family.json");
+  const manifestPath = join17(resourcesRoot, "hunter-workflow-family.json");
   if (!await pathExists3(manifestPath)) return {};
-  return JSON.parse(await readFile14(manifestPath, "utf8"));
+  return JSON.parse(await readFile15(manifestPath, "utf8"));
 }
 
 // src/bin.ts
@@ -5283,7 +5733,7 @@ async function runCli(argv, overrides = {}) {
       dependencies
     );
   });
-  addCommonOptions(program.command("push")).description("\u521B\u5EFA\u53D7\u6CBB\u7406\u7684\u53D8\u66F4\u63D0\u6848").action(async (options) => {
+  addCommonOptions(program.command("push")).description("\u521B\u5EFA\u53D7\u6CBB\u7406\u7684\u53D8\u66F4\u63D0\u6848").option("--skip-sensitive-scan", "\u663E\u5F0F\u8DF3\u8FC7\u654F\u611F\u626B\u63CF\u963B\u65AD\uFF08\u975E\u4EA4\u4E92\u9700\u914D\u5408 --yes\uFF09").action(async (options) => {
     exitCode = await runPush({ ...program.opts(), ...options }, dependencies);
   });
   addCommonOptions(program.command("cleanup")).description("\u6E05\u7406\u5DF2\u5B8C\u6210\u4E8B\u52A1\u548C\u8FC7\u671F\u670D\u52A1\u7AEF\u7F13\u5B58").action(async (options) => {