@haus-tech/haus-workflow 0.1.0 → 0.2.2

package/dist/cli.js

@@ -2,12 +2,12 @@
 
 // src/cli.ts
 import { readFileSync as readFileSync3 } from "fs";
-import path25 from "path";
+import path26 from "path";
 import { Command } from "commander";
 
-// src/claude/write-claude-files.ts
-import path9 from "path";
-import fs8 from "fs-extra";
+// src/commands/apply.ts
+import path10 from "path";
+import checkbox from "@inquirer/checkbox";
 
 // src/catalog/remote-catalog.ts
 import os from "os";
@@ -27,7 +27,7 @@ var error = (msg, ...args) => {
 
 // src/catalog/constants.ts
 var CATALOG_REPO_URL = "https://raw.githubusercontent.com/wearehaustech/haus-workflow-catalog";
-var CATALOG_REF = "main";
+var CATALOG_REF = process.env.HAUS_CATALOG_REF ?? "main";
 var CATALOG_CACHE_SUBDIR = ".claude/haus/catalog-cache";
 
 // src/catalog/remote-catalog.ts
@@ -129,6 +129,21 @@ async function syncRemoteCatalog() {
   }
   return { newItems, unchanged, failed };
 }
+var CATALOG_TAGS_API_URL = "https://api.github.com/repos/WeAreHausTech/haus-workflow-catalog/tags";
+async function fetchLatestCatalogTag() {
+  if (process.env["HAUS_CATALOG_REMOTE_BASE"]) return null;
+  try {
+    const res = await fetch(CATALOG_TAGS_API_URL, {
+      signal: AbortSignal.timeout(5e3),
+      headers: { Accept: "application/vnd.github+json" }
+    });
+    if (!res.ok) return null;
+    const tags = await res.json();
+    return tags[0]?.name ?? null;
+  } catch {
+    return null;
+  }
+}
 async function getCacheManifestAge() {
   try {
     const stat = await fs.stat(path.join(CACHE_DIR, "manifest.json"));
@@ -138,6 +153,10 @@ async function getCacheManifestAge() {
   }
 }
 
+// src/claude/write-claude-files.ts
+import path9 from "path";
+import fs8 from "fs-extra";
+
 // src/update/hash-installed.ts
 import path3 from "path";
 import fg2 from "fast-glob";
@@ -605,7 +624,7 @@ ${templateContent}`;
 }
 
 // src/claude/write-claude-files.ts
-async function writeClaudeFiles(root, dryRun) {
+async function writeClaudeFiles(root, dryRun, selectedIds) {
   const rec = await readJson(hausPath(root, "recommendation.json")) ?? {
     mode: "fast",
     recommended: [],
@@ -656,15 +675,17 @@ async function writeClaudeFiles(root, dryRun) {
     "- Never read secrets.\n- Block dangerous shell commands.\n",
     dryRun
   );
-  const manifest = await readJson(
-    path9.join(pkgRoot, "library", "catalog", "manifest.json")
-  ) ?? { items: [] };
+  const fixtureManifestPath = process.env["HAUS_FIXTURE_CATALOG"];
+  const manifestPath = fixtureManifestPath ?? path9.join(pkgRoot, "library", "catalog", "manifest.json");
+  const manifestDir = path9.dirname(manifestPath);
+  const manifest = await readJson(manifestPath) ?? { items: [] };
   const manifestById = new Map((manifest.items ?? []).map((item) => [item.id, item]));
   const cacheManifest = await readJson(path9.join(CACHE_DIR, "manifest.json"));
   const cacheManifestById = new Map((cacheManifest?.items ?? []).map((item) => [item.id, item]));
   const installedPathsByItem = /* @__PURE__ */ new Map();
   const installedIds = /* @__PURE__ */ new Set();
-  for (const item of rec.recommended) {
+  const catalogItems = selectedIds !== void 0 ? rec.recommended.filter((r) => selectedIds.includes(r.id)) : rec.recommended;
+  for (const item of catalogItems) {
     const manifestItem = manifestById.get(item.id);
     if (!manifestItem?.path) continue;
     if (manifestItem.source === "curated") {
@@ -681,8 +702,8 @@ async function writeClaudeFiles(root, dryRun) {
     }
     const cachedItem = cacheManifestById.get(item.id);
     const cachePath = cachedItem?.path ? path9.join(CACHE_DIR, cachedItem.path) : null;
-    const sourcePath = cachePath && await fs8.pathExists(cachePath) ? cachePath : path9.join(pkgRoot, manifestItem.path);
-    const target = item.type === "agent" ? "agents" : "skills";
+    const sourcePath = cachePath && await fs8.pathExists(cachePath) ? cachePath : path9.join(manifestDir, manifestItem.path);
+    const target = item.type === "agent" ? "agents" : item.type === "template" ? "templates" : "skills";
     const destination = claudePath(root, target, path9.basename(sourcePath));
     if (await fs8.pathExists(sourcePath)) {
       if (dryRun) {
@@ -701,7 +722,7 @@ async function writeClaudeFiles(root, dryRun) {
     }
   }
   if (dryRun) return [...new Set(files)];
-  const installedItems = rec.recommended.filter((r) => installedIds.has(r.id));
+  const installedItems = catalogItems.filter((r) => installedIds.has(r.id));
   await writeManagedJson(
     root,
     hausPath(root, "selected-context.json"),
@@ -718,6 +739,7 @@ async function writeClaudeFiles(root, dryRun) {
         type: r.type,
         source: isCurated ? "curated" : "haus",
         version: hausVersion,
+        catalogRef: CATALOG_REF,
         hash: await hashInstalledPaths(root, relPaths),
         installMode: "copied",
         paths: relPaths
@@ -763,6 +785,10 @@ async function writeManagedJson(root, filePath, value, dryRun) {
 }
 
 // src/commands/apply.ts
+async function cacheHasItems() {
+  const data = await readJson(path10.join(CACHE_DIR, "manifest.json"));
+  return Array.isArray(data?.items) && data.items.length > 0;
+}
 async function runApply(options) {
   if (!options.dryRun && !options.write) {
     log("Use --dry-run or --write");
@@ -770,7 +796,52 @@ async function runApply(options) {
   }
   const root = process.cwd();
   const isDryRun = Boolean(options.dryRun) && !options.write;
-  const files = await writeClaudeFiles(root, isDryRun);
+  let selectedIds;
+  if (options.select) {
+    if (!process.stdin.isTTY) {
+      error("--select requires an interactive terminal (stdin is not a TTY)");
+      process.exitCode = 1;
+      return;
+    }
+    const rec = await readJson(hausPath(root, "recommendation.json"));
+    if (!rec) {
+      log("No recommendation.json found \u2014 run `haus recommend` first. Writing core files only.");
+      selectedIds = [];
+    } else if (rec.recommended.length === 0) {
+      log("Recommendation contains no catalog items. Writing core files only.");
+      selectedIds = [];
+    } else {
+      const items = rec.recommended;
+      const choices = items.map((item) => ({
+        name: `${item.id}  [${item.confidenceLevel}] \u2014 ${item.reason}`,
+        value: item.id,
+        checked: true
+      }));
+      const chosen = await checkbox({
+        message: "Select catalog items to apply (space to toggle, enter to confirm):",
+        choices,
+        pageSize: Math.min(20, items.length + 2)
+      });
+      selectedIds = chosen;
+      log(`Selected ${selectedIds.length} of ${items.length} catalog items.`);
+    }
+  }
+  if (!options.allowEmptyCache && !process.env["HAUS_FIXTURE_CATALOG"]) {
+    const rec = await readJson(hausPath(root, "recommendation.json"));
+    const catalogItemCount = selectedIds !== void 0 ? selectedIds.length : rec?.recommended.length ?? 0;
+    if (catalogItemCount > 0 && !await cacheHasItems()) {
+      if (isDryRun) {
+        warn("Catalog cache is empty \u2014 `haus apply --write` will skip catalog items. Run `haus update` first.");
+      } else {
+        error(
+          "Catalog cache is empty \u2014 cannot install catalog items. Run `haus update` first, or pass --allow-empty-cache to apply core files only."
+        );
+        process.exitCode = 1;
+        return;
+      }
+    }
+  }
+  const files = await writeClaudeFiles(root, isDryRun, selectedIds);
   if (isDryRun) {
     log(`Dry-run complete \u2014 ${files.length} file(s) planned, none written. Run --write to apply.`);
   } else {
@@ -781,8 +852,8 @@ async function runApply(options) {
 
 // src/catalog/load-catalog.ts
 import os4 from "os";
-import path10 from "path";
-var CACHE_MANIFEST = path10.join(os4.homedir(), CATALOG_CACHE_SUBDIR, "manifest.json");
+import path11 from "path";
+var CACHE_MANIFEST = path11.join(os4.homedir(), CATALOG_CACHE_SUBDIR, "manifest.json");
 async function loadCatalog(root) {
   const envPath = process.env["HAUS_FIXTURE_CATALOG"];
   if (envPath) {
@@ -791,10 +862,10 @@ async function loadCatalog(root) {
   }
   const cacheData = await readJson(CACHE_MANIFEST);
   if (cacheData?.items?.length) return cacheData.items;
-  const localManifest = path10.join(root, "library/catalog/manifest.json");
+  const localManifest = path11.join(root, "library/catalog/manifest.json");
   const localData = await readJson(localManifest);
   if (localData?.items?.length) return localData.items;
-  const packageManifest = path10.join(packageRoot(), "library/catalog/manifest.json");
+  const packageManifest = path11.join(packageRoot(), "library/catalog/manifest.json");
   const data = await readJson(packageManifest);
   return data?.items ?? [];
 }
@@ -1148,6 +1219,9 @@ function computeRuleIntents(rule) {
     intents.add("admin-ui");
     intents.add("storefront");
   }
+  if (eco === "tailwind" || eco === "vite") {
+    intents.add("frontend");
+  }
   if (eco === "nx" || eco === "turbo") {
     intents.add("monorepo");
   }
@@ -1167,7 +1241,7 @@ function computeRuleIntents(rule) {
 
 // src/scanner/scan-project.ts
 import { readFile } from "fs/promises";
-import path12 from "path";
+import path13 from "path";
 
 // src/utils/audit-checks.ts
 function isRecord(v) {
@@ -1194,7 +1268,7 @@ function compareVersions(a, b) {
 }
 
 // src/scanner/detect-package-manager.ts
-import path11 from "path";
+import path12 from "path";
 import fs9 from "fs-extra";
 function detectPackageManager(root, packageManagerField) {
   const field = String(packageManagerField ?? "").trim();
@@ -1213,9 +1287,9 @@ function detectPackageManager(root, packageManagerField) {
     if (satisfiesVersion(version, ">=9")) return "npm";
     return "unknown";
   }
-  if (fs9.existsSync(path11.join(root, "yarn.lock"))) return "yarn";
-  if (fs9.existsSync(path11.join(root, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs9.existsSync(path11.join(root, "package-lock.json"))) return "npm";
+  if (fs9.existsSync(path12.join(root, "yarn.lock"))) return "yarn";
+  if (fs9.existsSync(path12.join(root, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs9.existsSync(path12.join(root, "package-lock.json"))) return "npm";
   return "unknown";
 }
 
@@ -1276,8 +1350,8 @@ function blocked(rel) {
   return SENSITIVE.some((x) => x.test(rel));
 }
 async function scanProject(root, mode = "fast") {
-  const pkg = await readJson(path12.join(root, "package.json"));
-  const composer = await readJson(path12.join(root, "composer.json"));
+  const pkg = await readJson(path13.join(root, "package.json"));
+  const composer = await readJson(path13.join(root, "composer.json"));
   const files = await listFiles(root, SAFE_FILES);
   const safeFiles = files.filter((f) => !blocked(f));
   const deps = dependencySet(pkg, composer);
@@ -1303,7 +1377,7 @@ async function scanProject(root, mode = "fast") {
     mode,
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     root,
-    repoName: String(pkg?.name ?? path12.basename(root)),
+    repoName: String(pkg?.name ?? path13.basename(root)),
     packageManager,
     repoRoles: roles,
     confidence: computeConfidence(roles, stacks),
@@ -1318,7 +1392,7 @@ async function scanProject(root, mode = "fast") {
     composer: isRecord(composer?.require) ? Object.keys(composer.require) : []
   };
   const scanHashes = Object.fromEntries(
-    await Promise.all(safeFiles.map(async (f) => [f, hashText(await readFile(path12.join(root, f), "utf8"))]))
+    await Promise.all(safeFiles.map(async (f) => [f, hashText(await readFile(path13.join(root, f), "utf8"))]))
   );
   const repoSummary = renderSummary(context);
   await writeJson(hausPath(root, "context-map.json"), context);
@@ -1415,7 +1489,7 @@ async function hasNeedle(root, files, needle) {
   );
   for (const rel of candidates.slice(0, 300)) {
     try {
-      const content = await readFile(path12.join(root, rel), "utf8");
+      const content = await readFile(path13.join(root, rel), "utf8");
       if (content.includes(needle)) return true;
     } catch {
       continue;
@@ -1508,8 +1582,30 @@ async function runContext(options) {
 }
 
 // src/commands/doctor.ts
-import path13 from "path";
+import path14 from "path";
 import fs10 from "fs-extra";
+
+// src/update/npm-version.ts
+var NPM_PACKAGE_NAME = "@haus-tech/haus-workflow";
+async function fetchNpmVersionStatus(currentVersion) {
+  try {
+    const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(NPM_PACKAGE_NAME)}/latest`, {
+      signal: AbortSignal.timeout(8e3)
+    });
+    if (!res.ok) return { current: currentVersion, latest: null, updateAvailable: false };
+    const data = await res.json();
+    const latest = data?.version;
+    if (!latest || !normalizeVersion(latest) || !normalizeVersion(currentVersion)) {
+      return { current: currentVersion, latest: null, updateAvailable: false };
+    }
+    const updateAvailable = compareVersions(latest, currentVersion) > 0;
+    return { current: currentVersion, latest, updateAvailable };
+  } catch {
+    return { current: currentVersion, latest: null, updateAvailable: false };
+  }
+}
+
+// src/commands/doctor.ts
 async function runDoctor(options) {
   const root = process.cwd();
   if (options?.hooks) {
@@ -1554,7 +1650,7 @@ async function runDoctor(options) {
     const enabled = await isHookEnabled(root, key);
     log(`- HOOK ${key}: ${enabled ? "enabled" : "disabled (default)"}`);
   }
-  const rootClaudeMdPath = path13.join(root, "CLAUDE.md");
+  const rootClaudeMdPath = path14.join(root, "CLAUDE.md");
   const rootClaudeMdContent = await readText(rootClaudeMdPath);
   if (!rootClaudeMdContent) {
     warn("- CLAUDE.md: missing (run `haus apply --write` to create)");
@@ -1574,7 +1670,7 @@ async function runDoctor(options) {
       warn("- .haus-workflow/haus-way-of-work.md: no HAUS-MANAGED header (user-owned)");
     } else {
       const storedHashMatch = firstLine.match(/hash=(sha256-[a-f0-9]+)/);
-      const templatePath = path13.join(packageRoot(), "library", "global", "templates", "haus-way-of-work.md");
+      const templatePath = path14.join(packageRoot(), "library", "global", "templates", "haus-way-of-work.md");
       const templateContent = await readText(templatePath);
       if (storedHashMatch && templateContent) {
         const currentHash = hashText(templateContent);
@@ -1612,6 +1708,17 @@ async function runDoctor(options) {
       log(`- CATALOG CACHE: OK (${cacheAgeDays}d old)`);
     }
   }
+  const pkgJson = await readJson(path14.join(packageRoot(), "package.json"));
+  const currentVersion = pkgJson?.version ?? "0.0.0";
+  const npmStatus = await fetchNpmVersionStatus(currentVersion);
+  if (npmStatus.updateAvailable && npmStatus.latest !== null) {
+    warn(`- CLI UPDATE: ${currentVersion} \u2192 ${npmStatus.latest} available (run: npm install -g ${NPM_PACKAGE_NAME})`);
+    process.exitCode = 1;
+  } else if (npmStatus.latest !== null) {
+    log(`- CLI: ${currentVersion} (up to date)`);
+  } else {
+    log(`- CLI: ${currentVersion} (version check unavailable)`);
+  }
 }
 
 // src/recommender/explain-formatters.ts
@@ -1766,7 +1873,7 @@ async function runGuard(kind, _options) {
 }
 
 // src/commands/init.ts
-import path14 from "path";
+import path15 from "path";
 import fs11 from "fs-extra";
 
 // src/utils/exec.ts
@@ -2288,7 +2395,7 @@ async function runSetupProject(options) {
 // src/commands/init.ts
 async function runInit(options) {
   const root = process.cwd();
-  const hausDir = path14.join(root, ".haus-workflow");
+  const hausDir = path15.join(root, ".haus-workflow");
   const alreadyInit = await fs11.pathExists(hausDir);
   if (alreadyInit) {
     log("Haus AI already initialized in this project.");
@@ -2301,7 +2408,7 @@ async function runInit(options) {
 
 // src/install/apply.ts
 import crypto2 from "crypto";
-import path17 from "path";
+import path18 from "path";
 import fs13 from "fs-extra";
 
 // src/install/header.ts
@@ -2336,13 +2443,13 @@ ${content}`;
 
 // src/install/manifest.ts
 import os5 from "os";
-import path15 from "path";
+import path16 from "path";
 var MANIFEST_SCHEMA = "haus-install-manifest/1";
 function globalClaudeDir() {
-  return path15.join(os5.homedir(), ".claude");
+  return path16.join(os5.homedir(), ".claude");
 }
 function hausManifestPath() {
-  return path15.join(globalClaudeDir(), "haus", "install-manifest.json");
+  return path16.join(globalClaudeDir(), "haus", "install-manifest.json");
 }
 async function readManifest() {
   return readJson(hausManifestPath());
@@ -2361,10 +2468,10 @@ function buildManifest(source, files, hooks) {
 }
 
 // src/install/settings-merge.ts
-import path16 from "path";
+import path17 from "path";
 import fs12 from "fs-extra";
 function settingsJsonPath() {
-  return path16.join(globalClaudeDir(), "settings.json");
+  return path17.join(globalClaudeDir(), "settings.json");
 }
 async function readSettings() {
   const parsed = await readJson(settingsJsonPath());
@@ -2435,7 +2542,7 @@ function hashContent(content) {
 }
 function sourceVersion() {
   try {
-    const pkgPath = path17.join(packageRoot(), "package.json");
+    const pkgPath = path18.join(packageRoot(), "package.json");
     const pkg = JSON.parse(fs13.readFileSync(pkgPath, "utf8"));
     return `${pkg.name ?? "haus"}@${pkg.version ?? "0.0.0"}`;
   } catch {
@@ -2443,32 +2550,32 @@ function sourceVersion() {
   }
 }
 function globalSrcDir() {
-  return path17.join(packageRoot(), "library", "global");
+  return path18.join(packageRoot(), "library", "global");
 }
 function collectSourceFiles(srcDir, claudeDir) {
   const entries = [];
-  const skillsDir = path17.join(srcDir, "skills");
+  const skillsDir = path18.join(srcDir, "skills");
   if (fs13.pathExistsSync(skillsDir)) {
     for (const skillName of fs13.readdirSync(skillsDir)) {
-      const skillFile = path17.join(skillsDir, skillName, "SKILL.md");
+      const skillFile = path18.join(skillsDir, skillName, "SKILL.md");
       if (fs13.pathExistsSync(skillFile)) {
         entries.push({
           stableId: `skill.${skillName}`,
-          srcRelPath: path17.join("library", "global", "skills", skillName, "SKILL.md"),
-          destPath: path17.join(claudeDir, "skills", skillName, "SKILL.md")
+          srcRelPath: path18.join("library", "global", "skills", skillName, "SKILL.md"),
+          destPath: path18.join(claudeDir, "skills", skillName, "SKILL.md")
         });
       }
     }
   }
-  const agentsDir = path17.join(srcDir, "agents");
+  const agentsDir = path18.join(srcDir, "agents");
   if (fs13.pathExistsSync(agentsDir)) {
     for (const agentFile of fs13.readdirSync(agentsDir)) {
       if (!agentFile.endsWith(".md")) continue;
       const agentName = agentFile.replace(/\.md$/, "");
       entries.push({
         stableId: `agent.${agentName}`,
-        srcRelPath: path17.join("library", "global", "agents", agentFile),
-        destPath: path17.join(claudeDir, "agents", agentFile)
+        srcRelPath: path18.join("library", "global", "agents", agentFile),
+        destPath: path18.join(claudeDir, "agents", agentFile)
       });
     }
   }
@@ -2492,7 +2599,7 @@ async function applyInstall(options = {}) {
   };
   const manifestFiles = [];
   for (const entry of sourceFiles) {
-    const srcPath = path17.join(packageRoot(), entry.srcRelPath);
+    const srcPath = path18.join(packageRoot(), entry.srcRelPath);
     const rawContent = await readText(srcPath);
     if (rawContent === void 0) {
       warn(`Source file not found: ${entry.srcRelPath}`);
@@ -2548,7 +2655,7 @@ async function applyInstall(options = {}) {
       schemaVersion: SCHEMA_VERSION3
     });
   }
-  const fragmentPath = path17.join(srcDir, "settings-fragments", "hooks.json");
+  const fragmentPath = path18.join(srcDir, "settings-fragments", "hooks.json");
   const fragments = await loadHooksFragment(fragmentPath);
   const settings = await readSettings();
   const { settings: mergedSettings, addedIds } = mergeHooks(settings, fragments);
@@ -2733,12 +2840,12 @@ async function runScan(options) {
 }
 
 // src/commands/undo.ts
-import path18 from "path";
+import path19 from "path";
 import fs14 from "fs-extra";
 var CLAUDE_DIR = ".claude";
 async function runUndo(options) {
   const root = process.cwd();
-  const targets = [path18.join(root, CLAUDE_DIR), path18.join(root, HAUS_DIR)];
+  const targets = [path19.join(root, CLAUDE_DIR), path19.join(root, HAUS_DIR)];
   const existing = targets.filter((p) => fs14.existsSync(p));
   if (existing.length === 0) {
     log("Nothing to remove: no .claude/ or .haus-workflow/ in this directory.");
@@ -2746,7 +2853,7 @@ async function runUndo(options) {
   }
   if (!options.yes) {
     const ok = await confirm(
-      `Remove ${existing.map((p) => path18.relative(root, p)).join(" and ")}? This cannot be undone.`
+      `Remove ${existing.map((p) => path19.relative(root, p)).join(" and ")}? This cannot be undone.`
     );
     if (!ok) {
       log("Cancelled.");
@@ -2755,13 +2862,13 @@ async function runUndo(options) {
   }
   for (const p of existing) {
     await fs14.remove(p);
-    log(`Removed ${path18.relative(root, p)}`);
+    log(`Removed ${path19.relative(root, p)}`);
   }
 }
 
 // src/install/uninstall.ts
 import crypto3 from "crypto";
-import path19 from "path";
+import path20 from "path";
 import fs15 from "fs-extra";
 async function runUninstall(options = {}) {
   const { force = false } = options;
@@ -2789,14 +2896,14 @@ async function runUninstall(options = {}) {
       continue;
     }
     await fs15.remove(entry.destPath);
-    await pruneEmptyDir(path19.dirname(entry.destPath));
+    await pruneEmptyDir(path20.dirname(entry.destPath));
     result.deleted.push(entry.destPath);
   }
   const settings = await readSettings();
   const stripped = stripHausHooks(settings);
   await writeSettings(stripped);
   result.hooksStripped = true;
-  const hausDir = path19.join(globalClaudeDir(), "haus");
+  const hausDir = path20.join(globalClaudeDir(), "haus");
   const manifestPath = hausManifestPath();
   if (fs15.pathExistsSync(manifestPath)) {
     await fs15.remove(manifestPath);
@@ -2841,7 +2948,7 @@ async function runUninstallCommand(options) {
 }
 
 // src/commands/update.ts
-import path21 from "path";
+import path22 from "path";
 
 // src/update/diff-generated-files.ts
 function diffGeneratedFiles() {
@@ -2868,11 +2975,12 @@ function summarizeLockDiff(before, after) {
 
 // src/update/lockfile.ts
 import { mkdir, readFile as readFile2, copyFile } from "fs/promises";
-import path20 from "path";
+import path21 from "path";
 async function checkLock(root) {
   const lock = await readJson(hausPath(root, "haus.lock.json")) ?? [];
   const hasValidVersions = lock.every((item) => !item.version || normalizeVersion(item.version) !== null);
-  return { ok: lock.length > 0 && hasValidVersions, count: lock.length };
+  const catalogRef = lock[0]?.catalogRef ?? null;
+  return { ok: lock.length > 0 && hasValidVersions, count: lock.length, catalogRef };
 }
 async function applyLock(root) {
   const lockPath = hausPath(root, "haus.lock.json");
@@ -2886,7 +2994,7 @@ async function applyLock(root) {
   try {
     const backupDir = hausPath(root, "backups");
     await mkdir(backupDir, { recursive: true });
-    await copyFile(lockPath, path20.join(backupDir, `haus.lock.${Date.now()}.json`));
+    await copyFile(lockPath, path21.join(backupDir, `haus.lock.${Date.now()}.json`));
   } catch {
   }
   const enriched = await Promise.all(
@@ -2908,7 +3016,7 @@ function diffLock(before, after) {
 }
 async function hasLocalOverrides(root) {
   try {
-    await readFile2(path20.join(root, ".claude", "settings.json"), "utf8");
+    await readFile2(path21.join(root, ".claude", "settings.json"), "utf8");
     return true;
   } catch {
     return false;
@@ -2916,35 +3024,29 @@ async function hasLocalOverrides(root) {
 }
 
 // src/commands/update.ts
-var NPM_PACKAGE_NAME = "@haus-tech/haus-workflow";
-async function checkNpmVersion(currentVersion) {
-  try {
-    const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(NPM_PACKAGE_NAME)}/latest`, {
-      signal: AbortSignal.timeout(8e3)
-    });
-    if (!res.ok) return;
-    const data = await res.json();
-    const latest = data?.version;
-    if (!latest || !normalizeVersion(latest) || !normalizeVersion(currentVersion)) return;
-    if (compareVersions(latest, currentVersion) > 0) {
-      log(`npm update available: ${currentVersion} \u2192 ${latest}`);
-      log(`Run: npm install -g ${NPM_PACKAGE_NAME}`);
-    } else {
-      log(`npm package up to date: ${currentVersion}`);
-    }
-  } catch {
-  }
-}
+var NPM_PACKAGE_NAME2 = "@haus-tech/haus-workflow";
 async function runUpdate(options) {
   const root = process.cwd();
   if (options.check) {
-    const status = await checkLock(root);
+    const pkgJson2 = await readJson(path22.join(packageRoot(), "package.json"));
+    const currentVersion2 = pkgJson2?.version ?? "0.0.0";
+    const [status, npmVersion, latestCatalogTag] = await Promise.all([
+      checkLock(root),
+      fetchNpmVersionStatus(currentVersion2),
+      fetchLatestCatalogTag()
+    ]);
+    const installedRef = status.catalogRef ?? "main";
+    const catalogRefBehind = latestCatalogTag !== null && installedRef !== latestCatalogTag ? `installed from ${installedRef}, latest tag is ${latestCatalogTag}` : false;
     log(
       JSON.stringify(
         {
           ...status,
+          installedCatalogRef: installedRef,
+          latestCatalogTag,
+          catalogRefBehind,
           localOverrides: await hasLocalOverrides(root),
-          summary: diffGeneratedFiles()
+          summary: diffGeneratedFiles(),
+          npmVersion
         },
         null,
         2
@@ -2953,9 +3055,15 @@ async function runUpdate(options) {
     if (!status.ok) process.exitCode = 1;
     return;
   }
-  const pkgJson = await readJson(path21.join(packageRoot(), "package.json"));
+  const pkgJson = await readJson(path22.join(packageRoot(), "package.json"));
   const currentVersion = pkgJson?.version ?? "0.0.0";
-  await checkNpmVersion(currentVersion);
+  const npmStatus = await fetchNpmVersionStatus(currentVersion);
+  if (npmStatus.updateAvailable && npmStatus.latest !== null) {
+    log(`npm update available: ${currentVersion} \u2192 ${npmStatus.latest}`);
+    log(`Run: npm install -g ${NPM_PACKAGE_NAME2}`);
+  } else if (npmStatus.latest !== null) {
+    log(`npm package up to date: ${currentVersion}`);
+  }
   if (await hasLocalOverrides(root)) {
     log("Local .claude overrides detected. Preserving local files; only lockfile updated.");
   }
@@ -2977,17 +3085,18 @@ async function runUpdate(options) {
 }
 
 // src/commands/validate-catalog.ts
-import path23 from "path";
+import fs16 from "fs";
+import path24 from "path";
 
 // src/catalog/allowed-stacks.ts
-import path22 from "path";
+import path23 from "path";
 async function readAllowedStacks(root) {
-  const data = await readJson(path22.join(root, "library", "catalog", "allowed-stacks.json"));
+  const data = await readJson(path23.join(root, "library", "catalog", "allowed-stacks.json"));
   return data?.stacks ?? [];
 }
 
-// src/commands/validate-catalog.ts
-var FORBIDDEN2 = [
+// src/catalog/validation-rules.ts
+var FORBIDDEN_TAGS = [
   "python",
   "django",
   "go",
@@ -3004,18 +3113,28 @@ var FORBIDDEN2 = [
   "defi",
   "trading"
 ];
-async function auditForbiddenStacks(items) {
+var BANNED_AGENT_PHRASES = ["autonomous", "swarm", "delegate", "orchestrat", "marketplace"];
+var REQUIRED_SKILL_SECTIONS = ["## Use when", "## Do not use when"];
+var REQUIRED_AGENT_SECTIONS = ["## Use when", "## Do not use when", "## Verification"];
+var RISKY_INSTALL_PATTERNS = [/\bnpx\s+-y\b/i, /\bnpx\s+--yes\b/i, /\byarn\s+dlx\b/i, /\bpnpm\s+dlx\b/i];
+var ALLOWED_NPX_PATTERN = /\bnpx\s+tsx\b/i;
+var ANY_NPX_PATTERN = /\bnpx\s+\S+/i;
+var HTTP_URL_PATTERN = /^http:\/\//i;
+var PLACEHOLDER_PATTERN = /\bTODO\b|\bPLACEHOLDER\b/i;
+
+// src/commands/validate-catalog.ts
+function auditForbiddenStacks(items) {
   const failures = [];
   for (const item of items) {
     const tags = Array.isArray(item.tags) ? item.tags : [];
     const text = `${item.id} ${tags.join(" ")}`.toLowerCase();
-    for (const word of FORBIDDEN2) {
+    for (const word of FORBIDDEN_TAGS) {
       if (text.includes(word)) failures.push(`${item.id}: unsupported stack/tag "${word}"`);
     }
   }
   return failures;
 }
-async function auditManifestStructure(items) {
+function auditManifestStructure(items) {
   const failures = [];
   const seenIds = /* @__PURE__ */ new Map();
   const seenPaths = /* @__PURE__ */ new Map();
@@ -3041,7 +3160,7 @@ async function auditManifestStructure(items) {
     } else {
       seenIds.set(item.id, i);
     }
-    if (item.type === "skill" || item.type === "agent") {
+    if (item.type === "skill" || item.type === "agent" || item.type === "template") {
       if (!item.path) {
         failures.push(`${item.id}: missing path`);
       } else {
@@ -3059,7 +3178,7 @@ async function auditManifestStructure(items) {
         failures.push(`${item.id}: source must be "haus" or curated with reviewStatus "approved"`);
       }
       for (const ref of item.references ?? []) {
-        if (/^http:\/\//i.test(ref)) {
+        if (HTTP_URL_PATTERN.test(ref)) {
           failures.push(`${item.id}: reference uses insecure http:// URL: ${ref}`);
         }
       }
@@ -3067,13 +3186,84 @@ async function auditManifestStructure(items) {
   }
   return failures;
 }
+function auditShippedFiles(manifestDir, items) {
+  const failures = [];
+  for (const item of items) {
+    if (!item.path) continue;
+    const absPath = path24.join(manifestDir, item.path);
+    if (item.type === "skill") {
+      const skillMd = path24.join(absPath, "SKILL.md");
+      if (!fs16.existsSync(skillMd)) {
+        failures.push(`${item.id}: missing ${path24.relative(manifestDir, skillMd)}`);
+        continue;
+      }
+      const text = fs16.readFileSync(skillMd, "utf8");
+      for (const section of REQUIRED_SKILL_SECTIONS) {
+        if (!text.includes(section)) failures.push(`${item.id}: SKILL.md missing ${section}`);
+      }
+    } else if (item.type === "agent") {
+      if (!fs16.existsSync(absPath)) {
+        failures.push(`${item.id}: missing agent file ${item.path}`);
+        continue;
+      }
+      const text = fs16.readFileSync(absPath, "utf8");
+      if (!text.startsWith("---")) failures.push(`${item.id}: agent file missing YAML frontmatter`);
+      for (const section of REQUIRED_AGENT_SECTIONS) {
+        if (!text.includes(section)) failures.push(`${item.id}: agent file missing ${section}`);
+      }
+      const lower = text.toLowerCase();
+      for (const phrase of BANNED_AGENT_PHRASES) {
+        if (lower.includes(phrase)) failures.push(`${item.id}: agent file contains disallowed phrase "${phrase}"`);
+      }
+    } else if (item.type === "template") {
+      if (!fs16.existsSync(absPath)) {
+        failures.push(`${item.id}: missing template file ${item.path}`);
+      }
+    }
+  }
+  return failures;
+}
+function auditMarkdownContent(manifestDir) {
+  const failures = [];
+  const dirs = ["skills", "agents"];
+  for (const dir of dirs) {
+    const abs = path24.join(manifestDir, dir);
+    if (!fs16.existsSync(abs)) continue;
+    walkMd(abs, (file) => {
+      const text = fs16.readFileSync(file, "utf8");
+      const rel = path24.relative(manifestDir, file);
+      const lines = text.split(/\r?\n/);
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i] ?? "";
+        if (PLACEHOLDER_PATTERN.test(line)) {
+          failures.push(`${rel}:${i + 1}: TODO or placeholder in shipped content`);
+        }
+        if (RISKY_INSTALL_PATTERNS.some((re) => re.test(line))) {
+          failures.push(`${rel}:${i + 1}: risky install pattern`);
+        }
+        if (ANY_NPX_PATTERN.test(line) && !ALLOWED_NPX_PATTERN.test(line)) {
+          failures.push(`${rel}:${i + 1}: disallowed npx (only npx tsx allowed)`);
+        }
+      }
+    });
+  }
+  return failures;
+}
+function walkMd(dir, fn) {
+  for (const entry of fs16.readdirSync(dir, { withFileTypes: true })) {
+    const full = path24.join(dir, entry.name);
+    if (entry.isDirectory()) walkMd(full, fn);
+    else if (entry.name.endsWith(".md")) fn(full);
+  }
+}
 async function runValidateCatalog(manifestPath) {
   if (!manifestPath) {
     error("Usage: haus validate-catalog <path/to/manifest.json>");
     process.exitCode = 1;
     return;
   }
-  const abs = path23.resolve(process.cwd(), manifestPath);
+  const abs = path24.resolve(process.cwd(), manifestPath);
+  const manifestDir = path24.dirname(abs);
   const data = await readJson(abs);
   if (!data?.items) {
     error(`Could not read catalog manifest at ${abs}`);
@@ -3081,22 +3271,22 @@ async function runValidateCatalog(manifestPath) {
     return;
   }
   const items = data.items;
-  const [structureFailures, stackFailures] = await Promise.all([
-    auditManifestStructure(items),
-    auditForbiddenStacks(items)
-  ]);
+  const structureFailures = auditManifestStructure(items);
+  const stackFailures = auditForbiddenStacks(items);
+  const fileFailures = auditShippedFiles(manifestDir, items);
+  const contentFailures = auditMarkdownContent(manifestDir);
   const allowed = new Set((await readAllowedStacks(packageRoot())).map((x) => x.toLowerCase()));
   const tagFailures = [];
   if (allowed.size > 0) {
     for (const item of items) {
       for (const tag of Array.isArray(item.tags) ? item.tags : []) {
-        if (!allowed.has(tag.toLowerCase()) && !tag.includes("-patterns") && tag !== "haus" && tag !== "security" && tag !== "quality" && tag !== "review" && tag !== "workflow") {
+        if (!allowed.has(tag.toLowerCase()) && !tag.includes("-patterns") && tag !== "haus" && tag !== "security" && tag !== "quality" && tag !== "review" && tag !== "workflow" && tag !== "baseline" && tag !== "project-instructions") {
           tagFailures.push(`${item.id}: tag not in allowlist: "${tag}"`);
         }
       }
     }
   }
-  const allFailures = [...structureFailures, ...stackFailures, ...tagFailures];
+  const allFailures = [...structureFailures, ...stackFailures, ...fileFailures, ...contentFailures, ...tagFailures];
   if (allFailures.length) {
     allFailures.forEach((f) => error(f));
     process.exitCode = 1;
@@ -3106,7 +3296,7 @@ async function runValidateCatalog(manifestPath) {
 }
 
 // src/commands/workspace.ts
-import path24 from "path";
+import path25 from "path";
 import YAML from "yaml";
 async function runWorkspace(action) {
   if (action === "init") {
@@ -3139,7 +3329,7 @@ relationships: []
   const summaries = [];
   const ownership = {};
   for (const repo of repos) {
-    const repoRoot = path24.resolve(process.cwd(), repo.path);
+    const repoRoot = path25.resolve(process.cwd(), repo.path);
     const result = await scanProject(repoRoot, "fast");
     summaries.push({
       name: repo.name,
@@ -3175,7 +3365,7 @@ ${summaries.map(
 // src/cli.ts
 function cliVersion() {
   try {
-    const pkgPath = path25.join(packageRoot(), "package.json");
+    const pkgPath = path26.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
@@ -3185,7 +3375,7 @@ function cliVersion() {
 var program = new Command();
 function validateRuntimeNodeVersion() {
   try {
-    const pkgPath = path25.join(packageRoot(), "package.json");
+    const pkgPath = path26.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
     const requiredRange = pkg.engines?.node;
     if (requiredRange && !satisfiesVersion(process.version, requiredRange)) {
@@ -3203,7 +3393,7 @@ program.command("scan").option("--json").action(runScan);
 program.command("recommend").option("--json").action(runRecommend);
 program.command("setup-project").option("--guided").option("--fast").option("--json").action(runSetupProject);
 program.command("doctor").option("--hooks", "Verify .claude/settings.json matches the hook contract").action(runDoctor);
-program.command("apply").option("--dry-run").option("--write").action(runApply);
+program.command("apply").option("--dry-run").option("--write").option("--select", "Interactively select catalog items before applying").option("--allow-empty-cache", "Apply core files only when catalog cache is empty (skip catalog items without error)").action(runApply);
 program.command("undo").option("-y, --yes", "Skip confirmation").action(runUndo);
 program.command("explain-recommendation").option("--json").action(runExplainRecommendation);
 program.command("context").option("--task <task>").option("--from-hook").option("--json").option("--verbose").action(runContext);