@haus-tech/haus-workflow 0.1.0

package/dist/cli.js

@@ -0,0 +1,3232 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { readFileSync as readFileSync3 } from "fs";
+import path25 from "path";
+import { Command } from "commander";
+
+// src/claude/write-claude-files.ts
+import path9 from "path";
+import fs8 from "fs-extra";
+
+// src/catalog/remote-catalog.ts
+import os from "os";
+import path from "path";
+import fs from "fs-extra";
+
+// src/utils/logger.ts
+var log = (msg, ...args) => {
+  console.log(msg, ...args);
+};
+var warn = (msg, ...args) => {
+  console.warn(msg, ...args);
+};
+var error = (msg, ...args) => {
+  console.error(msg, ...args);
+};
+
+// src/catalog/constants.ts
+var CATALOG_REPO_URL = "https://raw.githubusercontent.com/wearehaustech/haus-workflow-catalog";
+var CATALOG_REF = "main";
+var CATALOG_CACHE_SUBDIR = ".claude/haus/catalog-cache";
+
+// src/catalog/remote-catalog.ts
+var CACHE_DIR = process.env["HAUS_CATALOG_CACHE_DIR_OVERRIDE"] ?? path.join(os.homedir(), CATALOG_CACHE_SUBDIR);
+var REMOTE_BASE = process.env["HAUS_CATALOG_REMOTE_BASE"] ?? `${CATALOG_REPO_URL}/${CATALOG_REF}`;
+var REMOTE_MANIFEST_URL = `${REMOTE_BASE}/manifest.json`;
+async function fetchText(url) {
+  try {
+    const res = await fetch(url, { signal: AbortSignal.timeout(1e4) });
+    if (!res.ok) return null;
+    return await res.text();
+  } catch {
+    return null;
+  }
+}
+async function fetchRemoteManifest() {
+  const text = await fetchText(REMOTE_MANIFEST_URL);
+  if (!text) return null;
+  try {
+    const data = JSON.parse(text);
+    return data?.items?.length ? data.items : null;
+  } catch {
+    return null;
+  }
+}
+function isSafeCatalogPath(itemPath) {
+  if (!itemPath || path.isAbsolute(itemPath) || itemPath.includes("\\")) return false;
+  const normalized = path.normalize(itemPath);
+  return !normalized.startsWith("..") && !normalized.includes("/..");
+}
+function safeJoin(base, itemPath) {
+  if (!isSafeCatalogPath(itemPath)) return null;
+  const resolved = path.resolve(base, itemPath);
+  return resolved.startsWith(base + path.sep) || resolved === base ? resolved : null;
+}
+async function syncRemoteCatalog() {
+  const items = await fetchRemoteManifest();
+  if (!items) {
+    warn("Remote catalog fetch failed \u2014 using bundled catalog");
+    return { newItems: [], unchanged: 0, failed: [] };
+  }
+  await fs.ensureDir(CACHE_DIR);
+  await fs.writeFile(path.join(CACHE_DIR, "manifest.json"), `${JSON.stringify({ items }, null, 2)}
+`, "utf8");
+  const newItems = [];
+  let unchanged = 0;
+  const failed = [];
+  for (const item of items) {
+    if (item.type !== "skill" && item.type !== "agent" || !item.path) continue;
+    if (!isSafeCatalogPath(item.path)) {
+      warn(`Skipping ${item.id}: invalid path "${item.path}"`);
+      failed.push(item.id);
+      continue;
+    }
+    if (item.type === "skill") {
+      const destDir = safeJoin(CACHE_DIR, item.path);
+      if (!destDir) {
+        warn(`Skipping ${item.id}: path traversal detected`);
+        failed.push(item.id);
+        continue;
+      }
+      const dest = path.join(destDir, "SKILL.md");
+      if (await fs.pathExists(dest)) {
+        unchanged++;
+        continue;
+      }
+      const url = `${REMOTE_BASE}/${item.path}/SKILL.md`;
+      const text = await fetchText(url);
+      if (!text) {
+        warn(`Failed to fetch content for ${item.id}`);
+        failed.push(item.id);
+        continue;
+      }
+      await fs.ensureDir(path.dirname(dest));
+      await fs.writeFile(dest, text, "utf8");
+      newItems.push(item.id);
+    } else {
+      const dest = safeJoin(CACHE_DIR, item.path);
+      if (!dest) {
+        warn(`Skipping ${item.id}: path traversal detected`);
+        failed.push(item.id);
+        continue;
+      }
+      if (await fs.pathExists(dest)) {
+        unchanged++;
+        continue;
+      }
+      const url = `${REMOTE_BASE}/${item.path}`;
+      const text = await fetchText(url);
+      if (!text) {
+        warn(`Failed to fetch content for ${item.id}`);
+        failed.push(item.id);
+        continue;
+      }
+      await fs.ensureDir(path.dirname(dest));
+      await fs.writeFile(dest, text, "utf8");
+      newItems.push(item.id);
+    }
+  }
+  return { newItems, unchanged, failed };
+}
+async function getCacheManifestAge() {
+  try {
+    const stat = await fs.stat(path.join(CACHE_DIR, "manifest.json"));
+    return Date.now() - stat.mtimeMs;
+  } catch {
+    return null;
+  }
+}
+
+// src/update/hash-installed.ts
+import path3 from "path";
+import fg2 from "fast-glob";
+import fs3 from "fs-extra";
+
+// src/utils/fs.ts
+import crypto from "crypto";
+import path2 from "path";
+import fg from "fast-glob";
+import fs2 from "fs-extra";
+async function readJson(file) {
+  try {
+    return await fs2.readJson(file);
+  } catch {
+    return void 0;
+  }
+}
+async function writeJson(file, value) {
+  await fs2.ensureDir(path2.dirname(file));
+  await fs2.writeFile(file, `${JSON.stringify(value, null, 2)}
+`, "utf8");
+}
+async function readText(file) {
+  try {
+    return await fs2.readFile(file, "utf8");
+  } catch {
+    return void 0;
+  }
+}
+async function writeText(file, value) {
+  await fs2.ensureDir(path2.dirname(file));
+  await fs2.writeFile(file, value, "utf8");
+}
+async function listFiles(root, patterns) {
+  const files = await fg(patterns, {
+    cwd: root,
+    dot: true,
+    onlyFiles: true,
+    ignore: ["**/node_modules/**", "**/.git/**", "**/dist/**"]
+  });
+  return files.sort((a, b) => a.localeCompare(b));
+}
+function hashText(value) {
+  return `sha256-${crypto.createHash("sha256").update(value).digest("hex")}`;
+}
+
+// src/update/hash-installed.ts
+var EMPTY_LOCK_PATHS_TOKEN = "haus-lock:empty-paths";
+async function hashInstalledPaths(root, relPaths) {
+  if (relPaths.length === 0) {
+    return hashText(EMPTY_LOCK_PATHS_TOKEN);
+  }
+  const normalized = [...new Set(relPaths.map((p) => p.replace(/\\/g, "/")))].sort();
+  const fileDigests = [];
+  for (const rel of normalized) {
+    const abs = path3.join(root, rel);
+    if (!await fs3.pathExists(abs)) continue;
+    const stat = await fs3.stat(abs);
+    if (stat.isFile()) {
+      const body = await fs3.readFile(abs, "utf8");
+      fileDigests.push({ rel, digest: hashText(body) });
+      continue;
+    }
+    if (!stat.isDirectory()) continue;
+    const inner = await fg2("**/*", { cwd: abs, onlyFiles: true, dot: true });
+    for (const sub of inner.sort()) {
+      const relFile = path3.join(rel, sub).replace(/\\/g, "/");
+      const absFile = path3.join(abs, sub);
+      const body = await fs3.readFile(absFile, "utf8");
+      fileDigests.push({ rel: relFile, digest: hashText(body) });
+    }
+  }
+  if (fileDigests.length === 0) {
+    return hashText(`${EMPTY_LOCK_PATHS_TOKEN}|${normalized.join("|")}`);
+  }
+  fileDigests.sort((a, b) => a.rel.localeCompare(b.rel));
+  return hashText(fileDigests.map((f) => `${f.rel}=${f.digest}`).join("|"));
+}
+
+// src/utils/diff.ts
+import { createTwoFilesPatch } from "diff";
+function hasTextChanged(before, after) {
+  return before !== after;
+}
+function createUnifiedDiff(filePath, before, after) {
+  return createTwoFilesPatch(filePath, filePath, before, after, "before", "after", {
+    context: 3
+  });
+}
+function summarizeDiff(diffText) {
+  const lines = diffText.split("\n");
+  let additions = 0;
+  let deletions = 0;
+  for (const line of lines) {
+    if (line.startsWith("+++ ") || line.startsWith("--- ")) continue;
+    if (line.startsWith("+")) additions += 1;
+    if (line.startsWith("-")) deletions += 1;
+  }
+  return { additions, deletions };
+}
+
+// src/utils/paths.ts
+import { existsSync, readFileSync } from "fs";
+import os2 from "os";
+import path4 from "path";
+import { fileURLToPath } from "url";
+var HAUS_DIR = ".haus-workflow";
+function hausPath(root, ...parts) {
+  return path4.join(root, HAUS_DIR, ...parts);
+}
+function claudePath(root, ...parts) {
+  return path4.join(root, ".claude", ...parts);
+}
+function displayPath(root, targetPath) {
+  const rel = path4.relative(root, targetPath).replace(/\\/g, "/");
+  if (rel && !rel.startsWith("../") && rel !== "..") {
+    return rel.startsWith("./") ? rel : `./${rel}`;
+  }
+  const home = os2.homedir();
+  const normalized = targetPath.replace(/\\/g, "/");
+  if (home && home.trim().length > 0) {
+    const homeRel = path4.relative(home, targetPath).replace(/\\/g, "/");
+    if (homeRel && !homeRel.startsWith("../") && homeRel !== "..") {
+      return `~/${homeRel}`;
+    }
+  }
+  return normalized;
+}
+function packageRoot() {
+  let dir = path4.dirname(fileURLToPath(import.meta.url));
+  for (let i = 0; i < 12; i++) {
+    const pkgPath = path4.join(dir, "package.json");
+    if (existsSync(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+        if (pkg.name === "haus" || pkg.name === "@haus-tech/haus-workflow") return dir;
+      } catch {
+      }
+    }
+    const parent = path4.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  const file = fileURLToPath(import.meta.url);
+  return path4.resolve(path4.dirname(file), "../..");
+}
+
+// src/claude/load-hooks-config.ts
+import path5 from "path";
+var CONFIG_PATH = ".haus-workflow/config.json";
+var DEFAULT_HOOKS_CONFIG = {
+  hooks: {
+    context: { enabled: false },
+    memoryInject: { enabled: false }
+  }
+};
+async function isHookEnabled(root, key) {
+  const cfg = await readJson(path5.join(root, CONFIG_PATH));
+  return cfg?.hooks?.[key]?.enabled === true;
+}
+
+// src/claude/load-hooks.ts
+var CANONICAL_HOOKS = {
+  hooks: {
+    UserPromptSubmit: [
+      {
+        hooks: [
+          { type: "command", command: "haus context --from-hook || true" },
+          { type: "command", command: "haus memory inject --from-hook || true" }
+        ]
+      }
+    ],
+    PreToolUse: [
+      {
+        matcher: "Read|Edit|Write",
+        hooks: [{ type: "command", command: "haus guard file-access --from-hook || true" }]
+      },
+      {
+        matcher: "Bash",
+        hooks: [{ type: "command", command: "haus guard bash --from-hook || true" }]
+      }
+    ]
+  }
+};
+var STABLE_HOOK_IDS = {
+  "haus context --from-hook || true": "haus.context-hook",
+  "haus memory inject --from-hook || true": "haus.memory-hook",
+  "haus guard file-access --from-hook || true": "haus.guard-file",
+  "haus guard bash --from-hook || true": "haus.guard-bash"
+};
+async function loadClaudeHooksSettings() {
+  return CANONICAL_HOOKS;
+}
+function flattenRecommendedHooks(settings) {
+  const out = [];
+  let generic = 0;
+  for (const block of settings.hooks.UserPromptSubmit) {
+    for (const h of block.hooks) {
+      const id = STABLE_HOOK_IDS[h.command] ?? `haus.hook.user-${generic++}`;
+      out.push({ id, command: h.command });
+    }
+  }
+  for (const block of settings.hooks.PreToolUse) {
+    for (const h of block.hooks) {
+      const id = STABLE_HOOK_IDS[h.command] ?? `haus.hook.pre-${generic++}`;
+      out.push({ id, command: h.command });
+    }
+  }
+  return out;
+}
+
+// src/claude/verify-hooks-contract.ts
+import { isDeepStrictEqual } from "util";
+import fs4 from "fs-extra";
+async function assertPostApplySettingsMatchCanonical(root, canonical) {
+  const written = await readJson(claudePath(root, "settings.json"));
+  if (written == null || typeof written !== "object") {
+    throw new Error("haus: post-apply self-check failed: .claude/settings.json missing or unreadable");
+  }
+  if (!isDeepStrictEqual(canonical, written)) {
+    throw new Error("haus: post-apply self-check failed: .claude/settings.json does not match canonical hook contract");
+  }
+}
+async function verifyProjectSettingsHooksContract(root) {
+  const settingsPath = claudePath(root, "settings.json");
+  if (!await fs4.pathExists(settingsPath)) {
+    return {
+      ok: true,
+      skipped: true,
+      message: "No .claude/settings.json (run `haus apply --write` to install hooks)."
+    };
+  }
+  let canonical;
+  try {
+    canonical = await loadClaudeHooksSettings();
+  } catch (err) {
+    return { ok: false, message: `Cannot load canonical hooks: ${String(err)}` };
+  }
+  const project = await readJson(settingsPath);
+  if (project == null || typeof project !== "object") {
+    return { ok: false, message: ".claude/settings.json is unreadable." };
+  }
+  if (!isDeepStrictEqual(canonical, project)) {
+    return {
+      ok: false,
+      message: ".claude/settings.json drifts from canonical hook config (regenerate with `haus apply --write`)."
+    };
+  }
+  return { ok: true, message: "settings.json matches canonical hook contract." };
+}
+
+// src/claude/write-project-facts.ts
+import path6 from "path";
+import fs5 from "fs-extra";
+var STABLE_ID = "generated.project-facts";
+var SCHEMA_VERSION = "1";
+function makeHeader(pkgVersion) {
+  return `<!-- HAUS-MANAGED id=${STABLE_ID} v=${SCHEMA_VERSION} source=@haus-tech/haus-workflow@${pkgVersion} -->`;
+}
+function renderProjectFacts(ctx, rec, pkgVersion) {
+  const header = makeHeader(pkgVersion);
+  const stackEntries = Object.entries(ctx.detectedStacks ?? {});
+  const stackLines = stackEntries.length > 0 ? stackEntries.map(([stack, files]) => {
+    const f = files;
+    return `- **${stack}**: ${f.slice(0, 3).join(", ")}${f.length > 3 ? ", \u2026" : ""}`;
+  }).join("\n") : "- none detected";
+  const roles = ctx.repoRoles?.length > 0 ? ctx.repoRoles.join(", ") : "unknown";
+  const recLines = rec.recommended.length > 0 ? rec.recommended.map((r) => `- \`${r.id}\` (${r.type}) \u2014 ${r.reason}`).join("\n") : "- none";
+  const warningLines = [...ctx.warnings ?? [], ...rec.warnings ?? []];
+  const warnSection = warningLines.length > 0 ? warningLines.map((w) => `- ${w}`).join("\n") : "- none";
+  const repoName = ctx.repoName ?? path6.basename(ctx.root ?? "unknown");
+  return `${header}
+
+# Project facts
+
+> Auto-generated by \`haus apply\`. Do not edit \u2014 changes will be overwritten on next apply.
+
+**Repo:** ${repoName}
+**Package manager:** ${ctx.packageManager ?? "unknown"}
+**Roles:** ${roles}
+
+## Detected stacks
+
+${stackLines}
+
+## Recommended context
+
+${recLines}
+
+## Warnings
+
+${warnSection}
+`;
+}
+async function writeProjectFacts(root, pkgVersion, dryRun) {
+  const ctx = await readJson(hausPath(root, "context-map.json")) ?? {
+    mode: "fast",
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    root,
+    repoName: path6.basename(root),
+    packageManager: "unknown",
+    repoRoles: [],
+    confidence: 0,
+    detectedStacks: {},
+    dependencies: [],
+    securityRisks: [],
+    crossRepoHints: [],
+    warnings: []
+  };
+  const rec = await readJson(hausPath(root, "recommendation.json")) ?? {
+    mode: "fast",
+    recommended: [],
+    skipped: [],
+    warnings: [],
+    estimatedContextTokens: 0,
+    selectedRules: 0,
+    skippedRules: 0,
+    estimatedTokenReductionPct: 0
+  };
+  const destPath = hausPath(root, "project.md");
+  const printable = displayPath(root, destPath);
+  const next = renderProjectFacts(ctx, rec, pkgVersion);
+  const prev = await fs5.pathExists(destPath) ? await fs5.readFile(destPath, "utf8") : "";
+  if (dryRun) {
+    if (!prev) {
+      log(createUnifiedDiff(printable, "", next));
+    } else if (hasTextChanged(prev, next)) {
+      log(createUnifiedDiff(printable, prev, next));
+    } else {
+      log(`${printable}: unchanged`);
+    }
+    return destPath;
+  }
+  if (hasTextChanged(prev, next) && prev.length > 0) {
+    const diffText = createUnifiedDiff(printable, prev, next);
+    const summary = summarizeDiff(diffText);
+    log(`Overwriting ${printable} (diff +${summary.additions} -${summary.deletions})`);
+  }
+  await writeText(destPath, next);
+  return destPath;
+}
+
+// src/claude/write-root-claude-md.ts
+import path7 from "path";
+import fs6 from "fs-extra";
+var BLOCK_BEGIN = "<!-- HAUS:BEGIN haus-imports v=1 -->";
+var BLOCK_END = "<!-- HAUS:END haus-imports -->";
+var IMPORT_CONTENT = `@.haus-workflow/haus-way-of-work.md
+@.haus-workflow/project.md`;
+function buildImportBlock() {
+  return `${BLOCK_BEGIN}
+${IMPORT_CONTENT}
+${BLOCK_END}`;
+}
+function injectHausBlock(existing, block) {
+  const beginIdx = existing.indexOf(BLOCK_BEGIN);
+  const endIdx = existing.indexOf(BLOCK_END);
+  if (beginIdx !== -1 && endIdx !== -1 && endIdx > beginIdx) {
+    const before = existing.slice(0, beginIdx);
+    const after = existing.slice(endIdx + BLOCK_END.length);
+    return `${before}${block}${after}`;
+  }
+  const trimmed = existing.trimEnd();
+  if (trimmed.length === 0) {
+    return `${block}
+`;
+  }
+  return `${trimmed}
+
+${block}
+`;
+}
+async function writeRootClaudeMd(root, dryRun) {
+  const filePath = path7.join(root, "CLAUDE.md");
+  const block = buildImportBlock();
+  const prev = await fs6.pathExists(filePath) ? await fs6.readFile(filePath, "utf8") : "";
+  const next = injectHausBlock(prev, block);
+  const printable = displayPath(root, filePath);
+  if (dryRun) {
+    if (!prev) {
+      log(createUnifiedDiff(printable, "", next));
+    } else if (hasTextChanged(prev, next)) {
+      log(createUnifiedDiff(printable, prev, next));
+    } else {
+      log(`${printable}: unchanged`);
+    }
+    return filePath;
+  }
+  if (hasTextChanged(prev, next) && prev.length > 0) {
+    const diffText = createUnifiedDiff(printable, prev, next);
+    const summary = summarizeDiff(diffText);
+    log(`Overwriting ${printable} (diff +${summary.additions} -${summary.deletions})`);
+  }
+  await writeText(filePath, next);
+  return filePath;
+}
+
+// src/claude/write-way-of-work.ts
+import os3 from "os";
+import path8 from "path";
+import fs7 from "fs-extra";
+var STABLE_ID2 = "template.way-of-work";
+var SCHEMA_VERSION2 = "1";
+var TEMPLATE_REL = "library/global/templates/haus-way-of-work.md";
+var CATALOG_CACHE_TEMPLATE = path8.join(os3.homedir(), CATALOG_CACHE_SUBDIR, "templates/haus-way-of-work.md");
+function makeWayOfWorkHeader(pkgVersion, contentHash) {
+  return `<!-- HAUS-MANAGED id=${STABLE_ID2} v=${SCHEMA_VERSION2} source=@haus-tech/haus-workflow@${pkgVersion} hash=${contentHash} -->`;
+}
+function parseHausManagedHeader(line) {
+  const match = line.match(/<!-- HAUS-MANAGED id=([\w.:-]+)/);
+  if (!match) return null;
+  const hashMatch = line.match(/hash=(sha256-[a-f0-9]+)/);
+  return { id: match[1], hash: hashMatch?.[1] };
+}
+async function writeWayOfWork(root, pkgVersion, dryRun) {
+  const cachePath = CATALOG_CACHE_TEMPLATE;
+  const packagePath = path8.join(packageRoot(), TEMPLATE_REL);
+  const templatePath = await fs7.pathExists(cachePath) ? cachePath : packagePath;
+  if (!await fs7.pathExists(templatePath)) {
+    warn(`Way-of-work template not found \u2014 run \`haus update\` to fetch from catalog`);
+    return null;
+  }
+  const templateContent = await fs7.readFile(templatePath, "utf8");
+  const contentHash = hashText(templateContent);
+  const header = makeWayOfWorkHeader(pkgVersion, contentHash);
+  const next = `${header}
+${templateContent}`;
+  const destPath = hausPath(root, "haus-way-of-work.md");
+  const printable = displayPath(root, destPath);
+  if (await fs7.pathExists(destPath)) {
+    const existing = await fs7.readFile(destPath, "utf8");
+    const firstLine = existing.split("\n")[0] ?? "";
+    const parsed = parseHausManagedHeader(firstLine);
+    if (!parsed) {
+      warn(`${printable}: no HAUS-MANAGED header \u2014 file appears user-owned, skipping`);
+      return null;
+    }
+    if (parsed.id !== STABLE_ID2) {
+      warn(`${printable}: HAUS-MANAGED id mismatch (expected ${STABLE_ID2}) \u2014 skipping`);
+      return null;
+    }
+    const existingContent = existing.slice(firstLine.length + 1);
+    if (parsed.hash && hashText(existingContent) !== parsed.hash) {
+      warn(`${printable}: content modified by user \u2014 skipping. Use --force to overwrite.`);
+      return null;
+    }
+    if (!hasTextChanged(existing, next)) {
+      if (dryRun) log(`${printable}: unchanged`);
+      return destPath;
+    }
+  }
+  if (dryRun) {
+    const prev = await fs7.pathExists(destPath) ? await fs7.readFile(destPath, "utf8") : "";
+    if (!prev) {
+      log(createUnifiedDiff(printable, "", next));
+    } else {
+      const diffText = createUnifiedDiff(printable, prev, next);
+      const summary = summarizeDiff(diffText);
+      log(`${printable}: would update (diff +${summary.additions} -${summary.deletions})`);
+    }
+    return destPath;
+  }
+  await writeText(destPath, next);
+  return destPath;
+}
+
+// src/claude/write-claude-files.ts
+async function writeClaudeFiles(root, dryRun) {
+  const rec = await readJson(hausPath(root, "recommendation.json")) ?? {
+    mode: "fast",
+    recommended: [],
+    skipped: [],
+    warnings: [],
+    estimatedContextTokens: 0,
+    selectedRules: 0,
+    skippedRules: 0,
+    estimatedTokenReductionPct: 0
+  };
+  const pkgRoot = packageRoot();
+  const hausVersion = (await readJson(path9.join(pkgRoot, "package.json")))?.version ?? "0.0.0";
+  const coreFiles = [
+    claudePath(root, "settings.json"),
+    claudePath(root, "rules", "haus.md"),
+    claudePath(root, "rules", "security.md"),
+    claudePath(root, "commands", "haus-doctor.md"),
+    claudePath(root, "commands", "haus-review.md")
+  ];
+  const rootClaudeMdPath = await writeRootClaudeMd(root, dryRun);
+  const wayOfWorkPath = await writeWayOfWork(root, hausVersion, dryRun);
+  const projectFactsPath = await writeProjectFacts(root, hausVersion, dryRun);
+  const p6Files = [rootClaudeMdPath, projectFactsPath, ...wayOfWorkPath ? [wayOfWorkPath] : []];
+  const files = dryRun ? [...coreFiles, ...p6Files] : [...coreFiles, ...p6Files, hausPath(root, "selected-context.json"), hausPath(root, "haus.lock.json")];
+  const hookSettings = await loadClaudeHooksSettings();
+  await writeManagedJson(root, claudePath(root, "settings.json"), hookSettings, dryRun);
+  if (!dryRun) await assertPostApplySettingsMatchCanonical(root, hookSettings);
+  const configPath = hausPath(root, "config.json");
+  if (!await fs8.pathExists(configPath)) {
+    await writeManagedJson(root, configPath, DEFAULT_HOOKS_CONFIG, dryRun);
+  }
+  await writeManagedText(root, claudePath(root, "commands", "haus-doctor.md"), "Run `haus doctor`.", dryRun);
+  await writeManagedText(
+    root,
+    claudePath(root, "commands", "haus-review.md"),
+    'Run `haus context --task "code review"` then review diff.',
+    dryRun
+  );
+  await writeManagedText(
+    root,
+    claudePath(root, "rules", "haus.md"),
+    "- Keep context minimal.\n- Follow project conventions.\n",
+    dryRun
+  );
+  await writeManagedText(
+    root,
+    claudePath(root, "rules", "security.md"),
+    "- Never read secrets.\n- Block dangerous shell commands.\n",
+    dryRun
+  );
+  const manifest = await readJson(
+    path9.join(pkgRoot, "library", "catalog", "manifest.json")
+  ) ?? { items: [] };
+  const manifestById = new Map((manifest.items ?? []).map((item) => [item.id, item]));
+  const cacheManifest = await readJson(path9.join(CACHE_DIR, "manifest.json"));
+  const cacheManifestById = new Map((cacheManifest?.items ?? []).map((item) => [item.id, item]));
+  const installedPathsByItem = /* @__PURE__ */ new Map();
+  const installedIds = /* @__PURE__ */ new Set();
+  for (const item of rec.recommended) {
+    const manifestItem = manifestById.get(item.id);
+    if (!manifestItem?.path) continue;
+    if (manifestItem.source === "curated") {
+      if (manifestItem.reviewStatus !== "approved") {
+        warn(
+          `Skipping curated item ${item.id}: reviewStatus is not approved (${manifestItem.reviewStatus ?? "unset"})`
+        );
+        continue;
+      }
+      if (manifestItem.riskLevel === "blocked") {
+        warn(`Skipping curated item ${item.id}: riskLevel is blocked`);
+        continue;
+      }
+    }
+    const cachedItem = cacheManifestById.get(item.id);
+    const cachePath = cachedItem?.path ? path9.join(CACHE_DIR, cachedItem.path) : null;
+    const sourcePath = cachePath && await fs8.pathExists(cachePath) ? cachePath : path9.join(pkgRoot, manifestItem.path);
+    const target = item.type === "agent" ? "agents" : "skills";
+    const destination = claudePath(root, target, path9.basename(sourcePath));
+    if (await fs8.pathExists(sourcePath)) {
+      if (dryRun) {
+        const exists = await fs8.pathExists(destination);
+        log(`${displayPath(root, destination)}: ${exists ? "would overwrite" : "would create"} (${item.id})`);
+      } else {
+        await fs8.ensureDir(path9.dirname(destination));
+        await fs8.copy(sourcePath, destination, { overwrite: true, errorOnExist: false });
+      }
+      files.push(destination);
+      const current = installedPathsByItem.get(item.id) ?? [];
+      installedPathsByItem.set(item.id, [...current, path9.relative(root, destination)]);
+      installedIds.add(item.id);
+    } else {
+      warn(`Skipping ${item.id}: source not found at ${sourcePath} \u2014 run \`haus update\` to populate catalog cache`);
+    }
+  }
+  if (dryRun) return [...new Set(files)];
+  const installedItems = rec.recommended.filter((r) => installedIds.has(r.id));
+  await writeManagedJson(
+    root,
+    hausPath(root, "selected-context.json"),
+    installedItems.map((r) => ({ id: r.id, type: r.type, reason: r.reason, confidenceLevel: r.confidenceLevel })),
+    false
+  );
+  const lock = await Promise.all(
+    installedItems.map(async (r) => {
+      const relPaths = installedPathsByItem.get(r.id) ?? [];
+      const manifestItem = manifestById.get(r.id);
+      const isCurated = manifestItem?.source === "curated";
+      const base = {
+        id: r.id,
+        type: r.type,
+        source: isCurated ? "curated" : "haus",
+        version: hausVersion,
+        hash: await hashInstalledPaths(root, relPaths),
+        installMode: "copied",
+        paths: relPaths
+      };
+      if (!isCurated || !manifestItem) return base;
+      return {
+        ...base,
+        ...manifestItem.originSourceId ? { originSourceId: manifestItem.originSourceId } : {},
+        ...manifestItem.useMode ? { useMode: manifestItem.useMode } : {},
+        ...manifestItem.license ? { license: manifestItem.license } : {},
+        ...manifestItem.riskLevel ? { riskLevel: manifestItem.riskLevel } : {},
+        ...manifestItem.reviewStatus ? { reviewStatus: manifestItem.reviewStatus } : {}
+      };
+    })
+  );
+  await writeManagedJson(root, hausPath(root, "haus.lock.json"), lock, false);
+  return [...new Set(files)];
+}
+async function writeManagedText(root, filePath, nextText, dryRun) {
+  const prev = await fs8.pathExists(filePath) ? await fs8.readFile(filePath, "utf8") : "";
+  const printable = displayPath(root, filePath);
+  if (dryRun) {
+    if (!prev) {
+      log(createUnifiedDiff(printable, "", nextText));
+    } else if (hasTextChanged(prev, nextText)) {
+      log(createUnifiedDiff(printable, prev, nextText));
+    } else {
+      log(`${printable}: unchanged`);
+    }
+    return;
+  }
+  if (hasTextChanged(prev, nextText) && prev.length > 0) {
+    const diffText = createUnifiedDiff(printable, prev, nextText);
+    const summary = summarizeDiff(diffText);
+    log(`Overwriting ${printable} (diff +${summary.additions} -${summary.deletions})`);
+  }
+  await writeText(filePath, nextText);
+}
+async function writeManagedJson(root, filePath, value, dryRun) {
+  const nextText = `${JSON.stringify(value, null, 2)}
+`;
+  await writeManagedText(root, filePath, nextText, dryRun);
+}
+
+// src/commands/apply.ts
+async function runApply(options) {
+  if (!options.dryRun && !options.write) {
+    log("Use --dry-run or --write");
+    return;
+  }
+  const root = process.cwd();
+  const isDryRun = Boolean(options.dryRun) && !options.write;
+  const files = await writeClaudeFiles(root, isDryRun);
+  if (isDryRun) {
+    log(`Dry-run complete \u2014 ${files.length} file(s) planned, none written. Run --write to apply.`);
+  } else {
+    log("Applied files:");
+    files.forEach((f) => log(`- ${displayPath(root, f)}`));
+  }
+}
+
+// src/catalog/load-catalog.ts
+import os4 from "os";
+import path10 from "path";
+var CACHE_MANIFEST = path10.join(os4.homedir(), CATALOG_CACHE_SUBDIR, "manifest.json");
+async function loadCatalog(root) {
+  const envPath = process.env["HAUS_FIXTURE_CATALOG"];
+  if (envPath) {
+    const data2 = await readJson(envPath);
+    return data2?.items ?? [];
+  }
+  const cacheData = await readJson(CACHE_MANIFEST);
+  if (cacheData?.items?.length) return cacheData.items;
+  const localManifest = path10.join(root, "library/catalog/manifest.json");
+  const localData = await readJson(localManifest);
+  if (localData?.items?.length) return localData.items;
+  const packageManifest = path10.join(packageRoot(), "library/catalog/manifest.json");
+  const data = await readJson(packageManifest);
+  return data?.items ?? [];
+}
+
+// src/commands/catalog-audit.ts
+var FORBIDDEN = [
+  "python",
+  "django",
+  "go",
+  "rust",
+  "java",
+  "spring",
+  "kotlin",
+  "swift",
+  "android",
+  "flutter",
+  "dart",
+  "c++",
+  "perl",
+  "defi",
+  "trading"
+];
+async function runCatalogAudit() {
+  const items = await loadCatalog(process.cwd());
+  const failures = [];
+  for (const item of items) {
+    const text = `${item.id} ${item.tags.join(" ")}`.toLowerCase();
+    for (const word of FORBIDDEN) if (text.includes(word)) failures.push(`${item.id} has unsupported tag ${word}`);
+  }
+  if (failures.length) {
+    failures.forEach((f) => error(f));
+    process.exitCode = 1;
+    return;
+  }
+  log("Catalog audit passed.");
+}
+
+// src/recommender/explain-recommendation.ts
+function normalizeRecommendation(input2) {
+  const recommended = (input2.recommended ?? []).map((item) => {
+    const normalizedReasons = item.reasons?.map((reason) => ({
+      code: reason.code ?? "legacy-reason",
+      message: reason.message ?? item.reason ?? "legacy recommendation reason",
+      weight: reason.weight ?? 0,
+      ...reason.signal ? { signal: reason.signal } : {}
+    })) ?? [{ code: "legacy-reason", message: item.reason ?? "legacy recommendation reason", weight: 0 }];
+    const confidence = item.confidence ?? 0;
+    return {
+      id: item.id,
+      type: item.type ?? "skill",
+      reason: item.reason ?? normalizedReasons.map((reason) => reason.message).join(", "),
+      reasons: normalizedReasons,
+      confidence,
+      confidenceLevel: item.confidenceLevel ?? (confidence >= 0.75 ? "high" : confidence >= 0.4 ? "medium" : "low"),
+      selectionMode: item.selectionMode ?? "matched",
+      install: item.install ?? true,
+      score: item.score ?? 0,
+      scoreBreakdown: {
+        bonuses: normalizedReasons,
+        penalties: [],
+        finalScore: item.score ?? 0
+      },
+      tags: item.tags,
+      ecosystem: item.ecosystem
+    };
+  });
+  const skipped = (input2.skipped ?? []).map((item) => ({
+    id: item.id,
+    reason: item.reason ?? "legacy skipped reason",
+    skipReasons: item.skipReasons?.map((reason) => ({
+      code: reason.code ?? "legacy-skip-reason",
+      message: reason.message ?? item.reason ?? "legacy skipped reason",
+      penalty: reason.penalty ?? 0,
+      ...reason.signal ? { signal: reason.signal } : {}
+    })) ?? [
+      {
+        code: "legacy-skip-reason",
+        message: item.reason ?? "legacy skipped reason",
+        penalty: 0
+      }
+    ]
+  }));
+  return {
+    mode: input2.mode === "guided" ? "guided" : "fast",
+    recommended,
+    skipped,
+    warnings: input2.warnings ?? [],
+    estimatedContextTokens: input2.estimatedContextTokens ?? recommended.length * 320,
+    selectedRules: input2.selectedRules ?? recommended.length,
+    skippedRules: input2.skippedRules ?? skipped.length,
+    estimatedTokenReductionPct: input2.estimatedTokenReductionPct ?? Math.max(0, Math.round(skipped.length / Math.max(recommended.length + skipped.length, 1) * 100))
+  };
+}
+function buildRecommendationExplanation(recommendation) {
+  return {
+    selected: recommendation.recommended.map((item) => ({
+      id: item.id,
+      confidence: item.confidence,
+      confidenceLevel: item.confidenceLevel,
+      selectionMode: item.selectionMode,
+      reasons: item.reasons.map((reason) => reason.message)
+    })),
+    skipped: recommendation.skipped.map((item) => ({
+      id: item.id,
+      reasons: item.skipReasons.map((reason) => reason.message),
+      reasonDetails: item.skipReasons.map((reason) => ({
+        code: reason.code,
+        message: reason.message,
+        penalty: reason.penalty,
+        ...reason.signal ? { signal: reason.signal } : {}
+      }))
+    })),
+    stats: {
+      selectedRules: recommendation.selectedRules,
+      skippedRules: recommendation.skippedRules,
+      estimatedTokenReductionPct: recommendation.estimatedTokenReductionPct
+    }
+  };
+}
+
+// src/recommender/task-intent.ts
+function pickTaskRelevantRules(recommendation, task, taskIntents = /* @__PURE__ */ new Set()) {
+  const recommended = recommendation?.recommended ?? [];
+  if (!task) return recommended;
+  if (taskIntents.size > 0) {
+    const intentMatches = recommended.filter((rule) => {
+      if (rule.selectionMode === "baseline") return false;
+      const ruleIntents = computeRuleIntents(rule);
+      if (ruleIntents.size === 0) return false;
+      for (const ti of taskIntents) {
+        if (ruleIntents.has(ti)) return true;
+      }
+      return false;
+    });
+    if (intentMatches.length > 0) return intentMatches;
+  }
+  const tokens = task.toLowerCase().split(/[^a-z0-9]+/).filter((t) => t.length >= 3);
+  const tokenMatches = recommended.filter((rule) => {
+    if (rule.selectionMode === "baseline") return false;
+    const corpus = [
+      rule.id,
+      rule.ecosystem ?? "",
+      ...rule.tags ?? [],
+      rule.reason ?? "",
+      ...rule.reasons.map((r) => r.message)
+    ].join(" ").toLowerCase();
+    return tokens.some((token) => corpus.includes(token));
+  });
+  if (tokenMatches.length > 0) return tokenMatches;
+  const taskWantsTesting = taskIntents.has("testing");
+  const cappedMediumOrHigh = recommended.filter((rule) => {
+    if (rule.selectionMode === "baseline") return false;
+    if (rule.confidenceLevel === "low") return false;
+    if (taskWantsTesting) return true;
+    const ruleIntents = computeRuleIntents(rule);
+    const isTestingOnly = ruleIntents.size > 0 && [...ruleIntents].every((i) => i === "testing");
+    return !isTestingOnly;
+  });
+  return cappedMediumOrHigh.slice(0, 8);
+}
+var ALL_INTENTS = [
+  "backend",
+  "frontend",
+  "admin-ui",
+  "storefront",
+  "graphql",
+  "database",
+  "auth",
+  "testing",
+  "docs",
+  "monorepo"
+];
+var TASK_INTENT_KEYWORDS = {
+  backend: [
+    "api",
+    "endpoint",
+    "controller",
+    "service",
+    "queue",
+    "job",
+    "worker",
+    "cron",
+    "middleware",
+    "resolver",
+    "migration",
+    "seeder",
+    "model",
+    "repository",
+    "handler",
+    "plugin",
+    "webhook",
+    "schedule",
+    "background",
+    "consumer",
+    "producer",
+    "command",
+    "nova resource",
+    "api mutation",
+    "api subscription"
+  ],
+  frontend: [
+    "component",
+    "page",
+    "route",
+    "view",
+    "layout",
+    "form",
+    "dashboard",
+    "modal",
+    "navbar",
+    "navigation",
+    "sidebar",
+    "menu",
+    "tailwind",
+    "scss",
+    "style",
+    "theme",
+    "tanstack",
+    "shadcn",
+    "radix",
+    "block",
+    "client component",
+    "server component"
+  ],
+  "admin-ui": [
+    "admin",
+    "admin-ui",
+    "admin ui",
+    "backoffice",
+    "back-office",
+    "back office",
+    "nova",
+    "control panel",
+    "wp-admin",
+    "vendure admin"
+  ],
+  storefront: [
+    "storefront",
+    "checkout",
+    "cart",
+    "product page",
+    "product listing",
+    "category page",
+    "shop",
+    "ecommerce",
+    "e-commerce",
+    "order page"
+  ],
+  graphql: ["graphql", "resolver", "graphql mutation", "graphql subscription", "schema", "codegen"],
+  database: [
+    "database",
+    "migration",
+    "seed",
+    "table",
+    "index",
+    "elasticsearch",
+    "postgres",
+    "mariadb",
+    "mssql",
+    "sql query",
+    "db query"
+  ],
+  auth: [
+    "auth",
+    "login",
+    "logout",
+    "oauth",
+    "oidc",
+    "bankid",
+    "azure ad",
+    "session",
+    "jwt",
+    "permission",
+    "rbac",
+    "acl",
+    "guard",
+    "saml"
+  ],
+  testing: [
+    "test",
+    "tests",
+    "testing",
+    "spec",
+    "e2e",
+    "unit",
+    "story",
+    "stories",
+    "snapshot",
+    "fixture",
+    "playwright",
+    "cypress",
+    "phpunit",
+    "vitest"
+  ],
+  docs: ["doc", "docs", "documentation", "readme", "guide", "tutorial", "changelog"],
+  monorepo: [
+    "lib",
+    "library",
+    "package",
+    "workspace",
+    "shared",
+    "monorepo",
+    "nx",
+    "turbo",
+    "pnpm workspace",
+    "yarn workspace"
+  ]
+};
+function normalizeTaskForMatching(task) {
+  return ` ${task.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim()} `;
+}
+function classifyTaskIntents(task) {
+  const t = normalizeTaskForMatching(task);
+  const intents = /* @__PURE__ */ new Set();
+  for (const intent of ALL_INTENTS) {
+    const keywords = TASK_INTENT_KEYWORDS[intent];
+    for (const kw of keywords) {
+      const needle = ` ${kw} `;
+      if (t.includes(needle)) {
+        intents.add(intent);
+        break;
+      }
+    }
+  }
+  return intents;
+}
+function computeRuleIntents(rule) {
+  const intents = /* @__PURE__ */ new Set();
+  const tags = new Set((rule.tags ?? []).map((t) => t.toLowerCase()));
+  const eco = rule.ecosystem;
+  if (!eco && tags.size === 0) return intents;
+  const isTestingRule = tags.has("playwright") || tags.has("phpunit") || tags.has("testing-library") || tags.has("storybook") || tags.has("testing");
+  if (isTestingRule) {
+    intents.add("testing");
+    return intents;
+  }
+  if (eco === "laravel" || eco === "nestjs" || eco === "dotnet") {
+    intents.add("backend");
+  }
+  if (eco === "vendure") {
+    intents.add("backend");
+    intents.add("admin-ui");
+  }
+  if (eco === "wordpress") {
+    intents.add("backend");
+    intents.add("frontend");
+    intents.add("admin-ui");
+  }
+  if (eco === "nextjs" || eco === "react" || eco === "vue") {
+    intents.add("frontend");
+    intents.add("admin-ui");
+    intents.add("storefront");
+  }
+  if (eco === "nx" || eco === "turbo") {
+    intents.add("monorepo");
+  }
+  if (tags.has("backend")) intents.add("backend");
+  if (tags.has("frontend")) intents.add("frontend");
+  if (tags.has("graphql")) intents.add("graphql");
+  if (tags.has("laravel-nova")) intents.add("admin-ui");
+  if (tags.has("oidc") || tags.has("azure-ad") || tags.has("bankid")) intents.add("auth");
+  if (tags.has("postgresql") || tags.has("mariadb") || tags.has("mssql") || tags.has("elasticsearch")) {
+    intents.add("database");
+  }
+  if (tags.has("nx21") || tags.has("turbo") || tags.has("yarn4") || tags.has("pnpm89")) {
+    intents.add("monorepo");
+  }
+  return intents;
+}
+
+// src/scanner/scan-project.ts
+import { readFile } from "fs/promises";
+import path12 from "path";
+
+// src/utils/audit-checks.ts
+function isRecord(v) {
+  return typeof v === "object" && v !== null;
+}
+
+// src/utils/versions.ts
+import semver from "semver";
+function normalizeVersion(version) {
+  return semver.valid(semver.coerce(version));
+}
+function satisfiesVersion(version, range) {
+  const normalized = normalizeVersion(version);
+  if (!normalized) return false;
+  return semver.satisfies(normalized, range, { includePrerelease: true });
+}
+function compareVersions(a, b) {
+  const normalizedA = normalizeVersion(a);
+  const normalizedB = normalizeVersion(b);
+  if (!normalizedA || !normalizedB) {
+    throw new Error(`Cannot compare invalid versions: ${a} vs ${b}`);
+  }
+  return semver.compare(normalizedA, normalizedB);
+}
+
+// src/scanner/detect-package-manager.ts
+import path11 from "path";
+import fs9 from "fs-extra";
+function detectPackageManager(root, packageManagerField) {
+  const field = String(packageManagerField ?? "").trim();
+  if (field.startsWith("yarn@")) {
+    const version = field.slice("yarn@".length);
+    if (satisfiesVersion(version, ">=4 <5")) return "yarn";
+    return "unknown";
+  }
+  if (field.startsWith("pnpm@")) {
+    const version = field.slice("pnpm@".length);
+    if (satisfiesVersion(version, ">=8 <10")) return "pnpm";
+    return "unknown";
+  }
+  if (field.startsWith("npm@")) {
+    const version = field.slice("npm@".length);
+    if (satisfiesVersion(version, ">=9")) return "npm";
+    return "unknown";
+  }
+  if (fs9.existsSync(path11.join(root, "yarn.lock"))) return "yarn";
+  if (fs9.existsSync(path11.join(root, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs9.existsSync(path11.join(root, "package-lock.json"))) return "npm";
+  return "unknown";
+}
+
+// src/scanner/scan-project.ts
+var SAFE_FILES = [
+  "package.json",
+  "yarn.lock",
+  "pnpm-lock.yaml",
+  "composer.json",
+  "composer.lock",
+  "nx.json",
+  "turbo.json",
+  "tsconfig.json",
+  "vite.config.*",
+  "next.config.*",
+  "tailwind.config.*",
+  "components.json",
+  "playwright.config.*",
+  "phpunit.xml",
+  "artisan",
+  "routes/*.php",
+  "app/Providers/*.php",
+  "schema.graphql",
+  "**/*.graphql",
+  "**/vendure-config.*",
+  "**/*module.ts",
+  "web/app/**",
+  "wp-content/plugins/**",
+  "wp-content/themes/**",
+  "wp-content/mu-plugins/**",
+  "wp-content/acf-json/**",
+  ".storybook/**",
+  ".env.example",
+  "wp-config.php",
+  "**/*.csproj",
+  "**/*.sln",
+  "docker-compose.*",
+  "Dockerfile"
+];
+var SENSITIVE = [
+  /^\.env(\.|$)/,
+  /(^|\/)\.env(\.|$)/,
+  /\.pem$/,
+  /\.key$/,
+  /\.p12$/,
+  /\.pfx$/,
+  /\.sql$/,
+  /\.dump$/,
+  /customer-data/,
+  /exports/,
+  /certs/,
+  /secrets/,
+  /(^|\/)storage\/logs(\/|$)/,
+  /(^|\/)wp-content\/uploads(\/|$)/,
+  /(^|\/)uploads(\/|$)/
+];
+function blocked(rel) {
+  return SENSITIVE.some((x) => x.test(rel));
+}
+async function scanProject(root, mode = "fast") {
+  const pkg = await readJson(path12.join(root, "package.json"));
+  const composer = await readJson(path12.join(root, "composer.json"));
+  const files = await listFiles(root, SAFE_FILES);
+  const safeFiles = files.filter((f) => !blocked(f));
+  const deps = dependencySet(pkg, composer);
+  const packageManager = detectPackageManager(root, String(pkg?.packageManager ?? ""));
+  const roles = detectRoles(deps, safeFiles);
+  const stacks = await detectStacks(root, deps, safeFiles, packageManager);
+  const warnings = [];
+  const securityRisks = [];
+  const crossRepoHints = [];
+  if (!safeFiles.some((f) => f.endsWith(".env.example"))) warnings.push("No .env.example found");
+  if (!(pkg && isRecord(pkg.scripts) && String(pkg.scripts.test ?? "").length > 0))
+    warnings.push("No package.json test script found");
+  const nodeEngine = isRecord(pkg?.engines) ? String(pkg.engines.node ?? "") : "";
+  if (nodeEngine && !satisfiesVersion(process.version, nodeEngine)) {
+    warnings.push(`Current Node ${process.version} does not satisfy package engine ${nodeEngine}`);
+  }
+  if (safeFiles.some((f) => f.includes("docker-compose"))) crossRepoHints.push("Containerized services detected");
+  if (safeFiles.some((f) => f.includes("turbo.json") || f.includes("nx.json")))
+    crossRepoHints.push("Monorepo orchestration detected");
+  if (!safeFiles.some((f) => f.endsWith(".env.example"))) securityRisks.push("Missing env template");
+  if (safeFiles.some((f) => f.includes("wp-content/uploads"))) securityRisks.push("Uploads directory present");
+  const context = {
+    mode,
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    root,
+    repoName: String(pkg?.name ?? path12.basename(root)),
+    packageManager,
+    repoRoles: roles,
+    confidence: computeConfidence(roles, stacks),
+    detectedStacks: stacks,
+    dependencies: deps,
+    securityRisks,
+    crossRepoHints,
+    warnings
+  };
+  const dependencyMap = {
+    node: deps.filter((d) => !d.includes("/")),
+    composer: isRecord(composer?.require) ? Object.keys(composer.require) : []
+  };
+  const scanHashes = Object.fromEntries(
+    await Promise.all(safeFiles.map(async (f) => [f, hashText(await readFile(path12.join(root, f), "utf8"))]))
+  );
+  const repoSummary = renderSummary(context);
+  await writeJson(hausPath(root, "context-map.json"), context);
+  await writeJson(hausPath(root, "dependency-map.json"), dependencyMap);
+  await writeJson(hausPath(root, "scan-hashes.json"), scanHashes);
+  await writeText(hausPath(root, "repo-summary.md"), repoSummary);
+  return { ...context, dependencyMap, scanHashes, repoSummary };
+}
+function dependencySet(pkg, composer) {
+  const out = /* @__PURE__ */ new Set();
+  const pushObj = (obj) => {
+    if (!isRecord(obj)) return;
+    for (const key of Object.keys(obj)) out.add(key);
+  };
+  pushObj(pkg?.dependencies);
+  pushObj(pkg?.devDependencies);
+  pushObj(composer?.require);
+  pushObj(composer?.["require-dev"]);
+  return [...out].sort();
+}
+function detectRoles(deps, files) {
+  const roles = /* @__PURE__ */ new Set();
+  if (deps.includes("next") || files.some((f) => f.includes("next.config."))) roles.add("next-app");
+  if (deps.includes("react")) roles.add("react-app");
+  if (deps.includes("vite") || files.some((f) => f.includes("vite.config."))) roles.add("vite-app");
+  if (deps.includes("@vendure/core")) roles.add("vendure-app");
+  if (deps.some((d) => d.startsWith("@haus/vendure-")) || files.some((f) => f.includes("vendure-config")))
+    roles.add("vendure-plugin");
+  if (deps.includes("@nestjs/core")) roles.add("nestjs-api");
+  if (deps.includes("graphql") || deps.includes("@nestjs/graphql")) roles.add("graphql-api");
+  if (files.some((f) => f.endsWith("nx.json"))) roles.add("nx-monorepo");
+  if (files.some((f) => f.endsWith("turbo.json"))) roles.add("turbo-monorepo");
+  if (files.some((f) => f.endsWith("artisan")) || deps.includes("laravel/framework")) roles.add("laravel-app");
+  if (deps.includes("laravel/nova")) roles.add("laravel-nova-app");
+  if (files.some((f) => f.endsWith("wp-config.php")) && files.some((f) => f.includes("web/app"))) {
+    roles.add("wordpress-bedrock-site");
+    roles.add("wordpress-site");
+  }
+  if (files.some((f) => f.endsWith("wp-config.php")) && !files.some((f) => f.includes("web/app"))) {
+    roles.add("wordpress-vanilla-site");
+    roles.add("wordpress-site");
+  }
+  if (files.some((f) => f.endsWith(".csproj") || f.endsWith(".sln"))) roles.add("dotnet-service");
+  if (deps.includes("express")) roles.add("express-service");
+  return [...roles].sort();
+}
+async function detectStacks(root, deps, files, packageManager) {
+  const out = {
+    backend: [],
+    frontend: [],
+    databases: [],
+    testing: [],
+    auth: [],
+    tooling: [],
+    packageManagers: []
+  };
+  const add = (k, v) => {
+    out[k] ??= [];
+    if (!out[k].includes(v)) out[k].push(v);
+  };
+  if (deps.includes("next")) add("frontend", "nextjs");
+  if (deps.includes("react")) add("frontend", "react19");
+  if (deps.includes("vue")) add("frontend", "vue");
+  if (deps.includes("vite")) add("frontend", "vite8");
+  if (deps.includes("@vendure/core")) add("backend", "vendure3");
+  if (deps.includes("@nestjs/core")) add("backend", "nestjs");
+  if (await hasNeedle(root, files, "NestFactory")) add("backend", "nestjs");
+  if (await hasNeedle(root, files, "@VendurePlugin")) add("backend", "vendure3");
+  if (deps.includes("graphql") || deps.includes("@nestjs/graphql")) add("backend", "graphql");
+  if (files.some((f) => f.endsWith(".graphql") || f.endsWith("schema.graphql"))) add("backend", "graphql");
+  if (deps.includes("laravel/framework")) add("backend", "laravel");
+  if (files.some((f) => f.includes("app/Providers/") || f.includes("routes/"))) add("backend", "laravel");
+  if (files.some((f) => f.endsWith("wp-config.php"))) add("backend", "wordpress");
+  if (files.some((f) => f.endsWith(".csproj") || f.endsWith(".sln"))) add("backend", "dotnet");
+  if (deps.includes("@playwright/test")) add("testing", "playwright");
+  if (files.some((f) => f.includes(".storybook"))) add("testing", "storybook");
+  if (deps.some((d) => d.startsWith("@testing-library/"))) add("testing", "testing-library");
+  if (files.some((f) => f.endsWith("phpunit.xml"))) add("testing", "phpunit");
+  if (deps.some((d) => d.startsWith("@storybook/"))) add("testing", "storybook");
+  if (deps.includes("pg")) add("databases", "postgresql");
+  if (deps.includes("mariadb") || deps.includes("mysql2")) add("databases", "mariadb");
+  if (deps.includes("mssql")) add("databases", "mssql");
+  if (deps.includes("@elastic/elasticsearch")) add("databases", "elasticsearch");
+  if (await hasNeedle(root, files, "openid")) add("auth", "oidc");
+  if (await hasNeedle(root, files, "AZURE_AD")) add("auth", "azure-ad");
+  if (await hasNeedle(root, files, "BANKID")) add("auth", "bankid");
+  if (packageManager === "yarn") add("packageManagers", "yarn4");
+  if (packageManager === "pnpm") add("packageManagers", "pnpm89");
+  return out;
+}
+async function hasNeedle(root, files, needle) {
+  const candidates = files.filter(
+    (f) => f.endsWith(".ts") || f.endsWith(".js") || f.endsWith(".php") || f.endsWith(".json") || f.endsWith(".yml") || f.endsWith(".yaml")
+  );
+  for (const rel of candidates.slice(0, 300)) {
+    try {
+      const content = await readFile(path12.join(root, rel), "utf8");
+      if (content.includes(needle)) return true;
+    } catch {
+      continue;
+    }
+  }
+  return false;
+}
+function computeConfidence(roles, stacks) {
+  const stackCount = Object.values(stacks).reduce((sum, arr) => sum + arr.length, 0);
+  if (roles.length === 0) return 0.15;
+  return Math.min(0.99, Number((0.4 + roles.length * 0.08 + stackCount * 0.02).toFixed(2)));
+}
+function renderSummary(context) {
+  return `# Repo summary
+
+- Repo: ${context.repoName}
+- Package manager: ${context.packageManager}
+- Roles: ${context.repoRoles.join(", ") || "unknown"}
+- Generated: ${context.generatedAt}
+`;
+}
+
+// src/scanner/read-context.ts
+async function readContextOrScan(root) {
+  const context = await readJson(hausPath(root, "context-map.json"));
+  if (context) return context;
+  const scan = await scanProject(root, "fast");
+  return scan;
+}
+
+// src/commands/context.ts
+async function runContext(options) {
+  const root = process.cwd();
+  if (options.fromHook && !await isHookEnabled(root, "context")) {
+    return;
+  }
+  const context = await readContextOrScan(root);
+  const summary = await readText(hausPath(root, "repo-summary.md")) ?? "";
+  const recommendationRaw = await readJson(hausPath(root, "recommendation.json"));
+  const recommendation = recommendationRaw ? normalizeRecommendation(recommendationRaw) : void 0;
+  const rawBreakdownById = new Map(
+    (recommendationRaw?.recommended ?? []).map((item) => [item.id, item.scoreBreakdown])
+  );
+  const taskIntents = options.task ? classifyTaskIntents(options.task) : /* @__PURE__ */ new Set();
+  const selected = pickTaskRelevantRules(recommendation, options.task, taskIntents);
+  const payload = {
+    task: options.task ?? "not provided",
+    taskIntents: [...taskIntents].sort(),
+    roles: context.repoRoles,
+    selectedRules: selected.map((x) => ({
+      id: x.id,
+      confidenceLevel: x.confidenceLevel,
+      selectionMode: x.selectionMode,
+      reasons: x.reasons.map((reason) => reason.message),
+      ...options.verbose ? { scoreBreakdown: rawBreakdownById.get(x.id) } : {}
+    })),
+    skippedCount: recommendation?.skippedRules ?? 0,
+    estimatedTokenReductionPct: recommendation?.estimatedTokenReductionPct ?? 0
+  };
+  if (options.json) {
+    log(JSON.stringify(payload, null, 2));
+    return;
+  }
+  const lines = [
+    "# Haus Context",
+    `Task: ${payload.task}`,
+    `Task intents: ${payload.taskIntents.join(", ") || "(none classified)"}`,
+    `Roles: ${payload.roles.join(", ") || "unknown"}`,
+    `Selected rules: ${payload.selectedRules.length}`,
+    `Skipped rules: ${payload.skippedCount}`,
+    `Estimated token reduction: ${payload.estimatedTokenReductionPct}%`,
+    "Use minimal context.",
+    ...payload.selectedRules.flatMap((rule) => {
+      const reasonLine = `- ${rule.id}: ${rule.reasons.join(", ")}`;
+      if (!options.verbose) return [reasonLine];
+      const breakdown = rawBreakdownById.get(rule.id);
+      if (!breakdown) return [reasonLine];
+      const bonuses = (breakdown.bonuses ?? []).map(
+        (b) => `  + ${b.code}(+${b.weight})${b.signal ? ` [${b.signal}]` : ""}`
+      );
+      const penalties = (breakdown.penalties ?? []).map(
+        (p) => `  - ${p.code}(${p.penalty})${p.signal ? ` [${p.signal}]` : ""}`
+      );
+      return [reasonLine, ...bonuses, ...penalties];
+    }),
+    summary
+  ];
+  const text = lines.join("\n");
+  log(options.fromHook ? text.slice(0, 3e3) : text);
+}
+
+// src/commands/doctor.ts
+import path13 from "path";
+import fs10 from "fs-extra";
+async function runDoctor(options) {
+  const root = process.cwd();
+  if (options?.hooks) {
+    const hooks2 = await verifyProjectSettingsHooksContract(root);
+    if (hooks2.skipped) {
+      error(`Haus doctor --hooks: ${hooks2.message}`);
+      process.exitCode = 1;
+      return;
+    }
+    if (!hooks2.ok) {
+      error(`Haus doctor --hooks: ${hooks2.message}`);
+      process.exitCode = 1;
+      return;
+    }
+    log(`Haus doctor --hooks: ${hooks2.message}`);
+    return;
+  }
+  const context = await readContextOrScan(root);
+  const recommendation = await readJson(
+    hausPath(root, "recommendation.json")
+  );
+  log("Haus Doctor");
+  log(`Repo: ${context.repoName}`);
+  log(`Roles: ${context.repoRoles.join(", ") || "unknown"}`);
+  log(`Package manager: ${context.packageManager}`);
+  log(`Recommended items: ${recommendation?.recommended?.length ?? 0}`);
+  const warningLines = [.../* @__PURE__ */ new Set([...context.warnings, ...recommendation?.warnings ?? []])];
+  for (const warning of warningLines) {
+    log(`- WARN: ${warning}`);
+  }
+  const hooks = await verifyProjectSettingsHooksContract(root);
+  if (hooks.skipped) {
+    log(`- HOOKS: (skipped) ${hooks.message}`);
+  } else if (!hooks.ok) {
+    log(`- HOOKS FAIL: ${hooks.message}`);
+    process.exitCode = 1;
+  } else {
+    log(`- HOOKS OK: ${hooks.message}`);
+  }
+  const gatedHooks = ["context", "memoryInject"];
+  for (const key of gatedHooks) {
+    const enabled = await isHookEnabled(root, key);
+    log(`- HOOK ${key}: ${enabled ? "enabled" : "disabled (default)"}`);
+  }
+  const rootClaudeMdPath = path13.join(root, "CLAUDE.md");
+  const rootClaudeMdContent = await readText(rootClaudeMdPath);
+  if (!rootClaudeMdContent) {
+    warn("- CLAUDE.md: missing (run `haus apply --write` to create)");
+  } else if (!rootClaudeMdContent.includes(BLOCK_BEGIN)) {
+    warn("- CLAUDE.md: haus import block missing (run `haus apply --write` to add)");
+  } else {
+    log("- CLAUDE.md: import block present");
+  }
+  const wayOfWorkPath = hausPath(root, "haus-way-of-work.md");
+  const wayOfWorkExists = await fs10.pathExists(wayOfWorkPath);
+  if (!wayOfWorkExists) {
+    warn("- .haus-workflow/haus-way-of-work.md: missing (run `haus apply --write`)");
+  } else {
+    const wayOfWorkContent = await readText(wayOfWorkPath);
+    const firstLine = wayOfWorkContent?.split("\n")[0] ?? "";
+    if (!firstLine.includes("HAUS-MANAGED")) {
+      warn("- .haus-workflow/haus-way-of-work.md: no HAUS-MANAGED header (user-owned)");
+    } else {
+      const storedHashMatch = firstLine.match(/hash=(sha256-[a-f0-9]+)/);
+      const templatePath = path13.join(packageRoot(), "library", "global", "templates", "haus-way-of-work.md");
+      const templateContent = await readText(templatePath);
+      if (storedHashMatch && templateContent) {
+        const currentHash = hashText(templateContent);
+        if (storedHashMatch[1] !== currentHash) {
+          warn("- .haus-workflow/haus-way-of-work.md: stale (template updated \u2014 run `haus apply --write`)");
+        } else {
+          log("- .haus-workflow/haus-way-of-work.md: OK");
+        }
+      } else {
+        log("- .haus-workflow/haus-way-of-work.md: OK");
+      }
+    }
+  }
+  const projectMdPath = hausPath(root, "project.md");
+  const projectMdExists = await fs10.pathExists(projectMdPath);
+  if (!projectMdExists) {
+    warn("- .haus-workflow/project.md: missing (run `haus apply --write`)");
+  } else {
+    const projectMdContent = await readText(projectMdPath);
+    const hasHeader = projectMdContent?.split("\n")[0]?.includes("HAUS-MANAGED") ?? false;
+    if (!hasHeader) {
+      warn("- .haus-workflow/project.md: no HAUS-MANAGED header (user-owned)");
+    } else {
+      log("- .haus-workflow/project.md: OK");
+    }
+  }
+  const cacheAgeMs = await getCacheManifestAge();
+  if (cacheAgeMs === null) {
+    warn("- CATALOG CACHE: absent (run `haus update` to populate)");
+  } else {
+    const cacheAgeDays = Math.floor(cacheAgeMs / (1e3 * 60 * 60 * 24));
+    if (cacheAgeDays >= 7) {
+      warn(`- CATALOG CACHE: stale (${cacheAgeDays}d old \u2014 run \`haus update\`)`);
+    } else {
+      log(`- CATALOG CACHE: OK (${cacheAgeDays}d old)`);
+    }
+  }
+}
+
+// src/recommender/explain-formatters.ts
+function formatReasonWithSignal(reason) {
+  return reason.signal ? `${reason.message} (${reason.signal})` : reason.message;
+}
+function formatRecommendationHuman(rec) {
+  const lines = [];
+  lines.push("Recommendation explanation");
+  lines.push(`  mode: ${rec.mode}`);
+  lines.push(
+    `  selected: ${rec.selectedRules} | skipped: ${rec.skippedRules} | estimated token reduction: ${rec.estimatedTokenReductionPct}%`
+  );
+  if (rec.warnings.length > 0) {
+    lines.push("  warnings:");
+    for (const warning of rec.warnings) lines.push(`    - ${warning}`);
+  }
+  lines.push("");
+  lines.push("Selected");
+  if (rec.recommended.length === 0) lines.push("  (none)");
+  for (const item of rec.recommended) {
+    lines.push(`- ${item.id}`);
+    lines.push(`    confidence: ${item.confidenceLevel} (${item.confidence.toFixed(2)})`);
+    lines.push(`    selection: ${item.selectionMode}`);
+    lines.push("    why:");
+    for (const reason of item.reasons) lines.push(`      - ${formatReasonWithSignal(reason)}`);
+  }
+  lines.push("");
+  lines.push("Skipped");
+  if (rec.skipped.length === 0) lines.push("  (none)");
+  for (const item of rec.skipped) {
+    lines.push(`- ${item.id}`);
+    lines.push("    why:");
+    for (const reason of item.skipReasons) lines.push(`      - ${formatReasonWithSignal(reason)}`);
+  }
+  return lines.join("\n");
+}
+
+// src/commands/explain-recommendation.ts
+async function runExplainRecommendation(options) {
+  const root = process.cwd();
+  const rec = await readJson(hausPath(root, "recommendation.json"));
+  if (!rec) {
+    throw new Error("No recommendation found. Run `haus recommend` first.");
+  }
+  const normalized = normalizeRecommendation(rec);
+  if (options.json) {
+    const explanation = buildRecommendationExplanation(normalized);
+    log(JSON.stringify(explanation, null, 2));
+    return;
+  }
+  log(formatRecommendationHuman(normalized));
+}
+
+// src/commands/guard.ts
+import { readFileSync as readFileSync2 } from "fs";
+
+// src/security/dangerous-commands.ts
+var DANGEROUS_COMMANDS = [
+  "rm -rf",
+  "sudo",
+  "chmod -R 777",
+  "chown -R",
+  "git push --force",
+  "git reset --hard",
+  "docker system prune",
+  "drop database",
+  "truncate table",
+  "php artisan migrate --force",
+  "npm publish",
+  "yarn npm publish",
+  "pnpm publish"
+];
+
+// src/security/guard-bash.ts
+function guardBash(command) {
+  const matched = DANGEROUS_COMMANDS.find((token) => command.includes(token));
+  if (matched) return `Blocked dangerous command: ${command}`;
+  return void 0;
+}
+
+// src/security/sensitive-paths.ts
+var SENSITIVE_PATHS = [
+  ".env",
+  ".env.*",
+  "*.pem",
+  "*.key",
+  "*.p12",
+  "*.pfx",
+  "id_rsa",
+  "id_ed25519",
+  "*.sql",
+  "*.dump",
+  "*.backup",
+  "*.bak",
+  "storage/logs",
+  "wp-content/uploads",
+  "uploads",
+  "customer-data",
+  "exports",
+  "secrets",
+  "certs"
+];
+
+// src/security/guard-file-access.ts
+function guardFileAccess(candidate) {
+  const matched = SENSITIVE_PATHS.find((token) => candidate.includes(token.replace("*", "")));
+  if (matched) return `Blocked sensitive path: ${candidate}`;
+  return void 0;
+}
+
+// src/commands/guard.ts
+function stdin() {
+  try {
+    if (process.stdin.isTTY) return "";
+    return readFileSync2(0, "utf8");
+  } catch {
+    return "";
+  }
+}
+function deny(reason) {
+  log(JSON.stringify({ permissionDecision: "deny", permissionDecisionReason: reason }));
+}
+async function runGuard(kind, _options) {
+  const raw = stdin();
+  let payload = {};
+  if (raw) {
+    try {
+      const parsed = JSON.parse(raw);
+      if (isRecord(parsed)) payload = parsed;
+    } catch {
+      deny("Malformed hook payload");
+      process.exitCode = 1;
+      return;
+    }
+  }
+  const toolInput = isRecord(payload.tool_input) ? payload.tool_input : {};
+  if (kind === "file-access") {
+    const candidate = String(toolInput.path ?? toolInput.file_path ?? "");
+    if (guardFileAccess(candidate)) {
+      deny(`Blocked sensitive path: ${candidate}`);
+      process.exitCode = 1;
+      return;
+    }
+    return;
+  }
+  const command = String(toolInput.command ?? "");
+  if (guardBash(command) || DANGEROUS_COMMANDS.some((token) => command.includes(token))) {
+    deny(`Blocked dangerous command: ${command}`);
+    process.exitCode = 1;
+  }
+}
+
+// src/commands/init.ts
+import path14 from "path";
+import fs11 from "fs-extra";
+
+// src/utils/exec.ts
+import { execa } from "execa";
+async function runCommand(command, args = [], options = {}) {
+  try {
+    const result = await execa(command, args, {
+      reject: false,
+      ...options
+    });
+    return {
+      command,
+      args,
+      stdout: String(result.stdout ?? ""),
+      stderr: String(result.stderr ?? ""),
+      exitCode: result.exitCode ?? 0
+    };
+  } catch (error2) {
+    const message = error2 instanceof Error ? error2.message : String(error2);
+    throw new Error(`Failed to run command: ${command} ${args.join(" ")} (${message})`);
+  }
+}
+async function runGit(args, options = {}) {
+  return runCommand("git", args, options);
+}
+
+// src/recommender/recommend.ts
+var UNSUPPORTED = [
+  "python",
+  "django",
+  "go",
+  "rust",
+  "java",
+  "spring",
+  "kotlin",
+  "swift",
+  "android",
+  "flutter",
+  "dart",
+  "c++",
+  "perl",
+  "defi",
+  "trading"
+];
+var SENSITIVE2 = [".env", "secrets", "certs", "customer-data", "exports", ".pem", ".key"];
+var ECOSYSTEM_GROUPS = {
+  laravel: ["laravel-app", "laravel-nova-app"],
+  wordpress: ["wordpress-site", "wordpress-bedrock-site", "wordpress-vanilla-site"],
+  vendure: ["vendure-app", "vendure-plugin"],
+  nestjs: ["nestjs-api"],
+  nextjs: ["next-app"],
+  react: ["react-app", "next-app", "design-system"],
+  vue: ["vue-app"],
+  dotnet: ["dotnet-service"],
+  nx: ["nx-monorepo"],
+  turbo: ["turbo-monorepo"]
+};
+var ECOSYSTEM_PRIMARY_BACKENDS = /* @__PURE__ */ new Set(["laravel", "wordpress", "vendure", "nestjs", "dotnet"]);
+var ECOSYSTEM_COMPATIBLE_BACKENDS = {
+  vendure: /* @__PURE__ */ new Set(["vendure", "nestjs"]),
+  nestjs: /* @__PURE__ */ new Set(["nestjs"]),
+  laravel: /* @__PURE__ */ new Set(["laravel"]),
+  wordpress: /* @__PURE__ */ new Set(["wordpress"]),
+  dotnet: /* @__PURE__ */ new Set(["dotnet"])
+};
+async function recommend(root, context) {
+  const items = await loadCatalog(root);
+  const setupAnswers = await readJson(hausPath(root, "setup-answers.json")) ?? {};
+  const sources = await readJson(hausPath(root, "sources-report.json")) ?? {};
+  const stackSet = buildStackSet(context);
+  const depSet = new Set(context.dependencies.map((d) => d.toLowerCase()));
+  const roleSet = new Set(context.repoRoles.map((r) => r.toLowerCase()));
+  const repoEcosystems = inferRepoEcosystems(context.repoRoles);
+  const dominantBackendEcosystem = pickDominantBackend(repoEcosystems);
+  const recommended = [];
+  const skipped = [];
+  const goals = Object.values(setupAnswers).join(" ").toLowerCase();
+  const sourceTrust = new Map((sources.items ?? []).map((x) => [x.id, x.status ?? "candidate"]));
+  const changedFiles = await readChangedFiles(root);
+  const securityRiskCount = context.securityRisks?.length ?? 0;
+  for (const item of items) {
+    const blob = `${item.id} ${item.tags.join(" ")}`.toLowerCase();
+    if (UNSUPPORTED.some((x) => blob.includes(x))) {
+      skipped.push({
+        id: item.id,
+        reason: "Unsupported stack policy",
+        skipReasons: [
+          {
+            code: "unsupported-policy",
+            message: "Unsupported stack policy",
+            penalty: 100
+          }
+        ]
+      });
+      continue;
+    }
+    if (item.source === "curated") {
+      const rs = item.reviewStatus;
+      if (!rs || rs !== "approved") {
+        skipped.push({
+          id: item.id,
+          reason: `Curated item not approved (reviewStatus=${rs ?? "unset"})`,
+          skipReasons: [
+            {
+              code: "curated-not-approved",
+              message: `Curated item requires reviewStatus:approved (got ${rs ?? "unset"})`,
+              penalty: 100,
+              signal: `reviewStatus:${rs ?? "unset"}`
+            }
+          ]
+        });
+        continue;
+      }
+      if (item.riskLevel === "blocked") {
+        skipped.push({
+          id: item.id,
+          reason: "Curated item risk level is blocked",
+          skipReasons: [
+            {
+              code: "curated-risk-blocked",
+              message: "Curated item riskLevel is blocked",
+              penalty: 100,
+              signal: "riskLevel:blocked"
+            }
+          ]
+        });
+        continue;
+      }
+    }
+    const isDefaultBaseline = item.default === true;
+    const reasons = [];
+    const skipReasons = [];
+    let score = 0;
+    const pushReason = (code, message, weight, signal) => {
+      score += weight;
+      reasons.push({ code, message, weight, signal });
+    };
+    const pushSkipReason = (code, message, penalty, signal) => {
+      score -= penalty;
+      skipReasons.push({ code, message, penalty, signal });
+    };
+    if (isDefaultBaseline) {
+      pushReason("default-baseline", "catalog default baseline", 25, "policy:default");
+    }
+    const roleMatch = item.repoRoles.find((r) => roleSet.has(r.toLowerCase()));
+    if (roleMatch) {
+      pushReason("repo-role-match", "repo role match", 40, `role:${roleMatch}`);
+    }
+    const tagMatch = item.tags.find((t) => stackSet.has(t.toLowerCase()));
+    if (tagMatch) {
+      pushReason("stack-match", "stack/dependency match", 30, `tag:${tagMatch}`);
+    }
+    const goalMatch = item.tags.find((t) => goals.includes(t) || goals.includes(t.replace(/-/g, " ")));
+    if (goalMatch) {
+      pushReason("goal-match", "guided goal match", 15, `goal:${goalMatch}`);
+    }
+    if (item.tags.includes(context.packageManager) || item.tags.includes(`${context.packageManager}4`) || item.tags.includes(`${context.packageManager}89`)) {
+      pushReason("package-manager-match", "package manager match", 10, `packageManager:${context.packageManager}`);
+    }
+    const configSignal = item.tags.find((t) => context.warnings.join(" ").toLowerCase().includes(t.toLowerCase()));
+    if (configSignal) {
+      pushReason("config-signal-match", "config signal match", 20, `warning:${configSignal}`);
+    }
+    const changedMatch = changedFiles.find((f) => f.includes(item.id.split(".").pop() ?? ""));
+    if (changedMatch) {
+      pushReason("changed-file-match", "changed file match", 10, `changedFile:${changedMatch}`);
+    }
+    if (item.id === "haus.nx21-monorepo-patterns" && !roleSet.has("nx-monorepo")) {
+      skipped.push({
+        id: item.id,
+        reason: "Required role missing: nx-monorepo",
+        skipReasons: [
+          {
+            code: "required-role-missing",
+            message: "Required role missing: nx-monorepo",
+            penalty: 100,
+            signal: "role:nx-monorepo"
+          }
+        ]
+      });
+      continue;
+    }
+    if (item.id === "haus.turbo-monorepo-patterns" && !roleSet.has("turbo-monorepo")) {
+      skipped.push({
+        id: item.id,
+        reason: "Required role missing: turbo-monorepo",
+        skipReasons: [
+          {
+            code: "required-role-missing",
+            message: "Required role missing: turbo-monorepo",
+            penalty: 100,
+            signal: "role:turbo-monorepo"
+          }
+        ]
+      });
+      continue;
+    }
+    const requiresAny = item.requiresAny ?? [];
+    if (requiresAny.length > 0) {
+      const satisfied = matchRequiresAny(requiresAny, {
+        stackSet,
+        depSet,
+        roleSet
+      });
+      if (!satisfied.matched) {
+        const description = describeRequiresAny(requiresAny);
+        skipped.push({
+          id: item.id,
+          reason: `requiresAny unsatisfied: needs ${description}`,
+          skipReasons: [
+            {
+              code: "requires-any-unsatisfied",
+              message: `requiresAny unsatisfied: needs ${description}`,
+              penalty: 100,
+              signal: description
+            }
+          ]
+        });
+        continue;
+      }
+      if (!reasons.some((r) => r.code === "stack-match")) {
+        pushReason("requires-any-match", "requires-any signal match", 25, satisfied.signal);
+      }
+    }
+    if (item.ecosystem && dominantBackendEcosystem && isBackendEcosystem(item.ecosystem)) {
+      const compat = ECOSYSTEM_COMPATIBLE_BACKENDS[dominantBackendEcosystem] ?? /* @__PURE__ */ new Set([dominantBackendEcosystem]);
+      if (!compat.has(item.ecosystem)) {
+        pushSkipReason(
+          "ecosystem-conflict",
+          `ecosystem conflict: rule ecosystem=${item.ecosystem} but repo dominant backend=${dominantBackendEcosystem}`,
+          40,
+          `ecosystem:${item.ecosystem}->${dominantBackendEcosystem}`
+        );
+      }
+    }
+    if (SENSITIVE2.some((x) => blob.includes(x))) {
+      pushSkipReason("sensitive-policy", "Sensitive content policy block", 100);
+    }
+    const trust = sourceTrust.get(item.source);
+    if (trust === "candidate" || trust === "rejected") {
+      pushSkipReason("source-trust", "Source trust policy block", 100);
+    }
+    if (item.source && item.source !== "haus" && trust !== "approved") {
+      pushSkipReason("source-approval", "Source not approved", 100);
+    }
+    if (securityRiskCount > 0 && !isDefaultBaseline && (item.tags.includes("security") || item.id.includes("security"))) {
+      pushSkipReason("security-risk-penalty", "Security-tagged item penalized by active risk signals", 20);
+    }
+    const positiveReasonCodes = new Set(reasons.map((r) => r.code).filter((c) => c !== "default-baseline"));
+    const hasRoleSignal = positiveReasonCodes.has("repo-role-match");
+    const hasDepOrStackSignal = positiveReasonCodes.has("stack-match") || positiveReasonCodes.has("requires-any-match");
+    if (hasRoleSignal && !hasDepOrStackSignal && !isDefaultBaseline && requiresAny.length === 0) {
+      pushSkipReason(
+        "role-only-bleed-guard",
+        "role match without dep/stack signal (role-only bleed)",
+        25,
+        roleMatch ? `role:${roleMatch}` : void 0
+      );
+    }
+    const minScore = isDefaultBaseline ? 1 : 40;
+    if (score >= minScore) {
+      const confidenceLevel = computeConfidenceLevel({
+        isDefaultBaseline,
+        reasons,
+        hasEcosystemConflict: skipReasons.some((s) => s.code === "ecosystem-conflict"),
+        score
+      });
+      const confidence = confidenceLevelToNumber(confidenceLevel, score);
+      recommended.push({
+        id: item.id,
+        type: item.type,
+        reason: reasons.length ? reasons.map((x) => x.message).join(", ") : `score=${score}`,
+        reasons,
+        confidence,
+        confidenceLevel,
+        selectionMode: isDefaultBaseline && reasons.every((r) => r.code === "default-baseline") ? "baseline" : "matched",
+        install: true,
+        score,
+        scoreBreakdown: {
+          bonuses: reasons,
+          penalties: skipReasons,
+          finalScore: score
+        },
+        tags: item.tags,
+        ecosystem: item.ecosystem
+      });
+    } else {
+      if (skipReasons.length === 0) {
+        skipReasons.push({
+          code: "no-role-stack-match",
+          message: "No role/stack match",
+          penalty: 0
+        });
+      }
+      const primary = skipReasons[0];
+      skipped.push({ id: item.id, reason: primary.message, skipReasons });
+    }
+  }
+  recommended.sort((a, b) => a.id.localeCompare(b.id));
+  skipped.sort((a, b) => a.id.localeCompare(b.id));
+  const estimatedContextTokens = recommended.length * 320;
+  const selectedRules = recommended.length;
+  const skippedRules = skipped.length;
+  const estimatedTokenReductionPct = Math.max(
+    0,
+    Math.round(skippedRules / Math.max(selectedRules + skippedRules, 1) * 100)
+  );
+  return {
+    mode: context.mode,
+    recommended,
+    skipped,
+    warnings: mergeRecommendationWarnings(context),
+    estimatedContextTokens,
+    selectedRules,
+    skippedRules,
+    estimatedTokenReductionPct
+  };
+}
+function buildStackSet(context) {
+  return new Set([...context.repoRoles, ...Object.values(context.detectedStacks).flat()].map((x) => x.toLowerCase()));
+}
+function inferRepoEcosystems(roles) {
+  const ecosystems = /* @__PURE__ */ new Set();
+  for (const [eco, roleList] of Object.entries(ECOSYSTEM_GROUPS)) {
+    if (roleList.some((r) => roles.includes(r))) ecosystems.add(eco);
+  }
+  return [...ecosystems];
+}
+function pickDominantBackend(ecosystems) {
+  for (const eco of ecosystems) {
+    if (ECOSYSTEM_PRIMARY_BACKENDS.has(eco)) return eco;
+  }
+  return void 0;
+}
+function isBackendEcosystem(eco) {
+  return ECOSYSTEM_PRIMARY_BACKENDS.has(eco);
+}
+function matchRequiresAny(clauses, ctx) {
+  for (const clause of clauses) {
+    if ("stack" in clause) {
+      if (ctx.stackSet.has(clause.stack.toLowerCase())) {
+        return { matched: true, signal: `stack:${clause.stack}` };
+      }
+    } else if ("dependency" in clause) {
+      if (ctx.depSet.has(clause.dependency.toLowerCase())) {
+        return { matched: true, signal: `dependency:${clause.dependency}` };
+      }
+    } else if ("packageNamePattern" in clause) {
+      const pattern = clause.packageNamePattern.toLowerCase();
+      const prefix = pattern.endsWith("*") ? pattern.slice(0, -1) : pattern;
+      for (const dep of ctx.depSet) {
+        if (pattern.endsWith("*") ? dep.startsWith(prefix) : dep === pattern) {
+          return {
+            matched: true,
+            signal: `packageNamePattern:${clause.packageNamePattern}`
+          };
+        }
+      }
+    } else if ("role" in clause) {
+      if (ctx.roleSet.has(clause.role.toLowerCase())) {
+        return { matched: true, signal: `role:${clause.role}` };
+      }
+    }
+  }
+  return { matched: false };
+}
+function describeRequiresAny(clauses) {
+  return clauses.map((c) => {
+    if ("stack" in c) return `stack=${c.stack}`;
+    if ("dependency" in c) return `dependency=${c.dependency}`;
+    if ("packageNamePattern" in c) return `packageNamePattern=${c.packageNamePattern}`;
+    if ("role" in c) return `role=${c.role}`;
+    return "unknown";
+  }).join(" | ");
+}
+function computeConfidenceLevel(args) {
+  const { isDefaultBaseline, reasons, hasEcosystemConflict, score } = args;
+  const positiveCodes = new Set(reasons.map((r) => r.code));
+  positiveCodes.delete("default-baseline");
+  const distinctSignals = positiveCodes.size;
+  const strongCount = (positiveCodes.has("repo-role-match") ? 1 : 0) + (positiveCodes.has("stack-match") ? 1 : 0) + (positiveCodes.has("requires-any-match") ? 1 : 0);
+  if (hasEcosystemConflict) return "low";
+  if (isDefaultBaseline && distinctSignals === 0) return "medium";
+  if (strongCount >= 2 && score >= 70) return "high";
+  if (strongCount >= 1 && distinctSignals >= 2 && score >= 50) return "medium";
+  if (distinctSignals === 1) return "low";
+  return distinctSignals >= 2 ? "medium" : "low";
+}
+function confidenceLevelToNumber(level, score) {
+  const base = level === "high" ? 0.85 : level === "medium" ? 0.6 : 0.3;
+  const bonus = Math.min(0.1, Math.max(0, score - 40) / 1e3);
+  return Number(Math.min(0.99, base + bonus).toFixed(2));
+}
+function mergeRecommendationWarnings(context) {
+  const riskLines = (context.securityRisks?.length ?? 0) > 0 ? [`Scan reported security signals: ${context.securityRisks.join("; ")}`] : [];
+  return [.../* @__PURE__ */ new Set([...context.warnings, ...riskLines])];
+}
+async function readChangedFiles(root) {
+  if (process.env.HAUS_DISABLE_GIT_SIGNALS === "1") return [];
+  try {
+    const result = await runGit(["diff", "--name-only"], { cwd: root });
+    if (result.exitCode !== 0) {
+      return [];
+    }
+    return result.stdout.split("\n").map((x) => x.trim()).filter(Boolean).sort();
+  } catch {
+    return [];
+  }
+}
+
+// src/utils/prompts.ts
+import { stdin as input, stdout as output } from "process";
+import readline from "readline/promises";
+async function ask(question) {
+  const rl = readline.createInterface({ input, output });
+  try {
+    const answer = await rl.question(`${question}
+> `);
+    return answer.trim();
+  } finally {
+    rl.close();
+  }
+}
+async function confirm(question) {
+  const answer = (await ask(`${question} [y/N]`)).toLowerCase();
+  return answer === "y" || answer === "yes";
+}
+
+// src/commands/setup-project.ts
+var GUIDED_QUESTIONS = [
+  "What is this project for?",
+  "Is it for a client, internal Haus work, or experimentation?",
+  "What should Claude help with most?",
+  "Is this project connected to other repositories?",
+  "Are there parts of the project Claude should avoid touching?",
+  "Are there client-specific rules or sensitive areas?",
+  "Do you want a minimal, standard, or strict setup?"
+];
+async function runSetupProject(options) {
+  const root = process.cwd();
+  let mode = options.guided ? "guided" : "fast";
+  if (!options.guided && !options.fast && !options.json) {
+    log("How do you want to set this project up?");
+    log("1. Guided setup - I'll ask a few simple questions, then scan the project.");
+    log("2. Fast setup - I'll only scan the project and recommend defaults.");
+    const choice = await ask("Choose 1 or 2");
+    mode = choice === "1" ? "guided" : "fast";
+  }
+  if (mode === "guided") {
+    const existing = await readJson(hausPath(root, "setup-answers.json")) ?? {};
+    const merged = {};
+    for (const question of GUIDED_QUESTIONS) {
+      if (options.json) {
+        merged[question] = existing[question] ?? "pending-user-answer";
+        continue;
+      }
+      const answer = await ask(question);
+      merged[question] = answer || existing[question] || "no-answer";
+    }
+    await writeJson(hausPath(root, "setup-answers.json"), merged);
+  }
+  const scanResult = await scanProject(root, mode);
+  if (options.json) {
+    log(JSON.stringify(scanResult, null, 2));
+  } else {
+    log("Haus scan complete");
+    log(`Roles: ${scanResult.repoRoles.join(", ") || "unknown"}`);
+    log(`Package manager: ${scanResult.packageManager}`);
+  }
+  const context = await readContextOrScan(root);
+  const recommendation = await recommend(root, context);
+  await writeJson(hausPath(root, "recommendation.json"), recommendation);
+  const hookSettings = await loadClaudeHooksSettings();
+  await writeJson(hausPath(root, "recommended-hooks.json"), flattenRecommendedHooks(hookSettings));
+  await writeJson(hausPath(root, "recommended-rules.json"), [
+    { id: "haus.rule.context-minimal", enabled: true },
+    { id: "haus.rule.security", enabled: true }
+  ]);
+  if (options.json) {
+    log(JSON.stringify(recommendation, null, 2));
+  } else {
+    log("Haus recommendation ready");
+    log(`Recommended: ${recommendation.recommended.length}`);
+    log(`Skipped: ${recommendation.skipped.length}`);
+  }
+  const hooks = await verifyProjectSettingsHooksContract(root);
+  const warningLines = [.../* @__PURE__ */ new Set([...context.warnings, ...recommendation.warnings ?? []])];
+  log(`Repo: ${context.repoName}`);
+  for (const warning of warningLines) log(`- WARN: ${warning}`);
+  if (hooks.skipped) {
+    log(`- HOOKS: (skipped) ${hooks.message}`);
+  } else if (!hooks.ok) {
+    log(`- HOOKS FAIL: ${hooks.message}`);
+    process.exitCode = 1;
+  } else {
+    log(`- HOOKS OK: ${hooks.message}`);
+  }
+  if (options.json) return;
+  const approved = await confirm("Approve and write Claude files now?");
+  if (!approved) {
+    log("Setup reviewed. No files written.");
+    log("Next step: run `haus apply --write` when ready.");
+    return;
+  }
+  const files = await writeClaudeFiles(root, false);
+  log("Applied files:");
+  files.forEach((f) => log(`- ${displayPath(root, f)}`));
+  const hooksAfter = await verifyProjectSettingsHooksContract(root);
+  if (hooksAfter.skipped) {
+    log(`- HOOKS: (skipped) ${hooksAfter.message}`);
+  } else if (!hooksAfter.ok) {
+    log(`- HOOKS FAIL: ${hooksAfter.message}`);
+    process.exitCode = 1;
+  } else {
+    log(`- HOOKS OK: ${hooksAfter.message}`);
+  }
+}
+
+// src/commands/init.ts
+async function runInit(options) {
+  const root = process.cwd();
+  const hausDir = path14.join(root, ".haus-workflow");
+  const alreadyInit = await fs11.pathExists(hausDir);
+  if (alreadyInit) {
+    log("Haus AI already initialized in this project.");
+    log("Run `haus setup-project` to reconfigure.");
+    return;
+  }
+  log("Welcome to Haus AI. Initializing this project for the first time.");
+  await runSetupProject(options);
+}
+
+// src/install/apply.ts
+import crypto2 from "crypto";
+import path17 from "path";
+import fs13 from "fs-extra";
+
+// src/install/header.ts
+var MD_PREFIX = "<!-- HAUS-MANAGED";
+var MD_SUFFIX = " -->";
+function parseAttrs(raw) {
+  const idMatch = /\bid=(\S+)/.exec(raw);
+  const vMatch = /\bv=(\S+)/.exec(raw);
+  const srcMatch = /\bsource=(\S+)/.exec(raw);
+  if (!idMatch || !vMatch || !srcMatch) return void 0;
+  return { stableId: idMatch[1], schemaVersion: vMatch[1], source: srcMatch[1] };
+}
+function parseMarkdownHeader(content) {
+  const firstLine = content.split("\n")[0] ?? "";
+  if (!firstLine.startsWith(MD_PREFIX)) return void 0;
+  return parseAttrs(firstLine);
+}
+function buildMarkdownHeader(h) {
+  return `${MD_PREFIX} id=${h.stableId} v=${h.schemaVersion} source=${h.source}${MD_SUFFIX}`;
+}
+function stampMarkdown(content, h) {
+  const header = buildMarkdownHeader(h);
+  const existing = parseMarkdownHeader(content);
+  if (existing) {
+    const rest = content.slice(content.indexOf("\n") + 1);
+    return `${header}
+${rest}`;
+  }
+  return `${header}
+${content}`;
+}
+
+// src/install/manifest.ts
+import os5 from "os";
+import path15 from "path";
+var MANIFEST_SCHEMA = "haus-install-manifest/1";
+function globalClaudeDir() {
+  return path15.join(os5.homedir(), ".claude");
+}
+function hausManifestPath() {
+  return path15.join(globalClaudeDir(), "haus", "install-manifest.json");
+}
+async function readManifest() {
+  return readJson(hausManifestPath());
+}
+async function writeManifest(manifest) {
+  await writeJson(hausManifestPath(), manifest);
+}
+function buildManifest(source, files, hooks) {
+  return {
+    _schema: MANIFEST_SCHEMA,
+    source,
+    installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    files,
+    hooks
+  };
+}
+
+// src/install/settings-merge.ts
+import path16 from "path";
+import fs12 from "fs-extra";
+function settingsJsonPath() {
+  return path16.join(globalClaudeDir(), "settings.json");
+}
+async function readSettings() {
+  const parsed = await readJson(settingsJsonPath());
+  return parsed ?? {};
+}
+async function writeSettings(settings) {
+  await writeJson(settingsJsonPath(), settings);
+}
+function mergeHooks(settings, fragments) {
+  const existing = settings._haus?.hooks ?? [];
+  const existingCommands = settings._haus?.hookCommands ?? [];
+  const existingSet = new Set(existing);
+  const updated = { ...settings };
+  updated.hooks = { ...settings.hooks ?? {} };
+  const addedIds = [];
+  const addedCommands = [];
+  for (const fragment of fragments) {
+    if (fragment.gate !== "keep") continue;
+    if (existingSet.has(fragment.id)) continue;
+    const event = fragment.event;
+    if (!updated.hooks[event]) updated.hooks[event] = [];
+    const entry = {
+      hooks: [{ type: "command", command: fragment.command }]
+    };
+    if (fragment.matcher) entry.matcher = fragment.matcher;
+    updated.hooks[event] = [...updated.hooks[event] ?? [], entry];
+    addedIds.push(fragment.id);
+    addedCommands.push(fragment.command);
+  }
+  updated._haus = {
+    hooks: [...existing, ...addedIds],
+    hookCommands: [...existingCommands, ...addedCommands]
+  };
+  return { settings: updated, addedIds };
+}
+function stripHausHooks(settings) {
+  if (!settings._haus) return settings;
+  const ownedCommands = new Set(settings._haus.hookCommands ?? []);
+  const usePrefix = ownedCommands.size === 0;
+  const updated = { ...settings };
+  updated.hooks = {};
+  for (const [event, entries] of Object.entries(settings.hooks ?? {})) {
+    const kept = entries.filter((entry) => {
+      const cmd = entry.hooks[0]?.command ?? "";
+      return usePrefix ? !cmd.startsWith("haus ") : !ownedCommands.has(cmd);
+    });
+    if (kept.length > 0) updated.hooks[event] = kept;
+  }
+  const { _haus: _, ...rest } = updated;
+  void _;
+  return rest;
+}
+async function loadHooksFragment(fragmentPath) {
+  let raw;
+  try {
+    raw = await fs12.readJson(fragmentPath);
+  } catch {
+    return [];
+  }
+  const data = raw;
+  return Array.isArray(data?.hooks) ? data.hooks : [];
+}
+
+// src/install/apply.ts
+var SCHEMA_VERSION3 = "1";
+function hashContent(content) {
+  return `sha256-${crypto2.createHash("sha256").update(content).digest("hex")}`;
+}
+function sourceVersion() {
+  try {
+    const pkgPath = path17.join(packageRoot(), "package.json");
+    const pkg = JSON.parse(fs13.readFileSync(pkgPath, "utf8"));
+    return `${pkg.name ?? "haus"}@${pkg.version ?? "0.0.0"}`;
+  } catch {
+    return "haus@0.0.0";
+  }
+}
+function globalSrcDir() {
+  return path17.join(packageRoot(), "library", "global");
+}
+function collectSourceFiles(srcDir, claudeDir) {
+  const entries = [];
+  const skillsDir = path17.join(srcDir, "skills");
+  if (fs13.pathExistsSync(skillsDir)) {
+    for (const skillName of fs13.readdirSync(skillsDir)) {
+      const skillFile = path17.join(skillsDir, skillName, "SKILL.md");
+      if (fs13.pathExistsSync(skillFile)) {
+        entries.push({
+          stableId: `skill.${skillName}`,
+          srcRelPath: path17.join("library", "global", "skills", skillName, "SKILL.md"),
+          destPath: path17.join(claudeDir, "skills", skillName, "SKILL.md")
+        });
+      }
+    }
+  }
+  const agentsDir = path17.join(srcDir, "agents");
+  if (fs13.pathExistsSync(agentsDir)) {
+    for (const agentFile of fs13.readdirSync(agentsDir)) {
+      if (!agentFile.endsWith(".md")) continue;
+      const agentName = agentFile.replace(/\.md$/, "");
+      entries.push({
+        stableId: `agent.${agentName}`,
+        srcRelPath: path17.join("library", "global", "agents", agentFile),
+        destPath: path17.join(claudeDir, "agents", agentFile)
+      });
+    }
+  }
+  return entries;
+}
+async function applyInstall(options = {}) {
+  const { dryRun = false, force = false, check = false } = options;
+  const claudeDir = globalClaudeDir();
+  const srcDir = globalSrcDir();
+  const source = sourceVersion();
+  const existingManifest = await readManifest();
+  const manifestByDest = new Map(existingManifest?.files.map((f) => [f.destPath, f]) ?? []);
+  const sourceFiles = collectSourceFiles(srcDir, claudeDir);
+  const result = {
+    created: [],
+    updated: [],
+    skipped: [],
+    deleted: [],
+    hookIds: [],
+    drift: false
+  };
+  const manifestFiles = [];
+  for (const entry of sourceFiles) {
+    const srcPath = path17.join(packageRoot(), entry.srcRelPath);
+    const rawContent = await readText(srcPath);
+    if (rawContent === void 0) {
+      warn(`Source file not found: ${entry.srcRelPath}`);
+      continue;
+    }
+    const stamped = stampMarkdown(rawContent, {
+      stableId: entry.stableId,
+      schemaVersion: SCHEMA_VERSION3,
+      source
+    });
+    const newHash = hashContent(stamped);
+    const existing = manifestByDest.get(entry.destPath);
+    if (check) {
+      if (existing && existing.hash !== newHash) {
+        result.drift = true;
+        result.skipped.push(entry.destPath);
+      }
+      continue;
+    }
+    const destExists = fs13.pathExistsSync(entry.destPath);
+    if (destExists) {
+      const currentContent = await readText(entry.destPath);
+      if (currentContent !== void 0) {
+        const hasHeader = parseMarkdownHeader(currentContent) !== void 0;
+        if (!hasHeader) {
+          warn(`Refusing to overwrite user-owned file: ${entry.destPath}`);
+          result.skipped.push(entry.destPath);
+          continue;
+        }
+        if (existing && hashContent(currentContent) !== existing.hash && !force) {
+          warn(`User edited haus file (skipping): ${entry.destPath} \u2014 use --force to overwrite`);
+          result.skipped.push(entry.destPath);
+          manifestFiles.push(existing);
+          continue;
+        }
+        if (existing && existing.hash === newHash && !force) {
+          result.skipped.push(entry.destPath);
+          manifestFiles.push({ ...existing, hash: newHash });
+          continue;
+        }
+        if (!dryRun) await writeText(entry.destPath, stamped);
+        result.updated.push(entry.destPath);
+      }
+    } else {
+      if (!dryRun) await writeText(entry.destPath, stamped);
+      result.created.push(entry.destPath);
+    }
+    manifestFiles.push({
+      stableId: entry.stableId,
+      destPath: entry.destPath,
+      srcRelPath: entry.srcRelPath,
+      hash: newHash,
+      schemaVersion: SCHEMA_VERSION3
+    });
+  }
+  const fragmentPath = path17.join(srcDir, "settings-fragments", "hooks.json");
+  const fragments = await loadHooksFragment(fragmentPath);
+  const settings = await readSettings();
+  const { settings: mergedSettings, addedIds } = mergeHooks(settings, fragments);
+  result.hookIds = addedIds;
+  if (!check && existingManifest) {
+    const currentDestPaths = new Set(sourceFiles.map((f) => f.destPath));
+    for (const entry of existingManifest.files) {
+      if (currentDestPaths.has(entry.destPath)) continue;
+      if (!fs13.pathExistsSync(entry.destPath)) continue;
+      const content = await readText(entry.destPath);
+      if (!content) continue;
+      const hasHeader = parseMarkdownHeader(content) !== void 0;
+      const currentHash = hashContent(content);
+      if (hasHeader && currentHash === entry.hash) {
+        if (!dryRun) await fs13.remove(entry.destPath);
+        result.deleted.push(entry.destPath);
+      } else {
+        warn(`Orphaned file ${entry.destPath} was user-modified \u2014 leaving in place`);
+        result.skipped.push(entry.destPath);
+      }
+    }
+  }
+  if (!dryRun && !check) {
+    await writeSettings(mergedSettings);
+    const manifest = buildManifest(source, manifestFiles, [...existingManifest?.hooks ?? [], ...addedIds]);
+    await writeManifest(manifest);
+  }
+  return result;
+}
+function printApplyResult(result, dryRun) {
+  const prefix = dryRun ? "[dry-run] " : "";
+  if (result.created.length) {
+    log(`${prefix}Created:`);
+    result.created.forEach((p) => log(`  + ${p}`));
+  }
+  if (result.updated.length) {
+    log(`${prefix}Updated:`);
+    result.updated.forEach((p) => log(`  ~ ${p}`));
+  }
+  if (result.deleted.length) {
+    log(`${prefix}Deleted (orphaned):`);
+    result.deleted.forEach((p) => log(`  x ${p}`));
+  }
+  if (result.skipped.length) {
+    log(`${prefix}Skipped:`);
+    result.skipped.forEach((p) => log(`  - ${p}`));
+  }
+  if (result.hookIds.length) {
+    log(`${prefix}Hooks added: ${result.hookIds.join(", ")}`);
+  }
+  if (result.drift) {
+    warn("Install drift detected \u2014 run `haus install` to sync.");
+  }
+}
+
+// src/commands/install.ts
+async function runInstall(options) {
+  try {
+    const result = await applyInstall({
+      dryRun: options.dryRun,
+      force: options.force,
+      check: options.check
+    });
+    printApplyResult(result, options.dryRun ?? false);
+    if (options.check && result.drift) {
+      process.exitCode = 1;
+    } else if (!options.check && !options.dryRun) {
+      const total = result.created.length + result.updated.length;
+      log(`haus install complete (${total} file(s) written, ${result.hookIds.length} hook(s) added)`);
+    }
+  } catch (err) {
+    error(`haus install failed: ${err instanceof Error ? err.message : String(err)}`);
+    process.exitCode = 1;
+  }
+}
+
+// src/memory/memory-store.ts
+var FILES = ["project-learnings.md", "decisions.md", "recurring-issues.md", "client-context.md"];
+async function ensureMemory(root) {
+  await Promise.all(
+    FILES.map(async (name) => {
+      const file = hausPath(root, "memory", name);
+      const current = await readText(file);
+      if (!current) await writeText(file, `# ${name}
+`);
+    })
+  );
+  const indexFile = hausPath(root, "memory", "index.json");
+  const index = await readJson(indexFile);
+  if (!index) await writeJson(indexFile, { files: [...FILES] });
+}
+async function readMemory(root) {
+  await ensureMemory(root);
+  const blocks = await Promise.all(FILES.map((name) => readText(hausPath(root, "memory", name))));
+  return blocks.filter(Boolean).join("\n");
+}
+async function appendLearning(root, line) {
+  await ensureMemory(root);
+  const file = hausPath(root, "memory", "project-learnings.md");
+  const current = await readText(file) ?? "# project-learnings.md\n";
+  await writeText(file, `${current}
+- ${line}
+`);
+}
+
+// src/memory/redact-memory.ts
+function redactMemory(text) {
+  return text.replace(/(api[_-]?key|token|secret|password)\s*[:=]\s*\S+/gi, "$1=[REDACTED]").replace(/-----BEGIN [A-Z ]+-----[\s\S]*?-----END [A-Z ]+-----/g, "[REDACTED-KEY]");
+}
+
+// src/commands/memory.ts
+async function runMemory(subcommand, options) {
+  const root = process.cwd();
+  if (subcommand === "inject" && options.fromHook && !await isHookEnabled(root, "memoryInject")) {
+    return;
+  }
+  await ensureMemory(root);
+  if (subcommand === "status") {
+    log("Memory ready at .haus-workflow/memory");
+    return;
+  }
+  if (subcommand === "add") {
+    if (!options.text) throw new Error("memory add requires text");
+    await appendLearning(root, redactMemory(options.text));
+    log("Memory added");
+    return;
+  }
+  if (subcommand === "inject") {
+    const text = redactMemory(await readMemory(root));
+    if (!text.trim()) {
+      log("No relevant Haus memory found.");
+      return;
+    }
+    const compact = `Task: ${options.task ?? "n/a"}
+${text}`.slice(0, options.fromHook ? 1200 : 4e3);
+    log(compact);
+    return;
+  }
+  log("Promotion proposal: review memory and move stable rules into .claude/rules manually.");
+}
+
+// src/commands/recommend.ts
+async function runRecommend(options) {
+  const root = process.cwd();
+  const context = await readContextOrScan(root);
+  const result = await recommend(root, context);
+  await writeJson(hausPath(root, "recommendation.json"), result);
+  const hookSettings = await loadClaudeHooksSettings();
+  await writeJson(hausPath(root, "recommended-hooks.json"), flattenRecommendedHooks(hookSettings));
+  await writeJson(hausPath(root, "recommended-rules.json"), [
+    { id: "haus.rule.context-minimal", enabled: true },
+    { id: "haus.rule.security", enabled: true }
+  ]);
+  if (options.json) {
+    log(JSON.stringify(result, null, 2));
+    return;
+  }
+  log("Haus recommendation ready");
+  log(`Recommended: ${result.recommended.length}`);
+  log(`Skipped: ${result.skipped.length}`);
+}
+
+// src/commands/refresh.ts
+async function runRefresh() {
+  const result = await scanProject(process.cwd(), "fast");
+  log("Haus scan complete");
+  log(`Roles: ${result.repoRoles.join(", ") || "unknown"}`);
+  log(`Package manager: ${result.packageManager}`);
+}
+
+// src/commands/scan.ts
+async function runScan(options) {
+  const mode = options.mode ?? "fast";
+  const result = await scanProject(process.cwd(), mode);
+  if (options.json) {
+    log(JSON.stringify(result, null, 2));
+    return;
+  }
+  log("Haus scan complete");
+  log(`Roles: ${result.repoRoles.join(", ") || "unknown"}`);
+  log(`Package manager: ${result.packageManager}`);
+}
+
+// src/commands/undo.ts
+import path18 from "path";
+import fs14 from "fs-extra";
+var CLAUDE_DIR = ".claude";
+async function runUndo(options) {
+  const root = process.cwd();
+  const targets = [path18.join(root, CLAUDE_DIR), path18.join(root, HAUS_DIR)];
+  const existing = targets.filter((p) => fs14.existsSync(p));
+  if (existing.length === 0) {
+    log("Nothing to remove: no .claude/ or .haus-workflow/ in this directory.");
+    return;
+  }
+  if (!options.yes) {
+    const ok = await confirm(
+      `Remove ${existing.map((p) => path18.relative(root, p)).join(" and ")}? This cannot be undone.`
+    );
+    if (!ok) {
+      log("Cancelled.");
+      return;
+    }
+  }
+  for (const p of existing) {
+    await fs14.remove(p);
+    log(`Removed ${path18.relative(root, p)}`);
+  }
+}
+
+// src/install/uninstall.ts
+import crypto3 from "crypto";
+import path19 from "path";
+import fs15 from "fs-extra";
+async function runUninstall(options = {}) {
+  const { force = false } = options;
+  const manifest = await readManifest();
+  const result = { deleted: [], skipped: [], hooksStripped: false };
+  if (!manifest) {
+    warn("No install manifest found \u2014 nothing to uninstall.");
+    return result;
+  }
+  for (const entry of manifest.files) {
+    const exists = fs15.pathExistsSync(entry.destPath);
+    if (!exists) continue;
+    const content = await readText(entry.destPath);
+    if (content === void 0) continue;
+    const header = parseMarkdownHeader(content);
+    if (!header) {
+      warn(`Skipping user-owned file (no HAUS-MANAGED header): ${entry.destPath}`);
+      result.skipped.push(entry.destPath);
+      continue;
+    }
+    const currentHash = `sha256-${crypto3.createHash("sha256").update(content).digest("hex")}`;
+    if (currentHash !== entry.hash && !force) {
+      warn(`Skipping user-edited haus file (hash mismatch): ${entry.destPath} \u2014 use --force to delete`);
+      result.skipped.push(entry.destPath);
+      continue;
+    }
+    await fs15.remove(entry.destPath);
+    await pruneEmptyDir(path19.dirname(entry.destPath));
+    result.deleted.push(entry.destPath);
+  }
+  const settings = await readSettings();
+  const stripped = stripHausHooks(settings);
+  await writeSettings(stripped);
+  result.hooksStripped = true;
+  const hausDir = path19.join(globalClaudeDir(), "haus");
+  const manifestPath = hausManifestPath();
+  if (fs15.pathExistsSync(manifestPath)) {
+    await fs15.remove(manifestPath);
+  }
+  if (fs15.pathExistsSync(hausDir)) {
+    const remaining = await fs15.readdir(hausDir);
+    if (remaining.length === 0) await fs15.remove(hausDir);
+  }
+  return result;
+}
+function printUninstallResult(result) {
+  if (result.deleted.length) {
+    log("Deleted:");
+    result.deleted.forEach((p) => log(`  - ${p}`));
+  }
+  if (result.skipped.length) {
+    log("Skipped (user-owned or mismatch):");
+    result.skipped.forEach((p) => log(`  ! ${p}`));
+  }
+  if (result.hooksStripped) {
+    log("Haus hook entries removed from ~/.claude/settings.json");
+  }
+}
+async function pruneEmptyDir(dir) {
+  try {
+    const entries = await fs15.readdir(dir);
+    if (entries.length === 0) await fs15.remove(dir);
+  } catch {
+  }
+}
+
+// src/commands/uninstall.ts
+async function runUninstallCommand(options) {
+  try {
+    const result = await runUninstall({ force: options.force });
+    printUninstallResult(result);
+    log("haus uninstall complete");
+  } catch (err) {
+    error(`haus uninstall failed: ${err instanceof Error ? err.message : String(err)}`);
+    process.exitCode = 1;
+  }
+}
+
+// src/commands/update.ts
+import path21 from "path";
+
+// src/update/diff-generated-files.ts
+function diffGeneratedFiles() {
+  return "Generated files may change in .claude/* and .haus-workflow/haus.lock.json. Review git diff before apply.";
+}
+function summarizeLockDiff(before, after) {
+  if (before === after) return "No lockfile textual changes.";
+  const unified = createUnifiedDiff(".haus-workflow/haus.lock.json", before, after);
+  const counts = summarizeDiff(unified);
+  try {
+    const prev = JSON.parse(before || "[]");
+    const next = JSON.parse(after || "[]");
+    const prevIds = new Set(prev.map((x) => x.id));
+    const nextIds = new Set(next.map((x) => x.id));
+    const added = [...nextIds].filter((id) => !prevIds.has(id));
+    const removed = [...prevIds].filter((id) => !nextIds.has(id));
+    if (added.length === 0 && removed.length === 0)
+      return `Lock changed: +${counts.additions} -${counts.deletions} lines`;
+    return `Lock item changes: +${added.length} -${removed.length} (lines +${counts.additions} -${counts.deletions})`;
+  } catch {
+    return `Lock item changes unavailable. Text diff lines: +${counts.additions} -${counts.deletions}`;
+  }
+}
+
+// src/update/lockfile.ts
+import { mkdir, readFile as readFile2, copyFile } from "fs/promises";
+import path20 from "path";
+async function checkLock(root) {
+  const lock = await readJson(hausPath(root, "haus.lock.json")) ?? [];
+  const hasValidVersions = lock.every((item) => !item.version || normalizeVersion(item.version) !== null);
+  return { ok: lock.length > 0 && hasValidVersions, count: lock.length };
+}
+async function applyLock(root) {
+  const lockPath = hausPath(root, "haus.lock.json");
+  let before = "[]";
+  try {
+    before = await readFile2(lockPath, "utf8");
+  } catch {
+    before = "[]";
+  }
+  const lock = await readJson(lockPath) ?? [];
+  try {
+    const backupDir = hausPath(root, "backups");
+    await mkdir(backupDir, { recursive: true });
+    await copyFile(lockPath, path20.join(backupDir, `haus.lock.${Date.now()}.json`));
+  } catch {
+  }
+  const enriched = await Promise.all(
+    lock.map(async (x) => {
+      const paths = Array.isArray(x.paths) ? x.paths.map(String) : [];
+      const { hash: _oldHash, ...stableFields } = x;
+      const newHash = await hashInstalledPaths(root, paths);
+      return { ...stableFields, paths, hash: newHash };
+    })
+  );
+  await writeJson(lockPath, enriched);
+  const after = `${JSON.stringify(enriched, null, 2)}
+`;
+  return { before, after };
+}
+function diffLock(before, after) {
+  if (!hasTextChanged(before, after)) return "No lockfile changes.";
+  return createUnifiedDiff(".haus-workflow/haus.lock.json", before, after);
+}
+async function hasLocalOverrides(root) {
+  try {
+    await readFile2(path20.join(root, ".claude", "settings.json"), "utf8");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/commands/update.ts
+var NPM_PACKAGE_NAME = "@haus-tech/haus-workflow";
+async function checkNpmVersion(currentVersion) {
+  try {
+    const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(NPM_PACKAGE_NAME)}/latest`, {
+      signal: AbortSignal.timeout(8e3)
+    });
+    if (!res.ok) return;
+    const data = await res.json();
+    const latest = data?.version;
+    if (!latest || !normalizeVersion(latest) || !normalizeVersion(currentVersion)) return;
+    if (compareVersions(latest, currentVersion) > 0) {
+      log(`npm update available: ${currentVersion} \u2192 ${latest}`);
+      log(`Run: npm install -g ${NPM_PACKAGE_NAME}`);
+    } else {
+      log(`npm package up to date: ${currentVersion}`);
+    }
+  } catch {
+  }
+}
+async function runUpdate(options) {
+  const root = process.cwd();
+  if (options.check) {
+    const status = await checkLock(root);
+    log(
+      JSON.stringify(
+        {
+          ...status,
+          localOverrides: await hasLocalOverrides(root),
+          summary: diffGeneratedFiles()
+        },
+        null,
+        2
+      )
+    );
+    if (!status.ok) process.exitCode = 1;
+    return;
+  }
+  const pkgJson = await readJson(path21.join(packageRoot(), "package.json"));
+  const currentVersion = pkgJson?.version ?? "0.0.0";
+  await checkNpmVersion(currentVersion);
+  if (await hasLocalOverrides(root)) {
+    log("Local .claude overrides detected. Preserving local files; only lockfile updated.");
+  }
+  const { before, after } = await applyLock(root);
+  log(diffLock(before, after));
+  log(summarizeLockDiff(before, after));
+  log("Syncing remote catalog...");
+  const sync = await syncRemoteCatalog();
+  if (sync.newItems.length > 0) {
+    log(`Catalog updated: ${sync.newItems.length} new item(s): ${sync.newItems.join(", ")}`);
+    log("Run `haus recommend && haus apply --write` to install new skills.");
+  } else if (sync.unchanged > 0) {
+    log(`Catalog up to date (${sync.unchanged} item(s) unchanged).`);
+  }
+  if (sync.failed.length > 0) {
+    warn(`Failed to fetch ${sync.failed.length} item(s): ${sync.failed.join(", ")}`);
+  }
+  log("Update applied with backup in .haus-workflow/backups/. Run haus doctor.");
+}
+
+// src/commands/validate-catalog.ts
+import path23 from "path";
+
+// src/catalog/allowed-stacks.ts
+import path22 from "path";
+async function readAllowedStacks(root) {
+  const data = await readJson(path22.join(root, "library", "catalog", "allowed-stacks.json"));
+  return data?.stacks ?? [];
+}
+
+// src/commands/validate-catalog.ts
+var FORBIDDEN2 = [
+  "python",
+  "django",
+  "go",
+  "rust",
+  "java",
+  "spring",
+  "kotlin",
+  "swift",
+  "android",
+  "flutter",
+  "dart",
+  "c++",
+  "perl",
+  "defi",
+  "trading"
+];
+async function auditForbiddenStacks(items) {
+  const failures = [];
+  for (const item of items) {
+    const tags = Array.isArray(item.tags) ? item.tags : [];
+    const text = `${item.id} ${tags.join(" ")}`.toLowerCase();
+    for (const word of FORBIDDEN2) {
+      if (text.includes(word)) failures.push(`${item.id}: unsupported stack/tag "${word}"`);
+    }
+  }
+  return failures;
+}
+async function auditManifestStructure(items) {
+  const failures = [];
+  const seenIds = /* @__PURE__ */ new Map();
+  const seenPaths = /* @__PURE__ */ new Map();
+  for (let i = 0; i < items.length; i++) {
+    const item = items[i];
+    if (!item.id) {
+      failures.push(`item[${i}]: missing id`);
+      continue;
+    }
+    if (!item.type) {
+      failures.push(`${item.id}: missing type`);
+      continue;
+    }
+    if (!item.source) {
+      failures.push(`${item.id}: missing source`);
+    }
+    if (!item.title) {
+      failures.push(`${item.id}: missing title`);
+    }
+    const prev = seenIds.get(item.id);
+    if (prev !== void 0) {
+      failures.push(`${item.id}: duplicate id (first at index ${prev})`);
+    } else {
+      seenIds.set(item.id, i);
+    }
+    if (item.type === "skill" || item.type === "agent") {
+      if (!item.path) {
+        failures.push(`${item.id}: missing path`);
+      } else {
+        const norm = item.path.replace(/\\/g, "/");
+        const existing = seenPaths.get(norm);
+        if (existing) {
+          failures.push(`${item.id}: path "${norm}" already used by ${existing}`);
+        } else {
+          seenPaths.set(norm, item.id);
+        }
+      }
+      const isHaus = item.source === "haus";
+      const isCuratedApproved = item.source === "curated" && item.reviewStatus === "approved";
+      if (!isHaus && !isCuratedApproved) {
+        failures.push(`${item.id}: source must be "haus" or curated with reviewStatus "approved"`);
+      }
+      for (const ref of item.references ?? []) {
+        if (/^http:\/\//i.test(ref)) {
+          failures.push(`${item.id}: reference uses insecure http:// URL: ${ref}`);
+        }
+      }
+    }
+  }
+  return failures;
+}
+async function runValidateCatalog(manifestPath) {
+  if (!manifestPath) {
+    error("Usage: haus validate-catalog <path/to/manifest.json>");
+    process.exitCode = 1;
+    return;
+  }
+  const abs = path23.resolve(process.cwd(), manifestPath);
+  const data = await readJson(abs);
+  if (!data?.items) {
+    error(`Could not read catalog manifest at ${abs}`);
+    process.exitCode = 1;
+    return;
+  }
+  const items = data.items;
+  const [structureFailures, stackFailures] = await Promise.all([
+    auditManifestStructure(items),
+    auditForbiddenStacks(items)
+  ]);
+  const allowed = new Set((await readAllowedStacks(packageRoot())).map((x) => x.toLowerCase()));
+  const tagFailures = [];
+  if (allowed.size > 0) {
+    for (const item of items) {
+      for (const tag of Array.isArray(item.tags) ? item.tags : []) {
+        if (!allowed.has(tag.toLowerCase()) && !tag.includes("-patterns") && tag !== "haus" && tag !== "security" && tag !== "quality" && tag !== "review" && tag !== "workflow") {
+          tagFailures.push(`${item.id}: tag not in allowlist: "${tag}"`);
+        }
+      }
+    }
+  }
+  const allFailures = [...structureFailures, ...stackFailures, ...tagFailures];
+  if (allFailures.length) {
+    allFailures.forEach((f) => error(f));
+    process.exitCode = 1;
+    return;
+  }
+  log(`Catalog valid. ${items.length} items checked.`);
+}
+
+// src/commands/workspace.ts
+import path24 from "path";
+import YAML from "yaml";
+async function runWorkspace(action) {
+  if (action === "init") {
+    await writeText(
+      "haus.workspace.yaml",
+      `client: unknown
+repos:
+  - name: current
+    path: .
+    role: auto
+relationships: []
+`
+    );
+    log("Workspace initialized.");
+    return;
+  }
+  const configText = await readText("haus.workspace.yaml");
+  if (!configText) {
+    error("Missing haus.workspace.yaml. Run `haus workspace init` first.");
+    process.exitCode = 1;
+    return;
+  }
+  const config = YAML.parse(configText);
+  const repos = config.repos ?? [];
+  if (repos.length === 0) {
+    error("No repos configured in haus.workspace.yaml.");
+    process.exitCode = 1;
+    return;
+  }
+  const summaries = [];
+  const ownership = {};
+  for (const repo of repos) {
+    const repoRoot = path24.resolve(process.cwd(), repo.path);
+    const result = await scanProject(repoRoot, "fast");
+    summaries.push({
+      name: repo.name,
+      path: repo.path,
+      roles: result.repoRoles,
+      packageManager: result.packageManager,
+      deps: result.dependencies
+    });
+    for (const dep of result.dependencies) {
+      ownership[dep] ??= [];
+      ownership[dep].push(repo.name);
+    }
+  }
+  await writeJson(".haus-workflow/workspace-summary.json", {
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    repos: summaries
+  });
+  await writeJson(".haus-workflow/dependency-ownership-map.json", ownership);
+  await writeText(
+    ".haus-workflow/cross-repo-summary.md",
+    `# Cross Repo Summary
+
+${summaries.map(
+      (repo) => `- ${repo.name} (${repo.path}) roles: ${repo.roles.join(", ") || "unknown"}; package manager: ${repo.packageManager}`
+    ).join("\n")}
+`
+  );
+  log(
+    "Workspace scan complete. Wrote .haus-workflow/workspace-summary.json, cross-repo-summary.md, dependency-ownership-map.json"
+  );
+}
+
+// src/cli.ts
+function cliVersion() {
+  try {
+    const pkgPath = path25.join(packageRoot(), "package.json");
+    const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
+    return pkg.version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+var program = new Command();
+function validateRuntimeNodeVersion() {
+  try {
+    const pkgPath = path25.join(packageRoot(), "package.json");
+    const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
+    const requiredRange = pkg.engines?.node;
+    if (requiredRange && !satisfiesVersion(process.version, requiredRange)) {
+      throw new Error(`Node ${process.version} does not satisfy required range ${requiredRange}`);
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    error(message);
+    process.exit(1);
+  }
+}
+validateRuntimeNodeVersion();
+program.name("haus").description("Haus AI workflow CLI").version(cliVersion());
+program.command("scan").option("--json").action(runScan);
+program.command("recommend").option("--json").action(runRecommend);
+program.command("setup-project").option("--guided").option("--fast").option("--json").action(runSetupProject);
+program.command("doctor").option("--hooks", "Verify .claude/settings.json matches the hook contract").action(runDoctor);
+program.command("apply").option("--dry-run").option("--write").action(runApply);
+program.command("undo").option("-y, --yes", "Skip confirmation").action(runUndo);
+program.command("explain-recommendation").option("--json").action(runExplainRecommendation);
+program.command("context").option("--task <task>").option("--from-hook").option("--json").option("--verbose").action(runContext);
+program.command("init").option("--fast").option("--json").action(runInit);
+program.command("refresh").action(runRefresh);
+program.command("catalog-audit").action(runCatalogAudit);
+program.command("validate-catalog").argument("[manifest]").action(runValidateCatalog);
+program.command("update").option("--check").action(runUpdate);
+program.command("install").option("--dry-run").option("--force").option("--check", "Exit non-zero if any HAUS-MANAGED file is out of date").action(runInstall);
+program.command("uninstall").option("--force").action(runUninstallCommand);
+var memory = program.command("memory");
+memory.command("status").action(() => runMemory("status", {}));
+memory.command("add <text>").action((text) => runMemory("add", { text }));
+memory.command("inject").option("--task <task>").option("--from-hook").action((opts) => runMemory("inject", opts));
+memory.command("promote").action(() => runMemory("promote", {}));
+var guard = program.command("guard");
+guard.command("file-access").option("--from-hook").action((opts) => runGuard("file-access", opts));
+guard.command("bash").option("--from-hook").action((opts) => runGuard("bash", opts));
+var workspace = program.command("workspace");
+workspace.command("init").action(() => runWorkspace("init"));
+workspace.command("scan").action(() => runWorkspace("scan"));
+program.parseAsync(process.argv).catch((err) => {
+  const message = err instanceof Error ? err.message : String(err);
+  error(message);
+  process.exitCode = 1;
+});