@haus-tech/haus-workflow 0.11.1 → 0.12.1

package/dist/cli.js

@@ -2,7 +2,7 @@
 
 // src/cli.ts
 import { readFileSync as readFileSync3 } from "fs";
-import path28 from "path";
+import path29 from "path";
 import { Command } from "commander";
 
 // src/commands/apply.ts
@@ -53,6 +53,18 @@ async function fetchRemoteManifest() {
     return null;
   }
 }
+var WORKFLOW_TEMPLATE_REL = "templates/agentic-workflow-standard.md";
+async function readWorkflowTemplate(opts = {}) {
+  const dest = path.join(CACHE_DIR, WORKFLOW_TEMPLATE_REL);
+  if (await fs.pathExists(dest)) return fs.readFile(dest, "utf8");
+  const text = await fetchText(`${REMOTE_BASE}/${WORKFLOW_TEMPLATE_REL}`);
+  if (text === null) return null;
+  if (!opts.dryRun) {
+    await fs.ensureDir(path.dirname(dest));
+    await fs.writeFile(dest, text, "utf8");
+  }
+  return text;
+}
 function isSafeCatalogPath(itemPath) {
   if (!itemPath || path.isAbsolute(itemPath) || itemPath.includes("\\")) return false;
   const normalized = path.normalize(itemPath);
@@ -80,7 +92,8 @@ async function syncRemoteCatalog() {
   let unchanged = 0;
   const failed = [];
   for (const item of items) {
-    if (item.type !== "skill" && item.type !== "agent" || !item.path) continue;
+    if (item.type !== "skill" && item.type !== "agent" && item.type !== "template" || !item.path)
+      continue;
     if (!isSafeCatalogPath(item.path)) {
       warn(`Skipping ${item.id}: invalid path "${item.path}"`);
       failed.push(item.id);
@@ -159,7 +172,7 @@ async function getCacheManifestAge() {
 
 // src/claude/write-claude-files.ts
 import path10 from "path";
-import fs9 from "fs-extra";
+import fs10 from "fs-extra";
 
 // src/update/hash-installed.ts
 import path3 from "path";
@@ -254,10 +267,10 @@ function summarizeDiff(diffText) {
   const lines = diffText.split("\n");
   let additions = 0;
   let deletions = 0;
-  for (const line of lines) {
-    if (line.startsWith("+++ ") || line.startsWith("--- ")) continue;
-    if (line.startsWith("+")) additions += 1;
-    if (line.startsWith("-")) deletions += 1;
+  for (const line2 of lines) {
+    if (line2.startsWith("+++ ") || line2.startsWith("--- ")) continue;
+    if (line2.startsWith("+")) additions += 1;
+    if (line2.startsWith("-")) deletions += 1;
   }
   return { additions, deletions };
 }
@@ -313,8 +326,7 @@ import path5 from "path";
 var CONFIG_PATH = ".haus-workflow/config.json";
 var DEFAULT_HOOKS_CONFIG = {
   hooks: {
-    context: { enabled: false },
-    memoryInject: { enabled: false }
+    context: { enabled: false }
   }
 };
 async function isHookEnabled(root, key) {
@@ -322,15 +334,103 @@ async function isHookEnabled(root, key) {
   return cfg?.hooks?.[key]?.enabled === true;
 }
 
+// src/security/dangerous-commands.ts
+var DANGEROUS_COMMANDS = [
+  "rm -rf",
+  "sudo",
+  "chmod -R 777",
+  "chown -R",
+  "git push --force",
+  "git reset --hard",
+  "docker system prune",
+  "drop database",
+  "truncate table",
+  "php artisan migrate --force",
+  "npm publish",
+  "yarn npm publish",
+  "pnpm publish"
+];
+
+// src/security/sensitive-paths.ts
+var SENSITIVE_PATHS = [
+  ".env",
+  ".env.*",
+  "*.pem",
+  "*.key",
+  "*.p12",
+  "*.pfx",
+  "id_rsa",
+  "id_ed25519",
+  "*.sql",
+  "*.dump",
+  "*.backup",
+  "*.bak",
+  "storage/logs",
+  "wp-content/uploads",
+  "uploads",
+  "customer-data",
+  "exports",
+  "secrets",
+  "certs"
+];
+var SENSITIVE_PATH_REGEXES = [
+  /^\.env(\.|$)/,
+  /(^|\/)\.env(\.|$)/,
+  /\.pem$/,
+  /\.key$/,
+  /\.p12$/,
+  /\.pfx$/,
+  /\.sql$/,
+  /\.dump$/,
+  /customer-data/,
+  /exports/,
+  /certs/,
+  /secrets/,
+  /(^|\/)storage\/logs(\/|$)/,
+  /(^|\/)wp-content\/uploads(\/|$)/,
+  /(^|\/)uploads(\/|$)/
+];
+var SENSITIVE_ITEM_KEYWORDS = [
+  ".env",
+  "secrets",
+  "certs",
+  "customer-data",
+  "exports",
+  ".pem",
+  ".key"
+];
+
+// src/security/deny-rules.ts
+var SENSITIVE_DIRS = /* @__PURE__ */ new Set([
+  "storage/logs",
+  "wp-content/uploads",
+  "uploads",
+  "customer-data",
+  "exports",
+  "secrets",
+  "certs"
+]);
+var FILE_TOOLS = ["Read", "Edit", "Write"];
+function buildDenyRules() {
+  const rules = [];
+  for (const command of DANGEROUS_COMMANDS) {
+    rules.push(`Bash(${command}:*)`);
+  }
+  for (const path30 of SENSITIVE_PATHS) {
+    const pattern = SENSITIVE_DIRS.has(path30) ? `${path30}/**` : path30;
+    for (const tool of FILE_TOOLS) {
+      rules.push(`${tool}(${pattern})`);
+    }
+  }
+  return [...new Set(rules)];
+}
+
 // src/claude/load-hooks.ts
 var CANONICAL_HOOKS = {
   hooks: {
     UserPromptSubmit: [
       {
-        hooks: [
-          { type: "command", command: "haus context --from-hook || true" },
-          { type: "command", command: "haus memory inject --from-hook || true" }
-        ]
+        hooks: [{ type: "command", command: "haus context --from-hook || true" }]
       }
     ],
     PreToolUse: [
@@ -347,12 +447,11 @@ var CANONICAL_HOOKS = {
 };
 var STABLE_HOOK_IDS = {
   "haus context --from-hook || true": "haus.context-hook",
-  "haus memory inject --from-hook || true": "haus.memory-hook",
   "haus guard file-access --from-hook || true": "haus.guard-file",
   "haus guard bash --from-hook || true": "haus.guard-bash"
 };
 async function loadClaudeHooksSettings() {
-  return CANONICAL_HOOKS;
+  return { ...CANONICAL_HOOKS, permissions: { deny: buildDenyRules() } };
 }
 function flattenRecommendedHooks(settings) {
   const out = [];
@@ -438,9 +537,11 @@ function renderProjectFacts(ctx, rec, pkgVersion) {
   const repoName = ctx.repoName ?? path6.basename(ctx.root ?? "unknown");
   return `${header}
 
-# Project facts
+# What haus found in this project
 
-> Auto-generated by \`haus apply\`. Do not edit \u2014 changes will be overwritten on next apply.
+> This is a plain summary of your project that haus wrote automatically, so Claude
+> always has the basics to hand. haus rewrites it on every \`haus apply\`, so don't
+> edit it by hand \u2014 your changes would be replaced next time.
 
 **Repo:** ${repoName}
 **Package manager:** ${ctx.packageManager ?? "unknown"}
@@ -472,7 +573,9 @@ async function writeProjectFacts(root, pkgVersion, dryRun) {
     dependencies: [],
     securityRisks: [],
     crossRepoHints: [],
-    warnings: []
+    warnings: [],
+    detectionStatus: "unknown",
+    unsupportedSignals: []
   };
   const rec = await readJson(hausPath(root, "recommendation.json")) ?? {
     mode: "fast",
@@ -564,84 +667,189 @@ async function writeRootClaudeMd(root, dryRun) {
 }
 
 // src/claude/write-workflow-config.ts
+import path9 from "path";
+import fs8 from "fs-extra";
+
+// src/claude/derive-workflow-config.ts
 import path8 from "path";
 import fs7 from "fs-extra";
-function buildWorkflowConfig(ctx) {
+var VALIDATION_LIBS = [
+  "zod",
+  "valibot",
+  "yup",
+  "joi",
+  "@hapi/joi",
+  "class-validator",
+  "superstruct",
+  "ajv"
+];
+function binCmd(pm, bin, args) {
+  const tail = args ? ` ${args}` : "";
+  if (pm === "yarn") return `yarn ${bin}${tail}`;
+  if (pm === "pnpm") return `pnpm exec ${bin}${tail}`;
+  return `npx --no-install ${bin}${tail}`;
+}
+async function deriveWorkflowConfig(root, ctx) {
   const pm = ctx.packageManager === "unknown" ? "npm" : ctx.packageManager;
-  const testCmd = pm + " test";
-  const auditCmd = pm + " audit";
-  return "# Project workflow configuration\n\n> Project-specific values for the workflow standard in WORKFLOW.md.\n> Edit freely \u2014 this file is project-owned and will not be overwritten by haus.\n\n## Source-of-truth documents\n- Spec: <!-- fill in path, e.g. docs/SPEC.md -->\n- Design: <!-- fill in path, e.g. docs/DESIGN.md -->\n- UX flows: <!-- fill in path, e.g. docs/UX.md -->\n\n## Commands\n- Test (unit + integration): `" + testCmd + "`\n- Test (E2E): <!-- fill in command -->\n- Type check: <!-- fill in command, e.g. tsc --noEmit -->\n- Lint: <!-- fill in command, e.g. npm run lint -->\n- Lint fix: <!-- fill in command, e.g. npm run lint -- --fix -->\n- Format check: <!-- fill in command, e.g. prettier --check . -->\n- Security audit: `" + auditCmd + "`\n\n## Validation library\n<!-- fill in, e.g. zod, yup, joi -->\n\n## Highest-stakes logic\n<!-- fill in domain areas requiring TDD-only treatment, e.g. payment flows, auth, medical data -->\n\n## Pre-commit tool\n<!-- fill in, e.g. lefthook, husky -->\n";
+  const pkg = await readJson(path8.join(root, "package.json"));
+  const scripts = pkg?.scripts ?? {};
+  const deps = new Set(ctx.dependencies);
+  const stacks = Object.values(ctx.detectedStacks ?? {}).flat();
+  const script = (name) => scripts[name] ? `${pm} run ${name}` : null;
+  const firstScript = (...names) => {
+    for (const n of names) if (scripts[n]) return `${pm} run ${n}`;
+    return null;
+  };
+  const hasDep = (name) => deps.has(name);
+  const exists = (rel) => fs7.pathExistsSync(path8.join(root, rel));
+  const hasTypeScript = hasDep("typescript") || exists("tsconfig.json");
+  const hasEslint = hasDep("eslint");
+  const hasPrettier = hasDep("prettier");
+  const hasPlaywright = hasDep("@playwright/test") || stacks.includes("playwright");
+  const hasCypress = hasDep("cypress");
+  const preCommitTool = exists("lefthook.yml") || exists("lefthook.yaml") ? "lefthook" : exists(".husky") || hasDep("husky") || (scripts.prepare ?? "").includes("husky") ? "husky" : exists(".pre-commit-config.yaml") ? "pre-commit (Python framework)" : null;
+  return {
+    test: script("test") ?? `${pm} test`,
+    testE2E: firstScript("test:e2e", "e2e", "test:integration") ?? (hasPlaywright ? binCmd(pm, "playwright", "test") : null) ?? (hasCypress ? binCmd(pm, "cypress", "run") : null),
+    typecheck: firstScript("typecheck", "type-check", "tsc") ?? (hasTypeScript ? binCmd(pm, "tsc", "--noEmit") : null),
+    lint: script("lint") ?? (hasEslint ? binCmd(pm, "eslint", ".") : null),
+    lintFix: firstScript("lint:fix", "lint-fix") ?? (scripts.lint ? `${pm} run lint -- --fix` : hasEslint ? binCmd(pm, "eslint", ". --fix") : null),
+    formatCheck: firstScript("format:check", "format-check", "prettier:check") ?? (hasPrettier ? binCmd(pm, "prettier", "--check .") : null),
+    securityAudit: `${pm} audit`,
+    validationLibrary: VALIDATION_LIBS.find((lib) => deps.has(lib)) ?? null,
+    preCommitTool,
+    specPath: exists("docs/SPEC.md") ? "docs/SPEC.md" : null,
+    designPath: exists("docs/DESIGN.md") ? "docs/DESIGN.md" : null,
+    uxPath: exists("docs/UX.md") ? "docs/UX.md" : null
+  };
+}
+
+// src/claude/write-workflow-config.ts
+function fields(v) {
+  return [
+    { prefix: "- Spec: ", value: v.specPath, hint: "path, e.g. docs/SPEC.md" },
+    { prefix: "- Design: ", value: v.designPath, hint: "path, e.g. docs/DESIGN.md" },
+    { prefix: "- UX flows: ", value: v.uxPath, hint: "path, e.g. docs/UX.md" },
+    { prefix: "- Test (unit + integration): ", value: v.test, hint: "command", code: true },
+    { prefix: "- Test (E2E): ", value: v.testE2E, hint: "command, e.g. playwright test", code: true },
+    { prefix: "- Type check: ", value: v.typecheck, hint: "command, e.g. tsc --noEmit", code: true },
+    { prefix: "- Lint: ", value: v.lint, hint: "command, e.g. eslint .", code: true },
+    { prefix: "- Lint fix: ", value: v.lintFix, hint: "command, e.g. eslint . --fix", code: true },
+    { prefix: "- Format check: ", value: v.formatCheck, hint: "command, e.g. prettier --check .", code: true },
+    { prefix: "- Security audit: ", value: v.securityAudit, hint: "command", code: true },
+    { prefix: "- Library: ", value: v.validationLibrary, hint: "e.g. zod, yup, joi" },
+    { prefix: "- Tool: ", value: v.preCommitTool, hint: "e.g. lefthook, husky" }
+  ];
 }
-async function writeWorkflowConfig(root, dryRun) {
+function renderValue(f) {
+  if (f.value === null) return `<!-- fill in ${f.hint} -->`;
+  return f.code ? `\`${f.value}\`` : f.value;
+}
+function line(f) {
+  return `${f.prefix}${renderValue(f)}`;
+}
+function buildWorkflowConfig(v) {
+  const f = fields(v);
+  const byPrefix = (p) => line(f.find((x) => x.prefix === p));
+  return "# How this project works (commands & conventions)\n\n> The everyday commands and conventions for this project \u2014 the build, test, and\n> lint commands, where docs live, and so on. This file is yours to edit and haus\n> will not overwrite it. haus fills in what it can detect on first setup;\n> `haus apply --refill-config` fills any still-blank fields without touching\n> anything you've edited.\n\n## Source-of-truth documents\n" + byPrefix("- Spec: ") + "\n" + byPrefix("- Design: ") + "\n" + byPrefix("- UX flows: ") + "\n\n## Commands\n" + byPrefix("- Test (unit + integration): ") + "\n" + byPrefix("- Test (E2E): ") + "\n" + byPrefix("- Type check: ") + "\n" + byPrefix("- Lint: ") + "\n" + byPrefix("- Lint fix: ") + "\n" + byPrefix("- Format check: ") + "\n" + byPrefix("- Security audit: ") + "\n\n## Validation library\n" + byPrefix("- Library: ") + "\n\n## Highest-stakes logic\n<!-- fill in domain areas requiring TDD-only treatment, e.g. payment flows, auth, medical data -->\n\n## Pre-commit tool\n" + byPrefix("- Tool: ") + "\n";
+}
+function refillContent(existing, v) {
+  const f = fields(v);
+  return existing.split("\n").map((ln) => {
+    const field = f.find((x) => ln.startsWith(x.prefix));
+    if (!field || field.value === null) return ln;
+    const rest = ln.slice(field.prefix.length).trim();
+    return rest.startsWith("<!-- fill in") ? line(field) : ln;
+  }).join("\n");
+}
+var FALLBACK_CONTEXT = {
+  mode: "fast",
+  generatedAt: "",
+  root: "",
+  repoName: "",
+  packageManager: "unknown",
+  repoRoles: [],
+  confidence: 0,
+  detectedStacks: {},
+  dependencies: [],
+  securityRisks: [],
+  crossRepoHints: [],
+  warnings: [],
+  detectionStatus: "unknown",
+  unsupportedSignals: []
+};
+async function writeWorkflowConfig(root, dryRun, opts = {}) {
   const destPath = hausPath(root, "workflow-config.md");
   const printable = displayPath(root, destPath);
-  if (await fs7.pathExists(destPath)) {
+  const exists = await fs8.pathExists(destPath);
+  if (exists && !opts.refill) {
     if (dryRun) log(printable + ": exists (project-owned, skipping)");
     return null;
   }
   const ctx = await readJson(hausPath(root, "context-map.json")) ?? {
-    mode: "fast",
-    generatedAt: "",
+    ...FALLBACK_CONTEXT,
     root,
-    repoName: path8.basename(root),
-    packageManager: "unknown",
-    repoRoles: [],
-    confidence: 0,
-    detectedStacks: {},
-    dependencies: [],
-    securityRisks: [],
-    crossRepoHints: [],
-    warnings: []
+    repoName: path9.basename(root)
   };
-  const content = buildWorkflowConfig(ctx);
+  const values = await deriveWorkflowConfig(root, ctx);
+  if (exists) {
+    const current = await fs8.readFile(destPath, "utf8");
+    const refilled = refillContent(current, values);
+    if (refilled === current) {
+      if (dryRun) log(printable + ": no blank fields to refill");
+      return null;
+    }
+    if (dryRun) {
+      log(printable + ": would refill blank fields");
+      return destPath;
+    }
+    await writeText(destPath, refilled);
+    return destPath;
+  }
   if (dryRun) {
     log(printable + ": would create");
     return destPath;
   }
-  await writeText(destPath, content);
+  await writeText(destPath, buildWorkflowConfig(values));
   return destPath;
 }
 
 // src/claude/write-workflow.ts
-import path9 from "path";
-import fs8 from "fs-extra";
+import fs9 from "fs-extra";
 
 // src/claude/managed-template.ts
-function normaliseLF(content) {
-  return content.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+function normaliseLF(content2) {
+  return content2.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
 }
-function parseHausManagedHeader(line) {
-  const match = line.match(/<!-- HAUS-MANAGED id=([\w.:-]+)/);
+function parseHausManagedHeader(line2) {
+  const match = line2.match(/<!-- HAUS-MANAGED id=([\w.:-]+)/);
   if (!match) return null;
-  const hashMatch = line.match(/hash=(sha256-[a-f0-9]+)/);
+  const hashMatch = line2.match(/hash=(sha256-[a-f0-9]+)/);
   return { id: match[1], hash: hashMatch?.[1] };
 }
 
 // src/claude/write-workflow.ts
 var STABLE_ID2 = "template.workflow";
 var SCHEMA_VERSION2 = "1";
-var TEMPLATE_REL = "library/global/templates/agentic-workflow-standard.md";
-var CATALOG_CACHE_TEMPLATE = path9.join(CACHE_DIR, "templates/agentic-workflow-standard.md");
 function makeWorkflowHeader(pkgVersion, contentHash) {
   return `<!-- HAUS-MANAGED id=${STABLE_ID2} v=${SCHEMA_VERSION2} source=@haus-tech/haus-workflow@${pkgVersion} hash=${contentHash} -->`;
 }
 async function writeWorkflow(root, pkgVersion, dryRun) {
-  const cachePath = CATALOG_CACHE_TEMPLATE;
-  const packagePath = path9.join(packageRoot(), TEMPLATE_REL);
-  const templatePath = await fs8.pathExists(cachePath) ? cachePath : packagePath;
-  if (!await fs8.pathExists(templatePath)) {
-    warn(`Workflow template not found \u2014 run \`haus update\` to fetch from catalog`);
+  const templateContent = await readWorkflowTemplate({ dryRun });
+  if (templateContent === null) {
+    warn(
+      `Workflow template could not be fetched from the catalog \u2014 check your network, then re-run \`haus apply --write\` (or \`haus update\`)`
+    );
     return null;
   }
-  const templateContent = await fs8.readFile(templatePath, "utf8");
   const contentHash = hashText(normaliseLF(templateContent));
   const header = makeWorkflowHeader(pkgVersion, contentHash);
   const next = `${header}
 ${templateContent}`;
   const destPath = hausPath(root, "WORKFLOW.md");
   const printable = displayPath(root, destPath);
-  if (await fs8.pathExists(destPath)) {
-    const existing = await fs8.readFile(destPath, "utf8");
+  if (await fs9.pathExists(destPath)) {
+    const existing = await fs9.readFile(destPath, "utf8");
     const firstLine = existing.split("\n")[0] ?? "";
     const parsed = parseHausManagedHeader(firstLine);
     if (!parsed) {
@@ -663,7 +871,7 @@ ${templateContent}`;
     }
   }
   if (dryRun) {
-    const prev = await fs8.pathExists(destPath) ? await fs8.readFile(destPath, "utf8") : "";
+    const prev = await fs9.pathExists(destPath) ? await fs9.readFile(destPath, "utf8") : "";
     if (!prev) {
       log(createUnifiedDiff(printable, "", next));
     } else {
@@ -678,7 +886,7 @@ ${templateContent}`;
 }
 
 // src/claude/write-claude-files.ts
-async function writeClaudeFiles(root, dryRun, selectedIds) {
+async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
   const rec = await readJson(hausPath(root, "recommendation.json")) ?? {
     mode: "fast",
     recommended: [],
@@ -700,7 +908,9 @@ async function writeClaudeFiles(root, dryRun, selectedIds) {
   ];
   const rootClaudeMdPath = await writeRootClaudeMd(root, dryRun);
   const workflowPath = await writeWorkflow(root, hausVersion, dryRun);
-  const workflowConfigPath = await writeWorkflowConfig(root, dryRun);
+  const workflowConfigPath = await writeWorkflowConfig(root, dryRun, {
+    refill: opts.refillConfig
+  });
   const projectFactsPath = await writeProjectFacts(root, hausVersion, dryRun);
   const p6Files = [
     rootClaudeMdPath,
@@ -718,7 +928,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds) {
   await writeManagedJson(root, claudePath(root, "settings.json"), hookSettings, dryRun);
   if (!dryRun) await assertPostApplySettingsMatchCanonical(root, hookSettings);
   const configPath = hausPath(root, "config.json");
-  if (!await fs9.pathExists(configPath)) {
+  if (!await fs10.pathExists(configPath)) {
     await writeManagedJson(root, configPath, DEFAULT_HOOKS_CONFIG, dryRun);
   }
   await writeManagedText(
@@ -736,7 +946,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds) {
   await writeManagedText(
     root,
     claudePath(root, "rules", "haus.md"),
-    "- Keep context minimal.\n- Follow project conventions.\n",
+    "- Keep context minimal.\n- Follow project conventions.\n\n## Driving haus\nWhen the user asks to set up, configure, check, or fix the project, run `haus setup-project` or `haus doctor` and narrate results in plain language \u2014 never make them use a terminal or read JSON. The `/haus-setup`, `/haus-doctor`, and `/haus-fix` commands do the same.\n",
     dryRun
   );
   await writeManagedText(
@@ -774,18 +984,18 @@ async function writeClaudeFiles(root, dryRun, selectedIds) {
     }
     const cachedItem = cacheManifestById.get(item.id);
     const cachePath = cachedItem?.path ? path10.join(CACHE_DIR, cachedItem.path) : null;
-    const sourcePath = cachePath && await fs9.pathExists(cachePath) ? cachePath : path10.join(manifestDir, manifestItem.path);
+    const sourcePath = cachePath && await fs10.pathExists(cachePath) ? cachePath : path10.join(manifestDir, manifestItem.path);
     const target = item.type === "agent" ? "agents" : item.type === "template" ? "templates" : "skills";
     const destination = claudePath(root, target, path10.basename(sourcePath));
-    if (await fs9.pathExists(sourcePath)) {
+    if (await fs10.pathExists(sourcePath)) {
       if (dryRun) {
-        const exists = await fs9.pathExists(destination);
+        const exists = await fs10.pathExists(destination);
         log(
           `${displayPath(root, destination)}: ${exists ? "would overwrite" : "would create"} (${item.id})`
         );
       } else {
-        await fs9.ensureDir(path10.dirname(destination));
-        await fs9.copy(sourcePath, destination, { overwrite: true, errorOnExist: false });
+        await fs10.ensureDir(path10.dirname(destination));
+        await fs10.copy(sourcePath, destination, { overwrite: true, errorOnExist: false });
       }
       files.push(destination);
       const current = installedPathsByItem.get(item.id) ?? [];
@@ -840,7 +1050,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds) {
   return [...new Set(files)];
 }
 async function writeManagedText(root, filePath, nextText, dryRun) {
-  const prev = await fs9.pathExists(filePath) ? await fs9.readFile(filePath, "utf8") : "";
+  const prev = await fs10.pathExists(filePath) ? await fs10.readFile(filePath, "utf8") : "";
   const printable = displayPath(root, filePath);
   if (dryRun) {
     if (!prev) {
@@ -924,7 +1134,9 @@ async function runApply(options) {
       }
     }
   }
-  const files = await writeClaudeFiles(root, isDryRun, selectedIds);
+  const files = await writeClaudeFiles(root, isDryRun, selectedIds, {
+    refillConfig: options.refillConfig
+  });
   if (isDryRun) {
     log(`Dry-run complete \u2014 ${files.length} file(s) planned, none written. Run --write to apply.`);
   } else {
@@ -991,8 +1203,7 @@ async function runCatalogAudit() {
 import path13 from "path";
 var CONFIG_PATH2 = ".haus-workflow/config.json";
 var HOOK_ALIASES = {
-  "hook.context": "context",
-  "hook.memory": "memoryInject"
+  "hook.context": "context"
 };
 async function runConfig(key, action) {
   const hookKey = HOOK_ALIASES[key];
@@ -1045,7 +1256,8 @@ function normalizeRecommendation(input2) {
         finalScore: item.score ?? 0
       },
       tags: item.tags,
-      ecosystem: item.ecosystem
+      ecosystem: item.ecosystem,
+      tokenEstimate: item.tokenEstimate
     };
   });
   const skipped = (input2.skipped ?? []).map((item) => ({
@@ -1105,46 +1317,7 @@ function buildRecommendationExplanation(recommendation) {
   };
 }
 
-// src/recommender/task-intent.ts
-function pickTaskRelevantRules(recommendation, task, taskIntents = /* @__PURE__ */ new Set()) {
-  const recommended = recommendation?.recommended ?? [];
-  if (!task) return recommended;
-  if (taskIntents.size > 0) {
-    const intentMatches = recommended.filter((rule) => {
-      if (rule.selectionMode === "baseline") return false;
-      const ruleIntents = computeRuleIntents(rule);
-      if (ruleIntents.size === 0) return false;
-      for (const ti of taskIntents) {
-        if (ruleIntents.has(ti)) return true;
-      }
-      return false;
-    });
-    if (intentMatches.length > 0) return intentMatches;
-  }
-  const tokens = task.toLowerCase().split(/[^a-z0-9]+/).filter((t) => t.length >= 3);
-  const tokenMatches = recommended.filter((rule) => {
-    if (rule.selectionMode === "baseline") return false;
-    const corpus = [
-      rule.id,
-      rule.ecosystem ?? "",
-      ...rule.tags ?? [],
-      rule.reason ?? "",
-      ...rule.reasons.map((r) => r.message)
-    ].join(" ").toLowerCase();
-    return tokens.some((token) => corpus.includes(token));
-  });
-  if (tokenMatches.length > 0) return tokenMatches;
-  const taskWantsTesting = taskIntents.has("testing");
-  const cappedMediumOrHigh = recommended.filter((rule) => {
-    if (rule.selectionMode === "baseline") return false;
-    if (rule.confidenceLevel === "low") return false;
-    if (taskWantsTesting) return true;
-    const ruleIntents = computeRuleIntents(rule);
-    const isTestingOnly = ruleIntents.size > 0 && [...ruleIntents].every((i) => i === "testing");
-    return !isTestingOnly;
-  });
-  return cappedMediumOrHigh.slice(0, 8);
-}
+// src/recommender/task-classification.ts
 var ALL_INTENTS = [
   "backend",
   "frontend",
@@ -1358,9 +1531,76 @@ function computeRuleIntents(rule) {
   return intents;
 }
 
+// src/recommender/rule-selection.ts
+var DEFAULT_CONTEXT_TOKEN_BUDGET = 12e3;
+function pickTaskRelevantRules(recommendation, task, taskIntents = /* @__PURE__ */ new Set(), opts = {}) {
+  const recommended = recommendation?.recommended ?? [];
+  return applyTokenBudget(selectRules(recommended, task, taskIntents), opts.tokenBudget);
+}
+function applyTokenBudget(rules, budget) {
+  if (!budget || budget <= 0) return rules;
+  const total = rules.reduce((sum, r) => sum + (r.tokenEstimate ?? 0), 0);
+  if (total <= budget) return rules;
+  const keep = /* @__PURE__ */ new Set();
+  let used = 0;
+  for (const r of rules) {
+    if (r.selectionMode === "baseline") {
+      keep.add(r.id);
+      used += r.tokenEstimate ?? 0;
+    }
+  }
+  const matched = rules.filter((r) => r.selectionMode !== "baseline").sort((a, b) => b.score - a.score || a.id.localeCompare(b.id));
+  for (const r of matched) {
+    const est = r.tokenEstimate ?? 0;
+    if (used + est <= budget) {
+      keep.add(r.id);
+      used += est;
+    }
+  }
+  return rules.filter((r) => keep.has(r.id));
+}
+function selectRules(recommended, task, taskIntents) {
+  if (!task) return recommended;
+  if (taskIntents.size > 0) {
+    const intentMatches = recommended.filter((rule) => {
+      if (rule.selectionMode === "baseline") return false;
+      const ruleIntents = computeRuleIntents(rule);
+      if (ruleIntents.size === 0) return false;
+      for (const ti of taskIntents) {
+        if (ruleIntents.has(ti)) return true;
+      }
+      return false;
+    });
+    if (intentMatches.length > 0) return intentMatches;
+  }
+  const tokens = task.toLowerCase().split(/[^a-z0-9]+/).filter((t) => t.length >= 3);
+  const tokenMatches = recommended.filter((rule) => {
+    if (rule.selectionMode === "baseline") return false;
+    const corpus = [
+      rule.id,
+      rule.ecosystem ?? "",
+      ...rule.tags ?? [],
+      rule.reason ?? "",
+      ...rule.reasons.map((r) => r.message)
+    ].join(" ").toLowerCase();
+    return tokens.some((token) => corpus.includes(token));
+  });
+  if (tokenMatches.length > 0) return tokenMatches;
+  const taskWantsTesting = taskIntents.has("testing");
+  const cappedMediumOrHigh = recommended.filter((rule) => {
+    if (rule.selectionMode === "baseline") return false;
+    if (rule.confidenceLevel === "low") return false;
+    if (taskWantsTesting) return true;
+    const ruleIntents = computeRuleIntents(rule);
+    const isTestingOnly = ruleIntents.size > 0 && [...ruleIntents].every((i) => i === "testing");
+    return !isTestingOnly;
+  });
+  return cappedMediumOrHigh.slice(0, 8);
+}
+
 // src/scanner/scan-project.ts
-import { readFile } from "fs/promises";
-import path15 from "path";
+import { readFile as readFile2 } from "fs/promises";
+import path17 from "path";
 
 // src/utils/audit-checks.ts
 function isRecord(v) {
@@ -1388,7 +1628,7 @@ function compareVersions(a, b) {
 
 // src/scanner/detect-package-manager.ts
 import path14 from "path";
-import fs10 from "fs-extra";
+import fs11 from "fs-extra";
 function detectPackageManager(root, packageManagerField) {
   const field = String(packageManagerField ?? "").trim();
   if (field.startsWith("yarn@")) {
@@ -1406,77 +1646,394 @@ function detectPackageManager(root, packageManagerField) {
     if (satisfiesVersion(version, ">=9")) return "npm";
     return "unknown";
   }
-  if (fs10.existsSync(path14.join(root, "yarn.lock"))) return "yarn";
-  if (fs10.existsSync(path14.join(root, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs10.existsSync(path14.join(root, "package-lock.json"))) return "npm";
+  if (fs11.existsSync(path14.join(root, "yarn.lock"))) return "yarn";
+  if (fs11.existsSync(path14.join(root, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs11.existsSync(path14.join(root, "package-lock.json"))) return "npm";
   return "unknown";
 }
 
-// src/scanner/scan-project.ts
-var SAFE_FILES = [
-  "package.json",
-  "yarn.lock",
-  "pnpm-lock.yaml",
-  "composer.json",
-  "composer.lock",
-  "nx.json",
-  "turbo.json",
-  "tsconfig.json",
-  "vite.config.*",
-  "next.config.*",
-  "tailwind.config.*",
-  "components.json",
-  "playwright.config.*",
-  "phpunit.xml",
-  "artisan",
-  "routes/*.php",
-  "app/Providers/*.php",
-  "schema.graphql",
-  "**/*.graphql",
-  "**/vendure-config.*",
-  "**/*module.ts",
-  "web/app/**",
-  "wp-content/plugins/**",
-  "wp-content/themes/**",
-  "wp-content/mu-plugins/**",
-  "wp-content/acf-json/**",
-  ".storybook/**",
-  ".env.example",
-  "wp-config.php",
-  "**/*.csproj",
-  "**/*.sln",
-  "docker-compose.*",
-  "Dockerfile"
-];
-var SENSITIVE = [
-  /^\.env(\.|$)/,
-  /(^|\/)\.env(\.|$)/,
-  /\.pem$/,
-  /\.key$/,
-  /\.p12$/,
-  /\.pfx$/,
-  /\.sql$/,
-  /\.dump$/,
-  /customer-data/,
-  /exports/,
-  /certs/,
-  /secrets/,
-  /(^|\/)storage\/logs(\/|$)/,
-  /(^|\/)wp-content\/uploads(\/|$)/,
-  /(^|\/)uploads(\/|$)/
+// src/scanner/detection-registry.ts
+var dep = (value) => ({ kind: "dep", value });
+var depPrefix = (value) => ({ kind: "depPrefix", value });
+var depAbsent = (value) => ({ kind: "depAbsent", value });
+var fileEndsWith = (value) => ({ kind: "file", value, mode: "endsWith" });
+var fileIncludes = (value) => ({ kind: "file", value, mode: "includes" });
+var fileEquals = (value) => ({ kind: "file", value, mode: "equals" });
+var fileStartsWith = (value) => ({ kind: "file", value, mode: "startsWith" });
+var content = (value) => ({ kind: "content", value });
+var STACK_BUCKETS = [
+  "backend",
+  "frontend",
+  "databases",
+  "testing",
+  "auth",
+  "tooling",
+  "packageManagers"
 ];
+function matchSignal(sig, ctx) {
+  switch (sig.kind) {
+    case "dep":
+      return ctx.deps.has(sig.value);
+    case "depPrefix":
+      for (const d of ctx.deps) if (d.startsWith(sig.value)) return true;
+      return false;
+    case "depAbsent":
+      return !ctx.deps.has(sig.value);
+    case "content":
+      return ctx.contentBlob.includes(sig.value);
+    case "file":
+      return ctx.files.some((f) => {
+        switch (sig.mode) {
+          case "endsWith":
+            return f.endsWith(sig.value);
+          case "includes":
+            return f.includes(sig.value);
+          case "equals":
+            return f === sig.value;
+          case "startsWith":
+            return f.startsWith(sig.value);
+        }
+      });
+  }
+}
+function matchRule(rule, ctx) {
+  if (rule.all) return rule.all.every((s) => matchSignal(s, ctx));
+  if (rule.any) return rule.any.some((s) => matchSignal(s, ctx));
+  return false;
+}
+var ROLE_RULES = [
+  { role: "next-app", any: [dep("next"), fileIncludes("next.config.")] },
+  { role: "react-app", any: [dep("react")] },
+  { role: "vite-app", any: [dep("vite"), fileIncludes("vite.config.")] },
+  { role: "react-router-app", all: [dep("react-router"), dep("@react-router/node")] },
+  { role: "sanity-studio", any: [dep("sanity")] },
+  { role: "strapi-app", any: [dep("@strapi/strapi"), depPrefix("@strapi/")] },
+  { role: "expo-app", any: [dep("expo")] },
+  { role: "vendure-app", any: [dep("@vendure/core")] },
+  { role: "vendure-plugin", any: [depPrefix("@haus/vendure-"), fileIncludes("vendure-config")] },
+  { role: "nestjs-api", any: [dep("@nestjs/core")] },
+  { role: "graphql-api", any: [dep("graphql"), dep("@nestjs/graphql")] },
+  { role: "nx-monorepo", any: [fileEndsWith("nx.json")] },
+  { role: "turbo-monorepo", any: [fileEndsWith("turbo.json")] },
+  { role: "laravel-app", any: [fileEndsWith("artisan"), dep("laravel/framework")] },
+  { role: "laravel-nova-app", any: [dep("laravel/nova")] },
+  { role: "dotnet-service", any: [fileEndsWith(".csproj"), fileEndsWith(".sln")] },
+  { role: "express-service", any: [dep("express")] }
+];
+var STACK_RULES = [
+  { stack: ["frontend", "nextjs"], any: [dep("next")] },
+  { stack: ["frontend", "react19"], any: [dep("react")] },
+  { stack: ["frontend", "vue"], any: [dep("vue")] },
+  { stack: ["frontend", "vite8"], any: [dep("vite")] },
+  { stack: ["frontend", "react-router-v7"], all: [dep("react-router"), dep("@react-router/node")] },
+  { stack: ["frontend", "tailwindcss"], any: [dep("tailwindcss"), fileIncludes("tailwind.config.")] },
+  {
+    stack: ["frontend", "shadcn"],
+    all: [fileEndsWith("components.json"), dep("class-variance-authority")]
+  },
+  { stack: ["tooling", "typescript5"], any: [dep("typescript")] },
+  { stack: ["backend", "sanity"], any: [dep("sanity"), dep("next-sanity"), dep("@sanity/client")] },
+  { stack: ["backend", "strapi"], any: [dep("@strapi/strapi"), depPrefix("@strapi/")] },
+  { stack: ["backend", "prisma"], any: [dep("prisma"), dep("@prisma/client")] },
+  { stack: ["frontend", "expo"], any: [dep("expo")] },
+  { stack: ["frontend", "react-native"], any: [dep("react-native")] },
+  { stack: ["tooling", "i18next"], any: [dep("i18next"), dep("react-i18next")] },
+  { stack: ["tooling", "bullmq"], any: [dep("bullmq")] },
+  { stack: ["tooling", "docker"], any: [fileEquals("Dockerfile"), fileStartsWith("docker-compose")] },
+  { stack: ["tooling", "pm2"], any: [dep("pm2"), fileIncludes("ecosystem.config")] },
+  { stack: ["tooling", "sentry"], any: [depPrefix("@sentry/")] },
+  { stack: ["tooling", "deployer-php"], any: [dep("deployer/deployer")] },
+  { stack: ["tooling", "missing-prettier"], any: [depAbsent("prettier")] },
+  { stack: ["tooling", "missing-eslint"], any: [depAbsent("eslint")] },
+  {
+    stack: ["tooling", "stripe"],
+    any: [dep("@stripe/stripe-js"), dep("@stripe/react-stripe-js")]
+  },
+  { stack: ["tooling", "qliro"], any: [dep("@haus-tech/qliro-plugin")] },
+  {
+    stack: ["databases", "supabase"],
+    any: [dep("@supabase/supabase-js"), depPrefix("@supabase/")]
+  },
+  { stack: ["backend", "vendure3"], any: [dep("@vendure/core")] },
+  { stack: ["backend", "nestjs"], any: [dep("@nestjs/core")] },
+  { stack: ["backend", "nestjs"], any: [content("NestFactory")] },
+  { stack: ["backend", "vendure3"], any: [content("@VendurePlugin")] },
+  { stack: ["backend", "graphql"], any: [dep("graphql"), dep("@nestjs/graphql")] },
+  { stack: ["backend", "graphql"], any: [fileEndsWith(".graphql"), fileEndsWith("schema.graphql")] },
+  { stack: ["backend", "laravel"], any: [dep("laravel/framework")] },
+  { stack: ["backend", "laravel"], any: [fileIncludes("app/Providers/"), fileIncludes("routes/")] },
+  { stack: ["backend", "wordpress"], any: [fileEndsWith("wp-config.php"), dep("roots/wordpress")] },
+  {
+    stack: ["backend", "elementor"],
+    any: [
+      dep("wpackagist-plugin/elementor"),
+      dep("wearehaus/elementor-pro"),
+      dep("wpackagist-theme/hello-elementor")
+    ]
+  },
+  {
+    stack: ["backend", "acf-pro"],
+    any: [
+      dep("wearehaus/advanced-custom-fields-pro"),
+      dep("wpackagist-plugin/advanced-custom-fields")
+    ]
+  },
+  { stack: ["backend", "jetengine"], any: [dep("wearehaus/jet-engine")] },
+  { stack: ["backend", "jetsmartfilters"], any: [dep("wearehaus/jet-smart-filters")] },
+  { stack: ["backend", "gravityforms"], any: [dep("wearehaus/gravityforms")] },
+  { stack: ["backend", "dotnet"], any: [fileEndsWith(".csproj"), fileEndsWith(".sln")] },
+  { stack: ["testing", "playwright"], any: [dep("@playwright/test")] },
+  { stack: ["testing", "storybook"], any: [fileIncludes(".storybook")] },
+  { stack: ["testing", "testing-library"], any: [depPrefix("@testing-library/")] },
+  { stack: ["testing", "phpunit"], any: [fileEndsWith("phpunit.xml")] },
+  { stack: ["testing", "storybook"], any: [depPrefix("@storybook/")] },
+  { stack: ["testing", "vitest"], any: [dep("vitest")] },
+  { stack: ["testing", "jest"], any: [dep("jest"), dep("jest-environment-jsdom")] },
+  { stack: ["databases", "postgresql"], any: [dep("pg")] },
+  { stack: ["databases", "mariadb"], any: [dep("mariadb"), dep("mysql2")] },
+  { stack: ["databases", "mysql"], any: [dep("mysql"), dep("mysql2")] },
+  { stack: ["databases", "mssql"], any: [dep("mssql")] },
+  { stack: ["databases", "elasticsearch"], any: [dep("@elastic/elasticsearch")] },
+  { stack: ["databases", "redis"], any: [dep("predis/predis"), dep("ioredis"), dep("redis")] },
+  { stack: ["auth", "oidc"], any: [content("openid")] },
+  { stack: ["auth", "azure-ad"], any: [content("AZURE_AD")] },
+  { stack: ["auth", "bankid"], any: [content("BANKID")] },
+  {
+    stack: ["auth", "saml2"],
+    any: [dep("24slides/laravel-saml2"), dep("aacotroneo/laravel-saml2")]
+  },
+  { stack: ["auth", "next-auth"], any: [dep("next-auth"), dep("@auth/core")] }
+];
+function runDetection(ctx, rules = STACK_RULES) {
+  const roles = [];
+  for (const rule of ROLE_RULES) {
+    if (rule.role && matchRule(rule, ctx) && !roles.includes(rule.role)) roles.push(rule.role);
+  }
+  const stacks = {};
+  for (const bucket of STACK_BUCKETS) stacks[bucket] = [];
+  for (const rule of rules) {
+    if (!rule.stack || !matchRule(rule, ctx)) continue;
+    const [bucket, name] = rule.stack;
+    stacks[bucket] ??= [];
+    if (!stacks[bucket].includes(name)) stacks[bucket].push(name);
+  }
+  return { roles, stacks };
+}
+
+// src/scanner/detection.ts
+import path15 from "path";
+var UNSUPPORTED_MARKERS = {
+  "requirements.txt": "python",
+  "pyproject.toml": "python",
+  "go.mod": "go",
+  "Cargo.toml": "rust",
+  "pom.xml": "java",
+  "build.gradle": "java",
+  "build.gradle.kts": "java",
+  Gemfile: "ruby"
+};
+var WEAK_STACK_SIGNALS = /* @__PURE__ */ new Set(["missing-prettier", "missing-eslint"]);
+function computeDetectionStatus(roles, stacks, unsupportedSignals) {
+  const hasRealStack = Object.entries(stacks).some(
+    ([bucket, names]) => bucket !== "packageManagers" && names.some((n) => !WEAK_STACK_SIGNALS.has(n))
+  );
+  const hasRealSignal = roles.length > 0 || hasRealStack;
+  if (!hasRealSignal) return "unknown";
+  return unsupportedSignals.length > 0 ? "partial" : "supported";
+}
 function blocked(rel) {
-  return SENSITIVE.some((x) => x.test(rel));
+  return SENSITIVE_PATH_REGEXES.some((x) => x.test(rel));
 }
+function dependencySet(pkg, composer) {
+  const depNames = /* @__PURE__ */ new Set();
+  const pushObj = (obj) => {
+    if (!isRecord(obj)) return;
+    for (const key of Object.keys(obj)) depNames.add(key);
+  };
+  pushObj(pkg?.dependencies);
+  pushObj(pkg?.devDependencies);
+  pushObj(composer?.require);
+  pushObj(composer?.["require-dev"]);
+  return [...depNames].sort();
+}
+function finalizeRoles(registryRoles, deps, files) {
+  const roles = new Set(registryRoles);
+  const hasWpConfig = files.some((f) => f.endsWith("wp-config.php"));
+  const hasBedrockLayout = files.some((f) => f.includes("web/app")) || deps.includes("roots/wordpress");
+  if (hasWpConfig && hasBedrockLayout) {
+    roles.add("wordpress-bedrock-site");
+    roles.add("wordpress-site");
+  } else if (hasWpConfig) {
+    roles.add("wordpress-vanilla-site");
+    roles.add("wordpress-site");
+  } else if (deps.includes("roots/wordpress")) {
+    roles.add("wordpress-bedrock-site");
+    roles.add("wordpress-site");
+  }
+  return [...roles].sort();
+}
+function collectUnsupportedSignals(files) {
+  return [
+    ...new Set(
+      files.map((f) => UNSUPPORTED_MARKERS[path15.basename(f)]).filter((s) => Boolean(s))
+    )
+  ].sort();
+}
+
+// src/scanner/render.ts
+import { readFile } from "fs/promises";
+import path16 from "path";
+
+// src/scanner/role-labels.ts
+var ROLE_LABELS = {
+  "next-app": "a Next.js app",
+  "react-app": "a React app",
+  "vite-app": "a Vite app",
+  "react-router-app": "a React Router app",
+  "sanity-studio": "a Sanity Studio",
+  "strapi-app": "a Strapi app",
+  "expo-app": "an Expo app",
+  "vendure-app": "a Vendure server",
+  "vendure-plugin": "a Vendure plugin",
+  "nestjs-api": "a NestJS API",
+  "graphql-api": "a GraphQL API",
+  "nx-monorepo": "an Nx monorepo",
+  "turbo-monorepo": "a Turborepo monorepo",
+  "laravel-app": "a Laravel app",
+  "laravel-nova-app": "a Laravel Nova app",
+  "dotnet-service": "a .NET service",
+  "express-service": "an Express service",
+  "wordpress-bedrock-site": "a WordPress (Bedrock) site",
+  "wordpress-vanilla-site": "a WordPress site",
+  "wordpress-site": "a WordPress site"
+};
+function article(word) {
+  return /^[aeiou]/i.test(word) ? "an" : "a";
+}
+function friendlyRole(role) {
+  const known = ROLE_LABELS[role];
+  if (known) return known;
+  const words = role.replace(/[-_]+/g, " ").trim();
+  return words ? `${article(words)} ${words}` : "a project";
+}
+function joinRoles(labels) {
+  if (labels.length === 0) return "";
+  if (labels.length === 1) return labels[0];
+  return `${labels.slice(0, -1).join(", ")} and ${labels[labels.length - 1]}`;
+}
+function describeRepo(context) {
+  const labels = context.repoRoles.map(friendlyRole);
+  const roleText = joinRoles(labels);
+  if (context.detectionStatus === "unknown") {
+    const markers = context.unsupportedSignals.join(", ");
+    const detail = markers ? ` (I see ${markers})` : "";
+    return `I couldn't fully recognise this stack${detail}, so I'll apply the general workflow and security guidance rather than framework-specific help.`;
+  }
+  const base = roleText ? `This looks like ${roleText}, using ${context.packageManager}.` : `I recognised this project's tooling (${context.packageManager}) but not a specific framework.`;
+  if (context.detectionStatus === "partial" && context.unsupportedSignals.length > 0) {
+    return `${base} I also see ${context.unsupportedSignals.join(", ")}, which haus doesn't fully support \u2014 guidance covers the recognised parts.`;
+  }
+  return base;
+}
+
+// src/scanner/render.ts
+async function buildContentBlob(root, files) {
+  const candidates = files.filter(
+    (f) => f.endsWith(".ts") || f.endsWith(".js") || f.endsWith(".php") || f.endsWith(".json") || f.endsWith(".yml") || f.endsWith(".yaml")
+  );
+  const slice = candidates.slice(0, 300);
+  const CHUNK = 24;
+  const parts = [];
+  for (let i = 0; i < slice.length; i += CHUNK) {
+    const batch = await Promise.all(
+      slice.slice(i, i + CHUNK).map(async (rel) => {
+        try {
+          return await readFile(path16.join(root, rel), "utf8");
+        } catch {
+          return "";
+        }
+      })
+    );
+    parts.push(...batch);
+  }
+  return parts.join("\n");
+}
+function computeConfidence(roles, stacks) {
+  const stackCount = Object.values(stacks).reduce((sum, arr) => sum + arr.length, 0);
+  if (roles.length === 0) return 0.15;
+  return Math.min(0.99, Number((0.4 + roles.length * 0.08 + stackCount * 0.02).toFixed(2)));
+}
+function renderSummary(context) {
+  return `# Repo summary
+
+${describeRepo(context)}
+
+- Repo: ${context.repoName}
+- Package manager: ${context.packageManager}
+- Roles: ${context.repoRoles.join(", ") || "unknown"}
+- Generated: ${context.generatedAt}
+`;
+}
+
+// src/scanner/scan-project.ts
+var SAFE_FILES = [
+  "package.json",
+  "yarn.lock",
+  "pnpm-lock.yaml",
+  "composer.json",
+  "composer.lock",
+  "nx.json",
+  "turbo.json",
+  "tsconfig.json",
+  "vite.config.*",
+  "next.config.*",
+  "tailwind.config.*",
+  "components.json",
+  "playwright.config.*",
+  "phpunit.xml",
+  "artisan",
+  "routes/*.php",
+  "app/Providers/*.php",
+  "schema.graphql",
+  "**/*.graphql",
+  "**/vendure-config.*",
+  "**/*module.ts",
+  "web/app/**",
+  "wp-content/plugins/**",
+  "wp-content/themes/**",
+  "wp-content/mu-plugins/**",
+  "wp-content/acf-json/**",
+  ".storybook/**",
+  ".env.example",
+  "wp-config.php",
+  "**/*.csproj",
+  "**/*.sln",
+  "docker-compose.*",
+  "Dockerfile",
+  // Unsupported-ecosystem markers — matched by PRESENCE only (never content-read; none
+  // match the content-blob extensions). Drive detectionStatus / unsupportedSignals.
+  "requirements.txt",
+  "pyproject.toml",
+  "go.mod",
+  "Cargo.toml",
+  "pom.xml",
+  "build.gradle",
+  "build.gradle.kts",
+  "Gemfile"
+];
 async function scanProject(root, mode = "fast") {
-  const pkg = await readJson(path15.join(root, "package.json"));
-  const composer = await readJson(path15.join(root, "composer.json"));
+  const pkg = await readJson(path17.join(root, "package.json"));
+  const composer = await readJson(path17.join(root, "composer.json"));
   const files = await listFiles(root, SAFE_FILES);
   const safeFiles = files.filter((f) => !blocked(f));
   const deps = dependencySet(pkg, composer);
   const packageManager = detectPackageManager(root, String(pkg?.packageManager ?? ""));
-  const roles = detectRoles(deps, safeFiles);
-  const stacks = await detectStacks(root, deps, safeFiles, packageManager);
+  const contentBlob = await buildContentBlob(root, safeFiles);
+  const detection = runDetection({ deps: new Set(deps), files: safeFiles, contentBlob });
+  const roles = finalizeRoles(detection.roles, deps, safeFiles);
+  const stacks = detection.stacks;
+  if (packageManager === "yarn") stacks.packageManagers.push("yarn4");
+  if (packageManager === "pnpm") stacks.packageManagers.push("pnpm89");
   const warnings = [];
   const securityRisks = [];
   const crossRepoHints = [];
@@ -1494,11 +2051,13 @@ async function scanProject(root, mode = "fast") {
   if (!safeFiles.some((f) => f.endsWith(".env.example"))) securityRisks.push("Missing env template");
   if (safeFiles.some((f) => f.includes("wp-content/uploads")))
     securityRisks.push("Uploads directory present");
+  const unsupportedSignals = collectUnsupportedSignals(safeFiles);
+  const detectionStatus = computeDetectionStatus(roles, stacks, unsupportedSignals);
   const context = {
     mode,
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     root,
-    repoName: String(pkg?.name ?? path15.basename(root)),
+    repoName: String(pkg?.name ?? path17.basename(root)),
     packageManager,
     repoRoles: roles,
     confidence: computeConfidence(roles, stacks),
@@ -1506,7 +2065,9 @@ async function scanProject(root, mode = "fast") {
     dependencies: deps,
     securityRisks,
     crossRepoHints,
-    warnings
+    warnings,
+    detectionStatus,
+    unsupportedSignals
   };
   const dependencyMap = {
     node: deps.filter((d) => !d.includes("/")),
@@ -1515,7 +2076,7 @@ async function scanProject(root, mode = "fast") {
   const scanHashes = Object.fromEntries(
     await Promise.all(
       safeFiles.map(
-        async (f) => [f, hashText(await readFile(path15.join(root, f), "utf8"))]
+        async (f) => [f, hashText(await readFile2(path17.join(root, f), "utf8"))]
       )
     )
   );
@@ -1526,184 +2087,6 @@ async function scanProject(root, mode = "fast") {
   await writeText(hausPath(root, "repo-summary.md"), repoSummary);
   return { ...context, dependencyMap, scanHashes, repoSummary };
 }
-function dependencySet(pkg, composer) {
-  const out = /* @__PURE__ */ new Set();
-  const pushObj = (obj) => {
-    if (!isRecord(obj)) return;
-    for (const key of Object.keys(obj)) out.add(key);
-  };
-  pushObj(pkg?.dependencies);
-  pushObj(pkg?.devDependencies);
-  pushObj(composer?.require);
-  pushObj(composer?.["require-dev"]);
-  return [...out].sort();
-}
-function detectRoles(deps, files) {
-  const roles = /* @__PURE__ */ new Set();
-  if (deps.includes("next") || files.some((f) => f.includes("next.config."))) roles.add("next-app");
-  if (deps.includes("react")) roles.add("react-app");
-  if (deps.includes("vite") || files.some((f) => f.includes("vite.config."))) roles.add("vite-app");
-  if (deps.includes("react-router") && deps.includes("@react-router/node"))
-    roles.add("react-router-app");
-  if (deps.includes("sanity")) roles.add("sanity-studio");
-  if (deps.includes("@strapi/strapi") || deps.some((d) => d.startsWith("@strapi/")))
-    roles.add("strapi-app");
-  if (deps.includes("expo")) roles.add("expo-app");
-  if (deps.includes("@vendure/core")) roles.add("vendure-app");
-  if (deps.some((d) => d.startsWith("@haus/vendure-")) || files.some((f) => f.includes("vendure-config")))
-    roles.add("vendure-plugin");
-  if (deps.includes("@nestjs/core")) roles.add("nestjs-api");
-  if (deps.includes("graphql") || deps.includes("@nestjs/graphql")) roles.add("graphql-api");
-  if (files.some((f) => f.endsWith("nx.json"))) roles.add("nx-monorepo");
-  if (files.some((f) => f.endsWith("turbo.json"))) roles.add("turbo-monorepo");
-  if (files.some((f) => f.endsWith("artisan")) || deps.includes("laravel/framework"))
-    roles.add("laravel-app");
-  if (deps.includes("laravel/nova")) roles.add("laravel-nova-app");
-  const hasWpConfig = files.some((f) => f.endsWith("wp-config.php"));
-  const hasBedrockLayout = files.some((f) => f.includes("web/app")) || deps.includes("roots/wordpress");
-  if (hasWpConfig && hasBedrockLayout) {
-    roles.add("wordpress-bedrock-site");
-    roles.add("wordpress-site");
-  } else if (hasWpConfig) {
-    roles.add("wordpress-vanilla-site");
-    roles.add("wordpress-site");
-  } else if (deps.includes("roots/wordpress")) {
-    roles.add("wordpress-bedrock-site");
-    roles.add("wordpress-site");
-  }
-  if (files.some((f) => f.endsWith(".csproj") || f.endsWith(".sln"))) roles.add("dotnet-service");
-  if (deps.includes("express")) roles.add("express-service");
-  return [...roles].sort();
-}
-async function detectStacks(root, deps, files, packageManager) {
-  const out = {
-    backend: [],
-    frontend: [],
-    databases: [],
-    testing: [],
-    auth: [],
-    tooling: [],
-    packageManagers: []
-  };
-  const add = (k, v) => {
-    out[k] ??= [];
-    if (!out[k].includes(v)) out[k].push(v);
-  };
-  if (deps.includes("next")) add("frontend", "nextjs");
-  if (deps.includes("react")) add("frontend", "react19");
-  if (deps.includes("vue")) add("frontend", "vue");
-  if (deps.includes("vite")) add("frontend", "vite8");
-  if (deps.includes("react-router") && deps.includes("@react-router/node"))
-    add("frontend", "react-router-v7");
-  if (deps.includes("tailwindcss") || files.some((f) => f.includes("tailwind.config."))) {
-    add("frontend", "tailwindcss");
-  }
-  if (files.some((f) => f.endsWith("components.json")) && deps.includes("class-variance-authority")) {
-    add("frontend", "shadcn");
-  }
-  if (deps.includes("typescript")) add("tooling", "typescript5");
-  if (deps.includes("sanity") || deps.includes("next-sanity") || deps.includes("@sanity/client")) {
-    add("backend", "sanity");
-  }
-  if (deps.includes("@strapi/strapi") || deps.some((d) => d.startsWith("@strapi/"))) {
-    add("backend", "strapi");
-  }
-  if (deps.includes("prisma") || deps.includes("@prisma/client")) add("backend", "prisma");
-  if (deps.includes("expo")) add("frontend", "expo");
-  if (deps.includes("react-native")) add("frontend", "react-native");
-  if (deps.includes("i18next") || deps.includes("react-i18next")) add("tooling", "i18next");
-  if (deps.includes("bullmq")) add("tooling", "bullmq");
-  if (files.some((f) => f === "Dockerfile" || f.startsWith("docker-compose")))
-    add("tooling", "docker");
-  if (deps.includes("pm2") || files.some((f) => f.includes("ecosystem.config")))
-    add("tooling", "pm2");
-  if (deps.some((d) => d.startsWith("@sentry/"))) add("tooling", "sentry");
-  if (deps.includes("deployer/deployer")) add("tooling", "deployer-php");
-  if (!deps.includes("prettier")) add("tooling", "missing-prettier");
-  if (!deps.includes("eslint")) add("tooling", "missing-eslint");
-  if (deps.includes("@stripe/stripe-js") || deps.includes("@stripe/react-stripe-js")) {
-    add("tooling", "stripe");
-  }
-  if (deps.includes("@haus-tech/qliro-plugin")) add("tooling", "qliro");
-  if (deps.includes("@supabase/supabase-js") || deps.some((d) => d.startsWith("@supabase/"))) {
-    add("databases", "supabase");
-  }
-  if (deps.includes("@vendure/core")) add("backend", "vendure3");
-  if (deps.includes("@nestjs/core")) add("backend", "nestjs");
-  if (await hasNeedle(root, files, "NestFactory")) add("backend", "nestjs");
-  if (await hasNeedle(root, files, "@VendurePlugin")) add("backend", "vendure3");
-  if (deps.includes("graphql") || deps.includes("@nestjs/graphql")) add("backend", "graphql");
-  if (files.some((f) => f.endsWith(".graphql") || f.endsWith("schema.graphql")))
-    add("backend", "graphql");
-  if (deps.includes("laravel/framework")) add("backend", "laravel");
-  if (files.some((f) => f.includes("app/Providers/") || f.includes("routes/")))
-    add("backend", "laravel");
-  if (files.some((f) => f.endsWith("wp-config.php")) || deps.includes("roots/wordpress"))
-    add("backend", "wordpress");
-  if (deps.includes("wpackagist-plugin/elementor") || deps.includes("wearehaus/elementor-pro") || deps.includes("wpackagist-theme/hello-elementor")) {
-    add("backend", "elementor");
-  }
-  if (deps.includes("wearehaus/advanced-custom-fields-pro") || deps.includes("wpackagist-plugin/advanced-custom-fields")) {
-    add("backend", "acf-pro");
-  }
-  if (deps.includes("wearehaus/jet-engine")) add("backend", "jetengine");
-  if (deps.includes("wearehaus/jet-smart-filters")) add("backend", "jetsmartfilters");
-  if (deps.includes("wearehaus/gravityforms")) add("backend", "gravityforms");
-  if (files.some((f) => f.endsWith(".csproj") || f.endsWith(".sln"))) add("backend", "dotnet");
-  if (deps.includes("@playwright/test")) add("testing", "playwright");
-  if (files.some((f) => f.includes(".storybook"))) add("testing", "storybook");
-  if (deps.some((d) => d.startsWith("@testing-library/"))) add("testing", "testing-library");
-  if (files.some((f) => f.endsWith("phpunit.xml"))) add("testing", "phpunit");
-  if (deps.some((d) => d.startsWith("@storybook/"))) add("testing", "storybook");
-  if (deps.includes("vitest")) add("testing", "vitest");
-  if (deps.includes("jest") || deps.includes("jest-environment-jsdom")) add("testing", "jest");
-  if (deps.includes("pg")) add("databases", "postgresql");
-  if (deps.includes("mariadb") || deps.includes("mysql2")) add("databases", "mariadb");
-  if (deps.includes("mysql") || deps.includes("mysql2")) add("databases", "mysql");
-  if (deps.includes("mssql")) add("databases", "mssql");
-  if (deps.includes("@elastic/elasticsearch")) add("databases", "elasticsearch");
-  if (deps.includes("predis/predis") || deps.includes("ioredis") || deps.includes("redis")) {
-    add("databases", "redis");
-  }
-  if (await hasNeedle(root, files, "openid")) add("auth", "oidc");
-  if (await hasNeedle(root, files, "AZURE_AD")) add("auth", "azure-ad");
-  if (await hasNeedle(root, files, "BANKID")) add("auth", "bankid");
-  if (deps.includes("24slides/laravel-saml2") || deps.includes("aacotroneo/laravel-saml2")) {
-    add("auth", "saml2");
-  }
-  if (deps.includes("next-auth") || deps.includes("@auth/core")) add("auth", "next-auth");
-  if (packageManager === "yarn") add("packageManagers", "yarn4");
-  if (packageManager === "pnpm") add("packageManagers", "pnpm89");
-  return out;
-}
-async function hasNeedle(root, files, needle) {
-  const candidates = files.filter(
-    (f) => f.endsWith(".ts") || f.endsWith(".js") || f.endsWith(".php") || f.endsWith(".json") || f.endsWith(".yml") || f.endsWith(".yaml")
-  );
-  for (const rel of candidates.slice(0, 300)) {
-    try {
-      const content = await readFile(path15.join(root, rel), "utf8");
-      if (content.includes(needle)) return true;
-    } catch {
-      continue;
-    }
-  }
-  return false;
-}
-function computeConfidence(roles, stacks) {
-  const stackCount = Object.values(stacks).reduce((sum, arr) => sum + arr.length, 0);
-  if (roles.length === 0) return 0.15;
-  return Math.min(0.99, Number((0.4 + roles.length * 0.08 + stackCount * 0.02).toFixed(2)));
-}
-function renderSummary(context) {
-  return `# Repo summary
-
-- Repo: ${context.repoName}
-- Package manager: ${context.packageManager}
-- Roles: ${context.repoRoles.join(", ") || "unknown"}
-- Generated: ${context.generatedAt}
-`;
-}
 
 // src/scanner/read-context.ts
 async function readContextOrScan(root) {
@@ -1727,7 +2110,9 @@ async function runContext(options) {
     (recommendationRaw?.recommended ?? []).map((item) => [item.id, item.scoreBreakdown])
   );
   const taskIntents = options.task ? classifyTaskIntents(options.task) : /* @__PURE__ */ new Set();
-  const selected = pickTaskRelevantRules(recommendation, options.task, taskIntents);
+  const selected = pickTaskRelevantRules(recommendation, options.task, taskIntents, {
+    tokenBudget: DEFAULT_CONTEXT_TOKEN_BUDGET
+  });
   const payload = {
     task: options.task ?? "not provided",
     taskIntents: [...taskIntents].sort(),
@@ -1775,8 +2160,8 @@ async function runContext(options) {
 }
 
 // src/commands/doctor.ts
-import path16 from "path";
-import fs11 from "fs-extra";
+import path18 from "path";
+import fs12 from "fs-extra";
 
 // src/update/npm-version.ts
 var NPM_PACKAGE_NAME = "@haus-tech/haus-workflow";
@@ -1823,114 +2208,200 @@ async function runDoctor(options) {
   const recommendation = await readJson(
     hausPath(root, "recommendation.json")
   );
-  log("Haus Doctor");
-  log(`Repo: ${context.repoName}`);
-  log(`Roles: ${context.repoRoles.join(", ") || "unknown"}`);
-  log(`Package manager: ${context.packageManager}`);
-  log(`Recommended items: ${recommendation?.recommended?.length ?? 0}`);
+  const detail = [];
+  const attention = [];
+  const ok = (text) => detail.push({ stream: "log", text });
+  const flag = (text, sentence, fix) => {
+    detail.push({ stream: "warn", text });
+    attention.push({ sentence, fix });
+  };
+  ok(`Repo: ${context.repoName}`);
+  ok(`Roles: ${context.repoRoles.join(", ") || "unknown"}`);
+  ok(`Package manager: ${context.packageManager}`);
+  ok(`Recommended items: ${recommendation?.recommended?.length ?? 0}`);
   const warningLines = [.../* @__PURE__ */ new Set([...context.warnings, ...recommendation?.warnings ?? []])];
   for (const warning of warningLines) {
-    log(`- WARN: ${warning}`);
+    ok(`- WARN: ${warning}`);
   }
   const hooks = await verifyProjectSettingsHooksContract(root);
   if (hooks.skipped) {
-    log(`- HOOKS: (skipped) ${hooks.message}`);
+    ok(`- HOOKS: (skipped) ${hooks.message}`);
   } else if (!hooks.ok) {
-    log(`- HOOKS FAIL: ${hooks.message}`);
+    flag(
+      `- HOOKS FAIL: ${hooks.message}`,
+      "The Claude Code hooks don't match what haus expects",
+      "haus apply --write"
+    );
     process.exitCode = 1;
   } else {
-    log(`- HOOKS OK: ${hooks.message}`);
+    ok(`- HOOKS OK: ${hooks.message}`);
   }
-  const gatedHooks = ["context", "memoryInject"];
+  const gatedHooks = ["context"];
   for (const key of gatedHooks) {
     const enabled = await isHookEnabled(root, key);
-    log(`- HOOK ${key}: ${enabled ? "enabled" : "disabled (default)"}`);
+    ok(`- HOOK ${key}: ${enabled ? "enabled" : "disabled (default)"}`);
   }
-  const rootClaudeMdPath = path16.join(root, "CLAUDE.md");
+  const rootClaudeMdPath = path18.join(root, "CLAUDE.md");
   const rootClaudeMdContent = await readText(rootClaudeMdPath);
   if (!rootClaudeMdContent) {
-    warn("- CLAUDE.md: missing (run `haus apply --write` to create)");
+    flag(
+      "- CLAUDE.md: missing (run `haus apply --write` to create)",
+      "Your project's CLAUDE.md is missing, so haus guidance never loads",
+      "haus apply --write"
+    );
   } else if (!rootClaudeMdContent.includes(BLOCK_BEGIN)) {
-    warn("- CLAUDE.md: haus import block missing (run `haus apply --write` to add)");
+    flag(
+      "- CLAUDE.md: haus import block missing (run `haus apply --write` to add)",
+      "The haus import block is missing from CLAUDE.md, so its guidance never loads",
+      "haus apply --write"
+    );
   } else {
-    log("- CLAUDE.md: import block present");
+    const beginIdx = rootClaudeMdContent.indexOf(BLOCK_BEGIN);
+    const endIdx = rootClaudeMdContent.indexOf(BLOCK_END, beginIdx + BLOCK_BEGIN.length);
+    if (endIdx < 0) {
+      flag(
+        "- CLAUDE.md: haus import block is not closed (run `haus apply --write` to repair)",
+        "The haus import block in CLAUDE.md is broken, so its guidance may not load",
+        "haus apply --write"
+      );
+    } else {
+      ok("- CLAUDE.md: import block present");
+      const block = rootClaudeMdContent.slice(beginIdx, endIdx + BLOCK_END.length);
+      const importTargets = [...block.matchAll(/@\.haus-workflow\/(\S+)/g)].map((m) => m[1]);
+      for (const target of importTargets) {
+        if (!await fs12.pathExists(hausPath(root, target))) {
+          flag(
+            `- CLAUDE.md import: @.haus-workflow/${target} does not resolve (run \`haus apply --write\`)`,
+            `A file CLAUDE.md links to (${target}) is missing, so part of the guidance won't load`,
+            "haus apply --write"
+          );
+        }
+      }
+    }
   }
   const workflowPath = hausPath(root, "WORKFLOW.md");
-  const workflowExists = await fs11.pathExists(workflowPath);
+  const workflowExists = await fs12.pathExists(workflowPath);
   if (!workflowExists) {
-    warn("- .haus-workflow/WORKFLOW.md: missing (run `haus apply --write`)");
+    flag(
+      "- .haus-workflow/WORKFLOW.md: missing (run `haus apply --write`)",
+      "The workflow standard file is missing",
+      "haus apply --write"
+    );
   } else {
     const workflowContent = await readText(workflowPath);
     const firstLine = workflowContent?.split("\n")[0] ?? "";
     if (!firstLine.includes("HAUS-MANAGED")) {
-      log("- .haus-workflow/WORKFLOW.md: OK (user-owned)");
+      ok("- .haus-workflow/WORKFLOW.md: OK (user-owned)");
     } else {
       const storedHashMatch = firstLine.match(/hash=(sha256-[a-f0-9]+)/);
-      const cachePath = path16.join(CACHE_DIR, "templates/agentic-workflow-standard.md");
-      const bundledPath = path16.join(
+      const cachePath = path18.join(CACHE_DIR, "templates/agentic-workflow-standard.md");
+      const bundledPath = path18.join(
         packageRoot(),
         "library",
         "global",
         "templates",
         "agentic-workflow-standard.md"
       );
-      const templatePath = await fs11.pathExists(cachePath) ? cachePath : bundledPath;
+      const templatePath = await fs12.pathExists(cachePath) ? cachePath : bundledPath;
       const templateContent = await readText(templatePath);
       if (storedHashMatch && templateContent) {
         const currentHash = hashText(normaliseLF(templateContent));
         if (storedHashMatch[1] !== currentHash) {
-          warn("- .haus-workflow/WORKFLOW.md: stale (template updated \u2014 run `haus apply --write`)");
+          flag(
+            "- .haus-workflow/WORKFLOW.md: stale (template updated \u2014 run `haus apply --write`)",
+            "The workflow standard is out of date",
+            "haus apply --write"
+          );
         } else {
-          log("- .haus-workflow/WORKFLOW.md: OK");
+          ok("- .haus-workflow/WORKFLOW.md: OK");
         }
       } else {
-        log("- .haus-workflow/WORKFLOW.md: OK");
+        ok("- .haus-workflow/WORKFLOW.md: OK");
       }
     }
   }
   const workflowConfigPath = hausPath(root, "workflow-config.md");
-  const workflowConfigExists = await fs11.pathExists(workflowConfigPath);
+  const workflowConfigExists = await fs12.pathExists(workflowConfigPath);
   if (!workflowConfigExists) {
-    warn("- .haus-workflow/workflow-config.md: missing (run `haus apply --write`)");
+    flag(
+      "- .haus-workflow/workflow-config.md: missing (run `haus apply --write`)",
+      "The workflow config file is missing",
+      "haus apply --write"
+    );
   } else {
-    log("- .haus-workflow/workflow-config.md: OK (project-owned)");
+    const cfg = await fs12.readFile(workflowConfigPath, "utf8");
+    const unfilled = cfg.split("\n").filter((l) => l.includes("<!-- fill in")).length;
+    if (unfilled > 0) {
+      flag(
+        `- .haus-workflow/workflow-config.md: ${unfilled} field(s) still unfilled (run \`haus apply --refill-config\` to auto-fill detectable ones)`,
+        `${unfilled} workflow-config field(s) are still blank`,
+        "haus apply --refill-config"
+      );
+    } else {
+      ok("- .haus-workflow/workflow-config.md: OK (project-owned)");
+    }
   }
   const projectMdPath = hausPath(root, "project.md");
-  const projectMdExists = await fs11.pathExists(projectMdPath);
+  const projectMdExists = await fs12.pathExists(projectMdPath);
   if (!projectMdExists) {
-    warn("- .haus-workflow/project.md: missing (run `haus apply --write`)");
+    flag(
+      "- .haus-workflow/project.md: missing (run `haus apply --write`)",
+      "The project facts file is missing",
+      "haus apply --write"
+    );
   } else {
     const projectMdContent = await readText(projectMdPath);
     const hasHeader = projectMdContent?.split("\n")[0]?.includes("HAUS-MANAGED") ?? false;
     if (!hasHeader) {
-      warn("- .haus-workflow/project.md: no HAUS-MANAGED header (user-owned)");
+      ok("- .haus-workflow/project.md: no HAUS-MANAGED header (user-owned)");
     } else {
-      log("- .haus-workflow/project.md: OK");
+      ok("- .haus-workflow/project.md: OK");
     }
   }
   const cacheAgeMs = await getCacheManifestAge();
   if (cacheAgeMs === null) {
-    warn("- CATALOG CACHE: absent (run `haus update` to populate)");
+    flag(
+      "- CATALOG CACHE: absent (run `haus update` to populate)",
+      "The catalog cache hasn't been downloaded yet",
+      "haus update"
+    );
   } else {
     const cacheAgeDays = Math.floor(cacheAgeMs / (1e3 * 60 * 60 * 24));
     if (cacheAgeDays >= 7) {
-      warn(`- CATALOG CACHE: stale (${cacheAgeDays}d old \u2014 run \`haus update\`)`);
+      flag(
+        `- CATALOG CACHE: stale (${cacheAgeDays}d old \u2014 run \`haus update\`)`,
+        `The catalog cache is ${cacheAgeDays} days old`,
+        "haus update"
+      );
     } else {
-      log(`- CATALOG CACHE: OK (${cacheAgeDays}d old)`);
+      ok(`- CATALOG CACHE: OK (${cacheAgeDays}d old)`);
     }
   }
-  const pkgJson = await readJson(path16.join(packageRoot(), "package.json"));
+  const pkgJson = await readJson(path18.join(packageRoot(), "package.json"));
   const currentVersion = pkgJson?.version ?? "0.0.0";
   const npmStatus = await fetchNpmVersionStatus(currentVersion);
   if (npmStatus.updateAvailable && npmStatus.latest !== null) {
-    warn(
-      `- CLI UPDATE: ${currentVersion} \u2192 ${npmStatus.latest} available (run: npm install -g ${NPM_PACKAGE_NAME})`
+    flag(
+      `- CLI UPDATE: ${currentVersion} \u2192 ${npmStatus.latest} available (run: npm install -g ${NPM_PACKAGE_NAME})`,
+      `A newer haus (${npmStatus.latest}) is available`,
+      `npm install -g ${NPM_PACKAGE_NAME}`
     );
     process.exitCode = 1;
   } else if (npmStatus.latest !== null) {
-    log(`- CLI: ${currentVersion} (up to date)`);
+    ok(`- CLI: ${currentVersion} (up to date)`);
   } else {
-    log(`- CLI: ${currentVersion} (version check unavailable)`);
+    ok(`- CLI: ${currentVersion} (version check unavailable)`);
+  }
+  if (attention.length === 0) {
+    log("\u2705 Your project is set up and healthy.");
+  } else {
+    log(`\u26A0\uFE0F ${attention.length} thing(s) need attention:`);
+    for (const a of attention) log(`  \u2022 ${a.sentence} \u2014 fix: ${a.fix}`);
+  }
+  log("Haus Doctor");
+  for (const line2 of detail) {
+    if (line2.stream === "warn") warn(line2.text);
+    else log(line2.text);
   }
 }
 
@@ -1989,57 +2460,17 @@ async function runExplainRecommendation(options) {
 // src/commands/guard.ts
 import { readFileSync as readFileSync2 } from "fs";
 
-// src/security/dangerous-commands.ts
-var DANGEROUS_COMMANDS = [
-  "rm -rf",
-  "sudo",
-  "chmod -R 777",
-  "chown -R",
-  "git push --force",
-  "git reset --hard",
-  "docker system prune",
-  "drop database",
-  "truncate table",
-  "php artisan migrate --force",
-  "npm publish",
-  "yarn npm publish",
-  "pnpm publish"
-];
-
 // src/security/guard-bash.ts
 function guardBash(command) {
   const matched = DANGEROUS_COMMANDS.find((token) => command.includes(token));
-  if (matched) return `Blocked dangerous command: ${command}`;
+  if (matched) return `I didn't run that \u2014 it can permanently change or delete things: ${command}`;
   return void 0;
 }
 
-// src/security/sensitive-paths.ts
-var SENSITIVE_PATHS = [
-  ".env",
-  ".env.*",
-  "*.pem",
-  "*.key",
-  "*.p12",
-  "*.pfx",
-  "id_rsa",
-  "id_ed25519",
-  "*.sql",
-  "*.dump",
-  "*.backup",
-  "*.bak",
-  "storage/logs",
-  "wp-content/uploads",
-  "uploads",
-  "customer-data",
-  "exports",
-  "secrets",
-  "certs"
-];
-
 // src/security/guard-file-access.ts
 function guardFileAccess(candidate) {
   const matched = SENSITIVE_PATHS.find((token) => candidate.includes(token.replace("*", "")));
-  if (matched) return `Blocked sensitive path: ${candidate}`;
+  if (matched) return `I didn't open ${candidate} \u2014 it looks like it holds secrets or sensitive data`;
   return void 0;
 }
 
@@ -2071,23 +2502,136 @@ async function runGuard(kind, _options) {
   const toolInput = isRecord(payload.tool_input) ? payload.tool_input : {};
   if (kind === "file-access") {
     const candidate = String(toolInput.path ?? toolInput.file_path ?? "");
-    if (guardFileAccess(candidate)) {
-      deny(`Blocked sensitive path: ${candidate}`);
+    const reason2 = guardFileAccess(candidate);
+    if (reason2) {
+      deny(reason2);
       process.exitCode = 1;
       return;
     }
     return;
   }
   const command = String(toolInput.command ?? "");
-  if (guardBash(command) || DANGEROUS_COMMANDS.some((token) => command.includes(token))) {
-    deny(`Blocked dangerous command: ${command}`);
+  const reason = guardBash(command);
+  if (reason) {
+    deny(reason);
     process.exitCode = 1;
   }
 }
 
 // src/commands/init.ts
-import path17 from "path";
-import fs12 from "fs-extra";
+import path19 from "path";
+import fs13 from "fs-extra";
+
+// src/recommender/ecosystem.ts
+var ECOSYSTEM_GROUPS = {
+  laravel: ["laravel-app", "laravel-nova-app"],
+  wordpress: ["wordpress-site", "wordpress-bedrock-site", "wordpress-vanilla-site"],
+  vendure: ["vendure-app", "vendure-plugin"],
+  nestjs: ["nestjs-api"],
+  nextjs: ["next-app"],
+  react: ["react-app", "next-app", "design-system"],
+  vue: ["vue-app"],
+  dotnet: ["dotnet-service"],
+  nx: ["nx-monorepo"],
+  turbo: ["turbo-monorepo"]
+};
+var ECOSYSTEM_PRIMARY_BACKENDS = /* @__PURE__ */ new Set([
+  "laravel",
+  "wordpress",
+  "vendure",
+  "nestjs",
+  "dotnet"
+]);
+var ECOSYSTEM_COMPATIBLE_BACKENDS = {
+  vendure: /* @__PURE__ */ new Set(["vendure", "nestjs"]),
+  nestjs: /* @__PURE__ */ new Set(["nestjs"]),
+  laravel: /* @__PURE__ */ new Set(["laravel"]),
+  wordpress: /* @__PURE__ */ new Set(["wordpress"]),
+  dotnet: /* @__PURE__ */ new Set(["dotnet"])
+};
+function inferRepoEcosystems(roles) {
+  const ecosystems = /* @__PURE__ */ new Set();
+  for (const [eco, roleList] of Object.entries(ECOSYSTEM_GROUPS)) {
+    if (roleList.some((r) => roles.includes(r))) ecosystems.add(eco);
+  }
+  return [...ecosystems];
+}
+function pickDominantBackend(ecosystems) {
+  for (const eco of ecosystems) {
+    if (ECOSYSTEM_PRIMARY_BACKENDS.has(eco)) return eco;
+  }
+  return void 0;
+}
+function isBackendEcosystem(eco) {
+  return ECOSYSTEM_PRIMARY_BACKENDS.has(eco);
+}
+
+// src/recommender/policies.ts
+var UNSUPPORTED = [
+  "python",
+  "django",
+  "go",
+  "rust",
+  "java",
+  "spring",
+  "kotlin",
+  "swift",
+  "android",
+  "flutter",
+  "dart",
+  "c++",
+  "perl",
+  "defi",
+  "trading"
+];
+function matchRequiresAny(clauses, ctx) {
+  for (const clause of clauses) {
+    if ("stack" in clause) {
+      if (ctx.stackSet.has(clause.stack.toLowerCase())) {
+        return { matched: true, signal: `stack:${clause.stack}` };
+      }
+    } else if ("dependency" in clause) {
+      if (ctx.depSet.has(clause.dependency.toLowerCase())) {
+        return { matched: true, signal: `dependency:${clause.dependency}` };
+      }
+    } else if ("packageNamePattern" in clause) {
+      const pattern = clause.packageNamePattern.toLowerCase();
+      const prefix = pattern.endsWith("*") ? pattern.slice(0, -1) : pattern;
+      for (const dep2 of ctx.depSet) {
+        if (pattern.endsWith("*") ? dep2.startsWith(prefix) : dep2 === pattern) {
+          return {
+            matched: true,
+            signal: `packageNamePattern:${clause.packageNamePattern}`
+          };
+        }
+      }
+    } else if ("role" in clause) {
+      if (ctx.roleSet.has(clause.role.toLowerCase())) {
+        return { matched: true, signal: `role:${clause.role}` };
+      }
+    }
+  }
+  return { matched: false };
+}
+function describeRequiresAny(clauses) {
+  return clauses.map((c) => {
+    if ("stack" in c) return `stack=${c.stack}`;
+    if ("dependency" in c) return `dependency=${c.dependency}`;
+    if ("packageNamePattern" in c) return `packageNamePattern=${c.packageNamePattern}`;
+    if ("role" in c) return `role=${c.role}`;
+    return "unknown";
+  }).join(" | ");
+}
+function mergeRecommendationWarnings(context) {
+  const markers = context.unsupportedSignals?.join(", ");
+  const statusLines = context.detectionStatus === "unknown" ? [
+    markers ? `Stack not recognised \u2014 detected ${markers}, which haus does not support. Only stack-agnostic workflow and security guidance is applied.` : "Stack not recognised \u2014 no supported framework detected. Only stack-agnostic workflow and security guidance is applied."
+  ] : context.detectionStatus === "partial" && markers ? [
+    `Partially supported \u2014 found unsupported ${markers} alongside recognised stacks; guidance covers the supported parts only.`
+  ] : [];
+  const riskLines = (context.securityRisks?.length ?? 0) > 0 ? [`Scan reported security signals: ${context.securityRisks.join("; ")}`] : [];
+  return [.../* @__PURE__ */ new Set([...statusLines, ...context.warnings, ...riskLines])];
+}
 
 // src/utils/exec.ts
 import { execa } from "execa";
@@ -2110,49 +2654,43 @@ async function runCommand(command, args = [], options = {}) {
     throw new Error(`Failed to run command: ${command} ${args.join(" ")} (${message})`);
   }
 }
-async function runGit(args, options = {}) {
-  return runCommand("git", args, options);
-}
+async function runGit(args, options = {}) {
+  return runCommand("git", args, options);
+}
+
+// src/recommender/scoring.ts
+function computeConfidenceLevel(args) {
+  const { isDefaultBaseline, reasons, hasEcosystemConflict, score } = args;
+  const positiveCodes = new Set(reasons.map((r) => r.code));
+  positiveCodes.delete("default-baseline");
+  const distinctSignals = positiveCodes.size;
+  const strongCount = (positiveCodes.has("repo-role-match") ? 1 : 0) + (positiveCodes.has("stack-match") ? 1 : 0) + (positiveCodes.has("requires-any-match") ? 1 : 0);
+  if (hasEcosystemConflict) return "low";
+  if (isDefaultBaseline && distinctSignals === 0) return "medium";
+  if (strongCount >= 2 && score >= 70) return "high";
+  if (strongCount >= 1 && distinctSignals >= 2 && score >= 50) return "medium";
+  if (distinctSignals === 1) return "low";
+  return distinctSignals >= 2 ? "medium" : "low";
+}
+function confidenceLevelToNumber(level, score) {
+  const base = level === "high" ? 0.85 : level === "medium" ? 0.6 : 0.3;
+  const bonus = Math.min(0.1, Math.max(0, score - 40) / 1e3);
+  return Number(Math.min(0.99, base + bonus).toFixed(2));
+}
+async function readChangedFiles(root) {
+  if (process.env.HAUS_DISABLE_GIT_SIGNALS === "1") return [];
+  try {
+    const result = await runGit(["diff", "--name-only"], { cwd: root });
+    if (result.exitCode !== 0) {
+      return [];
+    }
+    return result.stdout.split("\n").map((x) => x.trim()).filter(Boolean).sort();
+  } catch {
+    return [];
+  }
+}
 
 // src/recommender/recommend.ts
-var UNSUPPORTED = [
-  "python",
-  "django",
-  "go",
-  "rust",
-  "java",
-  "spring",
-  "kotlin",
-  "swift",
-  "android",
-  "flutter",
-  "dart",
-  "c++",
-  "perl",
-  "defi",
-  "trading"
-];
-var SENSITIVE2 = [".env", "secrets", "certs", "customer-data", "exports", ".pem", ".key"];
-var ECOSYSTEM_GROUPS = {
-  laravel: ["laravel-app", "laravel-nova-app"],
-  wordpress: ["wordpress-site", "wordpress-bedrock-site", "wordpress-vanilla-site"],
-  vendure: ["vendure-app", "vendure-plugin"],
-  nestjs: ["nestjs-api"],
-  nextjs: ["next-app"],
-  react: ["react-app", "next-app", "design-system"],
-  vue: ["vue-app"],
-  dotnet: ["dotnet-service"],
-  nx: ["nx-monorepo"],
-  turbo: ["turbo-monorepo"]
-};
-var ECOSYSTEM_PRIMARY_BACKENDS = /* @__PURE__ */ new Set(["laravel", "wordpress", "vendure", "nestjs", "dotnet"]);
-var ECOSYSTEM_COMPATIBLE_BACKENDS = {
-  vendure: /* @__PURE__ */ new Set(["vendure", "nestjs"]),
-  nestjs: /* @__PURE__ */ new Set(["nestjs"]),
-  laravel: /* @__PURE__ */ new Set(["laravel"]),
-  wordpress: /* @__PURE__ */ new Set(["wordpress"]),
-  dotnet: /* @__PURE__ */ new Set(["dotnet"])
-};
 async function recommend(root, context) {
   const items = await loadCatalog(root);
   const setupAnswers = await readJson(hausPath(root, "setup-answers.json")) ?? {};
@@ -2171,8 +2709,8 @@ async function recommend(root, context) {
   const changedFiles = await readChangedFiles(root);
   const securityRiskCount = context.securityRisks?.length ?? 0;
   for (const item of items) {
-    const blob = `${item.id} ${item.tags.join(" ")}`.toLowerCase();
-    if (UNSUPPORTED.some((x) => blob.includes(x))) {
+    const itemSearchText = `${item.id} ${item.tags.join(" ")}`.toLowerCase();
+    if (UNSUPPORTED.some((x) => itemSearchText.includes(x))) {
       skipped.push({
         id: item.id,
         reason: "Unsupported stack policy",
@@ -2334,7 +2872,7 @@ async function recommend(root, context) {
         );
       }
     }
-    if (SENSITIVE2.some((x) => blob.includes(x))) {
+    if (SENSITIVE_ITEM_KEYWORDS.some((x) => itemSearchText.includes(x))) {
       pushSkipReason("sensitive-policy", "Sensitive content policy block", 100);
     }
     const trust = sourceTrust.get(item.source);
@@ -2389,7 +2927,8 @@ async function recommend(root, context) {
           finalScore: score
         },
         tags: item.tags,
-        ecosystem: item.ecosystem
+        ecosystem: item.ecosystem,
+        tokenEstimate: item.tokenEstimate
       });
     } else {
       if (skipReasons.length === 0) {
@@ -2430,94 +2969,6 @@ function buildStackSet(context) {
     )
   );
 }
-function inferRepoEcosystems(roles) {
-  const ecosystems = /* @__PURE__ */ new Set();
-  for (const [eco, roleList] of Object.entries(ECOSYSTEM_GROUPS)) {
-    if (roleList.some((r) => roles.includes(r))) ecosystems.add(eco);
-  }
-  return [...ecosystems];
-}
-function pickDominantBackend(ecosystems) {
-  for (const eco of ecosystems) {
-    if (ECOSYSTEM_PRIMARY_BACKENDS.has(eco)) return eco;
-  }
-  return void 0;
-}
-function isBackendEcosystem(eco) {
-  return ECOSYSTEM_PRIMARY_BACKENDS.has(eco);
-}
-function matchRequiresAny(clauses, ctx) {
-  for (const clause of clauses) {
-    if ("stack" in clause) {
-      if (ctx.stackSet.has(clause.stack.toLowerCase())) {
-        return { matched: true, signal: `stack:${clause.stack}` };
-      }
-    } else if ("dependency" in clause) {
-      if (ctx.depSet.has(clause.dependency.toLowerCase())) {
-        return { matched: true, signal: `dependency:${clause.dependency}` };
-      }
-    } else if ("packageNamePattern" in clause) {
-      const pattern = clause.packageNamePattern.toLowerCase();
-      const prefix = pattern.endsWith("*") ? pattern.slice(0, -1) : pattern;
-      for (const dep of ctx.depSet) {
-        if (pattern.endsWith("*") ? dep.startsWith(prefix) : dep === pattern) {
-          return {
-            matched: true,
-            signal: `packageNamePattern:${clause.packageNamePattern}`
-          };
-        }
-      }
-    } else if ("role" in clause) {
-      if (ctx.roleSet.has(clause.role.toLowerCase())) {
-        return { matched: true, signal: `role:${clause.role}` };
-      }
-    }
-  }
-  return { matched: false };
-}
-function describeRequiresAny(clauses) {
-  return clauses.map((c) => {
-    if ("stack" in c) return `stack=${c.stack}`;
-    if ("dependency" in c) return `dependency=${c.dependency}`;
-    if ("packageNamePattern" in c) return `packageNamePattern=${c.packageNamePattern}`;
-    if ("role" in c) return `role=${c.role}`;
-    return "unknown";
-  }).join(" | ");
-}
-function computeConfidenceLevel(args) {
-  const { isDefaultBaseline, reasons, hasEcosystemConflict, score } = args;
-  const positiveCodes = new Set(reasons.map((r) => r.code));
-  positiveCodes.delete("default-baseline");
-  const distinctSignals = positiveCodes.size;
-  const strongCount = (positiveCodes.has("repo-role-match") ? 1 : 0) + (positiveCodes.has("stack-match") ? 1 : 0) + (positiveCodes.has("requires-any-match") ? 1 : 0);
-  if (hasEcosystemConflict) return "low";
-  if (isDefaultBaseline && distinctSignals === 0) return "medium";
-  if (strongCount >= 2 && score >= 70) return "high";
-  if (strongCount >= 1 && distinctSignals >= 2 && score >= 50) return "medium";
-  if (distinctSignals === 1) return "low";
-  return distinctSignals >= 2 ? "medium" : "low";
-}
-function confidenceLevelToNumber(level, score) {
-  const base = level === "high" ? 0.85 : level === "medium" ? 0.6 : 0.3;
-  const bonus = Math.min(0.1, Math.max(0, score - 40) / 1e3);
-  return Number(Math.min(0.99, base + bonus).toFixed(2));
-}
-function mergeRecommendationWarnings(context) {
-  const riskLines = (context.securityRisks?.length ?? 0) > 0 ? [`Scan reported security signals: ${context.securityRisks.join("; ")}`] : [];
-  return [.../* @__PURE__ */ new Set([...context.warnings, ...riskLines])];
-}
-async function readChangedFiles(root) {
-  if (process.env.HAUS_DISABLE_GIT_SIGNALS === "1") return [];
-  try {
-    const result = await runGit(["diff", "--name-only"], { cwd: root });
-    if (result.exitCode !== 0) {
-      return [];
-    }
-    return result.stdout.split("\n").map((x) => x.trim()).filter(Boolean).sort();
-  } catch {
-    return [];
-  }
-}
 
 // src/utils/prompts.ts
 import { stdin as input, stdout as output } from "process";
@@ -2565,8 +3016,13 @@ async function runSetupProject(options) {
         merged[question] = existing[question] ?? "pending-user-answer";
         continue;
       }
+      const prefilled = existing[question];
+      if (prefilled && prefilled !== "pending-user-answer" && prefilled !== "no-answer") {
+        merged[question] = prefilled;
+        continue;
+      }
       const answer = await ask(question);
-      merged[question] = answer || existing[question] || "no-answer";
+      merged[question] = answer || prefilled || "no-answer";
     }
     await writeJson(hausPath(root, "setup-answers.json"), merged);
   }
@@ -2630,8 +3086,8 @@ async function runSetupProject(options) {
 // src/commands/init.ts
 async function runInit(options) {
   const root = process.cwd();
-  const hausDir = path17.join(root, ".haus-workflow");
-  const alreadyInit = await fs12.pathExists(hausDir);
+  const hausDir = path19.join(root, ".haus-workflow");
+  const alreadyInit = await fs13.pathExists(hausDir);
   if (alreadyInit) {
     log("Haus AI already initialized in this project.");
     log("Run `haus setup-project` to reconfigure.");
@@ -2643,8 +3099,21 @@ async function runInit(options) {
 
 // src/install/apply.ts
 import crypto2 from "crypto";
-import path20 from "path";
-import fs14 from "fs-extra";
+import path22 from "path";
+import fs15 from "fs-extra";
+
+// src/install/allow-rules.ts
+var ALLOWED_SUBCOMMANDS = [
+  "setup-project",
+  "apply",
+  "doctor",
+  "scan",
+  "context",
+  "recommend"
+];
+function buildAllowRules() {
+  return [...new Set(ALLOWED_SUBCOMMANDS.map((sub) => `Bash(haus ${sub}:*)`))];
+}
 
 // src/install/header.ts
 var MD_PREFIX = "<!-- HAUS-MANAGED";
@@ -2656,35 +3125,35 @@ function parseAttrs(raw) {
   if (!idMatch || !vMatch || !srcMatch) return void 0;
   return { stableId: idMatch[1], schemaVersion: vMatch[1], source: srcMatch[1] };
 }
-function parseMarkdownHeader(content) {
-  const firstLine = content.split("\n")[0] ?? "";
+function parseMarkdownHeader(content2) {
+  const firstLine = content2.split("\n")[0] ?? "";
   if (!firstLine.startsWith(MD_PREFIX)) return void 0;
   return parseAttrs(firstLine);
 }
 function buildMarkdownHeader(h) {
   return `${MD_PREFIX} id=${h.stableId} v=${h.schemaVersion} source=${h.source}${MD_SUFFIX}`;
 }
-function stampMarkdown(content, h) {
+function stampMarkdown(content2, h) {
   const header = buildMarkdownHeader(h);
-  const existing = parseMarkdownHeader(content);
+  const existing = parseMarkdownHeader(content2);
   if (existing) {
-    const rest = content.slice(content.indexOf("\n") + 1);
+    const rest = content2.slice(content2.indexOf("\n") + 1);
     return `${header}
 ${rest}`;
   }
   return `${header}
-${content}`;
+${content2}`;
 }
 
 // src/install/manifest.ts
 import os4 from "os";
-import path18 from "path";
+import path20 from "path";
 var MANIFEST_SCHEMA = "haus-install-manifest/1";
 function globalClaudeDir() {
-  return path18.join(os4.homedir(), ".claude");
+  return path20.join(os4.homedir(), ".claude");
 }
 function hausManifestPath() {
-  return path18.join(globalClaudeDir(), "haus", "install-manifest.json");
+  return path20.join(globalClaudeDir(), "haus", "install-manifest.json");
 }
 async function readManifest() {
   return readJson(hausManifestPath());
@@ -2703,10 +3172,10 @@ function buildManifest(source, files, hooks) {
 }
 
 // src/install/settings-merge.ts
-import path19 from "path";
-import fs13 from "fs-extra";
+import path21 from "path";
+import fs14 from "fs-extra";
 function settingsJsonPath() {
-  return path19.join(globalClaudeDir(), "settings.json");
+  return path21.join(globalClaudeDir(), "settings.json");
 }
 async function readSettings() {
   const parsed = await readJson(settingsJsonPath());
@@ -2738,10 +3207,95 @@ function mergeHooks(settings, fragments) {
   }
   updated._haus = {
     hooks: [...existing, ...addedIds],
-    hookCommands: [...existingCommands, ...addedCommands]
+    hookCommands: [...existingCommands, ...addedCommands],
+    // Preserve deny/allow tracking so hook, deny, and allow merges are order-independent.
+    ...settings._haus?.denyRules ? { denyRules: settings._haus.denyRules } : {},
+    ...settings._haus?.allowRules ? { allowRules: settings._haus.allowRules } : {}
   };
   return { settings: updated, addedIds };
 }
+function mergeDenyRules(settings, rules) {
+  const existingDeny = settings.permissions?.deny ?? [];
+  const seen = new Set(existingDeny);
+  const trackedDeny = settings._haus?.denyRules ?? [];
+  const addedRules = [];
+  for (const rule of rules) {
+    if (seen.has(rule)) continue;
+    seen.add(rule);
+    addedRules.push(rule);
+  }
+  const updated = { ...settings };
+  updated.permissions = {
+    ...settings.permissions ?? {},
+    deny: [...existingDeny, ...addedRules]
+  };
+  updated._haus = {
+    hooks: settings._haus?.hooks ?? [],
+    ...settings._haus?.hookCommands ? { hookCommands: settings._haus.hookCommands } : {},
+    denyRules: [...trackedDeny, ...addedRules],
+    ...settings._haus?.allowRules ? { allowRules: settings._haus.allowRules } : {}
+  };
+  return { settings: updated, addedRules };
+}
+function mergeAllowRules(settings, rules) {
+  const existingAllow = settings.permissions?.allow ?? [];
+  const seen = new Set(existingAllow);
+  const trackedAllow = settings._haus?.allowRules ?? [];
+  const addedRules = [];
+  for (const rule of rules) {
+    if (seen.has(rule)) continue;
+    seen.add(rule);
+    addedRules.push(rule);
+  }
+  const updated = { ...settings };
+  updated.permissions = {
+    ...settings.permissions ?? {},
+    allow: [...existingAllow, ...addedRules]
+  };
+  updated._haus = {
+    hooks: settings._haus?.hooks ?? [],
+    ...settings._haus?.hookCommands ? { hookCommands: settings._haus.hookCommands } : {},
+    ...settings._haus?.denyRules ? { denyRules: settings._haus.denyRules } : {},
+    allowRules: [...trackedAllow, ...addedRules]
+  };
+  return { settings: updated, addedRules };
+}
+function stripHausAllow(settings) {
+  const prevHaus = settings._haus;
+  if (!prevHaus?.allowRules || prevHaus.allowRules.length === 0) return settings;
+  const ownedSet = new Set(prevHaus.allowRules);
+  const updated = { ...settings };
+  const remainingAllow = (settings.permissions?.allow ?? []).filter((rule) => !ownedSet.has(rule));
+  const permissions = { ...settings.permissions ?? {} };
+  if (remainingAllow.length > 0) permissions.allow = remainingAllow;
+  else delete permissions.allow;
+  if (Object.keys(permissions).length > 0) updated.permissions = permissions;
+  else delete updated.permissions;
+  const haus = { ...prevHaus };
+  delete haus.allowRules;
+  const stillTracking = (haus.hooks?.length ?? 0) > 0 || (haus.hookCommands?.length ?? 0) > 0 || (haus.denyRules?.length ?? 0) > 0;
+  if (stillTracking) updated._haus = haus;
+  else delete updated._haus;
+  return updated;
+}
+function stripHausDeny(settings) {
+  const prevHaus = settings._haus;
+  if (!prevHaus?.denyRules || prevHaus.denyRules.length === 0) return settings;
+  const ownedSet = new Set(prevHaus.denyRules);
+  const updated = { ...settings };
+  const remainingDeny = (settings.permissions?.deny ?? []).filter((rule) => !ownedSet.has(rule));
+  const permissions = { ...settings.permissions ?? {} };
+  if (remainingDeny.length > 0) permissions.deny = remainingDeny;
+  else delete permissions.deny;
+  if (Object.keys(permissions).length > 0) updated.permissions = permissions;
+  else delete updated.permissions;
+  const haus = { ...prevHaus };
+  delete haus.denyRules;
+  const stillTracking = (haus.hooks?.length ?? 0) > 0 || (haus.hookCommands?.length ?? 0) > 0 || (haus.allowRules?.length ?? 0) > 0;
+  if (stillTracking) updated._haus = haus;
+  else delete updated._haus;
+  return updated;
+}
 function stripHausHooks(settings) {
   if (!settings._haus) return settings;
   const ownedCommands = new Set(settings._haus.hookCommands ?? []);
@@ -2762,7 +3316,7 @@ function stripHausHooks(settings) {
 async function loadHooksFragment(fragmentPath) {
   let raw;
   try {
-    raw = await fs13.readJson(fragmentPath);
+    raw = await fs14.readJson(fragmentPath);
   } catch {
     return [];
   }
@@ -2772,45 +3326,45 @@ async function loadHooksFragment(fragmentPath) {
 
 // src/install/apply.ts
 var SCHEMA_VERSION3 = "1";
-function hashContent(content) {
-  return `sha256-${crypto2.createHash("sha256").update(content).digest("hex")}`;
+function hashContent(content2) {
+  return `sha256-${crypto2.createHash("sha256").update(content2).digest("hex")}`;
 }
 function sourceVersion() {
   try {
-    const pkgPath = path20.join(packageRoot(), "package.json");
-    const pkg = JSON.parse(fs14.readFileSync(pkgPath, "utf8"));
+    const pkgPath = path22.join(packageRoot(), "package.json");
+    const pkg = JSON.parse(fs15.readFileSync(pkgPath, "utf8"));
     return `${pkg.name ?? "haus"}@${pkg.version ?? "0.0.0"}`;
   } catch {
     return "haus@0.0.0";
   }
 }
 function globalSrcDir() {
-  return path20.join(packageRoot(), "library", "global");
+  return path22.join(packageRoot(), "library", "global");
 }
 function collectSourceFiles(srcDir, claudeDir) {
   const entries = [];
-  const skillsDir = path20.join(srcDir, "skills");
-  if (fs14.pathExistsSync(skillsDir)) {
-    for (const skillName of fs14.readdirSync(skillsDir)) {
-      const skillFile = path20.join(skillsDir, skillName, "SKILL.md");
-      if (fs14.pathExistsSync(skillFile)) {
+  const skillsDir = path22.join(srcDir, "skills");
+  if (fs15.pathExistsSync(skillsDir)) {
+    for (const skillName of fs15.readdirSync(skillsDir)) {
+      const skillFile = path22.join(skillsDir, skillName, "SKILL.md");
+      if (fs15.pathExistsSync(skillFile)) {
         entries.push({
           stableId: `skill.${skillName}`,
-          srcRelPath: path20.join("library", "global", "skills", skillName, "SKILL.md"),
-          destPath: path20.join(claudeDir, "skills", skillName, "SKILL.md")
+          srcRelPath: path22.join("library", "global", "skills", skillName, "SKILL.md"),
+          destPath: path22.join(claudeDir, "skills", skillName, "SKILL.md")
         });
       }
     }
   }
-  const agentsDir = path20.join(srcDir, "agents");
-  if (fs14.pathExistsSync(agentsDir)) {
-    for (const agentFile of fs14.readdirSync(agentsDir)) {
-      if (!agentFile.endsWith(".md")) continue;
-      const agentName = agentFile.replace(/\.md$/, "");
+  const commandsDir = path22.join(srcDir, "commands");
+  if (fs15.pathExistsSync(commandsDir)) {
+    for (const fileName of fs15.readdirSync(commandsDir)) {
+      if (!fileName.endsWith(".md")) continue;
+      const commandName = fileName.slice(0, -".md".length);
       entries.push({
-        stableId: `agent.${agentName}`,
-        srcRelPath: path20.join("library", "global", "agents", agentFile),
-        destPath: path20.join(claudeDir, "agents", agentFile)
+        stableId: `command.${commandName}`,
+        srcRelPath: path22.join("library", "global", "commands", fileName),
+        destPath: path22.join(claudeDir, "commands", fileName)
       });
     }
   }
@@ -2834,7 +3388,7 @@ async function applyInstall(options = {}) {
   };
   const manifestFiles = [];
   for (const entry of sourceFiles) {
-    const srcPath = path20.join(packageRoot(), entry.srcRelPath);
+    const srcPath = path22.join(packageRoot(), entry.srcRelPath);
     const rawContent = await readText(srcPath);
     if (rawContent === void 0) {
       warn(`Source file not found: ${entry.srcRelPath}`);
@@ -2854,7 +3408,7 @@ async function applyInstall(options = {}) {
       }
       continue;
     }
-    const destExists = fs14.pathExistsSync(entry.destPath);
+    const destExists = fs15.pathExistsSync(entry.destPath);
     if (destExists) {
       const currentContent = await readText(entry.destPath);
       if (currentContent !== void 0) {
@@ -2890,22 +3444,24 @@ async function applyInstall(options = {}) {
       schemaVersion: SCHEMA_VERSION3
     });
   }
-  const fragmentPath = path20.join(srcDir, "settings-fragments", "hooks.json");
+  const fragmentPath = path22.join(srcDir, "settings-fragments", "hooks.json");
   const fragments = await loadHooksFragment(fragmentPath);
   const settings = await readSettings();
-  const { settings: mergedSettings, addedIds } = mergeHooks(settings, fragments);
+  const { settings: hookSettings, addedIds } = mergeHooks(settings, fragments);
+  const { settings: deniedSettings } = mergeDenyRules(hookSettings, buildDenyRules());
+  const { settings: mergedSettings } = mergeAllowRules(deniedSettings, buildAllowRules());
   result.hookIds = addedIds;
   if (!check && existingManifest) {
     const currentDestPaths = new Set(sourceFiles.map((f) => f.destPath));
     for (const entry of existingManifest.files) {
       if (currentDestPaths.has(entry.destPath)) continue;
-      if (!fs14.pathExistsSync(entry.destPath)) continue;
-      const content = await readText(entry.destPath);
-      if (!content) continue;
-      const hasHeader = parseMarkdownHeader(content) !== void 0;
-      const currentHash = hashContent(content);
+      if (!fs15.pathExistsSync(entry.destPath)) continue;
+      const content2 = await readText(entry.destPath);
+      if (!content2) continue;
+      const hasHeader = parseMarkdownHeader(content2) !== void 0;
+      const currentHash = hashContent(content2);
       if (hasHeader && currentHash === entry.hash) {
-        if (!dryRun) await fs14.remove(entry.destPath);
+        if (!dryRun) await fs15.remove(entry.destPath);
         result.deleted.push(entry.destPath);
       } else {
         warn(`Orphaned file ${entry.destPath} was user-modified \u2014 leaving in place`);
@@ -2957,14 +3513,27 @@ async function runInstall(options) {
       force: options.force,
       check: options.check
     });
-    printApplyResult(result, options.dryRun ?? false);
+    if (!options.postinstall) printApplyResult(result, options.dryRun ?? false);
     if (options.check && result.drift) {
       process.exitCode = 1;
     } else if (!options.check && !options.dryRun) {
       const total = result.created.length + result.updated.length;
-      log(
-        `haus install complete (${total} file(s) written, ${result.hookIds.length} hook(s) added)`
-      );
+      if (options.postinstall) {
+        log("haus configured Claude Code for you:");
+        const parts = [];
+        if (result.created.length) parts.push(`${result.created.length} file(s) added`);
+        if (result.updated.length) parts.push(`${result.updated.length} file(s) updated`);
+        log(
+          parts.length ? `  \u2022 ${parts.join(", ")} in ~/.claude (skills, slash commands)` : "  \u2022 already up to date \u2014 no files changed"
+        );
+        log(`  \u2022 ensured hooks + security rules are present in ~/.claude/settings.json`);
+        log("Undo any time with:  haus uninstall");
+        log("Disable this on install:  HAUS_NO_POSTINSTALL=1");
+      } else {
+        log(
+          `haus install complete (${total} file(s) written, ${result.hookIds.length} hook(s) added)`
+        );
+      }
     }
   } catch (err) {
     error(`haus install failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -2972,79 +3541,6 @@ async function runInstall(options) {
   }
 }
 
-// src/memory/memory-store.ts
-var FILES = [
-  "project-learnings.md",
-  "decisions.md",
-  "recurring-issues.md",
-  "client-context.md"
-];
-async function ensureMemory(root) {
-  await Promise.all(
-    FILES.map(async (name) => {
-      const file = hausPath(root, "memory", name);
-      const current = await readText(file);
-      if (!current) await writeText(file, `# ${name}
-`);
-    })
-  );
-  const indexFile = hausPath(root, "memory", "index.json");
-  const index = await readJson(indexFile);
-  if (!index) await writeJson(indexFile, { files: [...FILES] });
-}
-async function readMemory(root) {
-  await ensureMemory(root);
-  const blocks = await Promise.all(FILES.map((name) => readText(hausPath(root, "memory", name))));
-  return blocks.filter(Boolean).join("\n");
-}
-async function appendLearning(root, line) {
-  await ensureMemory(root);
-  const file = hausPath(root, "memory", "project-learnings.md");
-  const current = await readText(file) ?? "# project-learnings.md\n";
-  await writeText(file, `${current}
-- ${line}
-`);
-}
-
-// src/memory/redact-memory.ts
-function redactMemory(text) {
-  return text.replace(/(api[_-]?key|token|secret|password)\s*[:=]\s*\S+/gi, "$1=[REDACTED]").replace(/-----BEGIN [A-Z ]+-----[\s\S]*?-----END [A-Z ]+-----/g, "[REDACTED-KEY]");
-}
-
-// src/commands/memory.ts
-async function runMemory(subcommand, options) {
-  const root = process.cwd();
-  if (subcommand === "inject" && options.fromHook && !await isHookEnabled(root, "memoryInject")) {
-    return;
-  }
-  await ensureMemory(root);
-  if (subcommand === "status") {
-    log("Memory ready at .haus-workflow/memory");
-    return;
-  }
-  if (subcommand === "add") {
-    if (!options.text) throw new Error("memory add requires text");
-    await appendLearning(root, redactMemory(options.text));
-    log("Memory added");
-    return;
-  }
-  if (subcommand === "inject") {
-    const text = redactMemory(await readMemory(root));
-    if (!text.trim()) {
-      log("No relevant Haus memory found.");
-      return;
-    }
-    const compact = `Task: ${options.task ?? "n/a"}
-${text}`.slice(
-      0,
-      options.fromHook ? 1200 : 4e3
-    );
-    log(compact);
-    return;
-  }
-  log("Promotion proposal: review memory and move stable rules into .claude/rules manually.");
-}
-
 // src/commands/recommend.ts
 async function runRecommend(options) {
   const root = process.cwd();
@@ -3088,20 +3584,20 @@ async function runScan(options) {
 }
 
 // src/commands/undo.ts
-import path21 from "path";
-import fs15 from "fs-extra";
+import path23 from "path";
+import fs16 from "fs-extra";
 var CLAUDE_DIR = ".claude";
 async function runUndo(options) {
   const root = process.cwd();
-  const targets = [path21.join(root, CLAUDE_DIR), path21.join(root, HAUS_DIR)];
-  const existing = targets.filter((p) => fs15.existsSync(p));
+  const targets = [path23.join(root, CLAUDE_DIR), path23.join(root, HAUS_DIR)];
+  const existing = targets.filter((p) => fs16.existsSync(p));
   if (existing.length === 0) {
     log("Nothing to remove: no .claude/ or .haus-workflow/ in this directory.");
     return;
   }
   if (!options.yes) {
     const ok = await confirm(
-      `Remove ${existing.map((p) => path21.relative(root, p)).join(" and ")}? This cannot be undone.`
+      `Remove ${existing.map((p) => path23.relative(root, p)).join(" and ")}? This cannot be undone.`
     );
     if (!ok) {
       log("Cancelled.");
@@ -3109,15 +3605,15 @@ async function runUndo(options) {
     }
   }
   for (const p of existing) {
-    await fs15.remove(p);
-    log(`Removed ${path21.relative(root, p)}`);
+    await fs16.remove(p);
+    log(`Removed ${path23.relative(root, p)}`);
   }
 }
 
 // src/install/uninstall.ts
 import crypto3 from "crypto";
-import path22 from "path";
-import fs16 from "fs-extra";
+import path24 from "path";
+import fs17 from "fs-extra";
 async function runUninstall(options = {}) {
   const { force = false } = options;
   const manifest = await readManifest();
@@ -3127,17 +3623,17 @@ async function runUninstall(options = {}) {
     return result;
   }
   for (const entry of manifest.files) {
-    const exists = fs16.pathExistsSync(entry.destPath);
+    const exists = fs17.pathExistsSync(entry.destPath);
     if (!exists) continue;
-    const content = await readText(entry.destPath);
-    if (content === void 0) continue;
-    const header = parseMarkdownHeader(content);
+    const content2 = await readText(entry.destPath);
+    if (content2 === void 0) continue;
+    const header = parseMarkdownHeader(content2);
     if (!header) {
       warn(`Skipping user-owned file (no HAUS-MANAGED header): ${entry.destPath}`);
       result.skipped.push(entry.destPath);
       continue;
     }
-    const currentHash = `sha256-${crypto3.createHash("sha256").update(content).digest("hex")}`;
+    const currentHash = `sha256-${crypto3.createHash("sha256").update(content2).digest("hex")}`;
     if (currentHash !== entry.hash && !force) {
       warn(
         `Skipping user-edited haus file (hash mismatch): ${entry.destPath} \u2014 use --force to delete`
@@ -3145,22 +3641,22 @@ async function runUninstall(options = {}) {
       result.skipped.push(entry.destPath);
       continue;
     }
-    await fs16.remove(entry.destPath);
-    await pruneEmptyDir(path22.dirname(entry.destPath));
+    await fs17.remove(entry.destPath);
+    await pruneEmptyDir(path24.dirname(entry.destPath));
     result.deleted.push(entry.destPath);
   }
   const settings = await readSettings();
-  const stripped = stripHausHooks(settings);
+  const stripped = stripHausHooks(stripHausAllow(stripHausDeny(settings)));
   await writeSettings(stripped);
   result.hooksStripped = true;
-  const hausDir = path22.join(globalClaudeDir(), "haus");
+  const hausDir = path24.join(globalClaudeDir(), "haus");
   const manifestPath = hausManifestPath();
-  if (fs16.pathExistsSync(manifestPath)) {
-    await fs16.remove(manifestPath);
+  if (fs17.pathExistsSync(manifestPath)) {
+    await fs17.remove(manifestPath);
   }
-  if (fs16.pathExistsSync(hausDir)) {
-    const remaining = await fs16.readdir(hausDir);
-    if (remaining.length === 0) await fs16.remove(hausDir);
+  if (fs17.pathExistsSync(hausDir)) {
+    const remaining = await fs17.readdir(hausDir);
+    if (remaining.length === 0) await fs17.remove(hausDir);
   }
   return result;
 }
@@ -3179,8 +3675,8 @@ function printUninstallResult(result) {
 }
 async function pruneEmptyDir(dir) {
   try {
-    const entries = await fs16.readdir(dir);
-    if (entries.length === 0) await fs16.remove(dir);
+    const entries = await fs17.readdir(dir);
+    if (entries.length === 0) await fs17.remove(dir);
   } catch {
   }
 }
@@ -3198,7 +3694,7 @@ async function runUninstallCommand(options) {
 }
 
 // src/commands/update.ts
-import path24 from "path";
+import path26 from "path";
 
 // src/update/diff-generated-files.ts
 function diffGeneratedFiles() {
@@ -3224,8 +3720,8 @@ function summarizeLockDiff(before, after) {
 }
 
 // src/update/lockfile.ts
-import { mkdir, readFile as readFile2, copyFile } from "fs/promises";
-import path23 from "path";
+import { mkdir, readFile as readFile3, copyFile } from "fs/promises";
+import path25 from "path";
 async function checkLock(root) {
   const lock = await readJson(hausPath(root, "haus.lock.json")) ?? [];
   const hasValidVersions = lock.every(
@@ -3238,7 +3734,7 @@ async function applyLock(root) {
   const lockPath = hausPath(root, "haus.lock.json");
   let before = "[]";
   try {
-    before = await readFile2(lockPath, "utf8");
+    before = await readFile3(lockPath, "utf8");
   } catch {
     before = "[]";
   }
@@ -3246,7 +3742,7 @@ async function applyLock(root) {
   try {
     const backupDir = hausPath(root, "backups");
     await mkdir(backupDir, { recursive: true });
-    await copyFile(lockPath, path23.join(backupDir, `haus.lock.${Date.now()}.json`));
+    await copyFile(lockPath, path25.join(backupDir, `haus.lock.${Date.now()}.json`));
   } catch {
   }
   const enriched = await Promise.all(
@@ -3268,7 +3764,7 @@ function diffLock(before, after) {
 }
 async function hasLocalOverrides(root) {
   try {
-    await readFile2(path23.join(root, ".claude", "settings.json"), "utf8");
+    await readFile3(path25.join(root, ".claude", "settings.json"), "utf8");
     return true;
   } catch {
     return false;
@@ -3280,7 +3776,7 @@ var NPM_PACKAGE_NAME2 = "@haus-tech/haus-workflow";
 async function runUpdate(options) {
   const root = process.cwd();
   if (options.check) {
-    const pkgJson2 = await readJson(path24.join(packageRoot(), "package.json"));
+    const pkgJson2 = await readJson(path26.join(packageRoot(), "package.json"));
     const currentVersion2 = pkgJson2?.version ?? "0.0.0";
     const [status, npmVersion, latestCatalogTag] = await Promise.all([
       checkLock(root),
@@ -3307,7 +3803,7 @@ async function runUpdate(options) {
     if (!status.ok) process.exitCode = 1;
     return;
   }
-  const pkgJson = await readJson(path24.join(packageRoot(), "package.json"));
+  const pkgJson = await readJson(path26.join(packageRoot(), "package.json"));
   const currentVersion = pkgJson?.version ?? "0.0.0";
   const npmStatus = await fetchNpmVersionStatus(currentVersion);
   if (npmStatus.updateAvailable && npmStatus.latest !== null) {
@@ -3337,49 +3833,187 @@ async function runUpdate(options) {
 }
 
 // src/commands/validate-catalog.ts
-import fs17 from "fs";
-import path26 from "path";
+import fs18 from "fs";
+import path27 from "path";
 
-// src/catalog/allowed-stacks.ts
-import path25 from "path";
-async function readAllowedStacks(root) {
-  const data = await readJson(
-    path25.join(root, "library", "catalog", "allowed-stacks.json")
-  );
-  return data?.stacks ?? [];
-}
+// library/catalog/validation-rules.json
+var validation_rules_default = {
+  forbiddenTags: [
+    "python",
+    "django",
+    "go",
+    "rust",
+    "java",
+    "spring",
+    "kotlin",
+    "swift",
+    "android",
+    "flutter",
+    "dart",
+    "c++",
+    "perl",
+    "defi",
+    "trading"
+  ],
+  bannedAgentPhrases: ["autonomous", "swarm", "delegate", "orchestrat", "marketplace"],
+  requiredSkillSections: ["## Use when", "## Do not use when"],
+  requiredAgentSections: ["## Use when", "## Do not use when", "## Verification"],
+  riskyInstallPatterns: [
+    { source: "\\bnpx\\s+-y\\b", flags: "i" },
+    { source: "\\bnpx\\s+--yes\\b", flags: "i" },
+    { source: "\\byarn\\s+dlx\\b", flags: "i" },
+    { source: "\\bpnpm\\s+dlx\\b", flags: "i" }
+  ],
+  allowedNpxPattern: { source: "\\bnpx\\s+tsx\\b", flags: "i" },
+  anyNpxPattern: { source: "\\bnpx\\s+\\S+", flags: "i" },
+  httpUrlPattern: { source: "^http:\\/\\/", flags: "i" },
+  placeholderPattern: { source: "\\bTODO\\b|\\bPLACEHOLDER\\b", flags: "i" },
+  allowedStacks: [
+    "haus",
+    "security",
+    "quality",
+    "frontend",
+    "backend",
+    "testing",
+    "review",
+    "workflow",
+    "reference-pack",
+    "core-skill",
+    "workflow-skill",
+    "stack-skill",
+    "review-skill",
+    "agent",
+    "hook",
+    "rule",
+    "react",
+    "typescript",
+    "php",
+    "csharp",
+    "vendure",
+    "vendure3",
+    "nestjs",
+    "graphql",
+    "nx21",
+    "turbo",
+    "nextjs",
+    "react19",
+    "typescript5",
+    "vite8",
+    "tanstack-query",
+    "tanstack-router",
+    "radix",
+    "radix-ui",
+    "shadcn",
+    "shadcn-ui",
+    "tailwind",
+    "tailwindcss",
+    "scss",
+    "scss-modules",
+    "vue",
+    "expressjs",
+    "soup-base",
+    "laravel",
+    "laravel-nova",
+    "wordpress",
+    "bedrock",
+    "elementor-pro",
+    "acf-pro",
+    "jetengine",
+    "dotnet",
+    "oidc",
+    "azure-ad",
+    "bankid",
+    "myid",
+    "cgi",
+    "crypto",
+    "collection2",
+    "postgresql",
+    "mariadb",
+    "mssql",
+    "elasticsearch",
+    "yarn4",
+    "pnpm89",
+    "playwright",
+    "testing-library",
+    "phpunit",
+    "storybook",
+    "wisest",
+    "vitest",
+    "jest",
+    "redis",
+    "sanity",
+    "strapi",
+    "prisma",
+    "cms",
+    "database",
+    "mysql",
+    "saml2",
+    "next-auth",
+    "auth",
+    "expo",
+    "react-native",
+    "mobile",
+    "i18next",
+    "i18n",
+    "bullmq",
+    "queue",
+    "sentry",
+    "observability",
+    "tooling",
+    "prettier",
+    "eslint",
+    "missing-prettier",
+    "missing-eslint",
+    "docker",
+    "pm2",
+    "deployer-php",
+    "stripe",
+    "qliro",
+    "supabase",
+    "payments"
+  ],
+  alwaysAllowedTags: [
+    "haus",
+    "security",
+    "quality",
+    "review",
+    "workflow",
+    "baseline",
+    "project-instructions"
+  ],
+  patternTagSuffixes: ["-patterns"]
+};
 
 // src/catalog/validation-rules.ts
-var FORBIDDEN_TAGS = [
-  "python",
-  "django",
-  "go",
-  "rust",
-  "java",
-  "spring",
-  "kotlin",
-  "swift",
-  "android",
-  "flutter",
-  "dart",
-  "c++",
-  "perl",
-  "defi",
-  "trading"
-];
-var BANNED_AGENT_PHRASES = ["autonomous", "swarm", "delegate", "orchestrat", "marketplace"];
-var REQUIRED_SKILL_SECTIONS = ["## Use when", "## Do not use when"];
-var REQUIRED_AGENT_SECTIONS = ["## Use when", "## Do not use when", "## Verification"];
-var RISKY_INSTALL_PATTERNS = [
-  /\bnpx\s+-y\b/i,
-  /\bnpx\s+--yes\b/i,
-  /\byarn\s+dlx\b/i,
-  /\bpnpm\s+dlx\b/i
-];
-var ALLOWED_NPX_PATTERN = /\bnpx\s+tsx\b/i;
-var ANY_NPX_PATTERN = /\bnpx\s+\S+/i;
-var HTTP_URL_PATTERN = /^http:\/\//i;
-var PLACEHOLDER_PATTERN = /\bTODO\b|\bPLACEHOLDER\b/i;
+var toRegExp = (r) => new RegExp(r.source, r.flags);
+var FORBIDDEN_TAGS = validation_rules_default.forbiddenTags;
+var BANNED_AGENT_PHRASES = validation_rules_default.bannedAgentPhrases;
+var REQUIRED_SKILL_SECTIONS = validation_rules_default.requiredSkillSections;
+var REQUIRED_AGENT_SECTIONS = validation_rules_default.requiredAgentSections;
+var RISKY_INSTALL_PATTERNS = validation_rules_default.riskyInstallPatterns.map(toRegExp);
+var ALLOWED_NPX_PATTERN = toRegExp(validation_rules_default.allowedNpxPattern);
+var ANY_NPX_PATTERN = toRegExp(validation_rules_default.anyNpxPattern);
+var HTTP_URL_PATTERN = toRegExp(validation_rules_default.httpUrlPattern);
+var PLACEHOLDER_PATTERN = toRegExp(validation_rules_default.placeholderPattern);
+var ALLOWED_STACKS = validation_rules_default.allowedStacks;
+var ALWAYS_ALLOWED_TAGS = validation_rules_default.alwaysAllowedTags;
+var PATTERN_TAG_SUFFIXES = validation_rules_default.patternTagSuffixes;
+var ALLOWED_SET = new Set([...ALLOWED_STACKS, ...ALWAYS_ALLOWED_TAGS].map((t) => t.toLowerCase()));
+function isTagAllowed(tag) {
+  const lower = tag.toLowerCase();
+  if (ALLOWED_SET.has(lower)) return true;
+  return PATTERN_TAG_SUFFIXES.some((suffix) => lower.endsWith(suffix));
+}
+function auditDisallowedTags(items) {
+  const failures = [];
+  for (const item of items) {
+    if (!item.id) continue;
+    for (const tag of Array.isArray(item.tags) ? item.tags : []) {
+      if (!isTagAllowed(tag)) failures.push(`${item.id}: tag not in allowlist: "${tag}"`);
+    }
+  }
+  return failures;
+}
 
 // src/commands/validate-catalog.ts
 function auditForbiddenStacks(items) {
@@ -3449,23 +4083,23 @@ function auditShippedFiles(manifestDir, items) {
   const failures = [];
   for (const item of items) {
     if (!item.path) continue;
-    const absPath = path26.join(manifestDir, item.path);
+    const absPath = path27.join(manifestDir, item.path);
     if (item.type === "skill") {
-      const skillMd = path26.join(absPath, "SKILL.md");
-      if (!fs17.existsSync(skillMd)) {
-        failures.push(`${item.id}: missing ${path26.relative(manifestDir, skillMd)}`);
+      const skillMd = path27.join(absPath, "SKILL.md");
+      if (!fs18.existsSync(skillMd)) {
+        failures.push(`${item.id}: missing ${path27.relative(manifestDir, skillMd)}`);
         continue;
       }
-      const text = fs17.readFileSync(skillMd, "utf8");
+      const text = fs18.readFileSync(skillMd, "utf8");
       for (const section of REQUIRED_SKILL_SECTIONS) {
         if (!text.includes(section)) failures.push(`${item.id}: SKILL.md missing ${section}`);
       }
     } else if (item.type === "agent") {
-      if (!fs17.existsSync(absPath)) {
+      if (!fs18.existsSync(absPath)) {
         failures.push(`${item.id}: missing agent file ${item.path}`);
         continue;
       }
-      const text = fs17.readFileSync(absPath, "utf8");
+      const text = fs18.readFileSync(absPath, "utf8");
       if (!text.startsWith("---")) failures.push(`${item.id}: agent file missing YAML frontmatter`);
       for (const section of REQUIRED_AGENT_SECTIONS) {
         if (!text.includes(section)) failures.push(`${item.id}: agent file missing ${section}`);
@@ -3476,7 +4110,7 @@ function auditShippedFiles(manifestDir, items) {
           failures.push(`${item.id}: agent file contains disallowed phrase "${phrase}"`);
       }
     } else if (item.type === "template") {
-      if (!fs17.existsSync(absPath)) {
+      if (!fs18.existsSync(absPath)) {
         failures.push(`${item.id}: missing template file ${item.path}`);
       }
     }
@@ -3487,21 +4121,21 @@ function auditMarkdownContent(manifestDir) {
   const failures = [];
   const dirs = ["skills", "agents"];
   for (const dir of dirs) {
-    const abs = path26.join(manifestDir, dir);
-    if (!fs17.existsSync(abs)) continue;
+    const abs = path27.join(manifestDir, dir);
+    if (!fs18.existsSync(abs)) continue;
     walkMd(abs, (file) => {
-      const text = fs17.readFileSync(file, "utf8");
-      const rel = path26.relative(manifestDir, file);
+      const text = fs18.readFileSync(file, "utf8");
+      const rel = path27.relative(manifestDir, file);
       const lines = text.split(/\r?\n/);
       for (let i = 0; i < lines.length; i++) {
-        const line = lines[i] ?? "";
-        if (PLACEHOLDER_PATTERN.test(line)) {
+        const line2 = lines[i] ?? "";
+        if (PLACEHOLDER_PATTERN.test(line2)) {
           failures.push(`${rel}:${i + 1}: TODO or placeholder in shipped content`);
         }
-        if (RISKY_INSTALL_PATTERNS.some((re) => re.test(line))) {
+        if (RISKY_INSTALL_PATTERNS.some((re) => re.test(line2))) {
           failures.push(`${rel}:${i + 1}: risky install pattern`);
         }
-        if (ANY_NPX_PATTERN.test(line) && !ALLOWED_NPX_PATTERN.test(line)) {
+        if (ANY_NPX_PATTERN.test(line2) && !ALLOWED_NPX_PATTERN.test(line2)) {
           failures.push(`${rel}:${i + 1}: disallowed npx (only npx tsx allowed)`);
         }
       }
@@ -3510,8 +4144,8 @@ function auditMarkdownContent(manifestDir) {
   return failures;
 }
 function walkMd(dir, fn) {
-  for (const entry of fs17.readdirSync(dir, { withFileTypes: true })) {
-    const full = path26.join(dir, entry.name);
+  for (const entry of fs18.readdirSync(dir, { withFileTypes: true })) {
+    const full = path27.join(dir, entry.name);
     if (entry.isDirectory()) walkMd(full, fn);
     else if (entry.name.endsWith(".md")) fn(full);
   }
@@ -3522,8 +4156,8 @@ async function runValidateCatalog(manifestPath) {
     process.exitCode = 1;
     return;
   }
-  const abs = path26.resolve(process.cwd(), manifestPath);
-  const manifestDir = path26.dirname(abs);
+  const abs = path27.resolve(process.cwd(), manifestPath);
+  const manifestDir = path27.dirname(abs);
   const data = await readJson(abs);
   if (!data?.items) {
     error(`Could not read catalog manifest at ${abs}`);
@@ -3535,17 +4169,7 @@ async function runValidateCatalog(manifestPath) {
   const stackFailures = auditForbiddenStacks(items);
   const fileFailures = auditShippedFiles(manifestDir, items);
   const contentFailures = auditMarkdownContent(manifestDir);
-  const allowed = new Set((await readAllowedStacks(packageRoot())).map((x) => x.toLowerCase()));
-  const tagFailures = [];
-  if (allowed.size > 0) {
-    for (const item of items) {
-      for (const tag of Array.isArray(item.tags) ? item.tags : []) {
-        if (!allowed.has(tag.toLowerCase()) && !tag.includes("-patterns") && tag !== "haus" && tag !== "security" && tag !== "quality" && tag !== "review" && tag !== "workflow" && tag !== "baseline" && tag !== "project-instructions") {
-          tagFailures.push(`${item.id}: tag not in allowlist: "${tag}"`);
-        }
-      }
-    }
-  }
+  const tagFailures = auditDisallowedTags(items);
   const allFailures = [
     ...structureFailures,
     ...stackFailures,
@@ -3562,7 +4186,7 @@ async function runValidateCatalog(manifestPath) {
 }
 
 // src/commands/workspace.ts
-import path27 from "path";
+import path28 from "path";
 import YAML from "yaml";
 async function runWorkspace(action) {
   if (action === "init") {
@@ -3595,7 +4219,7 @@ relationships: []
   const summaries = [];
   const ownership = {};
   for (const repo of repos) {
-    const repoRoot = path27.resolve(process.cwd(), repo.path);
+    const repoRoot = path28.resolve(process.cwd(), repo.path);
     const result = await scanProject(repoRoot, "fast");
     summaries.push({
       name: repo.name,
@@ -3604,9 +4228,9 @@ relationships: []
       packageManager: result.packageManager,
       deps: result.dependencies
     });
-    for (const dep of result.dependencies) {
-      ownership[dep] ??= [];
-      ownership[dep].push(repo.name);
+    for (const dep2 of result.dependencies) {
+      ownership[dep2] ??= [];
+      ownership[dep2].push(repo.name);
     }
   }
   await writeJson(".haus-workflow/workspace-summary.json", {
@@ -3631,7 +4255,7 @@ ${summaries.map(
 // src/cli.ts
 function cliVersion() {
   try {
-    const pkgPath = path28.join(packageRoot(), "package.json");
+    const pkgPath = path29.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
@@ -3641,7 +4265,7 @@ function cliVersion() {
 var program = new Command();
 function validateRuntimeNodeVersion() {
   try {
-    const pkgPath = path28.join(packageRoot(), "package.json");
+    const pkgPath = path29.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
     const requiredRange = pkg.engines?.node;
     if (requiredRange && !satisfiesVersion(process.version, requiredRange)) {
@@ -3662,6 +4286,9 @@ program.command("doctor").option("--hooks", "Verify .claude/settings.json matche
 program.command("apply").option("--dry-run").option("--write").option("--select", "Interactively select catalog items before applying").option(
   "--allow-empty-cache",
   "Apply core files only when catalog cache is empty (skip catalog items without error)"
+).option(
+  "--refill-config",
+  "Fill still-blank fields in an existing workflow-config.md without touching edited ones"
 ).action(runApply);
 program.command("undo").option("-y, --yes", "Skip confirmation").action(runUndo);
 program.command("explain-recommendation").option("--json").action(runExplainRecommendation);
@@ -3671,20 +4298,15 @@ program.command("refresh").action(runRefresh);
 program.command("catalog-audit").action(runCatalogAudit);
 program.command("validate-catalog").argument("[manifest]").action(runValidateCatalog);
 program.command("update").option("--check").action(runUpdate);
-program.command("install").option("--dry-run").option("--force").option("--check", "Exit non-zero if any HAUS-MANAGED file is out of date").action(runInstall);
+program.command("install").option("--dry-run").option("--force").option("--check", "Exit non-zero if any HAUS-MANAGED file is out of date").option("--postinstall", "Run by the npm postinstall hook; prints a plain-language change notice").action(runInstall);
 program.command("uninstall").option("--force").action(runUninstallCommand);
-var memory = program.command("memory");
-memory.command("status").action(() => runMemory("status", {}));
-memory.command("add <text>").action((text) => runMemory("add", { text }));
-memory.command("inject").option("--task <task>").option("--from-hook").action((opts) => runMemory("inject", opts));
-memory.command("promote").action(() => runMemory("promote", {}));
 var guard = program.command("guard");
 guard.command("file-access").option("--from-hook").action((opts) => runGuard("file-access", opts));
 guard.command("bash").option("--from-hook").action((opts) => runGuard("bash", opts));
 var config = program.command("config");
-config.command("enable <key>").description("Enable a hook (hook.context, hook.memory)").action((key) => runConfig(key, "enable"));
-config.command("disable <key>").description("Disable a hook (hook.context, hook.memory)").action((key) => runConfig(key, "disable"));
-config.command("status <key>").description("Show current state of a hook (hook.context, hook.memory)").action((key) => runConfig(key, "status"));
+config.command("enable <key>").description("Enable a hook (hook.context)").action((key) => runConfig(key, "enable"));
+config.command("disable <key>").description("Disable a hook (hook.context)").action((key) => runConfig(key, "disable"));
+config.command("status <key>").description("Show current state of a hook (hook.context)").action((key) => runConfig(key, "status"));
 var workspace = program.command("workspace");
 workspace.command("init").action(() => runWorkspace("init"));
 workspace.command("scan").action(() => runWorkspace("scan"));