@haus-tech/haus-workflow 0.13.1 → 0.14.0

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { readFileSync as readFileSync3 } from "fs";
-import path28 from "path";
+import { readFileSync as readFileSync4 } from "fs";
+import path34 from "path";
 import { Command } from "commander";
 
 // src/commands/apply.ts
@@ -242,6 +242,16 @@ async function listFiles(root, patterns) {
 function hashText(value) {
   return `sha256-${crypto.createHash("sha256").update(value).digest("hex")}`;
 }
+async function mapWithConcurrency(items, fn, concurrency = 24) {
+  const size = Number.isFinite(concurrency) ? Math.max(1, Math.floor(concurrency)) : 24;
+  const results = new Array(items.length);
+  for (let i = 0; i < items.length; i += size) {
+    const batch = items.slice(i, i + size);
+    const settled = await Promise.all(batch.map((item, j) => fn(item, i + j)));
+    for (let j = 0; j < settled.length; j += 1) results[i + j] = settled[j];
+  }
+  return results;
+}
 
 // src/update/hash-installed.ts
 var EMPTY_LOCK_PATHS_TOKEN = "haus-lock:empty-paths";
@@ -439,8 +449,8 @@ function buildDenyRules() {
   for (const command of DANGEROUS_COMMANDS) {
     rules.push(`Bash(${command}:*)`);
   }
-  for (const path29 of SENSITIVE_PATHS) {
-    const pattern = SENSITIVE_DIRS.has(path29) ? `${path29}/**` : path29;
+  for (const path35 of SENSITIVE_PATHS) {
+    const pattern = SENSITIVE_DIRS.has(path35) ? `${path35}/**` : path35;
     for (const tool of FILE_TOOLS) {
       rules.push(`${tool}(${pattern})`);
     }
@@ -804,7 +814,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
     estimatedTokenReductionPct: 0
   };
   const pkgRoot = packageRoot();
-  const hausVersion = (await readJson(path9.join(pkgRoot, "package.json")))?.version ?? "0.0.0";
+  const hausVersion2 = (await readJson(path9.join(pkgRoot, "package.json")))?.version ?? "0.0.0";
   const coreFiles = [
     claudePath(root, "settings.json"),
     claudePath(root, "rules", "haus.md"),
@@ -813,7 +823,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
     claudePath(root, "commands", "haus-review.md")
   ];
   const rootClaudeMdPath = await writeRootClaudeMd(root, dryRun);
-  const workflowPath = await writeWorkflow(root, hausVersion, dryRun);
+  const workflowPath = await writeWorkflow(root, hausVersion2, dryRun);
   const workflowConfigPath = await writeWorkflowConfig(root, dryRun, {
     refill: opts.refillConfig
   });
@@ -860,9 +870,9 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
     dryRun
   );
   const fixtureManifestPath = process.env["HAUS_FIXTURE_CATALOG"];
-  const manifestPath = fixtureManifestPath ?? path9.join(pkgRoot, "library", "catalog", "manifest.json");
-  const manifestDir = path9.dirname(manifestPath);
-  const manifest = await readJson(manifestPath) ?? { items: [] };
+  const manifestPath2 = fixtureManifestPath ?? path9.join(pkgRoot, "library", "catalog", "manifest.json");
+  const manifestDir = path9.dirname(manifestPath2);
+  const manifest = await readJson(manifestPath2) ?? { items: [] };
   const manifestById = new Map((manifest.items ?? []).map((item) => [item.id, item]));
   const cacheManifest = await readJson(
     path9.join(CACHE_DIR, "manifest.json")
@@ -933,7 +943,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
         id: r.id,
         type: r.type,
         source: isCurated ? "curated" : "haus",
-        version: hausVersion,
+        version: hausVersion2,
         catalogRef: CATALOG_REF,
         hash: await hashInstalledPaths(root, relPaths),
         installMode: "copied",
@@ -1069,32 +1079,202 @@ async function loadCatalog(root) {
   return data?.items ?? [];
 }
 
+// library/catalog/validation-rules.json
+var validation_rules_default = {
+  forbiddenTags: [
+    "python",
+    "django",
+    "go",
+    "rust",
+    "java",
+    "spring",
+    "kotlin",
+    "swift",
+    "android",
+    "flutter",
+    "dart",
+    "c++",
+    "perl",
+    "defi",
+    "trading"
+  ],
+  bannedAgentPhrases: ["autonomous", "swarm", "delegate", "orchestrat", "marketplace"],
+  requiredSkillSections: ["## Use when", "## Do not use when"],
+  requiredAgentSections: ["## Use when", "## Do not use when", "## Verification"],
+  riskyInstallPatterns: [
+    { source: "\\bnpx\\s+-y\\b", flags: "i" },
+    { source: "\\bnpx\\s+--yes\\b", flags: "i" },
+    { source: "\\byarn\\s+dlx\\b", flags: "i" },
+    { source: "\\bpnpm\\s+dlx\\b", flags: "i" }
+  ],
+  allowedNpxPattern: { source: "\\bnpx\\s+tsx\\b", flags: "i" },
+  anyNpxPattern: { source: "\\bnpx\\s+\\S+", flags: "i" },
+  httpUrlPattern: { source: "^http:\\/\\/", flags: "i" },
+  placeholderPattern: { source: "\\bTODO\\b|\\bPLACEHOLDER\\b", flags: "i" },
+  allowedStacks: [
+    "haus",
+    "security",
+    "quality",
+    "frontend",
+    "backend",
+    "testing",
+    "review",
+    "workflow",
+    "reference-pack",
+    "core-skill",
+    "workflow-skill",
+    "stack-skill",
+    "review-skill",
+    "agent",
+    "hook",
+    "rule",
+    "react",
+    "typescript",
+    "php",
+    "csharp",
+    "vendure",
+    "vendure3",
+    "nestjs",
+    "graphql",
+    "nx21",
+    "turbo",
+    "nextjs",
+    "react19",
+    "typescript5",
+    "vite8",
+    "tanstack-query",
+    "tanstack-router",
+    "radix",
+    "radix-ui",
+    "shadcn",
+    "shadcn-ui",
+    "tailwind",
+    "tailwindcss",
+    "scss",
+    "scss-modules",
+    "vue",
+    "expressjs",
+    "soup-base",
+    "laravel",
+    "laravel-nova",
+    "wordpress",
+    "bedrock",
+    "elementor-pro",
+    "acf-pro",
+    "jetengine",
+    "dotnet",
+    "oidc",
+    "azure-ad",
+    "bankid",
+    "myid",
+    "cgi",
+    "crypto",
+    "collection2",
+    "postgresql",
+    "mariadb",
+    "mssql",
+    "elasticsearch",
+    "yarn4",
+    "pnpm89",
+    "playwright",
+    "testing-library",
+    "phpunit",
+    "storybook",
+    "wisest",
+    "vitest",
+    "jest",
+    "redis",
+    "sanity",
+    "strapi",
+    "prisma",
+    "cms",
+    "database",
+    "mysql",
+    "saml2",
+    "next-auth",
+    "auth",
+    "expo",
+    "react-native",
+    "mobile",
+    "i18next",
+    "i18n",
+    "bullmq",
+    "queue",
+    "sentry",
+    "observability",
+    "tooling",
+    "prettier",
+    "eslint",
+    "missing-prettier",
+    "missing-eslint",
+    "docker",
+    "pm2",
+    "deployer-php",
+    "stripe",
+    "qliro",
+    "supabase",
+    "payments"
+  ],
+  alwaysAllowedTags: [
+    "haus",
+    "security",
+    "quality",
+    "review",
+    "workflow",
+    "baseline",
+    "project-instructions"
+  ],
+  patternTagSuffixes: ["-patterns"]
+};
+
+// src/catalog/validation-rules.ts
+var toRegExp = (r) => new RegExp(r.source, r.flags);
+var FORBIDDEN_TAGS = validation_rules_default.forbiddenTags;
+var BANNED_AGENT_PHRASES = validation_rules_default.bannedAgentPhrases;
+var REQUIRED_SKILL_SECTIONS = validation_rules_default.requiredSkillSections;
+var REQUIRED_AGENT_SECTIONS = validation_rules_default.requiredAgentSections;
+var RISKY_INSTALL_PATTERNS = validation_rules_default.riskyInstallPatterns.map(toRegExp);
+var ALLOWED_NPX_PATTERN = toRegExp(validation_rules_default.allowedNpxPattern);
+var ANY_NPX_PATTERN = toRegExp(validation_rules_default.anyNpxPattern);
+var HTTP_URL_PATTERN = toRegExp(validation_rules_default.httpUrlPattern);
+var PLACEHOLDER_PATTERN = toRegExp(validation_rules_default.placeholderPattern);
+var ALLOWED_STACKS = validation_rules_default.allowedStacks;
+var ALWAYS_ALLOWED_TAGS = validation_rules_default.alwaysAllowedTags;
+var PATTERN_TAG_SUFFIXES = validation_rules_default.patternTagSuffixes;
+var ALLOWED_SET = new Set([...ALLOWED_STACKS, ...ALWAYS_ALLOWED_TAGS].map((t) => t.toLowerCase()));
+function isTagAllowed(tag) {
+  const lower = tag.toLowerCase();
+  if (ALLOWED_SET.has(lower)) return true;
+  return PATTERN_TAG_SUFFIXES.some((suffix) => lower.endsWith(suffix));
+}
+function auditDisallowedTags(items) {
+  const failures = [];
+  for (const item of items) {
+    if (!item.id) continue;
+    for (const tag of Array.isArray(item.tags) ? item.tags : []) {
+      if (!isTagAllowed(tag)) failures.push(`${item.id}: tag not in allowlist: "${tag}"`);
+    }
+  }
+  return failures;
+}
+
 // src/commands/catalog-audit.ts
-var FORBIDDEN = [
-  "python",
-  "django",
-  "go",
-  "rust",
-  "java",
-  "spring",
-  "kotlin",
-  "swift",
-  "android",
-  "flutter",
-  "dart",
-  "c++",
-  "perl",
-  "defi",
-  "trading"
-];
-async function runCatalogAudit() {
-  const items = await loadCatalog(process.cwd());
+function auditForbiddenTags(items) {
   const failures = [];
+  const forbidden = new Set(FORBIDDEN_TAGS.map((w) => w.toLowerCase()));
   for (const item of items) {
-    const text = `${item.id} ${item.tags.join(" ")}`.toLowerCase();
-    for (const word of FORBIDDEN)
-      if (text.includes(word)) failures.push(`${item.id} has unsupported tag ${word}`);
+    for (const tag of item.tags) {
+      if (forbidden.has(tag.toLowerCase())) failures.push(`${item.id} has unsupported tag ${tag}`);
+    }
+    for (const token of item.id.toLowerCase().split(/[^a-z0-9+]+/)) {
+      if (forbidden.has(token)) failures.push(`${item.id} has unsupported tag ${token}`);
+    }
   }
+  return failures;
+}
+async function runCatalogAudit() {
+  const items = await loadCatalog(process.cwd());
+  const failures = auditForbiddenTags(items);
   if (failures.length) {
     failures.forEach((f) => error(f));
     process.exitCode = 1;
@@ -1831,20 +2011,13 @@ async function buildContentBlob(root, files) {
     (f) => f.endsWith(".ts") || f.endsWith(".js") || f.endsWith(".php") || f.endsWith(".json") || f.endsWith(".yml") || f.endsWith(".yaml")
   );
   const slice = candidates.slice(0, 300);
-  const CHUNK = 24;
-  const parts = [];
-  for (let i = 0; i < slice.length; i += CHUNK) {
-    const batch = await Promise.all(
-      slice.slice(i, i + CHUNK).map(async (rel) => {
-        try {
-          return await readFile(path15.join(root, rel), "utf8");
-        } catch {
-          return "";
-        }
-      })
-    );
-    parts.push(...batch);
-  }
+  const parts = await mapWithConcurrency(slice, async (rel) => {
+    try {
+      return await readFile(path15.join(root, rel), "utf8");
+    } catch {
+      return "";
+    }
+  });
   return parts.join("\n");
 }
 function renderSummary(context) {
@@ -1957,10 +2130,9 @@ async function scanProject(root, mode = "fast") {
     composer: isRecord(composer?.require) ? Object.keys(composer.require) : []
   };
   const scanHashes = Object.fromEntries(
-    await Promise.all(
-      safeFiles.map(
-        async (f) => [f, hashText(await readFile2(path16.join(root, f), "utf8"))]
-      )
+    await mapWithConcurrency(
+      safeFiles,
+      async (f) => [f, hashText(await readFile2(path16.join(root, f), "utf8"))]
     )
   );
   const repoSummary = renderSummary(context);
@@ -2376,6 +2548,24 @@ async function runGuard(kind, _options) {
 import path18 from "path";
 import fs12 from "fs-extra";
 
+// src/utils/prompts.ts
+import { stdin as input, stdout as output } from "process";
+import readline from "readline/promises";
+async function ask(question) {
+  const rl = readline.createInterface({ input, output });
+  try {
+    const answer = await rl.question(`${question}
+> `);
+    return answer.trim();
+  } finally {
+    rl.close();
+  }
+}
+async function confirm(question) {
+  const answer = (await ask(`${question} [y/N]`)).toLowerCase();
+  return answer === "y" || answer === "yes";
+}
+
 // src/utils/exec.ts
 import { execa } from "execa";
 async function runCommand(command, args = [], options = {}) {
@@ -2660,69 +2850,16 @@ function buildStackSet(context) {
   );
 }
 
-// src/utils/prompts.ts
-import { stdin as input, stdout as output } from "process";
-import readline from "readline/promises";
-async function ask(question) {
-  const rl = readline.createInterface({ input, output });
-  try {
-    const answer = await rl.question(`${question}
-> `);
-    return answer.trim();
-  } finally {
-    rl.close();
-  }
-}
-async function confirm(question) {
-  const answer = (await ask(`${question} [y/N]`)).toLowerCase();
-  return answer === "y" || answer === "yes";
-}
-
-// src/commands/setup-project.ts
-var GUIDED_QUESTIONS = [
-  "What is this project for?",
-  "Is it for a client, internal Haus work, or experimentation?",
-  "What should Claude help with most?",
-  "Is this project connected to other repositories?",
-  "Are there parts of the project Claude should avoid touching?",
-  "Are there client-specific rules or sensitive areas?",
-  "Do you want a minimal, standard, or strict setup?"
-];
-async function runSetupProject(options) {
-  const root = process.cwd();
-  let mode = options.guided ? "guided" : "fast";
-  if (!options.guided && !options.fast && !options.json) {
-    log("How do you want to set this project up?");
-    log("1. Guided setup - I'll ask a few simple questions, then scan the project.");
-    log("2. Fast setup - I'll only scan the project and recommend defaults.");
-    const choice = await ask("Choose 1 or 2");
-    mode = choice === "1" ? "guided" : "fast";
-  }
-  if (mode === "guided") {
-    const existing = await readJson(hausPath(root, "setup-answers.json")) ?? {};
-    const merged = {};
-    for (const question of GUIDED_QUESTIONS) {
-      if (options.json) {
-        merged[question] = existing[question] ?? "pending-user-answer";
-        continue;
-      }
-      const prefilled = existing[question];
-      if (prefilled && prefilled !== "pending-user-answer" && prefilled !== "no-answer") {
-        merged[question] = prefilled;
-        continue;
-      }
-      const answer = await ask(question);
-      merged[question] = answer || prefilled || "no-answer";
-    }
-    await writeJson(hausPath(root, "setup-answers.json"), merged);
-  }
-  const scanResult = await scanProject(root, mode);
-  if (options.json) {
-    log(JSON.stringify(scanResult, null, 2));
-  } else {
-    log("Haus scan complete");
-    log(`Roles: ${scanResult.repoRoles.join(", ") || "unknown"}`);
-    log(`Package manager: ${scanResult.packageManager}`);
+// src/commands/setup-core.ts
+async function runSetupCore(root, opts) {
+  const { mode, json, apply, dryRun, confirm: confirm2 } = opts;
+  const scanResult = await scanProject(root, mode);
+  if (json) {
+    log(JSON.stringify(scanResult, null, 2));
+  } else {
+    log("Haus scan complete");
+    log(`Roles: ${scanResult.repoRoles.join(", ") || "unknown"}`);
+    log(`Package manager: ${scanResult.packageManager}`);
   }
   const context = await readContextOrScan(root);
   const recommendation = await recommend(root, context);
@@ -2733,7 +2870,7 @@ async function runSetupProject(options) {
     { id: "haus.rule.context-minimal", enabled: true },
     { id: "haus.rule.security", enabled: true }
   ]);
-  if (options.json) {
+  if (json) {
     log(JSON.stringify(recommendation, null, 2));
   } else {
     log("Haus recommendation ready");
@@ -2744,6 +2881,7 @@ async function runSetupProject(options) {
   const warningLines = [.../* @__PURE__ */ new Set([...context.warnings, ...recommendation.warnings ?? []])];
   log(`Repo: ${context.repoName}`);
   for (const warning of warningLines) log(`- WARN: ${warning}`);
+  const hooksOk = hooks.ok;
   if (hooks.skipped) {
     log(`- HOOKS: (skipped) ${hooks.message}`);
   } else if (!hooks.ok) {
@@ -2752,17 +2890,29 @@ async function runSetupProject(options) {
   } else {
     log(`- HOOKS OK: ${hooks.message}`);
   }
-  if (options.json) return;
-  const approved = await confirm("Approve and write Claude files now?");
-  if (!approved) {
-    log("Setup reviewed. No files written.");
-    log("Next step: run `haus apply --write` when ready.");
-    return;
+  const baseResult = {
+    root,
+    repoName: context.repoName,
+    roles: scanResult.repoRoles,
+    recommendedCount: recommendation.recommended.length,
+    warnings: warningLines,
+    hooksOk,
+    written: []
+  };
+  if (!apply) return baseResult;
+  if (confirm2) {
+    const approved = await confirm2();
+    if (!approved) {
+      log("Setup reviewed. No files written.");
+      log("Next step: run `haus apply --write` when ready.");
+      return baseResult;
+    }
   }
-  const files = await writeClaudeFiles(root, false);
+  const files = await writeClaudeFiles(root, dryRun ?? false);
   log("Applied files:");
   files.forEach((f) => log(`- ${displayPath(root, f)}`));
   const hooksAfter = await verifyProjectSettingsHooksContract(root);
+  const hooksOkAfter = hooksAfter.ok;
   if (hooksAfter.skipped) {
     log(`- HOOKS: (skipped) ${hooksAfter.message}`);
   } else if (!hooksAfter.ok) {
@@ -2771,6 +2921,54 @@ async function runSetupProject(options) {
   } else {
     log(`- HOOKS OK: ${hooksAfter.message}`);
   }
+  return { ...baseResult, hooksOk: hooksOkAfter, written: files };
+}
+
+// src/commands/setup-project.ts
+var GUIDED_QUESTIONS = [
+  "What is this project for?",
+  "Is it for a client, internal Haus work, or experimentation?",
+  "What should Claude help with most?",
+  "Is this project connected to other repositories?",
+  "Are there parts of the project Claude should avoid touching?",
+  "Are there client-specific rules or sensitive areas?",
+  "Do you want a minimal, standard, or strict setup?"
+];
+async function runSetupProject(options) {
+  const root = process.cwd();
+  let mode = options.guided ? "guided" : "fast";
+  if (!options.guided && !options.fast && !options.json) {
+    log("How do you want to set this project up?");
+    log("1. Guided setup - I'll ask a few simple questions, then scan the project.");
+    log("2. Fast setup - I'll only scan the project and recommend defaults.");
+    const choice = await ask("Choose 1 or 2");
+    mode = choice === "1" ? "guided" : "fast";
+  }
+  if (mode === "guided") {
+    const existing = await readJson(hausPath(root, "setup-answers.json")) ?? {};
+    const merged = {};
+    for (const question of GUIDED_QUESTIONS) {
+      if (options.json) {
+        merged[question] = existing[question] ?? "pending-user-answer";
+        continue;
+      }
+      const prefilled = existing[question];
+      if (prefilled && prefilled !== "pending-user-answer" && prefilled !== "no-answer") {
+        merged[question] = prefilled;
+        continue;
+      }
+      const answer = await ask(question);
+      merged[question] = answer || prefilled || "no-answer";
+    }
+    await writeJson(hausPath(root, "setup-answers.json"), merged);
+  }
+  await runSetupCore(root, {
+    mode,
+    json: options.json,
+    apply: !options.json,
+    dryRun: false,
+    confirm: () => confirm("Approve and write Claude files now?")
+  });
 }
 
 // src/commands/init.ts
@@ -3340,9 +3538,9 @@ async function runUninstall(options = {}) {
   await writeSettings(stripped);
   result.hooksStripped = true;
   const hausDir = path23.join(globalClaudeDir(), "haus");
-  const manifestPath = hausManifestPath();
-  if (fs16.pathExistsSync(manifestPath)) {
-    await fs16.remove(manifestPath);
+  const manifestPath2 = hausManifestPath();
+  if (fs16.pathExistsSync(manifestPath2)) {
+    await fs16.remove(manifestPath2);
   }
   if (fs16.pathExistsSync(hausDir)) {
     const remaining = await fs16.readdir(hausDir);
@@ -3525,187 +3723,6 @@ async function runUpdate(options) {
 // src/commands/validate-catalog.ts
 import fs17 from "fs";
 import path26 from "path";
-
-// library/catalog/validation-rules.json
-var validation_rules_default = {
-  forbiddenTags: [
-    "python",
-    "django",
-    "go",
-    "rust",
-    "java",
-    "spring",
-    "kotlin",
-    "swift",
-    "android",
-    "flutter",
-    "dart",
-    "c++",
-    "perl",
-    "defi",
-    "trading"
-  ],
-  bannedAgentPhrases: ["autonomous", "swarm", "delegate", "orchestrat", "marketplace"],
-  requiredSkillSections: ["## Use when", "## Do not use when"],
-  requiredAgentSections: ["## Use when", "## Do not use when", "## Verification"],
-  riskyInstallPatterns: [
-    { source: "\\bnpx\\s+-y\\b", flags: "i" },
-    { source: "\\bnpx\\s+--yes\\b", flags: "i" },
-    { source: "\\byarn\\s+dlx\\b", flags: "i" },
-    { source: "\\bpnpm\\s+dlx\\b", flags: "i" }
-  ],
-  allowedNpxPattern: { source: "\\bnpx\\s+tsx\\b", flags: "i" },
-  anyNpxPattern: { source: "\\bnpx\\s+\\S+", flags: "i" },
-  httpUrlPattern: { source: "^http:\\/\\/", flags: "i" },
-  placeholderPattern: { source: "\\bTODO\\b|\\bPLACEHOLDER\\b", flags: "i" },
-  allowedStacks: [
-    "haus",
-    "security",
-    "quality",
-    "frontend",
-    "backend",
-    "testing",
-    "review",
-    "workflow",
-    "reference-pack",
-    "core-skill",
-    "workflow-skill",
-    "stack-skill",
-    "review-skill",
-    "agent",
-    "hook",
-    "rule",
-    "react",
-    "typescript",
-    "php",
-    "csharp",
-    "vendure",
-    "vendure3",
-    "nestjs",
-    "graphql",
-    "nx21",
-    "turbo",
-    "nextjs",
-    "react19",
-    "typescript5",
-    "vite8",
-    "tanstack-query",
-    "tanstack-router",
-    "radix",
-    "radix-ui",
-    "shadcn",
-    "shadcn-ui",
-    "tailwind",
-    "tailwindcss",
-    "scss",
-    "scss-modules",
-    "vue",
-    "expressjs",
-    "soup-base",
-    "laravel",
-    "laravel-nova",
-    "wordpress",
-    "bedrock",
-    "elementor-pro",
-    "acf-pro",
-    "jetengine",
-    "dotnet",
-    "oidc",
-    "azure-ad",
-    "bankid",
-    "myid",
-    "cgi",
-    "crypto",
-    "collection2",
-    "postgresql",
-    "mariadb",
-    "mssql",
-    "elasticsearch",
-    "yarn4",
-    "pnpm89",
-    "playwright",
-    "testing-library",
-    "phpunit",
-    "storybook",
-    "wisest",
-    "vitest",
-    "jest",
-    "redis",
-    "sanity",
-    "strapi",
-    "prisma",
-    "cms",
-    "database",
-    "mysql",
-    "saml2",
-    "next-auth",
-    "auth",
-    "expo",
-    "react-native",
-    "mobile",
-    "i18next",
-    "i18n",
-    "bullmq",
-    "queue",
-    "sentry",
-    "observability",
-    "tooling",
-    "prettier",
-    "eslint",
-    "missing-prettier",
-    "missing-eslint",
-    "docker",
-    "pm2",
-    "deployer-php",
-    "stripe",
-    "qliro",
-    "supabase",
-    "payments"
-  ],
-  alwaysAllowedTags: [
-    "haus",
-    "security",
-    "quality",
-    "review",
-    "workflow",
-    "baseline",
-    "project-instructions"
-  ],
-  patternTagSuffixes: ["-patterns"]
-};
-
-// src/catalog/validation-rules.ts
-var toRegExp = (r) => new RegExp(r.source, r.flags);
-var FORBIDDEN_TAGS = validation_rules_default.forbiddenTags;
-var BANNED_AGENT_PHRASES = validation_rules_default.bannedAgentPhrases;
-var REQUIRED_SKILL_SECTIONS = validation_rules_default.requiredSkillSections;
-var REQUIRED_AGENT_SECTIONS = validation_rules_default.requiredAgentSections;
-var RISKY_INSTALL_PATTERNS = validation_rules_default.riskyInstallPatterns.map(toRegExp);
-var ALLOWED_NPX_PATTERN = toRegExp(validation_rules_default.allowedNpxPattern);
-var ANY_NPX_PATTERN = toRegExp(validation_rules_default.anyNpxPattern);
-var HTTP_URL_PATTERN = toRegExp(validation_rules_default.httpUrlPattern);
-var PLACEHOLDER_PATTERN = toRegExp(validation_rules_default.placeholderPattern);
-var ALLOWED_STACKS = validation_rules_default.allowedStacks;
-var ALWAYS_ALLOWED_TAGS = validation_rules_default.alwaysAllowedTags;
-var PATTERN_TAG_SUFFIXES = validation_rules_default.patternTagSuffixes;
-var ALLOWED_SET = new Set([...ALLOWED_STACKS, ...ALWAYS_ALLOWED_TAGS].map((t) => t.toLowerCase()));
-function isTagAllowed(tag) {
-  const lower = tag.toLowerCase();
-  if (ALLOWED_SET.has(lower)) return true;
-  return PATTERN_TAG_SUFFIXES.some((suffix) => lower.endsWith(suffix));
-}
-function auditDisallowedTags(items) {
-  const failures = [];
-  for (const item of items) {
-    if (!item.id) continue;
-    for (const tag of Array.isArray(item.tags) ? item.tags : []) {
-      if (!isTagAllowed(tag)) failures.push(`${item.id}: tag not in allowlist: "${tag}"`);
-    }
-  }
-  return failures;
-}
-
-// src/commands/validate-catalog.ts
 function auditForbiddenStacks(items) {
   const failures = [];
   for (const item of items) {
@@ -3840,13 +3857,13 @@ function walkMd(dir, fn) {
     else if (entry.name.endsWith(".md")) fn(full);
   }
 }
-async function runValidateCatalog(manifestPath) {
-  if (!manifestPath) {
+async function runValidateCatalog(manifestPath2) {
+  if (!manifestPath2) {
     error("Usage: haus validate-catalog <path/to/manifest.json>");
     process.exitCode = 1;
     return;
   }
-  const abs = path26.resolve(process.cwd(), manifestPath);
+  const abs = path26.resolve(process.cwd(), manifestPath2);
   const manifestDir = path26.dirname(abs);
   const data = await readJson(abs);
   if (!data?.items) {
@@ -3876,77 +3893,665 @@ async function runValidateCatalog(manifestPath) {
 }
 
 // src/commands/workspace.ts
+import { existsSync as existsSync4, statSync as statSync2 } from "fs";
+import path33 from "path";
+
+// src/commands/workspace/aggregate.ts
+async function writeWorkspaceArtifacts(workspaceRoot, repos, relationships = []) {
+  const summaries = repos.map((repo) => ({
+    name: repo.name,
+    path: repo.path,
+    roles: repo.context.repoRoles ?? [],
+    packageManager: repo.context.packageManager,
+    deps: repo.context.dependencies ?? []
+  }));
+  const ownership = {};
+  for (const repo of summaries) {
+    for (const dep2 of repo.deps) {
+      ownership[dep2] ??= [];
+      ownership[dep2].push(repo.name);
+    }
+  }
+  const roles = [...new Set(summaries.flatMap((r) => r.roles))].sort();
+  const crossRepoHints = [...new Set(repos.flatMap((r) => r.context.crossRepoHints ?? []))].sort();
+  const summaryPath = hausPath(workspaceRoot, "workspace-summary.json");
+  const ownershipPath = hausPath(workspaceRoot, "dependency-ownership-map.json");
+  const crossRepoPath = hausPath(workspaceRoot, "cross-repo-summary.md");
+  const contextMapPath = hausPath(workspaceRoot, "workspace-context-map.json");
+  await writeJson(summaryPath, {
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    repos: summaries
+  });
+  await writeJson(ownershipPath, ownership);
+  await writeText(
+    crossRepoPath,
+    `# Cross Repo Summary
+
+${summaries.map(
+      (repo) => `- ${repo.name} (${repo.path}) roles: ${repo.roles.join(", ") || "unknown"}; package manager: ${repo.packageManager}`
+    ).join("\n")}
+`
+  );
+  await writeJson(contextMapPath, {
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    roles,
+    crossRepoHints,
+    repos: summaries.map((r) => ({
+      name: r.name,
+      path: r.path,
+      roles: r.roles,
+      packageManager: r.packageManager
+    })),
+    relationships
+  });
+  return [summaryPath, ownershipPath, crossRepoPath, contextMapPath];
+}
+
+// src/commands/workspace/config.ts
 import path27 from "path";
 import YAML from "yaml";
-async function runWorkspace(action) {
-  if (action === "init") {
-    await writeText(
-      "haus.workspace.yaml",
-      `client: unknown
-repos:
-  - name: current
-    path: .
-    role: auto
-relationships: []
-`
+var WORKSPACE_FILE = "haus.workspace.yaml";
+function parseWorkspaceConfig(text) {
+  if (!text) return void 0;
+  let parsed;
+  try {
+    parsed = YAML.parse(text);
+  } catch {
+    return void 0;
+  }
+  if (!parsed || typeof parsed !== "object") return void 0;
+  const obj = parsed;
+  const repos = Array.isArray(obj.repos) ? obj.repos.filter(
+    (r) => typeof r === "object" && r !== null && typeof r.name === "string" && typeof r.path === "string"
+  ) : [];
+  return {
+    client: typeof obj.client === "string" ? obj.client : "unknown",
+    repos,
+    relationships: Array.isArray(obj.relationships) ? obj.relationships : []
+  };
+}
+async function readWorkspaceConfig(workspaceRoot) {
+  return parseWorkspaceConfig(await readText(path27.join(workspaceRoot, WORKSPACE_FILE)));
+}
+
+// src/commands/workspace/discover.ts
+import path28 from "path";
+import fg3 from "fast-glob";
+import YAML2 from "yaml";
+var DEFAULT_MAX_DEPTH = 3;
+var REPO_MARKERS = ["**/.git", "**/package.json", "**/composer.json"];
+var IGNORE = [
+  "**/node_modules/**",
+  "**/.git/**",
+  "**/vendor/**",
+  "**/dist/**",
+  "**/.haus-workflow/**"
+];
+function isDescendant(child, ancestor) {
+  if (ancestor === ".") return child !== ".";
+  return child === ancestor ? false : child.startsWith(`${ancestor}/`);
+}
+async function discoverRepos(workspaceRoot, maxDepth = DEFAULT_MAX_DEPTH) {
+  const matches = await fg3(REPO_MARKERS, {
+    cwd: workspaceRoot,
+    dot: true,
+    onlyFiles: false,
+    deep: maxDepth,
+    followSymbolicLinks: false,
+    ignore: IGNORE
+  });
+  const gitDirs = /* @__PURE__ */ new Set();
+  const manifestDirs = /* @__PURE__ */ new Set();
+  for (const match of matches) {
+    const base = path28.posix.basename(match);
+    const dir = path28.posix.dirname(match);
+    const owner = dir === "." ? "." : dir;
+    if (base === ".git") gitDirs.add(owner);
+    else manifestDirs.add(owner);
+  }
+  const repoRoots = [...gitDirs];
+  const manifestSorted = [...manifestDirs].sort(
+    (a, b) => a.split("/").length - b.split("/").length || a.localeCompare(b)
+  );
+  for (const dir of manifestSorted) {
+    if (gitDirs.has(dir)) continue;
+    if (repoRoots.some((root) => isDescendant(dir, root))) continue;
+    repoRoots.push(dir);
+  }
+  repoRoots.sort((a, b) => a.localeCompare(b));
+  return mapWithConcurrency(repoRoots, async (relDir) => {
+    const absDir = path28.resolve(workspaceRoot, relDir);
+    const pkg = await readJson(path28.join(absDir, "package.json"));
+    const name = typeof pkg?.name === "string" && pkg.name.length > 0 ? pkg.name : path28.basename(relDir === "." ? workspaceRoot : absDir);
+    let role = "auto";
+    try {
+      const scan = await scanProject(absDir, "fast");
+      if (scan.repoRoles[0]) role = scan.repoRoles[0];
+    } catch {
+    }
+    return { name, path: relDir === "." ? "." : relDir, role };
+  });
+}
+function mergeWorkspaceConfig(existing, discovered, opts = {}) {
+  const existingRepos = existing?.repos ?? [];
+  const byPath = new Map(existingRepos.map((r) => [r.path, r]));
+  for (const repo of discovered) {
+    if (!byPath.has(repo.path)) {
+      byPath.set(repo.path, { name: repo.name, path: repo.path, role: repo.role });
+    }
+  }
+  const ordered = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const repo of existingRepos) {
+    ordered.push(byPath.get(repo.path));
+    seen.add(repo.path);
+  }
+  for (const repo of discovered) {
+    if (seen.has(repo.path)) continue;
+    ordered.push(byPath.get(repo.path));
+    seen.add(repo.path);
+  }
+  return {
+    client: opts.client ?? existing?.client ?? "unknown",
+    repos: ordered,
+    relationships: existing?.relationships ?? []
+  };
+}
+function renderWorkspaceYaml(config2) {
+  return YAML2.stringify({
+    client: config2.client,
+    repos: config2.repos.map((r) => ({ name: r.name, path: r.path, role: r.role ?? "auto" })),
+    relationships: config2.relationships
+  });
+}
+async function runDiscover(workspaceRoot, opts = {}) {
+  const yamlPath = path28.join(workspaceRoot, "haus.workspace.yaml");
+  const existingText = await readText(yamlPath);
+  const existing = parseWorkspaceConfig(existingText);
+  if (existingText && !existing) {
+    error(
+      "Existing haus.workspace.yaml is malformed \u2014 fix or remove it before running discover (refusing to overwrite)."
     );
-    log("Workspace initialized.");
+    process.exitCode = 1;
     return;
   }
-  const configText = await readText("haus.workspace.yaml");
-  if (!configText) {
-    error("Missing haus.workspace.yaml. Run `haus workspace init` first.");
+  const discovered = await discoverRepos(workspaceRoot, opts.maxDepth ?? DEFAULT_MAX_DEPTH);
+  if (discovered.length === 0) {
+    error("No repos discovered under the workspace root.");
     process.exitCode = 1;
     return;
   }
-  const config2 = YAML.parse(configText);
-  const repos = config2.repos ?? [];
-  if (repos.length === 0) {
-    error("No repos configured in haus.workspace.yaml.");
-    process.exitCode = 1;
+  const merged = mergeWorkspaceConfig(existing, discovered, { client: opts.client });
+  const yamlText = renderWorkspaceYaml(merged);
+  if (opts.json) {
+    log(JSON.stringify({ discovered, config: merged }, null, 2));
+  }
+  if (opts.write) {
+    await writeText(yamlPath, yamlText);
+    log(`Wrote ${merged.repos.length} repo(s) to haus.workspace.yaml`);
     return;
   }
-  const summaries = [];
-  const ownership = {};
-  for (const repo of repos) {
-    const repoRoot = path27.resolve(process.cwd(), repo.path);
-    const result = await scanProject(repoRoot, "fast");
-    summaries.push({
+  if (!opts.json) {
+    log("Proposed haus.workspace.yaml (run with --write to persist):\n");
+    log(yamlText);
+  }
+}
+
+// src/commands/workspace/doctor.ts
+import { existsSync as existsSync2 } from "fs";
+import path30 from "path";
+
+// src/commands/workspace/manifest.ts
+import { readFileSync as readFileSync3 } from "fs";
+import path29 from "path";
+var MANIFEST_FILE = "workspace.manifest.json";
+function manifestPath(workspaceRoot) {
+  return hausPath(workspaceRoot, MANIFEST_FILE);
+}
+function hausVersion() {
+  try {
+    const pkg = JSON.parse(readFileSync3(path29.join(packageRoot(), "package.json"), "utf8"));
+    return pkg.version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+function buildManifest2(opts) {
+  const now = opts.now ?? (/* @__PURE__ */ new Date()).toISOString();
+  const version = opts.version ?? hausVersion();
+  return {
+    version: 1,
+    generatedAt: now,
+    hausVersion: version,
+    client: opts.client,
+    repos: opts.repos.map((repo) => ({
       name: repo.name,
       path: repo.path,
-      roles: result.repoRoles,
-      packageManager: result.packageManager,
-      deps: result.dependencies
+      role: repo.role,
+      lastSetupAt: repo.lastSetupAt !== void 0 ? repo.lastSetupAt : repo.status === "ok" ? now : null,
+      hausVersionAtSetup: repo.hausVersionAtSetup !== void 0 ? repo.hausVersionAtSetup : repo.status === "ok" ? version : null,
+      lockItemCount: repo.lockItemCount,
+      catalogRef: repo.catalogRef,
+      status: repo.status,
+      ...repo.error ? { error: repo.error } : {}
+    }))
+  };
+}
+async function readManifest2(workspaceRoot) {
+  return readJson(manifestPath(workspaceRoot));
+}
+async function writeWorkspaceManifest(workspaceRoot, manifest) {
+  const target = manifestPath(workspaceRoot);
+  await writeJson(target, manifest);
+  return target;
+}
+
+// src/commands/workspace/doctor.ts
+async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
+  const config2 = await readWorkspaceConfig(workspaceRoot);
+  const manifest = await readManifest2(workspaceRoot);
+  const currentVersion = hausVersion();
+  const drift = [];
+  const detail = [];
+  const ok = (text) => detail.push({ stream: "log", text });
+  const flag = (item) => {
+    drift.push(item);
+    detail.push({ stream: "warn", text: `- ${item.repo}: ${item.detail}` });
+  };
+  if (!config2) {
+    flag({
+      repo: "(workspace)",
+      kind: "no-config",
+      detail: "Missing or malformed haus.workspace.yaml \u2014 run `haus workspace discover --write` or `init`."
     });
-    for (const dep2 of result.dependencies) {
-      ownership[dep2] ??= [];
-      ownership[dep2].push(repo.name);
+    return emit({ workspaceRoot, manifest, drift, detail, json: opts.json });
+  }
+  if (!manifest) {
+    flag({
+      repo: "(workspace)",
+      kind: "no-manifest",
+      detail: "No workspace.manifest.json \u2014 run `haus workspace setup --write` first."
+    });
+    return emit({ workspaceRoot, manifest, drift, detail, json: opts.json });
+  }
+  const manifestByName = new Map(manifest.repos.map((r) => [r.name, r]));
+  for (const repo of config2.repos) {
+    const repoRoot = path30.resolve(workspaceRoot, repo.path);
+    const entry = manifestByName.get(repo.name);
+    if (!entry) {
+      flag({
+        repo: repo.name,
+        kind: "missing-from-manifest",
+        detail: "Configured in yaml but absent from the manifest \u2014 run `haus workspace setup --write`."
+      });
+      continue;
+    }
+    const driftBefore = drift.length;
+    if (entry.status === "failed") {
+      flag({
+        repo: repo.name,
+        kind: "failed",
+        detail: `Last setup failed${entry.error ? `: ${entry.error}` : ""}.`
+      });
+    }
+    if (entry.hausVersionAtSetup && entry.hausVersionAtSetup !== currentVersion) {
+      flag({
+        repo: repo.name,
+        kind: "version-mismatch",
+        detail: `Set up at haus ${entry.hausVersionAtSetup}, current is ${currentVersion} \u2014 re-run setup.`
+      });
+    }
+    if (!existsSync2(claudePath(repoRoot))) {
+      flag({
+        repo: repo.name,
+        kind: "missing-claude",
+        detail: "Missing .claude/ \u2014 run `haus workspace setup --write`."
+      });
+    }
+    const lock = await checkLock(repoRoot);
+    if (!existsSync2(hausPath(repoRoot, "haus.lock.json"))) {
+      flag({
+        repo: repo.name,
+        kind: "missing-lock",
+        detail: "Missing .haus-workflow/haus.lock.json \u2014 run `haus workspace setup --write`."
+      });
+    } else if (lock.count > 0 && !lock.ok) {
+      flag({
+        repo: repo.name,
+        kind: "invalid-lock",
+        detail: "haus.lock.json present but invalid \u2014 re-run `haus workspace setup --write`."
+      });
+    }
+    if (drift.length === driftBefore) {
+      ok(`- ${repo.name}: OK (${lock.count} lock item(s))`);
     }
   }
-  await writeJson(".haus-workflow/workspace-summary.json", {
-    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    repos: summaries
-  });
-  await writeJson(".haus-workflow/dependency-ownership-map.json", ownership);
-  await writeText(
-    ".haus-workflow/cross-repo-summary.md",
-    `# Cross Repo Summary
+  return emit({ workspaceRoot, manifest, drift, detail, json: opts.json });
+}
+function emit(args) {
+  const { workspaceRoot, manifest, drift, detail } = args;
+  if (args.json) {
+    log(JSON.stringify({ manifest: manifest ?? null, drift }, null, 2));
+  } else {
+    if (drift.length === 0) {
+      log("\u2705 Workspace is set up and healthy.");
+    } else {
+      log(`\u26A0\uFE0F ${drift.length} workspace drift item(s) need attention:`);
+    }
+    log("Haus Workspace Doctor");
+    for (const line2 of detail) {
+      if (line2.stream === "warn") warn(line2.text);
+      else log(line2.text);
+    }
+  }
+  if (drift.length > 0) process.exitCode = 1;
+  return { workspaceRoot, manifest, drift };
+}
 
-${summaries.map(
-      (repo) => `- ${repo.name} (${repo.path}) roles: ${repo.roles.join(", ") || "unknown"}; package manager: ${repo.packageManager}`
-    ).join("\n")}
+// src/commands/workspace/setup.ts
+import { existsSync as existsSync3, statSync } from "fs";
+import path32 from "path";
+
+// src/claude/write-workspace-claude-md.ts
+import path31 from "path";
+import fs18 from "fs-extra";
+function buildWorkspaceImportBlock(client, members) {
+  const memberLines = members.map((m) => `- ${m.name} (${m.path})`);
+  const body = [
+    "@.haus-workflow/cross-repo-summary.md",
+    "",
+    `# Workspace: ${client}`,
+    "",
+    "Member repos:",
+    ...memberLines
+  ].join("\n");
+  return `${BLOCK_BEGIN}
+${body}
+${BLOCK_END}`;
+}
+async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
+  const block = buildWorkspaceImportBlock(opts.client, opts.members);
+  const dryRun = opts.dryRun ?? false;
+  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path31.join(workspaceRoot, "CLAUDE.md");
+  const prev = await fs18.pathExists(filePath) ? await fs18.readFile(filePath, "utf8") : "";
+  const next = opts.collision ? `${block}
+` : injectHausBlock(prev, block);
+  const printable = displayPath(workspaceRoot, filePath);
+  if (dryRun) {
+    if (!prev) {
+      log(createUnifiedDiff(printable, "", next));
+    } else if (hasTextChanged(prev, next)) {
+      log(createUnifiedDiff(printable, prev, next));
+    } else {
+      log(`${printable}: unchanged`);
+    }
+    return filePath;
+  }
+  if (hasTextChanged(prev, next) && prev.length > 0) {
+    const diffText = createUnifiedDiff(printable, prev, next);
+    const summary = summarizeDiff(diffText);
+    log(`Overwriting ${printable} (diff +${summary.additions} -${summary.deletions})`);
+  }
+  await writeText(filePath, next);
+  return filePath;
+}
+
+// src/commands/workspace/setup.ts
+function resolveWorkspaceRoot(start = process.cwd()) {
+  let dir = path32.resolve(start);
+  for (; ; ) {
+    if (existsSync3(path32.join(dir, WORKSPACE_FILE))) return dir;
+    const parent = path32.dirname(dir);
+    if (parent === dir) return path32.resolve(start);
+    dir = parent;
+  }
+}
+function isRootRepo(workspaceRoot, repoPath) {
+  return path32.resolve(workspaceRoot, repoPath) === path32.resolve(workspaceRoot);
+}
+async function runWorkspaceSetup(workspaceRoot, options = {}) {
+  const mode = options.mode ?? "fast";
+  const apply = options.write ?? false;
+  const configText = await readText(path32.join(workspaceRoot, WORKSPACE_FILE));
+  if (!configText) {
+    error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
+    process.exitCode = 1;
+    return { workspaceRoot, statuses: [], written: [] };
+  }
+  const config2 = parseWorkspaceConfig(configText);
+  if (!config2 || config2.repos.length === 0) {
+    error(`No repos configured in ${WORKSPACE_FILE}.`);
+    process.exitCode = 1;
+    return { workspaceRoot, statuses: [], written: [] };
+  }
+  const onlySet = options.only && options.only.length > 0 ? new Set(options.only) : void 0;
+  const repos = onlySet ? config2.repos.filter((r) => onlySet.has(r.name)) : config2.repos;
+  const statuses = [];
+  const aggregateInputs = [];
+  for (const repo of repos) {
+    const repoRoot = path32.resolve(workspaceRoot, repo.path);
+    log(`
+\u2192 ${repo.name} (${repo.path})`);
+    try {
+      if (!existsSync3(repoRoot) || !statSync(repoRoot).isDirectory()) {
+        throw new Error(`Repo path is not a directory: ${repo.path}`);
+      }
+      const res = await runSetupCore(repoRoot, {
+        mode,
+        json: options.json,
+        apply,
+        dryRun: options.dryRun
+      });
+      statuses.push({
+        name: repo.name,
+        path: repo.path,
+        root: repoRoot,
+        status: "ok",
+        roles: res.roles,
+        recommendedCount: res.recommendedCount
+      });
+      const context = await readContextOrScan(repoRoot);
+      aggregateInputs.push({ name: repo.name, path: repo.path, context });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      statuses.push({
+        name: repo.name,
+        path: repo.path,
+        root: repoRoot,
+        status: "failed",
+        error: message
+      });
+      if (!options.continueOnError) throw err;
+      error(`Setup failed for ${repo.name}: ${message}`);
+    }
+  }
+  const written = [];
+  if (apply && aggregateInputs.length > 0) {
+    const collision = config2.repos.some((r) => isRootRepo(workspaceRoot, r.path));
+    if (!options.dryRun) {
+      const artifacts = await writeWorkspaceArtifacts(
+        workspaceRoot,
+        aggregateInputs,
+        config2.relationships
+      );
+      written.push(...artifacts);
+    }
+    const docPath = await writeWorkspaceClaudeMd(workspaceRoot, {
+      client: config2.client,
+      members: config2.repos.map((r) => ({ name: r.name, path: r.path })),
+      collision,
+      dryRun: options.dryRun
+    });
+    written.push(docPath);
+  }
+  if (apply && !options.dryRun) {
+    const statusByName = new Map(statuses.map((s) => [s.name, s]));
+    const prior = await readManifest2(workspaceRoot);
+    if (!prior && existsSync3(manifestPath(workspaceRoot))) {
+      warn(
+        "Existing workspace.manifest.json is unreadable \u2014 prior per-repo state will not be carried forward."
+      );
+    }
+    const priorByName = new Map((prior?.repos ?? []).map((r) => [r.name, r]));
+    const manifestRepos = [];
+    for (const repo of config2.repos) {
+      const status = statusByName.get(repo.name);
+      const role = repo.role ?? status?.roles?.[0] ?? "auto";
+      if (status?.status === "ok") {
+        const lock = await checkLock(path32.resolve(workspaceRoot, repo.path));
+        manifestRepos.push({
+          name: repo.name,
+          path: repo.path,
+          role,
+          status: "ok",
+          lockItemCount: lock.count,
+          catalogRef: lock.catalogRef
+        });
+      } else if (status?.status === "failed") {
+        manifestRepos.push({
+          name: repo.name,
+          path: repo.path,
+          role,
+          status: "failed",
+          lockItemCount: 0,
+          catalogRef: null,
+          error: status.error
+        });
+      } else {
+        const carried = priorByName.get(repo.name);
+        manifestRepos.push(
+          carried ? {
+            name: carried.name,
+            path: carried.path,
+            role: carried.role,
+            status: carried.status,
+            lockItemCount: carried.lockItemCount,
+            catalogRef: carried.catalogRef,
+            lastSetupAt: carried.lastSetupAt,
+            hausVersionAtSetup: carried.hausVersionAtSetup,
+            ...carried.error ? { error: carried.error } : {}
+          } : {
+            name: repo.name,
+            path: repo.path,
+            role,
+            status: "pending",
+            lockItemCount: 0,
+            catalogRef: null
+          }
+        );
+      }
+    }
+    const manifest = buildManifest2({ client: config2.client, repos: manifestRepos });
+    const manifestFile = await writeWorkspaceManifest(workspaceRoot, manifest);
+    written.push(manifestFile);
+  }
+  const ok = statuses.filter((s) => s.status === "ok").length;
+  const failed = statuses.length - ok;
+  log(`
+Workspace setup complete: ${ok} ok, ${failed} failed.`);
+  return { workspaceRoot, statuses, written };
+}
+
+// src/commands/workspace.ts
+function normalizeOnly(only) {
+  if (!only) return void 0;
+  const list = Array.isArray(only) ? only : only.split(/[\s,]+/);
+  const cleaned = list.map((s) => s.trim()).filter(Boolean);
+  return cleaned.length > 0 ? cleaned : void 0;
+}
+function normalizeMaxDepth(maxDepth) {
+  if (maxDepth === void 0) return void 0;
+  const n = typeof maxDepth === "number" ? maxDepth : Number.parseInt(maxDepth, 10);
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : void 0;
+}
+async function initWorkspace() {
+  await writeText(
+    WORKSPACE_FILE,
+    `client: unknown
+repos:
+  - name: current
+    path: .
+    role: auto
+relationships: []
 `
   );
-  log(
-    "Workspace scan complete. Wrote .haus-workflow/workspace-summary.json, cross-repo-summary.md, dependency-ownership-map.json"
-  );
+  log("Workspace initialized.");
+}
+async function scanWorkspace(workspaceRoot, opts) {
+  const configText = await readText(path33.join(workspaceRoot, WORKSPACE_FILE));
+  if (!configText) {
+    error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
+    process.exitCode = 1;
+    return;
+  }
+  const config2 = parseWorkspaceConfig(configText);
+  if (!config2) {
+    error(
+      `Malformed ${WORKSPACE_FILE}. Fix the YAML or re-run \`haus workspace discover --write\`.`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (config2.repos.length === 0) {
+    error(`No repos configured in ${WORKSPACE_FILE}.`);
+    process.exitCode = 1;
+    return;
+  }
+  const inputs = [];
+  for (const repo of config2.repos) {
+    const repoRoot = path33.resolve(workspaceRoot, repo.path);
+    if (!existsSync4(repoRoot) || !statSync2(repoRoot).isDirectory()) {
+      throw new Error(`Repo path is not a directory: ${repo.path}`);
+    }
+    const result = await scanProject(repoRoot, "fast");
+    inputs.push({ name: repo.name, path: repo.path, context: result });
+  }
+  const written = await writeWorkspaceArtifacts(workspaceRoot, inputs, config2.relationships);
+  if (opts.json) {
+    log(JSON.stringify({ written }, null, 2));
+  } else {
+    log(`Workspace scan complete. Wrote ${written.length} artifact(s) under .haus-workflow/.`);
+  }
+}
+async function runWorkspace(action, options = {}) {
+  if (action === "init") {
+    await initWorkspace();
+    return;
+  }
+  const workspaceRoot = resolveWorkspaceRoot();
+  switch (action) {
+    case "discover":
+      await runDiscover(workspaceRoot, {
+        write: options.write,
+        json: options.json,
+        maxDepth: normalizeMaxDepth(options.maxDepth),
+        client: options.client
+      });
+      return;
+    case "scan":
+      await scanWorkspace(workspaceRoot, { json: options.json });
+      return;
+    case "setup":
+      await runWorkspaceSetup(workspaceRoot, {
+        mode: options.guided ? "guided" : "fast",
+        write: options.write,
+        dryRun: options.dryRun,
+        json: options.json,
+        continueOnError: options.continueOnError,
+        only: normalizeOnly(options.only)
+      });
+      return;
+    case "doctor":
+      await runWorkspaceDoctor(workspaceRoot, { json: options.json });
+      return;
+  }
 }
 
 // src/cli.ts
 function cliVersion() {
   try {
-    const pkgPath = path28.join(packageRoot(), "package.json");
-    const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
+    const pkgPath = path34.join(packageRoot(), "package.json");
+    const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -3955,8 +4560,8 @@ function cliVersion() {
 var program = new Command();
 function validateRuntimeNodeVersion() {
   try {
-    const pkgPath = path28.join(packageRoot(), "package.json");
-    const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
+    const pkgPath = path34.join(packageRoot(), "package.json");
+    const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
     const requiredRange = pkg.engines?.node;
     if (requiredRange && !satisfiesVersion(process.version, requiredRange)) {
       throw new Error(`Node ${process.version} does not satisfy required range ${requiredRange}`);
@@ -3999,7 +4604,10 @@ config.command("disable <key>").description("Disable a hook (hook.context)").act
 config.command("status <key>").description("Show current state of a hook (hook.context)").action((key) => runConfig(key, "status"));
 var workspace = program.command("workspace");
 workspace.command("init").action(() => runWorkspace("init"));
-workspace.command("scan").action(() => runWorkspace("scan"));
+workspace.command("discover").description("Auto-find member repos and write/merge haus.workspace.yaml").option("--write", "Persist haus.workspace.yaml (default previews only)").option("--json", "Output the discovered repos and proposed config as JSON").option("--max-depth <n>", "Max directory depth to traverse (default 3)").option("--client <name>", "Set the workspace client name").action((opts) => runWorkspace("discover", opts));
+workspace.command("scan").description("Aggregate a cross-repo summary from a fast scan of each repo").option("--json", "Output the written artifact paths as JSON").action((opts) => runWorkspace("scan", opts));
+workspace.command("setup").description("Per-repo setup loop + workspace layer + manifest").option("--write", "Apply changes (default previews only)").option("--dry-run", "Preview changes without writing").option("--json", "Emit machine-readable per-repo output").option("--fast", "Skip interactive prompts (default)").option("--guided", "Enable guided Q&A per repo").option("--continue-on-error", "Keep going past a failed repo (default fail-fast)").option("--only <names>", "Restrict to comma-separated repo names").action((opts) => runWorkspace("setup", opts));
+workspace.command("doctor").description("Report workspace drift against the manifest").option("--json", "Output the manifest and drift array as JSON").action((opts) => runWorkspace("doctor", opts));
 program.parseAsync(process.argv).catch((err) => {
   const message = err instanceof Error ? err.message : String(err);
   error(message);