@haus-tech/haus-workflow 0.13.2 → 0.15.0

package/dist/cli.js

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { readFileSync as readFileSync3 } from "fs";
-import path28 from "path";
+import { readFileSync as readFileSync4 } from "fs";
+import path34 from "path";
 import { Command } from "commander";
 
 // src/commands/apply.ts
-import path10 from "path";
+import path12 from "path";
 import checkbox from "@inquirer/checkbox";
+import fs11 from "fs-extra";
 
 // src/catalog/remote-catalog.ts
 import os from "os";
@@ -102,13 +103,20 @@ async function syncRemoteCatalog() {
     warn("Remote catalog fetch failed \u2014 using bundled catalog");
     return { newItems: [], unchanged: 0, failed: [] };
   }
-  await fs.ensureDir(CACHE_DIR);
-  await fs.writeFile(
-    path.join(CACHE_DIR, "manifest.json"),
-    `${JSON.stringify({ items }, null, 2)}
+  try {
+    await fs.ensureDir(CACHE_DIR);
+    await fs.writeFile(
+      path.join(CACHE_DIR, "manifest.json"),
+      `${JSON.stringify({ items }, null, 2)}
 `,
-    "utf8"
-  );
+      "utf8"
+    );
+  } catch (err) {
+    warn(
+      `Catalog cache not writable (${CACHE_DIR}) \u2014 skipping cache sync: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return { newItems: [], unchanged: 0, failed: [] };
+  }
   const newItems = [];
   let unchanged = 0;
   const failed = [];
@@ -140,10 +148,15 @@ async function syncRemoteCatalog() {
         failed.push(item.id);
         continue;
       }
-      await fs.ensureDir(path.dirname(dest));
-      await fs.writeFile(dest, text, "utf8");
-      await downloadSkillReferences(item, destDir);
-      newItems.push(item.id);
+      try {
+        await fs.ensureDir(path.dirname(dest));
+        await fs.writeFile(dest, text, "utf8");
+        await downloadSkillReferences(item, destDir);
+        newItems.push(item.id);
+      } catch (err) {
+        warn(`Failed to cache ${item.id}: ${err instanceof Error ? err.message : String(err)}`);
+        failed.push(item.id);
+      }
     } else {
       const dest = safeJoin(CACHE_DIR, item.path);
       if (!dest) {
@@ -162,9 +175,14 @@ async function syncRemoteCatalog() {
         failed.push(item.id);
         continue;
       }
-      await fs.ensureDir(path.dirname(dest));
-      await fs.writeFile(dest, text, "utf8");
-      newItems.push(item.id);
+      try {
+        await fs.ensureDir(path.dirname(dest));
+        await fs.writeFile(dest, text, "utf8");
+        newItems.push(item.id);
+      } catch (err) {
+        warn(`Failed to cache ${item.id}: ${err instanceof Error ? err.message : String(err)}`);
+        failed.push(item.id);
+      }
     }
   }
   return { newItems, unchanged, failed };
@@ -193,13 +211,21 @@ async function getCacheManifestAge() {
   }
 }
 
-// src/claude/write-claude-files.ts
-import path9 from "path";
-import fs9 from "fs-extra";
+// src/install/allow-rules.ts
+var ALLOWED_SUBCOMMANDS = [
+  "setup-project",
+  "apply",
+  "doctor",
+  "scan",
+  "context",
+  "recommend"
+];
+function buildAllowRules() {
+  return [...new Set(ALLOWED_SUBCOMMANDS.map((sub) => `Bash(haus ${sub}:*)`))];
+}
 
-// src/update/hash-installed.ts
-import path3 from "path";
-import fg2 from "fast-glob";
+// src/install/settings-merge.ts
+import path4 from "path";
 import fs3 from "fs-extra";
 
 // src/utils/fs.ts
@@ -253,155 +279,218 @@ async function mapWithConcurrency(items, fn, concurrency = 24) {
   return results;
 }
 
-// src/update/hash-installed.ts
-var EMPTY_LOCK_PATHS_TOKEN = "haus-lock:empty-paths";
-async function hashInstalledPaths(root, relPaths) {
-  if (relPaths.length === 0) {
-    return hashText(EMPTY_LOCK_PATHS_TOKEN);
-  }
-  const normalized = [...new Set(relPaths.map((p) => p.replace(/\\/g, "/")))].sort();
-  const fileDigests = [];
-  for (const rel of normalized) {
-    const abs = path3.join(root, rel);
-    if (!await fs3.pathExists(abs)) continue;
-    const stat = await fs3.stat(abs);
-    if (stat.isFile()) {
-      const body = await fs3.readFile(abs, "utf8");
-      fileDigests.push({ rel, digest: hashText(body) });
-      continue;
-    }
-    if (!stat.isDirectory()) continue;
-    const inner = await fg2("**/*", { cwd: abs, onlyFiles: true, dot: true });
-    for (const sub of inner.sort()) {
-      const relFile = path3.join(rel, sub).replace(/\\/g, "/");
-      const absFile = path3.join(abs, sub);
-      const body = await fs3.readFile(absFile, "utf8");
-      fileDigests.push({ rel: relFile, digest: hashText(body) });
-    }
-  }
-  if (fileDigests.length === 0) {
-    return hashText(`${EMPTY_LOCK_PATHS_TOKEN}|${normalized.join("|")}`);
-  }
-  fileDigests.sort((a, b) => a.rel.localeCompare(b.rel));
-  return hashText(fileDigests.map((f) => `${f.rel}=${f.digest}`).join("|"));
+// src/install/manifest.ts
+import os2 from "os";
+import path3 from "path";
+var MANIFEST_SCHEMA = "haus-install-manifest/1";
+function globalClaudeDir() {
+  return path3.join(os2.homedir(), ".claude");
 }
-
-// src/utils/diff.ts
-import { createTwoFilesPatch } from "diff";
-function hasTextChanged(before, after) {
-  return before !== after;
+function hausManifestPath() {
+  return path3.join(globalClaudeDir(), "haus", "install-manifest.json");
 }
-function createUnifiedDiff(filePath, before, after) {
-  return createTwoFilesPatch(filePath, filePath, before, after, "before", "after", {
-    context: 3
-  });
+async function readManifest() {
+  return readJson(hausManifestPath());
 }
-function summarizeDiff(diffText) {
-  const lines = diffText.split("\n");
-  let additions = 0;
-  let deletions = 0;
-  for (const line2 of lines) {
-    if (line2.startsWith("+++ ") || line2.startsWith("--- ")) continue;
-    if (line2.startsWith("+")) additions += 1;
-    if (line2.startsWith("-")) deletions += 1;
-  }
-  return { additions, deletions };
+async function writeManifest(manifest) {
+  await writeJson(hausManifestPath(), manifest);
+}
+function buildManifest(source, files, hooks) {
+  return {
+    _schema: MANIFEST_SCHEMA,
+    source,
+    installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    files,
+    hooks
+  };
 }
 
-// src/utils/paths.ts
-import { existsSync, readFileSync } from "fs";
-import os2 from "os";
-import path4 from "path";
-import { fileURLToPath } from "url";
-var HAUS_DIR = ".haus-workflow";
-function hausPath(root, ...parts) {
-  return path4.join(root, HAUS_DIR, ...parts);
+// src/install/settings-merge.ts
+function settingsJsonPath() {
+  return path4.join(globalClaudeDir(), "settings.json");
 }
-function claudePath(root, ...parts) {
-  return path4.join(root, ".claude", ...parts);
+async function readSettings() {
+  const parsed = await readJson(settingsJsonPath());
+  return parsed ?? {};
 }
-function displayPath(root, targetPath) {
-  const rel = path4.relative(root, targetPath).replace(/\\/g, "/");
-  if (rel && !rel.startsWith("../") && rel !== "..") {
-    return rel.startsWith("./") ? rel : `./${rel}`;
-  }
-  const home = os2.homedir();
-  const normalized = targetPath.replace(/\\/g, "/");
-  if (home && home.trim().length > 0) {
-    const homeRel = path4.relative(home, targetPath).replace(/\\/g, "/");
-    if (homeRel && !homeRel.startsWith("../") && homeRel !== "..") {
-      return `~/${homeRel}`;
-    }
+async function writeSettings(settings) {
+  await writeJson(settingsJsonPath(), settings);
+}
+function mergeHooks(settings, fragments) {
+  const existing = settings._haus?.hooks ?? [];
+  const existingCommands = settings._haus?.hookCommands ?? [];
+  const existingSet = new Set(existing);
+  const updated = { ...settings };
+  updated.hooks = { ...settings.hooks ?? {} };
+  const addedIds = [];
+  const addedCommands = [];
+  for (const fragment of fragments) {
+    if (fragment.gate !== "keep") continue;
+    if (existingSet.has(fragment.id)) continue;
+    const event = fragment.event;
+    if (!updated.hooks[event]) updated.hooks[event] = [];
+    const entry = {
+      hooks: [{ type: "command", command: fragment.command }]
+    };
+    if (fragment.matcher) entry.matcher = fragment.matcher;
+    updated.hooks[event] = [...updated.hooks[event] ?? [], entry];
+    addedIds.push(fragment.id);
+    addedCommands.push(fragment.command);
   }
-  return normalized;
+  updated._haus = {
+    hooks: [...existing, ...addedIds],
+    hookCommands: [...existingCommands, ...addedCommands],
+    // Preserve deny/allow tracking so hook, deny, and allow merges are order-independent.
+    ...settings._haus?.denyRules ? { denyRules: settings._haus.denyRules } : {},
+    ...settings._haus?.allowRules ? { allowRules: settings._haus.allowRules } : {}
+  };
+  return { settings: updated, addedIds };
 }
-function packageRoot() {
-  let dir = path4.dirname(fileURLToPath(import.meta.url));
-  for (let i = 0; i < 12; i++) {
-    const pkgPath = path4.join(dir, "package.json");
-    if (existsSync(pkgPath)) {
-      try {
-        const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
-        if (pkg.name === "haus" || pkg.name === "@haus-tech/haus-workflow") return dir;
-      } catch {
-      }
-    }
-    const parent = path4.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
+function mergeDenyRules(settings, rules) {
+  const existingDeny = settings.permissions?.deny ?? [];
+  const seen = new Set(existingDeny);
+  const trackedDeny = settings._haus?.denyRules ?? [];
+  const addedRules = [];
+  for (const rule of rules) {
+    if (seen.has(rule)) continue;
+    seen.add(rule);
+    addedRules.push(rule);
   }
-  const file = fileURLToPath(import.meta.url);
-  return path4.resolve(path4.dirname(file), "../..");
+  const updated = { ...settings };
+  updated.permissions = {
+    ...settings.permissions ?? {},
+    deny: [...existingDeny, ...addedRules]
+  };
+  updated._haus = {
+    hooks: settings._haus?.hooks ?? [],
+    ...settings._haus?.hookCommands ? { hookCommands: settings._haus.hookCommands } : {},
+    denyRules: [...trackedDeny, ...addedRules],
+    ...settings._haus?.allowRules ? { allowRules: settings._haus.allowRules } : {}
+  };
+  return { settings: updated, addedRules };
 }
-
-// src/claude/load-hooks-config.ts
-import path5 from "path";
-var CONFIG_PATH = ".haus-workflow/config.json";
-var DEFAULT_HOOKS_CONFIG = {
-  hooks: {
-    context: { enabled: false }
+function mergeAllowRules(settings, rules) {
+  const existingAllow = settings.permissions?.allow ?? [];
+  const seen = new Set(existingAllow);
+  const trackedAllow = settings._haus?.allowRules ?? [];
+  const addedRules = [];
+  for (const rule of rules) {
+    if (seen.has(rule)) continue;
+    seen.add(rule);
+    addedRules.push(rule);
   }
-};
-async function isHookEnabled(root, key) {
-  const cfg = await readJson(path5.join(root, CONFIG_PATH));
-  return cfg?.hooks?.[key]?.enabled === true;
+  const updated = { ...settings };
+  updated.permissions = {
+    ...settings.permissions ?? {},
+    allow: [...existingAllow, ...addedRules]
+  };
+  updated._haus = {
+    hooks: settings._haus?.hooks ?? [],
+    ...settings._haus?.hookCommands ? { hookCommands: settings._haus.hookCommands } : {},
+    ...settings._haus?.denyRules ? { denyRules: settings._haus.denyRules } : {},
+    allowRules: [...trackedAllow, ...addedRules]
+  };
+  return { settings: updated, addedRules };
 }
-
-// src/security/dangerous-commands.ts
-var DANGEROUS_COMMANDS = [
-  "rm -rf",
-  "sudo",
-  "chmod -R 777",
-  "chown -R",
-  "git push --force",
-  "git reset --hard",
-  "docker system prune",
-  "drop database",
-  "truncate table",
-  "php artisan migrate --force",
-  "npm publish",
-  "yarn npm publish",
-  "pnpm publish"
-];
-
-// src/security/sensitive-paths.ts
-var SENSITIVE_PATHS = [
-  ".env",
-  ".env.*",
-  "*.pem",
-  "*.key",
-  "*.p12",
-  "*.pfx",
-  "id_rsa",
-  "id_ed25519",
-  "*.sql",
-  "*.dump",
-  "*.backup",
-  "*.bak",
-  "storage/logs",
-  "wp-content/uploads",
-  "uploads",
-  "customer-data",
+function stripHausAllow(settings) {
+  const prevHaus = settings._haus;
+  if (!prevHaus?.allowRules || prevHaus.allowRules.length === 0) return settings;
+  const ownedSet = new Set(prevHaus.allowRules);
+  const updated = { ...settings };
+  const remainingAllow = (settings.permissions?.allow ?? []).filter((rule) => !ownedSet.has(rule));
+  const permissions = { ...settings.permissions ?? {} };
+  if (remainingAllow.length > 0) permissions.allow = remainingAllow;
+  else delete permissions.allow;
+  if (Object.keys(permissions).length > 0) updated.permissions = permissions;
+  else delete updated.permissions;
+  const haus = { ...prevHaus };
+  delete haus.allowRules;
+  const stillTracking = (haus.hooks?.length ?? 0) > 0 || (haus.hookCommands?.length ?? 0) > 0 || (haus.denyRules?.length ?? 0) > 0;
+  if (stillTracking) updated._haus = haus;
+  else delete updated._haus;
+  return updated;
+}
+function stripHausDeny(settings) {
+  const prevHaus = settings._haus;
+  if (!prevHaus?.denyRules || prevHaus.denyRules.length === 0) return settings;
+  const ownedSet = new Set(prevHaus.denyRules);
+  const updated = { ...settings };
+  const remainingDeny = (settings.permissions?.deny ?? []).filter((rule) => !ownedSet.has(rule));
+  const permissions = { ...settings.permissions ?? {} };
+  if (remainingDeny.length > 0) permissions.deny = remainingDeny;
+  else delete permissions.deny;
+  if (Object.keys(permissions).length > 0) updated.permissions = permissions;
+  else delete updated.permissions;
+  const haus = { ...prevHaus };
+  delete haus.denyRules;
+  const stillTracking = (haus.hooks?.length ?? 0) > 0 || (haus.hookCommands?.length ?? 0) > 0 || (haus.allowRules?.length ?? 0) > 0;
+  if (stillTracking) updated._haus = haus;
+  else delete updated._haus;
+  return updated;
+}
+function stripHausHooks(settings) {
+  if (!settings._haus) return settings;
+  const ownedCommands = new Set(settings._haus.hookCommands ?? []);
+  const usePrefix = ownedCommands.size === 0;
+  const updated = { ...settings };
+  updated.hooks = {};
+  for (const [event, entries] of Object.entries(settings.hooks ?? {})) {
+    const kept = entries.filter((entry) => {
+      const cmd = entry.hooks[0]?.command ?? "";
+      return usePrefix ? !cmd.startsWith("haus ") : !ownedCommands.has(cmd);
+    });
+    if (kept.length > 0) updated.hooks[event] = kept;
+  }
+  const { _haus: _, ...rest } = updated;
+  void _;
+  return rest;
+}
+async function loadHooksFragment(fragmentPath) {
+  let raw;
+  try {
+    raw = await fs3.readJson(fragmentPath);
+  } catch {
+    return [];
+  }
+  const data = raw;
+  return Array.isArray(data?.hooks) ? data.hooks : [];
+}
+
+// src/security/dangerous-commands.ts
+var DANGEROUS_COMMANDS = [
+  "rm -rf",
+  "sudo",
+  "chmod -R 777",
+  "chown -R",
+  "git push --force",
+  "git reset --hard",
+  "docker system prune",
+  "drop database",
+  "truncate table",
+  "php artisan migrate --force",
+  "npm publish",
+  "yarn npm publish",
+  "pnpm publish"
+];
+
+// src/security/sensitive-paths.ts
+var SENSITIVE_PATHS = [
+  ".env",
+  ".env.*",
+  "*.pem",
+  "*.key",
+  "*.p12",
+  "*.pfx",
+  "id_rsa",
+  "id_ed25519",
+  "*.sql",
+  "*.dump",
+  "*.backup",
+  "*.bak",
+  "storage/logs",
+  "wp-content/uploads",
+  "uploads",
+  "customer-data",
   "exports",
   "secrets",
   "certs"
@@ -449,8 +538,8 @@ function buildDenyRules() {
   for (const command of DANGEROUS_COMMANDS) {
     rules.push(`Bash(${command}:*)`);
   }
-  for (const path29 of SENSITIVE_PATHS) {
-    const pattern = SENSITIVE_DIRS.has(path29) ? `${path29}/**` : path29;
+  for (const path35 of SENSITIVE_PATHS) {
+    const pattern = SENSITIVE_DIRS.has(path35) ? `${path35}/**` : path35;
     for (const tool of FILE_TOOLS) {
       rules.push(`${tool}(${pattern})`);
     }
@@ -458,6 +547,173 @@ function buildDenyRules() {
   return [...new Set(rules)];
 }
 
+// src/utils/paths.ts
+import { existsSync, readFileSync } from "fs";
+import os3 from "os";
+import path5 from "path";
+import { fileURLToPath } from "url";
+var HAUS_DIR = ".haus-workflow";
+function hausPath(root, ...parts) {
+  return path5.join(root, HAUS_DIR, ...parts);
+}
+function claudePath(root, ...parts) {
+  return path5.join(root, ".claude", ...parts);
+}
+function displayPath(root, targetPath) {
+  const rel = path5.relative(root, targetPath).replace(/\\/g, "/");
+  if (rel && !rel.startsWith("../") && rel !== "..") {
+    return rel.startsWith("./") ? rel : `./${rel}`;
+  }
+  const home = os3.homedir();
+  const normalized = targetPath.replace(/\\/g, "/");
+  if (home && home.trim().length > 0) {
+    const homeRel = path5.relative(home, targetPath).replace(/\\/g, "/");
+    if (homeRel && !homeRel.startsWith("../") && homeRel !== "..") {
+      return `~/${homeRel}`;
+    }
+  }
+  return normalized;
+}
+function packageRoot() {
+  let dir = path5.dirname(fileURLToPath(import.meta.url));
+  for (let i = 0; i < 12; i++) {
+    const pkgPath = path5.join(dir, "package.json");
+    if (existsSync(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+        if (pkg.name === "haus" || pkg.name === "@haus-tech/haus-workflow") return dir;
+      } catch {
+      }
+    }
+    const parent = path5.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  const file = fileURLToPath(import.meta.url);
+  return path5.resolve(path5.dirname(file), "../..");
+}
+
+// src/claude/merge-project-settings.ts
+var PROJECT_HOOK_FRAGMENTS = [
+  {
+    id: "haus.context-hook",
+    gate: "keep",
+    event: "UserPromptSubmit",
+    command: "haus context --from-hook || true"
+  },
+  {
+    id: "haus.guard-file",
+    gate: "keep",
+    event: "PreToolUse",
+    matcher: "Read|Edit|Write",
+    command: "haus guard file-access --from-hook || true"
+  },
+  {
+    id: "haus.guard-bash",
+    gate: "keep",
+    event: "PreToolUse",
+    matcher: "Bash",
+    command: "haus guard bash --from-hook || true"
+  }
+];
+async function readProjectSettings(root) {
+  const parsed = await readJson(claudePath(root, "settings.json"));
+  return parsed ?? {};
+}
+async function writeProjectSettings(root, settings) {
+  await writeJson(claudePath(root, "settings.json"), settings);
+}
+async function mergeProjectSettings(root) {
+  const base = await readProjectSettings(root);
+  const { settings: withHooks } = mergeHooks(base, PROJECT_HOOK_FRAGMENTS);
+  const { settings: withDeny } = mergeDenyRules(withHooks, buildDenyRules());
+  const { settings: merged } = mergeAllowRules(withDeny, buildAllowRules());
+  return merged;
+}
+async function applyProjectSettingsMerge(root) {
+  const merged = await mergeProjectSettings(root);
+  await writeProjectSettings(root, merged);
+  return merged;
+}
+
+// src/claude/write-claude-files.ts
+import path11 from "path";
+import fs10 from "fs-extra";
+
+// src/update/hash-installed.ts
+import path6 from "path";
+import fg2 from "fast-glob";
+import fs4 from "fs-extra";
+var EMPTY_LOCK_PATHS_TOKEN = "haus-lock:empty-paths";
+async function hashInstalledPaths(root, relPaths) {
+  if (relPaths.length === 0) {
+    return hashText(EMPTY_LOCK_PATHS_TOKEN);
+  }
+  const normalized = [...new Set(relPaths.map((p) => p.replace(/\\/g, "/")))].sort();
+  const fileDigests = [];
+  for (const rel of normalized) {
+    const abs = path6.join(root, rel);
+    if (!await fs4.pathExists(abs)) continue;
+    const stat = await fs4.stat(abs);
+    if (stat.isFile()) {
+      const body = await fs4.readFile(abs, "utf8");
+      fileDigests.push({ rel, digest: hashText(body) });
+      continue;
+    }
+    if (!stat.isDirectory()) continue;
+    const inner = await fg2("**/*", { cwd: abs, onlyFiles: true, dot: true });
+    for (const sub of inner.sort()) {
+      const relFile = path6.join(rel, sub).replace(/\\/g, "/");
+      const absFile = path6.join(abs, sub);
+      const body = await fs4.readFile(absFile, "utf8");
+      fileDigests.push({ rel: relFile, digest: hashText(body) });
+    }
+  }
+  if (fileDigests.length === 0) {
+    return hashText(`${EMPTY_LOCK_PATHS_TOKEN}|${normalized.join("|")}`);
+  }
+  fileDigests.sort((a, b) => a.rel.localeCompare(b.rel));
+  return hashText(fileDigests.map((f) => `${f.rel}=${f.digest}`).join("|"));
+}
+
+// src/utils/diff.ts
+import { createTwoFilesPatch } from "diff";
+function hasTextChanged(before, after) {
+  return before !== after;
+}
+function createUnifiedDiff(filePath, before, after) {
+  return createTwoFilesPatch(filePath, filePath, before, after, "before", "after", {
+    context: 3
+  });
+}
+function summarizeDiff(diffText) {
+  const lines = diffText.split("\n");
+  let additions = 0;
+  let deletions = 0;
+  for (const line2 of lines) {
+    if (line2.startsWith("+++ ") || line2.startsWith("--- ")) continue;
+    if (line2.startsWith("+")) additions += 1;
+    if (line2.startsWith("-")) deletions += 1;
+  }
+  return { additions, deletions };
+}
+
+// src/claude/load-hooks-config.ts
+import path7 from "path";
+var CONFIG_PATH = ".haus-workflow/config.json";
+var DEFAULT_HOOKS_CONFIG = {
+  hooks: {
+    context: { enabled: false }
+  }
+};
+async function isHookEnabled(root, key) {
+  const cfg = await readJson(path7.join(root, CONFIG_PATH));
+  return cfg?.hooks?.[key]?.enabled === true;
+}
+
+// src/claude/verify-hooks-contract.ts
+import fs5 from "fs-extra";
+
 // src/claude/load-hooks.ts
 var CANONICAL_HOOKS = {
   hooks: {
@@ -505,24 +761,52 @@ function flattenRecommendedHooks(settings) {
 }
 
 // src/claude/verify-hooks-contract.ts
-import { isDeepStrictEqual } from "util";
-import fs4 from "fs-extra";
-async function assertPostApplySettingsMatchCanonical(root, canonical) {
+function collectHookCommands(settings) {
+  const cmds = [];
+  for (const entries of Object.values(settings.hooks ?? {})) {
+    for (const entry of entries) {
+      for (const h of entry.hooks ?? []) {
+        if (h.command) cmds.push(h.command);
+      }
+    }
+  }
+  return cmds;
+}
+function hausHookContractSatisfied(project, canonical) {
+  const present = new Set(collectHookCommands(project));
+  for (const block of canonical.hooks.UserPromptSubmit) {
+    for (const h of block.hooks) {
+      if (!present.has(h.command)) return false;
+    }
+  }
+  for (const block of canonical.hooks.PreToolUse) {
+    for (const h of block.hooks) {
+      if (!present.has(h.command)) return false;
+    }
+  }
+  const denySet = new Set(project.permissions?.deny ?? []);
+  for (const rule of canonical.permissions?.deny ?? []) {
+    if (!denySet.has(rule)) return false;
+  }
+  return true;
+}
+async function assertPostApplySettingsHausContract(root) {
+  const canonical = await loadClaudeHooksSettings();
   const written = await readJson(claudePath(root, "settings.json"));
   if (written == null || typeof written !== "object") {
     throw new Error(
       "haus: post-apply self-check failed: .claude/settings.json missing or unreadable"
     );
   }
-  if (!isDeepStrictEqual(canonical, written)) {
+  if (!hausHookContractSatisfied(written, canonical)) {
     throw new Error(
-      "haus: post-apply self-check failed: .claude/settings.json does not match canonical hook contract"
+      "haus: post-apply self-check failed: .claude/settings.json missing required haus hooks or deny rules"
     );
   }
 }
 async function verifyProjectSettingsHooksContract(root) {
   const settingsPath = claudePath(root, "settings.json");
-  if (!await fs4.pathExists(settingsPath)) {
+  if (!await fs5.pathExists(settingsPath)) {
     return {
       ok: true,
       skipped: true,
@@ -539,18 +823,18 @@ async function verifyProjectSettingsHooksContract(root) {
   if (project == null || typeof project !== "object") {
     return { ok: false, message: ".claude/settings.json is unreadable." };
   }
-  if (!isDeepStrictEqual(canonical, project)) {
+  if (!hausHookContractSatisfied(project, canonical)) {
     return {
       ok: false,
-      message: ".claude/settings.json drifts from canonical hook config (regenerate with `haus apply --write`)."
+      message: ".claude/settings.json missing required haus hooks or deny rules (regenerate with `haus apply --write`)."
     };
   }
-  return { ok: true, message: "settings.json matches canonical hook contract." };
+  return { ok: true, message: "settings.json carries required haus hook contract." };
 }
 
 // src/claude/write-root-claude-md.ts
-import path6 from "path";
-import fs5 from "fs-extra";
+import path8 from "path";
+import fs6 from "fs-extra";
 var BLOCK_BEGIN = "<!-- HAUS:BEGIN haus-imports v=1 -->";
 var BLOCK_END = "<!-- HAUS:END haus-imports -->";
 var IMPORT_CONTENT = `@.haus-workflow/WORKFLOW.md
@@ -560,6 +844,16 @@ function buildImportBlock() {
 ${IMPORT_CONTENT}
 ${BLOCK_END}`;
 }
+function stripHausBlock(existing) {
+  const beginIdx = existing.indexOf(BLOCK_BEGIN);
+  const endIdx = existing.indexOf(BLOCK_END);
+  if (beginIdx === -1 || endIdx === -1 || endIdx <= beginIdx) return existing;
+  const before = existing.slice(0, beginIdx);
+  const after = existing.slice(endIdx + BLOCK_END.length);
+  const merged = `${before}${after}`.replace(/\n{3,}/g, "\n\n").trimEnd();
+  return merged.length > 0 ? `${merged}
+` : "";
+}
 function injectHausBlock(existing, block) {
   const beginIdx = existing.indexOf(BLOCK_BEGIN);
   const endIdx = existing.indexOf(BLOCK_END);
@@ -579,9 +873,9 @@ ${block}
 `;
 }
 async function writeRootClaudeMd(root, dryRun) {
-  const filePath = path6.join(root, "CLAUDE.md");
+  const filePath = path8.join(root, "CLAUDE.md");
   const block = buildImportBlock();
-  const prev = await fs5.pathExists(filePath) ? await fs5.readFile(filePath, "utf8") : "";
+  const prev = await fs6.pathExists(filePath) ? await fs6.readFile(filePath, "utf8") : "";
   const next = injectHausBlock(prev, block);
   const printable = displayPath(root, filePath);
   if (dryRun) {
@@ -604,12 +898,12 @@ async function writeRootClaudeMd(root, dryRun) {
 }
 
 // src/claude/write-workflow-config.ts
-import path8 from "path";
-import fs7 from "fs-extra";
+import path10 from "path";
+import fs8 from "fs-extra";
 
 // src/claude/derive-workflow-config.ts
-import path7 from "path";
-import fs6 from "fs-extra";
+import path9 from "path";
+import fs7 from "fs-extra";
 function binCmd(pm, bin, args) {
   const tail = args ? ` ${args}` : "";
   if (pm === "yarn") return `yarn ${bin}${tail}`;
@@ -618,7 +912,7 @@ function binCmd(pm, bin, args) {
 }
 async function deriveWorkflowConfig(root, ctx) {
   const pm = ctx.packageManager === "unknown" ? "npm" : ctx.packageManager;
-  const pkg = await readJson(path7.join(root, "package.json"));
+  const pkg = await readJson(path9.join(root, "package.json"));
   const scripts = pkg?.scripts ?? {};
   const deps = new Set(ctx.dependencies);
   const stacks = Object.values(ctx.detectedStacks ?? {}).flat();
@@ -628,7 +922,7 @@ async function deriveWorkflowConfig(root, ctx) {
     return null;
   };
   const hasDep = (name) => deps.has(name);
-  const exists = (rel) => fs6.pathExistsSync(path7.join(root, rel));
+  const exists = (rel) => fs7.pathExistsSync(path9.join(root, rel));
   const hasPlaywright = hasDep("@playwright/test") || stacks.includes("playwright");
   const hasCypress = hasDep("cypress");
   const preCommitTool = exists("lefthook.yml") || exists("lefthook.yaml") ? "lefthook" : exists(".husky") || hasDep("husky") || (scripts.prepare ?? "").includes("husky") ? "husky" : exists(".pre-commit-config.yaml") ? "pre-commit (Python framework)" : null;
@@ -697,7 +991,7 @@ var FALLBACK_CONTEXT = {
 async function writeWorkflowConfig(root, dryRun, opts = {}) {
   const destPath = hausPath(root, "workflow-config.md");
   const printable = displayPath(root, destPath);
-  const exists = await fs7.pathExists(destPath);
+  const exists = await fs8.pathExists(destPath);
   if (exists && !opts.refill) {
     if (dryRun) log(printable + ": exists (project-owned, skipping)");
     return null;
@@ -705,11 +999,11 @@ async function writeWorkflowConfig(root, dryRun, opts = {}) {
   const ctx = await readJson(hausPath(root, "context-map.json")) ?? {
     ...FALLBACK_CONTEXT,
     root,
-    repoName: path8.basename(root)
+    repoName: path10.basename(root)
   };
   const values = await deriveWorkflowConfig(root, ctx);
   if (exists) {
-    const current = await fs7.readFile(destPath, "utf8");
+    const current = await fs8.readFile(destPath, "utf8");
     const refilled = refillContent(current, values);
     if (refilled === current) {
       if (dryRun) log(printable + ": no blank fields to refill");
@@ -731,7 +1025,7 @@ async function writeWorkflowConfig(root, dryRun, opts = {}) {
 }
 
 // src/claude/write-workflow.ts
-import fs8 from "fs-extra";
+import fs9 from "fs-extra";
 
 // src/claude/managed-template.ts
 function normaliseLF(content2) {
@@ -764,8 +1058,8 @@ async function writeWorkflow(root, pkgVersion, dryRun) {
 ${templateContent}`;
   const destPath = hausPath(root, "WORKFLOW.md");
   const printable = displayPath(root, destPath);
-  if (await fs8.pathExists(destPath)) {
-    const existing = await fs8.readFile(destPath, "utf8");
+  if (await fs9.pathExists(destPath)) {
+    const existing = await fs9.readFile(destPath, "utf8");
     const firstLine = existing.split("\n")[0] ?? "";
     const parsed = parseHausManagedHeader(firstLine);
     if (!parsed) {
@@ -787,7 +1081,7 @@ ${templateContent}`;
     }
   }
   if (dryRun) {
-    const prev = await fs8.pathExists(destPath) ? await fs8.readFile(destPath, "utf8") : "";
+    const prev = await fs9.pathExists(destPath) ? await fs9.readFile(destPath, "utf8") : "";
     if (!prev) {
       log(createUnifiedDiff(printable, "", next));
     } else {
@@ -814,7 +1108,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
     estimatedTokenReductionPct: 0
   };
   const pkgRoot = packageRoot();
-  const hausVersion = (await readJson(path9.join(pkgRoot, "package.json")))?.version ?? "0.0.0";
+  const hausVersion2 = (await readJson(path11.join(pkgRoot, "package.json")))?.version ?? "0.0.0";
   const coreFiles = [
     claudePath(root, "settings.json"),
     claudePath(root, "rules", "haus.md"),
@@ -823,7 +1117,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
     claudePath(root, "commands", "haus-review.md")
   ];
   const rootClaudeMdPath = await writeRootClaudeMd(root, dryRun);
-  const workflowPath = await writeWorkflow(root, hausVersion, dryRun);
+  const workflowPath = await writeWorkflow(root, hausVersion2, dryRun);
   const workflowConfigPath = await writeWorkflowConfig(root, dryRun, {
     refill: opts.refillConfig
   });
@@ -838,11 +1132,15 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
     hausPath(root, "selected-context.json"),
     hausPath(root, "haus.lock.json")
   ];
-  const hookSettings = await loadClaudeHooksSettings();
-  await writeManagedJson(root, claudePath(root, "settings.json"), hookSettings, dryRun);
-  if (!dryRun) await assertPostApplySettingsMatchCanonical(root, hookSettings);
+  if (dryRun) {
+    const mergedSettings = await mergeProjectSettings(root);
+    await writeManagedJson(root, claudePath(root, "settings.json"), mergedSettings, true);
+  } else {
+    await applyProjectSettingsMerge(root);
+    await assertPostApplySettingsHausContract(root);
+  }
   const configPath = hausPath(root, "config.json");
-  if (!await fs9.pathExists(configPath)) {
+  if (!await fs10.pathExists(configPath)) {
     await writeManagedJson(root, configPath, DEFAULT_HOOKS_CONFIG, dryRun);
   }
   await writeManagedText(
@@ -870,12 +1168,12 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
     dryRun
   );
   const fixtureManifestPath = process.env["HAUS_FIXTURE_CATALOG"];
-  const manifestPath = fixtureManifestPath ?? path9.join(pkgRoot, "library", "catalog", "manifest.json");
-  const manifestDir = path9.dirname(manifestPath);
-  const manifest = await readJson(manifestPath) ?? { items: [] };
+  const manifestPath2 = fixtureManifestPath ?? path11.join(pkgRoot, "library", "catalog", "manifest.json");
+  const manifestDir = path11.dirname(manifestPath2);
+  const manifest = await readJson(manifestPath2) ?? { items: [] };
   const manifestById = new Map((manifest.items ?? []).map((item) => [item.id, item]));
   const cacheManifest = await readJson(
-    path9.join(CACHE_DIR, "manifest.json")
+    path11.join(CACHE_DIR, "manifest.json")
   );
   const cacheManifestById = new Map((cacheManifest?.items ?? []).map((item) => [item.id, item]));
   const installedPathsByItem = /* @__PURE__ */ new Map();
@@ -897,23 +1195,23 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
       }
     }
     const cachedItem = cacheManifestById.get(item.id);
-    const cachePath = cachedItem?.path ? path9.join(CACHE_DIR, cachedItem.path) : null;
-    const sourcePath = cachePath && await fs9.pathExists(cachePath) ? cachePath : path9.join(manifestDir, manifestItem.path);
+    const cachePath = cachedItem?.path ? path11.join(CACHE_DIR, cachedItem.path) : null;
+    const sourcePath = cachePath && await fs10.pathExists(cachePath) ? cachePath : path11.join(manifestDir, manifestItem.path);
     const target = item.type === "agent" ? "agents" : item.type === "template" ? "templates" : "skills";
-    const destination = claudePath(root, target, path9.basename(sourcePath));
-    if (await fs9.pathExists(sourcePath)) {
+    const destination = claudePath(root, target, path11.basename(sourcePath));
+    if (await fs10.pathExists(sourcePath)) {
       if (dryRun) {
-        const exists = await fs9.pathExists(destination);
+        const exists = await fs10.pathExists(destination);
         log(
           `${displayPath(root, destination)}: ${exists ? "would overwrite" : "would create"} (${item.id})`
         );
       } else {
-        await fs9.ensureDir(path9.dirname(destination));
-        await fs9.copy(sourcePath, destination, { overwrite: true, errorOnExist: false });
+        await fs10.ensureDir(path11.dirname(destination));
+        await fs10.copy(sourcePath, destination, { overwrite: true, errorOnExist: false });
       }
       files.push(destination);
       const current = installedPathsByItem.get(item.id) ?? [];
-      installedPathsByItem.set(item.id, [...current, path9.relative(root, destination)]);
+      installedPathsByItem.set(item.id, [...current, path11.relative(root, destination)]);
       installedIds.add(item.id);
     } else {
       warn(
@@ -943,7 +1241,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
         id: r.id,
         type: r.type,
         source: isCurated ? "curated" : "haus",
-        version: hausVersion,
+        version: hausVersion2,
         catalogRef: CATALOG_REF,
         hash: await hashInstalledPaths(root, relPaths),
         installMode: "copied",
@@ -964,7 +1262,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
   return [...new Set(files)];
 }
 async function writeManagedText(root, filePath, nextText, dryRun) {
-  const prev = await fs9.pathExists(filePath) ? await fs9.readFile(filePath, "utf8") : "";
+  const prev = await fs10.pathExists(filePath) ? await fs10.readFile(filePath, "utf8") : "";
   const printable = displayPath(root, filePath);
   if (dryRun) {
     if (!prev) {
@@ -991,7 +1289,7 @@ async function writeManagedJson(root, filePath, value, dryRun) {
 
 // src/commands/apply.ts
 async function cacheHasItems() {
-  const data = await readJson(path10.join(CACHE_DIR, "manifest.json"));
+  const data = await readJson(path12.join(CACHE_DIR, "manifest.json"));
   return Array.isArray(data?.items) && data.items.length > 0;
 }
 async function runApply(options) {
@@ -1058,11 +1356,23 @@ async function runApply(options) {
     files.forEach((f) => log(`- ${displayPath(root, f)}`));
   }
 }
+async function isHausProject(root) {
+  if (await fs11.pathExists(hausPath(root, "recommendation.json"))) return true;
+  if (await fs11.pathExists(claudePath(root, "settings.json"))) {
+    const settings = await readProjectSettings(root);
+    if (settings._haus != null) return true;
+  }
+  return false;
+}
+async function refreshProjectApply(root) {
+  if (!await isHausProject(root)) return [];
+  return writeClaudeFiles(root, false, void 0, { refillConfig: false });
+}
 
 // src/catalog/load-catalog.ts
-import os3 from "os";
-import path11 from "path";
-var CACHE_MANIFEST = path11.join(os3.homedir(), CATALOG_CACHE_SUBDIR, "manifest.json");
+import os4 from "os";
+import path13 from "path";
+var CACHE_MANIFEST = path13.join(os4.homedir(), CATALOG_CACHE_SUBDIR, "manifest.json");
 async function loadCatalog(root) {
   const envPath = process.env["HAUS_FIXTURE_CATALOG"];
   if (envPath) {
@@ -1071,10 +1381,10 @@ async function loadCatalog(root) {
   }
   const cacheData = await readJson(CACHE_MANIFEST);
   if (cacheData?.items?.length) return cacheData.items;
-  const localManifest = path11.join(root, "library/catalog/manifest.json");
+  const localManifest = path13.join(root, "library/catalog/manifest.json");
   const localData = await readJson(localManifest);
   if (localData?.items?.length) return localData.items;
-  const packageManifest = path11.join(packageRoot(), "library/catalog/manifest.json");
+  const packageManifest = path13.join(packageRoot(), "library/catalog/manifest.json");
   const data = await readJson(packageManifest);
   return data?.items ?? [];
 }
@@ -1284,7 +1594,7 @@ async function runCatalogAudit() {
 }
 
 // src/commands/config.ts
-import path12 from "path";
+import path14 from "path";
 var CONFIG_PATH2 = ".haus-workflow/config.json";
 var HOOK_ALIASES = {
   "hook.context": "context"
@@ -1297,7 +1607,7 @@ async function runConfig(key, action) {
     );
   }
   const root = process.cwd();
-  const configPath = path12.join(root, CONFIG_PATH2);
+  const configPath = path14.join(root, CONFIG_PATH2);
   const existing = await readJson(configPath);
   const cfg = existing ?? structuredClone(DEFAULT_HOOKS_CONFIG);
   cfg.hooks ??= {};
@@ -1669,7 +1979,7 @@ function selectRules(recommended, task, taskIntents) {
 
 // src/scanner/scan-project.ts
 import { readFile as readFile2 } from "fs/promises";
-import path16 from "path";
+import path18 from "path";
 
 // src/utils/audit-checks.ts
 function isRecord(v) {
@@ -1696,8 +2006,8 @@ function compareVersions(a, b) {
 }
 
 // src/scanner/detect-package-manager.ts
-import path13 from "path";
-import fs10 from "fs-extra";
+import path15 from "path";
+import fs12 from "fs-extra";
 function detectPackageManager(root, packageManagerField) {
   const field = String(packageManagerField ?? "").trim();
   if (field.startsWith("yarn@")) {
@@ -1715,9 +2025,9 @@ function detectPackageManager(root, packageManagerField) {
     if (satisfiesVersion(version, ">=9")) return "npm";
     return "unknown";
   }
-  if (fs10.existsSync(path13.join(root, "yarn.lock"))) return "yarn";
-  if (fs10.existsSync(path13.join(root, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs10.existsSync(path13.join(root, "package-lock.json"))) return "npm";
+  if (fs12.existsSync(path15.join(root, "yarn.lock"))) return "yarn";
+  if (fs12.existsSync(path15.join(root, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs12.existsSync(path15.join(root, "package-lock.json"))) return "npm";
   return "unknown";
 }
 
@@ -1890,7 +2200,7 @@ function runDetection(ctx, rules = STACK_RULES) {
 }
 
 // src/scanner/detection.ts
-import path14 from "path";
+import path16 from "path";
 var UNSUPPORTED_MARKERS = {
   "requirements.txt": "python",
   "pyproject.toml": "python",
@@ -1944,14 +2254,14 @@ function finalizeRoles(registryRoles, deps, files) {
 function collectUnsupportedSignals(files) {
   return [
     ...new Set(
-      files.map((f) => UNSUPPORTED_MARKERS[path14.basename(f)]).filter((s) => Boolean(s))
+      files.map((f) => UNSUPPORTED_MARKERS[path16.basename(f)]).filter((s) => Boolean(s))
     )
   ].sort();
 }
 
 // src/scanner/render.ts
 import { readFile } from "fs/promises";
-import path15 from "path";
+import path17 from "path";
 
 // src/scanner/role-labels.ts
 var ROLE_LABELS = {
@@ -2013,7 +2323,7 @@ async function buildContentBlob(root, files) {
   const slice = candidates.slice(0, 300);
   const parts = await mapWithConcurrency(slice, async (rel) => {
     try {
-      return await readFile(path15.join(root, rel), "utf8");
+      return await readFile(path17.join(root, rel), "utf8");
     } catch {
       return "";
     }
@@ -2079,8 +2389,8 @@ var SAFE_FILES = [
   "Gemfile"
 ];
 async function scanProject(root, mode = "fast") {
-  const pkg = await readJson(path16.join(root, "package.json"));
-  const composer = await readJson(path16.join(root, "composer.json"));
+  const pkg = await readJson(path18.join(root, "package.json"));
+  const composer = await readJson(path18.join(root, "composer.json"));
   const files = await listFiles(root, SAFE_FILES);
   const safeFiles = files.filter((f) => !blocked(f));
   const deps = dependencySet(pkg, composer);
@@ -2114,7 +2424,7 @@ async function scanProject(root, mode = "fast") {
     mode,
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     root,
-    repoName: String(pkg?.name ?? path16.basename(root)),
+    repoName: String(pkg?.name ?? path18.basename(root)),
     packageManager,
     repoRoles: roles,
     detectedStacks: stacks,
@@ -2132,7 +2442,7 @@ async function scanProject(root, mode = "fast") {
   const scanHashes = Object.fromEntries(
     await mapWithConcurrency(
       safeFiles,
-      async (f) => [f, hashText(await readFile2(path16.join(root, f), "utf8"))]
+      async (f) => [f, hashText(await readFile2(path18.join(root, f), "utf8"))]
     )
   );
   const repoSummary = renderSummary(context);
@@ -2204,8 +2514,8 @@ async function runContext(options) {
 }
 
 // src/commands/doctor.ts
-import path17 from "path";
-import fs11 from "fs-extra";
+import path19 from "path";
+import fs13 from "fs-extra";
 
 // src/update/npm-version.ts
 var NPM_PACKAGE_NAME = "@haus-tech/haus-workflow";
@@ -2285,7 +2595,7 @@ async function runDoctor(options) {
     const enabled = await isHookEnabled(root, key);
     ok(`- HOOK ${key}: ${enabled ? "enabled" : "disabled (default)"}`);
   }
-  const rootClaudeMdPath = path17.join(root, "CLAUDE.md");
+  const rootClaudeMdPath = path19.join(root, "CLAUDE.md");
   const rootClaudeMdContent = await readText(rootClaudeMdPath);
   if (!rootClaudeMdContent) {
     flag(
@@ -2313,7 +2623,7 @@ async function runDoctor(options) {
       const block = rootClaudeMdContent.slice(beginIdx, endIdx + BLOCK_END.length);
       const importTargets = [...block.matchAll(/@\.haus-workflow\/(\S+)/g)].map((m) => m[1]);
       for (const target of importTargets) {
-        if (!await fs11.pathExists(hausPath(root, target))) {
+        if (!await fs13.pathExists(hausPath(root, target))) {
           flag(
             `- CLAUDE.md import: @.haus-workflow/${target} does not resolve (run \`haus apply --write\`)`,
             `A file CLAUDE.md links to (${target}) is missing, so part of the guidance won't load`,
@@ -2324,7 +2634,7 @@ async function runDoctor(options) {
     }
   }
   const workflowPath = hausPath(root, "WORKFLOW.md");
-  const workflowExists = await fs11.pathExists(workflowPath);
+  const workflowExists = await fs13.pathExists(workflowPath);
   if (!workflowExists) {
     flag(
       "- .haus-workflow/WORKFLOW.md: missing (run `haus apply --write`)",
@@ -2338,15 +2648,15 @@ async function runDoctor(options) {
       ok("- .haus-workflow/WORKFLOW.md: OK (user-owned)");
     } else {
       const storedHashMatch = firstLine.match(/hash=(sha256-[a-f0-9]+)/);
-      const cachePath = path17.join(CACHE_DIR, "templates/agentic-workflow-standard.md");
-      const bundledPath = path17.join(
+      const cachePath = path19.join(CACHE_DIR, "templates/agentic-workflow-standard.md");
+      const bundledPath = path19.join(
         packageRoot(),
         "library",
         "global",
         "templates",
         "agentic-workflow-standard.md"
       );
-      const templatePath = await fs11.pathExists(cachePath) ? cachePath : bundledPath;
+      const templatePath = await fs13.pathExists(cachePath) ? cachePath : bundledPath;
       const templateContent = await readText(templatePath);
       if (storedHashMatch && templateContent) {
         const currentHash = hashText(normaliseLF(templateContent));
@@ -2365,7 +2675,7 @@ async function runDoctor(options) {
     }
   }
   const workflowConfigPath = hausPath(root, "workflow-config.md");
-  const workflowConfigExists = await fs11.pathExists(workflowConfigPath);
+  const workflowConfigExists = await fs13.pathExists(workflowConfigPath);
   if (!workflowConfigExists) {
     flag(
       "- .haus-workflow/workflow-config.md: missing (run `haus apply --write`)",
@@ -2373,7 +2683,7 @@ async function runDoctor(options) {
       "haus apply --write"
     );
   } else {
-    const cfg = await fs11.readFile(workflowConfigPath, "utf8");
+    const cfg = await fs13.readFile(workflowConfigPath, "utf8");
     const unfilled = cfg.split("\n").filter((l) => l.includes("<!-- fill in")).length;
     if (unfilled > 0) {
       flag(
@@ -2404,7 +2714,7 @@ async function runDoctor(options) {
       ok(`- CATALOG CACHE: OK (${cacheAgeDays}d old)`);
     }
   }
-  const pkgJson = await readJson(path17.join(packageRoot(), "package.json"));
+  const pkgJson = await readJson(path19.join(packageRoot(), "package.json"));
   const currentVersion = pkgJson?.version ?? "0.0.0";
   const npmStatus = await fetchNpmVersionStatus(currentVersion);
   if (npmStatus.updateAvailable && npmStatus.latest !== null) {
@@ -2545,8 +2855,26 @@ async function runGuard(kind, _options) {
 }
 
 // src/commands/init.ts
-import path18 from "path";
-import fs12 from "fs-extra";
+import path20 from "path";
+import fs14 from "fs-extra";
+
+// src/utils/prompts.ts
+import { stdin as input, stdout as output } from "process";
+import readline from "readline/promises";
+async function ask(question) {
+  const rl = readline.createInterface({ input, output });
+  try {
+    const answer = await rl.question(`${question}
+> `);
+    return answer.trim();
+  } finally {
+    rl.close();
+  }
+}
+async function confirm(question) {
+  const answer = (await ask(`${question} [y/N]`)).toLowerCase();
+  return answer === "y" || answer === "yes";
+}
 
 // src/utils/exec.ts
 import { execa } from "execa";
@@ -2832,64 +3160,11 @@ function buildStackSet(context) {
   );
 }
 
-// src/utils/prompts.ts
-import { stdin as input, stdout as output } from "process";
-import readline from "readline/promises";
-async function ask(question) {
-  const rl = readline.createInterface({ input, output });
-  try {
-    const answer = await rl.question(`${question}
-> `);
-    return answer.trim();
-  } finally {
-    rl.close();
-  }
-}
-async function confirm(question) {
-  const answer = (await ask(`${question} [y/N]`)).toLowerCase();
-  return answer === "y" || answer === "yes";
-}
-
-// src/commands/setup-project.ts
-var GUIDED_QUESTIONS = [
-  "What is this project for?",
-  "Is it for a client, internal Haus work, or experimentation?",
-  "What should Claude help with most?",
-  "Is this project connected to other repositories?",
-  "Are there parts of the project Claude should avoid touching?",
-  "Are there client-specific rules or sensitive areas?",
-  "Do you want a minimal, standard, or strict setup?"
-];
-async function runSetupProject(options) {
-  const root = process.cwd();
-  let mode = options.guided ? "guided" : "fast";
-  if (!options.guided && !options.fast && !options.json) {
-    log("How do you want to set this project up?");
-    log("1. Guided setup - I'll ask a few simple questions, then scan the project.");
-    log("2. Fast setup - I'll only scan the project and recommend defaults.");
-    const choice = await ask("Choose 1 or 2");
-    mode = choice === "1" ? "guided" : "fast";
-  }
-  if (mode === "guided") {
-    const existing = await readJson(hausPath(root, "setup-answers.json")) ?? {};
-    const merged = {};
-    for (const question of GUIDED_QUESTIONS) {
-      if (options.json) {
-        merged[question] = existing[question] ?? "pending-user-answer";
-        continue;
-      }
-      const prefilled = existing[question];
-      if (prefilled && prefilled !== "pending-user-answer" && prefilled !== "no-answer") {
-        merged[question] = prefilled;
-        continue;
-      }
-      const answer = await ask(question);
-      merged[question] = answer || prefilled || "no-answer";
-    }
-    await writeJson(hausPath(root, "setup-answers.json"), merged);
-  }
+// src/commands/setup-core.ts
+async function runSetupCore(root, opts) {
+  const { mode, json, apply, dryRun, confirm: confirm2 } = opts;
   const scanResult = await scanProject(root, mode);
-  if (options.json) {
+  if (json) {
     log(JSON.stringify(scanResult, null, 2));
   } else {
     log("Haus scan complete");
@@ -2905,7 +3180,7 @@ async function runSetupProject(options) {
     { id: "haus.rule.context-minimal", enabled: true },
     { id: "haus.rule.security", enabled: true }
   ]);
-  if (options.json) {
+  if (json) {
     log(JSON.stringify(recommendation, null, 2));
   } else {
     log("Haus recommendation ready");
@@ -2916,6 +3191,7 @@ async function runSetupProject(options) {
   const warningLines = [.../* @__PURE__ */ new Set([...context.warnings, ...recommendation.warnings ?? []])];
   log(`Repo: ${context.repoName}`);
   for (const warning of warningLines) log(`- WARN: ${warning}`);
+  const hooksOk = hooks.ok;
   if (hooks.skipped) {
     log(`- HOOKS: (skipped) ${hooks.message}`);
   } else if (!hooks.ok) {
@@ -2924,17 +3200,29 @@ async function runSetupProject(options) {
   } else {
     log(`- HOOKS OK: ${hooks.message}`);
   }
-  if (options.json) return;
-  const approved = await confirm("Approve and write Claude files now?");
-  if (!approved) {
-    log("Setup reviewed. No files written.");
-    log("Next step: run `haus apply --write` when ready.");
-    return;
+  const baseResult = {
+    root,
+    repoName: context.repoName,
+    roles: scanResult.repoRoles,
+    recommendedCount: recommendation.recommended.length,
+    warnings: warningLines,
+    hooksOk,
+    written: []
+  };
+  if (!apply) return baseResult;
+  if (confirm2) {
+    const approved = await confirm2();
+    if (!approved) {
+      log("Setup reviewed. No files written.");
+      log("Next step: run `haus apply --write` when ready.");
+      return baseResult;
+    }
   }
-  const files = await writeClaudeFiles(root, false);
+  const files = await writeClaudeFiles(root, dryRun ?? false);
   log("Applied files:");
   files.forEach((f) => log(`- ${displayPath(root, f)}`));
   const hooksAfter = await verifyProjectSettingsHooksContract(root);
+  const hooksOkAfter = hooksAfter.ok;
   if (hooksAfter.skipped) {
     log(`- HOOKS: (skipped) ${hooksAfter.message}`);
   } else if (!hooksAfter.ok) {
@@ -2943,13 +3231,61 @@ async function runSetupProject(options) {
   } else {
     log(`- HOOKS OK: ${hooksAfter.message}`);
   }
+  return { ...baseResult, hooksOk: hooksOkAfter, written: files };
+}
+
+// src/commands/setup-project.ts
+var GUIDED_QUESTIONS = [
+  "What is this project for?",
+  "Is it for a client, internal Haus work, or experimentation?",
+  "What should Claude help with most?",
+  "Is this project connected to other repositories?",
+  "Are there parts of the project Claude should avoid touching?",
+  "Are there client-specific rules or sensitive areas?",
+  "Do you want a minimal, standard, or strict setup?"
+];
+async function runSetupProject(options) {
+  const root = process.cwd();
+  let mode = options.guided ? "guided" : "fast";
+  if (!options.guided && !options.fast && !options.json) {
+    log("How do you want to set this project up?");
+    log("1. Guided setup - I'll ask a few simple questions, then scan the project.");
+    log("2. Fast setup - I'll only scan the project and recommend defaults.");
+    const choice = await ask("Choose 1 or 2");
+    mode = choice === "1" ? "guided" : "fast";
+  }
+  if (mode === "guided") {
+    const existing = await readJson(hausPath(root, "setup-answers.json")) ?? {};
+    const merged = {};
+    for (const question of GUIDED_QUESTIONS) {
+      if (options.json) {
+        merged[question] = existing[question] ?? "pending-user-answer";
+        continue;
+      }
+      const prefilled = existing[question];
+      if (prefilled && prefilled !== "pending-user-answer" && prefilled !== "no-answer") {
+        merged[question] = prefilled;
+        continue;
+      }
+      const answer = await ask(question);
+      merged[question] = answer || prefilled || "no-answer";
+    }
+    await writeJson(hausPath(root, "setup-answers.json"), merged);
+  }
+  await runSetupCore(root, {
+    mode,
+    json: options.json,
+    apply: !options.json,
+    dryRun: false,
+    confirm: () => confirm("Approve and write Claude files now?")
+  });
 }
 
 // src/commands/init.ts
 async function runInit(options) {
   const root = process.cwd();
-  const hausDir = path18.join(root, ".haus-workflow");
-  const alreadyInit = await fs12.pathExists(hausDir);
+  const hausDir = path20.join(root, ".haus-workflow");
+  const alreadyInit = await fs14.pathExists(hausDir);
   if (alreadyInit) {
     log("Haus AI already initialized in this project.");
     log("Run `haus setup-project` to reconfigure.");
@@ -2962,20 +3298,7 @@ async function runInit(options) {
 // src/install/apply.ts
 import crypto2 from "crypto";
 import path21 from "path";
-import fs14 from "fs-extra";
-
-// src/install/allow-rules.ts
-var ALLOWED_SUBCOMMANDS = [
-  "setup-project",
-  "apply",
-  "doctor",
-  "scan",
-  "context",
-  "recommend"
-];
-function buildAllowRules() {
-  return [...new Set(ALLOWED_SUBCOMMANDS.map((sub) => `Bash(haus ${sub}:*)`))];
-}
+import fs15 from "fs-extra";
 
 // src/install/header.ts
 var MD_PREFIX = "<!-- HAUS-MANAGED";
@@ -3004,186 +3327,7 @@ function stampMarkdown(content2, h) {
 ${rest}`;
   }
   return `${header}
-${content2}`;
-}
-
-// src/install/manifest.ts
-import os4 from "os";
-import path19 from "path";
-var MANIFEST_SCHEMA = "haus-install-manifest/1";
-function globalClaudeDir() {
-  return path19.join(os4.homedir(), ".claude");
-}
-function hausManifestPath() {
-  return path19.join(globalClaudeDir(), "haus", "install-manifest.json");
-}
-async function readManifest() {
-  return readJson(hausManifestPath());
-}
-async function writeManifest(manifest) {
-  await writeJson(hausManifestPath(), manifest);
-}
-function buildManifest(source, files, hooks) {
-  return {
-    _schema: MANIFEST_SCHEMA,
-    source,
-    installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    files,
-    hooks
-  };
-}
-
-// src/install/settings-merge.ts
-import path20 from "path";
-import fs13 from "fs-extra";
-function settingsJsonPath() {
-  return path20.join(globalClaudeDir(), "settings.json");
-}
-async function readSettings() {
-  const parsed = await readJson(settingsJsonPath());
-  return parsed ?? {};
-}
-async function writeSettings(settings) {
-  await writeJson(settingsJsonPath(), settings);
-}
-function mergeHooks(settings, fragments) {
-  const existing = settings._haus?.hooks ?? [];
-  const existingCommands = settings._haus?.hookCommands ?? [];
-  const existingSet = new Set(existing);
-  const updated = { ...settings };
-  updated.hooks = { ...settings.hooks ?? {} };
-  const addedIds = [];
-  const addedCommands = [];
-  for (const fragment of fragments) {
-    if (fragment.gate !== "keep") continue;
-    if (existingSet.has(fragment.id)) continue;
-    const event = fragment.event;
-    if (!updated.hooks[event]) updated.hooks[event] = [];
-    const entry = {
-      hooks: [{ type: "command", command: fragment.command }]
-    };
-    if (fragment.matcher) entry.matcher = fragment.matcher;
-    updated.hooks[event] = [...updated.hooks[event] ?? [], entry];
-    addedIds.push(fragment.id);
-    addedCommands.push(fragment.command);
-  }
-  updated._haus = {
-    hooks: [...existing, ...addedIds],
-    hookCommands: [...existingCommands, ...addedCommands],
-    // Preserve deny/allow tracking so hook, deny, and allow merges are order-independent.
-    ...settings._haus?.denyRules ? { denyRules: settings._haus.denyRules } : {},
-    ...settings._haus?.allowRules ? { allowRules: settings._haus.allowRules } : {}
-  };
-  return { settings: updated, addedIds };
-}
-function mergeDenyRules(settings, rules) {
-  const existingDeny = settings.permissions?.deny ?? [];
-  const seen = new Set(existingDeny);
-  const trackedDeny = settings._haus?.denyRules ?? [];
-  const addedRules = [];
-  for (const rule of rules) {
-    if (seen.has(rule)) continue;
-    seen.add(rule);
-    addedRules.push(rule);
-  }
-  const updated = { ...settings };
-  updated.permissions = {
-    ...settings.permissions ?? {},
-    deny: [...existingDeny, ...addedRules]
-  };
-  updated._haus = {
-    hooks: settings._haus?.hooks ?? [],
-    ...settings._haus?.hookCommands ? { hookCommands: settings._haus.hookCommands } : {},
-    denyRules: [...trackedDeny, ...addedRules],
-    ...settings._haus?.allowRules ? { allowRules: settings._haus.allowRules } : {}
-  };
-  return { settings: updated, addedRules };
-}
-function mergeAllowRules(settings, rules) {
-  const existingAllow = settings.permissions?.allow ?? [];
-  const seen = new Set(existingAllow);
-  const trackedAllow = settings._haus?.allowRules ?? [];
-  const addedRules = [];
-  for (const rule of rules) {
-    if (seen.has(rule)) continue;
-    seen.add(rule);
-    addedRules.push(rule);
-  }
-  const updated = { ...settings };
-  updated.permissions = {
-    ...settings.permissions ?? {},
-    allow: [...existingAllow, ...addedRules]
-  };
-  updated._haus = {
-    hooks: settings._haus?.hooks ?? [],
-    ...settings._haus?.hookCommands ? { hookCommands: settings._haus.hookCommands } : {},
-    ...settings._haus?.denyRules ? { denyRules: settings._haus.denyRules } : {},
-    allowRules: [...trackedAllow, ...addedRules]
-  };
-  return { settings: updated, addedRules };
-}
-function stripHausAllow(settings) {
-  const prevHaus = settings._haus;
-  if (!prevHaus?.allowRules || prevHaus.allowRules.length === 0) return settings;
-  const ownedSet = new Set(prevHaus.allowRules);
-  const updated = { ...settings };
-  const remainingAllow = (settings.permissions?.allow ?? []).filter((rule) => !ownedSet.has(rule));
-  const permissions = { ...settings.permissions ?? {} };
-  if (remainingAllow.length > 0) permissions.allow = remainingAllow;
-  else delete permissions.allow;
-  if (Object.keys(permissions).length > 0) updated.permissions = permissions;
-  else delete updated.permissions;
-  const haus = { ...prevHaus };
-  delete haus.allowRules;
-  const stillTracking = (haus.hooks?.length ?? 0) > 0 || (haus.hookCommands?.length ?? 0) > 0 || (haus.denyRules?.length ?? 0) > 0;
-  if (stillTracking) updated._haus = haus;
-  else delete updated._haus;
-  return updated;
-}
-function stripHausDeny(settings) {
-  const prevHaus = settings._haus;
-  if (!prevHaus?.denyRules || prevHaus.denyRules.length === 0) return settings;
-  const ownedSet = new Set(prevHaus.denyRules);
-  const updated = { ...settings };
-  const remainingDeny = (settings.permissions?.deny ?? []).filter((rule) => !ownedSet.has(rule));
-  const permissions = { ...settings.permissions ?? {} };
-  if (remainingDeny.length > 0) permissions.deny = remainingDeny;
-  else delete permissions.deny;
-  if (Object.keys(permissions).length > 0) updated.permissions = permissions;
-  else delete updated.permissions;
-  const haus = { ...prevHaus };
-  delete haus.denyRules;
-  const stillTracking = (haus.hooks?.length ?? 0) > 0 || (haus.hookCommands?.length ?? 0) > 0 || (haus.allowRules?.length ?? 0) > 0;
-  if (stillTracking) updated._haus = haus;
-  else delete updated._haus;
-  return updated;
-}
-function stripHausHooks(settings) {
-  if (!settings._haus) return settings;
-  const ownedCommands = new Set(settings._haus.hookCommands ?? []);
-  const usePrefix = ownedCommands.size === 0;
-  const updated = { ...settings };
-  updated.hooks = {};
-  for (const [event, entries] of Object.entries(settings.hooks ?? {})) {
-    const kept = entries.filter((entry) => {
-      const cmd = entry.hooks[0]?.command ?? "";
-      return usePrefix ? !cmd.startsWith("haus ") : !ownedCommands.has(cmd);
-    });
-    if (kept.length > 0) updated.hooks[event] = kept;
-  }
-  const { _haus: _, ...rest } = updated;
-  void _;
-  return rest;
-}
-async function loadHooksFragment(fragmentPath) {
-  let raw;
-  try {
-    raw = await fs13.readJson(fragmentPath);
-  } catch {
-    return [];
-  }
-  const data = raw;
-  return Array.isArray(data?.hooks) ? data.hooks : [];
+${content2}`;
 }
 
 // src/install/apply.ts
@@ -3194,7 +3338,7 @@ function hashContent(content2) {
 function sourceVersion() {
   try {
     const pkgPath = path21.join(packageRoot(), "package.json");
-    const pkg = JSON.parse(fs14.readFileSync(pkgPath, "utf8"));
+    const pkg = JSON.parse(fs15.readFileSync(pkgPath, "utf8"));
     return `${pkg.name ?? "haus"}@${pkg.version ?? "0.0.0"}`;
   } catch {
     return "haus@0.0.0";
@@ -3206,10 +3350,10 @@ function globalSrcDir() {
 function collectSourceFiles(srcDir, claudeDir) {
   const entries = [];
   const skillsDir = path21.join(srcDir, "skills");
-  if (fs14.pathExistsSync(skillsDir)) {
-    for (const skillName of fs14.readdirSync(skillsDir)) {
+  if (fs15.pathExistsSync(skillsDir)) {
+    for (const skillName of fs15.readdirSync(skillsDir)) {
       const skillFile = path21.join(skillsDir, skillName, "SKILL.md");
-      if (fs14.pathExistsSync(skillFile)) {
+      if (fs15.pathExistsSync(skillFile)) {
         entries.push({
           stableId: `skill.${skillName}`,
           srcRelPath: path21.join("library", "global", "skills", skillName, "SKILL.md"),
@@ -3219,8 +3363,8 @@ function collectSourceFiles(srcDir, claudeDir) {
     }
   }
   const commandsDir = path21.join(srcDir, "commands");
-  if (fs14.pathExistsSync(commandsDir)) {
-    for (const fileName of fs14.readdirSync(commandsDir)) {
+  if (fs15.pathExistsSync(commandsDir)) {
+    for (const fileName of fs15.readdirSync(commandsDir)) {
       if (!fileName.endsWith(".md")) continue;
       const commandName = fileName.slice(0, -".md".length);
       entries.push({
@@ -3270,7 +3414,7 @@ async function applyInstall(options = {}) {
       }
       continue;
     }
-    const destExists = fs14.pathExistsSync(entry.destPath);
+    const destExists = fs15.pathExistsSync(entry.destPath);
     if (destExists) {
       const currentContent = await readText(entry.destPath);
       if (currentContent !== void 0) {
@@ -3317,13 +3461,13 @@ async function applyInstall(options = {}) {
     const currentDestPaths = new Set(sourceFiles.map((f) => f.destPath));
     for (const entry of existingManifest.files) {
       if (currentDestPaths.has(entry.destPath)) continue;
-      if (!fs14.pathExistsSync(entry.destPath)) continue;
+      if (!fs15.pathExistsSync(entry.destPath)) continue;
       const content2 = await readText(entry.destPath);
       if (!content2) continue;
       const hasHeader = parseMarkdownHeader(content2) !== void 0;
       const currentHash = hashContent(content2);
       if (hasHeader && currentHash === entry.hash) {
-        if (!dryRun) await fs14.remove(entry.destPath);
+        if (!dryRun) await fs15.remove(entry.destPath);
         result.deleted.push(entry.destPath);
       } else {
         warn(`Orphaned file ${entry.destPath} was user-modified \u2014 leaving in place`);
@@ -3447,35 +3591,128 @@ async function runScan(options) {
 
 // src/commands/undo.ts
 import path22 from "path";
-import fs15 from "fs-extra";
-var CLAUDE_DIR = ".claude";
+import fs16 from "fs-extra";
+
+// src/claude/managed-paths.ts
+var PROJECT_MANAGED_CLAUDE_REL = [
+  "rules/haus.md",
+  "rules/security.md",
+  "commands/haus-doctor.md",
+  "commands/haus-review.md"
+];
+var PROJECT_MANAGED_HAUS_REL = [
+  "selected-context.json",
+  "haus.lock.json",
+  "config.json"
+];
+function coreManagedAbsolutePaths(root) {
+  const claude = PROJECT_MANAGED_CLAUDE_REL.map((rel) => claudePath(root, rel));
+  const haus = PROJECT_MANAGED_HAUS_REL.map((rel) => hausPath(root, rel));
+  return [...claude, ...haus];
+}
+
+// src/commands/undo.ts
+async function collectManagedPaths(root) {
+  const paths = new Set(coreManagedAbsolutePaths(root));
+  const lock = await readJson(hausPath(root, "haus.lock.json"));
+  for (const row of lock ?? []) {
+    for (const rel of row.paths ?? []) {
+      paths.add(path22.resolve(root, rel));
+    }
+  }
+  const existing = [];
+  for (const abs of paths) {
+    if (await fs16.pathExists(abs)) existing.push(abs);
+  }
+  return existing;
+}
+async function settingsHasHausContent(root) {
+  const settingsPath = claudePath(root, "settings.json");
+  if (!await fs16.pathExists(settingsPath)) return false;
+  const settings = await readProjectSettings(root);
+  return settings._haus != null;
+}
+async function claudeMdHasHausBlock(root) {
+  const filePath = path22.join(root, "CLAUDE.md");
+  if (!await fs16.pathExists(filePath)) return false;
+  const text = await fs16.readFile(filePath, "utf8");
+  return text.includes(BLOCK_BEGIN);
+}
+async function stripProjectSettings(root) {
+  const settingsPath = claudePath(root, "settings.json");
+  if (!await fs16.pathExists(settingsPath)) return false;
+  let settings = await readProjectSettings(root);
+  settings = stripHausAllow(stripHausDeny(stripHausHooks(settings)));
+  const hasContent = Object.keys(settings).length > 0;
+  if (hasContent) {
+    await writeProjectSettings(root, settings);
+    log(`Stripped haus rules from ${path22.relative(root, settingsPath)} (user settings preserved).`);
+    return true;
+  }
+  await fs16.remove(settingsPath);
+  log(`Removed ${path22.relative(root, settingsPath)} (no user-owned settings remained).`);
+  return true;
+}
+async function stripRootClaudeMd(root) {
+  const filePath = path22.join(root, "CLAUDE.md");
+  if (!await fs16.pathExists(filePath)) return false;
+  const prev = await fs16.readFile(filePath, "utf8");
+  if (!prev.includes(BLOCK_BEGIN)) return false;
+  const next = stripHausBlock(prev);
+  if (next.length === 0) {
+    await fs16.remove(filePath);
+    log("Removed CLAUDE.md (only contained haus import block).");
+  } else {
+    await fs16.writeFile(filePath, next, "utf8");
+    log("Removed haus import block from CLAUDE.md (user content preserved).");
+  }
+  return true;
+}
+async function pruneDirIfEmpty(dir) {
+  if (!await fs16.pathExists(dir)) return;
+  const entries = await fs16.readdir(dir);
+  if (entries.length === 0) await fs16.remove(dir);
+}
 async function runUndo(options) {
   const root = process.cwd();
-  const targets = [path22.join(root, CLAUDE_DIR), path22.join(root, HAUS_DIR)];
-  const existing = targets.filter((p) => fs15.existsSync(p));
-  if (existing.length === 0) {
-    log("Nothing to remove: no .claude/ or .haus-workflow/ in this directory.");
+  const managed = await collectManagedPaths(root);
+  const stripSettings = await settingsHasHausContent(root);
+  const stripClaudeMd = await claudeMdHasHausBlock(root);
+  if (managed.length === 0 && !stripSettings && !stripClaudeMd) {
+    log("Nothing to remove: no haus-managed files found in this directory.");
     return;
   }
+  const relTargets = managed.map((p) => path22.relative(root, p));
+  const summaryParts = [...relTargets];
+  if (stripSettings) summaryParts.push(".claude/settings.json (haus rules only)");
+  if (stripClaudeMd) summaryParts.push("CLAUDE.md (haus import block only)");
   if (!options.yes) {
     const ok = await confirm(
-      `Remove ${existing.map((p) => path22.relative(root, p)).join(" and ")}? This cannot be undone.`
+      `Remove haus-managed files?
+  ${summaryParts.join("\n  ")}
+User-owned .claude/ files will be preserved.`
     );
     if (!ok) {
       log("Cancelled.");
       return;
     }
   }
-  for (const p of existing) {
-    await fs15.remove(p);
-    log(`Removed ${path22.relative(root, p)}`);
+  for (const abs of managed) {
+    if (!await fs16.pathExists(abs)) continue;
+    await fs16.remove(abs);
+    log(`Removed ${path22.relative(root, abs)}`);
   }
+  if (stripSettings) await stripProjectSettings(root);
+  if (stripClaudeMd) await stripRootClaudeMd(root);
+  await pruneDirIfEmpty(claudePath(root));
+  await pruneDirIfEmpty(hausPath(root));
+  log("haus undo complete. Scan artifacts under .haus-workflow/ were left in place.");
 }
 
 // src/install/uninstall.ts
 import crypto3 from "crypto";
 import path23 from "path";
-import fs16 from "fs-extra";
+import fs17 from "fs-extra";
 async function runUninstall(options = {}) {
   const { force = false } = options;
   const manifest = await readManifest();
@@ -3485,7 +3722,7 @@ async function runUninstall(options = {}) {
     return result;
   }
   for (const entry of manifest.files) {
-    const exists = fs16.pathExistsSync(entry.destPath);
+    const exists = fs17.pathExistsSync(entry.destPath);
     if (!exists) continue;
     const content2 = await readText(entry.destPath);
     if (content2 === void 0) continue;
@@ -3503,7 +3740,7 @@ async function runUninstall(options = {}) {
       result.skipped.push(entry.destPath);
       continue;
     }
-    await fs16.remove(entry.destPath);
+    await fs17.remove(entry.destPath);
     await pruneEmptyDir(path23.dirname(entry.destPath));
     result.deleted.push(entry.destPath);
   }
@@ -3512,13 +3749,13 @@ async function runUninstall(options = {}) {
   await writeSettings(stripped);
   result.hooksStripped = true;
   const hausDir = path23.join(globalClaudeDir(), "haus");
-  const manifestPath = hausManifestPath();
-  if (fs16.pathExistsSync(manifestPath)) {
-    await fs16.remove(manifestPath);
+  const manifestPath2 = hausManifestPath();
+  if (fs17.pathExistsSync(manifestPath2)) {
+    await fs17.remove(manifestPath2);
   }
-  if (fs16.pathExistsSync(hausDir)) {
-    const remaining = await fs16.readdir(hausDir);
-    if (remaining.length === 0) await fs16.remove(hausDir);
+  if (fs17.pathExistsSync(hausDir)) {
+    const remaining = await fs17.readdir(hausDir);
+    if (remaining.length === 0) await fs17.remove(hausDir);
   }
   return result;
 }
@@ -3537,8 +3774,8 @@ function printUninstallResult(result) {
 }
 async function pruneEmptyDir(dir) {
   try {
-    const entries = await fs16.readdir(dir);
-    if (entries.length === 0) await fs16.remove(dir);
+    const entries = await fs17.readdir(dir);
+    if (entries.length === 0) await fs17.remove(dir);
   } catch {
   }
 }
@@ -3640,10 +3877,11 @@ async function runUpdate(options) {
   if (options.check) {
     const pkgJson2 = await readJson(path25.join(packageRoot(), "package.json"));
     const currentVersion2 = pkgJson2?.version ?? "0.0.0";
-    const [status, npmVersion, latestCatalogTag] = await Promise.all([
+    const [status, npmVersion, latestCatalogTag, globalInstallDrift] = await Promise.all([
       checkLock(root),
       fetchNpmVersionStatus(currentVersion2),
-      fetchLatestCatalogTag()
+      fetchLatestCatalogTag(),
+      detectGlobalInstallDrift()
     ]);
     const installedRef = status.catalogRef ?? "main";
     const catalogRefBehind = latestCatalogTag !== null && installedRef !== latestCatalogTag ? `installed from ${installedRef}, latest tag is ${latestCatalogTag}` : false;
@@ -3654,6 +3892,7 @@ async function runUpdate(options) {
           installedCatalogRef: installedRef,
           latestCatalogTag,
           catalogRefBehind,
+          globalInstallDrift,
           localOverrides: await hasLocalOverrides(root),
           summary: diffGeneratedFiles(),
           npmVersion
@@ -3675,7 +3914,7 @@ async function runUpdate(options) {
     log(`npm package up to date: ${currentVersion}`);
   }
   if (await hasLocalOverrides(root)) {
-    log("Local .claude overrides detected. Preserving local files; only lockfile updated.");
+    log("Existing .claude/settings.json \u2014 haus rules will be merged, not replaced.");
   }
   const { before, after } = await applyLock(root);
   log(diffLock(before, after));
@@ -3691,11 +3930,53 @@ async function runUpdate(options) {
   if (sync.failed.length > 0) {
     warn(`Failed to fetch ${sync.failed.length} item(s): ${sync.failed.join(", ")}`);
   }
+  await refreshGlobalInstall();
+  await refreshProjectFiles(root);
   log("Update applied with backup in .haus-workflow/backups/. Run haus doctor.");
 }
+async function refreshProjectFiles(root) {
+  log("Refreshing project .claude/ files...");
+  try {
+    const files = await refreshProjectApply(root);
+    if (files.length === 0) {
+      log("No prior haus project setup detected \u2014 skipped project re-apply.");
+      return;
+    }
+    log(`Project refreshed: ${files.length} managed path(s) updated.`);
+  } catch (err) {
+    warn(`Could not refresh project files: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+async function refreshGlobalInstall() {
+  log("Refreshing ~/.claude/ global files...");
+  try {
+    const result = await applyInstall({});
+    const total = result.created.length + result.updated.length;
+    if (total > 0) {
+      log(`~/.claude refreshed: ${result.created.length} added, ${result.updated.length} updated.`);
+    } else {
+      log("~/.claude already up to date.");
+    }
+    if (result.skipped.length > 0) {
+      log(
+        `Preserved ${result.skipped.length} locally-edited file(s) (run \`haus install --force\` to overwrite).`
+      );
+    }
+  } catch (err) {
+    warn(`Could not refresh ~/.claude/: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+async function detectGlobalInstallDrift() {
+  try {
+    const result = await applyInstall({ check: true });
+    return result.drift;
+  } catch {
+    return null;
+  }
+}
 
 // src/commands/validate-catalog.ts
-import fs17 from "fs";
+import fs18 from "fs";
 import path26 from "path";
 function auditForbiddenStacks(items) {
   const failures = [];
@@ -3767,20 +4048,20 @@ function auditShippedFiles(manifestDir, items) {
     const absPath = path26.join(manifestDir, item.path);
     if (item.type === "skill") {
       const skillMd = path26.join(absPath, "SKILL.md");
-      if (!fs17.existsSync(skillMd)) {
+      if (!fs18.existsSync(skillMd)) {
         failures.push(`${item.id}: missing ${path26.relative(manifestDir, skillMd)}`);
         continue;
       }
-      const text = fs17.readFileSync(skillMd, "utf8");
+      const text = fs18.readFileSync(skillMd, "utf8");
       for (const section of REQUIRED_SKILL_SECTIONS) {
         if (!text.includes(section)) failures.push(`${item.id}: SKILL.md missing ${section}`);
       }
     } else if (item.type === "agent") {
-      if (!fs17.existsSync(absPath)) {
+      if (!fs18.existsSync(absPath)) {
         failures.push(`${item.id}: missing agent file ${item.path}`);
         continue;
       }
-      const text = fs17.readFileSync(absPath, "utf8");
+      const text = fs18.readFileSync(absPath, "utf8");
       if (!text.startsWith("---")) failures.push(`${item.id}: agent file missing YAML frontmatter`);
       for (const section of REQUIRED_AGENT_SECTIONS) {
         if (!text.includes(section)) failures.push(`${item.id}: agent file missing ${section}`);
@@ -3791,7 +4072,7 @@ function auditShippedFiles(manifestDir, items) {
           failures.push(`${item.id}: agent file contains disallowed phrase "${phrase}"`);
       }
     } else if (item.type === "template") {
-      if (!fs17.existsSync(absPath)) {
+      if (!fs18.existsSync(absPath)) {
         failures.push(`${item.id}: missing template file ${item.path}`);
       }
     }
@@ -3803,9 +4084,9 @@ function auditMarkdownContent(manifestDir) {
   const dirs = ["skills", "agents"];
   for (const dir of dirs) {
     const abs = path26.join(manifestDir, dir);
-    if (!fs17.existsSync(abs)) continue;
+    if (!fs18.existsSync(abs)) continue;
     walkMd(abs, (file) => {
-      const text = fs17.readFileSync(file, "utf8");
+      const text = fs18.readFileSync(file, "utf8");
       const rel = path26.relative(manifestDir, file);
       const lines = text.split(/\r?\n/);
       for (let i = 0; i < lines.length; i++) {
@@ -3825,19 +4106,19 @@ function auditMarkdownContent(manifestDir) {
   return failures;
 }
 function walkMd(dir, fn) {
-  for (const entry of fs17.readdirSync(dir, { withFileTypes: true })) {
+  for (const entry of fs18.readdirSync(dir, { withFileTypes: true })) {
     const full = path26.join(dir, entry.name);
     if (entry.isDirectory()) walkMd(full, fn);
     else if (entry.name.endsWith(".md")) fn(full);
   }
 }
-async function runValidateCatalog(manifestPath) {
-  if (!manifestPath) {
+async function runValidateCatalog(manifestPath2) {
+  if (!manifestPath2) {
     error("Usage: haus validate-catalog <path/to/manifest.json>");
     process.exitCode = 1;
     return;
   }
-  const abs = path26.resolve(process.cwd(), manifestPath);
+  const abs = path26.resolve(process.cwd(), manifestPath2);
   const manifestDir = path26.dirname(abs);
   const data = await readJson(abs);
   if (!data?.items) {
@@ -3867,77 +4148,665 @@ async function runValidateCatalog(manifestPath) {
 }
 
 // src/commands/workspace.ts
+import { existsSync as existsSync4, statSync as statSync2 } from "fs";
+import path33 from "path";
+
+// src/commands/workspace/aggregate.ts
+async function writeWorkspaceArtifacts(workspaceRoot, repos, relationships = []) {
+  const summaries = repos.map((repo) => ({
+    name: repo.name,
+    path: repo.path,
+    roles: repo.context.repoRoles ?? [],
+    packageManager: repo.context.packageManager,
+    deps: repo.context.dependencies ?? []
+  }));
+  const ownership = {};
+  for (const repo of summaries) {
+    for (const dep2 of repo.deps) {
+      ownership[dep2] ??= [];
+      ownership[dep2].push(repo.name);
+    }
+  }
+  const roles = [...new Set(summaries.flatMap((r) => r.roles))].sort();
+  const crossRepoHints = [...new Set(repos.flatMap((r) => r.context.crossRepoHints ?? []))].sort();
+  const summaryPath = hausPath(workspaceRoot, "workspace-summary.json");
+  const ownershipPath = hausPath(workspaceRoot, "dependency-ownership-map.json");
+  const crossRepoPath = hausPath(workspaceRoot, "cross-repo-summary.md");
+  const contextMapPath = hausPath(workspaceRoot, "workspace-context-map.json");
+  await writeJson(summaryPath, {
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    repos: summaries
+  });
+  await writeJson(ownershipPath, ownership);
+  await writeText(
+    crossRepoPath,
+    `# Cross Repo Summary
+
+${summaries.map(
+      (repo) => `- ${repo.name} (${repo.path}) roles: ${repo.roles.join(", ") || "unknown"}; package manager: ${repo.packageManager}`
+    ).join("\n")}
+`
+  );
+  await writeJson(contextMapPath, {
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    roles,
+    crossRepoHints,
+    repos: summaries.map((r) => ({
+      name: r.name,
+      path: r.path,
+      roles: r.roles,
+      packageManager: r.packageManager
+    })),
+    relationships
+  });
+  return [summaryPath, ownershipPath, crossRepoPath, contextMapPath];
+}
+
+// src/commands/workspace/config.ts
 import path27 from "path";
 import YAML from "yaml";
-async function runWorkspace(action) {
-  if (action === "init") {
-    await writeText(
-      "haus.workspace.yaml",
-      `client: unknown
-repos:
-  - name: current
-    path: .
-    role: auto
-relationships: []
-`
+var WORKSPACE_FILE = "haus.workspace.yaml";
+function parseWorkspaceConfig(text) {
+  if (!text) return void 0;
+  let parsed;
+  try {
+    parsed = YAML.parse(text);
+  } catch {
+    return void 0;
+  }
+  if (!parsed || typeof parsed !== "object") return void 0;
+  const obj = parsed;
+  const repos = Array.isArray(obj.repos) ? obj.repos.filter(
+    (r) => typeof r === "object" && r !== null && typeof r.name === "string" && typeof r.path === "string"
+  ) : [];
+  return {
+    client: typeof obj.client === "string" ? obj.client : "unknown",
+    repos,
+    relationships: Array.isArray(obj.relationships) ? obj.relationships : []
+  };
+}
+async function readWorkspaceConfig(workspaceRoot) {
+  return parseWorkspaceConfig(await readText(path27.join(workspaceRoot, WORKSPACE_FILE)));
+}
+
+// src/commands/workspace/discover.ts
+import path28 from "path";
+import fg3 from "fast-glob";
+import YAML2 from "yaml";
+var DEFAULT_MAX_DEPTH = 3;
+var REPO_MARKERS = ["**/.git", "**/package.json", "**/composer.json"];
+var IGNORE = [
+  "**/node_modules/**",
+  "**/.git/**",
+  "**/vendor/**",
+  "**/dist/**",
+  "**/.haus-workflow/**"
+];
+function isDescendant(child, ancestor) {
+  if (ancestor === ".") return child !== ".";
+  return child === ancestor ? false : child.startsWith(`${ancestor}/`);
+}
+async function discoverRepos(workspaceRoot, maxDepth = DEFAULT_MAX_DEPTH) {
+  const matches = await fg3(REPO_MARKERS, {
+    cwd: workspaceRoot,
+    dot: true,
+    onlyFiles: false,
+    deep: maxDepth,
+    followSymbolicLinks: false,
+    ignore: IGNORE
+  });
+  const gitDirs = /* @__PURE__ */ new Set();
+  const manifestDirs = /* @__PURE__ */ new Set();
+  for (const match of matches) {
+    const base = path28.posix.basename(match);
+    const dir = path28.posix.dirname(match);
+    const owner = dir === "." ? "." : dir;
+    if (base === ".git") gitDirs.add(owner);
+    else manifestDirs.add(owner);
+  }
+  const repoRoots = [...gitDirs];
+  const manifestSorted = [...manifestDirs].sort(
+    (a, b) => a.split("/").length - b.split("/").length || a.localeCompare(b)
+  );
+  for (const dir of manifestSorted) {
+    if (gitDirs.has(dir)) continue;
+    if (repoRoots.some((root) => isDescendant(dir, root))) continue;
+    repoRoots.push(dir);
+  }
+  repoRoots.sort((a, b) => a.localeCompare(b));
+  return mapWithConcurrency(repoRoots, async (relDir) => {
+    const absDir = path28.resolve(workspaceRoot, relDir);
+    const pkg = await readJson(path28.join(absDir, "package.json"));
+    const name = typeof pkg?.name === "string" && pkg.name.length > 0 ? pkg.name : path28.basename(relDir === "." ? workspaceRoot : absDir);
+    let role = "auto";
+    try {
+      const scan = await scanProject(absDir, "fast");
+      if (scan.repoRoles[0]) role = scan.repoRoles[0];
+    } catch {
+    }
+    return { name, path: relDir === "." ? "." : relDir, role };
+  });
+}
+function mergeWorkspaceConfig(existing, discovered, opts = {}) {
+  const existingRepos = existing?.repos ?? [];
+  const byPath = new Map(existingRepos.map((r) => [r.path, r]));
+  for (const repo of discovered) {
+    if (!byPath.has(repo.path)) {
+      byPath.set(repo.path, { name: repo.name, path: repo.path, role: repo.role });
+    }
+  }
+  const ordered = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const repo of existingRepos) {
+    ordered.push(byPath.get(repo.path));
+    seen.add(repo.path);
+  }
+  for (const repo of discovered) {
+    if (seen.has(repo.path)) continue;
+    ordered.push(byPath.get(repo.path));
+    seen.add(repo.path);
+  }
+  return {
+    client: opts.client ?? existing?.client ?? "unknown",
+    repos: ordered,
+    relationships: existing?.relationships ?? []
+  };
+}
+function renderWorkspaceYaml(config2) {
+  return YAML2.stringify({
+    client: config2.client,
+    repos: config2.repos.map((r) => ({ name: r.name, path: r.path, role: r.role ?? "auto" })),
+    relationships: config2.relationships
+  });
+}
+async function runDiscover(workspaceRoot, opts = {}) {
+  const yamlPath = path28.join(workspaceRoot, "haus.workspace.yaml");
+  const existingText = await readText(yamlPath);
+  const existing = parseWorkspaceConfig(existingText);
+  if (existingText && !existing) {
+    error(
+      "Existing haus.workspace.yaml is malformed \u2014 fix or remove it before running discover (refusing to overwrite)."
     );
-    log("Workspace initialized.");
+    process.exitCode = 1;
     return;
   }
-  const configText = await readText("haus.workspace.yaml");
-  if (!configText) {
-    error("Missing haus.workspace.yaml. Run `haus workspace init` first.");
+  const discovered = await discoverRepos(workspaceRoot, opts.maxDepth ?? DEFAULT_MAX_DEPTH);
+  if (discovered.length === 0) {
+    error("No repos discovered under the workspace root.");
     process.exitCode = 1;
     return;
   }
-  const config2 = YAML.parse(configText);
-  const repos = config2.repos ?? [];
-  if (repos.length === 0) {
-    error("No repos configured in haus.workspace.yaml.");
-    process.exitCode = 1;
+  const merged = mergeWorkspaceConfig(existing, discovered, { client: opts.client });
+  const yamlText = renderWorkspaceYaml(merged);
+  if (opts.json) {
+    log(JSON.stringify({ discovered, config: merged }, null, 2));
+  }
+  if (opts.write) {
+    await writeText(yamlPath, yamlText);
+    log(`Wrote ${merged.repos.length} repo(s) to haus.workspace.yaml`);
     return;
   }
-  const summaries = [];
-  const ownership = {};
-  for (const repo of repos) {
-    const repoRoot = path27.resolve(process.cwd(), repo.path);
-    const result = await scanProject(repoRoot, "fast");
-    summaries.push({
+  if (!opts.json) {
+    log("Proposed haus.workspace.yaml (run with --write to persist):\n");
+    log(yamlText);
+  }
+}
+
+// src/commands/workspace/doctor.ts
+import { existsSync as existsSync2 } from "fs";
+import path30 from "path";
+
+// src/commands/workspace/manifest.ts
+import { readFileSync as readFileSync3 } from "fs";
+import path29 from "path";
+var MANIFEST_FILE = "workspace.manifest.json";
+function manifestPath(workspaceRoot) {
+  return hausPath(workspaceRoot, MANIFEST_FILE);
+}
+function hausVersion() {
+  try {
+    const pkg = JSON.parse(readFileSync3(path29.join(packageRoot(), "package.json"), "utf8"));
+    return pkg.version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+function buildManifest2(opts) {
+  const now = opts.now ?? (/* @__PURE__ */ new Date()).toISOString();
+  const version = opts.version ?? hausVersion();
+  return {
+    version: 1,
+    generatedAt: now,
+    hausVersion: version,
+    client: opts.client,
+    repos: opts.repos.map((repo) => ({
       name: repo.name,
       path: repo.path,
-      roles: result.repoRoles,
-      packageManager: result.packageManager,
-      deps: result.dependencies
+      role: repo.role,
+      lastSetupAt: repo.lastSetupAt !== void 0 ? repo.lastSetupAt : repo.status === "ok" ? now : null,
+      hausVersionAtSetup: repo.hausVersionAtSetup !== void 0 ? repo.hausVersionAtSetup : repo.status === "ok" ? version : null,
+      lockItemCount: repo.lockItemCount,
+      catalogRef: repo.catalogRef,
+      status: repo.status,
+      ...repo.error ? { error: repo.error } : {}
+    }))
+  };
+}
+async function readManifest2(workspaceRoot) {
+  return readJson(manifestPath(workspaceRoot));
+}
+async function writeWorkspaceManifest(workspaceRoot, manifest) {
+  const target = manifestPath(workspaceRoot);
+  await writeJson(target, manifest);
+  return target;
+}
+
+// src/commands/workspace/doctor.ts
+async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
+  const config2 = await readWorkspaceConfig(workspaceRoot);
+  const manifest = await readManifest2(workspaceRoot);
+  const currentVersion = hausVersion();
+  const drift = [];
+  const detail = [];
+  const ok = (text) => detail.push({ stream: "log", text });
+  const flag = (item) => {
+    drift.push(item);
+    detail.push({ stream: "warn", text: `- ${item.repo}: ${item.detail}` });
+  };
+  if (!config2) {
+    flag({
+      repo: "(workspace)",
+      kind: "no-config",
+      detail: "Missing or malformed haus.workspace.yaml \u2014 run `haus workspace discover --write` or `init`."
     });
-    for (const dep2 of result.dependencies) {
-      ownership[dep2] ??= [];
-      ownership[dep2].push(repo.name);
+    return emit({ workspaceRoot, manifest, drift, detail, json: opts.json });
+  }
+  if (!manifest) {
+    flag({
+      repo: "(workspace)",
+      kind: "no-manifest",
+      detail: "No workspace.manifest.json \u2014 run `haus workspace setup --write` first."
+    });
+    return emit({ workspaceRoot, manifest, drift, detail, json: opts.json });
+  }
+  const manifestByName = new Map(manifest.repos.map((r) => [r.name, r]));
+  for (const repo of config2.repos) {
+    const repoRoot = path30.resolve(workspaceRoot, repo.path);
+    const entry = manifestByName.get(repo.name);
+    if (!entry) {
+      flag({
+        repo: repo.name,
+        kind: "missing-from-manifest",
+        detail: "Configured in yaml but absent from the manifest \u2014 run `haus workspace setup --write`."
+      });
+      continue;
+    }
+    const driftBefore = drift.length;
+    if (entry.status === "failed") {
+      flag({
+        repo: repo.name,
+        kind: "failed",
+        detail: `Last setup failed${entry.error ? `: ${entry.error}` : ""}.`
+      });
+    }
+    if (entry.hausVersionAtSetup && entry.hausVersionAtSetup !== currentVersion) {
+      flag({
+        repo: repo.name,
+        kind: "version-mismatch",
+        detail: `Set up at haus ${entry.hausVersionAtSetup}, current is ${currentVersion} \u2014 re-run setup.`
+      });
+    }
+    if (!existsSync2(claudePath(repoRoot))) {
+      flag({
+        repo: repo.name,
+        kind: "missing-claude",
+        detail: "Missing .claude/ \u2014 run `haus workspace setup --write`."
+      });
+    }
+    const lock = await checkLock(repoRoot);
+    if (!existsSync2(hausPath(repoRoot, "haus.lock.json"))) {
+      flag({
+        repo: repo.name,
+        kind: "missing-lock",
+        detail: "Missing .haus-workflow/haus.lock.json \u2014 run `haus workspace setup --write`."
+      });
+    } else if (lock.count > 0 && !lock.ok) {
+      flag({
+        repo: repo.name,
+        kind: "invalid-lock",
+        detail: "haus.lock.json present but invalid \u2014 re-run `haus workspace setup --write`."
+      });
+    }
+    if (drift.length === driftBefore) {
+      ok(`- ${repo.name}: OK (${lock.count} lock item(s))`);
     }
   }
-  await writeJson(".haus-workflow/workspace-summary.json", {
-    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    repos: summaries
-  });
-  await writeJson(".haus-workflow/dependency-ownership-map.json", ownership);
-  await writeText(
-    ".haus-workflow/cross-repo-summary.md",
-    `# Cross Repo Summary
+  return emit({ workspaceRoot, manifest, drift, detail, json: opts.json });
+}
+function emit(args) {
+  const { workspaceRoot, manifest, drift, detail } = args;
+  if (args.json) {
+    log(JSON.stringify({ manifest: manifest ?? null, drift }, null, 2));
+  } else {
+    if (drift.length === 0) {
+      log("\u2705 Workspace is set up and healthy.");
+    } else {
+      log(`\u26A0\uFE0F ${drift.length} workspace drift item(s) need attention:`);
+    }
+    log("Haus Workspace Doctor");
+    for (const line2 of detail) {
+      if (line2.stream === "warn") warn(line2.text);
+      else log(line2.text);
+    }
+  }
+  if (drift.length > 0) process.exitCode = 1;
+  return { workspaceRoot, manifest, drift };
+}
 
-${summaries.map(
-      (repo) => `- ${repo.name} (${repo.path}) roles: ${repo.roles.join(", ") || "unknown"}; package manager: ${repo.packageManager}`
-    ).join("\n")}
+// src/commands/workspace/setup.ts
+import { existsSync as existsSync3, statSync } from "fs";
+import path32 from "path";
+
+// src/claude/write-workspace-claude-md.ts
+import path31 from "path";
+import fs19 from "fs-extra";
+function buildWorkspaceImportBlock(client, members) {
+  const memberLines = members.map((m) => `- ${m.name} (${m.path})`);
+  const body = [
+    "@.haus-workflow/cross-repo-summary.md",
+    "",
+    `# Workspace: ${client}`,
+    "",
+    "Member repos:",
+    ...memberLines
+  ].join("\n");
+  return `${BLOCK_BEGIN}
+${body}
+${BLOCK_END}`;
+}
+async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
+  const block = buildWorkspaceImportBlock(opts.client, opts.members);
+  const dryRun = opts.dryRun ?? false;
+  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path31.join(workspaceRoot, "CLAUDE.md");
+  const prev = await fs19.pathExists(filePath) ? await fs19.readFile(filePath, "utf8") : "";
+  const next = opts.collision ? `${block}
+` : injectHausBlock(prev, block);
+  const printable = displayPath(workspaceRoot, filePath);
+  if (dryRun) {
+    if (!prev) {
+      log(createUnifiedDiff(printable, "", next));
+    } else if (hasTextChanged(prev, next)) {
+      log(createUnifiedDiff(printable, prev, next));
+    } else {
+      log(`${printable}: unchanged`);
+    }
+    return filePath;
+  }
+  if (hasTextChanged(prev, next) && prev.length > 0) {
+    const diffText = createUnifiedDiff(printable, prev, next);
+    const summary = summarizeDiff(diffText);
+    log(`Overwriting ${printable} (diff +${summary.additions} -${summary.deletions})`);
+  }
+  await writeText(filePath, next);
+  return filePath;
+}
+
+// src/commands/workspace/setup.ts
+function resolveWorkspaceRoot(start = process.cwd()) {
+  let dir = path32.resolve(start);
+  for (; ; ) {
+    if (existsSync3(path32.join(dir, WORKSPACE_FILE))) return dir;
+    const parent = path32.dirname(dir);
+    if (parent === dir) return path32.resolve(start);
+    dir = parent;
+  }
+}
+function isRootRepo(workspaceRoot, repoPath) {
+  return path32.resolve(workspaceRoot, repoPath) === path32.resolve(workspaceRoot);
+}
+async function runWorkspaceSetup(workspaceRoot, options = {}) {
+  const mode = options.mode ?? "fast";
+  const apply = options.write ?? false;
+  const configText = await readText(path32.join(workspaceRoot, WORKSPACE_FILE));
+  if (!configText) {
+    error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
+    process.exitCode = 1;
+    return { workspaceRoot, statuses: [], written: [] };
+  }
+  const config2 = parseWorkspaceConfig(configText);
+  if (!config2 || config2.repos.length === 0) {
+    error(`No repos configured in ${WORKSPACE_FILE}.`);
+    process.exitCode = 1;
+    return { workspaceRoot, statuses: [], written: [] };
+  }
+  const onlySet = options.only && options.only.length > 0 ? new Set(options.only) : void 0;
+  const repos = onlySet ? config2.repos.filter((r) => onlySet.has(r.name)) : config2.repos;
+  const statuses = [];
+  const aggregateInputs = [];
+  for (const repo of repos) {
+    const repoRoot = path32.resolve(workspaceRoot, repo.path);
+    log(`
+\u2192 ${repo.name} (${repo.path})`);
+    try {
+      if (!existsSync3(repoRoot) || !statSync(repoRoot).isDirectory()) {
+        throw new Error(`Repo path is not a directory: ${repo.path}`);
+      }
+      const res = await runSetupCore(repoRoot, {
+        mode,
+        json: options.json,
+        apply,
+        dryRun: options.dryRun
+      });
+      statuses.push({
+        name: repo.name,
+        path: repo.path,
+        root: repoRoot,
+        status: "ok",
+        roles: res.roles,
+        recommendedCount: res.recommendedCount
+      });
+      const context = await readContextOrScan(repoRoot);
+      aggregateInputs.push({ name: repo.name, path: repo.path, context });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      statuses.push({
+        name: repo.name,
+        path: repo.path,
+        root: repoRoot,
+        status: "failed",
+        error: message
+      });
+      if (!options.continueOnError) throw err;
+      error(`Setup failed for ${repo.name}: ${message}`);
+    }
+  }
+  const written = [];
+  if (apply && aggregateInputs.length > 0) {
+    const collision = config2.repos.some((r) => isRootRepo(workspaceRoot, r.path));
+    if (!options.dryRun) {
+      const artifacts = await writeWorkspaceArtifacts(
+        workspaceRoot,
+        aggregateInputs,
+        config2.relationships
+      );
+      written.push(...artifacts);
+    }
+    const docPath = await writeWorkspaceClaudeMd(workspaceRoot, {
+      client: config2.client,
+      members: config2.repos.map((r) => ({ name: r.name, path: r.path })),
+      collision,
+      dryRun: options.dryRun
+    });
+    written.push(docPath);
+  }
+  if (apply && !options.dryRun) {
+    const statusByName = new Map(statuses.map((s) => [s.name, s]));
+    const prior = await readManifest2(workspaceRoot);
+    if (!prior && existsSync3(manifestPath(workspaceRoot))) {
+      warn(
+        "Existing workspace.manifest.json is unreadable \u2014 prior per-repo state will not be carried forward."
+      );
+    }
+    const priorByName = new Map((prior?.repos ?? []).map((r) => [r.name, r]));
+    const manifestRepos = [];
+    for (const repo of config2.repos) {
+      const status = statusByName.get(repo.name);
+      const role = repo.role ?? status?.roles?.[0] ?? "auto";
+      if (status?.status === "ok") {
+        const lock = await checkLock(path32.resolve(workspaceRoot, repo.path));
+        manifestRepos.push({
+          name: repo.name,
+          path: repo.path,
+          role,
+          status: "ok",
+          lockItemCount: lock.count,
+          catalogRef: lock.catalogRef
+        });
+      } else if (status?.status === "failed") {
+        manifestRepos.push({
+          name: repo.name,
+          path: repo.path,
+          role,
+          status: "failed",
+          lockItemCount: 0,
+          catalogRef: null,
+          error: status.error
+        });
+      } else {
+        const carried = priorByName.get(repo.name);
+        manifestRepos.push(
+          carried ? {
+            name: carried.name,
+            path: carried.path,
+            role: carried.role,
+            status: carried.status,
+            lockItemCount: carried.lockItemCount,
+            catalogRef: carried.catalogRef,
+            lastSetupAt: carried.lastSetupAt,
+            hausVersionAtSetup: carried.hausVersionAtSetup,
+            ...carried.error ? { error: carried.error } : {}
+          } : {
+            name: repo.name,
+            path: repo.path,
+            role,
+            status: "pending",
+            lockItemCount: 0,
+            catalogRef: null
+          }
+        );
+      }
+    }
+    const manifest = buildManifest2({ client: config2.client, repos: manifestRepos });
+    const manifestFile = await writeWorkspaceManifest(workspaceRoot, manifest);
+    written.push(manifestFile);
+  }
+  const ok = statuses.filter((s) => s.status === "ok").length;
+  const failed = statuses.length - ok;
+  log(`
+Workspace setup complete: ${ok} ok, ${failed} failed.`);
+  return { workspaceRoot, statuses, written };
+}
+
+// src/commands/workspace.ts
+function normalizeOnly(only) {
+  if (!only) return void 0;
+  const list = Array.isArray(only) ? only : only.split(/[\s,]+/);
+  const cleaned = list.map((s) => s.trim()).filter(Boolean);
+  return cleaned.length > 0 ? cleaned : void 0;
+}
+function normalizeMaxDepth(maxDepth) {
+  if (maxDepth === void 0) return void 0;
+  const n = typeof maxDepth === "number" ? maxDepth : Number.parseInt(maxDepth, 10);
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : void 0;
+}
+async function initWorkspace() {
+  await writeText(
+    WORKSPACE_FILE,
+    `client: unknown
+repos:
+  - name: current
+    path: .
+    role: auto
+relationships: []
 `
   );
-  log(
-    "Workspace scan complete. Wrote .haus-workflow/workspace-summary.json, cross-repo-summary.md, dependency-ownership-map.json"
-  );
+  log("Workspace initialized.");
+}
+async function scanWorkspace(workspaceRoot, opts) {
+  const configText = await readText(path33.join(workspaceRoot, WORKSPACE_FILE));
+  if (!configText) {
+    error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
+    process.exitCode = 1;
+    return;
+  }
+  const config2 = parseWorkspaceConfig(configText);
+  if (!config2) {
+    error(
+      `Malformed ${WORKSPACE_FILE}. Fix the YAML or re-run \`haus workspace discover --write\`.`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (config2.repos.length === 0) {
+    error(`No repos configured in ${WORKSPACE_FILE}.`);
+    process.exitCode = 1;
+    return;
+  }
+  const inputs = [];
+  for (const repo of config2.repos) {
+    const repoRoot = path33.resolve(workspaceRoot, repo.path);
+    if (!existsSync4(repoRoot) || !statSync2(repoRoot).isDirectory()) {
+      throw new Error(`Repo path is not a directory: ${repo.path}`);
+    }
+    const result = await scanProject(repoRoot, "fast");
+    inputs.push({ name: repo.name, path: repo.path, context: result });
+  }
+  const written = await writeWorkspaceArtifacts(workspaceRoot, inputs, config2.relationships);
+  if (opts.json) {
+    log(JSON.stringify({ written }, null, 2));
+  } else {
+    log(`Workspace scan complete. Wrote ${written.length} artifact(s) under .haus-workflow/.`);
+  }
+}
+async function runWorkspace(action, options = {}) {
+  if (action === "init") {
+    await initWorkspace();
+    return;
+  }
+  const workspaceRoot = resolveWorkspaceRoot();
+  switch (action) {
+    case "discover":
+      await runDiscover(workspaceRoot, {
+        write: options.write,
+        json: options.json,
+        maxDepth: normalizeMaxDepth(options.maxDepth),
+        client: options.client
+      });
+      return;
+    case "scan":
+      await scanWorkspace(workspaceRoot, { json: options.json });
+      return;
+    case "setup":
+      await runWorkspaceSetup(workspaceRoot, {
+        mode: options.guided ? "guided" : "fast",
+        write: options.write,
+        dryRun: options.dryRun,
+        json: options.json,
+        continueOnError: options.continueOnError,
+        only: normalizeOnly(options.only)
+      });
+      return;
+    case "doctor":
+      await runWorkspaceDoctor(workspaceRoot, { json: options.json });
+      return;
+  }
 }
 
 // src/cli.ts
 function cliVersion() {
   try {
-    const pkgPath = path28.join(packageRoot(), "package.json");
-    const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
+    const pkgPath = path34.join(packageRoot(), "package.json");
+    const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -3946,8 +4815,8 @@ function cliVersion() {
 var program = new Command();
 function validateRuntimeNodeVersion() {
   try {
-    const pkgPath = path28.join(packageRoot(), "package.json");
-    const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
+    const pkgPath = path34.join(packageRoot(), "package.json");
+    const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
     const requiredRange = pkg.engines?.node;
     if (requiredRange && !satisfiesVersion(process.version, requiredRange)) {
       throw new Error(`Node ${process.version} does not satisfy required range ${requiredRange}`);
@@ -3990,7 +4859,10 @@ config.command("disable <key>").description("Disable a hook (hook.context)").act
 config.command("status <key>").description("Show current state of a hook (hook.context)").action((key) => runConfig(key, "status"));
 var workspace = program.command("workspace");
 workspace.command("init").action(() => runWorkspace("init"));
-workspace.command("scan").action(() => runWorkspace("scan"));
+workspace.command("discover").description("Auto-find member repos and write/merge haus.workspace.yaml").option("--write", "Persist haus.workspace.yaml (default previews only)").option("--json", "Output the discovered repos and proposed config as JSON").option("--max-depth <n>", "Max directory depth to traverse (default 3)").option("--client <name>", "Set the workspace client name").action((opts) => runWorkspace("discover", opts));
+workspace.command("scan").description("Aggregate a cross-repo summary from a fast scan of each repo").option("--json", "Output the written artifact paths as JSON").action((opts) => runWorkspace("scan", opts));
+workspace.command("setup").description("Per-repo setup loop + workspace layer + manifest").option("--write", "Apply changes (default previews only)").option("--dry-run", "Preview changes without writing").option("--json", "Emit machine-readable per-repo output").option("--fast", "Skip interactive prompts (default)").option("--guided", "Enable guided Q&A per repo").option("--continue-on-error", "Keep going past a failed repo (default fail-fast)").option("--only <names>", "Restrict to comma-separated repo names").action((opts) => runWorkspace("setup", opts));
+workspace.command("doctor").description("Report workspace drift against the manifest").option("--json", "Output the manifest and drift array as JSON").action((opts) => runWorkspace("doctor", opts));
 program.parseAsync(process.argv).catch((err) => {
   const message = err instanceof Error ? err.message : String(err);
   error(message);