@haus-tech/haus-workflow 0.18.1 → 0.19.0

package/dist/cli.js

@@ -2,13 +2,13 @@
 
 // src/cli.ts
 import { readFileSync as readFileSync4 } from "fs";
-import path34 from "path";
+import path35 from "path";
 import { Command } from "commander";
 
 // src/commands/apply.ts
 import path13 from "path";
 import checkbox from "@inquirer/checkbox";
-import fs11 from "fs-extra";
+import fs12 from "fs-extra";
 
 // src/catalog/remote-catalog.ts
 import os from "os";
@@ -254,6 +254,13 @@ async function writeJson(file, value) {
   await fs2.writeFile(file, `${JSON.stringify(value, null, 2)}
 `, "utf8");
 }
+async function pruneEmptyDir(dir) {
+  try {
+    const entries = await fs2.readdir(dir);
+    if (entries.length === 0) await fs2.remove(dir);
+  } catch {
+  }
+}
 async function readText(file) {
   try {
     return await fs2.readFile(file, "utf8");
@@ -547,8 +554,8 @@ function buildDenyRules() {
   for (const command of DANGEROUS_COMMANDS) {
     rules.push(`Bash(${command}:*)`);
   }
-  for (const path35 of SENSITIVE_PATHS) {
-    const pattern = SENSITIVE_DIRS.has(path35) ? `${path35}/**` : path35;
+  for (const path36 of SENSITIVE_PATHS) {
+    const pattern = SENSITIVE_DIRS.has(path36) ? `${path36}/**` : path36;
     for (const tool of FILE_TOOLS) {
       rules.push(`${tool}(${pattern})`);
     }
@@ -647,7 +654,7 @@ async function applyProjectSettingsMerge(root) {
 
 // src/claude/write-claude-files.ts
 import path12 from "path";
-import fs10 from "fs-extra";
+import fs11 from "fs-extra";
 
 // src/catalog/load-catalog.ts
 import path6 from "path";
@@ -728,6 +735,22 @@ async function hashInstalledPaths(root, relPaths) {
   return hashText(fileDigests.map((f) => `${f.rel}=${f.digest}`).join("|"));
 }
 
+// src/claude/load-hooks-config.ts
+import path8 from "path";
+var CONFIG_PATH = ".haus-workflow/config.json";
+var DEFAULT_HOOKS_CONFIG = {
+  hooks: {
+    context: { enabled: false }
+  }
+};
+async function isHookEnabled(root, key) {
+  const cfg = await readJson(path8.join(root, CONFIG_PATH));
+  return cfg?.hooks?.[key]?.enabled === true;
+}
+
+// src/claude/managed-write.ts
+import fs5 from "fs-extra";
+
 // src/utils/diff.ts
 import { createTwoFilesPatch } from "diff";
 function hasTextChanged(before, after) {
@@ -750,21 +773,35 @@ function summarizeDiff(diffText) {
   return { additions, deletions };
 }
 
-// src/claude/load-hooks-config.ts
-import path8 from "path";
-var CONFIG_PATH = ".haus-workflow/config.json";
-var DEFAULT_HOOKS_CONFIG = {
-  hooks: {
-    context: { enabled: false }
+// src/claude/managed-write.ts
+async function writeManagedText(root, filePath, nextText, dryRun) {
+  const prev = await fs5.pathExists(filePath) ? await fs5.readFile(filePath, "utf8") : "";
+  const printable = displayPath(root, filePath);
+  if (dryRun) {
+    if (!prev) {
+      log(createUnifiedDiff(printable, "", nextText));
+    } else if (hasTextChanged(prev, nextText)) {
+      log(createUnifiedDiff(printable, prev, nextText));
+    } else {
+      log(`${printable}: unchanged`);
+    }
+    return;
   }
-};
-async function isHookEnabled(root, key) {
-  const cfg = await readJson(path8.join(root, CONFIG_PATH));
-  return cfg?.hooks?.[key]?.enabled === true;
+  if (hasTextChanged(prev, nextText) && prev.length > 0) {
+    const diffText = createUnifiedDiff(printable, prev, nextText);
+    const summary = summarizeDiff(diffText);
+    log(`Overwriting ${printable} (diff +${summary.additions} -${summary.deletions})`);
+  }
+  await writeText(filePath, nextText);
+}
+async function writeManagedJson(root, filePath, value, dryRun) {
+  const nextText = `${JSON.stringify(value, null, 2)}
+`;
+  await writeManagedText(root, filePath, nextText, dryRun);
 }
 
 // src/claude/verify-hooks-contract.ts
-import fs5 from "fs-extra";
+import fs6 from "fs-extra";
 
 // src/claude/load-hooks.ts
 var CANONICAL_HOOKS = {
@@ -858,7 +895,7 @@ async function assertPostApplySettingsHausContract(root) {
 }
 async function verifyProjectSettingsHooksContract(root) {
   const settingsPath = claudePath(root, "settings.json");
-  if (!await fs5.pathExists(settingsPath)) {
+  if (!await fs6.pathExists(settingsPath)) {
     return {
       ok: true,
       skipped: true,
@@ -886,7 +923,7 @@ async function verifyProjectSettingsHooksContract(root) {
 
 // src/claude/write-root-claude-md.ts
 import path9 from "path";
-import fs6 from "fs-extra";
+import fs7 from "fs-extra";
 var BLOCK_BEGIN = "<!-- HAUS:BEGIN haus-imports v=1 -->";
 var BLOCK_END = "<!-- HAUS:END haus-imports -->";
 var IMPORT_CONTENT = `@.haus-workflow/WORKFLOW.md
@@ -898,8 +935,9 @@ ${BLOCK_END}`;
 }
 function stripHausBlock(existing) {
   const beginIdx = existing.indexOf(BLOCK_BEGIN);
-  const endIdx = existing.indexOf(BLOCK_END);
-  if (beginIdx === -1 || endIdx === -1 || endIdx <= beginIdx) return existing;
+  if (beginIdx === -1) return existing;
+  const endIdx = existing.indexOf(BLOCK_END, beginIdx + BLOCK_BEGIN.length);
+  if (endIdx === -1) return existing;
   const before = existing.slice(0, beginIdx);
   const after = existing.slice(endIdx + BLOCK_END.length);
   const merged = `${before}${after}`.replace(/\n{3,}/g, "\n\n").trimEnd();
@@ -908,8 +946,8 @@ function stripHausBlock(existing) {
 }
 function injectHausBlock(existing, block) {
   const beginIdx = existing.indexOf(BLOCK_BEGIN);
-  const endIdx = existing.indexOf(BLOCK_END);
-  if (beginIdx !== -1 && endIdx !== -1 && endIdx > beginIdx) {
+  const endIdx = beginIdx === -1 ? -1 : existing.indexOf(BLOCK_END, beginIdx + BLOCK_BEGIN.length);
+  if (beginIdx !== -1 && endIdx !== -1) {
     const before = existing.slice(0, beginIdx);
     const after = existing.slice(endIdx + BLOCK_END.length);
     return `${before}${block}${after}`;
@@ -927,35 +965,19 @@ ${block}
 async function writeRootClaudeMd(root, dryRun) {
   const filePath = path9.join(root, "CLAUDE.md");
   const block = buildImportBlock();
-  const prev = await fs6.pathExists(filePath) ? await fs6.readFile(filePath, "utf8") : "";
+  const prev = await fs7.pathExists(filePath) ? await fs7.readFile(filePath, "utf8") : "";
   const next = injectHausBlock(prev, block);
-  const printable = displayPath(root, filePath);
-  if (dryRun) {
-    if (!prev) {
-      log(createUnifiedDiff(printable, "", next));
-    } else if (hasTextChanged(prev, next)) {
-      log(createUnifiedDiff(printable, prev, next));
-    } else {
-      log(`${printable}: unchanged`);
-    }
-    return filePath;
-  }
-  if (hasTextChanged(prev, next) && prev.length > 0) {
-    const diffText = createUnifiedDiff(printable, prev, next);
-    const summary = summarizeDiff(diffText);
-    log(`Overwriting ${printable} (diff +${summary.additions} -${summary.deletions})`);
-  }
-  await writeText(filePath, next);
+  await writeManagedText(root, filePath, next, dryRun);
   return filePath;
 }
 
 // src/claude/write-workflow-config.ts
 import path11 from "path";
-import fs8 from "fs-extra";
+import fs9 from "fs-extra";
 
 // src/claude/derive-workflow-config.ts
 import path10 from "path";
-import fs7 from "fs-extra";
+import fs8 from "fs-extra";
 function binCmd(pm, bin, args) {
   const tail = args ? ` ${args}` : "";
   if (pm === "yarn") return `yarn ${bin}${tail}`;
@@ -974,7 +996,7 @@ async function deriveWorkflowConfig(root, ctx) {
     return null;
   };
   const hasDep = (name) => deps.has(name);
-  const exists = (rel) => fs7.pathExistsSync(path10.join(root, rel));
+  const exists = (rel) => fs8.pathExistsSync(path10.join(root, rel));
   const hasPlaywright = hasDep("@playwright/test") || stacks.includes("playwright");
   const hasCypress = hasDep("cypress");
   const preCommitTool = exists("lefthook.yml") || exists("lefthook.yaml") ? "lefthook" : exists(".husky") || hasDep("husky") || (scripts.prepare ?? "").includes("husky") ? "husky" : exists(".pre-commit-config.yaml") ? "pre-commit (Python framework)" : null;
@@ -1043,7 +1065,7 @@ var FALLBACK_CONTEXT = {
 async function writeWorkflowConfig(root, dryRun, opts = {}) {
   const destPath = hausPath(root, "workflow-config.md");
   const printable = displayPath(root, destPath);
-  const exists = await fs8.pathExists(destPath);
+  const exists = await fs9.pathExists(destPath);
   if (exists && !opts.refill) {
     if (dryRun) log(printable + ": exists (project-owned, skipping)");
     return null;
@@ -1055,7 +1077,7 @@ async function writeWorkflowConfig(root, dryRun, opts = {}) {
   };
   const values = await deriveWorkflowConfig(root, ctx);
   if (exists) {
-    const current = await fs8.readFile(destPath, "utf8");
+    const current = await fs9.readFile(destPath, "utf8");
     const refilled = refillContent(current, values);
     if (refilled === current) {
       if (dryRun) log(printable + ": no blank fields to refill");
@@ -1077,7 +1099,7 @@ async function writeWorkflowConfig(root, dryRun, opts = {}) {
 }
 
 // src/claude/write-workflow.ts
-import fs9 from "fs-extra";
+import fs10 from "fs-extra";
 
 // src/claude/managed-template.ts
 function normaliseLF(content2) {
@@ -1110,8 +1132,8 @@ async function writeWorkflow(root, pkgVersion, dryRun) {
 ${templateContent}`;
   const destPath = hausPath(root, "WORKFLOW.md");
   const printable = displayPath(root, destPath);
-  if (await fs9.pathExists(destPath)) {
-    const existing = await fs9.readFile(destPath, "utf8");
+  if (await fs10.pathExists(destPath)) {
+    const existing = await fs10.readFile(destPath, "utf8");
     const firstLine = existing.split("\n")[0] ?? "";
     const parsed = parseHausManagedHeader(firstLine);
     if (!parsed) {
@@ -1133,7 +1155,7 @@ ${templateContent}`;
     }
   }
   if (dryRun) {
-    const prev = await fs9.pathExists(destPath) ? await fs9.readFile(destPath, "utf8") : "";
+    const prev = await fs10.pathExists(destPath) ? await fs10.readFile(destPath, "utf8") : "";
     if (!prev) {
       log(createUnifiedDiff(printable, "", next));
     } else {
@@ -1192,7 +1214,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
     await assertPostApplySettingsHausContract(root);
   }
   const configPath = hausPath(root, "config.json");
-  if (!await fs10.pathExists(configPath)) {
+  if (!await fs11.pathExists(configPath)) {
     await writeManagedJson(root, configPath, DEFAULT_HOOKS_CONFIG, dryRun);
   }
   await writeManagedText(
@@ -1242,15 +1264,15 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
     const sourcePath = catalogItemContentPath(contentRoot, manifestItem);
     const target = item.type === "agent" ? "agents" : item.type === "template" ? "templates" : item.type === "command" ? "commands" : "skills";
     const destination = claudePath(root, target, path12.basename(sourcePath));
-    if (await fs10.pathExists(sourcePath)) {
+    if (await fs11.pathExists(sourcePath)) {
       if (dryRun) {
-        const exists = await fs10.pathExists(destination);
+        const exists = await fs11.pathExists(destination);
         log(
           `${displayPath(root, destination)}: ${exists ? "would overwrite" : "would create"} (${item.id})`
         );
       } else {
-        await fs10.ensureDir(path12.dirname(destination));
-        await fs10.copy(sourcePath, destination, { overwrite: true, errorOnExist: false });
+        await fs11.ensureDir(path12.dirname(destination));
+        await fs11.copy(sourcePath, destination, { overwrite: true, errorOnExist: false });
       }
       files.push(destination);
       const current = installedPathsByItem.get(item.id) ?? [];
@@ -1314,7 +1336,7 @@ async function cleanupStaleCatalogItems(root, knownIds, dryRun) {
     if (relPaths.length === 0) continue;
     const existing = [];
     for (const rel of relPaths) {
-      if (await fs10.pathExists(path12.join(root, rel))) existing.push(rel);
+      if (await fs11.pathExists(path12.join(root, rel))) existing.push(rel);
     }
     if (existing.length === 0) continue;
     if (entry.hash === void 0) {
@@ -1336,44 +1358,12 @@ async function cleanupStaleCatalogItems(root, knownIds, dryRun) {
         log(`[dry-run] would remove stale ${displayPath(root, abs)} (${entry.id})`);
         continue;
       }
-      await fs10.remove(abs);
+      await fs11.remove(abs);
       await pruneEmptyDir(path12.dirname(abs));
       log(`Removed stale ${displayPath(root, abs)} (${entry.id})`);
     }
   }
 }
-async function pruneEmptyDir(dir) {
-  try {
-    const entries = await fs10.readdir(dir);
-    if (entries.length === 0) await fs10.remove(dir);
-  } catch {
-  }
-}
-async function writeManagedText(root, filePath, nextText, dryRun) {
-  const prev = await fs10.pathExists(filePath) ? await fs10.readFile(filePath, "utf8") : "";
-  const printable = displayPath(root, filePath);
-  if (dryRun) {
-    if (!prev) {
-      log(createUnifiedDiff(printable, "", nextText));
-    } else if (hasTextChanged(prev, nextText)) {
-      log(createUnifiedDiff(printable, prev, nextText));
-    } else {
-      log(`${printable}: unchanged`);
-    }
-    return;
-  }
-  if (hasTextChanged(prev, nextText) && prev.length > 0) {
-    const diffText = createUnifiedDiff(printable, prev, nextText);
-    const summary = summarizeDiff(diffText);
-    log(`Overwriting ${printable} (diff +${summary.additions} -${summary.deletions})`);
-  }
-  await writeText(filePath, nextText);
-}
-async function writeManagedJson(root, filePath, value, dryRun) {
-  const nextText = `${JSON.stringify(value, null, 2)}
-`;
-  await writeManagedText(root, filePath, nextText, dryRun);
-}
 
 // src/commands/apply.ts
 async function cacheHasItems() {
@@ -1437,8 +1427,8 @@ async function runApply(options) {
   }
 }
 async function isHausProject(root) {
-  if (await fs11.pathExists(hausPath(root, "recommendation.json"))) return true;
-  if (await fs11.pathExists(claudePath(root, "settings.json"))) {
+  if (await fs12.pathExists(hausPath(root, "recommendation.json"))) return true;
+  if (await fs12.pathExists(claudePath(root, "settings.json"))) {
     const settings = await readProjectSettings(root);
     if (settings._haus != null) return true;
   }
@@ -1653,8 +1643,67 @@ async function runCatalogAudit() {
   log("Catalog audit passed.");
 }
 
-// src/commands/config.ts
+// src/commands/clone.ts
+import { existsSync as existsSync2 } from "fs";
 import path14 from "path";
+
+// src/utils/exec.ts
+import { execa } from "execa";
+async function runCommand(command, args = [], options = {}) {
+  try {
+    const result = await execa(command, args, {
+      reject: false,
+      // non-zero exits are returned, not thrown
+      ...options
+    });
+    return {
+      command,
+      args,
+      stdout: String(result.stdout ?? ""),
+      stderr: String(result.stderr ?? ""),
+      exitCode: result.exitCode ?? 0
+    };
+  } catch (error2) {
+    const message = error2 instanceof Error ? error2.message : String(error2);
+    throw new Error(`Failed to run command: ${command} ${args.join(" ")} (${message})`);
+  }
+}
+async function runGit(args, options = {}) {
+  return runCommand("git", args, options);
+}
+
+// src/commands/clone.ts
+function repoNameFromUrl(url) {
+  const trimmed = url.trim().replace(/\.git$/, "").replace(/\/+$/, "");
+  const tail = trimmed.split(/[/:]/).pop() ?? "";
+  return tail || "repo";
+}
+async function runClone(url, opts = {}) {
+  if (!url || !url.trim()) {
+    error("A git URL is required: `haus clone <url> [dir]`.");
+    process.exitCode = 1;
+    return;
+  }
+  const target = path14.resolve(opts.dir?.trim() || repoNameFromUrl(url));
+  if (existsSync2(target)) {
+    log(`\u2022 ${path14.basename(target)} already present at ${target} \u2014 skipped`);
+    return;
+  }
+  if (opts.dryRun) {
+    log(`would clone ${url} \u2192 ${target}`);
+    return;
+  }
+  const res = await runGit(["clone", url, target]);
+  if (res.exitCode !== 0) {
+    error(`clone failed for ${url}: ${(res.stderr || res.stdout).trim()}`);
+    process.exitCode = 1;
+    return;
+  }
+  log(`\u2713 cloned ${url} \u2192 ${target}`);
+}
+
+// src/commands/config.ts
+import path15 from "path";
 var CONFIG_PATH2 = ".haus-workflow/config.json";
 var HOOK_ALIASES = {
   "hook.context": "context"
@@ -1667,7 +1716,7 @@ async function runConfig(key, action) {
     );
   }
   const root = process.cwd();
-  const configPath = path14.join(root, CONFIG_PATH2);
+  const configPath = path15.join(root, CONFIG_PATH2);
   const existing = await readJson(configPath);
   const cfg = existing ?? structuredClone(DEFAULT_HOOKS_CONFIG);
   cfg.hooks ??= {};
@@ -2039,7 +2088,7 @@ function selectRules(recommended, task, taskIntents) {
 
 // src/scanner/scan-project.ts
 import { readFile as readFile2 } from "fs/promises";
-import path18 from "path";
+import path19 from "path";
 
 // src/utils/audit-checks.ts
 function isRecord(v) {
@@ -2066,8 +2115,8 @@ function compareVersions(a, b) {
 }
 
 // src/scanner/detect-package-manager.ts
-import path15 from "path";
-import fs12 from "fs-extra";
+import path16 from "path";
+import fs13 from "fs-extra";
 function detectPackageManager(root, packageManagerField) {
   const field = String(packageManagerField ?? "").trim();
   if (field.startsWith("yarn@")) {
@@ -2085,9 +2134,9 @@ function detectPackageManager(root, packageManagerField) {
     if (satisfiesVersion(version, ">=9")) return "npm";
     return "unknown";
   }
-  if (fs12.existsSync(path15.join(root, "yarn.lock"))) return "yarn";
-  if (fs12.existsSync(path15.join(root, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs12.existsSync(path15.join(root, "package-lock.json"))) return "npm";
+  if (fs13.existsSync(path16.join(root, "yarn.lock"))) return "yarn";
+  if (fs13.existsSync(path16.join(root, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs13.existsSync(path16.join(root, "package-lock.json"))) return "npm";
   return "unknown";
 }
 
@@ -2260,7 +2309,7 @@ function runDetection(ctx, rules = STACK_RULES) {
 }
 
 // src/scanner/detection.ts
-import path16 from "path";
+import path17 from "path";
 var UNSUPPORTED_MARKERS = {
   "requirements.txt": "python",
   "pyproject.toml": "python",
@@ -2314,14 +2363,14 @@ function finalizeRoles(registryRoles, deps, files) {
 function collectUnsupportedSignals(files) {
   return [
     ...new Set(
-      files.map((f) => UNSUPPORTED_MARKERS[path16.basename(f)]).filter((s) => Boolean(s))
+      files.map((f) => UNSUPPORTED_MARKERS[path17.basename(f)]).filter((s) => Boolean(s))
     )
   ].sort();
 }
 
 // src/scanner/render.ts
 import { readFile } from "fs/promises";
-import path17 from "path";
+import path18 from "path";
 
 // src/scanner/role-labels.ts
 var ROLE_LABELS = {
@@ -2383,7 +2432,7 @@ async function buildContentBlob(root, files) {
   const slice = candidates.slice(0, 300);
   const parts = await mapWithConcurrency(slice, async (rel) => {
     try {
-      return await readFile(path17.join(root, rel), "utf8");
+      return await readFile(path18.join(root, rel), "utf8");
     } catch {
       return "";
     }
@@ -2481,8 +2530,8 @@ var SAFE_FILES = [
   "Gemfile"
 ];
 async function scanProject(root, mode = "fast") {
-  const pkg = await readJson(path18.join(root, "package.json"));
-  const composer = await readJson(path18.join(root, "composer.json"));
+  const pkg = await readJson(path19.join(root, "package.json"));
+  const composer = await readJson(path19.join(root, "composer.json"));
   const files = await listFiles(root, SAFE_FILES);
   const safeFiles = files.filter((f) => !blocked(f));
   const deps = dependencySet(pkg, composer);
@@ -2516,7 +2565,7 @@ async function scanProject(root, mode = "fast") {
     mode,
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     root,
-    repoName: String(pkg?.name ?? path18.basename(root)),
+    repoName: String(pkg?.name ?? path19.basename(root)),
     packageManager,
     repoRoles: roles,
     detectedStacks: stacks,
@@ -2534,7 +2583,7 @@ async function scanProject(root, mode = "fast") {
   const scanHashes = Object.fromEntries(
     await mapWithConcurrency(
       safeFiles,
-      async (f) => [f, hashText(await readFile2(path18.join(root, f), "utf8"))]
+      async (f) => [f, hashText(await readFile2(path19.join(root, f), "utf8"))]
     )
   );
   const repoSummary = renderSummary(context);
@@ -2619,8 +2668,8 @@ async function runContext(options) {
 }
 
 // src/commands/doctor.ts
-import path19 from "path";
-import fs13 from "fs-extra";
+import path20 from "path";
+import fs14 from "fs-extra";
 
 // src/update/npm-version.ts
 var NPM_PACKAGE_NAME = "@haus-tech/haus-workflow";
@@ -2700,7 +2749,7 @@ async function runDoctor(options) {
     const enabled = await isHookEnabled(root, key);
     ok(`- HOOK ${key}: ${enabled ? "enabled" : "disabled (default)"}`);
   }
-  const rootClaudeMdPath = path19.join(root, "CLAUDE.md");
+  const rootClaudeMdPath = path20.join(root, "CLAUDE.md");
   const rootClaudeMdContent = await readText(rootClaudeMdPath);
   if (!rootClaudeMdContent) {
     flag(
@@ -2728,7 +2777,7 @@ async function runDoctor(options) {
       const block = rootClaudeMdContent.slice(beginIdx, endIdx + BLOCK_END.length);
       const importTargets = [...block.matchAll(/@\.haus-workflow\/(\S+)/g)].map((m) => m[1]);
       for (const target of importTargets) {
-        if (!await fs13.pathExists(hausPath(root, target))) {
+        if (!await fs14.pathExists(hausPath(root, target))) {
           flag(
             `- CLAUDE.md import: @.haus-workflow/${target} does not resolve (run \`haus apply --write\`)`,
             `A file CLAUDE.md links to (${target}) is missing, so part of the guidance won't load`,
@@ -2739,7 +2788,7 @@ async function runDoctor(options) {
     }
   }
   const workflowPath = hausPath(root, "WORKFLOW.md");
-  const workflowExists = await fs13.pathExists(workflowPath);
+  const workflowExists = await fs14.pathExists(workflowPath);
   if (!workflowExists) {
     flag(
       "- .haus-workflow/WORKFLOW.md: missing (run `haus apply --write`)",
@@ -2753,15 +2802,15 @@ async function runDoctor(options) {
       ok("- .haus-workflow/WORKFLOW.md: OK (user-owned)");
     } else {
       const storedHashMatch = firstLine.match(/hash=(sha256-[a-f0-9]+)/);
-      const cachePath = path19.join(getCacheDir(), "templates/agentic-workflow-standard.md");
-      const bundledPath = path19.join(
+      const cachePath = path20.join(getCacheDir(), "templates/agentic-workflow-standard.md");
+      const bundledPath = path20.join(
         packageRoot(),
         "library",
         "global",
         "templates",
         "agentic-workflow-standard.md"
       );
-      const templatePath = await fs13.pathExists(cachePath) ? cachePath : bundledPath;
+      const templatePath = await fs14.pathExists(cachePath) ? cachePath : bundledPath;
       const templateContent = await readText(templatePath);
       if (storedHashMatch && templateContent) {
         const currentHash = hashText(normaliseLF(templateContent));
@@ -2780,7 +2829,7 @@ async function runDoctor(options) {
     }
   }
   const workflowConfigPath = hausPath(root, "workflow-config.md");
-  const workflowConfigExists = await fs13.pathExists(workflowConfigPath);
+  const workflowConfigExists = await fs14.pathExists(workflowConfigPath);
   if (!workflowConfigExists) {
     flag(
       "- .haus-workflow/workflow-config.md: missing (run `haus apply --write`)",
@@ -2788,7 +2837,7 @@ async function runDoctor(options) {
       "haus apply --write"
     );
   } else {
-    const cfg = await fs13.readFile(workflowConfigPath, "utf8");
+    const cfg = await fs14.readFile(workflowConfigPath, "utf8");
     const unfilled = cfg.split("\n").filter((l) => l.includes("<!-- fill in")).length;
     if (unfilled > 0) {
       flag(
@@ -2819,7 +2868,7 @@ async function runDoctor(options) {
       ok(`- CATALOG CACHE: OK (${cacheAgeDays}d old)`);
     }
   }
-  const pkgJson = await readJson(path19.join(packageRoot(), "package.json"));
+  const pkgJson = await readJson(path20.join(packageRoot(), "package.json"));
   const currentVersion = pkgJson?.version ?? "0.0.0";
   const npmStatus = await fetchNpmVersionStatus(currentVersion);
   if (npmStatus.updateAvailable && npmStatus.latest !== null) {
@@ -2962,8 +3011,8 @@ async function runGuard(kind, _options) {
 }
 
 // src/commands/init.ts
-import path20 from "path";
-import fs14 from "fs-extra";
+import path21 from "path";
+import fs15 from "fs-extra";
 
 // src/utils/prompts.ts
 import { stdin as input, stdout as output } from "process";
@@ -2983,31 +3032,6 @@ async function confirm(question) {
   return answer === "y" || answer === "yes";
 }
 
-// src/utils/exec.ts
-import { execa } from "execa";
-async function runCommand(command, args = [], options = {}) {
-  try {
-    const result = await execa(command, args, {
-      reject: false,
-      // non-zero exits are returned, not thrown
-      ...options
-    });
-    return {
-      command,
-      args,
-      stdout: String(result.stdout ?? ""),
-      stderr: String(result.stderr ?? ""),
-      exitCode: result.exitCode ?? 0
-    };
-  } catch (error2) {
-    const message = error2 instanceof Error ? error2.message : String(error2);
-    throw new Error(`Failed to run command: ${command} ${args.join(" ")} (${message})`);
-  }
-}
-async function runGit(args, options = {}) {
-  return runCommand("git", args, options);
-}
-
 // src/recommender/git-signal.ts
 async function readChangedFiles(root) {
   if (process.env.HAUS_DISABLE_GIT_SIGNALS === "1") return [];
@@ -3186,7 +3210,8 @@ async function recommend(root, context) {
       (t) => context.warnings.join(" ").toLowerCase().includes(t.toLowerCase())
     );
     if (configSignal) push("config-signal-match", "config signal match", `warning:${configSignal}`);
-    const changedMatch = changedFiles.find((f) => f.includes(item.id.split(".").pop() ?? ""));
+    const idSegment = item.id.split(".").pop() ?? "";
+    const changedMatch = idSegment ? changedFiles.find((f) => f.includes(idSegment)) : void 0;
     if (changedMatch)
       push("changed-file-match", "changed file match", `changedFile:${changedMatch}`);
     const requiresAny = item.requiresAny ?? [];
@@ -3349,8 +3374,8 @@ async function runSetupProject(options) {
 // src/commands/init.ts
 async function runInit(options) {
   const root = process.cwd();
-  const hausDir = path20.join(root, ".haus-workflow");
-  const alreadyInit = await fs14.pathExists(hausDir);
+  const hausDir = path21.join(root, ".haus-workflow");
+  const alreadyInit = await fs15.pathExists(hausDir);
   if (alreadyInit) {
     log("Haus AI already initialized in this project.");
     log("Run `haus setup-project` to reconfigure.");
@@ -3362,8 +3387,8 @@ async function runInit(options) {
 
 // src/install/apply.ts
 import crypto2 from "crypto";
-import path21 from "path";
-import fs15 from "fs-extra";
+import path22 from "path";
+import fs16 from "fs-extra";
 
 // src/install/header.ts
 var MD_PREFIX = "<!-- HAUS-MANAGED";
@@ -3451,40 +3476,40 @@ function hashContent(content2) {
 }
 function sourceVersion() {
   try {
-    const pkgPath = path21.join(packageRoot(), "package.json");
-    const pkg = JSON.parse(fs15.readFileSync(pkgPath, "utf8"));
+    const pkgPath = path22.join(packageRoot(), "package.json");
+    const pkg = JSON.parse(fs16.readFileSync(pkgPath, "utf8"));
     return `${pkg.name ?? "haus"}@${pkg.version ?? "0.0.0"}`;
   } catch {
     return "haus@0.0.0";
   }
 }
 function globalSrcDir() {
-  return path21.join(packageRoot(), "library", "global");
+  return path22.join(packageRoot(), "library", "global");
 }
 function collectSourceFiles(srcDir, claudeDir) {
   const entries = [];
-  const skillsDir = path21.join(srcDir, "skills");
-  if (fs15.pathExistsSync(skillsDir)) {
-    for (const skillName of fs15.readdirSync(skillsDir)) {
-      const skillFile = path21.join(skillsDir, skillName, "SKILL.md");
-      if (fs15.pathExistsSync(skillFile)) {
+  const skillsDir = path22.join(srcDir, "skills");
+  if (fs16.pathExistsSync(skillsDir)) {
+    for (const skillName of fs16.readdirSync(skillsDir)) {
+      const skillFile = path22.join(skillsDir, skillName, "SKILL.md");
+      if (fs16.pathExistsSync(skillFile)) {
         entries.push({
           stableId: `skill.${skillName}`,
-          srcRelPath: path21.join("library", "global", "skills", skillName, "SKILL.md"),
-          destPath: path21.join(claudeDir, "skills", skillName, "SKILL.md")
+          srcRelPath: path22.join("library", "global", "skills", skillName, "SKILL.md"),
+          destPath: path22.join(claudeDir, "skills", skillName, "SKILL.md")
         });
       }
     }
   }
-  const commandsDir = path21.join(srcDir, "commands");
-  if (fs15.pathExistsSync(commandsDir)) {
-    for (const fileName of fs15.readdirSync(commandsDir)) {
+  const commandsDir = path22.join(srcDir, "commands");
+  if (fs16.pathExistsSync(commandsDir)) {
+    for (const fileName of fs16.readdirSync(commandsDir)) {
       if (!fileName.endsWith(".md")) continue;
       const commandName = fileName.slice(0, -".md".length);
       entries.push({
         stableId: `command.${commandName}`,
-        srcRelPath: path21.join("library", "global", "commands", fileName),
-        destPath: path21.join(claudeDir, "commands", fileName)
+        srcRelPath: path22.join("library", "global", "commands", fileName),
+        destPath: path22.join(claudeDir, "commands", fileName)
       });
     }
   }
@@ -3508,7 +3533,7 @@ async function applyInstall(options = {}) {
   };
   const manifestFiles = [];
   for (const entry of sourceFiles) {
-    const srcPath = path21.join(packageRoot(), entry.srcRelPath);
+    const srcPath = path22.join(packageRoot(), entry.srcRelPath);
     const rawContent = await readText(srcPath);
     if (rawContent === void 0) {
       warn(`Source file not found: ${entry.srcRelPath}`);
@@ -3528,7 +3553,7 @@ async function applyInstall(options = {}) {
       }
       continue;
     }
-    const destExists = fs15.pathExistsSync(entry.destPath);
+    const destExists = fs16.pathExistsSync(entry.destPath);
     if (destExists) {
       const currentContent = await readText(entry.destPath);
       if (currentContent !== void 0) {
@@ -3564,7 +3589,7 @@ async function applyInstall(options = {}) {
       schemaVersion: SCHEMA_VERSION2
     });
   }
-  const fragmentPath = path21.join(srcDir, "settings-fragments", "hooks.json");
+  const fragmentPath = path22.join(srcDir, "settings-fragments", "hooks.json");
   const fragments = await loadHooksFragment(fragmentPath);
   const settings = await readSettings();
   const { settings: hookSettings, addedIds } = mergeHooks(settings, fragments);
@@ -3575,13 +3600,13 @@ async function applyInstall(options = {}) {
     const currentDestPaths = new Set(sourceFiles.map((f) => f.destPath));
     for (const entry of existingManifest.files) {
       if (currentDestPaths.has(entry.destPath)) continue;
-      if (!fs15.pathExistsSync(entry.destPath)) continue;
+      if (!fs16.pathExistsSync(entry.destPath)) continue;
       const content2 = await readText(entry.destPath);
       if (!content2) continue;
       const hasHeader = parseMarkdownHeader(content2) !== void 0;
       const currentHash = hashContent(content2);
       if (hasHeader && currentHash === entry.hash) {
-        if (!dryRun) await fs15.remove(entry.destPath);
+        if (!dryRun) await fs16.remove(entry.destPath);
         result.deleted.push(entry.destPath);
       } else {
         warn(`Orphaned file ${entry.destPath} was user-modified \u2014 leaving in place`);
@@ -3708,8 +3733,8 @@ async function runScan(options) {
 }
 
 // src/commands/undo.ts
-import path22 from "path";
-import fs16 from "fs-extra";
+import path23 from "path";
+import fs17 from "fs-extra";
 
 // src/claude/managed-paths.ts
 var PROJECT_MANAGED_CLAUDE_REL = [
@@ -3735,61 +3760,61 @@ async function collectManagedPaths(root) {
   const lock = await readJson(hausPath(root, "haus.lock.json"));
   for (const row of lock ?? []) {
     for (const rel of row.paths ?? []) {
-      paths.add(path22.resolve(root, rel));
+      paths.add(path23.resolve(root, rel));
     }
   }
   const existing = [];
   for (const abs of paths) {
-    if (await fs16.pathExists(abs)) existing.push(abs);
+    if (await fs17.pathExists(abs)) existing.push(abs);
   }
   return existing;
 }
 async function settingsHasHausContent(root) {
   const settingsPath = claudePath(root, "settings.json");
-  if (!await fs16.pathExists(settingsPath)) return false;
+  if (!await fs17.pathExists(settingsPath)) return false;
   const settings = await readProjectSettings(root);
   return settings._haus != null;
 }
 async function claudeMdHasHausBlock(root) {
-  const filePath = path22.join(root, "CLAUDE.md");
-  if (!await fs16.pathExists(filePath)) return false;
-  const text = await fs16.readFile(filePath, "utf8");
+  const filePath = path23.join(root, "CLAUDE.md");
+  if (!await fs17.pathExists(filePath)) return false;
+  const text = await fs17.readFile(filePath, "utf8");
   return text.includes(BLOCK_BEGIN);
 }
 async function stripProjectSettings(root) {
   const settingsPath = claudePath(root, "settings.json");
-  if (!await fs16.pathExists(settingsPath)) return false;
+  if (!await fs17.pathExists(settingsPath)) return false;
   let settings = await readProjectSettings(root);
   settings = stripHausAllow(stripHausDeny(stripHausHooks(settings)));
   const hasContent = Object.keys(settings).length > 0;
   if (hasContent) {
     await writeProjectSettings(root, settings);
-    log(`Stripped haus rules from ${path22.relative(root, settingsPath)} (user settings preserved).`);
+    log(`Stripped haus rules from ${path23.relative(root, settingsPath)} (user settings preserved).`);
     return true;
   }
-  await fs16.remove(settingsPath);
-  log(`Removed ${path22.relative(root, settingsPath)} (no user-owned settings remained).`);
+  await fs17.remove(settingsPath);
+  log(`Removed ${path23.relative(root, settingsPath)} (no user-owned settings remained).`);
   return true;
 }
 async function stripRootClaudeMd(root) {
-  const filePath = path22.join(root, "CLAUDE.md");
-  if (!await fs16.pathExists(filePath)) return false;
-  const prev = await fs16.readFile(filePath, "utf8");
+  const filePath = path23.join(root, "CLAUDE.md");
+  if (!await fs17.pathExists(filePath)) return false;
+  const prev = await fs17.readFile(filePath, "utf8");
   if (!prev.includes(BLOCK_BEGIN)) return false;
   const next = stripHausBlock(prev);
   if (next.length === 0) {
-    await fs16.remove(filePath);
+    await fs17.remove(filePath);
     log("Removed CLAUDE.md (only contained haus import block).");
   } else {
-    await fs16.writeFile(filePath, next, "utf8");
+    await fs17.writeFile(filePath, next, "utf8");
     log("Removed haus import block from CLAUDE.md (user content preserved).");
   }
   return true;
 }
 async function pruneDirIfEmpty(dir) {
-  if (!await fs16.pathExists(dir)) return;
-  const entries = await fs16.readdir(dir);
-  if (entries.length === 0) await fs16.remove(dir);
+  if (!await fs17.pathExists(dir)) return;
+  const entries = await fs17.readdir(dir);
+  if (entries.length === 0) await fs17.remove(dir);
 }
 async function runUndo(options) {
   const root = process.cwd();
@@ -3800,7 +3825,7 @@ async function runUndo(options) {
     log("Nothing to remove: no haus-managed files found in this directory.");
     return;
   }
-  const relTargets = managed.map((p) => path22.relative(root, p));
+  const relTargets = managed.map((p) => path23.relative(root, p));
   const summaryParts = [...relTargets];
   if (stripSettings) summaryParts.push(".claude/settings.json (haus rules only)");
   if (stripClaudeMd) summaryParts.push("CLAUDE.md (haus import block only)");
@@ -3816,9 +3841,9 @@ User-owned .claude/ files will be preserved.`
     }
   }
   for (const abs of managed) {
-    if (!await fs16.pathExists(abs)) continue;
-    await fs16.remove(abs);
-    log(`Removed ${path22.relative(root, abs)}`);
+    if (!await fs17.pathExists(abs)) continue;
+    await fs17.remove(abs);
+    log(`Removed ${path23.relative(root, abs)}`);
   }
   if (stripSettings) await stripProjectSettings(root);
   if (stripClaudeMd) await stripRootClaudeMd(root);
@@ -3829,8 +3854,8 @@ User-owned .claude/ files will be preserved.`
 
 // src/install/uninstall.ts
 import crypto3 from "crypto";
-import path23 from "path";
-import fs17 from "fs-extra";
+import path24 from "path";
+import fs18 from "fs-extra";
 async function runUninstall(options = {}) {
   const { force = false } = options;
   const manifest = await readManifest();
@@ -3840,7 +3865,7 @@ async function runUninstall(options = {}) {
     return result;
   }
   for (const entry of manifest.files) {
-    const exists = fs17.pathExistsSync(entry.destPath);
+    const exists = fs18.pathExistsSync(entry.destPath);
     if (!exists) continue;
     const content2 = await readText(entry.destPath);
     if (content2 === void 0) continue;
@@ -3858,22 +3883,22 @@ async function runUninstall(options = {}) {
       result.skipped.push(entry.destPath);
       continue;
     }
-    await fs17.remove(entry.destPath);
-    await pruneEmptyDir2(path23.dirname(entry.destPath));
+    await fs18.remove(entry.destPath);
+    await pruneEmptyDir(path24.dirname(entry.destPath));
     result.deleted.push(entry.destPath);
   }
   const settings = await readSettings();
   const stripped = stripHausHooks(stripHausAllow(stripHausDeny(settings)));
   await writeSettings(stripped);
   result.hooksStripped = true;
-  const hausDir = path23.join(globalClaudeDir(), "haus");
+  const hausDir = path24.join(globalClaudeDir(), "haus");
   const manifestPath2 = hausManifestPath();
-  if (fs17.pathExistsSync(manifestPath2)) {
-    await fs17.remove(manifestPath2);
+  if (fs18.pathExistsSync(manifestPath2)) {
+    await fs18.remove(manifestPath2);
   }
-  if (fs17.pathExistsSync(hausDir)) {
-    const remaining = await fs17.readdir(hausDir);
-    if (remaining.length === 0) await fs17.remove(hausDir);
+  if (fs18.pathExistsSync(hausDir)) {
+    const remaining = await fs18.readdir(hausDir);
+    if (remaining.length === 0) await fs18.remove(hausDir);
   }
   return result;
 }
@@ -3890,13 +3915,6 @@ function printUninstallResult(result) {
     log("Haus hook entries removed from ~/.claude/settings.json");
   }
 }
-async function pruneEmptyDir2(dir) {
-  try {
-    const entries = await fs17.readdir(dir);
-    if (entries.length === 0) await fs17.remove(dir);
-  } catch {
-  }
-}
 
 // src/commands/uninstall.ts
 async function runUninstallCommand(options) {
@@ -3911,7 +3929,7 @@ async function runUninstallCommand(options) {
 }
 
 // src/commands/update.ts
-import path25 from "path";
+import path26 from "path";
 
 // src/update/diff-generated-files.ts
 function diffGeneratedFiles() {
@@ -3938,7 +3956,7 @@ function summarizeLockDiff(before, after) {
 
 // src/update/lockfile.ts
 import { mkdir, readFile as readFile3, copyFile } from "fs/promises";
-import path24 from "path";
+import path25 from "path";
 async function checkLock(root) {
   const lock = await readJson(hausPath(root, "haus.lock.json")) ?? [];
   const hasValidVersions = lock.every(
@@ -3969,7 +3987,7 @@ async function applyLock(root) {
   try {
     const backupDir = hausPath(root, "backups");
     await mkdir(backupDir, { recursive: true });
-    await copyFile(lockPath, path24.join(backupDir, `haus.lock.${Date.now()}.json`));
+    await copyFile(lockPath, path25.join(backupDir, `haus.lock.${Date.now()}.json`));
   } catch {
   }
   const enriched = await Promise.all(
@@ -3991,7 +4009,7 @@ function diffLock(before, after) {
 }
 async function hasLocalOverrides(root) {
   try {
-    await readFile3(path24.join(root, ".claude", "settings.json"), "utf8");
+    await readFile3(path25.join(root, ".claude", "settings.json"), "utf8");
     return true;
   } catch {
     return false;
@@ -4003,7 +4021,7 @@ var NPM_PACKAGE_NAME2 = "@haus-tech/haus-workflow";
 async function runUpdate(options) {
   const root = process.cwd();
   if (options.check) {
-    const pkgJson2 = await readJson(path25.join(packageRoot(), "package.json"));
+    const pkgJson2 = await readJson(path26.join(packageRoot(), "package.json"));
     const currentVersion2 = pkgJson2?.version ?? "0.0.0";
     const [status, npmVersion, latestCatalogTag, globalInstallDrift] = await Promise.all([
       checkLock(root),
@@ -4033,7 +4051,7 @@ async function runUpdate(options) {
     if (status.driftCount > 0) process.exitCode = 1;
     return;
   }
-  const pkgJson = await readJson(path25.join(packageRoot(), "package.json"));
+  const pkgJson = await readJson(path26.join(packageRoot(), "package.json"));
   const currentVersion = pkgJson?.version ?? "0.0.0";
   const npmStatus = await fetchNpmVersionStatus(currentVersion);
   if (npmStatus.updateAvailable && npmStatus.latest !== null) {
@@ -4110,8 +4128,8 @@ async function detectGlobalInstallDrift() {
 }
 
 // src/commands/validate-catalog.ts
-import fs18 from "fs";
-import path26 from "path";
+import fs19 from "fs";
+import path27 from "path";
 
 // src/catalog/forbidden-content.ts
 var PROSE_FORBIDDEN_TAGS = FORBIDDEN_TAGS.filter((t) => t.toLowerCase() !== "go");
@@ -4129,13 +4147,14 @@ function extractUseWhenSection(text) {
 function isYamlBlockScalarHeader(rest) {
   return /^[>|][-+]?(\d+)?(?:\s+#.*)?$/.test(rest);
 }
-function extractFrontmatterDescription(text) {
+function extractFrontmatterValue(text, key) {
   const m = text.match(/^---\r?\n([\s\S]*?)\r?\n---/);
   if (!m) return "";
   const lines = m[1].split(/\r?\n/);
-  const idx = lines.findIndex((l) => /^description:[ \t]*/.test(l));
+  const keyRe = new RegExp(`^${escapeRegExp(key)}:[ \\t]*`);
+  const idx = lines.findIndex((l) => keyRe.test(l));
   if (idx < 0) return "";
-  const rest = lines[idx].replace(/^description:[ \t]*/, "").trim();
+  const rest = lines[idx].replace(keyRe, "").trim();
   if (!rest) return "";
   if (!isYamlBlockScalarHeader(rest)) {
     return rest.replace(/^["']|["']$/g, "").trim();
@@ -4150,6 +4169,9 @@ function extractFrontmatterDescription(text) {
   }
   return body.join(" ").replace(/\s+/g, " ").trim();
 }
+function extractFrontmatterDescription(text) {
+  return extractFrontmatterValue(text, "description");
+}
 function auditForbiddenTagsInText(text, label) {
   const body = `${extractFrontmatterDescription(text)}
 ${extractUseWhenSection(text)}`;
@@ -4226,33 +4248,37 @@ function auditManifestStructure(items) {
   }
   return failures;
 }
+function checkRequiredFrontmatter(text, label) {
+  const failures = [];
+  for (const key of REQUIRED_SKILL_FRONTMATTER) {
+    if (!extractFrontmatterValue(text, key)) {
+      failures.push(`${label}: missing non-empty frontmatter '${key}:'`);
+    }
+  }
+  return failures;
+}
 function auditShippedFiles(manifestDir, items) {
   const failures = [];
   for (const item of items) {
     if (!item.path) continue;
-    const absPath = path26.join(manifestDir, item.path);
+    const absPath = path27.join(manifestDir, item.path);
     if (item.type === "skill") {
-      const skillMd = path26.join(absPath, "SKILL.md");
-      if (!fs18.existsSync(skillMd)) {
-        failures.push(`${item.id}: missing ${path26.relative(manifestDir, skillMd)}`);
+      const skillMd = path27.join(absPath, "SKILL.md");
+      if (!fs19.existsSync(skillMd)) {
+        failures.push(`${item.id}: missing ${path27.relative(manifestDir, skillMd)}`);
         continue;
       }
-      const text = fs18.readFileSync(skillMd, "utf8");
-      const description = extractFrontmatterDescription(text);
-      for (const key of REQUIRED_SKILL_FRONTMATTER) {
-        if (key === "description" && !description) {
-          failures.push(`${item.id}: SKILL.md missing non-empty frontmatter 'description:'`);
-        }
-      }
+      const text = fs19.readFileSync(skillMd, "utf8");
+      failures.push(...checkRequiredFrontmatter(text, `${item.id}: SKILL.md`));
       failures.push(
-        ...auditForbiddenTagsInText(text, `${item.id}: ${path26.relative(manifestDir, skillMd)}`)
+        ...auditForbiddenTagsInText(text, `${item.id}: ${path27.relative(manifestDir, skillMd)}`)
       );
     } else if (item.type === "agent") {
-      if (!fs18.existsSync(absPath)) {
+      if (!fs19.existsSync(absPath)) {
         failures.push(`${item.id}: missing agent file ${item.path}`);
         continue;
       }
-      const text = fs18.readFileSync(absPath, "utf8");
+      const text = fs19.readFileSync(absPath, "utf8");
       if (!text.startsWith("---")) failures.push(`${item.id}: agent file missing YAML frontmatter`);
       for (const section of REQUIRED_AGENT_SECTIONS) {
         if (!text.includes(section)) failures.push(`${item.id}: agent file missing ${section}`);
@@ -4263,27 +4289,30 @@ function auditShippedFiles(manifestDir, items) {
           failures.push(`${item.id}: agent file contains disallowed phrase "${phrase}"`);
       }
       failures.push(
-        ...auditForbiddenTagsInText(text, `${item.id}: ${path26.relative(manifestDir, absPath)}`)
+        ...auditForbiddenTagsInText(text, `${item.id}: ${path27.relative(manifestDir, absPath)}`)
       );
     } else if (item.type === "template") {
-      if (!fs18.existsSync(absPath)) {
+      if (!fs19.existsSync(absPath)) {
         failures.push(`${item.id}: missing template file ${item.path}`);
         continue;
       }
       failures.push(...auditTemplateContent(manifestDir, absPath, item.id));
     } else if (item.type === "command") {
-      if (!fs18.existsSync(absPath)) {
+      if (!fs19.existsSync(absPath)) {
         failures.push(`${item.id}: missing command file ${item.path}`);
         continue;
       }
+      const text = fs19.readFileSync(absPath, "utf8");
+      const rel = path27.relative(manifestDir, absPath);
+      failures.push(...checkRequiredFrontmatter(text, `${item.id}: ${rel}`));
       failures.push(...auditTemplateContent(manifestDir, absPath, item.id));
     }
   }
   return failures;
 }
 function auditTemplateContent(manifestDir, absPath, itemId) {
-  const rel = path26.relative(manifestDir, absPath);
-  const text = fs18.readFileSync(absPath, "utf8");
+  const rel = path27.relative(manifestDir, absPath);
+  const text = fs19.readFileSync(absPath, "utf8");
   const failures = [];
   const lines = text.split(/\r?\n/);
   for (let i = 0; i < lines.length; i++) {
@@ -4305,11 +4334,11 @@ function auditMarkdownContent(manifestDir) {
   const failures = [];
   const dirs = ["skills", "agents", "templates", "commands"];
   for (const dir of dirs) {
-    const abs = path26.join(manifestDir, dir);
-    if (!fs18.existsSync(abs)) continue;
+    const abs = path27.join(manifestDir, dir);
+    if (!fs19.existsSync(abs)) continue;
     walkMd(abs, (file) => {
-      const text = fs18.readFileSync(file, "utf8");
-      const rel = path26.relative(manifestDir, file);
+      const text = fs19.readFileSync(file, "utf8");
+      const rel = path27.relative(manifestDir, file);
       const lines = text.split(/\r?\n/);
       for (let i = 0; i < lines.length; i++) {
         const line2 = lines[i] ?? "";
@@ -4328,8 +4357,8 @@ function auditMarkdownContent(manifestDir) {
   return failures;
 }
 function walkMd(dir, fn) {
-  for (const entry of fs18.readdirSync(dir, { withFileTypes: true })) {
-    const full = path26.join(dir, entry.name);
+  for (const entry of fs19.readdirSync(dir, { withFileTypes: true })) {
+    const full = path27.join(dir, entry.name);
     if (entry.isDirectory()) walkMd(full, fn);
     else if (entry.name.endsWith(".md")) fn(full);
   }
@@ -4340,8 +4369,8 @@ async function runValidateCatalog(manifestPath2) {
     process.exitCode = 1;
     return;
   }
-  const abs = path26.resolve(process.cwd(), manifestPath2);
-  const manifestDir = path26.dirname(abs);
+  const abs = path27.resolve(process.cwd(), manifestPath2);
+  const manifestDir = path27.dirname(abs);
   const data = await readJson(abs);
   if (!data?.items) {
     error(`Could not read catalog manifest at ${abs}`);
@@ -4370,8 +4399,8 @@ async function runValidateCatalog(manifestPath2) {
 }
 
 // src/commands/workspace.ts
-import { existsSync as existsSync4, statSync as statSync2 } from "fs";
-import path33 from "path";
+import { existsSync as existsSync5, statSync as statSync2 } from "fs";
+import path34 from "path";
 
 // src/commands/workspace/aggregate.ts
 async function writeWorkspaceArtifacts(workspaceRoot, repos, relationships = []) {
@@ -4425,7 +4454,7 @@ ${summaries.map(
 }
 
 // src/commands/workspace/config.ts
-import path27 from "path";
+import path28 from "path";
 import YAML from "yaml";
 var WORKSPACE_FILE = "haus.workspace.yaml";
 function parseWorkspaceConfig(text) {
@@ -4448,11 +4477,11 @@ function parseWorkspaceConfig(text) {
   };
 }
 async function readWorkspaceConfig(workspaceRoot) {
-  return parseWorkspaceConfig(await readText(path27.join(workspaceRoot, WORKSPACE_FILE)));
+  return parseWorkspaceConfig(await readText(path28.join(workspaceRoot, WORKSPACE_FILE)));
 }
 
 // src/commands/workspace/discover.ts
-import path28 from "path";
+import path29 from "path";
 import fg3 from "fast-glob";
 import YAML2 from "yaml";
 var DEFAULT_MAX_DEPTH = 3;
@@ -4480,8 +4509,8 @@ async function discoverRepos(workspaceRoot, maxDepth = DEFAULT_MAX_DEPTH) {
   const gitDirs = /* @__PURE__ */ new Set();
   const manifestDirs = /* @__PURE__ */ new Set();
   for (const match of matches) {
-    const base = path28.posix.basename(match);
-    const dir = path28.posix.dirname(match);
+    const base = path29.posix.basename(match);
+    const dir = path29.posix.dirname(match);
     const owner = dir === "." ? "." : dir;
     if (base === ".git") gitDirs.add(owner);
     else manifestDirs.add(owner);
@@ -4497,9 +4526,9 @@ async function discoverRepos(workspaceRoot, maxDepth = DEFAULT_MAX_DEPTH) {
   }
   repoRoots.sort((a, b) => a.localeCompare(b));
   return mapWithConcurrency(repoRoots, async (relDir) => {
-    const absDir = path28.resolve(workspaceRoot, relDir);
-    const pkg = await readJson(path28.join(absDir, "package.json"));
-    const name = typeof pkg?.name === "string" && pkg.name.length > 0 ? pkg.name : path28.basename(relDir === "." ? workspaceRoot : absDir);
+    const absDir = path29.resolve(workspaceRoot, relDir);
+    const pkg = await readJson(path29.join(absDir, "package.json"));
+    const name = typeof pkg?.name === "string" && pkg.name.length > 0 ? pkg.name : path29.basename(relDir === "." ? workspaceRoot : absDir);
     let role = "auto";
     try {
       const scan = await scanProject(absDir, "fast");
@@ -4542,7 +4571,7 @@ function renderWorkspaceYaml(config2) {
   });
 }
 async function runDiscover(workspaceRoot, opts = {}) {
-  const yamlPath = path28.join(workspaceRoot, "haus.workspace.yaml");
+  const yamlPath = path29.join(workspaceRoot, "haus.workspace.yaml");
   const existingText = await readText(yamlPath);
   const existing = parseWorkspaceConfig(existingText);
   if (existingText && !existing) {
@@ -4575,19 +4604,19 @@ async function runDiscover(workspaceRoot, opts = {}) {
 }
 
 // src/commands/workspace/doctor.ts
-import { existsSync as existsSync2 } from "fs";
-import path30 from "path";
+import { existsSync as existsSync3 } from "fs";
+import path31 from "path";
 
 // src/commands/workspace/manifest.ts
 import { readFileSync as readFileSync3 } from "fs";
-import path29 from "path";
+import path30 from "path";
 var MANIFEST_FILE = "workspace.manifest.json";
 function manifestPath(workspaceRoot) {
   return hausPath(workspaceRoot, MANIFEST_FILE);
 }
 function hausVersion() {
   try {
-    const pkg = JSON.parse(readFileSync3(path29.join(packageRoot(), "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync3(path30.join(packageRoot(), "package.json"), "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -4653,7 +4682,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
   }
   const manifestByName = new Map(manifest.repos.map((r) => [r.name, r]));
   for (const repo of config2.repos) {
-    const repoRoot = path30.resolve(workspaceRoot, repo.path);
+    const repoRoot = path31.resolve(workspaceRoot, repo.path);
     const entry = manifestByName.get(repo.name);
     if (!entry) {
       flag({
@@ -4678,7 +4707,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
         detail: `Set up at haus ${entry.hausVersionAtSetup}, current is ${currentVersion} \u2014 re-run setup.`
       });
     }
-    if (!existsSync2(claudePath(repoRoot))) {
+    if (!existsSync3(claudePath(repoRoot))) {
       flag({
         repo: repo.name,
         kind: "missing-claude",
@@ -4686,7 +4715,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
       });
     }
     const lock = await checkLock(repoRoot);
-    if (!existsSync2(hausPath(repoRoot, "haus.lock.json"))) {
+    if (!existsSync3(hausPath(repoRoot, "haus.lock.json"))) {
       flag({
         repo: repo.name,
         kind: "missing-lock",
@@ -4726,12 +4755,12 @@ function emit(args) {
 }
 
 // src/commands/workspace/setup.ts
-import { existsSync as existsSync3, statSync } from "fs";
-import path32 from "path";
+import { existsSync as existsSync4, statSync } from "fs";
+import path33 from "path";
 
 // src/claude/write-workspace-claude-md.ts
-import path31 from "path";
-import fs19 from "fs-extra";
+import path32 from "path";
+import fs20 from "fs-extra";
 function buildWorkspaceImportBlock(client, members) {
   const memberLines = members.map((m) => `- ${m.name} (${m.path})`);
   const body = [
@@ -4749,8 +4778,8 @@ ${BLOCK_END}`;
 async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
   const block = buildWorkspaceImportBlock(opts.client, opts.members);
   const dryRun = opts.dryRun ?? false;
-  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path31.join(workspaceRoot, "CLAUDE.md");
-  const prev = await fs19.pathExists(filePath) ? await fs19.readFile(filePath, "utf8") : "";
+  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path32.join(workspaceRoot, "CLAUDE.md");
+  const prev = await fs20.pathExists(filePath) ? await fs20.readFile(filePath, "utf8") : "";
   const next = opts.collision ? `${block}
 ` : injectHausBlock(prev, block);
   const printable = displayPath(workspaceRoot, filePath);
@@ -4775,21 +4804,21 @@ async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
 
 // src/commands/workspace/setup.ts
 function resolveWorkspaceRoot(start = process.cwd()) {
-  let dir = path32.resolve(start);
+  let dir = path33.resolve(start);
   for (; ; ) {
-    if (existsSync3(path32.join(dir, WORKSPACE_FILE))) return dir;
-    const parent = path32.dirname(dir);
-    if (parent === dir) return path32.resolve(start);
+    if (existsSync4(path33.join(dir, WORKSPACE_FILE))) return dir;
+    const parent = path33.dirname(dir);
+    if (parent === dir) return path33.resolve(start);
     dir = parent;
   }
 }
 function isRootRepo(workspaceRoot, repoPath) {
-  return path32.resolve(workspaceRoot, repoPath) === path32.resolve(workspaceRoot);
+  return path33.resolve(workspaceRoot, repoPath) === path33.resolve(workspaceRoot);
 }
 async function runWorkspaceSetup(workspaceRoot, options = {}) {
   const mode = options.mode ?? "fast";
   const apply = options.write ?? false;
-  const configText = await readText(path32.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path33.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
@@ -4806,11 +4835,11 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
   const statuses = [];
   const aggregateInputs = [];
   for (const repo of repos) {
-    const repoRoot = path32.resolve(workspaceRoot, repo.path);
+    const repoRoot = path33.resolve(workspaceRoot, repo.path);
     log(`
 \u2192 ${repo.name} (${repo.path})`);
     try {
-      if (!existsSync3(repoRoot) || !statSync(repoRoot).isDirectory()) {
+      if (!existsSync4(repoRoot) || !statSync(repoRoot).isDirectory()) {
         throw new Error(`Repo path is not a directory: ${repo.path}`);
       }
       const res = await runSetupCore(repoRoot, {
@@ -4864,7 +4893,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
   if (apply && !options.dryRun) {
     const statusByName = new Map(statuses.map((s) => [s.name, s]));
     const prior = await readManifest2(workspaceRoot);
-    if (!prior && existsSync3(manifestPath(workspaceRoot))) {
+    if (!prior && existsSync4(manifestPath(workspaceRoot))) {
       warn(
         "Existing workspace.manifest.json is unreadable \u2014 prior per-repo state will not be carried forward."
       );
@@ -4875,7 +4904,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
       const status = statusByName.get(repo.name);
       const role = repo.role ?? status?.roles?.[0] ?? "auto";
       if (status?.status === "ok") {
-        const lock = await checkLock(path32.resolve(workspaceRoot, repo.path));
+        const lock = await checkLock(path33.resolve(workspaceRoot, repo.path));
         manifestRepos.push({
           name: repo.name,
           path: repo.path,
@@ -4955,7 +4984,7 @@ relationships: []
   log("Workspace initialized.");
 }
 async function scanWorkspace(workspaceRoot, opts) {
-  const configText = await readText(path33.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path34.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
@@ -4976,8 +5005,8 @@ async function scanWorkspace(workspaceRoot, opts) {
   }
   const inputs = [];
   for (const repo of config2.repos) {
-    const repoRoot = path33.resolve(workspaceRoot, repo.path);
-    if (!existsSync4(repoRoot) || !statSync2(repoRoot).isDirectory()) {
+    const repoRoot = path34.resolve(workspaceRoot, repo.path);
+    if (!existsSync5(repoRoot) || !statSync2(repoRoot).isDirectory()) {
       throw new Error(`Repo path is not a directory: ${repo.path}`);
     }
     const result = await scanProject(repoRoot, "fast");
@@ -5027,7 +5056,7 @@ async function runWorkspace(action, options = {}) {
 // src/cli.ts
 function cliVersion() {
   try {
-    const pkgPath = path34.join(packageRoot(), "package.json");
+    const pkgPath = path35.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
@@ -5037,7 +5066,7 @@ function cliVersion() {
 var program = new Command();
 function validateRuntimeNodeVersion() {
   try {
-    const pkgPath = path34.join(packageRoot(), "package.json");
+    const pkgPath = path35.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
     const requiredRange = pkg.engines?.node;
     if (requiredRange && !satisfiesVersion(process.version, requiredRange)) {
@@ -5066,6 +5095,9 @@ program.command("undo").option("-y, --yes", "Skip confirmation").action(runUndo)
 program.command("explain-recommendation").option("--json").action(runExplainRecommendation);
 program.command("context").option("--task <task>").option("--from-hook").option("--json").option("--verbose").action(runContext);
 program.command("init").option("--json").action(runInit);
+program.command("clone").description("Clone a single git repository by URL").argument("<url>", "Git URL to clone").argument("[dir]", "Target directory (default: repo name derived from the URL)").option("--dry-run", "Print what would happen without cloning").action(
+  (url, dir, opts) => runClone(url, { dir, dryRun: opts.dryRun })
+);
 program.command("refresh").action(runRefresh);
 program.command("catalog-audit").action(runCatalogAudit);
 program.command("validate-catalog").argument("[manifest]").action(runValidateCatalog);