@haus-tech/haus-workflow 0.25.0 → 0.26.0

package/dist/cli.js

@@ -2,11 +2,11 @@
 
 // src/cli.ts
 import { readFileSync as readFileSync4 } from "fs";
-import path36 from "path";
+import path34 from "path";
 import { Command } from "commander";
 
 // src/commands/apply.ts
-import path14 from "path";
+import path13 from "path";
 import checkbox from "@inquirer/checkbox";
 import fs13 from "fs-extra";
 
@@ -119,6 +119,7 @@ var validation_rules_default = {
   ],
   allowedNpxPattern: { source: "\\bnpx\\s+tsx\\b", flags: "i" },
   anyNpxPattern: { source: "\\bnpx\\s+\\S+", flags: "i" },
+  npxTsxOnlyExemptTypes: ["agent"],
   httpUrlPattern: { source: "^http:\\/\\/", flags: "i" },
   placeholderPattern: { source: "\\bTODO\\b|\\bPLACEHOLDER\\b", flags: "i" },
   allowedStacks: [
@@ -239,6 +240,7 @@ var REQUIRED_SKILL_FRONTMATTER = validation_rules_default.requiredSkillFrontmatt
 var RISKY_INSTALL_PATTERNS = validation_rules_default.riskyInstallPatterns.map(toRegExp);
 var ALLOWED_NPX_PATTERN = toRegExp(validation_rules_default.allowedNpxPattern);
 var ANY_NPX_PATTERN = toRegExp(validation_rules_default.anyNpxPattern);
+var NPX_TSX_ONLY_EXEMPT_TYPES = validation_rules_default.npxTsxOnlyExemptTypes ?? [];
 var HTTP_URL_PATTERN = toRegExp(validation_rules_default.httpUrlPattern);
 var PLACEHOLDER_PATTERN = toRegExp(validation_rules_default.placeholderPattern);
 var ALLOWED_STACKS = validation_rules_default.allowedStacks;
@@ -317,13 +319,14 @@ ${extractUseWhenSection(text)}`;
 // src/catalog/ingest-catalog.ts
 function validateCatalogItem(item, content2) {
   const label = item.id;
+  const checkNonTsxNpx = !NPX_TSX_ONLY_EXEMPT_TYPES.includes(item.type);
   const lines = content2.split(/\r?\n/);
   for (let i = 0; i < lines.length; i++) {
     const line2 = lines[i] ?? "";
     if (RISKY_INSTALL_PATTERNS.some((re) => re.test(line2))) {
       return { ok: false, reason: `${label}: risky install pattern at line ${i + 1}` };
     }
-    if (ANY_NPX_PATTERN.test(line2) && !ALLOWED_NPX_PATTERN.test(line2)) {
+    if (checkNonTsxNpx && ANY_NPX_PATTERN.test(line2) && !ALLOWED_NPX_PATTERN.test(line2)) {
       return { ok: false, reason: `${label}: disallowed npx at line ${i + 1}` };
     }
   }
@@ -839,14 +842,7 @@ async function getCacheManifestAge() {
 }
 
 // src/install/allow-rules.ts
-var ALLOWED_SUBCOMMANDS = [
-  "setup-project",
-  "apply",
-  "doctor",
-  "scan",
-  "context",
-  "recommend"
-];
+var ALLOWED_SUBCOMMANDS = ["setup-project", "apply", "doctor", "scan", "recommend"];
 function buildAllowRules() {
   return [...new Set(ALLOWED_SUBCOMMANDS.map((sub) => `Bash(haus ${sub}:*)`))];
 }
@@ -901,6 +897,44 @@ function collectEventHookCommands(entries) {
   }
   return cmds;
 }
+var RETIRED_HAUS_HOOK_COMMANDS = ["haus context --from-hook"];
+var RETIRED_HAUS_HOOK_IDS = ["hook.context", "haus.context-hook"];
+function reconcileRetiredHausHooks(updated, fragments, priorHaus, addedIds, addedCommands) {
+  const canonicalCommands = new Set(
+    fragments.filter((f) => f.gate === "keep").map((f) => f.command)
+  );
+  const canonicalIds = new Set(fragments.filter((f) => f.gate === "keep").map((f) => f.id));
+  const retiredCommands = new Set(RETIRED_HAUS_HOOK_COMMANDS);
+  for (const cmd of [...priorHaus?.hookCommands ?? [], ...addedCommands]) {
+    if (!canonicalCommands.has(cmd)) retiredCommands.add(cmd);
+  }
+  const prunedHooks = {};
+  for (const [event, entries] of Object.entries(updated.hooks ?? {})) {
+    const kept = entries.filter((entry) => {
+      const cmds = (entry.hooks ?? []).map((h) => h.command).filter(Boolean);
+      return cmds.length === 0 || !cmds.some((cmd) => retiredCommands.has(cmd));
+    });
+    if (kept.length > 0) prunedHooks[event] = kept;
+  }
+  updated.hooks = prunedHooks;
+  const retiredIdSet = new Set(RETIRED_HAUS_HOOK_IDS);
+  for (const id of priorHaus?.hooks ?? []) {
+    if (!canonicalIds.has(id)) retiredIdSet.add(id);
+  }
+  const survivingIds = [.../* @__PURE__ */ new Set([...priorHaus?.hooks ?? [], ...addedIds])].filter(
+    (id) => canonicalIds.has(id) && !retiredIdSet.has(id)
+  );
+  const survivingCommands = [
+    .../* @__PURE__ */ new Set([...priorHaus?.hookCommands ?? [], ...addedCommands])
+  ].filter((cmd) => canonicalCommands.has(cmd));
+  updated._haus = {
+    hooks: survivingIds,
+    ...survivingCommands.length > 0 ? { hookCommands: survivingCommands } : {},
+    ...priorHaus?.denyRules ? { denyRules: priorHaus.denyRules } : {},
+    ...priorHaus?.allowRules ? { allowRules: priorHaus.allowRules } : {},
+    ...priorHaus?.askRules ? { askRules: priorHaus.askRules } : {}
+  };
+}
 function mergeHooks(settings, fragments) {
   const existing = settings._haus?.hooks ?? [];
   const existingCommands = settings._haus?.hookCommands ?? [];
@@ -926,14 +960,7 @@ function mergeHooks(settings, fragments) {
     if (!existing.includes(fragment.id)) addedIds.push(fragment.id);
     if (!existingCommands.includes(fragment.command)) addedCommands.push(fragment.command);
   }
-  updated._haus = {
-    hooks: [...existing, ...addedIds],
-    hookCommands: [...existingCommands, ...addedCommands],
-    // Preserve deny/allow/ask tracking so hook, deny, allow, and ask merges are order-independent.
-    ...settings._haus?.denyRules ? { denyRules: settings._haus.denyRules } : {},
-    ...settings._haus?.allowRules ? { allowRules: settings._haus.allowRules } : {},
-    ...settings._haus?.askRules ? { askRules: settings._haus.askRules } : {}
-  };
+  reconcileRetiredHausHooks(updated, fragments, settings._haus, addedIds, addedCommands);
   return { settings: updated, addedIds };
 }
 function reconcileManagedRules(existing, prevTracked, newRules) {
@@ -1185,8 +1212,8 @@ function buildDenyRules() {
   for (const command of DENY_COMMANDS) {
     rules.push(`Bash(${command}:*)`);
   }
-  for (const path37 of DENY_PATHS) {
-    const pattern = DENY_DIRS.has(path37) ? `${path37}/**` : path37;
+  for (const path35 of DENY_PATHS) {
+    const pattern = DENY_DIRS.has(path35) ? `${path35}/**` : path35;
     for (const tool of FILE_TOOLS) {
       rules.push(`${tool}(${pattern})`);
     }
@@ -1242,12 +1269,6 @@ function packageRoot() {
 
 // src/claude/merge-project-settings.ts
 var PROJECT_HOOK_FRAGMENTS = [
-  {
-    id: "haus.context-hook",
-    gate: "keep",
-    event: "UserPromptSubmit",
-    command: "haus context --from-hook"
-  },
   {
     id: "haus.guard-file",
     gate: "keep",
@@ -1285,7 +1306,7 @@ async function applyProjectSettingsMerge(root) {
 }
 
 // src/claude/write-claude-files.ts
-import path13 from "path";
+import path12 from "path";
 import fs12 from "fs-extra";
 
 // src/catalog/load-catalog.ts
@@ -1388,19 +1409,6 @@ async function hashInstalledPaths(root, relPaths) {
   return hashText(fileDigests.map((f) => `${f.rel}=${f.digest}`).join("|"));
 }
 
-// src/claude/load-hooks-config.ts
-import path8 from "path";
-var CONFIG_PATH = ".haus-workflow/config.json";
-var DEFAULT_HOOKS_CONFIG = {
-  hooks: {
-    context: { enabled: false }
-  }
-};
-async function isHookEnabled(root, key) {
-  const cfg = await readJson(path8.join(root, CONFIG_PATH));
-  return cfg?.hooks?.[key]?.enabled === true;
-}
-
 // src/claude/managed-write.ts
 import fs5 from "fs-extra";
 
@@ -1454,7 +1462,7 @@ async function writeManagedJson(root, filePath, value, dryRun) {
 }
 
 // src/claude/superpowers-install.ts
-import path9 from "path";
+import path8 from "path";
 import fg3 from "fast-glob";
 import fs6 from "fs-extra";
 var SUPERPOWERS_ORIGIN_SOURCE_ID = "superpowers-pcvelz";
@@ -1471,7 +1479,7 @@ function rewriteSuperpowersMarkdown(text) {
 async function rewriteMarkdownTree(dir) {
   const files = await fg3("**/*.md", { cwd: dir, onlyFiles: true, dot: true });
   for (const rel of files) {
-    const abs = path9.join(dir, rel);
+    const abs = path8.join(dir, rel);
     const text = await fs6.readFile(abs, "utf8");
     const rewritten = rewriteSuperpowersMarkdown(text);
     if (rewritten !== text) {
@@ -1481,7 +1489,7 @@ async function rewriteMarkdownTree(dir) {
 }
 async function installCatalogSkill(sourcePath, destination, opts) {
   if (opts.dryRun) return;
-  await fs6.ensureDir(path9.dirname(destination));
+  await fs6.ensureDir(path8.dirname(destination));
   if (await fs6.pathExists(destination)) {
     await fs6.remove(destination);
   }
@@ -1491,17 +1499,17 @@ async function installCatalogSkill(sourcePath, destination, opts) {
   }
 }
 async function installSuperpowersShared(contentRoot, projectRoot, dryRun) {
-  const source = path9.join(contentRoot, SUPERPOWERS_SHARED_CATALOG_REL);
+  const source = path8.join(contentRoot, SUPERPOWERS_SHARED_CATALOG_REL);
   if (!await fs6.pathExists(source)) return null;
   const destination = claudePath(projectRoot, "skills", "shared");
-  if (dryRun) return path9.relative(projectRoot, destination);
-  await fs6.ensureDir(path9.dirname(destination));
+  if (dryRun) return path8.relative(projectRoot, destination);
+  await fs6.ensureDir(path8.dirname(destination));
   if (await fs6.pathExists(destination)) {
     await fs6.remove(destination);
   }
   await fs6.copy(source, destination, { overwrite: true, errorOnExist: false });
   await rewriteMarkdownTree(destination);
-  return path9.relative(projectRoot, destination);
+  return path8.relative(projectRoot, destination);
 }
 
 // src/claude/verify-hooks-contract.ts
@@ -1510,11 +1518,6 @@ import fs7 from "fs-extra";
 // src/claude/load-hooks.ts
 var CANONICAL_HOOKS = {
   hooks: {
-    UserPromptSubmit: [
-      {
-        hooks: [{ type: "command", command: "haus context --from-hook" }]
-      }
-    ],
     PreToolUse: [
       {
         matcher: "Read|Edit|Write",
@@ -1545,11 +1548,6 @@ function collectHookCommands(settings) {
 }
 function hausHookContractSatisfied(project, canonical) {
   const present = new Set(collectHookCommands(project));
-  for (const block of canonical.hooks.UserPromptSubmit) {
-    for (const h of block.hooks) {
-      if (!present.has(h.command)) return false;
-    }
-  }
   for (const block of canonical.hooks.PreToolUse) {
     for (const h of block.hooks) {
       if (!present.has(h.command)) return false;
@@ -1604,7 +1602,7 @@ async function verifyProjectSettingsHooksContract(root) {
 }
 
 // src/claude/write-root-claude-md.ts
-import path10 from "path";
+import path9 from "path";
 import fs8 from "fs-extra";
 var BLOCK_BEGIN = "<!-- HAUS:BEGIN haus-imports v=1 -->";
 var BLOCK_END = "<!-- HAUS:END haus-imports -->";
@@ -1645,7 +1643,7 @@ ${block}
 `;
 }
 async function writeRootClaudeMd(root, dryRun) {
-  const filePath = path10.join(root, "CLAUDE.md");
+  const filePath = path9.join(root, "CLAUDE.md");
   const block = buildImportBlock();
   const prev = await fs8.pathExists(filePath) ? await fs8.readFile(filePath, "utf8") : "";
   const next = injectHausBlock(prev, block);
@@ -1654,11 +1652,11 @@ async function writeRootClaudeMd(root, dryRun) {
 }
 
 // src/claude/write-workflow-config.ts
-import path12 from "path";
+import path11 from "path";
 import fs10 from "fs-extra";
 
 // src/claude/derive-workflow-config.ts
-import path11 from "path";
+import path10 from "path";
 import fs9 from "fs-extra";
 function binCmd(pm, bin, args) {
   const tail = args ? ` ${args}` : "";
@@ -1668,7 +1666,7 @@ function binCmd(pm, bin, args) {
 }
 async function deriveWorkflowConfig(root, ctx) {
   const pm = ctx.packageManager === "unknown" ? "npm" : ctx.packageManager;
-  const pkg = await readJson(path11.join(root, "package.json"));
+  const pkg = await readJson(path10.join(root, "package.json"));
   const scripts = pkg?.scripts ?? {};
   const deps = new Set(ctx.dependencies);
   const stacks = Object.values(ctx.detectedStacks ?? {}).flat();
@@ -1678,7 +1676,7 @@ async function deriveWorkflowConfig(root, ctx) {
     return null;
   };
   const hasDep = (name) => deps.has(name);
-  const exists = (rel) => fs9.pathExistsSync(path11.join(root, rel));
+  const exists = (rel) => fs9.pathExistsSync(path10.join(root, rel));
   const hasPlaywright = hasDep("@playwright/test") || stacks.includes("playwright");
   const hasCypress = hasDep("cypress");
   const preCommitTool = exists("lefthook.yml") || exists("lefthook.yaml") ? "lefthook" : exists(".husky") || hasDep("husky") || (scripts.prepare ?? "").includes("husky") ? "husky" : exists(".pre-commit-config.yaml") ? "pre-commit (Python framework)" : null;
@@ -1754,7 +1752,7 @@ async function writeWorkflowConfig(root, dryRun, opts = {}) {
   const ctx = await readJson(hausPath(root, "context-map.json")) ?? {
     ...FALLBACK_CONTEXT,
     root,
-    repoName: path12.basename(root)
+    repoName: path11.basename(root)
   };
   const values = await deriveWorkflowConfig(root, ctx);
   if (exists) {
@@ -1861,7 +1859,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
     estimatedTokenReductionPct: 0
   };
   const pkgRoot = packageRoot();
-  const hausVersion2 = (await readJson(path13.join(pkgRoot, "package.json")))?.version ?? "0.0.0";
+  const hausVersion2 = (await readJson(path12.join(pkgRoot, "package.json")))?.version ?? "0.0.0";
   const coreFiles = [
     claudePath(root, "settings.json"),
     claudePath(root, "rules", "haus.md"),
@@ -1885,10 +1883,6 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
     await applyProjectSettingsMerge(root);
     await assertPostApplySettingsHausContract(root);
   }
-  const configPath = hausPath(root, "config.json");
-  if (!await fs12.pathExists(configPath)) {
-    await writeManagedJson(root, configPath, DEFAULT_HOOKS_CONFIG, dryRun);
-  }
   await writeManagedText(
     root,
     claudePath(root, "commands", "haus-doctor.md"),
@@ -1947,6 +1941,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
     }
   }
   const LEGACY_PRUNED_ARTIFACTS = [
+    "config.json",
     "selected-context.json",
     "dependency-map.json",
     "scan-hashes.json",
@@ -1997,7 +1992,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
       );
       continue;
     }
-    const destination = claudePath(root, target, path13.basename(sourcePath));
+    const destination = claudePath(root, target, path12.basename(sourcePath));
     if (await fs12.pathExists(sourcePath)) {
       if (dryRun) {
         const exists = await fs12.pathExists(destination);
@@ -2010,17 +2005,17 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
           dryRun: false
         });
       } else {
-        await fs12.ensureDir(path13.dirname(destination));
+        await fs12.ensureDir(path12.dirname(destination));
         await fs12.copy(sourcePath, destination, { overwrite: true, errorOnExist: false });
       }
       files.push(destination);
-      const relPaths = [path13.relative(root, destination)];
+      const relPaths = [path12.relative(root, destination)];
       if (!superpowersSharedInstalled && manifestItem.originSourceId === SUPERPOWERS_ORIGIN_SOURCE_ID && item.type === "skill") {
         const sharedRel = await installSuperpowersShared(contentRoot, root, dryRun);
         if (sharedRel) {
           superpowersSharedInstalled = true;
           relPaths.push(sharedRel);
-          files.push(path13.join(root, sharedRel));
+          files.push(path12.join(root, sharedRel));
         }
       }
       const current = installedPathsByItem.get(item.id) ?? [];
@@ -2083,7 +2078,7 @@ async function cleanupStaleCatalogItems(root, knownIds, dryRun) {
     if (relPaths.length === 0) continue;
     const existing = [];
     for (const rel of relPaths) {
-      if (await fs12.pathExists(path13.join(root, rel))) existing.push(rel);
+      if (await fs12.pathExists(path12.join(root, rel))) existing.push(rel);
     }
     if (existing.length === 0) continue;
     if (entry.hash === void 0) {
@@ -2100,13 +2095,13 @@ async function cleanupStaleCatalogItems(root, knownIds, dryRun) {
       continue;
     }
     for (const rel of existing) {
-      const abs = path13.join(root, rel);
+      const abs = path12.join(root, rel);
       if (dryRun) {
         log(`[dry-run] would remove stale ${displayPath(root, abs)} (${entry.id})`);
         continue;
       }
       await fs12.remove(abs);
-      await pruneEmptyDir(path13.dirname(abs));
+      await pruneEmptyDir(path12.dirname(abs));
       log(`Removed stale ${displayPath(root, abs)} (${entry.id})`);
     }
   }
@@ -2114,7 +2109,7 @@ async function cleanupStaleCatalogItems(root, knownIds, dryRun) {
 
 // src/commands/apply.ts
 async function cacheHasItems() {
-  const data = await readJson(path14.join(getCacheDir(), "manifest.json"));
+  const data = await readJson(path13.join(getCacheDir(), "manifest.json"));
   return Array.isArray(data?.items) && data.items.length > 0;
 }
 async function runApply(options) {
@@ -2219,7 +2214,7 @@ async function runCatalogAudit() {
 
 // src/commands/clone.ts
 import { existsSync as existsSync2 } from "fs";
-import path15 from "path";
+import path14 from "path";
 
 // src/utils/exec.ts
 import { execa } from "execa";
@@ -2272,9 +2267,9 @@ async function runClone(url, opts = {}) {
     process.exitCode = 1;
     return;
   }
-  const target = path15.resolve(opts.dir?.trim() || repoNameFromUrl(url));
+  const target = path14.resolve(opts.dir?.trim() || repoNameFromUrl(url));
   if (existsSync2(target)) {
-    log(`\u2022 ${path15.basename(target)} already present at ${target} \u2014 skipped`);
+    log(`\u2022 ${path14.basename(target)} already present at ${target} \u2014 skipped`);
     return;
   }
   if (opts.dryRun) {
@@ -2290,399 +2285,12 @@ async function runClone(url, opts = {}) {
   log(`\u2713 cloned ${url} \u2192 ${target}`);
 }
 
-// src/commands/config.ts
-import path16 from "path";
-var CONFIG_PATH2 = ".haus-workflow/config.json";
-var HOOK_ALIASES = {
-  "hook.context": "context"
-};
-async function runConfig(key, action) {
-  const hookKey = HOOK_ALIASES[key];
-  if (!hookKey) {
-    throw new Error(
-      `Unknown config key "${key}". Valid keys: ${Object.keys(HOOK_ALIASES).join(", ")}`
-    );
-  }
-  const root = process.cwd();
-  const configPath = path16.join(root, CONFIG_PATH2);
-  const existing = await readJson(configPath);
-  const cfg = existing ?? structuredClone(DEFAULT_HOOKS_CONFIG);
-  cfg.hooks ??= {};
-  cfg.hooks[hookKey] ??= {};
-  if (action === "status") {
-    const enabled = cfg.hooks[hookKey]?.enabled === true;
-    log(`${key}: ${enabled ? "enabled" : "disabled"}`);
-    return;
-  }
-  cfg.hooks[hookKey].enabled = action === "enable";
-  await writeJson(configPath, cfg);
-  log(`${key} ${action}d`);
-}
-
-// src/recommender/token-estimate.ts
-var TOKENS_PER_ITEM = 320;
-function estimateContextTokens(selectedCount) {
-  return selectedCount * TOKENS_PER_ITEM;
-}
-function tokenReductionPct(selected, skipped) {
-  const total = selected + skipped;
-  if (total === 0) return 0;
-  return Math.max(0, Math.round(skipped / total * 100));
-}
-
-// src/recommender/explain-recommendation.ts
-function normalizeRecommendation(input2) {
-  const recommended = (input2.recommended ?? []).map((item) => {
-    const normalizedReasons = item.reasons?.map((reason) => ({
-      code: reason.code ?? "legacy-reason",
-      message: reason.message ?? item.reason ?? "legacy recommendation reason",
-      ...reason.signal ? { signal: reason.signal } : {}
-    })) ?? [{ code: "legacy-reason", message: item.reason ?? "legacy recommendation reason" }];
-    return {
-      id: item.id,
-      type: item.type ?? "skill",
-      reason: item.reason ?? normalizedReasons.map((reason) => reason.message).join(", "),
-      reasons: normalizedReasons,
-      selectionMode: item.selectionMode ?? "matched",
-      install: item.install ?? true,
-      tags: item.tags,
-      ecosystem: item.ecosystem,
-      tokenEstimate: item.tokenEstimate
-    };
-  });
-  const skipped = (input2.skipped ?? []).map((item) => ({
-    id: item.id,
-    reason: item.reason ?? "legacy skipped reason",
-    skipReasons: item.skipReasons?.map((reason) => ({
-      code: reason.code ?? "legacy-skip-reason",
-      message: reason.message ?? item.reason ?? "legacy skipped reason",
-      ...reason.signal ? { signal: reason.signal } : {}
-    })) ?? [{ code: "legacy-skip-reason", message: item.reason ?? "legacy skipped reason" }]
-  }));
-  return {
-    recommended,
-    skipped,
-    warnings: input2.warnings ?? [],
-    estimatedContextTokens: input2.estimatedContextTokens ?? estimateContextTokens(recommended.length),
-    selectedRules: input2.selectedRules ?? recommended.length,
-    skippedRules: input2.skippedRules ?? skipped.length,
-    estimatedTokenReductionPct: input2.estimatedTokenReductionPct ?? tokenReductionPct(recommended.length, skipped.length)
-  };
-}
-function buildRecommendationExplanation(recommendation) {
-  return {
-    selected: recommendation.recommended.map((item) => ({
-      id: item.id,
-      selectionMode: item.selectionMode,
-      reasons: item.reasons.map((reason) => reason.message)
-    })),
-    skipped: recommendation.skipped.map((item) => ({
-      id: item.id,
-      reasons: item.skipReasons.map((reason) => reason.message),
-      reasonDetails: item.skipReasons.map((reason) => ({
-        code: reason.code,
-        message: reason.message,
-        ...reason.signal ? { signal: reason.signal } : {}
-      }))
-    })),
-    stats: {
-      selectedRules: recommendation.selectedRules,
-      skippedRules: recommendation.skippedRules,
-      estimatedTokenReductionPct: recommendation.estimatedTokenReductionPct
-    }
-  };
-}
-
-// src/recommender/task-classification.ts
-var ALL_INTENTS = [
-  "backend",
-  "frontend",
-  "admin-ui",
-  "storefront",
-  "graphql",
-  "database",
-  "auth",
-  "testing",
-  "docs",
-  "monorepo"
-];
-var TASK_INTENT_KEYWORDS = {
-  backend: [
-    "api",
-    "endpoint",
-    "controller",
-    "service",
-    "queue",
-    "job",
-    "worker",
-    "cron",
-    "middleware",
-    "resolver",
-    "migration",
-    "seeder",
-    "model",
-    "repository",
-    "handler",
-    "plugin",
-    "webhook",
-    "schedule",
-    "background",
-    "consumer",
-    "producer",
-    "command",
-    "nova resource",
-    "api mutation",
-    "api subscription"
-  ],
-  frontend: [
-    "component",
-    "page",
-    "route",
-    "view",
-    "layout",
-    "form",
-    "dashboard",
-    "modal",
-    "navbar",
-    "navigation",
-    "sidebar",
-    "menu",
-    "tailwind",
-    "scss",
-    "style",
-    "theme",
-    "tanstack",
-    "shadcn",
-    "radix",
-    "block",
-    "client component",
-    "server component"
-  ],
-  "admin-ui": [
-    "admin",
-    "admin-ui",
-    "admin ui",
-    "backoffice",
-    "back-office",
-    "back office",
-    "nova",
-    "control panel",
-    "wp-admin",
-    "vendure admin"
-  ],
-  storefront: [
-    "storefront",
-    "checkout",
-    "cart",
-    "product page",
-    "product listing",
-    "category page",
-    "shop",
-    "ecommerce",
-    "e-commerce",
-    "order page"
-  ],
-  graphql: ["graphql", "resolver", "graphql mutation", "graphql subscription", "schema", "codegen"],
-  database: [
-    "database",
-    "migration",
-    "seed",
-    "table",
-    "index",
-    "elasticsearch",
-    "postgres",
-    "mariadb",
-    "mssql",
-    "sql query",
-    "db query"
-  ],
-  auth: [
-    "auth",
-    "login",
-    "logout",
-    "oauth",
-    "oidc",
-    "bankid",
-    "azure ad",
-    "session",
-    "jwt",
-    "permission",
-    "rbac",
-    "acl",
-    "guard",
-    "saml"
-  ],
-  testing: [
-    "test",
-    "tests",
-    "testing",
-    "spec",
-    "e2e",
-    "unit",
-    "story",
-    "stories",
-    "snapshot",
-    "fixture",
-    "playwright",
-    "cypress",
-    "phpunit",
-    "vitest"
-  ],
-  docs: ["doc", "docs", "documentation", "readme", "guide", "tutorial", "changelog"],
-  monorepo: [
-    "lib",
-    "library",
-    "package",
-    "workspace",
-    "shared",
-    "monorepo",
-    "nx",
-    "turbo",
-    "pnpm workspace",
-    "yarn workspace"
-  ]
-};
-function normalizeTaskForMatching(task) {
-  return ` ${task.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim()} `;
-}
-function classifyTaskIntents(task) {
-  const t = normalizeTaskForMatching(task);
-  const intents = /* @__PURE__ */ new Set();
-  for (const intent of ALL_INTENTS) {
-    const keywords = TASK_INTENT_KEYWORDS[intent];
-    for (const kw of keywords) {
-      const needle = ` ${kw} `;
-      if (t.includes(needle)) {
-        intents.add(intent);
-        break;
-      }
-    }
-  }
-  return intents;
-}
-function computeRuleIntents(rule) {
-  const intents = /* @__PURE__ */ new Set();
-  const tags = new Set((rule.tags ?? []).map((t) => t.toLowerCase()));
-  const eco = rule.ecosystem;
-  if (!eco && tags.size === 0) return intents;
-  const isTestingRule = tags.has("playwright") || tags.has("phpunit") || tags.has("testing-library") || tags.has("storybook") || tags.has("testing");
-  if (isTestingRule) {
-    intents.add("testing");
-    return intents;
-  }
-  if (eco === "laravel" || eco === "nestjs" || eco === "dotnet") {
-    intents.add("backend");
-  }
-  if (eco === "vendure") {
-    intents.add("backend");
-    intents.add("admin-ui");
-  }
-  if (eco === "wordpress") {
-    intents.add("backend");
-    intents.add("frontend");
-    intents.add("admin-ui");
-  }
-  if (eco === "nextjs" || eco === "react" || eco === "vue") {
-    intents.add("frontend");
-    intents.add("admin-ui");
-    intents.add("storefront");
-  }
-  if (eco === "tailwind" || eco === "vite") {
-    intents.add("frontend");
-  }
-  if (eco === "nx" || eco === "turbo") {
-    intents.add("monorepo");
-  }
-  if (tags.has("backend")) intents.add("backend");
-  if (tags.has("frontend")) intents.add("frontend");
-  if (tags.has("graphql")) intents.add("graphql");
-  if (tags.has("laravel-nova")) intents.add("admin-ui");
-  if (tags.has("oidc") || tags.has("azure-ad") || tags.has("bankid")) intents.add("auth");
-  if (tags.has("postgresql") || tags.has("mariadb") || tags.has("mssql") || tags.has("elasticsearch")) {
-    intents.add("database");
-  }
-  if (tags.has("nx21") || tags.has("turbo") || tags.has("yarn4") || tags.has("pnpm89")) {
-    intents.add("monorepo");
-  }
-  return intents;
-}
-
-// src/recommender/rule-selection.ts
-function evidenceCount(rule) {
-  return rule.reasons.filter((r) => r.code !== "default-baseline").length;
-}
-function isRoleOnly(rule) {
-  const codes = rule.reasons.map((r) => r.code).filter((c) => c !== "default-baseline");
-  return codes.length > 0 && codes.every((c) => c === "repo-role-match");
-}
-var DEFAULT_CONTEXT_TOKEN_BUDGET = 12e3;
-function pickTaskRelevantRules(recommendation, task, taskIntents = /* @__PURE__ */ new Set(), opts = {}) {
-  const recommended = recommendation?.recommended ?? [];
-  return applyTokenBudget(selectRules(recommended, task, taskIntents), opts.tokenBudget);
-}
-function applyTokenBudget(rules, budget) {
-  if (!budget || budget <= 0) return rules;
-  const total = rules.reduce((sum, r) => sum + (r.tokenEstimate ?? 0), 0);
-  if (total <= budget) return rules;
-  const keep = /* @__PURE__ */ new Set();
-  let used = 0;
-  for (const r of rules) {
-    if (r.selectionMode === "baseline") {
-      keep.add(r.id);
-      used += r.tokenEstimate ?? 0;
-    }
-  }
-  const matched = rules.filter((r) => r.selectionMode !== "baseline").sort((a, b) => evidenceCount(b) - evidenceCount(a) || a.id.localeCompare(b.id));
-  for (const r of matched) {
-    const est = r.tokenEstimate ?? 0;
-    if (used + est <= budget) {
-      keep.add(r.id);
-      used += est;
-    }
-  }
-  return rules.filter((r) => keep.has(r.id));
-}
-function selectRules(recommended, task, taskIntents) {
-  if (!task) return recommended;
-  if (taskIntents.size > 0) {
-    const intentMatches = recommended.filter((rule) => {
-      if (rule.selectionMode === "baseline") return false;
-      const ruleIntents = computeRuleIntents(rule);
-      if (ruleIntents.size === 0) return false;
-      for (const ti of taskIntents) {
-        if (ruleIntents.has(ti)) return true;
-      }
-      return false;
-    });
-    if (intentMatches.length > 0) return intentMatches;
-  }
-  const tokens = task.toLowerCase().split(/[^a-z0-9]+/).filter((t) => t.length >= 3);
-  const tokenMatches = recommended.filter((rule) => {
-    if (rule.selectionMode === "baseline") return false;
-    const corpus = [
-      rule.id,
-      rule.ecosystem ?? "",
-      ...rule.tags ?? [],
-      rule.reason ?? "",
-      ...rule.reasons.map((r) => r.message)
-    ].join(" ").toLowerCase();
-    return tokens.some((token) => corpus.includes(token));
-  });
-  if (tokenMatches.length > 0) return tokenMatches;
-  const taskWantsTesting = taskIntents.has("testing");
-  const capped = recommended.filter((rule) => {
-    if (rule.selectionMode === "baseline") return false;
-    if (isRoleOnly(rule)) return false;
-    if (taskWantsTesting) return true;
-    const ruleIntents = computeRuleIntents(rule);
-    const isTestingOnly = ruleIntents.size > 0 && [...ruleIntents].every((i) => i === "testing");
-    return !isTestingOnly;
-  });
-  return capped.slice(0, 8);
-}
+// src/commands/doctor.ts
+import path19 from "path";
+import fs15 from "fs-extra";
 
 // src/scanner/scan-project.ts
-import path20 from "path";
+import path18 from "path";
 
 // src/utils/audit-checks.ts
 function isRecord(v) {
@@ -2709,7 +2317,7 @@ function compareVersions(a, b) {
 }
 
 // src/scanner/detect-package-manager.ts
-import path17 from "path";
+import path15 from "path";
 import fs14 from "fs-extra";
 function detectPackageManager(root, packageManagerField) {
   const field = String(packageManagerField ?? "").trim();
@@ -2728,9 +2336,9 @@ function detectPackageManager(root, packageManagerField) {
     if (satisfiesVersion(version, ">=9")) return "npm";
     return "unknown";
   }
-  if (fs14.existsSync(path17.join(root, "yarn.lock"))) return "yarn";
-  if (fs14.existsSync(path17.join(root, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs14.existsSync(path17.join(root, "package-lock.json"))) return "npm";
+  if (fs14.existsSync(path15.join(root, "yarn.lock"))) return "yarn";
+  if (fs14.existsSync(path15.join(root, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs14.existsSync(path15.join(root, "package-lock.json"))) return "npm";
   return "unknown";
 }
 
@@ -2866,6 +2474,11 @@ var STACK_RULES = [
     stack: ["backend", "graphql"],
     any: [fileEndsWith(".graphql"), fileEndsWith("schema.graphql")]
   },
+  // PHP (Composer-managed) — broad language signal so php-tooling catalog items
+  // (e.g. the php-reviewer agent gated on { stack: 'php' }) are recommendable on any
+  // Composer project. Placed before laravel/wordpress so 'php' precedes the
+  // framework-specific stacks in the backend bucket.
+  { stack: ["backend", "php"], any: [fileEndsWith("composer.json")] },
   { stack: ["backend", "laravel"], any: [dep("laravel/framework")] },
   { stack: ["backend", "laravel"], any: [fileIncludes("app/Providers/"), fileIncludes("routes/")] },
   { stack: ["backend", "wordpress"], any: [fileEndsWith("wp-config.php"), dep("roots/wordpress")] },
@@ -2927,7 +2540,7 @@ function runDetection(ctx, rules = STACK_RULES) {
 }
 
 // src/scanner/detection.ts
-import path18 from "path";
+import path16 from "path";
 var UNSUPPORTED_MARKERS = {
   "requirements.txt": "python",
   "pyproject.toml": "python",
@@ -2981,68 +2594,14 @@ function finalizeRoles(registryRoles, deps, files) {
 function collectUnsupportedSignals(files) {
   return [
     ...new Set(
-      files.map((f) => UNSUPPORTED_MARKERS[path18.basename(f)]).filter((s) => Boolean(s))
+      files.map((f) => UNSUPPORTED_MARKERS[path16.basename(f)]).filter((s) => Boolean(s))
     )
   ].sort();
 }
 
 // src/scanner/render.ts
 import { readFile } from "fs/promises";
-import path19 from "path";
-
-// src/scanner/role-labels.ts
-var ROLE_LABELS = {
-  "next-app": "a Next.js app",
-  "react-app": "a React app",
-  "vite-app": "a Vite app",
-  "react-router-app": "a React Router app",
-  "sanity-studio": "a Sanity Studio",
-  "strapi-app": "a Strapi app",
-  "expo-app": "an Expo app",
-  "vendure-app": "a Vendure server",
-  "vendure-plugin": "a Vendure plugin",
-  "nestjs-api": "a NestJS API",
-  "graphql-api": "a GraphQL API",
-  "nx-monorepo": "an Nx monorepo",
-  "turbo-monorepo": "a Turborepo monorepo",
-  "laravel-app": "a Laravel app",
-  "laravel-nova-app": "a Laravel Nova app",
-  "dotnet-service": "a .NET service",
-  "express-service": "an Express service",
-  "wordpress-bedrock-site": "a WordPress (Bedrock) site",
-  "wordpress-vanilla-site": "a WordPress site",
-  "wordpress-site": "a WordPress site"
-};
-function article(word) {
-  return /^[aeiou]/i.test(word) ? "an" : "a";
-}
-function friendlyRole(role) {
-  const known = ROLE_LABELS[role];
-  if (known) return known;
-  const words = role.replace(/[-_]+/g, " ").trim();
-  return words ? `${article(words)} ${words}` : "a project";
-}
-function joinRoles(labels) {
-  if (labels.length === 0) return "";
-  if (labels.length === 1) return labels[0];
-  return `${labels.slice(0, -1).join(", ")} and ${labels[labels.length - 1]}`;
-}
-function describeRepo(context) {
-  const labels = context.repoRoles.map(friendlyRole);
-  const roleText = joinRoles(labels);
-  if (context.detectionStatus === "unknown") {
-    const markers = context.unsupportedSignals.join(", ");
-    const detail = markers ? ` (I see ${markers})` : "";
-    return `I couldn't fully recognise this stack${detail}, so I'll apply the general workflow and security guidance rather than framework-specific help.`;
-  }
-  const base = roleText ? `This looks like ${roleText}, using ${context.packageManager}.` : `I recognised this project's tooling (${context.packageManager}) but not a specific framework.`;
-  if (context.detectionStatus === "partial" && context.unsupportedSignals.length > 0) {
-    return `${base} I also see ${context.unsupportedSignals.join(", ")}, which haus doesn't fully support \u2014 guidance covers the recognised parts.`;
-  }
-  return base;
-}
-
-// src/scanner/render.ts
+import path17 from "path";
 async function buildContentBlob(root, files) {
   const candidates = files.filter(
     (f) => f.endsWith(".ts") || f.endsWith(".js") || f.endsWith(".php") || f.endsWith(".json") || f.endsWith(".yml") || f.endsWith(".yaml")
@@ -3050,24 +2609,13 @@ async function buildContentBlob(root, files) {
   const slice = candidates.slice(0, 300);
   const parts = await mapWithConcurrency(slice, async (rel) => {
     try {
-      return await readFile(path19.join(root, rel), "utf8");
+      return await readFile(path17.join(root, rel), "utf8");
     } catch {
       return "";
     }
   });
   return parts.join("\n");
 }
-function renderSummary(context) {
-  return `# Repo summary
-
-${describeRepo(context)}
-
-- Repo: ${context.repoName}
-- Package manager: ${context.packageManager}
-- Roles: ${context.repoRoles.join(", ") || "unknown"}
-- Generated: ${context.generatedAt}
-`;
-}
 
 // src/scanner/write-sources-report.ts
 function buildSourcesReport(items) {
@@ -3148,8 +2696,8 @@ var SAFE_FILES = [
   "Gemfile"
 ];
 async function scanProject(root) {
-  const pkg = await readJson(path20.join(root, "package.json"));
-  const composer = await readJson(path20.join(root, "composer.json"));
+  const pkg = await readJson(path18.join(root, "package.json"));
+  const composer = await readJson(path18.join(root, "composer.json"));
   const files = await listFiles(root, SAFE_FILES);
   const safeFiles = files.filter((f) => !blocked(f));
   const deps = dependencySet(pkg, composer);
@@ -3178,7 +2726,7 @@ async function scanProject(root) {
   const context = {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     root,
-    repoName: String(pkg?.name ?? path20.basename(root)),
+    repoName: String(pkg?.name ?? path18.basename(root)),
     packageManager,
     repoRoles: roles,
     detectedStacks: stacks,
@@ -3202,74 +2750,6 @@ async function readContextOrScan(root) {
   return scan;
 }
 
-// src/security/secret-patterns.ts
-var SECRET_PATTERNS = [
-  /api[_-]?key\s*[:=]\s*\S+/i,
-  /token\s*[:=]\s*\S+/i,
-  /password\s*[:=]\s*\S+/i
-];
-
-// src/security/redact-sensitive.ts
-function redactSensitive(input2) {
-  return SECRET_PATTERNS.reduce((acc, pattern) => acc.replace(pattern, "[REDACTED]"), input2);
-}
-
-// src/commands/context.ts
-async function runContext(options) {
-  const root = process.cwd();
-  if (options.fromHook && !await isHookEnabled(root, "context")) {
-    return;
-  }
-  const context = await readContextOrScan(root);
-  const summary = renderSummary(context);
-  const recommendationRaw = await readJson(hausPath(root, "recommendation.json"));
-  const recommendation = recommendationRaw ? normalizeRecommendation(recommendationRaw) : void 0;
-  const taskIntents = options.task ? classifyTaskIntents(options.task) : /* @__PURE__ */ new Set();
-  const selected = pickTaskRelevantRules(recommendation, options.task, taskIntents, {
-    tokenBudget: DEFAULT_CONTEXT_TOKEN_BUDGET
-  });
-  const payload = {
-    task: options.task ?? "not provided",
-    taskIntents: [...taskIntents].sort(),
-    roles: context.repoRoles,
-    selectedRules: selected.map((x) => ({
-      id: x.id,
-      selectionMode: x.selectionMode,
-      reasons: x.reasons.map((reason) => reason.message),
-      ...options.verbose ? { signals: x.reasons.map((r) => r.signal).filter(Boolean) } : {}
-    })),
-    skippedCount: recommendation?.skippedRules ?? 0,
-    estimatedTokenReductionPct: recommendation?.estimatedTokenReductionPct ?? 0
-  };
-  if (options.json) {
-    log(JSON.stringify(payload, null, 2));
-    return;
-  }
-  const lines = [
-    "# Haus Context",
-    `Task: ${payload.task}`,
-    `Task intents: ${payload.taskIntents.join(", ") || "(none classified)"}`,
-    `Roles: ${payload.roles.join(", ") || "unknown"}`,
-    `Selected rules: ${payload.selectedRules.length}`,
-    `Skipped rules: ${payload.skippedCount}`,
-    `Estimated token reduction: ${payload.estimatedTokenReductionPct}%`,
-    "Use minimal context.",
-    ...payload.selectedRules.flatMap((rule) => {
-      const reasonLine = `- ${rule.id}: ${rule.reasons.join(", ")}`;
-      if (!options.verbose) return [reasonLine];
-      const signals = (rule.signals ?? []).map((s) => `  \u2022 ${s}`);
-      return [reasonLine, ...signals];
-    }),
-    summary
-  ];
-  const text = redactSensitive(lines.join("\n"));
-  log(options.fromHook ? text.slice(0, 3e3) : text);
-}
-
-// src/commands/doctor.ts
-import path21 from "path";
-import fs15 from "fs-extra";
-
 // src/update/npm-version.ts
 var NPM_PACKAGE_NAME = "@haus-tech/haus-workflow";
 async function fetchNpmVersionStatus(currentVersion) {
@@ -3343,12 +2823,7 @@ async function runDoctor(options) {
   } else {
     ok(`- HOOKS OK: ${hooks.message}`);
   }
-  const gatedHooks = ["context"];
-  for (const key of gatedHooks) {
-    const enabled = await isHookEnabled(root, key);
-    ok(`- HOOK ${key}: ${enabled ? "enabled" : "disabled (default)"}`);
-  }
-  const rootClaudeMdPath = path21.join(root, "CLAUDE.md");
+  const rootClaudeMdPath = path19.join(root, "CLAUDE.md");
   const rootClaudeMdContent = await readText(rootClaudeMdPath);
   if (!rootClaudeMdContent) {
     flag(
@@ -3410,8 +2885,8 @@ async function runDoctor(options) {
           "haus apply --write --force"
         );
       } else {
-        const cachePath = path21.join(getCacheDir(), "templates/agentic-workflow-standard.md");
-        const bundledPath = path21.join(
+        const cachePath = path19.join(getCacheDir(), "templates/agentic-workflow-standard.md");
+        const bundledPath = path19.join(
           packageRoot(),
           "library",
           "global",
@@ -3477,7 +2952,7 @@ async function runDoctor(options) {
       ok(`- CATALOG CACHE: OK (${cacheAgeDays}d old)`);
     }
   }
-  const pkgJson = await readJson(path21.join(packageRoot(), "package.json"));
+  const pkgJson = await readJson(path19.join(packageRoot(), "package.json"));
   const currentVersion = pkgJson?.version ?? "0.0.0";
   const npmStatus = await fetchNpmVersionStatus(currentVersion);
   if (npmStatus.updateAvailable && npmStatus.latest !== null) {
@@ -3541,6 +3016,80 @@ function formatRecommendationHuman(rec) {
   return lines.join("\n");
 }
 
+// src/recommender/token-estimate.ts
+var TOKENS_PER_ITEM = 320;
+function estimateContextTokens(selectedCount) {
+  return selectedCount * TOKENS_PER_ITEM;
+}
+function tokenReductionPct(selected, skipped) {
+  const total = selected + skipped;
+  if (total === 0) return 0;
+  return Math.max(0, Math.round(skipped / total * 100));
+}
+
+// src/recommender/explain-recommendation.ts
+function normalizeRecommendation(input2) {
+  const recommended = (input2.recommended ?? []).map((item) => {
+    const normalizedReasons = item.reasons?.map((reason) => ({
+      code: reason.code ?? "legacy-reason",
+      message: reason.message ?? item.reason ?? "legacy recommendation reason",
+      ...reason.signal ? { signal: reason.signal } : {}
+    })) ?? [{ code: "legacy-reason", message: item.reason ?? "legacy recommendation reason" }];
+    return {
+      id: item.id,
+      type: item.type ?? "skill",
+      reason: item.reason ?? normalizedReasons.map((reason) => reason.message).join(", "),
+      reasons: normalizedReasons,
+      selectionMode: item.selectionMode ?? "matched",
+      install: item.install ?? true,
+      tags: item.tags,
+      ecosystem: item.ecosystem,
+      tokenEstimate: item.tokenEstimate
+    };
+  });
+  const skipped = (input2.skipped ?? []).map((item) => ({
+    id: item.id,
+    reason: item.reason ?? "legacy skipped reason",
+    skipReasons: item.skipReasons?.map((reason) => ({
+      code: reason.code ?? "legacy-skip-reason",
+      message: reason.message ?? item.reason ?? "legacy skipped reason",
+      ...reason.signal ? { signal: reason.signal } : {}
+    })) ?? [{ code: "legacy-skip-reason", message: item.reason ?? "legacy skipped reason" }]
+  }));
+  return {
+    recommended,
+    skipped,
+    warnings: input2.warnings ?? [],
+    estimatedContextTokens: input2.estimatedContextTokens ?? estimateContextTokens(recommended.length),
+    selectedRules: input2.selectedRules ?? recommended.length,
+    skippedRules: input2.skippedRules ?? skipped.length,
+    estimatedTokenReductionPct: input2.estimatedTokenReductionPct ?? tokenReductionPct(recommended.length, skipped.length)
+  };
+}
+function buildRecommendationExplanation(recommendation) {
+  return {
+    selected: recommendation.recommended.map((item) => ({
+      id: item.id,
+      selectionMode: item.selectionMode,
+      reasons: item.reasons.map((reason) => reason.message)
+    })),
+    skipped: recommendation.skipped.map((item) => ({
+      id: item.id,
+      reasons: item.skipReasons.map((reason) => reason.message),
+      reasonDetails: item.skipReasons.map((reason) => ({
+        code: reason.code,
+        message: reason.message,
+        ...reason.signal ? { signal: reason.signal } : {}
+      }))
+    })),
+    stats: {
+      selectedRules: recommendation.selectedRules,
+      skippedRules: recommendation.skippedRules,
+      estimatedTokenReductionPct: recommendation.estimatedTokenReductionPct
+    }
+  };
+}
+
 // src/commands/explain-recommendation.ts
 async function runExplainRecommendation(options) {
   const root = process.cwd();
@@ -3620,7 +3169,7 @@ async function runGuard(kind, _options) {
 }
 
 // src/commands/init.ts
-import path22 from "path";
+import path20 from "path";
 import fs16 from "fs-extra";
 
 // src/utils/prompts.ts
@@ -3968,7 +3517,7 @@ async function runSetupProject(options) {
 // src/commands/init.ts
 async function runInit(options) {
   const root = process.cwd();
-  const hausDir = path22.join(root, ".haus-workflow");
+  const hausDir = path20.join(root, ".haus-workflow");
   const alreadyInit = await fs16.pathExists(hausDir);
   if (alreadyInit) {
     log("Haus AI already initialized in this project.");
@@ -3981,7 +3530,7 @@ async function runInit(options) {
 
 // src/install/apply.ts
 import crypto2 from "crypto";
-import path23 from "path";
+import path21 from "path";
 import fs17 from "fs-extra";
 
 // src/install/header.ts
@@ -4070,7 +3619,7 @@ function hashContent(content2) {
 }
 function sourceVersion() {
   try {
-    const pkgPath = path23.join(packageRoot(), "package.json");
+    const pkgPath = path21.join(packageRoot(), "package.json");
     const pkg = JSON.parse(fs17.readFileSync(pkgPath, "utf8"));
     return `${pkg.name ?? "haus"}@${pkg.version ?? "0.0.0"}`;
   } catch {
@@ -4078,32 +3627,32 @@ function sourceVersion() {
   }
 }
 function globalSrcDir() {
-  return path23.join(packageRoot(), "library", "global");
+  return path21.join(packageRoot(), "library", "global");
 }
 function collectSourceFiles(srcDir, claudeDir) {
   const entries = [];
-  const skillsDir = path23.join(srcDir, "skills");
+  const skillsDir = path21.join(srcDir, "skills");
   if (fs17.pathExistsSync(skillsDir)) {
     for (const skillName of fs17.readdirSync(skillsDir)) {
-      const skillFile = path23.join(skillsDir, skillName, "SKILL.md");
+      const skillFile = path21.join(skillsDir, skillName, "SKILL.md");
       if (fs17.pathExistsSync(skillFile)) {
         entries.push({
           stableId: `skill.${skillName}`,
-          srcRelPath: path23.join("library", "global", "skills", skillName, "SKILL.md"),
-          destPath: path23.join(claudeDir, "skills", skillName, "SKILL.md")
+          srcRelPath: path21.join("library", "global", "skills", skillName, "SKILL.md"),
+          destPath: path21.join(claudeDir, "skills", skillName, "SKILL.md")
         });
       }
     }
   }
-  const commandsDir = path23.join(srcDir, "commands");
+  const commandsDir = path21.join(srcDir, "commands");
   if (fs17.pathExistsSync(commandsDir)) {
     for (const fileName of fs17.readdirSync(commandsDir)) {
       if (!fileName.endsWith(".md")) continue;
       const commandName = fileName.slice(0, -".md".length);
       entries.push({
         stableId: `command.${commandName}`,
-        srcRelPath: path23.join("library", "global", "commands", fileName),
-        destPath: path23.join(claudeDir, "commands", fileName)
+        srcRelPath: path21.join("library", "global", "commands", fileName),
+        destPath: path21.join(claudeDir, "commands", fileName)
       });
     }
   }
@@ -4127,7 +3676,7 @@ async function applyInstall(options = {}) {
   };
   const manifestFiles = [];
   for (const entry of sourceFiles) {
-    const srcPath = path23.join(packageRoot(), entry.srcRelPath);
+    const srcPath = path21.join(packageRoot(), entry.srcRelPath);
     const rawContent = await readText(srcPath);
     if (rawContent === void 0) {
       warn(`Source file not found: ${entry.srcRelPath}`);
@@ -4183,7 +3732,7 @@ async function applyInstall(options = {}) {
       schemaVersion: SCHEMA_VERSION2
     });
   }
-  const fragmentPath = path23.join(srcDir, "settings-fragments", "hooks.json");
+  const fragmentPath = path21.join(srcDir, "settings-fragments", "hooks.json");
   const fragments = await loadHooksFragment(fragmentPath);
   const settings = await readSettings();
   const { settings: hookSettings, addedIds } = mergeHooks(settings, fragments);
@@ -4321,12 +3870,12 @@ async function runScan(options) {
 }
 
 // src/commands/undo.ts
-import path24 from "path";
+import path22 from "path";
 import fs18 from "fs-extra";
 
 // src/claude/managed-paths.ts
 var PROJECT_MANAGED_CLAUDE_REL = ["rules/haus.md", "commands/haus-doctor.md"];
-var PROJECT_MANAGED_HAUS_REL = ["haus.lock.json", "config.json"];
+var PROJECT_MANAGED_HAUS_REL = ["haus.lock.json"];
 function coreManagedAbsolutePaths(root) {
   const claude = PROJECT_MANAGED_CLAUDE_REL.map((rel) => claudePath(root, rel));
   const haus = PROJECT_MANAGED_HAUS_REL.map((rel) => hausPath(root, rel));
@@ -4339,7 +3888,7 @@ async function collectManagedPaths(root) {
   const lock = await readJson(hausPath(root, "haus.lock.json"));
   for (const row of lock ?? []) {
     for (const rel of row.paths ?? []) {
-      paths.add(path24.resolve(root, rel));
+      paths.add(path22.resolve(root, rel));
     }
   }
   const existing = [];
@@ -4355,7 +3904,7 @@ async function settingsHasHausContent(root) {
   return settings._haus != null;
 }
 async function claudeMdHasHausBlock(root) {
-  const filePath = path24.join(root, "CLAUDE.md");
+  const filePath = path22.join(root, "CLAUDE.md");
   if (!await fs18.pathExists(filePath)) return false;
   const text = await fs18.readFile(filePath, "utf8");
   return text.includes(BLOCK_BEGIN);
@@ -4368,15 +3917,15 @@ async function stripProjectSettings(root) {
   const hasContent = Object.keys(settings).length > 0;
   if (hasContent) {
     await writeProjectSettings(root, settings);
-    log(`Stripped haus rules from ${path24.relative(root, settingsPath)} (user settings preserved).`);
+    log(`Stripped haus rules from ${path22.relative(root, settingsPath)} (user settings preserved).`);
     return true;
   }
   await fs18.remove(settingsPath);
-  log(`Removed ${path24.relative(root, settingsPath)} (no user-owned settings remained).`);
+  log(`Removed ${path22.relative(root, settingsPath)} (no user-owned settings remained).`);
   return true;
 }
 async function stripRootClaudeMd(root) {
-  const filePath = path24.join(root, "CLAUDE.md");
+  const filePath = path22.join(root, "CLAUDE.md");
   if (!await fs18.pathExists(filePath)) return false;
   const prev = await fs18.readFile(filePath, "utf8");
   if (!prev.includes(BLOCK_BEGIN)) return false;
@@ -4404,7 +3953,7 @@ async function runUndo(options) {
     log("Nothing to remove: no haus-managed files found in this directory.");
     return;
   }
-  const relTargets = managed.map((p) => path24.relative(root, p));
+  const relTargets = managed.map((p) => path22.relative(root, p));
   const summaryParts = [...relTargets];
   if (stripSettings) summaryParts.push(".claude/settings.json (haus rules only)");
   if (stripClaudeMd) summaryParts.push("CLAUDE.md (haus import block only)");
@@ -4422,7 +3971,7 @@ User-owned .claude/ files will be preserved.`
   for (const abs of managed) {
     if (!await fs18.pathExists(abs)) continue;
     await fs18.remove(abs);
-    log(`Removed ${path24.relative(root, abs)}`);
+    log(`Removed ${path22.relative(root, abs)}`);
   }
   if (stripSettings) await stripProjectSettings(root);
   if (stripClaudeMd) await stripRootClaudeMd(root);
@@ -4433,7 +3982,7 @@ User-owned .claude/ files will be preserved.`
 
 // src/install/uninstall.ts
 import crypto3 from "crypto";
-import path25 from "path";
+import path23 from "path";
 import fs19 from "fs-extra";
 async function runUninstall(options = {}) {
   const { force = false } = options;
@@ -4463,14 +4012,14 @@ async function runUninstall(options = {}) {
       continue;
     }
     await fs19.remove(entry.destPath);
-    await pruneEmptyDir(path25.dirname(entry.destPath));
+    await pruneEmptyDir(path23.dirname(entry.destPath));
     result.deleted.push(entry.destPath);
   }
   const settings = await readSettings();
   const stripped = stripHausHooks(stripHausAsk(stripHausAllow(stripHausDeny(settings))));
   await writeSettings(stripped);
   result.hooksStripped = true;
-  const hausDir = path25.join(globalClaudeDir(), "haus");
+  const hausDir = path23.join(globalClaudeDir(), "haus");
   const manifestPath2 = hausManifestPath();
   if (fs19.pathExistsSync(manifestPath2)) {
     await fs19.remove(manifestPath2);
@@ -4508,7 +4057,7 @@ async function runUninstallCommand(options) {
 }
 
 // src/commands/update.ts
-import path27 from "path";
+import path25 from "path";
 
 // src/update/diff-generated-files.ts
 function diffGeneratedFiles() {
@@ -4535,7 +4084,7 @@ function summarizeLockDiff(before, after) {
 
 // src/update/lockfile.ts
 import { mkdir, readFile as readFile2, copyFile } from "fs/promises";
-import path26 from "path";
+import path24 from "path";
 async function checkLock(root) {
   const lock = await readJson(hausPath(root, "haus.lock.json")) ?? [];
   const hasValidVersions = lock.every(
@@ -4566,7 +4115,7 @@ async function applyLock(root) {
   try {
     const backupDir = hausPath(root, "backups");
     await mkdir(backupDir, { recursive: true });
-    await copyFile(lockPath, path26.join(backupDir, `haus.lock.${Date.now()}.json`));
+    await copyFile(lockPath, path24.join(backupDir, `haus.lock.${Date.now()}.json`));
   } catch {
   }
   const enriched = await Promise.all(
@@ -4588,7 +4137,7 @@ function diffLock(before, after) {
 }
 async function hasLocalOverrides(root) {
   try {
-    await readFile2(path26.join(root, ".claude", "settings.json"), "utf8");
+    await readFile2(path24.join(root, ".claude", "settings.json"), "utf8");
     return true;
   } catch {
     return false;
@@ -4600,7 +4149,7 @@ var NPM_PACKAGE_NAME2 = "@haus-tech/haus-workflow";
 async function runUpdate(options) {
   const root = process.cwd();
   if (options.check) {
-    const pkgJson2 = await readJson(path27.join(packageRoot(), "package.json"));
+    const pkgJson2 = await readJson(path25.join(packageRoot(), "package.json"));
     const currentVersion2 = pkgJson2?.version ?? "0.0.0";
     const [status, npmVersion, latestCatalogTag, globalInstallDrift] = await Promise.all([
       checkLock(root),
@@ -4630,7 +4179,7 @@ async function runUpdate(options) {
     if (status.driftCount > 0) process.exitCode = 1;
     return;
   }
-  const pkgJson = await readJson(path27.join(packageRoot(), "package.json"));
+  const pkgJson = await readJson(path25.join(packageRoot(), "package.json"));
   const currentVersion = pkgJson?.version ?? "0.0.0";
   const npmStatus = await fetchNpmVersionStatus(currentVersion);
   if (npmStatus.updateAvailable && npmStatus.latest !== null) {
@@ -4708,7 +4257,7 @@ async function detectGlobalInstallDrift() {
 
 // src/commands/validate-catalog.ts
 import fs20 from "fs";
-import path28 from "path";
+import path26 from "path";
 function auditForbiddenStacks(items) {
   const failures = [];
   for (const item of items) {
@@ -4785,17 +4334,17 @@ function auditShippedFiles(manifestDir, items) {
   const failures = [];
   for (const item of items) {
     if (!item.path) continue;
-    const absPath = path28.join(manifestDir, item.path);
+    const absPath = path26.join(manifestDir, item.path);
     if (item.type === "skill") {
-      const skillMd = path28.join(absPath, "SKILL.md");
+      const skillMd = path26.join(absPath, "SKILL.md");
       if (!fs20.existsSync(skillMd)) {
-        failures.push(`${item.id}: missing ${path28.relative(manifestDir, skillMd)}`);
+        failures.push(`${item.id}: missing ${path26.relative(manifestDir, skillMd)}`);
         continue;
       }
       const text = fs20.readFileSync(skillMd, "utf8");
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: SKILL.md`));
       failures.push(
-        ...auditForbiddenTagsInText(text, `${item.id}: ${path28.relative(manifestDir, skillMd)}`)
+        ...auditForbiddenTagsInText(text, `${item.id}: ${path26.relative(manifestDir, skillMd)}`)
       );
     } else if (item.type === "agent") {
       if (!fs20.existsSync(absPath)) {
@@ -4803,7 +4352,7 @@ function auditShippedFiles(manifestDir, items) {
         continue;
       }
       const text = fs20.readFileSync(absPath, "utf8");
-      const rel = path28.relative(manifestDir, absPath);
+      const rel = path26.relative(manifestDir, absPath);
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: ${rel}`));
       failures.push(...auditForbiddenTagsInText(text, `${item.id}: ${rel}`));
     } else if (item.type === "template") {
@@ -4818,7 +4367,7 @@ function auditShippedFiles(manifestDir, items) {
         continue;
       }
       const text = fs20.readFileSync(absPath, "utf8");
-      const rel = path28.relative(manifestDir, absPath);
+      const rel = path26.relative(manifestDir, absPath);
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: ${rel}`));
       failures.push(...auditTemplateContent(manifestDir, absPath, item.id));
     }
@@ -4826,7 +4375,7 @@ function auditShippedFiles(manifestDir, items) {
   return failures;
 }
 function auditTemplateContent(manifestDir, absPath, itemId) {
-  const rel = path28.relative(manifestDir, absPath);
+  const rel = path26.relative(manifestDir, absPath);
   const text = fs20.readFileSync(absPath, "utf8");
   const failures = [];
   const lines = text.split(/\r?\n/);
@@ -4845,22 +4394,29 @@ function auditTemplateContent(manifestDir, absPath, itemId) {
   failures.push(...auditForbiddenTagsInText(text, `${itemId}: ${rel}`));
   return failures;
 }
+var DIR_ITEM_TYPE = {
+  skills: "skill",
+  agents: "agent",
+  templates: "template",
+  commands: "command"
+};
 function auditMarkdownContent(manifestDir) {
   const failures = [];
   const dirs = ["skills", "agents", "templates", "commands"];
   for (const dir of dirs) {
-    const abs = path28.join(manifestDir, dir);
+    const abs = path26.join(manifestDir, dir);
     if (!fs20.existsSync(abs)) continue;
+    const checkNonTsxNpx = !NPX_TSX_ONLY_EXEMPT_TYPES.includes(DIR_ITEM_TYPE[dir] ?? "");
     walkMd(abs, (file) => {
       const text = fs20.readFileSync(file, "utf8");
-      const rel = path28.relative(manifestDir, file);
+      const rel = path26.relative(manifestDir, file);
       const lines = text.split(/\r?\n/);
       for (let i = 0; i < lines.length; i++) {
         const line2 = lines[i] ?? "";
         if (RISKY_INSTALL_PATTERNS.some((re) => re.test(line2))) {
           failures.push(`${rel}:${i + 1}: risky install pattern`);
         }
-        if (ANY_NPX_PATTERN.test(line2) && !ALLOWED_NPX_PATTERN.test(line2)) {
+        if (checkNonTsxNpx && ANY_NPX_PATTERN.test(line2) && !ALLOWED_NPX_PATTERN.test(line2)) {
           failures.push(`${rel}:${i + 1}: disallowed npx (only npx tsx allowed)`);
         }
       }
@@ -4873,7 +4429,7 @@ function auditMarkdownContent(manifestDir) {
 }
 function walkMd(dir, fn) {
   for (const entry of fs20.readdirSync(dir, { withFileTypes: true })) {
-    const full = path28.join(dir, entry.name);
+    const full = path26.join(dir, entry.name);
     if (entry.isDirectory()) walkMd(full, fn);
     else if (entry.name.endsWith(".md")) fn(full);
   }
@@ -4884,8 +4440,8 @@ async function runValidateCatalog(manifestPath2) {
     process.exitCode = 1;
     return;
   }
-  const abs = path28.resolve(process.cwd(), manifestPath2);
-  const manifestDir = path28.dirname(abs);
+  const abs = path26.resolve(process.cwd(), manifestPath2);
+  const manifestDir = path26.dirname(abs);
   const data = await readJson(abs);
   if (!data?.items) {
     error(`Could not read catalog manifest at ${abs}`);
@@ -4915,7 +4471,7 @@ async function runValidateCatalog(manifestPath2) {
 
 // src/commands/workspace.ts
 import { existsSync as existsSync5, statSync as statSync2 } from "fs";
-import path35 from "path";
+import path33 from "path";
 
 // src/commands/workspace/aggregate.ts
 async function writeWorkspaceArtifacts(workspaceRoot, repos, relationships = []) {
@@ -4969,7 +4525,7 @@ ${summaries.map(
 }
 
 // src/commands/workspace/config.ts
-import path29 from "path";
+import path27 from "path";
 import YAML from "yaml";
 var WORKSPACE_FILE = "haus.workspace.yaml";
 function parseWorkspaceConfig(text) {
@@ -4992,11 +4548,11 @@ function parseWorkspaceConfig(text) {
   };
 }
 async function readWorkspaceConfig(workspaceRoot) {
-  return parseWorkspaceConfig(await readText(path29.join(workspaceRoot, WORKSPACE_FILE)));
+  return parseWorkspaceConfig(await readText(path27.join(workspaceRoot, WORKSPACE_FILE)));
 }
 
 // src/commands/workspace/discover.ts
-import path30 from "path";
+import path28 from "path";
 import fg4 from "fast-glob";
 import YAML2 from "yaml";
 var DEFAULT_MAX_DEPTH = 3;
@@ -5024,8 +4580,8 @@ async function discoverRepos(workspaceRoot, maxDepth = DEFAULT_MAX_DEPTH) {
   const gitDirs = /* @__PURE__ */ new Set();
   const manifestDirs = /* @__PURE__ */ new Set();
   for (const match of matches) {
-    const base = path30.posix.basename(match);
-    const dir = path30.posix.dirname(match);
+    const base = path28.posix.basename(match);
+    const dir = path28.posix.dirname(match);
     const owner = dir === "." ? "." : dir;
     if (base === ".git") gitDirs.add(owner);
     else manifestDirs.add(owner);
@@ -5041,9 +4597,9 @@ async function discoverRepos(workspaceRoot, maxDepth = DEFAULT_MAX_DEPTH) {
   }
   repoRoots.sort((a, b) => a.localeCompare(b));
   return mapWithConcurrency(repoRoots, async (relDir) => {
-    const absDir = path30.resolve(workspaceRoot, relDir);
-    const pkg = await readJson(path30.join(absDir, "package.json"));
-    const name = typeof pkg?.name === "string" && pkg.name.length > 0 ? pkg.name : path30.basename(relDir === "." ? workspaceRoot : absDir);
+    const absDir = path28.resolve(workspaceRoot, relDir);
+    const pkg = await readJson(path28.join(absDir, "package.json"));
+    const name = typeof pkg?.name === "string" && pkg.name.length > 0 ? pkg.name : path28.basename(relDir === "." ? workspaceRoot : absDir);
     let role = "auto";
     try {
       const scan = await scanProject(absDir);
@@ -5078,15 +4634,15 @@ function mergeWorkspaceConfig(existing, discovered, opts = {}) {
     relationships: existing?.relationships ?? []
   };
 }
-function renderWorkspaceYaml(config2) {
+function renderWorkspaceYaml(config) {
   return YAML2.stringify({
-    client: config2.client,
-    repos: config2.repos.map((r) => ({ name: r.name, path: r.path, role: r.role ?? "auto" })),
-    relationships: config2.relationships
+    client: config.client,
+    repos: config.repos.map((r) => ({ name: r.name, path: r.path, role: r.role ?? "auto" })),
+    relationships: config.relationships
   });
 }
 async function runDiscover(workspaceRoot, opts = {}) {
-  const yamlPath = path30.join(workspaceRoot, "haus.workspace.yaml");
+  const yamlPath = path28.join(workspaceRoot, "haus.workspace.yaml");
   const existingText = await readText(yamlPath);
   const existing = parseWorkspaceConfig(existingText);
   if (existingText && !existing) {
@@ -5120,18 +4676,18 @@ async function runDiscover(workspaceRoot, opts = {}) {
 
 // src/commands/workspace/doctor.ts
 import { existsSync as existsSync3 } from "fs";
-import path32 from "path";
+import path30 from "path";
 
 // src/commands/workspace/manifest.ts
 import { readFileSync as readFileSync3 } from "fs";
-import path31 from "path";
+import path29 from "path";
 var MANIFEST_FILE = "workspace.manifest.json";
 function manifestPath(workspaceRoot) {
   return hausPath(workspaceRoot, MANIFEST_FILE);
 }
 function hausVersion() {
   try {
-    const pkg = JSON.parse(readFileSync3(path31.join(packageRoot(), "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync3(path29.join(packageRoot(), "package.json"), "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -5169,7 +4725,7 @@ async function writeWorkspaceManifest(workspaceRoot, manifest) {
 
 // src/commands/workspace/doctor.ts
 async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
-  const config2 = await readWorkspaceConfig(workspaceRoot);
+  const config = await readWorkspaceConfig(workspaceRoot);
   const manifest = await readManifest2(workspaceRoot);
   const currentVersion = hausVersion();
   const drift = [];
@@ -5179,7 +4735,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
     drift.push(item);
     detail.push({ stream: "warn", text: `- ${item.repo}: ${item.detail}` });
   };
-  if (!config2) {
+  if (!config) {
     flag({
       repo: "(workspace)",
       kind: "no-config",
@@ -5196,8 +4752,8 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
     return emit({ workspaceRoot, manifest, drift, detail, json: opts.json });
   }
   const manifestByName = new Map(manifest.repos.map((r) => [r.name, r]));
-  for (const repo of config2.repos) {
-    const repoRoot = path32.resolve(workspaceRoot, repo.path);
+  for (const repo of config.repos) {
+    const repoRoot = path30.resolve(workspaceRoot, repo.path);
     const entry = manifestByName.get(repo.name);
     if (!entry) {
       flag({
@@ -5271,10 +4827,10 @@ function emit(args) {
 
 // src/commands/workspace/setup.ts
 import { existsSync as existsSync4, statSync } from "fs";
-import path34 from "path";
+import path32 from "path";
 
 // src/claude/write-workspace-claude-md.ts
-import path33 from "path";
+import path31 from "path";
 import fs21 from "fs-extra";
 function buildWorkspaceImportBlock(client, members) {
   const memberLines = members.map((m) => `- ${m.name} (${m.path})`);
@@ -5293,7 +4849,7 @@ ${BLOCK_END}`;
 async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
   const block = buildWorkspaceImportBlock(opts.client, opts.members);
   const dryRun = opts.dryRun ?? false;
-  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path33.join(workspaceRoot, "CLAUDE.md");
+  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path31.join(workspaceRoot, "CLAUDE.md");
   const prev = await fs21.pathExists(filePath) ? await fs21.readFile(filePath, "utf8") : "";
   const next = opts.collision ? `${block}
 ` : injectHausBlock(prev, block);
@@ -5319,37 +4875,37 @@ async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
 
 // src/commands/workspace/setup.ts
 function resolveWorkspaceRoot(start = process.cwd()) {
-  let dir = path34.resolve(start);
+  let dir = path32.resolve(start);
   for (; ; ) {
-    if (existsSync4(path34.join(dir, WORKSPACE_FILE))) return dir;
-    const parent = path34.dirname(dir);
-    if (parent === dir) return path34.resolve(start);
+    if (existsSync4(path32.join(dir, WORKSPACE_FILE))) return dir;
+    const parent = path32.dirname(dir);
+    if (parent === dir) return path32.resolve(start);
     dir = parent;
   }
 }
 function isRootRepo(workspaceRoot, repoPath) {
-  return path34.resolve(workspaceRoot, repoPath) === path34.resolve(workspaceRoot);
+  return path32.resolve(workspaceRoot, repoPath) === path32.resolve(workspaceRoot);
 }
 async function runWorkspaceSetup(workspaceRoot, options = {}) {
   const apply = options.write ?? false;
-  const configText = await readText(path34.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path32.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
     return { workspaceRoot, statuses: [], written: [] };
   }
-  const config2 = parseWorkspaceConfig(configText);
-  if (!config2 || config2.repos.length === 0) {
+  const config = parseWorkspaceConfig(configText);
+  if (!config || config.repos.length === 0) {
     error(`No repos configured in ${WORKSPACE_FILE}.`);
     process.exitCode = 1;
     return { workspaceRoot, statuses: [], written: [] };
   }
   const onlySet = options.only && options.only.length > 0 ? new Set(options.only) : void 0;
-  const repos = onlySet ? config2.repos.filter((r) => onlySet.has(r.name)) : config2.repos;
+  const repos = onlySet ? config.repos.filter((r) => onlySet.has(r.name)) : config.repos;
   const statuses = [];
   const aggregateInputs = [];
   for (const repo of repos) {
-    const repoRoot = path34.resolve(workspaceRoot, repo.path);
+    const repoRoot = path32.resolve(workspaceRoot, repo.path);
     log(`
 \u2192 ${repo.name} (${repo.path})`);
     try {
@@ -5386,18 +4942,18 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
   }
   const written = [];
   if (apply && aggregateInputs.length > 0) {
-    const collision = config2.repos.some((r) => isRootRepo(workspaceRoot, r.path));
+    const collision = config.repos.some((r) => isRootRepo(workspaceRoot, r.path));
     if (!options.dryRun) {
       const artifacts = await writeWorkspaceArtifacts(
         workspaceRoot,
         aggregateInputs,
-        config2.relationships
+        config.relationships
       );
       written.push(...artifacts);
     }
     const docPath = await writeWorkspaceClaudeMd(workspaceRoot, {
-      client: config2.client,
-      members: config2.repos.map((r) => ({ name: r.name, path: r.path })),
+      client: config.client,
+      members: config.repos.map((r) => ({ name: r.name, path: r.path })),
       collision,
       dryRun: options.dryRun
     });
@@ -5413,11 +4969,11 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
     }
     const priorByName = new Map((prior?.repos ?? []).map((r) => [r.name, r]));
     const manifestRepos = [];
-    for (const repo of config2.repos) {
+    for (const repo of config.repos) {
       const status = statusByName.get(repo.name);
       const role = repo.role ?? status?.roles?.[0] ?? "auto";
       if (status?.status === "ok") {
-        const lock = await checkLock(path34.resolve(workspaceRoot, repo.path));
+        const lock = await checkLock(path32.resolve(workspaceRoot, repo.path));
         manifestRepos.push({
           name: repo.name,
           path: repo.path,
@@ -5460,7 +5016,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
         );
       }
     }
-    const manifest = buildManifest2({ client: config2.client, repos: manifestRepos });
+    const manifest = buildManifest2({ client: config.client, repos: manifestRepos });
     const manifestFile = await writeWorkspaceManifest(workspaceRoot, manifest);
     written.push(manifestFile);
   }
@@ -5497,35 +5053,35 @@ relationships: []
   log("Workspace initialized.");
 }
 async function scanWorkspace(workspaceRoot, opts) {
-  const configText = await readText(path35.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path33.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
     return;
   }
-  const config2 = parseWorkspaceConfig(configText);
-  if (!config2) {
+  const config = parseWorkspaceConfig(configText);
+  if (!config) {
     error(
       `Malformed ${WORKSPACE_FILE}. Fix the YAML or re-run \`haus workspace discover --write\`.`
     );
     process.exitCode = 1;
     return;
   }
-  if (config2.repos.length === 0) {
+  if (config.repos.length === 0) {
     error(`No repos configured in ${WORKSPACE_FILE}.`);
     process.exitCode = 1;
     return;
   }
   const inputs = [];
-  for (const repo of config2.repos) {
-    const repoRoot = path35.resolve(workspaceRoot, repo.path);
+  for (const repo of config.repos) {
+    const repoRoot = path33.resolve(workspaceRoot, repo.path);
     if (!existsSync5(repoRoot) || !statSync2(repoRoot).isDirectory()) {
       throw new Error(`Repo path is not a directory: ${repo.path}`);
     }
     const result = await scanProject(repoRoot);
     inputs.push({ name: repo.name, path: repo.path, context: result });
   }
-  const written = await writeWorkspaceArtifacts(workspaceRoot, inputs, config2.relationships);
+  const written = await writeWorkspaceArtifacts(workspaceRoot, inputs, config.relationships);
   if (opts.json) {
     log(JSON.stringify({ written }, null, 2));
   } else {
@@ -5568,7 +5124,7 @@ async function runWorkspace(action, options = {}) {
 // src/cli.ts
 function cliVersion() {
   try {
-    const pkgPath = path36.join(packageRoot(), "package.json");
+    const pkgPath = path34.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
@@ -5578,7 +5134,7 @@ function cliVersion() {
 var program = new Command();
 function validateRuntimeNodeVersion() {
   try {
-    const pkgPath = path36.join(packageRoot(), "package.json");
+    const pkgPath = path34.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
     const requiredRange = pkg.engines?.node;
     if (requiredRange && !satisfiesVersion(process.version, requiredRange)) {
@@ -5605,7 +5161,6 @@ program.command("apply").option("--dry-run").option("--write").option("--select"
 ).option("--force", "Overwrite user-modified managed workflow files").action(runApply);
 program.command("undo").option("-y, --yes", "Skip confirmation").action(runUndo);
 program.command("explain-recommendation").option("--json").action(runExplainRecommendation);
-program.command("context").option("--task <task>").option("--from-hook").option("--json").option("--verbose").action(runContext);
 program.command("init").option("--json").action(runInit);
 program.command("clone").description("Clone a single git repository by URL").argument("<url>", "Git URL to clone").argument("[dir]", "Target directory (default: repo name derived from the URL)").option("--dry-run", "Print what would happen without cloning").action(
   (url, dir, opts) => runClone(url, { dir, dryRun: opts.dryRun })
@@ -5619,10 +5174,6 @@ program.command("uninstall").option("--force").action(runUninstallCommand);
 var guard = program.command("guard");
 guard.command("file-access").option("--from-hook").action((opts) => runGuard("file-access", opts));
 guard.command("bash").option("--from-hook").action((opts) => runGuard("bash", opts));
-var config = program.command("config");
-config.command("enable <key>").description("Enable a hook (hook.context)").action((key) => runConfig(key, "enable"));
-config.command("disable <key>").description("Disable a hook (hook.context)").action((key) => runConfig(key, "disable"));
-config.command("status <key>").description("Show current state of a hook (hook.context)").action((key) => runConfig(key, "status"));
 var workspace = program.command("workspace");
 workspace.command("init").action(() => runWorkspace("init"));
 workspace.command("discover").description("Auto-find member repos and write/merge haus.workspace.yaml").option("--write", "Persist haus.workspace.yaml (default previews only)").option("--json", "Output the discovered repos and proposed config as JSON").option("--max-depth <n>", "Max directory depth to traverse (default 3)").option("--client <name>", "Set the workspace client name").action((opts) => runWorkspace("discover", opts));