@haus-tech/haus-workflow 0.28.1 → 0.30.0

package/dist/cli.js

@@ -2,7 +2,7 @@
 
 // src/cli.ts
 import { readFileSync as readFileSync4 } from "node:fs";
-import path35 from "node:path";
+import path36 from "node:path";
 import { Command } from "commander";
 
 // src/commands/apply.ts
@@ -154,7 +154,7 @@ var validation_rules_default = {
   ],
   allowedNpxPattern: { source: "\\bnpx\\s+tsx\\b", flags: "i" },
   anyNpxPattern: { source: "\\bnpx\\s+\\S+", flags: "i" },
-  npxTsxOnlyExemptTypes: ["agent"],
+  npxTsxOnlyExemptSources: ["curated"],
   httpUrlPattern: { source: "^http:\\/\\/", flags: "i" },
   placeholderPattern: { source: "\\bTODO\\b|\\bPLACEHOLDER\\b", flags: "i" },
   allowedStacks: [
@@ -274,7 +274,29 @@ var REQUIRED_SKILL_FRONTMATTER = validation_rules_default.requiredSkillFrontmatt
 var RISKY_INSTALL_PATTERNS = validation_rules_default.riskyInstallPatterns.map(toRegExp);
 var ALLOWED_NPX_PATTERN = toRegExp(validation_rules_default.allowedNpxPattern);
 var ANY_NPX_PATTERN = toRegExp(validation_rules_default.anyNpxPattern);
-var NPX_TSX_ONLY_EXEMPT_TYPES = validation_rules_default.npxTsxOnlyExemptTypes ?? [];
+var NPX_TSX_ONLY_EXEMPT_SOURCES = validation_rules_default.npxTsxOnlyExemptSources ?? [];
+function isNpxTsxOnlyExempt(_itemType, itemSource) {
+  return Boolean(itemSource && NPX_TSX_ONLY_EXEMPT_SOURCES.includes(itemSource));
+}
+function buildItemPathSourceMap(items) {
+  const map = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    if (!item.path) continue;
+    map.set(String(item.path).replace(/\\/g, "/"), item.source);
+  }
+  return map;
+}
+function resolveMarkdownItemSource(relPath, pathSourceMap) {
+  const norm = relPath.replace(/\\/g, "/");
+  let cursor = norm;
+  while (true) {
+    if (pathSourceMap.has(cursor)) return pathSourceMap.get(cursor);
+    const slash = cursor.lastIndexOf("/");
+    if (slash === -1) break;
+    cursor = cursor.slice(0, slash);
+  }
+  return void 0;
+}
 var HTTP_URL_PATTERN = toRegExp(validation_rules_default.httpUrlPattern);
 var PLACEHOLDER_PATTERN = toRegExp(validation_rules_default.placeholderPattern);
 var ALLOWED_STACKS = validation_rules_default.allowedStacks;
@@ -353,7 +375,7 @@ ${extractUseWhenSection(text)}`;
 // src/catalog/ingest-catalog.ts
 function validateCatalogItem(item, content2) {
   const label = item.id;
-  const checkNonTsxNpx = !NPX_TSX_ONLY_EXEMPT_TYPES.includes(item.type);
+  const checkNonTsxNpx = !isNpxTsxOnlyExempt(item.type, item.source);
   const lines = content2.split(/\r?\n/);
   for (let i = 0; i < lines.length; i++) {
     const line2 = lines[i] ?? "";
@@ -637,7 +659,7 @@ function safeJoin(base, itemPath) {
   const resolved = path2.resolve(base, itemPath);
   return resolved.startsWith(base + path2.sep) || resolved === base ? resolved : null;
 }
-var KNOWN_ITEM_TYPES = /* @__PURE__ */ new Set(["skill", "agent", "template", "command"]);
+var KNOWN_ITEM_TYPES = /* @__PURE__ */ new Set(["skill", "agent", "template", "command", "config"]);
 function isMarkdownPath(rel) {
   return rel.toLowerCase().endsWith(".md");
 }
@@ -782,12 +804,13 @@ async function writeFetchedDirectory(destDir, fetched) {
   }
 }
 async function syncDirectoryFromPrefix(item, catalogPrefix, destDir, base, opts) {
-  const relFiles = await listFilesUnderCatalogPrefix(catalogPrefix, base);
+  const relFiles = opts.relFiles ?? await listFilesUnderCatalogPrefix(catalogPrefix, base);
   if (!relFiles) {
     warn(`Failed to list files for ${item.id}`);
     return "failed";
   }
-  if (!relFiles.includes("SKILL.md") && catalogPrefix !== SUPERPOWERS_SHARED_CATALOG_REL) {
+  const requireSkillMd = opts.requireSkillMd ?? true;
+  if (requireSkillMd && !relFiles.includes("SKILL.md") && catalogPrefix !== SUPERPOWERS_SHARED_CATALOG_REL) {
     warn(`Failed to fetch content for ${item.id}: missing SKILL.md`);
     return "failed";
   }
@@ -802,7 +825,12 @@ async function syncDirectoryFromPrefix(item, catalogPrefix, destDir, base, opts)
     for (const file of fetched) {
       if (file.kind !== "text" || !isMarkdownPath(file.rel)) continue;
       const verdict = validateCatalogItem(
-        { id: item.id, type: "skill", path: catalogPrefix },
+        {
+          id: item.id,
+          type: "skill",
+          path: catalogPrefix,
+          ..."source" in item && item.source ? { source: item.source } : {}
+        },
         file.body
       );
       if (!verdict.ok) {
@@ -833,6 +861,42 @@ async function syncSkillDirectory(item, base) {
     return "failed";
   }
 }
+async function syncConfigItem(item, base) {
+  const dest = safeJoin(getCacheDir(), item.path);
+  if (!dest) {
+    warn(`Skipping ${item.id}: path traversal detected`);
+    return "failed";
+  }
+  const relFiles = await listFilesUnderCatalogPrefix(item.path, base);
+  if (relFiles && relFiles.length > 0) {
+    try {
+      return await syncDirectoryFromPrefix(item, item.path, dest, base, {
+        validateMarkdown: false,
+        requireSkillMd: false,
+        relFiles
+      });
+    } catch (err) {
+      warn(`Failed to cache ${item.id}: ${err instanceof Error ? err.message : String(err)}`);
+      return "failed";
+    }
+  }
+  const text = await fetchText(`${base}/${item.path}`);
+  if (text === null) {
+    warn(`Failed to fetch content for ${item.id}`);
+    return "failed";
+  }
+  const verdict = validateCatalogItem(item, text);
+  if (!verdict.ok) {
+    warn(`Rejected ${item.id} at ingest: ${verdict.reason}`);
+    return "failed";
+  }
+  try {
+    return await writeTextIfChanged(dest, text);
+  } catch (err) {
+    warn(`Failed to cache ${item.id}: ${err instanceof Error ? err.message : String(err)}`);
+    return "failed";
+  }
+}
 async function syncSuperpowersShared(base) {
   const relFiles = await listFilesUnderCatalogPrefix(SUPERPOWERS_SHARED_CATALOG_REL, base);
   if (!relFiles || relFiles.length === 0) return "skipped";
@@ -866,6 +930,9 @@ async function syncOneItem(item, base) {
   if (item.type === "skill") {
     return syncSkillDirectory(item, base);
   }
+  if (item.type === "config") {
+    return syncConfigItem(item, base);
+  }
   const dest = safeJoin(getCacheDir(), item.path);
   if (!dest) {
     warn(`Skipping ${item.id}: path traversal detected`);
@@ -1593,8 +1660,8 @@ function buildDenyRules() {
   for (const command of DENY_COMMANDS) {
     rules.push(`Bash(${command}:*)`);
   }
-  for (const path36 of DENY_PATHS) {
-    const pattern = DENY_DIRS.has(path36) ? `${path36}/**` : path36;
+  for (const path37 of DENY_PATHS) {
+    const pattern = DENY_DIRS.has(path37) ? `${path37}/**` : path37;
     for (const tool of FILE_TOOLS) {
       rules.push(`${tool}(${pattern})`);
     }
@@ -2202,6 +2269,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
         continue;
       }
     }
+    if (item.type === "config") continue;
     const sourcePath = catalogItemContentPath(contentRoot, manifestItem);
     const target = targetDirForType(item.type);
     if (!target) {
@@ -2250,7 +2318,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
       `${curatedReviewStatusSkips} curated items skipped: reviewStatus is not approved \u2014 possible catalog field rename upstream`
     );
   }
-  await cleanupStaleCatalogItems(root, new Set(manifestById.keys()), dryRun);
+  await cleanupStaleCatalogItems(root, manifestById, dryRun);
   if (dryRun) return [...new Set(files)];
   const installedItems = catalogItems.filter((r) => installedIds.has(r.id));
   const prevLock = await readJson(hausPath(root, "haus.lock.json"));
@@ -2287,11 +2355,15 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
   await writeManagedJson(root, hausPath(root, "haus.lock.json"), lock, false);
   return [...new Set(files)];
 }
-async function cleanupStaleCatalogItems(root, knownIds, dryRun) {
+async function cleanupStaleCatalogItems(root, manifestById, dryRun) {
   const prevLock = await readJson(hausPath(root, "haus.lock.json"));
   if (!prevLock?.length) return;
   for (const entry of prevLock) {
-    if (!entry.id || knownIds.has(entry.id)) continue;
+    if (!entry.id) continue;
+    const manifestItem = manifestById.get(entry.id);
+    const removedFromManifest = manifestItem === void 0;
+    const deprecated = manifestItem?.reviewStatus === "deprecated";
+    if (!removedFromManifest && !deprecated) continue;
     const relPaths = entry.paths ?? [];
     if (relPaths.length === 0) continue;
     const existing = [];
@@ -2299,28 +2371,29 @@ async function cleanupStaleCatalogItems(root, knownIds, dryRun) {
       if (await fs12.pathExists(path12.join(root, rel))) existing.push(rel);
     }
     if (existing.length === 0) continue;
+    const pruneReason = deprecated ? "deprecated" : "stale";
     if (entry.hash === void 0) {
       warn(
-        `Stale catalog item ${entry.id} has no lock hash \u2014 leaving in place: ${existing.join(", ")}`
+        `${deprecated ? "Deprecated" : "Stale"} catalog item ${entry.id} has no lock hash \u2014 leaving in place: ${existing.join(", ")}`
       );
       continue;
     }
     const currentHash = await hashInstalledPaths(root, relPaths);
     if (currentHash !== entry.hash) {
       warn(
-        `Stale catalog item ${entry.id} was modified locally \u2014 leaving in place: ${existing.join(", ")}`
+        `${deprecated ? "Deprecated" : "Stale"} catalog item ${entry.id} was modified locally \u2014 leaving in place: ${existing.join(", ")}`
       );
       continue;
     }
     for (const rel of existing) {
       const abs = path12.join(root, rel);
       if (dryRun) {
-        log(`[dry-run] would remove stale ${displayPath(root, abs)} (${entry.id})`);
+        log(`[dry-run] would remove ${pruneReason} ${displayPath(root, abs)} (${entry.id})`);
         continue;
       }
       await fs12.remove(abs);
       await pruneEmptyDir(path12.dirname(abs));
-      log(`Removed stale ${displayPath(root, abs)} (${entry.id})`);
+      log(`Removed ${pruneReason} ${displayPath(root, abs)} (${entry.id})`);
     }
   }
 }
@@ -2330,6 +2403,9 @@ async function cacheHasItems() {
   const data = await readJson(path13.join(getCacheDir(), "manifest.json"));
   return Array.isArray(data?.items) && data.items.length > 0;
 }
+function installableRecommendedItems(recommended) {
+  return recommended.filter((item) => item.install !== false);
+}
 async function runApply(options) {
   if (!options.dryRun && !options.write) {
     log("Use --dry-run or --write");
@@ -2348,28 +2424,31 @@ async function runApply(options) {
     if (!rec) {
       log("No recommendation.json found \u2014 run `haus recommend` first. Writing core files only.");
       selectedIds = [];
-    } else if (rec.recommended.length === 0) {
-      log("Recommendation contains no catalog items. Writing core files only.");
-      selectedIds = [];
     } else {
-      const items = rec.recommended;
-      const choices = items.map((item) => ({
-        name: `${item.id}  [${item.selectionMode}] \u2014 ${item.reason}`,
-        value: item.id,
-        checked: true
-      }));
-      const chosen = await checkbox({
-        message: "Select catalog items to apply (space to toggle, enter to confirm):",
-        choices,
-        pageSize: Math.min(20, items.length + 2)
-      });
-      selectedIds = chosen;
-      log(`Selected ${selectedIds.length} of ${items.length} catalog items.`);
+      const items = installableRecommendedItems(rec.recommended);
+      if (items.length === 0) {
+        log("Recommendation contains no catalog items. Writing core files only.");
+        selectedIds = [];
+      } else {
+        const choices = items.map((item) => ({
+          name: `${item.id}  [${item.selectionMode}] \u2014 ${item.reason}`,
+          value: item.id,
+          checked: true
+        }));
+        const chosen = await checkbox({
+          message: "Select catalog items to apply (space to toggle, enter to confirm):",
+          choices,
+          pageSize: Math.min(20, items.length + 2)
+        });
+        selectedIds = chosen;
+        log(`Selected ${selectedIds.length} of ${items.length} catalog items.`);
+      }
     }
   }
   if (!options.allowEmptyCache && !process.env["HAUS_FIXTURE_CATALOG"]) {
     const rec = await readJson(hausPath(root, "recommendation.json"));
-    const catalogItemCount = selectedIds !== void 0 ? selectedIds.length : rec?.recommended.length ?? 0;
+    const installableRecommended = installableRecommendedItems(rec?.recommended ?? []);
+    const catalogItemCount = selectedIds !== void 0 ? selectedIds.length : installableRecommended.length;
     if (catalogItemCount > 0 && !await cacheHasItems()) {
       const message = "No catalog content found. Run `haus update` first.";
       if (isDryRun) {
@@ -2664,7 +2743,7 @@ var STACK_RULES = [
   { stack: ["tooling", "missing-eslint"], any: [depAbsent("eslint")] },
   {
     stack: ["tooling", "stripe"],
-    any: [dep("@stripe/stripe-js"), dep("@stripe/react-stripe-js")]
+    any: [dep("stripe"), dep("@stripe/stripe-js"), dep("@stripe/react-stripe-js")]
   },
   { stack: ["tooling", "qliro"], any: [dep("@haus-tech/qliro-plugin")] },
   {
@@ -3558,6 +3637,19 @@ async function recommend(root, context) {
       );
       continue;
     }
+    if (item.id === "haus.ecc-database-reviewer" && !roleSet.has("database")) {
+      skip(item.id, "required-role-missing", "Required role missing: database", "role:database");
+      continue;
+    }
+    if (item.id === "haus.ecc-typescript-reviewer" && (stackSet.has("react") || stackSet.has("react19") || stackSet.has("nextjs") || stackSet.has("next") || roleSet.has("react-app") || roleSet.has("next-app"))) {
+      skip(
+        item.id,
+        "co-install-react-reviewer",
+        "Skip typescript-reviewer on React/Next stacks (use react-reviewer)",
+        "stack:react|nextjs|role:react-app|next-app"
+      );
+      continue;
+    }
     const isDefaultBaseline = item.default === true;
     const reasons = [];
     const push = (code, message, signal) => reasons.push({ code, message, signal });
@@ -3602,13 +3694,22 @@ async function recommend(root, context) {
     }
     const hasEvidence = reasons.some((r) => r.code !== "default-baseline");
     if (isDefaultBaseline || hasEvidence) {
+      const isConfig = item.type === "config";
+      const entryReasons = isConfig ? [
+        ...reasons,
+        {
+          code: "config-scaffold",
+          message: "Install with `haus scaffold`",
+          signal: "type:config"
+        }
+      ] : reasons;
       recommended.push({
         id: item.id,
         type: item.type,
-        reason: reasons.length ? reasons.map((x) => x.message).join(", ") : "eligible",
-        reasons,
+        reason: entryReasons.length ? entryReasons.map((x) => x.message).join(", ") : "eligible",
+        reasons: entryReasons,
         selectionMode: isDefaultBaseline && !hasEvidence ? "baseline" : "matched",
-        install: true,
+        install: !isConfig,
         tags: item.tags,
         ecosystem: item.ecosystem,
         tokenEstimate: item.tokenEstimate
@@ -3617,9 +3718,11 @@ async function recommend(root, context) {
       skip(item.id, "no-role-stack-match", "No role/stack match");
     }
   }
+  applyCoInstallSuppression(recommended, skipped);
   recommended.sort((a, b) => a.id.localeCompare(b.id));
   skipped.sort((a, b) => a.id.localeCompare(b.id));
-  const selectedRules = recommended.length;
+  const installableRecommended = recommended.filter((item) => item.install);
+  const selectedRules = installableRecommended.length;
   const skippedRules = skipped.length;
   const estimatedContextTokens = estimateContextTokens(selectedRules);
   const estimatedTokenReductionPct = tokenReductionPct(selectedRules, skippedRules);
@@ -3640,6 +3743,78 @@ function buildStackSet(context) {
     )
   );
 }
+function applyCoInstallSuppression(recommended, skipped) {
+  const recommendedIds = new Set(recommended.map((r) => r.id));
+  const rules = [
+    {
+      suppress: "haus.sentry-sentry-workflow",
+      whenAnyRecommended: [
+        "haus.sentry-sentry-php-sdk",
+        "haus.sentry-sentry-nextjs-sdk",
+        "haus.sentry-sentry-node-sdk",
+        "haus.sentry-sentry-nestjs-sdk"
+      ],
+      code: "co-install-sentry-sdk",
+      message: "Skip sentry-workflow when a stack-specific Sentry SDK skill is selected",
+      signal: "co-install:sentry-sdk"
+    },
+    {
+      suppress: "haus.ecc-e2e-runner",
+      whenAnyRecommended: ["haus.ecc-e2e-testing"],
+      code: "co-install-e2e-skill",
+      message: "Skip e2e-runner when e2e-testing skill covers patterns",
+      signal: "co-install:e2e-testing"
+    },
+    {
+      suppress: "haus.oh-my-claudecode-test-engineer",
+      whenAnyRecommended: ["haus.ecc-e2e-testing", "haus.ecc-e2e-runner"],
+      code: "co-install-e2e-coverage",
+      message: "Skip oh-my test-engineer when ECC e2e skill or agent is selected",
+      signal: "co-install:e2e-coverage"
+    },
+    {
+      suppress: "haus.wshobson-js-testing-patterns",
+      whenAnyRecommended: ["haus.ecc-react-testing"],
+      code: "co-install-react-testing",
+      message: "Skip js-testing-patterns when ecc-react-testing covers component tests",
+      signal: "co-install:react-testing"
+    },
+    {
+      suppress: "haus.superpowers-test-driven-development",
+      whenAnyRecommended: ["haus.wshobson-js-testing-patterns", "haus.ecc-react-testing"],
+      code: "co-install-stack-testing",
+      message: "Skip TDD superpower when a stack testing skill is selected",
+      signal: "co-install:stack-testing"
+    },
+    {
+      suppress: "haus.superpowers-specifying-gates",
+      whenAnyRecommended: ["haus.superpowers-checking-gates"],
+      code: "co-install-gate-workflow",
+      message: "Skip specifying-gates when checking-gates is selected",
+      signal: "co-install:checking-gates"
+    },
+    {
+      suppress: "haus.ecc-redis-patterns",
+      whenAnyRecommended: ["haus.redis-redis-connections"],
+      code: "co-install-redis-official",
+      message: "Skip ecc-redis-patterns when official redis-connections skill is selected",
+      signal: "co-install:redis-connections"
+    }
+  ];
+  for (const rule of rules) {
+    if (!recommendedIds.has(rule.suppress)) continue;
+    if (!rule.whenAnyRecommended.some((id) => recommendedIds.has(id))) continue;
+    const idx = recommended.findIndex((r) => r.id === rule.suppress);
+    if (idx === -1) continue;
+    const [removed] = recommended.splice(idx, 1);
+    recommendedIds.delete(rule.suppress);
+    skipped.push({
+      id: removed.id,
+      reason: rule.message,
+      skipReasons: [{ code: rule.code, message: rule.message, signal: rule.signal }]
+    });
+  }
+}
 
 // src/commands/setup-core.ts
 async function runSetupCore(root, opts) {
@@ -4123,6 +4298,144 @@ async function runRefresh() {
   log(`Recommended items: ${recommendation.recommended.length}`);
 }
 
+// src/install/scaffold.ts
+import path22 from "node:path";
+import fs17 from "fs-extra";
+async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
+  const scaffolded = [];
+  const skipped = [];
+  const skippedExisting = [];
+  const record = (name, outcome) => {
+    if (outcome === "scaffolded") {
+      scaffolded.push(name);
+      return;
+    }
+    skipped.push(name);
+    if (outcome === "skipped-exists") skippedExisting.push(name);
+  };
+  const realRoot = await fs17.realpath(catalogRoot).catch(() => null);
+  for (const item of items) {
+    if (item.type !== "config") continue;
+    const sourcePath = path22.resolve(catalogRoot, item.path);
+    const rel = path22.relative(catalogRoot, sourcePath);
+    const escapes = rel === "" || path22.isAbsolute(rel) || rel.split(/[/\\]/).some((seg) => seg === "..");
+    if (escapes) {
+      warn(`Skipping ${item.id}: path '${item.path}' escapes the catalog root`);
+      continue;
+    }
+    const realSource = await fs17.realpath(sourcePath).catch(() => null);
+    if (!realRoot || !realSource) {
+      warn(`Skipping ${item.id}: source not found at ${sourcePath}`);
+      continue;
+    }
+    const realRel = path22.relative(realRoot, realSource);
+    if (realRel !== "" && (path22.isAbsolute(realRel) || realRel.split(/[/\\]/)[0] === "..")) {
+      warn(`Skipping ${item.id}: path '${item.path}' resolves outside the catalog root`);
+      continue;
+    }
+    const stat = await fs17.lstat(sourcePath).catch(() => null);
+    if (!stat) {
+      warn(`Skipping ${item.id}: source not found at ${sourcePath}`);
+      continue;
+    }
+    if (stat.isSymbolicLink()) {
+      warn(`Skipping ${item.id}: source path is a symlink`);
+      continue;
+    }
+    if (stat.isFile()) {
+      const filename = path22.basename(sourcePath);
+      const dest = path22.join(projectRoot, filename);
+      record(filename, await scaffoldFile(sourcePath, dest, item.id, opts));
+    } else if (stat.isDirectory()) {
+      const entries = await fs17.readdir(sourcePath);
+      for (const entry of entries) {
+        const src = path22.join(sourcePath, entry);
+        const dest = path22.join(projectRoot, entry);
+        record(entry, await scaffoldFile(src, dest, item.id, opts));
+      }
+    }
+  }
+  return { scaffolded, skipped, skippedExisting };
+}
+async function scaffoldFile(src, dest, itemId, opts) {
+  const srcStat = await fs17.lstat(src).catch(() => null);
+  if (!srcStat) {
+    warn(`Skipping ${path22.basename(src)}: source not found`);
+    return "skipped-refused";
+  }
+  if (srcStat.isSymbolicLink()) {
+    warn(`Skipping ${path22.basename(src)}: source is a symlink`);
+    return "skipped-refused";
+  }
+  const exists = await fs17.pathExists(dest);
+  if (exists && !opts.force) {
+    warn(`Skipping ${path22.basename(dest)}: already exists (use --force to overwrite)`);
+    return "skipped-exists";
+  }
+  if (opts.dryRun) {
+    log(`[dry-run] would ${exists ? "overwrite" : "create"} ${path22.basename(dest)} (${itemId})`);
+    return "scaffolded";
+  }
+  if (exists && opts.force) {
+    await fs17.remove(dest);
+  }
+  await fs17.ensureDir(path22.dirname(dest));
+  await fs17.copy(src, dest, {
+    overwrite: true,
+    dereference: false,
+    // A vanished/unreadable entry mid-walk must skip that path, not crash the copy.
+    filter: (s) => {
+      try {
+        return !fs17.lstatSync(s).isSymbolicLink();
+      } catch {
+        return false;
+      }
+    }
+  });
+  log(`${exists ? "Overwrote" : "Created"} ${path22.basename(dest)} (${itemId})`);
+  return "scaffolded";
+}
+
+// src/commands/scaffold.ts
+async function runScaffold(ids, options) {
+  const { items: allItems, contentRoot } = await loadCatalogContext(options.root);
+  const configItems = allItems.filter((item) => {
+    if (item.type !== "config") return false;
+    if (item.reviewStatus && item.reviewStatus !== "approved") return false;
+    if (item.riskLevel === "blocked") return false;
+    if (ids.length > 0 && !ids.includes(item.id)) return false;
+    return true;
+  });
+  if (configItems.length === 0) {
+    if (ids.length > 0) {
+      log(`No config items found for: ${ids.join(", ")}`);
+    } else {
+      log("No config items available in catalog.");
+    }
+    return;
+  }
+  log(`Scaffolding ${configItems.length} config item(s)\u2026`);
+  const result = await scaffoldConfigItems(options.root, contentRoot, configItems, {
+    force: options.force,
+    dryRun: options.dryRun
+  });
+  if (result.scaffolded.length > 0) {
+    if (options.dryRun) {
+      log(`[dry-run] would scaffold: ${result.scaffolded.join(", ")} (no files written)`);
+    } else {
+      log(`\u2713 Scaffolded: ${result.scaffolded.join(", ")}`);
+    }
+  }
+  if (result.skipped.length > 0) {
+    log(`Skipped: ${result.skipped.join(", ")}`);
+    if (result.skippedExisting.length > 0) {
+      log(
+        `Already present (re-run with --force to overwrite): ${result.skippedExisting.join(", ")}`
+      );
+    }
+  }
+}
+
 // src/commands/scan.ts
 async function runScan(options) {
   const result = await scanProject(process.cwd());
@@ -4136,8 +4449,8 @@ async function runScan(options) {
 }
 
 // src/commands/undo.ts
-import path22 from "node:path";
-import fs17 from "fs-extra";
+import path23 from "node:path";
+import fs18 from "fs-extra";
 
 // src/claude/managed-paths.ts
 var PROJECT_MANAGED_CLAUDE_REL = ["rules/haus.md", "commands/haus-doctor.md"];
@@ -4154,74 +4467,74 @@ async function collectManagedPaths(root) {
   const lock = await readJson(hausPath(root, "haus.lock.json"));
   for (const row of lock ?? []) {
     for (const rel of row.paths ?? []) {
-      paths.add(path22.resolve(root, rel));
+      paths.add(path23.resolve(root, rel));
     }
   }
   const existing = [];
   for (const abs of paths) {
-    if (await fs17.pathExists(abs)) existing.push(abs);
+    if (await fs18.pathExists(abs)) existing.push(abs);
   }
   return existing;
 }
 async function settingsHasHausContent(root) {
   const settingsPath = claudePath(root, "settings.json");
-  if (!await fs17.pathExists(settingsPath)) return false;
+  if (!await fs18.pathExists(settingsPath)) return false;
   const settings = await readProjectSettings(root);
   return settings._haus != null;
 }
 async function claudeMdHasHausBlock(root) {
-  const filePath = path22.join(root, "CLAUDE.md");
-  if (!await fs17.pathExists(filePath)) return false;
-  const text = await fs17.readFile(filePath, "utf8");
+  const filePath = path23.join(root, "CLAUDE.md");
+  if (!await fs18.pathExists(filePath)) return false;
+  const text = await fs18.readFile(filePath, "utf8");
   return text.includes(BLOCK_BEGIN);
 }
 async function stripProjectSettings(root) {
   const settingsPath = claudePath(root, "settings.json");
-  if (!await fs17.pathExists(settingsPath)) return false;
+  if (!await fs18.pathExists(settingsPath)) return false;
   let settings = await readProjectSettings(root);
   settings = stripHausHooks(stripHausAsk(stripHausAllow(stripHausDeny(settings))));
   const hasContent = Object.keys(settings).length > 0;
   if (hasContent) {
     await writeProjectSettings(root, settings);
-    log(`Stripped haus rules from ${path22.relative(root, settingsPath)} (user settings preserved).`);
+    log(`Stripped haus rules from ${path23.relative(root, settingsPath)} (user settings preserved).`);
     return true;
   }
-  await fs17.remove(settingsPath);
-  log(`Removed ${path22.relative(root, settingsPath)} (no user-owned settings remained).`);
+  await fs18.remove(settingsPath);
+  log(`Removed ${path23.relative(root, settingsPath)} (no user-owned settings remained).`);
   return true;
 }
 async function stripRootClaudeMd(root) {
-  const filePath = path22.join(root, "CLAUDE.md");
-  if (!await fs17.pathExists(filePath)) return false;
-  const prev = await fs17.readFile(filePath, "utf8");
+  const filePath = path23.join(root, "CLAUDE.md");
+  if (!await fs18.pathExists(filePath)) return false;
+  const prev = await fs18.readFile(filePath, "utf8");
   if (!prev.includes(BLOCK_BEGIN)) return false;
   const next = stripHausBlock(prev);
   if (next.length === 0) {
-    await fs17.remove(filePath);
+    await fs18.remove(filePath);
     log("Removed CLAUDE.md (only contained haus import block).");
   } else {
-    await fs17.writeFile(filePath, next, "utf8");
+    await fs18.writeFile(filePath, next, "utf8");
     log("Removed haus import block from CLAUDE.md (user content preserved).");
   }
   return true;
 }
 async function pruneDirIfEmpty(dir) {
-  if (!await fs17.pathExists(dir)) return;
-  const entries = await fs17.readdir(dir);
-  if (entries.length === 0) await fs17.remove(dir);
+  if (!await fs18.pathExists(dir)) return;
+  const entries = await fs18.readdir(dir);
+  if (entries.length === 0) await fs18.remove(dir);
 }
 async function backupManagedFilesBeforeUndo(root, managedAbsPaths) {
   if (managedAbsPaths.length === 0) return;
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const backupRoot = hausPath(root, "backups", `undo-${stamp}`);
   for (const abs of managedAbsPaths) {
-    if (!await fs17.pathExists(abs)) continue;
-    const rel = path22.relative(root, abs);
-    const backupPath = path22.join(backupRoot, rel);
-    await fs17.ensureDir(path22.dirname(backupPath));
-    await fs17.copy(abs, backupPath);
+    if (!await fs18.pathExists(abs)) continue;
+    const rel = path23.relative(root, abs);
+    const backupPath = path23.join(backupRoot, rel);
+    await fs18.ensureDir(path23.dirname(backupPath));
+    await fs18.copy(abs, backupPath);
   }
-  log(`Backed up ${managedAbsPaths.length} managed file(s) to ${path22.relative(root, backupRoot)}.`);
+  log(`Backed up ${managedAbsPaths.length} managed file(s) to ${path23.relative(root, backupRoot)}.`);
 }
 async function runUndo(options) {
   const root = process.cwd();
@@ -4232,7 +4545,7 @@ async function runUndo(options) {
     log("Nothing to remove: no haus-managed files found in this directory.");
     return;
   }
-  const relTargets = managed.map((p) => path22.relative(root, p));
+  const relTargets = managed.map((p) => path23.relative(root, p));
   const summaryParts = [...relTargets];
   if (stripSettings) summaryParts.push(".claude/settings.json (haus rules only)");
   if (stripClaudeMd) summaryParts.push("CLAUDE.md (haus import block only)");
@@ -4249,9 +4562,9 @@ User-owned .claude/ files will be preserved.`
   }
   await backupManagedFilesBeforeUndo(root, managed);
   for (const abs of managed) {
-    if (!await fs17.pathExists(abs)) continue;
-    await fs17.remove(abs);
-    log(`Removed ${path22.relative(root, abs)}`);
+    if (!await fs18.pathExists(abs)) continue;
+    await fs18.remove(abs);
+    log(`Removed ${path23.relative(root, abs)}`);
   }
   if (stripSettings) await stripProjectSettings(root);
   if (stripClaudeMd) await stripRootClaudeMd(root);
@@ -4262,8 +4575,8 @@ User-owned .claude/ files will be preserved.`
 
 // src/install/uninstall.ts
 import crypto3 from "node:crypto";
-import path23 from "node:path";
-import fs18 from "fs-extra";
+import path24 from "node:path";
+import fs19 from "fs-extra";
 async function runUninstall(options = {}) {
   const { force = false } = options;
   const manifest = await readManifest();
@@ -4273,7 +4586,7 @@ async function runUninstall(options = {}) {
     return result;
   }
   for (const entry of manifest.files) {
-    const exists = fs18.pathExistsSync(entry.destPath);
+    const exists = fs19.pathExistsSync(entry.destPath);
     if (!exists) continue;
     const content2 = await readText(entry.destPath);
     if (content2 === void 0) continue;
@@ -4291,22 +4604,22 @@ async function runUninstall(options = {}) {
       result.skipped.push(entry.destPath);
       continue;
     }
-    await fs18.remove(entry.destPath);
-    await pruneEmptyDir(path23.dirname(entry.destPath));
+    await fs19.remove(entry.destPath);
+    await pruneEmptyDir(path24.dirname(entry.destPath));
     result.deleted.push(entry.destPath);
   }
   const settings = await readSettings();
   const stripped = stripHausHooks(stripHausAsk(stripHausAllow(stripHausDeny(settings))));
   await writeSettings(stripped);
   result.hooksStripped = true;
-  const hausDir = path23.join(globalClaudeDir(), "haus");
+  const hausDir = path24.join(globalClaudeDir(), "haus");
   const manifestPath2 = hausManifestPath();
-  if (fs18.pathExistsSync(manifestPath2)) {
-    await fs18.remove(manifestPath2);
+  if (fs19.pathExistsSync(manifestPath2)) {
+    await fs19.remove(manifestPath2);
   }
-  if (fs18.pathExistsSync(hausDir)) {
-    const remaining = await fs18.readdir(hausDir);
-    if (remaining.length === 0) await fs18.remove(hausDir);
+  if (fs19.pathExistsSync(hausDir)) {
+    const remaining = await fs19.readdir(hausDir);
+    if (remaining.length === 0) await fs19.remove(hausDir);
   }
   return result;
 }
@@ -4337,12 +4650,12 @@ async function runUninstallCommand(options) {
 }
 
 // src/commands/update.ts
-import path25 from "node:path";
+import path26 from "node:path";
 
 // src/claude/refresh-project.ts
-import fs19 from "fs-extra";
+import fs20 from "fs-extra";
 async function isHausProject(root) {
-  if (await fs19.pathExists(hausPath(root, "recommendation.json"))) return true;
+  if (await fs20.pathExists(hausPath(root, "recommendation.json"))) return true;
   const result = await readJsonDetailed(claudePath(root, "settings.json"));
   if (result.status === "ok") return result.value._haus != null;
   return false;
@@ -4377,7 +4690,7 @@ function summarizeLockDiff(before, after) {
 
 // src/update/lockfile.ts
 import { mkdir, readFile as readFile2, copyFile } from "node:fs/promises";
-import path24 from "node:path";
+import path25 from "node:path";
 async function checkLock(root) {
   const lock = await readJson(hausPath(root, "haus.lock.json")) ?? [];
   const hasValidVersions = lock.every(
@@ -4408,7 +4721,7 @@ async function applyLock(root) {
   try {
     const backupDir = hausPath(root, "backups");
     await mkdir(backupDir, { recursive: true });
-    await copyFile(lockPath, path24.join(backupDir, `haus.lock.${Date.now()}.json`));
+    await copyFile(lockPath, path25.join(backupDir, `haus.lock.${Date.now()}.json`));
   } catch {
   }
   const enriched = await Promise.all(
@@ -4430,7 +4743,7 @@ function diffLock(before, after) {
 }
 async function hasLocalOverrides(root) {
   try {
-    await readFile2(path24.join(root, ".claude", "settings.json"), "utf8");
+    await readFile2(path25.join(root, ".claude", "settings.json"), "utf8");
     return true;
   } catch {
     return false;
@@ -4442,7 +4755,7 @@ var NPM_PACKAGE_NAME2 = "@haus-tech/haus-workflow";
 async function runUpdate(options) {
   const root = process.cwd();
   if (options.check) {
-    const pkgJson2 = await readJson(path25.join(packageRoot(), "package.json"));
+    const pkgJson2 = await readJson(path26.join(packageRoot(), "package.json"));
     const currentVersion2 = pkgJson2?.version ?? "0.0.0";
     const [status, npmVersion, latestCatalogTag, globalInstallDrift] = await Promise.all([
       checkLock(root),
@@ -4472,7 +4785,7 @@ async function runUpdate(options) {
     if (status.driftCount > 0) process.exitCode = 1;
     return;
   }
-  const pkgJson = await readJson(path25.join(packageRoot(), "package.json"));
+  const pkgJson = await readJson(path26.join(packageRoot(), "package.json"));
   const currentVersion = pkgJson?.version ?? "0.0.0";
   const npmStatus = await fetchNpmVersionStatus(currentVersion);
   if (npmStatus.updateAvailable && npmStatus.latest !== null) {
@@ -4549,16 +4862,16 @@ async function detectGlobalInstallDrift() {
 }
 
 // src/commands/validate-catalog.ts
-import path27 from "node:path";
+import path28 from "node:path";
 
 // src/catalog/validate-core.ts
-import fs20 from "node:fs";
-import path26 from "node:path";
+import fs21 from "node:fs";
+import path27 from "node:path";
 var ITEM_SEMVER_RE = /^\d+\.\d+\.\d+$/;
 var MANIFEST_SEMVER_RE = /^\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?$/;
 function isSafeCatalogPath2(itemPath) {
-  if (!itemPath || path26.isAbsolute(itemPath) || itemPath.includes("\\")) return false;
-  const normalized = path26.normalize(itemPath);
+  if (!itemPath || path27.isAbsolute(itemPath) || itemPath.includes("\\")) return false;
+  const normalized = path27.normalize(itemPath);
   return !normalized.startsWith("..") && !normalized.includes("/..");
 }
 function auditForbiddenStacks(items) {
@@ -4606,7 +4919,7 @@ function auditManifestStructure(manifestVersion, items) {
     } else {
       seenIds.set(item.id, i);
     }
-    if (item.type === "skill" || item.type === "agent" || item.type === "template" || item.type === "command") {
+    if (item.type === "skill" || item.type === "agent" || item.type === "template" || item.type === "command" || item.type === "config") {
       if (!item.path) {
         failures.push(`${item.id}: missing path`);
       } else if (!isSafeCatalogPath2(item.path)) {
@@ -4637,8 +4950,8 @@ function checkRequiredFrontmatter(text, label) {
   return failures;
 }
 function auditTemplateContent(manifestDir, absPath, itemId) {
-  const rel = path26.relative(manifestDir, absPath);
-  const text = fs20.readFileSync(absPath, "utf8");
+  const rel = path27.relative(manifestDir, absPath);
+  const text = fs21.readFileSync(absPath, "utf8");
   const failures = [];
   const lines = text.split(/\r?\n/);
   for (let i = 0; i < lines.length; i++) {
@@ -4658,42 +4971,46 @@ function auditShippedFiles(manifestDir, items) {
   const failures = [];
   for (const item of items) {
     if (!item.path || !isSafeCatalogPath2(item.path)) continue;
-    const absPath = path26.join(manifestDir, item.path);
+    const absPath = path27.join(manifestDir, item.path);
     if (item.type === "skill") {
-      const skillMd = path26.join(absPath, "SKILL.md");
-      if (!fs20.existsSync(skillMd)) {
-        failures.push(`${item.id}: missing ${path26.relative(manifestDir, skillMd)}`);
+      const skillMd = path27.join(absPath, "SKILL.md");
+      if (!fs21.existsSync(skillMd)) {
+        failures.push(`${item.id}: missing ${path27.relative(manifestDir, skillMd)}`);
         continue;
       }
-      const text = fs20.readFileSync(skillMd, "utf8");
+      const text = fs21.readFileSync(skillMd, "utf8");
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: SKILL.md`));
       failures.push(
-        ...auditForbiddenTagsInText(text, `${item.id}: ${path26.relative(manifestDir, skillMd)}`)
+        ...auditForbiddenTagsInText(text, `${item.id}: ${path27.relative(manifestDir, skillMd)}`)
       );
     } else if (item.type === "agent") {
-      if (!fs20.existsSync(absPath)) {
+      if (!fs21.existsSync(absPath)) {
         failures.push(`${item.id}: missing agent file ${item.path}`);
         continue;
       }
-      const text = fs20.readFileSync(absPath, "utf8");
-      const rel = path26.relative(manifestDir, absPath);
+      const text = fs21.readFileSync(absPath, "utf8");
+      const rel = path27.relative(manifestDir, absPath);
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: ${rel}`));
       failures.push(...auditForbiddenTagsInText(text, `${item.id}: ${rel}`));
     } else if (item.type === "template") {
-      if (!fs20.existsSync(absPath)) {
+      if (!fs21.existsSync(absPath)) {
         failures.push(`${item.id}: missing template file ${item.path}`);
         continue;
       }
       failures.push(...auditTemplateContent(manifestDir, absPath, item.id));
     } else if (item.type === "command") {
-      if (!fs20.existsSync(absPath)) {
+      if (!fs21.existsSync(absPath)) {
         failures.push(`${item.id}: missing command file ${item.path}`);
         continue;
       }
-      const text = fs20.readFileSync(absPath, "utf8");
-      const rel = path26.relative(manifestDir, absPath);
+      const text = fs21.readFileSync(absPath, "utf8");
+      const rel = path27.relative(manifestDir, absPath);
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: ${rel}`));
       failures.push(...auditTemplateContent(manifestDir, absPath, item.id));
+    } else if (item.type === "config") {
+      if (!fs21.existsSync(absPath)) {
+        failures.push(`${item.id}: missing config path ${item.path}`);
+      }
     }
   }
   return failures;
@@ -4705,21 +5022,25 @@ var DIR_ITEM_TYPE = {
   commands: "command"
 };
 function walkMd(dir, fn) {
-  for (const entry of fs20.readdirSync(dir, { withFileTypes: true })) {
-    const full = path26.join(dir, entry.name);
+  for (const entry of fs21.readdirSync(dir, { withFileTypes: true })) {
+    const full = path27.join(dir, entry.name);
     if (entry.isDirectory()) walkMd(full, fn);
     else if (entry.name.endsWith(".md")) fn(full);
   }
 }
-function auditMarkdownContent(manifestDir) {
+function auditMarkdownContent(manifestDir, items) {
   const failures = [];
+  const pathSourceMap = buildItemPathSourceMap(items);
   for (const dir of ["skills", "agents", "templates", "commands"]) {
-    const abs = path26.join(manifestDir, dir);
-    if (!fs20.existsSync(abs)) continue;
-    const checkNonTsxNpx = !NPX_TSX_ONLY_EXEMPT_TYPES.includes(DIR_ITEM_TYPE[dir] ?? "");
+    const abs = path27.join(manifestDir, dir);
+    if (!fs21.existsSync(abs)) continue;
+    const dirType = DIR_ITEM_TYPE[dir] ?? "";
     walkMd(abs, (file) => {
-      const text = fs20.readFileSync(file, "utf8");
-      const rel = path26.relative(manifestDir, file);
+      const text = fs21.readFileSync(file, "utf8");
+      const rel = path27.relative(manifestDir, file);
+      const norm = rel.replace(/\\/g, "/");
+      const source = resolveMarkdownItemSource(norm, pathSourceMap);
+      const checkNonTsxNpx = !isNpxTsxOnlyExempt(dirType, source);
       const lines = text.split(/\r?\n/);
       for (let i = 0; i < lines.length; i++) {
         const line2 = lines[i] ?? "";
@@ -4729,7 +5050,7 @@ function auditMarkdownContent(manifestDir) {
           failures.push(`${rel}:${i + 1}: disallowed npx (only npx tsx allowed)`);
         }
       }
-      if (!rel.includes("/references/")) failures.push(...auditForbiddenTagsInText(text, rel));
+      if (!norm.includes("/references/")) failures.push(...auditForbiddenTagsInText(text, rel));
     });
   }
   return failures;
@@ -4739,7 +5060,7 @@ function validateCatalogData(manifestDir, manifestVersion, items) {
     ...auditManifestStructure(manifestVersion, items),
     ...auditForbiddenStacks(items),
     ...auditShippedFiles(manifestDir, items),
-    ...auditMarkdownContent(manifestDir),
+    ...auditMarkdownContent(manifestDir, items),
     ...auditDisallowedTags(items)
   ];
   return { ok: failures.length === 0, failures, items };
@@ -4752,8 +5073,8 @@ async function runValidateCatalog(manifestPath2) {
     process.exitCode = 1;
     return;
   }
-  const abs = path27.resolve(process.cwd(), manifestPath2);
-  const manifestDir = path27.dirname(abs);
+  const abs = path28.resolve(process.cwd(), manifestPath2);
+  const manifestDir = path28.dirname(abs);
   const data = await readJson(abs);
   if (!data?.items) {
     error(`Could not read catalog manifest at ${abs}`);
@@ -4771,7 +5092,7 @@ async function runValidateCatalog(manifestPath2) {
 
 // src/commands/workspace.ts
 import { existsSync as existsSync5, statSync as statSync2 } from "node:fs";
-import path34 from "node:path";
+import path35 from "node:path";
 
 // src/commands/workspace/aggregate.ts
 async function writeWorkspaceArtifacts(workspaceRoot, repos, relationships = []) {
@@ -4825,7 +5146,7 @@ ${summaries.map(
 }
 
 // src/commands/workspace/config.ts
-import path28 from "node:path";
+import path29 from "node:path";
 import YAML from "yaml";
 var WORKSPACE_FILE = "haus.workspace.yaml";
 function parseWorkspaceConfig(text) {
@@ -4848,11 +5169,11 @@ function parseWorkspaceConfig(text) {
   };
 }
 async function readWorkspaceConfig(workspaceRoot) {
-  return parseWorkspaceConfig(await readText(path28.join(workspaceRoot, WORKSPACE_FILE)));
+  return parseWorkspaceConfig(await readText(path29.join(workspaceRoot, WORKSPACE_FILE)));
 }
 
 // src/commands/workspace/discover.ts
-import path29 from "node:path";
+import path30 from "node:path";
 import fg4 from "fast-glob";
 import YAML2 from "yaml";
 var DEFAULT_MAX_DEPTH = 3;
@@ -4880,8 +5201,8 @@ async function discoverRepos(workspaceRoot, maxDepth = DEFAULT_MAX_DEPTH) {
   const gitDirs = /* @__PURE__ */ new Set();
   const manifestDirs = /* @__PURE__ */ new Set();
   for (const match of matches) {
-    const base = path29.posix.basename(match);
-    const dir = path29.posix.dirname(match);
+    const base = path30.posix.basename(match);
+    const dir = path30.posix.dirname(match);
     const owner = dir === "." ? "." : dir;
     if (base === ".git") gitDirs.add(owner);
     else manifestDirs.add(owner);
@@ -4897,9 +5218,9 @@ async function discoverRepos(workspaceRoot, maxDepth = DEFAULT_MAX_DEPTH) {
   }
   repoRoots.sort((a, b) => a.localeCompare(b));
   return mapWithConcurrency(repoRoots, async (relDir) => {
-    const absDir = path29.resolve(workspaceRoot, relDir);
-    const pkg = await readJson(path29.join(absDir, "package.json"));
-    const name = typeof pkg?.name === "string" && pkg.name.length > 0 ? pkg.name : path29.basename(relDir === "." ? workspaceRoot : absDir);
+    const absDir = path30.resolve(workspaceRoot, relDir);
+    const pkg = await readJson(path30.join(absDir, "package.json"));
+    const name = typeof pkg?.name === "string" && pkg.name.length > 0 ? pkg.name : path30.basename(relDir === "." ? workspaceRoot : absDir);
     let role = "auto";
     try {
       const scan = await scanProject(absDir);
@@ -4942,7 +5263,7 @@ function renderWorkspaceYaml(config) {
   });
 }
 async function runDiscover(workspaceRoot, opts = {}) {
-  const yamlPath = path29.join(workspaceRoot, "haus.workspace.yaml");
+  const yamlPath = path30.join(workspaceRoot, "haus.workspace.yaml");
   const existingText = await readText(yamlPath);
   const existing = parseWorkspaceConfig(existingText);
   if (existingText && !existing) {
@@ -4976,18 +5297,18 @@ async function runDiscover(workspaceRoot, opts = {}) {
 
 // src/commands/workspace/doctor.ts
 import { existsSync as existsSync3 } from "node:fs";
-import path31 from "node:path";
+import path32 from "node:path";
 
 // src/commands/workspace/manifest.ts
 import { readFileSync as readFileSync3 } from "node:fs";
-import path30 from "node:path";
+import path31 from "node:path";
 var MANIFEST_FILE = "workspace.manifest.json";
 function manifestPath(workspaceRoot) {
   return hausPath(workspaceRoot, MANIFEST_FILE);
 }
 function hausVersion() {
   try {
-    const pkg = JSON.parse(readFileSync3(path30.join(packageRoot(), "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync3(path31.join(packageRoot(), "package.json"), "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -5053,7 +5374,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
   }
   const manifestByName = new Map(manifest.repos.map((r) => [r.name, r]));
   for (const repo of config.repos) {
-    const repoRoot = path31.resolve(workspaceRoot, repo.path);
+    const repoRoot = path32.resolve(workspaceRoot, repo.path);
     const entry = manifestByName.get(repo.name);
     if (!entry) {
       flag({
@@ -5127,11 +5448,11 @@ function emit(args) {
 
 // src/commands/workspace/setup.ts
 import { existsSync as existsSync4, statSync } from "node:fs";
-import path33 from "node:path";
+import path34 from "node:path";
 
 // src/claude/write-workspace-claude-md.ts
-import path32 from "node:path";
-import fs21 from "fs-extra";
+import path33 from "node:path";
+import fs22 from "fs-extra";
 function buildWorkspaceImportBlock(client, members) {
   const memberLines = members.map((m) => `- ${m.name} (${m.path})`);
   const body = [
@@ -5149,8 +5470,8 @@ ${BLOCK_END}`;
 async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
   const block = buildWorkspaceImportBlock(opts.client, opts.members);
   const dryRun = opts.dryRun ?? false;
-  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path32.join(workspaceRoot, "CLAUDE.md");
-  const prev = await fs21.pathExists(filePath) ? await fs21.readFile(filePath, "utf8") : "";
+  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path33.join(workspaceRoot, "CLAUDE.md");
+  const prev = await fs22.pathExists(filePath) ? await fs22.readFile(filePath, "utf8") : "";
   const next = opts.collision ? `${block}
 ` : injectHausBlock(prev, block);
   const printable = displayPath(workspaceRoot, filePath);
@@ -5175,20 +5496,20 @@ async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
 
 // src/commands/workspace/setup.ts
 function resolveWorkspaceRoot(start = process.cwd()) {
-  let dir = path33.resolve(start);
+  let dir = path34.resolve(start);
   for (; ; ) {
-    if (existsSync4(path33.join(dir, WORKSPACE_FILE))) return dir;
-    const parent = path33.dirname(dir);
-    if (parent === dir) return path33.resolve(start);
+    if (existsSync4(path34.join(dir, WORKSPACE_FILE))) return dir;
+    const parent = path34.dirname(dir);
+    if (parent === dir) return path34.resolve(start);
     dir = parent;
   }
 }
 function isRootRepo(workspaceRoot, repoPath) {
-  return path33.resolve(workspaceRoot, repoPath) === path33.resolve(workspaceRoot);
+  return path34.resolve(workspaceRoot, repoPath) === path34.resolve(workspaceRoot);
 }
 async function runWorkspaceSetup(workspaceRoot, options = {}) {
   const apply = options.write ?? false;
-  const configText = await readText(path33.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path34.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
@@ -5205,7 +5526,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
   const statuses = [];
   const aggregateInputs = [];
   for (const repo of repos) {
-    const repoRoot = path33.resolve(workspaceRoot, repo.path);
+    const repoRoot = path34.resolve(workspaceRoot, repo.path);
     log(`
 \u2192 ${repo.name} (${repo.path})`);
     try {
@@ -5273,7 +5594,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
       const status = statusByName.get(repo.name);
       const role = repo.role ?? status?.roles?.[0] ?? "auto";
       if (status?.status === "ok") {
-        const lock = await checkLock(path33.resolve(workspaceRoot, repo.path));
+        const lock = await checkLock(path34.resolve(workspaceRoot, repo.path));
         manifestRepos.push({
           name: repo.name,
           path: repo.path,
@@ -5353,7 +5674,7 @@ relationships: []
   log("Workspace initialized.");
 }
 async function scanWorkspace(workspaceRoot, opts) {
-  const configText = await readText(path34.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path35.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
@@ -5374,7 +5695,7 @@ async function scanWorkspace(workspaceRoot, opts) {
   }
   const inputs = [];
   for (const repo of config.repos) {
-    const repoRoot = path34.resolve(workspaceRoot, repo.path);
+    const repoRoot = path35.resolve(workspaceRoot, repo.path);
     if (!existsSync5(repoRoot) || !statSync2(repoRoot).isDirectory()) {
       throw new Error(`Repo path is not a directory: ${repo.path}`);
     }
@@ -5424,7 +5745,7 @@ async function runWorkspace(action, options = {}) {
 // src/cli.ts
 function cliVersion() {
   try {
-    const pkgPath = path35.join(packageRoot(), "package.json");
+    const pkgPath = path36.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
@@ -5434,7 +5755,7 @@ function cliVersion() {
 var program = new Command();
 function validateRuntimeNodeVersion() {
   try {
-    const pkgPath = path35.join(packageRoot(), "package.json");
+    const pkgPath = path36.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
     const requiredRange = pkg.engines?.node;
     if (requiredRange && !satisfiesVersion(process.version, requiredRange)) {
@@ -5470,6 +5791,9 @@ program.command("catalog-audit").action(runCatalogAudit);
 program.command("validate-catalog").argument("[manifest]").action(runValidateCatalog);
 program.command("update").option("--check").action(runUpdate);
 program.command("install").option("--dry-run").option("--force").option("--check", "Exit non-zero if any HAUS-MANAGED file is out of date").option("--postinstall", "Run by the npm postinstall hook; prints a plain-language change notice").action(runInstall);
+program.command("scaffold [ids...]").description(
+  "Copy catalog config items (ESLint, Prettier) into the project root. Pass item IDs to scaffold specific items, or omit to scaffold all available config items."
+).option("--force", "Overwrite existing files").option("--dry-run", "Preview what would be written without changing anything").option("--root <path>", "Project root (defaults to cwd)", process.cwd()).action(runScaffold);
 program.command("uninstall").option("--force").action(runUninstallCommand);
 var guard = program.command("guard");
 guard.command("file-access").option("--from-hook").action((opts) => runGuard("file-access", opts));