@haus-tech/haus-workflow 0.28.1 → 0.30.0

package/library/catalog/validation-rules.json

@@ -25,7 +25,7 @@
   ],
   "allowedNpxPattern": { "source": "\\bnpx\\s+tsx\\b", "flags": "i" },
   "anyNpxPattern": { "source": "\\bnpx\\s+\\S+", "flags": "i" },
-  "npxTsxOnlyExemptTypes": ["agent"],
+  "npxTsxOnlyExemptSources": ["curated"],
   "httpUrlPattern": { "source": "^http:\\/\\/", "flags": "i" },
   "placeholderPattern": { "source": "\\bTODO\\b|\\bPLACEHOLDER\\b", "flags": "i" },
   "allowedStacks": [

package/library/global/commands/haus-cloneandsetup.md

@@ -131,9 +131,9 @@ seeds: # optional: data sources NOT owned by a manifest repo (e.g. a shared Word
    - `composer-path` → in `in`'s `composer.json`, set the `dep`'s require to `{ "type": "path", "url": "../<dep-folder>", "options": { "symlink": true } }`, then `composer update <vendor/dep>`.
    - `yarn-link` → `yarn link` in the `dep` repo, then `yarn link <pkg-name>` in each `in` repo (read `<pkg-name>` from the dep's `package.json`).
 5. **Env (deterministic):** write each repo's `.env` from known values — no improvising.
-   1. **Compute** each repo's values, in this precedence: the workspace `localdev.yml` `env` map (chosen literals + cross-repo `source` values — the single source of truth) → generated secrets (DB passwords/tokens minted this run) → the **dev-defaults table** below for anything still unset.
+   1. **Compute** each repo's values, in this precedence: the workspace `localdev.yml` `env` map (chosen literals + cross-repo `source` values — the single source of truth) → generated secrets (DB passwords/tokens minted this run) → **a value already present locally** in a sibling repo's `.env.example` / `.env` (matched by key, or by the same value under a framework-prefix swap `MIX_` ↔ `VITE_` ↔ `NEXT_PUBLIC_` ↔ `REACT_APP_`) — reuse it: it is already on the machine, so copying it into this repo's local (gitignored) `.env` adds nothing new to git → the **dev-defaults table** below for anything still unset.
    2. **Write** them into each repo's `.env` (create it if absent; **upsert** keys, never clobbering a value the user already set). These are local dev files — write them directly.
-   3. **Real secrets the generator can't mint** (third-party API keys, prod credentials) go in as clearly-marked `KEY=` blanks for the user to fill; report exactly which keys are still blank.
+   3. **Secrets that exist nowhere locally** (third-party API keys, prod credentials, license keys the machine doesn't already have — §1 reuse only applies when the value is present locally) can't be invented, so the flow **explicitly tells the user it needs them** — never silently leaving a blank and proceeding as if set up. Put each in as a clearly-marked `KEY=` blank and report it, naming **which key**, **what it unlocks** (the step or feature that fails without it), and **how to get it manually**: from the provider's own account/dashboard (e.g. the Laravel Nova licence page, the Mediaflow API account), by copying it from the deployed environment's env vars (the server / hosting config), or by asking a colleague who already has it. **NEVER write a secret value into a git-tracked file:** `.env` writes are local and gitignored (fine — reuse freely), but the workspace `localdev.yml` `env` map is committed, so it carries non-secret cross-repo literals only (DB names, ports, host URLs), never credentials. Report all blanks together as one actionable list, not piecemeal.
 
    **Dev-defaults table** — used only when neither `localdev.yml` nor a generated secret supplies the value:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haus-tech/haus-workflow",
-  "version": "0.28.1",
+  "version": "0.30.0",
   "description": "Haus AI workflow CLI for Claude Code.",
   "type": "module",
   "bin": {