@haus-tech/haus-workflow 0.29.0 → 0.31.0

package/library/catalog/validation-rules.json

@@ -25,7 +25,7 @@
   ],
   "allowedNpxPattern": { "source": "\\bnpx\\s+tsx\\b", "flags": "i" },
   "anyNpxPattern": { "source": "\\bnpx\\s+\\S+", "flags": "i" },
-  "npxTsxOnlyExemptTypes": ["agent"],
+  "npxTsxOnlyExemptSources": ["curated"],
   "httpUrlPattern": { "source": "^http:\\/\\/", "flags": "i" },
   "placeholderPattern": { "source": "\\bTODO\\b|\\bPLACEHOLDER\\b", "flags": "i" },
   "allowedStacks": [

package/library/global/commands/haus-cloneandsetup.md

@@ -131,9 +131,9 @@ seeds: # optional: data sources NOT owned by a manifest repo (e.g. a shared Word
    - `composer-path` → in `in`'s `composer.json`, set the `dep`'s require to `{ "type": "path", "url": "../<dep-folder>", "options": { "symlink": true } }`, then `composer update <vendor/dep>`.
    - `yarn-link` → `yarn link` in the `dep` repo, then `yarn link <pkg-name>` in each `in` repo (read `<pkg-name>` from the dep's `package.json`).
 5. **Env (deterministic):** write each repo's `.env` from known values — no improvising.
-   1. **Compute** each repo's values, in this precedence: the workspace `localdev.yml` `env` map (chosen literals + cross-repo `source` values — the single source of truth) → generated secrets (DB passwords/tokens minted this run) → the **dev-defaults table** below for anything still unset.
+   1. **Compute** each repo's values, in this precedence: the workspace `localdev.yml` `env` map (chosen literals + cross-repo `source` values — the single source of truth) → generated secrets (DB passwords/tokens minted this run) → **a value already present locally** in a sibling repo's `.env.example` / `.env` (matched by key, or by the same value under a framework-prefix swap `MIX_` ↔ `VITE_` ↔ `NEXT_PUBLIC_` ↔ `REACT_APP_`) — reuse it: it is already on the machine, so copying it into this repo's local (gitignored) `.env` adds nothing new to git → the **dev-defaults table** below for anything still unset.
    2. **Write** them into each repo's `.env` (create it if absent; **upsert** keys, never clobbering a value the user already set). These are local dev files — write them directly.
-   3. **Real secrets the generator can't mint** (third-party API keys, prod credentials) go in as clearly-marked `KEY=` blanks for the user to fill; report exactly which keys are still blank.
+   3. **Secrets that exist nowhere locally** (third-party API keys, prod credentials, license keys the machine doesn't already have — §1 reuse only applies when the value is present locally) can't be invented, so the flow **explicitly tells the user it needs them** — never silently leaving a blank and proceeding as if set up. Put each in as a clearly-marked `KEY=` blank and report it, naming **which key**, **what it unlocks** (the step or feature that fails without it), and **how to get it manually**: from the provider's own account/dashboard (e.g. the Laravel Nova licence page, the Mediaflow API account), by copying it from the deployed environment's env vars (the server / hosting config), or by asking a colleague who already has it. **NEVER write a secret value into a git-tracked file:** `.env` writes are local and gitignored (fine — reuse freely), but the workspace `localdev.yml` `env` map is committed, so it carries non-secret cross-repo literals only (DB names, ports, host URLs), never credentials. Report all blanks together as one actionable list, not piecemeal.
 
    **Dev-defaults table** — used only when neither `localdev.yml` nor a generated secret supplies the value:
 

package/library/global/commands/haus-setup.md

@@ -31,13 +31,37 @@ Do this in order:
    deep read discovered. You MUST run this before the next apply — `haus apply`
    does not re-calculate recommendations on its own.
 
-5. **Apply the rest.** Run `haus apply --write` again. It only writes what changed,
-   so this just adds the newly-matched helpers from step 4.
+5. **Offer optional helpers.** Read `.haus-workflow/recommendation.json` yourself
+   (never show the JSON). Two kinds of optional extras may be listed; offer only
+   the ones present, all **unchecked** by default — these are opt-in:
+   - **Optional skills & agents** (`optInEligible[]`): workflow/ops/review/design
+     helpers that don't auto-install for this stack. Group them by their
+     `optInGroup` label and present one `AskUserQuestion` option per group
+     (use each item's `purpose` and `tokenEstimate` to describe it in plain
+     language, e.g. "Code review workflow — request/receive structured reviews").
+     Collect the item ids from **all** the groups the user picked into one list
+     and run a **single** `haus recommend --include <id> <id> …` (one command with
+     every chosen id). Don't run it once per group — each run rewrites
+     `recommendation.json`, so repeated calls would drop the earlier includes.
+   - **Project config** (entries in `recommended[]` with `install: false`, e.g.
+     Haus ESLint / Prettier baselines): offer each as a plain choice ("Add the
+     Haus ESLint baseline"). On confirm, run `haus scaffold <id>`. `haus scaffold`
+     **preserves existing config files by default** and tells you when a file
+     already exists — only re-run with `haus scaffold <id> --force` if the user
+     explicitly chooses to **replace** their current config.
 
-6. **Confirm.** End with one plain-language line, for example:
+   If neither list has anything, skip this step silently — don't ask an empty
+   question.
+
+6. **Apply the rest.** Run `haus apply --write` again. It only writes what changed,
+   so this adds the newly-matched helpers from step 4 plus any opt-ins from step 5.
+
+7. **Confirm.** End with one plain-language line, for example:
    "✅ Your project is configured — I wrote your project docs, added N guardrails
-   and M coding helpers (K matched after reading your code in depth). Run
-   `/haus-doctor` any time to re-check." Fill the numbers from the apply output.
+   and M coding helpers (K matched after reading your code in depth), plus the J
+   optional helpers you chose: <name them>. Run `/haus-doctor` any time to
+   re-check." Fill the numbers from the apply output, and name the opt-ins the
+   user picked in step 5 (omit that clause if they chose none).
 
 If anything fails, explain what happened in plain language and what you'll try
 next — don't dump raw errors.

package/library/global/skills/haus-workflow/SKILL.md

@@ -26,6 +26,7 @@ The short legacy aliases still work but the names below are canonical.
 | `project:init` (`setup`, `init`)                                  | _Setup procedure below_         | project | First-time setup of an **existing** repo: adds AI skills, commands, workflow + project docs                                                                                               |
 | `project:clone [name]` (`clone`)                                  | _Clone procedure below_         | project | No name: clone a **workspace**'s repos from `repos.manifest.json`. With a `name`: find & clone one repo by name from GitHub                                                               |
 | `project:cloneandsetup [name]` (`cloneandsetup`)                  | _Clone & setup procedure below_ | project | Run `project:clone`, then set up each repo for local dev — deps, databases, cross-repo links, and env — via each repo's `.haus-workflow/localdev.yml` (+ the workspace's order/links/env) |
+| `project:add-skills` (`add-skills`, `opt-in`)                     | _Add-skills procedure below_    | project | Add optional skills, agents, or config (ESLint/Prettier) to an already-set-up project without re-running full setup                                                                       |
 | `project:refresh` (`apply`, `refresh`, `claude-md`, `regenerate`) | `haus apply --write`            | project | Re-run setup / refresh `.claude/` context + regenerate root `CLAUDE.md` import block                                                                                                      |
 | `project:doctor` (`doctor`, `check`)                              | `haus doctor`                   | project | Check for install drift                                                                                                                                                                   |
 | `update` (`upgrade`)                                              | `haus update`                   | global  | Update npm package + catalog + `~/.claude/` (also refreshes this project)                                                                                                                 |
@@ -51,6 +52,8 @@ Options:
      (no name: clone a workspace from repos.manifest.json; with a name: find & clone one repo by name from GitHub)
   5. [project] project:cloneandsetup [name] — clone repos, then set them up for local dev
      (project:clone, then per-repo deps + databases + cross-repo links + env from localdev.yml)
+  6. [project] project:add-skills — add optional skills, agents, or config to this project
+     (offers opt-in helpers matching your stack that aren't installed yet — no full re-setup)
 ```
 
 Map the user's selection to the command from the alias table, then continue to Step 2.
@@ -65,6 +68,8 @@ Run the mapped command via Bash. Quote the exact command you are running before
 
 **Exception — `project:cloneandsetup` (`cloneandsetup`):** clone followed by a per-repo setup pass, with confirmations. Skip to **Clone & setup (`project:cloneandsetup`)** under Step 3 and follow it.
 
+**Exception — `project:add-skills` (`add-skills` / `opt-in`):** a short scan → recommend → choose → apply procedure. Skip to **Add optional skills (`project:add-skills`)** under Step 3 and follow it.
+
 ## Step 3 — Post-run steps
 
 After the command completes, follow the relevant post-run steps below.
@@ -82,6 +87,31 @@ After the command completes, follow the relevant post-run steps below.
 
 1. Open and follow `~/.claude/commands/haus-cloneandsetup.md` — it runs the full `project:clone` flow, then sets up each cloned repo locally: selects the node version (`nvm install` from `.nvmrc`), enables corepack, installs JS/PHP dependencies, and seeds `.env`, confirming before each phase. It does not start servers.
 
+### Add optional skills (`project:add-skills`)
+
+For a project that's already set up but where the user wants more helpers later —
+without re-running the full `project:init` flow. Never show raw JSON; offer plain
+choices.
+
+1. Refresh the picture: run `haus scan --json` then `haus recommend` (it re-reads
+   `.haus-workflow/deep-context.json` if present).
+2. Read `.haus-workflow/recommendation.json` and `.haus-workflow/haus.lock.json`
+   yourself. Build the choices from items **not already installed** (lock ids):
+   - **Optional skills & agents** — `optInEligible[]`, grouped by `optInGroup`
+     (each carries `purpose` + `tokenEstimate` for a plain-language label).
+   - **Project config** — `recommended[]` entries with `install: false` (Haus
+     ESLint / Prettier) whose files aren't already present.
+3. If nothing is eligible, say so plainly and stop — e.g. "Everything matching
+   your stack is already installed" or "No optional helpers for this stack."
+4. Otherwise present a single `AskUserQuestion` (multi-select, all unchecked)
+   with one option per group / config item. Then:
+   - Skills/agents → `haus recommend --include <id> <id> …`, then
+     `haus apply --write`.
+   - Config → `haus scaffold <id>` (add `--force` only if the user chose to
+     replace an existing file; scaffold preserves files by default).
+5. Confirm with the names added and their combined token estimate, e.g.
+   "Added 2 optional helpers: Code review workflow, TDD workflow (~3k tokens)."
+
 ### After `haus apply --write`
 
 Verify that the root `CLAUDE.md` imports all three haus files:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haus-tech/haus-workflow",
-  "version": "0.29.0",
+  "version": "0.31.0",
   "description": "Haus AI workflow CLI for Claude Code.",
   "type": "module",
   "bin": {