@haus-tech/haus-workflow 0.30.0 → 0.31.1

package/dist/cli.js

@@ -2,11 +2,11 @@
 
 // src/cli.ts
 import { readFileSync as readFileSync4 } from "node:fs";
-import path36 from "node:path";
+import path37 from "node:path";
 import { Command } from "commander";
 
 // src/commands/apply.ts
-import path13 from "node:path";
+import path14 from "node:path";
 import checkbox from "@inquirer/checkbox";
 
 // src/catalog/remote-catalog.ts
@@ -182,7 +182,7 @@ var validation_rules_default = {
     "vendure3",
     "nestjs",
     "graphql",
-    "nx21",
+    "nx",
     "turbo",
     "nextjs",
     "react19",
@@ -1043,8 +1043,8 @@ async function getCacheManifestAge() {
 }
 
 // src/claude/write-claude-files.ts
-import path12 from "node:path";
-import fs12 from "fs-extra";
+import path13 from "node:path";
+import fs13 from "fs-extra";
 
 // src/catalog/load-catalog.ts
 import path4 from "node:path";
@@ -1660,8 +1660,8 @@ function buildDenyRules() {
   for (const command of DENY_COMMANDS) {
     rules.push(`Bash(${command}:*)`);
   }
-  for (const path37 of DENY_PATHS) {
-    const pattern = DENY_DIRS.has(path37) ? `${path37}/**` : path37;
+  for (const path38 of DENY_PATHS) {
+    const pattern = DENY_DIRS.has(path38) ? `${path38}/**` : path38;
     for (const tool of FILE_TOOLS) {
       rules.push(`${tool}(${pattern})`);
     }
@@ -1851,9 +1851,74 @@ async function verifyProjectSettingsHooksContract(root) {
   return { ok: true, message: "settings.json carries required haus hook contract." };
 }
 
-// src/claude/write-root-claude-md.ts
+// src/claude/write-prettierignore.ts
 import path9 from "node:path";
 import fs8 from "fs-extra";
+var PRETTIERIGNORE_BEGIN = "# HAUS:BEGIN haus-managed v=1";
+var PRETTIERIGNORE_END = "# HAUS:END haus-managed";
+var IGNORED_PATHS = [".haus-workflow/"];
+function buildPrettierIgnoreBlock() {
+  return [
+    PRETTIERIGNORE_BEGIN,
+    "# haus-owned files \u2014 do not reformat (keeps tamper-detection hashes stable)",
+    ...IGNORED_PATHS,
+    PRETTIERIGNORE_END
+  ].join("\n");
+}
+function findLineMarker(content2, marker, from = 0) {
+  let idx = content2.indexOf(marker, from);
+  while (idx !== -1) {
+    const lineStart = idx === 0 || content2[idx - 1] === "\n";
+    const after = idx + marker.length;
+    const lineEnd = after === content2.length || content2[after] === "\n" || content2[after] === "\r";
+    if (lineStart && lineEnd) return { start: idx, end: after };
+    idx = content2.indexOf(marker, idx + marker.length);
+  }
+  return null;
+}
+function findBlockRange(content2) {
+  const begin = findLineMarker(content2, PRETTIERIGNORE_BEGIN);
+  if (!begin) return null;
+  const end = findLineMarker(content2, PRETTIERIGNORE_END, begin.end);
+  if (!end) return null;
+  return { start: begin.start, end: end.end };
+}
+function injectPrettierIgnoreBlock(existing, block) {
+  const range = findBlockRange(existing);
+  if (range) {
+    const before = existing.slice(0, range.start);
+    const after = existing.slice(range.end);
+    return `${before}${block}${after}`.replace(/\n*$/, "\n");
+  }
+  const loneBegin = findLineMarker(existing, PRETTIERIGNORE_BEGIN);
+  if (loneBegin) {
+    const before = existing.slice(0, loneBegin.start).trimEnd();
+    if (before.length === 0) return `${block}
+`;
+    return `${before}
+
+${block}
+`;
+  }
+  const trimmed = existing.trimEnd();
+  if (trimmed.length === 0) return `${block}
+`;
+  return `${trimmed}
+
+${block}
+`;
+}
+async function writePrettierIgnore(root, dryRun) {
+  const filePath = path9.join(root, ".prettierignore");
+  const prev = await fs8.pathExists(filePath) ? await fs8.readFile(filePath, "utf8") : "";
+  const next = injectPrettierIgnoreBlock(prev, buildPrettierIgnoreBlock());
+  await writeManagedText(root, filePath, next, dryRun);
+  return filePath;
+}
+
+// src/claude/write-root-claude-md.ts
+import path10 from "node:path";
+import fs9 from "fs-extra";
 var BLOCK_BEGIN = "<!-- HAUS:BEGIN haus-imports v=1 -->";
 var BLOCK_END = "<!-- HAUS:END haus-imports -->";
 var IMPORT_CONTENT = `@.haus-workflow/WORKFLOW.md
@@ -1863,7 +1928,7 @@ function buildImportBlock() {
 ${IMPORT_CONTENT}
 ${BLOCK_END}`;
 }
-function findLineMarker(content2, marker, from = 0) {
+function findLineMarker2(content2, marker, from = 0) {
   let idx = content2.indexOf(marker, from);
   while (idx !== -1) {
     const lineStart = idx === 0 || content2[idx - 1] === "\n";
@@ -1875,9 +1940,9 @@ function findLineMarker(content2, marker, from = 0) {
   return null;
 }
 function findImportBlockRange(content2) {
-  const begin = findLineMarker(content2, BLOCK_BEGIN);
+  const begin = findLineMarker2(content2, BLOCK_BEGIN);
   if (!begin) return null;
-  const end = findLineMarker(content2, BLOCK_END, begin.end);
+  const end = findLineMarker2(content2, BLOCK_END, begin.end);
   if (!end) return null;
   return { beginStart: begin.start, beginEnd: begin.end, endStart: end.start, endEnd: end.end };
 }
@@ -1897,7 +1962,7 @@ function injectHausBlock(existing, block) {
     const after = existing.slice(range.endEnd);
     return `${before}${block}${after}`;
   }
-  const loneBegin = findLineMarker(existing, BLOCK_BEGIN);
+  const loneBegin = findLineMarker2(existing, BLOCK_BEGIN);
   if (loneBegin) {
     const before = existing.slice(0, loneBegin.start).trimEnd();
     if (before.length === 0) return `${block}
@@ -1918,21 +1983,21 @@ ${block}
 `;
 }
 async function writeRootClaudeMd(root, dryRun) {
-  const filePath = path9.join(root, "CLAUDE.md");
+  const filePath = path10.join(root, "CLAUDE.md");
   const block = buildImportBlock();
-  const prev = await fs8.pathExists(filePath) ? await fs8.readFile(filePath, "utf8") : "";
+  const prev = await fs9.pathExists(filePath) ? await fs9.readFile(filePath, "utf8") : "";
   const next = injectHausBlock(prev, block);
   await writeManagedText(root, filePath, next, dryRun);
   return filePath;
 }
 
 // src/claude/write-workflow-config.ts
-import path11 from "node:path";
-import fs10 from "fs-extra";
+import path12 from "node:path";
+import fs11 from "fs-extra";
 
 // src/claude/derive-workflow-config.ts
-import path10 from "node:path";
-import fs9 from "fs-extra";
+import path11 from "node:path";
+import fs10 from "fs-extra";
 function binCmd(pm, bin, args) {
   const tail = args ? ` ${args}` : "";
   if (pm === "yarn") return `yarn ${bin}${tail}`;
@@ -1941,7 +2006,7 @@ function binCmd(pm, bin, args) {
 }
 async function deriveWorkflowConfig(root, ctx) {
   const pm = ctx.packageManager === "unknown" ? "npm" : ctx.packageManager;
-  const pkg = await readJson(path10.join(root, "package.json"));
+  const pkg = await readJson(path11.join(root, "package.json"));
   const scripts = pkg?.scripts ?? {};
   const deps = new Set(ctx.dependencies);
   const stacks = Object.values(ctx.detectedStacks ?? {}).flat();
@@ -1951,7 +2016,7 @@ async function deriveWorkflowConfig(root, ctx) {
     return null;
   };
   const hasDep = (name) => deps.has(name);
-  const exists = (rel) => fs9.pathExistsSync(path10.join(root, rel));
+  const exists = (rel) => fs10.pathExistsSync(path11.join(root, rel));
   const hasPlaywright = hasDep("@playwright/test") || stacks.includes("playwright");
   const hasCypress = hasDep("cypress");
   const preCommitTool = exists("lefthook.yml") || exists("lefthook.yaml") ? "lefthook" : exists(".husky") || hasDep("husky") || (scripts.prepare ?? "").includes("husky") ? "husky" : exists(".pre-commit-config.yaml") ? "pre-commit (Python framework)" : null;
@@ -2019,7 +2084,7 @@ var FALLBACK_CONTEXT = {
 async function writeWorkflowConfig(root, dryRun, opts = {}) {
   const destPath = hausPath(root, "workflow-config.md");
   const printable = displayPath(root, destPath);
-  const exists = await fs10.pathExists(destPath);
+  const exists = await fs11.pathExists(destPath);
   if (exists && !opts.refill) {
     if (dryRun) log(printable + ": exists (project-owned, skipping)");
     return null;
@@ -2027,11 +2092,11 @@ async function writeWorkflowConfig(root, dryRun, opts = {}) {
   const ctx = await readJson(hausPath(root, "context-map.json")) ?? {
     ...FALLBACK_CONTEXT,
     root,
-    repoName: path11.basename(root)
+    repoName: path12.basename(root)
   };
   const values = await deriveWorkflowConfig(root, ctx);
   if (exists) {
-    const current = await fs10.readFile(destPath, "utf8");
+    const current = await fs11.readFile(destPath, "utf8");
     const refilled = refillContent(current, values);
     if (refilled === current) {
       if (dryRun) log(printable + ": no blank fields to refill");
@@ -2053,7 +2118,7 @@ async function writeWorkflowConfig(root, dryRun, opts = {}) {
 }
 
 // src/claude/write-workflow.ts
-import fs11 from "fs-extra";
+import fs12 from "fs-extra";
 var STABLE_ID = "template.workflow";
 function makeWorkflowHeader(pkgVersion, contentHash) {
   return `<!-- HAUS-MANAGED id=${STABLE_ID} v=${SCHEMA_VERSION} source=@haus-tech/haus-workflow@${pkgVersion} hash=${contentHash} -->`;
@@ -2072,8 +2137,8 @@ async function writeWorkflow(root, pkgVersion, dryRun, force = false) {
 ${templateContent}`;
   const destPath = hausPath(root, "WORKFLOW.md");
   const printable = displayPath(root, destPath);
-  if (await fs11.pathExists(destPath)) {
-    const existing = await fs11.readFile(destPath, "utf8");
+  if (await fs12.pathExists(destPath)) {
+    const existing = await fs12.readFile(destPath, "utf8");
     const firstLine = existing.split("\n")[0] ?? "";
     const parsed = parseHausManagedHeader(firstLine);
     if (!parsed) {
@@ -2107,7 +2172,7 @@ ${templateContent}`;
     }
   }
   if (dryRun) {
-    const prev = await fs11.pathExists(destPath) ? await fs11.readFile(destPath, "utf8") : "";
+    const prev = await fs12.pathExists(destPath) ? await fs12.readFile(destPath, "utf8") : "";
     if (!prev) {
       log(createUnifiedDiff(printable, "", next));
     } else {
@@ -2140,7 +2205,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
     estimatedTokenReductionPct: 0
   };
   const pkgRoot = packageRoot();
-  const hausVersion2 = (await readJson(path12.join(pkgRoot, "package.json")))?.version ?? "0.0.0";
+  const hausVersion2 = (await readJson(path13.join(pkgRoot, "package.json")))?.version ?? "0.0.0";
   const coreFiles = [
     claudePath(root, "settings.json"),
     claudePath(root, "rules", "haus.md"),
@@ -2151,10 +2216,12 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
   const workflowConfigPath = await writeWorkflowConfig(root, dryRun, {
     refill: opts.refillConfig
   });
+  const prettierIgnorePath = await writePrettierIgnore(root, dryRun);
   const p6Files = [
     rootClaudeMdPath,
     ...workflowPath ? [workflowPath] : [],
-    ...workflowConfigPath ? [workflowConfigPath] : []
+    ...workflowConfigPath ? [workflowConfigPath] : [],
+    prettierIgnorePath
   ];
   const files = dryRun ? [...coreFiles, ...p6Files] : [...coreFiles, ...p6Files, hausPath(root, "haus.lock.json")];
   if (dryRun) {
@@ -2171,8 +2238,8 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
     dryRun
   );
   const legacyReviewPath = claudePath(root, "commands", "haus-review.md");
-  if (await fs12.pathExists(legacyReviewPath)) {
-    const content2 = await fs12.readFile(legacyReviewPath, "utf8");
+  if (await fs13.pathExists(legacyReviewPath)) {
+    const content2 = await fs13.readFile(legacyReviewPath, "utf8");
     const stub = 'Run `haus context --task "code review"` then review diff.';
     if (content2 === stub || content2 === `${stub}
 ` || content2 === `${stub}\r
@@ -2180,7 +2247,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
       if (dryRun) {
         log(`[dry-run] would remove stale ${displayPath(root, legacyReviewPath)}`);
       } else {
-        await fs12.remove(legacyReviewPath);
+        await fs13.remove(legacyReviewPath);
       }
     }
   }
@@ -2208,8 +2275,8 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
     dryRun
   );
   const legacySecurityPath = claudePath(root, "rules", "security.md");
-  if (await fs12.pathExists(legacySecurityPath)) {
-    const content2 = await fs12.readFile(legacySecurityPath, "utf8");
+  if (await fs13.pathExists(legacySecurityPath)) {
+    const content2 = await fs13.readFile(legacySecurityPath, "utf8");
     const stub = "- Never read secrets.\n- Block dangerous shell commands.";
     if (content2 === stub || content2 === `${stub}
 ` || content2 === `${stub}\r
@@ -2217,7 +2284,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
       if (dryRun) {
         log(`[dry-run] would remove stale ${displayPath(root, legacySecurityPath)}`);
       } else {
-        await fs12.remove(legacySecurityPath);
+        await fs13.remove(legacySecurityPath);
       }
     }
   }
@@ -2232,11 +2299,11 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
   ];
   for (const rel of LEGACY_PRUNED_ARTIFACTS) {
     const legacyPath = hausPath(root, rel);
-    if (await fs12.pathExists(legacyPath)) {
+    if (await fs13.pathExists(legacyPath)) {
       if (dryRun) {
         log(`[dry-run] would remove stale ${displayPath(root, legacyPath)}`);
       } else {
-        await fs12.remove(legacyPath);
+        await fs13.remove(legacyPath);
       }
     }
   }
@@ -2278,10 +2345,10 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
       );
       continue;
     }
-    const destination = claudePath(root, target, path12.basename(sourcePath));
-    if (await fs12.pathExists(sourcePath)) {
+    const destination = claudePath(root, target, path13.basename(sourcePath));
+    if (await fs13.pathExists(sourcePath)) {
       if (dryRun) {
-        const exists = await fs12.pathExists(destination);
+        const exists = await fs13.pathExists(destination);
         log(
           `${displayPath(root, destination)}: ${exists ? "would overwrite" : "would create"} (${item.id})`
         );
@@ -2291,17 +2358,17 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
           dryRun: false
         });
       } else {
-        await fs12.ensureDir(path12.dirname(destination));
-        await fs12.copy(sourcePath, destination, { overwrite: true, errorOnExist: false });
+        await fs13.ensureDir(path13.dirname(destination));
+        await fs13.copy(sourcePath, destination, { overwrite: true, errorOnExist: false });
       }
       files.push(destination);
-      const relPaths = [path12.relative(root, destination)];
+      const relPaths = [path13.relative(root, destination)];
       if (!superpowersSharedInstalled && manifestItem.originSourceId === SUPERPOWERS_ORIGIN_SOURCE_ID && item.type === "skill") {
         const sharedRel = await installSuperpowersShared(contentRoot, root, dryRun);
         if (sharedRel) {
           superpowersSharedInstalled = true;
           relPaths.push(sharedRel);
-          files.push(path12.join(root, sharedRel));
+          files.push(path13.join(root, sharedRel));
         }
       }
       const current = installedPathsByItem.get(item.id) ?? [];
@@ -2368,7 +2435,7 @@ async function cleanupStaleCatalogItems(root, manifestById, dryRun) {
     if (relPaths.length === 0) continue;
     const existing = [];
     for (const rel of relPaths) {
-      if (await fs12.pathExists(path12.join(root, rel))) existing.push(rel);
+      if (await fs13.pathExists(path13.join(root, rel))) existing.push(rel);
     }
     if (existing.length === 0) continue;
     const pruneReason = deprecated ? "deprecated" : "stale";
@@ -2386,21 +2453,28 @@ async function cleanupStaleCatalogItems(root, manifestById, dryRun) {
       continue;
     }
     for (const rel of existing) {
-      const abs = path12.join(root, rel);
+      const abs = path13.join(root, rel);
       if (dryRun) {
         log(`[dry-run] would remove ${pruneReason} ${displayPath(root, abs)} (${entry.id})`);
         continue;
       }
-      await fs12.remove(abs);
-      await pruneEmptyDir(path12.dirname(abs));
+      await fs13.remove(abs);
+      await pruneEmptyDir(path13.dirname(abs));
       log(`Removed ${pruneReason} ${displayPath(root, abs)} (${entry.id})`);
     }
   }
 }
 
+// src/utils/args.ts
+function parseIdList(value) {
+  if (!value) return [];
+  const raw = Array.isArray(value) ? value : [value];
+  return raw.flatMap((v) => v.split(",")).map((v) => v.trim()).filter((v) => v.length > 0);
+}
+
 // src/commands/apply.ts
 async function cacheHasItems() {
-  const data = await readJson(path13.join(getCacheDir(), "manifest.json"));
+  const data = await readJson(path14.join(getCacheDir(), "manifest.json"));
   return Array.isArray(data?.items) && data.items.length > 0;
 }
 function installableRecommendedItems(recommended) {
@@ -2414,6 +2488,34 @@ async function runApply(options) {
   const root = process.cwd();
   const isDryRun = Boolean(options.dryRun) && !options.write;
   let selectedIds;
+  const explicitIds = parseIdList(options.ids);
+  if (explicitIds.length > 0) {
+    if (options.select) {
+      error("Use either --select (interactive) or --ids (explicit), not both");
+      process.exitCode = 1;
+      return;
+    }
+    const rec = await readJson(hausPath(root, "recommendation.json"));
+    const recommended = rec?.recommended ?? [];
+    const installableIds = new Set(installableRecommendedItems(recommended).map((i) => i.id));
+    const configIds = new Set(recommended.filter((i) => i.install === false).map((i) => i.id));
+    const skippedIds = new Set((rec?.skipped ?? []).map((s) => s.id));
+    for (const id of explicitIds.filter((id2) => !installableIds.has(id2))) {
+      if (configIds.has(id)) {
+        warn(`--ids: "${id}" is a config item \u2014 install it with \`haus scaffold ${id}\`. Ignoring.`);
+      } else if (skippedIds.has(id)) {
+        warn(
+          `--ids: "${id}" is not currently recommended (skipped) \u2014 add it with \`haus recommend --include ${id}\` first. Ignoring.`
+        );
+      } else {
+        warn(
+          `--ids: "${id}" is not in recommendation.json \u2014 run \`haus recommend\` (or \`--include ${id}\`) first. Ignoring.`
+        );
+      }
+    }
+    selectedIds = explicitIds.filter((id) => installableIds.has(id));
+    log(`Applying ${selectedIds.length} explicitly selected catalog item(s).`);
+  }
   if (options.select) {
     if (!process.stdin.isTTY) {
       error("--select requires an interactive terminal (stdin is not a TTY)");
@@ -2499,7 +2601,7 @@ async function runCatalogAudit() {
 
 // src/commands/clone.ts
 import { existsSync as existsSync2 } from "node:fs";
-import path14 from "node:path";
+import path15 from "node:path";
 
 // src/utils/exec.ts
 import { execa } from "execa";
@@ -2552,9 +2654,9 @@ async function runClone(url, opts = {}) {
     process.exitCode = 1;
     return;
   }
-  const target = path14.resolve(opts.dir?.trim() || repoNameFromUrl(url));
+  const target = path15.resolve(opts.dir?.trim() || repoNameFromUrl(url));
   if (existsSync2(target)) {
-    log(`\u2022 ${path14.basename(target)} already present at ${target} \u2014 skipped`);
+    log(`\u2022 ${path15.basename(target)} already present at ${target} \u2014 skipped`);
     return;
   }
   if (opts.dryRun) {
@@ -2571,11 +2673,11 @@ async function runClone(url, opts = {}) {
 }
 
 // src/commands/doctor.ts
-import path19 from "node:path";
-import fs14 from "fs-extra";
+import path20 from "node:path";
+import fs15 from "fs-extra";
 
 // src/scanner/scan-project.ts
-import path18 from "node:path";
+import path19 from "node:path";
 
 // src/utils/audit-checks.ts
 function isRecord(v) {
@@ -2602,8 +2704,8 @@ function compareVersions(a, b) {
 }
 
 // src/scanner/detect-package-manager.ts
-import path15 from "node:path";
-import fs13 from "fs-extra";
+import path16 from "node:path";
+import fs14 from "fs-extra";
 function detectPackageManager(root, packageManagerField) {
   const field = String(packageManagerField ?? "").trim();
   if (field.startsWith("yarn@")) {
@@ -2621,9 +2723,9 @@ function detectPackageManager(root, packageManagerField) {
     if (satisfiesVersion(version, ">=9")) return "npm";
     return "unknown";
   }
-  if (fs13.existsSync(path15.join(root, "yarn.lock"))) return "yarn";
-  if (fs13.existsSync(path15.join(root, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs13.existsSync(path15.join(root, "package-lock.json"))) return "npm";
+  if (fs14.existsSync(path16.join(root, "yarn.lock"))) return "yarn";
+  if (fs14.existsSync(path16.join(root, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs14.existsSync(path16.join(root, "package-lock.json"))) return "npm";
   return "unknown";
 }
 
@@ -2825,7 +2927,7 @@ function runDetection(ctx, rules = STACK_RULES) {
 }
 
 // src/scanner/detection.ts
-import path16 from "node:path";
+import path17 from "node:path";
 var UNSUPPORTED_MARKERS = {
   "requirements.txt": "python",
   "pyproject.toml": "python",
@@ -2879,14 +2981,14 @@ function finalizeRoles(registryRoles, deps, files) {
 function collectUnsupportedSignals(files) {
   return [
     ...new Set(
-      files.map((f) => UNSUPPORTED_MARKERS[path16.basename(f)]).filter((s) => Boolean(s))
+      files.map((f) => UNSUPPORTED_MARKERS[path17.basename(f)]).filter((s) => Boolean(s))
     )
   ].sort();
 }
 
 // src/scanner/render.ts
 import { readFile } from "node:fs/promises";
-import path17 from "node:path";
+import path18 from "node:path";
 async function buildContentBlob(root, files) {
   const candidates = files.filter(
     (f) => f.endsWith(".ts") || f.endsWith(".js") || f.endsWith(".php") || f.endsWith(".json") || f.endsWith(".yml") || f.endsWith(".yaml")
@@ -2894,7 +2996,7 @@ async function buildContentBlob(root, files) {
   const slice = candidates.slice(0, 300);
   const parts = await mapWithConcurrency(slice, async (rel) => {
     try {
-      return await readFile(path17.join(root, rel), "utf8");
+      return await readFile(path18.join(root, rel), "utf8");
     } catch {
       return "";
     }
@@ -2981,8 +3083,8 @@ var SAFE_FILES = [
   "Gemfile"
 ];
 async function scanProject(root) {
-  const pkg = await readJson(path18.join(root, "package.json"));
-  const composer = await readJson(path18.join(root, "composer.json"));
+  const pkg = await readJson(path19.join(root, "package.json"));
+  const composer = await readJson(path19.join(root, "composer.json"));
   const files = await listFiles(root, SAFE_FILES);
   const safeFiles = files.filter((f) => !blocked(f));
   const deps = dependencySet(pkg, composer);
@@ -3011,7 +3113,7 @@ async function scanProject(root) {
   const context = {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     root,
-    repoName: String(pkg?.name ?? path18.basename(root)),
+    repoName: String(pkg?.name ?? path19.basename(root)),
     packageManager,
     repoRoles: roles,
     detectedStacks: stacks,
@@ -3108,7 +3210,7 @@ async function runDoctor(options) {
   } else {
     ok(`- HOOKS OK: ${hooks.message}`);
   }
-  const rootClaudeMdPath = path19.join(root, "CLAUDE.md");
+  const rootClaudeMdPath = path20.join(root, "CLAUDE.md");
   const rootClaudeMdContent = await readText(rootClaudeMdPath);
   if (!rootClaudeMdContent) {
     flag(
@@ -3136,7 +3238,7 @@ async function runDoctor(options) {
       const block = rootClaudeMdContent.slice(beginIdx, endIdx + BLOCK_END.length);
       const importTargets = [...block.matchAll(/@\.haus-workflow\/(\S+)/g)].map((m) => m[1]);
       for (const target of importTargets) {
-        if (!await fs14.pathExists(hausPath(root, target))) {
+        if (!await fs15.pathExists(hausPath(root, target))) {
           flag(
             `- CLAUDE.md import: @.haus-workflow/${target} does not resolve (run \`haus apply --write\`)`,
             `A file CLAUDE.md links to (${target}) is missing, so part of the guidance won't load`,
@@ -3147,7 +3249,7 @@ async function runDoctor(options) {
     }
   }
   const workflowPath = hausPath(root, "WORKFLOW.md");
-  const workflowExists = await fs14.pathExists(workflowPath);
+  const workflowExists = await fs15.pathExists(workflowPath);
   if (!workflowExists) {
     flag(
       "- .haus-workflow/WORKFLOW.md: missing (run `haus apply --write`)",
@@ -3170,15 +3272,15 @@ async function runDoctor(options) {
           "haus apply --write --force"
         );
       } else {
-        const cachePath = path19.join(getCacheDir(), "templates/agentic-workflow-standard.md");
-        const bundledPath = path19.join(
+        const cachePath = path20.join(getCacheDir(), "templates/agentic-workflow-standard.md");
+        const bundledPath = path20.join(
           packageRoot(),
           "library",
           "global",
           "templates",
           "agentic-workflow-standard.md"
         );
-        const templatePath = await fs14.pathExists(cachePath) ? cachePath : bundledPath;
+        const templatePath = await fs15.pathExists(cachePath) ? cachePath : bundledPath;
         const templateContent = await readText(templatePath);
         if (storedHashMatch && templateContent) {
           const currentHash = hashText(normaliseLF(templateContent));
@@ -3198,7 +3300,7 @@ async function runDoctor(options) {
     }
   }
   const workflowConfigPath = hausPath(root, "workflow-config.md");
-  const workflowConfigExists = await fs14.pathExists(workflowConfigPath);
+  const workflowConfigExists = await fs15.pathExists(workflowConfigPath);
   if (!workflowConfigExists) {
     flag(
       "- .haus-workflow/workflow-config.md: missing (run `haus apply --write`)",
@@ -3206,7 +3308,7 @@ async function runDoctor(options) {
       "haus apply --write"
     );
   } else {
-    const cfg = await fs14.readFile(workflowConfigPath, "utf8");
+    const cfg = await fs15.readFile(workflowConfigPath, "utf8");
     const unfilled = cfg.split("\n").filter((l) => l.includes("<!-- fill in")).length;
     if (unfilled > 0) {
       flag(
@@ -3218,6 +3320,18 @@ async function runDoctor(options) {
       ok("- .haus-workflow/workflow-config.md: OK (project-owned)");
     }
   }
+  if (workflowExists) {
+    const prettierIgnore = await readText(path20.join(root, ".prettierignore")) ?? "";
+    if (!prettierIgnore.split("\n").some((l) => l.trim() === ".haus-workflow/")) {
+      flag(
+        "- .prettierignore: not protecting .haus-workflow/ (run `haus apply --write`)",
+        'The formatter may reformat managed files and trigger false "modified locally" reports',
+        "haus apply --write"
+      );
+    } else {
+      ok("- .prettierignore: protects .haus-workflow/");
+    }
+  }
   const cacheAgeMs = await getCacheManifestAge();
   if (cacheAgeMs === null) {
     flag(
@@ -3237,7 +3351,7 @@ async function runDoctor(options) {
       ok(`- CATALOG CACHE: OK (${cacheAgeDays}d old)`);
     }
   }
-  const pkgJson = await readJson(path19.join(packageRoot(), "package.json"));
+  const pkgJson = await readJson(path20.join(packageRoot(), "package.json"));
   const currentVersion = pkgJson?.version ?? "0.0.0";
   const npmStatus = await fetchNpmVersionStatus(currentVersion);
   if (npmStatus.updateAvailable && npmStatus.latest !== null) {
@@ -3459,8 +3573,8 @@ async function runGuard(kind, _options) {
 }
 
 // src/commands/init.ts
-import path20 from "node:path";
-import fs15 from "fs-extra";
+import path21 from "node:path";
+import fs16 from "fs-extra";
 
 // src/utils/prompts.ts
 import { stdin as input, stdout as output } from "node:process";
@@ -3546,7 +3660,7 @@ function mergeRecommendationWarnings(context) {
 }
 
 // src/recommender/recommend.ts
-async function recommend(root, context) {
+async function recommend(root, context, opts = {}) {
   const items = await loadCatalog(root);
   const sources = await readJson(
     hausPath(root, "sources-report.json")
@@ -3719,6 +3833,8 @@ async function recommend(root, context) {
     }
   }
   applyCoInstallSuppression(recommended, skipped);
+  const includeWarnings = applyManualIncludes(opts.include ?? [], items, recommended, skipped);
+  const optInEligible = buildOptInEligible(items, skipped);
   recommended.sort((a, b) => a.id.localeCompare(b.id));
   skipped.sort((a, b) => a.id.localeCompare(b.id));
   const installableRecommended = recommended.filter((item) => item.install);
@@ -3729,7 +3845,8 @@ async function recommend(root, context) {
   return {
     recommended,
     skipped,
-    warnings: mergeRecommendationWarnings(context),
+    optInEligible,
+    warnings: [...mergeRecommendationWarnings(context), ...includeWarnings],
     estimatedContextTokens,
     selectedRules,
     skippedRules,
@@ -3815,6 +3932,80 @@ function applyCoInstallSuppression(recommended, skipped) {
     });
   }
 }
+var HARD_SKIP_CODES = /* @__PURE__ */ new Set([
+  "unsupported-policy",
+  "deprecated",
+  "curated-not-approved",
+  "curated-risk-blocked",
+  "sensitive-policy",
+  "source-trust",
+  "source-approval"
+]);
+function applyManualIncludes(include, items, recommended, skipped) {
+  const warnings = [];
+  if (include.length === 0) return warnings;
+  const byId = new Map(items.map((i) => [i.id, i]));
+  const recommendedIds = new Set(recommended.map((r) => r.id));
+  for (const id of include) {
+    const item = byId.get(id);
+    if (!item) {
+      warnings.push(`--include: unknown catalog id "${id}" (not in manifest)`);
+      continue;
+    }
+    if (recommendedIds.has(id)) continue;
+    const skipIdx = skipped.findIndex((s) => s.id === id);
+    const skipCode = skipIdx >= 0 ? skipped[skipIdx].skipReasons[0]?.code : void 0;
+    if (skipCode && HARD_SKIP_CODES.has(skipCode)) {
+      warnings.push(`--include: "${id}" cannot be force-installed (blocked by ${skipCode})`);
+      continue;
+    }
+    if (skipCode === "requires-any-unsatisfied") {
+      warnings.push(`--include: "${id}" added manually though its requiresAny gate is unsatisfied`);
+    }
+    if (skipIdx >= 0) skipped.splice(skipIdx, 1);
+    const isConfig = item.type === "config";
+    recommended.push({
+      id: item.id,
+      type: item.type,
+      reason: "manually included",
+      reasons: [
+        {
+          code: "manual-include",
+          message: "manually included via --include",
+          signal: "selection:manual"
+        }
+      ],
+      selectionMode: "manual",
+      install: !isConfig,
+      tags: item.tags,
+      ecosystem: item.ecosystem,
+      tokenEstimate: item.tokenEstimate
+    });
+    recommendedIds.add(id);
+  }
+  return warnings;
+}
+function buildOptInEligible(items, skipped) {
+  const byId = new Map(items.map((i) => [i.id, i]));
+  const eligible = [];
+  for (const entry of skipped) {
+    if (entry.skipReasons[0]?.code !== "requires-any-unsatisfied") continue;
+    const item = byId.get(entry.id);
+    if (!item?.optInTier || !item.optInGroup) continue;
+    eligible.push({
+      id: item.id,
+      type: item.type,
+      title: item.title,
+      optInTier: item.optInTier,
+      optInGroup: item.optInGroup,
+      purpose: item.purpose,
+      tokenEstimate: item.tokenEstimate,
+      requires: entry.skipReasons[0]?.signal ?? describeRequiresAny(item.requiresAny ?? [])
+    });
+  }
+  eligible.sort((a, b) => a.optInGroup.localeCompare(b.optInGroup) || a.id.localeCompare(b.id));
+  return eligible;
+}
 
 // src/commands/setup-core.ts
 async function runSetupCore(root, opts) {
@@ -3907,8 +4098,8 @@ async function runSetupProject(options) {
 // src/commands/init.ts
 async function runInit(options) {
   const root = process.cwd();
-  const hausDir = path20.join(root, ".haus-workflow");
-  const alreadyInit = await fs15.pathExists(hausDir);
+  const hausDir = path21.join(root, ".haus-workflow");
+  const alreadyInit = await fs16.pathExists(hausDir);
   if (alreadyInit) {
     log("Haus AI already initialized in this project.");
     log("Run `haus setup-project` to reconfigure.");
@@ -3920,8 +4111,8 @@ async function runInit(options) {
 
 // src/install/apply.ts
 import crypto2 from "node:crypto";
-import path21 from "node:path";
-import fs16 from "fs-extra";
+import path22 from "node:path";
+import fs17 from "fs-extra";
 
 // src/install/header.ts
 var MD_PREFIX = "<!-- HAUS-MANAGED";
@@ -4007,40 +4198,40 @@ function hashContent(content2) {
 }
 function sourceVersion() {
   try {
-    const pkgPath = path21.join(packageRoot(), "package.json");
-    const pkg = JSON.parse(fs16.readFileSync(pkgPath, "utf8"));
+    const pkgPath = path22.join(packageRoot(), "package.json");
+    const pkg = JSON.parse(fs17.readFileSync(pkgPath, "utf8"));
     return `${pkg.name ?? "haus"}@${pkg.version ?? "0.0.0"}`;
   } catch {
     return "haus@0.0.0";
   }
 }
 function globalSrcDir() {
-  return path21.join(packageRoot(), "library", "global");
+  return path22.join(packageRoot(), "library", "global");
 }
 function collectSourceFiles(srcDir, claudeDir) {
   const entries = [];
-  const skillsDir = path21.join(srcDir, "skills");
-  if (fs16.pathExistsSync(skillsDir)) {
-    for (const skillName of fs16.readdirSync(skillsDir)) {
-      const skillFile = path21.join(skillsDir, skillName, "SKILL.md");
-      if (fs16.pathExistsSync(skillFile)) {
+  const skillsDir = path22.join(srcDir, "skills");
+  if (fs17.pathExistsSync(skillsDir)) {
+    for (const skillName of fs17.readdirSync(skillsDir)) {
+      const skillFile = path22.join(skillsDir, skillName, "SKILL.md");
+      if (fs17.pathExistsSync(skillFile)) {
         entries.push({
           stableId: `skill.${skillName}`,
-          srcRelPath: path21.join("library", "global", "skills", skillName, "SKILL.md"),
-          destPath: path21.join(claudeDir, "skills", skillName, "SKILL.md")
+          srcRelPath: path22.join("library", "global", "skills", skillName, "SKILL.md"),
+          destPath: path22.join(claudeDir, "skills", skillName, "SKILL.md")
         });
       }
     }
   }
-  const commandsDir = path21.join(srcDir, "commands");
-  if (fs16.pathExistsSync(commandsDir)) {
-    for (const fileName of fs16.readdirSync(commandsDir)) {
+  const commandsDir = path22.join(srcDir, "commands");
+  if (fs17.pathExistsSync(commandsDir)) {
+    for (const fileName of fs17.readdirSync(commandsDir)) {
       if (!fileName.endsWith(".md")) continue;
       const commandName = fileName.slice(0, -".md".length);
       entries.push({
         stableId: `command.${commandName}`,
-        srcRelPath: path21.join("library", "global", "commands", fileName),
-        destPath: path21.join(claudeDir, "commands", fileName)
+        srcRelPath: path22.join("library", "global", "commands", fileName),
+        destPath: path22.join(claudeDir, "commands", fileName)
       });
     }
   }
@@ -4064,7 +4255,7 @@ async function applyInstall(options = {}) {
   };
   const manifestFiles = [];
   for (const entry of sourceFiles) {
-    const srcPath = path21.join(packageRoot(), entry.srcRelPath);
+    const srcPath = path22.join(packageRoot(), entry.srcRelPath);
     const rawContent = await readText(srcPath);
     if (rawContent === void 0) {
       warn(`Source file not found: ${entry.srcRelPath}`);
@@ -4084,7 +4275,7 @@ async function applyInstall(options = {}) {
       }
       continue;
     }
-    const destExists = fs16.pathExistsSync(entry.destPath);
+    const destExists = fs17.pathExistsSync(entry.destPath);
     if (destExists) {
       const currentContent = await readText(entry.destPath);
       if (currentContent !== void 0) {
@@ -4120,7 +4311,7 @@ async function applyInstall(options = {}) {
       schemaVersion: SCHEMA_VERSION2
     });
   }
-  const fragmentPath = path21.join(srcDir, "settings-fragments", "hooks.json");
+  const fragmentPath = path22.join(srcDir, "settings-fragments", "hooks.json");
   const fragments = await loadHooksFragment(fragmentPath);
   const settings = await readSettings();
   const { settings: hookSettings, addedIds } = mergeHooks(settings, fragments);
@@ -4132,13 +4323,13 @@ async function applyInstall(options = {}) {
     const currentDestPaths = new Set(sourceFiles.map((f) => f.destPath));
     for (const entry of existingManifest.files) {
       if (currentDestPaths.has(entry.destPath)) continue;
-      if (!fs16.pathExistsSync(entry.destPath)) continue;
+      if (!fs17.pathExistsSync(entry.destPath)) continue;
       const content2 = await readText(entry.destPath);
       if (!content2) continue;
       const hasHeader = parseMarkdownHeader(content2) !== void 0;
       const currentHash = hashContent(content2);
       if (hasHeader && currentHash === entry.hash) {
-        if (!dryRun) await fs16.remove(entry.destPath);
+        if (!dryRun) await fs17.remove(entry.destPath);
         result.deleted.push(entry.destPath);
       } else {
         warn(`Orphaned file ${entry.destPath} was user-modified \u2014 leaving in place`);
@@ -4275,7 +4466,8 @@ async function runInstall(options) {
 async function runRecommend(options) {
   const root = process.cwd();
   const context = await readContextOrScan(root);
-  const result = await recommend(root, context);
+  const include = parseIdList(options.include);
+  const result = await recommend(root, context, { include });
   await writeJson(hausPath(root, "recommendation.json"), result);
   if (options.json) {
     log(JSON.stringify(result, null, 2));
@@ -4284,6 +4476,12 @@ async function runRecommend(options) {
   log("Haus recommendation ready");
   log(`Recommended: ${result.recommended.length}`);
   log(`Skipped: ${result.skipped.length}`);
+  if (result.optInEligible && result.optInEligible.length > 0) {
+    log(
+      `Opt-in available: ${result.optInEligible.length} (add with \`haus recommend --include <id>\`)`
+    );
+  }
+  for (const w of result.warnings.filter((w2) => w2.startsWith("--include:"))) log(w);
 }
 
 // src/commands/refresh.ts
@@ -4299,8 +4497,8 @@ async function runRefresh() {
 }
 
 // src/install/scaffold.ts
-import path22 from "node:path";
-import fs17 from "fs-extra";
+import path23 from "node:path";
+import fs18 from "fs-extra";
 async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
   const scaffolded = [];
   const skipped = [];
@@ -4313,27 +4511,27 @@ async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
     skipped.push(name);
     if (outcome === "skipped-exists") skippedExisting.push(name);
   };
-  const realRoot = await fs17.realpath(catalogRoot).catch(() => null);
+  const realRoot = await fs18.realpath(catalogRoot).catch(() => null);
   for (const item of items) {
     if (item.type !== "config") continue;
-    const sourcePath = path22.resolve(catalogRoot, item.path);
-    const rel = path22.relative(catalogRoot, sourcePath);
-    const escapes = rel === "" || path22.isAbsolute(rel) || rel.split(/[/\\]/).some((seg) => seg === "..");
+    const sourcePath = path23.resolve(catalogRoot, item.path);
+    const rel = path23.relative(catalogRoot, sourcePath);
+    const escapes = rel === "" || path23.isAbsolute(rel) || rel.split(/[/\\]/).some((seg) => seg === "..");
     if (escapes) {
       warn(`Skipping ${item.id}: path '${item.path}' escapes the catalog root`);
       continue;
     }
-    const realSource = await fs17.realpath(sourcePath).catch(() => null);
+    const realSource = await fs18.realpath(sourcePath).catch(() => null);
     if (!realRoot || !realSource) {
       warn(`Skipping ${item.id}: source not found at ${sourcePath}`);
       continue;
     }
-    const realRel = path22.relative(realRoot, realSource);
-    if (realRel !== "" && (path22.isAbsolute(realRel) || realRel.split(/[/\\]/)[0] === "..")) {
+    const realRel = path23.relative(realRoot, realSource);
+    if (realRel !== "" && (path23.isAbsolute(realRel) || realRel.split(/[/\\]/)[0] === "..")) {
       warn(`Skipping ${item.id}: path '${item.path}' resolves outside the catalog root`);
       continue;
     }
-    const stat = await fs17.lstat(sourcePath).catch(() => null);
+    const stat = await fs18.lstat(sourcePath).catch(() => null);
     if (!stat) {
       warn(`Skipping ${item.id}: source not found at ${sourcePath}`);
       continue;
@@ -4343,56 +4541,57 @@ async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
       continue;
     }
     if (stat.isFile()) {
-      const filename = path22.basename(sourcePath);
-      const dest = path22.join(projectRoot, filename);
-      record(filename, await scaffoldFile(sourcePath, dest, item.id, opts));
+      const filename = path23.basename(sourcePath);
+      const dest = path23.join(projectRoot, filename);
+      record(filename, await scaffoldFile(sourcePath, dest, item.id, projectRoot, opts));
     } else if (stat.isDirectory()) {
-      const entries = await fs17.readdir(sourcePath);
+      const entries = await fs18.readdir(sourcePath);
       for (const entry of entries) {
-        const src = path22.join(sourcePath, entry);
-        const dest = path22.join(projectRoot, entry);
-        record(entry, await scaffoldFile(src, dest, item.id, opts));
+        const src = path23.join(sourcePath, entry);
+        const dest = path23.join(projectRoot, entry);
+        record(entry, await scaffoldFile(src, dest, item.id, projectRoot, opts));
       }
     }
   }
   return { scaffolded, skipped, skippedExisting };
 }
-async function scaffoldFile(src, dest, itemId, opts) {
-  const srcStat = await fs17.lstat(src).catch(() => null);
+async function scaffoldFile(src, dest, itemId, projectRoot, opts) {
+  const destDisplay = path23.relative(projectRoot, dest) || path23.basename(dest);
+  const srcStat = await fs18.lstat(src).catch(() => null);
   if (!srcStat) {
-    warn(`Skipping ${path22.basename(src)}: source not found`);
+    warn(`Skipping ${path23.basename(src)}: source not found`);
     return "skipped-refused";
   }
   if (srcStat.isSymbolicLink()) {
-    warn(`Skipping ${path22.basename(src)}: source is a symlink`);
+    warn(`Skipping ${path23.basename(src)}: source is a symlink`);
     return "skipped-refused";
   }
-  const exists = await fs17.pathExists(dest);
+  const exists = await fs18.pathExists(dest);
   if (exists && !opts.force) {
-    warn(`Skipping ${path22.basename(dest)}: already exists (use --force to overwrite)`);
+    warn(`Skipping ${destDisplay}: already exists \u2014 re-run with --force to overwrite it`);
     return "skipped-exists";
   }
   if (opts.dryRun) {
-    log(`[dry-run] would ${exists ? "overwrite" : "create"} ${path22.basename(dest)} (${itemId})`);
+    log(`[dry-run] would ${exists ? "overwrite" : "create"} ${path23.basename(dest)} (${itemId})`);
     return "scaffolded";
   }
   if (exists && opts.force) {
-    await fs17.remove(dest);
+    await fs18.remove(dest);
   }
-  await fs17.ensureDir(path22.dirname(dest));
-  await fs17.copy(src, dest, {
+  await fs18.ensureDir(path23.dirname(dest));
+  await fs18.copy(src, dest, {
     overwrite: true,
     dereference: false,
     // A vanished/unreadable entry mid-walk must skip that path, not crash the copy.
     filter: (s) => {
       try {
-        return !fs17.lstatSync(s).isSymbolicLink();
+        return !fs18.lstatSync(s).isSymbolicLink();
       } catch {
         return false;
       }
     }
   });
-  log(`${exists ? "Overwrote" : "Created"} ${path22.basename(dest)} (${itemId})`);
+  log(`${exists ? "Overwrote" : "Created"} ${path23.basename(dest)} (${itemId})`);
   return "scaffolded";
 }
 
@@ -4449,8 +4648,8 @@ async function runScan(options) {
 }
 
 // src/commands/undo.ts
-import path23 from "node:path";
-import fs18 from "fs-extra";
+import path24 from "node:path";
+import fs19 from "fs-extra";
 
 // src/claude/managed-paths.ts
 var PROJECT_MANAGED_CLAUDE_REL = ["rules/haus.md", "commands/haus-doctor.md"];
@@ -4467,74 +4666,74 @@ async function collectManagedPaths(root) {
   const lock = await readJson(hausPath(root, "haus.lock.json"));
   for (const row of lock ?? []) {
     for (const rel of row.paths ?? []) {
-      paths.add(path23.resolve(root, rel));
+      paths.add(path24.resolve(root, rel));
     }
   }
   const existing = [];
   for (const abs of paths) {
-    if (await fs18.pathExists(abs)) existing.push(abs);
+    if (await fs19.pathExists(abs)) existing.push(abs);
   }
   return existing;
 }
 async function settingsHasHausContent(root) {
   const settingsPath = claudePath(root, "settings.json");
-  if (!await fs18.pathExists(settingsPath)) return false;
+  if (!await fs19.pathExists(settingsPath)) return false;
   const settings = await readProjectSettings(root);
   return settings._haus != null;
 }
 async function claudeMdHasHausBlock(root) {
-  const filePath = path23.join(root, "CLAUDE.md");
-  if (!await fs18.pathExists(filePath)) return false;
-  const text = await fs18.readFile(filePath, "utf8");
+  const filePath = path24.join(root, "CLAUDE.md");
+  if (!await fs19.pathExists(filePath)) return false;
+  const text = await fs19.readFile(filePath, "utf8");
   return text.includes(BLOCK_BEGIN);
 }
 async function stripProjectSettings(root) {
   const settingsPath = claudePath(root, "settings.json");
-  if (!await fs18.pathExists(settingsPath)) return false;
+  if (!await fs19.pathExists(settingsPath)) return false;
   let settings = await readProjectSettings(root);
   settings = stripHausHooks(stripHausAsk(stripHausAllow(stripHausDeny(settings))));
   const hasContent = Object.keys(settings).length > 0;
   if (hasContent) {
     await writeProjectSettings(root, settings);
-    log(`Stripped haus rules from ${path23.relative(root, settingsPath)} (user settings preserved).`);
+    log(`Stripped haus rules from ${path24.relative(root, settingsPath)} (user settings preserved).`);
     return true;
   }
-  await fs18.remove(settingsPath);
-  log(`Removed ${path23.relative(root, settingsPath)} (no user-owned settings remained).`);
+  await fs19.remove(settingsPath);
+  log(`Removed ${path24.relative(root, settingsPath)} (no user-owned settings remained).`);
   return true;
 }
 async function stripRootClaudeMd(root) {
-  const filePath = path23.join(root, "CLAUDE.md");
-  if (!await fs18.pathExists(filePath)) return false;
-  const prev = await fs18.readFile(filePath, "utf8");
+  const filePath = path24.join(root, "CLAUDE.md");
+  if (!await fs19.pathExists(filePath)) return false;
+  const prev = await fs19.readFile(filePath, "utf8");
   if (!prev.includes(BLOCK_BEGIN)) return false;
   const next = stripHausBlock(prev);
   if (next.length === 0) {
-    await fs18.remove(filePath);
+    await fs19.remove(filePath);
     log("Removed CLAUDE.md (only contained haus import block).");
   } else {
-    await fs18.writeFile(filePath, next, "utf8");
+    await fs19.writeFile(filePath, next, "utf8");
     log("Removed haus import block from CLAUDE.md (user content preserved).");
   }
   return true;
 }
 async function pruneDirIfEmpty(dir) {
-  if (!await fs18.pathExists(dir)) return;
-  const entries = await fs18.readdir(dir);
-  if (entries.length === 0) await fs18.remove(dir);
+  if (!await fs19.pathExists(dir)) return;
+  const entries = await fs19.readdir(dir);
+  if (entries.length === 0) await fs19.remove(dir);
 }
 async function backupManagedFilesBeforeUndo(root, managedAbsPaths) {
   if (managedAbsPaths.length === 0) return;
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const backupRoot = hausPath(root, "backups", `undo-${stamp}`);
   for (const abs of managedAbsPaths) {
-    if (!await fs18.pathExists(abs)) continue;
-    const rel = path23.relative(root, abs);
-    const backupPath = path23.join(backupRoot, rel);
-    await fs18.ensureDir(path23.dirname(backupPath));
-    await fs18.copy(abs, backupPath);
+    if (!await fs19.pathExists(abs)) continue;
+    const rel = path24.relative(root, abs);
+    const backupPath = path24.join(backupRoot, rel);
+    await fs19.ensureDir(path24.dirname(backupPath));
+    await fs19.copy(abs, backupPath);
   }
-  log(`Backed up ${managedAbsPaths.length} managed file(s) to ${path23.relative(root, backupRoot)}.`);
+  log(`Backed up ${managedAbsPaths.length} managed file(s) to ${path24.relative(root, backupRoot)}.`);
 }
 async function runUndo(options) {
   const root = process.cwd();
@@ -4545,7 +4744,7 @@ async function runUndo(options) {
     log("Nothing to remove: no haus-managed files found in this directory.");
     return;
   }
-  const relTargets = managed.map((p) => path23.relative(root, p));
+  const relTargets = managed.map((p) => path24.relative(root, p));
   const summaryParts = [...relTargets];
   if (stripSettings) summaryParts.push(".claude/settings.json (haus rules only)");
   if (stripClaudeMd) summaryParts.push("CLAUDE.md (haus import block only)");
@@ -4562,9 +4761,9 @@ User-owned .claude/ files will be preserved.`
   }
   await backupManagedFilesBeforeUndo(root, managed);
   for (const abs of managed) {
-    if (!await fs18.pathExists(abs)) continue;
-    await fs18.remove(abs);
-    log(`Removed ${path23.relative(root, abs)}`);
+    if (!await fs19.pathExists(abs)) continue;
+    await fs19.remove(abs);
+    log(`Removed ${path24.relative(root, abs)}`);
   }
   if (stripSettings) await stripProjectSettings(root);
   if (stripClaudeMd) await stripRootClaudeMd(root);
@@ -4575,8 +4774,8 @@ User-owned .claude/ files will be preserved.`
 
 // src/install/uninstall.ts
 import crypto3 from "node:crypto";
-import path24 from "node:path";
-import fs19 from "fs-extra";
+import path25 from "node:path";
+import fs20 from "fs-extra";
 async function runUninstall(options = {}) {
   const { force = false } = options;
   const manifest = await readManifest();
@@ -4586,7 +4785,7 @@ async function runUninstall(options = {}) {
     return result;
   }
   for (const entry of manifest.files) {
-    const exists = fs19.pathExistsSync(entry.destPath);
+    const exists = fs20.pathExistsSync(entry.destPath);
     if (!exists) continue;
     const content2 = await readText(entry.destPath);
     if (content2 === void 0) continue;
@@ -4604,22 +4803,22 @@ async function runUninstall(options = {}) {
       result.skipped.push(entry.destPath);
       continue;
     }
-    await fs19.remove(entry.destPath);
-    await pruneEmptyDir(path24.dirname(entry.destPath));
+    await fs20.remove(entry.destPath);
+    await pruneEmptyDir(path25.dirname(entry.destPath));
     result.deleted.push(entry.destPath);
   }
   const settings = await readSettings();
   const stripped = stripHausHooks(stripHausAsk(stripHausAllow(stripHausDeny(settings))));
   await writeSettings(stripped);
   result.hooksStripped = true;
-  const hausDir = path24.join(globalClaudeDir(), "haus");
+  const hausDir = path25.join(globalClaudeDir(), "haus");
   const manifestPath2 = hausManifestPath();
-  if (fs19.pathExistsSync(manifestPath2)) {
-    await fs19.remove(manifestPath2);
+  if (fs20.pathExistsSync(manifestPath2)) {
+    await fs20.remove(manifestPath2);
   }
-  if (fs19.pathExistsSync(hausDir)) {
-    const remaining = await fs19.readdir(hausDir);
-    if (remaining.length === 0) await fs19.remove(hausDir);
+  if (fs20.pathExistsSync(hausDir)) {
+    const remaining = await fs20.readdir(hausDir);
+    if (remaining.length === 0) await fs20.remove(hausDir);
   }
   return result;
 }
@@ -4650,12 +4849,12 @@ async function runUninstallCommand(options) {
 }
 
 // src/commands/update.ts
-import path26 from "node:path";
+import path27 from "node:path";
 
 // src/claude/refresh-project.ts
-import fs20 from "fs-extra";
+import fs21 from "fs-extra";
 async function isHausProject(root) {
-  if (await fs20.pathExists(hausPath(root, "recommendation.json"))) return true;
+  if (await fs21.pathExists(hausPath(root, "recommendation.json"))) return true;
   const result = await readJsonDetailed(claudePath(root, "settings.json"));
   if (result.status === "ok") return result.value._haus != null;
   return false;
@@ -4690,7 +4889,7 @@ function summarizeLockDiff(before, after) {
 
 // src/update/lockfile.ts
 import { mkdir, readFile as readFile2, copyFile } from "node:fs/promises";
-import path25 from "node:path";
+import path26 from "node:path";
 async function checkLock(root) {
   const lock = await readJson(hausPath(root, "haus.lock.json")) ?? [];
   const hasValidVersions = lock.every(
@@ -4721,7 +4920,7 @@ async function applyLock(root) {
   try {
     const backupDir = hausPath(root, "backups");
     await mkdir(backupDir, { recursive: true });
-    await copyFile(lockPath, path25.join(backupDir, `haus.lock.${Date.now()}.json`));
+    await copyFile(lockPath, path26.join(backupDir, `haus.lock.${Date.now()}.json`));
   } catch {
   }
   const enriched = await Promise.all(
@@ -4743,7 +4942,7 @@ function diffLock(before, after) {
 }
 async function hasLocalOverrides(root) {
   try {
-    await readFile2(path25.join(root, ".claude", "settings.json"), "utf8");
+    await readFile2(path26.join(root, ".claude", "settings.json"), "utf8");
     return true;
   } catch {
     return false;
@@ -4755,7 +4954,7 @@ var NPM_PACKAGE_NAME2 = "@haus-tech/haus-workflow";
 async function runUpdate(options) {
   const root = process.cwd();
   if (options.check) {
-    const pkgJson2 = await readJson(path26.join(packageRoot(), "package.json"));
+    const pkgJson2 = await readJson(path27.join(packageRoot(), "package.json"));
     const currentVersion2 = pkgJson2?.version ?? "0.0.0";
     const [status, npmVersion, latestCatalogTag, globalInstallDrift] = await Promise.all([
       checkLock(root),
@@ -4785,7 +4984,7 @@ async function runUpdate(options) {
     if (status.driftCount > 0) process.exitCode = 1;
     return;
   }
-  const pkgJson = await readJson(path26.join(packageRoot(), "package.json"));
+  const pkgJson = await readJson(path27.join(packageRoot(), "package.json"));
   const currentVersion = pkgJson?.version ?? "0.0.0";
   const npmStatus = await fetchNpmVersionStatus(currentVersion);
   if (npmStatus.updateAvailable && npmStatus.latest !== null) {
@@ -4862,16 +5061,16 @@ async function detectGlobalInstallDrift() {
 }
 
 // src/commands/validate-catalog.ts
-import path28 from "node:path";
+import path29 from "node:path";
 
 // src/catalog/validate-core.ts
-import fs21 from "node:fs";
-import path27 from "node:path";
+import fs22 from "node:fs";
+import path28 from "node:path";
 var ITEM_SEMVER_RE = /^\d+\.\d+\.\d+$/;
 var MANIFEST_SEMVER_RE = /^\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?$/;
 function isSafeCatalogPath2(itemPath) {
-  if (!itemPath || path27.isAbsolute(itemPath) || itemPath.includes("\\")) return false;
-  const normalized = path27.normalize(itemPath);
+  if (!itemPath || path28.isAbsolute(itemPath) || itemPath.includes("\\")) return false;
+  const normalized = path28.normalize(itemPath);
   return !normalized.startsWith("..") && !normalized.includes("/..");
 }
 function auditForbiddenStacks(items) {
@@ -4885,6 +5084,39 @@ function auditForbiddenStacks(items) {
   }
   return failures;
 }
+var OPT_IN_TIERS = /* @__PURE__ */ new Set(["workflow", "ops", "review", "design"]);
+function auditOptInMetadata(items) {
+  const failures = [];
+  for (const item of items) {
+    const hasTier = item.optInTier !== void 0;
+    const hasGroup = item.optInGroup !== void 0;
+    if (hasTier !== hasGroup) {
+      failures.push(`${item.id}: optInTier and optInGroup must be set together`);
+    }
+    if (hasTier) {
+      if (!OPT_IN_TIERS.has(item.optInTier)) {
+        failures.push(
+          `${item.id}: invalid optInTier "${item.optInTier}" (expected one of ${[...OPT_IN_TIERS].join(", ")})`
+        );
+      }
+      if (typeof item.optInGroup !== "string" || item.optInGroup.length === 0) {
+        failures.push(`${item.id}: optInGroup must be a non-empty string`);
+      }
+      if (item.default === true) {
+        failures.push(`${item.id}: opt-in items (optInTier set) must not be default:true`);
+      }
+      if (typeof item.purpose !== "string" || item.purpose.length === 0) {
+        failures.push(`${item.id}: opt-in items (optInTier set) must have a non-empty purpose`);
+      }
+    }
+    const requiresAny = Array.isArray(item.requiresAny) ? item.requiresAny : [];
+    const roleOnly = requiresAny.length > 0 && requiresAny.every((clause) => clause && clause.role);
+    if (item.default !== true && roleOnly && !hasTier) {
+      failures.push(`${item.id}: role-gated opt-in item missing optInTier/optInGroup`);
+    }
+  }
+  return failures;
+}
 function auditManifestStructure(manifestVersion, items) {
   const failures = [];
   const seenIds = /* @__PURE__ */ new Map();
@@ -4950,8 +5182,8 @@ function checkRequiredFrontmatter(text, label) {
   return failures;
 }
 function auditTemplateContent(manifestDir, absPath, itemId) {
-  const rel = path27.relative(manifestDir, absPath);
-  const text = fs21.readFileSync(absPath, "utf8");
+  const rel = path28.relative(manifestDir, absPath);
+  const text = fs22.readFileSync(absPath, "utf8");
   const failures = [];
   const lines = text.split(/\r?\n/);
   for (let i = 0; i < lines.length; i++) {
@@ -4971,44 +5203,44 @@ function auditShippedFiles(manifestDir, items) {
   const failures = [];
   for (const item of items) {
     if (!item.path || !isSafeCatalogPath2(item.path)) continue;
-    const absPath = path27.join(manifestDir, item.path);
+    const absPath = path28.join(manifestDir, item.path);
     if (item.type === "skill") {
-      const skillMd = path27.join(absPath, "SKILL.md");
-      if (!fs21.existsSync(skillMd)) {
-        failures.push(`${item.id}: missing ${path27.relative(manifestDir, skillMd)}`);
+      const skillMd = path28.join(absPath, "SKILL.md");
+      if (!fs22.existsSync(skillMd)) {
+        failures.push(`${item.id}: missing ${path28.relative(manifestDir, skillMd)}`);
         continue;
       }
-      const text = fs21.readFileSync(skillMd, "utf8");
+      const text = fs22.readFileSync(skillMd, "utf8");
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: SKILL.md`));
       failures.push(
-        ...auditForbiddenTagsInText(text, `${item.id}: ${path27.relative(manifestDir, skillMd)}`)
+        ...auditForbiddenTagsInText(text, `${item.id}: ${path28.relative(manifestDir, skillMd)}`)
       );
     } else if (item.type === "agent") {
-      if (!fs21.existsSync(absPath)) {
+      if (!fs22.existsSync(absPath)) {
         failures.push(`${item.id}: missing agent file ${item.path}`);
         continue;
       }
-      const text = fs21.readFileSync(absPath, "utf8");
-      const rel = path27.relative(manifestDir, absPath);
+      const text = fs22.readFileSync(absPath, "utf8");
+      const rel = path28.relative(manifestDir, absPath);
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: ${rel}`));
       failures.push(...auditForbiddenTagsInText(text, `${item.id}: ${rel}`));
     } else if (item.type === "template") {
-      if (!fs21.existsSync(absPath)) {
+      if (!fs22.existsSync(absPath)) {
         failures.push(`${item.id}: missing template file ${item.path}`);
         continue;
       }
       failures.push(...auditTemplateContent(manifestDir, absPath, item.id));
     } else if (item.type === "command") {
-      if (!fs21.existsSync(absPath)) {
+      if (!fs22.existsSync(absPath)) {
         failures.push(`${item.id}: missing command file ${item.path}`);
         continue;
       }
-      const text = fs21.readFileSync(absPath, "utf8");
-      const rel = path27.relative(manifestDir, absPath);
+      const text = fs22.readFileSync(absPath, "utf8");
+      const rel = path28.relative(manifestDir, absPath);
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: ${rel}`));
       failures.push(...auditTemplateContent(manifestDir, absPath, item.id));
     } else if (item.type === "config") {
-      if (!fs21.existsSync(absPath)) {
+      if (!fs22.existsSync(absPath)) {
         failures.push(`${item.id}: missing config path ${item.path}`);
       }
     }
@@ -5022,8 +5254,8 @@ var DIR_ITEM_TYPE = {
   commands: "command"
 };
 function walkMd(dir, fn) {
-  for (const entry of fs21.readdirSync(dir, { withFileTypes: true })) {
-    const full = path27.join(dir, entry.name);
+  for (const entry of fs22.readdirSync(dir, { withFileTypes: true })) {
+    const full = path28.join(dir, entry.name);
     if (entry.isDirectory()) walkMd(full, fn);
     else if (entry.name.endsWith(".md")) fn(full);
   }
@@ -5032,12 +5264,12 @@ function auditMarkdownContent(manifestDir, items) {
   const failures = [];
   const pathSourceMap = buildItemPathSourceMap(items);
   for (const dir of ["skills", "agents", "templates", "commands"]) {
-    const abs = path27.join(manifestDir, dir);
-    if (!fs21.existsSync(abs)) continue;
+    const abs = path28.join(manifestDir, dir);
+    if (!fs22.existsSync(abs)) continue;
     const dirType = DIR_ITEM_TYPE[dir] ?? "";
     walkMd(abs, (file) => {
-      const text = fs21.readFileSync(file, "utf8");
-      const rel = path27.relative(manifestDir, file);
+      const text = fs22.readFileSync(file, "utf8");
+      const rel = path28.relative(manifestDir, file);
       const norm = rel.replace(/\\/g, "/");
       const source = resolveMarkdownItemSource(norm, pathSourceMap);
       const checkNonTsxNpx = !isNpxTsxOnlyExempt(dirType, source);
@@ -5058,6 +5290,7 @@ function auditMarkdownContent(manifestDir, items) {
 function validateCatalogData(manifestDir, manifestVersion, items) {
   const failures = [
     ...auditManifestStructure(manifestVersion, items),
+    ...auditOptInMetadata(items),
     ...auditForbiddenStacks(items),
     ...auditShippedFiles(manifestDir, items),
     ...auditMarkdownContent(manifestDir, items),
@@ -5073,8 +5306,8 @@ async function runValidateCatalog(manifestPath2) {
     process.exitCode = 1;
     return;
   }
-  const abs = path28.resolve(process.cwd(), manifestPath2);
-  const manifestDir = path28.dirname(abs);
+  const abs = path29.resolve(process.cwd(), manifestPath2);
+  const manifestDir = path29.dirname(abs);
   const data = await readJson(abs);
   if (!data?.items) {
     error(`Could not read catalog manifest at ${abs}`);
@@ -5092,7 +5325,7 @@ async function runValidateCatalog(manifestPath2) {
 
 // src/commands/workspace.ts
 import { existsSync as existsSync5, statSync as statSync2 } from "node:fs";
-import path35 from "node:path";
+import path36 from "node:path";
 
 // src/commands/workspace/aggregate.ts
 async function writeWorkspaceArtifacts(workspaceRoot, repos, relationships = []) {
@@ -5146,7 +5379,7 @@ ${summaries.map(
 }
 
 // src/commands/workspace/config.ts
-import path29 from "node:path";
+import path30 from "node:path";
 import YAML from "yaml";
 var WORKSPACE_FILE = "haus.workspace.yaml";
 function parseWorkspaceConfig(text) {
@@ -5169,11 +5402,11 @@ function parseWorkspaceConfig(text) {
   };
 }
 async function readWorkspaceConfig(workspaceRoot) {
-  return parseWorkspaceConfig(await readText(path29.join(workspaceRoot, WORKSPACE_FILE)));
+  return parseWorkspaceConfig(await readText(path30.join(workspaceRoot, WORKSPACE_FILE)));
 }
 
 // src/commands/workspace/discover.ts
-import path30 from "node:path";
+import path31 from "node:path";
 import fg4 from "fast-glob";
 import YAML2 from "yaml";
 var DEFAULT_MAX_DEPTH = 3;
@@ -5201,8 +5434,8 @@ async function discoverRepos(workspaceRoot, maxDepth = DEFAULT_MAX_DEPTH) {
   const gitDirs = /* @__PURE__ */ new Set();
   const manifestDirs = /* @__PURE__ */ new Set();
   for (const match of matches) {
-    const base = path30.posix.basename(match);
-    const dir = path30.posix.dirname(match);
+    const base = path31.posix.basename(match);
+    const dir = path31.posix.dirname(match);
     const owner = dir === "." ? "." : dir;
     if (base === ".git") gitDirs.add(owner);
     else manifestDirs.add(owner);
@@ -5218,9 +5451,9 @@ async function discoverRepos(workspaceRoot, maxDepth = DEFAULT_MAX_DEPTH) {
   }
   repoRoots.sort((a, b) => a.localeCompare(b));
   return mapWithConcurrency(repoRoots, async (relDir) => {
-    const absDir = path30.resolve(workspaceRoot, relDir);
-    const pkg = await readJson(path30.join(absDir, "package.json"));
-    const name = typeof pkg?.name === "string" && pkg.name.length > 0 ? pkg.name : path30.basename(relDir === "." ? workspaceRoot : absDir);
+    const absDir = path31.resolve(workspaceRoot, relDir);
+    const pkg = await readJson(path31.join(absDir, "package.json"));
+    const name = typeof pkg?.name === "string" && pkg.name.length > 0 ? pkg.name : path31.basename(relDir === "." ? workspaceRoot : absDir);
     let role = "auto";
     try {
       const scan = await scanProject(absDir);
@@ -5263,7 +5496,7 @@ function renderWorkspaceYaml(config) {
   });
 }
 async function runDiscover(workspaceRoot, opts = {}) {
-  const yamlPath = path30.join(workspaceRoot, "haus.workspace.yaml");
+  const yamlPath = path31.join(workspaceRoot, "haus.workspace.yaml");
   const existingText = await readText(yamlPath);
   const existing = parseWorkspaceConfig(existingText);
   if (existingText && !existing) {
@@ -5297,18 +5530,18 @@ async function runDiscover(workspaceRoot, opts = {}) {
 
 // src/commands/workspace/doctor.ts
 import { existsSync as existsSync3 } from "node:fs";
-import path32 from "node:path";
+import path33 from "node:path";
 
 // src/commands/workspace/manifest.ts
 import { readFileSync as readFileSync3 } from "node:fs";
-import path31 from "node:path";
+import path32 from "node:path";
 var MANIFEST_FILE = "workspace.manifest.json";
 function manifestPath(workspaceRoot) {
   return hausPath(workspaceRoot, MANIFEST_FILE);
 }
 function hausVersion() {
   try {
-    const pkg = JSON.parse(readFileSync3(path31.join(packageRoot(), "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync3(path32.join(packageRoot(), "package.json"), "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -5374,7 +5607,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
   }
   const manifestByName = new Map(manifest.repos.map((r) => [r.name, r]));
   for (const repo of config.repos) {
-    const repoRoot = path32.resolve(workspaceRoot, repo.path);
+    const repoRoot = path33.resolve(workspaceRoot, repo.path);
     const entry = manifestByName.get(repo.name);
     if (!entry) {
       flag({
@@ -5448,11 +5681,11 @@ function emit(args) {
 
 // src/commands/workspace/setup.ts
 import { existsSync as existsSync4, statSync } from "node:fs";
-import path34 from "node:path";
+import path35 from "node:path";
 
 // src/claude/write-workspace-claude-md.ts
-import path33 from "node:path";
-import fs22 from "fs-extra";
+import path34 from "node:path";
+import fs23 from "fs-extra";
 function buildWorkspaceImportBlock(client, members) {
   const memberLines = members.map((m) => `- ${m.name} (${m.path})`);
   const body = [
@@ -5470,8 +5703,8 @@ ${BLOCK_END}`;
 async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
   const block = buildWorkspaceImportBlock(opts.client, opts.members);
   const dryRun = opts.dryRun ?? false;
-  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path33.join(workspaceRoot, "CLAUDE.md");
-  const prev = await fs22.pathExists(filePath) ? await fs22.readFile(filePath, "utf8") : "";
+  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path34.join(workspaceRoot, "CLAUDE.md");
+  const prev = await fs23.pathExists(filePath) ? await fs23.readFile(filePath, "utf8") : "";
   const next = opts.collision ? `${block}
 ` : injectHausBlock(prev, block);
   const printable = displayPath(workspaceRoot, filePath);
@@ -5496,20 +5729,20 @@ async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
 
 // src/commands/workspace/setup.ts
 function resolveWorkspaceRoot(start = process.cwd()) {
-  let dir = path34.resolve(start);
+  let dir = path35.resolve(start);
   for (; ; ) {
-    if (existsSync4(path34.join(dir, WORKSPACE_FILE))) return dir;
-    const parent = path34.dirname(dir);
-    if (parent === dir) return path34.resolve(start);
+    if (existsSync4(path35.join(dir, WORKSPACE_FILE))) return dir;
+    const parent = path35.dirname(dir);
+    if (parent === dir) return path35.resolve(start);
     dir = parent;
   }
 }
 function isRootRepo(workspaceRoot, repoPath) {
-  return path34.resolve(workspaceRoot, repoPath) === path34.resolve(workspaceRoot);
+  return path35.resolve(workspaceRoot, repoPath) === path35.resolve(workspaceRoot);
 }
 async function runWorkspaceSetup(workspaceRoot, options = {}) {
   const apply = options.write ?? false;
-  const configText = await readText(path34.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path35.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
@@ -5526,7 +5759,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
   const statuses = [];
   const aggregateInputs = [];
   for (const repo of repos) {
-    const repoRoot = path34.resolve(workspaceRoot, repo.path);
+    const repoRoot = path35.resolve(workspaceRoot, repo.path);
     log(`
 \u2192 ${repo.name} (${repo.path})`);
     try {
@@ -5594,7 +5827,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
       const status = statusByName.get(repo.name);
       const role = repo.role ?? status?.roles?.[0] ?? "auto";
       if (status?.status === "ok") {
-        const lock = await checkLock(path34.resolve(workspaceRoot, repo.path));
+        const lock = await checkLock(path35.resolve(workspaceRoot, repo.path));
         manifestRepos.push({
           name: repo.name,
           path: repo.path,
@@ -5674,7 +5907,7 @@ relationships: []
   log("Workspace initialized.");
 }
 async function scanWorkspace(workspaceRoot, opts) {
-  const configText = await readText(path35.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path36.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
@@ -5695,7 +5928,7 @@ async function scanWorkspace(workspaceRoot, opts) {
   }
   const inputs = [];
   for (const repo of config.repos) {
-    const repoRoot = path35.resolve(workspaceRoot, repo.path);
+    const repoRoot = path36.resolve(workspaceRoot, repo.path);
     if (!existsSync5(repoRoot) || !statSync2(repoRoot).isDirectory()) {
       throw new Error(`Repo path is not a directory: ${repo.path}`);
     }
@@ -5745,7 +5978,7 @@ async function runWorkspace(action, options = {}) {
 // src/cli.ts
 function cliVersion() {
   try {
-    const pkgPath = path36.join(packageRoot(), "package.json");
+    const pkgPath = path37.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
@@ -5755,7 +5988,7 @@ function cliVersion() {
 var program = new Command();
 function validateRuntimeNodeVersion() {
   try {
-    const pkgPath = path36.join(packageRoot(), "package.json");
+    const pkgPath = path37.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
     const requiredRange = pkg.engines?.node;
     if (requiredRange && !satisfiesVersion(process.version, requiredRange)) {
@@ -5770,10 +6003,16 @@ function validateRuntimeNodeVersion() {
 validateRuntimeNodeVersion();
 program.name("haus").description("Haus AI workflow CLI").version(cliVersion());
 program.command("scan").option("--json").action(runScan);
-program.command("recommend").option("--json").action(runRecommend);
+program.command("recommend").option("--json").option(
+  "--include <ids...>",
+  "Force opt-in catalog items into the recommendation as manual selections (space- or comma-separated ids)"
+).action(runRecommend);
 program.command("setup-project").option("--json").action(runSetupProject);
 program.command("doctor").option("--hooks", "Verify .claude/settings.json matches the hook contract").action(runDoctor);
 program.command("apply").option("--dry-run").option("--write").option("--select", "Interactively select catalog items before applying").option(
+  "--ids <ids...>",
+  "Install exactly these recommended item ids non-interactively (skill backend; space- or comma-separated)"
+).option(
   "--allow-empty-cache",
   "Apply core files only when catalog cache is empty (skip catalog items without error)"
 ).option(