@haus-tech/haus-workflow 1.2.0 → 1.3.0

package/dist/cli.js

@@ -60,7 +60,7 @@ var init_exec = __esm({
 
 // src/cli.ts
 import { readFileSync as readFileSync4 } from "node:fs";
-import path52 from "node:path";
+import path53 from "node:path";
 import { Command } from "commander";
 
 // src/commands/apply.ts
@@ -879,6 +879,26 @@ var validation_rules_default = {
     "collection2",
     "deployer-php"
   ],
+  safetyNotesRequiredTags: [
+    "stripe",
+    "qliro",
+    "payments",
+    "bankid",
+    "myid",
+    "oidc",
+    "azure-ad",
+    "saml2"
+  ],
+  intentsRequiredTags: [
+    "stripe",
+    "qliro",
+    "payments",
+    "bankid",
+    "myid",
+    "oidc",
+    "azure-ad",
+    "saml2"
+  ],
   alwaysAllowedTags: [
     "haus",
     "security",
@@ -1387,6 +1407,13 @@ function findFormerIdMigrations(lockItems, manifestItems) {
   });
 }
 
+// src/recommender/orphaned-items.ts
+function findOrphanedLockEntries(lock, recommendedIds) {
+  return lock.filter(
+    (entry) => typeof entry.id === "string" && !recommendedIds.has(entry.id)
+  );
+}
+
 // src/update/hash-installed.ts
 import path10 from "node:path";
 import fg2 from "fast-glob";
@@ -1876,8 +1903,8 @@ function buildDenyRules() {
   for (const command of DENY_COMMANDS) {
     rules.push(`Bash(${command}:*)`);
   }
-  for (const path53 of DENY_PATHS) {
-    const pattern = DENY_DIRS.has(path53) ? `${path53}/**` : path53;
+  for (const path54 of DENY_PATHS) {
+    const pattern = DENY_DIRS.has(path54) ? `${path54}/**` : path54;
     for (const tool of FILE_TOOLS) {
       rules.push(`${tool}(${pattern})`);
     }
@@ -2164,11 +2191,23 @@ import path15 from "node:path";
 import fs13 from "fs-extra";
 var PRETTIERIGNORE_BEGIN = "# HAUS:BEGIN haus-managed v=1";
 var PRETTIERIGNORE_END = "# HAUS:END haus-managed";
-var IGNORED_PATHS = [".haus-workflow/"];
+var IGNORED_PATHS = [".haus-workflow/", ".claude/"];
+function prettierIgnoreProtects(lines, dir) {
+  const bare = dir.replace(/\/+$/, "");
+  const equivalents = /* @__PURE__ */ new Set([
+    bare,
+    `${bare}/`,
+    `/${bare}`,
+    `/${bare}/`,
+    `${bare}/**`,
+    `/${bare}/**`
+  ]);
+  return lines.some((line2) => equivalents.has(line2.trim()));
+}
 function buildPrettierIgnoreBlock() {
   return [
     PRETTIERIGNORE_BEGIN,
-    "# haus-owned files \u2014 do not reformat (keeps tamper-detection hashes stable)",
+    "# haus-owned files \u2014 do not reformat (keeps tamper/lock hashes stable)",
     ...IGNORED_PATHS,
     PRETTIERIGNORE_END
   ].join("\n");
@@ -2817,6 +2856,16 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
     );
   }
   await cleanupStaleCatalogItems(root, cleanupManifestById, dryRun, opts.quiet);
+  if (opts.prune) {
+    const notOrphaned = new Set(rec.recommended.map((r) => r.id));
+    for (const migration of allMigrations) notOrphaned.add(migration.oldId);
+    for (const entry of prevLock) {
+      if (!entry.id) continue;
+      const manifestItem = manifestById.get(entry.id);
+      if (!manifestItem || manifestItem.reviewStatus === "deprecated") notOrphaned.add(entry.id);
+    }
+    await pruneOrphanedCatalogItems(root, prevLock, notOrphaned, dryRun, opts.quiet);
+  }
   if (dryRun) return [...new Set(files)];
   const installedItems = catalogItems.filter((r) => installedIds.has(r.id));
   const prevRefById = new Map(
@@ -2934,6 +2983,71 @@ async function cleanupStaleCatalogItems(root, manifestById, dryRun, quiet) {
     }
   }
 }
+async function backupBeforePrune(root, absPaths, say) {
+  if (absPaths.length === 0) return;
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const backupRoot = hausPath(root, "backups", `prune-${stamp}`);
+  for (const abs of absPaths) {
+    if (!await fs18.pathExists(abs)) continue;
+    const rel = path19.relative(root, abs);
+    const backupPath = path19.join(backupRoot, rel);
+    await fs18.ensureDir(path19.dirname(backupPath));
+    await fs18.copy(abs, backupPath);
+  }
+  say(`Backed up ${absPaths.length} path(s) to ${path19.relative(root, backupRoot)} before pruning.`);
+}
+async function pruneOrphanedCatalogItems(root, prevLock, notOrphanedIds, dryRun, quiet) {
+  const say = quiet ? () => {
+  } : log;
+  const orphaned = findOrphanedLockEntries(prevLock, notOrphanedIds);
+  if (orphaned.length === 0) return;
+  const toRemove = [];
+  for (const entry of orphaned) {
+    if (!entry.id) continue;
+    const relPaths = entry.paths ?? [];
+    if (relPaths.length === 0) continue;
+    const existing = [];
+    for (const rel of relPaths) {
+      if (await fs18.pathExists(path19.join(root, rel))) existing.push(rel);
+    }
+    if (existing.length === 0) continue;
+    if (entry.hash === void 0) {
+      warn(
+        `Orphaned catalog item ${entry.id} has no lock hash \u2014 leaving in place: ${existing.join(", ")}`
+      );
+      continue;
+    }
+    const currentHash = await hashInstalledPaths(root, relPaths);
+    if (currentHash !== entry.hash) {
+      warn(
+        `Orphaned catalog item ${entry.id} was modified locally \u2014 leaving in place: ${existing.join(", ")}`
+      );
+      continue;
+    }
+    toRemove.push({ id: entry.id, existing });
+  }
+  if (toRemove.length === 0) return;
+  if (dryRun) {
+    for (const { id, existing } of toRemove) {
+      for (const rel of existing) {
+        say(`[dry-run] would prune orphaned ${displayPath(root, path19.join(root, rel))} (${id})`);
+      }
+    }
+    return;
+  }
+  const allAbsPaths = toRemove.flatMap(
+    ({ existing }) => existing.map((rel) => path19.join(root, rel))
+  );
+  await backupBeforePrune(root, allAbsPaths, say);
+  for (const { id, existing } of toRemove) {
+    for (const rel of existing) {
+      const abs = path19.join(root, rel);
+      await fs18.remove(abs);
+      await pruneEmptyDir(path19.dirname(abs));
+      say(`Pruned orphaned ${displayPath(root, abs)} (${id})`);
+    }
+  }
+}
 
 // src/refs/fetch-refs.ts
 import path21 from "node:path";
@@ -3163,7 +3277,8 @@ async function runApply(options) {
   }
   const files = await writeClaudeFiles(root, isDryRun, selectedIds, {
     refillConfig: options.refillConfig,
-    force: options.force
+    force: options.force,
+    prune: options.prune
   });
   if (!isDryRun) {
     try {
@@ -3198,6 +3313,364 @@ async function runApply(options) {
   }
 }
 
+// src/commands/backups.ts
+import path23 from "node:path";
+import fs21 from "fs-extra";
+
+// src/utils/prompts.ts
+import { stdin as input, stdout as output } from "node:process";
+import readline from "node:readline/promises";
+async function ask(question) {
+  const rl = readline.createInterface({ input, output });
+  try {
+    const answer = await rl.question(`${question}
+> `);
+    return answer.trim();
+  } finally {
+    rl.close();
+  }
+}
+async function confirm(question) {
+  const answer = (await ask(`${question} [y/N]`)).toLowerCase();
+  return answer === "y" || answer === "yes";
+}
+
+// src/commands/backups.ts
+var LOCK_BACKUP_RE = /^haus\.lock\.\d+\.json$/;
+function classify(name) {
+  if (LOCK_BACKUP_RE.test(name)) return "lock";
+  if (name.startsWith("undo-")) return "undo";
+  if (name.startsWith("prune-")) return "prune";
+  return void 0;
+}
+async function listBackups(root) {
+  const dir = hausPath(root, "backups");
+  if (!await fs21.pathExists(dir)) return [];
+  const names = await fs21.readdir(dir);
+  const entries = [];
+  for (const name of names) {
+    const kind = classify(name);
+    if (!kind) continue;
+    const absPath = path23.join(dir, name);
+    const stat = await fs21.lstat(absPath);
+    if (stat.isSymbolicLink()) continue;
+    const expectDirectory = kind !== "lock";
+    if (stat.isDirectory() !== expectDirectory) continue;
+    entries.push({ id: name, kind, absPath, mtimeMs: stat.mtimeMs });
+  }
+  entries.sort((a, b) => a.mtimeMs - b.mtimeMs);
+  return entries;
+}
+function formatAge(mtimeMs, now) {
+  const minutes = Math.round(Math.max(0, now - mtimeMs) / 6e4);
+  if (minutes < 60) return `${minutes}m ago`;
+  const hours = Math.round(minutes / 60);
+  if (hours < 48) return `${hours}h ago`;
+  return `${Math.round(hours / 24)}d ago`;
+}
+async function runList(root) {
+  const entries = await listBackups(root);
+  if (entries.length === 0) {
+    log("No backups found under .haus-workflow/backups/.");
+    return;
+  }
+  const now = Date.now();
+  const newestFirst = [...entries].reverse();
+  for (const entry of newestFirst) {
+    log(`${entry.id}  [${entry.kind}]  ${formatAge(entry.mtimeMs, now)}`);
+  }
+}
+async function isUnsafeWriteTarget(root, target) {
+  const segments = path23.relative(root, target).split(path23.sep).filter(Boolean);
+  let current = root;
+  for (let i = 0; i < segments.length; i++) {
+    current = path23.join(current, segments[i]);
+    const isLastSegment = i === segments.length - 1;
+    try {
+      const stat = await fs21.lstat(current);
+      if (isLastSegment) {
+        if (!stat.isFile()) return true;
+      } else if (!stat.isDirectory()) {
+        return true;
+      }
+    } catch (err) {
+      if (err.code === "ENOENT") return false;
+      throw err;
+    }
+  }
+  return false;
+}
+async function lstatIfRegularFile(abs) {
+  try {
+    const stat = await fs21.lstat(abs);
+    return stat.isFile() ? stat : null;
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+}
+async function restoreLockBackup(root, entry, yes) {
+  const target = hausPath(root, "haus.lock.json");
+  if (await isUnsafeWriteTarget(root, target)) {
+    error(
+      `Refusing to restore: ${target} (or a parent directory) is a symlink or other non-regular file \u2014 never written through.`
+    );
+    return false;
+  }
+  if (await fs21.pathExists(target)) {
+    const targetStat = await fs21.stat(target);
+    if (targetStat.mtimeMs > entry.mtimeMs) {
+      warn(
+        `Current haus.lock.json (${new Date(targetStat.mtimeMs).toISOString()}) is newer than backup ${entry.id} (${new Date(entry.mtimeMs).toISOString()}) \u2014 it will be overwritten.`
+      );
+    }
+  }
+  if (!yes) {
+    const ok = await confirm(
+      `Restore .haus-workflow/haus.lock.json from backup ${entry.id}? This overwrites the current lockfile.`
+    );
+    if (!ok) {
+      log("Cancelled.");
+      return false;
+    }
+  }
+  if (!await lstatIfRegularFile(entry.absPath) || await isUnsafeWriteTarget(root, target)) {
+    error(`Refusing to restore: ${entry.id} or ${target} changed since being checked.`);
+    return false;
+  }
+  await fs21.copy(entry.absPath, target, { overwrite: true });
+  log(`Restored .haus-workflow/haus.lock.json from ${entry.id}.`);
+  return true;
+}
+async function collectFilesRecursive(dir) {
+  const files = [];
+  const skippedLinks = [];
+  const skippedOther = [];
+  const names = await fs21.readdir(dir);
+  for (const name of names) {
+    const abs = path23.join(dir, name);
+    const stat = await fs21.lstat(abs);
+    if (stat.isSymbolicLink()) {
+      skippedLinks.push(abs);
+      continue;
+    }
+    if (stat.isDirectory()) {
+      const nested = await collectFilesRecursive(abs);
+      files.push(...nested.files);
+      skippedLinks.push(...nested.skippedLinks);
+      skippedOther.push(...nested.skippedOther);
+    } else if (stat.isFile()) {
+      files.push(abs);
+    } else {
+      skippedOther.push(abs);
+    }
+  }
+  return { files, skippedLinks, skippedOther };
+}
+async function restoreDirBackup(root, entry, yes) {
+  const { files, skippedLinks, skippedOther } = await collectFilesRecursive(entry.absPath);
+  if (skippedLinks.length > 0) {
+    warn(
+      `Skipped ${skippedLinks.length} symlink(s) inside backup ${entry.id} \u2014 never followed: ${skippedLinks.map((abs) => path23.relative(entry.absPath, abs)).join(", ")}`
+    );
+  }
+  if (skippedOther.length > 0) {
+    warn(
+      `Skipped ${skippedOther.length} non-regular file(s) inside backup ${entry.id} (not restorable): ${skippedOther.map((abs) => path23.relative(entry.absPath, abs)).join(", ")}`
+    );
+  }
+  if (files.length === 0) {
+    log(`Backup ${entry.id} contains no files.`);
+    return false;
+  }
+  const safeFiles = [];
+  const unsafeTargets = [];
+  for (const abs of files) {
+    const rel = path23.relative(entry.absPath, abs);
+    const target = path23.join(root, rel);
+    if (await isUnsafeWriteTarget(root, target)) unsafeTargets.push(rel);
+    else safeFiles.push(abs);
+  }
+  if (unsafeTargets.length > 0) {
+    warn(
+      `Skipped ${unsafeTargets.length} restore target(s) that are a symlink (or under one) rather than a plain path \u2014 never written through: ${unsafeTargets.join(", ")}`
+    );
+  }
+  if (safeFiles.length === 0) {
+    log(`Backup ${entry.id} has no restorable targets.`);
+    return false;
+  }
+  const stale = [];
+  const vanished = [];
+  const toRestore = [];
+  for (const abs of safeFiles) {
+    const rel = path23.relative(entry.absPath, abs);
+    const backupFileStat = await lstatIfRegularFile(abs);
+    if (!backupFileStat) {
+      vanished.push(rel);
+      continue;
+    }
+    toRestore.push(abs);
+    const target = path23.join(root, rel);
+    if (await fs21.pathExists(target)) {
+      const targetStat = await fs21.stat(target);
+      if (targetStat.mtimeMs > backupFileStat.mtimeMs) {
+        stale.push({
+          rel,
+          targetMtimeMs: targetStat.mtimeMs,
+          backupMtimeMs: backupFileStat.mtimeMs
+        });
+      }
+    }
+  }
+  if (vanished.length > 0) {
+    warn(
+      `Skipped ${vanished.length} backup file(s) that changed (no longer a plain file) since being listed: ${vanished.join(", ")}`
+    );
+  }
+  if (toRestore.length === 0) {
+    log(`Backup ${entry.id} has no restorable files left after re-validation.`);
+    return false;
+  }
+  if (stale.length > 0) {
+    const detail = stale.map(
+      (s) => `${s.rel} (destination: ${new Date(s.targetMtimeMs).toISOString()}, backup: ${new Date(s.backupMtimeMs).toISOString()})`
+    ).join("; ");
+    warn(
+      `${stale.length} file(s) at the restore destination are newer than backup ${entry.id} and will be overwritten: ${detail}`
+    );
+  }
+  if (!yes) {
+    const ok = await confirm(
+      `Restore ${toRestore.length} file(s) from backup ${entry.id} to their original paths?`
+    );
+    if (!ok) {
+      log("Cancelled.");
+      return false;
+    }
+  }
+  let restoredCount = 0;
+  const skippedAtWrite = [];
+  for (const abs of toRestore) {
+    const rel = path23.relative(entry.absPath, abs);
+    const target = path23.join(root, rel);
+    if (!await lstatIfRegularFile(abs) || await isUnsafeWriteTarget(root, target)) {
+      skippedAtWrite.push(rel);
+      continue;
+    }
+    await fs21.ensureDir(path23.dirname(target));
+    await fs21.copy(abs, target, { overwrite: true });
+    restoredCount++;
+  }
+  if (skippedAtWrite.length > 0) {
+    warn(
+      `Skipped ${skippedAtWrite.length} file(s) that changed since being checked, right before restoring: ${skippedAtWrite.join(", ")}`
+    );
+  }
+  log(`Restored ${restoredCount} file(s) from ${entry.id}.`);
+  return restoredCount > 0;
+}
+async function runRestore(root, id, yes) {
+  const entries = await listBackups(root);
+  const entry = entries.find((e) => e.id === id);
+  if (!entry) {
+    error(`No backup found with id "${id}". Run \`haus backups list\` to see available backups.`);
+    return false;
+  }
+  return entry.kind === "lock" ? restoreLockBackup(root, entry, yes) : restoreDirBackup(root, entry, yes);
+}
+async function runPrune(root, opts) {
+  if (opts.olderThanDays === void 0 && opts.keep === void 0) {
+    error("Specify --older-than <days> or --keep <n> \u2014 refusing to prune with no bound.");
+    return false;
+  }
+  const entries = await listBackups(root);
+  const now = Date.now();
+  const toRemove = /* @__PURE__ */ new Set();
+  if (opts.olderThanDays !== void 0) {
+    const cutoff = now - opts.olderThanDays * 24 * 60 * 60 * 1e3;
+    for (const entry of entries) if (entry.mtimeMs < cutoff) toRemove.add(entry.id);
+  }
+  if (opts.keep !== void 0) {
+    const excess = entries.length - opts.keep;
+    if (excess > 0) for (const entry of entries.slice(0, excess)) toRemove.add(entry.id);
+  }
+  if (toRemove.size === 0) {
+    log("Nothing to prune.");
+    return true;
+  }
+  const removeList = entries.filter((e) => toRemove.has(e.id));
+  const keepCount = entries.length - removeList.length;
+  if (!opts.yes) {
+    const ok = await confirm(
+      `Remove ${removeList.length} backup(s)?
+  ${removeList.map((e) => e.id).join("\n  ")}
+Keeping ${keepCount}.`
+    );
+    if (!ok) {
+      log("Cancelled.");
+      return false;
+    }
+  }
+  const removed = [];
+  const failed = [];
+  for (const entry of removeList) {
+    try {
+      await fs21.remove(entry.absPath);
+      removed.push(entry.id);
+    } catch (err) {
+      failed.push({ id: entry.id, message: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  log(`Removed ${removed.length} backup(s), kept ${entries.length - removed.length}.`);
+  if (failed.length > 0) {
+    warn(
+      `Failed to remove ${failed.length} backup(s): ${failed.map((f) => `${f.id} (${f.message})`).join(", ")}`
+    );
+    return false;
+  }
+  return true;
+}
+async function runBackups(action, opts = {}) {
+  const root = opts.root ?? process.cwd();
+  if (action === "list") {
+    await runList(root);
+    return;
+  }
+  if (action === "restore") {
+    if (!opts.id) {
+      error("Usage: haus backups restore <id>");
+      process.exitCode = 1;
+      return;
+    }
+    if (!await runRestore(root, opts.id, Boolean(opts.yes))) process.exitCode = 1;
+    return;
+  }
+  let olderThanDays;
+  if (opts.olderThan !== void 0) {
+    const n = Number(opts.olderThan);
+    if (!Number.isFinite(n) || n < 0) {
+      error(
+        `Invalid --older-than value "${opts.olderThan}" \u2014 expected a non-negative number of days.`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    olderThanDays = n;
+  }
+  let keep;
+  if (opts.keep !== void 0) {
+    const n = Number(opts.keep);
+    if (!Number.isFinite(n) || n < 0 || !Number.isInteger(n)) {
+      error(`Invalid --keep value "${opts.keep}" \u2014 expected a non-negative integer.`);
+      process.exitCode = 1;
+      return;
+    }
+    keep = n;
+  }
+  if (!await runPrune(root, { olderThanDays, keep, yes: Boolean(opts.yes) })) process.exitCode = 1;
+}
+
 // src/commands/catalog-audit.ts
 function auditForbiddenTags(items) {
   const failures = [];
@@ -3226,7 +3699,7 @@ async function runCatalogAudit() {
 // src/commands/clone.ts
 init_exec();
 import { existsSync as existsSync2 } from "node:fs";
-import path23 from "node:path";
+import path24 from "node:path";
 var GIT_LOCATION_VARS = [
   "GIT_DIR",
   "GIT_WORK_TREE",
@@ -3246,15 +3719,50 @@ function repoNameFromUrl(url) {
   const tail = trimmed.split(/[/:]/).pop() ?? "";
   return tail || "repo";
 }
+function normalizeGitUrl(url) {
+  let s = url.trim();
+  s = s.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "");
+  s = s.replace(/^[^/@]+@/, "");
+  s = s.replace(/:(?=[^/])/, "/");
+  s = s.replace(/\/+$/, "");
+  s = s.replace(/\.git$/i, "");
+  return s.toLowerCase();
+}
+async function checkExistingTarget(target, url) {
+  const isRepo = await runGit(["-C", target, "rev-parse", "--is-inside-work-tree"], {
+    env: cloneEnv(),
+    extendEnv: false
+  });
+  if (isRepo.exitCode !== 0) return { kind: "not-a-repo" };
+  const origin = await runGit(["-C", target, "remote", "get-url", "origin"], {
+    env: cloneEnv(),
+    extendEnv: false
+  });
+  if (origin.exitCode !== 0) return { kind: "different-repo", origin: null };
+  const originUrl = origin.stdout.trim();
+  if (normalizeGitUrl(originUrl) === normalizeGitUrl(url)) return { kind: "matches" };
+  return { kind: "different-repo", origin: originUrl };
+}
 async function runClone(url, opts = {}) {
   if (!url || !url.trim()) {
     error("A git URL is required: `haus clone <url> [dir]`.");
     process.exitCode = 1;
     return;
   }
-  const target = path23.resolve(opts.dir?.trim() || repoNameFromUrl(url));
+  const target = path24.resolve(opts.dir?.trim() || repoNameFromUrl(url));
   if (existsSync2(target)) {
-    log(`\u2022 ${path23.basename(target)} already present at ${target} \u2014 skipped`);
+    const check = await checkExistingTarget(target, url);
+    if (check.kind === "matches") {
+      log(`\u2022 ${path24.basename(target)} already cloned here, matches ${url} \u2014 skipped`);
+      return;
+    }
+    const message = check.kind === "not-a-repo" ? `${target} already exists and is not a git repository \u2014 refusing to clone ${url} there. Remove or rename it, or pass a different [dir].` : `${target} already exists as a different repository (origin: ${check.origin ?? "(no origin remote)"}) \u2014 refusing to clone ${url} there. Remove or rename it, or pass a different [dir].`;
+    if (opts.dryRun) {
+      warn(`[dry-run] ${message}`);
+      return;
+    }
+    error(message);
+    process.exitCode = 1;
     return;
   }
   if (opts.dryRun) {
@@ -3325,8 +3833,8 @@ async function resolveBaseRef(root) {
 }
 
 // src/decisions/check.ts
-import path26 from "node:path";
-import fs23 from "fs-extra";
+import path27 from "node:path";
+import fs24 from "fs-extra";
 
 // src/decisions/diff.ts
 init_exec();
@@ -3381,22 +3889,22 @@ function matchesAnyRegex(filePath, patterns) {
 }
 
 // src/decisions/paths.ts
-import path24 from "node:path";
-import fs21 from "fs-extra";
+import path25 from "node:path";
+import fs22 from "fs-extra";
 async function resolveDecisionsDir(root) {
-  const primary = path24.join(root, DECISIONS_TRIGGERS.decisionsDir);
-  if (await fs21.pathExists(primary)) return primary;
-  const legacy = path24.join(root, DECISIONS_TRIGGERS.legacyDecisionsDir ?? "docs/adr");
-  if (await fs21.pathExists(legacy)) return legacy;
+  const primary = path25.join(root, DECISIONS_TRIGGERS.decisionsDir);
+  if (await fs22.pathExists(primary)) return primary;
+  const legacy = path25.join(root, DECISIONS_TRIGGERS.legacyDecisionsDir ?? "docs/adr");
+  if (await fs22.pathExists(legacy)) return legacy;
   return primary;
 }
 function relativeDecisionPath(decisionsDir, root) {
-  return path24.relative(root, decisionsDir).replace(/\\/g, "/");
+  return path25.relative(root, decisionsDir).replace(/\\/g, "/");
 }
 
 // src/decisions/validate.ts
-import path25 from "node:path";
-import fs22 from "fs-extra";
+import path26 from "node:path";
+import fs23 from "fs-extra";
 function validateDecisionContent(content2) {
   const errors = [];
   for (const section of DECISIONS_TRIGGERS.requiredSections) {
@@ -3425,14 +3933,14 @@ function decisionNumberFromFile(name) {
   return match?.[1] ?? null;
 }
 async function validateIndexSync(decisionsDir, decisionFiles) {
-  const readmePath = path25.join(decisionsDir, "README.md");
-  if (!await fs22.pathExists(readmePath)) {
+  const readmePath = path26.join(decisionsDir, "README.md");
+  if (!await fs23.pathExists(readmePath)) {
     return ["docs/decisions/README.md is missing"];
   }
   const readme = await readText(readmePath) ?? "";
   const errors = [];
   for (const file of decisionFiles) {
-    const num = decisionNumberFromFile(path25.basename(file));
+    const num = decisionNumberFromFile(path26.basename(file));
     if (num && !indexReferencesNumber(readme, num)) {
       errors.push(`README.md missing index row for ADR-${num}`);
     }
@@ -3486,22 +3994,22 @@ async function checkSatisfaction(input2) {
   const errors = [];
   const decisionsPrefix = `${input2.decisionsRel}/`;
   const newDecisionFiles = input2.changedFiles.filter(
-    (f) => f.startsWith(decisionsPrefix) && isDecisionFileName(path26.basename(f))
+    (f) => f.startsWith(decisionsPrefix) && isDecisionFileName(path27.basename(f))
   );
   if (newDecisionFiles.length === 0) {
     errors.push(`no new or updated decision under ${input2.decisionsRel}/`);
     return errors;
   }
-  const decisionsDir = path26.join(input2.root, input2.decisionsRel);
+  const decisionsDir = path27.join(input2.root, input2.decisionsRel);
   for (const rel of newDecisionFiles) {
-    const abs = path26.join(input2.root, rel);
+    const abs = path27.join(input2.root, rel);
     const content2 = await readText(abs) ?? "";
     const valid = validateDecisionContent(content2);
     if (!valid.ok) errors.push(...valid.errors.map((e) => `${rel}: ${e}`));
   }
   const indexErrors = await validateIndexSync(
     decisionsDir,
-    newDecisionFiles.map((f) => path26.basename(f))
+    newDecisionFiles.map((f) => path27.basename(f))
   );
   errors.push(...indexErrors);
   return errors;
@@ -3545,8 +4053,8 @@ ${opts.commitMessages ?? ""}`;
     changedFiles: stats.files
   });
   if (satisfactionErrors.length > 0 && decisionsRel !== legacyRel) {
-    const legacyExists = await fs23.pathExists(path26.join(root, legacyRel));
-    if (legacyExists && !await fs23.pathExists(decisionsDir)) {
+    const legacyExists = await fs24.pathExists(path27.join(root, legacyRel));
+    if (legacyExists && !await fs24.pathExists(decisionsDir)) {
       satisfactionErrors = await checkSatisfaction({
         root,
         decisionsRel: legacyRel,
@@ -3566,8 +4074,8 @@ ${opts.commitMessages ?? ""}`;
   return { triggered: true, satisfied: false, reasons, securityTriggered };
 }
 async function listDecisionNumbers(decisionsDir) {
-  if (!await fs23.pathExists(decisionsDir)) return [];
-  const entries = await fs23.readdir(decisionsDir);
+  if (!await fs24.pathExists(decisionsDir)) return [];
+  const entries = await fs24.readdir(decisionsDir);
   return entries.map((name) => decisionNumberFromFile(name)).filter((n) => n != null).map((n) => Number(n));
 }
 
@@ -3609,7 +4117,7 @@ async function runDecisionsGuard(options = {}) {
 }
 
 // src/commands/decisions.ts
-import path27 from "node:path";
+import path28 from "node:path";
 
 // src/decisions/next-number.ts
 async function nextDecisionNumber(root) {
@@ -3720,7 +4228,7 @@ async function runDecisions(sub, arg, options = {}) {
     return;
   }
   if (sub === "validate") {
-    const target = arg ? path27.resolve(root, arg) : void 0;
+    const target = arg ? path28.resolve(root, arg) : void 0;
     if (!target) {
       error("usage: haus decisions validate <path-to-decision.md>");
       process.exitCode = 1;
@@ -3737,18 +4245,18 @@ async function runDecisions(sub, arg, options = {}) {
 }
 
 // src/commands/doctor.ts
-import path34 from "node:path";
-import fs27 from "fs-extra";
+import path35 from "node:path";
+import fs28 from "fs-extra";
 
 // src/decisions/doctor.ts
-import path28 from "node:path";
-import fs24 from "fs-extra";
+import path29 from "node:path";
+import fs25 from "fs-extra";
 async function auditDecisionsLayout(root) {
   const findings = [];
-  const primary = path28.join(root, DECISIONS_TRIGGERS.decisionsDir);
-  const legacy = path28.join(root, DECISIONS_TRIGGERS.legacyDecisionsDir ?? "docs/adr");
-  const hasPrimary = await fs24.pathExists(primary);
-  const hasLegacy = await fs24.pathExists(legacy);
+  const primary = path29.join(root, DECISIONS_TRIGGERS.decisionsDir);
+  const legacy = path29.join(root, DECISIONS_TRIGGERS.legacyDecisionsDir ?? "docs/adr");
+  const hasPrimary = await fs25.pathExists(primary);
+  const hasLegacy = await fs25.pathExists(legacy);
   if (!hasPrimary && hasLegacy) {
     findings.push({
       level: "advisory",
@@ -3761,8 +4269,8 @@ async function auditDecisionsLayout(root) {
   if (!hasPrimary) return findings;
   const decisionsDir = await resolveDecisionsDir(root);
   const rel = relativeDecisionPath(decisionsDir, root);
-  const readmePath = path28.join(decisionsDir, "README.md");
-  if (!await fs24.pathExists(readmePath)) {
+  const readmePath = path29.join(decisionsDir, "README.md");
+  if (!await fs25.pathExists(readmePath)) {
     findings.push({
       level: "advisory",
       line: `- DECISIONS: missing ${rel}/README.md index`,
@@ -3772,7 +4280,7 @@ async function auditDecisionsLayout(root) {
     return findings;
   }
   const readme = await readText(readmePath);
-  const entries = (await fs24.readdir(decisionsDir)).filter(
+  const entries = (await fs25.readdir(decisionsDir)).filter(
     (f) => f.endsWith(".md") && f !== "README.md"
   );
   for (const file of entries) {
@@ -3786,7 +4294,7 @@ async function auditDecisionsLayout(root) {
       });
     }
   }
-  const claude = await readText(path28.join(root, "CLAUDE.md"));
+  const claude = await readText(path29.join(root, "CLAUDE.md"));
   if (claude && !claude.includes(`@${rel}/README.md`)) {
     findings.push({
       level: "advisory",
@@ -3817,11 +4325,11 @@ async function auditDecisionsLayout(root) {
 }
 
 // src/scanner/read-context.ts
-import path33 from "node:path";
-import fs26 from "fs-extra";
+import path34 from "node:path";
+import fs27 from "fs-extra";
 
 // src/scanner/scan-project.ts
-import path32 from "node:path";
+import path33 from "node:path";
 
 // src/utils/versions.ts
 import semver from "semver";
@@ -3843,8 +4351,8 @@ function compareVersions(a, b) {
 }
 
 // src/scanner/detect-package-manager.ts
-import path29 from "node:path";
-import fs25 from "fs-extra";
+import path30 from "node:path";
+import fs26 from "fs-extra";
 function detectPackageManager(root, packageManagerField) {
   const field = String(packageManagerField ?? "").trim();
   if (field.startsWith("yarn@")) {
@@ -3862,9 +4370,9 @@ function detectPackageManager(root, packageManagerField) {
     if (satisfiesVersion(version, ">=9")) return "npm";
     return "unknown";
   }
-  if (fs25.existsSync(path29.join(root, "yarn.lock"))) return "yarn";
-  if (fs25.existsSync(path29.join(root, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs25.existsSync(path29.join(root, "package-lock.json"))) return "npm";
+  if (fs26.existsSync(path30.join(root, "yarn.lock"))) return "yarn";
+  if (fs26.existsSync(path30.join(root, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs26.existsSync(path30.join(root, "package-lock.json"))) return "npm";
   return "unknown";
 }
 
@@ -4066,7 +4574,7 @@ function runDetection(ctx, rules = STACK_RULES) {
 }
 
 // src/scanner/detection.ts
-import path30 from "node:path";
+import path31 from "node:path";
 var UNSUPPORTED_MARKERS = {
   "requirements.txt": "python",
   "pyproject.toml": "python",
@@ -4120,14 +4628,14 @@ function finalizeRoles(registryRoles, deps, files) {
 function collectUnsupportedSignals(files) {
   return [
     ...new Set(
-      files.map((f) => UNSUPPORTED_MARKERS[path30.basename(f)]).filter((s) => Boolean(s))
+      files.map((f) => UNSUPPORTED_MARKERS[path31.basename(f)]).filter((s) => Boolean(s))
     )
   ].sort();
 }
 
 // src/scanner/render.ts
 import { readFile } from "node:fs/promises";
-import path31 from "node:path";
+import path32 from "node:path";
 async function buildContentBlob(root, files) {
   const candidates = files.filter(
     (f) => f.endsWith(".ts") || f.endsWith(".js") || f.endsWith(".php") || f.endsWith(".json") || f.endsWith(".yml") || f.endsWith(".yaml")
@@ -4135,7 +4643,7 @@ async function buildContentBlob(root, files) {
   const slice = candidates.slice(0, 300);
   const parts = await mapWithConcurrency(slice, async (rel) => {
     try {
-      return await readFile(path31.join(root, rel), "utf8");
+      return await readFile(path32.join(root, rel), "utf8");
     } catch {
       return "";
     }
@@ -4222,8 +4730,8 @@ var SAFE_FILES = [
   "Gemfile"
 ];
 async function scanProject(root) {
-  const pkg = await readJson(path32.join(root, "package.json"));
-  const composer = await readJson(path32.join(root, "composer.json"));
+  const pkg = await readJson(path33.join(root, "package.json"));
+  const composer = await readJson(path33.join(root, "composer.json"));
   const files = await listFiles(root, SAFE_FILES);
   const safeFiles = files.filter((f) => !blocked(f));
   const deps = dependencySet(pkg, composer);
@@ -4250,7 +4758,7 @@ async function scanProject(root) {
   const context = {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     root,
-    repoName: String(pkg?.name ?? path32.basename(root)),
+    repoName: String(pkg?.name ?? path33.basename(root)),
     packageManager,
     repoRoles: roles,
     detectedStacks: stacks,
@@ -4268,9 +4776,9 @@ async function scanProject(root) {
 
 // src/scanner/read-context.ts
 async function isCacheFresh(root, cachePath) {
-  const pkgJsonPath = path33.join(root, "package.json");
-  if (!await fs26.pathExists(pkgJsonPath)) return true;
-  const [cacheStat, pkgStat] = await Promise.all([fs26.stat(cachePath), fs26.stat(pkgJsonPath)]);
+  const pkgJsonPath = path34.join(root, "package.json");
+  if (!await fs27.pathExists(pkgJsonPath)) return true;
+  const [cacheStat, pkgStat] = await Promise.all([fs27.stat(cachePath), fs27.stat(pkgJsonPath)]);
   return cacheStat.mtimeMs >= pkgStat.mtimeMs;
 }
 async function readContextOrScan(root) {
@@ -4369,7 +4877,7 @@ async function runDoctor(options) {
   } else {
     ok(`- HOOKS OK: ${hooks.message}`);
   }
-  const rootClaudeMdPath = path34.join(root, "CLAUDE.md");
+  const rootClaudeMdPath = path35.join(root, "CLAUDE.md");
   const rootClaudeMdContent = await readText(rootClaudeMdPath);
   if (!rootClaudeMdContent) {
     flag(
@@ -4397,7 +4905,7 @@ async function runDoctor(options) {
       const block = rootClaudeMdContent.slice(beginIdx, endIdx + BLOCK_END.length);
       const importTargets = [...block.matchAll(/@\.haus-workflow\/(\S+)/g)].map((m) => m[1]);
       for (const target of importTargets) {
-        if (!await fs27.pathExists(hausPath(root, target))) {
+        if (!await fs28.pathExists(hausPath(root, target))) {
           flag(
             `- CLAUDE.md import: @.haus-workflow/${target} does not resolve (run \`haus apply --write\`)`,
             `A file CLAUDE.md links to (${target}) is missing, so part of the guidance won't load`,
@@ -4408,7 +4916,7 @@ async function runDoctor(options) {
     }
   }
   const workflowPath = hausPath(root, "WORKFLOW.md");
-  const workflowExists = await fs27.pathExists(workflowPath);
+  const workflowExists = await fs28.pathExists(workflowPath);
   if (!workflowExists) {
     flag(
       "- .haus-workflow/WORKFLOW.md: missing (run `haus apply --write`)",
@@ -4423,15 +4931,15 @@ async function runDoctor(options) {
     } else {
       const storedHashMatch = firstLine.match(/hash=(sha256-[a-f0-9]+)/);
       const bodyContent = workflowContent.slice(firstLine.length + 1);
-      const cachePath = path34.join(getCacheDir(), "templates/agentic-workflow-standard.md");
-      const bundledPath = path34.join(
+      const cachePath = path35.join(getCacheDir(), "templates/agentic-workflow-standard.md");
+      const bundledPath = path35.join(
         packageRoot(),
         "library",
         "global",
         "templates",
         "agentic-workflow-standard.md"
       );
-      const templatePath = await fs27.pathExists(cachePath) ? cachePath : bundledPath;
+      const templatePath = await fs28.pathExists(cachePath) ? cachePath : bundledPath;
       const templateContent = await readText(templatePath);
       const verdict = checkManagedTamper(bodyContent, storedHashMatch?.[1], templateContent ?? null);
       if (verdict.status === "tampered" || verdict.status === "legacy-diverged") {
@@ -4452,7 +4960,7 @@ async function runDoctor(options) {
     }
   }
   const workflowConfigPath = hausPath(root, "workflow-config.md");
-  const workflowConfigExists = await fs27.pathExists(workflowConfigPath);
+  const workflowConfigExists = await fs28.pathExists(workflowConfigPath);
   if (!workflowConfigExists) {
     flag(
       "- .haus-workflow/workflow-config.md: missing (run `haus apply --write`)",
@@ -4460,7 +4968,7 @@ async function runDoctor(options) {
       "haus apply --write"
     );
   } else {
-    const cfg = await fs27.readFile(workflowConfigPath, "utf8");
+    const cfg = await fs28.readFile(workflowConfigPath, "utf8");
     const unfilled = cfg.split("\n").filter((l) => l.includes("<!-- fill in")).length;
     if (unfilled > 0) {
       suggest(
@@ -4473,15 +4981,17 @@ async function runDoctor(options) {
     }
   }
   if (workflowExists) {
-    const prettierIgnore = await readText(path34.join(root, ".prettierignore")) ?? "";
-    if (!prettierIgnore.split("\n").some((l) => l.trim() === ".haus-workflow/")) {
+    const prettierIgnore = await readText(path35.join(root, ".prettierignore")) ?? "";
+    const lines = prettierIgnore.split("\n");
+    const missing = IGNORED_PATHS.filter((p) => !prettierIgnoreProtects(lines, p));
+    if (missing.length > 0) {
       flag(
-        "- .prettierignore: not protecting .haus-workflow/ (run `haus apply --write`)",
+        `- .prettierignore: not protecting ${missing.join(", ")} (run \`haus apply --write\`)`,
         'The formatter may reformat managed files and trigger false "modified locally" reports',
         "haus apply --write"
       );
     } else {
-      ok("- .prettierignore: protects .haus-workflow/");
+      ok(`- .prettierignore: protects ${IGNORED_PATHS.join(" and ")}`);
     }
   }
   for (const finding of await auditDecisionsLayout(root)) {
@@ -4510,9 +5020,9 @@ async function runDoctor(options) {
   if (recommendation) {
     const lock = await readJson(hausPath(root, "haus.lock.json"));
     const recommendedIds = new Set(
-      recommendation.recommended.map((r) => r.id)
+      recommendation.recommended.map((r) => r.id).filter((id) => typeof id === "string")
     );
-    const orphaned = (lock ?? []).map((entry) => entry.id).filter((id) => typeof id === "string" && !recommendedIds.has(id));
+    const orphaned = findOrphanedLockEntries(lock ?? [], recommendedIds).map((entry) => entry.id);
     if (orphaned.length > 0) {
       suggest(
         `- CATALOG ITEMS: ${orphaned.length} installed item(s) no longer in the current recommendation (${orphaned.join(", ")})`,
@@ -4521,7 +5031,7 @@ async function runDoctor(options) {
       );
     }
   }
-  const pkgJson = await readJson(path34.join(packageRoot(), "package.json"));
+  const pkgJson = await readJson(path35.join(packageRoot(), "package.json"));
   const currentVersion = pkgJson?.version ?? "0.0.0";
   const npmStatus = await fetchNpmVersionStatus(currentVersion);
   if (npmStatus.updateAvailable && npmStatus.latest !== null) {
@@ -4779,8 +5289,8 @@ async function runGuard(kind, _options) {
 }
 
 // src/commands/init.ts
-import path35 from "node:path";
-import fs28 from "fs-extra";
+import path36 from "node:path";
+import fs29 from "fs-extra";
 
 // src/recommender/git-signal.ts
 init_exec();
@@ -5283,24 +5793,6 @@ async function runSetupCore(root, opts) {
   return { ...baseResult, hooksOk: hooksOkAfter, written: files };
 }
 
-// src/utils/prompts.ts
-import { stdin as input, stdout as output } from "node:process";
-import readline from "node:readline/promises";
-async function ask(question) {
-  const rl = readline.createInterface({ input, output });
-  try {
-    const answer = await rl.question(`${question}
-> `);
-    return answer.trim();
-  } finally {
-    rl.close();
-  }
-}
-async function confirm(question) {
-  const answer = (await ask(`${question} [y/N]`)).toLowerCase();
-  return answer === "y" || answer === "yes";
-}
-
 // src/commands/setup-project.ts
 async function runSetupProject(options) {
   const root = process.cwd();
@@ -5315,8 +5807,8 @@ async function runSetupProject(options) {
 // src/commands/init.ts
 async function runInit(options) {
   const root = process.cwd();
-  const hausDir = path35.join(root, ".haus-workflow");
-  const alreadyInit = await fs28.pathExists(hausDir);
+  const hausDir = path36.join(root, ".haus-workflow");
+  const alreadyInit = await fs29.pathExists(hausDir);
   if (alreadyInit) {
     log("Haus AI already initialized in this project.");
     log("Run `haus setup-project` to reconfigure.");
@@ -5328,8 +5820,8 @@ async function runInit(options) {
 
 // src/install/apply.ts
 import crypto2 from "node:crypto";
-import path36 from "node:path";
-import fs29 from "fs-extra";
+import path37 from "node:path";
+import fs30 from "fs-extra";
 
 // src/install/header.ts
 var MD_PREFIX = "<!-- HAUS-MANAGED";
@@ -5415,57 +5907,57 @@ function hashContent(content2) {
 }
 function sourceVersion() {
   try {
-    const pkgPath = path36.join(packageRoot(), "package.json");
-    const pkg = JSON.parse(fs29.readFileSync(pkgPath, "utf8"));
+    const pkgPath = path37.join(packageRoot(), "package.json");
+    const pkg = JSON.parse(fs30.readFileSync(pkgPath, "utf8"));
     return `${pkg.name ?? "haus"}@${pkg.version ?? "0.0.0"}`;
   } catch {
     return "haus@0.0.0";
   }
 }
 function globalSrcDir() {
-  return path36.join(packageRoot(), "library", "global");
+  return path37.join(packageRoot(), "library", "global");
 }
 function collectSkillAuxFiles(skillsDir, claudeDir, skillName) {
-  const skillDir = path36.join(skillsDir, skillName);
+  const skillDir = path37.join(skillsDir, skillName);
   const entries = [];
-  for (const rel of fs29.readdirSync(skillDir, { recursive: true })) {
+  for (const rel of fs30.readdirSync(skillDir, { recursive: true })) {
     if (rel === "SKILL.md") continue;
-    const abs = path36.join(skillDir, rel);
-    if (!fs29.statSync(abs).isFile()) continue;
-    const posixRel = rel.split(path36.sep).join("/");
+    const abs = path37.join(skillDir, rel);
+    if (!fs30.statSync(abs).isFile()) continue;
+    const posixRel = rel.split(path37.sep).join("/");
     entries.push({
       stableId: `skill.${skillName}.${posixRel.replace(/\//g, ".")}`,
-      srcRelPath: path36.join("library", "global", "skills", skillName, rel),
-      destPath: path36.join(claudeDir, "skills", skillName, rel)
+      srcRelPath: path37.join("library", "global", "skills", skillName, rel),
+      destPath: path37.join(claudeDir, "skills", skillName, rel)
     });
   }
   return entries;
 }
 function collectSourceFiles(srcDir, claudeDir) {
   const entries = [];
-  const skillsDir = path36.join(srcDir, "skills");
-  if (fs29.pathExistsSync(skillsDir)) {
-    for (const skillName of fs29.readdirSync(skillsDir)) {
-      const skillFile = path36.join(skillsDir, skillName, "SKILL.md");
-      if (fs29.pathExistsSync(skillFile)) {
+  const skillsDir = path37.join(srcDir, "skills");
+  if (fs30.pathExistsSync(skillsDir)) {
+    for (const skillName of fs30.readdirSync(skillsDir)) {
+      const skillFile = path37.join(skillsDir, skillName, "SKILL.md");
+      if (fs30.pathExistsSync(skillFile)) {
         entries.push({
           stableId: `skill.${skillName}`,
-          srcRelPath: path36.join("library", "global", "skills", skillName, "SKILL.md"),
-          destPath: path36.join(claudeDir, "skills", skillName, "SKILL.md")
+          srcRelPath: path37.join("library", "global", "skills", skillName, "SKILL.md"),
+          destPath: path37.join(claudeDir, "skills", skillName, "SKILL.md")
         });
         entries.push(...collectSkillAuxFiles(skillsDir, claudeDir, skillName));
       }
     }
   }
-  const commandsDir = path36.join(srcDir, "commands");
-  if (fs29.pathExistsSync(commandsDir)) {
-    for (const fileName of fs29.readdirSync(commandsDir)) {
+  const commandsDir = path37.join(srcDir, "commands");
+  if (fs30.pathExistsSync(commandsDir)) {
+    for (const fileName of fs30.readdirSync(commandsDir)) {
       if (!fileName.endsWith(".md")) continue;
       const commandName = fileName.slice(0, -".md".length);
       entries.push({
         stableId: `command.${commandName}`,
-        srcRelPath: path36.join("library", "global", "commands", fileName),
-        destPath: path36.join(claudeDir, "commands", fileName)
+        srcRelPath: path37.join("library", "global", "commands", fileName),
+        destPath: path37.join(claudeDir, "commands", fileName)
       });
     }
   }
@@ -5491,7 +5983,7 @@ async function applyInstall(options = {}) {
   };
   const manifestFiles = [];
   for (const entry of sourceFiles) {
-    const srcPath = path36.join(packageRoot(), entry.srcRelPath);
+    const srcPath = path37.join(packageRoot(), entry.srcRelPath);
     const rawContent = await readText(srcPath);
     if (rawContent === void 0) {
       warn(`Source file not found: ${entry.srcRelPath}`);
@@ -5511,7 +6003,7 @@ async function applyInstall(options = {}) {
       }
       continue;
     }
-    const destExists = fs29.pathExistsSync(entry.destPath);
+    const destExists = fs30.pathExistsSync(entry.destPath);
     if (destExists) {
       const currentContent = await readText(entry.destPath);
       if (currentContent !== void 0) {
@@ -5551,7 +6043,7 @@ async function applyInstall(options = {}) {
   }
   let mergedSettings;
   if (!check) {
-    const fragmentPath = path36.join(srcDir, "settings-fragments", "hooks.json");
+    const fragmentPath = path37.join(srcDir, "settings-fragments", "hooks.json");
     const fragments = await loadHooksFragment(fragmentPath);
     const settings = await readSettings();
     const { settings: hookSettings, addedIds } = mergeHooks(settings, fragments);
@@ -5565,13 +6057,13 @@ async function applyInstall(options = {}) {
     const currentDestPaths = new Set(sourceFiles.map((f) => f.destPath));
     for (const entry of existingManifest.files) {
       if (currentDestPaths.has(entry.destPath)) continue;
-      if (!fs29.pathExistsSync(entry.destPath)) continue;
+      if (!fs30.pathExistsSync(entry.destPath)) continue;
       const content2 = await readText(entry.destPath);
       if (!content2) continue;
       const hasHeader = parseMarkdownHeader(content2) !== void 0;
       const currentHash = hashContent(content2);
       if (hasHeader && currentHash === entry.hash) {
-        if (!dryRun) await fs29.remove(entry.destPath);
+        if (!dryRun) await fs30.remove(entry.destPath);
         result.deleted.push(entry.destPath);
       } else {
         warn(`Orphaned file ${entry.destPath} was user-modified \u2014 leaving in place`);
@@ -5740,8 +6232,8 @@ async function runRefresh() {
 }
 
 // src/install/scaffold.ts
-import path37 from "node:path";
-import fs30 from "fs-extra";
+import path38 from "node:path";
+import fs31 from "fs-extra";
 async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
   const scaffolded = [];
   const skipped = [];
@@ -5754,27 +6246,27 @@ async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
     skipped.push(name);
     if (outcome === "skipped-exists") skippedExisting.push(name);
   };
-  const realRoot = await fs30.realpath(catalogRoot).catch(() => null);
+  const realRoot = await fs31.realpath(catalogRoot).catch(() => null);
   for (const item of items) {
     if (item.type !== "config") continue;
-    const sourcePath = path37.resolve(catalogRoot, item.path);
-    const rel = path37.relative(catalogRoot, sourcePath);
-    const escapes = rel === "" || path37.isAbsolute(rel) || rel.split(/[/\\]/).some((seg) => seg === "..");
+    const sourcePath = path38.resolve(catalogRoot, item.path);
+    const rel = path38.relative(catalogRoot, sourcePath);
+    const escapes = rel === "" || path38.isAbsolute(rel) || rel.split(/[/\\]/).some((seg) => seg === "..");
     if (escapes) {
       warn(`Skipping ${item.id}: path '${item.path}' escapes the catalog root`);
       continue;
     }
-    const realSource = await fs30.realpath(sourcePath).catch(() => null);
+    const realSource = await fs31.realpath(sourcePath).catch(() => null);
     if (!realRoot || !realSource) {
       warn(`Skipping ${item.id}: source not found at ${sourcePath}`);
       continue;
     }
-    const realRel = path37.relative(realRoot, realSource);
-    if (realRel !== "" && (path37.isAbsolute(realRel) || realRel.split(/[/\\]/)[0] === "..")) {
+    const realRel = path38.relative(realRoot, realSource);
+    if (realRel !== "" && (path38.isAbsolute(realRel) || realRel.split(/[/\\]/)[0] === "..")) {
       warn(`Skipping ${item.id}: path '${item.path}' resolves outside the catalog root`);
       continue;
     }
-    const stat = await fs30.lstat(sourcePath).catch(() => null);
+    const stat = await fs31.lstat(sourcePath).catch(() => null);
     if (!stat) {
       warn(`Skipping ${item.id}: source not found at ${sourcePath}`);
       continue;
@@ -5784,14 +6276,14 @@ async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
       continue;
     }
     if (stat.isFile()) {
-      const filename = path37.basename(sourcePath);
-      const dest = path37.join(projectRoot, filename);
+      const filename = path38.basename(sourcePath);
+      const dest = path38.join(projectRoot, filename);
       record(filename, await scaffoldFile(sourcePath, dest, item.id, projectRoot, opts));
     } else if (stat.isDirectory()) {
-      const entries = await fs30.readdir(sourcePath);
+      const entries = await fs31.readdir(sourcePath);
       for (const entry of entries) {
-        const src = path37.join(sourcePath, entry);
-        const dest = path37.join(projectRoot, entry);
+        const src = path38.join(sourcePath, entry);
+        const dest = path38.join(projectRoot, entry);
         record(entry, await scaffoldFile(src, dest, item.id, projectRoot, opts));
       }
     }
@@ -5799,42 +6291,42 @@ async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
   return { scaffolded, skipped, skippedExisting };
 }
 async function scaffoldFile(src, dest, itemId, projectRoot, opts) {
-  const destDisplay = path37.relative(projectRoot, dest) || path37.basename(dest);
-  const srcStat = await fs30.lstat(src).catch(() => null);
+  const destDisplay = path38.relative(projectRoot, dest) || path38.basename(dest);
+  const srcStat = await fs31.lstat(src).catch(() => null);
   if (!srcStat) {
-    warn(`Skipping ${path37.basename(src)}: source not found`);
+    warn(`Skipping ${path38.basename(src)}: source not found`);
     return "skipped-refused";
   }
   if (srcStat.isSymbolicLink()) {
-    warn(`Skipping ${path37.basename(src)}: source is a symlink`);
+    warn(`Skipping ${path38.basename(src)}: source is a symlink`);
     return "skipped-refused";
   }
-  const exists = await fs30.pathExists(dest);
+  const exists = await fs31.pathExists(dest);
   if (exists && !opts.force) {
     warn(`Skipping ${destDisplay}: already exists \u2014 re-run with --force to overwrite it`);
     return "skipped-exists";
   }
   if (opts.dryRun) {
-    log(`[dry-run] would ${exists ? "overwrite" : "create"} ${path37.basename(dest)} (${itemId})`);
+    log(`[dry-run] would ${exists ? "overwrite" : "create"} ${path38.basename(dest)} (${itemId})`);
     return "scaffolded";
   }
   if (exists && opts.force) {
-    await fs30.remove(dest);
+    await fs31.remove(dest);
   }
-  await fs30.ensureDir(path37.dirname(dest));
-  await fs30.copy(src, dest, {
+  await fs31.ensureDir(path38.dirname(dest));
+  await fs31.copy(src, dest, {
     overwrite: true,
     dereference: false,
     // A vanished/unreadable entry mid-walk must skip that path, not crash the copy.
     filter: (s) => {
       try {
-        return !fs30.lstatSync(s).isSymbolicLink();
+        return !fs31.lstatSync(s).isSymbolicLink();
       } catch {
         return false;
       }
     }
   });
-  log(`${exists ? "Overwrote" : "Created"} ${path37.basename(dest)} (${itemId})`);
+  log(`${exists ? "Overwrote" : "Created"} ${path38.basename(dest)} (${itemId})`);
   return "scaffolded";
 }
 
@@ -5891,8 +6383,8 @@ async function runScan(options) {
 }
 
 // src/commands/undo.ts
-import path38 from "node:path";
-import fs31 from "fs-extra";
+import path39 from "node:path";
+import fs32 from "fs-extra";
 
 // src/claude/managed-paths.ts
 var PROJECT_MANAGED_CLAUDE_REL = ["rules/haus.md"];
@@ -5907,7 +6399,7 @@ function coreManagedAbsolutePaths(root) {
 async function collectCoreManagedPaths(root) {
   const existing = [];
   for (const abs of coreManagedAbsolutePaths(root)) {
-    if (await fs31.pathExists(abs)) existing.push(abs);
+    if (await fs32.pathExists(abs)) existing.push(abs);
   }
   return existing;
 }
@@ -5919,18 +6411,18 @@ async function collectLockTrackedPaths(root) {
     const relPaths = row.paths ?? [];
     const existingRel = [];
     for (const rel of relPaths) {
-      if (await fs31.pathExists(path38.resolve(root, rel))) existingRel.push(rel);
+      if (await fs32.pathExists(path39.resolve(root, rel))) existingRel.push(rel);
     }
     if (existingRel.length === 0) continue;
     if (row.hash === void 0) {
-      removable.push(...existingRel.map((rel) => path38.resolve(root, rel)));
+      removable.push(...existingRel.map((rel) => path39.resolve(root, rel)));
       continue;
     }
     const currentHash = await hashInstalledPaths(root, existingRel);
     if (currentHash === row.hash) {
-      removable.push(...existingRel.map((rel) => path38.resolve(root, rel)));
+      removable.push(...existingRel.map((rel) => path39.resolve(root, rel)));
     } else {
-      preserved.push(...existingRel.map((rel) => path38.resolve(root, rel)));
+      preserved.push(...existingRel.map((rel) => path39.resolve(root, rel)));
       log(`Preserving locally-modified ${row.id ?? "(unknown item)"}: ${existingRel.join(", ")}`);
     }
   }
@@ -5938,51 +6430,51 @@ async function collectLockTrackedPaths(root) {
 }
 async function settingsHasHausContent(root) {
   const settingsPath = claudePath(root, "settings.json");
-  if (!await fs31.pathExists(settingsPath)) return false;
+  if (!await fs32.pathExists(settingsPath)) return false;
   const settings = await readProjectSettings(root);
   return settings._haus != null;
 }
 async function claudeMdHasHausBlock(root) {
-  const filePath = path38.join(root, "CLAUDE.md");
-  if (!await fs31.pathExists(filePath)) return false;
-  const text = await fs31.readFile(filePath, "utf8");
+  const filePath = path39.join(root, "CLAUDE.md");
+  if (!await fs32.pathExists(filePath)) return false;
+  const text = await fs32.readFile(filePath, "utf8");
   return text.includes(BLOCK_BEGIN);
 }
 async function stripProjectSettings(root) {
   const settingsPath = claudePath(root, "settings.json");
-  if (!await fs31.pathExists(settingsPath)) return false;
+  if (!await fs32.pathExists(settingsPath)) return false;
   let settings = await readProjectSettings(root);
   settings = stripHausHooks(stripHausAsk(stripHausAllow(stripHausDeny(settings))));
   const hasContent = Object.keys(settings).length > 0;
   if (hasContent) {
     await writeProjectSettings(root, settings);
-    log(`Stripped haus rules from ${path38.relative(root, settingsPath)} (user settings preserved).`);
+    log(`Stripped haus rules from ${path39.relative(root, settingsPath)} (user settings preserved).`);
     return true;
   }
-  await fs31.remove(settingsPath);
-  log(`Removed ${path38.relative(root, settingsPath)} (no user-owned settings remained).`);
+  await fs32.remove(settingsPath);
+  log(`Removed ${path39.relative(root, settingsPath)} (no user-owned settings remained).`);
   return true;
 }
 async function stripRootClaudeMd(root) {
-  const filePath = path38.join(root, "CLAUDE.md");
-  if (!await fs31.pathExists(filePath)) return false;
-  const prev = await fs31.readFile(filePath, "utf8");
+  const filePath = path39.join(root, "CLAUDE.md");
+  if (!await fs32.pathExists(filePath)) return false;
+  const prev = await fs32.readFile(filePath, "utf8");
   if (!prev.includes(BLOCK_BEGIN)) return false;
   const next = stripHausBlock(prev);
   if (next.length === 0) {
-    await fs31.remove(filePath);
+    await fs32.remove(filePath);
     log("Removed CLAUDE.md (only contained haus import block).");
   } else {
-    await fs31.writeFile(filePath, next, "utf8");
+    await fs32.writeFile(filePath, next, "utf8");
     log("Removed haus import block from CLAUDE.md (user content preserved).");
   }
   return true;
 }
 async function pruneDirIfEmpty(dir) {
-  if (!await fs31.pathExists(dir)) return;
+  if (!await fs32.pathExists(dir)) return;
   try {
-    const entries = await fs31.readdir(dir);
-    if (entries.length === 0) await fs31.remove(dir);
+    const entries = await fs32.readdir(dir);
+    if (entries.length === 0) await fs32.remove(dir);
   } catch {
   }
 }
@@ -5991,13 +6483,13 @@ async function backupManagedFilesBeforeUndo(root, managedAbsPaths) {
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const backupRoot = hausPath(root, "backups", `undo-${stamp}`);
   for (const abs of managedAbsPaths) {
-    if (!await fs31.pathExists(abs)) continue;
-    const rel = path38.relative(root, abs);
-    const backupPath = path38.join(backupRoot, rel);
-    await fs31.ensureDir(path38.dirname(backupPath));
-    await fs31.copy(abs, backupPath);
+    if (!await fs32.pathExists(abs)) continue;
+    const rel = path39.relative(root, abs);
+    const backupPath = path39.join(backupRoot, rel);
+    await fs32.ensureDir(path39.dirname(backupPath));
+    await fs32.copy(abs, backupPath);
   }
-  log(`Backed up ${managedAbsPaths.length} managed file(s) to ${path38.relative(root, backupRoot)}.`);
+  log(`Backed up ${managedAbsPaths.length} managed file(s) to ${path39.relative(root, backupRoot)}.`);
 }
 async function runUndo(options) {
   const root = options.root ?? process.cwd();
@@ -6010,7 +6502,7 @@ async function runUndo(options) {
     log("Nothing to remove: no haus-managed files found in this directory.");
     return;
   }
-  const relTargets = managed.map((p) => path38.relative(root, p));
+  const relTargets = managed.map((p) => path39.relative(root, p));
   const summaryParts = [...relTargets];
   if (stripSettings) summaryParts.push(".claude/settings.json (haus rules only)");
   if (stripClaudeMd) summaryParts.push("CLAUDE.md (haus import block only)");
@@ -6032,9 +6524,9 @@ User-owned .claude/ files will be preserved.`
   }
   await backupManagedFilesBeforeUndo(root, managed);
   for (const abs of managed) {
-    if (!await fs31.pathExists(abs)) continue;
-    await fs31.remove(abs);
-    log(`Removed ${path38.relative(root, abs)}`);
+    if (!await fs32.pathExists(abs)) continue;
+    await fs32.remove(abs);
+    log(`Removed ${path39.relative(root, abs)}`);
   }
   if (stripSettings) await stripProjectSettings(root);
   if (stripClaudeMd) await stripRootClaudeMd(root);
@@ -6045,8 +6537,8 @@ User-owned .claude/ files will be preserved.`
 
 // src/install/uninstall.ts
 import crypto3 from "node:crypto";
-import path39 from "node:path";
-import fs32 from "fs-extra";
+import path40 from "node:path";
+import fs33 from "fs-extra";
 async function runUninstall(options = {}) {
   const { force = false } = options;
   const manifest = await readManifest();
@@ -6056,7 +6548,7 @@ async function runUninstall(options = {}) {
     return result;
   }
   for (const entry of manifest.files) {
-    const exists = fs32.pathExistsSync(entry.destPath);
+    const exists = fs33.pathExistsSync(entry.destPath);
     if (!exists) continue;
     const content2 = await readText(entry.destPath);
     if (content2 === void 0) continue;
@@ -6074,23 +6566,23 @@ async function runUninstall(options = {}) {
       result.skipped.push(entry.destPath);
       continue;
     }
-    await fs32.remove(entry.destPath);
-    await pruneEmptyDir(path39.dirname(entry.destPath));
+    await fs33.remove(entry.destPath);
+    await pruneEmptyDir(path40.dirname(entry.destPath));
     result.deleted.push(entry.destPath);
   }
   const settings = await readSettings();
   const stripped = stripHausHooks(stripHausAsk(stripHausAllow(stripHausDeny(settings))));
   await writeSettings(stripped);
   result.hooksStripped = true;
-  const hausDir = path39.join(globalClaudeDir(), "haus");
+  const hausDir = path40.join(globalClaudeDir(), "haus");
   const manifestPath2 = hausManifestPath();
-  if (fs32.pathExistsSync(manifestPath2)) {
-    await fs32.remove(manifestPath2);
+  if (fs33.pathExistsSync(manifestPath2)) {
+    await fs33.remove(manifestPath2);
   }
-  if (fs32.pathExistsSync(hausDir)) {
+  if (fs33.pathExistsSync(hausDir)) {
     try {
-      const remaining = await fs32.readdir(hausDir);
-      if (remaining.length === 0) await fs32.remove(hausDir);
+      const remaining = await fs33.readdir(hausDir);
+      if (remaining.length === 0) await fs33.remove(hausDir);
     } catch {
     }
   }
@@ -6123,12 +6615,12 @@ async function runUninstallCommand(options) {
 }
 
 // src/commands/update.ts
-import path41 from "node:path";
+import path42 from "node:path";
 
 // src/claude/refresh-project.ts
-import fs33 from "fs-extra";
+import fs34 from "fs-extra";
 async function isHausProject(root) {
-  if (await fs33.pathExists(hausPath(root, "recommendation.json"))) return true;
+  if (await fs34.pathExists(hausPath(root, "recommendation.json"))) return true;
   const result = await readJsonDetailed(claudePath(root, "settings.json"));
   if (result.status === "ok") return result.value._haus != null;
   return false;
@@ -6163,7 +6655,7 @@ function summarizeLockDiff(before, after) {
 
 // src/update/lockfile.ts
 import { mkdir, readFile as readFile2, copyFile } from "node:fs/promises";
-import path40 from "node:path";
+import path41 from "node:path";
 async function readLockSummary(root) {
   const lock = await readJson(hausPath(root, "haus.lock.json")) ?? [];
   const catalogRef = lock.find((item) => item.catalogRef)?.catalogRef ?? null;
@@ -6199,7 +6691,7 @@ async function applyLock(root) {
   try {
     const backupDir = hausPath(root, "backups");
     await mkdir(backupDir, { recursive: true });
-    await copyFile(lockPath, path40.join(backupDir, `haus.lock.${Date.now()}.json`));
+    await copyFile(lockPath, path41.join(backupDir, `haus.lock.${Date.now()}.json`));
   } catch {
   }
   const enriched = await Promise.all(
@@ -6221,7 +6713,7 @@ function diffLock(before, after) {
 }
 async function hasLocalOverrides(root) {
   try {
-    await readFile2(path40.join(root, ".claude", "settings.json"), "utf8");
+    await readFile2(path41.join(root, ".claude", "settings.json"), "utf8");
     return true;
   } catch {
     return false;
@@ -6237,7 +6729,7 @@ async function runUpdate(options) {
     return;
   }
   if (options.check) {
-    const pkgJson2 = await readJson(path41.join(packageRoot(), "package.json"));
+    const pkgJson2 = await readJson(path42.join(packageRoot(), "package.json"));
     const currentVersion2 = pkgJson2?.version ?? "0.0.0";
     const [status, npmVersion, latestCatalogTag, globalInstallDrift, catalogItems, lockItems] = await Promise.all([
       options.fast ? fastLockStatus(root) : checkLock(root),
@@ -6272,7 +6764,7 @@ async function runUpdate(options) {
     if (hasHashDrift || formerIdMigrations.length > 0) process.exitCode = 1;
     return;
   }
-  const pkgJson = await readJson(path41.join(packageRoot(), "package.json"));
+  const pkgJson = await readJson(path42.join(packageRoot(), "package.json"));
   const currentVersion = pkgJson?.version ?? "0.0.0";
   const npmStatus = await fetchNpmVersionStatus(currentVersion);
   if (npmStatus.updateAvailable && npmStatus.latest !== null) {
@@ -6311,7 +6803,7 @@ async function runFromHookCheck(root) {
   try {
     const summary = await readLockSummary(root);
     if (summary.count === 0) return;
-    const pkgJson = await readJson(path41.join(packageRoot(), "package.json"));
+    const pkgJson = await readJson(path42.join(packageRoot(), "package.json"));
     const currentVersion = pkgJson?.version ?? "0.0.0";
     const [npmVersion, latestCatalogTag] = await Promise.all([
       fetchNpmVersionStatus(currentVersion),
@@ -6383,11 +6875,11 @@ async function fastLockStatus(root) {
 }
 
 // src/commands/validate-catalog.ts
-import path43 from "node:path";
+import path44 from "node:path";
 
 // src/catalog/validate-core.ts
-import fs34 from "node:fs";
-import path42 from "node:path";
+import fs35 from "node:fs";
+import path43 from "node:path";
 var ITEM_SEMVER_RE = /^\d+\.\d+\.\d+$/;
 function auditForbiddenStacks(items) {
   const failures = [];
@@ -6497,14 +6989,14 @@ function checkRequiredFrontmatter(text, label) {
 }
 function readForAudit(absPath, label, failures) {
   try {
-    return fs34.readFileSync(absPath, "utf8");
+    return fs35.readFileSync(absPath, "utf8");
   } catch (err) {
     failures.push(`${label}: unreadable (${err instanceof Error ? err.message : String(err)})`);
     return null;
   }
 }
 function auditTemplateContent(manifestDir, absPath, itemId) {
-  const rel = path42.relative(manifestDir, absPath);
+  const rel = path43.relative(manifestDir, absPath);
   const failures = [];
   const text = readForAudit(absPath, `${itemId}: ${rel}`, failures);
   if (text === null) return failures;
@@ -6526,47 +7018,47 @@ function auditShippedFiles(manifestDir, items) {
   const failures = [];
   for (const item of items) {
     if (!item.path || !isSafeCatalogPath(item.path)) continue;
-    const absPath = path42.join(manifestDir, item.path);
+    const absPath = path43.join(manifestDir, item.path);
     if (item.type === "skill") {
-      const skillMd = path42.join(absPath, "SKILL.md");
-      if (!fs34.existsSync(skillMd)) {
-        failures.push(`${item.id}: missing ${path42.relative(manifestDir, skillMd)}`);
+      const skillMd = path43.join(absPath, "SKILL.md");
+      if (!fs35.existsSync(skillMd)) {
+        failures.push(`${item.id}: missing ${path43.relative(manifestDir, skillMd)}`);
         continue;
       }
       const text = readForAudit(skillMd, `${item.id}: SKILL.md`, failures);
       if (text === null) continue;
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: SKILL.md`));
       failures.push(
-        ...auditForbiddenTagsInText(text, `${item.id}: ${path42.relative(manifestDir, skillMd)}`)
+        ...auditForbiddenTagsInText(text, `${item.id}: ${path43.relative(manifestDir, skillMd)}`)
       );
     } else if (item.type === "agent") {
-      if (!fs34.existsSync(absPath)) {
+      if (!fs35.existsSync(absPath)) {
         failures.push(`${item.id}: missing agent file ${item.path}`);
         continue;
       }
-      const rel = path42.relative(manifestDir, absPath);
+      const rel = path43.relative(manifestDir, absPath);
       const text = readForAudit(absPath, `${item.id}: ${rel}`, failures);
       if (text === null) continue;
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: ${rel}`));
       failures.push(...auditForbiddenTagsInText(text, `${item.id}: ${rel}`));
     } else if (item.type === "template") {
-      if (!fs34.existsSync(absPath)) {
+      if (!fs35.existsSync(absPath)) {
         failures.push(`${item.id}: missing template file ${item.path}`);
         continue;
       }
       failures.push(...auditTemplateContent(manifestDir, absPath, item.id));
     } else if (item.type === "command") {
-      if (!fs34.existsSync(absPath)) {
+      if (!fs35.existsSync(absPath)) {
         failures.push(`${item.id}: missing command file ${item.path}`);
         continue;
       }
-      const rel = path42.relative(manifestDir, absPath);
+      const rel = path43.relative(manifestDir, absPath);
       const text = readForAudit(absPath, `${item.id}: ${rel}`, failures);
       if (text === null) continue;
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: ${rel}`));
       failures.push(...auditTemplateContent(manifestDir, absPath, item.id));
     } else if (item.type === "config") {
-      if (!fs34.existsSync(absPath)) {
+      if (!fs35.existsSync(absPath)) {
         failures.push(`${item.id}: missing config path ${item.path}`);
       }
     }
@@ -6582,7 +7074,7 @@ var DIR_ITEM_TYPE = {
 function walkMd(dir, fn, failures) {
   let entries;
   try {
-    entries = fs34.readdirSync(dir, { withFileTypes: true });
+    entries = fs35.readdirSync(dir, { withFileTypes: true });
   } catch (err) {
     failures.push(
       `${dir}: unreadable subtree (${err instanceof Error ? err.message : String(err)})`
@@ -6590,7 +7082,7 @@ function walkMd(dir, fn, failures) {
     return;
   }
   for (const entry of entries) {
-    const full = path42.join(dir, entry.name);
+    const full = path43.join(dir, entry.name);
     if (entry.isDirectory()) walkMd(full, fn, failures);
     else if (entry.name.endsWith(".md")) fn(full);
   }
@@ -6599,13 +7091,13 @@ function auditMarkdownContent(manifestDir, items) {
   const failures = [];
   const pathSourceMap = buildItemPathSourceMap(items);
   for (const dir of ["skills", "agents", "templates", "commands"]) {
-    const abs = path42.join(manifestDir, dir);
-    if (!fs34.existsSync(abs)) continue;
+    const abs = path43.join(manifestDir, dir);
+    if (!fs35.existsSync(abs)) continue;
     const dirType = DIR_ITEM_TYPE[dir] ?? "";
     walkMd(
       abs,
       (file) => {
-        const rel = path42.relative(manifestDir, file);
+        const rel = path43.relative(manifestDir, file);
         const text = readForAudit(file, rel, failures);
         if (text === null) return;
         const norm = rel.replace(/\\/g, "/");
@@ -6647,8 +7139,8 @@ async function runValidateCatalog(manifestPath2) {
     process.exitCode = 1;
     return;
   }
-  const abs = path43.resolve(process.cwd(), manifestPath2);
-  const manifestDir = path43.dirname(abs);
+  const abs = path44.resolve(process.cwd(), manifestPath2);
+  const manifestDir = path44.dirname(abs);
   const data = await readJson(abs);
   if (!data?.items) {
     error(`Could not read catalog manifest at ${abs}`);
@@ -6666,7 +7158,7 @@ async function runValidateCatalog(manifestPath2) {
 
 // src/commands/workspace.ts
 import { existsSync as existsSync6, statSync as statSync3 } from "node:fs";
-import path51 from "node:path";
+import path52 from "node:path";
 
 // src/commands/workspace/aggregate.ts
 async function writeWorkspaceArtifacts(workspaceRoot, repos, relationships = []) {
@@ -6720,7 +7212,7 @@ ${summaries.map(
 }
 
 // src/commands/workspace/config.ts
-import path44 from "node:path";
+import path45 from "node:path";
 import YAML from "yaml";
 var WORKSPACE_FILE = "haus.workspace.yaml";
 function parseWorkspaceConfig(text) {
@@ -6743,11 +7235,11 @@ function parseWorkspaceConfig(text) {
   };
 }
 async function readWorkspaceConfig(workspaceRoot) {
-  return parseWorkspaceConfig(await readText(path44.join(workspaceRoot, WORKSPACE_FILE)));
+  return parseWorkspaceConfig(await readText(path45.join(workspaceRoot, WORKSPACE_FILE)));
 }
 
 // src/commands/workspace/discover.ts
-import path45 from "node:path";
+import path46 from "node:path";
 import fg4 from "fast-glob";
 import YAML2 from "yaml";
 var DEFAULT_MAX_DEPTH = 3;
@@ -6778,8 +7270,8 @@ async function discoverRepos(workspaceRoot, maxDepth = DEFAULT_MAX_DEPTH) {
   const gitDirs = /* @__PURE__ */ new Set();
   const manifestDirs = /* @__PURE__ */ new Set();
   for (const match of matches) {
-    const base = path45.posix.basename(match);
-    const dir = path45.posix.dirname(match);
+    const base = path46.posix.basename(match);
+    const dir = path46.posix.dirname(match);
     const owner = dir === "." ? "." : dir;
     if (base === ".git") gitDirs.add(owner);
     else manifestDirs.add(owner);
@@ -6795,9 +7287,9 @@ async function discoverRepos(workspaceRoot, maxDepth = DEFAULT_MAX_DEPTH) {
   }
   repoRoots.sort((a, b) => a.localeCompare(b));
   return mapWithConcurrency(repoRoots, async (relDir) => {
-    const absDir = path45.resolve(workspaceRoot, relDir);
-    const pkg = await readJson(path45.join(absDir, "package.json"));
-    const name = typeof pkg?.name === "string" && pkg.name.length > 0 ? pkg.name : path45.basename(relDir === "." ? workspaceRoot : absDir);
+    const absDir = path46.resolve(workspaceRoot, relDir);
+    const pkg = await readJson(path46.join(absDir, "package.json"));
+    const name = typeof pkg?.name === "string" && pkg.name.length > 0 ? pkg.name : path46.basename(relDir === "." ? workspaceRoot : absDir);
     let role = "auto";
     try {
       const scan = await scanProject(absDir);
@@ -6840,7 +7332,7 @@ function renderWorkspaceYaml(config) {
   });
 }
 async function runDiscover(workspaceRoot, opts = {}) {
-  const yamlPath = path45.join(workspaceRoot, "haus.workspace.yaml");
+  const yamlPath = path46.join(workspaceRoot, "haus.workspace.yaml");
   const existingText = await readText(yamlPath);
   const existing = parseWorkspaceConfig(existingText);
   if (existingText && !existing) {
@@ -6877,18 +7369,18 @@ async function runDiscover(workspaceRoot, opts = {}) {
 
 // src/commands/workspace/doctor.ts
 import { existsSync as existsSync3 } from "node:fs";
-import path47 from "node:path";
+import path48 from "node:path";
 
 // src/commands/workspace/manifest.ts
 import { readFileSync as readFileSync3 } from "node:fs";
-import path46 from "node:path";
+import path47 from "node:path";
 var MANIFEST_FILE = "workspace.manifest.json";
 function manifestPath(workspaceRoot) {
   return hausPath(workspaceRoot, MANIFEST_FILE);
 }
 function hausVersion() {
   try {
-    const pkg = JSON.parse(readFileSync3(path46.join(packageRoot(), "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync3(path47.join(packageRoot(), "package.json"), "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -6955,7 +7447,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
   const manifestByName = new Map(manifest.repos.map((r) => [r.name, r]));
   const catalogRefByRepo = [];
   for (const repo of config.repos) {
-    const repoRoot = path47.resolve(workspaceRoot, repo.path);
+    const repoRoot = path48.resolve(workspaceRoot, repo.path);
     const entry = manifestByName.get(repo.name);
     if (!entry) {
       flag({
@@ -7038,11 +7530,11 @@ function emit(args) {
 
 // src/commands/workspace/setup.ts
 import { existsSync as existsSync4, statSync } from "node:fs";
-import path49 from "node:path";
+import path50 from "node:path";
 
 // src/claude/write-workspace-claude-md.ts
-import path48 from "node:path";
-import fs35 from "fs-extra";
+import path49 from "node:path";
+import fs36 from "fs-extra";
 function buildWorkspaceImportBlock(client, members) {
   const memberLines = members.map((m) => `- ${m.name} (${m.path})`);
   const body = [
@@ -7060,11 +7552,11 @@ ${BLOCK_END}`;
 async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
   const block = buildWorkspaceImportBlock(opts.client, opts.members);
   const dryRun = opts.dryRun ?? false;
-  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path48.join(workspaceRoot, "CLAUDE.md");
+  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path49.join(workspaceRoot, "CLAUDE.md");
   const say = opts.quiet ? () => {
   } : log;
-  const existed = await fs35.pathExists(filePath);
-  const prev = existed ? await fs35.readFile(filePath, "utf8") : "";
+  const existed = await fs36.pathExists(filePath);
+  const prev = existed ? await fs36.readFile(filePath, "utf8") : "";
   const next = opts.collision ? `${block}
 ` : injectHausBlock(prev, block);
   const printable = displayPath(workspaceRoot, filePath);
@@ -7091,20 +7583,20 @@ async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
 
 // src/commands/workspace/setup.ts
 function resolveWorkspaceRoot(start = process.cwd()) {
-  let dir = path49.resolve(start);
+  let dir = path50.resolve(start);
   for (; ; ) {
-    if (existsSync4(path49.join(dir, WORKSPACE_FILE))) return dir;
-    const parent = path49.dirname(dir);
-    if (parent === dir) return path49.resolve(start);
+    if (existsSync4(path50.join(dir, WORKSPACE_FILE))) return dir;
+    const parent = path50.dirname(dir);
+    if (parent === dir) return path50.resolve(start);
     dir = parent;
   }
 }
 function isRootRepo(workspaceRoot, repoPath) {
-  return path49.resolve(workspaceRoot, repoPath) === path49.resolve(workspaceRoot);
+  return path50.resolve(workspaceRoot, repoPath) === path50.resolve(workspaceRoot);
 }
 async function runWorkspaceSetup(workspaceRoot, options = {}) {
   const apply = options.write ?? false;
-  const configText = await readText(path49.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path50.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
@@ -7131,7 +7623,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
   const statuses = [];
   const aggregateInputs = [];
   for (const repo of repos) {
-    const repoRoot = path49.resolve(workspaceRoot, repo.path);
+    const repoRoot = path50.resolve(workspaceRoot, repo.path);
     say(`
 \u2192 ${repo.name} (${repo.path})`);
     try {
@@ -7202,7 +7694,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
       const status = statusByName.get(repo.name);
       const role = repo.role ?? status?.roles?.[0] ?? "auto";
       if (status?.status === "ok") {
-        const lock = await checkLock(path49.resolve(workspaceRoot, repo.path));
+        const lock = await checkLock(path50.resolve(workspaceRoot, repo.path));
         manifestRepos.push({
           name: repo.name,
           path: repo.path,
@@ -7266,8 +7758,8 @@ Workspace setup complete: ${ok} ok, ${failed} failed. Wrote ${written.length} fi
 
 // src/commands/workspace/undo.ts
 import { existsSync as existsSync5, statSync as statSync2 } from "node:fs";
-import path50 from "node:path";
-import fs36 from "fs-extra";
+import path51 from "node:path";
+import fs37 from "fs-extra";
 var WORKSPACE_AGGREGATE_FILES = [
   "workspace-summary.json",
   "dependency-ownership-map.json",
@@ -7295,7 +7787,7 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
   }
   let anyRepoFailed = false;
   for (const repo of config.repos) {
-    const repoRoot = path50.resolve(workspaceRoot, repo.path);
+    const repoRoot = path51.resolve(workspaceRoot, repo.path);
     log(`
 \u2192 ${repo.name} (${repo.path})`);
     try {
@@ -7310,31 +7802,31 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
   }
   for (const rel of WORKSPACE_AGGREGATE_FILES) {
     const abs = hausPath(workspaceRoot, rel);
-    if (await fs36.pathExists(abs)) {
-      await fs36.remove(abs);
-      log(`Removed ${path50.relative(workspaceRoot, abs)}`);
+    if (await fs37.pathExists(abs)) {
+      await fs37.remove(abs);
+      log(`Removed ${path51.relative(workspaceRoot, abs)}`);
     }
   }
   const manifestFile = manifestPath(workspaceRoot);
-  if (await fs36.pathExists(manifestFile)) {
-    await fs36.remove(manifestFile);
-    log(`Removed ${path50.relative(workspaceRoot, manifestFile)}`);
+  if (await fs37.pathExists(manifestFile)) {
+    await fs37.remove(manifestFile);
+    log(`Removed ${path51.relative(workspaceRoot, manifestFile)}`);
   }
   const workspaceMdPath = hausPath(workspaceRoot, "WORKSPACE.md");
-  if (await fs36.pathExists(workspaceMdPath)) {
-    await fs36.remove(workspaceMdPath);
-    log(`Removed ${path50.relative(workspaceRoot, workspaceMdPath)}`);
+  if (await fs37.pathExists(workspaceMdPath)) {
+    await fs37.remove(workspaceMdPath);
+    log(`Removed ${path51.relative(workspaceRoot, workspaceMdPath)}`);
   } else {
-    const claudeMdPath = path50.join(workspaceRoot, "CLAUDE.md");
+    const claudeMdPath = path51.join(workspaceRoot, "CLAUDE.md");
     if (existsSync5(claudeMdPath)) {
       const prev = await readText(claudeMdPath);
       if (prev?.includes(BLOCK_BEGIN)) {
         const next = stripHausBlock(prev);
         if (next.length === 0) {
-          await fs36.remove(claudeMdPath);
+          await fs37.remove(claudeMdPath);
           log("Removed CLAUDE.md (only contained the workspace haus import block).");
         } else {
-          await fs36.writeFile(claudeMdPath, next, "utf8");
+          await fs37.writeFile(claudeMdPath, next, "utf8");
           log("Removed haus import block from CLAUDE.md (user content preserved).");
         }
       }
@@ -7377,7 +7869,7 @@ relationships: []
   log("Workspace initialized.");
 }
 async function scanWorkspace(workspaceRoot, opts) {
-  const configText = await readText(path51.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path52.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
@@ -7399,7 +7891,7 @@ async function scanWorkspace(workspaceRoot, opts) {
   const inputs = [];
   const failures = [];
   for (const repo of config.repos) {
-    const repoRoot = path51.resolve(workspaceRoot, repo.path);
+    const repoRoot = path52.resolve(workspaceRoot, repo.path);
     try {
       if (!existsSync6(repoRoot) || !statSync3(repoRoot).isDirectory()) {
         throw new Error("path is not a directory");
@@ -7462,7 +7954,7 @@ async function runWorkspace(action, options = {}) {
 // src/cli.ts
 function cliVersion() {
   try {
-    const pkgPath = path52.join(packageRoot(), "package.json");
+    const pkgPath = path53.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
@@ -7472,7 +7964,7 @@ function cliVersion() {
 var program = new Command();
 function validateRuntimeNodeVersion() {
   try {
-    const pkgPath = path52.join(packageRoot(), "package.json");
+    const pkgPath = path53.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
     const requiredRange = pkg.engines?.node;
     if (requiredRange && !satisfiesVersion(process.version, requiredRange)) {
@@ -7503,8 +7995,17 @@ program.command("apply").option("--dry-run").option("--write").option("--select"
 ).option(
   "--refill-config",
   "Fill still-blank fields in an existing workflow-config.md without touching edited ones"
-).option("--force", "Overwrite user-modified managed workflow files").action(runApply);
+).option("--force", "Overwrite user-modified managed workflow files").option(
+  "--prune",
+  "Remove lock-tracked catalog items no longer in the current recommendation (hash-gated, backed up first)"
+).action(runApply);
 program.command("undo").option("-y, --yes", "Skip confirmation").action(runUndo);
+var backups = program.command("backups");
+backups.command("list").description("List backups under .haus-workflow/backups/").action(() => runBackups("list"));
+backups.command("restore <id>").description("Restore a specific backup by id (see `haus backups list`)").option("-y, --yes", "Skip confirmation").action((id, opts) => runBackups("restore", { id, yes: opts.yes }));
+backups.command("prune").description("Delete old backups by age and/or count (requires --older-than or --keep)").option("--older-than <days>", "Remove backups older than N days").option("--keep <n>", "Keep only the N most recent backups").option("-y, --yes", "Skip confirmation").action(
+  (opts) => runBackups("prune", { olderThan: opts.olderThan, keep: opts.keep, yes: opts.yes })
+);
 program.command("explain-recommendation").option("--json").action(runExplainRecommendation);
 program.command("init").option("--json").action(runInit);
 program.command("clone").description("Clone a single git repository by URL").argument("<url>", "Git URL to clone").argument("[dir]", "Target directory (default: repo name derived from the URL)").option("--dry-run", "Print what would happen without cloning").action(