npm - @haus-tech/haus-workflow - Versions diffs - 1.5.0 → 1.5.1 - Mend

@haus-tech/haus-workflow 1.5.0 → 1.5.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/CHANGELOG.md +9 -0
package/dist/cli.js +564 -296
package/library/catalog/manifest.json +4 -4
package/package.json +2 -2

package/dist/cli.js CHANGED Viewed

@@ -60,7 +60,7 @@ var init_exec = __esm({
 // src/cli.ts
 import { readFileSync as readFileSync5 } from "node:fs";
-import path70 from "node:path";
+import path71 from "node:path";
 import { Command } from "commander";
 // src/commands/apply.ts
@@ -2103,8 +2103,8 @@ function buildDenyRules() {
   for (const command of DENY_COMMANDS) {
     rules.push(`Bash(${command}:*)`);
   }
-  for (const path71 of DENY_PATHS) {
-    const pattern = DENY_DIRS.has(path71) ? `${path71}/**` : path71;
+  for (const path72 of DENY_PATHS) {
+    const pattern = DENY_DIRS.has(path72) ? `${path72}/**` : path72;
     for (const tool of FILE_TOOLS) {
       rules.push(`${tool}(${pattern})`);
     }
@@ -4151,19 +4151,133 @@ async function runCatalogAudit() {
 }
 // src/commands/doctor.ts
-import path37 from "node:path";
+import path38 from "node:path";
 import fs29 from "fs-extra";
 // src/decisions/doctor.ts
-import path28 from "node:path";
+import path29 from "node:path";
 import fs26 from "fs-extra";
 // src/decisions/check.ts
-import path27 from "node:path";
+import path28 from "node:path";
 import fs25 from "fs-extra";
+// src/decisions/dep-bump.ts
+var DEP_SECTIONS = [
+  "dependencies",
+  "devDependencies",
+  "peerDependencies",
+  "optionalDependencies"
+];
+function isRecord(value) {
+  return value != null && typeof value === "object" && !Array.isArray(value);
+}
+function extractDepMap(pkg) {
+  const map = /* @__PURE__ */ new Map();
+  if (!isRecord(pkg)) return map;
+  for (const section of DEP_SECTIONS) {
+    const block = pkg[section];
+    if (!isRecord(block)) continue;
+    for (const [name, ver] of Object.entries(block)) {
+      if (typeof ver === "string") map.set(`${section}:${name}`, ver);
+    }
+  }
+  return map;
+}
+function stripDepSections(pkg) {
+  const out = { ...pkg };
+  for (const section of DEP_SECTIONS) delete out[section];
+  return out;
+}
+function mapsEqualKeys(a, b) {
+  if (a.size !== b.size) return false;
+  for (const k of a.keys()) if (!b.has(k)) return false;
+  return true;
+}
+function isDependencyBumpOnly(beforeText, afterText) {
+  let before;
+  let after;
+  try {
+    before = JSON.parse(beforeText);
+    after = JSON.parse(afterText);
+  } catch {
+    return false;
+  }
+  if (!isRecord(before) || !isRecord(after)) return false;
+  const beforeDeps = extractDepMap(before);
+  const afterDeps = extractDepMap(after);
+  if (beforeDeps.size === 0 && afterDeps.size === 0) return false;
+  if (!mapsEqualKeys(beforeDeps, afterDeps)) return false;
+  if (JSON.stringify(stripDepSections(before)) !== JSON.stringify(stripDepSections(after))) {
+    return false;
+  }
+  for (const [key, ver] of beforeDeps) {
+    if (afterDeps.get(key) !== ver) return true;
+  }
+  return false;
+}
 // src/decisions/diff.ts
 init_exec();
+import path25 from "node:path";
+function isPackageJsonPath(file) {
+  return file === "package.json" || file.endsWith("/package.json");
+}
+async function readBlob(root, spec) {
+  const result = await runGit(["show", spec], { cwd: root });
+  return result.exitCode === 0 ? result.stdout : null;
+}
+function parseDiffRange(range) {
+  const tripleIdx = range.indexOf("...");
+  if (tripleIdx !== -1) {
+    return {
+      left: range.slice(0, tripleIdx) || "HEAD",
+      right: range.slice(tripleIdx + 3) || "HEAD",
+      triple: true
+    };
+  }
+  const idx = range.indexOf("..");
+  if (idx !== -1) {
+    return {
+      left: range.slice(0, idx) || "HEAD",
+      right: range.slice(idx + 2) || "HEAD",
+      triple: false
+    };
+  }
+  return null;
+}
+async function getCurrentBranch(root) {
+  const result = await runGit(["rev-parse", "--abbrev-ref", "HEAD"], { cwd: root });
+  if (result.exitCode !== 0) return void 0;
+  const name = result.stdout.trim();
+  if (name && name !== "HEAD") return name;
+  const gha = process.env.GITHUB_HEAD_REF?.trim();
+  if (gha) return gha;
+  return void 0;
+}
+async function resolvePackageJsonPair(root, file, opts) {
+  const empty = "{}";
+  if (opts.staged) {
+    const before2 = await readBlob(root, `HEAD:${file}`) ?? empty;
+    const after2 = await readBlob(root, `:${file}`) ?? empty;
+    return { before: before2, after: after2 };
+  }
+  const range = opts.range ?? "HEAD";
+  const parsed = parseDiffRange(range);
+  if (parsed) {
+    let leftRev = parsed.left;
+    if (parsed.triple) {
+      const mb = await runGit(["merge-base", parsed.left, parsed.right], { cwd: root });
+      leftRev = mb.exitCode === 0 ? mb.stdout.trim() : parsed.left;
+    }
+    const before2 = await readBlob(root, `${leftRev}:${file}`) ?? empty;
+    const after2 = await readBlob(root, `${parsed.right}:${file}`) ?? empty;
+    return { before: before2, after: after2 };
+  }
+  const before = await readBlob(root, `${range}:${file}`) ?? empty;
+  const after = await readText(path25.join(root, file)) ?? empty;
+  return { before, after };
+}
 async function collectDiffStats(root, opts) {
   const gitArgs = opts.staged ? ["diff", "--cached", "--name-only"] : ["diff", "--name-only", opts.range ?? "HEAD"];
   const names = await runGit(gitArgs, { cwd: root });
@@ -4180,9 +4294,23 @@ async function collectDiffStats(root, opts) {
     if (!Number.isNaN(added)) linesAdded += added;
     if (!Number.isNaN(removed)) linesRemoved += removed;
   }
-  return { files, linesAdded, linesRemoved };
+  const packageJsonPairs = {};
+  for (const file of files) {
+    if (!isPackageJsonPath(file)) continue;
+    packageJsonPairs[file] = await resolvePackageJsonPair(root, file, opts);
+  }
+  return {
+    files,
+    linesAdded,
+    linesRemoved,
+    ...Object.keys(packageJsonPairs).length > 0 ? { packageJsonPairs } : {}
+  };
 }
+// src/decisions/local-exemptions.ts
+var LOCAL_EXEMPT_GLOBS = ["library/catalog/**"];
+var LOCAL_EXEMPT_BRANCH_PATTERN = /^chore\/sync-catalog/;
 // src/decisions/match.ts
 function segmentToRegex(segment) {
   if (segment === "**") return ".*";
@@ -4210,26 +4338,29 @@ function matchesAnyGlob(filePath, patterns) {
   return patterns.some((p) => matchesPathGlob(filePath, p));
 }
 function matchesAnyRegex(filePath, patterns) {
+  return firstMatchingRegex(filePath, patterns) != null;
+}
+function firstMatchingRegex(filePath, patterns) {
   const norm = filePath.replace(/\\/g, "/");
-  return patterns.some((p) => new RegExp(p).test(norm));
+  return patterns.find((p) => new RegExp(p).test(norm));
 }
 // src/decisions/paths.ts
-import path25 from "node:path";
+import path26 from "node:path";
 import fs23 from "fs-extra";
 async function resolveDecisionsDir(root) {
-  const primary = path25.join(root, DECISIONS_TRIGGERS.decisionsDir);
+  const primary = path26.join(root, DECISIONS_TRIGGERS.decisionsDir);
   if (await fs23.pathExists(primary)) return primary;
-  const legacy = path25.join(root, DECISIONS_TRIGGERS.legacyDecisionsDir ?? "docs/adr");
+  const legacy = path26.join(root, DECISIONS_TRIGGERS.legacyDecisionsDir ?? "docs/adr");
   if (await fs23.pathExists(legacy)) return legacy;
   return primary;
 }
 function relativeDecisionPath(decisionsDir, root) {
-  return path25.relative(root, decisionsDir).replace(/\\/g, "/");
+  return path26.relative(root, decisionsDir).replace(/\\/g, "/");
 }
 // src/decisions/validate.ts
-import path26 from "node:path";
+import path27 from "node:path";
 import fs24 from "fs-extra";
 function validateDecisionContent(content2) {
   const errors = [];
@@ -4259,14 +4390,14 @@ function decisionNumberFromFile(name) {
   return match?.[1] ?? null;
 }
 async function validateIndexSync(decisionsDir, decisionFiles) {
-  const readmePath = path26.join(decisionsDir, "README.md");
+  const readmePath = path27.join(decisionsDir, "README.md");
   if (!await fs24.pathExists(readmePath)) {
     return ["docs/decisions/README.md is missing"];
   }
   const readme = await readText(readmePath) ?? "";
   const errors = [];
   for (const file of decisionFiles) {
-    const num = decisionNumberFromFile(path26.basename(file));
+    const num = decisionNumberFromFile(path27.basename(file));
     if (num && !indexReferencesNumber(readme, num)) {
       errors.push(`README.md missing index row for ADR-${num}`);
     }
@@ -4275,8 +4406,35 @@ async function validateIndexSync(decisionsDir, decisionFiles) {
 }
 // src/decisions/check.ts
+var MANIFEST_LOCK_BASENAMES = /* @__PURE__ */ new Set([
+  "package.json",
+  "yarn.lock",
+  "pnpm-lock.yaml",
+  "package-lock.json"
+]);
 function isExempt(file) {
-  return matchesAnyGlob(file, DECISIONS_TRIGGERS.exemptGlobs);
+  return matchesAnyGlob(file, DECISIONS_TRIGGERS.exemptGlobs) || matchesAnyGlob(file, [...LOCAL_EXEMPT_GLOBS]);
+}
+function isManifestOrLockfile(file) {
+  const base = file.split("/").pop() ?? file;
+  return MANIFEST_LOCK_BASENAMES.has(base);
+}
+function isPackageJsonPath2(file) {
+  return file === "package.json" || file.endsWith("/package.json");
+}
+function isPureDependencyBumpDiff(stats) {
+  const relevant = stats.files.filter((f) => !isExempt(f));
+  if (relevant.length === 0) return false;
+  if (relevant.some((f) => !isManifestOrLockfile(f))) return false;
+  const pkgJsons = relevant.filter(isPackageJsonPath2);
+  if (pkgJsons.length === 0) {
+    return true;
+  }
+  const pairs = stats.packageJsonPairs ?? {};
+  return pkgJsons.every((f) => {
+    const pair = pairs[f];
+    return pair != null && isDependencyBumpOnly(pair.before, pair.after);
+  });
 }
 function countTopLevelDirs(files) {
   const dirs = /* @__PURE__ */ new Set();
@@ -4286,21 +4444,35 @@ function countTopLevelDirs(files) {
   }
   return dirs.size;
 }
-function isDecisionTriggered(stats) {
-  const relevant = stats.files.filter((f) => !isExempt(f));
-  if (relevant.length === 0) return false;
+function firstMatchingGlob(file, globs) {
+  return globs.find((g) => matchesPathGlob(file, g));
+}
+function explainDecisionTrigger(stats) {
+  let relevant = stats.files.filter((f) => !isExempt(f));
+  if (relevant.length === 0) return [];
+  if (isPureDependencyBumpDiff(stats)) {
+    relevant = relevant.filter((f) => !isManifestOrLockfile(f));
+    if (relevant.length === 0) return [];
+  }
   for (const file of relevant) {
-    if (matchesAnyGlob(file, DECISIONS_TRIGGERS.pathGlobs)) return true;
-    if (matchesAnyRegex(file, DECISIONS_TRIGGERS.pathRegex)) return true;
+    const glob = firstMatchingGlob(file, DECISIONS_TRIGGERS.pathGlobs);
+    if (glob) {
+      return [`matched pathGlobs: ${glob}`];
+    }
+    const regex = firstMatchingRegex(file, DECISIONS_TRIGGERS.pathRegex);
+    if (regex) {
+      return [`matched pathRegex: ${regex}`];
+    }
   }
   const totalLines = stats.linesAdded + stats.linesRemoved;
-  if (relevant.length >= DECISIONS_TRIGGERS.minFilesChanged && countTopLevelDirs(relevant) >= 2) {
-    return true;
+  const dirs = countTopLevelDirs(relevant);
+  if (relevant.length >= DECISIONS_TRIGGERS.minFilesChanged && dirs >= 2) {
+    return [`size threshold: ${relevant.length} files across ${dirs} top-level dirs`];
   }
   if (totalLines >= DECISIONS_TRIGGERS.minLinesChanged && relevant.some((f) => !f.startsWith("docs/"))) {
-    return true;
+    return [`size threshold: ${totalLines} lines changed (non-docs)`];
   }
-  return false;
+  return [];
 }
 function isSecurityTriggered(stats) {
   const relevant = stats.files.filter((f) => !isExempt(f));
@@ -4320,26 +4492,27 @@ async function checkSatisfaction(input2) {
   const errors = [];
   const decisionsPrefix = `${input2.decisionsRel}/`;
   const newDecisionFiles = input2.changedFiles.filter(
-    (f) => f.startsWith(decisionsPrefix) && isDecisionFileName(path27.basename(f))
+    (f) => f.startsWith(decisionsPrefix) && isDecisionFileName(path28.basename(f))
   );
   if (newDecisionFiles.length === 0) {
     errors.push(`no new or updated decision under ${input2.decisionsRel}/`);
     return errors;
   }
-  const decisionsDir = path27.join(input2.root, input2.decisionsRel);
+  const decisionsDir = path28.join(input2.root, input2.decisionsRel);
   for (const rel of newDecisionFiles) {
-    const abs = path27.join(input2.root, rel);
+    const abs = path28.join(input2.root, rel);
     const content2 = await readText(abs) ?? "";
     const valid = validateDecisionContent(content2);
     if (!valid.ok) errors.push(...valid.errors.map((e) => `${rel}: ${e}`));
   }
   const indexErrors = await validateIndexSync(
     decisionsDir,
-    newDecisionFiles.map((f) => path27.basename(f))
+    newDecisionFiles.map((f) => path28.basename(f))
   );
   errors.push(...indexErrors);
   return errors;
 }
+var WAYS_OUT = "Write an ADR under docs/decisions/ (haus decisions suggest), or use [adr-skip] for non-security changes.";
 async function runDecisionsCheck(root, opts = {}) {
   const reasons = [];
   if (await readGateMode(root) === "off") {
@@ -4351,8 +4524,18 @@ async function runDecisionsCheck(root, opts = {}) {
     };
   }
   const stats = await collectDiffStats(root, opts);
-  const triggered = isDecisionTriggered(stats);
   const securityTriggered = isSecurityTriggered(stats);
+  const branch = await getCurrentBranch(root);
+  if (branch != null && LOCAL_EXEMPT_BRANCH_PATTERN.test(branch) && !securityTriggered) {
+    return {
+      triggered: false,
+      satisfied: true,
+      reasons: ["catalog-sync branch \u2014 exempt"],
+      securityTriggered: false
+    };
+  }
+  const triggerReasons = explainDecisionTrigger(stats);
+  const triggered = triggerReasons.length > 0;
   if (!triggered) {
     return {
       triggered: false,
@@ -4361,6 +4544,7 @@ async function runDecisionsCheck(root, opts = {}) {
       securityTriggered
     };
   }
+  reasons.push(...triggerReasons);
   const skipText = `${opts.prBody ?? ""}
 ${opts.commitMessages ?? ""}`;
   if (hasSkipToken(skipText) && !securityTriggered) {
@@ -4379,7 +4563,7 @@ ${opts.commitMessages ?? ""}`;
     changedFiles: stats.files
   });
   if (satisfactionErrors.length > 0 && decisionsRel !== legacyRel) {
-    const legacyExists = await fs25.pathExists(path27.join(root, legacyRel));
+    const legacyExists = await fs25.pathExists(path28.join(root, legacyRel));
     if (legacyExists && !await fs25.pathExists(decisionsDir)) {
       satisfactionErrors = await checkSatisfaction({
         root,
@@ -4389,14 +4573,16 @@ ${opts.commitMessages ?? ""}`;
     }
   }
   if (satisfactionErrors.length === 0) {
+    reasons.push("decision record present");
     return {
       triggered: true,
       satisfied: true,
-      reasons: ["decision record present"],
+      reasons,
       securityTriggered
     };
   }
   reasons.push(...satisfactionErrors);
+  reasons.push(WAYS_OUT);
   return { triggered: true, satisfied: false, reasons, securityTriggered };
 }
 async function listDecisionNumbers(decisionsDir) {
@@ -4408,8 +4594,8 @@ async function listDecisionNumbers(decisionsDir) {
 // src/decisions/doctor.ts
 async function auditDecisionsLayout(root) {
   const findings = [];
-  const primary = path28.join(root, DECISIONS_TRIGGERS.decisionsDir);
-  const legacy = path28.join(root, DECISIONS_TRIGGERS.legacyDecisionsDir ?? "docs/adr");
+  const primary = path29.join(root, DECISIONS_TRIGGERS.decisionsDir);
+  const legacy = path29.join(root, DECISIONS_TRIGGERS.legacyDecisionsDir ?? "docs/adr");
   const hasPrimary = await fs26.pathExists(primary);
   const hasLegacy = await fs26.pathExists(legacy);
   if (!hasPrimary && hasLegacy) {
@@ -4424,7 +4610,7 @@ async function auditDecisionsLayout(root) {
   if (!hasPrimary) return findings;
   const decisionsDir = await resolveDecisionsDir(root);
   const rel = relativeDecisionPath(decisionsDir, root);
-  const readmePath = path28.join(decisionsDir, "README.md");
+  const readmePath = path29.join(decisionsDir, "README.md");
   if (!await fs26.pathExists(readmePath)) {
     findings.push({
       level: "advisory",
@@ -4449,7 +4635,7 @@ async function auditDecisionsLayout(root) {
       });
     }
   }
-  const claude = await readText(path28.join(root, "CLAUDE.md"));
+  const claude = await readText(path29.join(root, "CLAUDE.md"));
   if (claude && !claude.includes(`@${rel}/README.md`)) {
     findings.push({
       level: "advisory",
@@ -4480,11 +4666,11 @@ async function auditDecisionsLayout(root) {
 }
 // src/scanner/read-context.ts
-import path36 from "node:path";
+import path37 from "node:path";
 import fs28 from "fs-extra";
 // src/commands/workspace/config.ts
-import path29 from "node:path";
+import path30 from "node:path";
 import YAML from "yaml";
 var WORKSPACE_FILE = "haus.workspace.yaml";
 function parseWorkspaceConfig(text) {
@@ -4507,11 +4693,11 @@ function parseWorkspaceConfig(text) {
   };
 }
 async function readWorkspaceConfig(workspaceRoot) {
-  return parseWorkspaceConfig(await readText(path29.join(workspaceRoot, WORKSPACE_FILE)));
+  return parseWorkspaceConfig(await readText(path30.join(workspaceRoot, WORKSPACE_FILE)));
 }
 // src/workspace/members.ts
-import path30 from "node:path";
+import path31 from "node:path";
 var REPOS_MANIFEST_FILE = "repos.manifest.json";
 var REPOS_LOCAL_FILE = "repos.local.json";
 var MemberConfigError = class extends Error {
@@ -4524,11 +4710,11 @@ var MemberConfigError = class extends Error {
 };
 function resolveAbsPath(workspaceRoot, folder, overrides) {
   const override = overrides[folder];
-  if (override) return path30.resolve(workspaceRoot, override);
-  return path30.resolve(workspaceRoot, folder);
+  if (override) return path31.resolve(workspaceRoot, override);
+  return path31.resolve(workspaceRoot, folder);
 }
 async function readPathOverrides(workspaceRoot) {
-  const filePath = path30.join(workspaceRoot, REPOS_LOCAL_FILE);
+  const filePath = path31.join(workspaceRoot, REPOS_LOCAL_FILE);
   const result = await readJsonDetailed(filePath);
   if (result.status === "missing") return {};
   if (result.status === "invalid") throw new MemberConfigError(filePath, "invalid JSON");
@@ -4544,7 +4730,7 @@ async function readPathOverrides(workspaceRoot) {
   return overrides;
 }
 async function readFromWorkspaceYaml(workspaceRoot, overrides) {
-  const filePath = path30.join(workspaceRoot, WORKSPACE_FILE);
+  const filePath = path31.join(workspaceRoot, WORKSPACE_FILE);
   const text = await readText(filePath);
   if (text === void 0) return void 0;
   const config = parseWorkspaceConfig(text);
@@ -4557,7 +4743,7 @@ async function readFromWorkspaceYaml(workspaceRoot, overrides) {
   }));
 }
 async function readFromManifest(workspaceRoot, overrides) {
-  const filePath = path30.join(workspaceRoot, REPOS_MANIFEST_FILE);
+  const filePath = path31.join(workspaceRoot, REPOS_MANIFEST_FILE);
   const result = await readJsonDetailed(filePath);
   if (result.status === "missing") return void 0;
   if (result.status === "invalid") throw new MemberConfigError(filePath, "invalid JSON");
@@ -4599,16 +4785,16 @@ async function readMembers(rootInfo) {
 }
 // src/scanner/scan-project.ts
-import path35 from "node:path";
+import path36 from "node:path";
 // src/utils/audit-checks.ts
-function isRecord(v) {
+function isRecord2(v) {
   return typeof v === "object" && v !== null;
 }
 // src/utils/git-root.ts
 init_exec();
-import path31 from "node:path";
+import path32 from "node:path";
 function fallback(start) {
   return {
     cwd: start,
@@ -4624,11 +4810,11 @@ function fallback(start) {
 async function resolveAbsoluteGitPath(flag, cwd, repoRoot) {
   const withFormat = await runGit(["rev-parse", "--path-format=absolute", flag], { cwd });
   const raw = withFormat.exitCode === 0 ? withFormat.stdout.trim() : "";
-  if (raw && path31.isAbsolute(raw)) return path31.resolve(raw);
+  if (raw && path32.isAbsolute(raw)) return path32.resolve(raw);
   const plain = await runGit(["rev-parse", flag], { cwd });
   const plainRaw = plain.exitCode === 0 ? plain.stdout.trim() : "";
   if (!plainRaw) return "";
-  return path31.isAbsolute(plainRaw) ? path31.resolve(plainRaw) : path31.resolve(repoRoot, plainRaw);
+  return path32.isAbsolute(plainRaw) ? path32.resolve(plainRaw) : path32.resolve(repoRoot, plainRaw);
 }
 async function resolveRoots(start) {
   const cwd = start ?? process.cwd();
@@ -4637,15 +4823,15 @@ async function resolveRoots(start) {
     if (toplevel.exitCode !== 0) return fallback(cwd);
     const toplevelRaw = toplevel.stdout.trim();
     if (!toplevelRaw) return fallback(cwd);
-    const repoRoot = path31.resolve(toplevelRaw);
+    const repoRoot = path32.resolve(toplevelRaw);
     const [gitDir, gitCommonDir] = await Promise.all([
       resolveAbsoluteGitPath("--git-dir", cwd, repoRoot),
       resolveAbsoluteGitPath("--git-common-dir", cwd, repoRoot)
     ]);
     if (!gitDir || !gitCommonDir) return fallback(cwd);
     const isLinkedWorktree = gitDir !== gitCommonDir;
-    const mainRoot = isLinkedWorktree && path31.basename(gitCommonDir) === ".git" ? path31.dirname(gitCommonDir) : repoRoot;
-    const worktreeName = isLinkedWorktree ? path31.basename(gitDir) : null;
+    const mainRoot = isLinkedWorktree && path32.basename(gitCommonDir) === ".git" ? path32.dirname(gitCommonDir) : repoRoot;
+    const worktreeName = isLinkedWorktree ? path32.basename(gitDir) : null;
     return {
       cwd,
       repoRoot,
@@ -4681,7 +4867,7 @@ function compareVersions(a, b) {
 }
 // src/scanner/detect-package-manager.ts
-import path32 from "node:path";
+import path33 from "node:path";
 import fs27 from "fs-extra";
 function detectPackageManager(root, packageManagerField) {
   const field = String(packageManagerField ?? "").trim();
@@ -4700,9 +4886,9 @@ function detectPackageManager(root, packageManagerField) {
     if (satisfiesVersion(version, ">=9")) return "npm";
     return "unknown";
   }
-  if (fs27.existsSync(path32.join(root, "yarn.lock"))) return "yarn";
-  if (fs27.existsSync(path32.join(root, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs27.existsSync(path32.join(root, "package-lock.json"))) return "npm";
+  if (fs27.existsSync(path33.join(root, "yarn.lock"))) return "yarn";
+  if (fs27.existsSync(path33.join(root, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs27.existsSync(path33.join(root, "package-lock.json"))) return "npm";
   return "unknown";
 }
@@ -4912,7 +5098,7 @@ function runDetection(ctx, rules = STACK_RULES) {
 }
 // src/scanner/detection.ts
-import path33 from "node:path";
+import path34 from "node:path";
 var UNSUPPORTED_MARKERS = {
   "requirements.txt": "python",
   "pyproject.toml": "python",
@@ -4944,7 +5130,7 @@ function blocked(rel) {
 function dependencySet(pkg, composer) {
   const depNames = /* @__PURE__ */ new Set();
   const pushObj = (obj) => {
-    if (!isRecord(obj)) return;
+    if (!isRecord2(obj)) return;
     for (const key of Object.keys(obj)) depNames.add(key);
   };
   pushObj(pkg?.dependencies);
@@ -4972,14 +5158,14 @@ function finalizeRoles(registryRoles, deps, files) {
 function collectUnsupportedSignals(files) {
   return [
     ...new Set(
-      files.map((f) => UNSUPPORTED_MARKERS[path33.basename(f)]).filter((s) => Boolean(s))
+      files.map((f) => UNSUPPORTED_MARKERS[path34.basename(f)]).filter((s) => Boolean(s))
     )
   ].sort();
 }
 // src/scanner/render.ts
 import { readFile } from "node:fs/promises";
-import path34 from "node:path";
+import path35 from "node:path";
 async function buildContentBlob(root, files) {
   const candidates = files.filter(
     (f) => f.endsWith(".ts") || f.endsWith(".js") || f.endsWith(".php") || f.endsWith(".json") || f.endsWith(".yml") || f.endsWith(".yaml")
@@ -4987,7 +5173,7 @@ async function buildContentBlob(root, files) {
   const slice = candidates.slice(0, 300);
   const parts = await mapWithConcurrency(slice, async (rel) => {
     try {
-      return await readFile(path34.join(root, rel), "utf8");
+      return await readFile(path35.join(root, rel), "utf8");
     } catch {
       return "";
     }
@@ -5079,8 +5265,8 @@ var SAFE_FILES = [
   "Gemfile"
 ];
 async function scanProject(root) {
-  const pkg = await readJson(path35.join(root, "package.json"));
-  const composer = await readJson(path35.join(root, "composer.json"));
+  const pkg = await readJson(path36.join(root, "package.json"));
+  const composer = await readJson(path36.join(root, "composer.json"));
   const files = await listFiles(root, SAFE_FILES);
   const safeFiles = files.filter((f) => !blocked(f));
   const deps = dependencySet(pkg, composer);
@@ -5094,7 +5280,7 @@ async function scanProject(root) {
   const warnings = [];
   const securityRisks = [];
   const crossRepoHints = [];
-  const nodeEngine = isRecord(pkg?.engines) ? String(pkg.engines.node ?? "") : "";
+  const nodeEngine = isRecord2(pkg?.engines) ? String(pkg.engines.node ?? "") : "";
   if (nodeEngine && !satisfiesVersion(process.version, nodeEngine)) {
     warnings.push(`Current Node ${process.version} does not satisfy package engine ${nodeEngine}`);
   }
@@ -5104,7 +5290,7 @@ async function scanProject(root) {
     crossRepoHints.push("Monorepo orchestration detected");
   const unsupportedSignals = collectUnsupportedSignals(safeFiles);
   const detectionStatus = computeDetectionStatus(roles, stacks, unsupportedSignals);
-  const repoNameFallback = pkg?.name ? String(pkg.name) : path35.basename((await resolveRoots(root)).mainRoot);
+  const repoNameFallback = pkg?.name ? String(pkg.name) : path36.basename((await resolveRoots(root)).mainRoot);
   const context = {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     repoName: repoNameFallback,
@@ -5126,9 +5312,9 @@ async function scanProject(root) {
 // src/scanner/read-context.ts
 async function isCacheFresh(root, cachePath) {
   const markerPaths = [
-    path36.join(root, "package.json"),
-    path36.join(root, WORKSPACE_FILE),
-    path36.join(root, REPOS_MANIFEST_FILE)
+    path37.join(root, "package.json"),
+    path37.join(root, WORKSPACE_FILE),
+    path37.join(root, REPOS_MANIFEST_FILE)
   ];
   const cacheStat = await fs28.stat(cachePath);
   for (const markerPath of markerPaths) {
@@ -5234,7 +5420,7 @@ async function runDoctor(options) {
   } else {
     ok(`- HOOKS OK: ${hooks.message}`);
   }
-  const rootClaudeMdPath = path37.join(root, "CLAUDE.md");
+  const rootClaudeMdPath = path38.join(root, "CLAUDE.md");
   const rootClaudeMdContent = await readText(rootClaudeMdPath);
   if (!rootClaudeMdContent) {
     flag(
@@ -5288,8 +5474,8 @@ async function runDoctor(options) {
     } else {
       const storedHashMatch = firstLine.match(/hash=(sha256-[a-f0-9]+)/);
       const bodyContent = workflowContent.slice(firstLine.length + 1);
-      const cachePath = path37.join(getCacheDir(), "templates/agentic-workflow-standard.md");
-      const bundledPath = path37.join(
+      const cachePath = path38.join(getCacheDir(), "templates/agentic-workflow-standard.md");
+      const bundledPath = path38.join(
         packageRoot(),
         "library",
         "global",
@@ -5338,7 +5524,7 @@ async function runDoctor(options) {
     }
   }
   if (workflowExists) {
-    const prettierIgnore = await readText(path37.join(root, ".prettierignore")) ?? "";
+    const prettierIgnore = await readText(path38.join(root, ".prettierignore")) ?? "";
     const lines = prettierIgnore.split("\n");
     const missing = IGNORED_PATHS.filter((p) => !prettierIgnoreProtects(lines, p));
     if (missing.length > 0) {
@@ -5411,7 +5597,7 @@ async function runDoctor(options) {
       );
     }
   }
-  const pkgJson = await readJson(path37.join(packageRoot(), "package.json"));
+  const pkgJson = await readJson(path38.join(packageRoot(), "package.json"));
   const currentVersion = pkgJson?.version ?? "0.0.0";
   const npmStatus = await fetchNpmVersionStatus(currentVersion);
   if (npmStatus.updateAvailable && npmStatus.latest !== null) {
@@ -5444,7 +5630,7 @@ async function runDoctor(options) {
 }
 // src/commands/update.ts
-import path40 from "node:path";
+import path41 from "node:path";
 // src/claude/refresh-project.ts
 import fs30 from "fs-extra";
@@ -5461,7 +5647,7 @@ async function refreshProjectApply(root) {
 // src/install/apply.ts
 import crypto2 from "node:crypto";
-import path38 from "node:path";
+import path39 from "node:path";
 import fs31 from "fs-extra";
 // src/install/header.ts
@@ -5548,7 +5734,7 @@ function hashContent(content2) {
 }
 function sourceVersion() {
   try {
-    const pkgPath = path38.join(packageRoot(), "package.json");
+    const pkgPath = path39.join(packageRoot(), "package.json");
     const pkg = JSON.parse(fs31.readFileSync(pkgPath, "utf8"));
     return `${pkg.name ?? "haus"}@${pkg.version ?? "0.0.0"}`;
   } catch {
@@ -5556,49 +5742,49 @@ function sourceVersion() {
   }
 }
 function globalSrcDir() {
-  return path38.join(packageRoot(), "library", "global");
+  return path39.join(packageRoot(), "library", "global");
 }
 function collectSkillAuxFiles(skillsDir, claudeDir, skillName) {
-  const skillDir = path38.join(skillsDir, skillName);
+  const skillDir = path39.join(skillsDir, skillName);
   const entries = [];
   for (const rel of fs31.readdirSync(skillDir, { recursive: true })) {
     if (rel === "SKILL.md") continue;
-    const abs = path38.join(skillDir, rel);
+    const abs = path39.join(skillDir, rel);
     if (!fs31.statSync(abs).isFile()) continue;
-    const posixRel = rel.split(path38.sep).join("/");
+    const posixRel = rel.split(path39.sep).join("/");
     entries.push({
       stableId: `skill.${skillName}.${posixRel.replace(/\//g, ".")}`,
-      srcRelPath: path38.join("library", "global", "skills", skillName, rel),
-      destPath: path38.join(claudeDir, "skills", skillName, rel)
+      srcRelPath: path39.join("library", "global", "skills", skillName, rel),
+      destPath: path39.join(claudeDir, "skills", skillName, rel)
     });
   }
   return entries;
 }
 function collectSourceFiles(srcDir, claudeDir) {
   const entries = [];
-  const skillsDir = path38.join(srcDir, "skills");
+  const skillsDir = path39.join(srcDir, "skills");
   if (fs31.pathExistsSync(skillsDir)) {
     for (const skillName of fs31.readdirSync(skillsDir)) {
-      const skillFile = path38.join(skillsDir, skillName, "SKILL.md");
+      const skillFile = path39.join(skillsDir, skillName, "SKILL.md");
       if (fs31.pathExistsSync(skillFile)) {
         entries.push({
           stableId: `skill.${skillName}`,
-          srcRelPath: path38.join("library", "global", "skills", skillName, "SKILL.md"),
-          destPath: path38.join(claudeDir, "skills", skillName, "SKILL.md")
+          srcRelPath: path39.join("library", "global", "skills", skillName, "SKILL.md"),
+          destPath: path39.join(claudeDir, "skills", skillName, "SKILL.md")
         });
         entries.push(...collectSkillAuxFiles(skillsDir, claudeDir, skillName));
       }
     }
   }
-  const commandsDir = path38.join(srcDir, "commands");
+  const commandsDir = path39.join(srcDir, "commands");
   if (fs31.pathExistsSync(commandsDir)) {
     for (const fileName of fs31.readdirSync(commandsDir)) {
       if (!fileName.endsWith(".md")) continue;
       const commandName = fileName.slice(0, -".md".length);
       entries.push({
         stableId: `command.${commandName}`,
-        srcRelPath: path38.join("library", "global", "commands", fileName),
-        destPath: path38.join(claudeDir, "commands", fileName)
+        srcRelPath: path39.join("library", "global", "commands", fileName),
+        destPath: path39.join(claudeDir, "commands", fileName)
       });
     }
   }
@@ -5624,7 +5810,7 @@ async function applyInstall(options = {}) {
   };
   const manifestFiles = [];
   for (const entry of sourceFiles) {
-    const srcPath = path38.join(packageRoot(), entry.srcRelPath);
+    const srcPath = path39.join(packageRoot(), entry.srcRelPath);
     const rawContent = await readText(srcPath);
     if (rawContent === void 0) {
       warn(`Source file not found: ${entry.srcRelPath}`);
@@ -5684,7 +5870,7 @@ async function applyInstall(options = {}) {
   }
   let mergedSettings;
   if (!check) {
-    const fragmentPath = path38.join(srcDir, "settings-fragments", "hooks.json");
+    const fragmentPath = path39.join(srcDir, "settings-fragments", "hooks.json");
     const fragments = await loadHooksFragment(fragmentPath);
     const settings = await readSettings();
     const { settings: hookSettings, addedIds } = mergeHooks(settings, fragments);
@@ -5773,7 +5959,7 @@ function summarizeLockDiff(before, after) {
 // src/update/lockfile.ts
 import { mkdir, readFile as readFile2, copyFile } from "node:fs/promises";
-import path39 from "node:path";
+import path40 from "node:path";
 async function readLockSummary(root) {
   const lock = await readJson(hausPath(root, "haus.lock.json")) ?? [];
   const catalogRef = lock.find((item) => item.catalogRef)?.catalogRef ?? null;
@@ -5809,7 +5995,7 @@ async function applyLock(root) {
   try {
     const backupDir = hausPath(root, "backups");
     await mkdir(backupDir, { recursive: true });
-    await copyFile(lockPath, path39.join(backupDir, `haus.lock.${Date.now()}.json`));
+    await copyFile(lockPath, path40.join(backupDir, `haus.lock.${Date.now()}.json`));
   } catch {
   }
   const enriched = await Promise.all(
@@ -5831,7 +6017,7 @@ function diffLock(before, after) {
 }
 async function hasLocalOverrides(root) {
   try {
-    await readFile2(path39.join(root, ".claude", "settings.json"), "utf8");
+    await readFile2(path40.join(root, ".claude", "settings.json"), "utf8");
     return true;
   } catch {
     return false;
@@ -5847,7 +6033,7 @@ async function runUpdate(options) {
     return;
   }
   if (options.check) {
-    const pkgJson2 = await readJson(path40.join(packageRoot(), "package.json"));
+    const pkgJson2 = await readJson(path41.join(packageRoot(), "package.json"));
     const currentVersion2 = pkgJson2?.version ?? "0.0.0";
     const [status, npmVersion, latestCatalogTag, globalInstallDrift, catalogItems, lockItems] = await Promise.all([
       options.fast ? fastLockStatus(root) : checkLock(root),
@@ -5882,7 +6068,7 @@ async function runUpdate(options) {
     if (hasHashDrift || formerIdMigrations.length > 0) process.exitCode = 1;
     return;
   }
-  const pkgJson = await readJson(path40.join(packageRoot(), "package.json"));
+  const pkgJson = await readJson(path41.join(packageRoot(), "package.json"));
   const currentVersion = pkgJson?.version ?? "0.0.0";
   const npmStatus = await fetchNpmVersionStatus(currentVersion);
   if (npmStatus.updateAvailable && npmStatus.latest !== null) {
@@ -5924,7 +6110,7 @@ async function runFromHookCheck(root) {
   try {
     const summary = await readLockSummary(root);
     if (summary.count === 0) return;
-    const pkgJson = await readJson(path40.join(packageRoot(), "package.json"));
+    const pkgJson = await readJson(path41.join(packageRoot(), "package.json"));
     const currentVersion = pkgJson?.version ?? "0.0.0";
     const [npmVersion, latestCatalogTag] = await Promise.all([
       fetchNpmVersionStatus(currentVersion),
@@ -6074,7 +6260,7 @@ async function runCiGate(options = {}) {
 // src/commands/clone.ts
 init_exec();
 import { existsSync as existsSync2 } from "node:fs";
-import path41 from "node:path";
+import path42 from "node:path";
 var GIT_LOCATION_VARS = [
   "GIT_DIR",
   "GIT_WORK_TREE",
@@ -6124,11 +6310,11 @@ async function runClone(url, opts = {}) {
     process.exitCode = 1;
     return;
   }
-  const target = path41.resolve(opts.dir?.trim() || repoNameFromUrl(url));
+  const target = path42.resolve(opts.dir?.trim() || repoNameFromUrl(url));
   if (existsSync2(target)) {
     const check = await checkExistingTarget(target, url);
     if (check.kind === "matches") {
-      log(`\u2022 ${path41.basename(target)} already cloned here, matches ${url} \u2014 skipped`);
+      log(`\u2022 ${path42.basename(target)} already cloned here, matches ${url} \u2014 skipped`);
       return;
     }
     const message = check.kind === "not-a-repo" ? `${target} already exists and is not a git repository \u2014 refusing to clone ${url} there. Remove or rename it, or pass a different [dir].` : `${target} already exists as a different repository (origin: ${check.origin ?? "(no origin remote)"}) \u2014 refusing to clone ${url} there. Remove or rename it, or pass a different [dir].`;
@@ -6168,7 +6354,7 @@ function readHookPayload() {
   if (!raw) return { payload: {}, malformed: false };
   try {
     const parsed = JSON.parse(raw);
-    return { payload: isRecord(parsed) ? parsed : {}, malformed: false };
+    return { payload: isRecord2(parsed) ? parsed : {}, malformed: false };
   } catch {
     return { payload: {}, malformed: true };
   }
@@ -6207,7 +6393,7 @@ function readPayload(options) {
   if (options.stdinPayload != null) {
     try {
       const parsed = JSON.parse(options.stdinPayload);
-      return { payload: isRecord(parsed) ? parsed : {}, malformed: false };
+      return { payload: isRecord2(parsed) ? parsed : {}, malformed: false };
     } catch {
       return { payload: {}, malformed: true };
     }
@@ -6220,7 +6406,7 @@ async function runDecisionsGuard(options = {}) {
     emitPreToolUseDeny("Malformed hook payload");
     return;
   }
-  const toolInput = isRecord(payload.tool_input) ? payload.tool_input : {};
+  const toolInput = isRecord2(payload.tool_input) ? payload.tool_input : {};
   const command = String(toolInput.command ?? "");
   if (!PR_CREATE_PATTERN.test(command)) return;
   const root = process.cwd();
@@ -6232,13 +6418,13 @@ async function runDecisionsGuard(options = {}) {
   const result = await runDecisionsCheck(root, { range, commitMessages });
   if (result.triggered && !result.satisfied) {
     emitPreToolUseDeny(
-      `I didn't run that \u2014 this change needs an ADR before opening a PR (${result.reasons.join("; ")}). Run haus decisions suggest, add the decision under docs/decisions/, then retry.`
+      `I didn't run that \u2014 this change needs an ADR before opening a PR (${result.reasons.join("; ")}). Run haus decisions suggest, add the decision under docs/decisions/, then retry \u2014 or use [adr-skip] for non-security changes.`
     );
   }
 }
 // src/commands/decisions.ts
-import path42 from "node:path";
+import path43 from "node:path";
 // src/decisions/next-number.ts
 async function nextDecisionNumber(root) {
@@ -6281,10 +6467,9 @@ _(Why this over alternatives \u2014 the line agents read for "why".)_
 `;
 }
 async function runDecisionsSuggest(root, opts = {}) {
-  const stats = await collectDiffStats(root, { staged: true });
   const stagedCheck = await runDecisionsCheck(root, { staged: true });
-  const unstagedStats = await collectDiffStats(root, {});
-  const triggered = isDecisionTriggered(stats) || isDecisionTriggered(unstagedStats);
+  const unstagedCheck = await runDecisionsCheck(root, {});
+  const triggered = stagedCheck.triggered || unstagedCheck.triggered;
   if (!triggered) return;
   if (stagedCheck.triggered && stagedCheck.satisfied) return;
   const number = await nextDecisionNumber(root);
@@ -6335,7 +6520,7 @@ async function runDecisions(sub, arg, options = {}) {
     }
     for (const reason of result.reasons) warn(reason);
     error(
-      "decisions gate: decision-worthy change without a valid ADR under docs/decisions/. Run `haus decisions suggest`, add docs/decisions/NNNN-*.md + README row, or use [adr-skip] with justification."
+      `decisions gate: decision-worthy change without a valid ADR under docs/decisions/. Why: ${result.reasons.filter((r) => !r.startsWith("no new")).join("; ") || "see above"}. Run \`haus decisions suggest\`, add docs/decisions/NNNN-*.md + README row, or use [adr-skip] with justification (ignored for security paths).`
     );
     process.exitCode = 1;
     return;
@@ -6349,7 +6534,7 @@ async function runDecisions(sub, arg, options = {}) {
     return;
   }
   if (sub === "validate") {
-    const target = arg ? path42.resolve(root, arg) : void 0;
+    const target = arg ? path43.resolve(root, arg) : void 0;
     if (!target) {
       error("usage: haus decisions validate <path-to-decision.md>");
       process.exitCode = 1;
@@ -6601,7 +6786,7 @@ async function runGuard(kind, _options) {
     emitPreToolUseDeny("Malformed hook payload");
     return;
   }
-  const toolInput = isRecord(payload.tool_input) ? payload.tool_input : {};
+  const toolInput = isRecord2(payload.tool_input) ? payload.tool_input : {};
   if (kind === "file-access") {
     const candidate = String(toolInput.path ?? toolInput.file_path ?? "");
     const reason2 = guardFileAccess(candidate);
@@ -6618,7 +6803,7 @@ async function runGuard(kind, _options) {
 }
 // src/commands/init.ts
-import path44 from "node:path";
+import path45 from "node:path";
 import fs32 from "fs-extra";
 // src/recommender/git-signal.ts
@@ -7086,7 +7271,7 @@ function buildOptInEligible(items, skipped) {
 }
 // src/commands/workspace/discover.ts
-import path43 from "node:path";
+import path44 from "node:path";
 import fg4 from "fast-glob";
 import YAML2 from "yaml";
 var DEFAULT_MAX_DEPTH = 3;
@@ -7127,10 +7312,10 @@ async function findRepoRoots(workspaceRoot, maxDepth = DEFAULT_MAX_DEPTH) {
   const gitDirs = /* @__PURE__ */ new Set();
   const manifestDirs = /* @__PURE__ */ new Set();
   for (const match of gitMatches) {
-    gitDirs.add(path43.posix.dirname(match));
+    gitDirs.add(path44.posix.dirname(match));
   }
   for (const match of manifestMatches) {
-    manifestDirs.add(path43.posix.dirname(match));
+    manifestDirs.add(path44.posix.dirname(match));
   }
   const repoRoots = [...gitDirs];
   const manifestSorted = [...manifestDirs].sort(
@@ -7147,9 +7332,9 @@ async function findRepoRoots(workspaceRoot, maxDepth = DEFAULT_MAX_DEPTH) {
 async function discoverRepos(workspaceRoot, maxDepth = DEFAULT_MAX_DEPTH) {
   const repoRoots = await findRepoRoots(workspaceRoot, maxDepth);
   return mapWithConcurrency(repoRoots, async (relDir) => {
-    const absDir = path43.resolve(workspaceRoot, relDir);
-    const pkg = await readJson(path43.join(absDir, "package.json"));
-    const name = typeof pkg?.name === "string" && pkg.name.length > 0 ? pkg.name : path43.basename(relDir === "." ? workspaceRoot : absDir);
+    const absDir = path44.resolve(workspaceRoot, relDir);
+    const pkg = await readJson(path44.join(absDir, "package.json"));
+    const name = typeof pkg?.name === "string" && pkg.name.length > 0 ? pkg.name : path44.basename(relDir === "." ? workspaceRoot : absDir);
     let role = "auto";
     try {
       const scan = await scanProject(absDir);
@@ -7192,7 +7377,7 @@ function renderWorkspaceYaml(config) {
   });
 }
 async function runDiscover(workspaceRoot, opts = {}) {
-  const yamlPath = path43.join(workspaceRoot, "haus.workspace.yaml");
+  const yamlPath = path44.join(workspaceRoot, "haus.workspace.yaml");
   const existingText = await readText(yamlPath);
   const existing = parseWorkspaceConfig(existingText);
   if (existingText && !existing) {
@@ -7364,7 +7549,7 @@ async function runSetupProject(options) {
 // src/commands/init.ts
 async function runInit(options) {
   const root = process.cwd();
-  const hausDir = path44.join(root, ".haus-workflow");
+  const hausDir = path45.join(root, ".haus-workflow");
   const alreadyInit = await fs32.pathExists(hausDir);
   if (alreadyInit) {
     log("Haus AI already initialized in this project.");
@@ -7500,7 +7685,7 @@ async function runRefresh() {
 }
 // src/install/scaffold.ts
-import path45 from "node:path";
+import path46 from "node:path";
 import fs33 from "fs-extra";
 async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
   const scaffolded = [];
@@ -7517,9 +7702,9 @@ async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
   const realRoot = await fs33.realpath(catalogRoot).catch(() => null);
   for (const item of items) {
     if (item.type !== "config") continue;
-    const sourcePath = path45.resolve(catalogRoot, item.path);
-    const rel = path45.relative(catalogRoot, sourcePath);
-    const escapes = rel === "" || path45.isAbsolute(rel) || rel.split(/[/\\]/).some((seg) => seg === "..");
+    const sourcePath = path46.resolve(catalogRoot, item.path);
+    const rel = path46.relative(catalogRoot, sourcePath);
+    const escapes = rel === "" || path46.isAbsolute(rel) || rel.split(/[/\\]/).some((seg) => seg === "..");
     if (escapes) {
       warn(`Skipping ${item.id}: path '${item.path}' escapes the catalog root`);
       continue;
@@ -7529,8 +7714,8 @@ async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
       warn(`Skipping ${item.id}: source not found at ${sourcePath}`);
       continue;
     }
-    const realRel = path45.relative(realRoot, realSource);
-    if (realRel !== "" && (path45.isAbsolute(realRel) || realRel.split(/[/\\]/)[0] === "..")) {
+    const realRel = path46.relative(realRoot, realSource);
+    if (realRel !== "" && (path46.isAbsolute(realRel) || realRel.split(/[/\\]/)[0] === "..")) {
       warn(`Skipping ${item.id}: path '${item.path}' resolves outside the catalog root`);
       continue;
     }
@@ -7544,14 +7729,14 @@ async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
       continue;
     }
     if (stat.isFile()) {
-      const filename = path45.basename(sourcePath);
-      const dest = path45.join(projectRoot, filename);
+      const filename = path46.basename(sourcePath);
+      const dest = path46.join(projectRoot, filename);
       record(filename, await scaffoldFile(sourcePath, dest, item.id, projectRoot, opts));
     } else if (stat.isDirectory()) {
       const entries = await fs33.readdir(sourcePath);
       for (const entry of entries) {
-        const src = path45.join(sourcePath, entry);
-        const dest = path45.join(projectRoot, entry);
+        const src = path46.join(sourcePath, entry);
+        const dest = path46.join(projectRoot, entry);
         record(entry, await scaffoldFile(src, dest, item.id, projectRoot, opts));
       }
     }
@@ -7559,14 +7744,14 @@ async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
   return { scaffolded, skipped, skippedExisting };
 }
 async function scaffoldFile(src, dest, itemId, projectRoot, opts) {
-  const destDisplay = path45.relative(projectRoot, dest) || path45.basename(dest);
+  const destDisplay = path46.relative(projectRoot, dest) || path46.basename(dest);
   const srcStat = await fs33.lstat(src).catch(() => null);
   if (!srcStat) {
-    warn(`Skipping ${path45.basename(src)}: source not found`);
+    warn(`Skipping ${path46.basename(src)}: source not found`);
     return "skipped-refused";
   }
   if (srcStat.isSymbolicLink()) {
-    warn(`Skipping ${path45.basename(src)}: source is a symlink`);
+    warn(`Skipping ${path46.basename(src)}: source is a symlink`);
     return "skipped-refused";
   }
   const exists = await fs33.pathExists(dest);
@@ -7575,13 +7760,13 @@ async function scaffoldFile(src, dest, itemId, projectRoot, opts) {
     return "skipped-exists";
   }
   if (opts.dryRun) {
-    log(`[dry-run] would ${exists ? "overwrite" : "create"} ${path45.basename(dest)} (${itemId})`);
+    log(`[dry-run] would ${exists ? "overwrite" : "create"} ${path46.basename(dest)} (${itemId})`);
     return "scaffolded";
   }
   if (exists && opts.force) {
     await fs33.remove(dest);
   }
-  await fs33.ensureDir(path45.dirname(dest));
+  await fs33.ensureDir(path46.dirname(dest));
   await fs33.copy(src, dest, {
     overwrite: true,
     dereference: false,
@@ -7594,7 +7779,7 @@ async function scaffoldFile(src, dest, itemId, projectRoot, opts) {
       }
     }
   });
-  log(`${exists ? "Overwrote" : "Created"} ${path45.basename(dest)} (${itemId})`);
+  log(`${exists ? "Overwrote" : "Created"} ${path46.basename(dest)} (${itemId})`);
   return "scaffolded";
 }
@@ -7659,7 +7844,7 @@ async function runScan(options) {
 }
 // src/commands/undo.ts
-import path46 from "node:path";
+import path47 from "node:path";
 import fs34 from "fs-extra";
 // src/claude/managed-paths.ts
@@ -7687,18 +7872,18 @@ async function collectLockTrackedPaths(root) {
     const relPaths = row.paths ?? [];
     const existingRel = [];
     for (const rel of relPaths) {
-      if (await fs34.pathExists(path46.resolve(root, rel))) existingRel.push(rel);
+      if (await fs34.pathExists(path47.resolve(root, rel))) existingRel.push(rel);
     }
     if (existingRel.length === 0) continue;
     if (row.hash === void 0) {
-      removable.push(...existingRel.map((rel) => path46.resolve(root, rel)));
+      removable.push(...existingRel.map((rel) => path47.resolve(root, rel)));
       continue;
     }
     const currentHash = await hashInstalledPaths(root, existingRel);
     if (currentHash === row.hash) {
-      removable.push(...existingRel.map((rel) => path46.resolve(root, rel)));
+      removable.push(...existingRel.map((rel) => path47.resolve(root, rel)));
     } else {
-      preserved.push(...existingRel.map((rel) => path46.resolve(root, rel)));
+      preserved.push(...existingRel.map((rel) => path47.resolve(root, rel)));
       log(`Preserving locally-modified ${row.id ?? "(unknown item)"}: ${existingRel.join(", ")}`);
     }
   }
@@ -7711,7 +7896,7 @@ async function settingsHasHausContent(root) {
   return settings._haus != null;
 }
 async function claudeMdHasHausBlock(root) {
-  const filePath = path46.join(root, "CLAUDE.md");
+  const filePath = path47.join(root, "CLAUDE.md");
   if (!await fs34.pathExists(filePath)) return false;
   const text = await fs34.readFile(filePath, "utf8");
   return text.includes(BLOCK_BEGIN);
@@ -7724,15 +7909,15 @@ async function stripProjectSettings(root) {
   const hasContent = Object.keys(settings).length > 0;
   if (hasContent) {
     await writeProjectSettings(root, settings);
-    log(`Stripped haus rules from ${path46.relative(root, settingsPath)} (user settings preserved).`);
+    log(`Stripped haus rules from ${path47.relative(root, settingsPath)} (user settings preserved).`);
     return true;
   }
   await fs34.remove(settingsPath);
-  log(`Removed ${path46.relative(root, settingsPath)} (no user-owned settings remained).`);
+  log(`Removed ${path47.relative(root, settingsPath)} (no user-owned settings remained).`);
   return true;
 }
 async function stripRootClaudeMd(root) {
-  const filePath = path46.join(root, "CLAUDE.md");
+  const filePath = path47.join(root, "CLAUDE.md");
   if (!await fs34.pathExists(filePath)) return false;
   const prev = await fs34.readFile(filePath, "utf8");
   if (!prev.includes(BLOCK_BEGIN)) return false;
@@ -7760,12 +7945,12 @@ async function backupManagedFilesBeforeUndo(root, managedAbsPaths) {
   const backupRoot = hausPath(root, "backups", `undo-${stamp}`);
   for (const abs of managedAbsPaths) {
     if (!await fs34.pathExists(abs)) continue;
-    const rel = path46.relative(root, abs);
-    const backupPath = path46.join(backupRoot, rel);
-    await fs34.ensureDir(path46.dirname(backupPath));
+    const rel = path47.relative(root, abs);
+    const backupPath = path47.join(backupRoot, rel);
+    await fs34.ensureDir(path47.dirname(backupPath));
     await fs34.copy(abs, backupPath);
   }
-  log(`Backed up ${managedAbsPaths.length} managed file(s) to ${path46.relative(root, backupRoot)}.`);
+  log(`Backed up ${managedAbsPaths.length} managed file(s) to ${path47.relative(root, backupRoot)}.`);
 }
 async function runUndo(options) {
   const root = options.root ?? process.cwd();
@@ -7778,7 +7963,7 @@ async function runUndo(options) {
     log("Nothing to remove: no haus-managed files found in this directory.");
     return;
   }
-  const relTargets = managed.map((p) => path46.relative(root, p));
+  const relTargets = managed.map((p) => path47.relative(root, p));
   const summaryParts = [...relTargets];
   if (stripSettings) summaryParts.push(".claude/settings.json (haus rules only)");
   if (stripClaudeMd) summaryParts.push("CLAUDE.md (haus import block only)");
@@ -7802,7 +7987,7 @@ User-owned .claude/ files will be preserved.`
   for (const abs of managed) {
     if (!await fs34.pathExists(abs)) continue;
     await fs34.remove(abs);
-    log(`Removed ${path46.relative(root, abs)}`);
+    log(`Removed ${path47.relative(root, abs)}`);
   }
   if (stripSettings) await stripProjectSettings(root);
   if (stripClaudeMd) await stripRootClaudeMd(root);
@@ -7813,7 +7998,7 @@ User-owned .claude/ files will be preserved.`
 // src/install/uninstall.ts
 import crypto3 from "node:crypto";
-import path47 from "node:path";
+import path48 from "node:path";
 import fs35 from "fs-extra";
 async function runUninstall(options = {}) {
   const { force = false } = options;
@@ -7843,14 +8028,14 @@ async function runUninstall(options = {}) {
       continue;
     }
     await fs35.remove(entry.destPath);
-    await pruneEmptyDir(path47.dirname(entry.destPath));
+    await pruneEmptyDir(path48.dirname(entry.destPath));
     result.deleted.push(entry.destPath);
   }
   const settings = await readSettings();
   const stripped = stripHausHooks(stripHausAsk(stripHausAllow(stripHausDeny(settings))));
   await writeSettings(stripped);
   result.hooksStripped = true;
-  const hausDir = path47.join(globalClaudeDir(), "haus");
+  const hausDir = path48.join(globalClaudeDir(), "haus");
   const manifestPath2 = hausManifestPath();
   if (fs35.pathExistsSync(manifestPath2)) {
     await fs35.remove(manifestPath2);
@@ -7891,12 +8076,13 @@ async function runUninstallCommand(options) {
 }
 // src/commands/validate-catalog.ts
-import path49 from "node:path";
+import path50 from "node:path";
 // src/catalog/validate-core.ts
 import fs36 from "node:fs";
-import path48 from "node:path";
+import path49 from "node:path";
 var ITEM_SEMVER_RE = /^\d+\.\d+\.\d+$/;
+var ITEM_ID_PATTERN = /^haus\./;
 function auditForbiddenStacks(items) {
   const failures = [];
   for (const item of items) {
@@ -7982,6 +8168,9 @@ function auditManifestStructure(manifestVersion, items) {
       failures.push(`item[${i}]: missing id`);
       continue;
     }
+    if (!ITEM_ID_PATTERN.test(item.id)) {
+      failures.push(`${item.id}: id must start with "haus."`);
+    }
     const provenanceError = validateCuratedProvenance(item);
     if (provenanceError) failures.push(provenanceError);
     const referencesError = validateReferences(item.id, item.references);
@@ -8040,7 +8229,7 @@ function readForAudit(absPath, label, failures) {
   }
 }
 function auditTemplateContent(manifestDir, absPath, itemId) {
-  const rel = path48.relative(manifestDir, absPath);
+  const rel = path49.relative(manifestDir, absPath);
   const failures = [];
   const text = readForAudit(absPath, `${itemId}: ${rel}`, failures);
   if (text === null) return failures;
@@ -8062,25 +8251,25 @@ function auditShippedFiles(manifestDir, items) {
   const failures = [];
   for (const item of items) {
     if (!item.path || !isSafeCatalogPath(item.path)) continue;
-    const absPath = path48.join(manifestDir, item.path);
+    const absPath = path49.join(manifestDir, item.path);
     if (item.type === "skill") {
-      const skillMd = path48.join(absPath, "SKILL.md");
+      const skillMd = path49.join(absPath, "SKILL.md");
       if (!fs36.existsSync(skillMd)) {
-        failures.push(`${item.id}: missing ${path48.relative(manifestDir, skillMd)}`);
+        failures.push(`${item.id}: missing ${path49.relative(manifestDir, skillMd)}`);
         continue;
       }
       const text = readForAudit(skillMd, `${item.id}: SKILL.md`, failures);
       if (text === null) continue;
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: SKILL.md`));
       failures.push(
-        ...auditForbiddenTagsInText(text, `${item.id}: ${path48.relative(manifestDir, skillMd)}`)
+        ...auditForbiddenTagsInText(text, `${item.id}: ${path49.relative(manifestDir, skillMd)}`)
       );
     } else if (item.type === "agent") {
       if (!fs36.existsSync(absPath)) {
         failures.push(`${item.id}: missing agent file ${item.path}`);
         continue;
       }
-      const rel = path48.relative(manifestDir, absPath);
+      const rel = path49.relative(manifestDir, absPath);
       const text = readForAudit(absPath, `${item.id}: ${rel}`, failures);
       if (text === null) continue;
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: ${rel}`));
@@ -8096,7 +8285,7 @@ function auditShippedFiles(manifestDir, items) {
         failures.push(`${item.id}: missing command file ${item.path}`);
         continue;
       }
-      const rel = path48.relative(manifestDir, absPath);
+      const rel = path49.relative(manifestDir, absPath);
       const text = readForAudit(absPath, `${item.id}: ${rel}`, failures);
       if (text === null) continue;
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: ${rel}`));
@@ -8128,7 +8317,7 @@ function walkAllFiles(dir, fn, failures) {
   }
   for (const entry of entries) {
     if (entry.name === ".DS_Store") continue;
-    const full = path48.join(dir, entry.name);
+    const full = path49.join(dir, entry.name);
     if (entry.isDirectory()) walkAllFiles(full, fn, failures);
     else fn(full);
   }
@@ -8146,12 +8335,12 @@ function auditDiskOrphans(manifestDir, items) {
   const failures = [];
   const claimedPaths = items.filter((item) => item.path && isSafeCatalogPath(item.path)).map((item) => item.path.replace(/\\/g, "/"));
   for (const dir of CONTENT_ROOTS) {
-    const abs = path48.join(manifestDir, dir);
+    const abs = path49.join(manifestDir, dir);
     if (!fs36.existsSync(abs)) continue;
     walkAllFiles(
       abs,
       (file) => {
-        const relPath = path48.relative(manifestDir, file).replace(/\\/g, "/");
+        const relPath = path49.relative(manifestDir, file).replace(/\\/g, "/");
         if (!isPathClaimed(relPath, claimedPaths)) {
           failures.push(`orphaned on disk, claimed by no manifest item: ${relPath}`);
         }
@@ -8172,7 +8361,7 @@ function walkMd(dir, fn, failures) {
     return;
   }
   for (const entry of entries) {
-    const full = path48.join(dir, entry.name);
+    const full = path49.join(dir, entry.name);
     if (entry.isDirectory()) walkMd(full, fn, failures);
     else if (entry.name.endsWith(".md")) fn(full);
   }
@@ -8181,13 +8370,13 @@ function auditMarkdownContent(manifestDir, items) {
   const failures = [];
   const pathSourceMap = buildItemPathSourceMap(items);
   for (const dir of ["skills", "agents", "templates", "commands"]) {
-    const abs = path48.join(manifestDir, dir);
+    const abs = path49.join(manifestDir, dir);
     if (!fs36.existsSync(abs)) continue;
     const dirType = DIR_ITEM_TYPE[dir] ?? "";
     walkMd(
       abs,
       (file) => {
-        const rel = path48.relative(manifestDir, file);
+        const rel = path49.relative(manifestDir, file);
         const text = readForAudit(file, rel, failures);
         if (text === null) return;
         const norm = rel.replace(/\\/g, "/");
@@ -8232,8 +8421,8 @@ async function runValidateCatalog(manifestPath2) {
     process.exitCode = 1;
     return;
   }
-  const abs = path49.resolve(process.cwd(), manifestPath2);
-  const manifestDir = path49.dirname(abs);
+  const abs = path50.resolve(process.cwd(), manifestPath2);
+  const manifestDir = path50.dirname(abs);
   const data = await readJson(abs);
   if (!data?.items) {
     error(`Could not read catalog manifest at ${abs}`);
@@ -8250,7 +8439,7 @@ async function runValidateCatalog(manifestPath2) {
 }
 // src/workspace/worktree/add.ts
-import path56 from "node:path";
+import path57 from "node:path";
 import fs40 from "fs-extra";
 // src/workspace/worktree/git-worktree.ts
@@ -8370,12 +8559,12 @@ async function hasUnpushedWork(cwd) {
 }
 // src/workspace/worktree/hydrate.ts
-import path52 from "node:path";
+import path53 from "node:path";
 import fs38 from "fs-extra";
 // src/workspace/worktree/cow-copy.ts
 init_exec();
-import path50 from "node:path";
+import path51 from "node:path";
 import fs37 from "fs-extra";
 async function getMacFilesystemType(dir) {
   const df = await runCommand("df", ["-P", dir]);
@@ -8410,11 +8599,11 @@ async function cowCopyDir(src, dest) {
   const srcExists = await fs37.pathExists(src);
   if (!srcExists)
     return { strategy: "unsupported", attempted: false, ok: false, error: "source missing" };
-  const strategy = await detectCowStrategy(path50.dirname(dest));
+  const strategy = await detectCowStrategy(path51.dirname(dest));
   if (strategy === "unsupported" || strategy === "unknown-platform") {
     return { strategy, attempted: false, ok: false };
   }
-  await fs37.ensureDir(path50.dirname(dest));
+  await fs37.ensureDir(path51.dirname(dest));
   const args = strategy === "darwin-clonefile" ? ["-c", "-R", src, dest] : ["-a", "--reflink=always", src, dest];
   const result = await runCommand("cp", args);
   return {
@@ -8428,7 +8617,7 @@ async function cowCopyDir(src, dest) {
 // src/workspace/worktree/install.ts
 init_exec();
 import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
-import path51 from "node:path";
+import path52 from "node:path";
 import fg5 from "fast-glob";
 function detectInstallPlan(signals) {
   if (signals.hasYarnLock) {
@@ -8449,10 +8638,10 @@ function detectInstallPlan(signals) {
   return { manager: "none" };
 }
 async function computeLockfileSignals(dir) {
-  const hasYarnLock = existsSync3(path51.join(dir, "yarn.lock"));
-  const hasPnpmLock = existsSync3(path51.join(dir, "pnpm-lock.yaml"));
-  const hasPackageLock = existsSync3(path51.join(dir, "package-lock.json"));
-  const hasComposerLock = existsSync3(path51.join(dir, "composer.lock"));
+  const hasYarnLock = existsSync3(path52.join(dir, "yarn.lock"));
+  const hasPnpmLock = existsSync3(path52.join(dir, "pnpm-lock.yaml"));
+  const hasPackageLock = existsSync3(path52.join(dir, "package-lock.json"));
+  const hasComposerLock = existsSync3(path52.join(dir, "composer.lock"));
   const dotnetFiles = await fg5(["**/*.csproj", "**/*.sln"], {
     cwd: dir,
     onlyFiles: true,
@@ -8466,7 +8655,7 @@ async function computeLockfileSignals(dir) {
   });
   const hasDotnetProject = dotnetFiles.length > 0;
   let hasPackageManagerField = false;
-  const pkgPath = path51.join(dir, "package.json");
+  const pkgPath = path52.join(dir, "package.json");
   if (existsSync3(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
@@ -8507,8 +8696,8 @@ async function hydrateMember(mainMemberPath, worktreeMemberPath, opts = {}) {
   const start = Date.now();
   const targets = [];
   for (const target of HYDRATION_TARGETS) {
-    const src = path52.join(mainMemberPath, target);
-    const dest = path52.join(worktreeMemberPath, target);
+    const src = path53.join(mainMemberPath, target);
+    const dest = path53.join(worktreeMemberPath, target);
     if (!await fs38.pathExists(src)) continue;
     const destExists = await fs38.pathExists(dest);
     if (!opts.force && destExists) continue;
@@ -8526,11 +8715,11 @@ async function hydrateMember(mainMemberPath, worktreeMemberPath, opts = {}) {
 // src/workspace/worktree/local-files.ts
 init_exec();
-import path53 from "node:path";
+import path54 from "node:path";
 import fs39 from "fs-extra";
 var MACHINE_LOCAL_FILES = [
   "docker-compose.local.yml",
-  path53.join(".claude", "settings.local.json")
+  path54.join(".claude", "settings.local.json")
 ];
 async function isTracked(repoRoot, relFile) {
   const gitPath = relFile.replace(/\\/g, "/");
@@ -8540,11 +8729,11 @@ async function isTracked(repoRoot, relFile) {
 async function copyMachineLocalFiles(mainMemberPath, worktreeMemberPath) {
   const copied = [];
   for (const rel of MACHINE_LOCAL_FILES) {
-    const src = path53.join(mainMemberPath, rel);
+    const src = path54.join(mainMemberPath, rel);
     if (!await fs39.pathExists(src)) continue;
     if (await isTracked(mainMemberPath, rel)) continue;
-    const dest = path53.join(worktreeMemberPath, rel);
-    await fs39.ensureDir(path53.dirname(dest));
+    const dest = path54.join(worktreeMemberPath, rel);
+    await fs39.ensureDir(path54.dirname(dest));
     await fs39.copy(src, dest, { overwrite: true });
     copied.push(rel);
   }
@@ -8553,15 +8742,15 @@ async function copyMachineLocalFiles(mainMemberPath, worktreeMemberPath) {
 // src/workspace/worktree/root.ts
 import { existsSync as existsSync4 } from "node:fs";
-import path54 from "node:path";
+import path55 from "node:path";
 async function resolveWorkspaceForWorktree(start) {
   const rootInfo = await resolveRoots(start);
   if (!rootInfo.isGitRepo) {
     return { ok: false, reason: "Not inside a git repository." };
   }
   const workspaceRoot = rootInfo.mainRoot;
-  const hasYaml = existsSync4(path54.join(workspaceRoot, WORKSPACE_FILE));
-  const hasManifest = existsSync4(path54.join(workspaceRoot, REPOS_MANIFEST_FILE));
+  const hasYaml = existsSync4(path55.join(workspaceRoot, WORKSPACE_FILE));
+  const hasManifest = existsSync4(path55.join(workspaceRoot, REPOS_MANIFEST_FILE));
   if (!hasYaml && !hasManifest) {
     return {
       ok: false,
@@ -8586,19 +8775,19 @@ function selectMembers(members, only) {
 }
 // src/workspace/worktree/state.ts
-import path55 from "node:path";
+import path56 from "node:path";
 var WORKTREE_STATE_FILE = ".haus-worktree.json";
 function worktreesDir(mainRoot) {
-  return path55.join(mainRoot, ".claude", "worktrees");
+  return path56.join(mainRoot, ".claude", "worktrees");
 }
 function worktreePath(mainRoot, slug) {
-  return path55.join(worktreesDir(mainRoot), slug);
+  return path56.join(worktreesDir(mainRoot), slug);
 }
 async function readWorktreeState(worktreeRoot) {
-  return readJson(path55.join(worktreeRoot, WORKTREE_STATE_FILE));
+  return readJson(path56.join(worktreeRoot, WORKTREE_STATE_FILE));
 }
 async function writeWorktreeState(worktreeRoot, state) {
-  await writeJson(path55.join(worktreeRoot, WORKTREE_STATE_FILE), state);
+  await writeJson(path56.join(worktreeRoot, WORKTREE_STATE_FILE), state);
 }
 // src/workspace/worktree/add.ts
@@ -8616,7 +8805,7 @@ async function runAdd(opts) {
   if (await fs40.pathExists(wsWorktreePath)) {
     return {
       ok: false,
-      error: `Workspace worktree already exists at ${wsWorktreePath} \u2014 run \`haus workspace worktree hydrate\` or \`remove\` first.`
+      error: `Workspace worktree already exists at ${wsWorktreePath} \u2014 run \`haus workspace worktree hydrate --materialize\` from inside it to check out any missing members (e.g. a worktree created by plain \`git worktree add\`), or \`remove\` first to start over.`
     };
   }
   if (opts.dryRun) {
@@ -8632,7 +8821,7 @@ async function runAdd(opts) {
   const memberResults = [];
   for (const member of selected) {
     const start = Date.now();
-    const memberWorktreePath = path56.join(wsWorktreePath, member.folder);
+    const memberWorktreePath = path57.join(wsWorktreePath, member.folder);
     const outcome = await addWorktree(member.absPath, memberWorktreePath, branch, {
       preferDefaultBranchFrom: true
     });
@@ -8662,7 +8851,7 @@ async function runAdd(opts) {
   await mapWithConcurrency(okResults, async (result) => {
     const member = selected.find((m) => m.id === result.member);
     if (!member) return;
-    const memberWorktreePath = path56.join(wsWorktreePath, member.folder);
+    const memberWorktreePath = path57.join(wsWorktreePath, member.folder);
     const hydrationStart = Date.now();
     if (opts.hydrate !== false) {
       result.hydration = await hydrateMember(member.absPath, memberWorktreePath);
@@ -8729,10 +8918,10 @@ async function runDryRun(args) {
 // src/workspace/worktree/doctor.ts
 import { existsSync as existsSync5 } from "node:fs";
-import path57 from "node:path";
+import path58 from "node:path";
 var HYDRATION_MARKERS = ["node_modules", "vendor", "obj", "bin"];
 function looksHydrated(memberPath) {
-  return HYDRATION_MARKERS.some((marker) => existsSync5(path57.join(memberPath, marker)));
+  return HYDRATION_MARKERS.some((marker) => existsSync5(path58.join(memberPath, marker)));
 }
 async function runDoctor2() {
   const rootInfo = await resolveRoots();
@@ -8746,7 +8935,7 @@ async function runDoctor2() {
     };
   }
   const workspaceRoot = rootInfo.mainRoot;
-  const isWorkspace = existsSync5(path57.join(workspaceRoot, WORKSPACE_FILE)) || existsSync5(path57.join(workspaceRoot, REPOS_MANIFEST_FILE));
+  const isWorkspace = existsSync5(path58.join(workspaceRoot, WORKSPACE_FILE)) || existsSync5(path58.join(workspaceRoot, REPOS_MANIFEST_FILE));
   if (!isWorkspace) {
     return {
       isWorkspace: false,
@@ -8759,7 +8948,7 @@ async function runDoctor2() {
     };
   }
   const wsWorktreesDir = worktreesDir(workspaceRoot);
-  const underWorktreesDir = rootInfo.repoRoot.startsWith(`${wsWorktreesDir}${path57.sep}`);
+  const underWorktreesDir = rootInfo.repoRoot.startsWith(`${wsWorktreesDir}${path58.sep}`);
   const inWorkspaceWorktree = rootInfo.isLinkedWorktree && underWorktreesDir;
   const members = await readMembers(rootInfo);
   const problems = [];
@@ -8767,10 +8956,10 @@ async function runDoctor2() {
   let slug;
   if (inWorkspaceWorktree) {
     const wtPath = rootInfo.repoRoot;
-    slug = rootInfo.worktreeName ?? path57.basename(wtPath);
+    slug = rootInfo.worktreeName ?? path58.basename(wtPath);
     const state = await readWorktreeState(wtPath);
     for (const member of members) {
-      const memberPath = path57.join(wtPath, member.folder);
+      const memberPath = path58.join(wtPath, member.folder);
       const materialized = existsSync5(memberPath);
       const expectedBranch = state?.members.find((m) => m.folder === member.folder)?.branch ?? state?.branch;
       const actualBranch = materialized ? await currentBranch(memberPath) : void 0;
@@ -8801,16 +8990,16 @@ async function runDoctor2() {
   for (const member of members) {
     const entries = await listWorktrees(member.absPath);
     for (const entry of entries) {
-      const entryPath = path57.normalize(entry.path);
-      const marker = `${path57.sep}.claude${path57.sep}worktrees${path57.sep}`;
+      const entryPath = path58.normalize(entry.path);
+      const marker = `${path58.sep}.claude${path58.sep}worktrees${path58.sep}`;
       const idx = entryPath.indexOf(marker);
       if (idx === -1) continue;
       const rest = entryPath.slice(idx + marker.length);
-      const slugName = rest.split(path57.sep)[0];
+      const slugName = rest.split(path58.sep)[0];
       if (!slugName) continue;
-      if (!existsSync5(path57.join(wsWorktreesDir, slugName))) {
+      if (!existsSync5(path58.join(wsWorktreesDir, slugName))) {
         orphans.push(
-          `${member.id}: worktree registered at ${entry.path} but ${path57.join(wsWorktreesDir, slugName)} no longer exists \u2014 run \`git -C "${member.absPath}" worktree prune\`.`
+          `${member.id}: worktree registered at ${entry.path} but ${path58.join(wsWorktreesDir, slugName)} no longer exists \u2014 run \`git -C "${member.absPath}" worktree prune\`.`
         );
       }
     }
@@ -8821,7 +9010,7 @@ async function runDoctor2() {
 // src/workspace/worktree/hydrate-command.ts
 import { existsSync as existsSync6 } from "node:fs";
-import path58 from "node:path";
+import path59 from "node:path";
 async function runHydrateWorktree(opts) {
   const rootInfo = await resolveRoots();
   if (!rootInfo.isGitRepo || !rootInfo.isLinkedWorktree) {
@@ -8832,7 +9021,7 @@ async function runHydrateWorktree(opts) {
   }
   const workspaceRoot = rootInfo.mainRoot;
   const wtPath = rootInfo.repoRoot;
-  if (!wtPath.startsWith(`${worktreesDir(workspaceRoot)}${path58.sep}`)) {
+  if (!wtPath.startsWith(`${worktreesDir(workspaceRoot)}${path59.sep}`)) {
     return {
       ok: false,
       error: "Current worktree is not one of this workspace's .claude/worktrees/<slug> checkouts."
@@ -8844,49 +9033,97 @@ async function runHydrateWorktree(opts) {
     return { ok: false, error: `Unknown --only repo(s): ${unknown.join(", ")}` };
   }
   const state = await readWorktreeState(wtPath);
-  const slug = state?.slug ?? path58.basename(wtPath);
+  const slug = state?.slug ?? path59.basename(wtPath);
+  const detectedBranch = await currentBranch(wtPath);
+  const targetBranch = state?.branch ?? (detectedBranch !== "HEAD" ? detectedBranch : void 0) ?? slug;
   if (opts.dryRun) {
-    const results2 = selected.map((member) => {
-      const memberPath = path58.join(wtPath, member.folder);
-      return {
-        member: member.id,
-        folder: member.folder,
-        status: existsSync6(memberPath) ? "planned" : "skipped",
-        error: existsSync6(memberPath) ? void 0 : "not materialized in this worktree"
-      };
-    });
+    const results2 = await Promise.all(
+      selected.map(async (member) => {
+        const memberPath = path59.join(wtPath, member.folder);
+        if (existsSync6(memberPath)) {
+          return { member: member.id, folder: member.folder, status: "planned" };
+        }
+        if (!opts.materialize) {
+          return {
+            member: member.id,
+            folder: member.folder,
+            status: "skipped",
+            error: "not materialized in this worktree"
+          };
+        }
+        const branchAction = await branchExists(member.absPath, targetBranch) ? "checkout" : "create";
+        return { member: member.id, folder: member.folder, status: "planned", branchAction };
+      })
+    );
     return { ok: true, dryRun: true, slug, results: results2 };
   }
   const results = await mapWithConcurrency(
     selected,
     async (member) => {
-      const memberPath = path58.join(wtPath, member.folder);
+      const memberPath = path59.join(wtPath, member.folder);
+      let branchAction;
       if (!existsSync6(memberPath)) {
-        return {
-          member: member.id,
-          folder: member.folder,
-          status: "skipped",
-          error: "not materialized in this worktree"
-        };
+        if (!opts.materialize) {
+          return {
+            member: member.id,
+            folder: member.folder,
+            status: "skipped",
+            error: "not materialized in this worktree"
+          };
+        }
+        const outcome = await addWorktree(member.absPath, memberPath, targetBranch, {
+          preferDefaultBranchFrom: true
+        });
+        if (!outcome.ok) {
+          return {
+            member: member.id,
+            folder: member.folder,
+            status: "failed",
+            error: outcome.checkedOutElsewhere ? `Branch "${targetBranch}" is already checked out elsewhere in ${member.id} \u2014 remove that worktree or resolve the branch conflict first.` : outcome.stderr ?? "unknown error creating the member worktree"
+          };
+        }
+        branchAction = outcome.branchAction;
       }
       try {
         const hydration = await hydrateMember(member.absPath, memberPath, { force: opts.force });
-        return { member: member.id, folder: member.folder, status: "ok", hydration };
+        return { member: member.id, folder: member.folder, status: "ok", hydration, branchAction };
       } catch (err) {
         return {
           member: member.id,
           folder: member.folder,
           status: "failed",
-          error: err instanceof Error ? err.message : String(err)
+          error: err instanceof Error ? err.message : String(err),
+          branchAction
         };
       }
     }
   );
+  const newlyMaterialized = results.filter((r) => r.branchAction && r.status === "ok");
+  if (newlyMaterialized.length > 0) {
+    const byId = new Map((state?.members ?? []).map((m) => [m.id, m]));
+    for (const r of newlyMaterialized) {
+      const member = selected.find((m) => m.id === r.member);
+      if (!member) continue;
+      const entry = {
+        id: member.id,
+        folder: member.folder,
+        branch: targetBranch,
+        absPath: member.absPath
+      };
+      byId.set(member.id, entry);
+    }
+    await writeWorktreeState(wtPath, {
+      slug,
+      branch: state?.branch ?? targetBranch,
+      createdAt: state?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+      members: Array.from(byId.values())
+    });
+  }
   return { ok: results.every((r) => r.status !== "failed"), dryRun: false, slug, results };
 }
 // src/workspace/worktree/list.ts
-import path59 from "node:path";
+import path60 from "node:path";
 import fs41 from "fs-extra";
 async function runList2() {
   const resolved = await resolveWorkspaceForWorktree();
@@ -8899,12 +9136,12 @@ async function runList2() {
   const configuredMembers = await readMembers(rootInfo);
   const worktrees = [];
   for (const slug of slugs) {
-    const wtPath = path59.join(dir, slug);
+    const wtPath = path60.join(dir, slug);
     const state = await readWorktreeState(wtPath);
     const members = [];
     const source = state?.members ?? configuredMembers.map((m) => ({ id: m.id, folder: m.folder }));
     for (const m of source) {
-      const memberPath = path59.join(wtPath, m.folder);
+      const memberPath = path60.join(wtPath, m.folder);
       const materialized = await fs41.pathExists(memberPath);
       const actualBranch = materialized ? await currentBranch(memberPath) : void 0;
       members.push({
@@ -8926,7 +9163,7 @@ async function runList2() {
 }
 // src/workspace/worktree/remove.ts
-import path60 from "node:path";
+import path61 from "node:path";
 import fs42 from "fs-extra";
 async function runRemove(opts) {
   const resolved = await resolveWorkspaceForWorktree();
@@ -8953,7 +9190,7 @@ async function runRemove(opts) {
     targets.push({
       repo: configMember?.id ?? stateMember.id,
       ownerRepo,
-      path: path60.join(wsWorktreePath, stateMember.folder)
+      path: path61.join(wsWorktreePath, stateMember.folder)
     });
   }
   const existingTargets = [];
@@ -9081,7 +9318,8 @@ async function handleHydrate(opts) {
   const hydrateOpts = {
     only: normalizeOnly(opts.only),
     force: Boolean(opts.force),
-    dryRun: Boolean(opts.dryRun)
+    dryRun: Boolean(opts.dryRun),
+    materialize: Boolean(opts.materialize)
   };
   const result = await runHydrateWorktree(hydrateOpts);
   if (!result.ok && "error" in result) {
@@ -9091,14 +9329,20 @@ async function handleHydrate(opts) {
   }
   if (result.dryRun) {
     log(`[dry-run] Would hydrate "${result.slug}":`);
-    for (const r of result.results)
-      log(`[dry-run]   ${r.member}: ${r.status}${r.error ? ` (${r.error})` : ""}`);
+    for (const r of result.results) {
+      const action = r.branchAction ? ` (${r.branchAction} member worktree first)` : "";
+      log(`[dry-run]   ${r.member}: ${r.status}${action}${r.error ? ` (${r.error})` : ""}`);
+    }
     return;
   }
   log(`Hydrated "${result.slug}":`);
   for (const r of result.results) {
-    if (r.status === "ok" && r.hydration) log(`  ${r.member}: ${describeInstall(r.hydration)}`);
-    else warn(`  ${r.member}: ${r.status}${r.error ? ` \u2014 ${r.error}` : ""}`);
+    if (r.status === "ok" && r.hydration) {
+      const materializedNote = r.branchAction ? `materialized (${r.branchAction}), ` : "";
+      log(`  ${r.member}: ${materializedNote}${describeInstall(r.hydration)}`);
+    } else {
+      warn(`  ${r.member}: ${r.status}${r.error ? ` \u2014 ${r.error}` : ""}`);
+    }
   }
   if (!result.ok) process.exitCode = 1;
 }
@@ -9157,6 +9401,13 @@ async function handleList() {
     }
   }
 }
+function emitFromHookContext(additionalContext) {
+  log(
+    JSON.stringify({
+      hookSpecificOutput: { hookEventName: "SessionStart", additionalContext }
+    })
+  );
+}
 async function handleDoctor(opts) {
   try {
     const report = await runDoctor2();
@@ -9168,17 +9419,26 @@ async function handleDoctor(opts) {
       return;
     }
     if (report.problems.length === 0) {
-      log(
-        report.inWorkspaceWorktree ? `Workspace worktree "${report.slug}" looks healthy.` : "No issues found."
+      if (!opts.fromHook) {
+        log(
+          report.inWorkspaceWorktree ? `Workspace worktree "${report.slug}" looks healthy.` : "No issues found."
+        );
+      }
+      return;
+    }
+    if (opts.fromHook) {
+      const scope = report.slug ? `Workspace worktree "${report.slug}"` : "This haus workspace";
+      emitFromHookContext(
+        `${scope} has ${report.problems.length} issue(s): ${report.problems.join("; ")}`
       );
       return;
     }
     for (const p of report.problems) warn(p);
-    if (!opts.fromHook) process.exitCode = 1;
+    process.exitCode = 1;
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     if (opts.fromHook) {
-      warn(`worktree doctor: ${message}`);
+      emitFromHookContext(`\`haus workspace worktree doctor\` failed: ${message}`);
     } else {
       error(message);
       process.exitCode = 1;
@@ -9202,7 +9462,7 @@ async function runWorktree(action, opts = {}) {
 // src/commands/workspace.ts
 import { existsSync as existsSync10, statSync as statSync3 } from "node:fs";
-import path69 from "node:path";
+import path70 from "node:path";
 // src/commands/workspace/aggregate.ts
 async function writeWorkspaceArtifacts(workspaceRoot, repos, relationships = []) {
@@ -9257,18 +9517,18 @@ ${summaries.map(
 // src/commands/workspace/doctor.ts
 import { existsSync as existsSync7 } from "node:fs";
-import path62 from "node:path";
+import path63 from "node:path";
 // src/commands/workspace/manifest.ts
 import { readFileSync as readFileSync4 } from "node:fs";
-import path61 from "node:path";
+import path62 from "node:path";
 var MANIFEST_FILE = "workspace.manifest.json";
 function manifestPath(workspaceRoot) {
   return hausPath(workspaceRoot, MANIFEST_FILE);
 }
 function hausVersion() {
   try {
-    const pkg = JSON.parse(readFileSync4(path61.join(packageRoot(), "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync4(path62.join(packageRoot(), "package.json"), "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -9352,7 +9612,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
   const manifestByName = new Map(manifest.repos.map((r) => [r.name, r]));
   const catalogRefByRepo = [];
   for (const repo of config.repos) {
-    const repoRoot = path62.resolve(workspaceRoot, repo.path);
+    const repoRoot = path63.resolve(workspaceRoot, repo.path);
     const entry = manifestByName.get(repo.name);
     if (!entry) {
       flag({
@@ -9425,7 +9685,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
         });
         continue;
       }
-      if (!existsSync7(path62.join(workspaceRoot, entry.path))) {
+      if (!existsSync7(path63.join(workspaceRoot, entry.path))) {
         flag({
           repo: entry.repo,
           kind: "missing-linked-context-copy",
@@ -9468,15 +9728,15 @@ function emit(args) {
 }
 // src/workspace/link-context/link.ts
-import path65 from "node:path";
+import path66 from "node:path";
 import fs45 from "fs-extra";
 // src/workspace/link-context/plan.ts
-import path64 from "node:path";
+import path65 from "node:path";
 import fs44 from "fs-extra";
 // src/workspace/link-context/scan-source.ts
-import path63 from "node:path";
+import path64 from "node:path";
 import fs43 from "fs-extra";
 var ASSET_SUBDIR = {
   skill: "skills",
@@ -9485,36 +9745,36 @@ var ASSET_SUBDIR = {
 };
 async function hasLinkableContext(member) {
   for (const subdir of Object.values(ASSET_SUBDIR)) {
-    if (await fs43.pathExists(path63.join(member.absPath, ".claude", subdir))) return true;
+    if (await fs43.pathExists(path64.join(member.absPath, ".claude", subdir))) return true;
   }
   return false;
 }
 async function collectSkills(member) {
-  const dir = path63.join(member.absPath, ".claude", "skills");
+  const dir = path64.join(member.absPath, ".claude", "skills");
   if (!await fs43.pathExists(dir)) return [];
   const names = await fs43.readdir(dir);
   const out = [];
   for (const name of [...names].sort()) {
-    const abs = path63.join(dir, name);
+    const abs = path64.join(dir, name);
     const stat = await fs43.lstat(abs);
     if (!stat.isDirectory()) continue;
-    if (!await fs43.pathExists(path63.join(abs, "SKILL.md"))) continue;
-    out.push({ type: "skill", name, sourceRelPath: path63.posix.join(".claude", "skills", name) });
+    if (!await fs43.pathExists(path64.join(abs, "SKILL.md"))) continue;
+    out.push({ type: "skill", name, sourceRelPath: path64.posix.join(".claude", "skills", name) });
   }
   return out;
 }
 async function collectFlatMarkdown(member, type) {
   const subdir = ASSET_SUBDIR[type];
-  const dir = path63.join(member.absPath, ".claude", subdir);
+  const dir = path64.join(member.absPath, ".claude", subdir);
   if (!await fs43.pathExists(dir)) return [];
   const names = await fs43.readdir(dir);
   const out = [];
   for (const fileName of [...names].sort()) {
     if (!fileName.endsWith(".md")) continue;
-    const abs = path63.join(dir, fileName);
+    const abs = path64.join(dir, fileName);
     if (!(await fs43.lstat(abs)).isFile()) continue;
     const name = fileName.slice(0, -".md".length);
-    out.push({ type, name, sourceRelPath: path63.posix.join(".claude", subdir, fileName) });
+    out.push({ type, name, sourceRelPath: path64.posix.join(".claude", subdir, fileName) });
   }
   return out;
 }
@@ -9529,9 +9789,9 @@ async function collectSourceAssets(member) {
 // src/workspace/link-context/plan.ts
 function repoFolderPrefix(member) {
-  const base = path64.posix.basename(member.folder);
+  const base = path65.posix.basename(member.folder);
   if (base && base !== "." && base !== "/") return base;
-  const fromAbs = path64.basename(member.absPath);
+  const fromAbs = path65.basename(member.absPath);
   return fromAbs || member.id;
 }
 function assetKey(type, destKey) {
@@ -9588,7 +9848,7 @@ async function buildLinkPlan(members) {
       name: asset.name,
       destKey,
       sourceRelPath: asset.sourceRelPath,
-      sourceAbsPath: path64.join(member.absPath, asset.sourceRelPath),
+      sourceAbsPath: path65.join(member.absPath, asset.sourceRelPath),
       sourceHash
     });
   }
@@ -9599,7 +9859,7 @@ async function buildLinkPlan(members) {
 function destRelPathFor(type, destKey) {
   const subdir = `${type}s`;
   const leaf = type === "skill" ? destKey : `${destKey}.md`;
-  return path65.posix.join(".claude", subdir, leaf);
+  return path66.posix.join(".claude", subdir, leaf);
 }
 async function runLinkContext(workspaceRoot, opts = {}) {
   const write = opts.write ?? false;
@@ -9625,9 +9885,9 @@ async function runLinkContext(workspaceRoot, opts = {}) {
   const linkedAt = (/* @__PURE__ */ new Date()).toISOString();
   for (const entry of plan.entries) {
     const destRel = destRelPathFor(entry.type, entry.destKey);
-    const destAbs = path65.join(workspaceRoot, destRel);
+    const destAbs = path66.join(workspaceRoot, destRel);
     if (write) {
-      await fs45.ensureDir(path65.dirname(destAbs));
+      await fs45.ensureDir(path66.dirname(destAbs));
       if (await fs45.pathExists(destAbs)) await fs45.remove(destAbs);
       await fs45.copy(entry.sourceAbsPath, destAbs, {
         overwrite: true,
@@ -9659,7 +9919,7 @@ async function runLinkContext(workspaceRoot, opts = {}) {
     if (nextPaths.has(old.path)) continue;
     removed.push(old.path);
     if (write) {
-      const abs = path65.join(workspaceRoot, old.path);
+      const abs = path66.join(workspaceRoot, old.path);
       if (await fs45.pathExists(abs)) await fs45.remove(abs);
     }
   }
@@ -9712,10 +9972,10 @@ async function runWorkspaceLinkContext(workspaceRoot, opts = {}) {
 // src/commands/workspace/setup.ts
 import { existsSync as existsSync8, statSync } from "node:fs";
-import path67 from "node:path";
+import path68 from "node:path";
 // src/claude/write-workspace-claude-md.ts
-import path66 from "node:path";
+import path67 from "node:path";
 import fs46 from "fs-extra";
 function buildWorkspaceImportBlock(client, members) {
   const memberLines = members.map((m) => `- ${m.name} (${m.path})`);
@@ -9734,7 +9994,7 @@ ${BLOCK_END}`;
 async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
   const block = buildWorkspaceImportBlock(opts.client, opts.members);
   const dryRun = opts.dryRun ?? false;
-  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path66.join(workspaceRoot, "CLAUDE.md");
+  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path67.join(workspaceRoot, "CLAUDE.md");
   const say = opts.quiet ? () => {
   } : log;
   const existed = await fs46.pathExists(filePath);
@@ -9765,20 +10025,20 @@ async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
 // src/commands/workspace/setup.ts
 function resolveWorkspaceRoot(start = process.cwd()) {
-  let dir = path67.resolve(start);
+  let dir = path68.resolve(start);
   for (; ; ) {
-    if (existsSync8(path67.join(dir, WORKSPACE_FILE))) return dir;
-    const parent = path67.dirname(dir);
-    if (parent === dir) return path67.resolve(start);
+    if (existsSync8(path68.join(dir, WORKSPACE_FILE))) return dir;
+    const parent = path68.dirname(dir);
+    if (parent === dir) return path68.resolve(start);
     dir = parent;
   }
 }
 function isRootRepo(workspaceRoot, repoPath) {
-  return path67.resolve(workspaceRoot, repoPath) === path67.resolve(workspaceRoot);
+  return path68.resolve(workspaceRoot, repoPath) === path68.resolve(workspaceRoot);
 }
 async function runWorkspaceSetup(workspaceRoot, options = {}) {
   const apply = options.write ?? false;
-  const configText = await readText(path67.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path68.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
@@ -9805,7 +10065,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
   const statuses = [];
   const aggregateInputs = [];
   for (const repo of repos) {
-    const repoRoot = path67.resolve(workspaceRoot, repo.path);
+    const repoRoot = path68.resolve(workspaceRoot, repo.path);
     say(`
 \u2192 ${repo.name} (${repo.path})`);
     try {
@@ -9876,7 +10136,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
       const status = statusByName.get(repo.name);
       const role = repo.role ?? status?.roles?.[0] ?? "auto";
       if (status?.status === "ok") {
-        const lock = await checkLock(path67.resolve(workspaceRoot, repo.path));
+        const lock = await checkLock(path68.resolve(workspaceRoot, repo.path));
         manifestRepos.push({
           name: repo.name,
           path: repo.path,
@@ -9932,7 +10192,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
     try {
       const linkResult = await runLinkContext(workspaceRoot, { write: true, json: options.json });
       if (linkResult.ok) {
-        written.push(...linkResult.added.map((rel) => path67.join(workspaceRoot, rel)));
+        written.push(...linkResult.added.map((rel) => path68.join(workspaceRoot, rel)));
         if (!options.json) {
           say(
             `Linked ${linkResult.linked.length} cross-repo skill/agent/command copy(ies) into .claude/ (${linkResult.added.length} new, ${linkResult.removed.length} removed)${linkResult.skipped.length > 0 ? ` \u2014 ${linkResult.skipped.length} member(s) skipped, see above` : ""}.`
@@ -9964,7 +10224,7 @@ Workspace setup complete: ${ok} ok, ${failed} failed. Wrote ${written.length} fi
 // src/commands/workspace/undo.ts
 import { existsSync as existsSync9, statSync as statSync2 } from "node:fs";
-import path68 from "node:path";
+import path69 from "node:path";
 import fs47 from "fs-extra";
 var WORKSPACE_AGGREGATE_FILES = [
   "workspace-summary.json",
@@ -9993,7 +10253,7 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
   }
   let anyRepoFailed = false;
   for (const repo of config.repos) {
-    const repoRoot = path68.resolve(workspaceRoot, repo.path);
+    const repoRoot = path69.resolve(workspaceRoot, repo.path);
     log(`
 \u2192 ${repo.name} (${repo.path})`);
     try {
@@ -10008,7 +10268,7 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
   }
   const linkedContext = await readLinkedContext(workspaceRoot);
   for (const entry of linkedContext) {
-    const abs = path68.join(workspaceRoot, entry.path);
+    const abs = path69.join(workspaceRoot, entry.path);
     if (await fs47.pathExists(abs)) {
       await fs47.remove(abs);
       log(`Removed ${entry.path} (linked ${entry.type} from ${entry.repo})`);
@@ -10018,20 +10278,20 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
     const abs = hausPath(workspaceRoot, rel);
     if (await fs47.pathExists(abs)) {
       await fs47.remove(abs);
-      log(`Removed ${path68.relative(workspaceRoot, abs)}`);
+      log(`Removed ${path69.relative(workspaceRoot, abs)}`);
     }
   }
   const manifestFile = manifestPath(workspaceRoot);
   if (await fs47.pathExists(manifestFile)) {
     await fs47.remove(manifestFile);
-    log(`Removed ${path68.relative(workspaceRoot, manifestFile)}`);
+    log(`Removed ${path69.relative(workspaceRoot, manifestFile)}`);
   }
   const workspaceMdPath = hausPath(workspaceRoot, "WORKSPACE.md");
   if (await fs47.pathExists(workspaceMdPath)) {
     await fs47.remove(workspaceMdPath);
-    log(`Removed ${path68.relative(workspaceRoot, workspaceMdPath)}`);
+    log(`Removed ${path69.relative(workspaceRoot, workspaceMdPath)}`);
   } else {
-    const claudeMdPath = path68.join(workspaceRoot, "CLAUDE.md");
+    const claudeMdPath = path69.join(workspaceRoot, "CLAUDE.md");
     if (existsSync9(claudeMdPath)) {
       const prev = await readText(claudeMdPath);
       if (prev?.includes(BLOCK_BEGIN)) {
@@ -10083,7 +10343,7 @@ relationships: []
   log("Workspace initialized.");
 }
 async function scanWorkspace(workspaceRoot, opts) {
-  const configText = await readText(path69.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path70.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
@@ -10105,7 +10365,7 @@ async function scanWorkspace(workspaceRoot, opts) {
   const inputs = [];
   const failures = [];
   for (const repo of config.repos) {
-    const repoRoot = path69.resolve(workspaceRoot, repo.path);
+    const repoRoot = path70.resolve(workspaceRoot, repo.path);
     try {
       if (!existsSync10(repoRoot) || !statSync3(repoRoot).isDirectory()) {
         throw new Error("path is not a directory");
@@ -10171,7 +10431,7 @@ async function runWorkspace(action, options = {}) {
 // src/cli.ts
 function cliVersion() {
   try {
-    const pkgPath = path70.join(packageRoot(), "package.json");
+    const pkgPath = path71.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
@@ -10181,7 +10441,7 @@ function cliVersion() {
 var program = new Command();
 function validateRuntimeNodeVersion() {
   try {
-    const pkgPath = path70.join(packageRoot(), "package.json");
+    const pkgPath = path71.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
     const requiredRange = pkg.engines?.node;
     if (requiredRange && !satisfiesVersion(process.version, requiredRange)) {
@@ -10282,8 +10542,16 @@ worktree.command("add <slug>").description(
     dryRun: opts.dryRun
   })
 );
-worktree.command("hydrate").description("Re-run CoW clone + install-reconciliation for the current workspace worktree").option("--only <repos>", "Restrict to comma- or space-separated member ids/folders").option("--force", "Re-clone hydration targets even if already present").option("--dry-run", "Preview without writing or running anything").action(
-  (opts) => runWorktree("hydrate", { only: opts.only, force: opts.force, dryRun: opts.dryRun })
+worktree.command("hydrate").description("Re-run CoW clone + install-reconciliation for the current workspace worktree").option("--only <repos>", "Restrict to comma- or space-separated member ids/folders").option("--force", "Re-clone hydration targets even if already present").option(
+  "--materialize",
+  "Also `git worktree add` any member missing entirely (e.g. a worktree created by plain `git worktree add` outside haus) before hydrating it"
+).option("--dry-run", "Preview without writing or running anything").action(
+  (opts) => runWorktree("hydrate", {
+    only: opts.only,
+    force: opts.force,
+    materialize: opts.materialize,
+    dryRun: opts.dryRun
+  })
 );
 worktree.command("list").description("List materialized workspace worktrees and their member status").action(() => runWorktree("list"));
 worktree.command("remove <slug>").description("Remove a workspace worktree and its member worktrees").option("--force", "Bypass the uncommitted/unpushed-work refusal").option("--dry-run", "Preview without removing anything").action(