@haus-tech/haus-workflow 1.5.0 → 1.5.2

package/dist/cli.js

@@ -60,7 +60,7 @@ var init_exec = __esm({
 
 // src/cli.ts
 import { readFileSync as readFileSync5 } from "node:fs";
-import path70 from "node:path";
+import path71 from "node:path";
 import { Command } from "commander";
 
 // src/commands/apply.ts
@@ -2103,8 +2103,8 @@ function buildDenyRules() {
   for (const command of DENY_COMMANDS) {
     rules.push(`Bash(${command}:*)`);
   }
-  for (const path71 of DENY_PATHS) {
-    const pattern = DENY_DIRS.has(path71) ? `${path71}/**` : path71;
+  for (const path72 of DENY_PATHS) {
+    const pattern = DENY_DIRS.has(path72) ? `${path72}/**` : path72;
     for (const tool of FILE_TOOLS) {
       rules.push(`${tool}(${pattern})`);
     }
@@ -4151,19 +4151,133 @@ async function runCatalogAudit() {
 }
 
 // src/commands/doctor.ts
-import path37 from "node:path";
+import path38 from "node:path";
 import fs29 from "fs-extra";
 
 // src/decisions/doctor.ts
-import path28 from "node:path";
+import path29 from "node:path";
 import fs26 from "fs-extra";
 
 // src/decisions/check.ts
-import path27 from "node:path";
+import path28 from "node:path";
 import fs25 from "fs-extra";
 
+// src/decisions/dep-bump.ts
+var DEP_SECTIONS = [
+  "dependencies",
+  "devDependencies",
+  "peerDependencies",
+  "optionalDependencies"
+];
+function isRecord(value) {
+  return value != null && typeof value === "object" && !Array.isArray(value);
+}
+function extractDepMap(pkg) {
+  const map = /* @__PURE__ */ new Map();
+  if (!isRecord(pkg)) return map;
+  for (const section of DEP_SECTIONS) {
+    const block = pkg[section];
+    if (!isRecord(block)) continue;
+    for (const [name, ver] of Object.entries(block)) {
+      if (typeof ver === "string") map.set(`${section}:${name}`, ver);
+    }
+  }
+  return map;
+}
+function stripDepSections(pkg) {
+  const out = { ...pkg };
+  for (const section of DEP_SECTIONS) delete out[section];
+  return out;
+}
+function mapsEqualKeys(a, b) {
+  if (a.size !== b.size) return false;
+  for (const k of a.keys()) if (!b.has(k)) return false;
+  return true;
+}
+function isDependencyBumpOnly(beforeText, afterText) {
+  let before;
+  let after;
+  try {
+    before = JSON.parse(beforeText);
+    after = JSON.parse(afterText);
+  } catch {
+    return false;
+  }
+  if (!isRecord(before) || !isRecord(after)) return false;
+  const beforeDeps = extractDepMap(before);
+  const afterDeps = extractDepMap(after);
+  if (beforeDeps.size === 0 && afterDeps.size === 0) return false;
+  if (!mapsEqualKeys(beforeDeps, afterDeps)) return false;
+  if (JSON.stringify(stripDepSections(before)) !== JSON.stringify(stripDepSections(after))) {
+    return false;
+  }
+  for (const [key, ver] of beforeDeps) {
+    if (afterDeps.get(key) !== ver) return true;
+  }
+  return false;
+}
+
 // src/decisions/diff.ts
 init_exec();
+import path25 from "node:path";
+function isPackageJsonPath(file) {
+  return file === "package.json" || file.endsWith("/package.json");
+}
+async function readBlob(root, spec) {
+  const result = await runGit(["show", spec], { cwd: root });
+  return result.exitCode === 0 ? result.stdout : null;
+}
+function parseDiffRange(range) {
+  const tripleIdx = range.indexOf("...");
+  if (tripleIdx !== -1) {
+    return {
+      left: range.slice(0, tripleIdx) || "HEAD",
+      right: range.slice(tripleIdx + 3) || "HEAD",
+      triple: true
+    };
+  }
+  const idx = range.indexOf("..");
+  if (idx !== -1) {
+    return {
+      left: range.slice(0, idx) || "HEAD",
+      right: range.slice(idx + 2) || "HEAD",
+      triple: false
+    };
+  }
+  return null;
+}
+async function getCurrentBranch(root) {
+  const result = await runGit(["rev-parse", "--abbrev-ref", "HEAD"], { cwd: root });
+  if (result.exitCode !== 0) return void 0;
+  const name = result.stdout.trim();
+  if (name && name !== "HEAD") return name;
+  const gha = process.env.GITHUB_HEAD_REF?.trim();
+  if (gha) return gha;
+  return void 0;
+}
+async function resolvePackageJsonPair(root, file, opts) {
+  const empty = "{}";
+  if (opts.staged) {
+    const before2 = await readBlob(root, `HEAD:${file}`) ?? empty;
+    const after2 = await readBlob(root, `:${file}`) ?? empty;
+    return { before: before2, after: after2 };
+  }
+  const range = opts.range ?? "HEAD";
+  const parsed = parseDiffRange(range);
+  if (parsed) {
+    let leftRev = parsed.left;
+    if (parsed.triple) {
+      const mb = await runGit(["merge-base", parsed.left, parsed.right], { cwd: root });
+      leftRev = mb.exitCode === 0 ? mb.stdout.trim() : parsed.left;
+    }
+    const before2 = await readBlob(root, `${leftRev}:${file}`) ?? empty;
+    const after2 = await readBlob(root, `${parsed.right}:${file}`) ?? empty;
+    return { before: before2, after: after2 };
+  }
+  const before = await readBlob(root, `${range}:${file}`) ?? empty;
+  const after = await readText(path25.join(root, file)) ?? empty;
+  return { before, after };
+}
 async function collectDiffStats(root, opts) {
   const gitArgs = opts.staged ? ["diff", "--cached", "--name-only"] : ["diff", "--name-only", opts.range ?? "HEAD"];
   const names = await runGit(gitArgs, { cwd: root });
@@ -4180,9 +4294,23 @@ async function collectDiffStats(root, opts) {
     if (!Number.isNaN(added)) linesAdded += added;
     if (!Number.isNaN(removed)) linesRemoved += removed;
   }
-  return { files, linesAdded, linesRemoved };
+  const packageJsonPairs = {};
+  for (const file of files) {
+    if (!isPackageJsonPath(file)) continue;
+    packageJsonPairs[file] = await resolvePackageJsonPair(root, file, opts);
+  }
+  return {
+    files,
+    linesAdded,
+    linesRemoved,
+    ...Object.keys(packageJsonPairs).length > 0 ? { packageJsonPairs } : {}
+  };
 }
 
+// src/decisions/local-exemptions.ts
+var LOCAL_EXEMPT_GLOBS = ["library/catalog/**"];
+var LOCAL_EXEMPT_BRANCH_PATTERN = /^chore\/sync-catalog/;
+
 // src/decisions/match.ts
 function segmentToRegex(segment) {
   if (segment === "**") return ".*";
@@ -4210,26 +4338,29 @@ function matchesAnyGlob(filePath, patterns) {
   return patterns.some((p) => matchesPathGlob(filePath, p));
 }
 function matchesAnyRegex(filePath, patterns) {
+  return firstMatchingRegex(filePath, patterns) != null;
+}
+function firstMatchingRegex(filePath, patterns) {
   const norm = filePath.replace(/\\/g, "/");
-  return patterns.some((p) => new RegExp(p).test(norm));
+  return patterns.find((p) => new RegExp(p).test(norm));
 }
 
 // src/decisions/paths.ts
-import path25 from "node:path";
+import path26 from "node:path";
 import fs23 from "fs-extra";
 async function resolveDecisionsDir(root) {
-  const primary = path25.join(root, DECISIONS_TRIGGERS.decisionsDir);
+  const primary = path26.join(root, DECISIONS_TRIGGERS.decisionsDir);
   if (await fs23.pathExists(primary)) return primary;
-  const legacy = path25.join(root, DECISIONS_TRIGGERS.legacyDecisionsDir ?? "docs/adr");
+  const legacy = path26.join(root, DECISIONS_TRIGGERS.legacyDecisionsDir ?? "docs/adr");
   if (await fs23.pathExists(legacy)) return legacy;
   return primary;
 }
 function relativeDecisionPath(decisionsDir, root) {
-  return path25.relative(root, decisionsDir).replace(/\\/g, "/");
+  return path26.relative(root, decisionsDir).replace(/\\/g, "/");
 }
 
 // src/decisions/validate.ts
-import path26 from "node:path";
+import path27 from "node:path";
 import fs24 from "fs-extra";
 function validateDecisionContent(content2) {
   const errors = [];
@@ -4259,14 +4390,14 @@ function decisionNumberFromFile(name) {
   return match?.[1] ?? null;
 }
 async function validateIndexSync(decisionsDir, decisionFiles) {
-  const readmePath = path26.join(decisionsDir, "README.md");
+  const readmePath = path27.join(decisionsDir, "README.md");
   if (!await fs24.pathExists(readmePath)) {
     return ["docs/decisions/README.md is missing"];
   }
   const readme = await readText(readmePath) ?? "";
   const errors = [];
   for (const file of decisionFiles) {
-    const num = decisionNumberFromFile(path26.basename(file));
+    const num = decisionNumberFromFile(path27.basename(file));
     if (num && !indexReferencesNumber(readme, num)) {
       errors.push(`README.md missing index row for ADR-${num}`);
     }
@@ -4275,8 +4406,35 @@ async function validateIndexSync(decisionsDir, decisionFiles) {
 }
 
 // src/decisions/check.ts
+var MANIFEST_LOCK_BASENAMES = /* @__PURE__ */ new Set([
+  "package.json",
+  "yarn.lock",
+  "pnpm-lock.yaml",
+  "package-lock.json"
+]);
 function isExempt(file) {
-  return matchesAnyGlob(file, DECISIONS_TRIGGERS.exemptGlobs);
+  return matchesAnyGlob(file, DECISIONS_TRIGGERS.exemptGlobs) || matchesAnyGlob(file, [...LOCAL_EXEMPT_GLOBS]);
+}
+function isManifestOrLockfile(file) {
+  const base = file.split("/").pop() ?? file;
+  return MANIFEST_LOCK_BASENAMES.has(base);
+}
+function isPackageJsonPath2(file) {
+  return file === "package.json" || file.endsWith("/package.json");
+}
+function isPureDependencyBumpDiff(stats) {
+  const relevant = stats.files.filter((f) => !isExempt(f));
+  if (relevant.length === 0) return false;
+  if (relevant.some((f) => !isManifestOrLockfile(f))) return false;
+  const pkgJsons = relevant.filter(isPackageJsonPath2);
+  if (pkgJsons.length === 0) {
+    return true;
+  }
+  const pairs = stats.packageJsonPairs ?? {};
+  return pkgJsons.every((f) => {
+    const pair = pairs[f];
+    return pair != null && isDependencyBumpOnly(pair.before, pair.after);
+  });
 }
 function countTopLevelDirs(files) {
   const dirs = /* @__PURE__ */ new Set();
@@ -4286,21 +4444,35 @@ function countTopLevelDirs(files) {
   }
   return dirs.size;
 }
-function isDecisionTriggered(stats) {
-  const relevant = stats.files.filter((f) => !isExempt(f));
-  if (relevant.length === 0) return false;
+function firstMatchingGlob(file, globs) {
+  return globs.find((g) => matchesPathGlob(file, g));
+}
+function explainDecisionTrigger(stats) {
+  let relevant = stats.files.filter((f) => !isExempt(f));
+  if (relevant.length === 0) return [];
+  if (isPureDependencyBumpDiff(stats)) {
+    relevant = relevant.filter((f) => !isManifestOrLockfile(f));
+    if (relevant.length === 0) return [];
+  }
   for (const file of relevant) {
-    if (matchesAnyGlob(file, DECISIONS_TRIGGERS.pathGlobs)) return true;
-    if (matchesAnyRegex(file, DECISIONS_TRIGGERS.pathRegex)) return true;
+    const glob = firstMatchingGlob(file, DECISIONS_TRIGGERS.pathGlobs);
+    if (glob) {
+      return [`matched pathGlobs: ${glob}`];
+    }
+    const regex = firstMatchingRegex(file, DECISIONS_TRIGGERS.pathRegex);
+    if (regex) {
+      return [`matched pathRegex: ${regex}`];
+    }
   }
   const totalLines = stats.linesAdded + stats.linesRemoved;
-  if (relevant.length >= DECISIONS_TRIGGERS.minFilesChanged && countTopLevelDirs(relevant) >= 2) {
-    return true;
+  const dirs = countTopLevelDirs(relevant);
+  if (relevant.length >= DECISIONS_TRIGGERS.minFilesChanged && dirs >= 2) {
+    return [`size threshold: ${relevant.length} files across ${dirs} top-level dirs`];
   }
   if (totalLines >= DECISIONS_TRIGGERS.minLinesChanged && relevant.some((f) => !f.startsWith("docs/"))) {
-    return true;
+    return [`size threshold: ${totalLines} lines changed (non-docs)`];
   }
-  return false;
+  return [];
 }
 function isSecurityTriggered(stats) {
   const relevant = stats.files.filter((f) => !isExempt(f));
@@ -4320,26 +4492,27 @@ async function checkSatisfaction(input2) {
   const errors = [];
   const decisionsPrefix = `${input2.decisionsRel}/`;
   const newDecisionFiles = input2.changedFiles.filter(
-    (f) => f.startsWith(decisionsPrefix) && isDecisionFileName(path27.basename(f))
+    (f) => f.startsWith(decisionsPrefix) && isDecisionFileName(path28.basename(f))
   );
   if (newDecisionFiles.length === 0) {
     errors.push(`no new or updated decision under ${input2.decisionsRel}/`);
     return errors;
   }
-  const decisionsDir = path27.join(input2.root, input2.decisionsRel);
+  const decisionsDir = path28.join(input2.root, input2.decisionsRel);
   for (const rel of newDecisionFiles) {
-    const abs = path27.join(input2.root, rel);
+    const abs = path28.join(input2.root, rel);
     const content2 = await readText(abs) ?? "";
     const valid = validateDecisionContent(content2);
     if (!valid.ok) errors.push(...valid.errors.map((e) => `${rel}: ${e}`));
   }
   const indexErrors = await validateIndexSync(
     decisionsDir,
-    newDecisionFiles.map((f) => path27.basename(f))
+    newDecisionFiles.map((f) => path28.basename(f))
   );
   errors.push(...indexErrors);
   return errors;
 }
+var WAYS_OUT = "Write an ADR under docs/decisions/ (haus decisions suggest), or use [adr-skip] for non-security changes.";
 async function runDecisionsCheck(root, opts = {}) {
   const reasons = [];
   if (await readGateMode(root) === "off") {
@@ -4351,8 +4524,18 @@ async function runDecisionsCheck(root, opts = {}) {
     };
   }
   const stats = await collectDiffStats(root, opts);
-  const triggered = isDecisionTriggered(stats);
   const securityTriggered = isSecurityTriggered(stats);
+  const branch = await getCurrentBranch(root);
+  if (branch != null && LOCAL_EXEMPT_BRANCH_PATTERN.test(branch) && !securityTriggered) {
+    return {
+      triggered: false,
+      satisfied: true,
+      reasons: ["catalog-sync branch \u2014 exempt"],
+      securityTriggered: false
+    };
+  }
+  const triggerReasons = explainDecisionTrigger(stats);
+  const triggered = triggerReasons.length > 0;
   if (!triggered) {
     return {
       triggered: false,
@@ -4361,6 +4544,7 @@ async function runDecisionsCheck(root, opts = {}) {
       securityTriggered
     };
   }
+  reasons.push(...triggerReasons);
   const skipText = `${opts.prBody ?? ""}
 ${opts.commitMessages ?? ""}`;
   if (hasSkipToken(skipText) && !securityTriggered) {
@@ -4379,7 +4563,7 @@ ${opts.commitMessages ?? ""}`;
     changedFiles: stats.files
   });
   if (satisfactionErrors.length > 0 && decisionsRel !== legacyRel) {
-    const legacyExists = await fs25.pathExists(path27.join(root, legacyRel));
+    const legacyExists = await fs25.pathExists(path28.join(root, legacyRel));
     if (legacyExists && !await fs25.pathExists(decisionsDir)) {
       satisfactionErrors = await checkSatisfaction({
         root,
@@ -4389,14 +4573,16 @@ ${opts.commitMessages ?? ""}`;
     }
   }
   if (satisfactionErrors.length === 0) {
+    reasons.push("decision record present");
     return {
       triggered: true,
       satisfied: true,
-      reasons: ["decision record present"],
+      reasons,
       securityTriggered
     };
   }
   reasons.push(...satisfactionErrors);
+  reasons.push(WAYS_OUT);
   return { triggered: true, satisfied: false, reasons, securityTriggered };
 }
 async function listDecisionNumbers(decisionsDir) {
@@ -4408,8 +4594,8 @@ async function listDecisionNumbers(decisionsDir) {
 // src/decisions/doctor.ts
 async function auditDecisionsLayout(root) {
   const findings = [];
-  const primary = path28.join(root, DECISIONS_TRIGGERS.decisionsDir);
-  const legacy = path28.join(root, DECISIONS_TRIGGERS.legacyDecisionsDir ?? "docs/adr");
+  const primary = path29.join(root, DECISIONS_TRIGGERS.decisionsDir);
+  const legacy = path29.join(root, DECISIONS_TRIGGERS.legacyDecisionsDir ?? "docs/adr");
   const hasPrimary = await fs26.pathExists(primary);
   const hasLegacy = await fs26.pathExists(legacy);
   if (!hasPrimary && hasLegacy) {
@@ -4424,7 +4610,7 @@ async function auditDecisionsLayout(root) {
   if (!hasPrimary) return findings;
   const decisionsDir = await resolveDecisionsDir(root);
   const rel = relativeDecisionPath(decisionsDir, root);
-  const readmePath = path28.join(decisionsDir, "README.md");
+  const readmePath = path29.join(decisionsDir, "README.md");
   if (!await fs26.pathExists(readmePath)) {
     findings.push({
       level: "advisory",
@@ -4449,7 +4635,7 @@ async function auditDecisionsLayout(root) {
       });
     }
   }
-  const claude = await readText(path28.join(root, "CLAUDE.md"));
+  const claude = await readText(path29.join(root, "CLAUDE.md"));
   if (claude && !claude.includes(`@${rel}/README.md`)) {
     findings.push({
       level: "advisory",
@@ -4480,11 +4666,11 @@ async function auditDecisionsLayout(root) {
 }
 
 // src/scanner/read-context.ts
-import path36 from "node:path";
+import path37 from "node:path";
 import fs28 from "fs-extra";
 
 // src/commands/workspace/config.ts
-import path29 from "node:path";
+import path30 from "node:path";
 import YAML from "yaml";
 var WORKSPACE_FILE = "haus.workspace.yaml";
 function parseWorkspaceConfig(text) {
@@ -4507,11 +4693,11 @@ function parseWorkspaceConfig(text) {
   };
 }
 async function readWorkspaceConfig(workspaceRoot) {
-  return parseWorkspaceConfig(await readText(path29.join(workspaceRoot, WORKSPACE_FILE)));
+  return parseWorkspaceConfig(await readText(path30.join(workspaceRoot, WORKSPACE_FILE)));
 }
 
 // src/workspace/members.ts
-import path30 from "node:path";
+import path31 from "node:path";
 var REPOS_MANIFEST_FILE = "repos.manifest.json";
 var REPOS_LOCAL_FILE = "repos.local.json";
 var MemberConfigError = class extends Error {
@@ -4524,11 +4710,14 @@ var MemberConfigError = class extends Error {
 };
 function resolveAbsPath(workspaceRoot, folder, overrides) {
   const override = overrides[folder];
-  if (override) return path30.resolve(workspaceRoot, override);
-  return path30.resolve(workspaceRoot, folder);
+  if (override) return path31.resolve(workspaceRoot, override);
+  return path31.resolve(workspaceRoot, folder);
+}
+function isSelfMember(workspaceRoot, member) {
+  return path31.resolve(member.absPath) === path31.resolve(workspaceRoot);
 }
 async function readPathOverrides(workspaceRoot) {
-  const filePath = path30.join(workspaceRoot, REPOS_LOCAL_FILE);
+  const filePath = path31.join(workspaceRoot, REPOS_LOCAL_FILE);
   const result = await readJsonDetailed(filePath);
   if (result.status === "missing") return {};
   if (result.status === "invalid") throw new MemberConfigError(filePath, "invalid JSON");
@@ -4544,7 +4733,7 @@ async function readPathOverrides(workspaceRoot) {
   return overrides;
 }
 async function readFromWorkspaceYaml(workspaceRoot, overrides) {
-  const filePath = path30.join(workspaceRoot, WORKSPACE_FILE);
+  const filePath = path31.join(workspaceRoot, WORKSPACE_FILE);
   const text = await readText(filePath);
   if (text === void 0) return void 0;
   const config = parseWorkspaceConfig(text);
@@ -4557,7 +4746,7 @@ async function readFromWorkspaceYaml(workspaceRoot, overrides) {
   }));
 }
 async function readFromManifest(workspaceRoot, overrides) {
-  const filePath = path30.join(workspaceRoot, REPOS_MANIFEST_FILE);
+  const filePath = path31.join(workspaceRoot, REPOS_MANIFEST_FILE);
   const result = await readJsonDetailed(filePath);
   if (result.status === "missing") return void 0;
   if (result.status === "invalid") throw new MemberConfigError(filePath, "invalid JSON");
@@ -4592,23 +4781,23 @@ async function readMembers(rootInfo) {
   const workspaceRoot = rootInfo.mainRoot;
   const overrides = await readPathOverrides(workspaceRoot);
   const fromYaml = await readFromWorkspaceYaml(workspaceRoot, overrides);
-  if (fromYaml) return fromYaml;
+  if (fromYaml) return fromYaml.filter((m) => !isSelfMember(workspaceRoot, m));
   const fromManifest = await readFromManifest(workspaceRoot, overrides);
-  if (fromManifest) return fromManifest;
+  if (fromManifest) return fromManifest.filter((m) => !isSelfMember(workspaceRoot, m));
   return [];
 }
 
 // src/scanner/scan-project.ts
-import path35 from "node:path";
+import path36 from "node:path";
 
 // src/utils/audit-checks.ts
-function isRecord(v) {
+function isRecord2(v) {
   return typeof v === "object" && v !== null;
 }
 
 // src/utils/git-root.ts
 init_exec();
-import path31 from "node:path";
+import path32 from "node:path";
 function fallback(start) {
   return {
     cwd: start,
@@ -4624,11 +4813,11 @@ function fallback(start) {
 async function resolveAbsoluteGitPath(flag, cwd, repoRoot) {
   const withFormat = await runGit(["rev-parse", "--path-format=absolute", flag], { cwd });
   const raw = withFormat.exitCode === 0 ? withFormat.stdout.trim() : "";
-  if (raw && path31.isAbsolute(raw)) return path31.resolve(raw);
+  if (raw && path32.isAbsolute(raw)) return path32.resolve(raw);
   const plain = await runGit(["rev-parse", flag], { cwd });
   const plainRaw = plain.exitCode === 0 ? plain.stdout.trim() : "";
   if (!plainRaw) return "";
-  return path31.isAbsolute(plainRaw) ? path31.resolve(plainRaw) : path31.resolve(repoRoot, plainRaw);
+  return path32.isAbsolute(plainRaw) ? path32.resolve(plainRaw) : path32.resolve(repoRoot, plainRaw);
 }
 async function resolveRoots(start) {
   const cwd = start ?? process.cwd();
@@ -4637,15 +4826,15 @@ async function resolveRoots(start) {
     if (toplevel.exitCode !== 0) return fallback(cwd);
     const toplevelRaw = toplevel.stdout.trim();
     if (!toplevelRaw) return fallback(cwd);
-    const repoRoot = path31.resolve(toplevelRaw);
+    const repoRoot = path32.resolve(toplevelRaw);
     const [gitDir, gitCommonDir] = await Promise.all([
       resolveAbsoluteGitPath("--git-dir", cwd, repoRoot),
       resolveAbsoluteGitPath("--git-common-dir", cwd, repoRoot)
     ]);
     if (!gitDir || !gitCommonDir) return fallback(cwd);
     const isLinkedWorktree = gitDir !== gitCommonDir;
-    const mainRoot = isLinkedWorktree && path31.basename(gitCommonDir) === ".git" ? path31.dirname(gitCommonDir) : repoRoot;
-    const worktreeName = isLinkedWorktree ? path31.basename(gitDir) : null;
+    const mainRoot = isLinkedWorktree && path32.basename(gitCommonDir) === ".git" ? path32.dirname(gitCommonDir) : repoRoot;
+    const worktreeName = isLinkedWorktree ? path32.basename(gitDir) : null;
     return {
       cwd,
       repoRoot,
@@ -4679,9 +4868,18 @@ function compareVersions(a, b) {
   }
   return semver.compare(normalizedA, normalizedB);
 }
+function resolveMajorVersion(range) {
+  if (!range) return null;
+  try {
+    const min = semver.minVersion(range);
+    return min ? min.major : null;
+  } catch {
+    return null;
+  }
+}
 
 // src/scanner/detect-package-manager.ts
-import path32 from "node:path";
+import path33 from "node:path";
 import fs27 from "fs-extra";
 function detectPackageManager(root, packageManagerField) {
   const field = String(packageManagerField ?? "").trim();
@@ -4700,9 +4898,9 @@ function detectPackageManager(root, packageManagerField) {
     if (satisfiesVersion(version, ">=9")) return "npm";
     return "unknown";
   }
-  if (fs27.existsSync(path32.join(root, "yarn.lock"))) return "yarn";
-  if (fs27.existsSync(path32.join(root, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs27.existsSync(path32.join(root, "package-lock.json"))) return "npm";
+  if (fs27.existsSync(path33.join(root, "yarn.lock"))) return "yarn";
+  if (fs27.existsSync(path33.join(root, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs27.existsSync(path33.join(root, "package-lock.json"))) return "npm";
   return "unknown";
 }
 
@@ -4710,6 +4908,11 @@ function detectPackageManager(root, packageManagerField) {
 var dep = (value) => ({ kind: "dep", value });
 var depPrefix = (value) => ({ kind: "depPrefix", value });
 var depAbsent = (value) => ({ kind: "depAbsent", value });
+var depMajor = (value, major) => ({
+  kind: "depMajor",
+  value,
+  major
+});
 var fileEndsWith = (value) => ({
   kind: "file",
   value,
@@ -4749,6 +4952,8 @@ function matchSignal(sig, ctx) {
       return false;
     case "depAbsent":
       return !ctx.deps.has(sig.value);
+    case "depMajor":
+      return ctx.deps.has(sig.value) && resolveMajorVersion(ctx.depVersions.get(sig.value) ?? "") === sig.major;
     case "content":
       return ctx.contentBlob.includes(sig.value);
     case "file":
@@ -4800,9 +5005,9 @@ var ROLE_RULES = [
 ];
 var STACK_RULES = [
   { stack: ["frontend", "nextjs"], any: [dep("next")] },
-  { stack: ["frontend", "react19"], any: [dep("react")] },
+  { stack: ["frontend", "react19"], any: [depMajor("react", 19)] },
   { stack: ["frontend", "vue"], any: [dep("vue")] },
-  { stack: ["frontend", "vite8"], any: [dep("vite")] },
+  { stack: ["frontend", "vite8"], any: [depMajor("vite", 8)] },
   { stack: ["frontend", "react-router-v7"], all: [dep("react-router"), dep("@react-router/node")] },
   {
     stack: ["frontend", "tailwindcss"],
@@ -4812,7 +5017,7 @@ var STACK_RULES = [
     stack: ["frontend", "shadcn"],
     all: [fileEndsWith("components.json"), dep("class-variance-authority")]
   },
-  { stack: ["tooling", "typescript5"], any: [dep("typescript")] },
+  { stack: ["tooling", "typescript5"], any: [depMajor("typescript", 5)] },
   { stack: ["backend", "sanity"], any: [dep("sanity"), dep("next-sanity"), dep("@sanity/client")] },
   { stack: ["backend", "strapi"], any: [dep("@strapi/strapi"), depPrefix("@strapi/")] },
   { stack: ["backend", "prisma"], any: [dep("prisma"), dep("@prisma/client")] },
@@ -4837,9 +5042,15 @@ var STACK_RULES = [
     stack: ["databases", "supabase"],
     any: [dep("@supabase/supabase-js"), depPrefix("@supabase/")]
   },
-  { stack: ["backend", "vendure3"], any: [dep("@vendure/core")] },
+  { stack: ["backend", "vendure3"], any: [depMajor("@vendure/core", 3)] },
   { stack: ["backend", "nestjs"], any: [dep("@nestjs/core")] },
   { stack: ["backend", "nestjs"], any: [content("NestFactory")] },
+  // Deliberately NOT major-gated: this rule catches vendure *plugin* repos that use
+  // the @VendurePlugin decorator without depending on @vendure/core directly (a
+  // peer/transitive dep, common in a plugin package). depMajor requires the name to
+  // be a direct dependency (see matchSignal's depMajor case), which this repo shape
+  // doesn't satisfy — falling back to content detection is the only signal available,
+  // so it stays presence/content-based rather than gated on a major we can't read.
   { stack: ["backend", "vendure3"], any: [content("@VendurePlugin")] },
   { stack: ["backend", "graphql"], any: [dep("graphql"), dep("@nestjs/graphql")] },
   {
@@ -4912,7 +5123,7 @@ function runDetection(ctx, rules = STACK_RULES) {
 }
 
 // src/scanner/detection.ts
-import path33 from "node:path";
+import path34 from "node:path";
 var UNSUPPORTED_MARKERS = {
   "requirements.txt": "python",
   "pyproject.toml": "python",
@@ -4941,17 +5152,21 @@ function describeUnknownDetection(unsupportedSignals, isLinkedWorktree) {
 function blocked(rel) {
   return SENSITIVE_PATH_REGEXES.some((x) => x.test(rel));
 }
-function dependencySet(pkg, composer) {
-  const depNames = /* @__PURE__ */ new Set();
+function dependencyVersionMap(pkg, composer) {
+  const versions = /* @__PURE__ */ new Map();
   const pushObj = (obj) => {
-    if (!isRecord(obj)) return;
-    for (const key of Object.keys(obj)) depNames.add(key);
+    if (!isRecord2(obj)) return;
+    for (const key of Object.keys(obj)) {
+      if (versions.has(key)) continue;
+      const value = obj[key];
+      versions.set(key, typeof value === "string" ? value : "");
+    }
   };
   pushObj(pkg?.dependencies);
   pushObj(pkg?.devDependencies);
   pushObj(composer?.require);
   pushObj(composer?.["require-dev"]);
-  return [...depNames].sort();
+  return versions;
 }
 function finalizeRoles(registryRoles, deps, files) {
   const roles = new Set(registryRoles);
@@ -4972,14 +5187,14 @@ function finalizeRoles(registryRoles, deps, files) {
 function collectUnsupportedSignals(files) {
   return [
     ...new Set(
-      files.map((f) => UNSUPPORTED_MARKERS[path33.basename(f)]).filter((s) => Boolean(s))
+      files.map((f) => UNSUPPORTED_MARKERS[path34.basename(f)]).filter((s) => Boolean(s))
     )
   ].sort();
 }
 
 // src/scanner/render.ts
 import { readFile } from "node:fs/promises";
-import path34 from "node:path";
+import path35 from "node:path";
 async function buildContentBlob(root, files) {
   const candidates = files.filter(
     (f) => f.endsWith(".ts") || f.endsWith(".js") || f.endsWith(".php") || f.endsWith(".json") || f.endsWith(".yml") || f.endsWith(".yaml")
@@ -4987,7 +5202,7 @@ async function buildContentBlob(root, files) {
   const slice = candidates.slice(0, 300);
   const parts = await mapWithConcurrency(slice, async (rel) => {
     try {
-      return await readFile(path34.join(root, rel), "utf8");
+      return await readFile(path35.join(root, rel), "utf8");
     } catch {
       return "";
     }
@@ -5079,14 +5294,20 @@ var SAFE_FILES = [
   "Gemfile"
 ];
 async function scanProject(root) {
-  const pkg = await readJson(path35.join(root, "package.json"));
-  const composer = await readJson(path35.join(root, "composer.json"));
+  const pkg = await readJson(path36.join(root, "package.json"));
+  const composer = await readJson(path36.join(root, "composer.json"));
   const files = await listFiles(root, SAFE_FILES);
   const safeFiles = files.filter((f) => !blocked(f));
-  const deps = dependencySet(pkg, composer);
+  const depVersions = dependencyVersionMap(pkg, composer);
+  const deps = [...depVersions.keys()].sort();
   const packageManager = detectPackageManager(root, String(pkg?.packageManager ?? ""));
   const contentBlob = await buildContentBlob(root, safeFiles);
-  const detection = runDetection({ deps: new Set(deps), files: safeFiles, contentBlob });
+  const detection = runDetection({
+    deps: new Set(deps),
+    depVersions,
+    files: safeFiles,
+    contentBlob
+  });
   const roles = finalizeRoles(detection.roles, deps, safeFiles);
   const stacks = detection.stacks;
   if (packageManager === "yarn") stacks.packageManagers.push("yarn4");
@@ -5094,7 +5315,7 @@ async function scanProject(root) {
   const warnings = [];
   const securityRisks = [];
   const crossRepoHints = [];
-  const nodeEngine = isRecord(pkg?.engines) ? String(pkg.engines.node ?? "") : "";
+  const nodeEngine = isRecord2(pkg?.engines) ? String(pkg.engines.node ?? "") : "";
   if (nodeEngine && !satisfiesVersion(process.version, nodeEngine)) {
     warnings.push(`Current Node ${process.version} does not satisfy package engine ${nodeEngine}`);
   }
@@ -5104,7 +5325,7 @@ async function scanProject(root) {
     crossRepoHints.push("Monorepo orchestration detected");
   const unsupportedSignals = collectUnsupportedSignals(safeFiles);
   const detectionStatus = computeDetectionStatus(roles, stacks, unsupportedSignals);
-  const repoNameFallback = pkg?.name ? String(pkg.name) : path35.basename((await resolveRoots(root)).mainRoot);
+  const repoNameFallback = pkg?.name ? String(pkg.name) : path36.basename((await resolveRoots(root)).mainRoot);
   const context = {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     repoName: repoNameFallback,
@@ -5126,9 +5347,9 @@ async function scanProject(root) {
 // src/scanner/read-context.ts
 async function isCacheFresh(root, cachePath) {
   const markerPaths = [
-    path36.join(root, "package.json"),
-    path36.join(root, WORKSPACE_FILE),
-    path36.join(root, REPOS_MANIFEST_FILE)
+    path37.join(root, "package.json"),
+    path37.join(root, WORKSPACE_FILE),
+    path37.join(root, REPOS_MANIFEST_FILE)
   ];
   const cacheStat = await fs28.stat(cachePath);
   for (const markerPath of markerPaths) {
@@ -5234,7 +5455,7 @@ async function runDoctor(options) {
   } else {
     ok(`- HOOKS OK: ${hooks.message}`);
   }
-  const rootClaudeMdPath = path37.join(root, "CLAUDE.md");
+  const rootClaudeMdPath = path38.join(root, "CLAUDE.md");
   const rootClaudeMdContent = await readText(rootClaudeMdPath);
   if (!rootClaudeMdContent) {
     flag(
@@ -5288,8 +5509,8 @@ async function runDoctor(options) {
     } else {
       const storedHashMatch = firstLine.match(/hash=(sha256-[a-f0-9]+)/);
       const bodyContent = workflowContent.slice(firstLine.length + 1);
-      const cachePath = path37.join(getCacheDir(), "templates/agentic-workflow-standard.md");
-      const bundledPath = path37.join(
+      const cachePath = path38.join(getCacheDir(), "templates/agentic-workflow-standard.md");
+      const bundledPath = path38.join(
         packageRoot(),
         "library",
         "global",
@@ -5338,7 +5559,7 @@ async function runDoctor(options) {
     }
   }
   if (workflowExists) {
-    const prettierIgnore = await readText(path37.join(root, ".prettierignore")) ?? "";
+    const prettierIgnore = await readText(path38.join(root, ".prettierignore")) ?? "";
     const lines = prettierIgnore.split("\n");
     const missing = IGNORED_PATHS.filter((p) => !prettierIgnoreProtects(lines, p));
     if (missing.length > 0) {
@@ -5411,7 +5632,7 @@ async function runDoctor(options) {
       );
     }
   }
-  const pkgJson = await readJson(path37.join(packageRoot(), "package.json"));
+  const pkgJson = await readJson(path38.join(packageRoot(), "package.json"));
   const currentVersion = pkgJson?.version ?? "0.0.0";
   const npmStatus = await fetchNpmVersionStatus(currentVersion);
   if (npmStatus.updateAvailable && npmStatus.latest !== null) {
@@ -5444,7 +5665,7 @@ async function runDoctor(options) {
 }
 
 // src/commands/update.ts
-import path40 from "node:path";
+import path41 from "node:path";
 
 // src/claude/refresh-project.ts
 import fs30 from "fs-extra";
@@ -5461,7 +5682,7 @@ async function refreshProjectApply(root) {
 
 // src/install/apply.ts
 import crypto2 from "node:crypto";
-import path38 from "node:path";
+import path39 from "node:path";
 import fs31 from "fs-extra";
 
 // src/install/header.ts
@@ -5548,7 +5769,7 @@ function hashContent(content2) {
 }
 function sourceVersion() {
   try {
-    const pkgPath = path38.join(packageRoot(), "package.json");
+    const pkgPath = path39.join(packageRoot(), "package.json");
     const pkg = JSON.parse(fs31.readFileSync(pkgPath, "utf8"));
     return `${pkg.name ?? "haus"}@${pkg.version ?? "0.0.0"}`;
   } catch {
@@ -5556,49 +5777,49 @@ function sourceVersion() {
   }
 }
 function globalSrcDir() {
-  return path38.join(packageRoot(), "library", "global");
+  return path39.join(packageRoot(), "library", "global");
 }
 function collectSkillAuxFiles(skillsDir, claudeDir, skillName) {
-  const skillDir = path38.join(skillsDir, skillName);
+  const skillDir = path39.join(skillsDir, skillName);
   const entries = [];
   for (const rel of fs31.readdirSync(skillDir, { recursive: true })) {
     if (rel === "SKILL.md") continue;
-    const abs = path38.join(skillDir, rel);
+    const abs = path39.join(skillDir, rel);
     if (!fs31.statSync(abs).isFile()) continue;
-    const posixRel = rel.split(path38.sep).join("/");
+    const posixRel = rel.split(path39.sep).join("/");
     entries.push({
       stableId: `skill.${skillName}.${posixRel.replace(/\//g, ".")}`,
-      srcRelPath: path38.join("library", "global", "skills", skillName, rel),
-      destPath: path38.join(claudeDir, "skills", skillName, rel)
+      srcRelPath: path39.join("library", "global", "skills", skillName, rel),
+      destPath: path39.join(claudeDir, "skills", skillName, rel)
     });
   }
   return entries;
 }
 function collectSourceFiles(srcDir, claudeDir) {
   const entries = [];
-  const skillsDir = path38.join(srcDir, "skills");
+  const skillsDir = path39.join(srcDir, "skills");
   if (fs31.pathExistsSync(skillsDir)) {
     for (const skillName of fs31.readdirSync(skillsDir)) {
-      const skillFile = path38.join(skillsDir, skillName, "SKILL.md");
+      const skillFile = path39.join(skillsDir, skillName, "SKILL.md");
       if (fs31.pathExistsSync(skillFile)) {
         entries.push({
           stableId: `skill.${skillName}`,
-          srcRelPath: path38.join("library", "global", "skills", skillName, "SKILL.md"),
-          destPath: path38.join(claudeDir, "skills", skillName, "SKILL.md")
+          srcRelPath: path39.join("library", "global", "skills", skillName, "SKILL.md"),
+          destPath: path39.join(claudeDir, "skills", skillName, "SKILL.md")
         });
         entries.push(...collectSkillAuxFiles(skillsDir, claudeDir, skillName));
       }
     }
   }
-  const commandsDir = path38.join(srcDir, "commands");
+  const commandsDir = path39.join(srcDir, "commands");
   if (fs31.pathExistsSync(commandsDir)) {
     for (const fileName of fs31.readdirSync(commandsDir)) {
       if (!fileName.endsWith(".md")) continue;
       const commandName = fileName.slice(0, -".md".length);
       entries.push({
         stableId: `command.${commandName}`,
-        srcRelPath: path38.join("library", "global", "commands", fileName),
-        destPath: path38.join(claudeDir, "commands", fileName)
+        srcRelPath: path39.join("library", "global", "commands", fileName),
+        destPath: path39.join(claudeDir, "commands", fileName)
       });
     }
   }
@@ -5624,7 +5845,7 @@ async function applyInstall(options = {}) {
   };
   const manifestFiles = [];
   for (const entry of sourceFiles) {
-    const srcPath = path38.join(packageRoot(), entry.srcRelPath);
+    const srcPath = path39.join(packageRoot(), entry.srcRelPath);
     const rawContent = await readText(srcPath);
     if (rawContent === void 0) {
       warn(`Source file not found: ${entry.srcRelPath}`);
@@ -5684,7 +5905,7 @@ async function applyInstall(options = {}) {
   }
   let mergedSettings;
   if (!check) {
-    const fragmentPath = path38.join(srcDir, "settings-fragments", "hooks.json");
+    const fragmentPath = path39.join(srcDir, "settings-fragments", "hooks.json");
     const fragments = await loadHooksFragment(fragmentPath);
     const settings = await readSettings();
     const { settings: hookSettings, addedIds } = mergeHooks(settings, fragments);
@@ -5773,7 +5994,7 @@ function summarizeLockDiff(before, after) {
 
 // src/update/lockfile.ts
 import { mkdir, readFile as readFile2, copyFile } from "node:fs/promises";
-import path39 from "node:path";
+import path40 from "node:path";
 async function readLockSummary(root) {
   const lock = await readJson(hausPath(root, "haus.lock.json")) ?? [];
   const catalogRef = lock.find((item) => item.catalogRef)?.catalogRef ?? null;
@@ -5809,7 +6030,7 @@ async function applyLock(root) {
   try {
     const backupDir = hausPath(root, "backups");
     await mkdir(backupDir, { recursive: true });
-    await copyFile(lockPath, path39.join(backupDir, `haus.lock.${Date.now()}.json`));
+    await copyFile(lockPath, path40.join(backupDir, `haus.lock.${Date.now()}.json`));
   } catch {
   }
   const enriched = await Promise.all(
@@ -5831,7 +6052,7 @@ function diffLock(before, after) {
 }
 async function hasLocalOverrides(root) {
   try {
-    await readFile2(path39.join(root, ".claude", "settings.json"), "utf8");
+    await readFile2(path40.join(root, ".claude", "settings.json"), "utf8");
     return true;
   } catch {
     return false;
@@ -5847,7 +6068,7 @@ async function runUpdate(options) {
     return;
   }
   if (options.check) {
-    const pkgJson2 = await readJson(path40.join(packageRoot(), "package.json"));
+    const pkgJson2 = await readJson(path41.join(packageRoot(), "package.json"));
     const currentVersion2 = pkgJson2?.version ?? "0.0.0";
     const [status, npmVersion, latestCatalogTag, globalInstallDrift, catalogItems, lockItems] = await Promise.all([
       options.fast ? fastLockStatus(root) : checkLock(root),
@@ -5882,7 +6103,7 @@ async function runUpdate(options) {
     if (hasHashDrift || formerIdMigrations.length > 0) process.exitCode = 1;
     return;
   }
-  const pkgJson = await readJson(path40.join(packageRoot(), "package.json"));
+  const pkgJson = await readJson(path41.join(packageRoot(), "package.json"));
   const currentVersion = pkgJson?.version ?? "0.0.0";
   const npmStatus = await fetchNpmVersionStatus(currentVersion);
   if (npmStatus.updateAvailable && npmStatus.latest !== null) {
@@ -5924,7 +6145,7 @@ async function runFromHookCheck(root) {
   try {
     const summary = await readLockSummary(root);
     if (summary.count === 0) return;
-    const pkgJson = await readJson(path40.join(packageRoot(), "package.json"));
+    const pkgJson = await readJson(path41.join(packageRoot(), "package.json"));
     const currentVersion = pkgJson?.version ?? "0.0.0";
     const [npmVersion, latestCatalogTag] = await Promise.all([
       fetchNpmVersionStatus(currentVersion),
@@ -6074,7 +6295,7 @@ async function runCiGate(options = {}) {
 // src/commands/clone.ts
 init_exec();
 import { existsSync as existsSync2 } from "node:fs";
-import path41 from "node:path";
+import path42 from "node:path";
 var GIT_LOCATION_VARS = [
   "GIT_DIR",
   "GIT_WORK_TREE",
@@ -6124,11 +6345,11 @@ async function runClone(url, opts = {}) {
     process.exitCode = 1;
     return;
   }
-  const target = path41.resolve(opts.dir?.trim() || repoNameFromUrl(url));
+  const target = path42.resolve(opts.dir?.trim() || repoNameFromUrl(url));
   if (existsSync2(target)) {
     const check = await checkExistingTarget(target, url);
     if (check.kind === "matches") {
-      log(`\u2022 ${path41.basename(target)} already cloned here, matches ${url} \u2014 skipped`);
+      log(`\u2022 ${path42.basename(target)} already cloned here, matches ${url} \u2014 skipped`);
       return;
     }
     const message = check.kind === "not-a-repo" ? `${target} already exists and is not a git repository \u2014 refusing to clone ${url} there. Remove or rename it, or pass a different [dir].` : `${target} already exists as a different repository (origin: ${check.origin ?? "(no origin remote)"}) \u2014 refusing to clone ${url} there. Remove or rename it, or pass a different [dir].`;
@@ -6168,7 +6389,7 @@ function readHookPayload() {
   if (!raw) return { payload: {}, malformed: false };
   try {
     const parsed = JSON.parse(raw);
-    return { payload: isRecord(parsed) ? parsed : {}, malformed: false };
+    return { payload: isRecord2(parsed) ? parsed : {}, malformed: false };
   } catch {
     return { payload: {}, malformed: true };
   }
@@ -6207,7 +6428,7 @@ function readPayload(options) {
   if (options.stdinPayload != null) {
     try {
       const parsed = JSON.parse(options.stdinPayload);
-      return { payload: isRecord(parsed) ? parsed : {}, malformed: false };
+      return { payload: isRecord2(parsed) ? parsed : {}, malformed: false };
     } catch {
       return { payload: {}, malformed: true };
     }
@@ -6220,7 +6441,7 @@ async function runDecisionsGuard(options = {}) {
     emitPreToolUseDeny("Malformed hook payload");
     return;
   }
-  const toolInput = isRecord(payload.tool_input) ? payload.tool_input : {};
+  const toolInput = isRecord2(payload.tool_input) ? payload.tool_input : {};
   const command = String(toolInput.command ?? "");
   if (!PR_CREATE_PATTERN.test(command)) return;
   const root = process.cwd();
@@ -6232,13 +6453,13 @@ async function runDecisionsGuard(options = {}) {
   const result = await runDecisionsCheck(root, { range, commitMessages });
   if (result.triggered && !result.satisfied) {
     emitPreToolUseDeny(
-      `I didn't run that \u2014 this change needs an ADR before opening a PR (${result.reasons.join("; ")}). Run haus decisions suggest, add the decision under docs/decisions/, then retry.`
+      `I didn't run that \u2014 this change needs an ADR before opening a PR (${result.reasons.join("; ")}). Run haus decisions suggest, add the decision under docs/decisions/, then retry \u2014 or use [adr-skip] for non-security changes.`
     );
   }
 }
 
 // src/commands/decisions.ts
-import path42 from "node:path";
+import path43 from "node:path";
 
 // src/decisions/next-number.ts
 async function nextDecisionNumber(root) {
@@ -6281,10 +6502,9 @@ _(Why this over alternatives \u2014 the line agents read for "why".)_
 `;
 }
 async function runDecisionsSuggest(root, opts = {}) {
-  const stats = await collectDiffStats(root, { staged: true });
   const stagedCheck = await runDecisionsCheck(root, { staged: true });
-  const unstagedStats = await collectDiffStats(root, {});
-  const triggered = isDecisionTriggered(stats) || isDecisionTriggered(unstagedStats);
+  const unstagedCheck = await runDecisionsCheck(root, {});
+  const triggered = stagedCheck.triggered || unstagedCheck.triggered;
   if (!triggered) return;
   if (stagedCheck.triggered && stagedCheck.satisfied) return;
   const number = await nextDecisionNumber(root);
@@ -6335,7 +6555,7 @@ async function runDecisions(sub, arg, options = {}) {
     }
     for (const reason of result.reasons) warn(reason);
     error(
-      "decisions gate: decision-worthy change without a valid ADR under docs/decisions/. Run `haus decisions suggest`, add docs/decisions/NNNN-*.md + README row, or use [adr-skip] with justification."
+      `decisions gate: decision-worthy change without a valid ADR under docs/decisions/. Why: ${result.reasons.filter((r) => !r.startsWith("no new")).join("; ") || "see above"}. Run \`haus decisions suggest\`, add docs/decisions/NNNN-*.md + README row, or use [adr-skip] with justification (ignored for security paths).`
     );
     process.exitCode = 1;
     return;
@@ -6349,7 +6569,7 @@ async function runDecisions(sub, arg, options = {}) {
     return;
   }
   if (sub === "validate") {
-    const target = arg ? path42.resolve(root, arg) : void 0;
+    const target = arg ? path43.resolve(root, arg) : void 0;
     if (!target) {
       error("usage: haus decisions validate <path-to-decision.md>");
       process.exitCode = 1;
@@ -6601,7 +6821,7 @@ async function runGuard(kind, _options) {
     emitPreToolUseDeny("Malformed hook payload");
     return;
   }
-  const toolInput = isRecord(payload.tool_input) ? payload.tool_input : {};
+  const toolInput = isRecord2(payload.tool_input) ? payload.tool_input : {};
   if (kind === "file-access") {
     const candidate = String(toolInput.path ?? toolInput.file_path ?? "");
     const reason2 = guardFileAccess(candidate);
@@ -6618,7 +6838,7 @@ async function runGuard(kind, _options) {
 }
 
 // src/commands/init.ts
-import path44 from "node:path";
+import path45 from "node:path";
 import fs32 from "fs-extra";
 
 // src/recommender/git-signal.ts
@@ -7086,7 +7306,7 @@ function buildOptInEligible(items, skipped) {
 }
 
 // src/commands/workspace/discover.ts
-import path43 from "node:path";
+import path44 from "node:path";
 import fg4 from "fast-glob";
 import YAML2 from "yaml";
 var DEFAULT_MAX_DEPTH = 3;
@@ -7127,10 +7347,10 @@ async function findRepoRoots(workspaceRoot, maxDepth = DEFAULT_MAX_DEPTH) {
   const gitDirs = /* @__PURE__ */ new Set();
   const manifestDirs = /* @__PURE__ */ new Set();
   for (const match of gitMatches) {
-    gitDirs.add(path43.posix.dirname(match));
+    gitDirs.add(path44.posix.dirname(match));
   }
   for (const match of manifestMatches) {
-    manifestDirs.add(path43.posix.dirname(match));
+    manifestDirs.add(path44.posix.dirname(match));
   }
   const repoRoots = [...gitDirs];
   const manifestSorted = [...manifestDirs].sort(
@@ -7145,18 +7365,18 @@ async function findRepoRoots(workspaceRoot, maxDepth = DEFAULT_MAX_DEPTH) {
   return repoRoots;
 }
 async function discoverRepos(workspaceRoot, maxDepth = DEFAULT_MAX_DEPTH) {
-  const repoRoots = await findRepoRoots(workspaceRoot, maxDepth);
+  const repoRoots = (await findRepoRoots(workspaceRoot, maxDepth)).filter((dir) => dir !== ".");
   return mapWithConcurrency(repoRoots, async (relDir) => {
-    const absDir = path43.resolve(workspaceRoot, relDir);
-    const pkg = await readJson(path43.join(absDir, "package.json"));
-    const name = typeof pkg?.name === "string" && pkg.name.length > 0 ? pkg.name : path43.basename(relDir === "." ? workspaceRoot : absDir);
+    const absDir = path44.resolve(workspaceRoot, relDir);
+    const pkg = await readJson(path44.join(absDir, "package.json"));
+    const name = typeof pkg?.name === "string" && pkg.name.length > 0 ? pkg.name : path44.basename(absDir);
     let role = "auto";
     try {
       const scan = await scanProject(absDir);
       if (scan.repoRoles.length > 0) role = scan.repoRoles.join("+");
     } catch {
     }
-    return { name, path: relDir === "." ? "." : relDir, role };
+    return { name, path: relDir, role };
   });
 }
 function mergeWorkspaceConfig(existing, discovered, opts = {}) {
@@ -7192,7 +7412,7 @@ function renderWorkspaceYaml(config) {
   });
 }
 async function runDiscover(workspaceRoot, opts = {}) {
-  const yamlPath = path43.join(workspaceRoot, "haus.workspace.yaml");
+  const yamlPath = path44.join(workspaceRoot, "haus.workspace.yaml");
   const existingText = await readText(yamlPath);
   const existing = parseWorkspaceConfig(existingText);
   if (existingText && !existing) {
@@ -7364,7 +7584,7 @@ async function runSetupProject(options) {
 // src/commands/init.ts
 async function runInit(options) {
   const root = process.cwd();
-  const hausDir = path44.join(root, ".haus-workflow");
+  const hausDir = path45.join(root, ".haus-workflow");
   const alreadyInit = await fs32.pathExists(hausDir);
   if (alreadyInit) {
     log("Haus AI already initialized in this project.");
@@ -7500,7 +7720,7 @@ async function runRefresh() {
 }
 
 // src/install/scaffold.ts
-import path45 from "node:path";
+import path46 from "node:path";
 import fs33 from "fs-extra";
 async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
   const scaffolded = [];
@@ -7517,9 +7737,9 @@ async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
   const realRoot = await fs33.realpath(catalogRoot).catch(() => null);
   for (const item of items) {
     if (item.type !== "config") continue;
-    const sourcePath = path45.resolve(catalogRoot, item.path);
-    const rel = path45.relative(catalogRoot, sourcePath);
-    const escapes = rel === "" || path45.isAbsolute(rel) || rel.split(/[/\\]/).some((seg) => seg === "..");
+    const sourcePath = path46.resolve(catalogRoot, item.path);
+    const rel = path46.relative(catalogRoot, sourcePath);
+    const escapes = rel === "" || path46.isAbsolute(rel) || rel.split(/[/\\]/).some((seg) => seg === "..");
     if (escapes) {
       warn(`Skipping ${item.id}: path '${item.path}' escapes the catalog root`);
       continue;
@@ -7529,8 +7749,8 @@ async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
       warn(`Skipping ${item.id}: source not found at ${sourcePath}`);
       continue;
     }
-    const realRel = path45.relative(realRoot, realSource);
-    if (realRel !== "" && (path45.isAbsolute(realRel) || realRel.split(/[/\\]/)[0] === "..")) {
+    const realRel = path46.relative(realRoot, realSource);
+    if (realRel !== "" && (path46.isAbsolute(realRel) || realRel.split(/[/\\]/)[0] === "..")) {
       warn(`Skipping ${item.id}: path '${item.path}' resolves outside the catalog root`);
       continue;
     }
@@ -7544,14 +7764,14 @@ async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
       continue;
     }
     if (stat.isFile()) {
-      const filename = path45.basename(sourcePath);
-      const dest = path45.join(projectRoot, filename);
+      const filename = path46.basename(sourcePath);
+      const dest = path46.join(projectRoot, filename);
       record(filename, await scaffoldFile(sourcePath, dest, item.id, projectRoot, opts));
     } else if (stat.isDirectory()) {
       const entries = await fs33.readdir(sourcePath);
       for (const entry of entries) {
-        const src = path45.join(sourcePath, entry);
-        const dest = path45.join(projectRoot, entry);
+        const src = path46.join(sourcePath, entry);
+        const dest = path46.join(projectRoot, entry);
         record(entry, await scaffoldFile(src, dest, item.id, projectRoot, opts));
       }
     }
@@ -7559,14 +7779,14 @@ async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
   return { scaffolded, skipped, skippedExisting };
 }
 async function scaffoldFile(src, dest, itemId, projectRoot, opts) {
-  const destDisplay = path45.relative(projectRoot, dest) || path45.basename(dest);
+  const destDisplay = path46.relative(projectRoot, dest) || path46.basename(dest);
   const srcStat = await fs33.lstat(src).catch(() => null);
   if (!srcStat) {
-    warn(`Skipping ${path45.basename(src)}: source not found`);
+    warn(`Skipping ${path46.basename(src)}: source not found`);
     return "skipped-refused";
   }
   if (srcStat.isSymbolicLink()) {
-    warn(`Skipping ${path45.basename(src)}: source is a symlink`);
+    warn(`Skipping ${path46.basename(src)}: source is a symlink`);
     return "skipped-refused";
   }
   const exists = await fs33.pathExists(dest);
@@ -7575,13 +7795,13 @@ async function scaffoldFile(src, dest, itemId, projectRoot, opts) {
     return "skipped-exists";
   }
   if (opts.dryRun) {
-    log(`[dry-run] would ${exists ? "overwrite" : "create"} ${path45.basename(dest)} (${itemId})`);
+    log(`[dry-run] would ${exists ? "overwrite" : "create"} ${path46.basename(dest)} (${itemId})`);
     return "scaffolded";
   }
   if (exists && opts.force) {
     await fs33.remove(dest);
   }
-  await fs33.ensureDir(path45.dirname(dest));
+  await fs33.ensureDir(path46.dirname(dest));
   await fs33.copy(src, dest, {
     overwrite: true,
     dereference: false,
@@ -7594,7 +7814,7 @@ async function scaffoldFile(src, dest, itemId, projectRoot, opts) {
       }
     }
   });
-  log(`${exists ? "Overwrote" : "Created"} ${path45.basename(dest)} (${itemId})`);
+  log(`${exists ? "Overwrote" : "Created"} ${path46.basename(dest)} (${itemId})`);
   return "scaffolded";
 }
 
@@ -7659,7 +7879,7 @@ async function runScan(options) {
 }
 
 // src/commands/undo.ts
-import path46 from "node:path";
+import path47 from "node:path";
 import fs34 from "fs-extra";
 
 // src/claude/managed-paths.ts
@@ -7687,18 +7907,18 @@ async function collectLockTrackedPaths(root) {
     const relPaths = row.paths ?? [];
     const existingRel = [];
     for (const rel of relPaths) {
-      if (await fs34.pathExists(path46.resolve(root, rel))) existingRel.push(rel);
+      if (await fs34.pathExists(path47.resolve(root, rel))) existingRel.push(rel);
     }
     if (existingRel.length === 0) continue;
     if (row.hash === void 0) {
-      removable.push(...existingRel.map((rel) => path46.resolve(root, rel)));
+      removable.push(...existingRel.map((rel) => path47.resolve(root, rel)));
       continue;
     }
     const currentHash = await hashInstalledPaths(root, existingRel);
     if (currentHash === row.hash) {
-      removable.push(...existingRel.map((rel) => path46.resolve(root, rel)));
+      removable.push(...existingRel.map((rel) => path47.resolve(root, rel)));
     } else {
-      preserved.push(...existingRel.map((rel) => path46.resolve(root, rel)));
+      preserved.push(...existingRel.map((rel) => path47.resolve(root, rel)));
       log(`Preserving locally-modified ${row.id ?? "(unknown item)"}: ${existingRel.join(", ")}`);
     }
   }
@@ -7711,7 +7931,7 @@ async function settingsHasHausContent(root) {
   return settings._haus != null;
 }
 async function claudeMdHasHausBlock(root) {
-  const filePath = path46.join(root, "CLAUDE.md");
+  const filePath = path47.join(root, "CLAUDE.md");
   if (!await fs34.pathExists(filePath)) return false;
   const text = await fs34.readFile(filePath, "utf8");
   return text.includes(BLOCK_BEGIN);
@@ -7724,15 +7944,15 @@ async function stripProjectSettings(root) {
   const hasContent = Object.keys(settings).length > 0;
   if (hasContent) {
     await writeProjectSettings(root, settings);
-    log(`Stripped haus rules from ${path46.relative(root, settingsPath)} (user settings preserved).`);
+    log(`Stripped haus rules from ${path47.relative(root, settingsPath)} (user settings preserved).`);
     return true;
   }
   await fs34.remove(settingsPath);
-  log(`Removed ${path46.relative(root, settingsPath)} (no user-owned settings remained).`);
+  log(`Removed ${path47.relative(root, settingsPath)} (no user-owned settings remained).`);
   return true;
 }
 async function stripRootClaudeMd(root) {
-  const filePath = path46.join(root, "CLAUDE.md");
+  const filePath = path47.join(root, "CLAUDE.md");
   if (!await fs34.pathExists(filePath)) return false;
   const prev = await fs34.readFile(filePath, "utf8");
   if (!prev.includes(BLOCK_BEGIN)) return false;
@@ -7760,12 +7980,12 @@ async function backupManagedFilesBeforeUndo(root, managedAbsPaths) {
   const backupRoot = hausPath(root, "backups", `undo-${stamp}`);
   for (const abs of managedAbsPaths) {
     if (!await fs34.pathExists(abs)) continue;
-    const rel = path46.relative(root, abs);
-    const backupPath = path46.join(backupRoot, rel);
-    await fs34.ensureDir(path46.dirname(backupPath));
+    const rel = path47.relative(root, abs);
+    const backupPath = path47.join(backupRoot, rel);
+    await fs34.ensureDir(path47.dirname(backupPath));
     await fs34.copy(abs, backupPath);
   }
-  log(`Backed up ${managedAbsPaths.length} managed file(s) to ${path46.relative(root, backupRoot)}.`);
+  log(`Backed up ${managedAbsPaths.length} managed file(s) to ${path47.relative(root, backupRoot)}.`);
 }
 async function runUndo(options) {
   const root = options.root ?? process.cwd();
@@ -7778,7 +7998,7 @@ async function runUndo(options) {
     log("Nothing to remove: no haus-managed files found in this directory.");
     return;
   }
-  const relTargets = managed.map((p) => path46.relative(root, p));
+  const relTargets = managed.map((p) => path47.relative(root, p));
   const summaryParts = [...relTargets];
   if (stripSettings) summaryParts.push(".claude/settings.json (haus rules only)");
   if (stripClaudeMd) summaryParts.push("CLAUDE.md (haus import block only)");
@@ -7802,7 +8022,7 @@ User-owned .claude/ files will be preserved.`
   for (const abs of managed) {
     if (!await fs34.pathExists(abs)) continue;
     await fs34.remove(abs);
-    log(`Removed ${path46.relative(root, abs)}`);
+    log(`Removed ${path47.relative(root, abs)}`);
   }
   if (stripSettings) await stripProjectSettings(root);
   if (stripClaudeMd) await stripRootClaudeMd(root);
@@ -7813,7 +8033,7 @@ User-owned .claude/ files will be preserved.`
 
 // src/install/uninstall.ts
 import crypto3 from "node:crypto";
-import path47 from "node:path";
+import path48 from "node:path";
 import fs35 from "fs-extra";
 async function runUninstall(options = {}) {
   const { force = false } = options;
@@ -7843,14 +8063,14 @@ async function runUninstall(options = {}) {
       continue;
     }
     await fs35.remove(entry.destPath);
-    await pruneEmptyDir(path47.dirname(entry.destPath));
+    await pruneEmptyDir(path48.dirname(entry.destPath));
     result.deleted.push(entry.destPath);
   }
   const settings = await readSettings();
   const stripped = stripHausHooks(stripHausAsk(stripHausAllow(stripHausDeny(settings))));
   await writeSettings(stripped);
   result.hooksStripped = true;
-  const hausDir = path47.join(globalClaudeDir(), "haus");
+  const hausDir = path48.join(globalClaudeDir(), "haus");
   const manifestPath2 = hausManifestPath();
   if (fs35.pathExistsSync(manifestPath2)) {
     await fs35.remove(manifestPath2);
@@ -7891,12 +8111,13 @@ async function runUninstallCommand(options) {
 }
 
 // src/commands/validate-catalog.ts
-import path49 from "node:path";
+import path50 from "node:path";
 
 // src/catalog/validate-core.ts
 import fs36 from "node:fs";
-import path48 from "node:path";
+import path49 from "node:path";
 var ITEM_SEMVER_RE = /^\d+\.\d+\.\d+$/;
+var ITEM_ID_PATTERN = /^haus\./;
 function auditForbiddenStacks(items) {
   const failures = [];
   for (const item of items) {
@@ -7982,6 +8203,9 @@ function auditManifestStructure(manifestVersion, items) {
       failures.push(`item[${i}]: missing id`);
       continue;
     }
+    if (!ITEM_ID_PATTERN.test(item.id)) {
+      failures.push(`${item.id}: id must start with "haus."`);
+    }
     const provenanceError = validateCuratedProvenance(item);
     if (provenanceError) failures.push(provenanceError);
     const referencesError = validateReferences(item.id, item.references);
@@ -8040,7 +8264,7 @@ function readForAudit(absPath, label, failures) {
   }
 }
 function auditTemplateContent(manifestDir, absPath, itemId) {
-  const rel = path48.relative(manifestDir, absPath);
+  const rel = path49.relative(manifestDir, absPath);
   const failures = [];
   const text = readForAudit(absPath, `${itemId}: ${rel}`, failures);
   if (text === null) return failures;
@@ -8062,25 +8286,25 @@ function auditShippedFiles(manifestDir, items) {
   const failures = [];
   for (const item of items) {
     if (!item.path || !isSafeCatalogPath(item.path)) continue;
-    const absPath = path48.join(manifestDir, item.path);
+    const absPath = path49.join(manifestDir, item.path);
     if (item.type === "skill") {
-      const skillMd = path48.join(absPath, "SKILL.md");
+      const skillMd = path49.join(absPath, "SKILL.md");
       if (!fs36.existsSync(skillMd)) {
-        failures.push(`${item.id}: missing ${path48.relative(manifestDir, skillMd)}`);
+        failures.push(`${item.id}: missing ${path49.relative(manifestDir, skillMd)}`);
         continue;
       }
       const text = readForAudit(skillMd, `${item.id}: SKILL.md`, failures);
       if (text === null) continue;
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: SKILL.md`));
       failures.push(
-        ...auditForbiddenTagsInText(text, `${item.id}: ${path48.relative(manifestDir, skillMd)}`)
+        ...auditForbiddenTagsInText(text, `${item.id}: ${path49.relative(manifestDir, skillMd)}`)
       );
     } else if (item.type === "agent") {
       if (!fs36.existsSync(absPath)) {
         failures.push(`${item.id}: missing agent file ${item.path}`);
         continue;
       }
-      const rel = path48.relative(manifestDir, absPath);
+      const rel = path49.relative(manifestDir, absPath);
       const text = readForAudit(absPath, `${item.id}: ${rel}`, failures);
       if (text === null) continue;
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: ${rel}`));
@@ -8096,7 +8320,7 @@ function auditShippedFiles(manifestDir, items) {
         failures.push(`${item.id}: missing command file ${item.path}`);
         continue;
       }
-      const rel = path48.relative(manifestDir, absPath);
+      const rel = path49.relative(manifestDir, absPath);
       const text = readForAudit(absPath, `${item.id}: ${rel}`, failures);
       if (text === null) continue;
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: ${rel}`));
@@ -8128,7 +8352,7 @@ function walkAllFiles(dir, fn, failures) {
   }
   for (const entry of entries) {
     if (entry.name === ".DS_Store") continue;
-    const full = path48.join(dir, entry.name);
+    const full = path49.join(dir, entry.name);
     if (entry.isDirectory()) walkAllFiles(full, fn, failures);
     else fn(full);
   }
@@ -8146,12 +8370,12 @@ function auditDiskOrphans(manifestDir, items) {
   const failures = [];
   const claimedPaths = items.filter((item) => item.path && isSafeCatalogPath(item.path)).map((item) => item.path.replace(/\\/g, "/"));
   for (const dir of CONTENT_ROOTS) {
-    const abs = path48.join(manifestDir, dir);
+    const abs = path49.join(manifestDir, dir);
     if (!fs36.existsSync(abs)) continue;
     walkAllFiles(
       abs,
       (file) => {
-        const relPath = path48.relative(manifestDir, file).replace(/\\/g, "/");
+        const relPath = path49.relative(manifestDir, file).replace(/\\/g, "/");
         if (!isPathClaimed(relPath, claimedPaths)) {
           failures.push(`orphaned on disk, claimed by no manifest item: ${relPath}`);
         }
@@ -8172,7 +8396,7 @@ function walkMd(dir, fn, failures) {
     return;
   }
   for (const entry of entries) {
-    const full = path48.join(dir, entry.name);
+    const full = path49.join(dir, entry.name);
     if (entry.isDirectory()) walkMd(full, fn, failures);
     else if (entry.name.endsWith(".md")) fn(full);
   }
@@ -8181,13 +8405,13 @@ function auditMarkdownContent(manifestDir, items) {
   const failures = [];
   const pathSourceMap = buildItemPathSourceMap(items);
   for (const dir of ["skills", "agents", "templates", "commands"]) {
-    const abs = path48.join(manifestDir, dir);
+    const abs = path49.join(manifestDir, dir);
     if (!fs36.existsSync(abs)) continue;
     const dirType = DIR_ITEM_TYPE[dir] ?? "";
     walkMd(
       abs,
       (file) => {
-        const rel = path48.relative(manifestDir, file);
+        const rel = path49.relative(manifestDir, file);
         const text = readForAudit(file, rel, failures);
         if (text === null) return;
         const norm = rel.replace(/\\/g, "/");
@@ -8232,8 +8456,8 @@ async function runValidateCatalog(manifestPath2) {
     process.exitCode = 1;
     return;
   }
-  const abs = path49.resolve(process.cwd(), manifestPath2);
-  const manifestDir = path49.dirname(abs);
+  const abs = path50.resolve(process.cwd(), manifestPath2);
+  const manifestDir = path50.dirname(abs);
   const data = await readJson(abs);
   if (!data?.items) {
     error(`Could not read catalog manifest at ${abs}`);
@@ -8250,7 +8474,7 @@ async function runValidateCatalog(manifestPath2) {
 }
 
 // src/workspace/worktree/add.ts
-import path56 from "node:path";
+import path57 from "node:path";
 import fs40 from "fs-extra";
 
 // src/workspace/worktree/git-worktree.ts
@@ -8370,12 +8594,12 @@ async function hasUnpushedWork(cwd) {
 }
 
 // src/workspace/worktree/hydrate.ts
-import path52 from "node:path";
+import path53 from "node:path";
 import fs38 from "fs-extra";
 
 // src/workspace/worktree/cow-copy.ts
 init_exec();
-import path50 from "node:path";
+import path51 from "node:path";
 import fs37 from "fs-extra";
 async function getMacFilesystemType(dir) {
   const df = await runCommand("df", ["-P", dir]);
@@ -8410,11 +8634,11 @@ async function cowCopyDir(src, dest) {
   const srcExists = await fs37.pathExists(src);
   if (!srcExists)
     return { strategy: "unsupported", attempted: false, ok: false, error: "source missing" };
-  const strategy = await detectCowStrategy(path50.dirname(dest));
+  const strategy = await detectCowStrategy(path51.dirname(dest));
   if (strategy === "unsupported" || strategy === "unknown-platform") {
     return { strategy, attempted: false, ok: false };
   }
-  await fs37.ensureDir(path50.dirname(dest));
+  await fs37.ensureDir(path51.dirname(dest));
   const args = strategy === "darwin-clonefile" ? ["-c", "-R", src, dest] : ["-a", "--reflink=always", src, dest];
   const result = await runCommand("cp", args);
   return {
@@ -8428,7 +8652,7 @@ async function cowCopyDir(src, dest) {
 // src/workspace/worktree/install.ts
 init_exec();
 import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
-import path51 from "node:path";
+import path52 from "node:path";
 import fg5 from "fast-glob";
 function detectInstallPlan(signals) {
   if (signals.hasYarnLock) {
@@ -8449,10 +8673,10 @@ function detectInstallPlan(signals) {
   return { manager: "none" };
 }
 async function computeLockfileSignals(dir) {
-  const hasYarnLock = existsSync3(path51.join(dir, "yarn.lock"));
-  const hasPnpmLock = existsSync3(path51.join(dir, "pnpm-lock.yaml"));
-  const hasPackageLock = existsSync3(path51.join(dir, "package-lock.json"));
-  const hasComposerLock = existsSync3(path51.join(dir, "composer.lock"));
+  const hasYarnLock = existsSync3(path52.join(dir, "yarn.lock"));
+  const hasPnpmLock = existsSync3(path52.join(dir, "pnpm-lock.yaml"));
+  const hasPackageLock = existsSync3(path52.join(dir, "package-lock.json"));
+  const hasComposerLock = existsSync3(path52.join(dir, "composer.lock"));
   const dotnetFiles = await fg5(["**/*.csproj", "**/*.sln"], {
     cwd: dir,
     onlyFiles: true,
@@ -8466,7 +8690,7 @@ async function computeLockfileSignals(dir) {
   });
   const hasDotnetProject = dotnetFiles.length > 0;
   let hasPackageManagerField = false;
-  const pkgPath = path51.join(dir, "package.json");
+  const pkgPath = path52.join(dir, "package.json");
   if (existsSync3(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
@@ -8507,8 +8731,8 @@ async function hydrateMember(mainMemberPath, worktreeMemberPath, opts = {}) {
   const start = Date.now();
   const targets = [];
   for (const target of HYDRATION_TARGETS) {
-    const src = path52.join(mainMemberPath, target);
-    const dest = path52.join(worktreeMemberPath, target);
+    const src = path53.join(mainMemberPath, target);
+    const dest = path53.join(worktreeMemberPath, target);
     if (!await fs38.pathExists(src)) continue;
     const destExists = await fs38.pathExists(dest);
     if (!opts.force && destExists) continue;
@@ -8526,11 +8750,11 @@ async function hydrateMember(mainMemberPath, worktreeMemberPath, opts = {}) {
 
 // src/workspace/worktree/local-files.ts
 init_exec();
-import path53 from "node:path";
+import path54 from "node:path";
 import fs39 from "fs-extra";
 var MACHINE_LOCAL_FILES = [
   "docker-compose.local.yml",
-  path53.join(".claude", "settings.local.json")
+  path54.join(".claude", "settings.local.json")
 ];
 async function isTracked(repoRoot, relFile) {
   const gitPath = relFile.replace(/\\/g, "/");
@@ -8540,11 +8764,11 @@ async function isTracked(repoRoot, relFile) {
 async function copyMachineLocalFiles(mainMemberPath, worktreeMemberPath) {
   const copied = [];
   for (const rel of MACHINE_LOCAL_FILES) {
-    const src = path53.join(mainMemberPath, rel);
+    const src = path54.join(mainMemberPath, rel);
     if (!await fs39.pathExists(src)) continue;
     if (await isTracked(mainMemberPath, rel)) continue;
-    const dest = path53.join(worktreeMemberPath, rel);
-    await fs39.ensureDir(path53.dirname(dest));
+    const dest = path54.join(worktreeMemberPath, rel);
+    await fs39.ensureDir(path54.dirname(dest));
     await fs39.copy(src, dest, { overwrite: true });
     copied.push(rel);
   }
@@ -8553,15 +8777,15 @@ async function copyMachineLocalFiles(mainMemberPath, worktreeMemberPath) {
 
 // src/workspace/worktree/root.ts
 import { existsSync as existsSync4 } from "node:fs";
-import path54 from "node:path";
+import path55 from "node:path";
 async function resolveWorkspaceForWorktree(start) {
   const rootInfo = await resolveRoots(start);
   if (!rootInfo.isGitRepo) {
     return { ok: false, reason: "Not inside a git repository." };
   }
   const workspaceRoot = rootInfo.mainRoot;
-  const hasYaml = existsSync4(path54.join(workspaceRoot, WORKSPACE_FILE));
-  const hasManifest = existsSync4(path54.join(workspaceRoot, REPOS_MANIFEST_FILE));
+  const hasYaml = existsSync4(path55.join(workspaceRoot, WORKSPACE_FILE));
+  const hasManifest = existsSync4(path55.join(workspaceRoot, REPOS_MANIFEST_FILE));
   if (!hasYaml && !hasManifest) {
     return {
       ok: false,
@@ -8586,19 +8810,19 @@ function selectMembers(members, only) {
 }
 
 // src/workspace/worktree/state.ts
-import path55 from "node:path";
+import path56 from "node:path";
 var WORKTREE_STATE_FILE = ".haus-worktree.json";
 function worktreesDir(mainRoot) {
-  return path55.join(mainRoot, ".claude", "worktrees");
+  return path56.join(mainRoot, ".claude", "worktrees");
 }
 function worktreePath(mainRoot, slug) {
-  return path55.join(worktreesDir(mainRoot), slug);
+  return path56.join(worktreesDir(mainRoot), slug);
 }
 async function readWorktreeState(worktreeRoot) {
-  return readJson(path55.join(worktreeRoot, WORKTREE_STATE_FILE));
+  return readJson(path56.join(worktreeRoot, WORKTREE_STATE_FILE));
 }
 async function writeWorktreeState(worktreeRoot, state) {
-  await writeJson(path55.join(worktreeRoot, WORKTREE_STATE_FILE), state);
+  await writeJson(path56.join(worktreeRoot, WORKTREE_STATE_FILE), state);
 }
 
 // src/workspace/worktree/add.ts
@@ -8616,7 +8840,7 @@ async function runAdd(opts) {
   if (await fs40.pathExists(wsWorktreePath)) {
     return {
       ok: false,
-      error: `Workspace worktree already exists at ${wsWorktreePath} \u2014 run \`haus workspace worktree hydrate\` or \`remove\` first.`
+      error: `Workspace worktree already exists at ${wsWorktreePath} \u2014 run \`haus workspace worktree hydrate --materialize\` from inside it to check out any missing members (e.g. a worktree created by plain \`git worktree add\`), or \`remove\` first to start over.`
     };
   }
   if (opts.dryRun) {
@@ -8632,7 +8856,7 @@ async function runAdd(opts) {
   const memberResults = [];
   for (const member of selected) {
     const start = Date.now();
-    const memberWorktreePath = path56.join(wsWorktreePath, member.folder);
+    const memberWorktreePath = path57.join(wsWorktreePath, member.folder);
     const outcome = await addWorktree(member.absPath, memberWorktreePath, branch, {
       preferDefaultBranchFrom: true
     });
@@ -8662,7 +8886,7 @@ async function runAdd(opts) {
   await mapWithConcurrency(okResults, async (result) => {
     const member = selected.find((m) => m.id === result.member);
     if (!member) return;
-    const memberWorktreePath = path56.join(wsWorktreePath, member.folder);
+    const memberWorktreePath = path57.join(wsWorktreePath, member.folder);
     const hydrationStart = Date.now();
     if (opts.hydrate !== false) {
       result.hydration = await hydrateMember(member.absPath, memberWorktreePath);
@@ -8729,10 +8953,10 @@ async function runDryRun(args) {
 
 // src/workspace/worktree/doctor.ts
 import { existsSync as existsSync5 } from "node:fs";
-import path57 from "node:path";
+import path58 from "node:path";
 var HYDRATION_MARKERS = ["node_modules", "vendor", "obj", "bin"];
 function looksHydrated(memberPath) {
-  return HYDRATION_MARKERS.some((marker) => existsSync5(path57.join(memberPath, marker)));
+  return HYDRATION_MARKERS.some((marker) => existsSync5(path58.join(memberPath, marker)));
 }
 async function runDoctor2() {
   const rootInfo = await resolveRoots();
@@ -8746,7 +8970,7 @@ async function runDoctor2() {
     };
   }
   const workspaceRoot = rootInfo.mainRoot;
-  const isWorkspace = existsSync5(path57.join(workspaceRoot, WORKSPACE_FILE)) || existsSync5(path57.join(workspaceRoot, REPOS_MANIFEST_FILE));
+  const isWorkspace = existsSync5(path58.join(workspaceRoot, WORKSPACE_FILE)) || existsSync5(path58.join(workspaceRoot, REPOS_MANIFEST_FILE));
   if (!isWorkspace) {
     return {
       isWorkspace: false,
@@ -8759,7 +8983,7 @@ async function runDoctor2() {
     };
   }
   const wsWorktreesDir = worktreesDir(workspaceRoot);
-  const underWorktreesDir = rootInfo.repoRoot.startsWith(`${wsWorktreesDir}${path57.sep}`);
+  const underWorktreesDir = rootInfo.repoRoot.startsWith(`${wsWorktreesDir}${path58.sep}`);
   const inWorkspaceWorktree = rootInfo.isLinkedWorktree && underWorktreesDir;
   const members = await readMembers(rootInfo);
   const problems = [];
@@ -8767,10 +8991,10 @@ async function runDoctor2() {
   let slug;
   if (inWorkspaceWorktree) {
     const wtPath = rootInfo.repoRoot;
-    slug = rootInfo.worktreeName ?? path57.basename(wtPath);
+    slug = rootInfo.worktreeName ?? path58.basename(wtPath);
     const state = await readWorktreeState(wtPath);
     for (const member of members) {
-      const memberPath = path57.join(wtPath, member.folder);
+      const memberPath = path58.join(wtPath, member.folder);
       const materialized = existsSync5(memberPath);
       const expectedBranch = state?.members.find((m) => m.folder === member.folder)?.branch ?? state?.branch;
       const actualBranch = materialized ? await currentBranch(memberPath) : void 0;
@@ -8801,16 +9025,16 @@ async function runDoctor2() {
   for (const member of members) {
     const entries = await listWorktrees(member.absPath);
     for (const entry of entries) {
-      const entryPath = path57.normalize(entry.path);
-      const marker = `${path57.sep}.claude${path57.sep}worktrees${path57.sep}`;
+      const entryPath = path58.normalize(entry.path);
+      const marker = `${path58.sep}.claude${path58.sep}worktrees${path58.sep}`;
       const idx = entryPath.indexOf(marker);
       if (idx === -1) continue;
       const rest = entryPath.slice(idx + marker.length);
-      const slugName = rest.split(path57.sep)[0];
+      const slugName = rest.split(path58.sep)[0];
       if (!slugName) continue;
-      if (!existsSync5(path57.join(wsWorktreesDir, slugName))) {
+      if (!existsSync5(path58.join(wsWorktreesDir, slugName))) {
         orphans.push(
-          `${member.id}: worktree registered at ${entry.path} but ${path57.join(wsWorktreesDir, slugName)} no longer exists \u2014 run \`git -C "${member.absPath}" worktree prune\`.`
+          `${member.id}: worktree registered at ${entry.path} but ${path58.join(wsWorktreesDir, slugName)} no longer exists \u2014 run \`git -C "${member.absPath}" worktree prune\`.`
         );
       }
     }
@@ -8821,7 +9045,7 @@ async function runDoctor2() {
 
 // src/workspace/worktree/hydrate-command.ts
 import { existsSync as existsSync6 } from "node:fs";
-import path58 from "node:path";
+import path59 from "node:path";
 async function runHydrateWorktree(opts) {
   const rootInfo = await resolveRoots();
   if (!rootInfo.isGitRepo || !rootInfo.isLinkedWorktree) {
@@ -8832,7 +9056,7 @@ async function runHydrateWorktree(opts) {
   }
   const workspaceRoot = rootInfo.mainRoot;
   const wtPath = rootInfo.repoRoot;
-  if (!wtPath.startsWith(`${worktreesDir(workspaceRoot)}${path58.sep}`)) {
+  if (!wtPath.startsWith(`${worktreesDir(workspaceRoot)}${path59.sep}`)) {
     return {
       ok: false,
       error: "Current worktree is not one of this workspace's .claude/worktrees/<slug> checkouts."
@@ -8844,49 +9068,97 @@ async function runHydrateWorktree(opts) {
     return { ok: false, error: `Unknown --only repo(s): ${unknown.join(", ")}` };
   }
   const state = await readWorktreeState(wtPath);
-  const slug = state?.slug ?? path58.basename(wtPath);
+  const slug = state?.slug ?? path59.basename(wtPath);
+  const detectedBranch = await currentBranch(wtPath);
+  const targetBranch = state?.branch ?? (detectedBranch !== "HEAD" ? detectedBranch : void 0) ?? slug;
   if (opts.dryRun) {
-    const results2 = selected.map((member) => {
-      const memberPath = path58.join(wtPath, member.folder);
-      return {
-        member: member.id,
-        folder: member.folder,
-        status: existsSync6(memberPath) ? "planned" : "skipped",
-        error: existsSync6(memberPath) ? void 0 : "not materialized in this worktree"
-      };
-    });
+    const results2 = await Promise.all(
+      selected.map(async (member) => {
+        const memberPath = path59.join(wtPath, member.folder);
+        if (existsSync6(memberPath)) {
+          return { member: member.id, folder: member.folder, status: "planned" };
+        }
+        if (!opts.materialize) {
+          return {
+            member: member.id,
+            folder: member.folder,
+            status: "skipped",
+            error: "not materialized in this worktree"
+          };
+        }
+        const branchAction = await branchExists(member.absPath, targetBranch) ? "checkout" : "create";
+        return { member: member.id, folder: member.folder, status: "planned", branchAction };
+      })
+    );
     return { ok: true, dryRun: true, slug, results: results2 };
   }
   const results = await mapWithConcurrency(
     selected,
     async (member) => {
-      const memberPath = path58.join(wtPath, member.folder);
+      const memberPath = path59.join(wtPath, member.folder);
+      let branchAction;
       if (!existsSync6(memberPath)) {
-        return {
-          member: member.id,
-          folder: member.folder,
-          status: "skipped",
-          error: "not materialized in this worktree"
-        };
+        if (!opts.materialize) {
+          return {
+            member: member.id,
+            folder: member.folder,
+            status: "skipped",
+            error: "not materialized in this worktree"
+          };
+        }
+        const outcome = await addWorktree(member.absPath, memberPath, targetBranch, {
+          preferDefaultBranchFrom: true
+        });
+        if (!outcome.ok) {
+          return {
+            member: member.id,
+            folder: member.folder,
+            status: "failed",
+            error: outcome.checkedOutElsewhere ? `Branch "${targetBranch}" is already checked out elsewhere in ${member.id} \u2014 remove that worktree or resolve the branch conflict first.` : outcome.stderr ?? "unknown error creating the member worktree"
+          };
+        }
+        branchAction = outcome.branchAction;
       }
       try {
         const hydration = await hydrateMember(member.absPath, memberPath, { force: opts.force });
-        return { member: member.id, folder: member.folder, status: "ok", hydration };
+        return { member: member.id, folder: member.folder, status: "ok", hydration, branchAction };
       } catch (err) {
         return {
           member: member.id,
           folder: member.folder,
           status: "failed",
-          error: err instanceof Error ? err.message : String(err)
+          error: err instanceof Error ? err.message : String(err),
+          branchAction
         };
       }
     }
   );
+  const newlyMaterialized = results.filter((r) => r.branchAction && r.status === "ok");
+  if (newlyMaterialized.length > 0) {
+    const byId = new Map((state?.members ?? []).map((m) => [m.id, m]));
+    for (const r of newlyMaterialized) {
+      const member = selected.find((m) => m.id === r.member);
+      if (!member) continue;
+      const entry = {
+        id: member.id,
+        folder: member.folder,
+        branch: targetBranch,
+        absPath: member.absPath
+      };
+      byId.set(member.id, entry);
+    }
+    await writeWorktreeState(wtPath, {
+      slug,
+      branch: state?.branch ?? targetBranch,
+      createdAt: state?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+      members: Array.from(byId.values())
+    });
+  }
   return { ok: results.every((r) => r.status !== "failed"), dryRun: false, slug, results };
 }
 
 // src/workspace/worktree/list.ts
-import path59 from "node:path";
+import path60 from "node:path";
 import fs41 from "fs-extra";
 async function runList2() {
   const resolved = await resolveWorkspaceForWorktree();
@@ -8899,12 +9171,12 @@ async function runList2() {
   const configuredMembers = await readMembers(rootInfo);
   const worktrees = [];
   for (const slug of slugs) {
-    const wtPath = path59.join(dir, slug);
+    const wtPath = path60.join(dir, slug);
     const state = await readWorktreeState(wtPath);
     const members = [];
     const source = state?.members ?? configuredMembers.map((m) => ({ id: m.id, folder: m.folder }));
     for (const m of source) {
-      const memberPath = path59.join(wtPath, m.folder);
+      const memberPath = path60.join(wtPath, m.folder);
       const materialized = await fs41.pathExists(memberPath);
       const actualBranch = materialized ? await currentBranch(memberPath) : void 0;
       members.push({
@@ -8926,7 +9198,7 @@ async function runList2() {
 }
 
 // src/workspace/worktree/remove.ts
-import path60 from "node:path";
+import path61 from "node:path";
 import fs42 from "fs-extra";
 async function runRemove(opts) {
   const resolved = await resolveWorkspaceForWorktree();
@@ -8953,7 +9225,7 @@ async function runRemove(opts) {
     targets.push({
       repo: configMember?.id ?? stateMember.id,
       ownerRepo,
-      path: path60.join(wsWorktreePath, stateMember.folder)
+      path: path61.join(wsWorktreePath, stateMember.folder)
     });
   }
   const existingTargets = [];
@@ -9081,7 +9353,8 @@ async function handleHydrate(opts) {
   const hydrateOpts = {
     only: normalizeOnly(opts.only),
     force: Boolean(opts.force),
-    dryRun: Boolean(opts.dryRun)
+    dryRun: Boolean(opts.dryRun),
+    materialize: Boolean(opts.materialize)
   };
   const result = await runHydrateWorktree(hydrateOpts);
   if (!result.ok && "error" in result) {
@@ -9091,14 +9364,20 @@ async function handleHydrate(opts) {
   }
   if (result.dryRun) {
     log(`[dry-run] Would hydrate "${result.slug}":`);
-    for (const r of result.results)
-      log(`[dry-run]   ${r.member}: ${r.status}${r.error ? ` (${r.error})` : ""}`);
+    for (const r of result.results) {
+      const action = r.branchAction ? ` (${r.branchAction} member worktree first)` : "";
+      log(`[dry-run]   ${r.member}: ${r.status}${action}${r.error ? ` (${r.error})` : ""}`);
+    }
     return;
   }
   log(`Hydrated "${result.slug}":`);
   for (const r of result.results) {
-    if (r.status === "ok" && r.hydration) log(`  ${r.member}: ${describeInstall(r.hydration)}`);
-    else warn(`  ${r.member}: ${r.status}${r.error ? ` \u2014 ${r.error}` : ""}`);
+    if (r.status === "ok" && r.hydration) {
+      const materializedNote = r.branchAction ? `materialized (${r.branchAction}), ` : "";
+      log(`  ${r.member}: ${materializedNote}${describeInstall(r.hydration)}`);
+    } else {
+      warn(`  ${r.member}: ${r.status}${r.error ? ` \u2014 ${r.error}` : ""}`);
+    }
   }
   if (!result.ok) process.exitCode = 1;
 }
@@ -9157,6 +9436,13 @@ async function handleList() {
     }
   }
 }
+function emitFromHookContext(additionalContext) {
+  log(
+    JSON.stringify({
+      hookSpecificOutput: { hookEventName: "SessionStart", additionalContext }
+    })
+  );
+}
 async function handleDoctor(opts) {
   try {
     const report = await runDoctor2();
@@ -9168,17 +9454,26 @@ async function handleDoctor(opts) {
       return;
     }
     if (report.problems.length === 0) {
-      log(
-        report.inWorkspaceWorktree ? `Workspace worktree "${report.slug}" looks healthy.` : "No issues found."
+      if (!opts.fromHook) {
+        log(
+          report.inWorkspaceWorktree ? `Workspace worktree "${report.slug}" looks healthy.` : "No issues found."
+        );
+      }
+      return;
+    }
+    if (opts.fromHook) {
+      const scope = report.slug ? `Workspace worktree "${report.slug}"` : "This haus workspace";
+      emitFromHookContext(
+        `${scope} has ${report.problems.length} issue(s): ${report.problems.join("; ")}`
       );
       return;
     }
     for (const p of report.problems) warn(p);
-    if (!opts.fromHook) process.exitCode = 1;
+    process.exitCode = 1;
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     if (opts.fromHook) {
-      warn(`worktree doctor: ${message}`);
+      emitFromHookContext(`\`haus workspace worktree doctor\` failed: ${message}`);
     } else {
       error(message);
       process.exitCode = 1;
@@ -9202,7 +9497,7 @@ async function runWorktree(action, opts = {}) {
 
 // src/commands/workspace.ts
 import { existsSync as existsSync10, statSync as statSync3 } from "node:fs";
-import path69 from "node:path";
+import path70 from "node:path";
 
 // src/commands/workspace/aggregate.ts
 async function writeWorkspaceArtifacts(workspaceRoot, repos, relationships = []) {
@@ -9257,18 +9552,18 @@ ${summaries.map(
 
 // src/commands/workspace/doctor.ts
 import { existsSync as existsSync7 } from "node:fs";
-import path62 from "node:path";
+import path63 from "node:path";
 
 // src/commands/workspace/manifest.ts
 import { readFileSync as readFileSync4 } from "node:fs";
-import path61 from "node:path";
+import path62 from "node:path";
 var MANIFEST_FILE = "workspace.manifest.json";
 function manifestPath(workspaceRoot) {
   return hausPath(workspaceRoot, MANIFEST_FILE);
 }
 function hausVersion() {
   try {
-    const pkg = JSON.parse(readFileSync4(path61.join(packageRoot(), "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync4(path62.join(packageRoot(), "package.json"), "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -9352,7 +9647,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
   const manifestByName = new Map(manifest.repos.map((r) => [r.name, r]));
   const catalogRefByRepo = [];
   for (const repo of config.repos) {
-    const repoRoot = path62.resolve(workspaceRoot, repo.path);
+    const repoRoot = path63.resolve(workspaceRoot, repo.path);
     const entry = manifestByName.get(repo.name);
     if (!entry) {
       flag({
@@ -9425,7 +9720,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
         });
         continue;
       }
-      if (!existsSync7(path62.join(workspaceRoot, entry.path))) {
+      if (!existsSync7(path63.join(workspaceRoot, entry.path))) {
         flag({
           repo: entry.repo,
           kind: "missing-linked-context-copy",
@@ -9468,15 +9763,15 @@ function emit(args) {
 }
 
 // src/workspace/link-context/link.ts
-import path65 from "node:path";
+import path66 from "node:path";
 import fs45 from "fs-extra";
 
 // src/workspace/link-context/plan.ts
-import path64 from "node:path";
+import path65 from "node:path";
 import fs44 from "fs-extra";
 
 // src/workspace/link-context/scan-source.ts
-import path63 from "node:path";
+import path64 from "node:path";
 import fs43 from "fs-extra";
 var ASSET_SUBDIR = {
   skill: "skills",
@@ -9485,36 +9780,36 @@ var ASSET_SUBDIR = {
 };
 async function hasLinkableContext(member) {
   for (const subdir of Object.values(ASSET_SUBDIR)) {
-    if (await fs43.pathExists(path63.join(member.absPath, ".claude", subdir))) return true;
+    if (await fs43.pathExists(path64.join(member.absPath, ".claude", subdir))) return true;
   }
   return false;
 }
 async function collectSkills(member) {
-  const dir = path63.join(member.absPath, ".claude", "skills");
+  const dir = path64.join(member.absPath, ".claude", "skills");
   if (!await fs43.pathExists(dir)) return [];
   const names = await fs43.readdir(dir);
   const out = [];
   for (const name of [...names].sort()) {
-    const abs = path63.join(dir, name);
+    const abs = path64.join(dir, name);
     const stat = await fs43.lstat(abs);
     if (!stat.isDirectory()) continue;
-    if (!await fs43.pathExists(path63.join(abs, "SKILL.md"))) continue;
-    out.push({ type: "skill", name, sourceRelPath: path63.posix.join(".claude", "skills", name) });
+    if (!await fs43.pathExists(path64.join(abs, "SKILL.md"))) continue;
+    out.push({ type: "skill", name, sourceRelPath: path64.posix.join(".claude", "skills", name) });
   }
   return out;
 }
 async function collectFlatMarkdown(member, type) {
   const subdir = ASSET_SUBDIR[type];
-  const dir = path63.join(member.absPath, ".claude", subdir);
+  const dir = path64.join(member.absPath, ".claude", subdir);
   if (!await fs43.pathExists(dir)) return [];
   const names = await fs43.readdir(dir);
   const out = [];
   for (const fileName of [...names].sort()) {
     if (!fileName.endsWith(".md")) continue;
-    const abs = path63.join(dir, fileName);
+    const abs = path64.join(dir, fileName);
     if (!(await fs43.lstat(abs)).isFile()) continue;
     const name = fileName.slice(0, -".md".length);
-    out.push({ type, name, sourceRelPath: path63.posix.join(".claude", subdir, fileName) });
+    out.push({ type, name, sourceRelPath: path64.posix.join(".claude", subdir, fileName) });
   }
   return out;
 }
@@ -9529,9 +9824,9 @@ async function collectSourceAssets(member) {
 
 // src/workspace/link-context/plan.ts
 function repoFolderPrefix(member) {
-  const base = path64.posix.basename(member.folder);
+  const base = path65.posix.basename(member.folder);
   if (base && base !== "." && base !== "/") return base;
-  const fromAbs = path64.basename(member.absPath);
+  const fromAbs = path65.basename(member.absPath);
   return fromAbs || member.id;
 }
 function assetKey(type, destKey) {
@@ -9588,7 +9883,7 @@ async function buildLinkPlan(members) {
       name: asset.name,
       destKey,
       sourceRelPath: asset.sourceRelPath,
-      sourceAbsPath: path64.join(member.absPath, asset.sourceRelPath),
+      sourceAbsPath: path65.join(member.absPath, asset.sourceRelPath),
       sourceHash
     });
   }
@@ -9599,7 +9894,7 @@ async function buildLinkPlan(members) {
 function destRelPathFor(type, destKey) {
   const subdir = `${type}s`;
   const leaf = type === "skill" ? destKey : `${destKey}.md`;
-  return path65.posix.join(".claude", subdir, leaf);
+  return path66.posix.join(".claude", subdir, leaf);
 }
 async function runLinkContext(workspaceRoot, opts = {}) {
   const write = opts.write ?? false;
@@ -9625,9 +9920,9 @@ async function runLinkContext(workspaceRoot, opts = {}) {
   const linkedAt = (/* @__PURE__ */ new Date()).toISOString();
   for (const entry of plan.entries) {
     const destRel = destRelPathFor(entry.type, entry.destKey);
-    const destAbs = path65.join(workspaceRoot, destRel);
+    const destAbs = path66.join(workspaceRoot, destRel);
     if (write) {
-      await fs45.ensureDir(path65.dirname(destAbs));
+      await fs45.ensureDir(path66.dirname(destAbs));
       if (await fs45.pathExists(destAbs)) await fs45.remove(destAbs);
       await fs45.copy(entry.sourceAbsPath, destAbs, {
         overwrite: true,
@@ -9659,7 +9954,7 @@ async function runLinkContext(workspaceRoot, opts = {}) {
     if (nextPaths.has(old.path)) continue;
     removed.push(old.path);
     if (write) {
-      const abs = path65.join(workspaceRoot, old.path);
+      const abs = path66.join(workspaceRoot, old.path);
       if (await fs45.pathExists(abs)) await fs45.remove(abs);
     }
   }
@@ -9712,10 +10007,10 @@ async function runWorkspaceLinkContext(workspaceRoot, opts = {}) {
 
 // src/commands/workspace/setup.ts
 import { existsSync as existsSync8, statSync } from "node:fs";
-import path67 from "node:path";
+import path68 from "node:path";
 
 // src/claude/write-workspace-claude-md.ts
-import path66 from "node:path";
+import path67 from "node:path";
 import fs46 from "fs-extra";
 function buildWorkspaceImportBlock(client, members) {
   const memberLines = members.map((m) => `- ${m.name} (${m.path})`);
@@ -9734,7 +10029,7 @@ ${BLOCK_END}`;
 async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
   const block = buildWorkspaceImportBlock(opts.client, opts.members);
   const dryRun = opts.dryRun ?? false;
-  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path66.join(workspaceRoot, "CLAUDE.md");
+  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path67.join(workspaceRoot, "CLAUDE.md");
   const say = opts.quiet ? () => {
   } : log;
   const existed = await fs46.pathExists(filePath);
@@ -9765,20 +10060,20 @@ async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
 
 // src/commands/workspace/setup.ts
 function resolveWorkspaceRoot(start = process.cwd()) {
-  let dir = path67.resolve(start);
+  let dir = path68.resolve(start);
   for (; ; ) {
-    if (existsSync8(path67.join(dir, WORKSPACE_FILE))) return dir;
-    const parent = path67.dirname(dir);
-    if (parent === dir) return path67.resolve(start);
+    if (existsSync8(path68.join(dir, WORKSPACE_FILE))) return dir;
+    const parent = path68.dirname(dir);
+    if (parent === dir) return path68.resolve(start);
     dir = parent;
   }
 }
 function isRootRepo(workspaceRoot, repoPath) {
-  return path67.resolve(workspaceRoot, repoPath) === path67.resolve(workspaceRoot);
+  return path68.resolve(workspaceRoot, repoPath) === path68.resolve(workspaceRoot);
 }
 async function runWorkspaceSetup(workspaceRoot, options = {}) {
   const apply = options.write ?? false;
-  const configText = await readText(path67.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path68.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
@@ -9805,7 +10100,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
   const statuses = [];
   const aggregateInputs = [];
   for (const repo of repos) {
-    const repoRoot = path67.resolve(workspaceRoot, repo.path);
+    const repoRoot = path68.resolve(workspaceRoot, repo.path);
     say(`
 \u2192 ${repo.name} (${repo.path})`);
     try {
@@ -9876,7 +10171,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
       const status = statusByName.get(repo.name);
       const role = repo.role ?? status?.roles?.[0] ?? "auto";
       if (status?.status === "ok") {
-        const lock = await checkLock(path67.resolve(workspaceRoot, repo.path));
+        const lock = await checkLock(path68.resolve(workspaceRoot, repo.path));
         manifestRepos.push({
           name: repo.name,
           path: repo.path,
@@ -9932,7 +10227,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
     try {
       const linkResult = await runLinkContext(workspaceRoot, { write: true, json: options.json });
       if (linkResult.ok) {
-        written.push(...linkResult.added.map((rel) => path67.join(workspaceRoot, rel)));
+        written.push(...linkResult.added.map((rel) => path68.join(workspaceRoot, rel)));
         if (!options.json) {
           say(
             `Linked ${linkResult.linked.length} cross-repo skill/agent/command copy(ies) into .claude/ (${linkResult.added.length} new, ${linkResult.removed.length} removed)${linkResult.skipped.length > 0 ? ` \u2014 ${linkResult.skipped.length} member(s) skipped, see above` : ""}.`
@@ -9964,7 +10259,7 @@ Workspace setup complete: ${ok} ok, ${failed} failed. Wrote ${written.length} fi
 
 // src/commands/workspace/undo.ts
 import { existsSync as existsSync9, statSync as statSync2 } from "node:fs";
-import path68 from "node:path";
+import path69 from "node:path";
 import fs47 from "fs-extra";
 var WORKSPACE_AGGREGATE_FILES = [
   "workspace-summary.json",
@@ -9993,7 +10288,7 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
   }
   let anyRepoFailed = false;
   for (const repo of config.repos) {
-    const repoRoot = path68.resolve(workspaceRoot, repo.path);
+    const repoRoot = path69.resolve(workspaceRoot, repo.path);
     log(`
 \u2192 ${repo.name} (${repo.path})`);
     try {
@@ -10008,7 +10303,7 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
   }
   const linkedContext = await readLinkedContext(workspaceRoot);
   for (const entry of linkedContext) {
-    const abs = path68.join(workspaceRoot, entry.path);
+    const abs = path69.join(workspaceRoot, entry.path);
     if (await fs47.pathExists(abs)) {
       await fs47.remove(abs);
       log(`Removed ${entry.path} (linked ${entry.type} from ${entry.repo})`);
@@ -10018,20 +10313,20 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
     const abs = hausPath(workspaceRoot, rel);
     if (await fs47.pathExists(abs)) {
       await fs47.remove(abs);
-      log(`Removed ${path68.relative(workspaceRoot, abs)}`);
+      log(`Removed ${path69.relative(workspaceRoot, abs)}`);
     }
   }
   const manifestFile = manifestPath(workspaceRoot);
   if (await fs47.pathExists(manifestFile)) {
     await fs47.remove(manifestFile);
-    log(`Removed ${path68.relative(workspaceRoot, manifestFile)}`);
+    log(`Removed ${path69.relative(workspaceRoot, manifestFile)}`);
   }
   const workspaceMdPath = hausPath(workspaceRoot, "WORKSPACE.md");
   if (await fs47.pathExists(workspaceMdPath)) {
     await fs47.remove(workspaceMdPath);
-    log(`Removed ${path68.relative(workspaceRoot, workspaceMdPath)}`);
+    log(`Removed ${path69.relative(workspaceRoot, workspaceMdPath)}`);
   } else {
-    const claudeMdPath = path68.join(workspaceRoot, "CLAUDE.md");
+    const claudeMdPath = path69.join(workspaceRoot, "CLAUDE.md");
     if (existsSync9(claudeMdPath)) {
       const prev = await readText(claudeMdPath);
       if (prev?.includes(BLOCK_BEGIN)) {
@@ -10083,7 +10378,7 @@ relationships: []
   log("Workspace initialized.");
 }
 async function scanWorkspace(workspaceRoot, opts) {
-  const configText = await readText(path69.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path70.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
@@ -10105,7 +10400,7 @@ async function scanWorkspace(workspaceRoot, opts) {
   const inputs = [];
   const failures = [];
   for (const repo of config.repos) {
-    const repoRoot = path69.resolve(workspaceRoot, repo.path);
+    const repoRoot = path70.resolve(workspaceRoot, repo.path);
     try {
       if (!existsSync10(repoRoot) || !statSync3(repoRoot).isDirectory()) {
         throw new Error("path is not a directory");
@@ -10171,7 +10466,7 @@ async function runWorkspace(action, options = {}) {
 // src/cli.ts
 function cliVersion() {
   try {
-    const pkgPath = path70.join(packageRoot(), "package.json");
+    const pkgPath = path71.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
@@ -10181,7 +10476,7 @@ function cliVersion() {
 var program = new Command();
 function validateRuntimeNodeVersion() {
   try {
-    const pkgPath = path70.join(packageRoot(), "package.json");
+    const pkgPath = path71.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
     const requiredRange = pkg.engines?.node;
     if (requiredRange && !satisfiesVersion(process.version, requiredRange)) {
@@ -10282,8 +10577,16 @@ worktree.command("add <slug>").description(
     dryRun: opts.dryRun
   })
 );
-worktree.command("hydrate").description("Re-run CoW clone + install-reconciliation for the current workspace worktree").option("--only <repos>", "Restrict to comma- or space-separated member ids/folders").option("--force", "Re-clone hydration targets even if already present").option("--dry-run", "Preview without writing or running anything").action(
-  (opts) => runWorktree("hydrate", { only: opts.only, force: opts.force, dryRun: opts.dryRun })
+worktree.command("hydrate").description("Re-run CoW clone + install-reconciliation for the current workspace worktree").option("--only <repos>", "Restrict to comma- or space-separated member ids/folders").option("--force", "Re-clone hydration targets even if already present").option(
+  "--materialize",
+  "Also `git worktree add` any member missing entirely (e.g. a worktree created by plain `git worktree add` outside haus) before hydrating it"
+).option("--dry-run", "Preview without writing or running anything").action(
+  (opts) => runWorktree("hydrate", {
+    only: opts.only,
+    force: opts.force,
+    materialize: opts.materialize,
+    dryRun: opts.dryRun
+  })
 );
 worktree.command("list").description("List materialized workspace worktrees and their member status").action(() => runWorktree("list"));
 worktree.command("remove <slug>").description("Remove a workspace worktree and its member worktrees").option("--force", "Bypass the uncommitted/unpushed-work refusal").option("--dry-run", "Preview without removing anything").action(