@haus-tech/haus-workflow 1.5.5 → 1.5.6

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [1.5.6](https://github.com/WeAreHausTech/haus-workflow/compare/v1.5.5...v1.5.6) (2026-08-12)
+
+### Bug Fixes
+
+- cross-repo manifest validator parity (--include vs catalog) ([#269](https://github.com/WeAreHausTech/haus-workflow/issues/269)) ([84269e6](https://github.com/WeAreHausTech/haus-workflow/commit/84269e67ab5e5cb28efdfaaea537c1d2d1459c08)), closes [haus-workflow-catalog#76](https://github.com/WeAreHausTech/haus-workflow-catalog/issues/76) [#227](https://github.com/WeAreHausTech/haus-workflow/issues/227) [#228](https://github.com/WeAreHausTech/haus-workflow/issues/228) [#227](https://github.com/WeAreHausTech/haus-workflow/issues/227) [#227](https://github.com/WeAreHausTech/haus-workflow/issues/227) [#228](https://github.com/WeAreHausTech/haus-workflow/issues/228)
+
 ## [1.5.5](https://github.com/WeAreHausTech/haus-workflow/compare/v1.5.4...v1.5.5) (2026-08-11)
 
 ### Bug Fixes

package/dist/cli.js

@@ -693,10 +693,17 @@ function validateReferences(itemId, references) {
   if (references === void 0) return null;
   if (!isStringArray(references)) return `${itemId}: references must be a string array`;
   for (const ref of references) {
-    if (/^https?:\/\//i.test(ref)) {
-      if (!/^https:\/\//i.test(ref)) {
-        return `${itemId}: reference must be https:// URL: ${ref}`;
-      }
+    let parsed;
+    try {
+      parsed = new URL(ref);
+    } catch {
+      return `${itemId}: reference is not a valid URL: ${ref}`;
+    }
+    if (parsed.protocol === "http:") {
+      return `${itemId}: reference uses insecure http:// URL: ${ref}`;
+    }
+    if (parsed.protocol !== "https:") {
+      return `${itemId}: reference must be https:// URL: ${ref}`;
     }
   }
   return null;
@@ -751,16 +758,29 @@ function validateCuratedProvenance(item) {
   if (!RISK_LEVELS.has(item.riskLevel)) {
     return `${item.id}: invalid riskLevel "${item.riskLevel}"`;
   }
-  if (item.useMode !== void 0 && !USE_MODES.has(String(item.useMode))) {
+  if (!isNonEmptyString(item.originSourceId)) {
+    return `${item.id}: curated item missing originSourceId`;
+  }
+  if (!isNonEmptyString(item.originUrl)) {
+    return `${item.id}: curated item missing originUrl`;
+  }
+  if (!isNonEmptyString(item.useMode)) {
+    return `${item.id}: curated item missing useMode`;
+  }
+  if (!USE_MODES.has(item.useMode)) {
     return `${item.id}: invalid useMode "${item.useMode}"`;
   }
-  if (item.licenseConfidence !== void 0 && !LICENSE_CONFIDENCES.has(String(item.licenseConfidence))) {
+  if (!isNonEmptyString(item.license)) {
+    return `${item.id}: curated item missing license`;
+  }
+  if (!isNonEmptyString(item.licenseConfidence)) {
+    return `${item.id}: curated item missing licenseConfidence`;
+  }
+  if (!LICENSE_CONFIDENCES.has(item.licenseConfidence)) {
     return `${item.id}: invalid licenseConfidence "${item.licenseConfidence}"`;
   }
-  if (item.originUrl !== void 0) {
-    if (typeof item.originUrl !== "string" || !item.originUrl.startsWith("https://")) {
-      return `${item.id}: originUrl must be an https:// URL`;
-    }
+  if (typeof item.originUrl !== "string" || !item.originUrl.startsWith("https://")) {
+    return `${item.id}: originUrl must be an https:// URL`;
   }
   return null;
 }
@@ -782,9 +802,6 @@ function isRequiresAnyClause(value) {
   if (!REQUIRES_ANY_KEYS.includes(key)) return false;
   return typeof value[key] === "string";
 }
-function isRequiresAnyArray(value) {
-  return Array.isArray(value) && value.every(isRequiresAnyClause);
-}
 function safeParse(json) {
   return JSON.parse(json, (key, value) => {
     if (POLLUTION_KEYS.has(key)) return void 0;
@@ -811,6 +828,7 @@ function parseManifest(json) {
   const items = [];
   const seenIds = /* @__PURE__ */ new Set();
   const seenPaths = /* @__PURE__ */ new Set();
+  const warnings = [];
   for (let i = 0; i < root.items.length; i++) {
     const raw = root.items[i];
     if (!raw || typeof raw !== "object") {
@@ -845,8 +863,21 @@ function parseManifest(json) {
     if (!isStringArray2(item.repoRoles)) {
       return { ok: false, error: `${item.id}: repoRoles must be a string array` };
     }
-    if (item.requiresAny !== void 0 && !isRequiresAnyArray(item.requiresAny)) {
-      return { ok: false, error: `${item.id}: requiresAny must be an array of clause objects` };
+    if (item.requiresAny !== void 0) {
+      if (!Array.isArray(item.requiresAny)) {
+        return { ok: false, error: `${item.id}: requiresAny must be an array of clause objects` };
+      }
+      const kept = [];
+      for (const clause of item.requiresAny) {
+        if (isRequiresAnyClause(clause)) {
+          kept.push(clause);
+        } else {
+          warnings.push(
+            `${item.id}: dropping unrecognized requiresAny clause (catalog schema evolved ahead of this CLI version) \u2014 ${JSON.stringify(clause)}`
+          );
+        }
+      }
+      item.requiresAny = kept;
     }
     if (typeof item.tokenEstimate !== "number" || !Number.isFinite(item.tokenEstimate)) {
       return { ok: false, error: `${item.id}: tokenEstimate must be a finite number` };
@@ -863,7 +894,7 @@ function parseManifest(json) {
   if (formerIdFailures.length > 0) {
     return { ok: false, error: formerIdFailures[0] };
   }
-  return { ok: true, manifest: { version: root.version, items } };
+  return { ok: true, manifest: { version: root.version, items }, warnings };
 }
 
 // src/catalog/remote-catalog/manifest.ts
@@ -876,6 +907,7 @@ async function fetchRemoteManifest() {
     warn(`Remote manifest failed schema validation: ${parsed.error}`);
     return null;
   }
+  for (const warning of parsed.warnings) warn(warning);
   if (!parsed.manifest.items.length) return null;
   return parsed.manifest;
 }

package/library/catalog/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "4.3.2",
+  "version": "4.3.3",
   "items": [
     {
       "id": "haus.agentic-workflow-standard",
@@ -365,7 +365,7 @@
       "useMode": "copy",
       "license": "MIT",
       "licenseConfidence": "high",
-      "originSourceId": "ecc",
+      "originSourceId": "ecc-affaanm",
       "originUrl": "https://github.com/affaan-m/ECC/blob/ec92b528471df708c2384ebbcc82b390b60f535a/skills/csharp-testing/SKILL.md",
       "pinnedRef": "ec92b528471df708c2384ebbcc82b390b60f535a",
       "ecosystem": "dotnet",
@@ -466,7 +466,7 @@
       "useMode": "copy",
       "license": "MIT",
       "licenseConfidence": "high",
-      "originSourceId": "ecc",
+      "originSourceId": "ecc-affaanm",
       "originUrl": "https://github.com/affaan-m/ECC/blob/71d22d0a77b7e0684f4e51cba03749b788993cdb/skills/dotnet-patterns/SKILL.md",
       "pinnedRef": "71d22d0a77b7e0684f4e51cba03749b788993cdb",
       "ecosystem": "dotnet",
@@ -531,7 +531,7 @@
       "useMode": "copy",
       "license": "MIT",
       "licenseConfidence": "high",
-      "originSourceId": "ecc",
+      "originSourceId": "ecc-affaanm",
       "originUrl": "https://github.com/affaan-m/ECC/blob/71d22d0a77b7e0684f4e51cba03749b788993cdb/skills/e2e-testing/SKILL.md",
       "pinnedRef": "71d22d0a77b7e0684f4e51cba03749b788993cdb",
       "ecosystem": "playwright",
@@ -565,7 +565,7 @@
       "useMode": "copy",
       "license": "MIT",
       "licenseConfidence": "high",
-      "originSourceId": "ecc",
+      "originSourceId": "ecc-affaanm",
       "originUrl": "https://github.com/affaan-m/ECC/blob/ec92b528471df708c2384ebbcc82b390b60f535a/skills/frontend-patterns/SKILL.md",
       "pinnedRef": "ec92b528471df708c2384ebbcc82b390b60f535a",
       "ecosystem": "react",
@@ -601,7 +601,7 @@
       "useMode": "copy",
       "license": "MIT",
       "licenseConfidence": "high",
-      "originSourceId": "ecc",
+      "originSourceId": "ecc-affaanm",
       "originUrl": "https://github.com/affaan-m/ECC/blob/ec92b528471df708c2384ebbcc82b390b60f535a/skills/laravel-patterns/SKILL.md",
       "pinnedRef": "ec92b528471df708c2384ebbcc82b390b60f535a",
       "ecosystem": "laravel",
@@ -703,7 +703,7 @@
       "useMode": "copy",
       "license": "MIT",
       "licenseConfidence": "high",
-      "originSourceId": "ecc",
+      "originSourceId": "ecc-affaanm",
       "originUrl": "https://github.com/affaan-m/ECC/blob/ec92b528471df708c2384ebbcc82b390b60f535a/skills/laravel-plugin-discovery/SKILL.md",
       "pinnedRef": "ec92b528471df708c2384ebbcc82b390b60f535a",
       "ecosystem": "laravel",
@@ -774,7 +774,7 @@
       "useMode": "copy",
       "license": "MIT",
       "licenseConfidence": "high",
-      "originSourceId": "ecc",
+      "originSourceId": "ecc-affaanm",
       "originUrl": "https://github.com/affaan-m/ECC/blob/ec92b528471df708c2384ebbcc82b390b60f535a/skills/laravel-verification/SKILL.md",
       "pinnedRef": "ec92b528471df708c2384ebbcc82b390b60f535a",
       "ecosystem": "laravel",
@@ -807,7 +807,7 @@
       "useMode": "copy",
       "license": "MIT",
       "licenseConfidence": "high",
-      "originSourceId": "ecc",
+      "originSourceId": "ecc-affaanm",
       "originUrl": "https://github.com/affaan-m/ECC/blob/ec92b528471df708c2384ebbcc82b390b60f535a/skills/nestjs-patterns/SKILL.md",
       "pinnedRef": "ec92b528471df708c2384ebbcc82b390b60f535a",
       "ecosystem": "nestjs",
@@ -901,7 +901,7 @@
       "useMode": "copy",
       "license": "MIT",
       "licenseConfidence": "high",
-      "originSourceId": "ecc",
+      "originSourceId": "ecc-affaanm",
       "originUrl": "https://github.com/affaan-m/ECC/blob/81af40761939056ab3dc54732fd4f562a27309d0/skills/prisma-patterns/SKILL.md",
       "pinnedRef": "81af40761939056ab3dc54732fd4f562a27309d0",
       "ecosystem": "database",
@@ -1002,7 +1002,7 @@
       "useMode": "copy",
       "license": "MIT",
       "licenseConfidence": "high",
-      "originSourceId": "ecc",
+      "originSourceId": "ecc-affaanm",
       "originUrl": "https://github.com/affaan-m/ECC/blob/71d22d0a77b7e0684f4e51cba03749b788993cdb/skills/react-testing/SKILL.md",
       "pinnedRef": "71d22d0a77b7e0684f4e51cba03749b788993cdb",
       "ecosystem": "testing",
@@ -1172,7 +1172,7 @@
       "useMode": "copy",
       "license": "MIT",
       "licenseConfidence": "high",
-      "originSourceId": "ecc",
+      "originSourceId": "ecc-affaanm",
       "originUrl": "https://github.com/affaan-m/ECC/blob/ec92b528471df708c2384ebbcc82b390b60f535a/skills/vite-patterns/SKILL.md",
       "pinnedRef": "ec92b528471df708c2384ebbcc82b390b60f535a",
       "ecosystem": "vite",
@@ -1205,7 +1205,7 @@
       "useMode": "copy",
       "license": "MIT",
       "licenseConfidence": "high",
-      "originSourceId": "ecc",
+      "originSourceId": "ecc-affaanm",
       "originUrl": "https://github.com/affaan-m/ECC/blob/71d22d0a77b7e0684f4e51cba03749b788993cdb/skills/vue-patterns/SKILL.md",
       "pinnedRef": "71d22d0a77b7e0684f4e51cba03749b788993cdb",
       "ecosystem": "vue",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haus-tech/haus-workflow",
-  "version": "1.5.5",
+  "version": "1.5.6",
   "description": "Haus AI workflow CLI for Claude Code.",
   "type": "module",
   "bin": {