@haus-tech/haus-workflow 4.0.0 → 4.0.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [4.0.1](https://github.com/WeAreHausTech/haus-workflow/compare/v4.0.0...v4.0.1) (2026-08-20)
+
+### Bug Fixes
+
+- land remaining [#299](https://github.com/WeAreHausTech/haus-workflow/issues/299) cleanup backlog ([#322](https://github.com/WeAreHausTech/haus-workflow/issues/322)) ([0b9a747](https://github.com/WeAreHausTech/haus-workflow/commit/0b9a747be0ad4d61c52113a62d126f8133f6e175))
+- treat mixed escaping-path entries as whole-entry refusals ([#321](https://github.com/WeAreHausTech/haus-workflow/issues/321)) ([59593e8](https://github.com/WeAreHausTech/haus-workflow/commit/59593e8495f88422943132d8a9a62badee887431))
+
 ## [4.0.0](https://github.com/WeAreHausTech/haus-workflow/compare/v3.1.2...v4.0.0) (2026-08-20)
 
 ### ⚠ BREAKING CHANGES

package/dist/cli.js

@@ -1913,7 +1913,7 @@ var init_sync = __esm({
 
 // src/cli.ts
 import { readFileSync as readFileSync5 } from "node:fs";
-import path79 from "node:path";
+import path80 from "node:path";
 import { Command } from "commander";
 
 // src/commands/apply.ts
@@ -3050,8 +3050,8 @@ function buildDenyRules() {
   for (const command of DENY_COMMANDS) {
     rules.push(`Bash(${command}:*)`);
   }
-  for (const path80 of DENY_PATHS) {
-    const pattern = DENY_DIRS.has(path80) ? `${path80}/**` : path80;
+  for (const path81 of DENY_PATHS) {
+    const pattern = DENY_DIRS.has(path81) ? `${path81}/**` : path81;
     for (const tool of FILE_TOOLS) {
       rules.push(`${tool}(${pattern})`);
     }
@@ -4441,7 +4441,7 @@ async function cleanupMigratedCatalogItems(root, prevLock, migrations, dryRun, q
     const relPaths = entry.paths ?? [];
     const existing = await resolveExistingTrackedPaths(root, migration.oldId, relPaths, warn);
     if (existing.length === 0) continue;
-    const gate = await hashGateEntry(root, { id: migration.oldId, hash: entry.hash }, existing);
+    const gate = await hashGateEntry(root, { hash: entry.hash }, existing);
     if (!gate.ok) {
       if (gate.reason === "no-hash") {
         warn(
@@ -4468,7 +4468,7 @@ async function cleanupMigratedCatalogItems(root, prevLock, migrations, dryRun, q
     return;
   }
   const allAbsPaths = toRemove.flatMap(({ existing }) => existing.map(({ abs }) => abs));
-  await backupTrackedPaths(root, allAbsPaths, say, "migrate");
+  void await backupTrackedPaths(root, allAbsPaths, say, "migrate");
   for (const { existing } of toRemove) {
     for (const { abs } of existing) {
       await fs22.remove(abs);
@@ -4487,11 +4487,13 @@ async function cleanupStaleCatalogItems(root, manifestById, dryRun, quiet, activ
   );
   let keepShared = false;
   for (const entry of supersededEntries) {
+    const id = entry.id;
+    if (!id) continue;
     const relPaths = entry.paths ?? [];
     if (relPaths.length === 0) continue;
-    const existing = await resolveExistingTrackedPaths(root, entry.id, relPaths, warn);
+    const existing = await resolveExistingTrackedPaths(root, id, relPaths, warn);
     if (existing.length === 0) continue;
-    const gate = await hashGateEntry(root, { id: entry.id, hash: entry.hash }, existing);
+    const gate = await hashGateEntry(root, { hash: entry.hash }, existing);
     if (!gate.ok) keepShared = true;
   }
   for (const entry of prevLock) {
@@ -4503,12 +4505,15 @@ async function cleanupStaleCatalogItems(root, manifestById, dryRun, quiet, activ
     if (!removedFromManifest && !deprecated && !superseded) continue;
     const relPaths = entry.paths ?? [];
     if (relPaths.length === 0) continue;
-    if (await hasProtectedUnsafePath(root, relPaths)) refusedIds.add(entry.id);
     const existing = await resolveExistingTrackedPaths(root, entry.id, relPaths, warn);
+    if (await hasProtectedUnsafePath(root, relPaths)) {
+      refusedIds.add(entry.id);
+      continue;
+    }
     if (existing.length === 0) continue;
     const pruneReason = superseded ? "superseded" : deprecated ? "deprecated" : "stale";
     const label = superseded ? "Superseded" : deprecated ? "Deprecated" : "Stale";
-    const gate = await hashGateEntry(root, { id: entry.id, hash: entry.hash }, existing);
+    const gate = await hashGateEntry(root, { hash: entry.hash }, existing);
     if (!gate.ok) {
       if (gate.reason === "no-hash") {
         warn(
@@ -4533,7 +4538,7 @@ async function cleanupStaleCatalogItems(root, manifestById, dryRun, quiet, activ
       return true;
     }) : existing;
     if (!dryRun && removable.length > 0) {
-      await backupTrackedPaths(
+      void await backupTrackedPaths(
         root,
         removable.map((e) => e.abs),
         say,
@@ -4563,10 +4568,13 @@ async function pruneOrphanedCatalogItems(root, prevLock, notOrphanedIds, dryRun,
     if (!entry.id) continue;
     const relPaths = entry.paths ?? [];
     if (relPaths.length === 0) continue;
-    if (await hasProtectedUnsafePath(root, relPaths)) refusedIds.add(entry.id);
     const existing = await resolveExistingTrackedPaths(root, entry.id, relPaths, warn);
+    if (await hasProtectedUnsafePath(root, relPaths)) {
+      refusedIds.add(entry.id);
+      continue;
+    }
     if (existing.length === 0) continue;
-    const gate = await hashGateEntry(root, { id: entry.id, hash: entry.hash }, existing);
+    const gate = await hashGateEntry(root, { hash: entry.hash }, existing);
     if (!gate.ok) {
       const detail = gate.reason === "no-hash" ? "has no lock hash" : "was modified locally";
       warn(
@@ -4587,7 +4595,7 @@ async function pruneOrphanedCatalogItems(root, prevLock, notOrphanedIds, dryRun,
     return refusedIds;
   }
   const allAbsPaths = toRemove.flatMap(({ existing }) => existing.map(({ abs }) => abs));
-  await backupTrackedPaths(root, allAbsPaths, say, "prune");
+  void await backupTrackedPaths(root, allAbsPaths, say, "prune");
   for (const { id, existing } of toRemove) {
     await deleteTrackedPaths(root, id, existing, { verb: "Pruned", reason: "orphaned" }, say);
   }
@@ -4604,7 +4612,8 @@ var GITIGNORED_ARTIFACT_PATHS = [
   ".haus-workflow/context-map.json",
   ".haus-workflow/recommendation.json",
   ".haus-workflow/sources-report.json",
-  ".haus-workflow/deep-context.json"
+  ".haus-workflow/deep-context.json",
+  ".haus-workflow/backups/"
 ];
 function findLineMarker3(content2, marker, from = 0) {
   let idx = content2.indexOf(marker, from);
@@ -4649,7 +4658,7 @@ function buildBlockFor(existing, beginMarker, endMarker, comment, patterns) {
   if (needed.length === 0) return null;
   return [beginMarker, comment, ...needed, endMarker].join("\n");
 }
-var ARTIFACT_BLOCK_COMMENT = "# haus scan artifacts \u2014 machine-local, must never be committed (see ADR-0025)";
+var ARTIFACT_BLOCK_COMMENT = "# haus machine-local artifacts \u2014 must never be committed (see ADR-0025, ADR-0058)";
 function injectBlockFor(existing, beginMarker, endMarker, comment, patterns) {
   const block = buildBlockFor(existing, beginMarker, endMarker, comment, patterns);
   const range = findBlockRangeFor(existing, beginMarker, endMarker);
@@ -4742,7 +4751,7 @@ async function untrackMachineLocalArtifacts(root, dryRun, notify) {
   for (const rel of tracked) {
     if (dryRun) {
       notify(
-        `Would untrack ${rel} from git \u2014 it contains machine-local scan output and should never have been committed.`
+        `Would untrack ${rel} from git \u2014 it is machine-local haus output and should never have been committed.`
       );
       continue;
     }
@@ -4750,7 +4759,7 @@ async function untrackMachineLocalArtifacts(root, dryRun, notify) {
     if (result.exitCode === 0) {
       untracked.push(rel);
       notify(
-        `Untracked ${rel} from git \u2014 it contains machine-local scan output and should never have been committed. Run \`git status\` to review before committing this change.`
+        `Untracked ${rel} from git \u2014 it is machine-local haus output and should never have been committed. Run \`git status\` to review before committing this change.`
       );
     } else {
       notify(`Could not untrack ${rel} from git: ${result.stderr.trim() || result.stdout.trim()}`);
@@ -7665,12 +7674,12 @@ async function runDoctor(options) {
   const trackedArtifacts = await listTrackedArtifactPaths(root);
   if (trackedArtifacts.length > 0) {
     flag(
-      `- GITIGNORE: ${trackedArtifacts.length} machine-local scan artifact(s) still tracked in git (${trackedArtifacts.join(", ")})`,
-      `${trackedArtifacts.length} machine-local scan artifact(s) are still tracked in git`,
+      `- GITIGNORE: ${trackedArtifacts.length} machine-local artifact(s) still tracked in git (${trackedArtifacts.join(", ")})`,
+      `${trackedArtifacts.length} machine-local artifact(s) are still tracked in git`,
       `git rm --cached ${trackedArtifacts.join(" ")} (or run \`haus apply --write\` to do this and update .gitignore for you)`
     );
   } else {
-    ok("- GITIGNORE: OK (no machine-local scan artifacts tracked in git)");
+    ok("- GITIGNORE: OK (no machine-local artifacts tracked in git)");
   }
   const gitignoredHausPaths = await findGitignoredHausPaths(root);
   if (gitignoredHausPaths.length > 0) {
@@ -8291,7 +8300,8 @@ function summarizeLockDiff(before, after) {
 }
 
 // src/update/lockfile.ts
-import { mkdir, readFile as readFile2, copyFile } from "node:fs/promises";
+import { constants as fsConstants } from "node:fs";
+import { copyFile, mkdir, readFile as readFile2 } from "node:fs/promises";
 import path47 from "node:path";
 init_fs();
 init_paths();
@@ -8325,16 +8335,30 @@ async function readLockRaw(root) {
     return "[]";
   }
 }
-async function applyLock(root) {
+async function backupLockfile(root) {
   const lockPath = hausPath(root, "haus.lock.json");
-  const before = await readLockRaw(root);
-  const lock = await readJson(lockPath) ?? [];
   try {
     const backupDir = hausPath(root, "backups");
     await mkdir(backupDir, { recursive: true });
-    await copyFile(lockPath, path47.join(backupDir, `haus.lock.${Date.now()}.json`));
+    let stamp = Date.now();
+    for (; ; ) {
+      const dest = path47.join(backupDir, `haus.lock.${stamp}.json`);
+      try {
+        await copyFile(lockPath, dest, fsConstants.COPYFILE_EXCL);
+        return;
+      } catch (err) {
+        if (err.code !== "EEXIST") throw err;
+        stamp += 1;
+      }
+    }
   } catch {
   }
+}
+async function applyLock(root) {
+  const lockPath = hausPath(root, "haus.lock.json");
+  const before = await readLockRaw(root);
+  const lock = await readJson(lockPath) ?? [];
+  await backupLockfile(root);
   const enriched = await Promise.all(
     lock.map(async (x) => {
       const paths = Array.isArray(x.paths) ? x.paths.map(String) : [];
@@ -8357,12 +8381,7 @@ async function removeLockEntries(root, ids) {
   const removed = [...wanted].filter((id) => present.has(id));
   const missing = [...wanted].filter((id) => !present.has(id));
   if (removed.length === 0) return { removed, missing, before, after: before };
-  try {
-    const backupDir = hausPath(root, "backups");
-    await mkdir(backupDir, { recursive: true });
-    await copyFile(lockPath, path47.join(backupDir, `haus.lock.${Date.now()}.json`));
-  } catch {
-  }
+  await backupLockfile(root);
   const survivors = lock.filter((item) => !wanted.has(item.id));
   await writeJson(lockPath, survivors);
   return { removed, missing, before, after: `${JSON.stringify(survivors, null, 2)}
@@ -10799,6 +10818,7 @@ async function runRecommend(options) {
 }
 
 // src/commands/remove.ts
+import path54 from "node:path";
 init_fs();
 init_logger();
 init_paths();
@@ -10810,7 +10830,7 @@ async function runRemove(ids, options = {}) {
   const dryRun = Boolean(options.dryRun);
   const say = options.json ? () => {
   } : log;
-  const wanted = parseIdList(ids);
+  const wanted = [...new Set(parseIdList(ids))];
   if (wanted.length === 0) {
     error("Specify at least one catalog item id \u2014 see `haus doctor` for what is installed.");
     process.exitCode = 1;
@@ -10856,7 +10876,7 @@ async function runRemove(ids, options = {}) {
       cleared.push({ id, existing: [] });
       continue;
     }
-    const gate = await hashGateEntry(root, { id, hash: entry.hash }, existing);
+    const gate = await hashGateEntry(root, { hash: entry.hash }, existing);
     if (!gate.ok) {
       const detail = gate.reason === "no-hash" ? "has no lock hash" : "was modified locally";
       warn(
@@ -10902,7 +10922,8 @@ async function runRemove(ids, options = {}) {
     }
   }
   const allAbs = cleared.flatMap(({ existing }) => existing.map(({ abs }) => abs));
-  report.backupDir = await backupTrackedPaths(root, allAbs, say, "remove");
+  const backupRoot = await backupTrackedPaths(root, allAbs, say, "remove");
+  report.backupDir = backupRoot === null ? null : path54.basename(backupRoot);
   for (const { id, existing } of cleared) {
     await deleteTrackedPaths(root, id, existing, { verb: "Removed", reason: "" }, say);
   }
@@ -10987,7 +11008,7 @@ async function runScan(options) {
 }
 
 // src/commands/undo.ts
-import path54 from "node:path";
+import path55 from "node:path";
 import fs40 from "fs-extra";
 
 // src/claude/managed-paths.ts
@@ -11019,18 +11040,18 @@ async function collectLockTrackedPaths(root) {
     const relPaths = row.paths ?? [];
     const existingRel = [];
     for (const rel of relPaths) {
-      if (await fs40.pathExists(path54.resolve(root, rel))) existingRel.push(rel);
+      if (await fs40.pathExists(path55.resolve(root, rel))) existingRel.push(rel);
     }
     if (existingRel.length === 0) continue;
     if (row.hash === void 0) {
-      removable.push(...existingRel.map((rel) => path54.resolve(root, rel)));
+      removable.push(...existingRel.map((rel) => path55.resolve(root, rel)));
       continue;
     }
     const currentHash = await hashInstalledPaths(root, existingRel);
     if (currentHash === row.hash) {
-      removable.push(...existingRel.map((rel) => path54.resolve(root, rel)));
+      removable.push(...existingRel.map((rel) => path55.resolve(root, rel)));
     } else {
-      preserved.push(...existingRel.map((rel) => path54.resolve(root, rel)));
+      preserved.push(...existingRel.map((rel) => path55.resolve(root, rel)));
       log(`Preserving locally-modified ${row.id ?? "(unknown item)"}: ${existingRel.join(", ")}`);
     }
   }
@@ -11043,7 +11064,7 @@ async function settingsHasHausContent(root) {
   return settings._haus != null;
 }
 async function claudeMdHasHausBlock(root) {
-  const filePath = path54.join(root, "CLAUDE.md");
+  const filePath = path55.join(root, "CLAUDE.md");
   if (!await fs40.pathExists(filePath)) return false;
   const text = await fs40.readFile(filePath, "utf8");
   return text.includes(BLOCK_BEGIN);
@@ -11056,15 +11077,15 @@ async function stripProjectSettings(root) {
   const hasContent = Object.keys(settings).length > 0;
   if (hasContent) {
     await writeProjectSettings(root, settings);
-    log(`Stripped haus rules from ${path54.relative(root, settingsPath)} (user settings preserved).`);
+    log(`Stripped haus rules from ${path55.relative(root, settingsPath)} (user settings preserved).`);
     return true;
   }
   await fs40.remove(settingsPath);
-  log(`Removed ${path54.relative(root, settingsPath)} (no user-owned settings remained).`);
+  log(`Removed ${path55.relative(root, settingsPath)} (no user-owned settings remained).`);
   return true;
 }
 async function stripRootClaudeMd(root) {
-  const filePath = path54.join(root, "CLAUDE.md");
+  const filePath = path55.join(root, "CLAUDE.md");
   if (!await fs40.pathExists(filePath)) return false;
   const prev = await fs40.readFile(filePath, "utf8");
   if (!prev.includes(BLOCK_BEGIN)) return false;
@@ -11092,12 +11113,12 @@ async function backupManagedFilesBeforeUndo(root, managedAbsPaths) {
   const backupRoot = hausPath(root, "backups", `undo-${stamp}`);
   for (const abs of managedAbsPaths) {
     if (!await fs40.pathExists(abs)) continue;
-    const rel = path54.relative(root, abs);
-    const backupPath = path54.join(backupRoot, rel);
-    await fs40.ensureDir(path54.dirname(backupPath));
+    const rel = path55.relative(root, abs);
+    const backupPath = path55.join(backupRoot, rel);
+    await fs40.ensureDir(path55.dirname(backupPath));
     await fs40.copy(abs, backupPath);
   }
-  log(`Backed up ${managedAbsPaths.length} managed file(s) to ${path54.relative(root, backupRoot)}.`);
+  log(`Backed up ${managedAbsPaths.length} managed file(s) to ${path55.relative(root, backupRoot)}.`);
 }
 async function runUndo(options) {
   const root = options.root ?? process.cwd();
@@ -11110,7 +11131,7 @@ async function runUndo(options) {
     log("Nothing to remove: no haus-managed files found in this directory.");
     return;
   }
-  const relTargets = managed.map((p) => path54.relative(root, p));
+  const relTargets = managed.map((p) => path55.relative(root, p));
   const summaryParts = [...relTargets];
   if (stripSettings) summaryParts.push(".claude/settings.json (haus rules only)");
   if (stripClaudeMd) summaryParts.push("CLAUDE.md (haus import block only)");
@@ -11140,7 +11161,7 @@ User-owned .claude/ files will be preserved.`
   for (const abs of managed) {
     if (!await fs40.pathExists(abs)) continue;
     await fs40.remove(abs);
-    log(`Removed ${path54.relative(root, abs)}`);
+    log(`Removed ${path55.relative(root, abs)}`);
   }
   if (stripSettings) await stripProjectSettings(root);
   if (stripClaudeMd) await stripRootClaudeMd(root);
@@ -11154,7 +11175,7 @@ init_fs();
 init_logger();
 init_paths();
 import crypto3 from "node:crypto";
-import path55 from "node:path";
+import path56 from "node:path";
 import fs41 from "fs-extra";
 async function runUninstall(options = {}) {
   const { force = false, removePlugins = removeGlobalPlugins } = options;
@@ -11211,14 +11232,14 @@ async function runUninstall(options = {}) {
       continue;
     }
     await fs41.remove(entry.destPath);
-    await pruneEmptyDir(path55.dirname(entry.destPath));
+    await pruneEmptyDir(path56.dirname(entry.destPath));
     result.deleted.push(entry.destPath);
   }
   const settings = await readSettings();
   const stripped = stripHausHooks(stripHausAsk(stripHausAllow(stripHausDeny(settings))));
   await writeSettings(stripped);
   result.hooksStripped = true;
-  const hausDir = path55.join(globalClaudeDir(), "haus");
+  const hausDir = path56.join(globalClaudeDir(), "haus");
   const manifestPath2 = hausManifestPath();
   if (fs41.pathExistsSync(manifestPath2)) {
     await fs41.remove(manifestPath2);
@@ -11295,7 +11316,7 @@ async function runUninstallCommand(options) {
 }
 
 // src/commands/validate-catalog.ts
-import path57 from "node:path";
+import path58 from "node:path";
 
 // src/catalog/validate-core.ts
 init_forbidden_content();
@@ -11303,7 +11324,7 @@ init_manifest_item_fields();
 init_path_safety();
 init_validation_rules2();
 import fs42 from "node:fs";
-import path56 from "node:path";
+import path57 from "node:path";
 var ITEM_SEMVER_RE = /^\d+\.\d+\.\d+$/;
 var ITEM_ID_PATTERN = /^haus\./;
 function auditForbiddenStacks(items) {
@@ -11454,7 +11475,7 @@ function readForAudit(absPath, label, failures) {
   }
 }
 function auditTemplateContent(manifestDir, absPath, itemId) {
-  const rel = path56.relative(manifestDir, absPath);
+  const rel = path57.relative(manifestDir, absPath);
   const failures = [];
   const text = readForAudit(absPath, `${itemId}: ${rel}`, failures);
   if (text === null) return failures;
@@ -11476,25 +11497,25 @@ function auditShippedFiles(manifestDir, items) {
   const failures = [];
   for (const item of items) {
     if (!item.path || !isSafeCatalogPath(item.path)) continue;
-    const absPath = path56.join(manifestDir, item.path);
+    const absPath = path57.join(manifestDir, item.path);
     if (item.type === "skill") {
-      const skillMd = path56.join(absPath, "SKILL.md");
+      const skillMd = path57.join(absPath, "SKILL.md");
       if (!fs42.existsSync(skillMd)) {
-        failures.push(`${item.id}: missing ${path56.relative(manifestDir, skillMd)}`);
+        failures.push(`${item.id}: missing ${path57.relative(manifestDir, skillMd)}`);
         continue;
       }
       const text = readForAudit(skillMd, `${item.id}: SKILL.md`, failures);
       if (text === null) continue;
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: SKILL.md`));
       failures.push(
-        ...auditForbiddenTagsInText(text, `${item.id}: ${path56.relative(manifestDir, skillMd)}`)
+        ...auditForbiddenTagsInText(text, `${item.id}: ${path57.relative(manifestDir, skillMd)}`)
       );
     } else if (item.type === "agent") {
       if (!fs42.existsSync(absPath)) {
         failures.push(`${item.id}: missing agent file ${item.path}`);
         continue;
       }
-      const rel = path56.relative(manifestDir, absPath);
+      const rel = path57.relative(manifestDir, absPath);
       const text = readForAudit(absPath, `${item.id}: ${rel}`, failures);
       if (text === null) continue;
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: ${rel}`));
@@ -11510,7 +11531,7 @@ function auditShippedFiles(manifestDir, items) {
         failures.push(`${item.id}: missing command file ${item.path}`);
         continue;
       }
-      const rel = path56.relative(manifestDir, absPath);
+      const rel = path57.relative(manifestDir, absPath);
       const text = readForAudit(absPath, `${item.id}: ${rel}`, failures);
       if (text === null) continue;
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: ${rel}`));
@@ -11568,7 +11589,7 @@ function walkAllFiles(dir, fn, failures) {
   }
   for (const entry of entries) {
     if (entry.name === ".DS_Store") continue;
-    const full = path56.join(dir, entry.name);
+    const full = path57.join(dir, entry.name);
     if (entry.isDirectory()) walkAllFiles(full, fn, failures);
     else fn(full);
   }
@@ -11592,12 +11613,12 @@ function auditDiskOrphans(manifestDir, items) {
   const failures = [];
   const claimedPaths = items.filter((item) => item.path && isSafeCatalogPath(item.path)).map((item) => item.path.replace(/\\/g, "/"));
   for (const dir of CONTENT_ROOTS) {
-    const abs = path56.join(manifestDir, dir);
+    const abs = path57.join(manifestDir, dir);
     if (!fs42.existsSync(abs)) continue;
     walkAllFiles(
       abs,
       (file) => {
-        const relPath = path56.relative(manifestDir, file).replace(/\\/g, "/");
+        const relPath = path57.relative(manifestDir, file).replace(/\\/g, "/");
         if (!isPathClaimed(relPath, claimedPaths)) {
           failures.push(`orphaned on disk, claimed by no manifest item: ${relPath}`);
         }
@@ -11618,7 +11639,7 @@ function walkMd(dir, fn, failures) {
     return;
   }
   for (const entry of entries) {
-    const full = path56.join(dir, entry.name);
+    const full = path57.join(dir, entry.name);
     if (entry.isDirectory()) walkMd(full, fn, failures);
     else if (entry.name.endsWith(".md")) fn(full);
   }
@@ -11628,13 +11649,13 @@ function auditMarkdownContent(manifestDir, items) {
   const pathSourceMap = buildItemPathSourceMap(items);
   const pathTypeMap = buildItemPathTypeMap(items);
   for (const dir of ["skills", "agents", "templates", "commands", "sources"]) {
-    const abs = path56.join(manifestDir, dir);
+    const abs = path57.join(manifestDir, dir);
     if (!fs42.existsSync(abs)) continue;
     const dirType = DIR_ITEM_TYPE[dir] ?? "";
     walkMd(
       abs,
       (file) => {
-        const rel = path56.relative(manifestDir, file);
+        const rel = path57.relative(manifestDir, file);
         const text = readForAudit(file, rel, failures);
         if (text === null) return;
         const norm = rel.replace(/\\/g, "/");
@@ -11682,8 +11703,8 @@ async function runValidateCatalog(manifestPath2) {
     process.exitCode = 1;
     return;
   }
-  const abs = path57.resolve(process.cwd(), manifestPath2);
-  const manifestDir = path57.dirname(abs);
+  const abs = path58.resolve(process.cwd(), manifestPath2);
+  const manifestDir = path58.dirname(abs);
   const data = await readJson(abs);
   if (!data?.items) {
     error(`Could not read catalog manifest at ${abs}`);
@@ -11704,7 +11725,7 @@ init_logger();
 
 // src/workspace/worktree/add.ts
 init_fs();
-import path64 from "node:path";
+import path65 from "node:path";
 import fs46 from "fs-extra";
 
 // src/workspace/worktree/git-worktree.ts
@@ -11825,12 +11846,12 @@ async function hasUnpushedWork(cwd) {
 }
 
 // src/workspace/worktree/hydrate.ts
-import path60 from "node:path";
+import path61 from "node:path";
 import fs44 from "fs-extra";
 
 // src/workspace/worktree/cow-copy.ts
 init_exec();
-import path58 from "node:path";
+import path59 from "node:path";
 import fs43 from "fs-extra";
 async function getMacFilesystemType(dir) {
   const df = await runCommand("df", ["-P", dir]);
@@ -11865,11 +11886,11 @@ async function cowCopyDir(src, dest) {
   const srcExists = await fs43.pathExists(src);
   if (!srcExists)
     return { strategy: "unsupported", attempted: false, ok: false, error: "source missing" };
-  const strategy = await detectCowStrategy(path58.dirname(dest));
+  const strategy = await detectCowStrategy(path59.dirname(dest));
   if (strategy === "unsupported" || strategy === "unknown-platform") {
     return { strategy, attempted: false, ok: false };
   }
-  await fs43.ensureDir(path58.dirname(dest));
+  await fs43.ensureDir(path59.dirname(dest));
   const args = strategy === "darwin-clonefile" ? ["-c", "-R", src, dest] : ["-a", "--reflink=always", src, dest];
   const result = await runCommand("cp", args);
   return {
@@ -11883,7 +11904,7 @@ async function cowCopyDir(src, dest) {
 // src/workspace/worktree/install.ts
 init_exec();
 import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
-import path59 from "node:path";
+import path60 from "node:path";
 import fg6 from "fast-glob";
 function detectInstallPlan(signals) {
   if (signals.hasYarnLock) {
@@ -11904,10 +11925,10 @@ function detectInstallPlan(signals) {
   return { manager: "none" };
 }
 async function computeLockfileSignals(dir) {
-  const hasYarnLock = existsSync3(path59.join(dir, "yarn.lock"));
-  const hasPnpmLock = existsSync3(path59.join(dir, "pnpm-lock.yaml"));
-  const hasPackageLock = existsSync3(path59.join(dir, "package-lock.json"));
-  const hasComposerLock = existsSync3(path59.join(dir, "composer.lock"));
+  const hasYarnLock = existsSync3(path60.join(dir, "yarn.lock"));
+  const hasPnpmLock = existsSync3(path60.join(dir, "pnpm-lock.yaml"));
+  const hasPackageLock = existsSync3(path60.join(dir, "package-lock.json"));
+  const hasComposerLock = existsSync3(path60.join(dir, "composer.lock"));
   const dotnetFiles = await fg6(["**/*.csproj", "**/*.sln"], {
     cwd: dir,
     onlyFiles: true,
@@ -11921,7 +11942,7 @@ async function computeLockfileSignals(dir) {
   });
   const hasDotnetProject = dotnetFiles.length > 0;
   let hasPackageManagerField = false;
-  const pkgPath = path59.join(dir, "package.json");
+  const pkgPath = path60.join(dir, "package.json");
   if (existsSync3(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
@@ -11964,7 +11985,7 @@ function missingYarnrcEnvVars(content2, env) {
   return findRequiredYarnrcEnvVars(content2).filter((name) => env[name] === void 0);
 }
 function missingYarnrcEnvVarsInDir(dir, env) {
-  const yarnrcPath = path59.join(dir, ".yarnrc.yml");
+  const yarnrcPath = path60.join(dir, ".yarnrc.yml");
   if (!existsSync3(yarnrcPath)) return [];
   try {
     return missingYarnrcEnvVars(readFileSync3(yarnrcPath, "utf8"), env);
@@ -12054,8 +12075,8 @@ async function hydrateMember(mainMemberPath, worktreeMemberPath, opts = {}) {
   const start = Date.now();
   const targets = [];
   for (const target of HYDRATION_TARGETS) {
-    const src = path60.join(mainMemberPath, target);
-    const dest = path60.join(worktreeMemberPath, target);
+    const src = path61.join(mainMemberPath, target);
+    const dest = path61.join(worktreeMemberPath, target);
     if (!await fs44.pathExists(src)) continue;
     const destExists = await fs44.pathExists(dest);
     if (!opts.force && destExists) continue;
@@ -12073,11 +12094,11 @@ async function hydrateMember(mainMemberPath, worktreeMemberPath, opts = {}) {
 
 // src/workspace/worktree/local-files.ts
 init_exec();
-import path61 from "node:path";
+import path62 from "node:path";
 import fs45 from "fs-extra";
 var MACHINE_LOCAL_FILES = [
   "docker-compose.local.yml",
-  path61.join(".claude", "settings.local.json")
+  path62.join(".claude", "settings.local.json")
 ];
 async function isTracked(repoRoot, relFile) {
   const gitPath = relFile.replace(/\\/g, "/");
@@ -12087,11 +12108,11 @@ async function isTracked(repoRoot, relFile) {
 async function copyMachineLocalFiles(mainMemberPath, worktreeMemberPath) {
   const copied = [];
   for (const rel of MACHINE_LOCAL_FILES) {
-    const src = path61.join(mainMemberPath, rel);
+    const src = path62.join(mainMemberPath, rel);
     if (!await fs45.pathExists(src)) continue;
     if (await isTracked(mainMemberPath, rel)) continue;
-    const dest = path61.join(worktreeMemberPath, rel);
-    await fs45.ensureDir(path61.dirname(dest));
+    const dest = path62.join(worktreeMemberPath, rel);
+    await fs45.ensureDir(path62.dirname(dest));
     await fs45.copy(src, dest, { overwrite: true });
     copied.push(rel);
   }
@@ -12100,15 +12121,15 @@ async function copyMachineLocalFiles(mainMemberPath, worktreeMemberPath) {
 
 // src/workspace/worktree/root.ts
 import { existsSync as existsSync4 } from "node:fs";
-import path62 from "node:path";
+import path63 from "node:path";
 async function resolveWorkspaceForWorktree(start) {
   const rootInfo = await resolveRoots(start);
   if (!rootInfo.isGitRepo) {
     return { ok: false, reason: "Not inside a git repository." };
   }
   const workspaceRoot = rootInfo.mainRoot;
-  const hasYaml = existsSync4(path62.join(workspaceRoot, WORKSPACE_FILE));
-  const hasManifest = existsSync4(path62.join(workspaceRoot, REPOS_MANIFEST_FILE));
+  const hasYaml = existsSync4(path63.join(workspaceRoot, WORKSPACE_FILE));
+  const hasManifest = existsSync4(path63.join(workspaceRoot, REPOS_MANIFEST_FILE));
   if (!hasYaml && !hasManifest) {
     return {
       ok: false,
@@ -12134,10 +12155,10 @@ function selectMembers(members, only) {
 
 // src/workspace/worktree/state.ts
 init_fs();
-import path63 from "node:path";
+import path64 from "node:path";
 var WORKTREE_STATE_FILE = ".haus-worktree.json";
 function worktreesDir(mainRoot) {
-  return path63.join(mainRoot, ".claude", "worktrees");
+  return path64.join(mainRoot, ".claude", "worktrees");
 }
 function isValidWorktreeSlug(slug) {
   if (slug === "" || slug === "." || slug === "..") return false;
@@ -12150,15 +12171,15 @@ function worktreePath(mainRoot, slug) {
       `Invalid worktree slug ${JSON.stringify(slug)} \u2014 slugs may only contain letters, digits, ".", "_", "-" (no path separators, and not "." or "..").`
     );
   }
-  return path63.join(worktreesDir(mainRoot), slug);
+  return path64.join(worktreesDir(mainRoot), slug);
 }
 async function readWorktreeState(worktreeRoot) {
-  const state = await readJson(path63.join(worktreeRoot, WORKTREE_STATE_FILE));
+  const state = await readJson(path64.join(worktreeRoot, WORKTREE_STATE_FILE));
   if (state == null || typeof state !== "object" || !Array.isArray(state.members)) return void 0;
   return state;
 }
 async function writeWorktreeState(worktreeRoot, state) {
-  await writeJson(path63.join(worktreeRoot, WORKTREE_STATE_FILE), state);
+  await writeJson(path64.join(worktreeRoot, WORKTREE_STATE_FILE), state);
 }
 
 // src/workspace/worktree/add.ts
@@ -12192,7 +12213,7 @@ async function runAdd(opts) {
   const memberResults = [];
   for (const member of selected) {
     const start = Date.now();
-    const memberWorktreePath = path64.join(wsWorktreePath, member.folder);
+    const memberWorktreePath = path65.join(wsWorktreePath, member.folder);
     const outcome = await addWorktree(member.absPath, memberWorktreePath, branch, {
       preferDefaultBranchFrom: true
     });
@@ -12222,7 +12243,7 @@ async function runAdd(opts) {
   await mapWithConcurrency(okResults, async (result) => {
     const member = selected.find((m) => m.id === result.member);
     if (!member) return;
-    const memberWorktreePath = path64.join(wsWorktreePath, member.folder);
+    const memberWorktreePath = path65.join(wsWorktreePath, member.folder);
     const hydrationStart = Date.now();
     if (opts.hydrate !== false) {
       result.hydration = await hydrateMember(member.absPath, memberWorktreePath);
@@ -12289,25 +12310,25 @@ async function runDryRun(args) {
 
 // src/workspace/worktree/doctor.ts
 import { existsSync as existsSync6 } from "node:fs";
-import path66 from "node:path";
+import path67 from "node:path";
 
 // src/workspace/worktree/orphans.ts
 import { existsSync as existsSync5 } from "node:fs";
-import path65 from "node:path";
+import path66 from "node:path";
 var WORKSPACE_REPO_ID = "(workspace)";
 async function findOrphanedRegistrations(repos, wsWorktreesDir) {
   const orphans = [];
   for (const repo of repos) {
     const entries = await listWorktrees(repo.absPath);
     for (const entry of entries) {
-      const entryPath = path65.normalize(entry.path);
-      const marker = `${path65.sep}.claude${path65.sep}worktrees${path65.sep}`;
+      const entryPath = path66.normalize(entry.path);
+      const marker = `${path66.sep}.claude${path66.sep}worktrees${path66.sep}`;
       const idx = entryPath.indexOf(marker);
       if (idx === -1) continue;
       const rest = entryPath.slice(idx + marker.length);
-      const slug = rest.split(path65.sep)[0];
+      const slug = rest.split(path66.sep)[0];
       if (!slug) continue;
-      if (existsSync5(path65.join(wsWorktreesDir, slug))) continue;
+      if (existsSync5(path66.join(wsWorktreesDir, slug))) continue;
       orphans.push({
         repoId: repo.id,
         ownerRepo: repo.absPath,
@@ -12322,7 +12343,7 @@ async function findOrphanedRegistrations(repos, wsWorktreesDir) {
 // src/workspace/worktree/doctor.ts
 var HYDRATION_MARKERS = ["node_modules", "vendor", "obj", "bin"];
 function looksHydrated(memberPath) {
-  return HYDRATION_MARKERS.some((marker) => existsSync6(path66.join(memberPath, marker)));
+  return HYDRATION_MARKERS.some((marker) => existsSync6(path67.join(memberPath, marker)));
 }
 async function runDoctor2() {
   const rootInfo = await resolveRoots();
@@ -12338,7 +12359,7 @@ async function runDoctor2() {
     };
   }
   const workspaceRoot = rootInfo.mainRoot;
-  const isWorkspace = existsSync6(path66.join(workspaceRoot, WORKSPACE_FILE)) || existsSync6(path66.join(workspaceRoot, REPOS_MANIFEST_FILE));
+  const isWorkspace = existsSync6(path67.join(workspaceRoot, WORKSPACE_FILE)) || existsSync6(path67.join(workspaceRoot, REPOS_MANIFEST_FILE));
   if (!isWorkspace) {
     return {
       isWorkspace: false,
@@ -12353,7 +12374,7 @@ async function runDoctor2() {
     };
   }
   const wsWorktreesDir = worktreesDir(workspaceRoot);
-  const underWorktreesDir = rootInfo.repoRoot.startsWith(`${wsWorktreesDir}${path66.sep}`);
+  const underWorktreesDir = rootInfo.repoRoot.startsWith(`${wsWorktreesDir}${path67.sep}`);
   const inWorkspaceWorktree = rootInfo.isLinkedWorktree && underWorktreesDir;
   const workspaceConfig = await readWorkspaceConfig(workspaceRoot);
   const autoHydrate = workspaceConfig?.worktree?.autoHydrate === true;
@@ -12364,10 +12385,10 @@ async function runDoctor2() {
   let slug;
   if (inWorkspaceWorktree) {
     const wtPath = rootInfo.repoRoot;
-    slug = rootInfo.worktreeName ?? path66.basename(wtPath);
+    slug = rootInfo.worktreeName ?? path67.basename(wtPath);
     const state = await readWorktreeState(wtPath);
     for (const member of members) {
-      const memberPath = path66.join(wtPath, member.folder);
+      const memberPath = path67.join(wtPath, member.folder);
       const materialized = existsSync6(memberPath);
       const expectedBranch = state?.members.find((m) => m.folder === member.folder)?.branch ?? state?.branch;
       const actualBranch = materialized ? await currentBranch(memberPath) : void 0;
@@ -12407,7 +12428,7 @@ async function runDoctor2() {
     wsWorktreesDir
   );
   const orphans = orphanScan.map(
-    (o) => `${o.repoId}: worktree registered at ${o.registeredPath} but ${path66.join(wsWorktreesDir, o.slug)} no longer exists.`
+    (o) => `${o.repoId}: worktree registered at ${o.registeredPath} but ${path67.join(wsWorktreesDir, o.slug)} no longer exists.`
   );
   if (orphans.length > 0) {
     problems.push(...orphans);
@@ -12428,7 +12449,7 @@ async function runDoctor2() {
 // src/workspace/worktree/hydrate-command.ts
 init_fs();
 import { existsSync as existsSync7 } from "node:fs";
-import path67 from "node:path";
+import path68 from "node:path";
 async function runHydrateWorktree(opts) {
   const rootInfo = await resolveRoots();
   if (!rootInfo.isGitRepo || !rootInfo.isLinkedWorktree) {
@@ -12439,7 +12460,7 @@ async function runHydrateWorktree(opts) {
   }
   const workspaceRoot = rootInfo.mainRoot;
   const wtPath = rootInfo.repoRoot;
-  if (!wtPath.startsWith(`${worktreesDir(workspaceRoot)}${path67.sep}`)) {
+  if (!wtPath.startsWith(`${worktreesDir(workspaceRoot)}${path68.sep}`)) {
     return {
       ok: false,
       error: "Current worktree is not one of this workspace's .claude/worktrees/<slug> checkouts."
@@ -12451,13 +12472,13 @@ async function runHydrateWorktree(opts) {
     return { ok: false, error: `Unknown --only repo(s): ${unknown.join(", ")}` };
   }
   const state = await readWorktreeState(wtPath);
-  const slug = state?.slug ?? path67.basename(wtPath);
+  const slug = state?.slug ?? path68.basename(wtPath);
   const detectedBranch = await currentBranch(wtPath);
   const targetBranch = state?.branch ?? (detectedBranch !== "HEAD" ? detectedBranch : void 0) ?? slug;
   if (opts.dryRun) {
     const results2 = await Promise.all(
       selected.map(async (member) => {
-        const memberPath = path67.join(wtPath, member.folder);
+        const memberPath = path68.join(wtPath, member.folder);
         if (existsSync7(memberPath)) {
           return { member: member.id, folder: member.folder, status: "planned" };
         }
@@ -12478,7 +12499,7 @@ async function runHydrateWorktree(opts) {
   const results = await mapWithConcurrency(
     selected,
     async (member) => {
-      const memberPath = path67.join(wtPath, member.folder);
+      const memberPath = path68.join(wtPath, member.folder);
       let branchAction;
       if (!existsSync7(memberPath)) {
         if (!opts.materialize) {
@@ -12541,7 +12562,7 @@ async function runHydrateWorktree(opts) {
 }
 
 // src/workspace/worktree/list.ts
-import path68 from "node:path";
+import path69 from "node:path";
 import fs47 from "fs-extra";
 async function runList2() {
   const resolved = await resolveWorkspaceForWorktree();
@@ -12554,12 +12575,12 @@ async function runList2() {
   const configuredMembers = await readMembers(rootInfo);
   const worktrees = [];
   for (const slug of slugs) {
-    const wtPath = path68.join(dir, slug);
+    const wtPath = path69.join(dir, slug);
     const state = await readWorktreeState(wtPath);
     const members = [];
     const source = state?.members ?? configuredMembers.map((m) => ({ id: m.id, folder: m.folder }));
     for (const m of source) {
-      const memberPath = path68.join(wtPath, m.folder);
+      const memberPath = path69.join(wtPath, m.folder);
       const materialized = await fs47.pathExists(memberPath);
       const actualBranch = materialized ? await currentBranch(memberPath) : void 0;
       members.push({
@@ -12621,7 +12642,7 @@ async function runPrune2(opts) {
 }
 
 // src/workspace/worktree/remove.ts
-import path69 from "node:path";
+import path70 from "node:path";
 import fs48 from "fs-extra";
 async function runRemove2(opts) {
   const resolved = await resolveWorkspaceForWorktree();
@@ -12648,7 +12669,7 @@ async function runRemove2(opts) {
     targets.push({
       repo: configMember?.id ?? stateMember.id,
       ownerRepo,
-      path: path69.join(wsWorktreePath, stateMember.folder)
+      path: path70.join(wsWorktreePath, stateMember.folder)
     });
   }
   const existingTargets = [];
@@ -12986,7 +13007,7 @@ async function runWorktree(action, opts = {}) {
 
 // src/commands/workspace.ts
 import { existsSync as existsSync11, statSync as statSync3 } from "node:fs";
-import path78 from "node:path";
+import path79 from "node:path";
 init_fs();
 init_logger();
 
@@ -13045,7 +13066,7 @@ ${summaries.map(
 
 // src/commands/workspace/doctor.ts
 import { existsSync as existsSync8 } from "node:fs";
-import path71 from "node:path";
+import path72 from "node:path";
 init_logger();
 init_paths();
 
@@ -13053,14 +13074,14 @@ init_paths();
 init_fs();
 init_paths();
 import { readFileSync as readFileSync4 } from "node:fs";
-import path70 from "node:path";
+import path71 from "node:path";
 var MANIFEST_FILE = "workspace.manifest.json";
 function manifestPath(workspaceRoot) {
   return hausPath(workspaceRoot, MANIFEST_FILE);
 }
 function hausVersion() {
   try {
-    const pkg = JSON.parse(readFileSync4(path70.join(packageRoot(), "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync4(path71.join(packageRoot(), "package.json"), "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -13152,7 +13173,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
   const manifestByName = new Map(manifest.repos.map((r) => [r.name, r]));
   const catalogRefByRepo = [];
   for (const repo of config.repos) {
-    const repoRoot = path71.resolve(workspaceRoot, repo.path);
+    const repoRoot = path72.resolve(workspaceRoot, repo.path);
     const entry = manifestByName.get(repo.name);
     if (!entry) {
       flag({
@@ -13225,7 +13246,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
         });
         continue;
       }
-      if (!existsSync8(path71.join(workspaceRoot, entry.path))) {
+      if (!existsSync8(path72.join(workspaceRoot, entry.path))) {
         flag({
           repo: entry.repo,
           kind: "missing-linked-context-copy",
@@ -13271,17 +13292,17 @@ function emit(args) {
 init_logger();
 
 // src/workspace/link-context/link.ts
-import path74 from "node:path";
+import path75 from "node:path";
 import fs51 from "fs-extra";
 init_fs();
 init_logger();
 
 // src/workspace/link-context/plan.ts
-import path73 from "node:path";
+import path74 from "node:path";
 import fs50 from "fs-extra";
 
 // src/workspace/link-context/scan-source.ts
-import path72 from "node:path";
+import path73 from "node:path";
 import fs49 from "fs-extra";
 var ASSET_SUBDIR = {
   skill: "skills",
@@ -13290,36 +13311,36 @@ var ASSET_SUBDIR = {
 };
 async function hasLinkableContext(member) {
   for (const subdir of Object.values(ASSET_SUBDIR)) {
-    if (await fs49.pathExists(path72.join(member.absPath, ".claude", subdir))) return true;
+    if (await fs49.pathExists(path73.join(member.absPath, ".claude", subdir))) return true;
   }
   return false;
 }
 async function collectSkills(member) {
-  const dir = path72.join(member.absPath, ".claude", "skills");
+  const dir = path73.join(member.absPath, ".claude", "skills");
   if (!await fs49.pathExists(dir)) return [];
   const names = await fs49.readdir(dir);
   const out = [];
   for (const name of [...names].sort()) {
-    const abs = path72.join(dir, name);
+    const abs = path73.join(dir, name);
     const stat = await fs49.lstat(abs);
     if (!stat.isDirectory()) continue;
-    if (!await fs49.pathExists(path72.join(abs, "SKILL.md"))) continue;
-    out.push({ type: "skill", name, sourceRelPath: path72.posix.join(".claude", "skills", name) });
+    if (!await fs49.pathExists(path73.join(abs, "SKILL.md"))) continue;
+    out.push({ type: "skill", name, sourceRelPath: path73.posix.join(".claude", "skills", name) });
   }
   return out;
 }
 async function collectFlatMarkdown(member, type) {
   const subdir = ASSET_SUBDIR[type];
-  const dir = path72.join(member.absPath, ".claude", subdir);
+  const dir = path73.join(member.absPath, ".claude", subdir);
   if (!await fs49.pathExists(dir)) return [];
   const names = await fs49.readdir(dir);
   const out = [];
   for (const fileName of [...names].sort()) {
     if (!fileName.endsWith(".md")) continue;
-    const abs = path72.join(dir, fileName);
+    const abs = path73.join(dir, fileName);
     if (!(await fs49.lstat(abs)).isFile()) continue;
     const name = fileName.slice(0, -".md".length);
-    out.push({ type, name, sourceRelPath: path72.posix.join(".claude", subdir, fileName) });
+    out.push({ type, name, sourceRelPath: path73.posix.join(".claude", subdir, fileName) });
   }
   return out;
 }
@@ -13334,9 +13355,9 @@ async function collectSourceAssets(member) {
 
 // src/workspace/link-context/plan.ts
 function repoFolderPrefix(member) {
-  const base = path73.posix.basename(member.folder);
+  const base = path74.posix.basename(member.folder);
   if (base && base !== "." && base !== "/") return base;
-  const fromAbs = path73.basename(member.absPath);
+  const fromAbs = path74.basename(member.absPath);
   return fromAbs || member.id;
 }
 function assetKey(type, destKey) {
@@ -13393,7 +13414,7 @@ async function buildLinkPlan(members) {
       name: asset.name,
       destKey,
       sourceRelPath: asset.sourceRelPath,
-      sourceAbsPath: path73.join(member.absPath, asset.sourceRelPath),
+      sourceAbsPath: path74.join(member.absPath, asset.sourceRelPath),
       sourceHash
     });
   }
@@ -13404,7 +13425,7 @@ async function buildLinkPlan(members) {
 function destRelPathFor(type, destKey) {
   const subdir = `${type}s`;
   const leaf = type === "skill" ? destKey : `${destKey}.md`;
-  return path74.posix.join(".claude", subdir, leaf);
+  return path75.posix.join(".claude", subdir, leaf);
 }
 async function runLinkContext(workspaceRoot, opts = {}) {
   const write = resolveWriteMode(opts, "preview-by-default").kind === "write";
@@ -13430,9 +13451,9 @@ async function runLinkContext(workspaceRoot, opts = {}) {
   const linkedAt = (/* @__PURE__ */ new Date()).toISOString();
   for (const entry of plan.entries) {
     const destRel = destRelPathFor(entry.type, entry.destKey);
-    const destAbs = path74.join(workspaceRoot, destRel);
+    const destAbs = path75.join(workspaceRoot, destRel);
     if (write) {
-      await fs51.ensureDir(path74.dirname(destAbs));
+      await fs51.ensureDir(path75.dirname(destAbs));
       if (await fs51.pathExists(destAbs)) await fs51.remove(destAbs);
       await fs51.copy(entry.sourceAbsPath, destAbs, {
         overwrite: true,
@@ -13521,10 +13542,10 @@ async function runWorkspaceLinkContext(workspaceRoot, opts = {}) {
 
 // src/commands/workspace/setup.ts
 import { existsSync as existsSync9, statSync } from "node:fs";
-import path76 from "node:path";
+import path77 from "node:path";
 
 // src/claude/write-workspace-claude-md.ts
-import path75 from "node:path";
+import path76 from "node:path";
 import fs52 from "fs-extra";
 init_fs();
 init_logger();
@@ -13547,7 +13568,7 @@ ${WORKSPACE_BLOCK_END}`;
 async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
   const block = buildWorkspaceImportBlock(opts.client, opts.members);
   const dryRun = opts.dryRun ?? false;
-  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path75.join(workspaceRoot, "CLAUDE.md");
+  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path76.join(workspaceRoot, "CLAUDE.md");
   const say = opts.quiet ? () => {
   } : log;
   const existed = await fs52.pathExists(filePath);
@@ -13580,20 +13601,20 @@ async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
 init_fs();
 init_logger();
 function resolveWorkspaceRoot(start = process.cwd()) {
-  let dir = path76.resolve(start);
+  let dir = path77.resolve(start);
   for (; ; ) {
-    if (existsSync9(path76.join(dir, WORKSPACE_FILE))) return dir;
-    const parent = path76.dirname(dir);
-    if (parent === dir) return path76.resolve(start);
+    if (existsSync9(path77.join(dir, WORKSPACE_FILE))) return dir;
+    const parent = path77.dirname(dir);
+    if (parent === dir) return path77.resolve(start);
     dir = parent;
   }
 }
 function isRootRepo(workspaceRoot, repoPath) {
-  return path76.resolve(workspaceRoot, repoPath) === path76.resolve(workspaceRoot);
+  return path77.resolve(workspaceRoot, repoPath) === path77.resolve(workspaceRoot);
 }
 async function runWorkspaceSetup(workspaceRoot, options = {}) {
   const apply = options.write ?? false;
-  const configText = await readText(path76.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path77.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
@@ -13620,7 +13641,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
   const statuses = [];
   const aggregateInputs = [];
   for (const repo of repos) {
-    const repoRoot = path76.resolve(workspaceRoot, repo.path);
+    const repoRoot = path77.resolve(workspaceRoot, repo.path);
     say(`
 \u2192 ${repo.name} (${repo.path})`);
     try {
@@ -13710,7 +13731,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
       const status = statusByName.get(repo.name);
       const role = repo.role ?? status?.roles?.[0] ?? "auto";
       if (status?.status === "ok") {
-        const lock = await checkLock(path76.resolve(workspaceRoot, repo.path));
+        const lock = await checkLock(path77.resolve(workspaceRoot, repo.path));
         manifestRepos.push({
           name: repo.name,
           path: repo.path,
@@ -13766,7 +13787,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
     try {
       const linkResult = await runLinkContext(workspaceRoot, { write: true, json: options.json });
       if (linkResult.ok) {
-        written.push(...linkResult.added.map((rel) => path76.join(workspaceRoot, rel)));
+        written.push(...linkResult.added.map((rel) => path77.join(workspaceRoot, rel)));
         if (!options.json) {
           say(
             `Linked ${linkResult.linked.length} cross-repo skill/agent/command copy(ies) into .claude/ (${linkResult.added.length} new, ${linkResult.removed.length} removed)${linkResult.skipped.length > 0 ? ` \u2014 ${linkResult.skipped.length} member(s) skipped, see above` : ""}.`
@@ -13798,7 +13819,7 @@ Workspace setup complete: ${ok} ok, ${failed} failed. Wrote ${written.length} fi
 
 // src/commands/workspace/undo.ts
 import { existsSync as existsSync10, statSync as statSync2 } from "node:fs";
-import path77 from "node:path";
+import path78 from "node:path";
 import fs53 from "fs-extra";
 init_fs();
 init_logger();
@@ -13829,7 +13850,7 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
   }
   if (options.dryRun) {
     for (const repo of config.repos) {
-      const repoRoot = path77.resolve(workspaceRoot, repo.path);
+      const repoRoot = path78.resolve(workspaceRoot, repo.path);
       log(`
 \u2192 ${repo.name} (${repo.path})`);
       try {
@@ -13861,11 +13882,11 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
     ];
     for (const abs of workspaceArtifacts) {
       if (await fs53.pathExists(abs)) {
-        log(`[dry-run] Would remove ${path77.relative(workspaceRoot, abs)}`);
+        log(`[dry-run] Would remove ${path78.relative(workspaceRoot, abs)}`);
       }
     }
     if (!await fs53.pathExists(hausPath(workspaceRoot, "WORKSPACE.md"))) {
-      const claudeMd = await readText(path77.join(workspaceRoot, "CLAUDE.md"));
+      const claudeMd = await readText(path78.join(workspaceRoot, "CLAUDE.md"));
       if (claudeMd?.includes(WORKSPACE_BLOCK_BEGIN) || claudeMd && hasLegacyWorkspaceBlock(claudeMd)) {
         log("[dry-run] Would remove the workspace haus import block from CLAUDE.md");
       }
@@ -13884,7 +13905,7 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
   }
   let anyRepoFailed = false;
   for (const repo of config.repos) {
-    const repoRoot = path77.resolve(workspaceRoot, repo.path);
+    const repoRoot = path78.resolve(workspaceRoot, repo.path);
     log(`
 \u2192 ${repo.name} (${repo.path})`);
     try {
@@ -13913,20 +13934,20 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
     const abs = hausPath(workspaceRoot, rel);
     if (await fs53.pathExists(abs)) {
       await fs53.remove(abs);
-      log(`Removed ${path77.relative(workspaceRoot, abs)}`);
+      log(`Removed ${path78.relative(workspaceRoot, abs)}`);
     }
   }
   const manifestFile = manifestPath(workspaceRoot);
   if (await fs53.pathExists(manifestFile)) {
     await fs53.remove(manifestFile);
-    log(`Removed ${path77.relative(workspaceRoot, manifestFile)}`);
+    log(`Removed ${path78.relative(workspaceRoot, manifestFile)}`);
   }
   const workspaceMdPath = hausPath(workspaceRoot, "WORKSPACE.md");
   if (await fs53.pathExists(workspaceMdPath)) {
     await fs53.remove(workspaceMdPath);
-    log(`Removed ${path77.relative(workspaceRoot, workspaceMdPath)}`);
+    log(`Removed ${path78.relative(workspaceRoot, workspaceMdPath)}`);
   } else {
-    const claudeMdPath = path77.join(workspaceRoot, "CLAUDE.md");
+    const claudeMdPath = path78.join(workspaceRoot, "CLAUDE.md");
     if (existsSync10(claudeMdPath)) {
       const prev = await readText(claudeMdPath);
       if (prev?.includes(WORKSPACE_BLOCK_BEGIN)) {
@@ -13995,7 +14016,7 @@ relationships: []
   log("Workspace initialized.");
 }
 async function scanWorkspace(workspaceRoot, opts) {
-  const configText = await readText(path78.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path79.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
@@ -14017,7 +14038,7 @@ async function scanWorkspace(workspaceRoot, opts) {
   const inputs = [];
   const failures = [];
   for (const repo of config.repos) {
-    const repoRoot = path78.resolve(workspaceRoot, repo.path);
+    const repoRoot = path79.resolve(workspaceRoot, repo.path);
     try {
       if (!existsSync11(repoRoot) || !statSync3(repoRoot).isDirectory()) {
         throw new Error("path is not a directory");
@@ -14085,7 +14106,7 @@ init_logger();
 init_paths();
 function cliVersion() {
   try {
-    const pkgPath = path79.join(packageRoot(), "package.json");
+    const pkgPath = path80.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
@@ -14095,7 +14116,7 @@ function cliVersion() {
 var program = new Command();
 function validateRuntimeNodeVersion() {
   try {
-    const pkgPath = path79.join(packageRoot(), "package.json");
+    const pkgPath = path80.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
     const requiredRange = pkg.engines?.node;
     if (requiredRange && !satisfiesVersion(process.version, requiredRange)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haus-tech/haus-workflow",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "description": "Haus AI workflow CLI for Claude Code.",
   "type": "module",
   "bin": {
@@ -37,6 +37,7 @@
     "verify": "node scripts/verify.mjs",
     "verify:full": "node scripts/verify.mjs --coverage",
     "check:contract-behavior": "node --import tsx scripts/contract-behavior-check.mjs",
+    "check:mutation-table": "node scripts/check-mutation-table.mjs",
     "postinstall": "node ./scripts/postinstall.mjs || true",
     "prepare": "lefthook install || true",
     "security:audit": "yarn npm audit -A -R --severity high --environment production"