@haus-tech/haus-workflow 4.5.0 → 4.7.0

package/dist/cli.js

@@ -404,6 +404,9 @@ var init_exec = __esm({
 });
 
 // src/catalog/remote-catalog/github-auth.ts
+function ghProbeDisabled() {
+  return process.env["HAUS_NO_GH_AUTH_PROBE"] === "1";
+}
 async function defaultGhTokenResolver() {
   try {
     const result = await runCommand("gh", ["auth", "token"], {
@@ -425,8 +428,9 @@ async function resolveGithubAuthToken(env = process.env) {
       if (haus) return haus;
       const github = env["GITHUB_TOKEN"]?.trim();
       if (github) return github;
-      const fromGh = await (ghResolverOverride ?? defaultGhTokenResolver)();
-      return fromGh;
+      if (ghResolverOverride) return ghResolverOverride();
+      if (ghProbeDisabled()) return null;
+      return defaultGhTokenResolver();
     })().then((token) => {
       cachedToken = token;
       inFlight = void 0;
@@ -1932,7 +1936,7 @@ var init_sync = __esm({
 // src/cli.ts
 init_offline();
 import { readFileSync as readFileSync5 } from "node:fs";
-import path80 from "node:path";
+import path81 from "node:path";
 import { Command } from "commander";
 
 // src/commands/apply.ts
@@ -2338,6 +2342,11 @@ var ASK_PATHS = [
   { pattern: ".env.*", tools: ["Edit", "Write"] },
   { pattern: "storage/logs/**", tools: ["Edit", "Write"] },
   { pattern: "exports/**", tools: ["Edit", "Write"] },
+  // Dump-shaped formats: reading one is the leak, so Read is in the tool set. `*.sql`
+  // belongs with them — a dump can carry an entire customer table — and was the one
+  // missing from every permission tier (it appeared only in SENSITIVE_PATH_REGEXES,
+  // which gates the bulk scanner, not on-demand file access). See ADR-0071.
+  { pattern: "*.sql", tools: ["Read", "Edit", "Write"] },
   { pattern: "*.dump", tools: ["Read", "Edit", "Write"] },
   { pattern: "*.backup", tools: ["Read", "Edit", "Write"] },
   { pattern: "*.bak", tools: ["Read", "Edit", "Write"] },
@@ -2376,6 +2385,34 @@ function isRecord(v) {
   return typeof v === "object" && v !== null;
 }
 
+// src/utils/versions.ts
+import semver from "semver";
+function normalizeVersion(version) {
+  return semver.valid(semver.coerce(version));
+}
+function satisfiesVersion(version, range) {
+  const normalized = normalizeVersion(version);
+  if (!normalized) return false;
+  return semver.satisfies(normalized, range, { includePrerelease: true });
+}
+function compareVersions(a, b) {
+  const normalizedA = normalizeVersion(a);
+  const normalizedB = normalizeVersion(b);
+  if (!normalizedA || !normalizedB) {
+    throw new Error(`Cannot compare invalid versions: ${a} vs ${b}`);
+  }
+  return semver.compare(normalizedA, normalizedB);
+}
+function resolveMajorVersion(range) {
+  if (!range) return null;
+  try {
+    const min = semver.minVersion(range);
+    return min ? min.major : null;
+  } catch {
+    return null;
+  }
+}
+
 // src/scanner/detection.ts
 var UNSUPPORTED_MARKERS = {
   "Cargo.toml": "rust",
@@ -2402,7 +2439,7 @@ function describeUnknownDetection(unsupportedSignals, isLinkedWorktree) {
 function blocked(rel) {
   return SENSITIVE_PATH_REGEXES.some((x) => x.test(rel));
 }
-function dependencyVersionMap(pkg, composer) {
+function dependencyVersionMap(pkg, composer, memberPkgs = []) {
   const versions = /* @__PURE__ */ new Map();
   const pushObj = (obj) => {
     if (!isRecord(obj)) return;
@@ -2416,8 +2453,34 @@ function dependencyVersionMap(pkg, composer) {
   pushObj(pkg?.devDependencies);
   pushObj(composer?.require);
   pushObj(composer?.["require-dev"]);
+  const rootDeclared = new Set(versions.keys());
+  for (const member of memberPkgs) {
+    pushObj(member?.dependencies);
+    pushObj(member?.devDependencies);
+  }
+  for (const [name, majors] of memberMajorsByName(memberPkgs)) {
+    if (rootDeclared.has(name)) continue;
+    if (majors.size > 1) versions.set(name, "");
+  }
   return versions;
 }
+function memberMajorsByName(memberPkgs) {
+  const majors = /* @__PURE__ */ new Map();
+  for (const member of memberPkgs) {
+    for (const section of [member?.dependencies, member?.devDependencies]) {
+      if (!isRecord(section)) continue;
+      for (const [name, raw] of Object.entries(section)) {
+        if (typeof raw !== "string") continue;
+        const major = resolveMajorVersion(raw);
+        if (major == null) continue;
+        const seen = majors.get(name) ?? /* @__PURE__ */ new Set();
+        seen.add(major);
+        majors.set(name, seen);
+      }
+    }
+  }
+  return majors;
+}
 function finalizeRoles(registryRoles, deps, files) {
   const roles = new Set(registryRoles);
   const hasWpConfig = files.some((f) => f.endsWith("wp-config.php"));
@@ -2514,36 +2577,6 @@ function isSupersededByPlugin(lockId, activePinIds) {
 // src/scanner/detect-package-manager.ts
 import path13 from "node:path";
 import fs9 from "fs-extra";
-
-// src/utils/versions.ts
-import semver from "semver";
-function normalizeVersion(version) {
-  return semver.valid(semver.coerce(version));
-}
-function satisfiesVersion(version, range) {
-  const normalized = normalizeVersion(version);
-  if (!normalized) return false;
-  return semver.satisfies(normalized, range, { includePrerelease: true });
-}
-function compareVersions(a, b) {
-  const normalizedA = normalizeVersion(a);
-  const normalizedB = normalizeVersion(b);
-  if (!normalizedA || !normalizedB) {
-    throw new Error(`Cannot compare invalid versions: ${a} vs ${b}`);
-  }
-  return semver.compare(normalizedA, normalizedB);
-}
-function resolveMajorVersion(range) {
-  if (!range) return null;
-  try {
-    const min = semver.minVersion(range);
-    return min ? min.major : null;
-  } catch {
-    return null;
-  }
-}
-
-// src/scanner/detect-package-manager.ts
 function detectPackageManager(root, packageManagerField) {
   const field = String(packageManagerField ?? "").trim();
   if (field.startsWith("yarn@")) {
@@ -3160,8 +3193,8 @@ function buildDenyRules() {
   for (const command of DENY_COMMANDS) {
     rules.push(`Bash(${command}:*)`);
   }
-  for (const path81 of DENY_PATHS) {
-    const pattern = DENY_DIRS.has(path81) ? `${path81}/**` : path81;
+  for (const path82 of DENY_PATHS) {
+    const pattern = DENY_DIRS.has(path82) ? `${path82}/**` : path82;
     for (const tool of FILE_TOOLS) {
       rules.push(`${tool}(${pattern})`);
     }
@@ -3680,6 +3713,7 @@ var IMPORT_CONTENT = `@.haus-workflow/WORKFLOW.md
 @docs/decisions/README.md`;
 function buildImportBlock() {
   return `${BLOCK_BEGIN}
+
 ${IMPORT_CONTENT}
 ${BLOCK_END}`;
 }
@@ -4748,7 +4782,8 @@ var GITIGNORED_ARTIFACT_PATHS = [
   ".haus-workflow/recommendation.json",
   ".haus-workflow/sources-report.json",
   ".haus-workflow/deep-context.json",
-  ".haus-workflow/backups/"
+  ".haus-workflow/backups/",
+  ".haus-workflow/llms-cache/"
 ];
 function findLineMarker3(content2, marker, from = 0) {
   let idx = content2.indexOf(marker, from);
@@ -4793,7 +4828,7 @@ function buildBlockFor(existing, beginMarker, endMarker, comment, patterns) {
   if (needed.length === 0) return null;
   return [beginMarker, comment, ...needed, endMarker].join("\n");
 }
-var ARTIFACT_BLOCK_COMMENT = "# haus machine-local artifacts \u2014 must never be committed (see ADR-0025, ADR-0058)";
+var ARTIFACT_BLOCK_COMMENT = "# haus machine-local artifacts \u2014 must never be committed (see ADR-0025, ADR-0058, ADR-0009)";
 function injectBlockFor(existing, beginMarker, endMarker, comment, patterns) {
   const block = buildBlockFor(existing, beginMarker, endMarker, comment, patterns);
   const range = findBlockRangeFor(existing, beginMarker, endMarker);
@@ -6454,8 +6489,8 @@ async function runBundleImport(file, options = {}) {
 }
 
 // src/commands/doctor.ts
-import path45 from "node:path";
-import fs37 from "fs-extra";
+import path46 from "node:path";
+import fs38 from "fs-extra";
 init_manifest_format();
 
 // src/claude/former-install-orphans.ts
@@ -6490,11 +6525,132 @@ async function findOrphanedFormerInstalls(root, items, lockRows) {
   return orphans;
 }
 
+// src/claude/project-exclusions.ts
+init_project_pin();
+init_fs();
+init_logger();
+init_paths();
+
+// src/claude/project-intent.ts
+init_project_pin();
+init_fs();
+init_logger();
+init_paths();
+import fs30 from "fs-extra";
+function normalizeIdList(value) {
+  if (!Array.isArray(value)) return [];
+  return [
+    ...new Set(
+      value.filter((entry) => typeof entry === "string" && entry.length > 0)
+    )
+  ];
+}
+function normalizeSignalList(value) {
+  return [...new Set(normalizeIdList(value).map((entry) => entry.toLowerCase()))];
+}
+async function readProjectConfigObject(root) {
+  try {
+    const data = await readJson(hausPath(root, PROJECT_CONFIG_FILE));
+    if (data == null || typeof data !== "object" || Array.isArray(data)) return null;
+    return data;
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    warn(
+      `${PROJECT_CONFIG_REL} could not be read (${err instanceof Error ? err.message : String(err)}) \u2014 treating project intent as unset`
+    );
+    return null;
+  }
+}
+async function updateProjectConfig(root, mutate) {
+  const file = hausPath(root, PROJECT_CONFIG_FILE);
+  let existing = {};
+  if (await fs30.pathExists(file)) {
+    try {
+      const parsed = JSON.parse(await fs30.readFile(file, "utf8"));
+      if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+        existing = { ...parsed };
+      } else {
+        warn(`${PROJECT_CONFIG_REL} is not a JSON object \u2014 rewriting with haus-managed keys only`);
+      }
+    } catch (err) {
+      warn(
+        `${PROJECT_CONFIG_REL} could not be parsed (${err instanceof Error ? err.message : String(err)}) \u2014 rewriting with haus-managed keys only`
+      );
+    }
+  }
+  await writeJson(file, mutate(existing));
+}
+async function readProjectIncludedIds(root) {
+  const data = await readProjectConfigObject(root);
+  return data == null ? [] : normalizeIdList(data.includedIds);
+}
+async function addProjectIncludedIds(root, ids) {
+  const toAdd = normalizeIdList(ids);
+  if (toAdd.length === 0) return;
+  await updateProjectConfig(root, (existing) => ({
+    ...existing,
+    includedIds: [.../* @__PURE__ */ new Set([...normalizeIdList(existing.includedIds), ...toAdd])].sort()
+  }));
+}
+function withdrawIncludedIds(existing, ids) {
+  const drop = new Set(ids);
+  return normalizeIdList(existing.includedIds).filter((id) => !drop.has(id));
+}
+async function readDeclaredContext(root) {
+  const data = await readProjectConfigObject(root);
+  if (data == null) return { roles: [], stacks: [] };
+  return {
+    roles: normalizeSignalList(data.declaredRoles),
+    stacks: normalizeSignalList(data.declaredStacks)
+  };
+}
+
+// src/claude/project-exclusions.ts
+function normalizeExcludedIds(value) {
+  if (!Array.isArray(value)) return [];
+  return [
+    ...new Set(
+      value.filter((entry) => typeof entry === "string" && entry.length > 0)
+    )
+  ];
+}
+async function readProjectExcludedIds(root) {
+  try {
+    const data = await readJson(hausPath(root, PROJECT_CONFIG_FILE));
+    if (!data) return [];
+    return normalizeExcludedIds(data.excludedIds);
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    warn(
+      `${PROJECT_CONFIG_REL} could not be read for excludedIds (${err instanceof Error ? err.message : String(err)}) \u2014 treating as none`
+    );
+    return [];
+  }
+}
+function isItemExcluded(item, excluded) {
+  if (excluded.has(item.id)) return true;
+  return normalizeFormerIds(item.formerIds).some((formerId) => excluded.has(formerId));
+}
+async function addProjectExcludedIds(root, ids) {
+  const toAdd = [...new Set(ids.filter((id) => id.length > 0))];
+  if (toAdd.length === 0) return;
+  await updateProjectConfig(root, (existing) => {
+    const next = { ...existing };
+    next.excludedIds = [
+      .../* @__PURE__ */ new Set([...normalizeExcludedIds(existing.excludedIds), ...toAdd])
+    ].sort();
+    const remainingIncludes = withdrawIncludedIds(existing, toAdd);
+    if (remainingIncludes.length > 0) next.includedIds = remainingIncludes;
+    else delete next.includedIds;
+    return next;
+  });
+}
+
 // src/claude/skill-reference-check.ts
 init_paths();
 import path32 from "node:path";
 import fg4 from "fast-glob";
-import fs30 from "fs-extra";
+import fs31 from "fs-extra";
 var REFERENCE_PATTERN = /\b([a-z][a-z0-9]*(?:-[a-z0-9]+)+):([a-z][a-z0-9]*(?:-[a-z0-9]+)*)\b(?!:\/\/)/g;
 function stripFencedCodeBlocks(text) {
   return text.replace(/```[\s\S]*?```/g, (block) => block.replace(/[^\n]/g, " "));
@@ -6509,17 +6665,9 @@ function inlineCodeSpanRanges(line2) {
 }
 async function findUnresolvedSkillReferences(root, options = {}) {
   const resolvableNamespaces = new Set(options.pluginNamespaces ?? []);
-  const skillsRoot = claudePath(root, "skills");
-  if (!await fs30.pathExists(skillsRoot)) return [];
-  const skillDirs = (await fs30.readdir(skillsRoot, { withFileTypes: true })).filter((entry) => entry.isDirectory() && entry.name !== "shared").map((entry) => entry.name);
-  const installedSkillNames = new Set(skillDirs);
-  const files = await fg4("*/**/*.md", { cwd: skillsRoot, onlyFiles: true, dot: true });
+  const installedSkillNames = await readInstalledSkillNames(root);
   const issues = [];
-  for (const rel of files) {
-    if (rel.startsWith("shared/")) continue;
-    const abs = path32.join(skillsRoot, rel);
-    const raw = await fs30.readFile(abs, "utf8");
-    const lines = stripFencedCodeBlocks(raw).split("\n");
+  for (const { file, lines } of await readScannedMarkdown(root)) {
     lines.forEach((line2, idx) => {
       const codeSpans = inlineCodeSpanRanges(line2);
       for (const match of line2.matchAll(REFERENCE_PATTERN)) {
@@ -6531,7 +6679,7 @@ async function findUnresolvedSkillReferences(root, options = {}) {
         );
         if (inCodeSpan && !installedSkillNames.has(bareName)) continue;
         issues.push({
-          file: path32.join(".claude/skills", rel),
+          file,
           line: idx + 1,
           reference,
           bareName,
@@ -6542,17 +6690,83 @@ async function findUnresolvedSkillReferences(root, options = {}) {
   }
   return issues;
 }
+var BOLD_AGENT_PATTERN = /\*\*([a-z][a-z0-9]*(?:-[a-z0-9]+)+)\*\*/g;
+var AGENT_WORD = /\bagents?\b/i;
+function isAgentContext(line2, nearestHeading) {
+  const outsideBold = line2.replace(BOLD_AGENT_PATTERN, " ");
+  return AGENT_WORD.test(outsideBold) || AGENT_WORD.test(nearestHeading);
+}
+async function findUnresolvedAgentReferences(root, options = {}) {
+  const installedAgentNames = await readInstalledAgentNames(root);
+  const catalogAgentNames = new Set(options.catalogAgentNames ?? []);
+  const issues = [];
+  for (const { file, lines } of await readScannedMarkdown(root)) {
+    let nearestHeading = "";
+    lines.forEach((line2, idx) => {
+      if (/^#{1,6}\s/.test(line2)) nearestHeading = line2.replace(/^#{1,6}\s*/, "");
+      if (!isAgentContext(line2, nearestHeading)) return;
+      const codeSpans = inlineCodeSpanRanges(line2);
+      for (const match of line2.matchAll(BOLD_AGENT_PATTERN)) {
+        const agentName = match[1];
+        if (!agentName || installedAgentNames.has(agentName)) continue;
+        const inCodeSpan = codeSpans.some(
+          ([start, end]) => match.index >= start && match.index < end
+        );
+        if (inCodeSpan) continue;
+        issues.push({
+          file,
+          line: idx + 1,
+          agentName,
+          inCatalog: catalogAgentNames.has(agentName)
+        });
+      }
+    });
+  }
+  return issues;
+}
+async function readInstalledSkillNames(root) {
+  const skillsRoot = claudePath(root, "skills");
+  if (!await fs31.pathExists(skillsRoot)) return /* @__PURE__ */ new Set();
+  const entries = await fs31.readdir(skillsRoot, { withFileTypes: true });
+  return new Set(entries.filter((e) => e.isDirectory() && e.name !== "shared").map((e) => e.name));
+}
+async function readInstalledAgentNames(root) {
+  const agentsRoot = claudePath(root, "agents");
+  if (!await fs31.pathExists(agentsRoot)) return /* @__PURE__ */ new Set();
+  const entries = await fs31.readdir(agentsRoot, { withFileTypes: true });
+  return new Set(
+    entries.filter((e) => e.isFile() && e.name.endsWith(".md")).map((e) => e.name.replace(/\.md$/, ""))
+  );
+}
+async function readScannedMarkdown(root) {
+  const scanned = [];
+  for (const dir of ["skills", "agents", "rules"]) {
+    const dirRoot = claudePath(root, dir);
+    if (!await fs31.pathExists(dirRoot)) continue;
+    const pattern = dir === "skills" ? "*/**/*.md" : "**/*.md";
+    const files = await fg4(pattern, { cwd: dirRoot, onlyFiles: true, dot: true });
+    for (const rel of files) {
+      if (dir === "skills" && rel.startsWith("shared/")) continue;
+      const raw = await fs31.readFile(path32.join(dirRoot, rel), "utf8");
+      scanned.push({
+        file: path32.posix.join(".claude", dir, rel.split(path32.sep).join("/")),
+        lines: stripFencedCodeBlocks(raw).split("\n")
+      });
+    }
+  }
+  return scanned;
+}
 
 // src/decisions/doctor.ts
 init_fs();
 import path37 from "node:path";
-import fs34 from "fs-extra";
+import fs35 from "fs-extra";
 
 // src/decisions/check.ts
 init_fs();
 init_paths();
 import path36 from "node:path";
-import fs33 from "fs-extra";
+import fs34 from "fs-extra";
 
 // src/decisions/dep-bump.ts
 var DEP_SECTIONS = [
@@ -6613,6 +6827,32 @@ function isDependencyBumpOnly(beforeText, afterText) {
 init_exec();
 init_fs();
 import path33 from "node:path";
+var NUL = String.fromCharCode(0);
+function parseNumstat(output) {
+  const fields2 = output.split(NUL);
+  const linesByFile = {};
+  let linesAdded = 0;
+  let linesRemoved = 0;
+  for (let i = 0; i < fields2.length; i++) {
+    const field = fields2[i];
+    if (!field) continue;
+    const parts = field.split("	");
+    if (parts.length < 3) continue;
+    const added = parts[0] === "-" ? 0 : Number(parts[0]);
+    const removed = parts[1] === "-" ? 0 : Number(parts[1]);
+    if (Number.isNaN(added) || Number.isNaN(removed)) continue;
+    let file = parts[2];
+    if (file === "") {
+      file = fields2[i + 2];
+      i += 2;
+    }
+    if (!file) continue;
+    linesAdded += added;
+    linesRemoved += removed;
+    linesByFile[file] = (linesByFile[file] ?? 0) + added + removed;
+  }
+  return { linesByFile, linesAdded, linesRemoved };
+}
 function isPackageJsonPath(file) {
   return file === "package.json" || file.endsWith("/package.json");
 }
@@ -6680,18 +6920,9 @@ async function collectDiffStats(root, opts) {
   const gitArgs = opts.staged ? ["diff", "--cached", "--name-only"] : ["diff", "--name-only", opts.range ?? "HEAD"];
   const names = await runGit(gitArgs, { cwd: root });
   const files = names.stdout.split("\n").map((f) => f.trim()).filter(Boolean);
-  const numstatArgs = opts.staged ? ["diff", "--cached", "--numstat"] : ["diff", "--numstat", opts.range ?? "HEAD"];
+  const numstatArgs = opts.staged ? ["diff", "--cached", "--numstat", "-z"] : ["diff", "--numstat", "-z", opts.range ?? "HEAD"];
   const numstat = await runGit(numstatArgs, { cwd: root });
-  let linesAdded = 0;
-  let linesRemoved = 0;
-  for (const line2 of numstat.stdout.split("\n")) {
-    const parts = line2.trim().split(/\s+/);
-    if (parts.length < 3) continue;
-    const added = parts[0] === "-" ? 0 : Number(parts[0]);
-    const removed = parts[1] === "-" ? 0 : Number(parts[1]);
-    if (!Number.isNaN(added)) linesAdded += added;
-    if (!Number.isNaN(removed)) linesRemoved += removed;
-  }
+  const { linesByFile, linesAdded, linesRemoved } = parseNumstat(numstat.stdout);
   const packageJsonPairs = {};
   for (const file of files) {
     if (!isPackageJsonPath(file)) continue;
@@ -6701,6 +6932,7 @@ async function collectDiffStats(root, opts) {
     files,
     linesAdded,
     linesRemoved,
+    linesByFile,
     ...Object.keys(packageJsonPairs).length > 0 ? { packageJsonPairs } : {}
   };
 }
@@ -6745,12 +6977,12 @@ function firstMatchingRegex(filePath, patterns) {
 
 // src/decisions/paths.ts
 import path34 from "node:path";
-import fs31 from "fs-extra";
+import fs32 from "fs-extra";
 async function resolveDecisionsDir(root) {
   const primary = path34.join(root, DECISIONS_TRIGGERS.decisionsDir);
-  if (await fs31.pathExists(primary)) return primary;
+  if (await fs32.pathExists(primary)) return primary;
   const legacy = path34.join(root, DECISIONS_TRIGGERS.legacyDecisionsDir ?? "docs/adr");
-  if (await fs31.pathExists(legacy)) return legacy;
+  if (await fs32.pathExists(legacy)) return legacy;
   return primary;
 }
 function relativeDecisionPath(decisionsDir, root) {
@@ -6760,7 +6992,7 @@ function relativeDecisionPath(decisionsDir, root) {
 // src/decisions/validate.ts
 init_fs();
 import path35 from "node:path";
-import fs32 from "fs-extra";
+import fs33 from "fs-extra";
 function validateDecisionContent(content2) {
   const errors = [];
   for (const section of DECISIONS_TRIGGERS.requiredSections) {
@@ -6790,7 +7022,7 @@ function decisionNumberFromFile(name) {
 }
 async function validateIndexSync(decisionsDir, decisionFiles) {
   const readmePath = path35.join(decisionsDir, "README.md");
-  if (!await fs32.pathExists(readmePath)) {
+  if (!await fs33.pathExists(readmePath)) {
     return ["docs/decisions/README.md is missing"];
   }
   const readme = await readText(readmePath) ?? "";
@@ -6846,6 +7078,11 @@ function countTopLevelDirs(files) {
 function firstMatchingGlob(file, globs) {
   return globs.find((g) => matchesPathGlob(file, g));
 }
+function relevantLineCount(stats, relevant) {
+  const byFile = stats.linesByFile;
+  if (byFile == null) return stats.linesAdded + stats.linesRemoved;
+  return relevant.reduce((sum, file) => sum + (byFile[file] ?? 0), 0);
+}
 function explainDecisionTrigger(stats) {
   let relevant = stats.files.filter((f) => !isExempt(f));
   if (relevant.length === 0) return [];
@@ -6863,7 +7100,7 @@ function explainDecisionTrigger(stats) {
       return [`matched pathRegex: ${regex}`];
     }
   }
-  const totalLines = stats.linesAdded + stats.linesRemoved;
+  const totalLines = relevantLineCount(stats, relevant);
   const dirs = countTopLevelDirs(relevant);
   if (relevant.length >= DECISIONS_TRIGGERS.minFilesChanged && dirs >= 2) {
     return [`size threshold: ${relevant.length} files across ${dirs} top-level dirs`];
@@ -6962,8 +7199,8 @@ ${opts.commitMessages ?? ""}`;
     changedFiles: stats.files
   });
   if (satisfactionErrors.length > 0 && decisionsRel !== legacyRel) {
-    const legacyExists = await fs33.pathExists(path36.join(root, legacyRel));
-    if (legacyExists && !await fs33.pathExists(decisionsDir)) {
+    const legacyExists = await fs34.pathExists(path36.join(root, legacyRel));
+    if (legacyExists && !await fs34.pathExists(decisionsDir)) {
       satisfactionErrors = await checkSatisfaction({
         root,
         decisionsRel: legacyRel,
@@ -6985,8 +7222,8 @@ ${opts.commitMessages ?? ""}`;
   return { triggered: true, satisfied: false, reasons, securityTriggered };
 }
 async function listDecisionNumbers(decisionsDir) {
-  if (!await fs33.pathExists(decisionsDir)) return [];
-  const entries = await fs33.readdir(decisionsDir);
+  if (!await fs34.pathExists(decisionsDir)) return [];
+  const entries = await fs34.readdir(decisionsDir);
   return entries.map((name) => decisionNumberFromFile(name)).filter((n) => n != null).map((n) => Number(n));
 }
 
@@ -6995,8 +7232,8 @@ async function auditDecisionsLayout(root) {
   const findings = [];
   const primary = path37.join(root, DECISIONS_TRIGGERS.decisionsDir);
   const legacy = path37.join(root, DECISIONS_TRIGGERS.legacyDecisionsDir ?? "docs/adr");
-  const hasPrimary = await fs34.pathExists(primary);
-  const hasLegacy = await fs34.pathExists(legacy);
+  const hasPrimary = await fs35.pathExists(primary);
+  const hasLegacy = await fs35.pathExists(legacy);
   if (!hasPrimary && hasLegacy) {
     findings.push({
       level: "advisory",
@@ -7010,7 +7247,7 @@ async function auditDecisionsLayout(root) {
   const decisionsDir = await resolveDecisionsDir(root);
   const rel = relativeDecisionPath(decisionsDir, root);
   const readmePath = path37.join(decisionsDir, "README.md");
-  if (!await fs34.pathExists(readmePath)) {
+  if (!await fs35.pathExists(readmePath)) {
     findings.push({
       level: "advisory",
       line: `- DECISIONS: missing ${rel}/README.md index`,
@@ -7020,7 +7257,7 @@ async function auditDecisionsLayout(root) {
     return findings;
   }
   const readme = await readText(readmePath);
-  const entries = (await fs34.readdir(decisionsDir)).filter(
+  const entries = (await fs35.readdir(decisionsDir)).filter(
     (f) => f.endsWith(".md") && f !== "README.md"
   );
   for (const file of entries) {
@@ -7069,7 +7306,7 @@ init_fs();
 init_logger();
 init_paths();
 import path38 from "node:path";
-import fs35 from "fs-extra";
+import fs36 from "fs-extra";
 function manifestPathIn(configDir) {
   return path38.join(configDir, "haus", "install-manifest.json");
 }
@@ -7099,9 +7336,9 @@ async function pruneVacatedDirs(root, vacatedFiles) {
 async function destinationWritable(dir) {
   let candidate = path38.resolve(dir);
   for (; ; ) {
-    if (await fs35.pathExists(candidate)) {
+    if (await fs36.pathExists(candidate)) {
       try {
-        await fs35.access(candidate, fs35.constants.W_OK);
+        await fs36.access(candidate, fs36.constants.W_OK);
         return true;
       } catch (err) {
         return err instanceof Error ? err.message : String(err);
@@ -7133,7 +7370,7 @@ async function migrateGlobalConfigDir(options = {}) {
   if (!legacy || !Array.isArray(legacy.files)) {
     return { ...base, reason: "no install manifest under ~/.claude" };
   }
-  if (await fs35.pathExists(manifestPathIn(to))) {
+  if (await fs36.pathExists(manifestPathIn(to))) {
     return { ...base, reason: "an install manifest already exists in the resolved config dir" };
   }
   const writable = await destinationWritable(to);
@@ -7156,14 +7393,14 @@ async function migrateGlobalConfigDir(options = {}) {
       continue;
     }
     const newDest = path38.join(to, rel);
-    if (!await fs35.pathExists(entry.destPath)) {
+    if (!await fs36.pathExists(entry.destPath)) {
       rewritten.push({ ...entry, destPath: newDest });
       continue;
     }
-    if (await fs35.pathExists(newDest)) {
+    if (await fs36.pathExists(newDest)) {
       if (await sameContent(entry.destPath, newDest)) {
         if (!dryRun) {
-          await fs35.remove(entry.destPath);
+          await fs36.remove(entry.destPath);
           vacated.push(entry.destPath);
         }
         moved.push(newDest);
@@ -7180,7 +7417,7 @@ async function migrateGlobalConfigDir(options = {}) {
       continue;
     }
     try {
-      await fs35.move(entry.destPath, newDest);
+      await fs36.move(entry.destPath, newDest);
       vacated.push(entry.destPath);
       moved.push(newDest);
       rewritten.push({ ...entry, destPath: newDest });
@@ -7205,7 +7442,7 @@ async function migrateGlobalConfigDir(options = {}) {
   }
   try {
     await writeJson(manifestPathIn(to), { ...legacy, files: rewritten });
-    await fs35.remove(legacyManifestPath);
+    await fs36.remove(legacyManifestPath);
     vacated.push(legacyManifestPath);
   } catch (err) {
     return {
@@ -7250,8 +7487,8 @@ function printConfigDirMigration(result) {
 }
 
 // src/scanner/read-context.ts
-import path44 from "node:path";
-import fs36 from "fs-extra";
+import path45 from "node:path";
+import fs37 from "fs-extra";
 
 // src/commands/workspace/config.ts
 init_fs();
@@ -7381,7 +7618,7 @@ async function readMembers(rootInfo) {
 }
 
 // src/scanner/scan-project.ts
-import path43 from "node:path";
+import path44 from "node:path";
 init_fs();
 
 // src/utils/git-root.ts
@@ -7445,7 +7682,7 @@ init_paths();
 // src/scanner/detection-registry.ts
 var dep = (value) => ({ kind: "dep", value });
 var depPrefix = (value) => ({ kind: "depPrefix", value });
-var depAbsent = (value) => ({ kind: "depAbsent", value });
+var depSuffix = (value) => ({ kind: "depSuffix", value });
 var depMajor = (value, major) => ({
   kind: "depMajor",
   value,
@@ -7472,6 +7709,7 @@ var fileStartsWith = (value) => ({
   mode: "startsWith"
 });
 var content = (value) => ({ kind: "content", value });
+var composerType = (value) => ({ kind: "composerType", value });
 var STACK_BUCKETS = [
   "backend",
   "frontend",
@@ -7488,12 +7726,17 @@ function matchSignal(sig, ctx) {
     case "depPrefix":
       for (const d of ctx.deps) if (d.startsWith(sig.value)) return true;
       return false;
+    case "depSuffix":
+      for (const d of ctx.deps) if (d.endsWith(sig.value)) return true;
+      return false;
     case "depAbsent":
       return !ctx.deps.has(sig.value);
     case "depMajor":
       return ctx.deps.has(sig.value) && resolveMajorVersion(ctx.depVersions.get(sig.value) ?? "") === sig.major;
     case "content":
       return ctx.contentBlob.includes(sig.value);
+    case "composerType":
+      return sig.value.length > 0 && ctx.composerType === sig.value;
     case "file":
       return ctx.files.some((f) => {
         switch (sig.mode) {
@@ -7510,9 +7753,12 @@ function matchSignal(sig, ctx) {
   }
 }
 function matchRule(rule, ctx) {
-  if (rule.all) return rule.all.every((s) => matchSignal(s, ctx));
-  if (rule.any) return rule.any.some((s) => matchSignal(s, ctx));
-  return false;
+  const groups = [];
+  if (rule.all) groups.push(rule.all.every((s) => matchSignal(s, ctx)));
+  if (rule.any) groups.push(rule.any.some((s) => matchSignal(s, ctx)));
+  if (rule.none) groups.push(!rule.none.some((s) => matchSignal(s, ctx)));
+  if (groups.length === 0) return false;
+  return groups.every(Boolean);
 }
 var ROLE_RULES = [
   // Workspace/meta-repo root — same bridge signal `readMembers()`/
@@ -7570,8 +7816,33 @@ var STACK_RULES = [
   },
   { stack: ["tooling", "pm2"], any: [dep("pm2"), fileIncludes("ecosystem.config")] },
   { stack: ["tooling", "sentry"], any: [depPrefix("@sentry/")] },
-  { stack: ["tooling", "missing-prettier"], any: [depAbsent("prettier")] },
-  { stack: ["tooling", "missing-eslint"], any: [depAbsent("eslint")] },
+  // "Missing" means no evidence of Prettier at all — not merely no direct dependency.
+  // A repo configuring Prettier through a shared config package (`@scope/prettier-config`)
+  // has no `prettier` key of its own, so `depAbsent('prettier')` reported it as missing
+  // even with a `.prettierrc` sitting right there.
+  {
+    stack: ["tooling", "missing-prettier"],
+    none: [
+      dep("prettier"),
+      depSuffix("prettier-config"),
+      fileIncludes(".prettierrc"),
+      fileIncludes("prettier.config.")
+    ]
+  },
+  // Same shape as missing-prettier above (#374). ESLint has TWO shared-config naming
+  // conventions rather than one — `@scope/eslint-config` and the older
+  // `eslint-config-<name>` — so both are evidence, as is a flat (`eslint.config.*`) or
+  // legacy (`.eslintrc*`) config file.
+  {
+    stack: ["tooling", "missing-eslint"],
+    none: [
+      dep("eslint"),
+      depSuffix("eslint-config"),
+      depPrefix("eslint-config-"),
+      fileIncludes("eslint.config."),
+      fileIncludes(".eslintrc")
+    ]
+  },
   {
     stack: ["tooling", "stripe"],
     any: [dep("stripe"), dep("@stripe/stripe-js"), dep("@stripe/react-stripe-js")]
@@ -7603,7 +7874,16 @@ var STACK_RULES = [
   { stack: ["backend", "php"], any: [fileEndsWith("composer.json")] },
   { stack: ["backend", "laravel"], any: [dep("laravel/framework")] },
   { stack: ["backend", "laravel"], any: [fileIncludes("app/Providers/"), fileIncludes("routes/")] },
-  { stack: ["backend", "wordpress"], any: [fileEndsWith("wp-config.php"), dep("roots/wordpress")] },
+  // `wp-config.php` and `roots/wordpress` both describe a WordPress *site* — the thing
+  // that runs the install. A WordPress *plugin* repo has neither; it ships source that
+  // gets dropped into someone else's `wp-content/plugins/`, and declares that with
+  // composer's `"type": "wordpress-plugin"`. Both shapes need WordPress context, so
+  // both earn the stack. Site-only roles (`wordpress-*-site`) are unaffected — those
+  // still come from the site signals alone (`finalizeRoles`, src/scanner/detection.ts).
+  {
+    stack: ["backend", "wordpress"],
+    any: [fileEndsWith("wp-config.php"), dep("roots/wordpress"), composerType("wordpress-plugin")]
+  },
   {
     stack: ["backend", "elementor"],
     any: [
@@ -7696,6 +7976,76 @@ async function buildContentBlob(root, files) {
   return parts.join("\n");
 }
 
+// src/scanner/workspace-packages.ts
+import path43 from "node:path";
+import fg5 from "fast-glob";
+import YAML2 from "yaml";
+init_fs();
+var PNPM_WORKSPACE_FILE = "pnpm-workspace.yaml";
+var MAX_WORKSPACE_MEMBERS = 200;
+function isRepoRelativeGlob(glob) {
+  if (glob.length === 0) return false;
+  if (path43.isAbsolute(glob) || glob.startsWith("/")) return false;
+  return !glob.split("/").includes("..");
+}
+function stringEntries(value) {
+  if (!Array.isArray(value)) return [];
+  return value.filter((entry) => typeof entry === "string" && entry.length > 0);
+}
+function workspaceGlobsFromPackageJson(pkg) {
+  if (!isRecord(pkg)) return [];
+  const field = pkg.workspaces;
+  if (Array.isArray(field)) return stringEntries(field);
+  if (isRecord(field)) return stringEntries(field.packages);
+  return [];
+}
+function workspaceGlobsFromPnpmYaml(text) {
+  try {
+    const doc = YAML2.parse(text);
+    if (!isRecord(doc)) return [];
+    return stringEntries(doc.packages);
+  } catch {
+    return [];
+  }
+}
+async function readWorkspaceGlobs(root, pkg) {
+  const fromPkg = workspaceGlobsFromPackageJson(pkg);
+  const pnpmText = await readText(path43.join(root, PNPM_WORKSPACE_FILE));
+  const fromPnpm = pnpmText == null ? [] : workspaceGlobsFromPnpmYaml(pnpmText);
+  return [.../* @__PURE__ */ new Set([...fromPkg, ...fromPnpm])];
+}
+async function collectWorkspaceMemberPackages(root, globs) {
+  const safeGlobs = globs.filter(isRepoRelativeGlob);
+  if (safeGlobs.length === 0) return [];
+  const patterns = safeGlobs.map((g) => `${g.replace(/\/+$/, "")}/package.json`);
+  let matches;
+  try {
+    matches = await fg5(patterns, {
+      cwd: root,
+      dot: false,
+      onlyFiles: true,
+      followSymbolicLinks: false,
+      suppressErrors: true,
+      ignore: ["**/node_modules/**", "**/.git/**", "**/dist/**"]
+    });
+  } catch {
+    return [];
+  }
+  const rootManifest = path43.resolve(root, "package.json");
+  const contained = [
+    ...new Set(
+      matches.map((rel) => resolveContainedPath(root, rel)).filter((abs) => abs != null && abs !== rootManifest)
+    )
+  ].sort().slice(0, MAX_WORKSPACE_MEMBERS);
+  const read = await mapWithConcurrency(contained, async (abs) => {
+    const pkg = await readJson(abs);
+    if (!isRecord(pkg)) return null;
+    const rel = path43.relative(root, path43.dirname(abs));
+    return { dir: rel.split(path43.sep).join("/"), pkg };
+  });
+  return read.filter((entry) => entry != null);
+}
+
 // src/scanner/write-sources-report.ts
 init_manifest_format();
 init_fs();
@@ -7758,6 +8108,20 @@ var SAFE_FILES = [
   "next.config.*",
   "tailwind.config.*",
   "components.json",
+  // Prettier config, in every shape Prettier itself accepts. Presence is what the
+  // `missing-prettier` rule needs: a repo can configure Prettier entirely through a
+  // shared config package, with no `prettier` dependency of its own to detect.
+  ".prettierrc*",
+  "prettier.config.*",
+  "**/.prettierrc*",
+  "**/prettier.config.*",
+  // ESLint config, flat and legacy, for the same reason (#374): a repo can configure
+  // ESLint entirely through a shared config package with no `eslint` dependency of
+  // its own, so presence of the config file is the only local evidence.
+  "eslint.config.*",
+  ".eslintrc*",
+  "**/eslint.config.*",
+  "**/.eslintrc*",
   "playwright.config.*",
   "phpunit.xml",
   "artisan",
@@ -7797,11 +8161,17 @@ var SAFE_FILES = [
   "Gemfile"
 ];
 async function scanProject(root, options = {}) {
-  const pkg = await readJson(path43.join(root, "package.json"));
-  const composer = await readJson(path43.join(root, "composer.json"));
+  const pkg = await readJson(path44.join(root, "package.json"));
+  const composer = await readJson(path44.join(root, "composer.json"));
   const files = await listFiles(root, SAFE_FILES);
   const safeFiles = files.filter((f) => !blocked(f));
-  const depVersions = dependencyVersionMap(pkg, composer);
+  const workspaceGlobs = await readWorkspaceGlobs(root, pkg ?? void 0);
+  const memberPackages = await collectWorkspaceMemberPackages(root, workspaceGlobs);
+  const depVersions = dependencyVersionMap(
+    pkg,
+    composer,
+    memberPackages.map((m) => m.pkg)
+  );
   const deps = [...depVersions.keys()].sort();
   const packageManager = detectPackageManager(root, String(pkg?.packageManager ?? ""));
   const contentBlob = await buildContentBlob(root, safeFiles);
@@ -7809,7 +8179,8 @@ async function scanProject(root, options = {}) {
     deps: new Set(deps),
     depVersions,
     files: safeFiles,
-    contentBlob
+    contentBlob,
+    composerType: typeof composer?.type === "string" ? composer.type : ""
   });
   const roles = finalizeRoles(detection.roles, deps, safeFiles);
   const stacks = detection.stacks;
@@ -7828,7 +8199,7 @@ async function scanProject(root, options = {}) {
     crossRepoHints.push("Monorepo orchestration detected");
   const unsupportedSignals = collectUnsupportedSignals(safeFiles);
   const detectionStatus = computeDetectionStatus(roles, stacks, unsupportedSignals);
-  const repoNameFallback = pkg?.name ? String(pkg.name) : path43.basename((await resolveRoots(root)).mainRoot);
+  const repoNameFallback = pkg?.name ? String(pkg.name) : path44.basename((await resolveRoots(root)).mainRoot);
   const context = {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     repoName: repoNameFallback,
@@ -7852,15 +8223,15 @@ async function scanProject(root, options = {}) {
 // src/scanner/read-context.ts
 async function isCacheFresh(root, cachePath) {
   const markerPaths = [
-    path44.join(root, "package.json"),
-    path44.join(root, "composer.json"),
-    path44.join(root, WORKSPACE_FILE),
-    path44.join(root, REPOS_MANIFEST_FILE)
+    path45.join(root, "package.json"),
+    path45.join(root, "composer.json"),
+    path45.join(root, WORKSPACE_FILE),
+    path45.join(root, REPOS_MANIFEST_FILE)
   ];
-  const cacheStat = await fs36.stat(cachePath);
+  const cacheStat = await fs37.stat(cachePath);
   for (const markerPath of markerPaths) {
-    if (!await fs36.pathExists(markerPath)) continue;
-    const markerStat = await fs36.stat(markerPath);
+    if (!await fs37.pathExists(markerPath)) continue;
+    const markerStat = await fs37.stat(markerPath);
     if (markerStat.mtimeMs > cacheStat.mtimeMs) return false;
   }
   return true;
@@ -7975,7 +8346,7 @@ async function runDoctor(options) {
   } else {
     ok(`- HOOKS OK: ${hooks.message}`);
   }
-  const rootClaudeMdPath = path45.join(root, "CLAUDE.md");
+  const rootClaudeMdPath = path46.join(root, "CLAUDE.md");
   const rootClaudeMdContent = await readText(rootClaudeMdPath);
   if (!rootClaudeMdContent) {
     flag(
@@ -8018,10 +8389,10 @@ async function runDoctor(options) {
         ok("- CLAUDE.md: import block present");
       }
       for (const target of actualTargets) {
-        const resolved = path45.resolve(root, target);
-        const relFromRoot = path45.relative(root, resolved);
-        const escapesRoot = relFromRoot === ".." || relFromRoot.startsWith(`..${path45.sep}`) || path45.isAbsolute(relFromRoot);
-        if (escapesRoot || !await fs37.pathExists(resolved)) {
+        const resolved = path46.resolve(root, target);
+        const relFromRoot = path46.relative(root, resolved);
+        const escapesRoot = relFromRoot === ".." || relFromRoot.startsWith(`..${path46.sep}`) || path46.isAbsolute(relFromRoot);
+        if (escapesRoot || !await fs38.pathExists(resolved)) {
           flag(
             `- CLAUDE.md import: @${target} does not resolve (run \`haus apply --write\`)`,
             `A file CLAUDE.md links to (${target}) is missing, so part of the guidance won't load`,
@@ -8039,7 +8410,7 @@ async function runDoctor(options) {
     );
   }
   const workflowPath = hausPath(root, "WORKFLOW.md");
-  const workflowExists = await fs37.pathExists(workflowPath);
+  const workflowExists = await fs38.pathExists(workflowPath);
   if (!workflowExists) {
     flag(
       "- .haus-workflow/WORKFLOW.md: missing (run `haus apply --write`)",
@@ -8054,15 +8425,15 @@ async function runDoctor(options) {
     } else {
       const storedHashMatch = firstLine.match(/hash=(sha256-[a-f0-9]+)/);
       const bodyContent = workflowContent.slice(firstLine.length + 1);
-      const cachePath = path45.join(getCacheDir(), "templates/agentic-workflow-standard.md");
-      const bundledPath = path45.join(
+      const cachePath = path46.join(getCacheDir(), "templates/agentic-workflow-standard.md");
+      const bundledPath = path46.join(
         packageRoot(),
         "library",
         "global",
         "templates",
         "agentic-workflow-standard.md"
       );
-      const templatePath = await fs37.pathExists(cachePath) ? cachePath : bundledPath;
+      const templatePath = await fs38.pathExists(cachePath) ? cachePath : bundledPath;
       const templateContent = await readText(templatePath);
       const verdict = checkManagedTamper(bodyContent, storedHashMatch?.[1], templateContent ?? null);
       if (verdict.status === "tampered" || verdict.status === "legacy-diverged") {
@@ -8090,7 +8461,7 @@ async function runDoctor(options) {
     }
   }
   const workflowConfigPath = hausPath(root, "workflow-config.md");
-  const workflowConfigExists = await fs37.pathExists(workflowConfigPath);
+  const workflowConfigExists = await fs38.pathExists(workflowConfigPath);
   if (!workflowConfigExists) {
     flag(
       "- .haus-workflow/workflow-config.md: missing (run `haus apply --write`)",
@@ -8098,7 +8469,7 @@ async function runDoctor(options) {
       "haus apply --write"
     );
   } else {
-    const cfg = await fs37.readFile(workflowConfigPath, "utf8");
+    const cfg = await fs38.readFile(workflowConfigPath, "utf8");
     const unfilled = cfg.split("\n").filter((l) => l.includes("<!-- fill in")).length;
     if (unfilled > 0) {
       suggest(
@@ -8110,11 +8481,11 @@ async function runDoctor(options) {
       ok("- .haus-workflow/workflow-config.md: OK (project-owned)");
     }
   }
-  const docsSkillInstalled = await fs37.pathExists(
-    path45.join(root, ".claude", "skills", "writing-documentation", "SKILL.md")
+  const docsSkillInstalled = await fs38.pathExists(
+    path46.join(root, ".claude", "skills", "writing-documentation", "SKILL.md")
   );
   if (docsSkillInstalled) {
-    if (await fs37.pathExists(path45.join(root, "docs", "SUMMARY.md"))) {
+    if (await fs38.pathExists(path46.join(root, "docs", "SUMMARY.md"))) {
       ok("- PROJECT DOCS: OK (docs/SUMMARY.md present)");
     } else {
       suggest(
@@ -8125,7 +8496,7 @@ async function runDoctor(options) {
     }
   }
   if (workflowExists) {
-    const prettierIgnore = await readText(path45.join(root, ".prettierignore")) ?? "";
+    const prettierIgnore = await readText(path46.join(root, ".prettierignore")) ?? "";
     const lines = prettierIgnore.split("\n");
     const missing = IGNORED_PATHS.filter((p) => !prettierIgnoreProtects(lines, p));
     if (missing.length > 0) {
@@ -8241,8 +8612,53 @@ async function runDoctor(options) {
         "find its catalog id and run `haus recommend --include <id>` then `haus apply --write`, or remove the reference"
       );
     }
-  } else {
-    ok("- SKILL REFS: OK (no unresolved cross-skill references)");
+  }
+  const agentCatalogNames = catalogItems === null ? [] : catalogItems.filter((item) => item.type === "agent").map((item) => installTargetFor(item)).flatMap((target) => target.ok ? [path46.basename(target.relPath, ".md")] : []);
+  const agentRefIssues = await findUnresolvedAgentReferences(root, {
+    catalogAgentNames: agentCatalogNames
+  });
+  if (agentRefIssues.length > 0) {
+    const describeAgent = (i) => `${i.file}:${i.line} "${i.agentName}"`;
+    const installable = agentRefIssues.filter((i) => i.inCatalog);
+    const unknown = agentRefIssues.filter((i) => !i.inCatalog);
+    if (installable.length > 0) {
+      const names = [...new Set(installable.map((i) => i.agentName))];
+      flag(
+        `- AGENT REFS: ${installable.length} reference(s) point at an agent the catalog can install but this project has not (${names.join(", ")}) (${installable.slice(0, 3).map(describeAgent).join("; ")}${installable.length > 3 ? "; \u2026" : ""})`,
+        `${installable.length} rule/agent reference(s) send agents after ${names.join(", ")}, which is available but not installed`,
+        "find its catalog id and run `haus recommend --include <id>` then `haus apply --write`"
+      );
+    }
+    if (unknown.length > 0) {
+      const names = [...new Set(unknown.map((i) => i.agentName))];
+      suggest(
+        `- AGENT REFS: ${unknown.length} reference(s) name an agent that exists neither here nor in the catalog (${names.join(", ")}) (${unknown.slice(0, 3).map(describeAgent).join("; ")}${unknown.length > 3 ? "; \u2026" : ""})`,
+        `${unknown.length} rule/agent reference(s) send agents after ${names.join(", ")}, which was never shipped`,
+        "correct or drop the reference upstream (catalog-owned prose), so agents stop being sent after a tool that does not exist"
+      );
+    }
+  }
+  if (skillRefIssues.length === 0 && agentRefIssues.length === 0) {
+    ok("- SKILL REFS: OK (no unresolved cross-skill or agent references)");
+  }
+  const recommendedIds = new Set(
+    (recommendation?.recommended ?? []).map((entry) => entry.id).filter((id) => typeof id === "string")
+  );
+  if (catalogItems !== null && recommendedIds.size > 0) {
+    const catalogIds = new Set(catalogItems.map((item) => item.id));
+    const excludedIds = new Set(await readProjectExcludedIds(root));
+    const activePinIds = activePins.map((pin) => pin.id);
+    const lockedIds = (await readJson(hausPath(root, "haus.lock.json")) ?? []).map((entry) => entry.id).filter((id) => typeof id === "string");
+    const drifted = lockedIds.filter(
+      (id) => catalogIds.has(id) && !recommendedIds.has(id) && !excludedIds.has(id) && !isSupersededByPlugin(id, activePinIds)
+    );
+    if (drifted.length > 0) {
+      suggest(
+        `- ELIGIBILITY DRIFT: ${drifted.length} installed item(s) are no longer recommended by the current signals (${drifted.slice(0, 3).join(", ")}${drifted.length > 3 ? ", \u2026" : ""})`,
+        `${drifted.length} installed item(s) no longer match anything haus can detect in this repo \u2014 often a role that only \`deep-context.json\` knew about, which is not tracked in git`,
+        "declare the role or stack in .haus-workflow/haus.config.json (declaredRoles / declaredStacks), re-run the docs pass to regenerate deep-context.json, or `haus remove <id>` if the item is genuinely no longer wanted"
+      );
+    }
   }
   if (claudeConfigDirIsRelocated()) {
     const configMigration = await probeGlobalConfigDirMigration();
@@ -8321,10 +8737,10 @@ async function runDoctor(options) {
       );
     } else {
       const lock = await readJson(hausPath(root, "haus.lock.json"));
-      const recommendedIds = new Set(
+      const recommendedIds2 = new Set(
         recommendation.recommended.map((r) => r.id).filter((id) => typeof id === "string")
       );
-      const orphaned = findOrphanedLockEntries(lock ?? [], recommendedIds).map((entry) => entry.id);
+      const orphaned = findOrphanedLockEntries(lock ?? [], recommendedIds2).map((entry) => entry.id);
       if (orphaned.length > 0) {
         suggest(
           `- CATALOG ITEMS: ${orphaned.length} installed item(s) no longer in the current recommendation (${orphaned.join(", ")})`,
@@ -8380,7 +8796,7 @@ async function runDoctor(options) {
       let onDisk = false;
       for (const rel of row.paths ?? []) {
         const abs = resolveContainedPath(root, rel);
-        if (abs !== null && await fs37.pathExists(abs)) {
+        if (abs !== null && await fs38.pathExists(abs)) {
           onDisk = true;
           break;
         }
@@ -8396,7 +8812,7 @@ async function runDoctor(options) {
       );
     }
   }
-  const pkgJson = await readJson(path45.join(packageRoot(), "package.json"));
+  const pkgJson = await readJson(path46.join(packageRoot(), "package.json"));
   const currentVersion = pkgJson?.version ?? "0.0.0";
   const npmStatus = await fetchNpmVersionStatus(currentVersion);
   if (npmStatus.updateAvailable && npmStatus.latest !== null) {
@@ -8447,15 +8863,15 @@ async function runDoctor(options) {
 }
 
 // src/commands/update.ts
-import path48 from "node:path";
+import path49 from "node:path";
 init_github_rate_limit();
 
 // src/claude/refresh-project.ts
-import fs38 from "fs-extra";
+import fs39 from "fs-extra";
 init_fs();
 init_paths();
 async function isHausProject(root) {
-  if (await fs38.pathExists(hausPath(root, "recommendation.json"))) return true;
+  if (await fs39.pathExists(hausPath(root, "recommendation.json"))) return true;
   const result = await readJsonDetailed(claudePath(root, "settings.json"));
   if (result.status === "ok") return result.value._haus != null;
   return false;
@@ -8471,8 +8887,8 @@ async function refreshProjectApply(root) {
 
 // src/install/apply.ts
 import crypto2 from "node:crypto";
-import path46 from "node:path";
-import fs39 from "fs-extra";
+import path47 from "node:path";
+import fs40 from "fs-extra";
 init_fs();
 init_logger();
 init_paths();
@@ -8482,6 +8898,17 @@ var MD_PREFIX = "<!-- HAUS-MANAGED";
 var MD_SUFFIX = " -->";
 var FM_FENCE = "---";
 var FM_KEY = "haus_managed";
+var JS_PREFIX = "// HAUS-MANAGED";
+var JS_EXT_RE = /\.[mc]?js$/i;
+var MD_EXT_RE = /\.(md|markdown)$/i;
+function stampableMarkerForm(destPath) {
+  if (JS_EXT_RE.test(destPath)) return "js";
+  if (MD_EXT_RE.test(destPath)) return "markdown";
+  return void 0;
+}
+function isShebang(line2) {
+  return (line2 ?? "").startsWith("#!");
+}
 function parseAttrs(raw) {
   const attrs = parseHausManagedAttrs(raw) ?? parseHausManagedAttrs(`<!-- HAUS-MANAGED ${raw.trim()} -->`);
   if (!attrs?.id || !attrs.v || !attrs.source) return void 0;
@@ -8504,8 +8931,11 @@ function frontmatterMarkerValue(content2) {
   return void 0;
 }
 function parseMarkdownHeader(content2) {
-  const firstLine = content2.split("\n")[0] ?? "";
+  const lines = content2.split("\n");
+  const firstLine = lines[0] ?? "";
   if (firstLine.startsWith(MD_PREFIX)) return parseAttrs(firstLine);
+  const jsLine = isShebang(firstLine) ? lines[1] ?? "" : firstLine;
+  if (jsLine.startsWith(JS_PREFIX)) return parseAttrs(jsLine.slice(JS_PREFIX.length));
   const fmValue = frontmatterMarkerValue(content2);
   if (fmValue !== void 0) return parseAttrs(fmValue);
   return void 0;
@@ -8540,7 +8970,18 @@ function stampFrontmatter(content2, h) {
   ];
   return rebuilt.join("\n");
 }
-function stampMarkdown(content2, h) {
+function buildJsHeader(h) {
+  return `${JS_PREFIX} ${buildMarkerValue(h)}`;
+}
+function stampJs(content2, h) {
+  const lines = content2.split("\n");
+  const at = isShebang(lines[0]) ? 1 : 0;
+  if ((lines[at] ?? "").startsWith(JS_PREFIX)) lines[at] = buildJsHeader(h);
+  else lines.splice(at, 0, buildJsHeader(h));
+  return lines.join("\n");
+}
+function stampMarkdown(content2, h, destPath) {
+  if (destPath !== void 0 && stampableMarkerForm(destPath) === "js") return stampJs(content2, h);
   if (hasFrontmatter(content2)) return stampFrontmatter(content2, h);
   const header = buildMarkdownHeader(h);
   const firstLine = content2.split("\n")[0] ?? "";
@@ -8561,67 +9002,72 @@ function hashContent(content2) {
 }
 function destFileMissing(destPath) {
   try {
-    return !fs39.statSync(destPath).isFile();
+    return !fs40.statSync(destPath).isFile();
   } catch {
     return true;
   }
 }
 function sourceVersion() {
   try {
-    const pkgPath = path46.join(packageRoot(), "package.json");
-    const pkg = JSON.parse(fs39.readFileSync(pkgPath, "utf8"));
+    const pkgPath = path47.join(packageRoot(), "package.json");
+    const pkg = JSON.parse(fs40.readFileSync(pkgPath, "utf8"));
     return `${pkg.name ?? "haus"}@${pkg.version ?? "0.0.0"}`;
   } catch {
     return "haus@0.0.0";
   }
 }
 function globalSrcDir() {
-  return path46.join(packageRoot(), "library", "global");
+  return path47.join(packageRoot(), "library", "global");
 }
 function collectSkillAuxFiles(skillsDir, claudeDir, skillName) {
-  const skillDir = path46.join(skillsDir, skillName);
+  const skillDir = path47.join(skillsDir, skillName);
   const entries = [];
-  for (const rel of fs39.readdirSync(skillDir, { recursive: true })) {
+  for (const rel of fs40.readdirSync(skillDir, { recursive: true })) {
     if (rel === "SKILL.md") continue;
-    const abs = path46.join(skillDir, rel);
-    if (!fs39.statSync(abs).isFile()) continue;
-    const posixRel = rel.split(path46.sep).join("/");
+    const abs = path47.join(skillDir, rel);
+    if (!fs40.statSync(abs).isFile()) continue;
+    const posixRel = rel.split(path47.sep).join("/");
     entries.push({
       stableId: `skill.${skillName}.${posixRel.replace(/\//g, ".")}`,
-      srcRelPath: path46.join("library", "global", "skills", skillName, rel),
-      destPath: path46.join(claudeDir, "skills", skillName, rel)
+      srcRelPath: path47.join("library", "global", "skills", skillName, rel),
+      destPath: path47.join(claudeDir, "skills", skillName, rel)
+    });
+  }
+  return entries;
+}
+function collectFlatChannel(srcDir, claudeDir, dirName, idPrefix) {
+  const entries = [];
+  const channelDir = path47.join(srcDir, dirName);
+  if (!fs40.pathExistsSync(channelDir)) return entries;
+  for (const fileName of fs40.readdirSync(channelDir)) {
+    if (!fileName.endsWith(".md")) continue;
+    const name = fileName.slice(0, -".md".length);
+    entries.push({
+      stableId: `${idPrefix}.${name}`,
+      srcRelPath: path47.join("library", "global", dirName, fileName),
+      destPath: path47.join(claudeDir, dirName, fileName)
     });
   }
   return entries;
 }
 function collectSourceFiles(srcDir, claudeDir) {
   const entries = [];
-  const skillsDir = path46.join(srcDir, "skills");
-  if (fs39.pathExistsSync(skillsDir)) {
-    for (const skillName of fs39.readdirSync(skillsDir)) {
-      const skillFile = path46.join(skillsDir, skillName, "SKILL.md");
-      if (fs39.pathExistsSync(skillFile)) {
+  const skillsDir = path47.join(srcDir, "skills");
+  if (fs40.pathExistsSync(skillsDir)) {
+    for (const skillName of fs40.readdirSync(skillsDir)) {
+      const skillFile = path47.join(skillsDir, skillName, "SKILL.md");
+      if (fs40.pathExistsSync(skillFile)) {
         entries.push({
           stableId: `skill.${skillName}`,
-          srcRelPath: path46.join("library", "global", "skills", skillName, "SKILL.md"),
-          destPath: path46.join(claudeDir, "skills", skillName, "SKILL.md")
+          srcRelPath: path47.join("library", "global", "skills", skillName, "SKILL.md"),
+          destPath: path47.join(claudeDir, "skills", skillName, "SKILL.md")
         });
         entries.push(...collectSkillAuxFiles(skillsDir, claudeDir, skillName));
       }
     }
   }
-  const commandsDir = path46.join(srcDir, "commands");
-  if (fs39.pathExistsSync(commandsDir)) {
-    for (const fileName of fs39.readdirSync(commandsDir)) {
-      if (!fileName.endsWith(".md")) continue;
-      const commandName = fileName.slice(0, -".md".length);
-      entries.push({
-        stableId: `command.${commandName}`,
-        srcRelPath: path46.join("library", "global", "commands", fileName),
-        destPath: path46.join(claudeDir, "commands", fileName)
-      });
-    }
-  }
+  entries.push(...collectFlatChannel(srcDir, claudeDir, "commands", "command"));
+  entries.push(...collectFlatChannel(srcDir, claudeDir, "agents", "agent"));
   return entries;
 }
 async function applyInstall(options = {}) {
@@ -8650,17 +9096,25 @@ async function applyInstall(options = {}) {
   };
   const manifestFiles = [];
   for (const entry of sourceFiles) {
-    const srcPath = path46.join(packageRoot(), entry.srcRelPath);
+    const srcPath = path47.join(packageRoot(), entry.srcRelPath);
     const rawContent = await readText(srcPath);
     if (rawContent === void 0) {
       warn(`Source file not found: ${entry.srcRelPath}`);
       continue;
     }
-    const stamped = stampMarkdown(rawContent, {
-      stableId: entry.stableId,
-      schemaVersion: SCHEMA_VERSION2,
-      source
-    });
+    if (stampableMarkerForm(entry.destPath) === void 0)
+      throw new Error(
+        `No safe ownership-marker form for ${entry.srcRelPath} \u2014 only .md and .js/.mjs/.cjs aux files can ship in library/global (see ADR-0072)`
+      );
+    const stamped = stampMarkdown(
+      rawContent,
+      {
+        stableId: entry.stableId,
+        schemaVersion: SCHEMA_VERSION2,
+        source
+      },
+      entry.destPath
+    );
     const newHash = hashContent(stamped);
     const existing = manifestByDest.get(entry.destPath);
     if (check) {
@@ -8671,7 +9125,7 @@ async function applyInstall(options = {}) {
       }
       continue;
     }
-    const destExists = fs39.pathExistsSync(entry.destPath);
+    const destExists = fs40.pathExistsSync(entry.destPath);
     if (destExists) {
       const currentContent = await readText(entry.destPath);
       if (currentContent !== void 0) {
@@ -8711,7 +9165,7 @@ async function applyInstall(options = {}) {
   }
   let mergedSettings;
   if (!check) {
-    const fragmentPath = path46.join(srcDir, "settings-fragments", "hooks.json");
+    const fragmentPath = path47.join(srcDir, "settings-fragments", "hooks.json");
     const fragments = await loadHooksFragment(fragmentPath);
     const settings = await readSettings();
     const { settings: hookSettings, addedIds } = mergeHooks(settings, fragments);
@@ -8730,13 +9184,13 @@ async function applyInstall(options = {}) {
         manifestFiles.push(entry);
         continue;
       }
-      if (!fs39.pathExistsSync(entry.destPath)) continue;
+      if (!fs40.pathExistsSync(entry.destPath)) continue;
       const content2 = await readText(entry.destPath);
       if (!content2) continue;
       const hasHeader = parseMarkdownHeader(content2) !== void 0;
       const currentHash = hashContent(content2);
       if (hasHeader && currentHash === entry.hash) {
-        if (!dryRun) await fs39.remove(entry.destPath);
+        if (!dryRun) await fs40.remove(entry.destPath);
         result.deleted.push(entry.destPath);
       } else {
         warn(`Orphaned file ${entry.destPath} was user-modified \u2014 leaving in place`);
@@ -8810,7 +9264,7 @@ function summarizeLockDiff(before, after) {
 // src/update/lockfile.ts
 import { constants as fsConstants } from "node:fs";
 import { copyFile, mkdir, readFile as readFile2 } from "node:fs/promises";
-import path47 from "node:path";
+import path48 from "node:path";
 init_fs();
 init_paths();
 async function readLockSummary(root) {
@@ -8850,7 +9304,7 @@ async function backupLockfile(root) {
     await mkdir(backupDir, { recursive: true });
     let stamp = Date.now();
     for (; ; ) {
-      const dest = path47.join(backupDir, lockBackupFileName(stamp));
+      const dest = path48.join(backupDir, lockBackupFileName(stamp));
       try {
         await copyFile(lockPath, dest, fsConstants.COPYFILE_EXCL);
         return;
@@ -8901,7 +9355,7 @@ function diffLock(before, after) {
 }
 async function hasLocalOverrides(root) {
   try {
-    await readFile2(path47.join(root, ".claude", "settings.json"), "utf8");
+    await readFile2(path48.join(root, ".claude", "settings.json"), "utf8");
     return true;
   } catch {
     return false;
@@ -8946,7 +9400,7 @@ async function runUpdate(options) {
     return;
   }
   if (options.check) {
-    const pkgJson2 = await readJson(path48.join(packageRoot(), "package.json"));
+    const pkgJson2 = await readJson(path49.join(packageRoot(), "package.json"));
     const currentVersion2 = pkgJson2?.version ?? "0.0.0";
     const [
       status,
@@ -8998,7 +9452,7 @@ async function runUpdate(options) {
     }
     return;
   }
-  const pkgJson = await readJson(path48.join(packageRoot(), "package.json"));
+  const pkgJson = await readJson(path49.join(packageRoot(), "package.json"));
   const currentVersion = pkgJson?.version ?? "0.0.0";
   const npmStatus = await fetchNpmVersionStatus(currentVersion);
   if (npmStatus.updateAvailable && npmStatus.latest !== null) {
@@ -9055,7 +9509,7 @@ async function runFromHookCheck(root) {
   try {
     const summary = await readLockSummary(root);
     if (summary.count === 0) return;
-    const pkgJson = await readJson(path48.join(packageRoot(), "package.json"));
+    const pkgJson = await readJson(path49.join(packageRoot(), "package.json"));
     const currentVersion = pkgJson?.version ?? "0.0.0";
     const pin = readProjectCatalogPin(root);
     const honoursPin = pin.kind === "pinned" && summary.catalogRef === pin.ref;
@@ -9239,7 +9693,7 @@ init_exec();
 init_logger();
 import { existsSync as existsSync2 } from "node:fs";
 import { readdir } from "node:fs/promises";
-import path49 from "node:path";
+import path50 from "node:path";
 var GIT_LOCATION_VARS = [
   "GIT_DIR",
   "GIT_WORK_TREE",
@@ -9299,11 +9753,11 @@ async function runClone(url, opts = {}) {
     process.exitCode = 1;
     return;
   }
-  const target = path49.resolve(opts.dir?.trim() || repoNameFromUrl(url));
+  const target = path50.resolve(opts.dir?.trim() || repoNameFromUrl(url));
   if (existsSync2(target) && !await isEmptyDirectory(target)) {
     const check = await checkExistingTarget(target, url);
     if (check.kind === "matches") {
-      log(`\u2022 ${path49.basename(target)} already cloned here, matches ${url} \u2014 skipped`);
+      log(`\u2022 ${path50.basename(target)} already cloned here, matches ${url} \u2014 skipped`);
       return;
     }
     const message2 = check.kind === "not-a-repo" ? `${target} already exists and is not a git repository \u2014 refusing to clone ${url} there. Remove or rename it, or pass a different [dir].` : `${target} already exists as a different repository (origin: ${check.origin ?? "(no origin remote)"}) \u2014 refusing to clone ${url} there. Remove or rename it, or pass a different [dir].`;
@@ -9330,8 +9784,8 @@ async function runClone(url, opts = {}) {
 
 // src/install/scaffold.ts
 init_logger();
-import path50 from "node:path";
-import fs40 from "fs-extra";
+import path51 from "node:path";
+import fs41 from "fs-extra";
 async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
   const scaffolded = [];
   const skipped = [];
@@ -9344,27 +9798,27 @@ async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
     skipped.push(name);
     if (outcome === "skipped-exists") skippedExisting.push(name);
   };
-  const realRoot = await fs40.realpath(catalogRoot).catch(() => null);
+  const realRoot = await fs41.realpath(catalogRoot).catch(() => null);
   for (const item of items) {
     if (item.type !== "config") continue;
-    const sourcePath = path50.resolve(catalogRoot, item.path);
-    const rel = path50.relative(catalogRoot, sourcePath);
-    const escapes = rel === "" || path50.isAbsolute(rel) || rel.split(/[/\\]/).some((seg) => seg === "..");
+    const sourcePath = path51.resolve(catalogRoot, item.path);
+    const rel = path51.relative(catalogRoot, sourcePath);
+    const escapes = rel === "" || path51.isAbsolute(rel) || rel.split(/[/\\]/).some((seg) => seg === "..");
     if (escapes) {
       warn(`Skipping ${item.id}: path '${item.path}' escapes the catalog root`);
       continue;
     }
-    const realSource = await fs40.realpath(sourcePath).catch(() => null);
+    const realSource = await fs41.realpath(sourcePath).catch(() => null);
     if (!realRoot || !realSource) {
       warn(`Skipping ${item.id}: source not found at ${sourcePath}`);
       continue;
     }
-    const realRel = path50.relative(realRoot, realSource);
-    if (realRel !== "" && (path50.isAbsolute(realRel) || realRel.split(/[/\\]/)[0] === "..")) {
+    const realRel = path51.relative(realRoot, realSource);
+    if (realRel !== "" && (path51.isAbsolute(realRel) || realRel.split(/[/\\]/)[0] === "..")) {
       warn(`Skipping ${item.id}: path '${item.path}' resolves outside the catalog root`);
       continue;
     }
-    const stat = await fs40.lstat(sourcePath).catch(() => null);
+    const stat = await fs41.lstat(sourcePath).catch(() => null);
     if (!stat) {
       warn(`Skipping ${item.id}: source not found at ${sourcePath}`);
       continue;
@@ -9374,14 +9828,14 @@ async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
       continue;
     }
     if (stat.isFile()) {
-      const filename = path50.basename(sourcePath);
-      const dest = path50.join(projectRoot, filename);
+      const filename = path51.basename(sourcePath);
+      const dest = path51.join(projectRoot, filename);
       record(filename, await scaffoldFile(sourcePath, dest, item.id, projectRoot, opts));
     } else if (stat.isDirectory()) {
-      const entries = await fs40.readdir(sourcePath);
+      const entries = await fs41.readdir(sourcePath);
       for (const entry of entries) {
-        const src = path50.join(sourcePath, entry);
-        const dest = path50.join(projectRoot, entry);
+        const src = path51.join(sourcePath, entry);
+        const dest = path51.join(projectRoot, entry);
         record(entry, await scaffoldFile(src, dest, item.id, projectRoot, opts));
       }
     }
@@ -9389,42 +9843,42 @@ async function scaffoldConfigItems(projectRoot, catalogRoot, items, opts = {}) {
   return { scaffolded, skipped, skippedExisting };
 }
 async function scaffoldFile(src, dest, itemId, projectRoot, opts) {
-  const destDisplay = path50.relative(projectRoot, dest) || path50.basename(dest);
-  const srcStat = await fs40.lstat(src).catch(() => null);
+  const destDisplay = path51.relative(projectRoot, dest) || path51.basename(dest);
+  const srcStat = await fs41.lstat(src).catch(() => null);
   if (!srcStat) {
-    warn(`Skipping ${path50.basename(src)}: source not found`);
+    warn(`Skipping ${path51.basename(src)}: source not found`);
     return "skipped-refused";
   }
   if (srcStat.isSymbolicLink()) {
-    warn(`Skipping ${path50.basename(src)}: source is a symlink`);
+    warn(`Skipping ${path51.basename(src)}: source is a symlink`);
     return "skipped-refused";
   }
-  const exists = await fs40.pathExists(dest);
+  const exists = await fs41.pathExists(dest);
   if (exists && !opts.force) {
     warn(`Skipping ${destDisplay}: already exists \u2014 re-run with --force to overwrite it`);
     return "skipped-exists";
   }
   if (opts.dryRun) {
-    log(`[dry-run] would ${exists ? "overwrite" : "create"} ${path50.basename(dest)} (${itemId})`);
+    log(`[dry-run] would ${exists ? "overwrite" : "create"} ${path51.basename(dest)} (${itemId})`);
     return "scaffolded";
   }
   if (exists && opts.force) {
-    await fs40.remove(dest);
+    await fs41.remove(dest);
   }
-  await fs40.ensureDir(path50.dirname(dest));
-  await fs40.copy(src, dest, {
+  await fs41.ensureDir(path51.dirname(dest));
+  await fs41.copy(src, dest, {
     overwrite: true,
     dereference: false,
     // A vanished/unreadable entry mid-walk must skip that path, not crash the copy.
     filter: (s) => {
       try {
-        return !fs40.lstatSync(s).isSymbolicLink();
+        return !fs41.lstatSync(s).isSymbolicLink();
       } catch {
         return false;
       }
     }
   });
-  if (!opts.quiet) log(`${exists ? "Overwrote" : "Created"} ${path50.basename(dest)} (${itemId})`);
+  if (!opts.quiet) log(`${exists ? "Overwrote" : "Created"} ${path51.basename(dest)} (${itemId})`);
   return "scaffolded";
 }
 
@@ -9553,7 +10007,7 @@ async function runDecisionsGuard(options = {}) {
 }
 
 // src/commands/decisions.ts
-import path51 from "node:path";
+import path52 from "node:path";
 
 // src/decisions/next-number.ts
 async function nextDecisionNumber(root) {
@@ -9664,7 +10118,7 @@ async function runDecisions(sub, arg, options = {}) {
     return;
   }
   if (sub === "validate") {
-    const target = arg ? path51.resolve(root, arg) : void 0;
+    const target = arg ? path52.resolve(root, arg) : void 0;
     if (!target) {
       error("usage: haus decisions validate <path-to-decision.md>");
       process.exitCode = 1;
@@ -9940,61 +10394,6 @@ async function runGuard(kind, _options) {
 // src/claude/setup-core.ts
 init_github_rate_limit();
 
-// src/claude/project-exclusions.ts
-import fs41 from "fs-extra";
-init_project_pin();
-init_fs();
-init_logger();
-init_paths();
-function normalizeExcludedIds(value) {
-  if (!Array.isArray(value)) return [];
-  return [
-    ...new Set(
-      value.filter((entry) => typeof entry === "string" && entry.length > 0)
-    )
-  ];
-}
-async function readProjectExcludedIds(root) {
-  try {
-    const data = await readJson(hausPath(root, PROJECT_CONFIG_FILE));
-    if (!data) return [];
-    return normalizeExcludedIds(data.excludedIds);
-  } catch (err) {
-    if (err.code === "ENOENT") return [];
-    warn(
-      `${PROJECT_CONFIG_REL} could not be read for excludedIds (${err instanceof Error ? err.message : String(err)}) \u2014 treating as none`
-    );
-    return [];
-  }
-}
-function isItemExcluded(item, excluded) {
-  if (excluded.has(item.id)) return true;
-  return normalizeFormerIds(item.formerIds).some((formerId) => excluded.has(formerId));
-}
-async function addProjectExcludedIds(root, ids) {
-  const toAdd = [...new Set(ids.filter((id) => id.length > 0))];
-  if (toAdd.length === 0) return;
-  const file = hausPath(root, PROJECT_CONFIG_FILE);
-  let existing = {};
-  if (await fs41.pathExists(file)) {
-    try {
-      const parsed = JSON.parse(await fs41.readFile(file, "utf8"));
-      if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
-        existing = { ...parsed };
-      } else {
-        warn(`${PROJECT_CONFIG_REL} is not a JSON object \u2014 rewriting with excludedIds only`);
-      }
-    } catch (err) {
-      warn(
-        `${PROJECT_CONFIG_REL} could not be parsed (${err instanceof Error ? err.message : String(err)}) \u2014 rewriting with excludedIds only`
-      );
-    }
-  }
-  const merged = normalizeExcludedIds(existing.excludedIds);
-  const next = [.../* @__PURE__ */ new Set([...merged, ...toAdd])].sort();
-  await writeJson(file, { ...existing, excludedIds: next });
-}
-
 // src/recommender/recommend.ts
 init_fs();
 init_paths();
@@ -10055,8 +10454,11 @@ async function recommend(root, context, opts = {}) {
       (x) => x.toLowerCase()
     )
   );
-  const roleSet = /* @__PURE__ */ new Set([...scannerRoles, ...deepRoles]);
-  const stackSet = /* @__PURE__ */ new Set([...scannerStacks, ...deepStacks]);
+  const declared = await readDeclaredContext(root);
+  const declaredRoles = new Set(declared.roles);
+  const declaredStacks = new Set(declared.stacks);
+  const roleSet = /* @__PURE__ */ new Set([...scannerRoles, ...deepRoles, ...declaredRoles]);
+  const stackSet = /* @__PURE__ */ new Set([...scannerStacks, ...deepStacks, ...declaredStacks]);
   const depSet = scannerDeps;
   const recommended = [];
   const skipped = [];
@@ -10071,8 +10473,32 @@ async function recommend(root, context, opts = {}) {
       ...gates ? { gates: gates.map(({ name, passed }) => ({ name, passed })) } : {}
     });
   };
-  const roleSignal = (name) => scannerRoles.has(name.toLowerCase()) ? `role:${name}` : `deep:role:${name}`;
-  const stackSignal = (name) => scannerStacks.has(name.toLowerCase()) ? `tag:${name}` : `deep:tag:${name}`;
+  const roleSignal = (name) => {
+    const key = name.toLowerCase();
+    if (scannerRoles.has(key)) return `role:${name}`;
+    if (declaredRoles.has(key)) return `declared:role:${name}`;
+    return `deep:role:${name}`;
+  };
+  const stackSignal = (name) => {
+    const key = name.toLowerCase();
+    if (scannerStacks.has(key)) return `tag:${name}`;
+    if (declaredStacks.has(key)) return `declared:tag:${name}`;
+    return `deep:tag:${name}`;
+  };
+  const markDeclaredProvenance = (signal) => {
+    if (signal == null) return signal;
+    const separator = signal.indexOf(":");
+    if (separator === -1) return signal;
+    const kind = signal.slice(0, separator);
+    const value = signal.slice(separator + 1).toLowerCase();
+    if (kind === "role" && !scannerRoles.has(value) && declaredRoles.has(value)) {
+      return `declared:${signal}`;
+    }
+    if (kind === "stack" && !scannerStacks.has(value) && declaredStacks.has(value)) {
+      return `declared:${signal}`;
+    }
+    return signal;
+  };
   const buildGateChecks = (item, itemTags, normSource) => {
     const gates = [];
     const add = (name, passed, code, message2, signal) => {
@@ -10220,7 +10646,11 @@ async function recommend(root, context, opts = {}) {
     if (changedMatch)
       push("changed-file-match", "changed file match", `changedFile:${changedMatch}`);
     if (requiresAnySatisfied && !reasons.some((r) => r.code === "stack-match")) {
-      push("requires-any-match", "requires-any signal match", requiresAnySatisfied.signal);
+      push(
+        "requires-any-match",
+        "requires-any signal match",
+        markDeclaredProvenance(requiresAnySatisfied.signal)
+      );
     }
     const gateSummary = gates.map(({ name, passed }) => ({ name, passed }));
     const hasEvidence = reasons.some((r) => r.code !== "default-baseline");
@@ -10252,7 +10682,15 @@ async function recommend(root, context, opts = {}) {
   }
   applyCoInstallSuppression(recommended, skipped);
   applyManualExcludes(excludedIds, items, recommended, skipped);
-  const includeWarnings = applyManualIncludes(opts.include ?? [], items, recommended, skipped);
+  const persistedIncludes = (await readProjectIncludedIds(root)).filter(
+    (id) => !excludedIds.includes(id)
+  );
+  const includeWarnings = applyManualIncludes(
+    [.../* @__PURE__ */ new Set([...opts.include ?? [], ...persistedIncludes])],
+    items,
+    recommended,
+    skipped
+  );
   const optInEligible = buildOptInEligible(items, skipped);
   recommended.sort((a, b) => a.id.localeCompare(b.id));
   skipped.sort((a, b) => a.id.localeCompare(b.id));
@@ -10463,9 +10901,9 @@ function buildOptInEligible(items, skipped) {
 }
 
 // src/commands/workspace/discover.ts
-import path52 from "node:path";
-import fg5 from "fast-glob";
-import YAML2 from "yaml";
+import path53 from "node:path";
+import fg6 from "fast-glob";
+import YAML3 from "yaml";
 init_fs();
 init_logger();
 var DEFAULT_MAX_DEPTH = 3;
@@ -10500,16 +10938,16 @@ async function findRepoRoots(workspaceRoot, maxDepth = DEFAULT_MAX_DEPTH) {
     suppressErrors: true
   };
   const [gitMatches, manifestMatches] = await Promise.all([
-    fg5(GIT_MARKER, { ...commonOpts, ignore: IGNORE }),
-    fg5(MANIFEST_MARKERS, { ...commonOpts, ignore: [...IGNORE, "**/.git/**"] })
+    fg6(GIT_MARKER, { ...commonOpts, ignore: IGNORE }),
+    fg6(MANIFEST_MARKERS, { ...commonOpts, ignore: [...IGNORE, "**/.git/**"] })
   ]);
   const gitDirs = /* @__PURE__ */ new Set();
   const manifestDirs = /* @__PURE__ */ new Set();
   for (const match of gitMatches) {
-    gitDirs.add(path52.posix.dirname(match));
+    gitDirs.add(path53.posix.dirname(match));
   }
   for (const match of manifestMatches) {
-    manifestDirs.add(path52.posix.dirname(match));
+    manifestDirs.add(path53.posix.dirname(match));
   }
   const repoRoots = [...gitDirs];
   const manifestSorted = [...manifestDirs].sort(
@@ -10526,9 +10964,9 @@ async function findRepoRoots(workspaceRoot, maxDepth = DEFAULT_MAX_DEPTH) {
 async function discoverRepos(workspaceRoot, maxDepth = DEFAULT_MAX_DEPTH) {
   const repoRoots = (await findRepoRoots(workspaceRoot, maxDepth)).filter((dir) => dir !== ".");
   return mapWithConcurrency(repoRoots, async (relDir) => {
-    const absDir = path52.resolve(workspaceRoot, relDir);
-    const pkg = await readJson(path52.join(absDir, "package.json"));
-    const name = typeof pkg?.name === "string" && pkg.name.length > 0 ? pkg.name : path52.basename(absDir);
+    const absDir = path53.resolve(workspaceRoot, relDir);
+    const pkg = await readJson(path53.join(absDir, "package.json"));
+    const name = typeof pkg?.name === "string" && pkg.name.length > 0 ? pkg.name : path53.basename(absDir);
     let role = "auto";
     try {
       const scan = await scanProject(absDir);
@@ -10564,14 +11002,14 @@ function mergeWorkspaceConfig(existing, discovered, opts = {}) {
   };
 }
 function renderWorkspaceYaml(config) {
-  return YAML2.stringify({
+  return YAML3.stringify({
     client: config.client,
     repos: config.repos.map((r) => ({ name: r.name, path: r.path, role: r.role ?? "auto" })),
     relationships: config.relationships
   });
 }
 async function runDiscover(workspaceRoot, opts = {}) {
-  const yamlPath = path52.join(workspaceRoot, "haus.workspace.yaml");
+  const yamlPath = path53.join(workspaceRoot, "haus.workspace.yaml");
   const existingText = await readText(yamlPath);
   const existing = parseWorkspaceConfig(existingText);
   if (existingText && !existing) {
@@ -10955,7 +11393,7 @@ async function runInstall(options, deps = {}) {
         if (result.created.length) parts.push(`${result.created.length} file(s) added`);
         if (result.updated.length) parts.push(`${result.updated.length} file(s) updated`);
         log(
-          parts.length ? `  \u2022 ${parts.join(", ")} in ${claudeConfigDirLabel()} (skills, slash commands)` : "  \u2022 already up to date \u2014 no files changed"
+          parts.length ? `  \u2022 ${parts.join(", ")} in ${claudeConfigDirLabel()} (skills, agents, slash commands)` : "  \u2022 already up to date \u2014 no files changed"
         );
         log(
           `  \u2022 ensured hooks + security rules are present in ${claudeConfigDirLabel()}/settings.json`
@@ -10978,7 +11416,7 @@ async function runInstall(options, deps = {}) {
 }
 
 // src/new-project/create-project.ts
-import path53 from "node:path";
+import path54 from "node:path";
 import fs42 from "fs-extra";
 init_exec();
 init_logger();
@@ -11142,7 +11580,7 @@ var defaultDeps = {
 var NAME_RE = /^[a-z0-9][a-z0-9._-]*$/;
 async function createProject(opts, deps = defaultDeps) {
   const steps = [];
-  const projectPath = path53.resolve(opts.parentDir, opts.name);
+  const projectPath = path54.resolve(opts.parentDir, opts.name);
   const installHint = `cd ${opts.name} && ${opts.pm}${opts.pm === "yarn" ? "" : " install"}`;
   const fail = (step, detail) => {
     steps.push({ step, status: "failed", detail });
@@ -11150,7 +11588,7 @@ async function createProject(opts, deps = defaultDeps) {
   };
   const stack = getStack(opts.stackId);
   if (!stack) return fail("preflight", `Unknown stack "${opts.stackId}". Run \`haus new --list\`.`);
-  if (!NAME_RE.test(opts.name) || opts.name.includes("/") || opts.name.includes("\\") || path53.dirname(projectPath) !== path53.resolve(opts.parentDir)) {
+  if (!NAME_RE.test(opts.name) || opts.name.includes("/") || opts.name.includes("\\") || path54.dirname(projectPath) !== path54.resolve(opts.parentDir)) {
     return fail(
       "preflight",
       `Invalid project name "${opts.name}" (lowercase letters, digits, . _ - only).`
@@ -11234,15 +11672,15 @@ async function createProject(opts, deps = defaultDeps) {
     steps.push({ step: "scaffold", status: "done" });
     phase = "git";
     if (!opts.json) log("\u25B6 git: init/branch/commit");
-    if (!await fs42.pathExists(path53.join(projectPath, ".git"))) {
+    if (!await fs42.pathExists(path54.join(projectPath, ".git"))) {
       const init = await deps.git(["init"], { cwd: projectPath });
       if (init.exitCode !== 0) return fail("git", `git init failed: ${init.stderr}`);
     }
     const branch = await deps.git(["branch", "-M", "main"], { cwd: projectPath });
     if (branch.exitCode !== 0) return fail("git", `git branch -M main failed: ${branch.stderr}`);
     const lockfile = opts.pm === "yarn" ? "yarn.lock" : opts.pm === "pnpm" ? "pnpm-lock.yaml" : "package-lock.json";
-    if (!await fs42.pathExists(path53.join(projectPath, lockfile))) {
-      await fs42.writeFile(path53.join(projectPath, lockfile), "");
+    if (!await fs42.pathExists(path54.join(projectPath, lockfile))) {
+      await fs42.writeFile(path54.join(projectPath, lockfile), "");
     }
     const add = await deps.git(["add", "-A"], { cwd: projectPath });
     if (add.exitCode !== 0) return fail("git", `git add failed: ${add.stderr}`);
@@ -11491,6 +11929,7 @@ async function runRecommend(options) {
   const root = process.cwd();
   const context = await readContextOrScan(root);
   const include = parseIdList(options.include);
+  if (include.length > 0) await addProjectIncludedIds(root, include);
   const activePluginIds = await activeGlobalPluginIds(root);
   const result = await recommend(root, context, { include, activePluginIds });
   await writeJson(hausPath(root, "recommendation.json"), result);
@@ -11511,7 +11950,7 @@ async function runRecommend(options) {
 }
 
 // src/commands/remove.ts
-import path54 from "node:path";
+import path55 from "node:path";
 init_fs();
 init_logger();
 init_paths();
@@ -11616,7 +12055,7 @@ async function runRemove(ids, options = {}) {
   }
   const allAbs = cleared.flatMap(({ existing }) => existing.map(({ abs }) => abs));
   const backupRoot = await backupTrackedPaths(root, allAbs, say, "remove");
-  report.backupDir = backupRoot === null ? null : path54.basename(backupRoot);
+  report.backupDir = backupRoot === null ? null : path55.basename(backupRoot);
   for (const { id, existing } of cleared) {
     await deleteTrackedPaths(root, id, existing, { verb: "Removed", reason: "" }, say);
   }
@@ -11704,7 +12143,7 @@ async function runScan(options) {
 }
 
 // src/commands/undo.ts
-import path55 from "node:path";
+import path56 from "node:path";
 import fs43 from "fs-extra";
 
 // src/claude/managed-paths.ts
@@ -11754,7 +12193,7 @@ async function settingsHasHausContent(root) {
   return settings._haus != null;
 }
 async function claudeMdHasHausBlock(root) {
-  const filePath = path55.join(root, "CLAUDE.md");
+  const filePath = path56.join(root, "CLAUDE.md");
   if (!await fs43.pathExists(filePath)) return false;
   const text = await fs43.readFile(filePath, "utf8");
   return text.includes(BLOCK_BEGIN);
@@ -11767,15 +12206,15 @@ async function stripProjectSettings(root) {
   const hasContent = Object.keys(settings).length > 0;
   if (hasContent) {
     await writeProjectSettings(root, settings);
-    log(`Stripped haus rules from ${path55.relative(root, settingsPath)} (user settings preserved).`);
+    log(`Stripped haus rules from ${path56.relative(root, settingsPath)} (user settings preserved).`);
     return true;
   }
   await fs43.remove(settingsPath);
-  log(`Removed ${path55.relative(root, settingsPath)} (no user-owned settings remained).`);
+  log(`Removed ${path56.relative(root, settingsPath)} (no user-owned settings remained).`);
   return true;
 }
 async function stripRootClaudeMd(root) {
-  const filePath = path55.join(root, "CLAUDE.md");
+  const filePath = path56.join(root, "CLAUDE.md");
   if (!await fs43.pathExists(filePath)) return false;
   const prev = await fs43.readFile(filePath, "utf8");
   if (!prev.includes(BLOCK_BEGIN)) return false;
@@ -11803,12 +12242,12 @@ async function backupManagedFilesBeforeUndo(root, managedAbsPaths) {
   const backupRoot = hausPath(root, "backups", dirBackupDirName("undo", stamp));
   for (const abs of managedAbsPaths) {
     if (!await fs43.pathExists(abs)) continue;
-    const rel = path55.relative(root, abs);
-    const backupPath = path55.join(backupRoot, rel);
-    await fs43.ensureDir(path55.dirname(backupPath));
+    const rel = path56.relative(root, abs);
+    const backupPath = path56.join(backupRoot, rel);
+    await fs43.ensureDir(path56.dirname(backupPath));
     await fs43.copy(abs, backupPath);
   }
-  log(`Backed up ${managedAbsPaths.length} managed file(s) to ${path55.relative(root, backupRoot)}.`);
+  log(`Backed up ${managedAbsPaths.length} managed file(s) to ${path56.relative(root, backupRoot)}.`);
 }
 async function runUndo(options) {
   const root = options.root ?? process.cwd();
@@ -11822,7 +12261,7 @@ async function runUndo(options) {
     log("Nothing to remove: no haus-managed files found in this directory.");
     return;
   }
-  const relTargets = managed.map((p) => path55.relative(root, p));
+  const relTargets = managed.map((p) => path56.relative(root, p));
   const summaryParts = [...relTargets];
   if (stripSettings) summaryParts.push(".claude/settings.json (haus rules only)");
   if (stripClaudeMd) summaryParts.push("CLAUDE.md (haus import block only)");
@@ -11850,7 +12289,7 @@ User-owned .claude/ files will be preserved.`
   for (const abs of coreManaged) {
     if (!await fs43.pathExists(abs)) continue;
     await fs43.remove(abs);
-    log(`Removed ${path55.relative(root, abs)}`);
+    log(`Removed ${path56.relative(root, abs)}`);
   }
   for (const { id, existing } of lockRemovable) {
     await deleteTrackedPaths(root, id, existing, { verb: "Removed" }, log);
@@ -11867,7 +12306,7 @@ init_fs();
 init_logger();
 init_paths();
 import crypto3 from "node:crypto";
-import path56 from "node:path";
+import path57 from "node:path";
 import fs44 from "fs-extra";
 async function runUninstall(options = {}) {
   const { force = false, removePlugins = removeGlobalPlugins } = options;
@@ -11924,14 +12363,14 @@ async function runUninstall(options = {}) {
       continue;
     }
     await fs44.remove(entry.destPath);
-    await pruneEmptyDir(path56.dirname(entry.destPath));
+    await pruneEmptyDir(path57.dirname(entry.destPath));
     result.deleted.push(entry.destPath);
   }
   const settings = await readSettings();
   const stripped = stripHausHooks(stripHausAsk(stripHausAllow(stripHausDeny(settings))));
   await writeSettings(stripped);
   result.hooksStripped = true;
-  const hausDir = path56.join(globalClaudeDir(), "haus");
+  const hausDir = path57.join(globalClaudeDir(), "haus");
   const manifestPath2 = hausManifestPath();
   if (fs44.pathExistsSync(manifestPath2)) {
     await fs44.remove(manifestPath2);
@@ -12008,7 +12447,7 @@ async function runUninstallCommand(options) {
 }
 
 // src/commands/validate-catalog.ts
-import path58 from "node:path";
+import path59 from "node:path";
 
 // src/catalog/validate-core.ts
 init_forbidden_content();
@@ -12016,7 +12455,7 @@ init_manifest_item_fields();
 init_path_safety();
 init_validation_rules2();
 import fs45 from "node:fs";
-import path57 from "node:path";
+import path58 from "node:path";
 var ITEM_SEMVER_RE = /^\d+\.\d+\.\d+$/;
 var ITEM_ID_PATTERN = /^haus\./;
 function auditForbiddenStacks(items) {
@@ -12167,7 +12606,7 @@ function readForAudit(absPath, label, failures) {
   }
 }
 function auditTemplateContent(manifestDir, absPath, itemId) {
-  const rel = path57.relative(manifestDir, absPath);
+  const rel = path58.relative(manifestDir, absPath);
   const failures = [];
   const text = readForAudit(absPath, `${itemId}: ${rel}`, failures);
   if (text === null) return failures;
@@ -12189,25 +12628,25 @@ function auditShippedFiles(manifestDir, items) {
   const failures = [];
   for (const item of items) {
     if (!item.path || !isSafeCatalogPath(item.path)) continue;
-    const absPath = path57.join(manifestDir, item.path);
+    const absPath = path58.join(manifestDir, item.path);
     if (item.type === "skill") {
-      const skillMd = path57.join(absPath, "SKILL.md");
+      const skillMd = path58.join(absPath, "SKILL.md");
       if (!fs45.existsSync(skillMd)) {
-        failures.push(`${item.id}: missing ${path57.relative(manifestDir, skillMd)}`);
+        failures.push(`${item.id}: missing ${path58.relative(manifestDir, skillMd)}`);
         continue;
       }
       const text = readForAudit(skillMd, `${item.id}: SKILL.md`, failures);
       if (text === null) continue;
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: SKILL.md`));
       failures.push(
-        ...auditForbiddenTagsInText(text, `${item.id}: ${path57.relative(manifestDir, skillMd)}`)
+        ...auditForbiddenTagsInText(text, `${item.id}: ${path58.relative(manifestDir, skillMd)}`)
       );
     } else if (item.type === "agent") {
       if (!fs45.existsSync(absPath)) {
         failures.push(`${item.id}: missing agent file ${item.path}`);
         continue;
       }
-      const rel = path57.relative(manifestDir, absPath);
+      const rel = path58.relative(manifestDir, absPath);
       const text = readForAudit(absPath, `${item.id}: ${rel}`, failures);
       if (text === null) continue;
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: ${rel}`));
@@ -12223,7 +12662,7 @@ function auditShippedFiles(manifestDir, items) {
         failures.push(`${item.id}: missing command file ${item.path}`);
         continue;
       }
-      const rel = path57.relative(manifestDir, absPath);
+      const rel = path58.relative(manifestDir, absPath);
       const text = readForAudit(absPath, `${item.id}: ${rel}`, failures);
       if (text === null) continue;
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: ${rel}`));
@@ -12281,7 +12720,7 @@ function walkAllFiles(dir, fn, failures) {
   }
   for (const entry of entries) {
     if (entry.name === ".DS_Store") continue;
-    const full = path57.join(dir, entry.name);
+    const full = path58.join(dir, entry.name);
     if (entry.isDirectory()) walkAllFiles(full, fn, failures);
     else fn(full);
   }
@@ -12305,12 +12744,12 @@ function auditDiskOrphans(manifestDir, items) {
   const failures = [];
   const claimedPaths = items.filter((item) => item.path && isSafeCatalogPath(item.path)).map((item) => item.path.replace(/\\/g, "/"));
   for (const dir of CONTENT_ROOTS) {
-    const abs = path57.join(manifestDir, dir);
+    const abs = path58.join(manifestDir, dir);
     if (!fs45.existsSync(abs)) continue;
     walkAllFiles(
       abs,
       (file) => {
-        const relPath = path57.relative(manifestDir, file).replace(/\\/g, "/");
+        const relPath = path58.relative(manifestDir, file).replace(/\\/g, "/");
         if (!isPathClaimed(relPath, claimedPaths)) {
           failures.push(`orphaned on disk, claimed by no manifest item: ${relPath}`);
         }
@@ -12331,7 +12770,7 @@ function walkMd(dir, fn, failures) {
     return;
   }
   for (const entry of entries) {
-    const full = path57.join(dir, entry.name);
+    const full = path58.join(dir, entry.name);
     if (entry.isDirectory()) walkMd(full, fn, failures);
     else if (entry.name.endsWith(".md")) fn(full);
   }
@@ -12341,13 +12780,13 @@ function auditMarkdownContent(manifestDir, items) {
   const pathSourceMap = buildItemPathSourceMap(items);
   const pathTypeMap = buildItemPathTypeMap(items);
   for (const dir of ["skills", "agents", "templates", "commands", "sources"]) {
-    const abs = path57.join(manifestDir, dir);
+    const abs = path58.join(manifestDir, dir);
     if (!fs45.existsSync(abs)) continue;
     const dirType = DIR_ITEM_TYPE[dir] ?? "";
     walkMd(
       abs,
       (file) => {
-        const rel = path57.relative(manifestDir, file);
+        const rel = path58.relative(manifestDir, file);
         const text = readForAudit(file, rel, failures);
         if (text === null) return;
         const norm = rel.replace(/\\/g, "/");
@@ -12395,8 +12834,8 @@ async function runValidateCatalog(manifestPath2) {
     process.exitCode = 1;
     return;
   }
-  const abs = path58.resolve(process.cwd(), manifestPath2);
-  const manifestDir = path58.dirname(abs);
+  const abs = path59.resolve(process.cwd(), manifestPath2);
+  const manifestDir = path59.dirname(abs);
   const data = await readJson(abs);
   if (!data?.items) {
     error(`Could not read catalog manifest at ${abs}`);
@@ -12417,7 +12856,7 @@ init_logger();
 
 // src/workspace/worktree/add.ts
 init_fs();
-import path65 from "node:path";
+import path66 from "node:path";
 import fs49 from "fs-extra";
 
 // src/workspace/worktree/git-worktree.ts
@@ -12538,12 +12977,12 @@ async function hasUnpushedWork(cwd) {
 }
 
 // src/workspace/worktree/hydrate.ts
-import path61 from "node:path";
+import path62 from "node:path";
 import fs47 from "fs-extra";
 
 // src/workspace/worktree/cow-copy.ts
 init_exec();
-import path59 from "node:path";
+import path60 from "node:path";
 import fs46 from "fs-extra";
 async function getMacFilesystemType(dir) {
   const df = await runCommand("df", ["-P", dir]);
@@ -12578,11 +13017,11 @@ async function cowCopyDir(src, dest) {
   const srcExists = await fs46.pathExists(src);
   if (!srcExists)
     return { strategy: "unsupported", attempted: false, ok: false, error: "source missing" };
-  const strategy = await detectCowStrategy(path59.dirname(dest));
+  const strategy = await detectCowStrategy(path60.dirname(dest));
   if (strategy === "unsupported" || strategy === "unknown-platform") {
     return { strategy, attempted: false, ok: false };
   }
-  await fs46.ensureDir(path59.dirname(dest));
+  await fs46.ensureDir(path60.dirname(dest));
   const args = strategy === "darwin-clonefile" ? ["-c", "-R", src, dest] : ["-a", "--reflink=always", src, dest];
   const result = await runCommand("cp", args);
   return {
@@ -12596,8 +13035,8 @@ async function cowCopyDir(src, dest) {
 // src/workspace/worktree/install.ts
 init_exec();
 import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
-import path60 from "node:path";
-import fg6 from "fast-glob";
+import path61 from "node:path";
+import fg7 from "fast-glob";
 function detectInstallPlan(signals) {
   if (signals.hasYarnLock) {
     return signals.hasPackageManagerField ? { manager: "yarn", command: "corepack", args: ["yarn", "install"] } : { manager: "yarn", command: "yarn", args: ["install"] };
@@ -12617,11 +13056,11 @@ function detectInstallPlan(signals) {
   return { manager: "none" };
 }
 async function computeLockfileSignals(dir) {
-  const hasYarnLock = existsSync3(path60.join(dir, "yarn.lock"));
-  const hasPnpmLock = existsSync3(path60.join(dir, "pnpm-lock.yaml"));
-  const hasPackageLock = existsSync3(path60.join(dir, "package-lock.json"));
-  const hasComposerLock = existsSync3(path60.join(dir, "composer.lock"));
-  const dotnetFiles = await fg6(["**/*.csproj", "**/*.sln"], {
+  const hasYarnLock = existsSync3(path61.join(dir, "yarn.lock"));
+  const hasPnpmLock = existsSync3(path61.join(dir, "pnpm-lock.yaml"));
+  const hasPackageLock = existsSync3(path61.join(dir, "package-lock.json"));
+  const hasComposerLock = existsSync3(path61.join(dir, "composer.lock"));
+  const dotnetFiles = await fg7(["**/*.csproj", "**/*.sln"], {
     cwd: dir,
     onlyFiles: true,
     suppressErrors: true,
@@ -12634,7 +13073,7 @@ async function computeLockfileSignals(dir) {
   });
   const hasDotnetProject = dotnetFiles.length > 0;
   let hasPackageManagerField = false;
-  const pkgPath = path60.join(dir, "package.json");
+  const pkgPath = path61.join(dir, "package.json");
   if (existsSync3(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
@@ -12677,7 +13116,7 @@ function missingYarnrcEnvVars(content2, env) {
   return findRequiredYarnrcEnvVars(content2).filter((name) => env[name] === void 0);
 }
 function missingYarnrcEnvVarsInDir(dir, env) {
-  const yarnrcPath = path60.join(dir, ".yarnrc.yml");
+  const yarnrcPath = path61.join(dir, ".yarnrc.yml");
   if (!existsSync3(yarnrcPath)) return [];
   try {
     return missingYarnrcEnvVars(readFileSync3(yarnrcPath, "utf8"), env);
@@ -12767,8 +13206,8 @@ async function hydrateMember(mainMemberPath, worktreeMemberPath, opts = {}) {
   const start = Date.now();
   const targets = [];
   for (const target of HYDRATION_TARGETS) {
-    const src = path61.join(mainMemberPath, target);
-    const dest = path61.join(worktreeMemberPath, target);
+    const src = path62.join(mainMemberPath, target);
+    const dest = path62.join(worktreeMemberPath, target);
     if (!await fs47.pathExists(src)) continue;
     const destExists = await fs47.pathExists(dest);
     if (!opts.force && destExists) continue;
@@ -12786,11 +13225,11 @@ async function hydrateMember(mainMemberPath, worktreeMemberPath, opts = {}) {
 
 // src/workspace/worktree/local-files.ts
 init_exec();
-import path62 from "node:path";
+import path63 from "node:path";
 import fs48 from "fs-extra";
 var MACHINE_LOCAL_FILES = [
   "docker-compose.local.yml",
-  path62.join(".claude", "settings.local.json")
+  path63.join(".claude", "settings.local.json")
 ];
 async function isTracked(repoRoot, relFile) {
   const gitPath = relFile.replace(/\\/g, "/");
@@ -12800,11 +13239,11 @@ async function isTracked(repoRoot, relFile) {
 async function copyMachineLocalFiles(mainMemberPath, worktreeMemberPath) {
   const copied = [];
   for (const rel of MACHINE_LOCAL_FILES) {
-    const src = path62.join(mainMemberPath, rel);
+    const src = path63.join(mainMemberPath, rel);
     if (!await fs48.pathExists(src)) continue;
     if (await isTracked(mainMemberPath, rel)) continue;
-    const dest = path62.join(worktreeMemberPath, rel);
-    await fs48.ensureDir(path62.dirname(dest));
+    const dest = path63.join(worktreeMemberPath, rel);
+    await fs48.ensureDir(path63.dirname(dest));
     await fs48.copy(src, dest, { overwrite: true });
     copied.push(rel);
   }
@@ -12813,15 +13252,15 @@ async function copyMachineLocalFiles(mainMemberPath, worktreeMemberPath) {
 
 // src/workspace/worktree/root.ts
 import { existsSync as existsSync4 } from "node:fs";
-import path63 from "node:path";
+import path64 from "node:path";
 async function resolveWorkspaceForWorktree(start) {
   const rootInfo = await resolveRoots(start);
   if (!rootInfo.isGitRepo) {
     return { ok: false, reason: "Not inside a git repository." };
   }
   const workspaceRoot = rootInfo.mainRoot;
-  const hasYaml = existsSync4(path63.join(workspaceRoot, WORKSPACE_FILE));
-  const hasManifest = existsSync4(path63.join(workspaceRoot, REPOS_MANIFEST_FILE));
+  const hasYaml = existsSync4(path64.join(workspaceRoot, WORKSPACE_FILE));
+  const hasManifest = existsSync4(path64.join(workspaceRoot, REPOS_MANIFEST_FILE));
   if (!hasYaml && !hasManifest) {
     return {
       ok: false,
@@ -12847,10 +13286,10 @@ function selectMembers(members, only) {
 
 // src/workspace/worktree/state.ts
 init_fs();
-import path64 from "node:path";
+import path65 from "node:path";
 var WORKTREE_STATE_FILE = ".haus-worktree.json";
 function worktreesDir(mainRoot) {
-  return path64.join(mainRoot, ".claude", "worktrees");
+  return path65.join(mainRoot, ".claude", "worktrees");
 }
 function isValidWorktreeSlug(slug) {
   if (slug === "" || slug === "." || slug === "..") return false;
@@ -12863,15 +13302,15 @@ function worktreePath(mainRoot, slug) {
       `Invalid worktree slug ${JSON.stringify(slug)} \u2014 slugs may only contain letters, digits, ".", "_", "-" (no path separators, and not "." or "..").`
     );
   }
-  return path64.join(worktreesDir(mainRoot), slug);
+  return path65.join(worktreesDir(mainRoot), slug);
 }
 async function readWorktreeState(worktreeRoot) {
-  const state = await readJson(path64.join(worktreeRoot, WORKTREE_STATE_FILE));
+  const state = await readJson(path65.join(worktreeRoot, WORKTREE_STATE_FILE));
   if (state == null || typeof state !== "object" || !Array.isArray(state.members)) return void 0;
   return state;
 }
 async function writeWorktreeState(worktreeRoot, state) {
-  await writeJson(path64.join(worktreeRoot, WORKTREE_STATE_FILE), state);
+  await writeJson(path65.join(worktreeRoot, WORKTREE_STATE_FILE), state);
 }
 
 // src/workspace/worktree/add.ts
@@ -12905,7 +13344,7 @@ async function runAdd(opts) {
   const memberResults = [];
   for (const member of selected) {
     const start = Date.now();
-    const memberWorktreePath = path65.join(wsWorktreePath, member.folder);
+    const memberWorktreePath = path66.join(wsWorktreePath, member.folder);
     const outcome = await addWorktree(member.absPath, memberWorktreePath, branch, {
       preferDefaultBranchFrom: true
     });
@@ -12935,7 +13374,7 @@ async function runAdd(opts) {
   await mapWithConcurrency(okResults, async (result) => {
     const member = selected.find((m) => m.id === result.member);
     if (!member) return;
-    const memberWorktreePath = path65.join(wsWorktreePath, member.folder);
+    const memberWorktreePath = path66.join(wsWorktreePath, member.folder);
     const hydrationStart = Date.now();
     if (opts.hydrate !== false) {
       result.hydration = await hydrateMember(member.absPath, memberWorktreePath);
@@ -13002,25 +13441,25 @@ async function runDryRun(args) {
 
 // src/workspace/worktree/doctor.ts
 import { existsSync as existsSync6 } from "node:fs";
-import path67 from "node:path";
+import path68 from "node:path";
 
 // src/workspace/worktree/orphans.ts
 import { existsSync as existsSync5 } from "node:fs";
-import path66 from "node:path";
+import path67 from "node:path";
 var WORKSPACE_REPO_ID = "(workspace)";
 async function findOrphanedRegistrations(repos, wsWorktreesDir) {
   const orphans = [];
   for (const repo of repos) {
     const entries = await listWorktrees(repo.absPath);
     for (const entry of entries) {
-      const entryPath = path66.normalize(entry.path);
-      const marker = `${path66.sep}.claude${path66.sep}worktrees${path66.sep}`;
+      const entryPath = path67.normalize(entry.path);
+      const marker = `${path67.sep}.claude${path67.sep}worktrees${path67.sep}`;
       const idx = entryPath.indexOf(marker);
       if (idx === -1) continue;
       const rest = entryPath.slice(idx + marker.length);
-      const slug = rest.split(path66.sep)[0];
+      const slug = rest.split(path67.sep)[0];
       if (!slug) continue;
-      if (existsSync5(path66.join(wsWorktreesDir, slug))) continue;
+      if (existsSync5(path67.join(wsWorktreesDir, slug))) continue;
       orphans.push({
         repoId: repo.id,
         ownerRepo: repo.absPath,
@@ -13035,7 +13474,7 @@ async function findOrphanedRegistrations(repos, wsWorktreesDir) {
 // src/workspace/worktree/doctor.ts
 var HYDRATION_MARKERS = ["node_modules", "vendor", "obj", "bin"];
 function looksHydrated(memberPath) {
-  return HYDRATION_MARKERS.some((marker) => existsSync6(path67.join(memberPath, marker)));
+  return HYDRATION_MARKERS.some((marker) => existsSync6(path68.join(memberPath, marker)));
 }
 async function runDoctor2() {
   const rootInfo = await resolveRoots();
@@ -13051,7 +13490,7 @@ async function runDoctor2() {
     };
   }
   const workspaceRoot = rootInfo.mainRoot;
-  const isWorkspace = existsSync6(path67.join(workspaceRoot, WORKSPACE_FILE)) || existsSync6(path67.join(workspaceRoot, REPOS_MANIFEST_FILE));
+  const isWorkspace = existsSync6(path68.join(workspaceRoot, WORKSPACE_FILE)) || existsSync6(path68.join(workspaceRoot, REPOS_MANIFEST_FILE));
   if (!isWorkspace) {
     return {
       isWorkspace: false,
@@ -13066,7 +13505,7 @@ async function runDoctor2() {
     };
   }
   const wsWorktreesDir = worktreesDir(workspaceRoot);
-  const underWorktreesDir = rootInfo.repoRoot.startsWith(`${wsWorktreesDir}${path67.sep}`);
+  const underWorktreesDir = rootInfo.repoRoot.startsWith(`${wsWorktreesDir}${path68.sep}`);
   const inWorkspaceWorktree = rootInfo.isLinkedWorktree && underWorktreesDir;
   const workspaceConfig = await readWorkspaceConfig(workspaceRoot);
   const autoHydrate = workspaceConfig?.worktree?.autoHydrate === true;
@@ -13077,10 +13516,10 @@ async function runDoctor2() {
   let slug;
   if (inWorkspaceWorktree) {
     const wtPath = rootInfo.repoRoot;
-    slug = rootInfo.worktreeName ?? path67.basename(wtPath);
+    slug = rootInfo.worktreeName ?? path68.basename(wtPath);
     const state = await readWorktreeState(wtPath);
     for (const member of members) {
-      const memberPath = path67.join(wtPath, member.folder);
+      const memberPath = path68.join(wtPath, member.folder);
       const materialized = existsSync6(memberPath);
       const expectedBranch = state?.members.find((m) => m.folder === member.folder)?.branch ?? state?.branch;
       const actualBranch = materialized ? await currentBranch(memberPath) : void 0;
@@ -13120,7 +13559,7 @@ async function runDoctor2() {
     wsWorktreesDir
   );
   const orphans = orphanScan.map(
-    (o) => `${o.repoId}: worktree registered at ${o.registeredPath} but ${path67.join(wsWorktreesDir, o.slug)} no longer exists.`
+    (o) => `${o.repoId}: worktree registered at ${o.registeredPath} but ${path68.join(wsWorktreesDir, o.slug)} no longer exists.`
   );
   if (orphans.length > 0) {
     problems.push(...orphans);
@@ -13141,7 +13580,7 @@ async function runDoctor2() {
 // src/workspace/worktree/hydrate-command.ts
 init_fs();
 import { existsSync as existsSync7 } from "node:fs";
-import path68 from "node:path";
+import path69 from "node:path";
 async function runHydrateWorktree(opts) {
   const rootInfo = await resolveRoots();
   if (!rootInfo.isGitRepo || !rootInfo.isLinkedWorktree) {
@@ -13152,7 +13591,7 @@ async function runHydrateWorktree(opts) {
   }
   const workspaceRoot = rootInfo.mainRoot;
   const wtPath = rootInfo.repoRoot;
-  if (!wtPath.startsWith(`${worktreesDir(workspaceRoot)}${path68.sep}`)) {
+  if (!wtPath.startsWith(`${worktreesDir(workspaceRoot)}${path69.sep}`)) {
     return {
       ok: false,
       error: "Current worktree is not one of this workspace's .claude/worktrees/<slug> checkouts."
@@ -13164,13 +13603,13 @@ async function runHydrateWorktree(opts) {
     return { ok: false, error: `Unknown --only repo(s): ${unknown.join(", ")}` };
   }
   const state = await readWorktreeState(wtPath);
-  const slug = state?.slug ?? path68.basename(wtPath);
+  const slug = state?.slug ?? path69.basename(wtPath);
   const detectedBranch = await currentBranch(wtPath);
   const targetBranch = state?.branch ?? (detectedBranch !== "HEAD" ? detectedBranch : void 0) ?? slug;
   if (opts.dryRun) {
     const results2 = await Promise.all(
       selected.map(async (member) => {
-        const memberPath = path68.join(wtPath, member.folder);
+        const memberPath = path69.join(wtPath, member.folder);
         if (existsSync7(memberPath)) {
           return { member: member.id, folder: member.folder, status: "planned" };
         }
@@ -13191,7 +13630,7 @@ async function runHydrateWorktree(opts) {
   const results = await mapWithConcurrency(
     selected,
     async (member) => {
-      const memberPath = path68.join(wtPath, member.folder);
+      const memberPath = path69.join(wtPath, member.folder);
       let branchAction;
       if (!existsSync7(memberPath)) {
         if (!opts.materialize) {
@@ -13254,7 +13693,7 @@ async function runHydrateWorktree(opts) {
 }
 
 // src/workspace/worktree/list.ts
-import path69 from "node:path";
+import path70 from "node:path";
 import fs50 from "fs-extra";
 async function runList2() {
   const resolved = await resolveWorkspaceForWorktree();
@@ -13267,12 +13706,12 @@ async function runList2() {
   const configuredMembers = await readMembers(rootInfo);
   const worktrees = [];
   for (const slug of slugs) {
-    const wtPath = path69.join(dir, slug);
+    const wtPath = path70.join(dir, slug);
     const state = await readWorktreeState(wtPath);
     const members = [];
     const source = state?.members ?? configuredMembers.map((m) => ({ id: m.id, folder: m.folder }));
     for (const m of source) {
-      const memberPath = path69.join(wtPath, m.folder);
+      const memberPath = path70.join(wtPath, m.folder);
       const materialized = await fs50.pathExists(memberPath);
       const actualBranch = materialized ? await currentBranch(memberPath) : void 0;
       members.push({
@@ -13334,7 +13773,7 @@ async function runPrune2(opts) {
 }
 
 // src/workspace/worktree/remove.ts
-import path70 from "node:path";
+import path71 from "node:path";
 import fs51 from "fs-extra";
 async function runRemove2(opts) {
   const resolved = await resolveWorkspaceForWorktree();
@@ -13361,7 +13800,7 @@ async function runRemove2(opts) {
     targets.push({
       repo: configMember?.id ?? stateMember.id,
       ownerRepo,
-      path: path70.join(wsWorktreePath, stateMember.folder)
+      path: path71.join(wsWorktreePath, stateMember.folder)
     });
   }
   const existingTargets = [];
@@ -13699,7 +14138,7 @@ async function runWorktree(action, opts = {}) {
 
 // src/commands/workspace.ts
 import { existsSync as existsSync11, statSync as statSync3 } from "node:fs";
-import path79 from "node:path";
+import path80 from "node:path";
 init_fs();
 init_logger();
 
@@ -13758,7 +14197,7 @@ ${summaries.map(
 
 // src/commands/workspace/doctor.ts
 import { existsSync as existsSync8 } from "node:fs";
-import path72 from "node:path";
+import path73 from "node:path";
 init_logger();
 init_paths();
 
@@ -13766,14 +14205,14 @@ init_paths();
 init_fs();
 init_paths();
 import { readFileSync as readFileSync4 } from "node:fs";
-import path71 from "node:path";
+import path72 from "node:path";
 var MANIFEST_FILE2 = "workspace.manifest.json";
 function manifestPath(workspaceRoot) {
   return hausPath(workspaceRoot, MANIFEST_FILE2);
 }
 function hausVersion() {
   try {
-    const pkg = JSON.parse(readFileSync4(path71.join(packageRoot(), "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync4(path72.join(packageRoot(), "package.json"), "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -13865,7 +14304,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
   const manifestByName = new Map(manifest.repos.map((r) => [r.name, r]));
   const catalogRefByRepo = [];
   for (const repo of config.repos) {
-    const repoRoot = path72.resolve(workspaceRoot, repo.path);
+    const repoRoot = path73.resolve(workspaceRoot, repo.path);
     const entry = manifestByName.get(repo.name);
     if (!entry) {
       flag({
@@ -13938,7 +14377,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
         });
         continue;
       }
-      if (!existsSync8(path72.join(workspaceRoot, entry.path))) {
+      if (!existsSync8(path73.join(workspaceRoot, entry.path))) {
         flag({
           repo: entry.repo,
           kind: "missing-linked-context-copy",
@@ -13984,17 +14423,17 @@ function emit(args) {
 init_logger();
 
 // src/workspace/link-context/link.ts
-import path75 from "node:path";
+import path76 from "node:path";
 import fs54 from "fs-extra";
 init_fs();
 init_logger();
 
 // src/workspace/link-context/plan.ts
-import path74 from "node:path";
+import path75 from "node:path";
 import fs53 from "fs-extra";
 
 // src/workspace/link-context/scan-source.ts
-import path73 from "node:path";
+import path74 from "node:path";
 import fs52 from "fs-extra";
 var ASSET_SUBDIR = {
   skill: "skills",
@@ -14003,36 +14442,36 @@ var ASSET_SUBDIR = {
 };
 async function hasLinkableContext(member) {
   for (const subdir of Object.values(ASSET_SUBDIR)) {
-    if (await fs52.pathExists(path73.join(member.absPath, ".claude", subdir))) return true;
+    if (await fs52.pathExists(path74.join(member.absPath, ".claude", subdir))) return true;
   }
   return false;
 }
 async function collectSkills(member) {
-  const dir = path73.join(member.absPath, ".claude", "skills");
+  const dir = path74.join(member.absPath, ".claude", "skills");
   if (!await fs52.pathExists(dir)) return [];
   const names = await fs52.readdir(dir);
   const out = [];
   for (const name of [...names].sort()) {
-    const abs = path73.join(dir, name);
+    const abs = path74.join(dir, name);
     const stat = await fs52.lstat(abs);
     if (!stat.isDirectory()) continue;
-    if (!await fs52.pathExists(path73.join(abs, "SKILL.md"))) continue;
-    out.push({ type: "skill", name, sourceRelPath: path73.posix.join(".claude", "skills", name) });
+    if (!await fs52.pathExists(path74.join(abs, "SKILL.md"))) continue;
+    out.push({ type: "skill", name, sourceRelPath: path74.posix.join(".claude", "skills", name) });
   }
   return out;
 }
 async function collectFlatMarkdown(member, type) {
   const subdir = ASSET_SUBDIR[type];
-  const dir = path73.join(member.absPath, ".claude", subdir);
+  const dir = path74.join(member.absPath, ".claude", subdir);
   if (!await fs52.pathExists(dir)) return [];
   const names = await fs52.readdir(dir);
   const out = [];
   for (const fileName of [...names].sort()) {
     if (!fileName.endsWith(".md")) continue;
-    const abs = path73.join(dir, fileName);
+    const abs = path74.join(dir, fileName);
     if (!(await fs52.lstat(abs)).isFile()) continue;
     const name = fileName.slice(0, -".md".length);
-    out.push({ type, name, sourceRelPath: path73.posix.join(".claude", subdir, fileName) });
+    out.push({ type, name, sourceRelPath: path74.posix.join(".claude", subdir, fileName) });
   }
   return out;
 }
@@ -14047,9 +14486,9 @@ async function collectSourceAssets(member) {
 
 // src/workspace/link-context/plan.ts
 function repoFolderPrefix(member) {
-  const base = path74.posix.basename(member.folder);
+  const base = path75.posix.basename(member.folder);
   if (base && base !== "." && base !== "/") return base;
-  const fromAbs = path74.basename(member.absPath);
+  const fromAbs = path75.basename(member.absPath);
   return fromAbs || member.id;
 }
 function assetKey(type, destKey) {
@@ -14106,7 +14545,7 @@ async function buildLinkPlan(members) {
       name: asset.name,
       destKey,
       sourceRelPath: asset.sourceRelPath,
-      sourceAbsPath: path74.join(member.absPath, asset.sourceRelPath),
+      sourceAbsPath: path75.join(member.absPath, asset.sourceRelPath),
       sourceHash
     });
   }
@@ -14117,7 +14556,7 @@ async function buildLinkPlan(members) {
 function destRelPathFor(type, destKey) {
   const subdir = `${type}s`;
   const leaf = type === "skill" ? destKey : `${destKey}.md`;
-  return path75.posix.join(".claude", subdir, leaf);
+  return path76.posix.join(".claude", subdir, leaf);
 }
 async function runLinkContext(workspaceRoot, opts = {}) {
   const write = resolveWriteMode(opts, "preview-by-default").kind === "write";
@@ -14143,9 +14582,9 @@ async function runLinkContext(workspaceRoot, opts = {}) {
   const linkedAt = (/* @__PURE__ */ new Date()).toISOString();
   for (const entry of plan.entries) {
     const destRel = destRelPathFor(entry.type, entry.destKey);
-    const destAbs = path75.join(workspaceRoot, destRel);
+    const destAbs = path76.join(workspaceRoot, destRel);
     if (write) {
-      await fs54.ensureDir(path75.dirname(destAbs));
+      await fs54.ensureDir(path76.dirname(destAbs));
       if (await fs54.pathExists(destAbs)) await fs54.remove(destAbs);
       await fs54.copy(entry.sourceAbsPath, destAbs, {
         overwrite: true,
@@ -14234,10 +14673,10 @@ async function runWorkspaceLinkContext(workspaceRoot, opts = {}) {
 
 // src/commands/workspace/setup.ts
 import { existsSync as existsSync9, statSync } from "node:fs";
-import path77 from "node:path";
+import path78 from "node:path";
 
 // src/claude/write-workspace-claude-md.ts
-import path76 from "node:path";
+import path77 from "node:path";
 import fs55 from "fs-extra";
 init_fs();
 init_logger();
@@ -14251,16 +14690,19 @@ function buildWorkspaceImportBlock(client, members) {
     `# Workspace: ${client}`,
     "",
     "Member repos:",
+    "",
     ...memberLines
   ].join("\n");
   return `${WORKSPACE_BLOCK_BEGIN}
+
 ${body}
+
 ${WORKSPACE_BLOCK_END}`;
 }
 async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
   const block = buildWorkspaceImportBlock(opts.client, opts.members);
   const dryRun = opts.dryRun ?? false;
-  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path76.join(workspaceRoot, "CLAUDE.md");
+  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path77.join(workspaceRoot, "CLAUDE.md");
   const say = opts.quiet ? () => {
   } : log;
   const existed = await fs55.pathExists(filePath);
@@ -14293,20 +14735,20 @@ async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
 init_fs();
 init_logger();
 function resolveWorkspaceRoot(start = process.cwd()) {
-  let dir = path77.resolve(start);
+  let dir = path78.resolve(start);
   for (; ; ) {
-    if (existsSync9(path77.join(dir, WORKSPACE_FILE))) return dir;
-    const parent = path77.dirname(dir);
-    if (parent === dir) return path77.resolve(start);
+    if (existsSync9(path78.join(dir, WORKSPACE_FILE))) return dir;
+    const parent = path78.dirname(dir);
+    if (parent === dir) return path78.resolve(start);
     dir = parent;
   }
 }
 function isRootRepo(workspaceRoot, repoPath) {
-  return path77.resolve(workspaceRoot, repoPath) === path77.resolve(workspaceRoot);
+  return path78.resolve(workspaceRoot, repoPath) === path78.resolve(workspaceRoot);
 }
 async function runWorkspaceSetup(workspaceRoot, options = {}) {
   const apply = options.write ?? false;
-  const configText = await readText(path77.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path78.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
@@ -14333,7 +14775,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
   const statuses = [];
   const aggregateInputs = [];
   for (const repo of repos) {
-    const repoRoot = path77.resolve(workspaceRoot, repo.path);
+    const repoRoot = path78.resolve(workspaceRoot, repo.path);
     say(`
 \u2192 ${repo.name} (${repo.path})`);
     let res;
@@ -14449,7 +14891,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
       const status = statusByName.get(repo.name);
       const role = repo.role ?? status?.roles?.[0] ?? "auto";
       if (status?.status === "ok") {
-        const lock = await checkLock(path77.resolve(workspaceRoot, repo.path));
+        const lock = await checkLock(path78.resolve(workspaceRoot, repo.path));
         manifestRepos.push({
           name: repo.name,
           path: repo.path,
@@ -14505,7 +14947,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
     try {
       const linkResult = await runLinkContext(workspaceRoot, { write: true, json: options.json });
       if (linkResult.ok) {
-        written.push(...linkResult.added.map((rel) => path77.join(workspaceRoot, rel)));
+        written.push(...linkResult.added.map((rel) => path78.join(workspaceRoot, rel)));
         if (!options.json) {
           say(
             `Linked ${linkResult.linked.length} cross-repo skill/agent/command copy(ies) into .claude/ (${linkResult.added.length} new, ${linkResult.removed.length} removed)${linkResult.skipped.length > 0 ? ` \u2014 ${linkResult.skipped.length} member(s) skipped, see above` : ""}.`
@@ -14538,7 +14980,7 @@ Workspace setup complete: ${ok} ok, ${failed} failed. Wrote ${written.length} fi
 
 // src/commands/workspace/undo.ts
 import { existsSync as existsSync10, statSync as statSync2 } from "node:fs";
-import path78 from "node:path";
+import path79 from "node:path";
 import fs56 from "fs-extra";
 init_fs();
 init_logger();
@@ -14569,7 +15011,7 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
   }
   if (options.dryRun) {
     for (const repo of config.repos) {
-      const repoRoot = path78.resolve(workspaceRoot, repo.path);
+      const repoRoot = path79.resolve(workspaceRoot, repo.path);
       log(`
 \u2192 ${repo.name} (${repo.path})`);
       try {
@@ -14601,11 +15043,11 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
     ];
     for (const abs of workspaceArtifacts) {
       if (await fs56.pathExists(abs)) {
-        log(`[dry-run] Would remove ${path78.relative(workspaceRoot, abs)}`);
+        log(`[dry-run] Would remove ${path79.relative(workspaceRoot, abs)}`);
       }
     }
     if (!await fs56.pathExists(hausPath(workspaceRoot, "WORKSPACE.md"))) {
-      const claudeMd = await readText(path78.join(workspaceRoot, "CLAUDE.md"));
+      const claudeMd = await readText(path79.join(workspaceRoot, "CLAUDE.md"));
       if (claudeMd?.includes(WORKSPACE_BLOCK_BEGIN) || claudeMd && hasLegacyWorkspaceBlock(claudeMd)) {
         log("[dry-run] Would remove the workspace haus import block from CLAUDE.md");
       }
@@ -14624,7 +15066,7 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
   }
   let anyRepoFailed = false;
   for (const repo of config.repos) {
-    const repoRoot = path78.resolve(workspaceRoot, repo.path);
+    const repoRoot = path79.resolve(workspaceRoot, repo.path);
     log(`
 \u2192 ${repo.name} (${repo.path})`);
     try {
@@ -14653,20 +15095,20 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
     const abs = hausPath(workspaceRoot, rel);
     if (await fs56.pathExists(abs)) {
       await fs56.remove(abs);
-      log(`Removed ${path78.relative(workspaceRoot, abs)}`);
+      log(`Removed ${path79.relative(workspaceRoot, abs)}`);
     }
   }
   const manifestFile = manifestPath(workspaceRoot);
   if (await fs56.pathExists(manifestFile)) {
     await fs56.remove(manifestFile);
-    log(`Removed ${path78.relative(workspaceRoot, manifestFile)}`);
+    log(`Removed ${path79.relative(workspaceRoot, manifestFile)}`);
   }
   const workspaceMdPath = hausPath(workspaceRoot, "WORKSPACE.md");
   if (await fs56.pathExists(workspaceMdPath)) {
     await fs56.remove(workspaceMdPath);
-    log(`Removed ${path78.relative(workspaceRoot, workspaceMdPath)}`);
+    log(`Removed ${path79.relative(workspaceRoot, workspaceMdPath)}`);
   } else {
-    const claudeMdPath = path78.join(workspaceRoot, "CLAUDE.md");
+    const claudeMdPath = path79.join(workspaceRoot, "CLAUDE.md");
     if (existsSync10(claudeMdPath)) {
       const prev = await readText(claudeMdPath);
       if (prev?.includes(WORKSPACE_BLOCK_BEGIN)) {
@@ -14735,7 +15177,7 @@ relationships: []
   log("Workspace initialized.");
 }
 async function scanWorkspace(workspaceRoot, opts) {
-  const configText = await readText(path79.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path80.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
@@ -14757,7 +15199,7 @@ async function scanWorkspace(workspaceRoot, opts) {
   const inputs = [];
   const failures = [];
   for (const repo of config.repos) {
-    const repoRoot = path79.resolve(workspaceRoot, repo.path);
+    const repoRoot = path80.resolve(workspaceRoot, repo.path);
     try {
       if (!existsSync11(repoRoot) || !statSync3(repoRoot).isDirectory()) {
         throw new Error("path is not a directory");
@@ -14826,7 +15268,7 @@ init_logger();
 init_paths();
 function cliVersion() {
   try {
-    const pkgPath = path80.join(packageRoot(), "package.json");
+    const pkgPath = path81.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
@@ -14836,7 +15278,7 @@ function cliVersion() {
 var program = new Command();
 function validateRuntimeNodeVersion() {
   try {
-    const pkgPath = path80.join(packageRoot(), "package.json");
+    const pkgPath = path81.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
     const requiredRange = pkg.engines?.node;
     if (requiredRange && !satisfiesVersion(process.version, requiredRange)) {