@haus-tech/haus-workflow 4.7.0 → 4.8.0

package/dist/cli.js

@@ -1369,7 +1369,9 @@ var init_validation_rules = __esm({
         "myid",
         "oidc",
         "azure-ad",
-        "saml2"
+        "saml2",
+        "auth",
+        "next-auth"
       ],
       intentsRequiredTags: [
         "stripe",
@@ -1379,7 +1381,9 @@ var init_validation_rules = __esm({
         "myid",
         "oidc",
         "azure-ad",
-        "saml2"
+        "saml2",
+        "auth",
+        "next-auth"
       ],
       alwaysAllowedTags: [
         "haus",
@@ -1936,8 +1940,8 @@ var init_sync = __esm({
 // src/cli.ts
 init_offline();
 import { readFileSync as readFileSync5 } from "node:fs";
-import path81 from "node:path";
-import { Command } from "commander";
+import path85 from "node:path";
+import { Command, Option } from "commander";
 
 // src/commands/apply.ts
 import checkbox from "@inquirer/checkbox";
@@ -2316,20 +2320,26 @@ var DENY_PATHS = [
   "*.key",
   "*.p12",
   "*.pfx",
+  "*.ppk",
   "id_rsa",
   "id_ed25519",
+  "id_ecdsa",
+  "id_dsa",
   "customer-data",
   "secrets",
   "certs"
 ];
 var DENY_DIRS = /* @__PURE__ */ new Set(["customer-data", "secrets", "certs"]);
 var DENY_PATH_REGEXES = [
-  /(^|\/)[^/]+\.pem$/i,
-  /(^|\/)[^/]+\.key$/i,
-  /(^|\/)[^/]+\.p12$/i,
-  /(^|\/)[^/]+\.pfx$/i,
+  /(^|\/)[^/]*\.pem$/i,
+  /(^|\/)[^/]*\.key$/i,
+  /(^|\/)[^/]*\.p12$/i,
+  /(^|\/)[^/]*\.pfx$/i,
+  /(^|\/)[^/]*\.ppk$/i,
   /(^|\/)id_rsa$/i,
   /(^|\/)id_ed25519$/i,
+  /(^|\/)id_ecdsa$/i,
+  /(^|\/)id_dsa$/i,
   /(^|\/)customer-data(\/|$)/i,
   /(^|\/)secrets(\/|$)/i,
   /(^|\/)certs(\/|$)/i
@@ -2892,6 +2902,9 @@ var ALLOWED_SUBCOMMANDS = [
   "workspace link-context",
   "workspace worktree add",
   "workspace worktree hydrate",
+  // Same class as `hydrate`: materializes and installs, deletes nothing. The
+  // deleters in this family (`remove`, `prune`, `dematerialize`, `reclaim`) stay out.
+  "workspace worktree autohydrate",
   "workspace worktree list",
   "workspace worktree doctor"
 ];
@@ -2956,14 +2969,61 @@ async function readSettings() {
 async function writeSettings(settings) {
   await writeJson(settingsJsonPath(), settings);
 }
-function collectEventHookCommands(entries) {
-  const cmds = /* @__PURE__ */ new Set();
-  for (const entry of entries) {
-    for (const h of entry.hooks ?? []) {
-      if (h.command) cmds.add(h.command);
-    }
+function placementKey(event, matcher) {
+  return `${event}\0${matcher ?? ""}`;
+}
+function collectCanonicalPlacements(fragments) {
+  const placements = /* @__PURE__ */ new Map();
+  for (const fragment of fragments) {
+    if (fragment.gate !== "keep") continue;
+    const key = placementKey(fragment.event, fragment.matcher);
+    const known = placements.get(fragment.command);
+    if (known) known.add(key);
+    else placements.set(fragment.command, /* @__PURE__ */ new Set([key]));
+  }
+  return placements;
+}
+function collectHausOwnedCommands(fragments, priorHaus) {
+  const owned = new Set(priorHaus?.hookCommands ?? []);
+  const trackedIds = new Set(priorHaus?.hooks ?? []);
+  for (const fragment of fragments) {
+    if (fragment.gate === "keep" && trackedIds.has(fragment.id)) owned.add(fragment.command);
+  }
+  return owned;
+}
+function pruneStaleHausPlacements(hooks, canonicalPlacements, hausOwnedCommands) {
+  const kept = {};
+  for (const [event, entries] of Object.entries(hooks)) {
+    const keptEntries = entries.map(
+      (entry) => pruneEntryCommands(entry, (command) => {
+        if (!hausOwnedCommands.has(command)) return false;
+        const placements = canonicalPlacements.get(command);
+        if (!placements) return false;
+        return !placements.has(placementKey(event, entry.matcher));
+      })
+    ).filter((entry) => entry !== null);
+    if (keptEntries.length > 0) kept[event] = keptEntries;
+  }
+  return kept;
+}
+function splitHookMap(hooks) {
+  const usable = {};
+  const foreign = {};
+  for (const [event, entries] of Object.entries(hooks)) {
+    if (Array.isArray(entries)) usable[event] = entries;
+    else foreign[event] = entries;
   }
-  return cmds;
+  return { usable, foreign };
+}
+function entryExistsAtPlacement(entries, matcher, command) {
+  return entries.some(
+    (entry) => (entry.matcher ?? "") === (matcher ?? "") && (entry.hooks ?? []).some((hook) => hook.command === command)
+  );
+}
+function commandPresentAnywhere(hooks, command) {
+  return Object.values(hooks).some(
+    (entries) => (entries ?? []).some((entry) => (entry.hooks ?? []).some((hook) => hook.command === command))
+  );
 }
 function pruneEntryCommands(entry, shouldDrop) {
   const keptHooks = (entry.hooks ?? []).filter((hook) => {
@@ -3011,17 +3071,25 @@ function reconcileRetiredHausHooks(updated, fragments, priorHaus, addedIds, adde
 function mergeHooks(settings, fragments) {
   const existing = settings._haus?.hooks ?? [];
   const existingCommands = settings._haus?.hookCommands ?? [];
+  const { usable, foreign } = splitHookMap(settings.hooks ?? {});
   const updated = { ...settings };
-  updated.hooks = { ...settings.hooks ?? {} };
+  updated.hooks = { ...usable };
   const addedIds = [];
   const addedCommands = [];
+  const canonicalPlacements = collectCanonicalPlacements(fragments);
+  const hausOwnedCommands = collectHausOwnedCommands(fragments, settings._haus);
+  updated.hooks = pruneStaleHausPlacements(updated.hooks, canonicalPlacements, hausOwnedCommands);
   for (const fragment of fragments) {
     if (fragment.gate !== "keep") continue;
     const event = fragment.event;
     const eventEntries = updated.hooks[event] ?? [];
-    const presentCommands = collectEventHookCommands(eventEntries);
-    if (presentCommands.has(fragment.command)) {
-      if (!existingCommands.includes(fragment.command)) addedCommands.push(fragment.command);
+    if (entryExistsAtPlacement(eventEntries, fragment.matcher, fragment.command)) {
+      if (existing.includes(fragment.id) && !existingCommands.includes(fragment.command)) {
+        addedCommands.push(fragment.command);
+      }
+      continue;
+    }
+    if (!hausOwnedCommands.has(fragment.command) && commandPresentAnywhere(updated.hooks, fragment.command)) {
       continue;
     }
     if (!updated.hooks[event]) updated.hooks[event] = [];
@@ -3034,6 +3102,11 @@ function mergeHooks(settings, fragments) {
     if (!existingCommands.includes(fragment.command)) addedCommands.push(fragment.command);
   }
   reconcileRetiredHausHooks(updated, fragments, settings._haus, addedIds, addedCommands);
+  for (const [event, value] of Object.entries(foreign)) {
+    if (updated.hooks[event] === void 0) {
+      updated.hooks[event] = value;
+    }
+  }
   return { settings: updated, addedIds };
 }
 function reconcileManagedRules(existing, prevTracked, newRules) {
@@ -3152,15 +3225,20 @@ async function loadHooksFragment(fragmentPath) {
 }
 
 // src/security/dangerous-commands.ts
+var RUNTIME_ONLY_DENY_COMMANDS = ["drop database", "truncate table"];
 var DENY_COMMANDS = [
   "sudo",
   "chmod -R 777",
   "git push --force",
   "git push --force-with-lease",
   "git push -f",
-  "drop database",
-  "truncate table",
+  // Skipping the hooks is a NEVER rule in WORKFLOW.md and was missing from every tier.
+  "git commit --no-verify",
+  "git push --no-verify",
+  ...RUNTIME_ONLY_DENY_COMMANDS,
   "npm publish",
+  // Classic v1 syntax alongside the Berry `yarn npm publish` form.
+  "yarn publish",
   "yarn npm publish",
   "pnpm publish"
 ];
@@ -3187,14 +3265,15 @@ function buildAskRules() {
 }
 
 // src/security/deny-rules.ts
-var FILE_TOOLS = ["Read", "Edit", "Write"];
+var FILE_TOOLS = ["Read", "Edit", "Write", "NotebookEdit"];
 function buildDenyRules() {
   const rules = [];
   for (const command of DENY_COMMANDS) {
+    if (RUNTIME_ONLY_DENY_COMMANDS.includes(command)) continue;
     rules.push(`Bash(${command}:*)`);
   }
-  for (const path82 of DENY_PATHS) {
-    const pattern = DENY_DIRS.has(path82) ? `${path82}/**` : path82;
+  for (const path86 of DENY_PATHS) {
+    const pattern = DENY_DIRS.has(path86) ? `${path86}/**` : path86;
     for (const tool of FILE_TOOLS) {
       rules.push(`${tool}(${pattern})`);
     }
@@ -3211,7 +3290,7 @@ var PROJECT_HOOK_FRAGMENTS = [
     id: "haus.guard-file",
     gate: "keep",
     event: "PreToolUse",
-    matcher: "Read|Edit|Write",
+    matcher: "Read|Edit|Write|NotebookEdit",
     command: "haus guard file-access --from-hook"
   },
   {
@@ -3248,6 +3327,13 @@ var PROJECT_HOOK_FRAGMENTS = [
     event: "SessionStart",
     matcher: "*",
     command: "haus workspace worktree doctor --from-hook"
+  },
+  {
+    id: "hook.workspace.worktree-autohydrate",
+    gate: "keep",
+    event: "SessionStart",
+    matcher: "*",
+    command: "haus workspace worktree autohydrate --from-hook"
   }
 ];
 async function readProjectSettings(root) {
@@ -3276,6 +3362,7 @@ async function applyProjectSettingsMerge(root) {
 }
 
 // src/claude/remove-items.ts
+import crypto2 from "node:crypto";
 import path18 from "node:path";
 import fs14 from "fs-extra";
 init_fs();
@@ -3304,14 +3391,44 @@ function classifyBackupName(name) {
 }
 
 // src/claude/remove-items.ts
-async function resolveExistingTrackedPaths(root, itemId, relPaths, warnFn) {
+async function unsafeTrackedPath(root, rel) {
+  const abs = resolveContainedPath(root, rel);
+  if (abs === null) return "escapes-root";
+  if (!await fs14.pathExists(abs)) {
+    try {
+      if ((await fs14.lstat(abs)).isSymbolicLink()) return "symlink";
+    } catch {
+      return null;
+    }
+    return null;
+  }
+  if ((await fs14.lstat(abs)).isSymbolicLink()) return "symlink";
+  const [realAbs, realRoot] = await Promise.all([fs14.realpath(abs), fs14.realpath(root)]);
+  const prefix = realRoot.endsWith(path18.sep) ? realRoot : realRoot + path18.sep;
+  if (realAbs !== realRoot && !realAbs.startsWith(prefix)) return "symlink";
+  return null;
+}
+async function unsafeReasonsFor(root, relPaths) {
+  const reasons = /* @__PURE__ */ new Map();
+  for (const rel of relPaths) {
+    if (reasons.has(rel)) continue;
+    reasons.set(rel, await unsafeTrackedPath(root, rel));
+  }
+  return reasons;
+}
+async function resolveExistingTrackedPaths(root, itemId, relPaths, warnFn, unsafeByRel) {
   const existing = [];
   for (const rel of relPaths) {
-    const abs = resolveContainedPath(root, rel);
-    if (abs === null) {
+    const unsafe = unsafeByRel?.has(rel) ? unsafeByRel.get(rel) ?? null : await unsafeTrackedPath(root, rel);
+    if (unsafe === "escapes-root") {
       warnFn(`Refusing to touch ${itemId}'s recorded path outside the project root: ${rel}`);
       continue;
     }
+    if (unsafe === "symlink") {
+      warnFn(`Refusing to touch ${itemId}'s recorded path through a symlink: ${rel}`);
+      continue;
+    }
+    const abs = path18.resolve(root, rel);
     if (await fs14.pathExists(abs)) existing.push({ rel, abs });
   }
   return existing;
@@ -3327,7 +3444,7 @@ async function hashGateEntry(root, entry, existing) {
 }
 async function backupTrackedPaths(root, absPaths, say, prefix) {
   if (absPaths.length === 0) return null;
-  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const stamp = `${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}-${crypto2.randomBytes(3).toString("hex")}`;
   const backupRoot = hausPath(root, "backups", dirBackupDirName(prefix, stamp));
   for (const abs of absPaths) {
     if (!await fs14.pathExists(abs)) continue;
@@ -3467,7 +3584,7 @@ var CANONICAL_HOOKS = {
   hooks: {
     PreToolUse: [
       {
-        matcher: "Read|Edit|Write",
+        matcher: "Read|Edit|Write|NotebookEdit",
         hooks: [{ type: "command", command: "haus guard file-access --from-hook" }]
       },
       {
@@ -3493,6 +3610,14 @@ var CANONICAL_HOOKS = {
       {
         matcher: "*",
         hooks: [{ type: "command", command: "haus workspace worktree doctor --from-hook" }]
+      },
+      // The acting half of `worktree.autoHydrate` (#419, ADR-0074). Kept separate
+      // from the doctor hook above so `doctor --from-hook` keeps the
+      // side-effect-free contract ADR-0029 gave it, and so the mutating half can
+      // be switched off by removing one entry.
+      {
+        matcher: "*",
+        hooks: [{ type: "command", command: "haus workspace worktree autohydrate --from-hook" }]
       }
     ]
   }
@@ -3502,30 +3627,36 @@ async function loadClaudeHooksSettings() {
 }
 
 // src/claude/verify-hooks-contract.ts
-function collectHookCommands(settings) {
-  const cmds = [];
-  for (const entries of Object.values(settings.hooks ?? {})) {
+function placementKey2(event, matcher, command) {
+  return `${event}\0${matcher ?? ""}\0${command}`;
+}
+function collectHookPlacements(settings) {
+  const placements = /* @__PURE__ */ new Set();
+  for (const [event, entries] of Object.entries(settings.hooks ?? {})) {
+    if (!Array.isArray(entries)) continue;
     for (const entry of entries) {
       for (const h of entry.hooks ?? []) {
-        if (h.command) cmds.push(h.command);
+        if (h.command) placements.add(placementKey2(event, entry.matcher, h.command));
       }
     }
   }
-  return cmds;
+  return placements;
+}
+function coversRules(installed, required) {
+  const present = new Set(installed ?? []);
+  return (required ?? []).every((rule) => present.has(rule));
 }
 function hausHookContractSatisfied(project, canonical) {
-  const present = new Set(collectHookCommands(project));
-  for (const blocks of Object.values(canonical.hooks)) {
+  const present = collectHookPlacements(project);
+  for (const [event, blocks] of Object.entries(canonical.hooks)) {
     for (const block of blocks ?? []) {
       for (const h of block.hooks) {
-        if (!present.has(h.command)) return false;
+        if (!present.has(placementKey2(event, block.matcher, h.command))) return false;
       }
     }
   }
-  const denySet = new Set(project.permissions?.deny ?? []);
-  for (const rule of canonical.permissions?.deny ?? []) {
-    if (!denySet.has(rule)) return false;
-  }
+  if (!coversRules(project.permissions?.deny, canonical.permissions?.deny)) return false;
+  if (!coversRules(project.permissions?.ask, canonical.permissions?.ask)) return false;
   return true;
 }
 async function assertPostApplySettingsHausContract(root) {
@@ -3538,7 +3669,7 @@ async function assertPostApplySettingsHausContract(root) {
   }
   if (!hausHookContractSatisfied(written, canonical)) {
     throw new Error(
-      "haus: post-apply self-check failed: .claude/settings.json missing required haus hooks or deny rules"
+      "haus: post-apply self-check failed: .claude/settings.json is missing required haus hooks (or has them wired to the wrong event/matcher), deny rules, or ask rules"
     );
   }
 }
@@ -3564,7 +3695,7 @@ async function verifyProjectSettingsHooksContract(root) {
   if (!hausHookContractSatisfied(project, canonical)) {
     return {
       ok: false,
-      message: ".claude/settings.json missing required haus hooks or deny rules (regenerate with `haus apply --write`)."
+      message: ".claude/settings.json is missing required haus hooks (or has them wired to the wrong event/matcher), deny rules, or ask rules (regenerate with `haus apply --write`)."
     };
   }
   return { ok: true, message: "settings.json carries required haus hook contract." };
@@ -4279,6 +4410,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
   await cleanupMigratedCatalogItems(root, prevLock, migrations, dryRun, opts.quiet);
   const installedPathsByItem = /* @__PURE__ */ new Map();
   const installedIds = /* @__PURE__ */ new Set();
+  const keptEditedIds = /* @__PURE__ */ new Set();
   const selectedCatalogItems = selectedIds !== void 0 ? rec.recommended.filter((r) => selectedIds.includes(r.id)) : rec.recommended;
   const catalogItemsById = /* @__PURE__ */ new Map();
   for (const recommended of selectedCatalogItems) {
@@ -4386,7 +4518,8 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
         opts.force,
         files,
         installedPathsByItem,
-        installedIds
+        installedIds,
+        keptEditedIds
       )) {
         continue;
       } else if (item.type === "skill") {
@@ -4536,15 +4669,16 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
       const relPaths = installedPathsByItem.get(r.id) ?? [];
       const manifestItem = manifestById.get(r.id);
       const isCurated = manifestItem?.source === "curated";
+      const keptEditedPrev = keptEditedIds.has(r.id) ? prevLockById.get(r.id) : void 0;
       const base = {
         id: r.id,
         type: r.type,
         source: isCurated ? "curated" : "haus",
         version: hausVersion2,
         catalogRef: lockCatalogRef(r.id),
-        hash: await hashInstalledPaths(root, relPaths),
+        hash: keptEditedPrev?.hash ?? await hashInstalledPaths(root, relPaths),
         installMode: "copied",
-        paths: relPaths
+        paths: keptEditedPrev?.paths ?? relPaths
       };
       if (!isCurated || !manifestItem) return base;
       return {
@@ -4573,14 +4707,15 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
   );
   return [...new Set(files)];
 }
-async function hasProtectedUnsafePath(root, relPaths) {
+async function hasProtectedUnsafePath(root, relPaths, unsafeByRel) {
   for (const rel of relPaths) {
-    if (resolveContainedPath(root, rel) !== null) continue;
-    if (await fs23.pathExists(path25.resolve(root, rel))) return true;
+    const unsafe = unsafeByRel.get(rel) ?? null;
+    if (unsafe === "symlink") return true;
+    if (unsafe === "escapes-root" && await fs23.pathExists(path25.resolve(root, rel))) return true;
   }
   return false;
 }
-async function skipLocallyEditedItem(root, itemId, prevEntry, force, files, installedPathsByItem, installedIds) {
+async function skipLocallyEditedItem(root, itemId, prevEntry, force, files, installedPathsByItem, installedIds, keptEditedIds) {
   if (!prevEntry || prevEntry.hash === void 0 || force) return false;
   const existing = await resolveExistingTrackedPaths(root, itemId, prevEntry.paths ?? [], warn);
   if (existing.length === 0) return false;
@@ -4598,6 +4733,7 @@ async function skipLocallyEditedItem(root, itemId, prevEntry, force, files, inst
     existing.map((e) => e.rel)
   );
   installedIds.add(itemId);
+  keptEditedIds.add(itemId);
   return true;
 }
 async function cleanupMigratedCatalogItems(root, prevLock, migrations, dryRun, quiet) {
@@ -4674,8 +4810,9 @@ async function cleanupStaleCatalogItems(root, manifestById, dryRun, quiet, activ
     if (!removedFromManifest && !deprecated && !superseded) continue;
     const relPaths = entry.paths ?? [];
     if (relPaths.length === 0) continue;
-    const existing = await resolveExistingTrackedPaths(root, entry.id, relPaths, warn);
-    if (await hasProtectedUnsafePath(root, relPaths)) {
+    const unsafeByRel = await unsafeReasonsFor(root, relPaths);
+    const existing = await resolveExistingTrackedPaths(root, entry.id, relPaths, warn, unsafeByRel);
+    if (await hasProtectedUnsafePath(root, relPaths, unsafeByRel)) {
       refusedIds.add(entry.id);
       continue;
     }
@@ -4737,8 +4874,9 @@ async function pruneOrphanedCatalogItems(root, prevLock, notOrphanedIds, dryRun,
     if (!entry.id) continue;
     const relPaths = entry.paths ?? [];
     if (relPaths.length === 0) continue;
-    const existing = await resolveExistingTrackedPaths(root, entry.id, relPaths, warn);
-    if (await hasProtectedUnsafePath(root, relPaths)) {
+    const unsafeByRel = await unsafeReasonsFor(root, relPaths);
+    const existing = await resolveExistingTrackedPaths(root, entry.id, relPaths, warn, unsafeByRel);
+    if (await hasProtectedUnsafePath(root, relPaths, unsafeByRel)) {
       refusedIds.add(entry.id);
       continue;
     }
@@ -4783,7 +4921,11 @@ var GITIGNORED_ARTIFACT_PATHS = [
   ".haus-workflow/sources-report.json",
   ".haus-workflow/deep-context.json",
   ".haus-workflow/backups/",
-  ".haus-workflow/llms-cache/"
+  ".haus-workflow/llms-cache/",
+  // Hydration locks and the detached hydration log/last-run record (#419): live
+  // process state and machine-local diagnostics, meaningless in another checkout.
+  ".haus-workflow/locks/",
+  ".haus-workflow/logs/"
 ];
 function findLineMarker3(content2, marker, from = 0) {
   let idx = content2.indexOf(marker, from);
@@ -7509,7 +7651,12 @@ function parseWorkspaceConfig(text) {
     (r) => typeof r === "object" && r !== null && typeof r.name === "string" && typeof r.path === "string"
   ) : [];
   const worktreeRaw = parsed.worktree;
-  const worktree2 = typeof worktreeRaw === "object" && worktreeRaw !== null && !Array.isArray(worktreeRaw) ? { autoHydrate: worktreeRaw.autoHydrate === true } : void 0;
+  const reclaimRaw = worktreeRaw?.reclaimAfterDays;
+  const reclaimAfterDays = typeof reclaimRaw === "number" && Number.isFinite(reclaimRaw) && reclaimRaw > 0 ? reclaimRaw : void 0;
+  const worktree2 = typeof worktreeRaw === "object" && worktreeRaw !== null && !Array.isArray(worktreeRaw) ? {
+    autoHydrate: worktreeRaw.autoHydrate === true,
+    ...reclaimAfterDays !== void 0 ? { reclaimAfterDays } : {}
+  } : void 0;
   return {
     client: typeof obj.client === "string" ? obj.client : "unknown",
     repos,
@@ -8420,10 +8567,10 @@ async function runDoctor(options) {
   } else {
     const workflowContent = await readText(workflowPath) ?? "";
     const firstLine = workflowContent.split("\n")[0] ?? "";
-    if (!firstLine.includes("HAUS-MANAGED")) {
+    const managedHeader = parseHausManagedHeader(firstLine);
+    if (!managedHeader) {
       ok("- .haus-workflow/WORKFLOW.md: OK (user-owned)");
     } else {
-      const storedHashMatch = firstLine.match(/hash=(sha256-[a-f0-9]+)/);
       const bodyContent = workflowContent.slice(firstLine.length + 1);
       const cachePath = path46.join(getCacheDir(), "templates/agentic-workflow-standard.md");
       const bundledPath = path46.join(
@@ -8435,7 +8582,7 @@ async function runDoctor(options) {
       );
       const templatePath = await fs38.pathExists(cachePath) ? cachePath : bundledPath;
       const templateContent = await readText(templatePath);
-      const verdict = checkManagedTamper(bodyContent, storedHashMatch?.[1], templateContent ?? null);
+      const verdict = checkManagedTamper(bodyContent, managedHeader.hash, templateContent ?? null);
       if (verdict.status === "tampered" || verdict.status === "legacy-diverged") {
         let diffNote = "";
         if (templateContent != null) {
@@ -8886,7 +9033,7 @@ async function refreshProjectApply(root) {
 }
 
 // src/install/apply.ts
-import crypto2 from "node:crypto";
+import crypto3 from "node:crypto";
 import path47 from "node:path";
 import fs40 from "fs-extra";
 init_fs();
@@ -8998,7 +9145,7 @@ ${content2}`;
 // src/install/apply.ts
 var SCHEMA_VERSION2 = "1";
 function hashContent(content2) {
-  return `sha256-${crypto2.createHash("sha256").update(normaliseLF(content2)).digest("hex")}`;
+  return `sha256-${crypto3.createHash("sha256").update(normaliseLF(content2)).digest("hex")}`;
 }
 function destFileMissing(destPath) {
   try {
@@ -10345,20 +10492,246 @@ async function runFetchRefs(options) {
   }
 }
 
-// src/security/guard-bash.ts
-function matchesDenyToken(command, denyPhrase) {
-  if (denyPhrase === "sudo") {
-    return /(?:^|[|;&]\s*)sudo\b/i.test(command);
+// src/security/shell-tokens.ts
+var WRAPPER_COMMANDS = /* @__PURE__ */ new Set([
+  "builtin",
+  "command",
+  "env",
+  "exec",
+  "ionice",
+  "nice",
+  "nohup",
+  "setsid",
+  "stdbuf",
+  "time",
+  "timeout",
+  "xargs"
+]);
+var ENV_ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+function commandBaseName(word) {
+  const lowered = word.toLowerCase();
+  const lastSlash = lowered.lastIndexOf("/");
+  return lastSlash === -1 ? lowered : lowered.slice(lastSlash + 1);
+}
+function parseShellSegments(command) {
+  const segments = [];
+  let segment = [];
+  let word = "";
+  let hasUnquoted = false;
+  let started = false;
+  let quote = null;
+  const endWord = () => {
+    if (started) segment.push({ value: word, quoted: !hasUnquoted });
+    word = "";
+    hasUnquoted = false;
+    started = false;
+  };
+  const endSegment = () => {
+    endWord();
+    if (segment.length > 0) segments.push(segment);
+    segment = [];
+  };
+  for (let i = 0; i < command.length; i += 1) {
+    const char = command[i];
+    if (quote) {
+      if (char === quote) quote = null;
+      else {
+        word += char;
+        started = true;
+      }
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      started = true;
+      continue;
+    }
+    if (char === "\\") {
+      const next = command[i + 1];
+      if (next === "\n") {
+        i += 1;
+        continue;
+      }
+      if (next !== void 0) {
+        word += next;
+        hasUnquoted = true;
+        started = true;
+        i += 1;
+      }
+      continue;
+    }
+    if (";&|\n`(){}".includes(char)) {
+      endSegment();
+      continue;
+    }
+    if (/\s/.test(char)) {
+      endWord();
+      continue;
+    }
+    word += char;
+    hasUnquoted = true;
+    started = true;
   }
-  const normalizedCommand = command.replace(/["'`]/g, "").toLowerCase().replace(/\s+/g, " ").trim();
-  return normalizedCommand.includes(denyPhrase.toLowerCase());
+  endSegment();
+  return segments;
 }
-function guardBash(command) {
-  const matched = DENY_COMMANDS.find((denyPhrase) => matchesDenyToken(command, denyPhrase));
-  if (matched) return `I didn't run that \u2014 it can permanently change or delete things: ${command}`;
+function commandWords(segment) {
+  const words = segment.filter((token) => !(token.quoted && /\s/.test(token.value))).map((token) => token.value);
+  let start = 0;
+  while (start < words.length) {
+    const word = words[start];
+    if (ENV_ASSIGNMENT.test(word)) {
+      start += 1;
+      continue;
+    }
+    if (WRAPPER_COMMANDS.has(commandBaseName(word))) {
+      start += 1;
+      while (start < words.length && words[start].startsWith("-")) start += 1;
+      continue;
+    }
+    break;
+  }
+  return words.slice(start);
+}
+
+// src/security/dangerous-command-shapes.ts
+var FORCE_PUSH_FLAGS = /* @__PURE__ */ new Set(["--force", "-f", "--force-with-lease", "--force-if-includes"]);
+var SQL_CLIENTS = /* @__PURE__ */ new Set([
+  "clickhouse-client",
+  "cockroach",
+  "mariadb",
+  "mongo",
+  "mongosh",
+  "mycli",
+  "mysql",
+  "pgcli",
+  "psql",
+  "sqlite",
+  "sqlite3"
+]);
+var PUBLISHERS = /* @__PURE__ */ new Set(["bun", "npm", "pnpm", "yarn"]);
+var RUN_SCRIPT_VERBS = ["run", "run-script", "rum", "urn"];
+function shortFlagGroupHas(word, flag) {
+  return /^-[A-Za-z]+$/.test(word) && !word.startsWith("--") && word.slice(1).includes(flag);
+}
+function commandName(words) {
+  return commandBaseName(words[0] ?? "");
+}
+function hasWord(words, name) {
+  return words.some((word) => word.toLowerCase() === name);
+}
+var GIT_VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "-c",
+  "-C",
+  "--config-env",
+  "--exec-path",
+  "--git-dir",
+  "--namespace",
+  "--work-tree"
+]);
+var GIT_TEXT_FLAGS = /* @__PURE__ */ new Set(["-m", "--message", "-F", "--file"]);
+function gitSubcommand(words) {
+  if (commandName(words) !== "git") return void 0;
+  for (let i = 1; i < words.length; i += 1) {
+    const word = words[i];
+    if (GIT_VALUE_FLAGS.has(word)) {
+      i += 1;
+      continue;
+    }
+    if (word.startsWith("-")) continue;
+    return word.toLowerCase();
+  }
+  return void 0;
+}
+function gitArguments(words) {
+  const args = [];
+  for (let i = 1; i < words.length; i += 1) {
+    const word = words[i];
+    if (GIT_VALUE_FLAGS.has(word) || GIT_TEXT_FLAGS.has(word)) {
+      i += 1;
+      continue;
+    }
+    args.push(word);
+  }
+  return args;
+}
+function isForcePush(words) {
+  if (gitSubcommand(words) !== "push") return false;
+  return gitArguments(words).some(
+    (word) => FORCE_PUSH_FLAGS.has(word) || word.startsWith("--force-with-lease=") || shortFlagGroupHas(word, "f") || /^\+\S+/.test(word)
+  );
+}
+function isHookBypass(words) {
+  const subcommand = gitSubcommand(words);
+  if (subcommand !== "commit" && subcommand !== "push") return false;
+  const args = gitArguments(words);
+  if (args.some((word) => word === "--no-verify" || word.startsWith("--no-verify="))) return true;
+  return subcommand === "commit" && args.some((word) => shortFlagGroupHas(word, "n"));
+}
+function isWorldWritableMode(word) {
+  if (/^[0-7]+$/.test(word)) {
+    return (Number(word.slice(-1)) & 2) !== 0;
+  }
+  return word.split(",").some(isWorldWritableClause);
+}
+function isWorldWritableClause(clause) {
+  const symbolic = /^([ugoa]*)([+=])([rwxstugo]+)$/i.exec(clause);
+  if (!symbolic) return false;
+  const [, who, , perms] = symbolic;
+  if (!perms.toLowerCase().includes("w")) return false;
+  const scope = who.toLowerCase();
+  return scope === "" || scope.includes("a") || scope.includes("o");
+}
+function isRecursiveChmod(words) {
+  if (commandName(words) !== "chmod") return false;
+  const recursive = words.some((word) => word === "--recursive" || shortFlagGroupHas(word, "R"));
+  if (!recursive) return false;
+  return words.slice(1).some((word) => !word.startsWith("-") && isWorldWritableMode(word));
+}
+function isPackagePublish(words) {
+  if (!PUBLISHERS.has(commandName(words))) return false;
+  if (!hasWord(words, "publish")) return false;
+  if (RUN_SCRIPT_VERBS.some((verb) => hasWord(words, verb))) return false;
+  return !words.some((word) => word === "--dry-run" || word === "--dry-run=true");
+}
+function isPrivilegeEscalation(words) {
+  return commandName(words) === "sudo";
+}
+function isDestructiveSql(segment) {
+  const words = commandWords(segment);
+  if (words.length === 0) return false;
+  if (words.some((word) => SQL_CLIENTS.has(commandBaseName(word)))) {
+    const text = segment.map((token) => token.value).join(" ").toLowerCase().replace(/\s+/g, " ");
+    return RUNTIME_ONLY_DENY_COMMANDS.some((phrase) => text.includes(phrase));
+  }
+  const spoken = words.join(" ").toLowerCase();
+  return RUNTIME_ONLY_DENY_COMMANDS.some((phrase) => spoken.startsWith(phrase));
+}
+var SEGMENT_MATCHERS = [
+  { name: "a privilege escalation", matches: isPrivilegeEscalation },
+  { name: "a force push", matches: isForcePush },
+  { name: "a commit or push that skips the hooks", matches: isHookBypass },
+  { name: "a recursive permission change", matches: isRecursiveChmod },
+  { name: "a package publish", matches: isPackagePublish }
+];
+function matchDangerousCommandShape(command) {
+  for (const segment of parseShellSegments(command)) {
+    const words = commandWords(segment);
+    if (words.length === 0) continue;
+    const matched = SEGMENT_MATCHERS.find((matcher) => matcher.matches(words));
+    if (matched) return matched.name;
+    if (isDestructiveSql(segment)) return "a destructive database statement";
+  }
   return void 0;
 }
 
+// src/security/guard-bash.ts
+function guardBash(command) {
+  const shape = matchDangerousCommandShape(command);
+  if (!shape) return void 0;
+  return `I didn't run that \u2014 it looks like ${shape}, which can permanently change or delete things: ${command}`;
+}
+
 // src/security/guard-file-access.ts
 function guardFileAccess(candidate) {
   const normalized = normalizePathForMatch(candidate);
@@ -10377,7 +10750,7 @@ async function runGuard(kind, _options) {
   }
   const toolInput = isRecord(payload.tool_input) ? payload.tool_input : {};
   if (kind === "file-access") {
-    const candidate = String(toolInput.path ?? toolInput.file_path ?? "");
+    const candidate = String(toolInput.notebook_path ?? toolInput.path ?? toolInput.file_path ?? "");
     const reason2 = guardFileAccess(candidate);
     if (reason2) {
       emitPreToolUseDeny(reason2);
@@ -10627,7 +11000,7 @@ async function recommend(root, context, opts = {}) {
     const tagMatch = item.tags.find((t) => stackSet.has(t.toLowerCase()));
     if (tagMatch) push("stack-match", "stack/dependency match", stackSignal(tagMatch));
     const pm = context.packageManager;
-    const pmVersionedMatch = pm === "yarn" || pm === "pnpm" ? item.tags.includes(pm) || item.tags.includes(`${pm}4`) || item.tags.includes(`${pm}89`) : item.tags.includes(pm);
+    const pmVersionedMatch = pm === "yarn" || pm === "pnpm" ? itemTags.includes(pm) || itemTags.includes(`${pm}4`) || pm === "pnpm" && itemTags.includes("pnpm89") : itemTags.includes(pm);
     if (pmVersionedMatch) {
       push(
         "package-manager-match",
@@ -11987,17 +12360,19 @@ async function runRemove(ids, options = {}) {
   for (const id of found) {
     const entry = byId.get(id);
     const relPaths = entry.paths ?? [];
-    const hasUnsafePath = relPaths.some((rel) => resolveContainedPath(root, rel) === null);
-    if (hasUnsafePath) {
-      for (const rel of relPaths) {
-        if (resolveContainedPath(root, rel) === null) {
+    const unsafeByRel = await unsafeReasonsFor(root, relPaths);
+    if ([...unsafeByRel.values()].some((reason) => reason !== null)) {
+      for (const [rel, reason] of unsafeByRel) {
+        if (reason === "escapes-root") {
           warn(`Refusing to touch ${id}'s recorded path outside the project root: ${rel}`);
+        } else if (reason === "symlink") {
+          warn(`Refusing to touch ${id}'s recorded path through a symlink: ${rel}`);
         }
       }
       report.skipped.push({ id, reason: "unsafe-path" });
       continue;
     }
-    const existing = await resolveExistingTrackedPaths(root, id, relPaths, warn);
+    const existing = await resolveExistingTrackedPaths(root, id, relPaths, warn, unsafeByRel);
     if (existing.length === 0) {
       if (relPaths.length === 0) {
         warn(`${id} has no recorded paths \u2014 leaving its lock entry in place.`);
@@ -12173,7 +12548,12 @@ async function collectLockTrackedPaths(root) {
   const preserved = [];
   for (const row of lock ?? []) {
     const id = row.id ?? "(unknown item)";
-    const existing = await resolveExistingTrackedPaths(root, id, row.paths ?? [], log);
+    const relPaths = row.paths ?? [];
+    const unsafeByRel = await unsafeReasonsFor(root, relPaths);
+    const existing = await resolveExistingTrackedPaths(root, id, relPaths, log, unsafeByRel);
+    for (const [rel, reason] of unsafeByRel) {
+      if (reason !== null) preserved.push(path56.resolve(root, rel));
+    }
     if (existing.length === 0) continue;
     const gate = await hashGateEntry(root, { hash: row.hash }, existing);
     if (!gate.ok) {
@@ -12305,7 +12685,7 @@ User-owned .claude/ files will be preserved.`
 init_fs();
 init_logger();
 init_paths();
-import crypto3 from "node:crypto";
+import crypto4 from "node:crypto";
 import path57 from "node:path";
 import fs44 from "fs-extra";
 async function runUninstall(options = {}) {
@@ -12354,7 +12734,7 @@ async function runUninstall(options = {}) {
       result.skipped.push(entry.destPath);
       continue;
     }
-    const currentHash = `sha256-${crypto3.createHash("sha256").update(content2).digest("hex")}`;
+    const currentHash = `sha256-${crypto4.createHash("sha256").update(content2).digest("hex")}`;
     if (currentHash !== entry.hash && !force) {
       warn(
         `Skipping user-edited haus file (hash mismatch): ${entry.destPath} \u2014 use --force to delete`
@@ -12561,6 +12941,22 @@ function auditManifestStructure(manifestVersion2, items) {
     if (item.version && !ITEM_SEMVER_RE.test(item.version)) {
       failures.push(`${item.id}: version "${item.version}" is not valid semver (expected X.Y.Z)`);
     }
+    if (typeof item.tokenEstimate === "number" && item.tokenEstimate > 0) {
+      if (typeof item.tokenBudget !== "number") {
+        failures.push(
+          `${item.id}: tokenEstimate ${item.tokenEstimate} but no tokenBudget \u2014 an item that loads into context needs a growth ceiling (estimate + ~30% headroom, so ${Math.ceil(item.tokenEstimate * 1.3)})`
+        );
+      } else if (item.tokenEstimate > item.tokenBudget) {
+        failures.push(
+          `${item.id}: tokenEstimate (${item.tokenEstimate}) exceeds tokenBudget (${item.tokenBudget})`
+        );
+      }
+    }
+    if (item.default !== true && !String(item.ecosystem ?? "").trim()) {
+      failures.push(
+        `${item.id}: non-default item missing ecosystem (it groups alternatives for conflict detection; baseline items are exempt)`
+      );
+    }
     const prev = seenIds.get(item.id);
     if (prev !== void 0) {
       failures.push(`${item.id}: duplicate id (first at index ${prev})`);
@@ -13145,6 +13541,9 @@ function summarizeInstall(install) {
   const details = [...envNotes, ...tail.length > 0 ? tail.split("\n") : []];
   return details.length > 0 ? [head, ...details].join("\n    ") : head;
 }
+function installFailed(install) {
+  return install?.ran === true && install.ok === false;
+}
 function withMissingEnv(result, missingEnvVars) {
   return missingEnvVars.length > 0 ? { ...result, missingEnvVars } : result;
 }
@@ -13202,6 +13601,9 @@ async function runInstallPlan(dir, plan, deps = {}) {
 
 // src/workspace/worktree/hydrate.ts
 var HYDRATION_TARGETS = ["node_modules", "vendor", "obj", "bin"];
+function memberOutcomeOk(member) {
+  return member.status !== "failed" && !installFailed(member.hydration?.install);
+}
 async function hydrateMember(mainMemberPath, worktreeMemberPath, opts = {}) {
   const start = Date.now();
   const targets = [];
@@ -13304,6 +13706,13 @@ function worktreePath(mainRoot, slug) {
   }
   return path65.join(worktreesDir(mainRoot), slug);
 }
+function slugFromWorktreePath(mainRoot, somePath) {
+  const dir = worktreesDir(mainRoot);
+  const prefix = `${dir}${path65.sep}`;
+  if (!somePath.startsWith(prefix)) return void 0;
+  const segment = somePath.slice(prefix.length).split(path65.sep)[0];
+  return segment !== void 0 && segment !== "" ? segment : void 0;
+}
 async function readWorktreeState(worktreeRoot) {
   const state = await readJson(path65.join(worktreeRoot, WORKTREE_STATE_FILE));
   if (state == null || typeof state !== "object" || !Array.isArray(state.members)) return void 0;
@@ -13394,7 +13803,7 @@ async function runAdd(opts) {
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     members: stateMembers
   });
-  const anyFailed = memberResults.some((m) => m.status === "failed");
+  const anyFailed = memberResults.some((m) => !memberOutcomeOk(m));
   return {
     ok: !anyFailed,
     dryRun: false,
@@ -13439,27 +13848,135 @@ async function runDryRun(args) {
   };
 }
 
+// src/workspace/worktree/autohydrate.ts
+import { spawn } from "node:child_process";
+import fsSync from "node:fs";
+import path71 from "node:path";
+import fs51 from "fs-extra";
+
 // src/workspace/worktree/doctor.ts
 import { existsSync as existsSync6 } from "node:fs";
-import path68 from "node:path";
+import path69 from "node:path";
+
+// src/workspace/worktree/hydrate-lock.ts
+init_paths();
+import path67 from "node:path";
+import fs50 from "fs-extra";
+var STALE_LOCK_MS = 30 * 60 * 1e3;
+function locksDir(mainRoot) {
+  return hausPath(mainRoot, "locks");
+}
+function logsDir(mainRoot) {
+  return hausPath(mainRoot, "logs");
+}
+function assertSlug(slug) {
+  if (!isValidWorktreeSlug(slug)) {
+    throw new Error(
+      `Invalid worktree slug ${JSON.stringify(slug)} \u2014 slugs may only contain letters, digits, ".", "_", "-" (no path separators, and not "." or "..").`
+    );
+  }
+  return slug;
+}
+function hydrateLockPath(mainRoot, slug) {
+  return path67.join(locksDir(mainRoot), `hydrate-${assertSlug(slug)}.lock`);
+}
+function hydrateLogPath(mainRoot, slug) {
+  return path67.join(logsDir(mainRoot), `hydrate-${assertSlug(slug)}.log`);
+}
+function hydrateLastRunPath(mainRoot, slug) {
+  return path67.join(logsDir(mainRoot), `hydrate-${assertSlug(slug)}.last.json`);
+}
+function defaultIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+async function readOwnerPid(lockPath) {
+  try {
+    const raw = (await fs50.readFile(path67.join(lockPath, "pid"), "utf8")).trim();
+    if (raw === "") return void 0;
+    const pid = Number.parseInt(raw, 10);
+    return Number.isInteger(pid) && pid > 0 ? pid : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function claim(lockPath, pid) {
+  await fs50.ensureDir(path67.dirname(lockPath));
+  try {
+    await fs50.mkdir(lockPath);
+  } catch {
+    return false;
+  }
+  await fs50.writeFile(path67.join(lockPath, "pid"), String(pid), "utf8");
+  return true;
+}
+async function acquireHydrateLock(mainRoot, slug, deps = {}) {
+  const lockPath = hydrateLockPath(mainRoot, slug);
+  const pid = deps.pid ?? process.pid;
+  const isAlive = deps.isAlive ?? defaultIsAlive;
+  const now = deps.now ?? Date.now;
+  if (await claim(lockPath, pid)) return { acquired: true, lockPath };
+  const ownerPid = await readOwnerPid(lockPath);
+  if (ownerPid !== void 0) {
+    let alive;
+    try {
+      alive = isAlive(ownerPid);
+    } catch {
+      alive = true;
+    }
+    if (alive) return { acquired: false, reason: "live", ownerPid, lockPath };
+  } else {
+    const stat = await fs50.stat(lockPath).catch(() => void 0);
+    if (stat === void 0) {
+      return await claim(lockPath, pid) ? { acquired: true, lockPath } : { acquired: false, reason: "live", lockPath };
+    }
+    if (now() - stat.mtimeMs <= STALE_LOCK_MS) {
+      return { acquired: false, reason: "starting", lockPath };
+    }
+  }
+  await fs50.remove(lockPath);
+  return await claim(lockPath, pid) ? { acquired: true, lockPath } : { acquired: false, reason: "live", ownerPid, lockPath };
+}
+async function recordHydrateLockOwner(mainRoot, slug, pid) {
+  await fs50.writeFile(path67.join(hydrateLockPath(mainRoot, slug), "pid"), String(pid), "utf8");
+}
+async function releaseHydrateLock(mainRoot, slug) {
+  await fs50.remove(hydrateLockPath(mainRoot, slug));
+}
+async function readHydrateLock(mainRoot, slug) {
+  const lockPath = hydrateLockPath(mainRoot, slug);
+  const stat = await fs50.stat(lockPath).catch(() => void 0);
+  if (stat === void 0) return { held: false };
+  const ownerPid = await readOwnerPid(lockPath);
+  return {
+    held: true,
+    ...ownerPid !== void 0 ? { ownerPid } : {},
+    ageMs: Date.now() - stat.mtimeMs,
+    lockPath
+  };
+}
 
 // src/workspace/worktree/orphans.ts
 import { existsSync as existsSync5 } from "node:fs";
-import path67 from "node:path";
+import path68 from "node:path";
 var WORKSPACE_REPO_ID = "(workspace)";
 async function findOrphanedRegistrations(repos, wsWorktreesDir) {
   const orphans = [];
   for (const repo of repos) {
     const entries = await listWorktrees(repo.absPath);
     for (const entry of entries) {
-      const entryPath = path67.normalize(entry.path);
-      const marker = `${path67.sep}.claude${path67.sep}worktrees${path67.sep}`;
+      const entryPath = path68.normalize(entry.path);
+      const marker = `${path68.sep}.claude${path68.sep}worktrees${path68.sep}`;
       const idx = entryPath.indexOf(marker);
       if (idx === -1) continue;
       const rest = entryPath.slice(idx + marker.length);
-      const slug = rest.split(path67.sep)[0];
+      const slug = rest.split(path68.sep)[0];
       if (!slug) continue;
-      if (existsSync5(path67.join(wsWorktreesDir, slug))) continue;
+      if (existsSync5(path68.join(wsWorktreesDir, slug))) continue;
       orphans.push({
         repoId: repo.id,
         ownerRepo: repo.absPath,
@@ -13474,7 +13991,7 @@ async function findOrphanedRegistrations(repos, wsWorktreesDir) {
 // src/workspace/worktree/doctor.ts
 var HYDRATION_MARKERS = ["node_modules", "vendor", "obj", "bin"];
 function looksHydrated(memberPath) {
-  return HYDRATION_MARKERS.some((marker) => existsSync6(path68.join(memberPath, marker)));
+  return HYDRATION_MARKERS.some((marker) => existsSync6(path69.join(memberPath, marker)));
 }
 async function runDoctor2() {
   const rootInfo = await resolveRoots();
@@ -13486,11 +14003,12 @@ async function runDoctor2() {
       orphans: [],
       problems: ["Not inside a git repository."],
       remedies: [],
-      autoHydrate: false
+      autoHydrate: false,
+      hydrationInProgress: false
     };
   }
   const workspaceRoot = rootInfo.mainRoot;
-  const isWorkspace = existsSync6(path68.join(workspaceRoot, WORKSPACE_FILE)) || existsSync6(path68.join(workspaceRoot, REPOS_MANIFEST_FILE));
+  const isWorkspace = existsSync6(path69.join(workspaceRoot, WORKSPACE_FILE)) || existsSync6(path69.join(workspaceRoot, REPOS_MANIFEST_FILE));
   if (!isWorkspace) {
     return {
       isWorkspace: false,
@@ -13501,11 +14019,12 @@ async function runDoctor2() {
         `Not a haus workspace \u2014 no ${WORKSPACE_FILE} or ${REPOS_MANIFEST_FILE} at ${workspaceRoot}.`
       ],
       remedies: [],
-      autoHydrate: false
+      autoHydrate: false,
+      hydrationInProgress: false
     };
   }
   const wsWorktreesDir = worktreesDir(workspaceRoot);
-  const underWorktreesDir = rootInfo.repoRoot.startsWith(`${wsWorktreesDir}${path68.sep}`);
+  const underWorktreesDir = rootInfo.repoRoot.startsWith(`${wsWorktreesDir}${path69.sep}`);
   const inWorkspaceWorktree = rootInfo.isLinkedWorktree && underWorktreesDir;
   const workspaceConfig = await readWorkspaceConfig(workspaceRoot);
   const autoHydrate = workspaceConfig?.worktree?.autoHydrate === true;
@@ -13514,12 +14033,14 @@ async function runDoctor2() {
   const remedies = [];
   const memberChecks = [];
   let slug;
+  let hydrationInProgress = false;
+  let hydrationOwnerPid;
   if (inWorkspaceWorktree) {
     const wtPath = rootInfo.repoRoot;
-    slug = rootInfo.worktreeName ?? path68.basename(wtPath);
+    slug = rootInfo.worktreeName ?? path69.basename(wtPath);
     const state = await readWorktreeState(wtPath);
     for (const member of members) {
-      const memberPath = path68.join(wtPath, member.folder);
+      const memberPath = path69.join(wtPath, member.folder);
       const materialized = existsSync6(memberPath);
       const expectedBranch = state?.members.find((m) => m.folder === member.folder)?.branch ?? state?.branch;
       const actualBranch = materialized ? await currentBranch(memberPath) : void 0;
@@ -13545,9 +14066,14 @@ async function runDoctor2() {
         );
       }
     }
+    const lock = await readHydrateLock(workspaceRoot, slug).catch(() => ({ held: false }));
+    if (lock.held) {
+      hydrationInProgress = true;
+      hydrationOwnerPid = lock.ownerPid;
+    }
     if (memberChecks.some((m) => !m.materialized)) {
       remedies.push(
-        "Run `haus workspace worktree hydrate --materialize` to materialize the missing members."
+        hydrationInProgress ? `A hydration is already running for "${slug}"${hydrationOwnerPid !== void 0 ? ` (pid ${hydrationOwnerPid})` : ""} \u2014 wait for ${lock.held ? lock.lockPath : "the lock"} to disappear rather than starting another.` : "Run `haus workspace worktree hydrate --materialize` to materialize the missing members."
       );
     }
   }
@@ -13559,7 +14085,7 @@ async function runDoctor2() {
     wsWorktreesDir
   );
   const orphans = orphanScan.map(
-    (o) => `${o.repoId}: worktree registered at ${o.registeredPath} but ${path68.join(wsWorktreesDir, o.slug)} no longer exists.`
+    (o) => `${o.repoId}: worktree registered at ${o.registeredPath} but ${path69.join(wsWorktreesDir, o.slug)} no longer exists.`
   );
   if (orphans.length > 0) {
     problems.push(...orphans);
@@ -13573,14 +14099,16 @@ async function runDoctor2() {
     orphans,
     problems,
     remedies,
-    autoHydrate
+    autoHydrate,
+    hydrationInProgress,
+    ...hydrationOwnerPid !== void 0 ? { hydrationOwnerPid } : {}
   };
 }
 
 // src/workspace/worktree/hydrate-command.ts
 init_fs();
 import { existsSync as existsSync7 } from "node:fs";
-import path69 from "node:path";
+import path70 from "node:path";
 async function runHydrateWorktree(opts) {
   const rootInfo = await resolveRoots();
   if (!rootInfo.isGitRepo || !rootInfo.isLinkedWorktree) {
@@ -13591,7 +14119,7 @@ async function runHydrateWorktree(opts) {
   }
   const workspaceRoot = rootInfo.mainRoot;
   const wtPath = rootInfo.repoRoot;
-  if (!wtPath.startsWith(`${worktreesDir(workspaceRoot)}${path69.sep}`)) {
+  if (!wtPath.startsWith(`${worktreesDir(workspaceRoot)}${path70.sep}`)) {
     return {
       ok: false,
       error: "Current worktree is not one of this workspace's .claude/worktrees/<slug> checkouts."
@@ -13603,13 +14131,13 @@ async function runHydrateWorktree(opts) {
     return { ok: false, error: `Unknown --only repo(s): ${unknown.join(", ")}` };
   }
   const state = await readWorktreeState(wtPath);
-  const slug = state?.slug ?? path69.basename(wtPath);
+  const slug = state?.slug ?? path70.basename(wtPath);
   const detectedBranch = await currentBranch(wtPath);
   const targetBranch = state?.branch ?? (detectedBranch !== "HEAD" ? detectedBranch : void 0) ?? slug;
   if (opts.dryRun) {
     const results2 = await Promise.all(
       selected.map(async (member) => {
-        const memberPath = path69.join(wtPath, member.folder);
+        const memberPath = path70.join(wtPath, member.folder);
         if (existsSync7(memberPath)) {
           return { member: member.id, folder: member.folder, status: "planned" };
         }
@@ -13630,7 +14158,7 @@ async function runHydrateWorktree(opts) {
   const results = await mapWithConcurrency(
     selected,
     async (member) => {
-      const memberPath = path69.join(wtPath, member.folder);
+      const memberPath = path70.join(wtPath, member.folder);
       let branchAction;
       if (!existsSync7(memberPath)) {
         if (!opts.materialize) {
@@ -13689,47 +14217,7 @@ async function runHydrateWorktree(opts) {
       members: Array.from(byId.values())
     });
   }
-  return { ok: results.every((r) => r.status !== "failed"), dryRun: false, slug, results };
-}
-
-// src/workspace/worktree/list.ts
-import path70 from "node:path";
-import fs50 from "fs-extra";
-async function runList2() {
-  const resolved = await resolveWorkspaceForWorktree();
-  if (!resolved.ok) return { ok: false, error: resolved.reason };
-  const { rootInfo, workspaceRoot } = resolved;
-  const dir = worktreesDir(workspaceRoot);
-  if (!await fs50.pathExists(dir)) return { ok: true, workspaceRoot, worktrees: [] };
-  const entries = await fs50.readdir(dir, { withFileTypes: true });
-  const slugs = entries.filter((e) => e.isDirectory()).map((e) => e.name);
-  const configuredMembers = await readMembers(rootInfo);
-  const worktrees = [];
-  for (const slug of slugs) {
-    const wtPath = path70.join(dir, slug);
-    const state = await readWorktreeState(wtPath);
-    const members = [];
-    const source = state?.members ?? configuredMembers.map((m) => ({ id: m.id, folder: m.folder }));
-    for (const m of source) {
-      const memberPath = path70.join(wtPath, m.folder);
-      const materialized = await fs50.pathExists(memberPath);
-      const actualBranch = materialized ? await currentBranch(memberPath) : void 0;
-      members.push({
-        id: m.id,
-        folder: m.folder,
-        expectedBranch: m.branch,
-        materialized,
-        actualBranch
-      });
-    }
-    worktrees.push({
-      slug,
-      branch: state?.branch ?? await currentBranch(wtPath) ?? "unknown",
-      createdAt: state?.createdAt,
-      members
-    });
-  }
-  return { ok: true, workspaceRoot, worktrees };
+  return { ok: results.every(memberOutcomeOk), dryRun: false, slug, results };
 }
 
 // src/workspace/worktree/prune.ts
@@ -13772,58 +14260,523 @@ async function runPrune2(opts) {
   return { ok: results.every((r) => r.pruned), dryRun: false, results };
 }
 
-// src/workspace/worktree/remove.ts
-import path71 from "node:path";
-import fs51 from "fs-extra";
-async function runRemove2(opts) {
-  const resolved = await resolveWorkspaceForWorktree();
-  if (!resolved.ok) return { ok: false, error: resolved.reason };
-  const { rootInfo, workspaceRoot } = resolved;
-  const wsWorktreePath = worktreePath(workspaceRoot, opts.slug);
-  if (!await fs51.pathExists(wsWorktreePath)) {
-    return { ok: false, error: `No workspace worktree found at ${wsWorktreePath}.` };
+// src/workspace/worktree/autohydrate.ts
+var NO_AUTO_HYDRATE_ENV = "HAUS_NO_AUTO_HYDRATE";
+var LOG_SIZE_CAP_BYTES = 512 * 1024;
+function defaultSpawnDetached(spec) {
+  const fd = fsSync.openSync(spec.logPath, "a");
+  try {
+    const child = spawn(spec.command, spec.args, {
+      cwd: spec.cwd,
+      detached: true,
+      stdio: ["ignore", fd, fd]
+    });
+    child.unref();
+    return child.pid;
+  } finally {
+    fsSync.closeSync(fd);
   }
-  const state = await readWorktreeState(wsWorktreePath);
-  const allMembers = await readMembers(rootInfo);
-  const stateMembers = state?.members.map((m) => ({ id: m.id, folder: m.folder, absPath: m.absPath })) ?? allMembers.map((m) => ({ id: m.id, folder: m.folder, absPath: m.absPath }));
-  const targets = [
-    { repo: "(workspace)", ownerRepo: workspaceRoot, path: wsWorktreePath }
-  ];
-  const unresolvedDroppedMembers = [];
-  for (const stateMember of stateMembers) {
-    const configMember = allMembers.find((m) => m.folder === stateMember.folder);
-    const ownerRepo = configMember?.absPath ?? stateMember.absPath;
-    if (!ownerRepo) {
-      if (!configMember) unresolvedDroppedMembers.push(stateMember.folder);
-      continue;
+}
+function appendLog(logPath, line2) {
+  try {
+    fsSync.mkdirSync(path71.dirname(logPath), { recursive: true });
+    const size = fsSync.statSync(logPath, { throwIfNoEntry: false })?.size ?? 0;
+    if (size > LOG_SIZE_CAP_BYTES) {
+      fsSync.writeFileSync(logPath, `--- log rotated (exceeded ${LOG_SIZE_CAP_BYTES} bytes) ---
+`);
     }
-    targets.push({
-      repo: configMember?.id ?? stateMember.id,
-      ownerRepo,
-      path: path71.join(wsWorktreePath, stateMember.folder)
-    });
+    fsSync.appendFileSync(logPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line2}
+`);
+  } catch {
   }
-  const existingTargets = [];
-  for (const target of targets) {
-    if (await fs51.pathExists(target.path)) existingTargets.push(target);
+}
+async function consumeLastRunFailure(mainRoot, slug) {
+  const file = hydrateLastRunPath(mainRoot, slug);
+  let parsed;
+  try {
+    parsed = JSON.parse(await fs51.readFile(file, "utf8"));
+  } catch {
+    return void 0;
   }
-  if (!opts.force) {
-    const blockers = [];
-    for (const folder of unresolvedDroppedMembers) {
-      blockers.push({
-        repo: folder,
-        reason: "no longer in the workspace config and this worktree predates absPath tracking \u2014 cannot verify for uncommitted work or unregister its git worktree; removing anyway will delete its directory here but leak the registration in whatever repo it came from (run `git worktree prune` there manually afterward)"
-      });
+  await fs51.remove(file).catch(() => void 0);
+  if (parsed && parsed.ok === false) return parsed;
+  return void 0;
+}
+async function resolveWorktree() {
+  const rootInfo = await resolveRoots();
+  if (!rootInfo.isGitRepo || !rootInfo.isLinkedWorktree) return void 0;
+  const mainRoot = rootInfo.mainRoot;
+  const wtPath = rootInfo.repoRoot;
+  const slug = slugFromWorktreePath(mainRoot, wtPath);
+  if (slug === void 0) return void 0;
+  return { mainRoot, wtPath, slug };
+}
+async function runAutoHydrate(opts = {}, deps = {}) {
+  const env = opts.env ?? process.env;
+  const resolved = await resolveWorktree();
+  if (!resolved) return { status: "not-a-workspace-worktree" };
+  const { mainRoot, wtPath, slug } = resolved;
+  if (env[NO_AUTO_HYDRATE_ENV] === "1") {
+    return { status: "disabled", slug, reason: `${NO_AUTO_HYDRATE_ENV}=1 is set` };
+  }
+  const config = await readWorkspaceConfig(mainRoot);
+  if (config?.worktree?.autoHydrate !== true) {
+    return {
+      status: "disabled",
+      slug,
+      reason: "worktree.autoHydrate is not enabled in haus.workspace.yaml"
+    };
+  }
+  const lastRunFailure = await consumeLastRunFailure(mainRoot, slug);
+  const withLastRun = (result) => lastRunFailure ? { ...result, lastRunFailure } : result;
+  let prunedRepos;
+  if (!opts.dryRun) {
+    const prune = await runPrune2({}).catch(() => void 0);
+    if (prune && !("error" in prune)) {
+      prunedRepos = prune.results.filter((r) => r.pruned).map((r) => r.repo);
     }
-    for (const target of existingTargets) {
-      const ignorePaths = target.repo === "(workspace)" ? [WORKTREE_STATE_FILE, ...stateMembers.map((m) => m.folder)] : [];
-      if (await hasUncommittedChanges(target.path, ignorePaths)) {
-        blockers.push({ repo: target.repo, reason: "uncommitted changes" });
+  }
+  const report = await runDoctor2();
+  const missingMembers = report.members.filter((m) => !m.materialized).map((m) => m.id);
+  if (missingMembers.length === 0) {
+    return withLastRun({
+      status: "up-to-date",
+      slug,
+      missingMembers,
+      ...prunedRepos ? { prunedRepos } : {}
+    });
+  }
+  const logPath = hydrateLogPath(mainRoot, slug);
+  if (opts.dryRun) {
+    return withLastRun({ status: "planned", slug, missingMembers, logPath });
+  }
+  const acquired = await acquireHydrateLock(mainRoot, slug);
+  if (!acquired.acquired) {
+    return withLastRun({
+      status: "in-progress",
+      slug,
+      missingMembers,
+      ...acquired.ownerPid !== void 0 ? { ownerPid: acquired.ownerPid } : {},
+      lockPath: acquired.lockPath,
+      logPath
+    });
+  }
+  const entry = process.argv[1];
+  if (entry === void 0) {
+    await releaseHydrateLock(mainRoot, slug);
+    return {
+      status: "error",
+      slug,
+      reason: "could not determine the haus CLI entry point to re-invoke"
+    };
+  }
+  await fs51.ensureDir(logsDir(mainRoot));
+  appendLog(
+    logPath,
+    `autohydrate: forking hydrate --materialize for "${slug}" (${missingMembers.join(", ")})`
+  );
+  const spawnDetached = deps.spawnDetached ?? defaultSpawnDetached;
+  let pid;
+  try {
+    pid = spawnDetached({
+      command: process.execPath,
+      args: [entry, "workspace", "worktree", "autohydrate", "--detached-child"],
+      cwd: wtPath,
+      logPath
+    });
+  } catch (err) {
+    await releaseHydrateLock(mainRoot, slug);
+    return {
+      status: "error",
+      slug,
+      reason: err instanceof Error ? err.message : String(err)
+    };
+  }
+  if (pid === void 0) {
+    await releaseHydrateLock(mainRoot, slug);
+    return { status: "error", slug, reason: "the detached hydration reported no pid" };
+  }
+  await recordHydrateLockOwner(mainRoot, slug, pid);
+  return withLastRun({
+    status: "started",
+    slug,
+    missingMembers,
+    pid,
+    lockPath: acquired.lockPath,
+    logPath,
+    ...prunedRepos ? { prunedRepos } : {}
+  });
+}
+async function runDetachedHydration() {
+  const resolved = await resolveWorktree();
+  if (!resolved) return { ok: false, failures: ["not inside a workspace worktree"] };
+  const { mainRoot, slug } = resolved;
+  const logPath = hydrateLogPath(mainRoot, slug);
+  try {
+    const result = await runHydrateWorktree({ materialize: true });
+    if ("error" in result && !result.ok) {
+      const failures2 = [result.error];
+      await writeLastRun(mainRoot, slug, false, failures2);
+      appendLog(logPath, `hydrate failed: ${result.error}`);
+      return { ok: false, slug, failures: failures2 };
+    }
+    const detail = "results" in result ? result.results : [];
+    const failures = detail.filter((r) => r.status === "failed" || installFailed(r.hydration?.install)).map(
+      (r) => r.status === "failed" ? `${r.member}: failed to materialize \u2014 ${r.error ?? "unknown error"}` : `${r.member}: materialized, but its install FAILED via ${r.hydration?.install.plan.manager}`
+    );
+    await writeLastRun(mainRoot, slug, result.ok, failures);
+    appendLog(logPath, `hydrate finished: ${result.ok ? "ok" : `FAILED (${failures.join("; ")})`}`);
+    return { ok: result.ok, slug, failures };
+  } catch (err) {
+    const message2 = err instanceof Error ? err.message : String(err);
+    await writeLastRun(mainRoot, slug, false, [message2]);
+    appendLog(logPath, `hydrate threw: ${message2}`);
+    return { ok: false, slug, failures: [message2] };
+  } finally {
+    await releaseHydrateLock(mainRoot, slug).catch(() => void 0);
+  }
+}
+async function writeLastRun(mainRoot, slug, ok, failures) {
+  const file = hydrateLastRunPath(mainRoot, slug);
+  if (ok) {
+    await fs51.remove(file).catch(() => void 0);
+    return;
+  }
+  const record = { slug, finishedAt: (/* @__PURE__ */ new Date()).toISOString(), ok, failures };
+  await fs51.ensureDir(path71.dirname(file));
+  await fs51.writeJson(file, record, { spaces: 2 }).catch(() => void 0);
+}
+
+// src/workspace/worktree/dematerialize.ts
+import path73 from "node:path";
+import fs53 from "fs-extra";
+
+// src/workspace/worktree/member-targets.ts
+import path72 from "node:path";
+import fs52 from "fs-extra";
+function normalizeStateMembers(state, allMembers) {
+  return state?.members.map((m) => ({ id: m.id, folder: m.folder, absPath: m.absPath })) ?? allMembers.map((m) => ({ id: m.id, folder: m.folder, absPath: m.absPath }));
+}
+function resolveMemberTargets(wsWorktreePath, stateMembers, allMembers) {
+  const targets = [];
+  const unresolvedDroppedMembers = [];
+  for (const stateMember of stateMembers) {
+    const configMember = allMembers.find((m) => m.folder === stateMember.folder);
+    const ownerRepo = configMember?.absPath ?? stateMember.absPath;
+    if (!ownerRepo) {
+      if (!configMember) unresolvedDroppedMembers.push(stateMember.folder);
+      continue;
+    }
+    targets.push({
+      repo: configMember?.id ?? stateMember.id,
+      ownerRepo,
+      path: path72.join(wsWorktreePath, stateMember.folder)
+    });
+  }
+  return { targets, unresolvedDroppedMembers };
+}
+async function filterExistingTargets(targets) {
+  const existing = [];
+  for (const target of targets) {
+    if (await fs52.pathExists(target.path)) existing.push(target);
+  }
+  return existing;
+}
+function unresolvedDroppedBlockerReason() {
+  return "no longer in the workspace config and this worktree predates absPath tracking \u2014 cannot verify for uncommitted work or unregister its git worktree; removing anyway will delete its directory here but leak the registration in whatever repo it came from (run `git worktree prune` there manually afterward)";
+}
+function unresolvedDroppedFailureReason() {
+  return "directory removed, but its git worktree registration could not be unregistered (no recorded absPath) \u2014 run `git worktree prune` in its original owning repo";
+}
+async function findWorkBlockers(targets, ignorePathsFor = () => []) {
+  const blockers = [];
+  for (const target of targets) {
+    if (await hasUncommittedChanges(target.path, ignorePathsFor(target))) {
+      blockers.push({ repo: target.repo, reason: "uncommitted changes" });
+      continue;
+    }
+    const unpushed = await hasUnpushedWork(target.path);
+    if (unpushed.unpushed) blockers.push({ repo: target.repo, reason: unpushed.reason });
+  }
+  return blockers;
+}
+
+// src/workspace/worktree/dematerialize.ts
+function resolveSlug(opts, workspaceRoot, repoRoot, isLinkedWorktree) {
+  if (opts.slug !== void 0) return { slug: opts.slug };
+  const slug = isLinkedWorktree ? slugFromWorktreePath(workspaceRoot, repoRoot) : void 0;
+  if (slug !== void 0) return { slug };
+  return {
+    error: "Name the worktree to dematerialize (`haus workspace worktree dematerialize <slug>`), or run this from inside one of this workspace's .claude/worktrees/<slug> checkouts."
+  };
+}
+async function runDematerialize(opts) {
+  const resolved = await resolveWorkspaceForWorktree();
+  if (!resolved.ok) return { ok: false, error: resolved.reason };
+  const { rootInfo, workspaceRoot } = resolved;
+  const slugResult = resolveSlug(opts, workspaceRoot, rootInfo.repoRoot, rootInfo.isLinkedWorktree);
+  if ("error" in slugResult) return { ok: false, error: slugResult.error };
+  const { slug } = slugResult;
+  let wsWorktreePath;
+  try {
+    wsWorktreePath = worktreePath(workspaceRoot, slug);
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+  if (!await fs53.pathExists(wsWorktreePath)) {
+    return { ok: false, error: `No workspace worktree found at ${wsWorktreePath}.` };
+  }
+  const lock = await readHydrateLock(workspaceRoot, slug);
+  if (lock.held) {
+    return {
+      ok: false,
+      error: `A hydration is running for "${slug}"${lock.ownerPid !== void 0 ? ` (pid ${lock.ownerPid})` : ""} \u2014 wait for ${lock.lockPath} to disappear before dematerializing it.`
+    };
+  }
+  const state = await readWorktreeState(wsWorktreePath);
+  const allMembers = await readMembers(rootInfo);
+  const stateMembers = normalizeStateMembers(state, allMembers);
+  const { targets, unresolvedDroppedMembers } = resolveMemberTargets(
+    wsWorktreePath,
+    stateMembers,
+    allMembers
+  );
+  const existingTargets = await filterExistingTargets(targets);
+  if (!opts.force) {
+    const blockers = unresolvedDroppedMembers.map((folder) => ({
+      repo: folder,
+      reason: unresolvedDroppedBlockerReason()
+    }));
+    blockers.push(...await findWorkBlockers(existingTargets));
+    if (blockers.length > 0) return { ok: false, blocked: true, slug, blockers };
+  }
+  if (opts.dryRun) {
+    return { ok: true, dryRun: true, slug, wouldRemove: existingTargets.map((t) => t.repo) };
+  }
+  const removed = [];
+  const failed = [];
+  for (const folder of unresolvedDroppedMembers) {
+    const droppedPath = path73.join(wsWorktreePath, folder);
+    if (await fs53.pathExists(droppedPath)) {
+      await fs53.remove(droppedPath);
+      failed.push({ repo: folder, error: unresolvedDroppedFailureReason() });
+    }
+  }
+  for (const target of existingTargets) {
+    const result = await removeWorktree(target.ownerRepo, target.path);
+    if (result.ok) removed.push(target.repo);
+    else failed.push({ repo: target.repo, error: result.stderr ?? "unknown error" });
+    await pruneWorktrees(target.ownerRepo);
+  }
+  return { ok: failed.length === 0, dryRun: false, slug, removed, failed };
+}
+
+// src/workspace/worktree/list.ts
+import path74 from "node:path";
+import fs54 from "fs-extra";
+async function runList2() {
+  const resolved = await resolveWorkspaceForWorktree();
+  if (!resolved.ok) return { ok: false, error: resolved.reason };
+  const { rootInfo, workspaceRoot } = resolved;
+  const dir = worktreesDir(workspaceRoot);
+  if (!await fs54.pathExists(dir)) return { ok: true, workspaceRoot, worktrees: [] };
+  const entries = await fs54.readdir(dir, { withFileTypes: true });
+  const slugs = entries.filter((e) => e.isDirectory()).map((e) => e.name);
+  const configuredMembers = await readMembers(rootInfo);
+  const worktrees = [];
+  for (const slug of slugs) {
+    const wtPath = path74.join(dir, slug);
+    const state = await readWorktreeState(wtPath);
+    const members = [];
+    const source = state?.members ?? configuredMembers.map((m) => ({ id: m.id, folder: m.folder }));
+    for (const m of source) {
+      const memberPath = path74.join(wtPath, m.folder);
+      const materialized = await fs54.pathExists(memberPath);
+      const actualBranch = materialized ? await currentBranch(memberPath) : void 0;
+      members.push({
+        id: m.id,
+        folder: m.folder,
+        expectedBranch: m.branch,
+        materialized,
+        actualBranch
+      });
+    }
+    worktrees.push({
+      slug,
+      branch: state?.branch ?? await currentBranch(wtPath) ?? "unknown",
+      createdAt: state?.createdAt,
+      members
+    });
+  }
+  return { ok: true, workspaceRoot, worktrees };
+}
+
+// src/workspace/worktree/reclaim.ts
+import { existsSync as existsSync8 } from "node:fs";
+import path75 from "node:path";
+import fs55 from "fs-extra";
+var MS_PER_DAY = 24 * 60 * 60 * 1e3;
+async function lastTouchedMs(worktreeRoot) {
+  const candidates = [worktreeRoot, path75.join(worktreeRoot, ".haus-worktree.json")];
+  try {
+    const dotGit = await fs55.readFile(path75.join(worktreeRoot, ".git"), "utf8");
+    const match = /^gitdir:\s*(.+)$/m.exec(dotGit);
+    if (match?.[1]) {
+      const gitdir = match[1].trim();
+      candidates.push(path75.join(gitdir, "HEAD"), path75.join(gitdir, "index"));
+    }
+  } catch {
+  }
+  let newest = 0;
+  for (const candidate of candidates) {
+    const stat = await fs55.stat(candidate).catch(() => void 0);
+    if (stat && stat.mtimeMs > newest) newest = stat.mtimeMs;
+  }
+  return newest;
+}
+async function runReclaim(opts = {}) {
+  const resolved = await resolveWorkspaceForWorktree();
+  if (!resolved.ok) return { ok: false, error: resolved.reason };
+  const { rootInfo, workspaceRoot } = resolved;
+  const config = await readWorkspaceConfig(workspaceRoot);
+  const olderThanDays = opts.olderThanDays ?? config?.worktree?.reclaimAfterDays;
+  if (olderThanDays === void 0) {
+    return {
+      ok: false,
+      error: "No reclamation age configured. Pass `--older-than-days <n>`, or set `worktree.reclaimAfterDays` in haus.workspace.yaml."
+    };
+  }
+  if (!Number.isFinite(olderThanDays) || olderThanDays <= 0) {
+    return {
+      ok: false,
+      error: `--older-than-days must be a number greater than 0 (got ${String(olderThanDays)}).`
+    };
+  }
+  const dir = worktreesDir(workspaceRoot);
+  if (!existsSync8(dir)) {
+    return { ok: true, dryRun: !opts.write, olderThanDays, candidates: [], reclaimed: 0 };
+  }
+  const allEntries = (await fs55.readdir(dir, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name).sort();
+  const entries = allEntries.filter((name) => isValidWorktreeSlug(name));
+  const unaddressable = allEntries.filter((name) => !isValidWorktreeSlug(name));
+  const members = await readMembers(rootInfo);
+  const currentSlug = rootInfo.isLinkedWorktree ? slugFromWorktreePath(workspaceRoot, rootInfo.repoRoot) : void 0;
+  const candidates = [];
+  let reclaimed = 0;
+  for (const name of unaddressable) {
+    candidates.push({
+      slug: name,
+      ageDays: (Date.now() - await lastTouchedMs(path75.join(dir, name))) / MS_PER_DAY,
+      materializedMembers: 0,
+      action: "skip",
+      reason: "directory name is not a valid worktree slug \u2014 no haus worktree command can address it; remove it by hand if it is debris"
+    });
+  }
+  for (const slug of entries) {
+    const wtPath = path75.join(dir, slug);
+    const state = await readWorktreeState(wtPath);
+    const stateMembers = normalizeStateMembers(state, members);
+    const materialized = stateMembers.filter((m) => existsSync8(path75.join(wtPath, m.folder)));
+    const ageDays = (Date.now() - await lastTouchedMs(wtPath)) / MS_PER_DAY;
+    const base = { slug, ageDays, materializedMembers: materialized.length };
+    if (slug === currentSlug) {
+      candidates.push({ ...base, action: "skip", reason: "this is the current worktree" });
+      continue;
+    }
+    if (materialized.length === 0) {
+      candidates.push({ ...base, action: "skip", reason: "nothing materialized to reclaim" });
+      continue;
+    }
+    const lock = await readHydrateLock(workspaceRoot, slug).catch(() => ({ held: false }));
+    if (lock.held) {
+      candidates.push({ ...base, action: "skip", reason: "a hydration is running for it" });
+      continue;
+    }
+    if (ageDays < olderThanDays) {
+      candidates.push({
+        ...base,
+        action: "skip",
+        reason: `touched ${ageDays.toFixed(1)} days ago (threshold ${olderThanDays})`
+      });
+      continue;
+    }
+    const outcome = await runDematerialize({ slug, dryRun: !opts.write });
+    if (!outcome.ok && "blocked" in outcome) {
+      candidates.push({ ...base, action: "blocked", blockers: outcome.blockers });
+      continue;
+    }
+    if (!outcome.ok && "error" in outcome) {
+      candidates.push({ ...base, action: "failed", reason: outcome.error });
+      continue;
+    }
+    if ("dryRun" in outcome && outcome.dryRun) {
+      candidates.push({ ...base, action: "reclaim", members: outcome.wouldRemove });
+      continue;
+    }
+    if ("removed" in outcome) {
+      if (outcome.failed.length > 0) {
+        candidates.push({
+          ...base,
+          action: "failed",
+          members: outcome.removed,
+          reason: outcome.failed.map((f) => `${f.repo}: ${f.error}`).join("; ")
+        });
         continue;
       }
-      const unpushed = await hasUnpushedWork(target.path);
-      if (unpushed.unpushed) blockers.push({ repo: target.repo, reason: unpushed.reason });
+      reclaimed += 1;
+      candidates.push({ ...base, action: "reclaim", members: outcome.removed });
     }
+  }
+  return {
+    ok: candidates.every((c) => c.action !== "failed"),
+    dryRun: !opts.write,
+    olderThanDays,
+    candidates,
+    reclaimed
+  };
+}
+
+// src/workspace/worktree/remove.ts
+import fs56 from "fs-extra";
+async function runRemove2(opts) {
+  const resolved = await resolveWorkspaceForWorktree();
+  if (!resolved.ok) return { ok: false, error: resolved.reason };
+  const { rootInfo, workspaceRoot } = resolved;
+  const wsWorktreePath = worktreePath(workspaceRoot, opts.slug);
+  if (!await fs56.pathExists(wsWorktreePath)) {
+    return { ok: false, error: `No workspace worktree found at ${wsWorktreePath}.` };
+  }
+  const state = await readWorktreeState(wsWorktreePath);
+  const allMembers = await readMembers(rootInfo);
+  const stateMembers = normalizeStateMembers(state, allMembers);
+  const { targets: memberOnlyTargets, unresolvedDroppedMembers } = resolveMemberTargets(
+    wsWorktreePath,
+    stateMembers,
+    allMembers
+  );
+  const targets = [
+    { repo: "(workspace)", ownerRepo: workspaceRoot, path: wsWorktreePath },
+    ...memberOnlyTargets
+  ];
+  const existingTargets = await filterExistingTargets(targets);
+  if (!opts.force) {
+    const blockers = unresolvedDroppedMembers.map((folder) => ({
+      repo: folder,
+      reason: unresolvedDroppedBlockerReason()
+    }));
+    blockers.push(
+      ...await findWorkBlockers(
+        existingTargets,
+        (target) => (
+          // The workspace worktree root always contains content that is untracked by
+          // design and must not read as "uncommitted work": our own state file, and
+          // every member folder (each a separate nested repo, so it shows as `?? forms/`
+          // whether or not that member is clean). Members are dirty-checked
+          // independently as their own targets.
+          target.repo === "(workspace)" ? [WORKTREE_STATE_FILE, ...stateMembers.map((m) => m.folder)] : []
+        )
+      )
+    );
     if (blockers.length > 0) return { ok: false, blocked: true, blockers };
   }
   if (opts.dryRun) {
@@ -13837,10 +14790,7 @@ async function runRemove2(opts) {
   const removed = [];
   const failed = [];
   for (const folder of unresolvedDroppedMembers) {
-    failed.push({
-      repo: folder,
-      error: "directory removed, but its git worktree registration could not be unregistered (no recorded absPath) \u2014 run `git worktree prune` in its original owning repo"
-    });
+    failed.push({ repo: folder, error: unresolvedDroppedFailureReason() });
   }
   const memberTargets = existingTargets.filter((t) => t.repo !== "(workspace)");
   for (const target of memberTargets) {
@@ -13861,8 +14811,8 @@ async function runRemove2(opts) {
     }
     await pruneWorktrees(workspaceRoot);
   }
-  if (wsRemoveOk && await fs51.pathExists(wsWorktreePath)) {
-    await fs51.remove(wsWorktreePath);
+  if (wsRemoveOk && await fs56.pathExists(wsWorktreePath)) {
+    await fs56.remove(wsWorktreePath);
   }
   return { ok: failed.length === 0, dryRun: false, slug: opts.slug, removed, failed };
 }
@@ -13878,6 +14828,23 @@ function emitMemberLine(hydration, line2) {
   if (hydration?.install.ran && !hydration.install.ok) warn(line2);
   else log(line2);
 }
+function countMemberFailures(members) {
+  let materialize = 0;
+  let install = 0;
+  for (const m of members) {
+    if (m.status === "failed") materialize += 1;
+    else if (installFailed(m.hydration?.install)) install += 1;
+  }
+  return { materialize, install };
+}
+function describeMemberFailures(members) {
+  const { materialize, install } = countMemberFailures(members);
+  const parts = [];
+  if (materialize > 0) parts.push(`${materialize} member(s) failed to materialize`);
+  if (install > 0) parts.push(`${install} member(s) materialized but their install FAILED`);
+  const summary = parts.length > 0 ? parts.join(" and ") : "the run did not complete cleanly";
+  return `${summary} \u2014 see the per-member detail above for exactly what exists.`;
+}
 async function handleAdd(opts) {
   if (!opts.slug) {
     if (opts.json) emitJson({ ok: false, error: "Usage: haus workspace worktree add <slug>" });
@@ -13930,10 +14897,7 @@ async function handleAdd(opts) {
     }
   }
   if (!result.ok) {
-    const failedCount = result.members.filter((m) => m.status === "failed").length;
-    error(
-      `${failedCount} member(s) failed to materialize \u2014 the worktree is partially built. See the per-member detail above for exactly what exists.`
-    );
+    error(`The worktree is partially built: ${describeMemberFailures(result.members)}`);
     process.exitCode = 1;
   }
 }
@@ -13976,7 +14940,10 @@ async function handleHydrate(opts) {
       warn(`  ${r.member}: ${r.status}${r.error ? ` \u2014 ${r.error}` : ""}`);
     }
   }
-  if (!result.ok) process.exitCode = 1;
+  if (!result.ok) {
+    error(describeMemberFailures(result.results));
+    process.exitCode = 1;
+  }
 }
 async function handleRemove(opts) {
   if (!opts.slug) {
@@ -14119,6 +15086,168 @@ async function handleDoctor(opts) {
     }
   }
 }
+function describeAutoHydrate(result) {
+  const lines = [];
+  if (result.lastRunFailure) {
+    lines.push(
+      `The previous automatic hydration of "${result.lastRunFailure.slug}" FAILED (${result.lastRunFailure.finishedAt}): ${result.lastRunFailure.failures.join("; ")}. Re-run \`haus workspace worktree hydrate --materialize\` and read the error before trusting the member repos.`
+    );
+  }
+  switch (result.status) {
+    case "started":
+      lines.push(
+        `The member repos are missing in this worktree and are being hydrated in the background now (${result.missingMembers?.join(", ")}). This takes minutes, not seconds. Wait until ${result.lockPath} disappears before reading any file in a member repo \u2014 \`haus workspace worktree doctor\` turns green before the work is finished. Log: ${result.logPath}`
+      );
+      break;
+    case "in-progress":
+      lines.push(
+        `The member repos in this worktree are already being hydrated by another session${result.ownerPid !== void 0 ? ` (pid ${result.ownerPid})` : ""}. Wait until ${result.lockPath} disappears before reading files in the member repos.`
+      );
+      break;
+    case "planned":
+      lines.push(
+        `[dry-run] Would hydrate ${result.missingMembers?.join(", ")} in the background for "${result.slug}". Log would be ${result.logPath}.`
+      );
+      break;
+    case "error":
+      lines.push(`Automatic hydration could not start: ${result.reason ?? "unknown reason"}`);
+      break;
+    case "disabled":
+    case "up-to-date":
+    case "not-a-workspace-worktree":
+      break;
+  }
+  return lines;
+}
+async function handleAutoHydrate(opts) {
+  if (opts.detachedChild) {
+    const outcome = await runDetachedHydration();
+    if (opts.json) emitJson(outcome);
+    else if (!outcome.ok) for (const f of outcome.failures) error(f);
+    if (!outcome.ok) process.exitCode = 1;
+    return;
+  }
+  let result;
+  try {
+    result = await runAutoHydrate({
+      dryRun: resolveWriteMode(opts, "mutate-by-default").kind === "preview"
+    });
+  } catch (err) {
+    const message2 = err instanceof Error ? err.message : String(err);
+    if (opts.fromHook) return;
+    if (opts.json) emitJson({ status: "error", reason: message2 });
+    else error(message2);
+    process.exitCode = 1;
+    return;
+  }
+  const lines = describeAutoHydrate(result);
+  if (opts.fromHook) {
+    if (lines.length > 0) emitFromHookContext(lines.join(" "));
+    return;
+  }
+  if (opts.json) {
+    emitJson(result);
+    if (result.status === "error") process.exitCode = 1;
+    return;
+  }
+  if (lines.length === 0) {
+    log(
+      result.status === "disabled" ? `Automatic hydration is off: ${result.reason ?? "not enabled"}.` : "Nothing to hydrate."
+    );
+    return;
+  }
+  for (const line2 of lines) log(line2);
+  if (result.status === "error") process.exitCode = 1;
+}
+async function handleDematerialize(opts) {
+  const dematOpts = {
+    ...opts.slug !== void 0 ? { slug: opts.slug } : {},
+    force: Boolean(opts.force),
+    dryRun: resolveWriteMode(opts, "mutate-by-default").kind === "preview"
+  };
+  const result = await runDematerialize(dematOpts);
+  if (opts.json) {
+    emitJson(result);
+    if (!result.ok || "removed" in result && result.failed.length > 0) process.exitCode = 1;
+    return;
+  }
+  if (!result.ok && "blocked" in result) {
+    error(`Refusing to dematerialize "${result.slug}" \u2014 uncommitted or unpushed work found:`);
+    for (const b of result.blockers) error(`  ${b.repo}: ${b.reason}`);
+    error("Re-run with --force to dematerialize anyway.");
+    process.exitCode = 1;
+    return;
+  }
+  if (!result.ok && "error" in result) {
+    error(result.error);
+    process.exitCode = 1;
+    return;
+  }
+  if ("dryRun" in result && result.dryRun) {
+    log(`[dry-run] Would dematerialize: ${result.wouldRemove.join(", ") || "(nothing)"}`);
+    return;
+  }
+  if ("removed" in result) {
+    log(
+      `Dematerialized "${result.slug}": ${result.removed.join(", ") || "(nothing)"}. The workspace worktree and its branch are untouched \u2014 run \`haus workspace worktree hydrate --materialize\` to bring the members back.`
+    );
+    if (result.failed.length > 0) {
+      for (const f of result.failed) error(`  Failed to dematerialize ${f.repo}: ${f.error}`);
+      process.exitCode = 1;
+    }
+  }
+}
+async function handleReclaim(opts) {
+  const result = await runReclaim({
+    ...opts.olderThanDays !== void 0 ? { olderThanDays: opts.olderThanDays } : {},
+    write: resolveWriteMode(opts, "preview-by-default").kind === "write"
+  });
+  if (opts.json) {
+    emitJson(result);
+    if (!result.ok) process.exitCode = 1;
+    return;
+  }
+  if (!result.ok && "error" in result) {
+    error(result.error);
+    process.exitCode = 1;
+    return;
+  }
+  if (!("candidates" in result)) return;
+  if (result.candidates.length === 0) {
+    log("No workspace worktrees under .claude/worktrees/.");
+    return;
+  }
+  for (const c of result.candidates) {
+    const age = `${c.ageDays.toFixed(1)}d`;
+    switch (c.action) {
+      case "reclaim":
+        log(
+          dryRunPrefix(
+            result.dryRun,
+            `${result.dryRun ? "Would reclaim" : "Reclaimed"} ${c.slug} (${age}): ${(c.members ?? []).join(", ")}`
+          )
+        );
+        break;
+      case "blocked":
+        warn(`Blocked ${c.slug} (${age}) \u2014 uncommitted or unpushed work:`);
+        for (const b of c.blockers ?? []) warn(`  ${b.repo}: ${b.reason}`);
+        break;
+      case "failed":
+        error(`FAILED ${c.slug} (${age}): ${c.reason ?? "unknown error"}`);
+        break;
+      case "skip":
+        log(`Keeping ${c.slug} (${age}) \u2014 ${c.reason ?? "not a candidate"}`);
+        break;
+    }
+  }
+  if (result.dryRun) {
+    const would = result.candidates.filter((c) => c.action === "reclaim").length;
+    log(
+      would > 0 ? `Re-run with --write to reclaim ${would} worktree(s).` : "Nothing to reclaim at this age."
+    );
+  }
+  if (!result.ok) process.exitCode = 1;
+}
 async function runWorktree(action, opts = {}) {
   switch (action) {
     case "add":
@@ -14133,12 +15262,18 @@ async function runWorktree(action, opts = {}) {
       return handleDoctor(opts);
     case "prune":
       return handlePrune(opts);
+    case "autohydrate":
+      return handleAutoHydrate(opts);
+    case "dematerialize":
+      return handleDematerialize(opts);
+    case "reclaim":
+      return handleReclaim(opts);
   }
 }
 
 // src/commands/workspace.ts
-import { existsSync as existsSync11, statSync as statSync3 } from "node:fs";
-import path80 from "node:path";
+import { existsSync as existsSync12, statSync as statSync3 } from "node:fs";
+import path84 from "node:path";
 init_fs();
 init_logger();
 
@@ -14196,8 +15331,8 @@ ${summaries.map(
 }
 
 // src/commands/workspace/doctor.ts
-import { existsSync as existsSync8 } from "node:fs";
-import path73 from "node:path";
+import { existsSync as existsSync9 } from "node:fs";
+import path77 from "node:path";
 init_logger();
 init_paths();
 
@@ -14205,14 +15340,14 @@ init_paths();
 init_fs();
 init_paths();
 import { readFileSync as readFileSync4 } from "node:fs";
-import path72 from "node:path";
+import path76 from "node:path";
 var MANIFEST_FILE2 = "workspace.manifest.json";
 function manifestPath(workspaceRoot) {
   return hausPath(workspaceRoot, MANIFEST_FILE2);
 }
 function hausVersion() {
   try {
-    const pkg = JSON.parse(readFileSync4(path72.join(packageRoot(), "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync4(path76.join(packageRoot(), "package.json"), "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -14304,7 +15439,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
   const manifestByName = new Map(manifest.repos.map((r) => [r.name, r]));
   const catalogRefByRepo = [];
   for (const repo of config.repos) {
-    const repoRoot = path73.resolve(workspaceRoot, repo.path);
+    const repoRoot = path77.resolve(workspaceRoot, repo.path);
     const entry = manifestByName.get(repo.name);
     if (!entry) {
       flag({
@@ -14329,7 +15464,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
         detail: `Set up at haus ${entry.hausVersionAtSetup}, current is ${currentVersion} \u2014 re-run setup.`
       });
     }
-    if (!existsSync8(claudePath(repoRoot))) {
+    if (!existsSync9(claudePath(repoRoot))) {
       flag({
         repo: repo.name,
         kind: "missing-claude",
@@ -14338,7 +15473,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
     }
     const lock = await checkLock(repoRoot);
     if (lock.catalogRef) catalogRefByRepo.push({ repo: repo.name, ref: lock.catalogRef });
-    if (!existsSync8(hausPath(repoRoot, "haus.lock.json"))) {
+    if (!existsSync9(hausPath(repoRoot, "haus.lock.json"))) {
       flag({
         repo: repo.name,
         kind: "missing-lock",
@@ -14369,7 +15504,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
     const memberById = new Map(members.map((m) => [m.id, m]));
     for (const entry of manifest.linkedContext) {
       const member = memberById.get(entry.repo);
-      if (!member || !existsSync8(member.absPath)) {
+      if (!member || !existsSync9(member.absPath)) {
         flag({
           repo: entry.repo,
           kind: "missing-linked-context-source",
@@ -14377,7 +15512,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
         });
         continue;
       }
-      if (!existsSync8(path73.join(workspaceRoot, entry.path))) {
+      if (!existsSync9(path77.join(workspaceRoot, entry.path))) {
         flag({
           repo: entry.repo,
           kind: "missing-linked-context-copy",
@@ -14423,18 +15558,18 @@ function emit(args) {
 init_logger();
 
 // src/workspace/link-context/link.ts
-import path76 from "node:path";
-import fs54 from "fs-extra";
+import path80 from "node:path";
+import fs59 from "fs-extra";
 init_fs();
 init_logger();
 
 // src/workspace/link-context/plan.ts
-import path75 from "node:path";
-import fs53 from "fs-extra";
+import path79 from "node:path";
+import fs58 from "fs-extra";
 
 // src/workspace/link-context/scan-source.ts
-import path74 from "node:path";
-import fs52 from "fs-extra";
+import path78 from "node:path";
+import fs57 from "fs-extra";
 var ASSET_SUBDIR = {
   skill: "skills",
   agent: "agents",
@@ -14442,36 +15577,36 @@ var ASSET_SUBDIR = {
 };
 async function hasLinkableContext(member) {
   for (const subdir of Object.values(ASSET_SUBDIR)) {
-    if (await fs52.pathExists(path74.join(member.absPath, ".claude", subdir))) return true;
+    if (await fs57.pathExists(path78.join(member.absPath, ".claude", subdir))) return true;
   }
   return false;
 }
 async function collectSkills(member) {
-  const dir = path74.join(member.absPath, ".claude", "skills");
-  if (!await fs52.pathExists(dir)) return [];
-  const names = await fs52.readdir(dir);
+  const dir = path78.join(member.absPath, ".claude", "skills");
+  if (!await fs57.pathExists(dir)) return [];
+  const names = await fs57.readdir(dir);
   const out = [];
   for (const name of [...names].sort()) {
-    const abs = path74.join(dir, name);
-    const stat = await fs52.lstat(abs);
+    const abs = path78.join(dir, name);
+    const stat = await fs57.lstat(abs);
     if (!stat.isDirectory()) continue;
-    if (!await fs52.pathExists(path74.join(abs, "SKILL.md"))) continue;
-    out.push({ type: "skill", name, sourceRelPath: path74.posix.join(".claude", "skills", name) });
+    if (!await fs57.pathExists(path78.join(abs, "SKILL.md"))) continue;
+    out.push({ type: "skill", name, sourceRelPath: path78.posix.join(".claude", "skills", name) });
   }
   return out;
 }
 async function collectFlatMarkdown(member, type) {
   const subdir = ASSET_SUBDIR[type];
-  const dir = path74.join(member.absPath, ".claude", subdir);
-  if (!await fs52.pathExists(dir)) return [];
-  const names = await fs52.readdir(dir);
+  const dir = path78.join(member.absPath, ".claude", subdir);
+  if (!await fs57.pathExists(dir)) return [];
+  const names = await fs57.readdir(dir);
   const out = [];
   for (const fileName of [...names].sort()) {
     if (!fileName.endsWith(".md")) continue;
-    const abs = path74.join(dir, fileName);
-    if (!(await fs52.lstat(abs)).isFile()) continue;
+    const abs = path78.join(dir, fileName);
+    if (!(await fs57.lstat(abs)).isFile()) continue;
     const name = fileName.slice(0, -".md".length);
-    out.push({ type, name, sourceRelPath: path74.posix.join(".claude", subdir, fileName) });
+    out.push({ type, name, sourceRelPath: path78.posix.join(".claude", subdir, fileName) });
   }
   return out;
 }
@@ -14486,9 +15621,9 @@ async function collectSourceAssets(member) {
 
 // src/workspace/link-context/plan.ts
 function repoFolderPrefix(member) {
-  const base = path75.posix.basename(member.folder);
+  const base = path79.posix.basename(member.folder);
   if (base && base !== "." && base !== "/") return base;
-  const fromAbs = path75.basename(member.absPath);
+  const fromAbs = path79.basename(member.absPath);
   return fromAbs || member.id;
 }
 function assetKey(type, destKey) {
@@ -14503,7 +15638,7 @@ async function buildLinkPlan(members) {
   const byKey = /* @__PURE__ */ new Map();
   const membersById = new Map(members.map((m) => [m.id, m]));
   for (const member of members) {
-    if (!await fs53.pathExists(member.absPath)) {
+    if (!await fs58.pathExists(member.absPath)) {
       skipped.push({ repo: member.id, reason: `not cloned locally (${member.absPath}) \u2014 skipped` });
       continue;
     }
@@ -14545,7 +15680,7 @@ async function buildLinkPlan(members) {
       name: asset.name,
       destKey,
       sourceRelPath: asset.sourceRelPath,
-      sourceAbsPath: path75.join(member.absPath, asset.sourceRelPath),
+      sourceAbsPath: path79.join(member.absPath, asset.sourceRelPath),
       sourceHash
     });
   }
@@ -14556,7 +15691,7 @@ async function buildLinkPlan(members) {
 function destRelPathFor(type, destKey) {
   const subdir = `${type}s`;
   const leaf = type === "skill" ? destKey : `${destKey}.md`;
-  return path76.posix.join(".claude", subdir, leaf);
+  return path80.posix.join(".claude", subdir, leaf);
 }
 async function runLinkContext(workspaceRoot, opts = {}) {
   const write = resolveWriteMode(opts, "preview-by-default").kind === "write";
@@ -14582,17 +15717,17 @@ async function runLinkContext(workspaceRoot, opts = {}) {
   const linkedAt = (/* @__PURE__ */ new Date()).toISOString();
   for (const entry of plan.entries) {
     const destRel = destRelPathFor(entry.type, entry.destKey);
-    const destAbs = path76.join(workspaceRoot, destRel);
+    const destAbs = path80.join(workspaceRoot, destRel);
     if (write) {
-      await fs54.ensureDir(path76.dirname(destAbs));
-      if (await fs54.pathExists(destAbs)) await fs54.remove(destAbs);
-      await fs54.copy(entry.sourceAbsPath, destAbs, {
+      await fs59.ensureDir(path80.dirname(destAbs));
+      if (await fs59.pathExists(destAbs)) await fs59.remove(destAbs);
+      await fs59.copy(entry.sourceAbsPath, destAbs, {
         overwrite: true,
         errorOnExist: false,
         dereference: false,
         filter: (s) => {
           try {
-            return !fs54.lstatSync(s).isSymbolicLink();
+            return !fs59.lstatSync(s).isSymbolicLink();
           } catch {
             return false;
           }
@@ -14621,7 +15756,7 @@ async function runLinkContext(workspaceRoot, opts = {}) {
         warn(`Refusing to remove linked context path outside the workspace root: ${old.path}`);
         continue;
       }
-      if (await fs54.pathExists(abs)) await fs54.remove(abs);
+      if (await fs59.pathExists(abs)) await fs59.remove(abs);
     }
   }
   if (write) {
@@ -14672,12 +15807,12 @@ async function runWorkspaceLinkContext(workspaceRoot, opts = {}) {
 }
 
 // src/commands/workspace/setup.ts
-import { existsSync as existsSync9, statSync } from "node:fs";
-import path78 from "node:path";
+import { existsSync as existsSync10, statSync } from "node:fs";
+import path82 from "node:path";
 
 // src/claude/write-workspace-claude-md.ts
-import path77 from "node:path";
-import fs55 from "fs-extra";
+import path81 from "node:path";
+import fs60 from "fs-extra";
 init_fs();
 init_logger();
 init_paths();
@@ -14702,11 +15837,11 @@ ${WORKSPACE_BLOCK_END}`;
 async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
   const block = buildWorkspaceImportBlock(opts.client, opts.members);
   const dryRun = opts.dryRun ?? false;
-  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path77.join(workspaceRoot, "CLAUDE.md");
+  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path81.join(workspaceRoot, "CLAUDE.md");
   const say = opts.quiet ? () => {
   } : log;
-  const existed = await fs55.pathExists(filePath);
-  const prev = existed ? await fs55.readFile(filePath, "utf8") : "";
+  const existed = await fs60.pathExists(filePath);
+  const prev = existed ? await fs60.readFile(filePath, "utf8") : "";
   const next = opts.collision ? `${block}
 ` : injectHausBlock(prev, block, WORKSPACE_SENTINELS);
   const printable = displayPath(workspaceRoot, filePath);
@@ -14735,20 +15870,20 @@ async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
 init_fs();
 init_logger();
 function resolveWorkspaceRoot(start = process.cwd()) {
-  let dir = path78.resolve(start);
+  let dir = path82.resolve(start);
   for (; ; ) {
-    if (existsSync9(path78.join(dir, WORKSPACE_FILE))) return dir;
-    const parent = path78.dirname(dir);
-    if (parent === dir) return path78.resolve(start);
+    if (existsSync10(path82.join(dir, WORKSPACE_FILE))) return dir;
+    const parent = path82.dirname(dir);
+    if (parent === dir) return path82.resolve(start);
     dir = parent;
   }
 }
 function isRootRepo(workspaceRoot, repoPath) {
-  return path78.resolve(workspaceRoot, repoPath) === path78.resolve(workspaceRoot);
+  return path82.resolve(workspaceRoot, repoPath) === path82.resolve(workspaceRoot);
 }
 async function runWorkspaceSetup(workspaceRoot, options = {}) {
   const apply = options.write ?? false;
-  const configText = await readText(path78.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path82.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
@@ -14775,12 +15910,12 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
   const statuses = [];
   const aggregateInputs = [];
   for (const repo of repos) {
-    const repoRoot = path78.resolve(workspaceRoot, repo.path);
+    const repoRoot = path82.resolve(workspaceRoot, repo.path);
     say(`
 \u2192 ${repo.name} (${repo.path})`);
     let res;
     try {
-      if (!existsSync9(repoRoot) || !statSync(repoRoot).isDirectory()) {
+      if (!existsSync10(repoRoot) || !statSync(repoRoot).isDirectory()) {
         throw new Error(`Repo path is not a directory: ${repo.path}`);
       }
       res = await runSetupCore(repoRoot, {
@@ -14880,7 +16015,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
   if (apply && !options.dryRun) {
     const statusByName = new Map(statuses.map((s) => [s.name, s]));
     const prior = await readManifest2(workspaceRoot);
-    if (!prior && existsSync9(manifestPath(workspaceRoot))) {
+    if (!prior && existsSync10(manifestPath(workspaceRoot))) {
       warn(
         "Existing workspace.manifest.json is unreadable \u2014 prior per-repo state will not be carried forward."
       );
@@ -14891,7 +16026,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
       const status = statusByName.get(repo.name);
       const role = repo.role ?? status?.roles?.[0] ?? "auto";
       if (status?.status === "ok") {
-        const lock = await checkLock(path78.resolve(workspaceRoot, repo.path));
+        const lock = await checkLock(path82.resolve(workspaceRoot, repo.path));
         manifestRepos.push({
           name: repo.name,
           path: repo.path,
@@ -14947,7 +16082,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
     try {
       const linkResult = await runLinkContext(workspaceRoot, { write: true, json: options.json });
       if (linkResult.ok) {
-        written.push(...linkResult.added.map((rel) => path78.join(workspaceRoot, rel)));
+        written.push(...linkResult.added.map((rel) => path82.join(workspaceRoot, rel)));
         if (!options.json) {
           say(
             `Linked ${linkResult.linked.length} cross-repo skill/agent/command copy(ies) into .claude/ (${linkResult.added.length} new, ${linkResult.removed.length} removed)${linkResult.skipped.length > 0 ? ` \u2014 ${linkResult.skipped.length} member(s) skipped, see above` : ""}.`
@@ -14979,9 +16114,9 @@ Workspace setup complete: ${ok} ok, ${failed} failed. Wrote ${written.length} fi
 }
 
 // src/commands/workspace/undo.ts
-import { existsSync as existsSync10, statSync as statSync2 } from "node:fs";
-import path79 from "node:path";
-import fs56 from "fs-extra";
+import { existsSync as existsSync11, statSync as statSync2 } from "node:fs";
+import path83 from "node:path";
+import fs61 from "fs-extra";
 init_fs();
 init_logger();
 init_paths();
@@ -15011,11 +16146,11 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
   }
   if (options.dryRun) {
     for (const repo of config.repos) {
-      const repoRoot = path79.resolve(workspaceRoot, repo.path);
+      const repoRoot = path83.resolve(workspaceRoot, repo.path);
       log(`
 \u2192 ${repo.name} (${repo.path})`);
       try {
-        if (!existsSync10(repoRoot) || !statSync2(repoRoot).isDirectory()) {
+        if (!existsSync11(repoRoot) || !statSync2(repoRoot).isDirectory()) {
           throw new Error(`Repo path is not a directory: ${repo.path}`);
         }
         await runUndo({ dryRun: true, root: repoRoot });
@@ -15032,7 +16167,7 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
         warn(`Refusing to remove linked context path outside the workspace root: ${entry.path}`);
         continue;
       }
-      if (await fs56.pathExists(abs)) {
+      if (await fs61.pathExists(abs)) {
         log(`[dry-run] Would remove ${entry.path} (linked ${entry.type} from ${entry.repo})`);
       }
     }
@@ -15042,12 +16177,12 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
       hausPath(workspaceRoot, "WORKSPACE.md")
     ];
     for (const abs of workspaceArtifacts) {
-      if (await fs56.pathExists(abs)) {
-        log(`[dry-run] Would remove ${path79.relative(workspaceRoot, abs)}`);
+      if (await fs61.pathExists(abs)) {
+        log(`[dry-run] Would remove ${path83.relative(workspaceRoot, abs)}`);
       }
     }
-    if (!await fs56.pathExists(hausPath(workspaceRoot, "WORKSPACE.md"))) {
-      const claudeMd = await readText(path79.join(workspaceRoot, "CLAUDE.md"));
+    if (!await fs61.pathExists(hausPath(workspaceRoot, "WORKSPACE.md"))) {
+      const claudeMd = await readText(path83.join(workspaceRoot, "CLAUDE.md"));
       if (claudeMd?.includes(WORKSPACE_BLOCK_BEGIN) || claudeMd && hasLegacyWorkspaceBlock(claudeMd)) {
         log("[dry-run] Would remove the workspace haus import block from CLAUDE.md");
       }
@@ -15066,11 +16201,11 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
   }
   let anyRepoFailed = false;
   for (const repo of config.repos) {
-    const repoRoot = path79.resolve(workspaceRoot, repo.path);
+    const repoRoot = path83.resolve(workspaceRoot, repo.path);
     log(`
 \u2192 ${repo.name} (${repo.path})`);
     try {
-      if (!existsSync10(repoRoot) || !statSync2(repoRoot).isDirectory()) {
+      if (!existsSync11(repoRoot) || !statSync2(repoRoot).isDirectory()) {
         throw new Error(`Repo path is not a directory: ${repo.path}`);
       }
       await runUndo({ yes: true, root: repoRoot });
@@ -15086,30 +16221,30 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
       warn(`Refusing to remove linked context path outside the workspace root: ${entry.path}`);
       continue;
     }
-    if (await fs56.pathExists(abs)) {
-      await fs56.remove(abs);
+    if (await fs61.pathExists(abs)) {
+      await fs61.remove(abs);
       log(`Removed ${entry.path} (linked ${entry.type} from ${entry.repo})`);
     }
   }
   for (const rel of WORKSPACE_AGGREGATE_FILES) {
     const abs = hausPath(workspaceRoot, rel);
-    if (await fs56.pathExists(abs)) {
-      await fs56.remove(abs);
-      log(`Removed ${path79.relative(workspaceRoot, abs)}`);
+    if (await fs61.pathExists(abs)) {
+      await fs61.remove(abs);
+      log(`Removed ${path83.relative(workspaceRoot, abs)}`);
     }
   }
   const manifestFile = manifestPath(workspaceRoot);
-  if (await fs56.pathExists(manifestFile)) {
-    await fs56.remove(manifestFile);
-    log(`Removed ${path79.relative(workspaceRoot, manifestFile)}`);
+  if (await fs61.pathExists(manifestFile)) {
+    await fs61.remove(manifestFile);
+    log(`Removed ${path83.relative(workspaceRoot, manifestFile)}`);
   }
   const workspaceMdPath = hausPath(workspaceRoot, "WORKSPACE.md");
-  if (await fs56.pathExists(workspaceMdPath)) {
-    await fs56.remove(workspaceMdPath);
-    log(`Removed ${path79.relative(workspaceRoot, workspaceMdPath)}`);
+  if (await fs61.pathExists(workspaceMdPath)) {
+    await fs61.remove(workspaceMdPath);
+    log(`Removed ${path83.relative(workspaceRoot, workspaceMdPath)}`);
   } else {
-    const claudeMdPath = path79.join(workspaceRoot, "CLAUDE.md");
-    if (existsSync10(claudeMdPath)) {
+    const claudeMdPath = path83.join(workspaceRoot, "CLAUDE.md");
+    if (existsSync11(claudeMdPath)) {
       const prev = await readText(claudeMdPath);
       if (prev?.includes(WORKSPACE_BLOCK_BEGIN)) {
         const next = stripHausBlock(prev, {
@@ -15117,19 +16252,19 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
           end: WORKSPACE_BLOCK_END
         });
         if (next.length === 0) {
-          await fs56.remove(claudeMdPath);
+          await fs61.remove(claudeMdPath);
           log("Removed CLAUDE.md (only contained the workspace haus import block).");
         } else {
-          await fs56.writeFile(claudeMdPath, next, "utf8");
+          await fs61.writeFile(claudeMdPath, next, "utf8");
           log("Removed haus import block from CLAUDE.md (user content preserved).");
         }
       } else if (prev && hasLegacyWorkspaceBlock(prev)) {
         const next = stripHausBlock(prev, { begin: BLOCK_BEGIN, end: BLOCK_END });
         if (next.length === 0) {
-          await fs56.remove(claudeMdPath);
+          await fs61.remove(claudeMdPath);
           log("Removed CLAUDE.md (only contained the pre-upgrade workspace haus import block).");
         } else {
-          await fs56.writeFile(claudeMdPath, next, "utf8");
+          await fs61.writeFile(claudeMdPath, next, "utf8");
           log(
             "Removed pre-upgrade workspace haus import block from CLAUDE.md (user content preserved)."
           );
@@ -15155,7 +16290,7 @@ function normalizeMaxDepth(maxDepth) {
   return void 0;
 }
 async function initWorkspace(options = {}) {
-  if (existsSync11(WORKSPACE_FILE) && !options.yes) {
+  if (existsSync12(WORKSPACE_FILE) && !options.yes) {
     const ok = await confirm(
       `${WORKSPACE_FILE} already exists \u2014 overwrite with a fresh placeholder? Existing client/repos/relationships will be lost. Run \`haus workspace discover\` instead to merge in newly found repos.`
     );
@@ -15177,7 +16312,7 @@ relationships: []
   log("Workspace initialized.");
 }
 async function scanWorkspace(workspaceRoot, opts) {
-  const configText = await readText(path80.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path84.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
@@ -15199,9 +16334,9 @@ async function scanWorkspace(workspaceRoot, opts) {
   const inputs = [];
   const failures = [];
   for (const repo of config.repos) {
-    const repoRoot = path80.resolve(workspaceRoot, repo.path);
+    const repoRoot = path84.resolve(workspaceRoot, repo.path);
     try {
-      if (!existsSync11(repoRoot) || !statSync3(repoRoot).isDirectory()) {
+      if (!existsSync12(repoRoot) || !statSync3(repoRoot).isDirectory()) {
         throw new Error("path is not a directory");
       }
       const result = await scanProject(repoRoot);
@@ -15268,7 +16403,7 @@ init_logger();
 init_paths();
 function cliVersion() {
   try {
-    const pkgPath = path81.join(packageRoot(), "package.json");
+    const pkgPath = path85.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
@@ -15278,7 +16413,7 @@ function cliVersion() {
 var program = new Command();
 function validateRuntimeNodeVersion() {
   try {
-    const pkgPath = path81.join(packageRoot(), "package.json");
+    const pkgPath = path85.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
     const requiredRange = pkg.engines?.node;
     if (requiredRange && !satisfiesVersion(process.version, requiredRange)) {
@@ -15438,6 +16573,35 @@ worktree.command("prune").description(
 ).option("--dry-run", "Preview which registrations would be pruned").option("--json", "Emit the structured prune result as JSON").action(
   (opts) => runWorktree("prune", { dryRun: opts.dryRun, json: opts.json })
 );
+worktree.command("autohydrate").description(
+  "Materialize + hydrate this worktree's missing member repos in the background when `worktree.autoHydrate` is enabled (the acting half of the flag; see ADR-0074)"
+).option("--from-hook", "Emit for the SessionStart hook \u2014 always exits 0").option("--dry-run", "Report what would be hydrated without forking anything").option("--json", "Emit the structured autohydrate result as JSON").addOption(new Option("--detached-child", "internal: run the forked hydration").hideHelp()).action(
+  (opts) => runWorktree("autohydrate", {
+    fromHook: opts.fromHook,
+    dryRun: opts.dryRun,
+    json: opts.json,
+    detachedChild: opts.detachedChild
+  })
+);
+worktree.command("dematerialize [slug]").description(
+  "Drop a workspace worktree's member worktrees while keeping the workspace worktree, its branch and its state (the other end of `hydrate --materialize`; see ADR-0075)"
+).option("--force", "Bypass the uncommitted/unpushed-work refusal").option("--dry-run", "Preview which members would be dropped").option("--json", "Emit the structured dematerialize result as JSON").action(
+  (slug, opts) => runWorktree("dematerialize", {
+    slug,
+    force: opts.force,
+    dryRun: opts.dryRun,
+    json: opts.json
+  })
+);
+worktree.command("reclaim").description(
+  "Dematerialize workspace worktrees untouched for longer than `worktree.reclaimAfterDays` \u2014 previews unless --write (ADR-0075)"
+).option("--older-than-days <n>", "Override worktree.reclaimAfterDays", Number.parseFloat).option("--write", "Perform the reclamation (default previews only)").option("--json", "Emit the structured reclaim result as JSON").action(
+  (opts) => runWorktree("reclaim", {
+    olderThanDays: opts.olderThanDays,
+    write: opts.write,
+    json: opts.json
+  })
+);
 worktree.command("doctor").description("Fast, side-effect-free health check for the current workspace worktree").option("--from-hook", "Emit for the SessionStart hook \u2014 always exits 0").action((opts) => runWorktree("doctor", { fromHook: opts.fromHook }));
 program.parseAsync(process.argv).catch((err) => {
   const message2 = err instanceof Error ? err.message : String(err);