@geraldmaron/construct 1.4.0 → 1.4.2

package/bin/construct

@@ -514,7 +514,8 @@ async function cmdDoctor() {
   const wantsFixMigrateState = wantsFixAll || args.includes('--fix-migrate-state');
 
   const checks = [];
-  const add = (label, pass, optional = false) => checks.push({ label, pass, optional });
+  const { DOCTOR_STATES } = await import('../lib/doctor/diagnosis.mjs');
+  const add = (label, pass, optional = false, failureState = pass ? DOCTOR_STATES.healthy : null) => checks.push({ label, pass, optional, failureState });
   const { isConstructSourceCheckout } = await import('../lib/doctor/source-checkout.mjs');
   const isSourceCheckout = isConstructSourceCheckout(ROOT_DIR);
   add('specialists/org exists', fs.existsSync(path.join(ROOT_DIR, 'specialists', 'org')));

package/bin/construct-postinstall.mjs

@@ -19,7 +19,7 @@
  */
 
 import { spawnSync } from 'node:child_process';
-import { existsSync, statSync, readFileSync } from 'node:fs';
+import { existsSync, statSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -109,13 +109,19 @@ if (consumerPkg.name === '@geraldmaron/construct') {
   process.exit(0);
 }
 
+// Track every project mutation for the itemized receipt written at the end.
+// npm has no uninstall lifecycle hook so the manifest is the only machine-readable
+// record of what the hook touched and how to revert it (CX-AUDIT-PACKAGE-004).
+const mutations = [];
+
 try {
-  stageProjectAdapters({
+  const stageResult = stageProjectAdapters({
     projectRoot: initCwd,
     packageRoot: PKG_ROOT,
     pkgVersion: PKG_VERSION,
     log,
   });
+  mutations.push({ path: '.construct', type: 'stage', synced: stageResult.synced });
 
   // ADR-0027: Ensure .gitignore covers the newly staged adapters (construct-f6l6).
   // Idempotent: missingIgnorePatterns returns only patterns not already present.
@@ -129,8 +135,27 @@ try {
     const block = `${prefix}\n${HEADER}\n${SUBHEADER}\n${missing.join('\n')}\n`;
     const { appendFileSync } = await import('node:fs');
     appendFileSync(giPath, block, 'utf8');
+    mutations.push({ path: '.gitignore', type: 'append', patterns: missing });
     log(`appended ${missing.length} Construct ignore pattern(s) to .gitignore`);
   }
+
+  // Write the itemized mutation receipt so consumers can audit and revert what the
+  // hook touched. Write is best-effort: a manifest failure must never break an install.
+  try {
+    mkdirSync(path.join(initCwd, '.construct'), { recursive: true });
+    const manifest = {
+      pkgVersion: PKG_VERSION,
+      ts: new Date().toISOString(),
+      files: mutations.map((m) => m.path),
+      mutations,
+      recovery: 'npx construct init --repair',
+    };
+    writeFileSync(
+      path.join(initCwd, '.construct', 'install-manifest.json'),
+      JSON.stringify(manifest, null, 2) + '\n',
+    );
+    log('wrote .construct/install-manifest.json');
+  } catch { /* manifest write must not fail the install */ }
 } catch (err) {
   fail(`Adapter staging failed: ${err.message}`, 'The package is installed; run `npx construct init` in this project to complete setup.');
   // Intentionally exit 0: staging is best-effort completion, and a non-zero exit

package/config/tag-vocabulary.json

@@ -0,0 +1,264 @@
+{
+  "version": 1,
+  "facets": {
+    "intake-type":     { "exclusive": true,  "auto_threshold": 0.80 },
+    "lifecycle":       { "exclusive": true,  "auto_threshold": 0.90 },
+    "priority":        { "exclusive": true,  "auto_threshold": 0.90 },
+    "signal-strength": { "exclusive": false, "auto_threshold": 0.95 },
+    "reversibility":   { "exclusive": true,  "auto_threshold": 0.85 },
+    "doctype":         { "exclusive": true,  "auto_threshold": 0.90 }
+  },
+  "tags": [
+    {
+      "id": "intake/bug",
+      "facet": "intake-type",
+      "label": "Bug",
+      "synonyms": ["defect", "regression", "error"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/user-signal",
+      "facet": "intake-type",
+      "label": "User Signal",
+      "synonyms": ["feedback", "user-feedback", "customer-signal"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/experiment",
+      "facet": "intake-type",
+      "label": "Experiment",
+      "synonyms": ["ab-test", "test", "trial"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/architecture",
+      "facet": "intake-type",
+      "label": "Architecture",
+      "synonyms": ["design", "system-design", "arch"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/incident",
+      "facet": "intake-type",
+      "label": "Incident",
+      "synonyms": ["outage", "postmortem", "production-issue"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/security",
+      "facet": "intake-type",
+      "label": "Security",
+      "synonyms": ["vulnerability", "cve", "threat"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/requirement",
+      "facet": "intake-type",
+      "label": "Requirement",
+      "synonyms": ["spec", "specification", "acceptance-criteria"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/research",
+      "facet": "intake-type",
+      "label": "Research",
+      "synonyms": ["study", "literature-review"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/ops",
+      "facet": "intake-type",
+      "label": "Ops",
+      "synonyms": ["operational", "runbook", "infra"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/eval-finding",
+      "facet": "intake-type",
+      "label": "Eval Finding",
+      "synonyms": ["evaluation", "eval", "benchmark-result"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/launch-asset",
+      "facet": "intake-type",
+      "label": "Launch Asset",
+      "synonyms": ["launch", "go-to-market", "release-material"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "intake/legal-compliance",
+      "facet": "intake-type",
+      "label": "Legal Compliance",
+      "synonyms": ["legal", "compliance", "regulatory"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "lifecycle/draft",
+      "facet": "lifecycle",
+      "label": "Draft",
+      "synonyms": ["wip", "in-progress"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "lifecycle/approved",
+      "facet": "lifecycle",
+      "label": "Approved",
+      "synonyms": ["accepted", "ratified"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "lifecycle/deprecated",
+      "facet": "lifecycle",
+      "label": "Deprecated",
+      "synonyms": ["sunset", "retiring"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "lifecycle/superseded",
+      "facet": "lifecycle",
+      "label": "Superseded",
+      "synonyms": ["replaced", "obsolete"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "lifecycle/archived",
+      "facet": "lifecycle",
+      "label": "Archived",
+      "synonyms": ["closed", "done"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "priority/p0",
+      "facet": "priority",
+      "label": "P0 - Critical",
+      "synonyms": ["critical", "blocker", "sev0"],
+      "promote_to_graph": true,
+      "status": "active"
+    },
+    {
+      "id": "priority/p1",
+      "facet": "priority",
+      "label": "P1 - High",
+      "synonyms": ["high", "urgent", "sev1"],
+      "promote_to_graph": true,
+      "status": "active"
+    },
+    {
+      "id": "priority/p2",
+      "facet": "priority",
+      "label": "P2 - Medium",
+      "synonyms": ["medium", "normal", "sev2"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "priority/p3",
+      "facet": "priority",
+      "label": "P3 - Low",
+      "synonyms": ["low", "nice-to-have", "sev3"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "signal/high-customer-interest",
+      "facet": "signal-strength",
+      "label": "High Customer Interest",
+      "synonyms": ["customer-demand", "high-demand", "top-request"],
+      "promote_to_graph": true,
+      "anchor_entities": ["customer-feedback"],
+      "expected_cardinality": 100,
+      "cardinality_window_days": 90,
+      "status": "active"
+    },
+    {
+      "id": "signal/internal-alignment",
+      "facet": "signal-strength",
+      "label": "Internal Alignment",
+      "synonyms": ["aligned", "consensus", "cross-team"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "signal/blocked",
+      "facet": "signal-strength",
+      "label": "Blocked",
+      "synonyms": ["dependency", "waiting", "stalled"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "reversibility/irreversible",
+      "facet": "reversibility",
+      "label": "Irreversible",
+      "synonyms": ["one-way-door", "permanent"],
+      "promote_to_graph": true,
+      "status": "active"
+    },
+    {
+      "id": "reversibility/reversible",
+      "facet": "reversibility",
+      "label": "Reversible",
+      "synonyms": ["two-way-door", "rollback"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "reversibility/quasi-reversible",
+      "facet": "reversibility",
+      "label": "Quasi-Reversible",
+      "synonyms": ["partially-reversible", "conditional-rollback"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "doctype/prd",
+      "facet": "doctype",
+      "label": "PRD",
+      "synonyms": ["product-requirements", "product-spec"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "doctype/adr",
+      "facet": "doctype",
+      "label": "ADR",
+      "synonyms": ["architecture-decision", "decision-record"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "doctype/rfc",
+      "facet": "doctype",
+      "label": "RFC",
+      "synonyms": ["request-for-comments", "proposal"],
+      "promote_to_graph": false,
+      "status": "active"
+    },
+    {
+      "id": "doctype/postmortem",
+      "facet": "doctype",
+      "label": "Postmortem",
+      "synonyms": ["incident-review", "retrospective"],
+      "promote_to_graph": false,
+      "status": "active"
+    }
+  ]
+}

package/lib/config/schema.mjs

@@ -156,7 +156,7 @@ export const FIELD_RULES = {
       types: { type: 'object', required: false },
     },
   },
-  scope: { type: 'string', required: false, maxLength: 40 },
+  scope: { type: 'string', required: false, maxLength: 40, enum: ['rnd', 'operations', 'creative', 'research'] },
   autoEmbed: { type: 'boolean', required: false },
   ingest: {
     type: 'object',

package/lib/doctor/diagnosis.mjs

@@ -0,0 +1,20 @@
+/**
+ * lib/doctor/diagnosis.mjs — typed failure-state taxonomy for the doctor command.
+ *
+ * Each constant names a distinct class of host / package / MCP / runtime / secrets
+ * failure so doctor findings carry an actionable code rather than a bare boolean.
+ * Consumers (bin/construct cmdDoctor, lib/host/readiness.mjs, tests) import these
+ * keys to ensure the full taxonomy is covered and no failure collapses to a generic
+ * "unhealthy" verdict.
+ */
+
+export const DOCTOR_STATES = {
+  'missing-config': 'A required configuration file or directory is absent.',
+  'stale-path': 'A registered path (toolkit, entrypoint, server) is outdated or points nowhere.',
+  'disabled': 'A feature or gate is explicitly disabled in config.',
+  'server-start-failure': 'The MCP or dashboard server failed to start or did not respond within the timeout.',
+  'secret-leak': 'A credential or secret is exposed in a tracked file or insecure location.',
+  'entrypoint-missing': 'A binary or script the runtime expects (construct-mcp, construct) is not found on PATH.',
+  'healthy': 'The check passed with no issues detected.',
+  'degraded': 'The check passed with warnings; functionality may be reduced.',
+};

package/lib/doctor/index.mjs

@@ -15,6 +15,7 @@ import { writeFileSync, existsSync, readFileSync, unlinkSync, mkdirSync } from '
 import { join } from 'node:path';
 
 import { record } from './audit.mjs';
+import { enableSecretAuditTrail } from '../providers/secret-audit-wiring.mjs';
 import * as disk from './watchers/disk.mjs';
 import * as cost from './watchers/cost.mjs';
 import * as processPressure from './watchers/process-pressure.mjs';
@@ -140,5 +141,9 @@ const isMain = (() => {
   try { return import.meta.url === `file://${process.argv[1]}`; } catch { return false; }
 })();
 if (isMain) {
+  // A long-lived daemon in its own process: wire the audit sink at the entry so any
+  // credential resolution a watcher performs is recorded on the shared trail rather
+  // than escaping it, matching the CLI entrypoint's own wiring.
+  enableSecretAuditTrail();
   await start();
 }

package/lib/embed/worker.mjs

@@ -9,6 +9,7 @@
 import os from 'node:os';
 import path from 'node:path';
 import { prepareConstructEnv } from '../runtime-env.mjs';
+import { enableSecretAuditTrail } from '../providers/secret-audit-wiring.mjs';
 import { EmbedDaemon } from './daemon.mjs';
 
 function parseArgv(argv) {
@@ -18,6 +19,10 @@ function parseArgv(argv) {
   return null;
 }
 
+// Snapshot ticks resolve provider credentials in the daemon's own process; wiring
+// the sink here records those op reads on the same trail as the CLI entrypoint.
+enableSecretAuditTrail();
+
 const configPath = parseArgv(process.argv.slice(2));
 const env = prepareConstructEnv();
 

package/lib/env-config.mjs

@@ -52,7 +52,15 @@ export function writeEnvValues(filePath, values = {}) {
     .filter(([, value]) => value !== undefined && value !== null && value !== '')
     .map(([key, value]) => `${key}=${value}`)
     .join('\n');
-  fs.writeFileSync(filePath, `${content}\n`, 'utf8');
+  fs.writeFileSync(filePath, `${content}\n`, { encoding: 'utf8', mode: 0o600 });
+
+  // config.env can hold plaintext credentials. writeFileSync keeps an existing inode's
+  // mode, so the mode option does not tighten a file an earlier write (or a caller that
+  // skipped its own chmod) left 0644; re-apply 0600 on every write so the credential
+  // file is never group/world readable.
+  if (process.platform !== 'win32') {
+    try { fs.chmodSync(filePath, 0o600); } catch { /* exotic filesystem */ }
+  }
 }
 
 function cleanEnvValue(value) {
@@ -103,7 +111,7 @@ function isOpReference(value) {
   return Boolean(extractOpRef(value));
 }
 
-function preferInjectedCredential(envValue, fileValue) {
+export function preferInjectedCredential(envValue, fileValue) {
   return Boolean(
     envValue
     && !isOpReference(envValue)

package/lib/export-validate.mjs

@@ -86,21 +86,53 @@ export function contentRoundtrip({ exportPath, format, sourceMarkdown, env = pro
 }
 
 // Local image and link targets must resolve on disk; remote URLs, anchors, and mailto are out of
-// scope for an on-disk integrity check.
+// scope for an on-disk integrity check. Three reference forms in source are covered: ![]() syntax,
+// raw inline <img src> HTML, and reference-style definitions ([id]: ./path). The produced HTML
+// file's own <img src> references are also scanned, catching assets referenced only in the export.
 
-export function referenceIntegrity(sourceMarkdown, baseDir) {
+export function referenceIntegrity(sourceMarkdown, baseDir, exportPath = null) {
   const body = sourceMarkdown.replace(/```[\s\S]*?```/g, '');
   const missingImages = [];
   const brokenLinks = [];
+
+  // Standard Markdown image syntax: ![alt](path)
   for (const match of body.matchAll(/!\[[^\]]*\]\(([^)]+)\)/g)) {
     const ref = match[1].split(/\s+/)[0];
     if (/^https?:|^data:/.test(ref)) continue;
     if (!fs.existsSync(path.resolve(baseDir, ref))) missingImages.push(ref);
   }
+
+  // Raw inline HTML <img src> in source markdown
+  for (const match of body.matchAll(/<img[^>]+src\s*=\s*["']([^"']+)["']/gi)) {
+    const ref = match[1];
+    if (/^https?:|^data:|^#/.test(ref)) continue;
+    if (!fs.existsSync(path.resolve(baseDir, ref))) missingImages.push(ref);
+  }
+
+  // Reference-style image/link definitions: [id]: ./path
+  for (const match of body.matchAll(/^\[[^\]]+\]:\s+(\S+)/gm)) {
+    const ref = match[1];
+    if (/^https?:|^#|^mailto:/.test(ref)) continue;
+    if (!fs.existsSync(path.resolve(baseDir, ref))) missingImages.push(ref);
+  }
+
+  // Standard Markdown link syntax: [text](path) (non-image)
   for (const match of body.matchAll(/(?<!!)\[[^\]]*\]\(([^)]+)\)/g)) {
     const ref = match[1].split(/\s+/)[0];
     if (/^https?:|^#|^mailto:/.test(ref)) continue;
     if (!fs.existsSync(path.resolve(baseDir, ref))) brokenLinks.push(ref);
   }
+
+  // Produced HTML file: scan internal <img src> references that may not appear in source markdown
+  if (exportPath && exportPath.endsWith('.html') && fs.existsSync(exportPath)) {
+    let html = '';
+    try { html = fs.readFileSync(exportPath, 'utf8'); } catch { /* skip */ }
+    for (const match of html.matchAll(/<img[^>]+src\s*=\s*["']([^"']+)["']/gi)) {
+      const ref = match[1];
+      if (/^https?:|^data:|^#/.test(ref)) continue;
+      if (!fs.existsSync(path.resolve(baseDir, ref))) missingImages.push(ref);
+    }
+  }
+
   return { ok: missingImages.length === 0 && brokenLinks.length === 0, missingImages, brokenLinks };
 }

package/lib/hooks/guard-bash.mjs

@@ -4,7 +4,9 @@
  *
  * Runs as PreToolUse on Bash. Scans the command against a blocklist of destructive patterns (rm -rf, force push to main, etc.) and exits 2 to block matches.
  *
- * @p95ms 5
+ * Budget covers the role-fence path below — doctorRoot lookup, last-agent file reads, and the lazy manifest/fence/approval imports — which the original 5ms target predated; the nightly bench (variance-heavy CI lane) measured ~17-19ms marginal, so the budget reflects that real cost with the ×2 gate tolerance still catching a true regression.
+ *
+ * @p95ms 15
  * @maxBlockingScope PreToolUse
  *
  * @lifecycle PreToolUse

package/lib/host/readiness.mjs

@@ -0,0 +1,109 @@
+/**
+ * lib/host/readiness.mjs — host-config readiness classifier for VS Code / Copilot.
+ *
+ * Distinguishes the discrete states a host-config can be in — from missing config
+ * through various partial-setup failure modes to healthy — rather than collapsing
+ * readiness to a binary file-presence check. Each state has an associated next-step
+ * hint surfaced by `construct doctor` to guide the developer toward a working setup.
+ *
+ * classifyHostReadiness({ host, settingsPath, mcpPath, root }) returns a reasonCode
+ * from HOST_READINESS_REASONS. Resolution order: missing_config → stale_path →
+ * jsonc_unpatched → wrong_key → disabled → healthy (runtime states untrusted /
+ * server_start_failure / missing_tool / sandbox_disabled require a live host session
+ * and are returned when the caller supplies runtimeState evidence).
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const HOST_READINESS_REASONS = Object.freeze([
+  'missing_config',
+  'stale_path',
+  'jsonc_unpatched',
+  'wrong_key',
+  'untrusted',
+  'disabled',
+  'server_start_failure',
+  'missing_tool',
+  'sandbox_disabled',
+  'healthy',
+]);
+
+export const HOST_READINESS_NEXT_STEPS = Object.freeze({
+  missing_config: 'Run `construct sync` to generate host config files.',
+  stale_path: 'Run `construct sync` to refresh the MCP server path.',
+  jsonc_unpatched: 'Run `construct sync` to merge managed settings into your settings.json.',
+  wrong_key: 'Run `construct sync` to correct the MCP autostart setting key.',
+  untrusted: 'Open VS Code, find the MCP server notification, and grant trust.',
+  disabled: 'Set `chat.mcp.autoStart: "always"` in your VS Code settings.',
+  server_start_failure: 'Check the MCP server log: `construct mcp:logs`.',
+  missing_tool: 'Run `construct sync` and restart VS Code.',
+  sandbox_disabled: 'Enable the MCP sandbox in VS Code extension settings.',
+  healthy: null,
+});
+
+const MANAGED_MCP_KEY_PATTERN = /\/lib\/mcp\/[a-z0-9-]+\.mjs$/i;
+const AUTOSTART_KEY = 'chat.mcp.autoStart';
+const AUTOSTART_KEY_WRONG_CASE_PATTERN = /^chat\.mcp\.autostart$/i;
+
+function tryReadJson(filePath) {
+  try { return JSON.parse(fs.readFileSync(filePath, 'utf8')); }
+  catch { return null; }
+}
+
+function isJsoncFile(filePath) {
+  try {
+    const text = fs.readFileSync(filePath, 'utf8');
+    JSON.parse(text);
+    return false;
+  } catch {
+    return true;
+  }
+}
+
+export function classifyHostReadiness({
+  host = 'vscode',
+  settingsPath = null,
+  mcpPath = null,
+  root = null,
+  runtimeState = null,
+} = {}) {
+  if (mcpPath && !fs.existsSync(mcpPath)) return 'missing_config';
+
+  if (mcpPath && root) {
+    const mcp = tryReadJson(mcpPath);
+    if (mcp) {
+      const servers = mcp.servers ?? {};
+      const hasStale = Object.values(servers).some((s) => {
+        const args = Array.isArray(s?.args) ? s.args : [];
+        return args.some((arg) => {
+          if (typeof arg !== 'string') return false;
+          const normalArg = arg.replace(/\\/g, '/');
+          const normalRoot = root.replace(/\\/g, '/');
+          return MANAGED_MCP_KEY_PATTERN.test(normalArg) && !normalArg.startsWith(`${normalRoot}/`);
+        });
+      });
+      if (hasStale) return 'stale_path';
+    }
+  }
+
+  if (settingsPath) {
+    if (fs.existsSync(settingsPath)) {
+      if (isJsoncFile(settingsPath)) return 'jsonc_unpatched';
+      const settings = tryReadJson(settingsPath);
+      if (settings) {
+        const hasWrongCase = Object.keys(settings).some(
+          (k) => k !== AUTOSTART_KEY && AUTOSTART_KEY_WRONG_CASE_PATTERN.test(k),
+        );
+        if (hasWrongCase) return 'wrong_key';
+        if (settings[AUTOSTART_KEY] === 'never' || settings[AUTOSTART_KEY] === false) {
+          return 'disabled';
+        }
+      }
+    }
+  }
+
+  if (runtimeState) return runtimeState;
+
+  return 'healthy';
+}

package/lib/host-disposition.mjs

@@ -41,13 +41,22 @@ export const IGNORED_PATTERNS = [
   '.construct/',
   '.mcp.json',
   '.github/prompts/',
-  '.github/copilot-instructions.md',
+  '.github/agents/',
   'config.env',
   'embed.yaml',
   'plan.md',
   'inbox/',
 ];
 
+// User-owned files Construct mutates only via replaceManagedBlock (ADR-0027 §2).
+// These are durable repo source, not ignored cache — they must NOT appear in
+// IGNORED_PATTERNS, but they still need an explicit disposition so consumers
+// know not to gitignore or delete them on uninstall.
+
+export const MANAGED_PATTERNS = [
+  '.github/copilot-instructions.md',
+];
+
 // A pattern counts as already-ignored when an existing line matches it exactly,
 // matches its bare/slashed form, or is a broader `*` / `**` catch-all.