@tryaura/aura-cli 0.1.0 → 0.2.0

package/dist/{plugins-n3DS8XXi.js → plugins-SZegBVXF.js}

@@ -1,12 +1,11 @@
-import { H as src_default$4, N as createAuraManifestWriteOperation, U as pluralize, V as SHARED_INSTRUCTIONS_TEMPLATE, _ as managedSnippetContentProblems, a as planSharedInstructionLink, b as canonicalizeManagedSnippet, c as planMcpSecretRemediation, f as planManifestMcpConvergence, i as skillDeploymentStatus, n as planSkillDeployment, o as canPlanMcpSecretRemediation, p as planMcpServerRemoval, r as sharedSkillsRoot, t as isAuraOwnedSkillTarget, u as mcpConvergenceBlockers, v as readManagedBlock, x as hashCanonicalManagedSnippet, y as AURA_MANAGED_SNIPPET_BEGIN_PREFIX } from "./skill-deployment-plan-C4GTrVSy.js";
+import { G as src_default$4, I as createAuraManifestWriteOperation, K as pluralize, S as readManagedBlock, W as SHARED_INSTRUCTIONS_TEMPLATE, _ as planSharedSkillTreeUpdate, b as reconcileManagedSnippet, c as planManifestMcpConvergence, f as isAuraOwnedSkillTarget, g as managedContentRevisionStatus, h as skillDeploymentStatus, i as planMcpSecretRemediation, l as planMcpServerRemoval, m as sharedSkillsRoot, n as canPlanMcpSecretRemediation, o as mcpConvergenceBlockers, p as planSkillDeployment, q as displayPath, t as planSharedInstructionLink, v as reconcileParsedManagedBlock, y as diffManagedSnippet } from "./shared-link-plan-DVgOyqP9.js";
 import { EMPTY_COLLECTION, McpWriteError, SHARED_INSTRUCTIONS_TEMPLATE_TOKEN, TIMEOUT_EXIT_CODE, collectJsonMcpServers, collectMcpServers, configStringArray, configStringRecord, defineAdapter, defineCheck, definePlugin, detectExecutable, detectLineEnding, inspectJsonMcpSecrets, isConfigRecord, isFileReference, jsonMcpEntry, jsonMcpSecretTransform, maskMarkdownCode, mcpCommandEntry, mcpEnvironmentVariableNames, mcpWriteResult, normalizeMcpServerDefinition, parseAtImports, parseConfigObject, parseInstalledSkills, parseJsonMcpConfig, redactMcpArguments, referenceTargetPath, sanitizeMcpUrl, skillDirectorySpecs, splitSourceLines, stdioTransport, writeJsonMcpServers } from "@tryaura/aura-sdk";
-import { dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { dirname, extname, isAbsolute, join, resolve, sep } from "node:path";
 import { parse, stringify } from "smol-toml";
 import { Buffer } from "node:buffer";
 import { parseTOML } from "toml-eslint-parser";
 import ignore from "ignore";
 import { createHash } from "node:crypto";
-import { createTwoFilesPatch } from "diff";
 import { isDeepStrictEqual } from "node:util";
 //#region ../../plugins/adapter-claude-code/src/contract.ts
 /**
@@ -2455,19 +2454,15 @@ function compareParagraphs$1(left, right) {
 //#region ../../plugins/checks-core/src/instruction-paths.ts
 /** Names an instruction file the way a user can address it from the current workspace. */
 function displayInstructionPath(path, model) {
-	const projectPath = pathInside(model.projectRoot ?? model.cwd, path);
-	if (projectPath !== void 0) return projectPath;
-	const homePath = pathInside(model.homeDir, path);
-	return homePath === void 0 ? path : `~/${homePath}`;
+	return displayPath(path, {
+		cwd: model.cwd,
+		homeDir: model.homeDir,
+		...model.projectRoot === void 0 ? {} : { projectRoot: model.projectRoot }
+	});
 }
 function instructionLineRange(startLine, endLine) {
 	return startLine === endLine ? String(startLine) : `${String(startLine)}-${String(endLine)}`;
 }
-function pathInside(root, path) {
-	const difference = relative(root, path);
-	if (difference.length === 0 || difference === ".." || difference.startsWith(`..${sep}`) || isAbsolute(difference)) return;
-	return difference.split(sep).join("/");
-}
 //#endregion
 //#region ../../plugins/checks-core/src/ins-003/clusters.ts
 /** Groups duplicate-pair edges into transitive connected components. */
@@ -2642,6 +2637,11 @@ const duplicateInstructionsCheck = defineCheck({
 	explain: `Repeated guidance across agent instruction files is easy to update in one place and forget in another. Similar copies also consume context repeatedly and can diverge into subtly different rules.
 
 Review each reported cluster and keep its clearest version in the shared instruction source. Remove the redundant copies only after confirming their scopes and conditions are preserved.`,
+	findingGroup: {
+		description: "Keep each piece of guidance in one canonical source.",
+		id: "checks-core/duplicate-instructions",
+		title: "Consolidate duplicated instruction guidance"
+	},
 	fixability: "manual",
 	id: "INS-003",
 	scope: "global",
@@ -4015,61 +4015,13 @@ function findingForProjectSignals(document, report, model) {
 	};
 }
 //#endregion
-//#region ../core/src/managed-block/reconcile-snippet.ts
-/** Reconciles exactly one snippet while preserving every other source byte. */
-function reconcileManagedSnippet(source, snippetId, resolution) {
-	const current = readManagedBlock(source);
-	if (current.status === "invalid") return invalidResult(source, current.notes, current.problems);
-	if (current.status === "absent") return missingSnippet(source, current.notes, snippetId, "an Aura-managed block");
-	const snippet = current.block.snippets.find((candidate) => candidate.id === snippetId);
-	if (snippet === void 0) return missingSnippet(source, current.notes, snippetId, "the Aura-managed block");
-	const lineEnding = markerLineEnding(source, snippet.startOffset, snippet.contentStartOffset);
-	const canonical = resolution.kind === "restore" ? canonicalizeManagedSnippet(resolution.content) : void 0;
-	if (canonical !== void 0) {
-		const problems = managedSnippetContentProblems(snippet.id, canonical);
-		if (problems.length > 0) return invalidResult(source, current.notes, problems);
-	}
-	const content = canonical === void 0 ? snippet.content : withLineEnding(canonical, lineEnding);
-	const hash = canonical === void 0 ? snippet.computedHash : hashCanonicalManagedSnippet(canonical);
-	const opening = `${AURA_MANAGED_SNIPPET_BEGIN_PREFIX}${snippet.id} sha256=${hash} -->${lineEnding}`;
-	const updated = source.slice(0, snippet.startOffset) + opening + content + source.slice(snippet.contentEndOffset);
-	return updated === source ? Object.freeze({
-		content: source,
-		notes: current.notes,
-		status: "unchanged"
-	}) : Object.freeze({
-		content: updated,
-		notes: current.notes,
-		status: "updated"
-	});
-}
-/** Creates the opt-in edited-versus-canonical detail used by the merge choice. */
-function diffManagedSnippet(path, editedContent, canonicalContent) {
-	return createTwoFilesPatch(`${path} (edited)`, `${path} (canonical)`, canonicalizeManagedSnippet(editedContent), canonicalizeManagedSnippet(canonicalContent), "edited", "canonical", { context: 3 });
-}
-function missingSnippet(source, notes, snippetId, location) {
-	return invalidResult(source, notes, [Object.freeze({
-		code: "missing-snippet",
-		message: `Snippet "${snippetId}" does not exist in ${location}.`
-	})]);
-}
-function invalidResult(source, notes, problems) {
-	return Object.freeze({
-		content: source,
-		notes,
-		problems,
-		status: "invalid"
-	});
-}
-function markerLineEnding(source, startOffset, contentStartOffset) {
-	return source.slice(startOffset, contentStartOffset).endsWith("\r\n") ? "\r\n" : "\n";
-}
-function withLineEnding(content, lineEnding) {
-	return lineEnding === "\n" ? content : content.replaceAll("\n", lineEnding);
-}
-//#endregion
 //#region ../../plugins/checks-core/src/instructions.ts
 const READY = "Aura can add the missing link with check --fix.";
+const SHARED_INSTRUCTION_GROUP = Object.freeze({
+	description: "Create the shared source and connect supported agent applications.",
+	id: "checks-core/shared-instructions",
+	title: "Complete the shared instruction setup"
+});
 const sharedInstructionsCheck = defineCheck({
 	defaultSeverity: "error",
 	detect(model) {
@@ -4090,6 +4042,7 @@ const sharedInstructionsCheck = defineCheck({
 	explain: `A non-empty shared instruction source gives every configured agent application one canonical set of guidance. Without it, application-specific files become independent copies that drift as preferences change.
 
 Re-run the check with \`--fix\` to create the shared source from Aura's starter template. Review the generated ~/agents/AGENTS.md, add personal guidance there, and check again.`,
+	findingGroup: SHARED_INSTRUCTION_GROUP,
 	fix(_finding, model) {
 		const shared = model.sharedInstructions;
 		if (shared.problem !== void 0 || (shared.content?.trim().length ?? 0) > 0) return;
@@ -4116,6 +4069,7 @@ const sharedInstructionLinksCheck = defineCheck({
 	explain: `Each detected agent application must load the canonical shared instructions through a mechanism its adapter understands. A missing import, native copy, or symlink leaves that application working from different rules even when the shared source is correct.
 
 Re-run the check with \`--fix\` to add the adapter-supported link without replacing unrelated instructions. Inspect the preview first, apply it, then restart the affected application if it caches instruction files.`,
+	findingGroup: SHARED_INSTRUCTION_GROUP,
 	fix(finding, model) {
 		const app = model.apps.find((candidate) => candidate.adapterId === findingAppId(finding));
 		if (app === void 0) return;
@@ -4133,6 +4087,7 @@ function detectMissingLink(app, model) {
 	const sharedPath = resolve(model.sharedInstructions.path);
 	if (shared !== void 0 && linksToShared(app, shared, sharedPath)) return [];
 	const outcome = planSharedInstructionLink(app, model);
+	if ("plan" in outcome && outcome.plan.operations.length === 0) return [];
 	const blocked = "blocked" in outcome;
 	return [{
 		details: blocked ? outcome.blocked : READY,
@@ -4143,10 +4098,16 @@ function detectMissingLink(app, model) {
 		metadata: { appId: app.adapterId }
 	}];
 }
-/** Whether the declared entry already carries a link the declared mechanism would have written. */
+/**
+* Whether the declared entry already carries a link the declared mechanism would have written.
+*
+* Target validity belongs to INS-001 and INS-006. INS-002 only owns the link's mechanism and
+* destination; treating a missing shared source as a missing link produces a zero-operation fix
+* because the planner correctly sees that the link itself is already converged.
+*/
 function linksToShared(app, shared, sharedPath) {
 	const entryPath = resolve(shared.entryPath);
-	return app.instructionFiles.some((document) => resolve(document.path) === entryPath && document.links.some((link) => link.valid && compatibleLink(shared.kind, link.kind) && resolve(link.targetPath) === sharedPath));
+	return app.instructionFiles.some((document) => resolve(document.path) === entryPath && document.links.some((link) => compatibleLink(shared.kind, link.kind) && resolve(link.targetPath) === sharedPath));
 }
 /** Which parsed link kinds each declared mechanism can be satisfied by. */
 function compatibleLink(declared, found) {
@@ -4323,9 +4284,9 @@ function isSymlinkDocument(document, model) {
 }
 //#endregion
 //#region ../../plugins/checks-core/src/mgd-001-fixes.ts
-const CHECK_ID$3 = "MGD-001";
+const CHECK_ID$4 = "MGD-001";
 function guidedFixes$2(finding, model) {
-	if (finding.checkId !== CHECK_ID$3) return [];
+	if (finding.checkId !== CHECK_ID$4) return [];
 	const kind = finding.metadata?.["kind"];
 	if (kind === "malformed") return [malformedMergeChoice(finding)];
 	if (kind === "unterminated-fence") return [unterminatedFenceChoice(finding)];
@@ -4576,6 +4537,302 @@ function manifestSnippetHashes(model) {
 	return hashes;
 }
 //#endregion
+//#region ../../plugins/checks-core/src/mgd-002-fixes.ts
+function managedContentUpdateChoices(finding, model) {
+	if (finding.checkId !== "MGD-002") return [];
+	const kind = finding.metadata?.["kind"];
+	if (kind === "snippet-update" || kind === "snippet-diverged") return snippetUpdateChoices(finding, model);
+	if (kind === "snippet-missing") return missingSnippetChoices(finding, model);
+	return kind === "skill-update" || kind === "skill-diverged" ? skillUpdateChoices(finding, model) : [];
+}
+/**
+* How a choice names the revision it would apply.
+*
+* A diverged revision is a deliberate move to content that is not newer, so calling it an update
+* would misdescribe what the user is accepting.
+*/
+function applyLabel(finding, version) {
+	return `${finding.metadata?.["kind"] === "snippet-update" || finding.metadata?.["kind"] === "skill-update" ? "Update to" : "Switch to"} ${version}`;
+}
+function snippetUpdateChoices(finding, model) {
+	const context = readyFindingContext(finding, model);
+	if (context === void 0) return [];
+	const { contentId, manifest: manifestState } = context;
+	const installed = manifestState.value.snippets.find((snippet) => snippet.id === contentId);
+	const available = model.availableSnippets.find((snippet) => snippet.id === contentId);
+	const located = locateManagedSnippet(model, contentId);
+	if (installed === void 0 || available === void 0 || located === void 0) return [];
+	if (!located.snippet.hashMatches || located.snippet.computedHash !== installed.hash) return [resolveDriftFirst(contentId)];
+	const reconciled = reconcileManagedSnippet(located.document.content, contentId, {
+		content: available.content,
+		kind: "restore"
+	});
+	if (reconciled.status === "invalid") return [resolveDriftFirst(contentId)];
+	const manifest = {
+		...manifestState.value,
+		snippets: manifestState.value.snippets.map((snippet) => snippet === installed ? {
+			...snippet,
+			hash: available.hash,
+			pinned: false,
+			version: available.version
+		} : snippet)
+	};
+	return [{
+		details: () => diffManagedSnippet(located.document.path, located.snippet.content, available.content),
+		id: "update",
+		label: applyLabel(finding, available.version),
+		plan: {
+			operations: [{
+				content: reconciled.content,
+				path: located.document.path,
+				type: "write"
+			}, createAuraManifestWriteOperation(manifestState, manifest)],
+			summary: `Set managed snippet ${contentId} to ${available.version}.`
+		}
+	}];
+}
+function missingSnippetChoices(finding, model) {
+	const context = readyFindingContext(finding, model);
+	if (context === void 0) return [];
+	const { contentId, manifest } = context;
+	const installed = manifest.value.snippets.find((snippet) => snippet.id === contentId);
+	if (installed === void 0) return [];
+	const pinnedManifest = {
+		...manifest.value,
+		snippets: manifest.value.snippets.map((snippet) => snippet === installed ? {
+			...snippet,
+			pinned: true
+		} : snippet)
+	};
+	const choices = [{
+		id: "pin",
+		label: "Keep as pinned",
+		plan: {
+			operations: [createAuraManifestWriteOperation(manifest, pinnedManifest)],
+			summary: `Keep unavailable snippet ${contentId} at its installed revision.`
+		}
+	}];
+	const removal = removeSnippetPlan(model, contentId, installed);
+	if (removal !== void 0) choices.push({
+		id: "remove",
+		label: "Remove",
+		plan: removal
+	});
+	return choices;
+}
+function removeSnippetPlan(model, contentId, installed) {
+	if (model.manifest.status !== "ready") return;
+	const located = locateManagedSnippet(model, contentId);
+	if (located === void 0) return;
+	const preserve = located.document.parsed.status === "present" ? located.document.parsed.block.snippets.map((snippet) => snippet.id).filter((id) => id !== contentId) : [];
+	const reconciled = reconcileParsedManagedBlock(located.document.content, located.document.parsed, [], {
+		ownedSnippetIds: model.manifest.value.snippets.map((snippet) => snippet.id),
+		preserveSnippetIds: preserve,
+		previousSnippetHashes: new Map(model.manifest.value.snippets.map((snippet) => [snippet.id, snippet.hash]))
+	});
+	if (reconciled.status === "invalid") return;
+	const manifest = {
+		...model.manifest.value,
+		snippets: model.manifest.value.snippets.filter((snippet) => snippet !== installed)
+	};
+	return {
+		operations: [{
+			content: reconciled.content,
+			path: located.document.path,
+			type: "write"
+		}, createAuraManifestWriteOperation(model.manifest, manifest)],
+		summary: `Remove unavailable managed snippet ${contentId}.`
+	};
+}
+function skillUpdateChoices(finding, model) {
+	const context = readyFindingContext(finding, model);
+	const sourceId = finding.metadata?.["sourceId"];
+	if (context === void 0 || typeof sourceId !== "string") return [];
+	const { contentId, manifest: manifestState } = context;
+	const installed = manifestState.value.skills.find((skill) => skill.id === contentId && skill.source === sourceId);
+	const available = model.availableSkills?.find((skill) => skill.id === contentId && skill.source.id === sourceId);
+	const shared = model.sharedSkills?.find((skill) => skill.id === contentId);
+	if (installed === void 0 || available === void 0 || shared === void 0) return [];
+	if (shared.problem !== void 0 || shared.treeHash !== installed.treeHash) return [resolveSkillDriftFirst(contentId)];
+	const manifest = {
+		...manifestState.value,
+		skills: manifestState.value.skills.map((skill) => skill === installed ? updatedSkill(skill, available) : skill)
+	};
+	return [{
+		id: "update",
+		label: applyLabel(finding, available.version),
+		plan: {
+			operations: [...planSharedSkillTreeUpdate(shared.path, shared.entries, available), createAuraManifestWriteOperation(manifestState, manifest)],
+			summary: `Set managed skill ${contentId} to ${available.version}.`
+		}
+	}];
+}
+function readyFindingContext(finding, model) {
+	const contentId = finding.metadata?.["contentId"];
+	return typeof contentId === "string" && model.manifest.status === "ready" ? {
+		contentId,
+		manifest: model.manifest
+	} : void 0;
+}
+function updatedSkill(installed, available) {
+	return {
+		...installed,
+		pinned: false,
+		treeHash: available.treeHash,
+		version: available.version
+	};
+}
+function locateManagedSnippet(model, contentId) {
+	for (const document of managedDocuments(model)) {
+		if (document.parsed.status !== "present") continue;
+		const snippet = document.parsed.block.snippets.find((candidate) => candidate.id === contentId);
+		if (snippet !== void 0) return {
+			document,
+			snippet
+		};
+	}
+}
+function resolveDriftFirst(contentId) {
+	return {
+		id: "resolve-drift",
+		label: "Resolve local edits first",
+		plan: {
+			manualSteps: [`Run \`aura check --only MGD-001 --fix --interactive\` and resolve edits to ${contentId}, then review this update again.`],
+			operations: [],
+			summary: `Resolve local edits to ${contentId} before updating it.`
+		}
+	};
+}
+function resolveSkillDriftFirst(contentId) {
+	return {
+		id: "resolve-drift",
+		label: "Review local edits first",
+		plan: {
+			manualSteps: [`Review the locally changed shared skill ${contentId}; pin or reconcile it before applying the source update.`],
+			operations: [],
+			summary: `Review local edits to skill ${contentId} before updating it.`
+		}
+	};
+}
+const managedContentUpdateCheck = defineCheck({
+	defaultSeverity: "info",
+	detect: detectManagedContentUpdates,
+	explain: "Aura records the exact version and content hash of each managed snippet and skill. When an installed plugin offers a different revision, Aura reports it and waits for a reviewed change instead of silently replacing managed content. A revision that is not newer — a rollback, or one this build cannot order — is reported too, because Aura keeps the recorded revision either way and an unreported hold would look like nothing to do. Pinned selections remain quiet until they are unpinned.\n\nRun `aura check --fix --interactive` to review bundled revisions and vanished snippets. Locally edited content must be resolved first; directory-sourced skill updates stay in `aura setup`, where network and credential approval are explicit.",
+	fix: () => void 0,
+	fixability: "guided",
+	guidedFixes: managedContentUpdateChoices,
+	id: "MGD-002",
+	scope: "global",
+	title: "Managed snippets and skills are at their reviewed source revisions"
+});
+function detectManagedContentUpdates(model) {
+	if (model.manifest.status !== "ready") return [];
+	return [...model.manifest.value.snippets.flatMap((snippet) => snippetFinding(snippet, model)), ...model.manifest.value.skills.flatMap((skill) => skillFinding(skill, model))];
+}
+function snippetFinding(installed, model) {
+	if (installed.pinned) return [];
+	const available = model.availableSnippets.find((snippet) => snippet.id === installed.id);
+	if (available === void 0) return [{
+		id: `snippet:${installed.id}:missing`,
+		message: `Managed snippet ${installed.id} at version ${installed.version} is no longer provided by an installed plugin.`,
+		metadata: {
+			contentId: installed.id,
+			kind: "snippet-missing"
+		}
+	}];
+	const status = managedContentRevisionStatus(installed.version, installed.hash, available.version, available.hash);
+	if (status === "current") return [];
+	if (status === "diverged") return [{
+		details: "Aura keeps the recorded revision because the offered one is not newer. Re-run `aura setup` interactively to switch to it deliberately, or pin this snippet to stop the comparison.",
+		id: `snippet:${installed.id}:diverged`,
+		message: `Managed snippet ${installed.id} is recorded at version ${installed.version}, but the installed plugin offers ${available.version}, which is not newer.`,
+		metadata: {
+			availableVersion: available.version,
+			contentId: installed.id,
+			installedVersion: installed.version,
+			kind: "snippet-diverged"
+		}
+	}];
+	return [{
+		id: `snippet:${installed.id}:update`,
+		message: `Managed snippet ${installed.id} can update from version ${installed.version} to ${available.version}.`,
+		metadata: {
+			availableVersion: available.version,
+			contentId: installed.id,
+			installedVersion: installed.version,
+			kind: "snippet-update"
+		}
+	}];
+}
+function skillFinding(installed, model) {
+	if (installed.pinned || !installed.source.startsWith("plugin:")) return [];
+	const available = model.availableSkills?.find((skill) => skill.id === installed.id && skill.source.id === installed.source);
+	if (available === void 0) return [];
+	const status = managedContentRevisionStatus(installed.version, installed.treeHash, available.version, available.treeHash);
+	if (status === "current") return [];
+	const location = { path: join(sharedSkillsRoot(model.homeDir), installed.id) };
+	if (status === "diverged") return [{
+		details: "Aura keeps the recorded revision because the offered one is not newer. Re-run `aura setup` interactively to switch to it deliberately, or pin this skill to stop the comparison.",
+		id: `skill:${installed.source}:${installed.id}:diverged`,
+		locations: [location],
+		message: `Managed skill ${installed.id} is recorded at version ${installed.version}, but the installed plugin offers ${available.version}, which is not newer.`,
+		metadata: {
+			availableVersion: available.version,
+			contentId: installed.id,
+			installedVersion: installed.version,
+			kind: "skill-diverged",
+			sourceId: installed.source
+		}
+	}];
+	return [{
+		id: `skill:${installed.source}:${installed.id}:update`,
+		locations: [location],
+		message: `Managed skill ${installed.id} can update from version ${installed.version} to ${available.version}.`,
+		metadata: {
+			availableVersion: available.version,
+			contentId: installed.id,
+			installedVersion: installed.version,
+			kind: "skill-update",
+			sourceId: installed.source
+		}
+	}];
+}
+/**
+* Deliberately manual: the only resolution is a full `setup` run.
+*
+* Recording the decision means asking the apps picker, and this check must never start a nested
+* command. Declaring it fixable would open an interactive fix on a single choice that changes
+* nothing — a prompt whose only answer leaves the finding exactly where it was — so the next step
+* is carried on the finding itself instead.
+*/
+const unmanagedDetectedAppCheck = defineCheck({
+	defaultSeverity: "info",
+	detect: detectUnmanagedApps,
+	explain: "Aura can inspect an installed agent application without managing it. This informational check highlights detected applications that have never been accepted or ignored in the Aura manifest.\n\nRun `aura setup` to add the application, or leave it unchecked once to record that Aura should ignore it. There is no automatic fix: the decision belongs to the apps step, and this check never starts a nested command.",
+	findingGroup: {
+		description: "Run `aura setup` to manage them or record an ignore decision.",
+		id: "checks-core/application-management",
+		title: "Decide which detected applications Aura should manage"
+	},
+	fixability: "manual",
+	id: "MGD-003",
+	scope: "global",
+	title: "Detected applications have an explicit Aura management decision"
+});
+function detectUnmanagedApps(model) {
+	const apps = model.manifest.status === "ready" ? model.manifest.value.apps : {};
+	const ignored = new Set(model.manifest.status === "ready" ? model.manifest.value.ignoredApps ?? [] : []);
+	return model.apps.flatMap((app) => {
+		if (app.synthetic === true || Object.hasOwn(apps, app.adapterId) || ignored.has(app.adapterId)) return [];
+		return [{
+			details: `Run \`aura setup\` and select ${app.displayName} to manage it, or leave it unchecked to record an ignored-app decision.`,
+			id: app.adapterId,
+			message: `${app.displayName} detected but not managed — run \`aura setup\` to add it.`,
+			metadata: { appId: app.adapterId }
+		}];
+	});
+}
+//#endregion
 //#region ../../plugins/checks-core/src/mcp-common.ts
 /**
 * The servers the manifest selects for applications this scan can actually converge.
@@ -4681,7 +4938,17 @@ function detectParity(model) {
 	if (model.manifest.status !== "ready") return [];
 	const desired = desiredMcpTargets(model);
 	const desiredByApp = /* @__PURE__ */ new Map();
-	const findings = [];
+	const findings = (model.overriddenRequiredMcpServers ?? []).map((override) => ({
+		details: "The omission was explicitly confirmed during setup and remains recorded in the Aura manifest. Run `aura setup` to add the server or keep the documented deviation.",
+		id: `override:${override.catalogId}`,
+		message: `MCP server ${override.catalogId} required by ${override.requiredBy} is explicitly omitted; this machine deviates from the team preset.`,
+		metadata: {
+			catalogId: override.catalogId,
+			kind: "preset-override",
+			requiredBy: override.requiredBy
+		},
+		severity: "info"
+	}));
 	const affected = /* @__PURE__ */ new Set();
 	for (const target of desired) {
 		const names = desiredByApp.get(target.appId) ?? /* @__PURE__ */ new Set();
@@ -4806,36 +5073,26 @@ function inlineCredential(transport) {
 /**
 * One row per state, rather than the same three-way branch spelled out for each string.
 *
-* The five strings a state needs were previously five parallel ternaries in two functions, so
-* adding a state meant finding all of them and nothing made them agree. Keyed by state, the
-* compiler requires the row and the lookups cannot drift.
+* The strings a state needs were previously parallel ternaries in two functions, so adding a state
+* meant finding all of them and nothing made them agree. Keyed by state, the compiler requires the
+* row and the lookups cannot drift.
 */
 const CURSOR_STATE_ACTIONS = Object.freeze({
 	disabled: {
-		choiceId: "enable-in-cursor",
-		choiceLabel: "Enable in Cursor",
 		guidance: (name) => `Open Cursor, open MCP settings, and enable server ${name}.`,
-		message: (name, displayName) => `MCP server ${name} is disabled in ${displayName}.`,
-		summary: (name) => `Enable MCP server ${name} in Cursor.`
+		message: (name, displayName) => `MCP server ${name} is disabled in ${displayName}.`
 	},
 	error: {
-		choiceId: "repair-in-cursor",
-		choiceLabel: "Repair in Cursor",
 		guidance: (name) => `Open Cursor's MCP settings, inspect the connection error for server ${name}, and repair its configuration or service.`,
-		message: (name, displayName) => `MCP server ${name} in ${displayName} cannot be reached because Cursor reported a connection error.`,
-		summary: (name) => `Repair MCP server ${name} in Cursor.`
+		message: (name, displayName) => `MCP server ${name} in ${displayName} cannot be reached because Cursor reported a connection error.`
 	},
 	"needs-approval": {
-		choiceId: "approve-in-cursor",
-		choiceLabel: "Approve in Cursor",
 		guidance: (name) => `Open Cursor, open MCP settings, and approve server ${name}.`,
-		message: (name, displayName) => `MCP server ${name} in ${displayName} needs approval.`,
-		summary: (name) => `Approve MCP server ${name} in Cursor.`
+		message: (name, displayName) => `MCP server ${name} in ${displayName} needs approval.`
 	}
 });
 //#endregion
 //#region ../../plugins/checks-core/src/mcp-003-cursor.ts
-const CHECK_ID$1 = "MCP-003";
 /**
 * Cursor runtime-state findings that are not superseded by a concrete transport failure.
 *
@@ -4857,23 +5114,6 @@ function cursorMcpStateFindings(app, concretelyFailed) {
 		return state === "error" && concretelyFailed.has(mcpServerNameKey(app.adapterId, name)) ? [] : [cursorStateFinding(app, name, state)];
 	});
 }
-/** Zero-operation guided action for one Cursor-owned runtime-state finding. */
-function cursorMcpStateChoice(finding) {
-	if (finding.checkId !== CHECK_ID$1 || finding.metadata?.["appId"] !== "cursor" || finding.metadata?.["kind"] !== "cursor-state") return;
-	const name = finding.metadata["serverName"];
-	const state = finding.metadata["state"];
-	if (typeof name !== "string" || !isActionableState(state)) return;
-	const action = CURSOR_STATE_ACTIONS[state];
-	return {
-		id: action.choiceId,
-		label: action.choiceLabel,
-		plan: {
-			manualSteps: [action.guidance(name), "Run `aura check` again."],
-			operations: [],
-			summary: action.summary(name)
-		}
-	};
-}
 /** Stable identity for the name-level state Cursor reports. */
 function mcpServerNameKey(appId, name) {
 	return `${appId}\0${name}`;
@@ -4882,6 +5122,7 @@ function cursorStateFinding(app, name, state) {
 	const action = CURSOR_STATE_ACTIONS[state];
 	return {
 		details: action.guidance(name),
+		fixability: "manual",
 		id: `${app.adapterId}:${name}:cursor-${state}`,
 		message: action.message(name, app.displayName),
 		metadata: {
@@ -4903,6 +5144,7 @@ function cursorStateFinding(app, name, state) {
 function unknownStateFinding(app, name) {
 	return {
 		details: `Run \`cursor-agent mcp list\` to see what ${app.displayName} reports for server ${name}, and check whether server ${name} is approved and enabled in its MCP settings.`,
+		fixability: "manual",
 		id: `${app.adapterId}:${name}:cursor-unknown`,
 		message: `MCP server ${name}'s state in ${app.displayName} could not be understood.`,
 		metadata: {
@@ -4918,6 +5160,7 @@ function unavailableFinding(app, reason) {
 	const cause = reason === "timeout" ? "did not finish in time" : "exited unsuccessfully";
 	return {
 		details: `Run \`cursor-agent mcp list\` to see why, then re-run \`aura check\`. Approval and enablement of ${app.displayName}'s MCP servers were not checked; every other MCP check still ran.`,
+		fixability: "manual",
 		id: `${app.adapterId}:cursor-state-unavailable`,
 		message: `${app.displayName}'s MCP server states were not read because \`cursor-agent mcp list\` ${cause}.`,
 		metadata: {
@@ -4928,9 +5171,6 @@ function unavailableFinding(app, reason) {
 		severity: "info"
 	};
 }
-function isActionableState(value) {
-	return value === "needs-approval" || value === "disabled" || value === "error";
-}
 //#endregion
 //#region ../../plugins/checks-core/src/mcp-003.ts
 const CHECK_ID = "MCP-003";
@@ -4971,6 +5211,7 @@ function unsetEnvironmentFindings(model) {
 		const credential = catalog?.manifest.credentialEnv.find((candidate) => candidate.name === variableName);
 		return [{
 			details: credentialDetails(server.name, variableName, credential, catalog?.manifest.docsUrl),
+			fixability: "manual",
 			id: `environment:${String(serverIndex)}:${variableName}`,
 			locations: [{ path: model.manifest.path }],
 			message: `MCP server ${server.name} needs environment variable ${variableName}.`,
@@ -5012,8 +5253,6 @@ function findingFor(server, probe, model) {
 	};
 }
 function guidedFixes$1(finding, model) {
-	const cursorChoice = cursorMcpStateChoice(finding);
-	if (cursorChoice !== void 0) return [cursorChoice];
 	const server = findingServer(finding, model);
 	const kind = finding.metadata?.["kind"];
 	if (server === void 0 || kind !== "command" && kind !== "url") return [];
@@ -5079,6 +5318,11 @@ const mcp004 = defineCheck({
 	explain: `Inline credentials in MCP configuration can leak through source control, logs, diagnostics, and copied configuration. Aura identifies credential-bearing fields without retaining their values, prefixes, or lengths.
 
 Re-run with \`--fix --interactive\` to replace every behavior-preserving sighting in the same source file with an environment reference. Copy the current values directly from the named file before applying the rewrite; Aura never displays or stores those values outside the protected undo payload, which stays owner-only under \`~/agents/.backups\` until twenty later fixes have pushed it out of the journal. Then rotate each credential at its issuer: moving a value behind an environment reference stops it leaking again, not from wherever it has already reached.`,
+	findingGroup: {
+		description: "Replace inline credentials with environment-variable references.",
+		id: "checks-core/mcp-credentials",
+		title: "Protect credentials stored in MCP configuration"
+	},
 	fix: remediation,
 	fixability: "guided",
 	guidedFixes,
@@ -5652,6 +5896,8 @@ const checksCorePlugin = definePlugin({
 		instructionContextBudgetCheck,
 		instructionPrecedenceCheck,
 		managedBlockHashCheck,
+		managedContentUpdateCheck,
+		unmanagedDetectedAppCheck,
 		mcp001,
 		mcp002,
 		mcp003,