@tryaura/aura-cli 0.1.1 → 0.2.1

package/dist/bin/aura.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { n as OFFICIAL_REGISTRY_OPTIONS, t as OFFICIAL_PLUGINS } from "../plugins-DDfc7XT9.js";
-import { t as runCli } from "../run-ZDkvqvZb.js";
+import { n as OFFICIAL_REGISTRY_OPTIONS, t as OFFICIAL_PLUGINS } from "../plugins-Dbasvr1u.js";
+import { t as runCli } from "../run.boundary-CF5kZTH3.js";
 //#endregion
 //#region src/bin.ts
 await runCli({
@@ -8,7 +8,8 @@ await runCli({
 		command: "aura",
 		description: "Agent Unification & Repair Assistant",
 		displayName: "Aura",
-		version: "0.1.1"
+		docsUrl: "https://tryaura.sh/docs/introduction",
+		version: "0.2.1"
 	},
 	plugins: OFFICIAL_PLUGINS,
 	registry: OFFICIAL_REGISTRY_OPTIONS

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { a as CliRuntime, i as CliRegistryOptions, n as CliDistro, r as CliExitCode, t as CliBranding } from "./types-DmBu6g0d.js";
+import { a as CliRuntime, i as CliRegistryOptions, n as CliDistro, r as CliExitCode, t as CliBranding } from "./types--E7zqKfw.js";
 import { AdapterSupport, AuraConfigurationProvenance, FindingLocation, FindingPresentation, Fixability, HttpFailureReason, HttpPostRequest, HttpPostResult, JsonObject, Scope, Severity, TelemetryEvent, TelemetrySink, TelemetrySink as TelemetrySink$1 } from "@tryaura/aura-sdk";
 //#region src/http-telemetry-sink.d.ts
 /** A privacy-safe reason one HTTP delivery was dropped. */
@@ -93,6 +93,14 @@ interface ReportDiagnostic {
   readonly path?: string | undefined;
   readonly phase: "check" | "detect" | "files" | "fix" | "parse" | "read" | "support";
 }
+interface ReportRepositoryPreset {
+  readonly path: string;
+  readonly status: "applied" | "held";
+}
+/** Configuration state that affects how a check document should be interpreted. */
+interface ReportConfiguration {
+  readonly repositoryPreset?: ReportRepositoryPreset | undefined;
+}
 type ReportStatus = "clean" | "empty" | "error" | "operational-error" | "warning";
 interface ReportFixOperation {
   readonly conflict?: string | undefined;
@@ -111,6 +119,7 @@ interface ReportFix {
 }
 interface CheckReportV1 {
   readonly apps: readonly ReportApp[];
+  readonly configuration?: ReportConfiguration | undefined;
   readonly diagnostics: readonly ReportDiagnostic[];
   readonly findings: readonly ReportFinding[];
   readonly fixes?: readonly ReportFix[] | undefined;
@@ -122,6 +131,7 @@ interface CheckReportV1 {
 }
 type CheckReport = CheckReportV1;
 interface CheckExplanationV1 {
+  readonly configuration?: ReportConfiguration | undefined;
   readonly enabled: boolean;
   readonly explain: string;
   readonly fixability: Fixability;
@@ -149,4 +159,4 @@ type CheckExplanation = CheckExplanationV1;
 declare function runCli(distro: CliDistro, runtime?: CliRuntime): Promise<CliExitCode>;
 declare function createHttpTelemetrySink(options: HttpTelemetrySinkOptions): TelemetrySink$1;
 //#endregion
-export { type CheckCounts, type CheckExplanation, type CheckExplanationV1, type CheckReport, type CheckReportV1, type CheckSummary, type CliBranding, type CliDistro, type CliExitCode, type CliRegistryOptions, type CliRuntime, type HttpTelemetryDeliveryFailure, type HttpTelemetrySinkOptions, type PassedCheck, type ReportApp, type ReportDiagnostic, type ReportFinding, type ReportFix, type ReportFixOperation, type ReportStatus, type TelemetryEvent, type TelemetrySink, createHttpTelemetrySink, runCli };
+export { type CheckCounts, type CheckExplanation, type CheckExplanationV1, type CheckReport, type CheckReportV1, type CheckSummary, type CliBranding, type CliDistro, type CliExitCode, type CliRegistryOptions, type CliRuntime, type HttpTelemetryDeliveryFailure, type HttpTelemetrySinkOptions, type PassedCheck, type ReportApp, type ReportConfiguration, type ReportDiagnostic, type ReportFinding, type ReportFix, type ReportFixOperation, type ReportRepositoryPreset, type ReportStatus, type TelemetryEvent, type TelemetrySink, createHttpTelemetrySink, runCli };

package/dist/index.js

@@ -1,5 +1,5 @@
-import { i as vetHttpUrl, n as clampHttpTimeout, r as failureReason, t as runCli } from "./run-ZDkvqvZb.js";
-//#region ../core/src/http-post.ts
+import { i as vetHttpUrl, n as clampHttpTimeout, r as failureReason, t as runCli } from "./run.boundary-CF5kZTH3.js";
+//#region ../core/src/http-post.boundary.ts
 /**
 * Creates a bounded, TLS-only JSON POST that never rejects.
 *

package/dist/plugins/index.d.ts

@@ -1,4 +1,4 @@
-import { i as CliRegistryOptions } from "../types-DmBu6g0d.js";
+import { i as CliRegistryOptions } from "../types--E7zqKfw.js";
 import { AuraPlugin } from "@tryaura/aura-sdk";
 //#region src/plugins.d.ts
 declare const checksCorePlugin: AuraPlugin;

package/dist/plugins/index.js

@@ -1,2 +1,2 @@
-import { a as codexPlugin, i as claudeCodePlugin, n as OFFICIAL_REGISTRY_OPTIONS, o as cursorPlugin, r as checksCorePlugin, s as officialContentPlugin, t as OFFICIAL_PLUGINS } from "../plugins-DDfc7XT9.js";
+import { a as codexPlugin, i as claudeCodePlugin, n as OFFICIAL_REGISTRY_OPTIONS, o as cursorPlugin, r as checksCorePlugin, s as officialContentPlugin, t as OFFICIAL_PLUGINS } from "../plugins-Dbasvr1u.js";
 export { OFFICIAL_PLUGINS, OFFICIAL_REGISTRY_OPTIONS, checksCorePlugin, claudeCodePlugin, codexPlugin, cursorPlugin, officialContentPlugin };

package/dist/{plugins-DDfc7XT9.js → plugins-Dbasvr1u.js}

@@ -1,6 +1,6 @@
-import { G as src_default$4, I as createAuraManifestWriteOperation, K as pluralize, S as readManagedBlock, W as SHARED_INSTRUCTIONS_TEMPLATE, _ as planSharedSkillTreeUpdate, b as reconcileManagedSnippet, c as planManifestMcpConvergence, f as isAuraOwnedSkillTarget, g as managedContentRevisionStatus, h as skillDeploymentStatus, i as planMcpSecretRemediation, l as planMcpServerRemoval, m as sharedSkillsRoot, n as canPlanMcpSecretRemediation, o as mcpConvergenceBlockers, p as planSkillDeployment, t as planSharedInstructionLink, v as reconcileParsedManagedBlock, y as diffManagedSnippet } from "./shared-link-plan-BigeLxDX.js";
+import { G as src_default$4, I as createAuraManifestWriteOperation, K as pluralize, S as readManagedBlock, W as SHARED_INSTRUCTIONS_TEMPLATE, _ as planSharedSkillTreeUpdate, b as reconcileManagedSnippet, c as planManifestMcpConvergence, f as isAuraOwnedSkillTarget, g as managedContentRevisionStatus, h as skillDeploymentStatus, i as planMcpSecretRemediation, l as planMcpServerRemoval, m as sharedSkillsRoot, n as canPlanMcpSecretRemediation, o as mcpConvergenceBlockers, p as planSkillDeployment, q as displayPath, t as planSharedInstructionLink, v as reconcileParsedManagedBlock, y as diffManagedSnippet } from "./shared-link-plan-D8fxdFYv.js";
 import { EMPTY_COLLECTION, McpWriteError, SHARED_INSTRUCTIONS_TEMPLATE_TOKEN, TIMEOUT_EXIT_CODE, collectJsonMcpServers, collectMcpServers, configStringArray, configStringRecord, defineAdapter, defineCheck, definePlugin, detectExecutable, detectLineEnding, inspectJsonMcpSecrets, isConfigRecord, isFileReference, jsonMcpEntry, jsonMcpSecretTransform, maskMarkdownCode, mcpCommandEntry, mcpEnvironmentVariableNames, mcpWriteResult, normalizeMcpServerDefinition, parseAtImports, parseConfigObject, parseInstalledSkills, parseJsonMcpConfig, redactMcpArguments, referenceTargetPath, sanitizeMcpUrl, skillDirectorySpecs, splitSourceLines, stdioTransport, writeJsonMcpServers } from "@tryaura/aura-sdk";
-import { dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { dirname, extname, isAbsolute, join, resolve, sep } from "node:path";
 import { parse, stringify } from "smol-toml";
 import { Buffer } from "node:buffer";
 import { parseTOML } from "toml-eslint-parser";
@@ -1194,12 +1194,10 @@ function validateToml(content, message) {
 //#endregion
 //#region ../../plugins/adapter-codex/src/project-directories.ts
 /**
-* Every directory of the current project Codex consults, from `cwd` outward to the repository root.
+* Every directory Codex searches for project instructions, from `cwd` to the repository root.
 *
-* Two features need exactly this list. Codex keys `[projects."..."]` by the directory it was
-* launched in, which is frequently a subdirectory of the repository rather than its root, and it
-* reads one `AGENTS.md` per directory from the root down to `cwd`. Both are the same walk read in
-* opposite directions, so they share it rather than each keeping a copy.
+* Codex reads one `AGENTS.md` per directory from the root down to `cwd`. Project trust deliberately
+* does not share this walk: Codex checks only the exact cwd and the primary Git checkout for trust.
 *
 * Without a repository root there is nothing to walk to: every ancestor of the working directory is
 * a different project as far as Codex is concerned, so only `cwd` is considered. The same answer
@@ -1351,11 +1349,10 @@ function remainingBytes(selected, files, remaining) {
 /**
 * Reads the current project's trust marker from Codex's shared configuration.
 *
-* Codex keys `[projects."..."]` by the directory it was launched in, which is frequently a
-* subdirectory of the repository rather than its root. Looking only at the root would report a
-* project as untrusted whenever the developer started Codex from somewhere inside it, so every
-* directory from `cwd` up to and including the repository root is considered and the narrowest
-* recorded answer wins.
+* Codex first checks the exact directory it was launched in, then the primary Git checkout. The
+* second identity matters for linked worktrees: Codex resolves their `.git` pointer back to the
+* main checkout, so trusting that checkout covers every associated worktree unless an exact cwd
+* entry overrides it.
 */
 function parseProjectTrust(file, lookup) {
 	const root = parseConfigObject(file.content, parse);
@@ -1363,7 +1360,7 @@ function parseProjectTrust(file, lookup) {
 	const projects = root["projects"];
 	if (!isConfigRecord(projects)) return "unknown";
 	const entries = new Map(Object.entries(projects).map(([key, value]) => [normalize(key), value]));
-	for (const directory of projectDirectories(lookup)) {
+	for (const directory of trustDirectories(lookup)) {
 		const project = entries.get(directory);
 		if (!isConfigRecord(project)) continue;
 		const trust = project["trust_level"];
@@ -1371,6 +1368,12 @@ function parseProjectTrust(file, lookup) {
 	}
 	return "unknown";
 }
+function trustDirectories(lookup) {
+	const cwd = normalize(lookup.cwd);
+	if (lookup.gitMainWorktreeRoot === void 0) return [cwd];
+	const mainWorktreeRoot = normalize(lookup.gitMainWorktreeRoot);
+	return cwd === mainWorktreeRoot ? [cwd] : [cwd, mainWorktreeRoot];
+}
 /** Collapses separators and trailing slashes so a config key and a scanned path compare equal. */
 function normalize(directory) {
 	return resolve(directory);
@@ -1401,7 +1404,7 @@ const codexAdapter = defineAdapter({
 	mcpWrite: writeMcpServers$1,
 	mcpSecrets: transformMcpSecrets$1,
 	parse: (input) => {
-		const { cwd, files, homeDir, projectRoot } = input;
+		const { cwd, files, gitMainWorktreeRoot, homeDir } = input;
 		const mcp = files.get(CODEX_SOURCE_IDS.mcp);
 		const mcpConfig = mcp === void 0 ? EMPTY_MCP : parseMcpServers$1(mcp);
 		const instructions = selectInstructionFiles(files, {
@@ -1414,7 +1417,7 @@ const codexAdapter = defineAdapter({
 			mcpSecretSightings: mcpConfig.secretSightings ?? [],
 			metadata: { [CODEX_PROJECT_TRUST_KEY]: mcp === void 0 ? "unknown" : parseProjectTrust(mcp, {
 				cwd,
-				projectRoot
+				gitMainWorktreeRoot
 			}) },
 			problems: [...shadowedEntryProblems(instructions.shadowed), ...unusableConfig(mcp, mcpConfig.malformed)],
 			skills: parseInstalledSkills(CODEX_ADAPTER_ID, input, SKILL_DIRECTORIES),
@@ -2162,7 +2165,7 @@ const env004 = defineCheck({
 	detect: (model) => detectConflicts(model),
 	explain: `Claude Code can appear unable to work when its effective default permission mode is plan or dontAsk. Codex skips project-scoped configuration when a project is untrusted, so Aura also reports projects that are not explicitly trusted.
 
-Claude Code: edit the settings file named by the finding and choose default or acceptEdits as appropriate. Codex: edit ~/.codex/config.toml and add a \`[projects."<project-root>"]\` section with \`trust_level = "trusted"\` after reviewing the repository.`,
+Claude Code: edit the settings file named by the finding and choose default or acceptEdits as appropriate. Codex: after reviewing the repository, edit ~/.codex/config.toml and trust the exact working directory or the primary Git checkout. Codex resolves linked worktrees back to that primary checkout.`,
 	fix: (finding, model) => guidedFix$2(finding, model),
 	fixability: "guided",
 	id: "ENV-004",
@@ -2198,7 +2201,7 @@ function codexFindings(app) {
 	if (trust === "trusted" || trust === "unreadable") return [];
 	const path = sourcePath$2(app, CODEX_SOURCE_IDS.mcp);
 	return [{
-		details: trust === "untrusted" ? "Codex explicitly marks this project untrusted and skips its project-scoped configuration." : "Codex has no trusted entry for this project or any directory inside it, so project-scoped configuration may be unavailable until trust is confirmed.",
+		details: trust === "untrusted" ? "Codex explicitly marks this project untrusted and skips its project-scoped configuration." : "Codex has no trusted entry for this working directory or its primary Git checkout, so project-scoped configuration may be unavailable until trust is confirmed.",
 		id: `codex-project-trust:${trust}`,
 		...path === void 0 ? {} : { locations: [{ path }] },
 		message: trust === "untrusted" ? "Codex marks this project as untrusted." : "Codex does not mark this project as trusted.",
@@ -2223,11 +2226,14 @@ function guidedFix$2(finding, model) {
 			summary: "Change Claude Code's restrictive default permission mode."
 		};
 	}
-	if (appId === "codex" && model.projectRoot !== void 0) return {
-		manualSteps: [`After reviewing the repository, add [projects.${JSON.stringify(model.projectRoot)}] with trust_level = "trusted" in ~/.codex/config.toml.`, "Restart Codex in the project and run `aura check` again."],
-		operations: [],
-		summary: "Trust the current project in Codex."
-	};
+	if (appId === "codex" && model.projectRoot !== void 0) {
+		const trustRoot = model.gitMainWorktreeRoot ?? model.cwd;
+		return {
+			manualSteps: [`After reviewing the repository, add [projects.${JSON.stringify(trustRoot)}] with trust_level = "trusted" in ~/.codex/config.toml.`, "Restart Codex in the project and run `aura check` again."],
+			operations: [],
+			summary: "Trust the current project in Codex."
+		};
+	}
 }
 //#endregion
 //#region ../../plugins/checks-core/src/hashing.ts
@@ -2454,19 +2460,15 @@ function compareParagraphs$1(left, right) {
 //#region ../../plugins/checks-core/src/instruction-paths.ts
 /** Names an instruction file the way a user can address it from the current workspace. */
 function displayInstructionPath(path, model) {
-	const projectPath = pathInside(model.projectRoot ?? model.cwd, path);
-	if (projectPath !== void 0) return projectPath;
-	const homePath = pathInside(model.homeDir, path);
-	return homePath === void 0 ? path : `~/${homePath}`;
+	return displayPath(path, {
+		cwd: model.cwd,
+		homeDir: model.homeDir,
+		...model.projectRoot === void 0 ? {} : { projectRoot: model.projectRoot }
+	});
 }
 function instructionLineRange(startLine, endLine) {
 	return startLine === endLine ? String(startLine) : `${String(startLine)}-${String(endLine)}`;
 }
-function pathInside(root, path) {
-	const difference = relative(root, path);
-	if (difference.length === 0 || difference === ".." || difference.startsWith(`..${sep}`) || isAbsolute(difference)) return;
-	return difference.split(sep).join("/");
-}
 //#endregion
 //#region ../../plugins/checks-core/src/ins-003/clusters.ts
 /** Groups duplicate-pair edges into transitive connected components. */
@@ -2641,6 +2643,11 @@ const duplicateInstructionsCheck = defineCheck({
 	explain: `Repeated guidance across agent instruction files is easy to update in one place and forget in another. Similar copies also consume context repeatedly and can diverge into subtly different rules.
 
 Review each reported cluster and keep its clearest version in the shared instruction source. Remove the redundant copies only after confirming their scopes and conditions are preserved.`,
+	findingGroup: {
+		description: "Keep each piece of guidance in one canonical source.",
+		id: "checks-core/duplicate-instructions",
+		title: "Consolidate duplicated instruction guidance"
+	},
 	fixability: "manual",
 	id: "INS-003",
 	scope: "global",
@@ -2755,7 +2762,7 @@ const legacyInstructionsCheck = defineCheck({
 	detect: (model) => legacyDocuments(model.instructionFiles).map((legacy) => toFinding(legacy, model)),
 	explain: `Legacy instruction files are easy to forget after changing agent applications or configuration formats. They may still be loaded unexpectedly, or hold useful guidance that newer application files never received.
 
-Re-run the check with \`--fix --interactive\` to review the suggested migration steps, then use the \`setup\` command to consolidate selected content. Aura archives originals through its reversible backup history instead of deleting them silently.`,
+Re-run the check with \`--fix\` to review the suggested migration steps, then use the \`setup\` command to consolidate selected content. Aura archives originals through its reversible backup history instead of deleting them silently.`,
 	fix: guidedFix$1,
 	fixability: "guided",
 	id: "INS-004",
@@ -3465,7 +3472,7 @@ const instructionLinkIntegrityCheck = defineCheck({
 	detect: detectLinkProblems,
 	explain: `Instruction imports must point to files the application can load without cycles or excessive nesting. Broken or unsupported chains silently discard guidance and can leave an agent running with only part of the intended instructions.
 
-Re-run the check with \`--fix --interactive\` to review the affected source and target paths. Create or correct missing targets, remove one edge from cycles, and flatten chains that exceed the named application's supported depth.`,
+Re-run the check with \`--fix\` to review the affected source and target paths. Create or correct missing targets, remove one edge from cycles, and flatten chains that exceed the named application's supported depth.`,
 	fix: guidedFix,
 	fixability: "guided",
 	id: "INS-006",
@@ -4016,6 +4023,11 @@ function findingForProjectSignals(document, report, model) {
 //#endregion
 //#region ../../plugins/checks-core/src/instructions.ts
 const READY = "Aura can add the missing link with check --fix.";
+const SHARED_INSTRUCTION_GROUP = Object.freeze({
+	description: "Create the shared source and connect supported agent applications.",
+	id: "checks-core/shared-instructions",
+	title: "Complete the shared instruction setup"
+});
 const sharedInstructionsCheck = defineCheck({
 	defaultSeverity: "error",
 	detect(model) {
@@ -4036,6 +4048,7 @@ const sharedInstructionsCheck = defineCheck({
 	explain: `A non-empty shared instruction source gives every configured agent application one canonical set of guidance. Without it, application-specific files become independent copies that drift as preferences change.
 
 Re-run the check with \`--fix\` to create the shared source from Aura's starter template. Review the generated ~/agents/AGENTS.md, add personal guidance there, and check again.`,
+	findingGroup: SHARED_INSTRUCTION_GROUP,
 	fix(_finding, model) {
 		const shared = model.sharedInstructions;
 		if (shared.problem !== void 0 || (shared.content?.trim().length ?? 0) > 0) return;
@@ -4062,6 +4075,7 @@ const sharedInstructionLinksCheck = defineCheck({
 	explain: `Each detected agent application must load the canonical shared instructions through a mechanism its adapter understands. A missing import, native copy, or symlink leaves that application working from different rules even when the shared source is correct.
 
 Re-run the check with \`--fix\` to add the adapter-supported link without replacing unrelated instructions. Inspect the preview first, apply it, then restart the affected application if it caches instruction files.`,
+	findingGroup: SHARED_INSTRUCTION_GROUP,
 	fix(finding, model) {
 		const app = model.apps.find((candidate) => candidate.adapterId === findingAppId(finding));
 		if (app === void 0) return;
@@ -4079,6 +4093,7 @@ function detectMissingLink(app, model) {
 	const sharedPath = resolve(model.sharedInstructions.path);
 	if (shared !== void 0 && linksToShared(app, shared, sharedPath)) return [];
 	const outcome = planSharedInstructionLink(app, model);
+	if ("plan" in outcome && outcome.plan.operations.length === 0) return [];
 	const blocked = "blocked" in outcome;
 	return [{
 		details: blocked ? outcome.blocked : READY,
@@ -4089,10 +4104,16 @@ function detectMissingLink(app, model) {
 		metadata: { appId: app.adapterId }
 	}];
 }
-/** Whether the declared entry already carries a link the declared mechanism would have written. */
+/**
+* Whether the declared entry already carries a link the declared mechanism would have written.
+*
+* Target validity belongs to INS-001 and INS-006. INS-002 only owns the link's mechanism and
+* destination; treating a missing shared source as a missing link produces a zero-operation fix
+* because the planner correctly sees that the link itself is already converged.
+*/
 function linksToShared(app, shared, sharedPath) {
 	const entryPath = resolve(shared.entryPath);
-	return app.instructionFiles.some((document) => resolve(document.path) === entryPath && document.links.some((link) => link.valid && compatibleLink(shared.kind, link.kind) && resolve(link.targetPath) === sharedPath));
+	return app.instructionFiles.some((document) => resolve(document.path) === entryPath && document.links.some((link) => compatibleLink(shared.kind, link.kind) && resolve(link.targetPath) === sharedPath));
 }
 /** Which parsed link kinds each declared mechanism can be satisfied by. */
 function compatibleLink(declared, found) {
@@ -4269,9 +4290,9 @@ function isSymlinkDocument(document, model) {
 }
 //#endregion
 //#region ../../plugins/checks-core/src/mgd-001-fixes.ts
-const CHECK_ID$5 = "MGD-001";
+const CHECK_ID$4 = "MGD-001";
 function guidedFixes$2(finding, model) {
-	if (finding.checkId !== CHECK_ID$5) return [];
+	if (finding.checkId !== CHECK_ID$4) return [];
 	const kind = finding.metadata?.["kind"];
 	if (kind === "malformed") return [malformedMergeChoice(finding)];
 	if (kind === "unterminated-fence") return [unterminatedFenceChoice(finding)];
@@ -4442,7 +4463,7 @@ const managedBlockHashCheck = defineCheck({
 	detect: detectManagedBlockDrift,
 	explain: `Aura hashes each managed snippet so hand edits cannot be overwritten silently. A mismatch means the installed text no longer matches the registered version, so a later setup run must not guess which side should win.
 
-Re-run the check with \`--fix --interactive\` and choose Keep yours to adopt the edit, Restore to return to registered content, or Merge to review both versions and reconcile them manually. Every executable choice is previewed and backed up before Aura writes.`,
+Re-run the check with \`--fix\` and choose Keep yours to adopt the edit, Restore to return to registered content, or Merge to review both versions and reconcile them manually. Every executable choice is previewed and backed up before Aura writes.`,
 	fix: () => void 0,
 	fixability: "guided",
 	guidedFixes: guidedFixes$2,
@@ -4464,7 +4485,7 @@ function findingsForDocument(document, model) {
 		const manifestHash = manifestHashes.get(snippet.id);
 		return !snippet.hashMatches || manifestHash !== void 0 && manifestHash !== snippet.computedHash;
 	}).map((snippet) => ({
-		details: "Run `aura check --fix --interactive` and choose Keep yours, Restore, or Merge before running setup again.",
+		details: "Run `aura check --fix` and choose Keep yours, Restore, or Merge before running setup again.",
 		id: `${document.sourceId}:${snippet.id}`,
 		locations: [{
 			line: snippet.startLine,
@@ -4480,7 +4501,7 @@ function findingsForDocument(document, model) {
 }
 function unterminatedFenceFinding(document, line, model) {
 	return {
-		details: "Close the Markdown fence, then run `aura check --fix --interactive` again. Aura will not reconcile this document while its markers are hidden.",
+		details: "Close the Markdown fence, then run `aura check --fix` again. Aura will not reconcile this document while its markers are hidden.",
 		id: `${document.sourceId}:unterminated-fence`,
 		locations: [{
 			...line === void 0 ? {} : { line },
@@ -4682,7 +4703,7 @@ function resolveDriftFirst(contentId) {
 		id: "resolve-drift",
 		label: "Resolve local edits first",
 		plan: {
-			manualSteps: [`Run \`aura check --only MGD-001 --fix --interactive\` and resolve edits to ${contentId}, then review this update again.`],
+			manualSteps: [`Run \`aura check --only MGD-001 --fix\` and resolve edits to ${contentId}, then review this update again.`],
 			operations: [],
 			summary: `Resolve local edits to ${contentId} before updating it.`
 		}
@@ -4702,7 +4723,7 @@ function resolveSkillDriftFirst(contentId) {
 const managedContentUpdateCheck = defineCheck({
 	defaultSeverity: "info",
 	detect: detectManagedContentUpdates,
-	explain: "Aura records the exact version and content hash of each managed snippet and skill. When an installed plugin offers a different revision, Aura reports it and waits for a reviewed change instead of silently replacing managed content. A revision that is not newer — a rollback, or one this build cannot order — is reported too, because Aura keeps the recorded revision either way and an unreported hold would look like nothing to do. Pinned selections remain quiet until they are unpinned.\n\nRun `aura check --fix --interactive` to review bundled revisions and vanished snippets. Locally edited content must be resolved first; directory-sourced skill updates stay in `aura setup`, where network and credential approval are explicit.",
+	explain: "Aura records the exact version and content hash of each managed snippet and skill. When an installed plugin offers a different revision, Aura reports it and waits for a reviewed change instead of silently replacing managed content. A revision that is not newer — a rollback, or one this build cannot order — is reported too, because Aura keeps the recorded revision either way and an unreported hold would look like nothing to do. Pinned selections remain quiet until they are unpinned.\n\nRun `aura check --fix` to review bundled revisions and vanished snippets. Locally edited content must be resolved first; directory-sourced skill updates stay in `aura setup`, where network and credential approval are explicit.",
 	fix: () => void 0,
 	fixability: "guided",
 	guidedFixes: managedContentUpdateChoices,
@@ -4794,6 +4815,11 @@ const unmanagedDetectedAppCheck = defineCheck({
 	defaultSeverity: "info",
 	detect: detectUnmanagedApps,
 	explain: "Aura can inspect an installed agent application without managing it. This informational check highlights detected applications that have never been accepted or ignored in the Aura manifest.\n\nRun `aura setup` to add the application, or leave it unchecked once to record that Aura should ignore it. There is no automatic fix: the decision belongs to the apps step, and this check never starts a nested command.",
+	findingGroup: {
+		description: "Run `aura setup` to manage them or record an ignore decision.",
+		id: "checks-core/application-management",
+		title: "Decide which detected applications Aura should manage"
+	},
 	fixability: "manual",
 	id: "MGD-003",
 	scope: "global",
@@ -5053,36 +5079,26 @@ function inlineCredential(transport) {
 /**
 * One row per state, rather than the same three-way branch spelled out for each string.
 *
-* The five strings a state needs were previously five parallel ternaries in two functions, so
-* adding a state meant finding all of them and nothing made them agree. Keyed by state, the
-* compiler requires the row and the lookups cannot drift.
+* The strings a state needs were previously parallel ternaries in two functions, so adding a state
+* meant finding all of them and nothing made them agree. Keyed by state, the compiler requires the
+* row and the lookups cannot drift.
 */
 const CURSOR_STATE_ACTIONS = Object.freeze({
 	disabled: {
-		choiceId: "enable-in-cursor",
-		choiceLabel: "Enable in Cursor",
 		guidance: (name) => `Open Cursor, open MCP settings, and enable server ${name}.`,
-		message: (name, displayName) => `MCP server ${name} is disabled in ${displayName}.`,
-		summary: (name) => `Enable MCP server ${name} in Cursor.`
+		message: (name, displayName) => `MCP server ${name} is disabled in ${displayName}.`
 	},
 	error: {
-		choiceId: "repair-in-cursor",
-		choiceLabel: "Repair in Cursor",
 		guidance: (name) => `Open Cursor's MCP settings, inspect the connection error for server ${name}, and repair its configuration or service.`,
-		message: (name, displayName) => `MCP server ${name} in ${displayName} cannot be reached because Cursor reported a connection error.`,
-		summary: (name) => `Repair MCP server ${name} in Cursor.`
+		message: (name, displayName) => `MCP server ${name} in ${displayName} cannot be reached because Cursor reported a connection error.`
 	},
 	"needs-approval": {
-		choiceId: "approve-in-cursor",
-		choiceLabel: "Approve in Cursor",
 		guidance: (name) => `Open Cursor, open MCP settings, and approve server ${name}.`,
-		message: (name, displayName) => `MCP server ${name} in ${displayName} needs approval.`,
-		summary: (name) => `Approve MCP server ${name} in Cursor.`
+		message: (name, displayName) => `MCP server ${name} in ${displayName} needs approval.`
 	}
 });
 //#endregion
 //#region ../../plugins/checks-core/src/mcp-003-cursor.ts
-const CHECK_ID$1 = "MCP-003";
 /**
 * Cursor runtime-state findings that are not superseded by a concrete transport failure.
 *
@@ -5104,23 +5120,6 @@ function cursorMcpStateFindings(app, concretelyFailed) {
 		return state === "error" && concretelyFailed.has(mcpServerNameKey(app.adapterId, name)) ? [] : [cursorStateFinding(app, name, state)];
 	});
 }
-/** Zero-operation guided action for one Cursor-owned runtime-state finding. */
-function cursorMcpStateChoice(finding) {
-	if (finding.checkId !== CHECK_ID$1 || finding.metadata?.["appId"] !== "cursor" || finding.metadata?.["kind"] !== "cursor-state") return;
-	const name = finding.metadata["serverName"];
-	const state = finding.metadata["state"];
-	if (typeof name !== "string" || !isActionableState(state)) return;
-	const action = CURSOR_STATE_ACTIONS[state];
-	return {
-		id: action.choiceId,
-		label: action.choiceLabel,
-		plan: {
-			manualSteps: [action.guidance(name), "Run `aura check` again."],
-			operations: [],
-			summary: action.summary(name)
-		}
-	};
-}
 /** Stable identity for the name-level state Cursor reports. */
 function mcpServerNameKey(appId, name) {
 	return `${appId}\0${name}`;
@@ -5129,6 +5128,7 @@ function cursorStateFinding(app, name, state) {
 	const action = CURSOR_STATE_ACTIONS[state];
 	return {
 		details: action.guidance(name),
+		fixability: "manual",
 		id: `${app.adapterId}:${name}:cursor-${state}`,
 		message: action.message(name, app.displayName),
 		metadata: {
@@ -5150,6 +5150,7 @@ function cursorStateFinding(app, name, state) {
 function unknownStateFinding(app, name) {
 	return {
 		details: `Run \`cursor-agent mcp list\` to see what ${app.displayName} reports for server ${name}, and check whether server ${name} is approved and enabled in its MCP settings.`,
+		fixability: "manual",
 		id: `${app.adapterId}:${name}:cursor-unknown`,
 		message: `MCP server ${name}'s state in ${app.displayName} could not be understood.`,
 		metadata: {
@@ -5165,6 +5166,7 @@ function unavailableFinding(app, reason) {
 	const cause = reason === "timeout" ? "did not finish in time" : "exited unsuccessfully";
 	return {
 		details: `Run \`cursor-agent mcp list\` to see why, then re-run \`aura check\`. Approval and enablement of ${app.displayName}'s MCP servers were not checked; every other MCP check still ran.`,
+		fixability: "manual",
 		id: `${app.adapterId}:cursor-state-unavailable`,
 		message: `${app.displayName}'s MCP server states were not read because \`cursor-agent mcp list\` ${cause}.`,
 		metadata: {
@@ -5175,9 +5177,6 @@ function unavailableFinding(app, reason) {
 		severity: "info"
 	};
 }
-function isActionableState(value) {
-	return value === "needs-approval" || value === "disabled" || value === "error";
-}
 //#endregion
 //#region ../../plugins/checks-core/src/mcp-003.ts
 const CHECK_ID = "MCP-003";
@@ -5186,7 +5185,7 @@ const mcp003 = defineCheck({
 	detect: detectDeadServers,
 	explain: `Aura checks stdio commands with filesystem-only PATH resolution, and starts no MCP server of its own. Package launchers such as npx, uvx, and bunx are checked, but Aura does not guess whether the requested package is installed or cached.
 
-Remote URLs are silent and generate no network traffic unless \`check --online\` is supplied. Online probes use short, bounded requests without configured authentication headers, and they skip an endpoint whose credentials Aura stripped, because the remaining URL no longer addresses the configured server. A redirect to a private address is reported rather than followed. A timeout or a server-side fault is a warning, not an error: it may not repeat. Re-run with \`--fix --interactive\` to choose whether to repair or remove a server that definitely failed its probe. Cursor separately requires its MCP servers to be approved and enabled in its own settings, which no file records; Aura reads those states by running \`cursor-agent mcp list\` when that CLI is installed and identifies itself. The command is Cursor's, and it connects to servers to answer, so Aura runs it from your home directory: only your own global configuration takes part, never a \`.cursor/mcp.json\` committed to the repository you are in. Aura never approves, enables, or retries a server itself, and every state it reports this way is a warning. Aura also reports an informational reminder when a desired MCP transport references an unset environment variable. It retains only the variable name and whether it is set; credential values never enter the workspace model or report.`,
+Remote URLs are silent and generate no network traffic unless \`check --online\` is supplied. Online probes use short, bounded requests without configured authentication headers, and they skip an endpoint whose credentials Aura stripped, because the remaining URL no longer addresses the configured server. A redirect to a private address is reported rather than followed. A timeout or a server-side fault is a warning, not an error: it may not repeat. Re-run with \`--fix\` to choose whether to repair or remove a server that definitely failed its probe. Cursor separately requires its MCP servers to be approved and enabled in its own settings, which no file records; Aura reads those states by running \`cursor-agent mcp list\` when that CLI is installed and identifies itself. The command is Cursor's, and it connects to servers to answer, so Aura runs it from your home directory: only your own global configuration takes part, never a \`.cursor/mcp.json\` committed to the repository you are in. Aura never approves, enables, or retries a server itself, and every state it reports this way is a warning. Aura also reports an informational reminder when a desired MCP transport references an unset environment variable. It retains only the variable name and whether it is set; credential values never enter the workspace model or report.`,
 	fix: () => void 0,
 	fixability: "guided",
 	guidedFixes: guidedFixes$1,
@@ -5218,6 +5217,7 @@ function unsetEnvironmentFindings(model) {
 		const credential = catalog?.manifest.credentialEnv.find((candidate) => candidate.name === variableName);
 		return [{
 			details: credentialDetails(server.name, variableName, credential, catalog?.manifest.docsUrl),
+			fixability: "manual",
 			id: `environment:${String(serverIndex)}:${variableName}`,
 			locations: [{ path: model.manifest.path }],
 			message: `MCP server ${server.name} needs environment variable ${variableName}.`,
@@ -5259,8 +5259,6 @@ function findingFor(server, probe, model) {
 	};
 }
 function guidedFixes$1(finding, model) {
-	const cursorChoice = cursorMcpStateChoice(finding);
-	if (cursorChoice !== void 0) return [cursorChoice];
 	const server = findingServer(finding, model);
 	const kind = finding.metadata?.["kind"];
 	if (server === void 0 || kind !== "command" && kind !== "url") return [];
@@ -5325,7 +5323,12 @@ const mcp004 = defineCheck({
 	detect: detectInlineSecrets,
 	explain: `Inline credentials in MCP configuration can leak through source control, logs, diagnostics, and copied configuration. Aura identifies credential-bearing fields without retaining their values, prefixes, or lengths.
 
-Re-run with \`--fix --interactive\` to replace every behavior-preserving sighting in the same source file with an environment reference. Copy the current values directly from the named file before applying the rewrite; Aura never displays or stores those values outside the protected undo payload, which stays owner-only under \`~/agents/.backups\` until twenty later fixes have pushed it out of the journal. Then rotate each credential at its issuer: moving a value behind an environment reference stops it leaking again, not from wherever it has already reached.`,
+Re-run with \`--fix\` to replace every behavior-preserving sighting in the same source file with an environment reference. Copy the current values directly from the named file before applying the rewrite; Aura never displays or stores those values outside the protected undo payload, which stays owner-only under \`~/agents/.backups\` until twenty later fixes have pushed it out of the journal. Then rotate each credential at its issuer: moving a value behind an environment reference stops it leaking again, not from wherever it has already reached.`,
+	findingGroup: {
+		description: "Replace inline credentials with environment-variable references.",
+		id: "checks-core/mcp-credentials",
+		title: "Protect credentials stored in MCP configuration"
+	},
 	fix: remediation,
 	fixability: "guided",
 	guidedFixes,
@@ -5560,7 +5563,7 @@ const mcp005 = defineCheck({
 	detect: detectScopePlacement,
 	explain: `The Aura manifest distinguishes personal MCP servers from team servers. Personal servers belong in global configuration; putting one in repository configuration can publish it to teammates through source control. Team servers belong in project configuration; keeping one only in personal configuration means teammates do not receive it and their setup drifts. Placement is judged by the file an entry is written in, not by the scope label alone, because an application can keep both kinds in one document.
 
-Re-run with \`--fix --interactive\` to move an Aura-owned entry through the same manifest convergence and undo machinery as other MCP fixes. Aura never removes a name outside its ownership ledger automatically.`,
+Re-run with \`--fix\` to move an Aura-owned entry through the same manifest convergence and undo machinery as other MCP fixes. Aura never removes a name outside its ownership ledger automatically.`,
 	fix: placementFix,
 	fixability: "guided",
 	id: MCP_005_ID,