@tryaura/aura-cli 0.2.0 → 0.3.0

package/dist/{shared-link-plan-DVgOyqP9.js → shared-link-plan-C57dSoid.js}

@@ -1,8 +1,6 @@
-import { McpWriteError, advanceMarkdownFence, defineOwnProperty, definePlugin, detectLineEnding as detectLineEnding$1, jsonPropertyPath, mcpServerNameProblem, normalizeMcpServerDefinition, parseMcpServerDefinition, pluginContentUrl, splitSourceLines as splitSourceLines$1 } from "@tryaura/aura-sdk";
+import { advanceMarkdownFence, defineOwnProperty, definePlugin, jsonPropertyPath, mcpServerNameProblem, parseMcpServerDefinition, pluginContentUrl, splitSourceLines as splitSourceLines$1 } from "@tryaura/aura-sdk";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { Buffer, isUtf8 } from "node:buffer";
 import { createHash } from "node:crypto";
-import { createTwoFilesPatch } from "diff";
 import { gt, valid } from "semver";
 import { isDeepStrictEqual } from "node:util";
 //#region ../core/src/display-path.ts
@@ -157,6 +155,8 @@ var AuraManifestError = class extends Error {
 };
 //#endregion
 //#region ../core/src/manifest/protocol.ts
+/** Home-relative protocol path shared by every Aura distribution. */
+const AURA_MANIFEST_PATH = "~/agents/aura.json";
 /** Resolves the manifest protocol path against one captured home directory. */
 function resolveAuraManifestPath(homeDir) {
 	return join(homeDir, "agents", "aura.json");
@@ -353,6 +353,48 @@ function targetApps(value, path, name, scope, claimed) {
 	}
 	return entries;
 }
+//#endregion
+//#region ../core/src/manifest/schema-snippets.ts
+/**
+* The same grammar `CONTENT_ID_PATTERN` admits for a preset's snippet ids.
+*
+* Deliberately not stricter: a preset may name any id this pattern accepts, and a manifest that
+* refused one would fail on a selection the preset was allowed to make.
+*/
+const SNIPPET_ID_PATTERN = /^[a-z0-9][a-z0-9._/-]*$/u;
+/**
+* Reads the install record for every snippet appended to the shared instructions.
+*
+* Two older shapes name an install that has to survive the read: the released record carried a
+* `pinned` revision Aura no longer holds content at, and an early install-once build wrote a bare
+* id. Both normalize to `{ id, hash? }` — the dead revision keys are dropped rather than carried
+* forward, and a record with no hash stays installed rather than being discarded for the shape.
+*/
+function snippets(value) {
+	if (!Array.isArray(value)) throw invalid("$.snippets", "must be an array");
+	const seen = /* @__PURE__ */ new Set();
+	const installed = [];
+	for (const [index, candidate] of value.entries()) {
+		const path = `$.snippets[${String(index)}]`;
+		const record = typeof candidate === "string" ? { id: candidate } : requiredObject(candidate, path);
+		const id = requiredString(record, "id", path);
+		if (!SNIPPET_ID_PATTERN.test(id)) throw invalid(`${path}.id`, "must be a lowercase snippet id such as \"acme/rules\"");
+		const hash = optionalSnippetHash(record, path);
+		if (seen.has(id)) continue;
+		seen.add(id);
+		installed.push(Object.freeze({
+			...hash === void 0 ? {} : { hash },
+			id
+		}));
+	}
+	return Object.freeze(installed);
+}
+function optionalSnippetHash(record, path) {
+	const hash = record["hash"];
+	if (hash === void 0) return;
+	if (typeof hash !== "string" || !SHA256_PATTERN.test(hash)) throw invalid(`${path}.hash`, "must be a lowercase SHA-256 hash");
+	return hash;
+}
 const MAX_TRUSTED_PATH_LENGTH = 1024;
 /**
 * Reads `trustedRepoPresets`, the repository presets the user accepted during setup.
@@ -360,28 +402,44 @@ const MAX_TRUSTED_PATH_LENGTH = 1024;
 * Each entry binds an absolute preset path to a hash of the exact contents that were reviewed, so
 * a file edited after acceptance is untrusted again until someone looks at the new contents. Only
 * acceptances appear here: declining records nothing, and the next interactive setup asks again.
+*
+* `mainWorktreePath` names the same file in the repository's primary Git checkout and carries no
+* uniqueness of its own: every worktree of one repository shares it, so a repository accumulates
+* one entry per distinct set of contents its user accepted rather than one per working directory.
 */
 function optionalTrustedRepoPresets(value) {
 	if (value === void 0) return {};
 	if (!Array.isArray(value)) throw invalid("$.trustedRepoPresets", "must be an array");
 	if (value.length > 64) throw invalid("$.trustedRepoPresets", `must contain at most ${String(64)} entries`);
-	const paths = /* @__PURE__ */ new Set();
+	const records = /* @__PURE__ */ new Set();
 	return { trustedRepoPresets: Object.freeze(value.map((candidate, index) => {
 		const path = `$.trustedRepoPresets[${String(index)}]`;
 		const entry = requiredObject(candidate, path);
-		const presetPath = requiredString(entry, "path", path);
-		if (presetPath.length === 0 || presetPath.length > MAX_TRUSTED_PATH_LENGTH) throw invalid(`${path}.path`, `must be a non-empty path of at most ${String(MAX_TRUSTED_PATH_LENGTH)} characters`);
-		if (paths.has(presetPath)) throw invalid(`${path}.path`, "must not duplicate another trusted preset path");
-		paths.add(presetPath);
+		const presetPath = trustedPath(requiredString(entry, "path", path), `${path}.path`);
 		const hash = requiredString(entry, "hash", path);
 		if (!SHA256_PATTERN.test(hash)) throw invalid(`${path}.hash`, "must be a lowercase SHA-256 hash");
+		const record = `${presetPath}\0${hash}`;
+		if (records.has(record)) throw invalid(`${path}.hash`, "must not duplicate another trusted preset path and hash");
+		records.add(record);
+		const mainWorktree = entry["mainWorktreePath"];
+		if (mainWorktree === void 0) return Object.freeze({
+			...entry,
+			hash,
+			path: presetPath
+		});
+		if (typeof mainWorktree !== "string") throw invalid(`${path}.mainWorktreePath`, "must be a string");
 		return Object.freeze({
 			...entry,
 			hash,
+			mainWorktreePath: trustedPath(mainWorktree, `${path}.mainWorktreePath`),
 			path: presetPath
 		});
 	})) };
 }
+function trustedPath(value, jsonPath) {
+	if (value.length === 0 || value.length > MAX_TRUSTED_PATH_LENGTH) throw invalid(jsonPath, `must be a non-empty path of at most ${String(MAX_TRUSTED_PATH_LENGTH)} characters`);
+	return value;
+}
 //#endregion
 //#region ../core/src/manifest/schema.ts
 const APP_ID_PATTERN = /^[a-z0-9][a-z0-9._-]*$/u;
@@ -505,22 +563,6 @@ function apps(value) {
 	}
 	return Object.freeze(result);
 }
-function snippets(value) {
-	if (!Array.isArray(value)) throw invalid("$.snippets", "must be an array");
-	return Object.freeze(value.map((candidate, index) => {
-		const path = `$.snippets[${String(index)}]`;
-		const snippet = requiredObject(candidate, path);
-		const hash = requiredString(snippet, "hash", path);
-		if (!SHA256_PATTERN.test(hash)) throw invalid(`${path}.hash`, "must be a lowercase SHA-256 hash");
-		return Object.freeze({
-			...snippet,
-			hash,
-			id: requiredString(snippet, "id", path),
-			pinned: requiredBoolean(snippet, "pinned", path),
-			version: requiredString(snippet, "version", path)
-		});
-	}));
-}
 function ownership(value) {
 	const source = requiredObject(value, "$.ownership");
 	const result = {};
@@ -689,228 +731,49 @@ function createAuraManifestWriteOperation(state, manifest) {
 	});
 }
 //#endregion
-//#region ../core/src/fix-plan/limits.ts
-/**
-* The largest file Aura will write over, remove, or replace with a link.
-*
-* A mutation is only reversible if its previous contents were captured, so this doubles as the
-* ceiling on what one operation retains in memory. Agent configuration is measured in kilobytes;
-* anything approaching this size is not something a fix should be rewriting unattended.
-*/
-const MAX_MUTABLE_FILE_BYTES = 4194304;
-/**
-* The most file content Aura retains across a whole plan.
-*
-* {@link MAX_MUTABLE_FILE_BYTES} bounds one operation; without a plan-wide budget a long plan still
-* multiplies it by the operation count.
-*/
-const MAX_RETAINED_PLAN_BYTES = 67108864;
-/**
-* The combined before/after size above which a preview summarizes instead of rendering a patch.
-*
-* A unified diff is larger than the inputs that produced it, and a preview no human can read is not
-* worth the memory it costs.
-*/
-const MAX_DIFF_BYTES = 262144;
-/**
-* Every mode a plan may request.
-*
-* `FileMode` already closes this set, but a type is erased at runtime and plugins ship as compiled
-* JavaScript. Since the mode reaches `chmod` unchanged, checking it here is what actually keeps a
-* plan from asking for a world-writable or setuid file.
-*/
-const FILE_MODES = /* @__PURE__ */ new Set([
-	384,
-	420,
-	448,
-	493
-]);
-//#endregion
-//#region ../core/src/fix-plan/diff.ts
-const NULL_PATH = "/dev/null";
-function renderWriteDiff(path, before, content, requestedMode, mode) {
-	const note = modeNote(before, requestedMode, mode);
-	const previous = textOf(before);
-	if (previous === void 0) return renderSummary("write", path, "Binary or oversized file would change.") + note;
-	if (exceedsDiffBudget(previous, content)) return renderSummary("write", path, "File is too large to diff; contents would change.") + note;
-	return renderPatch("write", path, before.kind === "missing" ? NULL_PATH : path, path, previous, content) + note;
-}
-/** Fail-closed write preview used when a semantic redactor cannot safely project both sides. */
-function renderWriteSummary(path, before, requestedMode, mode) {
-	return renderSummary("write", path, "Sensitive MCP configuration would change.") + modeNote(before, requestedMode, mode);
-}
-function renderRemoveDiff(path, before) {
-	if (before.kind === "directory") return renderSummary("remove", path, "Remove empty directory.");
-	const previous = textOf(before);
-	if (previous === void 0) return renderSummary("remove", path, "Binary or oversized file would be removed.");
-	if (exceedsDiffBudget(previous, "")) return renderSummary("remove", path, "File is too large to diff; it would be removed.");
-	return renderPatch("remove", path, path, NULL_PATH, previous, "");
-}
-function renderMoveDiff(sourcePath, destinationPath) {
-	return [
-		`diff --aura move ${sourcePath} ${destinationPath}`,
-		`rename from ${sourcePath}`,
-		`rename to ${destinationPath}`,
-		""
-	].join("\n");
-}
-function renderArchiveDiff(path, relativePath, before, replacement, replacementMode) {
-	const archive = renderSummary("archive", path, `Preserve the original at <backup>/consolidation/${relativePath}.`);
-	if (replacement === void 0) return `${archive}${renderRemoveDiff(path, before)}`;
-	return replacement.type === "symlink" ? `${archive}${renderSymlinkDiff(path, before, replacement.target)}` : `${archive}${renderWriteDiff(path, before, replacement.content, replacement.mode, replacementMode ?? 420)}`;
-}
-function renderSymlinkDiff(path, before, target) {
-	const previous = textOf(before);
-	if (previous === void 0) return renderSummary("symlink", path, `Binary or oversized file would become a link.`);
-	if (exceedsDiffBudget(previous, target)) return renderSummary("symlink", path, "File is too large to diff; it would become a link.");
-	return `${renderPatch("symlink", path, before.kind === "missing" ? NULL_PATH : path, path, previous, `${target}\n`)}link target ${target}\n`;
-}
-/** Describes a conflict in the same shape as a diff, so a renderer can treat previews uniformly. */
-function renderConflict(operation, path, reason) {
-	return renderSummary(operation, path, `Blocked: ${reason}.`);
-}
-function renderPatch(operation, displayPath, oldPath, newPath, oldContent, newContent) {
-	return `diff --aura ${operation} ${displayPath}\n${createTwoFilesPatch(oldPath, newPath, oldContent, newContent, "before", "after", { context: 3 })}`;
-}
-function renderSummary(operation, path, detail) {
-	return [
-		`diff --aura ${operation} ${path}`,
-		detail,
-		""
-	].join("\n");
-}
-/**
-* Says what happens to an existing file's permissions.
-*
-* Two cases are worth a line. A mode that changes is a change the diff itself cannot show, and core
-* only does that to files it owns as protocol. A `mode` a plan asked for and will not get is the
-* commoner one: an existing file keeps whatever the user set, and saying so is the difference
-* between a deliberate choice and a silent one.
-*/
-function modeNote(before, requestedMode, mode) {
-	if (before.kind !== "file") return "";
-	if (before.mode !== mode) return `mode ${formatMode(before.mode)} changes to ${formatMode(mode)}\n`;
-	if (requestedMode !== void 0 && requestedMode !== before.mode) return `mode ${formatMode(requestedMode)} requested; existing mode ${formatMode(before.mode)} is preserved\n`;
-	return "";
-}
-function formatMode(mode) {
-	return `0o${mode.toString(8).padStart(3, "0")}`;
-}
-function exceedsDiffBudget(before, after) {
-	return Buffer.byteLength(before, "utf8") + Buffer.byteLength(after, "utf8") > MAX_DIFF_BYTES;
-}
-function textOf(state) {
-	switch (state.kind) {
-		case "directory":
-		case "unsupported": return;
-		case "file": return state.content !== void 0 && isUtf8(state.content) ? state.content.toString("utf8") : void 0;
-		case "missing": return "";
-		case "symlink": return `${state.target}\n`;
-	}
-}
-//#endregion
-//#region ../core/src/fix-plan/write-redaction.ts
-const REDACTORS = /* @__PURE__ */ new WeakMap();
+//#region ../core/src/content-hash.ts
+/** Shape of every hash this module produces, for validators that must recognize one. */
+const CONTENT_HASH_PATTERN = /^[0-9a-f]{64}$/u;
 /**
-* Paths some operation has asked to have redacted, kept beside the identity-keyed registry above.
+* Normalizes Markdown to LF and exactly one trailing newline.
 *
-* The registry is keyed on the operation object, so anything that copies an operation between
-* planning and preview silently drops its masker — and the symptom of that would be a credential
-* rendered into a diff rather than an error. Remembering the path as well turns the silent case
-* into the conservative one: a write to a path that has ever needed masking and arrives without a
-* masker gets a summary, not a patch.
+* Line endings and trailing blank lines are what a checkout, an editor, or an append seam change
+* without changing what the text says, so a hash that counted them would report drift on every
+* machine that rewrote them — and a fragment appended in this form is the same text the hash
+* covers. Trailing newlines are trimmed by scanning rather than with `/\n+$/`, whose backtracking
+* is quadratic when a long newline run does not reach the end of the string.
 */
-const REDACTED_PATHS = /* @__PURE__ */ new Set();
-/** Associates a semantic content masker with a write without changing the public operation schema. */
-function rememberWriteRedactor(operation, redactor) {
-	const existing = REDACTORS.get(operation) ?? [];
-	REDACTORS.set(operation, [...existing, redactor]);
-	REDACTED_PATHS.add(operation.path);
+function canonicalizeContent(content) {
+	const normalized = content.replace(/\r\n?/gu, "\n");
+	let end = normalized.length;
+	while (end > 0 && normalized[end - 1] === "\n") end -= 1;
+	return `${normalized.slice(0, end)}\n`;
 }
 /**
-* Wraps an adapter's transform so a projection that could not account for every field fails closed.
+* Fingerprints Markdown Aura records but does not own: an installed snippet, a trusted preset.
 *
-* `unresolved` names the fields whose server entry this content does not contain. That is not the
-* same as "nothing to mask": a rewritten side legitimately has nothing left to mask and reports no
-* unresolved fields, while a document shaped in a way the adapter cannot navigate reports them all
-* and still holds the credential.
+* One function for both because the two records answer the same question — "is this still the text
+* the user accepted?" — and two spellings of the canonical form would answer it differently on the
+* first file whose line endings a checkout rewrote.
 */
-function mcpSecretRedactor(transform, sightings) {
-	return (content) => {
-		const redaction = transform.redact({
-			content,
-			sightings
-		});
-		return redaction === void 0 || redaction.unresolved.length > 0 ? void 0 : redaction.content;
-	};
-}
-/** Renders a write only after every registered semantic masker succeeds on both diff sides. */
-function renderRedactedWriteDiff(operations, path, before, content, requestedMode, mode) {
-	const redactors = operations.flatMap((operation) => REDACTORS.get(operation) ?? []);
-	if (redactors.length === 0) return REDACTED_PATHS.has(path) ? renderWriteSummary(path, before, requestedMode, mode) : renderWriteDiff(path, before, content, requestedMode, mode);
-	const next = redactAll(redactors, content);
-	if (next === void 0) return renderWriteSummary(path, before, requestedMode, mode);
-	if (before.kind !== "file" || before.content === void 0) return renderWriteDiff(path, before, next, requestedMode, mode);
-	const previous = redactAll(redactors, before.content.toString("utf8"));
-	if (previous === void 0) return renderWriteSummary(path, before, requestedMode, mode);
-	return renderWriteDiff(path, {
-		...before,
-		content: Buffer.from(previous, "utf8")
-	}, next, requestedMode, mode);
-}
-function redactAll(redactors, content) {
-	let projected = content;
-	for (const redact of redactors) {
-		const result = safeRedact(redact, projected);
-		if (result === void 0) return;
-		projected = result;
-	}
-	return projected;
+function hashContent(content) {
+	return createHash("sha256").update(canonicalizeContent(content), "utf8").digest("hex");
 }
-function safeRedact(redact, content) {
-	try {
-		return redact(content);
-	} catch {
-		return;
-	}
-}
-//#endregion
-//#region ../core/src/managed-block/protocol.ts
-/** Distribution-independent outer marker opening Aura-managed content. */
-const AURA_MANAGED_BLOCK_BEGIN = "<!-- aura:begin -->";
-/** Distribution-independent outer marker closing Aura-managed content. */
-const AURA_MANAGED_BLOCK_END = "<!-- aura:end -->";
-/** Prefix shared by every Aura snippet opening marker. */
-const AURA_MANAGED_SNIPPET_BEGIN_PREFIX = "<!-- aura:begin id=";
-/** Prefix shared by every Aura snippet closing marker. */
-const AURA_MANAGED_SNIPPET_END_PREFIX = "<!-- aura:end id=";
-/** Human-facing ownership warning rendered once inside the outer block. */
-const AURA_MANAGED_BLOCK_NOTICE = "Managed by Aura. Edit via the Aura CLI; manual edits to this block are overwritten.";
 const MANAGED_SNIPPET_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
-const MANAGED_SNIPPET_HASH_PATTERN = /^[0-9a-f]{64}$/;
+const MANAGED_SNIPPET_HASH_PATTERN = CONTENT_HASH_PATTERN;
 /** Whether an id is both line-safe and legal inside an HTML comment. */
 function isManagedSnippetId(id) {
 	return MANAGED_SNIPPET_ID_PATTERN.test(id) && !id.includes("--");
 }
 /**
-* Normalizes snippet text to the bytes covered by the managed-block hash protocol.
+* Computes the protocol hash for a snippet's canonical UTF-8 contents.
 *
-* Trailing newlines are trimmed by scanning rather than with `/\n+$/`, whose backtracking is
-* quadratic when a long newline run does not reach the end of the string.
+* The legacy block's hash is {@link hashContent} under another name: a marked section read back
+* from an older file has to compare equal to the same text hashed anywhere else in Aura, or a
+* migration would report drift on content nobody touched.
 */
-function canonicalizeManagedSnippet(content) {
-	const normalized = content.replace(/\r\n?/g, "\n");
-	let end = normalized.length;
-	while (end > 0 && normalized[end - 1] === "\n") end -= 1;
-	return `${normalized.slice(0, end)}\n`;
-}
-/** Computes the protocol hash for text already in {@link canonicalizeManagedSnippet} form. */
-function hashCanonicalManagedSnippet(canonical) {
-	return createHash("sha256").update(canonical, "utf8").digest("hex");
-}
-/** Computes the protocol hash for a snippet's canonical UTF-8 contents. */
 function hashManagedSnippet(content) {
-	return hashCanonicalManagedSnippet(canonicalizeManagedSnippet(content));
+	return hashContent(content);
 }
 //#endregion
 //#region ../core/src/managed-block/parse-state.ts
@@ -1132,324 +995,23 @@ function collectPlainLine(source, line, protectedByFence, block, snippet, notes)
 	}));
 }
 //#endregion
-//#region ../core/src/managed-block/scan.ts
-/**
-* Finds protocol markers the reader would honour, applying the same fence rules as
-* {@link readManagedBlock} so fenced marker examples stay ordinary text.
-*/
-function scanForMarkers(text) {
-	let fence;
-	let markerLine;
-	for (const line of splitSourceLines$1(text)) {
-		const previousFence = fence;
-		fence = advanceMarkdownFence(line.text, fence);
-		if (previousFence !== void 0 || fence !== void 0) continue;
-		if (markerLine === void 0 && parseMarker(line.text) !== void 0) markerLine = line.number;
-	}
-	return {
-		markerLine,
-		unterminatedFence: fence !== void 0
-	};
-}
+//#region ../core/src/managed-block/strip.ts
 /**
-* Rejects content that would escape its own snippet. Written verbatim, a marker inside a snippet
-* body reopens or closes the protocol, and the resulting file parses as invalid forever — so the
-* damage has to be caught before the write, not after.
+* Removes a legacy Aura-managed block from a source string, keeping everything else byte-for-byte.
 *
-* Every write path shares this guard. A narrower path that skipped it would be a way to write the
-* exact bytes the wider one refuses, and the file it corrupts is the same file either way.
-*/
-function managedSnippetContentProblems(id, canonical) {
-	const scan = scanForMarkers(canonical);
-	if (scan.markerLine !== void 0) return Object.freeze([Object.freeze({
-		code: "invalid-snippet-content",
-		message: `Snippet "${id}" declares an Aura marker on content line ${String(scan.markerLine)}. Wrap marker examples in a Markdown fence.`
-	})]);
-	if (scan.unterminatedFence) return Object.freeze([Object.freeze({
-		code: "invalid-snippet-content",
-		message: `Snippet "${id}" ends inside an unclosed Markdown fence, which would hide every marker after it. Close the fence.`
-	})]);
-	return Object.freeze([]);
-}
-/**
-* Drops every protocol line the reader honours, plus the notice that follows an opening marker,
-* leaving handwritten text byte-for-byte. Fenced marker examples survive because the reader never
-* treated them as protocol in the first place.
-*/
-function stripManagedMarkers(source) {
-	const kept = [];
-	let fence;
-	let afterBlockBegin = false;
-	for (const line of splitSourceLines$1(source)) {
-		const previousFence = fence;
-		fence = advanceMarkdownFence(line.text, fence);
-		const marker = previousFence !== void 0 || fence !== void 0 ? void 0 : parseMarker(line.text);
-		if (marker !== void 0) {
-			afterBlockBegin = marker.kind === "block-begin";
-			continue;
-		}
-		if (afterBlockBegin && line.text === "Managed by Aura. Edit via the Aura CLI; manual edits to this block are overwritten.") {
-			afterBlockBegin = false;
-			continue;
-		}
-		afterBlockBegin = false;
-		kept.push(source.slice(line.start, line.end));
-	}
-	return kept.join("");
-}
-//#endregion
-//#region ../core/src/managed-block/reconcile-snippet.ts
-/** Reconciles exactly one snippet while preserving every other source byte. */
-function reconcileManagedSnippet(source, snippetId, resolution) {
-	const current = readManagedBlock(source);
-	if (current.status === "invalid") return invalidResult$1(source, current.notes, current.problems);
-	if (current.status === "absent") return missingSnippet(source, current.notes, snippetId, "an Aura-managed block");
-	const snippet = current.block.snippets.find((candidate) => candidate.id === snippetId);
-	if (snippet === void 0) return missingSnippet(source, current.notes, snippetId, "the Aura-managed block");
-	const lineEnding = markerLineEnding(source, snippet.startOffset, snippet.contentStartOffset);
-	const canonical = resolution.kind === "restore" ? canonicalizeManagedSnippet(resolution.content) : void 0;
-	if (canonical !== void 0) {
-		const problems = managedSnippetContentProblems(snippet.id, canonical);
-		if (problems.length > 0) return invalidResult$1(source, current.notes, problems);
-	}
-	const content = canonical === void 0 ? snippet.content : withLineEnding(canonical, lineEnding);
-	const hash = canonical === void 0 ? snippet.computedHash : hashCanonicalManagedSnippet(canonical);
-	const opening = `${AURA_MANAGED_SNIPPET_BEGIN_PREFIX}${snippet.id} sha256=${hash} -->${lineEnding}`;
-	const updated = source.slice(0, snippet.startOffset) + opening + content + source.slice(snippet.contentEndOffset);
-	return updated === source ? Object.freeze({
-		content: source,
-		notes: current.notes,
-		status: "unchanged"
-	}) : Object.freeze({
-		content: updated,
-		notes: current.notes,
-		status: "updated"
-	});
-}
-/** Creates the opt-in edited-versus-canonical detail used by the merge choice. */
-function diffManagedSnippet(path, editedContent, canonicalContent) {
-	return createTwoFilesPatch(`${path} (edited)`, `${path} (canonical)`, canonicalizeManagedSnippet(editedContent), canonicalizeManagedSnippet(canonicalContent), "edited", "canonical", { context: 3 });
-}
-function missingSnippet(source, notes, snippetId, location) {
-	return invalidResult$1(source, notes, [Object.freeze({
-		code: "missing-snippet",
-		message: `Snippet "${snippetId}" does not exist in ${location}.`
-	})]);
-}
-function invalidResult$1(source, notes, problems) {
-	return Object.freeze({
-		content: source,
-		notes,
-		problems,
-		status: "invalid"
-	});
-}
-function markerLineEnding(source, startOffset, contentStartOffset) {
-	return source.slice(startOffset, contentStartOffset).endsWith("\r\n") ? "\r\n" : "\n";
-}
-function withLineEnding(content, lineEnding) {
-	return lineEnding === "\n" ? content : content.replaceAll("\n", lineEnding);
-}
-//#endregion
-//#region ../core/src/managed-block/reconcile-desired.ts
-function prepareDesiredSnippets(snippets, options) {
-	const ids = /* @__PURE__ */ new Set();
-	const preserved = new Set(options.preserveSnippetIds ?? []);
-	const prepared = [];
-	const problems = [];
-	for (const snippet of snippets) {
-		if (!isManagedSnippetId(snippet.id)) problems.push(Object.freeze({
-			code: "invalid-snippet-id",
-			message: `Snippet ID "${snippet.id}" is not safe inside an HTML comment marker.`
-		}));
-		if (ids.has(snippet.id)) problems.push(Object.freeze({
-			code: "duplicate-snippet",
-			message: `Desired snippet ID "${snippet.id}" appears more than once.`
-		}));
-		if (preserved.has(snippet.id)) problems.push(Object.freeze({
-			code: "duplicate-snippet",
-			message: `Snippet ID "${snippet.id}" is both desired and preserved; writing both would duplicate it.`
-		}));
-		ids.add(snippet.id);
-		const canonical = canonicalizeManagedSnippet(snippet.content);
-		problems.push(...managedSnippetContentProblems(snippet.id, canonical));
-		prepared.push({
-			canonical,
-			hash: hashCanonicalManagedSnippet(canonical),
-			id: snippet.id,
-			kind: "desired"
-		});
-	}
-	return {
-		prepared,
-		problems: Object.freeze(problems)
-	};
-}
-//#endregion
-//#region ../core/src/managed-block/reconcile-ledger.ts
-function renderLedgerSnippets(source, block, desired, options) {
-	if (block === void 0 || options.ownedSnippetIds === void 0) return desired;
-	const controlled = controlledSnippetIds(desired, options);
-	const preserved = new Set(options.preserveSnippetIds ?? []);
-	const remaining = [...desired];
-	const rendered = [];
-	for (const snippet of block.snippets) {
-		if (preserved.has(snippet.id) || !controlled.has(snippet.id)) {
-			rendered.push({
-				id: snippet.id,
-				kind: "preserved",
-				raw: source.slice(snippet.startOffset, snippet.endOffset)
-			});
-			continue;
-		}
-		const replacement = remaining.shift();
-		if (replacement !== void 0) rendered.push(replacement);
-	}
-	rendered.push(...remaining);
-	return rendered;
-}
-function controlledSnippetIds(desired, options) {
-	return /* @__PURE__ */ new Set([...options.ownedSnippetIds ?? [], ...desired.map((snippet) => snippet.id)]);
-}
-function preservedUnownedNotes(block, desired, options) {
-	if (block === void 0 || options.ownedSnippetIds === void 0) return [];
-	const controlled = controlledSnippetIds(desired, options);
-	return block.snippets.filter((snippet) => !controlled.has(snippet.id)).map((snippet) => Object.freeze({
-		code: "preserved-unowned-snippet",
-		line: snippet.startLine,
-		message: `Snippet "${snippet.id}" is not recorded in Aura's manifest; its section was preserved.`
-	}));
-}
-//#endregion
-//#region ../core/src/managed-block/reconcile.ts
-/**
-* Reconciles one source string against the complete ordered set of desired snippets.
+* For a consumer deciding what a file's *user-authored* content is — instruction consolidation
+* above all — the managed block is Aura's own artifact: merging it elsewhere plants links and
+* legacy ledger sections in files that must not carry them. Unmanaged lines found inside the block
+* are user text and are kept.
 *
-* Existing hash mismatches remain observable through {@link readManagedBlock}, but reconciliation
-* deliberately replaces managed content with the desired canonical version, reporting each
-* discarded hand edit as an `overwritten-snippet` note. Invalid structures fail closed and return
-* the original source unchanged unless the caller opts into `onInvalid: "repair"`.
+* A source with no block, and one whose block does not parse, are returned unchanged: a malformed
+* block cannot be attributed to Aura with confidence, and dropping bytes on that guess would lose
+* user content.
 */
-function reconcileManagedBlock(source, desiredSnippets, options = {}) {
-	return reconcileParsedManagedBlock(source, readManagedBlock(source), desiredSnippets, options);
-}
-/**
-* {@link reconcileManagedBlock}, for a caller that already parsed `source`.
-*
-* `current` must be `readManagedBlock(source)` for the same string; passing a result read from
-* anything else splices content at offsets that no longer describe the source.
-*/
-function reconcileParsedManagedBlock(source, current, desiredSnippets, options = {}) {
-	const desired = prepareDesiredSnippets(desiredSnippets, options);
-	if (desired.problems.length > 0) return invalidResult(source, current.notes, desired.problems);
-	const hiddenMarker = current.notes.find((note) => note.code === "unterminated-fence");
-	if (hiddenMarker !== void 0) return invalidResult(source, current.notes, [Object.freeze({
-		code: "unterminated-fence",
-		line: hiddenMarker.line,
-		message: hiddenMarker.message
-	})]);
-	if (current.status !== "invalid") {
-		const block = current.status === "present" ? current.block : void 0;
-		const rendered = renderLedgerSnippets(source, block, desired.prepared, options);
-		const notes = [
-			...current.notes,
-			...overwrittenNotes(current, desired.prepared, options),
-			...preservedUnownedNotes(block, desired.prepared, options)
-		];
-		return settle(source, buildContent(source, rendered, current), notes);
-	}
-	if (options.onInvalid !== "repair") return invalidResult(source, current.notes, current.problems);
-	if (options.ownedSnippetIds !== void 0) return invalidResult(source, current.notes, current.problems);
-	const stripped = stripManagedMarkers(source);
-	const repaired = readManagedBlock(stripped);
-	if (repaired.status === "invalid") return invalidResult(source, current.notes, current.problems);
-	const notes = [...current.notes, ...repairNotes(current.problems)];
-	return settle(source, buildContent(stripped, desired.prepared, repaired), notes);
-}
-function buildContent(source, prepared, current) {
-	if (prepared.length === 0) return current.status === "absent" ? source : source.slice(0, current.block.startOffset) + current.block.unmanagedContent + source.slice(current.block.endOffset);
-	const lineEnding = detectLineEnding$1(source);
-	if (current.status === "absent") return `${source}${source.length === 0 || source.endsWith("\n") ? "" : lineEnding}${renderManagedBlock(prepared, lineEnding, true)}`;
-	const replacement = renderManagedBlock(prepared, lineEnding, source[current.block.endOffset - 1] === "\n" || current.block.unmanagedContent.length > 0);
-	if (current.block.unmanagedContent.length === 0 && replacement === source.slice(current.block.startOffset, current.block.endOffset)) return source;
-	return source.slice(0, current.block.startOffset) + replacement + current.block.unmanagedContent + source.slice(current.block.endOffset);
-}
-function renderManagedBlock(snippets, lineEnding, endsWithLineEnding) {
-	const parts = [
-		AURA_MANAGED_BLOCK_BEGIN,
-		lineEnding,
-		AURA_MANAGED_BLOCK_NOTICE,
-		lineEnding
-	];
-	for (const snippet of snippets) {
-		if (snippet.kind === "preserved") {
-			parts.push(snippet.raw);
-			continue;
-		}
-		const content = lineEnding === "\n" ? snippet.canonical : snippet.canonical.replaceAll("\n", lineEnding);
-		parts.push(`${AURA_MANAGED_SNIPPET_BEGIN_PREFIX}${snippet.id} sha256=${snippet.hash} -->`, lineEnding, content, `${AURA_MANAGED_SNIPPET_END_PREFIX}${snippet.id} -->`, lineEnding);
-	}
-	parts.push(AURA_MANAGED_BLOCK_END);
-	if (endsWithLineEnding) parts.push(lineEnding);
-	return parts.join("");
-}
-function overwrittenNotes(current, desired, options) {
-	if (current.status === "absent") return [];
-	const controlled = controlledSnippetIds(desired, options);
-	const desiredById = new Map(desired.map((snippet) => [snippet.id, snippet]));
-	const preserved = new Set(options.preserveSnippetIds ?? []);
-	return current.block.snippets.flatMap((snippet) => {
-		if (options.ownedSnippetIds !== void 0 && !controlled.has(snippet.id) || preserved.has(snippet.id) || !handEdited(snippet, options)) return [];
-		const replacement = desiredById.get(snippet.id);
-		if (replacement === void 0) return [Object.freeze({
-			code: "removed-snippet",
-			line: snippet.startLine,
-			message: `Snippet "${snippet.id}" was edited by hand since Aura wrote it; the edit is being removed.`
-		})];
-		if (replacement.hash === snippet.computedHash) return [];
-		return [Object.freeze({
-			code: "overwritten-snippet",
-			line: snippet.startLine,
-			message: `Snippet "${snippet.id}" was edited by hand since Aura wrote it; the edit is being replaced.`
-		})];
-	});
-}
-/**
-* Whether a section differs from what Aura last recorded for it.
-*
-* The marker hash is written by whoever wrote the marker, so a re-stamped section certifies itself
-* and `hashMatches` alone cannot tell a hand edit from a catalog upgrade. The manifest is the only
-* record the editor did not control; fall back to the marker only when there is no manifest entry.
-*/
-function handEdited(snippet, options) {
-	const previousHash = options.previousSnippetHashes?.get(snippet.id);
-	return previousHash === void 0 ? !snippet.hashMatches : previousHash !== snippet.computedHash;
-}
-function repairNotes(problems) {
-	return problems.map((problem) => Object.freeze({
-		code: "repaired-invalid-block",
-		line: problem.line,
-		message: `Rebuilt the managed block to repair: ${problem.message}`
-	}));
-}
-function invalidResult(source, notes, problems) {
-	return Object.freeze({
-		content: source,
-		notes: Object.freeze([...notes]),
-		problems,
-		status: "invalid"
-	});
-}
-function settle(source, content, notes) {
-	return content === source ? Object.freeze({
-		content: source,
-		notes: Object.freeze([...notes]),
-		status: "unchanged"
-	}) : Object.freeze({
-		content,
-		notes: Object.freeze([...notes]),
-		status: "updated"
-	});
+function stripLegacyManagedBlock(source) {
+	const parsed = readManagedBlock(source);
+	if (parsed.status !== "present") return source;
+	return source.slice(0, parsed.block.startOffset) + parsed.block.unmanagedContent + source.slice(parsed.block.endOffset);
 }
 //#endregion
 //#region ../core/src/managed-content/revision.ts
@@ -1580,210 +1142,6 @@ function convergedPlan$1(app, skillId) {
 	};
 }
 //#endregion
-//#region ../core/src/workspace/mcp-classify.ts
-/**
-* Splits desired servers into the ones Aura may write and the collisions a person has to settle.
-*
-* Scope is part of identity here. A server named `docs` in a project `.mcp.json` is not the `docs`
-* the manifest wants in user-level configuration, and treating them as one either blocks a write
-* that would not have collided or skips one that never happened.
-*/
-function classifyDesired(desired, ledgerNames, state) {
-	const ledger = new Set(ledgerNames);
-	const owned = [];
-	const blockers = [];
-	for (const entry of desired) {
-		const blocker = collisionBlocker(entry, ledger, state);
-		if (blocker === "owned") owned.push(entry);
-		else if (blocker !== void 0) blockers.push(blocker);
-	}
-	return {
-		blockers,
-		owned
-	};
-}
-/** `owned` to write it, a blocker to refuse, `undefined` when the config already satisfies it. */
-function collisionBlocker(entry, ledger, state) {
-	if (ledger.has(entry.name)) return "owned";
-	const sameName = (candidate) => candidate.name === entry.name && candidate.scope === entry.scope;
-	const unusable = state.unusable.find(sameName);
-	if (unusable !== void 0) return {
-		message: unusable.reason === "disabled" ? `MCP server ${entry.name} is already declared in this application's ${entry.scope} configuration but is turned off there. Remove or enable it, then run the fix again.` : `MCP server ${entry.name} is already declared in this application's ${entry.scope} configuration in a form Aura does not recognize, so Aura left it unchanged.`,
-		scope: entry.scope,
-		sourceId: unusable.sourceId
-	};
-	const existing = state.servers.filter(sameName);
-	if (existing.length === 0) return "owned";
-	const normalized = normalizeDesired(entry);
-	if ("message" in normalized) return normalized;
-	return existing.every((server) => isDeepStrictEqual(server.transport, normalized.transport)) ? void 0 : {
-		message: `MCP server ${entry.name} already exists outside Aura's ownership ledger and differs from the manifest.`,
-		scope: entry.scope
-	};
-}
-/**
-* Normalizes one desired transport, reporting a manifest Aura refuses to write as a blocker.
-*
-* The manifest is a file a person can edit. One that has acquired a credential literal is not a
-* crash in a check's `detect`; it is something to say out loud and decline to propagate.
-*/
-function normalizeDesired(entry) {
-	try {
-		return { transport: normalizeMcpServerDefinition(entry.transport) };
-	} catch (error) {
-		return {
-			message: error instanceof McpWriteError ? `MCP server ${entry.name} cannot be written as the manifest defines it: ${error.message}` : `MCP server ${entry.name} has a manifest definition Aura cannot represent.`,
-			scope: entry.scope
-		};
-	}
-}
-//#endregion
-//#region ../core/src/workspace/mcp-convergence.ts
-/** Captures adapter source bytes behind a function, keeping them out of the model entirely. */
-function createAppMcpConvergence(adapter, files, state) {
-	const writer = adapter.mcpWrite;
-	if (writer === void 0) return;
-	const targets = [...files.values()].filter((file) => file.spec.kind === "mcp");
-	return (desired, ledgerNames) => {
-		const classified = classifyDesired(desired, ledgerNames, state);
-		if (classified.blockers.length > 0) return blocked(classified.blockers);
-		const scopes = ["global", "project"].map((scope) => planScope(adapter, writer, targets, classified.owned, ledgerNames, scope, state.secretSightings));
-		const blockers = scopes.flatMap((result) => result.blockers);
-		const operations = scopes.flatMap((result) => result.operations);
-		return blockers.length > 0 ? blocked(blockers) : {
-			blockers: [],
-			operations,
-			ownedNames: [...new Set(classified.owned.map((entry) => entry.name))].sort()
-		};
-	};
-}
-function planScope(adapter, writer, targets, desired, ledgerNames, scope, sightings) {
-	const scopedDesired = desired.filter((entry) => entry.scope === scope);
-	const scopedTargets = targets.filter((target) => target.spec.scope === scope);
-	if (scopedDesired.length > 0 && scopedTargets.length === 0) return blockedScope(`${adapter.displayName} has no ${scope}-scope MCP configuration target.`, scope);
-	if (scopedTargets.length > 1) return blockedScope(`${adapter.displayName} declares more than one ${scope}-scope MCP write target.`, scope);
-	const target = scopedTargets[0];
-	return target === void 0 ? {
-		blockers: [],
-		operations: []
-	} : writeScopeTarget(adapter, writer, target, scopedDesired, ledgerNames, scope, sightings);
-}
-function writeScopeTarget(adapter, writer, target, desired, ledgerNames, scope, sightings) {
-	if (!needsTargetWrite(target, desired, ledgerNames)) return {
-		blockers: [],
-		operations: []
-	};
-	const unwritable = targetRefusal(target);
-	if (unwritable !== void 0) return {
-		blockers: [{
-			...unwritable,
-			scope,
-			sourceId: target.spec.id
-		}],
-		operations: []
-	};
-	const written = runWriter(writer, target, desired, ledgerNames);
-	if ("refusal" in written) return {
-		blockers: [{
-			message: written.refusal,
-			path: target.spec.path,
-			scope,
-			sourceId: target.spec.id
-		}],
-		operations: []
-	};
-	if (Buffer.byteLength(written.content, "utf8") > 4194304) return {
-		blockers: [{
-			message: `${adapter.displayName}'s MCP configuration at ${target.spec.path} is larger than Aura will rewrite in one operation, so Aura left it unchanged.`,
-			path: target.spec.path,
-			scope,
-			sourceId: target.spec.id
-		}],
-		operations: []
-	};
-	const operation = {
-		content: written.content,
-		mode: scope === "global" ? 384 : 420,
-		path: target.spec.path,
-		precondition: targetPrecondition(target),
-		type: "write"
-	};
-	rememberMcpRedactor(adapter, operation, target, sightings);
-	return {
-		blockers: [],
-		operations: [operation]
-	};
-}
-/**
-* Registers preview masking only for a target that actually holds an inline credential.
-*
-* Registering unconditionally would cost every convergence preview its diff, because masking has
-* no previous side to project when the fix is creating the file — which is what most MCP-001 fixes
-* do, on a file that by definition has no credentials in it yet.
-*/
-function rememberMcpRedactor(adapter, operation, target, sightings) {
-	const transform = adapter.mcpSecrets;
-	const scoped = sightings.filter((sighting) => sighting.sourceId === target.spec.id);
-	if (transform === void 0 || scoped.length === 0) return;
-	rememberWriteRedactor(operation, mcpSecretRedactor(transform, scoped));
-}
-/** Runs a plugin serializer, treating a thrown error as the refusal it forgot to return. */
-function runWriter(writer, target, desired, ledgerNames) {
-	try {
-		return writer({
-			desired,
-			...target.content === void 0 ? {} : { existingContent: target.content },
-			ledgerNames
-		});
-	} catch {
-		return { refusal: "The MCP configuration serializer failed, so Aura left the file unchanged." };
-	}
-}
-/**
-* What the file must still look like when the plan is applied.
-*
-* The rendered content is this file's own previous bytes with one section replaced, so applying it
-* against a file the application has since rewritten would silently revert that work. Declaring
-* what was read turns the race into a reported conflict.
-*/
-function targetPrecondition(target) {
-	return target.content === void 0 ? { kind: "absent" } : {
-		digest: createHash("sha256").update(target.content, "utf8").digest("hex"),
-		kind: "sha256"
-	};
-}
-function needsTargetWrite(target, desired, ledgerNames) {
-	return (desired.length > 0 || ledgerNames.length > 0) && (target.exists || desired.length > 0);
-}
-/** Why this target cannot be rewritten safely, before a serializer is asked to try. */
-function targetRefusal(target) {
-	const path = target.spec.path;
-	if (target.problem !== void 0 || target.exists && target.content === void 0) return {
-		message: `MCP configuration at ${path} could not be read safely, so Aura left it unchanged.`,
-		path
-	};
-	return (target.size ?? 0) > 4194304 ? {
-		message: `MCP configuration at ${path} is larger than Aura will rewrite in one operation, so Aura left it unchanged.`,
-		path
-	} : void 0;
-}
-function blockedScope(message, scope) {
-	return {
-		blockers: [{
-			message,
-			scope
-		}],
-		operations: []
-	};
-}
-function blocked(blockers) {
-	return {
-		blockers,
-		operations: [],
-		ownedNames: []
-	};
-}
-//#endregion
 //#region ../core/src/workspace/mcp-plan-manifest.ts
 /**
 * Merges preset-required servers under the manifest's own, keyed by scope and name.
@@ -1842,12 +1200,16 @@ function withoutServer(manifest, server) {
 * association lives here instead of on the object: reaching a planner takes this module, which
 * plugin code cannot import.
 */
-const PLANNERS$1 = /* @__PURE__ */ new WeakMap();
+const PLANNERS = /* @__PURE__ */ new WeakMap();
 /** Per-scan memo of what convergence planning produced, keyed by the model it was computed from. */
-const PLANS$1 = /* @__PURE__ */ new WeakMap();
+const PLANS = /* @__PURE__ */ new WeakMap();
 /** Associates a planner with the app model core just built for it. */
 function rememberMcpConvergence(app, convergence) {
-	PLANNERS$1.set(app, convergence);
+	PLANNERS.set(app, convergence);
+}
+/** Forgets one scan's memoized plans, after a refresh replaced the bytes they were built from. */
+function forgetMcpPlans(model) {
+	PLANS.delete(model);
 }
 /**
 * Reports only why convergence is impossible, without rendering any file.
@@ -1861,8 +1223,8 @@ function mcpConvergenceBlockers(model, appId) {
 }
 /** Builds application writes and the ownership-ledger update as one atomic fix plan. */
 function planManifestMcpConvergence(model, appId) {
-	const memo = PLANS$1.get(model) ?? /* @__PURE__ */ new Map();
-	PLANS$1.set(model, memo);
+	const memo = PLANS.get(model) ?? /* @__PURE__ */ new Map();
+	PLANS.set(model, memo);
 	const cached = memo.get(appId);
 	if (cached !== void 0) return cached;
 	const computed = computeConvergence(model, appId);
@@ -1978,103 +1340,53 @@ function ambiguousRemoval(model, server) {
 function resolvePlanner(model, appId) {
 	const app = model.apps.find((candidate) => candidate.adapterId === appId);
 	if (app === void 0) return { blockers: [{ message: `Application ${appId} was not detected.` }] };
-	const convergence = PLANNERS$1.get(app);
+	const convergence = PLANNERS.get(app);
 	return convergence === void 0 ? { blockers: [{ message: `${app.displayName}'s adapter cannot write MCP configuration.` }] } : {
 		app,
 		convergence
 	};
 }
 //#endregion
-//#region ../core/src/workspace/mcp-secret-plan.ts
-const PLANNERS = /* @__PURE__ */ new WeakMap();
-const PLANS = /* @__PURE__ */ new WeakMap();
-/** Captures raw MCP bytes for remediation behind the same private boundary as convergence. */
-function createAppMcpSecretPlanner(adapter, files, sightings) {
-	const transform = adapter.mcpSecrets;
-	if (transform === void 0) return;
-	return {
-		plan: (sourceId) => {
-			const target = files.get(sourceId);
-			const sourceSightings = sightings.filter((sighting) => sighting.sourceId === sourceId);
-			const supported = sourceSightings.filter(transform.supports);
-			if (target === void 0 || target.spec.kind !== "mcp" || target.content === void 0 || targetRefusal(target) !== void 0 || supported.length === 0) return;
-			let rewritten;
-			try {
-				rewritten = transform.rewrite({
-					content: target.content,
-					sightings: supported
-				});
-			} catch {
-				return;
-			}
-			if ("refusal" in rewritten || rewritten.rewrittenFields.length !== supported.length) return;
-			if (Buffer.byteLength(rewritten.content, "utf8") > 4194304) return;
-			const operation = {
-				content: rewritten.content,
-				mode: target.spec.scope === "global" ? 384 : 420,
-				path: target.spec.path,
-				precondition: targetPrecondition(target),
-				type: "write"
-			};
-			rememberWriteRedactor(operation, mcpSecretRedactor(transform, sourceSightings));
-			return {
-				manualSteps: remediationSteps(target.spec.path, supported),
-				operations: [operation],
-				summary: `Replace inline MCP credentials in ${target.spec.path} with environment references.`
-			};
-		},
-		supports: transform.supports
-	};
-}
-/** Associates a private planner with the app model that exposes only safe sightings. */
-function rememberMcpSecretPlanner(app, planner) {
-	PLANNERS.set(app, planner);
-}
-/**
-* Whether this occurrence has a behavior-preserving adapter rewrite that a plan can actually carry.
-*
-* `supports` only reads the locator's shape, so it answers "could this kind of field be rewritten",
-* not "was this one". Planning is what discovers that the document is spelled in a form the writer
-* cannot edit, and a finding that advertises a guided fix the planner then declines to produce is
-* a dead end for the user. The plan is memoized, so asking it here costs nothing.
-*/
-function canPlanMcpSecretRemediation(model, sighting) {
-	const app = model.apps.find((candidate) => candidate.adapterId === sighting.appId);
-	if ((app === void 0 ? void 0 : PLANNERS.get(app))?.supports(sighting) !== true) return false;
-	return planMcpSecretRemediation(model, sighting) !== void 0;
-}
-/** Builds the one whole-file plan shared by every representable sighting in a source file. */
-function planMcpSecretRemediation(model, sighting) {
-	const key = `${sighting.appId}:${sighting.sourceId}`;
-	const memo = PLANS.get(model) ?? /* @__PURE__ */ new Map();
-	PLANS.set(model, memo);
-	if (memo.has(key)) return memo.get(key);
-	const app = model.apps.find((candidate) => candidate.adapterId === sighting.appId);
-	const plan = (app === void 0 ? void 0 : PLANNERS.get(app))?.plan(sighting.sourceId);
-	memo.set(key, plan);
-	return plan;
-}
+//#region ../core/src/workspace/append-instructions.ts
 /**
-* What the user has to do around the rewrite, in the order the rewrite makes them possible.
+* Appends Markdown fragments while preserving every existing byte.
 *
-* Rotation leads the list because moving a credential out of the file does not undo where it has
-* already been. A value that sat inline in configuration is a value that may have reached source
-* control, a shell history, a log, or a copied snippet — which is the reason this check exists, and
-* the reason the same value put behind an environment reference is still the wrong value to keep.
+* Only appended fragments are canonicalized, and by the same normalization the content hash
+* covers — that is what lets a recorded fingerprint answer for text already in the file. They use
+* the target's line ending and end in one line ending, with one blank-line seam between
+* consecutive fragments.
 */
-function remediationSteps(path, sightings) {
-	const copies = sightings.map((sighting) => `Copy the current value for ${sighting.serverName}.${sighting.field} from ${path} now; Aura will replace it with ${sighting.suggestedEnvName}.`);
-	const exports = [...new Set(sightings.map((sighting) => sighting.suggestedEnvName))].sort().map((name) => `Run \`export ${name}=…\` in the environment that starts the MCP client.`);
-	return [
-		...copies,
-		...exports,
-		"Rotate each credential at its issuer: an inline value may already have been copied elsewhere.",
-		"Run `aura check` again."
-	];
+function appendInstructionFragments(source, fragments) {
+	if (fragments.length === 0) return source;
+	const lineEnding = source.includes("\r\n") ? "\r\n" : "\n";
+	let result = source;
+	for (const fragment of fragments) {
+		const canonical = canonicalizeContent(fragment).replaceAll("\n", lineEnding);
+		if (result.length > 0) result += blankLineSeparator(result, lineEnding);
+		result += canonical;
+	}
+	return result;
+}
+function blankLineSeparator(source, lineEnding) {
+	let trailingLineEndings = 0;
+	let end = source.length;
+	while (end > 0 && trailingLineEndings < 2) {
+		if (source.endsWith("\r\n", end)) {
+			end -= 2;
+			trailingLineEndings += 1;
+			continue;
+		}
+		if (source[end - 1] === "\n" || source[end - 1] === "\r") {
+			end -= 1;
+			trailingLineEndings += 1;
+			continue;
+		}
+		break;
+	}
+	return lineEnding.repeat(2 - trailingLineEndings);
 }
 //#endregion
 //#region ../core/src/workspace/shared-link-plan.ts
-const SHARED_LINK_SNIPPET_ID = "shared-instructions";
 /** Builds the same safe shared-instruction link plan for checks and setup. */
 function planSharedInstructionLink(app, model, options = {}) {
 	const link = options.link ?? app.sharedLink;
@@ -2083,21 +1395,24 @@ function planSharedInstructionLink(app, model, options = {}) {
 	const refusal = refuseBefore(app, status);
 	if (refusal !== void 0) return { blocked: refusal };
 	switch (link.kind) {
-		case "import-line": return planImportLine(app, model, link, status, options.sourceContent);
-		case "native-copy": return planNativeCopy(app, model, link, status, options.sourceContent);
+		case "import-line": return planImportLine(app, link, status, options.sourceContent);
+		case "native-copy": return planNativeCopy(app, link, status, options.sourceContent);
 		case "symlink": return planSymlink(app, model, link, status, options);
 	}
 }
-function planImportLine(app, model, link, status, sourceContent) {
+function planImportLine(app, link, status, sourceContent) {
 	const source = instructionEntry(app, link.entryPath);
 	if (unreadableInstructionEntry(status, source, sourceContent)) return { blocked: `Something is at ${link.entryPath} that the adapter could not read as an instruction file, so Aura will not replace it. Check whether it is a broken symbolic link.` };
-	const reconciled = reconcileManagedBlock(selectedContent(sourceContent, source), [{
-		content: link.content ?? "",
-		id: SHARED_LINK_SNIPPET_ID
-	}]);
-	if (reconciled.status === "invalid") return { blocked: `The Aura-managed block in ${link.entryPath} is malformed, so Aura will not rewrite the file. Repair or delete the block and run check --fix again.` };
-	if (reconciled.status === "unchanged" && observedStateHolds(sourceContent)) return { plan: convergedPlan(app) };
-	return { plan: writePlan(app, link, reconciled.content, model.homeDir) };
+	const current = selectedContent(sourceContent, source);
+	const desired = link.content ?? "";
+	if (observedStateHolds(sourceContent) && containsImport(current, desired)) return { plan: convergedPlan(app) };
+	return { plan: writePlan(app, link, appendInstructionFragments(current, [desired])) };
+}
+/** Legacy marked imports and new plain imports both contain the exact adapter-rendered line. */
+function containsImport(source, desired) {
+	const normalized = desired.replace(/\r\n?/gu, "\n");
+	const normalizedDesired = normalized.endsWith("\n") ? normalized.slice(0, -1) : normalized;
+	return source.replace(/\r\n?/gu, "\n").split("\n").some((line) => line === normalizedDesired);
 }
 /**
 * Whether what the scan saw still describes the file when this plan is applied.
@@ -2116,19 +1431,19 @@ function unreadableInstructionEntry(status, source, sourceContent) {
 function selectedContent(sourceContent, source) {
 	return sourceContent ?? source?.content ?? "";
 }
-function planNativeCopy(app, model, link, status, sourceContent) {
+function planNativeCopy(app, link, status, sourceContent) {
 	const content = sourceContent ?? instructionEntry(app, link.entryPath)?.content;
 	const refusal = nativeCopyRefusal(status, sourceContent, content, link.content);
 	if (refusal !== void 0) return { blocked: refusal };
 	if (status?.exists === true && content === link.content && observedStateHolds(sourceContent)) return { plan: convergedPlan(app) };
-	return { plan: writePlan(app, link, link.content ?? "", model.homeDir) };
+	return { plan: writePlan(app, link, link.content ?? "") };
 }
 function nativeCopyRefusal(status, sourceContent, content, desired) {
 	return status?.exists === true && sourceContent === void 0 && content !== desired ? "The Aura wrapper path contains different content, so it is treated as user-owned and preserved." : void 0;
 }
 function planSymlink(app, model, link, status, options) {
-	if (status?.exists === true && status.pathKind !== "symlink" && options.sourceContent === void 0) return { blocked: "The existing file is user-owned. Consolidate its content before replacing it with a symlink." };
 	const target = options.symlinkTarget ?? model.sharedInstructions.path;
+	if (status?.exists === true && status.pathKind !== "symlink" && options.sourceContent === void 0 && !holdsOnlySharedReference(app, link.entryPath, target)) return { blocked: "The existing file is user-owned and is never replaced automatically. Run `aura setup` and choose instruction consolidation to merge its content into the shared source." };
 	if (observedStateHolds(options.sourceContent) && pointsAt(status, target)) return { plan: convergedPlan(app) };
 	return { plan: {
 		operations: [{
@@ -2162,9 +1477,16 @@ function refuseBefore(app, status) {
 	if (status?.problem !== void 0) return `Aura could not safely read the instruction entry (${status.problem}) and will not overwrite it.`;
 	return status?.pathKind === "directory" ? "The instruction entry is a directory and cannot be replaced automatically." : void 0;
 }
-function writePlan(app, link, content, homeDir) {
+/**
+* Writes one entry, with nothing to warn the user about afterwards.
+*
+* There used to be a manual step here telling the user to keep a project entry out of version
+* control, because a project entry could name the shared source by absolute path. It cannot any
+* more: a project entry names it relatively, and a home entry through `~`. Both are committable or
+* personal by construction rather than by advice the user has to remember to follow.
+*/
+function writePlan(app, link, content) {
 	return {
-		...link.scope === "project" && content.includes(homeDir) ? { manualSteps: [`${link.entryPath} points at the shared source by absolute path, which is specific to this machine and this user. Keep it out of version control — add it to .gitignore or .git/info/exclude.`] } : {},
 		operations: [{
 			content,
 			mode: 420,
@@ -2174,6 +1496,19 @@ function writePlan(app, link, content, homeDir) {
 		summary: `Link ${app.displayName} to the shared instruction source.`
 	};
 }
+/**
+* Whether a real file at this entry holds nothing but a legacy block or plain link Aura wrote.
+*
+* The refusal above guards the user's own guidance, and an entry Aura wired as an import line holds
+* none. Without this, an app switching from an import line to a link strands every machine already
+* wired the old way: consolidation has no source to offer for a file that is Aura's.
+*/
+function holdsOnlySharedReference(app, path, target) {
+	const document = instructionEntry(app, path);
+	if (document === void 0) return false;
+	if (stripLegacyManagedBlock(document.content).trim().length === 0) return true;
+	return document.content.replace(/\r\n?/gu, "\n").split("\n").filter((line) => line.trim().length > 0).length === 1 && document.links.some((candidate) => resolve(candidate.targetPath) === resolve(target));
+}
 function instructionEntry(app, path) {
 	return app.instructionFiles.find((document) => resolve(document.path) === resolve(path));
 }
@@ -2181,4 +1516,4 @@ function entryStatus(app, path) {
 	return app.sourceFiles.find((file) => resolve(file.spec.path) === resolve(path));
 }
 //#endregion
-export { renderRemoveDiff as A, errorMessage as B, canonicalizeManagedSnippet as C, renderArchiveDiff as D, renderRedactedWriteDiff as E, assertAuraManifestWritable as F, src_default as G, resolveAuraManifestPath as H, createAuraManifestWriteOperation as I, pluralize as K, createEmptyAuraManifest as L, FILE_MODES as M, MAX_MUTABLE_FILE_BYTES as N, renderConflict as O, MAX_RETAINED_PLAN_BYTES as P, parseAuraManifest as R, readManagedBlock as S, hashManagedSnippet as T, AuraManifestError as U, isRecord as V, SHARED_INSTRUCTIONS_TEMPLATE as W, planSharedSkillTreeUpdate as _, rememberMcpSecretPlanner as a, reconcileManagedSnippet as b, planManifestMcpConvergence as c, createAppMcpConvergence as d, isAuraOwnedSkillTarget as f, managedContentRevisionStatus as g, skillDeploymentStatus as h, planMcpSecretRemediation as i, renderSymlinkDiff as j, renderMoveDiff as k, planMcpServerRemoval as l, sharedSkillsRoot as m, canPlanMcpSecretRemediation as n, mcpConvergenceBlockers as o, planSkillDeployment as p, displayPath as q, createAppMcpSecretPlanner as r, planDesiredMcpConvergence as s, planSharedInstructionLink as t, rememberMcpConvergence as u, reconcileParsedManagedBlock as v, hashCanonicalManagedSnippet as w, managedSnippetContentProblems as x, diffManagedSnippet as y, errorCode as z };
+export { displayPath as A, isRecord as C, SHARED_INSTRUCTIONS_TEMPLATE as D, AuraManifestError as E, src_default as O, errorMessage as S, resolveAuraManifestPath as T, assertAuraManifestWritable as _, planDesiredMcpConvergence as a, parseAuraManifest as b, rememberMcpConvergence as c, sharedSkillsRoot as d, skillDeploymentStatus as f, hashContent as g, stripLegacyManagedBlock as h, mcpConvergenceBlockers as i, pluralize as k, isAuraOwnedSkillTarget as l, planSharedSkillTreeUpdate as m, appendInstructionFragments as n, planManifestMcpConvergence as o, managedContentRevisionStatus as p, forgetMcpPlans as r, planMcpServerRemoval as s, planSharedInstructionLink as t, planSkillDeployment as u, createAuraManifestWriteOperation as v, AURA_MANIFEST_PATH as w, errorCode as x, createEmptyAuraManifest as y };