@tryaura/aura-cli 0.2.1 → 0.3.1

package/dist/{plugins-Dbasvr1u.js → plugins-BEuoEUo_.js}

@@ -1,4 +1,4 @@
-import { G as src_default$4, I as createAuraManifestWriteOperation, K as pluralize, S as readManagedBlock, W as SHARED_INSTRUCTIONS_TEMPLATE, _ as planSharedSkillTreeUpdate, b as reconcileManagedSnippet, c as planManifestMcpConvergence, f as isAuraOwnedSkillTarget, g as managedContentRevisionStatus, h as skillDeploymentStatus, i as planMcpSecretRemediation, l as planMcpServerRemoval, m as sharedSkillsRoot, n as canPlanMcpSecretRemediation, o as mcpConvergenceBlockers, p as planSkillDeployment, q as displayPath, t as planSharedInstructionLink, v as reconcileParsedManagedBlock, y as diffManagedSnippet } from "./shared-link-plan-D8fxdFYv.js";
+import { A as displayPath, D as SHARED_INSTRUCTIONS_TEMPLATE, O as src_default$4, d as sharedSkillsRoot, f as skillDeploymentStatus, i as mcpConvergenceBlockers, k as pluralize, l as isAuraOwnedSkillTarget, m as planSharedSkillTreeUpdate, o as planManifestMcpConvergence, p as managedContentRevisionStatus, s as planMcpServerRemoval, t as planSharedInstructionLink, u as planSkillDeployment, v as createAuraManifestWriteOperation } from "./shared-link-plan-AcSkw9bO.js";
 import { EMPTY_COLLECTION, McpWriteError, SHARED_INSTRUCTIONS_TEMPLATE_TOKEN, TIMEOUT_EXIT_CODE, collectJsonMcpServers, collectMcpServers, configStringArray, configStringRecord, defineAdapter, defineCheck, definePlugin, detectExecutable, detectLineEnding, inspectJsonMcpSecrets, isConfigRecord, isFileReference, jsonMcpEntry, jsonMcpSecretTransform, maskMarkdownCode, mcpCommandEntry, mcpEnvironmentVariableNames, mcpWriteResult, normalizeMcpServerDefinition, parseAtImports, parseConfigObject, parseInstalledSkills, parseJsonMcpConfig, redactMcpArguments, referenceTargetPath, sanitizeMcpUrl, skillDirectorySpecs, splitSourceLines, stdioTransport, writeJsonMcpServers } from "@tryaura/aura-sdk";
 import { dirname, extname, isAbsolute, join, resolve, sep } from "node:path";
 import { parse, stringify } from "smol-toml";
@@ -243,8 +243,7 @@ const claudeCodeAdapter = defineAdapter({
 	},
 	sharedLink: {
 		entryPath: "~/.claude/CLAUDE.md",
-		kind: "import-line",
-		lineTemplate: `@${SHARED_INSTRUCTIONS_TEMPLATE_TOKEN}`
+		kind: "symlink"
 	},
 	supportedRange: ">=2.1.0 <3.0.0"
 });
@@ -1521,12 +1520,12 @@ var src_default$2 = definePlugin({
 * silently stop finding anything, so the contract is exported and imported rather than retyped.
 *
 * `rulesProject` names the `.cursor/rules` directory slot; each discovered child file gets a
-* derived id of the form `cursor.rules.project/<encoded-name>`, and `aura` is the derived id
-* reserved for the rule Aura itself maintains there.
+* derived id of the form `cursor.rules.project/<encoded-name>`. No id is reserved for a rule Aura
+* writes, because Aura writes none: a rule left behind by an older version is read as the ordinary
+* project rule it is.
 */
 const CURSOR_SOURCE_IDS = Object.freeze({
 	agents: "cursor.rules.project.agents",
-	aura: "cursor.rules.project/aura-owned",
 	legacyRules: "cursor.rules.project.legacy",
 	mcpGlobal: "cursor.mcp.global",
 	mcpProject: "cursor.mcp.project",
@@ -1812,6 +1811,7 @@ function normalizeReference(reference) {
 //#region ../../plugins/adapter-cursor/src/adapter.ts
 const cursorAdapter = defineAdapter({
 	capabilities: { instructions: {
+		globalSharedLink: "not-applicable",
 		importStyle: "at-import",
 		loading: "import-graph"
 	} },
@@ -1840,18 +1840,6 @@ const cursorAdapter = defineAdapter({
 			unusableMcpServers: mcpFiles.flatMap(({ config }) => config.unusable)
 		};
 	},
-	sharedLink: {
-		entryPath: "./.cursor/rules/aura.mdc",
-		kind: "native-copy",
-		lineTemplate: [
-			"---",
-			"alwaysApply: true",
-			"---",
-			"",
-			`@file ${SHARED_INSTRUCTIONS_TEMPLATE_TOKEN}`,
-			""
-		].join("\n")
-	},
 	supportedRange: ">=0.45.0 <4.0.0"
 });
 /**
@@ -1903,13 +1891,6 @@ function cursorFiles({ environment, files }) {
 			path: join(environment.cwd, "AGENTS.md"),
 			scope: "project"
 		},
-		{
-			id: CURSOR_SOURCE_IDS.aura,
-			kind: "instructions",
-			optional: true,
-			path: join(environment.cwd, ".cursor", "rules", "aura.mdc"),
-			scope: "project"
-		},
 		{
 			id: CURSOR_SOURCE_IDS.mcpGlobal,
 			kind: "mcp",
@@ -1931,16 +1912,13 @@ function discoveredRuleSpecs(files) {
 	const specs = [];
 	for (const file of files.values()) {
 		if (!isRuleSourceId(file.spec.id) || file.entries === void 0) continue;
-		for (const entry of file.entries) {
-			if (file.spec.id === CURSOR_SOURCE_IDS.rulesProject && entry === "aura.mdc") continue;
-			specs.push({
-				id: `${file.spec.id}/${encodeURIComponent(entry)}`,
-				kind: "instructions",
-				optional: true,
-				path: join(file.spec.path, entry),
-				scope: "project"
-			});
-		}
+		for (const entry of file.entries) specs.push({
+			id: `${file.spec.id}/${encodeURIComponent(entry)}`,
+			kind: "instructions",
+			optional: true,
+			path: join(file.spec.path, entry),
+			scope: "project"
+		});
 	}
 	return specs;
 }
@@ -2183,7 +2161,7 @@ function detectConflicts(model) {
 function claudeFindings(app) {
 	const effective = readClaudePermissionMode(app);
 	if (effective === void 0 || !RESTRICTIVE_MODES.has(effective.mode)) return [];
-	const path = sourcePath$2(app, effective.sourceId);
+	const path = sourcePath$1(app, effective.sourceId);
 	return [{
 		details: effective.mode === "plan" ? "Plan mode prevents source edits and most commands. Choose a normal working mode if this was not intentional." : "dontAsk denies tools that were not pre-approved, which can make requests stop without a permission prompt.",
 		id: `claude-permission-mode:${effective.mode}`,
@@ -2199,7 +2177,7 @@ function claudeFindings(app) {
 function codexFindings(app) {
 	const trust = readCodexProjectTrust(app) ?? "unknown";
 	if (trust === "trusted" || trust === "unreadable") return [];
-	const path = sourcePath$2(app, CODEX_SOURCE_IDS.mcp);
+	const path = sourcePath$1(app, CODEX_SOURCE_IDS.mcp);
 	return [{
 		details: trust === "untrusted" ? "Codex explicitly marks this project untrusted and skips its project-scoped configuration." : "Codex has no trusted entry for this working directory or its primary Git checkout, so project-scoped configuration may be unavailable until trust is confirmed.",
 		id: `codex-project-trust:${trust}`,
@@ -2212,7 +2190,7 @@ function codexFindings(app) {
 		}
 	}];
 }
-function sourcePath$2(app, sourceId) {
+function sourcePath$1(app, sourceId) {
 	return app.sourceFiles.find((file) => file.spec.id === sourceId)?.spec.path;
 }
 function guidedFix$2(finding, model) {
@@ -4072,9 +4050,9 @@ const sharedInstructionLinksCheck = defineCheck({
 	detect(model) {
 		return model.apps.flatMap((app) => detectMissingLink(app, model));
 	},
-	explain: `Each detected agent application must load the canonical shared instructions through a mechanism its adapter understands. A missing import, native copy, or symlink leaves that application working from different rules even when the shared source is correct.
+	explain: `Each detected agent application must load the canonical shared instructions through a mechanism its adapter understands. A missing import, native copy, or symlink leaves that application working from different rules even when the shared source is correct. Applications with no instruction file of their own in the home directory are out of scope: Cursor, for one, keeps its global User Rules inside its own settings, where Aura cannot write.
 
-Re-run the check with \`--fix\` to add the adapter-supported link without replacing unrelated instructions. Inspect the preview first, apply it, then restart the affected application if it caches instruction files.`,
+Re-run the check with \`--fix\` to add the adapter-supported link without replacing unrelated instructions. Inspect the preview first, apply it, then restart the affected application if it caches instruction files. An application whose instruction file already holds guidance of its own is a manual finding instead, because \`--fix\` never overwrites one: run \`aura setup\` and choose instruction consolidation to merge that content into the shared source, which archives the original before the link takes its place.`,
 	findingGroup: SHARED_INSTRUCTION_GROUP,
 	fix(finding, model) {
 		const app = model.apps.find((candidate) => candidate.adapterId === findingAppId(finding));
@@ -4089,6 +4067,10 @@ Re-run the check with \`--fix\` to add the adapter-supported link without replac
 });
 function detectMissingLink(app, model) {
 	if (app.synthetic === true) return [];
+	if (app.capabilities?.instructions?.globalSharedLink === "not-applicable") return [];
+	return detectRequiredLink(app, model);
+}
+function detectRequiredLink(app, model) {
 	const shared = app.sharedLink;
 	const sharedPath = resolve(model.sharedInstructions.path);
 	if (shared !== void 0 && linksToShared(app, shared, sharedPath)) return [];
@@ -4247,431 +4229,47 @@ function isScope$1(value) {
 	return SCOPES.some((scope) => scope === value);
 }
 //#endregion
-//#region ../../plugins/checks-core/src/mgd-001-documents.ts
-const SHARED_SOURCE_ID = "aura.shared-instructions";
-/**
-* Every document whose managed block this check owns, parsed.
-*
-* Memoized per model because detection and remediation ask the same question: `detect` walks the
-* set once, then each finding's guided fixes look its document back up. Rebuilding the set per
-* finding re-resolves every instruction path and re-parses every block to reach an answer that
-* cannot have changed — the model is frozen for the length of a run.
-*/
-const CACHE = /* @__PURE__ */ new WeakMap();
-function managedDocuments(model) {
-	const cached = CACHE.get(model);
-	if (cached !== void 0) return cached;
-	const documents = /* @__PURE__ */ new Map();
-	if (model.sharedInstructions.content !== void 0) documents.set(resolve(model.sharedInstructions.path), managedDocument(model.sharedInstructions.content, model.sharedInstructions.path, SHARED_SOURCE_ID));
-	for (const document of canonicalInstructionDocuments(model.instructionFiles)) {
-		const path = resolve(document.path);
-		if (!documents.has(path) && !isSymlinkDocument(document, model)) documents.set(path, managedDocument(document.content, document.path, document.sourceId));
-	}
-	const resolved = Object.freeze([...documents.values()]);
-	CACHE.set(model, resolved);
-	return resolved;
-}
-/** Finds the document one finding was raised against, without rebuilding the set. */
-function findManagedDocument(model, sourceId, path) {
-	const target = resolve(path);
-	return managedDocuments(model).find((document) => document.sourceId === sourceId && resolve(document.path) === target);
-}
-function managedDocument(content, path, sourceId) {
-	return Object.freeze({
-		content,
-		parsed: readManagedBlock(content),
-		path,
-		sourceId
-	});
-}
-function isSymlinkDocument(document, model) {
-	const path = resolve(document.path);
-	return model.apps.some((app) => app.sourceFiles.some((file) => file.spec.id === document.sourceId && resolve(file.spec.path) === path && file.pathKind === "symlink"));
-}
-//#endregion
-//#region ../../plugins/checks-core/src/mgd-001-fixes.ts
-const CHECK_ID$4 = "MGD-001";
-function guidedFixes$2(finding, model) {
-	if (finding.checkId !== CHECK_ID$4) return [];
-	const kind = finding.metadata?.["kind"];
-	if (kind === "malformed") return [malformedMergeChoice(finding)];
-	if (kind === "unterminated-fence") return [unterminatedFenceChoice(finding)];
-	return kind === "hash-mismatch" ? mismatchChoices(finding, model) : [];
-}
-function mismatchChoices(finding, model) {
-	const context = mismatchContext(finding, model);
-	if (context === void 0) throw new Error(`The managed snippet for finding "${finding.id}" is no longer available.`);
-	const choices = [];
-	const keep = keepChoice(context, model);
-	choices.push(keep);
-	const canonical = model.availableSnippets.find((candidate) => candidate.id === context.snippet.id);
-	const restore = restoreChoice(context, canonical, model);
-	if (restore !== void 0) choices.push(restore);
-	choices.push(mergeChoice(context.document, context.snippet, canonical?.content));
-	return Object.freeze(choices);
-}
-function mismatchContext(finding, model) {
-	const document = findingDocument(finding, model);
-	const snippetId = finding.metadata?.["snippetId"];
-	if (document === void 0 || typeof snippetId !== "string") return;
-	if (document.parsed.status !== "present") return;
-	const snippet = document.parsed.block.snippets.find((candidate) => candidate.id === snippetId);
-	return snippet === void 0 ? void 0 : {
-		document,
-		snippet
-	};
-}
-function keepChoice(context, model) {
-	const { document, snippet } = context;
-	const keep = reconcileManagedSnippet(document.content, snippet.id, { kind: "keep" });
-	if (keep.status === "invalid") throw new Error(`Keep yours could not reconcile ${snippet.id}: ${keep.problems.map((problem) => problem.message).join(" ")}`);
-	const applied = operationsWithManifest({
-		content: keep.content,
-		hash: snippet.computedHash,
-		model,
-		path: document.path,
-		pinned: true,
-		snippetId: snippet.id
-	});
-	return {
-		id: "keep",
-		label: "Keep yours",
-		plan: {
-			...applied.manualSteps.length === 0 ? {} : { manualSteps: [...applied.manualSteps] },
-			operations: applied.operations,
-			summary: `Adopt the edited ${snippet.id} snippet.`
-		}
-	};
-}
-function restoreChoice(context, canonical, model) {
-	if (canonical === void 0) return;
-	const restored = reconcileManagedSnippet(context.document.content, context.snippet.id, {
-		content: canonical.content,
-		kind: "restore"
-	});
-	if (restored.status === "invalid") throw new Error(`Restore could not reconcile ${context.snippet.id}: ${restored.problems.map((problem) => problem.message).join(" ")}`);
-	const applied = operationsWithManifest({
-		content: restored.content,
-		hash: canonical.hash,
-		model,
-		path: context.document.path,
-		pinned: false,
-		snippetId: context.snippet.id,
-		version: canonical.version
-	});
-	return {
-		id: "restore",
-		label: "Restore",
-		plan: {
-			...applied.manualSteps.length === 0 ? {} : { manualSteps: [...applied.manualSteps] },
-			operations: applied.operations,
-			summary: `Restore ${context.snippet.id} from the registered snippet.`
-		}
-	};
-}
-/**
-* Pairs the instruction-file write with the manifest update that records it.
-*
-* The write can succeed where the manifest update cannot: an unreadable manifest, or an id that
-* several selections claim, leaves nothing unambiguous to edit. Applying only the file half is
-* still the right outcome — the marker hash is what stops the next run overwriting the user — but
-* it leaves the manifest disagreeing with disk, which is the drift the manifest exists to catch.
-* So the shortfall becomes a manual step rather than a silence.
-*/
-function operationsWithManifest(options) {
-	const operations = [{
-		content: options.content,
-		path: options.path,
-		type: "write"
-	}];
-	if (options.model.manifest.status === "missing") return {
-		manualSteps: [`Create ${options.model.manifest.path} and record ${options.snippetId} at hash ${options.hash}; the manifest does not exist, so this fix updates only ${options.path}.`],
-		operations
-	};
-	if (options.model.manifest.status === "read-only") return {
-		manualSteps: [`Record ${options.snippetId} at hash ${options.hash} after repairing the Aura manifest: ${options.model.manifest.problem.message}`],
-		operations
-	};
-	const matches = options.model.manifest.value.snippets.filter((snippet) => snippet.id === options.snippetId);
-	const selected = matches[0];
-	if (matches.length !== 1 || selected === void 0) return {
-		manualSteps: [`Record ${options.snippetId} at hash ${options.hash} in ${options.model.manifest.path} by hand; ${String(matches.length)} manifest entries claim that id, so this fix updates only ${options.path}.`],
-		operations
-	};
-	const manifest = {
-		...options.model.manifest.value,
-		snippets: options.model.manifest.value.snippets.map((snippet) => snippet === selected ? updatedSelection(snippet, options) : snippet)
-	};
-	operations.push(createAuraManifestWriteOperation(options.model.manifest, manifest));
-	return {
-		manualSteps: [],
-		operations
-	};
-}
-function updatedSelection(snippet, options) {
-	return {
-		...snippet,
-		hash: options.hash,
-		pinned: options.pinned,
-		version: options.version ?? snippet.version
-	};
-}
-function mergeChoice(document, snippet, canonicalContent) {
-	const lines = `${String(snippet.startLine)}-${String(snippet.endLine)}`;
-	return {
-		...canonicalContent === void 0 ? {} : { details: () => diffManagedSnippet(document.path, snippet.content, canonicalContent) },
-		id: "merge",
-		label: "Merge",
-		plan: {
-			manualSteps: [canonicalContent === void 0 ? `Edit ${document.path} at lines ${lines}; the registry no longer provides ${snippet.id}, so no canonical diff is available.` : `Review the diff and edit ${document.path} at lines ${lines} to the combined content you want.`, "Run `aura check` again and choose Keep yours to adopt the result."],
-			operations: [],
-			summary: `Manually merge the edited ${snippet.id} snippet.`
-		}
-	};
-}
-function malformedMergeChoice(finding) {
-	const path = finding.locations?.[0]?.path;
-	return {
-		id: "merge",
-		label: "Repair manually",
-		plan: {
-			manualSteps: [path === void 0 ? "Repair the malformed Aura marker structure without changing surrounding content." : `Repair the malformed Aura marker structure in ${path} without changing surrounding content.`, "Run `aura check` again after the block parses cleanly."],
-			operations: [],
-			summary: "Repair the malformed Aura-managed block manually."
-		}
-	};
-}
-function unterminatedFenceChoice(finding) {
-	const path = finding.locations?.[0]?.path;
-	return {
-		id: "close-fence",
-		label: "Close the fence",
-		plan: {
-			manualSteps: [path === void 0 ? "Close the Markdown fence that hides the Aura-managed markers." : `Close the Markdown fence that hides the Aura-managed markers in ${path}.`, "Run `aura check` again after the markers are visible."],
-			operations: [],
-			summary: "Close the unterminated Markdown fence manually."
-		}
-	};
-}
-function findingDocument(finding, model) {
-	const sourceId = finding.metadata?.["sourceId"];
-	const path = finding.locations?.[0]?.path;
-	return typeof sourceId === "string" && path !== void 0 ? findManagedDocument(model, sourceId, path) : void 0;
-}
-const managedBlockHashCheck = defineCheck({
-	defaultSeverity: "warn",
-	detect: detectManagedBlockDrift,
-	explain: `Aura hashes each managed snippet so hand edits cannot be overwritten silently. A mismatch means the installed text no longer matches the registered version, so a later setup run must not guess which side should win.
-
-Re-run the check with \`--fix\` and choose Keep yours to adopt the edit, Restore to return to registered content, or Merge to review both versions and reconcile them manually. Every executable choice is previewed and backed up before Aura writes.`,
-	fix: () => void 0,
-	fixability: "guided",
-	guidedFixes: guidedFixes$2,
-	id: "MGD-001",
-	scope: "global",
-	title: "Aura-managed instruction blocks have not changed by hand"
-});
-function detectManagedBlockDrift(model) {
-	return managedDocuments(model).flatMap((document) => findingsForDocument(document, model));
-}
-function findingsForDocument(document, model) {
-	const parsed = document.parsed;
-	const hiddenMarker = parsed.notes.find((note) => note.code === "unterminated-fence");
-	if (hiddenMarker !== void 0) return [unterminatedFenceFinding(document, hiddenMarker.line, model)];
-	if (parsed.status === "invalid") return [malformedFinding(document, parsed.problems, model)];
-	if (parsed.status === "absent") return [];
-	const manifestHashes = manifestSnippetHashes(model);
-	return parsed.block.snippets.filter((snippet) => {
-		const manifestHash = manifestHashes.get(snippet.id);
-		return !snippet.hashMatches || manifestHash !== void 0 && manifestHash !== snippet.computedHash;
-	}).map((snippet) => ({
-		details: "Run `aura check --fix` and choose Keep yours, Restore, or Merge before running setup again.",
-		id: `${document.sourceId}:${snippet.id}`,
-		locations: [{
-			line: snippet.startLine,
-			path: document.path
-		}],
-		message: `Managed snippet ${snippet.id} in ${displayInstructionPath(document.path, model)} was edited by hand.`,
-		metadata: {
-			kind: "hash-mismatch",
-			snippetId: snippet.id,
-			sourceId: document.sourceId
-		}
-	}));
-}
-function unterminatedFenceFinding(document, line, model) {
-	return {
-		details: "Close the Markdown fence, then run `aura check --fix` again. Aura will not reconcile this document while its markers are hidden.",
-		id: `${document.sourceId}:unterminated-fence`,
-		locations: [{
-			...line === void 0 ? {} : { line },
-			path: document.path
-		}],
-		message: `An unclosed Markdown fence hides Aura-managed markers in ${displayInstructionPath(document.path, model)}.`,
-		metadata: {
-			kind: "unterminated-fence",
-			sourceId: document.sourceId
-		}
-	};
-}
-function malformedFinding(document, problems, model) {
-	return {
-		details: `${problems.map((problem) => problem.message).join(" ")} Aura will not write to a block it cannot parse; repair the markers by hand.`,
-		id: `${document.sourceId}:malformed-managed-block`,
-		locations: problems.map((problem) => ({
-			...problem.line === void 0 ? {} : { line: problem.line },
-			path: document.path
-		})),
-		message: `The Aura-managed block in ${displayInstructionPath(document.path, model)} is malformed.`,
-		metadata: {
-			kind: "malformed",
-			problems: problems.map((problem) => ({
-				code: problem.code,
-				...problem.line === void 0 ? {} : { line: problem.line }
-			})),
-			sourceId: document.sourceId
-		}
-	};
-}
-function manifestSnippetHashes(model) {
-	if (model.manifest.status !== "ready") return /* @__PURE__ */ new Map();
-	const hashes = /* @__PURE__ */ new Map();
-	const ambiguous = /* @__PURE__ */ new Set();
-	for (const snippet of model.manifest.value.snippets) if (hashes.has(snippet.id)) ambiguous.add(snippet.id);
-	else hashes.set(snippet.id, snippet.hash);
-	for (const id of ambiguous) hashes.delete(id);
-	return hashes;
-}
-//#endregion
 //#region ../../plugins/checks-core/src/mgd-002-fixes.ts
-function managedContentUpdateChoices(finding, model) {
-	if (finding.checkId !== "MGD-002") return [];
+function managedSkillUpdateChoices(finding, model) {
 	const kind = finding.metadata?.["kind"];
-	if (kind === "snippet-update" || kind === "snippet-diverged") return snippetUpdateChoices(finding, model);
-	if (kind === "snippet-missing") return missingSnippetChoices(finding, model);
-	return kind === "skill-update" || kind === "skill-diverged" ? skillUpdateChoices(finding, model) : [];
+	return finding.checkId === "MGD-002" && (kind === "skill-update" || kind === "skill-diverged") ? skillUpdateChoices(finding, model) : [];
 }
-/**
-* How a choice names the revision it would apply.
-*
-* A diverged revision is a deliberate move to content that is not newer, so calling it an update
-* would misdescribe what the user is accepting.
-*/
-function applyLabel(finding, version) {
-	return `${finding.metadata?.["kind"] === "snippet-update" || finding.metadata?.["kind"] === "skill-update" ? "Update to" : "Switch to"} ${version}`;
-}
-function snippetUpdateChoices(finding, model) {
-	const context = readyFindingContext(finding, model);
-	if (context === void 0) return [];
-	const { contentId, manifest: manifestState } = context;
-	const installed = manifestState.value.snippets.find((snippet) => snippet.id === contentId);
-	const available = model.availableSnippets.find((snippet) => snippet.id === contentId);
-	const located = locateManagedSnippet(model, contentId);
-	if (installed === void 0 || available === void 0 || located === void 0) return [];
-	if (!located.snippet.hashMatches || located.snippet.computedHash !== installed.hash) return [resolveDriftFirst(contentId)];
-	const reconciled = reconcileManagedSnippet(located.document.content, contentId, {
-		content: available.content,
-		kind: "restore"
-	});
-	if (reconciled.status === "invalid") return [resolveDriftFirst(contentId)];
-	const manifest = {
-		...manifestState.value,
-		snippets: manifestState.value.snippets.map((snippet) => snippet === installed ? {
-			...snippet,
-			hash: available.hash,
-			pinned: false,
-			version: available.version
-		} : snippet)
-	};
-	return [{
-		details: () => diffManagedSnippet(located.document.path, located.snippet.content, available.content),
-		id: "update",
-		label: applyLabel(finding, available.version),
-		plan: {
-			operations: [{
-				content: reconciled.content,
-				path: located.document.path,
-				type: "write"
-			}, createAuraManifestWriteOperation(manifestState, manifest)],
-			summary: `Set managed snippet ${contentId} to ${available.version}.`
-		}
-	}];
-}
-function missingSnippetChoices(finding, model) {
-	const context = readyFindingContext(finding, model);
+function skillUpdateChoices(finding, model) {
+	const context = skillUpdateContext(finding, model);
 	if (context === void 0) return [];
-	const { contentId, manifest } = context;
-	const installed = manifest.value.snippets.find((snippet) => snippet.id === contentId);
-	if (installed === void 0) return [];
-	const pinnedManifest = {
-		...manifest.value,
-		snippets: manifest.value.snippets.map((snippet) => snippet === installed ? {
-			...snippet,
-			pinned: true
-		} : snippet)
-	};
-	const choices = [{
-		id: "pin",
-		label: "Keep as pinned",
-		plan: {
-			operations: [createAuraManifestWriteOperation(manifest, pinnedManifest)],
-			summary: `Keep unavailable snippet ${contentId} at its installed revision.`
-		}
-	}];
-	const removal = removeSnippetPlan(model, contentId, installed);
-	if (removal !== void 0) choices.push({
-		id: "remove",
-		label: "Remove",
-		plan: removal
-	});
-	return choices;
-}
-function removeSnippetPlan(model, contentId, installed) {
-	if (model.manifest.status !== "ready") return;
-	const located = locateManagedSnippet(model, contentId);
-	if (located === void 0) return;
-	const preserve = located.document.parsed.status === "present" ? located.document.parsed.block.snippets.map((snippet) => snippet.id).filter((id) => id !== contentId) : [];
-	const reconciled = reconcileParsedManagedBlock(located.document.content, located.document.parsed, [], {
-		ownedSnippetIds: model.manifest.value.snippets.map((snippet) => snippet.id),
-		preserveSnippetIds: preserve,
-		previousSnippetHashes: new Map(model.manifest.value.snippets.map((snippet) => [snippet.id, snippet.hash]))
-	});
-	if (reconciled.status === "invalid") return;
-	const manifest = {
-		...model.manifest.value,
-		snippets: model.manifest.value.snippets.filter((snippet) => snippet !== installed)
-	};
-	return {
-		operations: [{
-			content: reconciled.content,
-			path: located.document.path,
-			type: "write"
-		}, createAuraManifestWriteOperation(model.manifest, manifest)],
-		summary: `Remove unavailable managed snippet ${contentId}.`
-	};
+	if (context.shared.problem !== void 0 || context.shared.treeHash !== context.installed.treeHash) return [resolveSkillDriftFirst(context.contentId)];
+	return [skillUpdateChoice(finding, context)];
 }
-function skillUpdateChoices(finding, model) {
+function skillUpdateContext(finding, model) {
 	const context = readyFindingContext(finding, model);
 	const sourceId = finding.metadata?.["sourceId"];
-	if (context === void 0 || typeof sourceId !== "string") return [];
-	const { contentId, manifest: manifestState } = context;
-	const installed = manifestState.value.skills.find((skill) => skill.id === contentId && skill.source === sourceId);
+	if (context === void 0 || typeof sourceId !== "string") return;
+	const { contentId, manifest } = context;
+	const installed = manifest.value.skills.find((skill) => skill.id === contentId && skill.source === sourceId);
 	const available = model.availableSkills?.find((skill) => skill.id === contentId && skill.source.id === sourceId);
 	const shared = model.sharedSkills?.find((skill) => skill.id === contentId);
-	if (installed === void 0 || available === void 0 || shared === void 0) return [];
-	if (shared.problem !== void 0 || shared.treeHash !== installed.treeHash) return [resolveSkillDriftFirst(contentId)];
+	return installed === void 0 || available === void 0 || shared === void 0 ? void 0 : {
+		available,
+		contentId,
+		installed,
+		manifest,
+		shared
+	};
+}
+function skillUpdateChoice(finding, context) {
+	const { available, contentId, installed, manifest: manifestState, shared } = context;
 	const manifest = {
 		...manifestState.value,
 		skills: manifestState.value.skills.map((skill) => skill === installed ? updatedSkill(skill, available) : skill)
 	};
-	return [{
+	return {
 		id: "update",
-		label: applyLabel(finding, available.version),
+		label: `${finding.metadata?.["kind"] === "skill-update" ? "Update to" : "Switch to"} ${available.version}`,
 		plan: {
 			operations: [...planSharedSkillTreeUpdate(shared.path, shared.entries, available), createAuraManifestWriteOperation(manifestState, manifest)],
 			summary: `Set managed skill ${contentId} to ${available.version}.`
 		}
-	}];
+	};
 }
 function readyFindingContext(finding, model) {
 	const contentId = finding.metadata?.["contentId"];
@@ -4688,27 +4286,6 @@ function updatedSkill(installed, available) {
 		version: available.version
 	};
 }
-function locateManagedSnippet(model, contentId) {
-	for (const document of managedDocuments(model)) {
-		if (document.parsed.status !== "present") continue;
-		const snippet = document.parsed.block.snippets.find((candidate) => candidate.id === contentId);
-		if (snippet !== void 0) return {
-			document,
-			snippet
-		};
-	}
-}
-function resolveDriftFirst(contentId) {
-	return {
-		id: "resolve-drift",
-		label: "Resolve local edits first",
-		plan: {
-			manualSteps: [`Run \`aura check --only MGD-001 --fix\` and resolve edits to ${contentId}, then review this update again.`],
-			operations: [],
-			summary: `Resolve local edits to ${contentId} before updating it.`
-		}
-	};
-}
 function resolveSkillDriftFirst(contentId) {
 	return {
 		id: "resolve-drift",
@@ -4720,55 +4297,21 @@ function resolveSkillDriftFirst(contentId) {
 		}
 	};
 }
+//#endregion
+//#region ../../plugins/checks-core/src/mgd-002.ts
 const managedContentUpdateCheck = defineCheck({
 	defaultSeverity: "info",
-	detect: detectManagedContentUpdates,
-	explain: "Aura records the exact version and content hash of each managed snippet and skill. When an installed plugin offers a different revision, Aura reports it and waits for a reviewed change instead of silently replacing managed content. A revision that is not newer — a rollback, or one this build cannot order — is reported too, because Aura keeps the recorded revision either way and an unreported hold would look like nothing to do. Pinned selections remain quiet until they are unpinned.\n\nRun `aura check --fix` to review bundled revisions and vanished snippets. Locally edited content must be resolved first; directory-sourced skill updates stay in `aura setup`, where network and credential approval are explicit.",
+	detect: detectManagedSkillUpdates,
+	explain: "Aura records the exact source revision of each managed skill. When an installed plugin offers a different revision, Aura reports it and waits for a reviewed change instead of silently replacing the skill. Pinned skills remain quiet until they are unpinned.\n\nRun `aura check --fix` to review bundled skill revisions. Directory-sourced skill updates stay in `aura setup`, where network and credential approval are explicit.",
 	fix: () => void 0,
 	fixability: "guided",
-	guidedFixes: managedContentUpdateChoices,
+	guidedFixes: managedSkillUpdateChoices,
 	id: "MGD-002",
 	scope: "global",
-	title: "Managed snippets and skills are at their reviewed source revisions"
+	title: "Managed skills are at their reviewed source revisions"
 });
-function detectManagedContentUpdates(model) {
-	if (model.manifest.status !== "ready") return [];
-	return [...model.manifest.value.snippets.flatMap((snippet) => snippetFinding(snippet, model)), ...model.manifest.value.skills.flatMap((skill) => skillFinding(skill, model))];
-}
-function snippetFinding(installed, model) {
-	if (installed.pinned) return [];
-	const available = model.availableSnippets.find((snippet) => snippet.id === installed.id);
-	if (available === void 0) return [{
-		id: `snippet:${installed.id}:missing`,
-		message: `Managed snippet ${installed.id} at version ${installed.version} is no longer provided by an installed plugin.`,
-		metadata: {
-			contentId: installed.id,
-			kind: "snippet-missing"
-		}
-	}];
-	const status = managedContentRevisionStatus(installed.version, installed.hash, available.version, available.hash);
-	if (status === "current") return [];
-	if (status === "diverged") return [{
-		details: "Aura keeps the recorded revision because the offered one is not newer. Re-run `aura setup` interactively to switch to it deliberately, or pin this snippet to stop the comparison.",
-		id: `snippet:${installed.id}:diverged`,
-		message: `Managed snippet ${installed.id} is recorded at version ${installed.version}, but the installed plugin offers ${available.version}, which is not newer.`,
-		metadata: {
-			availableVersion: available.version,
-			contentId: installed.id,
-			installedVersion: installed.version,
-			kind: "snippet-diverged"
-		}
-	}];
-	return [{
-		id: `snippet:${installed.id}:update`,
-		message: `Managed snippet ${installed.id} can update from version ${installed.version} to ${available.version}.`,
-		metadata: {
-			availableVersion: available.version,
-			contentId: installed.id,
-			installedVersion: installed.version,
-			kind: "snippet-update"
-		}
-	}];
+function detectManagedSkillUpdates(model) {
+	return model.manifest.status === "ready" ? model.manifest.value.skills.flatMap((skill) => skillFinding(skill, model)) : [];
 }
 function skillFinding(installed, model) {
 	if (installed.pinned || !installed.source.startsWith("plugin:")) return [];
@@ -5188,7 +4731,7 @@ const mcp003 = defineCheck({
 Remote URLs are silent and generate no network traffic unless \`check --online\` is supplied. Online probes use short, bounded requests without configured authentication headers, and they skip an endpoint whose credentials Aura stripped, because the remaining URL no longer addresses the configured server. A redirect to a private address is reported rather than followed. A timeout or a server-side fault is a warning, not an error: it may not repeat. Re-run with \`--fix\` to choose whether to repair or remove a server that definitely failed its probe. Cursor separately requires its MCP servers to be approved and enabled in its own settings, which no file records; Aura reads those states by running \`cursor-agent mcp list\` when that CLI is installed and identifies itself. The command is Cursor's, and it connects to servers to answer, so Aura runs it from your home directory: only your own global configuration takes part, never a \`.cursor/mcp.json\` committed to the repository you are in. Aura never approves, enables, or retries a server itself, and every state it reports this way is a warning. Aura also reports an informational reminder when a desired MCP transport references an unset environment variable. It retains only the variable name and whether it is set; credential values never enter the workspace model or report.`,
 	fix: () => void 0,
 	fixability: "guided",
-	guidedFixes: guidedFixes$1,
+	guidedFixes,
 	id: CHECK_ID,
 	scope: "global",
 	title: "Configured MCP servers can be reached"
@@ -5258,14 +4801,14 @@ function findingFor(server, probe, model) {
 		...probe.transient === true ? { severity: "warn" } : {}
 	};
 }
-function guidedFixes$1(finding, model) {
+function guidedFixes(finding, model) {
 	const server = findingServer(finding, model);
 	const kind = finding.metadata?.["kind"];
 	if (server === void 0 || kind !== "command" && kind !== "url") return [];
 	return [repairChoice(server, kind, model), removeChoice(server, model)];
 }
 function repairChoice(server, kind, model) {
-	const location = sourcePath$1(server, model) ?? "the application's MCP configuration";
+	const location = sourcePath(server, model) ?? "the application's MCP configuration";
 	return {
 		id: "repair",
 		label: "Repair server",
@@ -5293,7 +4836,7 @@ function removeChoice(server, model) {
 	};
 }
 function manualRemoval(server, model, blockers) {
-	const path = sourcePath$1(server, model) ?? "the application's MCP configuration file";
+	const path = sourcePath(server, model) ?? "the application's MCP configuration file";
 	const selected = model.manifest.status === "ready" && model.manifest.value.mcpServers.some((entry) => entry.name === server.name && entry.scope === server.scope && entry.apps.includes(server.appId));
 	return {
 		manualSteps: [
@@ -5315,72 +4858,9 @@ function findingServer(finding, model) {
 	if (typeof appId !== "string" || typeof name !== "string" || scope !== "global" && scope !== "project" || typeof sourceId !== "string") return;
 	return model.mcpServers.find((server) => server.appId === appId && server.name === name && server.scope === scope && server.sourceId === sourceId);
 }
-function sourcePath$1(server, model) {
+function sourcePath(server, model) {
 	return model.apps.find((app) => app.adapterId === server.appId)?.sourceFiles.find((file) => file.spec.id === server.sourceId)?.spec.path;
 }
-const mcp004 = defineCheck({
-	defaultSeverity: "error",
-	detect: detectInlineSecrets,
-	explain: `Inline credentials in MCP configuration can leak through source control, logs, diagnostics, and copied configuration. Aura identifies credential-bearing fields without retaining their values, prefixes, or lengths.
-
-Re-run with \`--fix\` to replace every behavior-preserving sighting in the same source file with an environment reference. Copy the current values directly from the named file before applying the rewrite; Aura never displays or stores those values outside the protected undo payload, which stays owner-only under \`~/agents/.backups\` until twenty later fixes have pushed it out of the journal. Then rotate each credential at its issuer: moving a value behind an environment reference stops it leaking again, not from wherever it has already reached.`,
-	findingGroup: {
-		description: "Replace inline credentials with environment-variable references.",
-		id: "checks-core/mcp-credentials",
-		title: "Protect credentials stored in MCP configuration"
-	},
-	fix: remediation,
-	fixability: "guided",
-	guidedFixes,
-	id: "MCP-004",
-	scope: "global",
-	title: "MCP credentials use environment references"
-});
-function detectInlineSecrets(model) {
-	return model.mcpSecretSightings.map((sighting) => {
-		const supported = canPlanMcpSecretRemediation(model, sighting);
-		const path = sourcePath(model, sighting);
-		return {
-			details: supported ? `Aura can replace this field with ${sighting.suggestedEnvName} as part of a whole-file guided rewrite.` : manualDetails(sighting),
-			...supported ? {} : { fixability: "manual" },
-			id: `${sighting.appId}:${sighting.sourceId}:${sighting.serverName}:${sighting.field}`,
-			...path === void 0 ? {} : { locations: [{ path }] },
-			message: `MCP server ${sighting.serverName} in ${sighting.appId} stores a credential inline at ${sighting.field}.`,
-			metadata: {
-				appId: sighting.appId,
-				field: sighting.field,
-				serverName: sighting.serverName,
-				sourceId: sighting.sourceId,
-				suggestedEnvName: sighting.suggestedEnvName
-			}
-		};
-	});
-}
-function remediation(finding, model) {
-	const sighting = findingSighting(finding, model);
-	return sighting === void 0 ? void 0 : planMcpSecretRemediation(model, sighting);
-}
-function guidedFixes(finding, model) {
-	const plan = remediation(finding, model);
-	return plan === void 0 ? [] : [{
-		id: "replace-file-secrets",
-		label: "Replace inline credentials in this file",
-		plan
-	}];
-}
-function findingSighting(finding, model) {
-	const appId = finding.metadata?.["appId"];
-	const sourceId = finding.metadata?.["sourceId"];
-	const serverName = finding.metadata?.["serverName"];
-	const field = finding.metadata?.["field"];
-	return model.mcpSecretSightings.find((sighting) => sighting.appId === appId && sighting.sourceId === sourceId && sighting.serverName === serverName && sighting.field === field);
-}
-function sourcePath(model, sighting) {
-	return model.apps.find((app) => app.adapterId === sighting.appId)?.sourceFiles.find((file) => file.spec.id === sighting.sourceId)?.spec.path;
-}
-function manualDetails(sighting) {
-	return sighting.appId === "codex" ? `Aura cannot rewrite ${sighting.field} without changing how Codex reads it — either the field has no environment-reference form, or the entry is not written as a \`[mcp_servers.${sighting.serverName}]\` table. Move the credential manually to an environment-aware field, then run \`aura check\` again.` : `This adapter cannot safely rewrite ${sighting.field}. Replace it manually with ${sighting.suggestedEnvName}, then run \`aura check\` again.`;
-}
 //#endregion
 //#region ../../plugins/checks-core/src/mcp-005-placement.ts
 /** Identifier every MCP-005 module stamps and matches on. */
@@ -5901,13 +5381,11 @@ const checksCorePlugin = definePlugin({
 		instructionLinkIntegrityCheck,
 		instructionContextBudgetCheck,
 		instructionPrecedenceCheck,
-		managedBlockHashCheck,
 		managedContentUpdateCheck,
 		unmanagedDetectedAppCheck,
 		mcp001,
 		mcp002,
 		mcp003,
-		mcp004,
 		mcp005,
 		skl001,
 		skl002,