@tryaura/aura-cli 0.3.0 → 0.3.1

package/dist/{run.boundary-DtkI7ZeG.js → run.boundary-NVWIwGgg.js}

@@ -1,5 +1,5 @@
-import { A as displayPath, C as isRecord$4, D as SHARED_INSTRUCTIONS_TEMPLATE, E as AuraManifestError, S as errorMessage$1, T as resolveAuraManifestPath, _ as assertAuraManifestWritable, a as planDesiredMcpConvergence, b as parseAuraManifest, c as rememberMcpConvergence, d as sharedSkillsRoot, g as hashContent, h as stripLegacyManagedBlock, k as pluralize, m as planSharedSkillTreeUpdate, n as appendInstructionFragments, p as managedContentRevisionStatus, r as forgetMcpPlans, t as planSharedInstructionLink, u as planSkillDeployment, v as createAuraManifestWriteOperation, w as AURA_MANIFEST_PATH, x as errorCode, y as createEmptyAuraManifest } from "./shared-link-plan-C57dSoid.js";
-import { COMMAND_NOT_FOUND_EXIT_CODE, DEFAULT_EXEC_TIMEOUT_MS, DEFAULT_HTTP_TIMEOUT_MS, MAX_EXEC_OUTPUT_CHARACTERS, MAX_EXEC_TIMEOUT_MS, MAX_HTTP_RESPONSE_BYTES, MAX_HTTP_TIMEOUT_MS, McpWriteError, NOT_EXECUTABLE_EXIT_CODE, OUTPUT_LIMIT_EXIT_CODE, SHARED_INSTRUCTIONS_TEMPLATE_TOKEN, TIMEOUT_EXIT_CODE, defineOwnProperty, detectExecutable, hasMcpRedaction, jsonPropertyPath, mcpEnvironmentVariableNames, mcpServerNameProblem, normalizeMcpServerDefinition, parseMcpServerDefinition, parseMcpServerManifest, parseSkillFrontmatter, parseSkillReferences, resolveMcpSecretNameCollisions, resolveSkillDirectory, splitSourceLines } from "@tryaura/aura-sdk";
+import { A as displayPath, C as isRecord$4, D as SHARED_INSTRUCTIONS_TEMPLATE, E as AuraManifestError, S as errorMessage$1, T as resolveAuraManifestPath, _ as assertAuraManifestWritable, a as planDesiredMcpConvergence, b as parseAuraManifest, c as rememberMcpConvergence, d as sharedSkillsRoot, g as hashContent, h as stripLegacyManagedBlock, k as pluralize, m as planSharedSkillTreeUpdate, n as appendInstructionFragments, p as managedContentRevisionStatus, r as forgetMcpPlans, t as planSharedInstructionLink, u as planSkillDeployment, v as createAuraManifestWriteOperation, w as AURA_MANIFEST_PATH, x as errorCode, y as createEmptyAuraManifest } from "./shared-link-plan-AcSkw9bO.js";
+import { COMMAND_NOT_FOUND_EXIT_CODE, DEFAULT_EXEC_TIMEOUT_MS, DEFAULT_HTTP_TIMEOUT_MS, MAX_EXEC_OUTPUT_CHARACTERS, MAX_EXEC_TIMEOUT_MS, MAX_HTTP_RESPONSE_BYTES, MAX_HTTP_TIMEOUT_MS, McpWriteError, NOT_EXECUTABLE_EXIT_CODE, OUTPUT_LIMIT_EXIT_CODE, SHARED_INSTRUCTIONS_TEMPLATE_TOKEN, TIMEOUT_EXIT_CODE, defineOwnProperty, detectExecutable, hasMcpRedaction, jsonPropertyPath, mcpEnvironmentVariableNames, mcpServerNameProblem, normalizeMcpServerDefinition, parseMcpServerDefinition, parseMcpServerManifest, parseMcpServerManifestValue, parseSkillFrontmatter, parseSkillReferences, resolveMcpSecretNameCollisions, resolveSkillDirectory, splitSourceLines } from "@tryaura/aura-sdk";
 import { basename, delimiter, dirname, isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
 import { Buffer as Buffer$1, isUtf8 } from "node:buffer";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
@@ -10,7 +10,7 @@ import { access, chmod, link, lstat, mkdir, open, opendir, readFile, readdir, re
 import { applyPatch, createTwoFilesPatch, structuredPatch } from "diff";
 import { coerce, parse, satisfies, valid, validRange } from "semver";
 import { isDeepStrictEqual } from "node:util";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { EnvHttpProxyAgent, fetch as fetch$1 } from "undici";
 import { gunzipSync } from "node:zlib";
 import process$1 from "node:process";
@@ -3903,6 +3903,7 @@ function collectUnknownBareCheckIdPlugins(state, bareCheckIdPlugins, candidates)
 function collectIdentityViolations(state, plugin) {
 	const violationCount = state.violations.length;
 	if (!PLUGIN_ID_PATTERN.test(plugin.id)) state.violations.push(`Plugin "${plugin.name}" declares ID "${plugin.id}", which cannot be used as an ID namespace; expected lowercase letters, digits, ".", "-", or "_", starting with a letter or digit.`);
+	if (plugin.id === "repo") state.violations.push(`Plugin "${plugin.name}" declares ID "repo", which is reserved.`);
 	if (plugin.name.trim().length === 0) state.violations.push(`Plugin "${plugin.id}" declares an empty name; reports identify plugins by name.`);
 	if (canonicalSemver(plugin.version) !== plugin.version) state.violations.push(`${formatPlugin(plugin)} declares version "${plugin.version}"; expected a semver version such as "1.0.0".`);
 	return state.violations.length === violationCount;
@@ -6315,12 +6316,13 @@ const MAX_SKILL_DRIVER_CALL_MS = 3e4;
 *
 * Bundled and already-installed trees are local state Aura itself wrote, so they walk unbounded.
 * A driver-materialized tree is whatever a plugin's driver put on disk — the reviewed origin is a
-* claim, not a guarantee — so it walks under {@link DRIVER_WALK_POLICY}, which caps file size,
-* file count, and total bytes, refuses paths that will not survive a portable filesystem, and
-* refuses two paths that would alias on a case-insensitive one.
+* claim, not a guarantee — so it walks under {@link DRIVER_WALK_POLICY}, which caps directory
+* count, file size, file count, and total bytes, refuses paths that will not survive a portable
+* filesystem, and refuses two paths that would alias on a case-insensitive one.
 */
 /** The bounds an untrusted, driver-supplied tree is read under. */
 const DRIVER_WALK_POLICY = Object.freeze({
+	maxDirectories: 200,
 	maxFileBytes: MAX_SKILL_FILE_BYTES,
 	maxFiles: 200,
 	maxTotalBytes: MAX_SKILL_RESPONSE_BYTES
@@ -6334,19 +6336,22 @@ function treeHash(files) {
 	return createHash("sha256").update(`${signature}\n`, "utf8").digest("hex");
 }
 /** Reads one skill directory, stopping at the first entry it cannot safely resolve. */
-async function walkTree(root, reader, policy) {
+async function walkTree(root, reader, policy, outerBoundary) {
 	const files = [];
 	const entries = [];
 	const state = {
+		bytesRead: 0,
+		directoryCount: 0,
 		portablePaths: /* @__PURE__ */ new Set(),
 		totalBytes: 0
 	};
 	const path = resolve(root);
 	const problem = await walkPath({
-		boundary: await reader.realPath(path) ?? path,
+		boundary: outerBoundary ?? await reader.realPath(path) ?? path,
 		path
 	}, path, reader, files, entries, state, policy);
 	return {
+		bytesRead: state.bytesRead,
 		entries: Object.freeze(entries),
 		files: Object.freeze(files.sort((left, right) => comparePortablePaths(left.path, right.path))),
 		...problem === void 0 ? {} : { problem }
@@ -6368,6 +6373,11 @@ async function walkPath(root, path, reader, files, entries, state, policy) {
 		message: `${relativePath || "."} could not be read (${contents.problem})`
 	};
 	if (contents.entries !== void 0) {
+		if (policy !== void 0 && state.directoryCount >= policy.maxDirectories) return {
+			kind: "too-large",
+			message: `${relativePath || "."} exceeds the skill directory limit`
+		};
+		state.directoryCount += 1;
 		entries.push({
 			kind: "directory",
 			path
@@ -6385,6 +6395,8 @@ function addFile(path, relativePath, contents, files, entries, state, policy) {
 		kind: "unsupported",
 		message: `${relativePath} is not a readable regular file`
 	};
+	const bytes = Buffer$1.byteLength(contents.content, "utf8");
+	state.bytesRead += bytes;
 	if (contents.utf8Valid === false) return {
 		kind: "unsupported",
 		message: `${relativePath} is not valid UTF-8`
@@ -6399,7 +6411,6 @@ function addFile(path, relativePath, contents, files, entries, state, policy) {
 			kind: "unsupported",
 			message: `${relativePath} aliases another skill file`
 		};
-		const bytes = Buffer$1.byteLength(contents.content, "utf8");
 		if (state.totalBytes + bytes > policy.maxTotalBytes) return {
 			kind: "too-large",
 			message: `${relativePath} exceeds the skill size limit`
@@ -6425,7 +6436,7 @@ function comparePortablePaths(left, right) {
 //#endregion
 //#region ../core/src/workspace/skills.ts
 const SKILLS_DIAGNOSTIC_ID = "core/skills";
-const SKILL_FILE$1 = "SKILL.md";
+const SKILL_FILE$2 = "SKILL.md";
 /** Canonical shared skill root for one captured environment. */
 function sharedSkillsPath(environment) {
 	return sharedSkillsRoot(environment.homeDir);
@@ -6448,8 +6459,8 @@ async function resolveBundledSkills(registrations, reader) {
 			path,
 			skill
 		};
-		if (!tree.files.some((file) => file.path === SKILL_FILE$1)) return {
-			message: `does not contain ${SKILL_FILE$1}`,
+		if (!tree.files.some((file) => file.path === SKILL_FILE$2)) return {
+			message: `does not contain ${SKILL_FILE$2}`,
 			path,
 			skill
 		};
@@ -6485,7 +6496,7 @@ async function resolveDriverSkillPack(skill, source, reader) {
 		return { kind: "invalid" };
 	}
 	const tree = await walkTree(path, reader, DRIVER_WALK_POLICY);
-	if (tree.problem !== void 0 || !tree.files.some((file) => file.path === SKILL_FILE$1)) return { kind: "invalid" };
+	if (tree.problem !== void 0 || !tree.files.some((file) => file.path === SKILL_FILE$2)) return { kind: "invalid" };
 	return {
 		kind: "resolved",
 		value: Object.freeze({
@@ -6529,8 +6540,8 @@ async function scanSharedSkills(environment, reader) {
 * reports `unreadable` and leaves the real cause to travel in `problemDetail`.
 */
 function sharedSkillDefinition(path, tree, homeDir) {
-	const skillFilePath = join(path, SKILL_FILE$1);
-	const file = tree.files.find((entry) => entry.path === SKILL_FILE$1);
+	const skillFilePath = join(path, SKILL_FILE$2);
+	const file = tree.files.find((entry) => entry.path === SKILL_FILE$2);
 	if (file === void 0) return {
 		definitionStatus: tree.problem === void 0 ? "missing-file" : "unreadable",
 		skillFilePath
@@ -7264,7 +7275,7 @@ function parseContents(body) {
 }
 //#endregion
 //#region ../core/src/skills/pack-schema.ts
-const SKILL_FILE = "SKILL.md";
+const SKILL_FILE$1 = "SKILL.md";
 /**
 * Parses a directory's `skills/<id>` body.
 *
@@ -7307,9 +7318,9 @@ function parseDirectorySkillPack(body, expectedId) {
 		kind: "invalid",
 		problem: files
 	};
-	if (!files.some((file) => file.path === SKILL_FILE)) return {
+	if (!files.some((file) => file.path === SKILL_FILE$1)) return {
 		kind: "invalid",
-		problem: `response does not contain a root ${SKILL_FILE}`
+		problem: `response does not contain a root ${SKILL_FILE$1}`
 	};
 	return {
 		files,
@@ -7483,7 +7494,7 @@ async function downloadFiles(environment, location, remoteFiles) {
 async function listAgenticSkills(environment, source, options = {}) {
 	const catalog = await loadAgenticCatalog(environment, source, options.noCache === true);
 	if (catalog.kind === "failure") return {
-		diagnostics: [diagnostic(`Skill source "${source.id}" ${catalog.reason}, so it is unavailable.`)],
+		diagnostics: [diagnostic$1(`Skill source "${source.id}" ${catalog.reason}, so it is unavailable.`)],
 		listings: [],
 		status: {
 			hint: "unreachable",
@@ -7492,7 +7503,7 @@ async function listAgenticSkills(environment, source, options = {}) {
 	};
 	return {
 		collections: catalog.collections,
-		diagnostics: [...cacheDiagnostics(source, catalog), ...catalog.problems.map((problem) => diagnostic(`Skill source "${source.id}" catalog ${problem}, so some of it is unavailable.`))],
+		diagnostics: [...cacheDiagnostics(source, catalog), ...catalog.problems.map((problem) => diagnostic$1(`Skill source "${source.id}" catalog ${problem}, so some of it is unavailable.`))],
 		listings: Object.freeze(catalog.entries.map(({ listing }) => Object.freeze({
 			...listing,
 			source
@@ -7506,7 +7517,7 @@ async function listAgenticSkills(environment, source, options = {}) {
 function cacheDiagnostics(source, catalog) {
 	if (catalog.cacheAgeMs === void 0) return [];
 	const age = describeCacheAge(catalog.cacheAgeMs);
-	return [diagnostic(catalog.staleAfterFailure === true ? `Skill source "${source.id}" could not be reached, so its listing is served from the local cache (${age}).` : `Skill source "${source.id}" listing served from the local cache (${age}); pass --no-cache to refetch it now.`)];
+	return [diagnostic$1(catalog.staleAfterFailure === true ? `Skill source "${source.id}" could not be reached, so its listing is served from the local cache (${age}).` : `Skill source "${source.id}" listing served from the local cache (${age}); pass --no-cache to refetch it now.`)];
 }
 /** Resolves AgenticSkills entries from their exact GitHub directories into reviewed Aura packs. */
 async function resolveAgenticSkills(environment, source, skillIds) {
@@ -7529,7 +7540,7 @@ async function resolveAgenticSkills(environment, source, skillIds) {
 function catalogEntries(catalog) {
 	return catalog.kind === "catalog" ? new Map(catalog.entries.map((entry) => [entry.listing.id, entry])) : /* @__PURE__ */ new Map();
 }
-function diagnostic(message) {
+function diagnostic$1(message) {
 	return {
 		adapterId: AGENTICSKILLS_DIAGNOSTIC_ID,
 		message,
@@ -7537,7 +7548,7 @@ function diagnostic(message) {
 	};
 }
 function skillDiagnostic(source, id, reason) {
-	return diagnostic(`Skill "${id}" from "${source.id}" ${reason}, so it is unavailable.`);
+	return diagnostic$1(`Skill "${id}" from "${source.id}" ${reason}, so it is unavailable.`);
 }
 function isDiagnostic(value) {
 	return "adapterId" in value;
@@ -7851,7 +7862,7 @@ const DIRECTORY_PREFIX = "directory:";
 /** Namespaced MCP catalog id, such as `official/github`. */
 const MCP_CATALOG_ID_PATTERN = /^[a-z0-9][a-z0-9._-]*\/[a-zA-Z0-9][a-zA-Z0-9._-]*$/u;
 const SKILL_ID_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
-const SKILL_SOURCE_ID_PATTERN = /^(?:directory|driver|plugin):[^\s:]+$/u;
+const SKILL_SOURCE_ID_PATTERN = /^(?:directory|driver|plugin|repo):[^\s:]+$/u;
 /**
 * Picks the first collected problem out of a batch of independently validated fields.
 *
@@ -7984,6 +7995,52 @@ function collectJsonValue(value, path, depth) {
 	return collectJsonObject(value, path, depth);
 }
 //#endregion
+//#region ../core/src/preset/repo-content-limits.ts
+/**
+* The largest combined byte size of a repository's content set.
+*
+* The snapshot lives in memory for the whole run so planners apply consented bytes rather than a
+* re-read; a repository must not be able to balloon that residency.
+*/
+const MAX_REPO_CONTENT_TOTAL_BYTES = 16e6;
+//#endregion
+//#region ../core/src/preset/schema-provides.ts
+const REPO_MCP_ID_PATTERN = /^repo\/[a-zA-Z0-9][a-zA-Z0-9._-]*$/u;
+/**
+* Collects the `provides` envelope of a repository preset.
+*
+* Content a preset authors reaches command lines and app configuration, so it may only arrive
+* from the file the user hash-trusted for this repository. Callers validating a downloaded or
+* bundled preset reject the field wholesale before this collector runs.
+*/
+function collectProvides(value) {
+	if (value === void 0) return;
+	if (!isRecord$4(value)) return "$.provides: must be an object";
+	const servers = collectProvidedMcpServers(value["mcpServers"]);
+	if (typeof servers === "string") return servers;
+	return servers === void 0 ? Object.freeze({}) : Object.freeze({ mcpServers: servers });
+}
+function collectProvidedMcpServers(value) {
+	if (value === void 0) return;
+	if (!Array.isArray(value)) return "$.provides.mcpServers: must be an array of MCP server definitions";
+	if (value.length > 16) return `$.provides.mcpServers: must contain at most ${String(16)} definitions`;
+	const result = [];
+	const ids = /* @__PURE__ */ new Set();
+	const serverNames = /* @__PURE__ */ new Set();
+	for (const [index, candidate] of value.entries()) {
+		const path = `$.provides.mcpServers[${String(index)}]`;
+		const parsed = parseMcpServerManifestValue(candidate);
+		if ("error" in parsed) return `${path}${parsed.error.path.slice(1)}: ${parsed.error.message}`;
+		if (!REPO_MCP_ID_PATTERN.test(parsed.value.id)) return `${path}.id: must be namespaced "repo/<name>"`;
+		if (ids.has(parsed.value.id)) return `${path}.id: must not duplicate another provided server id`;
+		if (serverNames.has(parsed.value.serverName)) return `${path}.serverName: must not duplicate another provided server name`;
+		ids.add(parsed.value.id);
+		serverNames.add(parsed.value.serverName);
+		result.push(parsed.value);
+	}
+	return Object.freeze(result);
+}
+//#endregion
 //#region ../core/src/preset/schema-sources.ts
 function collectSkills(value) {
 	if (value === void 0) return;
@@ -7997,7 +8054,7 @@ function collectSkills(value) {
 		const id = candidate["id"];
 		const source = candidate["source"];
 		if (typeof id !== "string" || !SKILL_ID_PATTERN.test(id)) return `${path}.id: must be a kebab-case skill id`;
-		if (typeof source !== "string" || !SKILL_SOURCE_ID_PATTERN.test(source)) return `${path}.source: must be a plugin:, directory:, or driver: source id`;
+		if (typeof source !== "string" || !SKILL_SOURCE_ID_PATTERN.test(source)) return `${path}.source: must be a plugin:, directory:, driver:, or repo: source id`;
 		const identity = `${source}/${id}`;
 		if (seen.has(identity)) return `${path}: must not duplicate another skill selection`;
 		seen.add(identity);
@@ -8071,31 +8128,32 @@ function toDirectoryId(id) {
 function toSourceId(id) {
 	if (id.startsWith("directory:")) return toDirectoryId(id);
 	if (id.startsWith("driver:")) return `driver:${id.slice(7)}`;
+	if (id.startsWith("repo:")) return `repo:${id.slice(5)}`;
 	return `plugin:${id.slice(id.indexOf(":") + 1)}`;
 }
 //#endregion
 //#region ../core/src/preset/schema.ts
 /** Validates and freezes one parsed JSON document as a data-only team preset. */
-function validateTeamPreset(value) {
+function validateTeamPreset(value, options = {}) {
 	if (!isRecord$4(value)) return invalid$2("$: must be an object");
-	const depthProblem = documentDepthProblem(value, "$", 0);
-	if (depthProblem !== void 0) return invalid$2(depthProblem);
-	if (value["schemaVersion"] !== 1) return invalid$2("$.schemaVersion: must be 1");
+	const problemBeforeFields = envelopeProblem(value, options);
+	if (problemBeforeFields !== void 0) return invalid$2(problemBeforeFields);
 	const name = value["name"];
-	if (name !== void 0 && (typeof name !== "string" || name.trim().length === 0 || name.length > 128)) return invalid$2("$.name: must be a non-empty string of at most 128 characters");
 	const checks = collectChecks(value["checks"]);
 	const allowed = collectAllowedSources(value["allowedSkillSources"]);
 	const directories = collectDirectories(value["skillDirectories"]);
 	const requiredMcpServers = collectIds(value["requiredMcpServers"], "$.requiredMcpServers", MCP_CATALOG_ID_PATTERN);
 	const snippets = collectIds(value["snippets"], "$.snippets", CONTENT_ID_PATTERN);
 	const skills = collectSkills(value["skills"]);
+	const provides = collectProvides(value["provides"]);
 	const problem = firstProblem([
 		checks,
 		allowed,
 		directories,
 		requiredMcpServers,
 		snippets,
-		skills
+		skills,
+		provides
 	]);
 	if (problem !== void 0) return invalid$2(problem);
 	return {
@@ -8103,6 +8161,7 @@ function validateTeamPreset(value) {
 		preset: Object.freeze({
 			...Array.isArray(allowed) ? { allowedSkillSources: allowed } : {},
 			...isChecks(checks) ? { checks } : {},
+			...typeof provides === "object" ? { provides } : {},
 			...Array.isArray(requiredMcpServers) ? { requiredMcpServers } : {},
 			...typeof name === "string" ? { name } : {},
 			schemaVersion: 1,
@@ -8118,6 +8177,15 @@ function invalid$2(problem) {
 		problem
 	};
 }
+/** Checks the document envelope — depth, version, origin gate, name — before any field walks. */
+function envelopeProblem(value, options) {
+	const depthProblem = documentDepthProblem(value, "$", 0);
+	if (depthProblem !== void 0) return depthProblem;
+	if (value["schemaVersion"] !== 1) return "$.schemaVersion: must be 1";
+	if (options.allowProvides !== true && value["provides"] !== void 0) return "$.provides: only the repository preset may provide content";
+	const name = value["name"];
+	if (name !== void 0 && (typeof name !== "string" || name.trim().length === 0 || name.length > 128)) return "$.name: must be a non-empty string of at most 128 characters";
+}
 /**
 * Rejects a document nested past the limit before any field is read.
 *
@@ -8967,7 +9035,7 @@ async function readTeamPreset(cwd, reader) {
 	} catch {
 		return failure(path, "is not valid JSON");
 	}
-	const result = validateTeamPreset(parsed);
+	const result = validateTeamPreset(parsed, { allowProvides: true });
 	if (result.kind === "invalid") return failure(path, `is not a valid team preset (${result.problem})`);
 	return {
 		content: contents.content,
@@ -8989,18 +9057,275 @@ function failure(path, reason) {
 	};
 }
 //#endregion
-//#region ../core/src/preset/repo-trust.ts
+//#region ../core/src/skills/repo-source.ts
+const REPO_SKILLS_DIAGNOSTIC_ID = "core/repo-skills";
+const SKILL_FILE = "SKILL.md";
+/** The one source id repository skills are offered under; one repository, one source. */
+const REPO_SKILL_SOURCE_ID = "repo:workspace";
+/** The repository skills directory as a picker-facing source. */
+function repoSkillSource(path) {
+	return Object.freeze({
+		id: REPO_SKILL_SOURCE_ID,
+		kind: "repo",
+		name: "This repository",
+		path
+	});
+}
+/**
+* Resolves every skill tree below `.aura/skills` into an installable pack.
+*
+* A broken entry earns a diagnostic and drops out rather than failing the run: unlike snippets,
+* these trees are outside the trust hash — they are offers the per-skill review gates, so an
+* unreadable one is a smaller catalog, not a broken consent record. Each tree walks under the
+* driver policy: a cloned tree deserves exactly the suspicion a driver-materialized one gets.
+*/
+async function resolveRepoSkills(root, boundary, reader, maxTotalBytes) {
+	const rootRead = await reader.readWithin(root, [boundary]);
+	const { contents } = rootRead;
+	if (!contents.exists) return {
+		diagnostics: [],
+		skills: []
+	};
+	if (rootRead.kind !== "read" || contents.pathKind === "symlink" || contents.problem !== void 0 || contents.entries === void 0) return {
+		diagnostics: [{
+			adapterId: REPO_SKILLS_DIAGNOSTIC_ID,
+			message: "Repository skills path .aura/skills is not a directory, so none are offered.",
+			path: root,
+			phase: "read"
+		}],
+		skills: []
+	};
+	const diagnostics = [];
+	const named = contents.entries.filter((entry) => !entry.startsWith("."));
+	if (named.length > 32) diagnostics.push({
+		adapterId: REPO_SKILLS_DIAGNOSTIC_ID,
+		message: `Repository skills directory holds more than the ${String(32)} entries Aura offers; the rest are ignored.`,
+		path: root,
+		phase: "read"
+	});
+	const skills = [];
+	const source = repoSkillSource(root);
+	let bytesRead = 0;
+	for (const id of named.slice(0, 32)) {
+		const remainingBytes = maxTotalBytes - bytesRead;
+		if (remainingBytes <= 0) {
+			diagnostics.push(diagnostic(join(root, id), "exceeds the repository content size budget"));
+			continue;
+		}
+		const outcome = await resolveOneSkill(root, id, source, reader, boundary, remainingWalkPolicy(remainingBytes));
+		bytesRead += outcome.bytesRead;
+		if (outcome.problem !== void 0) {
+			diagnostics.push(diagnostic(join(root, id), outcome.bytesRead >= remainingBytes ? "exceeds the repository content size budget" : outcome.problem));
+			continue;
+		}
+		skills.push(outcome.skill);
+	}
+	return {
+		diagnostics: Object.freeze(diagnostics),
+		skills: Object.freeze(skills)
+	};
+}
+async function resolveOneSkill(root, id, source, reader, boundary, policy) {
+	const idProblem = skillIdProblem(id);
+	if (idProblem !== void 0) return {
+		bytesRead: 0,
+		problem: idProblem
+	};
+	const tree = await walkTree(join(root, id), reader, policy, boundary);
+	if (tree.problem !== void 0) return {
+		bytesRead: tree.bytesRead,
+		problem: tree.problem.message
+	};
+	const definition = tree.files.find((file) => file.path === SKILL_FILE);
+	if (definition === void 0) return {
+		bytesRead: tree.bytesRead,
+		problem: `does not contain ${SKILL_FILE}`
+	};
+	const frontmatter = parseSkillFrontmatter(definition.content);
+	return {
+		bytesRead: tree.bytesRead,
+		skill: Object.freeze({
+			description: frontmatter.description ?? "Repository skill.",
+			files: tree.files,
+			id,
+			name: frontmatter.name ?? id,
+			source,
+			treeHash: treeHash(tree.files),
+			version: frontmatter.version ?? "0.0.0"
+		})
+	};
+}
+/** Caps each attempt by what remains of the repository-wide read budget. */
+function remainingWalkPolicy(remainingBytes) {
+	return Object.freeze({
+		...DRIVER_WALK_POLICY,
+		maxFileBytes: Math.min(DRIVER_WALK_POLICY.maxFileBytes, remainingBytes),
+		maxTotalBytes: Math.min(DRIVER_WALK_POLICY.maxTotalBytes, remainingBytes)
+	});
+}
+function diagnostic(path, message) {
+	return {
+		adapterId: REPO_SKILLS_DIAGNOSTIC_ID,
+		message: `Repository skill ${message}, so it is not offered.`,
+		path,
+		phase: "read"
+	};
+}
+//#endregion
+//#region ../core/src/preset/repo-content-files.ts
+/** Matches the optional frontmatter block a snippet file may open with. */
+const FRONTMATTER_PATTERN = /^---\r?\n[\s\S]*?\r?\n---(?:\r?\n|$)/u;
+/** Reads every Markdown snippet below `.aura/snippets` under the trust-set rules. */
+async function readRepoSnippets(root, boundary, reader) {
+	const contents = await reader.read(root);
+	if (!contents.exists) return {
+		files: [],
+		status: "ready"
+	};
+	if (contents.entries === void 0) return {
+		problem: "the snippets path is not a directory",
+		status: "invalid"
+	};
+	const names = contents.entries.filter((entry) => !entry.startsWith(".") && entry.endsWith(".md"));
+	if (names.length > 64) return {
+		problem: `holds more than the ${String(64)} snippet limit`,
+		status: "invalid"
+	};
+	const files = [];
+	for (const name of names) {
+		const result = await readSnippetFile(root, name, boundary, reader);
+		if (typeof result === "string") return {
+			problem: result,
+			status: "invalid"
+		};
+		files.push(result);
+	}
+	files.sort((left, right) => left.entry.id < right.entry.id ? -1 : 1);
+	return {
+		files: Object.freeze(files),
+		status: "ready"
+	};
+}
+async function readSnippetFile(root, name, boundary, reader) {
+	const stem = name.slice(0, -3);
+	if (skillIdProblem(stem) !== void 0) return "contains an entry that is not a kebab-case Markdown file name";
+	const read = await reader.readWithin(join(root, name), [boundary], { maxBytes: MAX_SNIPPET_BYTES });
+	const problem = snippetReadProblem(read);
+	if (problem !== void 0) return problem;
+	const text = read.contents.content ?? "";
+	const frontmatter = parseSkillFrontmatter(text);
+	const body = text.replace(FRONTMATTER_PATTERN, "");
+	return {
+		entry: Object.freeze({
+			body,
+			...frontmatter.description === void 0 ? {} : { description: frontmatter.description },
+			id: `repo/${stem}`,
+			name: frontmatter.name ?? stem
+		}),
+		text
+	};
+}
+/** Why a bounded, boundary-checked read did not yield a plain snippet file. */
+function snippetReadProblem(read) {
+	if (read.kind === "outside") return "contains an entry that leads outside the repository's .aura directory";
+	if (read.kind === "unverified" || read.contents.pathKind === "symlink") return "contains an entry that is not a regular file";
+	const { contents } = read;
+	if (contents.problem !== void 0 || contents.isDirectory || contents.content === void 0 || contents.utf8Valid === false) return "contains an entry that is not a readable UTF-8 file";
+	if ((contents.size ?? 0) > 256e3) return `contains an entry larger than the ${String(MAX_SNIPPET_BYTES)} byte snippet limit`;
+}
+//#endregion
+//#region ../core/src/preset/repo-content.ts
+const REPO_CONTENT_DIAGNOSTIC_ID = "core/repo-content";
+/**
+* Reads the repository's trust-hashed content and any requested installable content in one snapshot.
+*
+* The result is what catalogs and planners consume for the whole run: applying from this snapshot
+* rather than from a re-read is what closes the window between the bytes the user consented to
+* and the bytes a later write could put on disk. A broken snippet set fails the run — those bytes
+* are inside the trust hash — while a broken skill tree only shrinks the offers, because skills
+* stay behind the per-skill review.
+*/
+async function readRepoContent(auraDir, preset, presetText, reader, options = {}) {
+	const boundary = await reader.realPath(auraDir) ?? auraDir;
+	const snippets = await readRepoSnippets(join(auraDir, "snippets"), boundary, reader);
+	if (snippets.status === "invalid") return {
+		diagnostics: [{
+			adapterId: REPO_CONTENT_DIAGNOSTIC_ID,
+			message: `Repository snippets directory ".aura/snippets" ${snippets.problem}.`,
+			path: join(auraDir, "snippets"),
+			phase: "read"
+		}],
+		status: "invalid"
+	};
+	const snippetBytes = snippets.files.reduce((sum, file) => sum + Buffer$1.byteLength(file.text, "utf8"), 0);
+	if (snippetBytes > 16e6) return {
+		diagnostics: [{
+			adapterId: REPO_CONTENT_DIAGNOSTIC_ID,
+			message: `Repository snippets exceed the ${String(MAX_REPO_CONTENT_TOTAL_BYTES)} byte repository content budget.`,
+			path: join(auraDir, "snippets"),
+			phase: "read"
+		}],
+		status: "invalid"
+	};
+	const skills = options.includeSkills === false ? {
+		diagnostics: [],
+		skills: []
+	} : await resolveRepoSkills(join(auraDir, "skills"), boundary, reader, MAX_REPO_CONTENT_TOTAL_BYTES - snippetBytes);
+	return {
+		contentSet: Object.freeze({
+			mcpServers: preset.provides?.mcpServers ?? [],
+			skills: skills.skills,
+			snippets: Object.freeze(snippets.files.map((file) => file.entry))
+		}),
+		diagnostics: skills.diagnostics,
+		hash: hashRepoContentSet(presetText, snippets.files.map((file) => ({
+			id: file.entry.id,
+			text: file.text
+		}))),
+		status: "ready"
+	};
+}
 /**
-* Hashes repository preset contents for the trust record.
+* Lifts the preset's inline MCP definitions into catalog entries.
 *
-* Normalizes line endings so a checkout that rewrites them does not invalidate a trust the user
-* already granted to the same bytes-as-authored.
+* The `repo/` namespace is reserved against plugins at registry build, so these can never collide
+* with — or be shadowed by — a plugin catalog entry. The source URL names the preset file itself:
+* that is the file whose bytes the user trusted.
 */
-function hashRepoPreset(content) {
-	return hashContent(content);
+function repoMcpServerDefs(servers, presetPath) {
+	return Object.freeze(servers.map((manifest) => Object.freeze({
+		description: manifest.description,
+		id: manifest.id,
+		kind: "mcp-server",
+		manifest,
+		name: manifest.name,
+		source: Object.freeze({
+			type: "file",
+			url: pathToFileURL(presetPath).href
+		}),
+		version: "0.0.0"
+	})));
 }
+/**
+* Hashes the repository content set for the trust record.
+*
+* With no snippet files the hash is exactly the preset file's own content hash, so a repository
+* that never adds `.aura/snippets` keeps every trust its users already recorded. The first
+* snippet changes the descriptor shape — and consent is re-asked, which is the point.
+*/
+function hashRepoContentSet(presetText, snippets) {
+	if (snippets.length === 0) return hashContent(presetText);
+	const lines = [
+		"aura-repo-content-v1",
+		`preset ${hashContent(presetText)}`,
+		...[...snippets].sort((left, right) => left.id < right.id ? -1 : 1).map((file) => `snippet ${file.id} ${hashContent(file.text)}`)
+	];
+	return hashContent(lines.join("\n"));
+}
+//#endregion
+//#region ../core/src/preset/repo-trust.ts
 /** Reads and validates the repository preset below the invoking directory. */
-async function readRepoPreset(environment, reader = createFileReader()) {
+async function readRepoPreset(environment, reader = createFileReader(), options = {}) {
 	const cwd = await reader.realPath(environment.cwd) ?? environment.cwd;
 	const path = resolveTeamPresetPath(cwd);
 	const state = await readTeamPreset(cwd, reader);
@@ -9009,10 +9334,17 @@ async function readRepoPreset(environment, reader = createFileReader()) {
 		path,
 		status: state.status
 	};
+	const content = await readRepoContent(dirname(path), state.preset, state.content, reader, options);
+	if (content.status === "invalid") return {
+		diagnostics: [...state.diagnostics, ...content.diagnostics],
+		path,
+		status: "invalid"
+	};
 	const mainWorktreePath = await resolveMainWorktreePresetPath(cwd, path, reader);
 	return {
-		diagnostics: state.diagnostics,
-		hash: hashRepoPreset(state.content),
+		contentSet: content.contentSet,
+		diagnostics: [...state.diagnostics, ...content.diagnostics],
+		hash: content.hash,
 		...mainWorktreePath === void 0 ? {} : { mainWorktreePath },
 		path,
 		preset: state.preset,
@@ -9117,6 +9449,91 @@ function note(reason, id, selection) {
 	};
 }
 //#endregion
+//#region src/runtime-config.ts
+/** Loads the selected preset and resolves all runtime layers once for a command. */
+async function resolveRuntimeConfig(input) {
+	if (input.manifest.status === "read-only") return {
+		message: input.manifest.problem.message,
+		status: "invalid"
+	};
+	const manifest = input.manifest.status === "ready" ? input.manifest.value : void 0;
+	const loaded = await loadTeamPreset({
+		cliReference: input.cliReference,
+		defaultReference: input.defaultPreset,
+		environment: input.environment,
+		manifestReference: manifest?.preset,
+		noCache: input.noCache,
+		offline: input.online !== true,
+		presets: input.registry.presets
+	});
+	if (loaded.status === "invalid") return loaded;
+	const repo = input.repoPresetState ?? await readRepoPreset(input.environment, void 0, { includeSkills: false });
+	if (repo.status === "invalid") return {
+		message: `${repo.diagnostics[0]?.message ?? `Repository preset ${repo.path} cannot be read.`} Fix or remove the file to continue.`,
+		status: "invalid"
+	};
+	const repoTrusted = repo.status === "ready" && repo.hash !== void 0 && (repo.hash === input.acceptedRepoPresetHash || isRepoPresetTrusted(manifest, repo, repo.hash));
+	const resolved = resolveEffectiveConfig({
+		checks: input.registry.checks,
+		cli: input.cliLayer,
+		distro: input.defaults,
+		knownMcpServers: /* @__PURE__ */ new Set([...input.registry.mcpServers.map((server) => server.id), ...repoTrusted ? (repo.preset?.provides?.mcpServers ?? []).map((server) => server.id) : []]),
+		...manifest === void 0 ? {} : { manifest: {
+			...manifest.checks === void 0 ? {} : { checks: manifest.checks },
+			skills: manifest.skills.map(({ id, source }) => ({
+				id,
+				source
+			})),
+			snippets: manifest.snippets.map(({ id }) => id)
+		} },
+		...loaded.status === "ready" ? {
+			preset: loaded.preset,
+			selectedPreset: loaded.selected
+		} : {},
+		...repoTrusted ? { repo: repo.preset } : {}
+	});
+	if (resolved.status === "invalid") return {
+		message: resolved.problems.join("\n"),
+		status: "invalid"
+	};
+	const policyPreset = loaded.status === "ready" || resolved.config.allowedSkillSources !== void 0 || resolved.config.skillDirectories.length > 0 ? Object.freeze({
+		...loaded.status === "ready" ? loaded.preset : {},
+		...resolved.config.allowedSkillSources === void 0 ? {} : { allowedSkillSources: resolved.config.allowedSkillSources.value },
+		name: resolved.config.preset?.name ?? resolved.config.allowedSkillSources?.provenance.label ?? resolved.config.skillDirectories[0]?.provenance.label ?? "runtime policy",
+		schemaVersion: 1,
+		skillDirectories: resolved.config.skillDirectories.map(({ value }) => value)
+	}) : void 0;
+	return {
+		config: resolved.config,
+		notes: [...loaded.status === "ready" ? loaded.notes : [], ...repoTrusted ? repo.diagnostics.map((diagnostic) => diagnostic.message) : []],
+		...policyPreset === void 0 ? {} : { preset: policyPreset },
+		presetOrigin: loaded.status === "ready" ? loaded.origin : policyPreset?.name ?? ".aura/preset.json",
+		...repo.status === "ready" && repo.hash !== void 0 ? { repoPreset: {
+			...repoTrusted && repo.contentSet !== void 0 ? { contentSet: repo.contentSet } : {},
+			hash: repo.hash,
+			...repo.mainWorktreePath === void 0 ? {} : { mainWorktreePath: repo.mainWorktreePath },
+			path: repo.path,
+			...repoTrusted && repo.preset !== void 0 ? { preset: repo.preset } : {},
+			status: repoTrusted ? "applied" : "held"
+		} } : {},
+		status: "ready"
+	};
+}
+/**
+* Adds a trusted repository's provided MCP definitions to the model's catalog.
+*
+* Run before {@link applyRequiredMcpServers} projection wherever a model is projected, so a
+* repository can require a server it defines itself. A held repository changes nothing.
+*/
+function withRepoMcpCatalog(model, repoPreset) {
+	const servers = repoPreset?.status === "applied" ? repoPreset.contentSet?.mcpServers ?? [] : [];
+	if (servers.length === 0 || repoPreset === void 0) return model;
+	return Object.freeze({
+		...model,
+		availableMcpServers: Object.freeze([...model.availableMcpServers, ...repoMcpServerDefs(servers, repoPreset.path)])
+	});
+}
+//#endregion
 //#region src/safe-text.ts
 const MAX_FINDING_TEXT_CHARACTERS = 500;
 const UNICODE_FORMAT_CHARACTER = /\p{Cf}/u;
@@ -9339,6 +9756,15 @@ function countsByCheck(findings) {
 }
 //#endregion
 //#region src/command-support.ts
+/**
+* Projects preset requirements onto a check scan's model.
+*
+* A trusted repository's provided MCP definitions join the catalog first, so a repository can
+* require a server it defines itself and `check` reports that requirement the way setup would.
+*/
+function projectConfiguredModel(model, configured) {
+	return applyRequiredMcpServers(withRepoMcpCatalog(model, configured.repoPreset), configured.config);
+}
 /** The `--home` override every scanning command shares. */
 function homeOption() {
 	return Option.String("--home", { description: "Override the home directory." });
@@ -9404,75 +9830,6 @@ function reportUnexpectedFailure(error, subject, branding, withDetail, stderr, t
 	return 3;
 }
 //#endregion
-//#region src/runtime-config.ts
-/** Loads the selected preset and resolves all runtime layers once for a command. */
-async function resolveRuntimeConfig(input) {
-	if (input.manifest.status === "read-only") return {
-		message: input.manifest.problem.message,
-		status: "invalid"
-	};
-	const manifest = input.manifest.status === "ready" ? input.manifest.value : void 0;
-	const loaded = await loadTeamPreset({
-		cliReference: input.cliReference,
-		defaultReference: input.defaultPreset,
-		environment: input.environment,
-		manifestReference: manifest?.preset,
-		noCache: input.noCache,
-		offline: input.online !== true,
-		presets: input.registry.presets
-	});
-	if (loaded.status === "invalid") return loaded;
-	const repo = await readRepoPreset(input.environment);
-	if (repo.status === "invalid") return {
-		message: `${repo.diagnostics[0]?.message ?? `Repository preset ${repo.path} cannot be read.`} Fix or remove the file to continue.`,
-		status: "invalid"
-	};
-	const repoTrusted = repo.status === "ready" && repo.hash !== void 0 && (repo.hash === input.acceptedRepoPresetHash || isRepoPresetTrusted(manifest, repo, repo.hash));
-	const resolved = resolveEffectiveConfig({
-		checks: input.registry.checks,
-		cli: input.cliLayer,
-		distro: input.defaults,
-		knownMcpServers: new Set(input.registry.mcpServers.map((server) => server.id)),
-		...manifest === void 0 ? {} : { manifest: {
-			...manifest.checks === void 0 ? {} : { checks: manifest.checks },
-			skills: manifest.skills.map(({ id, source }) => ({
-				id,
-				source
-			})),
-			snippets: manifest.snippets.map(({ id }) => id)
-		} },
-		...loaded.status === "ready" ? {
-			preset: loaded.preset,
-			selectedPreset: loaded.selected
-		} : {},
-		...repoTrusted ? { repo: repo.preset } : {}
-	});
-	if (resolved.status === "invalid") return {
-		message: resolved.problems.join("\n"),
-		status: "invalid"
-	};
-	const policyPreset = loaded.status === "ready" || resolved.config.allowedSkillSources !== void 0 || resolved.config.skillDirectories.length > 0 ? Object.freeze({
-		...loaded.status === "ready" ? loaded.preset : {},
-		...resolved.config.allowedSkillSources === void 0 ? {} : { allowedSkillSources: resolved.config.allowedSkillSources.value },
-		name: resolved.config.preset?.name ?? resolved.config.allowedSkillSources?.provenance.label ?? resolved.config.skillDirectories[0]?.provenance.label ?? "runtime policy",
-		schemaVersion: 1,
-		skillDirectories: resolved.config.skillDirectories.map(({ value }) => value)
-	}) : void 0;
-	return {
-		config: resolved.config,
-		notes: loaded.status === "ready" ? loaded.notes : [],
-		...policyPreset === void 0 ? {} : { preset: policyPreset },
-		presetOrigin: loaded.status === "ready" ? loaded.origin : policyPreset?.name ?? ".aura/preset.json",
-		...repo.status === "ready" && repo.hash !== void 0 ? { repoPreset: {
-			hash: repo.hash,
-			...repo.mainWorktreePath === void 0 ? {} : { mainWorktreePath: repo.mainWorktreePath },
-			path: repo.path,
-			status: repoTrusted ? "applied" : "held"
-		} } : {},
-		status: "ready"
-	};
-}
-//#endregion
 //#region src/check-config.ts
 /** Resolves the effective configuration for one `check` run. */
 function resolveCheckConfiguration(options) {
@@ -12917,7 +13274,7 @@ var CheckCommand = class extends Command {
 		try {
 			const startedAt = environment.now();
 			let scan = await scanner.run();
-			let projected = applyRequiredMcpServers(scan.model, configured.config);
+			let projected = projectConfiguredModel(scan.model, configured);
 			let model = projected.model;
 			let run = runChecks(activeChecks, model, configured.config);
 			let fixRunDiagnostics = [];
@@ -12945,7 +13302,7 @@ var CheckCommand = class extends Command {
 				fixes = outcome.fixes;
 				if (outcome.applied) {
 					scan = await scanner.run();
-					projected = applyRequiredMcpServers(scan.model, configured.config);
+					projected = projectConfiguredModel(scan.model, configured);
 					model = projected.model;
 					run = runChecks(activeChecks, model, configured.config);
 				}
@@ -13029,7 +13386,7 @@ function renderRootHelp(branding) {
 			rows: [NO_COLOR_ROW],
 			title: "Advanced"
 		}
-	], branding.docsUrl === void 0 ? [] : [`Docs: ${branding.docsUrl}`]);
+	], branding.docsUrl === void 0 ? [] : [`Docs: ${branding.docsUrl}`], ROOT_INTRO);
 }
 function renderCheckHelp(branding) {
 	const bin = branding.command;
@@ -13216,6 +13573,17 @@ const NO_COLOR_ROW = {
 	term: "--no-color",
 	text: "Disable terminal colors"
 };
+/**
+* The root screen's one paragraph: what Aura is for, in the words of someone who has not read the
+* docs yet. It sits above "Get started" because a first-time reader needs the problem before the
+* command. Hand-wrapped at 80 columns — the renderer aligns columns, it never reflows prose — and
+* carried only by the root screen, since every other screen is reached by someone who already knows.
+*/
+const ROOT_INTRO = [
+	"Every AI coding agent keeps its own rules and its own tool settings, in its own",
+	"files. Aura reads all of them, tells you where they disagree or are broken, and",
+	"fixes them after you say yes - so every agent works from the same instructions."
+];
 /** Test and CI plumbing, present on every command and interesting to almost nobody. */
 function advancedRows() {
 	return [
@@ -13263,9 +13631,10 @@ function headline(branding) {
 	return branding.description === void 0 ? name : `${name} — ${branding.description}`;
 }
 /** Terms align to one shared column so the eye scans a single list, not per-section islands. */
-function renderHelpScreen(header, sections, footers) {
+function renderHelpScreen(header, sections, footers, intro = []) {
 	const width = Math.max(...sections.flatMap((section) => section.rows.map((row) => row.term.length)));
 	const lines = [header];
+	if (intro.length > 0) lines.push("", ...intro.map((line) => `  ${line}`));
 	for (const section of sections) {
 		lines.push("", `  ${section.title}`);
 		for (const row of section.rows) lines.push(`    ${row.term.padEnd(width)}    ${row.text}`);
@@ -14160,6 +14529,131 @@ function formatThresholds(thresholds) {
 	return pairs.length === 0 ? "no thresholds" : pairs.join(", ");
 }
 //#endregion
+//#region src/setup/repo-trust-preview.ts
+/** Printed instead of the row block when the preset carries nothing worth reviewing. */
+const NO_SETTINGS = "No check, MCP, skill, or snippet settings.";
+/**
+* Security-relevant capabilities shown before repository-controlled settings are accepted.
+*
+* One row per thing, never one row per field: a snippet the preset both provides and selects is
+* one snippet, and naming it twice made the screen long enough to skim past. Everything
+* executable-adjacent is spelled out verbatim (escaped) — the MCP command line or endpoint is
+* exactly what a later selection would configure, and trust time is the one moment the user is
+* looking. Snippet bodies are deliberately not echoed — pasting untrusted Markdown into a consent
+* prompt is its own injection surface — the picker's preview is where they are read, and the
+* prompt itself carries the explicit-selection boundary.
+*/
+function repoPresetTrustPreview(preset, contentSet) {
+	const rows = [
+		...mcpRows(preset, contentSet),
+		...skillRows(preset, contentSet),
+		...snippetRows(preset, contentSet),
+		...(preset.skillDirectories ?? []).map(directoryRow),
+		...listRow("sources", preset.allowedSkillSources),
+		...checksRow(preset.checks)
+	];
+	return [
+		"",
+		...rows.length === 0 ? [`  ${NO_SETTINGS}`] : alignRows(rows),
+		""
+	].join("\n");
+}
+/** Whether the prompt should promise that admitted content still needs a deliberate tick. */
+function hasRepoContent(contentSet) {
+	return contentSet !== void 0 && contentSet.mcpServers.length + contentSet.skills.length + contentSet.snippets.length > 0;
+}
+function alignRows(rows) {
+	const width = Math.max(...rows.map((row) => row.term.length));
+	return rows.map((row) => `  ${row.term.padEnd(width)}  ${row.detail}`);
+}
+/**
+* Every MCP server the repository would configure, provided ones with their full command line.
+*
+* A required id the repository does not define itself resolves from the catalog, so it gets a row
+* saying that rather than an executable surface this file cannot promise.
+*/
+function mcpRows(preset, contentSet) {
+	const provided = contentSet?.mcpServers ?? [];
+	const providedIds = new Set(provided.map((server) => server.id));
+	const required = new Set(preset.requiredMcpServers ?? []);
+	return [...provided.map((server) => ({
+		detail: `${mcpServerPreview(server)}${required.has(server.id) ? " · required" : ""}`,
+		term: "mcp"
+	})), ...[...required].filter((id) => !providedIds.has(id)).map((id) => ({
+		detail: `${safe(id)} · required, from the catalog`,
+		term: "mcp"
+	}))];
+}
+/** Skill trees the repository ships, then selections that point somewhere else. */
+function skillRows(preset, contentSet) {
+	const provided = contentSet?.skills ?? [];
+	const providedKeys = new Set(provided.map((skill) => `${skill.source.id}/${skill.id}`));
+	return [...provided.map((skill) => ({
+		detail: `${safe(skill.id)} (${count(skill.files.length, "file")})`,
+		term: "skill"
+	})), ...(preset.skills ?? []).map((selection) => `${selection.source}/${selection.id}`).filter((key) => !providedKeys.has(key)).map((key) => ({
+		detail: `${safe(key)} · selected`,
+		term: "skill"
+	}))];
+}
+/** Snippets the repository ships, then selections from the catalog. */
+function snippetRows(preset, contentSet) {
+	const provided = contentSet?.snippets ?? [];
+	const providedIds = new Set(provided.map((snippet) => snippet.id));
+	return [...provided.map((snippet) => ({
+		detail: `${safe(snippet.id)} (${String(Buffer$1.byteLength(snippet.body, "utf8"))} B)`,
+		term: "snippet"
+	})), ...(preset.snippets ?? []).filter((id) => !providedIds.has(id)).map((id) => ({
+		detail: `${safe(id)} · selected`,
+		term: "snippet"
+	}))];
+}
+/** The full executable surface of one provided MCP server, escaped but verbatim. */
+function mcpServerPreview(server) {
+	return `${safe(server.id)} "${safe(server.serverName)}" → ${transportPreview(server.transportTemplate)}`;
+}
+function transportPreview(transport) {
+	if (transport.type === "http") return `http ${safe(transport.url)}`;
+	const args = (transport.args ?? []).map((argument) => `"${safe(argument)}"`).join(", ");
+	const env = (transport.env ?? []).map(safe).join(", ");
+	return [
+		`stdio "${safe(transport.command)}"`,
+		...args === "" ? [] : [`args [${args}]`],
+		...env === "" ? [] : [`env ${env}`]
+	].join(", ");
+}
+/** The exact check settings the repository preset asks the user to trust. */
+function checksRow(checks) {
+	if (checks === void 0) return [];
+	const settings = [
+		...(checks.disabled ?? []).map((id) => `${safe(id)}: disabled`),
+		...(checks.enabled ?? []).map((id) => `${safe(id)}: enabled`),
+		...Object.entries(checks.severity ?? {}).map(([id, severity]) => `${safe(id)}: severity ${safe(severity)}`),
+		...Object.entries(checks.thresholds ?? {}).map(([id, thresholds]) => `${safe(id)}: thresholds ${safe(JSON.stringify(thresholds))}`)
+	].sort();
+	return [{
+		detail: settings.length === 0 ? "(none)" : settings.join("; "),
+		term: "checks"
+	}];
+}
+function directoryRow(source) {
+	const token = source.kind === "private-directory" ? ` · token ${safe(source.tokenEnv)}` : "";
+	return {
+		detail: `${safe(source.name)} → ${safe(source.url)}${token}`,
+		term: "directory"
+	};
+}
+function listRow(term, values) {
+	if (values === void 0) return [];
+	return [{
+		detail: values.length === 0 ? "(none)" : values.map(safe).join(", "),
+		term
+	}];
+}
+function count(total, noun) {
+	return `${String(total)} ${noun}${total === 1 ? "" : "s"}`;
+}
+//#endregion
 //#region src/setup/repo-trust.ts
 /**
 * Asks whether an untrusted repository preset may be applied, once per repo and contents.
@@ -14169,61 +14663,39 @@ function formatThresholds(thresholds) {
 * answer. A non-interactive run resolves without the layer, and the plan summary says so.
 */
 async function establishRepoPresetTrust(options) {
-	const repo = await readRepoPreset(options.environment);
+	const repo = options.repoPresetState ?? await readRepoPreset(options.environment);
 	if (repo.status !== "ready" || repo.hash === void 0) return { kind: "resolved" };
 	const manifest = options.manifest.status === "ready" ? options.manifest.value : void 0;
 	if (isRepoPresetTrusted(manifest, repo, repo.hash) || !options.interactive) return { kind: "resolved" };
 	const name = repo.preset?.name;
-	options.io.note(name === void 0 ? `This repository provides a preset at ${AURA_TEAM_PRESET_PATH}.` : `This repository provides the preset "${safe(name)}" at ${AURA_TEAM_PRESET_PATH}.`);
-	if (repo.preset !== void 0) options.io.note(repoPresetTrustPreview(repo.preset));
+	options.io.note(name === void 0 ? `Repository preset — ${AURA_TEAM_PRESET_PATH}` : `Repository preset "${safe(name)}" — ${AURA_TEAM_PRESET_PATH}`);
+	if (repo.preset !== void 0) options.io.note(repoPresetTrustPreview(repo.preset, repo.contentSet));
 	if (repo.mainWorktreePath !== void 0) options.io.note("This directory is a linked worktree, so trusting these contents also applies them in every other worktree of the same checkout.");
 	const changed = (manifest?.trustedRepoPresets ?? []).some((entry) => entry.path === repo.path);
-	const confirmation = await options.io.confirm(changed ? `The repository preset at ${AURA_TEAM_PRESET_PATH} changed since you trusted it. Trust the new contents?` : `Trust the repository preset at ${AURA_TEAM_PRESET_PATH}? Its settings apply to every Aura run in this repository until the file changes.`);
+	const confirmation = await options.io.confirm(trustPrompt(changed, repo.contentSet));
 	if (confirmation === "aborted") return { kind: "aborted" };
 	return confirmation === "accepted" ? {
 		acceptedHash: repo.hash,
 		kind: "resolved"
 	} : { kind: "resolved" };
 }
-/** Security-relevant capabilities shown before repository-controlled settings are accepted. */
-function repoPresetTrustPreview(preset) {
-	const settings = [
-		checksPreview(preset.checks),
-		listPreview("Required MCP servers", preset.requiredMcpServers),
-		listPreview("Allowed skill sources", preset.allowedSkillSources),
-		...(preset.skillDirectories ?? []).map(directoryPreview),
-		listPreview("Selected skills", preset.skills?.map((skill) => `${skill.source}/${skill.id}`)),
-		listPreview("Selected snippets", preset.snippets)
-	].filter((line) => line !== void 0);
-	return ["Review these repository-controlled settings before trusting:", ...settings.length === 0 ? ["No check, MCP, skill, or snippet settings."] : settings].join("\n");
-}
-/** The exact check settings the repository preset asks the user to trust. */
-function checksPreview(checks) {
-	if (checks === void 0) return;
-	const settings = [
-		...(checks.disabled ?? []).map((id) => `${safe(id)}: disabled`),
-		...(checks.enabled ?? []).map((id) => `${safe(id)}: enabled`),
-		...Object.entries(checks.severity ?? {}).map(([id, severity]) => `${safe(id)}: severity ${safe(severity)}`),
-		...Object.entries(checks.thresholds ?? {}).map(([id, thresholds]) => `${safe(id)}: thresholds ${safe(JSON.stringify(thresholds))}`)
-	].sort();
-	return `Checks: ${settings.length === 0 ? "(none)" : settings.join("; ")}`;
-}
-function directoryPreview(source) {
-	const token = source.kind === "private-directory" ? `; token ${safe(source.tokenEnv)}` : "";
-	return `Skill directory: ${safe(source.name)} — ${safe(source.url)}${token}`;
-}
-function listPreview(label, values) {
-	return values === void 0 ? void 0 : `${label}: ${listValues(values)}`;
-}
-function listValues(values) {
-	return values.length === 0 ? "(none)" : values.map(safe).join(", ");
+/**
+* The question itself, short because the note above it already named the file and its contents.
+*
+* The two-tier contract rides here rather than in the summary: a preset that only carries policy
+* installs nothing either way, so promising a later tick would be noise in the one line the user
+* is certain to read.
+*/
+function trustPrompt(changed, contentSet) {
+	if (changed) return "The preset changed since you trusted it. Trust the new contents?";
+	return hasRepoContent(contentSet) ? "Trust it? Nothing installs until you pick it; applies to every run here until the file changes." : "Trust it? Applies to every run here until the file changes.";
 }
 /**
 * Whether this run's prompt accepted exactly the contents the resolved layer applied.
 *
-* The two reads of the file — the prompt's and configuration resolution's — are independent, so a
-* write that lands between them leaves the layer held. Recording trust for a layer that did not
-* apply would claim consent for settings this run never used.
+* Boot passes one immutable snapshot through the prompt and configuration resolution. Comparing
+* hashes here keeps this helper correct for direct callers too: trust is recorded only for the
+* layer this run actually applied.
 */
 function acceptedRepoPreset(configured, acceptedHash) {
 	const repo = configured.repoPreset;
@@ -14236,9 +14708,11 @@ function setupRepoPresetContext(configured, acceptedHash, recorded) {
 	return Object.freeze({
 		accepted: acceptedRepoPreset(configured, acceptedHash),
 		checkSummary: repo.status === "applied" ? presetCheckSummary(configured.config, "repo") : Object.freeze([]),
+		...repo.contentSet === void 0 ? {} : { contentSet: repo.contentSet },
 		hash: repo.hash,
 		...repo.mainWorktreePath === void 0 ? {} : { mainWorktreePath: repo.mainWorktreePath },
 		path: repo.path,
+		...repo.preset === void 0 ? {} : { preset: repo.preset },
 		recorded,
 		status: repo.status
 	});
@@ -14856,11 +15330,15 @@ async function bootSetup(request, environment) {
 		message: manifest.problem.message,
 		status: "invalid"
 	};
+	const initialRepoPreset = await readRepoPreset(environment, void 0, { includeSkills: request.interactive });
+	const manifestValue = manifest.status === "ready" ? manifest.value : void 0;
+	const repoPresetState = !request.interactive && initialRepoPreset.status === "ready" && initialRepoPreset.hash !== void 0 && isRepoPresetTrusted(manifestValue, initialRepoPreset, initialRepoPreset.hash) ? await readRepoPreset(environment) : initialRepoPreset;
 	const trust = await establishRepoPresetTrust({
 		environment,
 		interactive: request.interactive,
 		io: request.io,
-		manifest
+		manifest,
+		repoPresetState
 	});
 	if (trust.kind === "aborted") return { status: "aborted" };
 	const scanCancellation = new AbortController();
@@ -14882,7 +15360,8 @@ async function bootSetup(request, environment) {
 		manifest,
 		noCache: request.noCache,
 		online: true,
-		registry: request.registry
+		registry: request.registry,
+		repoPresetState
 	});
 	if (configured.status === "invalid") {
 		scanCancellation.abort();
@@ -14890,7 +15369,7 @@ async function bootSetup(request, environment) {
 	}
 	const scan = await settleScan(request.io);
 	const trusted = await bootRepoPresetTrust(request, configured, trust.acceptedHash, scan);
-	const projected = applyRequiredMcpServers(trusted.scan.model, configured.config);
+	const projected = applyRequiredMcpServers(withRepoMcpCatalog(trusted.scan.model, configured.repoPreset), configured.config);
 	return {
 		activeChecks: enabledChecks(request.registry.checks, configured.config),
 		configured,
@@ -14907,8 +15386,8 @@ async function bootSetup(request, environment) {
 	};
 }
 /** Re-projects a rescan so the closing checklist reads the same virtual state the run planned. */
-function projectRescan(rescanned, config) {
-	const projection = applyRequiredMcpServers(rescanned.model, config);
+function projectRescan(rescanned, config, repoPreset) {
+	const projection = applyRequiredMcpServers(withRepoMcpCatalog(rescanned.model, repoPreset), config);
 	return {
 		...rescanned,
 		diagnostics: [...rescanned.diagnostics, ...projection.diagnostics],
@@ -15242,6 +15721,7 @@ function createMcpSetupCatalog(inputs) {
 			entries.push({
 				catalog,
 				key: `catalog:${catalog.id}`,
+				...isRepoCatalogId(catalog.id) ? { repo: true } : {},
 				required: requiredIds.has(catalog.id),
 				sourceName: owner?.name
 			});
@@ -15253,6 +15733,7 @@ function createMcpSetupCatalog(inputs) {
 				catalog,
 				existing: match.server,
 				key: `manifest:${String(match.index)}`,
+				...isRepoCatalogId(catalog.id) ? { repo: true } : {},
 				required: requiredIds.has(catalog.id),
 				sourceName: owner?.name
 			});
@@ -15265,6 +15746,7 @@ function createMcpSetupCatalog(inputs) {
 			...catalog === void 0 ? {} : { catalog },
 			existing: server,
 			key: `manifest:${String(index)}`,
+			...server.catalogId !== void 0 && isRepoCatalogId(server.catalogId) ? { repo: true } : {},
 			required: server.catalogId !== void 0 && requiredIds.has(server.catalogId),
 			sourceName: server.catalogId === void 0 ? void 0 : inputs.registry.ownerOf("mcp-server", server.catalogId)?.name
 		});
@@ -15277,12 +15759,24 @@ function createMcpSetupCatalog(inputs) {
 		requiredIds
 	});
 }
+/**
+* Required rows first (they carry blocker semantics whoever asked for them), then this
+* repository's own definitions, then configured rows, then everything else by name. Repo rows
+* lead the optional block — they are what a person running setup inside the repository came for —
+* without outranking a requirement they did not make.
+*/
 function compareEntries(left, right) {
 	if (left.required !== right.required) return left.required ? -1 : 1;
+	const leftRepo = left.repo === true;
+	if (leftRepo !== (right.repo === true)) return leftRepo ? -1 : 1;
 	const leftConfigured = left.existing !== void 0;
 	if (leftConfigured !== (right.existing !== void 0)) return leftConfigured ? -1 : 1;
 	return entryName(left).localeCompare(entryName(right));
 }
+/** The `repo/` namespace is reserved against plugins, so the prefix alone is provenance. */
+function isRepoCatalogId(id) {
+	return id.startsWith("repo/");
+}
 /** User-facing name used by the picker and deterministic sorting. */
 function mcpCatalogEntryName(entry) {
 	return entryName(entry);
@@ -15365,7 +15859,7 @@ const MAX_CONCURRENT_SOURCE_LISTINGS = 4;
 * of both. Only the draining is ordered, which is what keeps the picker's rows stable.
 */
 async function loadListing(request) {
-	const entries = [...bundledEntries(request.inputs)];
+	const entries = [...repoEntries(request.inputs), ...bundledEntries(request.inputs)];
 	const notes = [...request.notes];
 	const unavailableSources = request.unapproved.map((source) => ({
 		hint: `connection not approved; token ${source.tokenEnv}`,
@@ -15485,6 +15979,30 @@ function memoizedDriverListing(request, source) {
 	request.driverListings.set(source.id, listing);
 	return listing;
 }
+/** Repository skills the active allowlist admits; the source id is `repo:workspace`. */
+function allowedRepoSkills(inputs) {
+	return (inputs.repoSkills ?? []).filter((skill) => isSkillSourceAllowed(inputs.preset, skill.source.id));
+}
+/**
+* This repository's own skills, resolved from the trusted snapshot rather than any fetch.
+*
+* `remote` stays false — no fetch is needed — but the review stage still gates their first
+* install by identity: trees that arrive by cloning get the same on-screen reading a directory
+* skill does.
+*/
+function repoEntries(inputs) {
+	return allowedRepoSkills(inputs).map((skill) => ({
+		description: skill.description,
+		id: skill.id,
+		identity: skillIdentity(skill.source.id, skill.id),
+		name: skill.name,
+		preview: skill.files.find((file) => file.path === "SKILL.md")?.content,
+		remote: false,
+		sourceId: skill.source.id,
+		sourceName: skill.source.name,
+		version: skill.version
+	}));
+}
 function bundledEntries(inputs) {
 	return (inputs.model.availableSkills ?? []).filter((skill) => isSkillSourceAllowed(inputs.preset, skill.source.id)).map((skill) => ({
 		description: skill.description,
@@ -15525,6 +16043,7 @@ function remoteEntries(listings, source) {
 function createSkillCatalog(inputs) {
 	const collected = collectSkillDirectorySources(inputs.registryDirectories, inputs.preset);
 	const packs = /* @__PURE__ */ new Map();
+	for (const skill of allowedRepoSkills(inputs)) packs.set(skillIdentity(skill.source.id, skill.id), skill);
 	const failures = /* @__PURE__ */ new Map();
 	const pending = /* @__PURE__ */ new Map();
 	const driverListings = /* @__PURE__ */ new Map();
@@ -15601,7 +16120,8 @@ function createSetupCatalogs(inputs) {
 			presetOrigin: inputs.presetOrigin,
 			registryDirectories: inputs.registry.skillDirectories,
 			registryDrivers: inputs.registry.skillSources,
-			registryPresets: inputs.registry.presets
+			registryPresets: inputs.registry.presets,
+			repoSkills: inputs.repoSkills
 		})
 	};
 }
@@ -15632,15 +16152,17 @@ function requiringPreset(preset, config) {
 }
 //#endregion
 //#region src/setup/snippets.ts
+/** The picker group every repository-defined snippet renders under. */
+const REPO_SNIPPET_CATEGORY = "From this repository";
 /** Bounds simultaneous snippet handles independently of how many contributions a distro ships. */
 const MAX_CONCURRENT_SNIPPET_READS = 24;
-function createSnippetCatalog(snippets, manifest, presetIds = []) {
+function createSnippetCatalog(snippets, manifest, presetIds = [], repoSnippets = []) {
 	let resolved = [];
 	let pending;
 	return {
 		entries: () => resolved,
 		load: () => {
-			pending ??= resolveSnippetCatalog(snippets, manifest, presetIds).then((entries) => {
+			pending ??= resolveSnippetCatalog(snippets, manifest, presetIds, repoSnippets).then((entries) => {
 				resolved = entries;
 				return entries;
 			});
@@ -15649,13 +16171,23 @@ function createSnippetCatalog(snippets, manifest, presetIds = []) {
 	};
 }
 /** Resolves every registry source once and retains manifest-only selections as unavailable rows. */
-async function resolveSnippetCatalog(snippets, manifest, presetIds = []) {
-	const registered = new Set(snippets.map((snippet) => snippet.id));
+async function resolveSnippetCatalog(snippets, manifest, presetIds = [], repoSnippets = []) {
+	const repoEntries = repoSnippets.map((snippet) => Object.freeze({
+		category: REPO_SNIPPET_CATEGORY,
+		content: snippet.body,
+		description: snippet.description ?? "Defined by this repository.",
+		id: snippet.id,
+		name: snippet.name,
+		origin: "repo",
+		status: "available"
+	}));
+	const registered = /* @__PURE__ */ new Set([...snippets.map((snippet) => snippet.id), ...repoEntries.map((entry) => entry.id)]);
 	const limit = createLimiter(MAX_CONCURRENT_SNIPPET_READS);
 	const resolved = await Promise.all(snippets.map((snippet) => limit(() => resolveSnippet(snippet))));
 	const previous = manifest.status === "ready" ? manifest.value.snippets : [];
 	const previousIds = new Set(previous.map((entry) => entry.id));
 	return Object.freeze([
+		...repoEntries,
 		...resolved,
 		...previous.map((entry) => entry.id).filter((id) => !registered.has(id)).map((id) => Object.freeze({
 			category: "general",
@@ -16525,7 +17057,7 @@ async function configureEntry(context, entry, taken, io) {
 		return SETUP_BACK;
 	}
 	const defaultName = seed?.name ?? catalog?.serverName ?? "custom";
-	const defaultScope = seed?.scope ?? "global";
+	const defaultScope = seed?.scope ?? (entry.repo === true ? "project" : "global");
 	const apps = appChoices(context, catalog?.supportedApps, seed?.apps ?? []);
 	if (apps.eligible.length === 0 && (seed?.apps.length ?? 0) === 0) {
 		io.note("No detected, managed, compatible application can receive this MCP server.");
@@ -16802,15 +17334,24 @@ function requiredCatalogIds(entries) {
 	return [...new Set(entries.flatMap((entry) => entry.required && entry.catalog !== void 0 ? [entry.catalog.id] : []))];
 }
 function serverOption(entry) {
-	const configured = entry.selectedServer !== void 0 || entry.existing !== void 0;
-	const tags = [...entry.required ? ["from preset", "required"] : [], ...configured ? [entry.catalog === void 0 ? "custom" : "configured"] : []];
+	const tags = serverTags(entry);
 	const suffix = tags.length === 0 ? "" : ` (${tags.join(", ")})`;
 	return {
-		description: entry.sourceName === void 0 ? "Custom server" : `Plugin: ${entry.sourceName}`,
+		description: serverProvenance(entry),
 		label: `${safe(mcpCatalogEntryName(entry))}${suffix}`,
 		value: entry.key
 	};
 }
+/** What the run knows about a row: who selected it, whether it is required or configured. */
+function serverTags(entry) {
+	const configured = entry.selectedServer !== void 0 || entry.existing !== void 0;
+	const origin = entry.repo === true ? "from repo" : "from preset";
+	return [...entry.required ? [origin, "required"] : entry.repo === true ? [origin] : [], ...configured ? [entry.catalog === void 0 ? "custom" : "configured"] : []];
+}
+function serverProvenance(entry) {
+	if (entry.repo === true) return "Repository: .aura/preset.json";
+	return entry.sourceName === void 0 ? "Custom server" : `Plugin: ${entry.sourceName}`;
+}
 function hasManagedMcpApp(context) {
 	const managed = new Set(managedAppIdList(context));
 	return context.appCatalog.some((entry) => entry.kind === "detected" && entry.supportsMcp && managed.has(catalogEntryId(entry)));
@@ -16927,11 +17468,7 @@ function pickerOptions(inputs) {
 	const policy = inputs.catalog.policy;
 	const unsupported = !hasSkillsHome(inputs.managedApps);
 	const preset = new Set(inputs.presetSkills.map((skill) => skillIdentity(skill.source, skill.id)));
-	const entryRows = sortForDisplay(inputs.listing.entries, (entry) => [
-		entry.sourceName,
-		entry.name,
-		entry.id
-	]).map((entry) => ({
+	const entryRow = (entry) => ({
 		description: `${entry.description} · v${entry.version}`,
 		get disabled() {
 			return unsupported || inputs.listing.verification?.isMissing(entry.identity) === true;
@@ -16941,10 +17478,18 @@ function pickerOptions(inputs) {
 			return inputs.listing.verification?.isMissing(entry.identity) === true ? "source no longer publishes this skill" : void 0;
 		},
 		group: entry.sourceName,
-		label: `${entry.name}${preset.has(entry.identity) ? " (from preset)" : ""}`,
+		label: `${entry.name}${selectedBySuffix(entry.identity)}`,
 		...previewField(inputs, entry),
 		value: entry.identity
-	}));
+	});
+	const selectedBySuffix = (identity) => inputs.repoSelectedIdentities.has(identity) ? " (from repo)" : preset.has(identity) ? " (from preset)" : "";
+	const sortedEntries = sortForDisplay(inputs.listing.entries, (entry) => [
+		entry.sourceName,
+		entry.name,
+		entry.id
+	]);
+	const repoEntryRows = sortedEntries.filter((entry) => entry.sourceId.startsWith("repo:")).map(entryRow);
+	const entryRows = sortedEntries.filter((entry) => !entry.sourceId.startsWith("repo:")).map(entryRow);
 	const manifestRows = inputs.manifestSkills.flatMap((skill) => {
 		const identity = skillIdentity(skill.source, skill.id);
 		if (covered.has(identity)) return [];
@@ -16999,18 +17544,23 @@ function pickerOptions(inputs) {
 		value: `truncated:${source.id}`
 	}));
 	const represented = /* @__PURE__ */ new Set([...inputs.listing.entries.map((entry) => entry.identity), ...inputs.manifestSkills.map((skill) => skillIdentity(skill.source, skill.id))]);
-	const presetRows = inputs.presetSkills.filter((skill) => !represented.has(skillIdentity(skill.source, skill.id))).map((skill) => ({
-		description: "Selected by the active team preset, but unavailable in this run.",
-		disabled: true,
-		disabledNote: "preset selection unavailable",
-		group: skill.source,
-		label: `${skill.id} (from preset)`,
-		value: skillIdentity(skill.source, skill.id)
-	}));
+	const presetRows = inputs.presetSkills.filter((skill) => !represented.has(skillIdentity(skill.source, skill.id))).map((skill) => {
+		const identity = skillIdentity(skill.source, skill.id);
+		const fromRepo = inputs.repoSelectedIdentities.has(identity);
+		return {
+			description: fromRepo ? "Selected by the repository preset, but unavailable in this run." : "Selected by the active team preset, but unavailable in this run.",
+			disabled: true,
+			disabledNote: fromRepo ? "repo selection unavailable" : "preset selection unavailable",
+			group: skill.source,
+			label: `${skill.id} ${fromRepo ? "(from repo)" : "(from preset)"}`,
+			value: identity
+		};
+	});
 	return [
 		...sourceRows,
 		...truncatedRows,
 		...packRows,
+		...repoEntryRows,
 		...entryRows,
 		...manifestRows,
 		...presetRows
@@ -17093,6 +17643,16 @@ function skillStages(inputs) {
 function isRemoteIdentity(identity) {
 	return identity.startsWith("directory:") || identity.startsWith("driver:");
 }
+/**
+* A repository identity's install needs no fetch, but the review boundary all the same.
+*
+* The trees arrive by cloning, not by anything the user selected — "local files" is the bundled
+* exemption's mechanism, but distribution vouching was its justification, and a checkout has
+* neither.
+*/
+function isRepoIdentity(identity) {
+	return identity.startsWith("repo:");
+}
 /** The typed selection behind each offered identity: catalog entries plus manifest rows. */
 function selectionsByIdentity(inputs) {
 	const selections = /* @__PURE__ */ new Map();
@@ -17152,7 +17712,8 @@ function reviewStage(inputs) {
 	const offered = selectionsByIdentity(inputs);
 	const entries = new Map(inputs.listing.entries.map((entry) => [entry.identity, entry]));
 	const bundled = bundledByIdentity(inputs.availableSkills);
-	const reviewable = (identity) => needsReview(identity, recorded, bundled);
+	const repo = bundledByIdentity(inputs.repoSkills);
+	const reviewable = (identity) => needsReview(identity, recorded, bundled, repo);
 	return {
 		apply: (state, answers) => ({
 			...state,
@@ -17169,7 +17730,11 @@ function reviewStage(inputs) {
 			}), inputs.approvedPrivateSourceIds);
 			const resolutionWithBundled = {
 				problems: resolution.problems,
-				resolved: new Map([...resolution.resolved, ...bundled])
+				resolved: new Map([
+					...resolution.resolved,
+					...bundled,
+					...repo
+				])
 			};
 			const questions = state.selected.filter(reviewable).flatMap((identity) => reviewQuestion(identity, state.decisions, resolutionWithBundled, recorded, entries.get(identity), offered.get(identity)));
 			return questions.length === 0 ? void 0 : questions;
@@ -17179,8 +17744,13 @@ function reviewStage(inputs) {
 function bundledByIdentity(packs) {
 	return new Map(packs.map((pack) => [skillIdentity(pack.source.id, pack.id), pack]));
 }
-function needsReview(identity, recorded, bundled) {
+function needsReview(identity, recorded, bundled, repo) {
 	if (isRemoteIdentity(identity)) return true;
+	if (isRepoIdentity(identity)) {
+		const previous = recorded.get(identity);
+		const pack = repo.get(identity);
+		return previous === void 0 || pack !== void 0 && movedFrom(previous, pack);
+	}
 	const previous = recorded.get(identity);
 	const available = bundled.get(identity);
 	return previous !== void 0 && available !== void 0 && movedFrom(previous, available);
@@ -17206,11 +17776,19 @@ async function finalizeSkills(state, inputs, manifestSkills) {
 		const selection = offered.get(identity);
 		return selection === void 0 ? [] : [selection];
 	}), inputs.approvedPrivateSourceIds);
+	const repoPacks = new Map(inputs.repoSkills.map((pack) => [skillIdentity(pack.source.id, pack.id), pack]));
 	const selected = [];
 	const resolved = [];
 	for (const identity of state.selected) {
 		const selection = offered.get(identity);
 		if (selection === void 0) continue;
+		if (isRepoIdentity(identity)) {
+			finalizeRemote(identity, selection, state, repoPacks.get(identity), recorded.get(identity), {
+				resolved,
+				selected
+			});
+			continue;
+		}
 		if (!isRemoteIdentity(identity)) {
 			selected.push(selection);
 			continue;
@@ -17283,15 +17861,7 @@ async function gatherApprovedSkills(context, io, approval) {
 	const manifestSkills = recordedSkills(context);
 	emitNotes(context, io, listing, manifestSkills);
 	if (isEmptyCatalog(listing, manifestSkills)) return emptyCatalogOutcome$1(context);
-	const inputs = {
-		approvedPrivateSourceIds,
-		availableSkills: context.model.availableSkills ?? [],
-		catalog: context.skillCatalog,
-		listing,
-		managedApps: managedSkillApps(context),
-		manifestSkills,
-		presetSkills: context.preset?.skills ?? []
-	};
+	const inputs = stageInputs(context, approvedPrivateSourceIds, listing, manifestSkills);
 	const opening = openingSelection(context, inputs, manifestSkills);
 	noteHeldBack(inputs, io, opening.heldBack);
 	const result = await runFormChain(skillStages(inputs), opening.state, io, {
@@ -17316,6 +17886,21 @@ function noteHeldBack(inputs, io, heldBack) {
 function recordedSkills(context) {
 	return context.manifest.status === "ready" ? context.manifest.value.skills : [];
 }
+/** Everything the picker/review chain reads, with the repository selections folded in. */
+function stageInputs(context, approvedPrivateSourceIds, listing, manifestSkills) {
+	const repoSelections = context.repoPreset?.preset?.skills ?? [];
+	return {
+		approvedPrivateSourceIds,
+		availableSkills: context.model.availableSkills ?? [],
+		catalog: context.skillCatalog,
+		listing,
+		managedApps: managedSkillApps(context),
+		manifestSkills,
+		presetSkills: [...context.preset?.skills ?? [], ...repoSelections],
+		repoSelectedIdentities: new Set(repoSelections.map((skill) => skillIdentity(skill.source, skill.id))),
+		repoSkills: context.repoPreset?.contentSet?.skills ?? []
+	};
+}
 function emptyCatalogOutcome$1(context) {
 	return context.enteredBackward === true ? SETUP_BACK : {
 		selections: { ...context.selections },
@@ -17439,7 +18024,7 @@ const snippetsStep = {
 		const installed = installedSnippetIds(context);
 		if (context.revisited !== true) emitCatalogNotes(context, catalog, installed, io.note);
 		if (catalog.length === 0) return emptyCatalogOutcome(context, io);
-		const options = snippetOptions(catalog, installed, new Set(context.preset?.snippets ?? []));
+		const options = snippetOptions(catalog, installed, new Set(context.preset?.snippets ?? []), new Set(context.repoPreset?.preset?.snippets ?? []));
 		const selectable = new Set(options.filter((option) => option.disabled !== true).map((option) => option.value));
 		const question = {
 			id: "snippets",
@@ -17479,14 +18064,23 @@ const RECORD_NOTE = "Aura keeps the record; the text stays where it is.";
 * checkbox has anything to do — the row is there to report the record, not to be answered with.
 * Gathering those rows under one heading is what lets the numbers below start at 1 and count only
 * what a tick would change, and it empties out any category whose every snippet is installed.
+*
+* Repository rows lead the offered rows: they are this repository's own guidance, which is what a
+* person running setup inside it most likely came for. Plugin categories keep their sorted order
+* underneath.
 */
-function snippetOptions(catalog, installed, preset) {
+function snippetOptions(catalog, installed, preset, repoSelected) {
 	const sorted = sortForDisplay(catalog, (entry) => [
 		entry.category,
 		entry.name,
 		entry.id
 	]);
-	return [...recordBlock(sorted.filter((entry) => installed.has(entry.id))), ...sorted.filter((entry) => !installed.has(entry.id)).map((entry) => offeredOption(entry, preset))];
+	const offered = sorted.filter((entry) => !installed.has(entry.id));
+	return [
+		...recordBlock(sorted.filter((entry) => installed.has(entry.id))),
+		...offered.filter((entry) => entry.origin === "repo").map((entry) => offeredOption(entry, preset, repoSelected)),
+		...offered.filter((entry) => entry.origin !== "repo").map((entry) => offeredOption(entry, preset, repoSelected))
+	];
 }
 /**
 * The installed rows, with the shared note appended to the last of them.
@@ -17506,10 +18100,11 @@ function recordBlock(entries) {
 	}));
 }
 /** A row a tick would act on, or one disabled because no installed plugin publishes its text. */
-function offeredOption(entry, preset) {
+function offeredOption(entry, preset, repoSelected) {
+	const selectedBy = repoSelected.has(entry.id) ? " (from repo)" : preset.has(entry.id) ? " (from preset)" : "";
 	const base = {
 		group: entry.category,
-		label: `${entry.name}${preset.has(entry.id) ? " (from preset)" : ""}`,
+		label: `${entry.name}${selectedBy}`,
 		value: entry.id,
 		...entry.status === "available" ? { preview: entry.content } : {}
 	};
@@ -17535,19 +18130,20 @@ function snippetsPrompt(options) {
 	return options.every((option) => option.locked === true) ? "Every snippet the installed plugins provide is already in your instructions." : "Nothing here can be added: every snippet is either installed already or unavailable.";
 }
 /**
-* What the picker opens with: every installed id, plus this run's answer or the preset.
+* What the picker opens with: every installed id, plus this run's answer or team-preset defaults.
 *
 * Installed rows are locked, so they are seeded on every visit — there is no earlier answer that
 * could have dropped one. Their `✔` comes from the lock rather than from this seeding, so what it
-* settles is the answer the form reports back, not the checkbox the picker draws. The preset adds
-* only what it can actually contribute: a disabled row opening ticked is an answer `--yes` has no
-* way to take back.
+* settles is the answer the form reports back, not the checkbox the picker draws. Team-preset
+* defaults add only what their installed plugins can contribute. Repository rows deliberately
+* open unticked even when the repository preset selects them: their bodies are arbitrary agent
+* instructions, so a first install requires a person to select the previewable row explicitly.
 */
 function initialSelection(context, options, installed) {
-	const preset = new Set(context.preset?.snippets ?? []);
+	const selected = new Set(context.preset?.snippets ?? []);
 	const chosen = context.selections.snippets;
 	const kept = [...installed];
-	const added = chosen?.selected ?? options.filter((option) => option.disabled !== true && !installed.has(option.value) && preset.has(option.value)).map((option) => option.value);
+	const added = chosen?.selected ?? options.filter((option) => option.disabled !== true && !installed.has(option.value) && selected.has(option.value)).map((option) => option.value);
 	return [...kept, ...added];
 }
 function emptyCatalogOutcome(context, io) {
@@ -17642,36 +18238,9 @@ async function runSetup(request) {
 		stdout.write("\nLeft everything as it was.\n");
 		return finish(1, "aborted");
 	}
-	const { activeChecks, configured, effectiveModel, effectiveScan, projected, scan } = booted;
-	const model = scan.model;
+	const { activeChecks, configured, effectiveModel, effectiveScan } = booted;
 	const steps = request.steps ?? SETUP_STEPS;
-	const initialFindings = steps.some((step) => step.needsFindings === true) ? gatherFindings(activeChecks, effectiveModel, io, configured.config) : void 0;
-	const catalogs = createSetupCatalogs({
-		config: configured.config,
-		environment,
-		interactive: request.interactive,
-		model: effectiveModel,
-		noCache: request.noCache,
-		preset: configured.preset,
-		presetNotes: [...configured.notes, ...projected.diagnostics.map((diagnostic) => diagnostic.message)],
-		presetOrigin: configured.presetOrigin,
-		registry: request.registry
-	});
-	const preset = setupPresetContext(request, configured.config, configured.preset);
-	const repoPreset = booted.repoPreset;
-	const stepContext = {
-		appCatalog: buildAppCatalog(request.registry.adapters, model, scan.skipped),
-		...initialFindings === void 0 ? {} : { findings: initialFindings },
-		interactive: request.interactive,
-		isEnvironmentVariableSet: (name) => environment.readVariable(name) !== void 0,
-		manifest: model.manifest,
-		mcpCatalog: catalogs.mcpCatalog,
-		model: effectiveModel,
-		skillCatalog: catalogs.skillCatalog,
-		snippetCatalog: createSnippetCatalog(request.registry.snippets, model.manifest, preset?.snippets ?? []),
-		...preset === void 0 ? {} : { preset },
-		...repoPreset === void 0 ? {} : { repoPreset }
-	};
+	const stepContext = buildStepContext(request, booted, environment, steps.some((step) => step.needsFindings === true) ? gatherFindings(activeChecks, effectiveModel, io, configured.config) : void 0);
 	let start = {
 		index: 0,
 		offered: /* @__PURE__ */ new Set(),
@@ -17701,7 +18270,7 @@ async function runSetup(request) {
 		environment,
 		mcpCatalog: request.registry.mcpServers,
 		skills: request.registry.skills
-	}), configured.config), activeChecks, configured.config), "applied", {
+	}), configured.config, configured.repoPreset), activeChecks, configured.config), "applied", {
 		actions: setupActions(ready.gathered),
 		appliedOperationCount: result.appliedOperationCount
 	});
@@ -17710,6 +18279,46 @@ async function runSetup(request) {
 function plannedActions(gathered) {
 	return gathered === void 0 ? void 0 : setupActions(gathered);
 }
+/** Assembles the catalogs and the immutable context every wizard step reads. */
+function buildStepContext(request, booted, environment, initialFindings) {
+	const { configured, effectiveModel, repoPreset, scan } = booted;
+	const model = scan.model;
+	const catalogs = buildCatalogs(request, booted, environment);
+	const preset = setupPresetContext(request, configured.config, configured.preset);
+	return {
+		appCatalog: buildAppCatalog(request.registry.adapters, model, scan.skipped),
+		...initialFindings === void 0 ? {} : { findings: initialFindings },
+		interactive: request.interactive,
+		isEnvironmentVariableSet: (name) => environment.readVariable(name) !== void 0,
+		manifest: model.manifest,
+		mcpCatalog: catalogs.mcpCatalog,
+		model: effectiveModel,
+		skillCatalog: catalogs.skillCatalog,
+		snippetCatalog: buildSnippetCatalog(request, booted, preset),
+		...preset === void 0 ? {} : { preset },
+		...repoPreset === void 0 ? {} : { repoPreset }
+	};
+}
+function buildCatalogs(request, booted, environment) {
+	const { configured, effectiveModel, projected, repoPreset } = booted;
+	return createSetupCatalogs({
+		config: configured.config,
+		environment,
+		interactive: request.interactive,
+		model: effectiveModel,
+		noCache: request.noCache,
+		preset: configured.preset,
+		presetNotes: [...configured.notes, ...projected.diagnostics.map((diagnostic) => diagnostic.message)],
+		presetOrigin: configured.presetOrigin,
+		registry: request.registry,
+		repoSkills: repoPreset?.contentSet?.skills ?? []
+	});
+}
+/** The snippet catalog, with the trusted repository's bodies and default selections folded in. */
+function buildSnippetCatalog(request, booted, preset) {
+	const repoPreset = booted.repoPreset;
+	return createSnippetCatalog(request.registry.snippets, booted.scan.model.manifest, [...preset?.snippets ?? [], ...repoPreset?.preset?.snippets ?? []], repoPreset?.contentSet?.snippets ?? []);
+}
 function setupPresetContext(request, config, preset) {
 	const selected = config.preset;
 	if (selected === void 0 || preset === void 0) return;