@tryaura/aura-cli 0.3.0 → 0.3.2

package/dist/{run.boundary-DtkI7ZeG.js → run.boundary-fZhCH0bP.js}

@@ -1,5 +1,5 @@
-import { A as displayPath, C as isRecord$4, D as SHARED_INSTRUCTIONS_TEMPLATE, E as AuraManifestError, S as errorMessage$1, T as resolveAuraManifestPath, _ as assertAuraManifestWritable, a as planDesiredMcpConvergence, b as parseAuraManifest, c as rememberMcpConvergence, d as sharedSkillsRoot, g as hashContent, h as stripLegacyManagedBlock, k as pluralize, m as planSharedSkillTreeUpdate, n as appendInstructionFragments, p as managedContentRevisionStatus, r as forgetMcpPlans, t as planSharedInstructionLink, u as planSkillDeployment, v as createAuraManifestWriteOperation, w as AURA_MANIFEST_PATH, x as errorCode, y as createEmptyAuraManifest } from "./shared-link-plan-C57dSoid.js";
-import { COMMAND_NOT_FOUND_EXIT_CODE, DEFAULT_EXEC_TIMEOUT_MS, DEFAULT_HTTP_TIMEOUT_MS, MAX_EXEC_OUTPUT_CHARACTERS, MAX_EXEC_TIMEOUT_MS, MAX_HTTP_RESPONSE_BYTES, MAX_HTTP_TIMEOUT_MS, McpWriteError, NOT_EXECUTABLE_EXIT_CODE, OUTPUT_LIMIT_EXIT_CODE, SHARED_INSTRUCTIONS_TEMPLATE_TOKEN, TIMEOUT_EXIT_CODE, defineOwnProperty, detectExecutable, hasMcpRedaction, jsonPropertyPath, mcpEnvironmentVariableNames, mcpServerNameProblem, normalizeMcpServerDefinition, parseMcpServerDefinition, parseMcpServerManifest, parseSkillFrontmatter, parseSkillReferences, resolveMcpSecretNameCollisions, resolveSkillDirectory, splitSourceLines } from "@tryaura/aura-sdk";
+import { A as displayPath, C as isRecord$4, D as SHARED_INSTRUCTIONS_TEMPLATE, E as AuraManifestError, S as errorMessage$1, T as resolveAuraManifestPath, _ as assertAuraManifestWritable, a as planDesiredMcpConvergence, b as parseAuraManifest, c as rememberMcpConvergence, d as sharedSkillsRoot, g as hashContent, h as stripLegacyManagedBlock, k as pluralize, m as planSharedSkillTreeUpdate, n as appendInstructionFragments, p as managedContentRevisionStatus, r as forgetMcpPlans, t as planSharedInstructionLink, u as planSkillDeployment, v as createAuraManifestWriteOperation, w as AURA_MANIFEST_PATH, x as errorCode, y as createEmptyAuraManifest } from "./shared-link-plan-DMijyUdG.js";
+import { COMMAND_NOT_FOUND_EXIT_CODE, DEFAULT_EXEC_TIMEOUT_MS, DEFAULT_HTTP_TIMEOUT_MS, MAX_EXEC_OUTPUT_CHARACTERS, MAX_EXEC_TIMEOUT_MS, MAX_HTTP_RESPONSE_BYTES, MAX_HTTP_TIMEOUT_MS, McpWriteError, NOT_EXECUTABLE_EXIT_CODE, OUTPUT_LIMIT_EXIT_CODE, SHARED_INSTRUCTIONS_TEMPLATE_TOKEN, TIMEOUT_EXIT_CODE, defineOwnProperty, detectExecutable, hasMcpRedaction, jsonPropertyPath, mcpEnvironmentVariableNames, mcpServerNameProblem, normalizeMcpServerDefinition, parseMcpServerDefinition, parseMcpServerManifest, parseMcpServerManifestValue, parseSkillFrontmatter, parseSkillReferences, resolveMcpSecretNameCollisions, resolveSkillDirectory, splitSourceLines } from "@tryaura/aura-sdk";
 import { basename, delimiter, dirname, isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
 import { Buffer as Buffer$1, isUtf8 } from "node:buffer";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
@@ -10,7 +10,7 @@ import { access, chmod, link, lstat, mkdir, open, opendir, readFile, readdir, re
 import { applyPatch, createTwoFilesPatch, structuredPatch } from "diff";
 import { coerce, parse, satisfies, valid, validRange } from "semver";
 import { isDeepStrictEqual } from "node:util";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { EnvHttpProxyAgent, fetch as fetch$1 } from "undici";
 import { gunzipSync } from "node:zlib";
 import process$1 from "node:process";
@@ -931,25 +931,21 @@ function backupRoot(homeDir) {
 /**
 * Determines where a plan may write.
 *
-* The workspace is always one root. The rest are derived from what the detected adapters declared
-* as global-scope configuration, so the writable surface of the home directory is exactly the
+* Roots are derived only from Aura's shared home directory and what detected adapters declared as
+* global-scope configuration, so the writable surface of the home directory is exactly the
 * applications Aura found rather than a hardcoded guess. A declared file contributes its own
 * directory — `~/.claude/CLAUDE.md` yields `~/.claude`, not `~` — which keeps an adapter that reads
 * something under a shared directory such as `~/.config/<app>` from opening `~/.config` wholesale.
 */
-function resolveAllowedRoots(model, managedHomeRoots) {
+function resolveAllowedRoots(model) {
 	const homeDir = resolve(model.homeDir);
 	const roots = /* @__PURE__ */ new Map();
-	add(roots, {
-		exact: false,
-		path: resolve(model.projectRoot ?? model.cwd)
-	});
 	const sharedDirectory = dirname(resolve(model.sharedInstructions.path));
 	if (isStrictDescendant(homeDir, sharedDirectory)) add(roots, {
 		exact: false,
 		path: sharedDirectory
 	});
-	for (const root of managedHomeRoots === void 0 ? deriveManagedHomeRoots(model, homeDir) : validateManagedHomeRoots(managedHomeRoots, homeDir)) add(roots, root);
+	for (const root of deriveManagedHomeRoots(model, homeDir)) add(roots, root);
 	return Object.freeze([...roots.values()]);
 }
 /**
@@ -1002,17 +998,6 @@ function rootsForSpec(spec, homeDir) {
 		path
 	}];
 }
-function validateManagedHomeRoots(managedHomeRoots, homeDir) {
-	return managedHomeRoots.map((candidate) => {
-		if (!isAbsolute(candidate)) throw new FixPlanError("invalid-options", `managedHomeRoots must contain absolute paths: ${candidate}`, { path: candidate });
-		const path = resolve(candidate);
-		if (!isStrictDescendant(homeDir, path)) throw new FixPlanError("invalid-options", `managedHomeRoots must sit strictly inside ${homeDir}: ${candidate}`, { path: candidate });
-		return {
-			exact: false,
-			path
-		};
-	});
-}
 function add(roots, root) {
 	const existing = roots.get(root.path);
 	if (existing === void 0 || existing.exact && !root.exact) roots.set(root.path, root);
@@ -1109,12 +1094,12 @@ async function mapWithConcurrency(items, limit, run) {
 //#endregion
 //#region ../core/src/fix-plan/path-policy.ts
 /** Resolves the roots and filesystem traits a plan is validated against. */
-async function createPathPolicy(model, managedHomeRoots) {
+async function createPathPolicy(model) {
 	const sensitivity = await detectCaseSensitivity(resolve(model.projectRoot ?? model.cwd));
 	return {
 		caseInsensitive: sensitivity !== "sensitive",
 		reservedRoots: Object.freeze([backupRoot(model.homeDir)]),
-		roots: resolveAllowedRoots(model, managedHomeRoots),
+		roots: resolveAllowedRoots(model),
 		rootsCaseInsensitive: sensitivity === "insensitive"
 	};
 }
@@ -2878,7 +2863,7 @@ function decodeUtf8(content) {
 //#endregion
 //#region ../core/src/fix-plan/prepare.ts
 async function prepareOperations(options) {
-	const policy = await createPathPolicy(options.model, options.managedHomeRoots);
+	const policy = await createPathPolicy(options.model);
 	const validated = await validatePlanPaths(options.plan, policy);
 	const budget = { remaining: MAX_RETAINED_PLAN_BYTES };
 	const operations = [];
@@ -3397,7 +3382,7 @@ async function undoFixPlan(options) {
 		if (options.backupId !== void 0) throw new FixPlanError("backup-error", `no undo journal entry named ${options.backupId}`);
 		return Object.freeze({ status: "nothing-to-undo" });
 	}
-	const policy = await createPathPolicy(options.model, options.managedHomeRoots);
+	const policy = await createPathPolicy(options.model);
 	return withJournalLock(root, options.now, async () => {
 		const selection = await select(root, options);
 		if (selection === void 0) return Object.freeze({ status: "nothing-to-undo" });
@@ -3748,50 +3733,32 @@ function portableSkillFilePathKey(path) {
 //#endregion
 //#region ../core/src/workspace/shared-links.ts
 const GLOBAL_PREFIX = "~/";
-const PROJECT_PREFIX = "./";
 const SHARED_INSTRUCTIONS_SEGMENTS = Object.freeze(["agents", "AGENTS.md"]);
 const SHARED_INSTRUCTIONS_HOME_REFERENCE = "~/agents/AGENTS.md";
-const PROJECT_SHARED_INSTRUCTIONS_FILE = "AGENTS.md";
 const SHARED_LINK_KINDS = /* @__PURE__ */ new Set([
 	"import-line",
 	"native-copy",
 	"symlink"
 ]);
-const GLOBAL_SLOT = Object.freeze({
-	name: "sharedLink",
-	scope: "global"
-});
-const PROJECT_SLOT = Object.freeze({
-	name: "projectSharedLink",
-	scope: "project"
-});
+/** The one adapter field a shared-link declaration can come from. */
+const SLOT_NAME = "sharedLink";
 /** Canonical shared-instruction path for one captured environment. */
 function sharedInstructionsPath(environment) {
 	return join(environment.homeDir, ...SHARED_INSTRUCTIONS_SEGMENTS);
 }
 /**
-* Canonical project shared-instruction path for one checkout.
-*
-* Exported because the setup wizard has to name the same file core links adapters to. Two packages
-* each spelling out `AGENTS.md` is how a link ends up pointing at a file setup never wrote.
-*/
-function projectSharedInstructionsPath(projectRoot, cwd) {
-	return join(projectRoot ?? cwd, PROJECT_SHARED_INSTRUCTIONS_FILE);
-}
-/**
-* Returns every declarative problem in a shared-link contribution to the given scope.
+* Returns every declarative problem in a shared-link contribution.
 *
-* The prefix is checked against the slot rather than merely being one of the two: a global
-* declaration naming `./something` is what let a home-scoped check demand a file inside whichever
-* repository the user was standing in, written with their home directory spelled out absolutely.
-* Which slot an adapter fills is the whole statement of where the file lives.
+* The `~/` prefix is required rather than merely accepted. A declaration naming `./something` is
+* what let a home-scoped check demand a file inside whichever repository the user was standing in,
+* written with their home directory spelled out absolutely; Aura links only the home entry now, so
+* the prefix is the whole statement of where the file lives.
 */
-function sharedLinkViolations(link, scope) {
+function sharedLinkViolations(link) {
 	const violations = [];
 	if (!SHARED_LINK_KINDS.has(link.kind)) violations.push(`kind "${String(link.kind)}" is not supported`);
-	const prefix = entryPrefix(scope);
-	const relative = typeof link.entryPath === "string" && link.entryPath.startsWith(prefix) ? link.entryPath.slice(prefix.length) : void 0;
-	if (relative === void 0) violations.push(`entryPath must begin with "${prefix}" at ${scope} scope`);
+	const relative = typeof link.entryPath === "string" && link.entryPath.startsWith(GLOBAL_PREFIX) ? link.entryPath.slice(2) : void 0;
+	if (relative === void 0) violations.push(`entryPath must begin with "${GLOBAL_PREFIX}"`);
 	else if (relative.length === 0 || relative.includes("\\") || relative.includes("\0") || relative.split("/").some((segment) => segment.length === 0 || segment === "." || segment === "..")) violations.push("entryPath must be a normalized portable path without traversal");
 	if (link.kind === "symlink") {
 		if (link.lineTemplate !== void 0) violations.push("symlink declarations must not provide lineTemplate");
@@ -3802,51 +3769,36 @@ function sharedLinkViolations(link, scope) {
 }
 /** Resolves and verifies one adapter's shared-link declaration against its read-side files. */
 function resolveAdapterSharedLink(adapter, environment, files) {
-	return resolveSharedLink(adapter.sharedLink, GLOBAL_SLOT, environment, files, () => SHARED_INSTRUCTIONS_HOME_REFERENCE);
-}
-function resolveAdapterProjectSharedLink(adapter, environment, files, projectRoot) {
-	const target = projectSharedInstructionsPath(projectRoot, environment.cwd);
-	return resolveSharedLink(adapter.projectSharedLink, PROJECT_SLOT, environment, files, (entryPath) => portableRelativePath(entryPath, target));
+	return resolveSharedLink(adapter.sharedLink, environment, files);
 }
 /**
-* Resolves one declaration, naming the shared source the way its own scope can survive.
+* Resolves one declaration, naming the shared source the way a home entry can survive.
 *
-* A home entry names the source through `~`, which is the same string on every machine the user
-* owns. A project entry names it relative to itself, so the file it produces is one the whole team
-* can commit. Nothing here can write a machine-specific absolute path into a repository, because
-* the slot decides both halves at once.
+* The entry names the source through `~`, which is the same string on every machine the user owns.
 */
-function resolveSharedLink(declaration, slot, environment, files, targetReference) {
+function resolveSharedLink(declaration, environment, files) {
 	if (declaration === void 0) return;
-	const entryPath = resolveSharedEntry(declaration, slot, environment, files);
+	const entryPath = resolveSharedEntry(declaration, environment, files);
 	if (declaration.kind === "symlink") return {
 		entryPath,
 		kind: declaration.kind,
-		scope: slot.scope
+		scope: "global"
 	};
 	return {
-		content: declaration.lineTemplate?.replace(SHARED_INSTRUCTIONS_TEMPLATE_TOKEN, targetReference(entryPath)),
+		content: declaration.lineTemplate?.replace(SHARED_INSTRUCTIONS_TEMPLATE_TOKEN, SHARED_INSTRUCTIONS_HOME_REFERENCE),
 		entryPath,
 		kind: declaration.kind,
-		scope: slot.scope
+		scope: "global"
 	};
 }
-function resolveSharedEntry(declaration, slot, environment, files) {
-	const violations = sharedLinkViolations(declaration, slot.scope);
-	if (violations.length > 0) throw new Error(`declares an invalid ${slot.name}: ${violations.join("; ")}`);
-	const global = slot.scope === "global";
-	const relative = declaration.entryPath.slice(entryPrefix(slot.scope).length);
-	const entryPath = join(global ? environment.homeDir : environment.cwd, ...relative.split("/"));
-	if (![...files.values()].some((file) => resolve(file.spec.path) === resolve(entryPath) && file.spec.scope === slot.scope)) throw new Error(`declares ${slot.name} entry ${entryPath}, but its files() result did not declare that path at ${slot.scope} scope`);
+function resolveSharedEntry(declaration, environment, files) {
+	const violations = sharedLinkViolations(declaration);
+	if (violations.length > 0) throw new Error(`declares an invalid ${SLOT_NAME}: ${violations.join("; ")}`);
+	const relative = declaration.entryPath.slice(2);
+	const entryPath = join(environment.homeDir, ...relative.split("/"));
+	if (![...files.values()].some((file) => resolve(file.spec.path) === resolve(entryPath) && file.spec.scope === "global")) throw new Error(`declares ${SLOT_NAME} entry ${entryPath}, but its files() result did not declare that path at global scope`);
 	return entryPath;
 }
-function portableRelativePath(entryPath, targetPath) {
-	const path = relative(dirname(entryPath), targetPath).replaceAll("\\", "/");
-	return path.startsWith(".") ? path : `./${path}`;
-}
-function entryPrefix(scope) {
-	return scope === "global" ? GLOBAL_PREFIX : PROJECT_PREFIX;
-}
 function countToken(template) {
 	return template.split(SHARED_INSTRUCTIONS_TEMPLATE_TOKEN).length - 1;
 }
@@ -3866,6 +3818,41 @@ function toSharedInstructions(path, contents) {
 		problem
 	};
 }
+//#endregion
+//#region ../core/src/plugin-validation-links.ts
+/**
+* Validates an adapter's shared-instruction link declaration.
+*
+* Two rules, because the contract removed one field and constrained the other. A plugin built
+* against the previous contract still carries `projectSharedLink`; `apiVersion` already refuses
+* that plugin, and naming the property is what tells its author which one to delete.
+*/
+function collectSharedLinkDeclarationViolations(state, adapter, pluginLabel) {
+	if ("projectSharedLink" in adapter) state.violations.push(`${pluginLabel} adapter "${adapter.id}" declares removed projectSharedLink; Aura manages only global shared-instruction links. Remove this property.`);
+	if (adapter.sharedLink === void 0) return;
+	for (const violation of sharedLinkViolations(adapter.sharedLink)) state.violations.push(`${pluginLabel} adapter "${adapter.id}" declares invalid sharedLink: ${violation}.`);
+}
+//#endregion
+//#region ../core/src/plugin-validation-skills.ts
+/** Rejects skill destinations that are empty, duplicated, or outside the user's home directory. */
+function collectSkillDirectoryViolations(state, adapter, pluginLabel) {
+	const directories = adapter.capabilities?.skills?.directories;
+	if (directories === void 0) return;
+	if (directories.length === 0) {
+		state.violations.push(`${pluginLabel} adapter "${adapter.id}" declares Agent Skills support without a global skills directory.`);
+		return;
+	}
+	const ids = /* @__PURE__ */ new Set();
+	for (const directory of directories) {
+		if (ids.has(directory.id)) state.violations.push(`${pluginLabel} adapter "${adapter.id}" declares duplicate skills directory ID "${directory.id}".`);
+		ids.add(directory.id);
+		if (!isGlobalSkillPath(directory.entryPath)) state.violations.push(`${pluginLabel} adapter "${adapter.id}" declares invalid global skills directory ${directory.entryPath}.`);
+	}
+}
+function isGlobalSkillPath(entryPath) {
+	const relative = entryPath.startsWith("~/") ? entryPath.slice(2) : void 0;
+	return relative !== void 0 && relative.length > 0 && !relative.includes("\\") && !relative.includes("\0") && relative.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
+}
 /** Plugin ids become id namespaces, so `/` and anything shell- or path-surprising is refused. */
 const PLUGIN_ID_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
 function createRegistryState() {
@@ -3875,7 +3862,7 @@ function createRegistryState() {
 	};
 }
 function isSupportedPlugin(candidate) {
-	return candidate.apiVersion === 1;
+	return candidate.apiVersion === 2;
 }
 /** Validates each contribution's namespace and collects the ones that claimed their id. */
 function collectNamespaced(state, kind, contributions, plugin, collected) {
@@ -3903,6 +3890,7 @@ function collectUnknownBareCheckIdPlugins(state, bareCheckIdPlugins, candidates)
 function collectIdentityViolations(state, plugin) {
 	const violationCount = state.violations.length;
 	if (!PLUGIN_ID_PATTERN.test(plugin.id)) state.violations.push(`Plugin "${plugin.name}" declares ID "${plugin.id}", which cannot be used as an ID namespace; expected lowercase letters, digits, ".", "-", or "_", starting with a letter or digit.`);
+	if (plugin.id === "repo") state.violations.push(`Plugin "${plugin.name}" declares ID "repo", which is reserved.`);
 	if (plugin.name.trim().length === 0) state.violations.push(`Plugin "${plugin.id}" declares an empty name; reports identify plugins by name.`);
 	if (canonicalSemver(plugin.version) !== plugin.version) state.violations.push(`${formatPlugin(plugin)} declares version "${plugin.version}"; expected a semver version such as "1.0.0".`);
 	return state.violations.length === violationCount;
@@ -3912,15 +3900,8 @@ function collectAdapterViolations(state, adapters, plugin) {
 	for (const adapter of adapters ?? []) {
 		if (!PLUGIN_ID_PATTERN.test(adapter.id)) state.violations.push(`${formatPlugin(plugin)} contributes adapter ID "${adapter.id}", which is not a usable adapter ID; expected lowercase letters, digits, ".", "-", or "_", starting with a letter or digit.`);
 		collectSharedLinkCapabilityViolations(state, adapter, plugin);
-		for (const [name, scope, link] of [[
-			"sharedLink",
-			"global",
-			adapter.sharedLink
-		], [
-			"projectSharedLink",
-			"project",
-			adapter.projectSharedLink
-		]]) if (link !== void 0) for (const violation of sharedLinkViolations(link, scope)) state.violations.push(`${formatPlugin(plugin)} adapter "${adapter.id}" declares invalid ${name}: ${violation}.`);
+		collectSkillDirectoryViolations(state, adapter, formatPlugin(plugin));
+		collectSharedLinkDeclarationViolations(state, adapter, formatPlugin(plugin));
 	}
 }
 function collectSharedLinkCapabilityViolations(state, adapter, plugin) {
@@ -3953,8 +3934,8 @@ function claimId(state, kind, id, plugin) {
 	return true;
 }
 function formatApiVersionViolation(candidate) {
-	const remedy = candidate.apiVersion > 1 ? "Upgrade Aura, or install a plugin release built against" : "Upgrade the plugin to a release built against";
-	return `${formatPlugin(candidate)} uses unsupported apiVersion ${candidate.apiVersion}; this Aura build supports apiVersion 1. ${remedy} apiVersion 1.`;
+	const remedy = candidate.apiVersion > 2 ? "Upgrade Aura, or install a plugin release built against" : "Upgrade the plugin to a release built against";
+	return `${formatPlugin(candidate)} uses unsupported apiVersion ${candidate.apiVersion}; this Aura build supports apiVersion 2. ${remedy} apiVersion 2.`;
 }
 function formatViolations(violations) {
 	return [violations.length === 1 ? "Aura cannot build the plugin registry:" : `Aura cannot build the plugin registry (${violations.length} problems):`, ...violations.map((violation) => `  - ${violation}`)].join("\n");
@@ -5163,9 +5144,8 @@ function normalizeVersion(version) {
 /**
 * Splits desired servers into the ones Aura may write and the collisions a person has to settle.
 *
-* Scope is part of identity here. A server named `docs` in a project `.mcp.json` is not the `docs`
-* the manifest wants in user-level configuration, and treating them as one either blocks a write
-* that would not have collided or skips one that never happened.
+* Desired servers are global-only. A server named `docs` in a project `.mcp.json` remains a
+* read-only observation and cannot collide with the global entry Aura manages.
 */
 function classifyDesired(desired, ledgerNames, state) {
 	const ledger = new Set(ledgerNames);
@@ -5184,11 +5164,11 @@ function classifyDesired(desired, ledgerNames, state) {
 /** `owned` to write it, a blocker to refuse, `undefined` when the config already satisfies it. */
 function collisionBlocker(entry, ledger, state) {
 	if (ledger.has(entry.name)) return "owned";
-	const sameName = (candidate) => candidate.name === entry.name && candidate.scope === entry.scope;
+	const sameName = (candidate) => candidate.name === entry.name && candidate.scope === "global";
 	const unusable = state.unusable.find(sameName);
 	if (unusable !== void 0) return {
-		message: unusable.reason === "disabled" ? `MCP server ${entry.name} is already declared in this application's ${entry.scope} configuration but is turned off there. Remove or enable it, then run the fix again.` : `MCP server ${entry.name} is already declared in this application's ${entry.scope} configuration in a form Aura does not recognize, so Aura left it unchanged.`,
-		scope: entry.scope,
+		message: unusable.reason === "disabled" ? `MCP server ${entry.name} is already declared in this application's global configuration but is turned off there. Remove or enable it, then run the fix again.` : `MCP server ${entry.name} is already declared in this application's global configuration in a form Aura does not recognize, so Aura left it unchanged.`,
+		scope: "global",
 		sourceId: unusable.sourceId
 	};
 	const existing = state.servers.filter(sameName);
@@ -5197,7 +5177,7 @@ function collisionBlocker(entry, ledger, state) {
 	if ("message" in normalized) return normalized;
 	return existing.every((server) => isDeepStrictEqual(server.transport, normalized.transport)) ? void 0 : {
 		message: `MCP server ${entry.name} already exists outside Aura's ownership ledger and differs from the manifest.`,
-		scope: entry.scope
+		scope: "global"
 	};
 }
 /**
@@ -5212,7 +5192,7 @@ function normalizeDesired(entry) {
 	} catch (error) {
 		return {
 			message: error instanceof McpWriteError ? `MCP server ${entry.name} cannot be written as the manifest defines it: ${error.message}` : `MCP server ${entry.name} has a manifest definition Aura cannot represent.`,
-			scope: entry.scope
+			scope: "global"
 		};
 	}
 }
@@ -5226,28 +5206,25 @@ function createAppMcpConvergence(adapter, files, state) {
 		const targets = [...files.values()].filter((file) => file.spec.kind === "mcp");
 		const classified = classifyDesired(desired, ledgerNames, state);
 		if (classified.blockers.length > 0) return blocked(classified.blockers);
-		const scopes = ["global", "project"].map((scope) => planScope$1(adapter, writer, targets, classified.owned, ledgerNames, scope, state.secretSightings));
-		const blockers = scopes.flatMap((result) => result.blockers);
-		const operations = scopes.flatMap((result) => result.operations);
-		return blockers.length > 0 ? blocked(blockers) : {
+		const planned = planGlobalTarget(adapter, writer, targets, classified.owned, ledgerNames, state.secretSightings);
+		return planned.blockers.length > 0 ? blocked(planned.blockers) : {
 			blockers: [],
-			operations,
+			operations: planned.operations,
 			ownedNames: [...new Set(classified.owned.map((entry) => entry.name))].sort()
 		};
 	};
 }
-function planScope$1(adapter, writer, targets, desired, ledgerNames, scope, sightings) {
-	const scopedDesired = desired.filter((entry) => entry.scope === scope);
-	const scopedTargets = targets.filter((target) => target.spec.scope === scope);
-	if (scopedDesired.length > 0 && scopedTargets.length === 0) return blockedScope(`${adapter.displayName} has no ${scope}-scope MCP configuration target.`, scope);
-	if (scopedTargets.length > 1) return blockedScope(`${adapter.displayName} declares more than one ${scope}-scope MCP write target.`, scope);
-	const target = scopedTargets[0];
+function planGlobalTarget(adapter, writer, targets, desired, ledgerNames, sightings) {
+	const globalTargets = targets.filter((target) => target.spec.scope === "global");
+	if (desired.length > 0 && globalTargets.length === 0) return blockedScope(`${adapter.displayName} has no global MCP configuration target.`, "global");
+	if (globalTargets.length > 1) return blockedScope(`${adapter.displayName} declares more than one global MCP write target.`, "global");
+	const target = globalTargets[0];
 	return target === void 0 ? {
 		blockers: [],
 		operations: []
-	} : writeScopeTarget(adapter, writer, target, scopedDesired, ledgerNames, scope, sightings);
+	} : writeGlobalTarget(adapter, writer, target, desired, ledgerNames, sightings);
 }
-function writeScopeTarget(adapter, writer, target, desired, ledgerNames, scope, sightings) {
+function writeGlobalTarget(adapter, writer, target, desired, ledgerNames, sightings) {
 	if (!needsTargetWrite(target, desired, ledgerNames)) return {
 		blockers: [],
 		operations: []
@@ -5256,7 +5233,7 @@ function writeScopeTarget(adapter, writer, target, desired, ledgerNames, scope,
 	if (unwritable !== void 0) return {
 		blockers: [{
 			...unwritable,
-			scope,
+			scope: "global",
 			sourceId: target.spec.id
 		}],
 		operations: []
@@ -5266,7 +5243,7 @@ function writeScopeTarget(adapter, writer, target, desired, ledgerNames, scope,
 		blockers: [{
 			message: written.refusal,
 			path: target.spec.path,
-			scope,
+			scope: "global",
 			sourceId: target.spec.id
 		}],
 		operations: []
@@ -5275,14 +5252,14 @@ function writeScopeTarget(adapter, writer, target, desired, ledgerNames, scope,
 		blockers: [{
 			message: `${adapter.displayName}'s MCP configuration at ${target.spec.path} is larger than Aura will rewrite in one operation, so Aura left it unchanged.`,
 			path: target.spec.path,
-			scope,
+			scope: "global",
 			sourceId: target.spec.id
 		}],
 		operations: []
 	};
 	const operation = {
 		content: written.content,
-		mode: scope === "global" ? 384 : 420,
+		mode: 384,
 		path: target.spec.path,
 		precondition: targetPrecondition(target),
 		type: "write"
@@ -5525,11 +5502,9 @@ async function scanAdapter(adapter, context) {
 		return { diagnostics: [failure$2(adapter, "files", error)] };
 	}
 	diagnostics.push(...discovery.diagnostics);
-	let projectSharedLink;
 	let sharedLink;
 	try {
 		sharedLink = resolveAdapterSharedLink(adapter, context.environment, discovery.files);
-		projectSharedLink = resolveAdapterProjectSharedLink(adapter, context.environment, discovery.files, await context.projectRoot);
 	} catch (error) {
 		diagnostics.push(failure$2(adapter, "files", error));
 	}
@@ -5553,9 +5528,8 @@ async function scanAdapter(adapter, context) {
 		mcpServers,
 		metadata: snapshot.metadata,
 		skills: snapshot.skills,
-		skillDirectories: (adapter.capabilities?.skills?.directories ?? []).map((directory) => resolveSkillDirectory(directory, context.environment.homeDir, context.environment.cwd)),
+		skillDirectories: (adapter.capabilities?.skills?.directories ?? []).map((directory) => resolveSkillDirectory(directory, context.environment.homeDir)),
 		sourceFiles: [...discovery.files.values()].filter((file) => file.spec.kind !== "probe").map(toStatus),
-		...projectSharedLink === void 0 ? {} : { projectSharedLink },
 		...sharedLink === void 0 ? {} : { sharedLink },
 		support: evaluateSupport(adapter.supportedRange, detection.version),
 		...adapter.synthetic === void 0 ? {} : { synthetic: adapter.synthetic },
@@ -6315,12 +6289,13 @@ const MAX_SKILL_DRIVER_CALL_MS = 3e4;
 *
 * Bundled and already-installed trees are local state Aura itself wrote, so they walk unbounded.
 * A driver-materialized tree is whatever a plugin's driver put on disk — the reviewed origin is a
-* claim, not a guarantee — so it walks under {@link DRIVER_WALK_POLICY}, which caps file size,
-* file count, and total bytes, refuses paths that will not survive a portable filesystem, and
-* refuses two paths that would alias on a case-insensitive one.
+* claim, not a guarantee — so it walks under {@link DRIVER_WALK_POLICY}, which caps directory
+* count, file size, file count, and total bytes, refuses paths that will not survive a portable
+* filesystem, and refuses two paths that would alias on a case-insensitive one.
 */
 /** The bounds an untrusted, driver-supplied tree is read under. */
 const DRIVER_WALK_POLICY = Object.freeze({
+	maxDirectories: 200,
 	maxFileBytes: MAX_SKILL_FILE_BYTES,
 	maxFiles: 200,
 	maxTotalBytes: MAX_SKILL_RESPONSE_BYTES
@@ -6334,19 +6309,22 @@ function treeHash(files) {
 	return createHash("sha256").update(`${signature}\n`, "utf8").digest("hex");
 }
 /** Reads one skill directory, stopping at the first entry it cannot safely resolve. */
-async function walkTree(root, reader, policy) {
+async function walkTree(root, reader, policy, outerBoundary) {
 	const files = [];
 	const entries = [];
 	const state = {
+		bytesRead: 0,
+		directoryCount: 0,
 		portablePaths: /* @__PURE__ */ new Set(),
 		totalBytes: 0
 	};
 	const path = resolve(root);
 	const problem = await walkPath({
-		boundary: await reader.realPath(path) ?? path,
+		boundary: outerBoundary ?? await reader.realPath(path) ?? path,
 		path
 	}, path, reader, files, entries, state, policy);
 	return {
+		bytesRead: state.bytesRead,
 		entries: Object.freeze(entries),
 		files: Object.freeze(files.sort((left, right) => comparePortablePaths(left.path, right.path))),
 		...problem === void 0 ? {} : { problem }
@@ -6368,6 +6346,11 @@ async function walkPath(root, path, reader, files, entries, state, policy) {
 		message: `${relativePath || "."} could not be read (${contents.problem})`
 	};
 	if (contents.entries !== void 0) {
+		if (policy !== void 0 && state.directoryCount >= policy.maxDirectories) return {
+			kind: "too-large",
+			message: `${relativePath || "."} exceeds the skill directory limit`
+		};
+		state.directoryCount += 1;
 		entries.push({
 			kind: "directory",
 			path
@@ -6385,6 +6368,8 @@ function addFile(path, relativePath, contents, files, entries, state, policy) {
 		kind: "unsupported",
 		message: `${relativePath} is not a readable regular file`
 	};
+	const bytes = Buffer$1.byteLength(contents.content, "utf8");
+	state.bytesRead += bytes;
 	if (contents.utf8Valid === false) return {
 		kind: "unsupported",
 		message: `${relativePath} is not valid UTF-8`
@@ -6399,7 +6384,6 @@ function addFile(path, relativePath, contents, files, entries, state, policy) {
 			kind: "unsupported",
 			message: `${relativePath} aliases another skill file`
 		};
-		const bytes = Buffer$1.byteLength(contents.content, "utf8");
 		if (state.totalBytes + bytes > policy.maxTotalBytes) return {
 			kind: "too-large",
 			message: `${relativePath} exceeds the skill size limit`
@@ -6425,7 +6409,7 @@ function comparePortablePaths(left, right) {
 //#endregion
 //#region ../core/src/workspace/skills.ts
 const SKILLS_DIAGNOSTIC_ID = "core/skills";
-const SKILL_FILE$1 = "SKILL.md";
+const SKILL_FILE$2 = "SKILL.md";
 /** Canonical shared skill root for one captured environment. */
 function sharedSkillsPath(environment) {
 	return sharedSkillsRoot(environment.homeDir);
@@ -6448,8 +6432,8 @@ async function resolveBundledSkills(registrations, reader) {
 			path,
 			skill
 		};
-		if (!tree.files.some((file) => file.path === SKILL_FILE$1)) return {
-			message: `does not contain ${SKILL_FILE$1}`,
+		if (!tree.files.some((file) => file.path === SKILL_FILE$2)) return {
+			message: `does not contain ${SKILL_FILE$2}`,
 			path,
 			skill
 		};
@@ -6485,7 +6469,7 @@ async function resolveDriverSkillPack(skill, source, reader) {
 		return { kind: "invalid" };
 	}
 	const tree = await walkTree(path, reader, DRIVER_WALK_POLICY);
-	if (tree.problem !== void 0 || !tree.files.some((file) => file.path === SKILL_FILE$1)) return { kind: "invalid" };
+	if (tree.problem !== void 0 || !tree.files.some((file) => file.path === SKILL_FILE$2)) return { kind: "invalid" };
 	return {
 		kind: "resolved",
 		value: Object.freeze({
@@ -6529,8 +6513,8 @@ async function scanSharedSkills(environment, reader) {
 * reports `unreadable` and leaves the real cause to travel in `problemDetail`.
 */
 function sharedSkillDefinition(path, tree, homeDir) {
-	const skillFilePath = join(path, SKILL_FILE$1);
-	const file = tree.files.find((entry) => entry.path === SKILL_FILE$1);
+	const skillFilePath = join(path, SKILL_FILE$2);
+	const file = tree.files.find((entry) => entry.path === SKILL_FILE$2);
 	if (file === void 0) return {
 		definitionStatus: tree.problem === void 0 ? "missing-file" : "unreadable",
 		skillFilePath
@@ -7264,7 +7248,7 @@ function parseContents(body) {
 }
 //#endregion
 //#region ../core/src/skills/pack-schema.ts
-const SKILL_FILE = "SKILL.md";
+const SKILL_FILE$1 = "SKILL.md";
 /**
 * Parses a directory's `skills/<id>` body.
 *
@@ -7307,9 +7291,9 @@ function parseDirectorySkillPack(body, expectedId) {
 		kind: "invalid",
 		problem: files
 	};
-	if (!files.some((file) => file.path === SKILL_FILE)) return {
+	if (!files.some((file) => file.path === SKILL_FILE$1)) return {
 		kind: "invalid",
-		problem: `response does not contain a root ${SKILL_FILE}`
+		problem: `response does not contain a root ${SKILL_FILE$1}`
 	};
 	return {
 		files,
@@ -7483,7 +7467,7 @@ async function downloadFiles(environment, location, remoteFiles) {
 async function listAgenticSkills(environment, source, options = {}) {
 	const catalog = await loadAgenticCatalog(environment, source, options.noCache === true);
 	if (catalog.kind === "failure") return {
-		diagnostics: [diagnostic(`Skill source "${source.id}" ${catalog.reason}, so it is unavailable.`)],
+		diagnostics: [diagnostic$1(`Skill source "${source.id}" ${catalog.reason}, so it is unavailable.`)],
 		listings: [],
 		status: {
 			hint: "unreachable",
@@ -7492,7 +7476,7 @@ async function listAgenticSkills(environment, source, options = {}) {
 	};
 	return {
 		collections: catalog.collections,
-		diagnostics: [...cacheDiagnostics(source, catalog), ...catalog.problems.map((problem) => diagnostic(`Skill source "${source.id}" catalog ${problem}, so some of it is unavailable.`))],
+		diagnostics: [...cacheDiagnostics(source, catalog), ...catalog.problems.map((problem) => diagnostic$1(`Skill source "${source.id}" catalog ${problem}, so some of it is unavailable.`))],
 		listings: Object.freeze(catalog.entries.map(({ listing }) => Object.freeze({
 			...listing,
 			source
@@ -7506,7 +7490,7 @@ async function listAgenticSkills(environment, source, options = {}) {
 function cacheDiagnostics(source, catalog) {
 	if (catalog.cacheAgeMs === void 0) return [];
 	const age = describeCacheAge(catalog.cacheAgeMs);
-	return [diagnostic(catalog.staleAfterFailure === true ? `Skill source "${source.id}" could not be reached, so its listing is served from the local cache (${age}).` : `Skill source "${source.id}" listing served from the local cache (${age}); pass --no-cache to refetch it now.`)];
+	return [diagnostic$1(catalog.staleAfterFailure === true ? `Skill source "${source.id}" could not be reached, so its listing is served from the local cache (${age}).` : `Skill source "${source.id}" listing served from the local cache (${age}); pass --no-cache to refetch it now.`)];
 }
 /** Resolves AgenticSkills entries from their exact GitHub directories into reviewed Aura packs. */
 async function resolveAgenticSkills(environment, source, skillIds) {
@@ -7529,7 +7513,7 @@ async function resolveAgenticSkills(environment, source, skillIds) {
 function catalogEntries(catalog) {
 	return catalog.kind === "catalog" ? new Map(catalog.entries.map((entry) => [entry.listing.id, entry])) : /* @__PURE__ */ new Map();
 }
-function diagnostic(message) {
+function diagnostic$1(message) {
 	return {
 		adapterId: AGENTICSKILLS_DIAGNOSTIC_ID,
 		message,
@@ -7537,7 +7521,7 @@ function diagnostic(message) {
 	};
 }
 function skillDiagnostic(source, id, reason) {
-	return diagnostic(`Skill "${id}" from "${source.id}" ${reason}, so it is unavailable.`);
+	return diagnostic$1(`Skill "${id}" from "${source.id}" ${reason}, so it is unavailable.`);
 }
 function isDiagnostic(value) {
 	return "adapterId" in value;
@@ -7851,7 +7835,7 @@ const DIRECTORY_PREFIX = "directory:";
 /** Namespaced MCP catalog id, such as `official/github`. */
 const MCP_CATALOG_ID_PATTERN = /^[a-z0-9][a-z0-9._-]*\/[a-zA-Z0-9][a-zA-Z0-9._-]*$/u;
 const SKILL_ID_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
-const SKILL_SOURCE_ID_PATTERN = /^(?:directory|driver|plugin):[^\s:]+$/u;
+const SKILL_SOURCE_ID_PATTERN = /^(?:directory|driver|plugin|repo):[^\s:]+$/u;
 /**
 * Picks the first collected problem out of a batch of independently validated fields.
 *
@@ -7984,6 +7968,52 @@ function collectJsonValue(value, path, depth) {
 	return collectJsonObject(value, path, depth);
 }
 //#endregion
+//#region ../core/src/preset/repo-content-limits.ts
+/**
+* The largest combined byte size of a repository's content set.
+*
+* The snapshot lives in memory for the whole run so planners apply consented bytes rather than a
+* re-read; a repository must not be able to balloon that residency.
+*/
+const MAX_REPO_CONTENT_TOTAL_BYTES = 16e6;
+//#endregion
+//#region ../core/src/preset/schema-provides.ts
+const REPO_MCP_ID_PATTERN = /^repo\/[a-zA-Z0-9][a-zA-Z0-9._-]*$/u;
+/**
+* Collects the `provides` envelope of a repository preset.
+*
+* Content a preset authors reaches command lines and app configuration, so it may only arrive
+* from the file the user hash-trusted for this repository. Callers validating a downloaded or
+* bundled preset reject the field wholesale before this collector runs.
+*/
+function collectProvides(value) {
+	if (value === void 0) return;
+	if (!isRecord$4(value)) return "$.provides: must be an object";
+	const servers = collectProvidedMcpServers(value["mcpServers"]);
+	if (typeof servers === "string") return servers;
+	return servers === void 0 ? Object.freeze({}) : Object.freeze({ mcpServers: servers });
+}
+function collectProvidedMcpServers(value) {
+	if (value === void 0) return;
+	if (!Array.isArray(value)) return "$.provides.mcpServers: must be an array of MCP server definitions";
+	if (value.length > 16) return `$.provides.mcpServers: must contain at most ${String(16)} definitions`;
+	const result = [];
+	const ids = /* @__PURE__ */ new Set();
+	const serverNames = /* @__PURE__ */ new Set();
+	for (const [index, candidate] of value.entries()) {
+		const path = `$.provides.mcpServers[${String(index)}]`;
+		const parsed = parseMcpServerManifestValue(candidate);
+		if ("error" in parsed) return `${path}${parsed.error.path.slice(1)}: ${parsed.error.message}`;
+		if (!REPO_MCP_ID_PATTERN.test(parsed.value.id)) return `${path}.id: must be namespaced "repo/<name>"`;
+		if (ids.has(parsed.value.id)) return `${path}.id: must not duplicate another provided server id`;
+		if (serverNames.has(parsed.value.serverName)) return `${path}.serverName: must not duplicate another provided server name`;
+		ids.add(parsed.value.id);
+		serverNames.add(parsed.value.serverName);
+		result.push(parsed.value);
+	}
+	return Object.freeze(result);
+}
+//#endregion
 //#region ../core/src/preset/schema-sources.ts
 function collectSkills(value) {
 	if (value === void 0) return;
@@ -7997,7 +8027,7 @@ function collectSkills(value) {
 		const id = candidate["id"];
 		const source = candidate["source"];
 		if (typeof id !== "string" || !SKILL_ID_PATTERN.test(id)) return `${path}.id: must be a kebab-case skill id`;
-		if (typeof source !== "string" || !SKILL_SOURCE_ID_PATTERN.test(source)) return `${path}.source: must be a plugin:, directory:, or driver: source id`;
+		if (typeof source !== "string" || !SKILL_SOURCE_ID_PATTERN.test(source)) return `${path}.source: must be a plugin:, directory:, driver:, or repo: source id`;
 		const identity = `${source}/${id}`;
 		if (seen.has(identity)) return `${path}: must not duplicate another skill selection`;
 		seen.add(identity);
@@ -8071,31 +8101,32 @@ function toDirectoryId(id) {
 function toSourceId(id) {
 	if (id.startsWith("directory:")) return toDirectoryId(id);
 	if (id.startsWith("driver:")) return `driver:${id.slice(7)}`;
+	if (id.startsWith("repo:")) return `repo:${id.slice(5)}`;
 	return `plugin:${id.slice(id.indexOf(":") + 1)}`;
 }
 //#endregion
 //#region ../core/src/preset/schema.ts
 /** Validates and freezes one parsed JSON document as a data-only team preset. */
-function validateTeamPreset(value) {
+function validateTeamPreset(value, options = {}) {
 	if (!isRecord$4(value)) return invalid$2("$: must be an object");
-	const depthProblem = documentDepthProblem(value, "$", 0);
-	if (depthProblem !== void 0) return invalid$2(depthProblem);
-	if (value["schemaVersion"] !== 1) return invalid$2("$.schemaVersion: must be 1");
+	const problemBeforeFields = envelopeProblem(value, options);
+	if (problemBeforeFields !== void 0) return invalid$2(problemBeforeFields);
 	const name = value["name"];
-	if (name !== void 0 && (typeof name !== "string" || name.trim().length === 0 || name.length > 128)) return invalid$2("$.name: must be a non-empty string of at most 128 characters");
 	const checks = collectChecks(value["checks"]);
 	const allowed = collectAllowedSources(value["allowedSkillSources"]);
 	const directories = collectDirectories(value["skillDirectories"]);
 	const requiredMcpServers = collectIds(value["requiredMcpServers"], "$.requiredMcpServers", MCP_CATALOG_ID_PATTERN);
 	const snippets = collectIds(value["snippets"], "$.snippets", CONTENT_ID_PATTERN);
 	const skills = collectSkills(value["skills"]);
+	const provides = collectProvides(value["provides"]);
 	const problem = firstProblem([
 		checks,
 		allowed,
 		directories,
 		requiredMcpServers,
 		snippets,
-		skills
+		skills,
+		provides
 	]);
 	if (problem !== void 0) return invalid$2(problem);
 	return {
@@ -8103,6 +8134,7 @@ function validateTeamPreset(value) {
 		preset: Object.freeze({
 			...Array.isArray(allowed) ? { allowedSkillSources: allowed } : {},
 			...isChecks(checks) ? { checks } : {},
+			...typeof provides === "object" ? { provides } : {},
 			...Array.isArray(requiredMcpServers) ? { requiredMcpServers } : {},
 			...typeof name === "string" ? { name } : {},
 			schemaVersion: 1,
@@ -8118,6 +8150,15 @@ function invalid$2(problem) {
 		problem
 	};
 }
+/** Checks the document envelope — depth, version, origin gate, name — before any field walks. */
+function envelopeProblem(value, options) {
+	const depthProblem = documentDepthProblem(value, "$", 0);
+	if (depthProblem !== void 0) return depthProblem;
+	if (value["schemaVersion"] !== 1) return "$.schemaVersion: must be 1";
+	if (options.allowProvides !== true && value["provides"] !== void 0) return "$.provides: only the repository preset may provide content";
+	const name = value["name"];
+	if (name !== void 0 && (typeof name !== "string" || name.trim().length === 0 || name.length > 128)) return "$.name: must be a non-empty string of at most 128 characters";
+}
 /**
 * Rejects a document nested past the limit before any field is read.
 *
@@ -8967,7 +9008,7 @@ async function readTeamPreset(cwd, reader) {
 	} catch {
 		return failure(path, "is not valid JSON");
 	}
-	const result = validateTeamPreset(parsed);
+	const result = validateTeamPreset(parsed, { allowProvides: true });
 	if (result.kind === "invalid") return failure(path, `is not a valid team preset (${result.problem})`);
 	return {
 		content: contents.content,
@@ -8989,18 +9030,275 @@ function failure(path, reason) {
 	};
 }
 //#endregion
-//#region ../core/src/preset/repo-trust.ts
+//#region ../core/src/skills/repo-source.ts
+const REPO_SKILLS_DIAGNOSTIC_ID = "core/repo-skills";
+const SKILL_FILE = "SKILL.md";
+/** The one source id repository skills are offered under; one repository, one source. */
+const REPO_SKILL_SOURCE_ID = "repo:workspace";
+/** The repository skills directory as a picker-facing source. */
+function repoSkillSource(path) {
+	return Object.freeze({
+		id: REPO_SKILL_SOURCE_ID,
+		kind: "repo",
+		name: "This repository",
+		path
+	});
+}
+/**
+* Resolves every skill tree below `.aura/skills` into an installable pack.
+*
+* A broken entry earns a diagnostic and drops out rather than failing the run: unlike snippets,
+* these trees are outside the trust hash — they are offers the per-skill review gates, so an
+* unreadable one is a smaller catalog, not a broken consent record. Each tree walks under the
+* driver policy: a cloned tree deserves exactly the suspicion a driver-materialized one gets.
+*/
+async function resolveRepoSkills(root, boundary, reader, maxTotalBytes) {
+	const rootRead = await reader.readWithin(root, [boundary]);
+	const { contents } = rootRead;
+	if (!contents.exists) return {
+		diagnostics: [],
+		skills: []
+	};
+	if (rootRead.kind !== "read" || contents.pathKind === "symlink" || contents.problem !== void 0 || contents.entries === void 0) return {
+		diagnostics: [{
+			adapterId: REPO_SKILLS_DIAGNOSTIC_ID,
+			message: "Repository skills path .aura/skills is not a directory, so none are offered.",
+			path: root,
+			phase: "read"
+		}],
+		skills: []
+	};
+	const diagnostics = [];
+	const named = contents.entries.filter((entry) => !entry.startsWith("."));
+	if (named.length > 32) diagnostics.push({
+		adapterId: REPO_SKILLS_DIAGNOSTIC_ID,
+		message: `Repository skills directory holds more than the ${String(32)} entries Aura offers; the rest are ignored.`,
+		path: root,
+		phase: "read"
+	});
+	const skills = [];
+	const source = repoSkillSource(root);
+	let bytesRead = 0;
+	for (const id of named.slice(0, 32)) {
+		const remainingBytes = maxTotalBytes - bytesRead;
+		if (remainingBytes <= 0) {
+			diagnostics.push(diagnostic(join(root, id), "exceeds the repository content size budget"));
+			continue;
+		}
+		const outcome = await resolveOneSkill(root, id, source, reader, boundary, remainingWalkPolicy(remainingBytes));
+		bytesRead += outcome.bytesRead;
+		if (outcome.problem !== void 0) {
+			diagnostics.push(diagnostic(join(root, id), outcome.bytesRead >= remainingBytes ? "exceeds the repository content size budget" : outcome.problem));
+			continue;
+		}
+		skills.push(outcome.skill);
+	}
+	return {
+		diagnostics: Object.freeze(diagnostics),
+		skills: Object.freeze(skills)
+	};
+}
+async function resolveOneSkill(root, id, source, reader, boundary, policy) {
+	const idProblem = skillIdProblem(id);
+	if (idProblem !== void 0) return {
+		bytesRead: 0,
+		problem: idProblem
+	};
+	const tree = await walkTree(join(root, id), reader, policy, boundary);
+	if (tree.problem !== void 0) return {
+		bytesRead: tree.bytesRead,
+		problem: tree.problem.message
+	};
+	const definition = tree.files.find((file) => file.path === SKILL_FILE);
+	if (definition === void 0) return {
+		bytesRead: tree.bytesRead,
+		problem: `does not contain ${SKILL_FILE}`
+	};
+	const frontmatter = parseSkillFrontmatter(definition.content);
+	return {
+		bytesRead: tree.bytesRead,
+		skill: Object.freeze({
+			description: frontmatter.description ?? "Repository skill.",
+			files: tree.files,
+			id,
+			name: frontmatter.name ?? id,
+			source,
+			treeHash: treeHash(tree.files),
+			version: frontmatter.version ?? "0.0.0"
+		})
+	};
+}
+/** Caps each attempt by what remains of the repository-wide read budget. */
+function remainingWalkPolicy(remainingBytes) {
+	return Object.freeze({
+		...DRIVER_WALK_POLICY,
+		maxFileBytes: Math.min(DRIVER_WALK_POLICY.maxFileBytes, remainingBytes),
+		maxTotalBytes: Math.min(DRIVER_WALK_POLICY.maxTotalBytes, remainingBytes)
+	});
+}
+function diagnostic(path, message) {
+	return {
+		adapterId: REPO_SKILLS_DIAGNOSTIC_ID,
+		message: `Repository skill ${message}, so it is not offered.`,
+		path,
+		phase: "read"
+	};
+}
+//#endregion
+//#region ../core/src/preset/repo-content-files.ts
+/** Matches the optional frontmatter block a snippet file may open with. */
+const FRONTMATTER_PATTERN = /^---\r?\n[\s\S]*?\r?\n---(?:\r?\n|$)/u;
+/** Reads every Markdown snippet below `.aura/snippets` under the trust-set rules. */
+async function readRepoSnippets(root, boundary, reader) {
+	const contents = await reader.read(root);
+	if (!contents.exists) return {
+		files: [],
+		status: "ready"
+	};
+	if (contents.entries === void 0) return {
+		problem: "the snippets path is not a directory",
+		status: "invalid"
+	};
+	const names = contents.entries.filter((entry) => !entry.startsWith(".") && entry.endsWith(".md"));
+	if (names.length > 64) return {
+		problem: `holds more than the ${String(64)} snippet limit`,
+		status: "invalid"
+	};
+	const files = [];
+	for (const name of names) {
+		const result = await readSnippetFile(root, name, boundary, reader);
+		if (typeof result === "string") return {
+			problem: result,
+			status: "invalid"
+		};
+		files.push(result);
+	}
+	files.sort((left, right) => left.entry.id < right.entry.id ? -1 : 1);
+	return {
+		files: Object.freeze(files),
+		status: "ready"
+	};
+}
+async function readSnippetFile(root, name, boundary, reader) {
+	const stem = name.slice(0, -3);
+	if (skillIdProblem(stem) !== void 0) return "contains an entry that is not a kebab-case Markdown file name";
+	const read = await reader.readWithin(join(root, name), [boundary], { maxBytes: MAX_SNIPPET_BYTES });
+	const problem = snippetReadProblem(read);
+	if (problem !== void 0) return problem;
+	const text = read.contents.content ?? "";
+	const frontmatter = parseSkillFrontmatter(text);
+	const body = text.replace(FRONTMATTER_PATTERN, "");
+	return {
+		entry: Object.freeze({
+			body,
+			...frontmatter.description === void 0 ? {} : { description: frontmatter.description },
+			id: `repo/${stem}`,
+			name: frontmatter.name ?? stem
+		}),
+		text
+	};
+}
+/** Why a bounded, boundary-checked read did not yield a plain snippet file. */
+function snippetReadProblem(read) {
+	if (read.kind === "outside") return "contains an entry that leads outside the repository's .aura directory";
+	if (read.kind === "unverified" || read.contents.pathKind === "symlink") return "contains an entry that is not a regular file";
+	const { contents } = read;
+	if (contents.problem !== void 0 || contents.isDirectory || contents.content === void 0 || contents.utf8Valid === false) return "contains an entry that is not a readable UTF-8 file";
+	if ((contents.size ?? 0) > 256e3) return `contains an entry larger than the ${String(MAX_SNIPPET_BYTES)} byte snippet limit`;
+}
+//#endregion
+//#region ../core/src/preset/repo-content.ts
+const REPO_CONTENT_DIAGNOSTIC_ID = "core/repo-content";
+/**
+* Reads the repository's trust-hashed content and any requested installable content in one snapshot.
+*
+* The result is what catalogs and planners consume for the whole run: applying from this snapshot
+* rather than from a re-read is what closes the window between the bytes the user consented to
+* and the bytes a later write could put on disk. A broken snippet set fails the run — those bytes
+* are inside the trust hash — while a broken skill tree only shrinks the offers, because skills
+* stay behind the per-skill review.
+*/
+async function readRepoContent(auraDir, preset, presetText, reader, options = {}) {
+	const boundary = await reader.realPath(auraDir) ?? auraDir;
+	const snippets = await readRepoSnippets(join(auraDir, "snippets"), boundary, reader);
+	if (snippets.status === "invalid") return {
+		diagnostics: [{
+			adapterId: REPO_CONTENT_DIAGNOSTIC_ID,
+			message: `Repository snippets directory ".aura/snippets" ${snippets.problem}.`,
+			path: join(auraDir, "snippets"),
+			phase: "read"
+		}],
+		status: "invalid"
+	};
+	const snippetBytes = snippets.files.reduce((sum, file) => sum + Buffer$1.byteLength(file.text, "utf8"), 0);
+	if (snippetBytes > 16e6) return {
+		diagnostics: [{
+			adapterId: REPO_CONTENT_DIAGNOSTIC_ID,
+			message: `Repository snippets exceed the ${String(MAX_REPO_CONTENT_TOTAL_BYTES)} byte repository content budget.`,
+			path: join(auraDir, "snippets"),
+			phase: "read"
+		}],
+		status: "invalid"
+	};
+	const skills = options.includeSkills === false ? {
+		diagnostics: [],
+		skills: []
+	} : await resolveRepoSkills(join(auraDir, "skills"), boundary, reader, MAX_REPO_CONTENT_TOTAL_BYTES - snippetBytes);
+	return {
+		contentSet: Object.freeze({
+			mcpServers: preset.provides?.mcpServers ?? [],
+			skills: skills.skills,
+			snippets: Object.freeze(snippets.files.map((file) => file.entry))
+		}),
+		diagnostics: skills.diagnostics,
+		hash: hashRepoContentSet(presetText, snippets.files.map((file) => ({
+			id: file.entry.id,
+			text: file.text
+		}))),
+		status: "ready"
+	};
+}
+/**
+* Lifts the preset's inline MCP definitions into catalog entries.
+*
+* The `repo/` namespace is reserved against plugins at registry build, so these can never collide
+* with — or be shadowed by — a plugin catalog entry. The source URL names the preset file itself:
+* that is the file whose bytes the user trusted.
+*/
+function repoMcpServerDefs(servers, presetPath) {
+	return Object.freeze(servers.map((manifest) => Object.freeze({
+		description: manifest.description,
+		id: manifest.id,
+		kind: "mcp-server",
+		manifest,
+		name: manifest.name,
+		source: Object.freeze({
+			type: "file",
+			url: pathToFileURL(presetPath).href
+		}),
+		version: "0.0.0"
+	})));
+}
 /**
-* Hashes repository preset contents for the trust record.
+* Hashes the repository content set for the trust record.
 *
-* Normalizes line endings so a checkout that rewrites them does not invalidate a trust the user
-* already granted to the same bytes-as-authored.
+* With no snippet files the hash is exactly the preset file's own content hash, so a repository
+* that never adds `.aura/snippets` keeps every trust its users already recorded. The first
+* snippet changes the descriptor shape — and consent is re-asked, which is the point.
 */
-function hashRepoPreset(content) {
-	return hashContent(content);
+function hashRepoContentSet(presetText, snippets) {
+	if (snippets.length === 0) return hashContent(presetText);
+	const lines = [
+		"aura-repo-content-v1",
+		`preset ${hashContent(presetText)}`,
+		...[...snippets].sort((left, right) => left.id < right.id ? -1 : 1).map((file) => `snippet ${file.id} ${hashContent(file.text)}`)
+	];
+	return hashContent(lines.join("\n"));
 }
+//#endregion
+//#region ../core/src/preset/repo-trust.ts
 /** Reads and validates the repository preset below the invoking directory. */
-async function readRepoPreset(environment, reader = createFileReader()) {
+async function readRepoPreset(environment, reader = createFileReader(), options = {}) {
 	const cwd = await reader.realPath(environment.cwd) ?? environment.cwd;
 	const path = resolveTeamPresetPath(cwd);
 	const state = await readTeamPreset(cwd, reader);
@@ -9009,10 +9307,17 @@ async function readRepoPreset(environment, reader = createFileReader()) {
 		path,
 		status: state.status
 	};
+	const content = await readRepoContent(dirname(path), state.preset, state.content, reader, options);
+	if (content.status === "invalid") return {
+		diagnostics: [...state.diagnostics, ...content.diagnostics],
+		path,
+		status: "invalid"
+	};
 	const mainWorktreePath = await resolveMainWorktreePresetPath(cwd, path, reader);
 	return {
-		diagnostics: state.diagnostics,
-		hash: hashRepoPreset(state.content),
+		contentSet: content.contentSet,
+		diagnostics: [...state.diagnostics, ...content.diagnostics],
+		hash: content.hash,
 		...mainWorktreePath === void 0 ? {} : { mainWorktreePath },
 		path,
 		preset: state.preset,
@@ -9057,7 +9362,7 @@ function applyRequiredMcpServers(model, config) {
 		model
 	};
 	const manifest = model.manifest.value;
-	const configured = new Set(manifest.mcpServers.map((server) => `${server.scope}\0${server.name}`));
+	const configured = new Set(manifest.mcpServers.map((server) => server.name));
 	const configuredCatalogIds = new Set(manifest.mcpServers.flatMap((server) => server.catalogId === void 0 ? [] : [server.catalogId]));
 	const diagnostics = [];
 	const required = [];
@@ -9078,7 +9383,7 @@ function applyRequiredMcpServers(model, config) {
 			continue;
 		}
 		const name = catalog.manifest.serverName;
-		if (configured.has(`global\0${name}`)) {
+		if (configured.has(name)) {
 			diagnostics.push(note(`is already configured as "${name}", so your own settings were kept`, catalog.id, selection));
 			continue;
 		}
@@ -9092,7 +9397,6 @@ function applyRequiredMcpServers(model, config) {
 			catalogId: catalog.id,
 			name,
 			requiredBy: selection.provenance.label,
-			scope: "global",
 			transport: catalog.manifest.transportTemplate
 		}));
 	}
@@ -9117,6 +9421,91 @@ function note(reason, id, selection) {
 	};
 }
 //#endregion
+//#region src/runtime-config.ts
+/** Loads the selected preset and resolves all runtime layers once for a command. */
+async function resolveRuntimeConfig(input) {
+	if (input.manifest.status === "read-only") return {
+		message: input.manifest.problem.message,
+		status: "invalid"
+	};
+	const manifest = input.manifest.status === "ready" ? input.manifest.value : void 0;
+	const loaded = await loadTeamPreset({
+		cliReference: input.cliReference,
+		defaultReference: input.defaultPreset,
+		environment: input.environment,
+		manifestReference: manifest?.preset,
+		noCache: input.noCache,
+		offline: input.online !== true,
+		presets: input.registry.presets
+	});
+	if (loaded.status === "invalid") return loaded;
+	const repo = input.repoPresetState ?? await readRepoPreset(input.environment, void 0, { includeSkills: false });
+	if (repo.status === "invalid") return {
+		message: `${repo.diagnostics[0]?.message ?? `Repository preset ${repo.path} cannot be read.`} Fix or remove the file to continue.`,
+		status: "invalid"
+	};
+	const repoTrusted = repo.status === "ready" && repo.hash !== void 0 && (repo.hash === input.acceptedRepoPresetHash || isRepoPresetTrusted(manifest, repo, repo.hash));
+	const resolved = resolveEffectiveConfig({
+		checks: input.registry.checks,
+		cli: input.cliLayer,
+		distro: input.defaults,
+		knownMcpServers: /* @__PURE__ */ new Set([...input.registry.mcpServers.map((server) => server.id), ...repoTrusted ? (repo.preset?.provides?.mcpServers ?? []).map((server) => server.id) : []]),
+		...manifest === void 0 ? {} : { manifest: {
+			...manifest.checks === void 0 ? {} : { checks: manifest.checks },
+			skills: manifest.skills.map(({ id, source }) => ({
+				id,
+				source
+			})),
+			snippets: manifest.snippets.map(({ id }) => id)
+		} },
+		...loaded.status === "ready" ? {
+			preset: loaded.preset,
+			selectedPreset: loaded.selected
+		} : {},
+		...repoTrusted ? { repo: repo.preset } : {}
+	});
+	if (resolved.status === "invalid") return {
+		message: resolved.problems.join("\n"),
+		status: "invalid"
+	};
+	const policyPreset = loaded.status === "ready" || resolved.config.allowedSkillSources !== void 0 || resolved.config.skillDirectories.length > 0 ? Object.freeze({
+		...loaded.status === "ready" ? loaded.preset : {},
+		...resolved.config.allowedSkillSources === void 0 ? {} : { allowedSkillSources: resolved.config.allowedSkillSources.value },
+		name: resolved.config.preset?.name ?? resolved.config.allowedSkillSources?.provenance.label ?? resolved.config.skillDirectories[0]?.provenance.label ?? "runtime policy",
+		schemaVersion: 1,
+		skillDirectories: resolved.config.skillDirectories.map(({ value }) => value)
+	}) : void 0;
+	return {
+		config: resolved.config,
+		notes: [...loaded.status === "ready" ? loaded.notes : [], ...repoTrusted ? repo.diagnostics.map((diagnostic) => diagnostic.message) : []],
+		...policyPreset === void 0 ? {} : { preset: policyPreset },
+		presetOrigin: loaded.status === "ready" ? loaded.origin : policyPreset?.name ?? ".aura/preset.json",
+		...repo.status === "ready" && repo.hash !== void 0 ? { repoPreset: {
+			...repoTrusted && repo.contentSet !== void 0 ? { contentSet: repo.contentSet } : {},
+			hash: repo.hash,
+			...repo.mainWorktreePath === void 0 ? {} : { mainWorktreePath: repo.mainWorktreePath },
+			path: repo.path,
+			...repoTrusted && repo.preset !== void 0 ? { preset: repo.preset } : {},
+			status: repoTrusted ? "applied" : "held"
+		} } : {},
+		status: "ready"
+	};
+}
+/**
+* Adds a trusted repository's provided MCP definitions to the model's catalog.
+*
+* Run before {@link applyRequiredMcpServers} projection wherever a model is projected, so a
+* repository can require a server it defines itself. A held repository changes nothing.
+*/
+function withRepoMcpCatalog(model, repoPreset) {
+	const servers = repoPreset?.status === "applied" ? repoPreset.contentSet?.mcpServers ?? [] : [];
+	if (servers.length === 0 || repoPreset === void 0) return model;
+	return Object.freeze({
+		...model,
+		availableMcpServers: Object.freeze([...model.availableMcpServers, ...repoMcpServerDefs(servers, repoPreset.path)])
+	});
+}
+//#endregion
 //#region src/safe-text.ts
 const MAX_FINDING_TEXT_CHARACTERS = 500;
 const UNICODE_FORMAT_CHARACTER = /\p{Cf}/u;
@@ -9287,10 +9676,7 @@ function isBundledSkillSelection(skill) {
 /** Final instruction handling only; paths, sources, and duplicate choices stop here. */
 function instructionActions(selections) {
 	if (selections === void 0) return [];
-	return [selections.global, ...selections.project === void 0 ? [] : [selections.project]].map(({ action, scope }) => ({
-		action,
-		scope
-	}));
+	return [{ action: selections.global.action }];
 }
 /**
 * Per-check state and severity counts for every executed check, ordered by check ID.
@@ -9339,6 +9725,15 @@ function countsByCheck(findings) {
 }
 //#endregion
 //#region src/command-support.ts
+/**
+* Projects preset requirements onto a check scan's model.
+*
+* A trusted repository's provided MCP definitions join the catalog first, so a repository can
+* require a server it defines itself and `check` reports that requirement the way setup would.
+*/
+function projectConfiguredModel(model, configured) {
+	return applyRequiredMcpServers(withRepoMcpCatalog(model, configured.repoPreset), configured.config);
+}
 /** The `--home` override every scanning command shares. */
 function homeOption() {
 	return Option.String("--home", { description: "Override the home directory." });
@@ -9404,75 +9799,6 @@ function reportUnexpectedFailure(error, subject, branding, withDetail, stderr, t
 	return 3;
 }
 //#endregion
-//#region src/runtime-config.ts
-/** Loads the selected preset and resolves all runtime layers once for a command. */
-async function resolveRuntimeConfig(input) {
-	if (input.manifest.status === "read-only") return {
-		message: input.manifest.problem.message,
-		status: "invalid"
-	};
-	const manifest = input.manifest.status === "ready" ? input.manifest.value : void 0;
-	const loaded = await loadTeamPreset({
-		cliReference: input.cliReference,
-		defaultReference: input.defaultPreset,
-		environment: input.environment,
-		manifestReference: manifest?.preset,
-		noCache: input.noCache,
-		offline: input.online !== true,
-		presets: input.registry.presets
-	});
-	if (loaded.status === "invalid") return loaded;
-	const repo = await readRepoPreset(input.environment);
-	if (repo.status === "invalid") return {
-		message: `${repo.diagnostics[0]?.message ?? `Repository preset ${repo.path} cannot be read.`} Fix or remove the file to continue.`,
-		status: "invalid"
-	};
-	const repoTrusted = repo.status === "ready" && repo.hash !== void 0 && (repo.hash === input.acceptedRepoPresetHash || isRepoPresetTrusted(manifest, repo, repo.hash));
-	const resolved = resolveEffectiveConfig({
-		checks: input.registry.checks,
-		cli: input.cliLayer,
-		distro: input.defaults,
-		knownMcpServers: new Set(input.registry.mcpServers.map((server) => server.id)),
-		...manifest === void 0 ? {} : { manifest: {
-			...manifest.checks === void 0 ? {} : { checks: manifest.checks },
-			skills: manifest.skills.map(({ id, source }) => ({
-				id,
-				source
-			})),
-			snippets: manifest.snippets.map(({ id }) => id)
-		} },
-		...loaded.status === "ready" ? {
-			preset: loaded.preset,
-			selectedPreset: loaded.selected
-		} : {},
-		...repoTrusted ? { repo: repo.preset } : {}
-	});
-	if (resolved.status === "invalid") return {
-		message: resolved.problems.join("\n"),
-		status: "invalid"
-	};
-	const policyPreset = loaded.status === "ready" || resolved.config.allowedSkillSources !== void 0 || resolved.config.skillDirectories.length > 0 ? Object.freeze({
-		...loaded.status === "ready" ? loaded.preset : {},
-		...resolved.config.allowedSkillSources === void 0 ? {} : { allowedSkillSources: resolved.config.allowedSkillSources.value },
-		name: resolved.config.preset?.name ?? resolved.config.allowedSkillSources?.provenance.label ?? resolved.config.skillDirectories[0]?.provenance.label ?? "runtime policy",
-		schemaVersion: 1,
-		skillDirectories: resolved.config.skillDirectories.map(({ value }) => value)
-	}) : void 0;
-	return {
-		config: resolved.config,
-		notes: loaded.status === "ready" ? loaded.notes : [],
-		...policyPreset === void 0 ? {} : { preset: policyPreset },
-		presetOrigin: loaded.status === "ready" ? loaded.origin : policyPreset?.name ?? ".aura/preset.json",
-		...repo.status === "ready" && repo.hash !== void 0 ? { repoPreset: {
-			hash: repo.hash,
-			...repo.mainWorktreePath === void 0 ? {} : { mainWorktreePath: repo.mainWorktreePath },
-			path: repo.path,
-			status: repoTrusted ? "applied" : "held"
-		} } : {},
-		status: "ready"
-	};
-}
-//#endregion
 //#region src/check-config.ts
 /** Resolves the effective configuration for one `check` run. */
 function resolveCheckConfiguration(options) {
@@ -12917,7 +13243,7 @@ var CheckCommand = class extends Command {
 		try {
 			const startedAt = environment.now();
 			let scan = await scanner.run();
-			let projected = applyRequiredMcpServers(scan.model, configured.config);
+			let projected = projectConfiguredModel(scan.model, configured);
 			let model = projected.model;
 			let run = runChecks(activeChecks, model, configured.config);
 			let fixRunDiagnostics = [];
@@ -12945,7 +13271,7 @@ var CheckCommand = class extends Command {
 				fixes = outcome.fixes;
 				if (outcome.applied) {
 					scan = await scanner.run();
-					projected = applyRequiredMcpServers(scan.model, configured.config);
+					projected = projectConfiguredModel(scan.model, configured);
 					model = projected.model;
 					run = runChecks(activeChecks, model, configured.config);
 				}
@@ -13029,7 +13355,7 @@ function renderRootHelp(branding) {
 			rows: [NO_COLOR_ROW],
 			title: "Advanced"
 		}
-	], branding.docsUrl === void 0 ? [] : [`Docs: ${branding.docsUrl}`]);
+	], branding.docsUrl === void 0 ? [] : [`Docs: ${branding.docsUrl}`], ROOT_INTRO);
 }
 function renderCheckHelp(branding) {
 	const bin = branding.command;
@@ -13216,6 +13542,17 @@ const NO_COLOR_ROW = {
 	term: "--no-color",
 	text: "Disable terminal colors"
 };
+/**
+* The root screen's one paragraph: what Aura is for, in the words of someone who has not read the
+* docs yet. It sits above "Get started" because a first-time reader needs the problem before the
+* command. Hand-wrapped at 80 columns — the renderer aligns columns, it never reflows prose — and
+* carried only by the root screen, since every other screen is reached by someone who already knows.
+*/
+const ROOT_INTRO = [
+	"Every AI coding agent keeps its own rules and its own tool settings, in its own",
+	"files. Aura reads all of them, tells you where they disagree or are broken, and",
+	"fixes them after you say yes - so every agent works from the same instructions."
+];
 /** Test and CI plumbing, present on every command and interesting to almost nobody. */
 function advancedRows() {
 	return [
@@ -13263,9 +13600,10 @@ function headline(branding) {
 	return branding.description === void 0 ? name : `${name} — ${branding.description}`;
 }
 /** Terms align to one shared column so the eye scans a single list, not per-section islands. */
-function renderHelpScreen(header, sections, footers) {
+function renderHelpScreen(header, sections, footers, intro = []) {
 	const width = Math.max(...sections.flatMap((section) => section.rows.map((row) => row.term.length)));
 	const lines = [header];
+	if (intro.length > 0) lines.push("", ...intro.map((line) => `  ${line}`));
 	for (const section of sections) {
 		lines.push("", `  ${section.title}`);
 		for (const row of section.rows) lines.push(`    ${row.term.padEnd(width)}    ${row.text}`);
@@ -13507,7 +13845,7 @@ function planLinks$1(context, scopeSelections, archived, ownership, manualSteps)
 }
 function planAppLinks(context, app, scopeSelections, archived, ownership, manualSteps) {
 	return scopeSelections.flatMap((selection) => {
-		const link = selection.scope === "global" ? app.sharedLink : app.projectSharedLink;
+		const link = app.sharedLink;
 		if (link === void 0) return [];
 		const outcome = planSharedInstructionLink(app, context.model, {
 			link,
@@ -13534,12 +13872,12 @@ function planAppLinks(context, app, scopeSelections, archived, ownership, manual
 * only once that entry is merged here and archived. The wizard does not offer an entry already
 * pointing at the target, so leaving this to the selection strands the app on every run.
 */
-function mandatoryEntryPaths(context, scope) {
+function mandatoryEntryPaths(context) {
 	const managedIds = new Set(managedAppIdList(context));
 	const paths = /* @__PURE__ */ new Set();
 	for (const app of context.model.apps) {
 		if (app.synthetic === true || !managedIds.has(app.adapterId)) continue;
-		const link = scope === "global" ? app.sharedLink : app.projectSharedLink;
+		const link = app.sharedLink;
 		if (link?.kind === "symlink") paths.add(resolve(link.entryPath));
 	}
 	return paths;
@@ -13551,7 +13889,7 @@ function mandatoryEntryPaths(context, scope) {
 * archives them.
 */
 function requiredEntries(context, selection, inventory) {
-	const required = mandatoryEntryPaths(context, selection.scope);
+	const required = mandatoryEntryPaths(context);
 	return inventory.filter((source) => source.scope === selection.scope && required.has(resolve(source.path)));
 }
 /** Folds the required entries into the selection, so the merge and the archive both see them. */
@@ -13586,7 +13924,7 @@ function canonicalSourcePath(document) {
 */
 function isAuraArtifact(document, model) {
 	const path = resolve(document.path);
-	return model.apps.some((app) => [app.sharedLink, app.projectSharedLink].some((link) => link !== void 0 && resolve(link.entryPath) === path && matchesLink(document, link)));
+	return model.apps.some((app) => app.sharedLink !== void 0 && resolve(app.sharedLink.entryPath) === path && matchesLink(document, app.sharedLink));
 }
 function matchesLink(document, link) {
 	if (link.kind === "native-copy") return document.content === link.content;
@@ -13600,7 +13938,7 @@ function matchesLink(document, link) {
 * would otherwise re-walk every application to rediscover the same handful of links.
 */
 function importLineLinks(model) {
-	return model.apps.flatMap((app) => [app.sharedLink, app.projectSharedLink]).filter((link) => link?.kind === "import-line" && link.content !== void 0);
+	return model.apps.map((app) => app.sharedLink).filter((link) => link?.kind === "import-line" && link.content !== void 0);
 }
 /** Removes legacy marked links and a plain import Aura appended at the declared entry path. */
 function stripAuraInstructionArtifacts(content, path, links) {
@@ -13736,17 +14074,14 @@ function removeRanges(content, ranges) {
 //#endregion
 //#region src/setup/instructions.ts
 function instructionTargets(model) {
-	return {
-		global: resolve(model.sharedInstructions.path),
-		project: resolve(projectSharedInstructionsPath(model.projectRoot, model.cwd))
-	};
+	return { global: resolve(model.sharedInstructions.path) };
 }
 function instructionInventory(model) {
 	const targets = instructionTargets(model);
 	const owned = new Set(model.manifest.status === "ready" ? Object.values(model.manifest.value.ownership).flatMap((entry) => entry.files.map((path) => resolve(path))) : []);
 	const documents = /* @__PURE__ */ new Map();
 	for (const document of model.instructionFiles) {
-		if ([resolve(document.path), canonicalSourcePath(document)].some((candidate) => candidate === targets.global || candidate === targets.project || owned.has(candidate)) || isAuraArtifact(document, model)) continue;
+		if ([resolve(document.path), canonicalSourcePath(document)].some((candidate) => candidate === targets.global || owned.has(candidate)) || isAuraArtifact(document, model)) continue;
 		const key = canonicalSourcePath(document);
 		const current = documents.get(key);
 		if (current === void 0 || document.content.length > current.content.length) documents.set(key, document);
@@ -13847,10 +14182,8 @@ function planInstructions(context) {
 	const ownership = /* @__PURE__ */ new Map();
 	const inventory = instructionInventory(context.model);
 	const clusters = duplicateClusters(context.findings ?? []);
-	const scopeSelections = [selections.global, selections.project].filter((selection) => selection !== void 0 && selection.action !== "blocked" && selection.action !== "skip");
-	const linked = [];
-	for (const selection of scopeSelections) if (planScope(context, selection, inventory, clusters, state)) linked.push(selection);
-	const linkOperations = planLinks$1(context, linked, state.archived, ownership, state.manualSteps);
+	const selection = selections.global;
+	const linkOperations = planLinks$1(context, selection.action !== "blocked" && planScope(context, selection, inventory, clusters, state) ? [selection] : [], state.archived, ownership, state.manualSteps);
 	for (const [path, archive] of state.archived) {
 		const linkIndex = linkOperations.findIndex((operation) => resolve(primaryPath(operation)) === path);
 		const link = linkIndex === -1 ? void 0 : linkOperations.splice(linkIndex, 1)[0];
@@ -13892,14 +14225,10 @@ function planScope(context, requested, inventory, clusters, state) {
 	if (selection.action !== "consolidate") return true;
 	const content = composeConsolidatedInstructions(chosen, selection, clusters, context.model, existing);
 	if (content.trim().length === 0) {
-		if (selection.scope === "global") {
-			state.blockers.push({
-				path: selection.targetPath,
-				reason: "No selected instruction content is available to consolidate. Select a source, or choose the starter template."
-			});
-			return false;
-		}
-		state.manualSteps.push(`Configure ${selection.targetPath} on the next run: select at least one project source to consolidate, or choose the starter template. Aura wrote nothing there.`);
+		state.blockers.push({
+			path: selection.targetPath,
+			reason: "No selected instruction content is available to consolidate. Select a source, or choose the starter template."
+		});
 		return false;
 	}
 	planConsolidatedTarget(context, selection, existing, content, state);
@@ -14083,7 +14412,7 @@ function withRequiredOverrides(manifest, requiredIds, overriddenIds) {
 * was available to receive it.
 */
 function unconfiguredRequirement(context, id) {
-	return context.interactive ? `Required MCP catalog entry ${id} could not be selected for a managed compatible application.` : `Required MCP catalog entry ${id} is not configured yet. Run setup interactively to choose its name, scope, and applications; later non-interactive runs re-apply what the manifest records.`;
+	return context.interactive ? `Required MCP catalog entry ${id} could not be selected for a managed compatible application.` : `Required MCP catalog entry ${id} is not configured yet. Run setup interactively to choose its name and applications; later non-interactive runs re-apply what the manifest records globally.`;
 }
 function withMcpOwnership(manifest, appId, names) {
 	const previous = manifest.ownership[appId];
@@ -14160,6 +14489,131 @@ function formatThresholds(thresholds) {
 	return pairs.length === 0 ? "no thresholds" : pairs.join(", ");
 }
 //#endregion
+//#region src/setup/repo-trust-preview.ts
+/** Printed instead of the row block when the preset carries nothing worth reviewing. */
+const NO_SETTINGS = "No check, MCP, skill, or snippet settings.";
+/**
+* Security-relevant capabilities shown before repository-controlled settings are accepted.
+*
+* One row per thing, never one row per field: a snippet the preset both provides and selects is
+* one snippet, and naming it twice made the screen long enough to skim past. Everything
+* executable-adjacent is spelled out verbatim (escaped) — the MCP command line or endpoint is
+* exactly what a later selection would configure, and trust time is the one moment the user is
+* looking. Snippet bodies are deliberately not echoed — pasting untrusted Markdown into a consent
+* prompt is its own injection surface — the picker's preview is where they are read, and the
+* prompt itself carries the explicit-selection boundary.
+*/
+function repoPresetTrustPreview(preset, contentSet) {
+	const rows = [
+		...mcpRows(preset, contentSet),
+		...skillRows(preset, contentSet),
+		...snippetRows(preset, contentSet),
+		...(preset.skillDirectories ?? []).map(directoryRow),
+		...listRow("sources", preset.allowedSkillSources),
+		...checksRow(preset.checks)
+	];
+	return [
+		"",
+		...rows.length === 0 ? [`  ${NO_SETTINGS}`] : alignRows(rows),
+		""
+	].join("\n");
+}
+/** Whether the prompt should promise that admitted content still needs a deliberate tick. */
+function hasRepoContent(contentSet) {
+	return contentSet !== void 0 && contentSet.mcpServers.length + contentSet.skills.length + contentSet.snippets.length > 0;
+}
+function alignRows(rows) {
+	const width = Math.max(...rows.map((row) => row.term.length));
+	return rows.map((row) => `  ${row.term.padEnd(width)}  ${row.detail}`);
+}
+/**
+* Every MCP server the repository would configure, provided ones with their full command line.
+*
+* A required id the repository does not define itself resolves from the catalog, so it gets a row
+* saying that rather than an executable surface this file cannot promise.
+*/
+function mcpRows(preset, contentSet) {
+	const provided = contentSet?.mcpServers ?? [];
+	const providedIds = new Set(provided.map((server) => server.id));
+	const required = new Set(preset.requiredMcpServers ?? []);
+	return [...provided.map((server) => ({
+		detail: `${mcpServerPreview(server)}${required.has(server.id) ? " · required" : ""}`,
+		term: "mcp"
+	})), ...[...required].filter((id) => !providedIds.has(id)).map((id) => ({
+		detail: `${safe(id)} · required, from the catalog`,
+		term: "mcp"
+	}))];
+}
+/** Skill trees the repository ships, then selections that point somewhere else. */
+function skillRows(preset, contentSet) {
+	const provided = contentSet?.skills ?? [];
+	const providedKeys = new Set(provided.map((skill) => `${skill.source.id}/${skill.id}`));
+	return [...provided.map((skill) => ({
+		detail: `${safe(skill.id)} (${count(skill.files.length, "file")})`,
+		term: "skill"
+	})), ...(preset.skills ?? []).map((selection) => `${selection.source}/${selection.id}`).filter((key) => !providedKeys.has(key)).map((key) => ({
+		detail: `${safe(key)} · selected`,
+		term: "skill"
+	}))];
+}
+/** Snippets the repository ships, then selections from the catalog. */
+function snippetRows(preset, contentSet) {
+	const provided = contentSet?.snippets ?? [];
+	const providedIds = new Set(provided.map((snippet) => snippet.id));
+	return [...provided.map((snippet) => ({
+		detail: `${safe(snippet.id)} (${String(Buffer$1.byteLength(snippet.body, "utf8"))} B)`,
+		term: "snippet"
+	})), ...(preset.snippets ?? []).filter((id) => !providedIds.has(id)).map((id) => ({
+		detail: `${safe(id)} · selected`,
+		term: "snippet"
+	}))];
+}
+/** The full executable surface of one provided MCP server, escaped but verbatim. */
+function mcpServerPreview(server) {
+	return `${safe(server.id)} "${safe(server.serverName)}" → ${transportPreview(server.transportTemplate)}`;
+}
+function transportPreview(transport) {
+	if (transport.type === "http") return `http ${safe(transport.url)}`;
+	const args = (transport.args ?? []).map((argument) => `"${safe(argument)}"`).join(", ");
+	const env = (transport.env ?? []).map(safe).join(", ");
+	return [
+		`stdio "${safe(transport.command)}"`,
+		...args === "" ? [] : [`args [${args}]`],
+		...env === "" ? [] : [`env ${env}`]
+	].join(", ");
+}
+/** The exact check settings the repository preset asks the user to trust. */
+function checksRow(checks) {
+	if (checks === void 0) return [];
+	const settings = [
+		...(checks.disabled ?? []).map((id) => `${safe(id)}: disabled`),
+		...(checks.enabled ?? []).map((id) => `${safe(id)}: enabled`),
+		...Object.entries(checks.severity ?? {}).map(([id, severity]) => `${safe(id)}: severity ${safe(severity)}`),
+		...Object.entries(checks.thresholds ?? {}).map(([id, thresholds]) => `${safe(id)}: thresholds ${safe(JSON.stringify(thresholds))}`)
+	].sort();
+	return [{
+		detail: settings.length === 0 ? "(none)" : settings.join("; "),
+		term: "checks"
+	}];
+}
+function directoryRow(source) {
+	const token = source.kind === "private-directory" ? ` · token ${safe(source.tokenEnv)}` : "";
+	return {
+		detail: `${safe(source.name)} → ${safe(source.url)}${token}`,
+		term: "directory"
+	};
+}
+function listRow(term, values) {
+	if (values === void 0) return [];
+	return [{
+		detail: values.length === 0 ? "(none)" : values.map(safe).join(", "),
+		term
+	}];
+}
+function count(total, noun) {
+	return `${String(total)} ${noun}${total === 1 ? "" : "s"}`;
+}
+//#endregion
 //#region src/setup/repo-trust.ts
 /**
 * Asks whether an untrusted repository preset may be applied, once per repo and contents.
@@ -14169,61 +14623,39 @@ function formatThresholds(thresholds) {
 * answer. A non-interactive run resolves without the layer, and the plan summary says so.
 */
 async function establishRepoPresetTrust(options) {
-	const repo = await readRepoPreset(options.environment);
+	const repo = options.repoPresetState ?? await readRepoPreset(options.environment);
 	if (repo.status !== "ready" || repo.hash === void 0) return { kind: "resolved" };
 	const manifest = options.manifest.status === "ready" ? options.manifest.value : void 0;
 	if (isRepoPresetTrusted(manifest, repo, repo.hash) || !options.interactive) return { kind: "resolved" };
 	const name = repo.preset?.name;
-	options.io.note(name === void 0 ? `This repository provides a preset at ${AURA_TEAM_PRESET_PATH}.` : `This repository provides the preset "${safe(name)}" at ${AURA_TEAM_PRESET_PATH}.`);
-	if (repo.preset !== void 0) options.io.note(repoPresetTrustPreview(repo.preset));
+	options.io.note(name === void 0 ? `Repository preset — ${AURA_TEAM_PRESET_PATH}` : `Repository preset "${safe(name)}" — ${AURA_TEAM_PRESET_PATH}`);
+	if (repo.preset !== void 0) options.io.note(repoPresetTrustPreview(repo.preset, repo.contentSet));
 	if (repo.mainWorktreePath !== void 0) options.io.note("This directory is a linked worktree, so trusting these contents also applies them in every other worktree of the same checkout.");
 	const changed = (manifest?.trustedRepoPresets ?? []).some((entry) => entry.path === repo.path);
-	const confirmation = await options.io.confirm(changed ? `The repository preset at ${AURA_TEAM_PRESET_PATH} changed since you trusted it. Trust the new contents?` : `Trust the repository preset at ${AURA_TEAM_PRESET_PATH}? Its settings apply to every Aura run in this repository until the file changes.`);
+	const confirmation = await options.io.confirm(trustPrompt(changed, repo.contentSet));
 	if (confirmation === "aborted") return { kind: "aborted" };
 	return confirmation === "accepted" ? {
 		acceptedHash: repo.hash,
 		kind: "resolved"
 	} : { kind: "resolved" };
 }
-/** Security-relevant capabilities shown before repository-controlled settings are accepted. */
-function repoPresetTrustPreview(preset) {
-	const settings = [
-		checksPreview(preset.checks),
-		listPreview("Required MCP servers", preset.requiredMcpServers),
-		listPreview("Allowed skill sources", preset.allowedSkillSources),
-		...(preset.skillDirectories ?? []).map(directoryPreview),
-		listPreview("Selected skills", preset.skills?.map((skill) => `${skill.source}/${skill.id}`)),
-		listPreview("Selected snippets", preset.snippets)
-	].filter((line) => line !== void 0);
-	return ["Review these repository-controlled settings before trusting:", ...settings.length === 0 ? ["No check, MCP, skill, or snippet settings."] : settings].join("\n");
-}
-/** The exact check settings the repository preset asks the user to trust. */
-function checksPreview(checks) {
-	if (checks === void 0) return;
-	const settings = [
-		...(checks.disabled ?? []).map((id) => `${safe(id)}: disabled`),
-		...(checks.enabled ?? []).map((id) => `${safe(id)}: enabled`),
-		...Object.entries(checks.severity ?? {}).map(([id, severity]) => `${safe(id)}: severity ${safe(severity)}`),
-		...Object.entries(checks.thresholds ?? {}).map(([id, thresholds]) => `${safe(id)}: thresholds ${safe(JSON.stringify(thresholds))}`)
-	].sort();
-	return `Checks: ${settings.length === 0 ? "(none)" : settings.join("; ")}`;
-}
-function directoryPreview(source) {
-	const token = source.kind === "private-directory" ? `; token ${safe(source.tokenEnv)}` : "";
-	return `Skill directory: ${safe(source.name)} — ${safe(source.url)}${token}`;
-}
-function listPreview(label, values) {
-	return values === void 0 ? void 0 : `${label}: ${listValues(values)}`;
-}
-function listValues(values) {
-	return values.length === 0 ? "(none)" : values.map(safe).join(", ");
+/**
+* The question itself, short because the note above it already named the file and its contents.
+*
+* The two-tier contract rides here rather than in the summary: a preset that only carries policy
+* installs nothing either way, so promising a later tick would be noise in the one line the user
+* is certain to read.
+*/
+function trustPrompt(changed, contentSet) {
+	if (changed) return "The preset changed since you trusted it. Trust the new contents?";
+	return hasRepoContent(contentSet) ? "Trust it? Nothing installs until you pick it; applies to every run here until the file changes." : "Trust it? Applies to every run here until the file changes.";
 }
 /**
 * Whether this run's prompt accepted exactly the contents the resolved layer applied.
 *
-* The two reads of the file — the prompt's and configuration resolution's — are independent, so a
-* write that lands between them leaves the layer held. Recording trust for a layer that did not
-* apply would claim consent for settings this run never used.
+* Boot passes one immutable snapshot through the prompt and configuration resolution. Comparing
+* hashes here keeps this helper correct for direct callers too: trust is recorded only for the
+* layer this run actually applied.
 */
 function acceptedRepoPreset(configured, acceptedHash) {
 	const repo = configured.repoPreset;
@@ -14236,9 +14668,11 @@ function setupRepoPresetContext(configured, acceptedHash, recorded) {
 	return Object.freeze({
 		accepted: acceptedRepoPreset(configured, acceptedHash),
 		checkSummary: repo.status === "applied" ? presetCheckSummary(configured.config, "repo") : Object.freeze([]),
+		...repo.contentSet === void 0 ? {} : { contentSet: repo.contentSet },
 		hash: repo.hash,
 		...repo.mainWorktreePath === void 0 ? {} : { mainWorktreePath: repo.mainWorktreePath },
 		path: repo.path,
+		...repo.preset === void 0 ? {} : { preset: repo.preset },
 		recorded,
 		status: repo.status
 	});
@@ -14856,11 +15290,15 @@ async function bootSetup(request, environment) {
 		message: manifest.problem.message,
 		status: "invalid"
 	};
+	const initialRepoPreset = await readRepoPreset(environment, void 0, { includeSkills: request.interactive });
+	const manifestValue = manifest.status === "ready" ? manifest.value : void 0;
+	const repoPresetState = !request.interactive && initialRepoPreset.status === "ready" && initialRepoPreset.hash !== void 0 && isRepoPresetTrusted(manifestValue, initialRepoPreset, initialRepoPreset.hash) ? await readRepoPreset(environment) : initialRepoPreset;
 	const trust = await establishRepoPresetTrust({
 		environment,
 		interactive: request.interactive,
 		io: request.io,
-		manifest
+		manifest,
+		repoPresetState
 	});
 	if (trust.kind === "aborted") return { status: "aborted" };
 	const scanCancellation = new AbortController();
@@ -14882,7 +15320,8 @@ async function bootSetup(request, environment) {
 		manifest,
 		noCache: request.noCache,
 		online: true,
-		registry: request.registry
+		registry: request.registry,
+		repoPresetState
 	});
 	if (configured.status === "invalid") {
 		scanCancellation.abort();
@@ -14890,7 +15329,7 @@ async function bootSetup(request, environment) {
 	}
 	const scan = await settleScan(request.io);
 	const trusted = await bootRepoPresetTrust(request, configured, trust.acceptedHash, scan);
-	const projected = applyRequiredMcpServers(trusted.scan.model, configured.config);
+	const projected = applyRequiredMcpServers(withRepoMcpCatalog(trusted.scan.model, configured.repoPreset), configured.config);
 	return {
 		activeChecks: enabledChecks(request.registry.checks, configured.config),
 		configured,
@@ -14907,8 +15346,8 @@ async function bootSetup(request, environment) {
 	};
 }
 /** Re-projects a rescan so the closing checklist reads the same virtual state the run planned. */
-function projectRescan(rescanned, config) {
-	const projection = applyRequiredMcpServers(rescanned.model, config);
+function projectRescan(rescanned, config, repoPreset) {
+	const projection = applyRequiredMcpServers(withRepoMcpCatalog(rescanned.model, repoPreset), config);
 	return {
 		...rescanned,
 		diagnostics: [...rescanned.diagnostics, ...projection.diagnostics],
@@ -15242,6 +15681,7 @@ function createMcpSetupCatalog(inputs) {
 			entries.push({
 				catalog,
 				key: `catalog:${catalog.id}`,
+				...isRepoCatalogId(catalog.id) ? { repo: true } : {},
 				required: requiredIds.has(catalog.id),
 				sourceName: owner?.name
 			});
@@ -15253,6 +15693,7 @@ function createMcpSetupCatalog(inputs) {
 				catalog,
 				existing: match.server,
 				key: `manifest:${String(match.index)}`,
+				...isRepoCatalogId(catalog.id) ? { repo: true } : {},
 				required: requiredIds.has(catalog.id),
 				sourceName: owner?.name
 			});
@@ -15265,6 +15706,7 @@ function createMcpSetupCatalog(inputs) {
 			...catalog === void 0 ? {} : { catalog },
 			existing: server,
 			key: `manifest:${String(index)}`,
+			...server.catalogId !== void 0 && isRepoCatalogId(server.catalogId) ? { repo: true } : {},
 			required: server.catalogId !== void 0 && requiredIds.has(server.catalogId),
 			sourceName: server.catalogId === void 0 ? void 0 : inputs.registry.ownerOf("mcp-server", server.catalogId)?.name
 		});
@@ -15277,12 +15719,24 @@ function createMcpSetupCatalog(inputs) {
 		requiredIds
 	});
 }
+/**
+* Required rows first (they carry blocker semantics whoever asked for them), then this
+* repository's own definitions, then configured rows, then everything else by name. Repo rows
+* lead the optional block — they are what a person running setup inside the repository came for —
+* without outranking a requirement they did not make.
+*/
 function compareEntries(left, right) {
 	if (left.required !== right.required) return left.required ? -1 : 1;
+	const leftRepo = left.repo === true;
+	if (leftRepo !== (right.repo === true)) return leftRepo ? -1 : 1;
 	const leftConfigured = left.existing !== void 0;
 	if (leftConfigured !== (right.existing !== void 0)) return leftConfigured ? -1 : 1;
 	return entryName(left).localeCompare(entryName(right));
 }
+/** The `repo/` namespace is reserved against plugins, so the prefix alone is provenance. */
+function isRepoCatalogId(id) {
+	return id.startsWith("repo/");
+}
 /** User-facing name used by the picker and deterministic sorting. */
 function mcpCatalogEntryName(entry) {
 	return entryName(entry);
@@ -15365,7 +15819,7 @@ const MAX_CONCURRENT_SOURCE_LISTINGS = 4;
 * of both. Only the draining is ordered, which is what keeps the picker's rows stable.
 */
 async function loadListing(request) {
-	const entries = [...bundledEntries(request.inputs)];
+	const entries = [...repoEntries(request.inputs), ...bundledEntries(request.inputs)];
 	const notes = [...request.notes];
 	const unavailableSources = request.unapproved.map((source) => ({
 		hint: `connection not approved; token ${source.tokenEnv}`,
@@ -15485,6 +15939,30 @@ function memoizedDriverListing(request, source) {
 	request.driverListings.set(source.id, listing);
 	return listing;
 }
+/** Repository skills the active allowlist admits; the source id is `repo:workspace`. */
+function allowedRepoSkills(inputs) {
+	return (inputs.repoSkills ?? []).filter((skill) => isSkillSourceAllowed(inputs.preset, skill.source.id));
+}
+/**
+* This repository's own skills, resolved from the trusted snapshot rather than any fetch.
+*
+* `remote` stays false — no fetch is needed — but the review stage still gates their first
+* install by identity: trees that arrive by cloning get the same on-screen reading a directory
+* skill does.
+*/
+function repoEntries(inputs) {
+	return allowedRepoSkills(inputs).map((skill) => ({
+		description: skill.description,
+		id: skill.id,
+		identity: skillIdentity(skill.source.id, skill.id),
+		name: skill.name,
+		preview: skill.files.find((file) => file.path === "SKILL.md")?.content,
+		remote: false,
+		sourceId: skill.source.id,
+		sourceName: skill.source.name,
+		version: skill.version
+	}));
+}
 function bundledEntries(inputs) {
 	return (inputs.model.availableSkills ?? []).filter((skill) => isSkillSourceAllowed(inputs.preset, skill.source.id)).map((skill) => ({
 		description: skill.description,
@@ -15525,6 +16003,7 @@ function remoteEntries(listings, source) {
 function createSkillCatalog(inputs) {
 	const collected = collectSkillDirectorySources(inputs.registryDirectories, inputs.preset);
 	const packs = /* @__PURE__ */ new Map();
+	for (const skill of allowedRepoSkills(inputs)) packs.set(skillIdentity(skill.source.id, skill.id), skill);
 	const failures = /* @__PURE__ */ new Map();
 	const pending = /* @__PURE__ */ new Map();
 	const driverListings = /* @__PURE__ */ new Map();
@@ -15601,7 +16080,8 @@ function createSetupCatalogs(inputs) {
 			presetOrigin: inputs.presetOrigin,
 			registryDirectories: inputs.registry.skillDirectories,
 			registryDrivers: inputs.registry.skillSources,
-			registryPresets: inputs.registry.presets
+			registryPresets: inputs.registry.presets,
+			repoSkills: inputs.repoSkills
 		})
 	};
 }
@@ -15632,15 +16112,17 @@ function requiringPreset(preset, config) {
 }
 //#endregion
 //#region src/setup/snippets.ts
+/** The picker group every repository-defined snippet renders under. */
+const REPO_SNIPPET_CATEGORY = "From this repository";
 /** Bounds simultaneous snippet handles independently of how many contributions a distro ships. */
 const MAX_CONCURRENT_SNIPPET_READS = 24;
-function createSnippetCatalog(snippets, manifest, presetIds = []) {
+function createSnippetCatalog(snippets, manifest, presetIds = [], repoSnippets = []) {
 	let resolved = [];
 	let pending;
 	return {
 		entries: () => resolved,
 		load: () => {
-			pending ??= resolveSnippetCatalog(snippets, manifest, presetIds).then((entries) => {
+			pending ??= resolveSnippetCatalog(snippets, manifest, presetIds, repoSnippets).then((entries) => {
 				resolved = entries;
 				return entries;
 			});
@@ -15649,13 +16131,23 @@ function createSnippetCatalog(snippets, manifest, presetIds = []) {
 	};
 }
 /** Resolves every registry source once and retains manifest-only selections as unavailable rows. */
-async function resolveSnippetCatalog(snippets, manifest, presetIds = []) {
-	const registered = new Set(snippets.map((snippet) => snippet.id));
+async function resolveSnippetCatalog(snippets, manifest, presetIds = [], repoSnippets = []) {
+	const repoEntries = repoSnippets.map((snippet) => Object.freeze({
+		category: REPO_SNIPPET_CATEGORY,
+		content: snippet.body,
+		description: snippet.description ?? "Defined by this repository.",
+		id: snippet.id,
+		name: snippet.name,
+		origin: "repo",
+		status: "available"
+	}));
+	const registered = /* @__PURE__ */ new Set([...snippets.map((snippet) => snippet.id), ...repoEntries.map((entry) => entry.id)]);
 	const limit = createLimiter(MAX_CONCURRENT_SNIPPET_READS);
 	const resolved = await Promise.all(snippets.map((snippet) => limit(() => resolveSnippet(snippet))));
 	const previous = manifest.status === "ready" ? manifest.value.snippets : [];
 	const previousIds = new Set(previous.map((entry) => entry.id));
 	return Object.freeze([
+		...repoEntries,
 		...resolved,
 		...previous.map((entry) => entry.id).filter((id) => !registered.has(id)).map((id) => Object.freeze({
 			category: "general",
@@ -16071,7 +16563,6 @@ function excerpt(sources, path, startLine, endLine) {
 //#region src/setup/steps/instruction-stages.ts
 const TEMPLATE_VALUE = "template";
 const CONSOLIDATE_VALUE = "consolidate";
-const SKIP_VALUE = "skip";
 /**
 * The target's current text when this scope has nothing left to decide, otherwise undefined.
 *
@@ -16102,13 +16593,13 @@ function scopeStages(input) {
 	return [
 		{
 			isApplicable: () => !input.blocked,
-			label: input.scope === "global" ? "Global" : "Project",
+			label: "Personal",
 			apply: (state, answers) => update(state, { action: settled(answers[actionId], offered, fallback) }),
 			questions: (state) => input.blocked ? void 0 : [{
 				id: actionId,
 				initial: [draft(state).action ?? fallback],
 				kind: "select",
-				label: input.scope === "global" ? "Global" : "Project",
+				label: "Personal",
 				options,
 				prompt: `How should Aura configure ${input.targetPath}?`
 			}]
@@ -16127,7 +16618,7 @@ function scopeStages(input) {
 					label: source.path,
 					value: source.path
 				})),
-				prompt: `Which ${input.scope} instruction files should Aura consolidate?`
+				prompt: "Which personal instruction files should Aura consolidate?"
 			}] : void 0
 		},
 		{
@@ -16164,10 +16655,8 @@ function settled(answer, offered, fallback) {
 * advice, the mark and the cursor on row `1.` together, and leaves the rest of the menu in the
 * order it was built. A scope with nothing to combine recommends nothing and keeps that order.
 *
-* The opt-out is offered on the project scope only. Declining the global scope would leave INS-001
-* and INS-002 firing at error severity, so setup could not end on green — an answer the wizard
-* offers should not be one the closing checklist then fails the run over. The project tier has no
-* error-severity counterpart, so a declined project scope still ends green.
+* Personal instructions cannot be skipped because setup must leave applications connected to the
+* global shared source.
 */
 function actionOptions(input) {
 	const options = [];
@@ -16187,11 +16676,6 @@ function actionOptions(input) {
 		label: "Use starter template",
 		value: TEMPLATE_VALUE
 	});
-	if (input.scope === "project") options.push({
-		description: hasTargetContent(input) ? `Aura writes nothing here and adds no project-level link; ${basename(input.targetPath)} and anything already linking to it stay as they are.` : "Aura writes nothing here and adds no project-level link.",
-		label: "Skip project instructions",
-		value: SKIP_VALUE
-	});
 	return recommendedFirst(options);
 }
 function hasTargetContent(input) {
@@ -16200,7 +16684,7 @@ function hasTargetContent(input) {
 //#endregion
 //#region src/setup/steps/instructions.ts
 /**
-* The instructions step: one back-navigable chain of forms across both scopes.
+* The instructions step: one back-navigable chain of forms for personal instructions.
 *
 * Each scope contributes action → sources → duplicate review stages; a stage whose precondition no
 * longer holds (a non-consolidate action, no duplicated paragraphs left) simply disappears from
@@ -16210,9 +16694,8 @@ function hasTargetContent(input) {
 const instructionsStep = {
 	gather: async (context, io) => {
 		const inputs = scopeInputs(context);
-		const scopes = scopeList(inputs);
-		if (context.revisited !== true) for (const input of scopes) emitScopeNotes(input, io);
-		const stages = scopes.flatMap(scopeStages);
+		if (context.revisited !== true) emitScopeNotes(inputs.global, io);
+		const stages = scopeStages(inputs.global);
 		const result = await runFormChain(stages, initialState(context), io, {
 			entry: context.enteredBackward === true ? "end" : "start",
 			flow: context.flow
@@ -16226,55 +16709,34 @@ const instructionsStep = {
 	telemetryCategory: "instructions",
 	title: "Instructions"
 };
-/** Both scopes in flow order, which is the order notes are emitted and stages are chained in. */
-function scopeList(inputs) {
-	return inputs.project === void 0 ? [inputs.global] : [inputs.global, inputs.project];
-}
-/** Folds both scopes' drafts into the step's selections, unoffered when it asked nothing to do it. */
+/** Folds the personal draft into the step's selections, unoffered when it asked nothing to do it. */
 function settle(context, inputs, result, unoffered) {
-	const project = inputs.project === void 0 ? void 0 : scopeSelection(inputs.project, result.project);
 	const selections = {
 		...context.selections,
-		instructions: {
-			global: scopeSelection(inputs.global, result.global),
-			...project === void 0 ? {} : { project }
-		}
+		instructions: { global: scopeSelection(inputs.global, result.global) }
 	};
 	return unoffered ? {
 		selections,
 		unoffered: true
 	} : selections;
 }
-/** Everything both scopes need from the workspace; project is absent when it has nothing to do. */
+/** Everything personal instruction setup needs from the workspace. */
 function scopeInputs(context) {
 	const inventory = instructionInventory(context.model);
 	const targets = instructionTargets(context.model);
 	const clusters = duplicateClusters(context.findings ?? []);
-	const global = {
+	return { global: {
 		blocked: context.model.sharedInstructions.problem !== void 0,
 		clusters,
 		scope: "global",
 		sources: inventory.filter((source) => source.scope === "global"),
 		targetContentValue: instructionTargetContent(context.model, "global", targets.global),
 		targetPath: targets.global
-	};
-	const projectSources = inventory.filter((source) => source.scope === "project");
-	const projectContent = instructionTargetContent(context.model, "project", targets.project);
-	return {
-		global,
-		project: projectSources.length === 0 && projectContent === void 0 ? void 0 : {
-			blocked: false,
-			clusters,
-			scope: "project",
-			sources: projectSources,
-			targetContentValue: projectContent,
-			targetPath: targets.project
-		}
-	};
+	} };
 }
 function scopeSelection(input, draft) {
 	if (input.blocked) return inactiveSelection(input, "blocked");
-	if (draft.action !== "consolidate") return inactiveSelection(input, inactiveAction(draft.action, input.scope));
+	if (draft.action !== "consolidate") return inactiveSelection(input, inactiveAction(draft.action));
 	const selectedSources = draft.selectedSources ?? [];
 	const relevant = relevantDuplicateClusters(selectedSources, input.clusters);
 	return {
@@ -16292,9 +16754,9 @@ function scopeSelection(input, draft) {
 * INS-002 firing at error severity, so the action menu never offers it there; this mapping is the
 * second half of that rule, keeping an action off the menu from becoming one the planner obeys.
 */
-function inactiveAction(action, scope) {
+function inactiveAction(action) {
 	if (action === "template") return "template";
-	return action === "skip" && scope === "project" ? "skip" : "keep";
+	return "keep";
 }
 function inactiveSelection(input, action) {
 	return {
@@ -16308,10 +16770,7 @@ function inactiveSelection(input, action) {
 /** A re-entered step resumes from what this run already decided, not from cold-start defaults. */
 function initialState(context) {
 	const existing = context.selections.instructions;
-	return {
-		global: toDraft(existing?.global),
-		project: toDraft(existing?.project)
-	};
+	return { global: toDraft(existing?.global) };
 }
 function toDraft(selection) {
 	if (selection === void 0 || selection.action === "blocked") return {};
@@ -16333,10 +16792,10 @@ function emitScopeNotes(input, io) {
 			path: input.targetPath,
 			scope: input.scope
 		});
-		io.note(`${input.scope === "global" ? "Global" : "Project"} instructions already live in ${input.targetPath} (${size}); Aura found nothing else to consolidate and leaves the file as it is.`);
+		io.note(`Personal instructions already live in ${input.targetPath} (${size}); Aura found nothing else to consolidate and leaves the file as it is.`);
 		return;
 	}
-	if (input.sources.length > 0) io.note(`Found ${describeSources(input.sources)} for ${input.scope} consolidation.`);
+	if (input.sources.length > 0) io.note(`Found ${describeSources(input.sources)} for personal consolidation.`);
 }
 function describeSources(sources) {
 	return sources.map((source) => `${basename(source.path)} (${describeInstructionSource(source)})`).join(" and ");
@@ -16525,47 +16984,27 @@ async function configureEntry(context, entry, taken, io) {
 		return SETUP_BACK;
 	}
 	const defaultName = seed?.name ?? catalog?.serverName ?? "custom";
-	const defaultScope = seed?.scope ?? "global";
 	const apps = appChoices(context, catalog?.supportedApps, seed?.apps ?? []);
 	if (apps.eligible.length === 0 && (seed?.apps.length ?? 0) === 0) {
 		io.note("No detected, managed, compatible application can receive this MCP server.");
 		return;
 	}
 	let name = defaultName;
-	let scope = defaultScope;
 	let selectedApps = seed === void 0 || seed.apps.length === 0 ? apps.eligible : seed.apps;
 	for (;;) {
-		const result = await io.ask([
-			textQuestion("mcp-name", "Name", "Configuration name", name),
-			{
-				id: "mcp-scope",
-				initial: [scope],
-				kind: "select",
-				label: "Scope",
-				options: [{
-					label: "Global",
-					value: "global"
-				}, {
-					label: "Project",
-					value: "project"
-				}],
-				prompt: "Where should applications configure this server?"
-			},
-			{
-				id: "mcp-apps",
-				initial: selectedApps,
-				kind: "multiselect",
-				label: "Applications",
-				options: apps.options,
-				prompt: "Which applications should enable this server?"
-			}
-		]);
+		const result = await io.ask([textQuestion("mcp-name", "Name", "Configuration name", name), {
+			id: "mcp-apps",
+			initial: selectedApps,
+			kind: "multiselect",
+			label: "Applications",
+			options: apps.options,
+			prompt: "Which applications should enable this server?"
+		}]);
 		if (result === "aborted") return SETUP_ABORTED;
 		if (result === "back") return SETUP_BACK;
 		name = answerText(result["mcp-name"]);
-		scope = selectedValues(result["mcp-scope"])[0] === "project" ? "project" : "global";
 		selectedApps = selectedValues(result["mcp-apps"]);
-		const problem = entryProblem(name, scope, selectedApps, taken);
+		const problem = entryProblem(name, selectedApps, taken);
 		if (problem !== void 0) {
 			io.note(problem);
 			if (!context.interactive) return SETUP_ABORTED;
@@ -16575,7 +17014,6 @@ async function configureEntry(context, entry, taken, io) {
 			apps: Object.freeze([...new Set(selectedApps)]),
 			...catalog === void 0 ? {} : { catalogId: catalog.id },
 			name,
-			scope,
 			transport
 		});
 	}
@@ -16588,12 +17026,12 @@ async function configureEntry(context, entry, taken, io) {
 * the form that is one line to re-type; caught at serialization it would end the run after every
 * question had been answered.
 */
-function entryProblem(name, scope, apps, taken) {
+function entryProblem(name, apps, taken) {
 	const nameProblem = mcpServerNameProblem(name);
 	if (nameProblem !== void 0) return `MCP server $.name ${nameProblem}.`;
 	if (apps.length === 0) return "MCP server $.apps must select at least one application.";
 	const selected = new Set(apps);
-	return taken.some((server) => server.name === name && server.scope === scope && server.apps.some((app) => selected.has(app))) ? `MCP server $.name ${name} is already configured at ${scope} scope for an application selected here. Choose another name.` : void 0;
+	return taken.some((server) => server.name === name && server.apps.some((app) => selected.has(app))) ? `MCP server $.name ${name} is already configured globally for an application selected here. Choose another name.` : void 0;
 }
 function appChoices(context, supportedApps, existingApps) {
 	const managed = new Set(managedAppIdList(context));
@@ -16654,7 +17092,7 @@ function workingEntries(context) {
 }
 function matchesEntry(server, entry) {
 	const existing = entry.existing;
-	if (existing !== void 0) return existing.catalogId === server.catalogId && existing.name === server.name && existing.scope === server.scope;
+	if (existing !== void 0) return existing.catalogId === server.catalogId && existing.name === server.name;
 	return entry.catalog?.id === server.catalogId;
 }
 function nextCustomKey(entries) {
@@ -16665,7 +17103,7 @@ function nextCustomKey(entries) {
 /**
 * A default name no other row has taken.
 *
-* Two servers cannot share one name in one application and scope — the manifest refuses to record
+* Two servers cannot share one name in one application — the manifest refuses to record
 * it — so seeding every custom server with `custom` would turn "add two, accept the defaults" into
 * a plan the manifest declines to hold.
 */
@@ -16727,7 +17165,6 @@ async function gatherMcp(context, io) {
 			const server = {
 				apps: [],
 				name: nextCustomName(entries),
-				scope: "global",
 				transport
 			};
 			entries.push({
@@ -16802,15 +17239,24 @@ function requiredCatalogIds(entries) {
 	return [...new Set(entries.flatMap((entry) => entry.required && entry.catalog !== void 0 ? [entry.catalog.id] : []))];
 }
 function serverOption(entry) {
-	const configured = entry.selectedServer !== void 0 || entry.existing !== void 0;
-	const tags = [...entry.required ? ["from preset", "required"] : [], ...configured ? [entry.catalog === void 0 ? "custom" : "configured"] : []];
+	const tags = serverTags(entry);
 	const suffix = tags.length === 0 ? "" : ` (${tags.join(", ")})`;
 	return {
-		description: entry.sourceName === void 0 ? "Custom server" : `Plugin: ${entry.sourceName}`,
+		description: serverProvenance(entry),
 		label: `${safe(mcpCatalogEntryName(entry))}${suffix}`,
 		value: entry.key
 	};
 }
+/** What the run knows about a row: who selected it, whether it is required or configured. */
+function serverTags(entry) {
+	const configured = entry.selectedServer !== void 0 || entry.existing !== void 0;
+	const origin = entry.repo === true ? "from repo" : "from preset";
+	return [...entry.required ? [origin, "required"] : entry.repo === true ? [origin] : [], ...configured ? [entry.catalog === void 0 ? "custom" : "configured"] : []];
+}
+function serverProvenance(entry) {
+	if (entry.repo === true) return "Repository: .aura/preset.json";
+	return entry.sourceName === void 0 ? "Custom server" : `Plugin: ${entry.sourceName}`;
+}
 function hasManagedMcpApp(context) {
 	const managed = new Set(managedAppIdList(context));
 	return context.appCatalog.some((entry) => entry.kind === "detected" && entry.supportsMcp && managed.has(catalogEntryId(entry)));
@@ -16927,11 +17373,7 @@ function pickerOptions(inputs) {
 	const policy = inputs.catalog.policy;
 	const unsupported = !hasSkillsHome(inputs.managedApps);
 	const preset = new Set(inputs.presetSkills.map((skill) => skillIdentity(skill.source, skill.id)));
-	const entryRows = sortForDisplay(inputs.listing.entries, (entry) => [
-		entry.sourceName,
-		entry.name,
-		entry.id
-	]).map((entry) => ({
+	const entryRow = (entry) => ({
 		description: `${entry.description} · v${entry.version}`,
 		get disabled() {
 			return unsupported || inputs.listing.verification?.isMissing(entry.identity) === true;
@@ -16941,10 +17383,18 @@ function pickerOptions(inputs) {
 			return inputs.listing.verification?.isMissing(entry.identity) === true ? "source no longer publishes this skill" : void 0;
 		},
 		group: entry.sourceName,
-		label: `${entry.name}${preset.has(entry.identity) ? " (from preset)" : ""}`,
+		label: `${entry.name}${selectedBySuffix(entry.identity)}`,
 		...previewField(inputs, entry),
 		value: entry.identity
-	}));
+	});
+	const selectedBySuffix = (identity) => inputs.repoSelectedIdentities.has(identity) ? " (from repo)" : preset.has(identity) ? " (from preset)" : "";
+	const sortedEntries = sortForDisplay(inputs.listing.entries, (entry) => [
+		entry.sourceName,
+		entry.name,
+		entry.id
+	]);
+	const repoEntryRows = sortedEntries.filter((entry) => entry.sourceId.startsWith("repo:")).map(entryRow);
+	const entryRows = sortedEntries.filter((entry) => !entry.sourceId.startsWith("repo:")).map(entryRow);
 	const manifestRows = inputs.manifestSkills.flatMap((skill) => {
 		const identity = skillIdentity(skill.source, skill.id);
 		if (covered.has(identity)) return [];
@@ -16999,18 +17449,23 @@ function pickerOptions(inputs) {
 		value: `truncated:${source.id}`
 	}));
 	const represented = /* @__PURE__ */ new Set([...inputs.listing.entries.map((entry) => entry.identity), ...inputs.manifestSkills.map((skill) => skillIdentity(skill.source, skill.id))]);
-	const presetRows = inputs.presetSkills.filter((skill) => !represented.has(skillIdentity(skill.source, skill.id))).map((skill) => ({
-		description: "Selected by the active team preset, but unavailable in this run.",
-		disabled: true,
-		disabledNote: "preset selection unavailable",
-		group: skill.source,
-		label: `${skill.id} (from preset)`,
-		value: skillIdentity(skill.source, skill.id)
-	}));
+	const presetRows = inputs.presetSkills.filter((skill) => !represented.has(skillIdentity(skill.source, skill.id))).map((skill) => {
+		const identity = skillIdentity(skill.source, skill.id);
+		const fromRepo = inputs.repoSelectedIdentities.has(identity);
+		return {
+			description: fromRepo ? "Selected by the repository preset, but unavailable in this run." : "Selected by the active team preset, but unavailable in this run.",
+			disabled: true,
+			disabledNote: fromRepo ? "repo selection unavailable" : "preset selection unavailable",
+			group: skill.source,
+			label: `${skill.id} ${fromRepo ? "(from repo)" : "(from preset)"}`,
+			value: identity
+		};
+	});
 	return [
 		...sourceRows,
 		...truncatedRows,
 		...packRows,
+		...repoEntryRows,
 		...entryRows,
 		...manifestRows,
 		...presetRows
@@ -17093,6 +17548,16 @@ function skillStages(inputs) {
 function isRemoteIdentity(identity) {
 	return identity.startsWith("directory:") || identity.startsWith("driver:");
 }
+/**
+* A repository identity's install needs no fetch, but the review boundary all the same.
+*
+* The trees arrive by cloning, not by anything the user selected — "local files" is the bundled
+* exemption's mechanism, but distribution vouching was its justification, and a checkout has
+* neither.
+*/
+function isRepoIdentity(identity) {
+	return identity.startsWith("repo:");
+}
 /** The typed selection behind each offered identity: catalog entries plus manifest rows. */
 function selectionsByIdentity(inputs) {
 	const selections = /* @__PURE__ */ new Map();
@@ -17152,7 +17617,8 @@ function reviewStage(inputs) {
 	const offered = selectionsByIdentity(inputs);
 	const entries = new Map(inputs.listing.entries.map((entry) => [entry.identity, entry]));
 	const bundled = bundledByIdentity(inputs.availableSkills);
-	const reviewable = (identity) => needsReview(identity, recorded, bundled);
+	const repo = bundledByIdentity(inputs.repoSkills);
+	const reviewable = (identity) => needsReview(identity, recorded, bundled, repo);
 	return {
 		apply: (state, answers) => ({
 			...state,
@@ -17169,7 +17635,11 @@ function reviewStage(inputs) {
 			}), inputs.approvedPrivateSourceIds);
 			const resolutionWithBundled = {
 				problems: resolution.problems,
-				resolved: new Map([...resolution.resolved, ...bundled])
+				resolved: new Map([
+					...resolution.resolved,
+					...bundled,
+					...repo
+				])
 			};
 			const questions = state.selected.filter(reviewable).flatMap((identity) => reviewQuestion(identity, state.decisions, resolutionWithBundled, recorded, entries.get(identity), offered.get(identity)));
 			return questions.length === 0 ? void 0 : questions;
@@ -17179,8 +17649,13 @@ function reviewStage(inputs) {
 function bundledByIdentity(packs) {
 	return new Map(packs.map((pack) => [skillIdentity(pack.source.id, pack.id), pack]));
 }
-function needsReview(identity, recorded, bundled) {
+function needsReview(identity, recorded, bundled, repo) {
 	if (isRemoteIdentity(identity)) return true;
+	if (isRepoIdentity(identity)) {
+		const previous = recorded.get(identity);
+		const pack = repo.get(identity);
+		return previous === void 0 || pack !== void 0 && movedFrom(previous, pack);
+	}
 	const previous = recorded.get(identity);
 	const available = bundled.get(identity);
 	return previous !== void 0 && available !== void 0 && movedFrom(previous, available);
@@ -17206,11 +17681,19 @@ async function finalizeSkills(state, inputs, manifestSkills) {
 		const selection = offered.get(identity);
 		return selection === void 0 ? [] : [selection];
 	}), inputs.approvedPrivateSourceIds);
+	const repoPacks = new Map(inputs.repoSkills.map((pack) => [skillIdentity(pack.source.id, pack.id), pack]));
 	const selected = [];
 	const resolved = [];
 	for (const identity of state.selected) {
 		const selection = offered.get(identity);
 		if (selection === void 0) continue;
+		if (isRepoIdentity(identity)) {
+			finalizeRemote(identity, selection, state, repoPacks.get(identity), recorded.get(identity), {
+				resolved,
+				selected
+			});
+			continue;
+		}
 		if (!isRemoteIdentity(identity)) {
 			selected.push(selection);
 			continue;
@@ -17283,15 +17766,7 @@ async function gatherApprovedSkills(context, io, approval) {
 	const manifestSkills = recordedSkills(context);
 	emitNotes(context, io, listing, manifestSkills);
 	if (isEmptyCatalog(listing, manifestSkills)) return emptyCatalogOutcome$1(context);
-	const inputs = {
-		approvedPrivateSourceIds,
-		availableSkills: context.model.availableSkills ?? [],
-		catalog: context.skillCatalog,
-		listing,
-		managedApps: managedSkillApps(context),
-		manifestSkills,
-		presetSkills: context.preset?.skills ?? []
-	};
+	const inputs = stageInputs(context, approvedPrivateSourceIds, listing, manifestSkills);
 	const opening = openingSelection(context, inputs, manifestSkills);
 	noteHeldBack(inputs, io, opening.heldBack);
 	const result = await runFormChain(skillStages(inputs), opening.state, io, {
@@ -17316,6 +17791,21 @@ function noteHeldBack(inputs, io, heldBack) {
 function recordedSkills(context) {
 	return context.manifest.status === "ready" ? context.manifest.value.skills : [];
 }
+/** Everything the picker/review chain reads, with the repository selections folded in. */
+function stageInputs(context, approvedPrivateSourceIds, listing, manifestSkills) {
+	const repoSelections = context.repoPreset?.preset?.skills ?? [];
+	return {
+		approvedPrivateSourceIds,
+		availableSkills: context.model.availableSkills ?? [],
+		catalog: context.skillCatalog,
+		listing,
+		managedApps: managedSkillApps(context),
+		manifestSkills,
+		presetSkills: [...context.preset?.skills ?? [], ...repoSelections],
+		repoSelectedIdentities: new Set(repoSelections.map((skill) => skillIdentity(skill.source, skill.id))),
+		repoSkills: context.repoPreset?.contentSet?.skills ?? []
+	};
+}
 function emptyCatalogOutcome$1(context) {
 	return context.enteredBackward === true ? SETUP_BACK : {
 		selections: { ...context.selections },
@@ -17439,7 +17929,7 @@ const snippetsStep = {
 		const installed = installedSnippetIds(context);
 		if (context.revisited !== true) emitCatalogNotes(context, catalog, installed, io.note);
 		if (catalog.length === 0) return emptyCatalogOutcome(context, io);
-		const options = snippetOptions(catalog, installed, new Set(context.preset?.snippets ?? []));
+		const options = snippetOptions(catalog, installed, new Set(context.preset?.snippets ?? []), new Set(context.repoPreset?.preset?.snippets ?? []));
 		const selectable = new Set(options.filter((option) => option.disabled !== true).map((option) => option.value));
 		const question = {
 			id: "snippets",
@@ -17479,14 +17969,23 @@ const RECORD_NOTE = "Aura keeps the record; the text stays where it is.";
 * checkbox has anything to do — the row is there to report the record, not to be answered with.
 * Gathering those rows under one heading is what lets the numbers below start at 1 and count only
 * what a tick would change, and it empties out any category whose every snippet is installed.
+*
+* Repository rows lead the offered rows: they are this repository's own guidance, which is what a
+* person running setup inside it most likely came for. Plugin categories keep their sorted order
+* underneath.
 */
-function snippetOptions(catalog, installed, preset) {
+function snippetOptions(catalog, installed, preset, repoSelected) {
 	const sorted = sortForDisplay(catalog, (entry) => [
 		entry.category,
 		entry.name,
 		entry.id
 	]);
-	return [...recordBlock(sorted.filter((entry) => installed.has(entry.id))), ...sorted.filter((entry) => !installed.has(entry.id)).map((entry) => offeredOption(entry, preset))];
+	const offered = sorted.filter((entry) => !installed.has(entry.id));
+	return [
+		...recordBlock(sorted.filter((entry) => installed.has(entry.id))),
+		...offered.filter((entry) => entry.origin === "repo").map((entry) => offeredOption(entry, preset, repoSelected)),
+		...offered.filter((entry) => entry.origin !== "repo").map((entry) => offeredOption(entry, preset, repoSelected))
+	];
 }
 /**
 * The installed rows, with the shared note appended to the last of them.
@@ -17506,10 +18005,11 @@ function recordBlock(entries) {
 	}));
 }
 /** A row a tick would act on, or one disabled because no installed plugin publishes its text. */
-function offeredOption(entry, preset) {
+function offeredOption(entry, preset, repoSelected) {
+	const selectedBy = repoSelected.has(entry.id) ? " (from repo)" : preset.has(entry.id) ? " (from preset)" : "";
 	const base = {
 		group: entry.category,
-		label: `${entry.name}${preset.has(entry.id) ? " (from preset)" : ""}`,
+		label: `${entry.name}${selectedBy}`,
 		value: entry.id,
 		...entry.status === "available" ? { preview: entry.content } : {}
 	};
@@ -17535,19 +18035,20 @@ function snippetsPrompt(options) {
 	return options.every((option) => option.locked === true) ? "Every snippet the installed plugins provide is already in your instructions." : "Nothing here can be added: every snippet is either installed already or unavailable.";
 }
 /**
-* What the picker opens with: every installed id, plus this run's answer or the preset.
+* What the picker opens with: every installed id, plus this run's answer or team-preset defaults.
 *
 * Installed rows are locked, so they are seeded on every visit — there is no earlier answer that
 * could have dropped one. Their `✔` comes from the lock rather than from this seeding, so what it
-* settles is the answer the form reports back, not the checkbox the picker draws. The preset adds
-* only what it can actually contribute: a disabled row opening ticked is an answer `--yes` has no
-* way to take back.
+* settles is the answer the form reports back, not the checkbox the picker draws. Team-preset
+* defaults add only what their installed plugins can contribute. Repository rows deliberately
+* open unticked even when the repository preset selects them: their bodies are arbitrary agent
+* instructions, so a first install requires a person to select the previewable row explicitly.
 */
 function initialSelection(context, options, installed) {
-	const preset = new Set(context.preset?.snippets ?? []);
+	const selected = new Set(context.preset?.snippets ?? []);
 	const chosen = context.selections.snippets;
 	const kept = [...installed];
-	const added = chosen?.selected ?? options.filter((option) => option.disabled !== true && !installed.has(option.value) && preset.has(option.value)).map((option) => option.value);
+	const added = chosen?.selected ?? options.filter((option) => option.disabled !== true && !installed.has(option.value) && selected.has(option.value)).map((option) => option.value);
 	return [...kept, ...added];
 }
 function emptyCatalogOutcome(context, io) {
@@ -17642,36 +18143,9 @@ async function runSetup(request) {
 		stdout.write("\nLeft everything as it was.\n");
 		return finish(1, "aborted");
 	}
-	const { activeChecks, configured, effectiveModel, effectiveScan, projected, scan } = booted;
-	const model = scan.model;
+	const { activeChecks, configured, effectiveModel, effectiveScan } = booted;
 	const steps = request.steps ?? SETUP_STEPS;
-	const initialFindings = steps.some((step) => step.needsFindings === true) ? gatherFindings(activeChecks, effectiveModel, io, configured.config) : void 0;
-	const catalogs = createSetupCatalogs({
-		config: configured.config,
-		environment,
-		interactive: request.interactive,
-		model: effectiveModel,
-		noCache: request.noCache,
-		preset: configured.preset,
-		presetNotes: [...configured.notes, ...projected.diagnostics.map((diagnostic) => diagnostic.message)],
-		presetOrigin: configured.presetOrigin,
-		registry: request.registry
-	});
-	const preset = setupPresetContext(request, configured.config, configured.preset);
-	const repoPreset = booted.repoPreset;
-	const stepContext = {
-		appCatalog: buildAppCatalog(request.registry.adapters, model, scan.skipped),
-		...initialFindings === void 0 ? {} : { findings: initialFindings },
-		interactive: request.interactive,
-		isEnvironmentVariableSet: (name) => environment.readVariable(name) !== void 0,
-		manifest: model.manifest,
-		mcpCatalog: catalogs.mcpCatalog,
-		model: effectiveModel,
-		skillCatalog: catalogs.skillCatalog,
-		snippetCatalog: createSnippetCatalog(request.registry.snippets, model.manifest, preset?.snippets ?? []),
-		...preset === void 0 ? {} : { preset },
-		...repoPreset === void 0 ? {} : { repoPreset }
-	};
+	const stepContext = buildStepContext(request, booted, environment, steps.some((step) => step.needsFindings === true) ? gatherFindings(activeChecks, effectiveModel, io, configured.config) : void 0);
 	let start = {
 		index: 0,
 		offered: /* @__PURE__ */ new Set(),
@@ -17701,7 +18175,7 @@ async function runSetup(request) {
 		environment,
 		mcpCatalog: request.registry.mcpServers,
 		skills: request.registry.skills
-	}), configured.config), activeChecks, configured.config), "applied", {
+	}), configured.config, configured.repoPreset), activeChecks, configured.config), "applied", {
 		actions: setupActions(ready.gathered),
 		appliedOperationCount: result.appliedOperationCount
 	});
@@ -17710,6 +18184,46 @@ async function runSetup(request) {
 function plannedActions(gathered) {
 	return gathered === void 0 ? void 0 : setupActions(gathered);
 }
+/** Assembles the catalogs and the immutable context every wizard step reads. */
+function buildStepContext(request, booted, environment, initialFindings) {
+	const { configured, effectiveModel, repoPreset, scan } = booted;
+	const model = scan.model;
+	const catalogs = buildCatalogs(request, booted, environment);
+	const preset = setupPresetContext(request, configured.config, configured.preset);
+	return {
+		appCatalog: buildAppCatalog(request.registry.adapters, model, scan.skipped),
+		...initialFindings === void 0 ? {} : { findings: initialFindings },
+		interactive: request.interactive,
+		isEnvironmentVariableSet: (name) => environment.readVariable(name) !== void 0,
+		manifest: model.manifest,
+		mcpCatalog: catalogs.mcpCatalog,
+		model: effectiveModel,
+		skillCatalog: catalogs.skillCatalog,
+		snippetCatalog: buildSnippetCatalog(request, booted, preset),
+		...preset === void 0 ? {} : { preset },
+		...repoPreset === void 0 ? {} : { repoPreset }
+	};
+}
+function buildCatalogs(request, booted, environment) {
+	const { configured, effectiveModel, projected, repoPreset } = booted;
+	return createSetupCatalogs({
+		config: configured.config,
+		environment,
+		interactive: request.interactive,
+		model: effectiveModel,
+		noCache: request.noCache,
+		preset: configured.preset,
+		presetNotes: [...configured.notes, ...projected.diagnostics.map((diagnostic) => diagnostic.message)],
+		presetOrigin: configured.presetOrigin,
+		registry: request.registry,
+		repoSkills: repoPreset?.contentSet?.skills ?? []
+	});
+}
+/** The snippet catalog, with the trusted repository's bodies and default selections folded in. */
+function buildSnippetCatalog(request, booted, preset) {
+	const repoPreset = booted.repoPreset;
+	return createSnippetCatalog(request.registry.snippets, booted.scan.model.manifest, [...preset?.snippets ?? [], ...repoPreset?.preset?.snippets ?? []], repoPreset?.contentSet?.snippets ?? []);
+}
 function setupPresetContext(request, config, preset) {
 	const selected = config.preset;
 	if (selected === void 0 || preset === void 0) return;