@tryaura/aura-cli 0.3.1 → 0.4.0

package/dist/bin/aura.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { n as OFFICIAL_REGISTRY_OPTIONS, t as OFFICIAL_PLUGINS } from "../plugins-BEuoEUo_.js";
-import { t as runCli } from "../run.boundary-NVWIwGgg.js";
+import { n as OFFICIAL_REGISTRY_OPTIONS, t as OFFICIAL_PLUGINS } from "../plugins-C-b2qvpr.js";
+import { t as runCli } from "../run.boundary-fZhCH0bP.js";
 //#endregion
 //#region src/bin.ts
 await runCli({
@@ -9,7 +9,7 @@ await runCli({
 		description: "Agent Unification & Repair Assistant",
 		displayName: "Aura",
 		docsUrl: "https://tryaura.sh/docs/introduction",
-		version: "0.3.1"
+		version: "0.4.0"
 	},
 	plugins: OFFICIAL_PLUGINS,
 	registry: OFFICIAL_REGISTRY_OPTIONS

package/dist/index.js

@@ -1,4 +1,4 @@
-import { i as vetHttpUrl, n as clampHttpTimeout, r as failureReason, t as runCli } from "./run.boundary-NVWIwGgg.js";
+import { i as vetHttpUrl, n as clampHttpTimeout, r as failureReason, t as runCli } from "./run.boundary-fZhCH0bP.js";
 //#region ../core/src/http-post.boundary.ts
 /**
 * Creates a bounded, TLS-only JSON POST that never rejects.

package/dist/plugins/index.js

@@ -1,2 +1,2 @@
-import { a as codexPlugin, i as claudeCodePlugin, n as OFFICIAL_REGISTRY_OPTIONS, o as cursorPlugin, r as checksCorePlugin, s as officialContentPlugin, t as OFFICIAL_PLUGINS } from "../plugins-BEuoEUo_.js";
+import { a as codexPlugin, i as claudeCodePlugin, n as OFFICIAL_REGISTRY_OPTIONS, o as cursorPlugin, r as checksCorePlugin, s as officialContentPlugin, t as OFFICIAL_PLUGINS } from "../plugins-C-b2qvpr.js";
 export { OFFICIAL_PLUGINS, OFFICIAL_REGISTRY_OPTIONS, checksCorePlugin, claudeCodePlugin, codexPlugin, cursorPlugin, officialContentPlugin };

package/dist/{plugins-BEuoEUo_.js → plugins-C-b2qvpr.js}

@@ -1,5 +1,5 @@
-import { A as displayPath, D as SHARED_INSTRUCTIONS_TEMPLATE, O as src_default$4, d as sharedSkillsRoot, f as skillDeploymentStatus, i as mcpConvergenceBlockers, k as pluralize, l as isAuraOwnedSkillTarget, m as planSharedSkillTreeUpdate, o as planManifestMcpConvergence, p as managedContentRevisionStatus, s as planMcpServerRemoval, t as planSharedInstructionLink, u as planSkillDeployment, v as createAuraManifestWriteOperation } from "./shared-link-plan-AcSkw9bO.js";
-import { EMPTY_COLLECTION, McpWriteError, SHARED_INSTRUCTIONS_TEMPLATE_TOKEN, TIMEOUT_EXIT_CODE, collectJsonMcpServers, collectMcpServers, configStringArray, configStringRecord, defineAdapter, defineCheck, definePlugin, detectExecutable, detectLineEnding, inspectJsonMcpSecrets, isConfigRecord, isFileReference, jsonMcpEntry, jsonMcpSecretTransform, maskMarkdownCode, mcpCommandEntry, mcpEnvironmentVariableNames, mcpWriteResult, normalizeMcpServerDefinition, parseAtImports, parseConfigObject, parseInstalledSkills, parseJsonMcpConfig, redactMcpArguments, referenceTargetPath, sanitizeMcpUrl, skillDirectorySpecs, splitSourceLines, stdioTransport, writeJsonMcpServers } from "@tryaura/aura-sdk";
+import { A as displayPath, D as SHARED_INSTRUCTIONS_TEMPLATE, O as src_default$4, d as sharedSkillsRoot, f as skillDeploymentStatus, i as mcpConvergenceBlockers, k as pluralize, l as isAuraOwnedSkillTarget, m as planSharedSkillTreeUpdate, o as planManifestMcpConvergence, p as managedContentRevisionStatus, s as planMcpServerRemoval, t as planSharedInstructionLink, u as planSkillDeployment, v as createAuraManifestWriteOperation } from "./shared-link-plan-DMijyUdG.js";
+import { EMPTY_COLLECTION, McpWriteError, TIMEOUT_EXIT_CODE, collectJsonMcpServers, collectMcpServers, configStringArray, configStringRecord, defineAdapter, defineCheck, definePlugin, detectExecutable, inspectJsonMcpSecrets, isConfigRecord, isFileReference, jsonMcpEntry, jsonMcpSecretTransform, maskMarkdownCode, mcpCommandEntry, mcpEnvironmentVariableNames, mcpWriteResult, normalizeMcpServerDefinition, parseAtImports, parseConfigObject, parseInstalledSkills, parseJsonMcpConfig, redactMcpArguments, referenceTargetPath, sanitizeMcpUrl, skillDirectorySpecs, splitSourceLines, stdioTransport, writeJsonMcpServers } from "@tryaura/aura-sdk";
 import { dirname, extname, isAbsolute, join, resolve, sep } from "node:path";
 import { parse, stringify } from "smol-toml";
 import { Buffer } from "node:buffer";
@@ -27,8 +27,7 @@ const CLAUDE_CODE_SOURCE_IDS = Object.freeze({
 	settingsGlobal: "claude-code.settings.global",
 	settingsLocal: "claude-code.settings.local",
 	settingsProject: "claude-code.settings.project",
-	skillsGlobal: "claude-code.skills.global",
-	skillsProject: "claude-code.skills.project"
+	skillsGlobal: "claude-code.skills.global"
 });
 const CLAUDE_CODE_ADAPTER_ID = "claude-code";
 /** Metadata key holding {@link ClaudePermissions}. */
@@ -185,9 +184,6 @@ const GLOBAL_INSTRUCTIONS_SEGMENTS = Object.freeze([".claude", "CLAUDE.md"]);
 const SKILL_DIRECTORIES$1 = Object.freeze([{
 	entryPath: "~/.claude/skills",
 	id: CLAUDE_CODE_SOURCE_IDS.skillsGlobal
-}, {
-	entryPath: "./.claude/skills",
-	id: CLAUDE_CODE_SOURCE_IDS.skillsProject
 }]);
 const claudeCodeAdapter = defineAdapter({
 	capabilities: {
@@ -236,11 +232,6 @@ const claudeCodeAdapter = defineAdapter({
 			skills: parseInstalledSkills(CLAUDE_CODE_ADAPTER_ID, input, SKILL_DIRECTORIES$1)
 		};
 	},
-	projectSharedLink: {
-		entryPath: "./CLAUDE.md",
-		kind: "import-line",
-		lineTemplate: `@${SHARED_INSTRUCTIONS_TEMPLATE_TOKEN}`
-	},
 	sharedLink: {
 		entryPath: "~/.claude/CLAUDE.md",
 		kind: "symlink"
@@ -357,7 +348,7 @@ function claudeFiles(input) {
 //#region ../../plugins/adapter-claude-code/src/index.ts
 var src_default$3 = definePlugin({
 	adapters: [claudeCodeAdapter],
-	apiVersion: 1,
+	apiVersion: 2,
 	id: "adapter-claude-code",
 	name: "Claude Code Adapter",
 	version: "0.0.0"
@@ -1506,7 +1497,7 @@ function instructionLevel(directory, id, scope) {
 //#region ../../plugins/adapter-codex/src/index.ts
 var src_default$2 = definePlugin({
 	adapters: [codexAdapter],
-	apiVersion: 1,
+	apiVersion: 2,
 	id: "adapter-codex",
 	name: "Codex Adapter",
 	version: "0.0.0"
@@ -1934,7 +1925,7 @@ function isRuleSourceId(id) {
 //#region ../../plugins/adapter-cursor/src/index.ts
 var src_default$1 = definePlugin({
 	adapters: [cursorAdapter],
-	apiVersion: 1,
+	apiVersion: 2,
 	id: "adapter-cursor",
 	name: "Cursor Adapter",
 	version: "0.0.0"
@@ -1990,40 +1981,28 @@ function authenticationHint(appId, displayName) {
 	}
 }
 //#endregion
-//#region ../../plugins/checks-core/src/gitignore-block.ts
+//#region ../../plugins/checks-core/src/env-003-legacy.ts
 const BEGIN = "# aura:begin ENV-003";
 const END = "# aura:end ENV-003";
-const MANAGED_LINES = [
-	BEGIN,
-	"# Managed by Aura. Personal agent state stays local; team configuration stays shareable.",
-	"/.claude/settings.local.json",
-	"/.claude/skills/",
-	"!/AGENTS.md",
-	"!/CLAUDE.md",
-	"!/.mcp.json",
-	END
-];
-/** Replaces Aura's gitignore block and moves it last so its negations take precedence. */
-function reconcileGitignoreBlock(source) {
-	const lines = [...splitSourceLines(source)];
-	if (lines.some((line) => isMalformedMarker(line.text))) return;
-	const begins = lines.filter((line) => line.text === BEGIN);
-	const ends = lines.filter((line) => line.text === END);
-	if (begins.length > 1 || ends.length > 1 || begins.length !== ends.length) return;
-	let unmanaged = source;
-	if (begins.length === 1 && ends.length === 1) {
-		const begin = begins[0];
-		const end = ends[0];
-		if (begin === void 0 || end === void 0 || end.start < begin.start) return;
-		unmanaged = source.slice(0, begin.start) + source.slice(end.end);
-	}
-	const lineEnding = detectLineEnding(unmanaged);
-	const separator = unmanaged.length === 0 || unmanaged.endsWith("\n") ? "" : lineEnding;
-	return `${unmanaged}${separator}${MANAGED_LINES.join(lineEnding)}${lineEnding}`;
+/**
+* Finds the managed block earlier Aura releases wrote into a repository's `.gitignore`.
+*
+* Aura used to maintain this block itself and no longer writes to repository files at all. Left
+* unmentioned, the markers are the worst of both: they carry Aura's name, so a reader assumes Aura
+* still keeps them current, and nothing ever will. Naming them once is what lets someone decide to
+* keep the rules as their own or delete them.
+*
+* A lone marker counts. A half-removed block is still a block somebody has to finish removing, and
+* the reconciler that used to repair one is gone.
+*/
+function abandonedBlock(gitignore) {
+	const markers = new Set([...splitSourceLines(gitignore.content ?? "")].map((line) => line.text.trim()).filter((text) => text === BEGIN || text === END));
+	if (markers.size === 0) return;
+	return markers.has(BEGIN) && markers.has(END) ? "complete" : "partial";
 }
-function isMalformedMarker(line) {
-	const normalized = line.trim();
-	return normalized.startsWith(BEGIN) && normalized !== BEGIN || normalized.startsWith(END) && normalized !== END || (normalized === BEGIN || normalized === END) && line !== normalized;
+/** How the block is described to the person who now owns it. */
+function abandonedBlockDetail(gitignorePath, block) {
+	return `${block === "complete" ? `The block runs from \`${BEGIN}\` to \`${END}\`.` : `One of the \`${BEGIN}\` / \`${END}\` markers is present without the other, so the block was already partly removed.`} Aura wrote it in an earlier release and no longer maintains it. Its rules are still valid Git rules, so keeping them is fine — delete the two marker comments so nothing implies Aura owns them, or delete the whole block. One of its rules, \`/.claude/skills/\`, ignored the per-project skill links Aura also no longer creates; if ${join(dirname(gitignorePath), ".claude", "skills")} still holds symlinks into your home directory, they are leftovers you can remove.`;
 }
 //#endregion
 //#region ../../plugins/checks-core/src/env-003.ts
@@ -2040,9 +2019,8 @@ const env003 = defineCheck({
 	detect: (model) => detectGitignoreFindings(model),
 	explain: `Personal agent overrides should stay out of version control, while shared instruction and MCP configuration should remain commit-ready. Aura evaluates the repository's root .gitignore together with .git/info/exclude, using Git-style pattern semantics including negations and rule order. Nested .gitignore files and a global core.excludesFile are not read, so \`git check-ignore -v <path>\` is the authority whenever the two disagree.
 
-The automatic fix maintains a final ENV-003 block in the root .gitignore, and only ever adds rules for agent-owned paths. If a personal file was already tracked, ignore rules cannot remove it from the index; review it, then run \`git rm --cached -- <path>\` manually.`,
-	fix: (finding, model) => fixGitignore(finding, model),
-	fixability: "auto",
+Aura never edits repository files. Update the root .gitignore manually if this policy does not match, and use \`git check-ignore -v <path>\` to verify the result. If a personal file was already tracked, ignore rules cannot remove it from the index; review it, then run \`git rm --cached -- <path>\` manually. Earlier releases maintained an \`# aura:begin ENV-003\` block in this file; Aura no longer writes or repairs it, and reports it once so the rules become yours rather than something carrying Aura's name that nothing updates.`,
+	fixability: "manual",
 	id: "ENV-003",
 	scope: "project",
 	title: "Repository ignore rules separate personal and shared agent state"
@@ -2059,10 +2037,21 @@ function detectGitignoreFindings(model) {
 	}];
 	return [
 		...policyFindings(repository),
-		...malformedBlockFindings(repository.gitignore),
+		...abandonedBlockFindings(repository.gitignore),
 		...trackedPersonalFindings(repository.trackedAgentPaths ?? [])
 	];
 }
+function abandonedBlockFindings(gitignore) {
+	const block = abandonedBlock(gitignore);
+	return block === void 0 ? [] : [{
+		details: abandonedBlockDetail(gitignore.path, block),
+		fixability: "manual",
+		id: "managed-block-abandoned",
+		locations: [{ path: gitignore.path }],
+		message: "An earlier Aura release left a managed block in this repository's .gitignore.",
+		severity: "info"
+	}];
+}
 function policyFindings(repository) {
 	const infoExclude = repository.infoExclude;
 	if (infoExclude?.problem !== void 0) return [{
@@ -2086,15 +2075,6 @@ function policyFindings(repository) {
 		}
 	}];
 }
-function malformedBlockFindings(gitignore) {
-	return reconcileGitignoreBlock(gitignore.content ?? "") === void 0 ? [{
-		details: "Repair the duplicate, incomplete, reversed, suffixed, or indented ENV-003 markers before running the automatic fix again.",
-		fixability: "manual",
-		id: "managed-block-malformed",
-		locations: [{ path: gitignore.path }],
-		message: "Aura's managed ENV-003 block has malformed markers."
-	}] : [];
-}
 function trackedPersonalFindings(paths) {
 	return paths.flatMap((path) => PERSONAL_PATHS.includes(path) ? [{
 		details: `Review the file, then run \`git rm --cached -- ${shellArgument(path)}\` if it should remain local.`,
@@ -2120,21 +2100,6 @@ function shellArgument(value) {
 function policyDetail(personalNotIgnored, shareableIgnored) {
 	return [...personalNotIgnored.length === 0 ? [] : [`Personal paths not ignored: ${personalNotIgnored.join(", ")}.`], ...shareableIgnored.length === 0 ? [] : [`Shareable paths currently ignored: ${shareableIgnored.join(", ")}.`]].join(" ");
 }
-function fixGitignore(finding, model) {
-	if (finding.id !== "gitignore-policy") return;
-	const gitignore = model.repository?.gitignore;
-	if (gitignore === void 0 || gitignore.problem !== void 0) return;
-	const content = reconcileGitignoreBlock(gitignore.content ?? "");
-	if (content === void 0) return;
-	return {
-		operations: [{
-			content,
-			path: gitignore.path,
-			type: "write"
-		}],
-		summary: "Update Aura's managed agent-file rules in .gitignore."
-	};
-}
 //#endregion
 //#region ../../plugins/checks-core/src/env-004.ts
 const RESTRICTIVE_MODES = /* @__PURE__ */ new Set(["plan", "dontAsk"]);
@@ -2161,7 +2126,7 @@ function detectConflicts(model) {
 function claudeFindings(app) {
 	const effective = readClaudePermissionMode(app);
 	if (effective === void 0 || !RESTRICTIVE_MODES.has(effective.mode)) return [];
-	const path = sourcePath$1(app, effective.sourceId);
+	const path = sourcePath$2(app, effective.sourceId);
 	return [{
 		details: effective.mode === "plan" ? "Plan mode prevents source edits and most commands. Choose a normal working mode if this was not intentional." : "dontAsk denies tools that were not pre-approved, which can make requests stop without a permission prompt.",
 		id: `claude-permission-mode:${effective.mode}`,
@@ -2177,7 +2142,7 @@ function claudeFindings(app) {
 function codexFindings(app) {
 	const trust = readCodexProjectTrust(app) ?? "unknown";
 	if (trust === "trusted" || trust === "unreadable") return [];
-	const path = sourcePath$1(app, CODEX_SOURCE_IDS.mcp);
+	const path = sourcePath$2(app, CODEX_SOURCE_IDS.mcp);
 	return [{
 		details: trust === "untrusted" ? "Codex explicitly marks this project untrusted and skips its project-scoped configuration." : "Codex has no trusted entry for this working directory or its primary Git checkout, so project-scoped configuration may be unavailable until trust is confirmed.",
 		id: `codex-project-trust:${trust}`,
@@ -2190,7 +2155,7 @@ function codexFindings(app) {
 		}
 	}];
 }
-function sourcePath$1(app, sourceId) {
+function sourcePath$2(app, sourceId) {
 	return app.sourceFiles.find((file) => file.spec.id === sourceId)?.spec.path;
 }
 function guidedFix$2(finding, model) {
@@ -4222,10 +4187,10 @@ function sourceId(scope, tool) {
 /** Reads back {@link sourceId}, ignoring the index {@link legacyFiles} appends per project base. */
 function entryForSourceId(id) {
 	const [prefix, scope, tool] = id.split(".");
-	if (prefix !== "legacy-instructions" || !isScope$1(scope)) return;
+	if (prefix !== "legacy-instructions" || !isScope(scope)) return;
 	return INVENTORY_FILES.find((file) => file.tool === tool);
 }
-function isScope$1(value) {
+function isScope(value) {
 	return SCOPES.some((scope) => scope === value);
 }
 //#endregion
@@ -4397,11 +4362,11 @@ function desiredMcpTargets(model) {
 	const result = /* @__PURE__ */ new Map();
 	for (const server of [...manifest.value.mcpServers, ...model.requiredMcpServers ?? []]) for (const appId of server.apps) {
 		if (!detected.has(appId) || manifest.value.apps[appId]?.managed !== true) continue;
-		result.set(`${appId}\0${server.scope}\0${server.name}`, {
+		result.set(`${appId}\0${server.name}`, {
 			appId,
 			name: server.name,
 			..."requiredBy" in server && typeof server.requiredBy === "string" ? { requiredBy: server.requiredBy } : {},
-			scope: server.scope,
+			scope: "global",
 			transport: server.transport
 		});
 	}
@@ -4423,15 +4388,6 @@ function unusableFor(model, target) {
 function configuredFor(model, target) {
 	return model.mcpServers.filter((server) => server.appId === target.appId && server.name === target.name && server.scope === target.scope);
 }
-/**
-* Whether MCP-005, rather than MCP-001, owns this target's absent expected-scope entry.
-*
-* Takes the desired list rather than deriving it: the caller evaluates this once per target, and
-* recomputing the manifest's selection inside that loop rebuilt the whole list every time.
-*/
-function hasMisplacedServerFor(model, desired, target) {
-	return model.mcpServers.some((server) => server.appId === target.appId && server.name === target.name && server.scope !== target.scope && !desired.some((candidate) => candidate.appId === server.appId && candidate.name === server.name && candidate.scope === server.scope));
-}
 /** Turns one application's convergence blockers into findings a user can act on. */
 function blockerFindings(appId, blockers) {
 	return blockers.map((blocker, index) => ({
@@ -4451,7 +4407,9 @@ function blockerFindings(appId, blockers) {
 * Downgrades findings whose application cannot converge, optionally reporting why.
 *
 * Only one check reports the blockers themselves. Both would describe the same obstruction in the
-* same words, and a user reading two copies has to work out that it is one problem.
+* same words, and a user reading two copies has to work out that it is one problem. Where MCP-001
+* and MCP-005 do both fire for one server, they describe two different remedies and each names the
+* other, which is the distinction this rule turns on.
 */
 function withBlockers(findings, affected, model, options) {
 	const blockers = /* @__PURE__ */ new Map();
@@ -4503,7 +4461,7 @@ function detectParity(model) {
 		const names = desiredByApp.get(target.appId) ?? /* @__PURE__ */ new Set();
 		names.add(target.name);
 		desiredByApp.set(target.appId, names);
-		const finding = parityFinding(model, desired, target);
+		const finding = parityFinding(model, target);
 		if (finding !== void 0) {
 			affected.add(target.appId);
 			findings.push(finding);
@@ -4524,7 +4482,7 @@ function managedApps(model) {
 * conflating them produces the contradiction of Aura offering to add a name that is already in the
 * file — where the write then refuses because it does not own it.
 */
-function parityFinding(model, desired, target) {
+function parityFinding(model, target) {
 	const unusable = unusableFor(model, target);
 	if (unusable !== void 0) return {
 		details: unusable.reason === "disabled" ? "The entry is present but turned off, so the application does not start it. Aura will not enable a server someone switched off." : "The entry is present in a form Aura does not recognize, so it cannot tell whether the application runs it.",
@@ -4538,8 +4496,10 @@ function parityFinding(model, desired, target) {
 			sourceId: unusable.sourceId
 		}
 	};
-	if (hasMisplacedServerFor(model, desired, target)) return;
-	return configuredFor(model, target).length > 0 ? void 0 : {
+	if (configuredFor(model, target).length > 0) return;
+	const elsewhere = elsewhereDetail(model, target);
+	return {
+		...elsewhere === void 0 ? {} : { details: elsewhere },
 		id: `missing:${target.appId}:${target.name}`,
 		message: `MCP server ${target.name} is missing from ${target.appId}.`,
 		metadata: {
@@ -4551,6 +4511,21 @@ function parityFinding(model, desired, target) {
 	};
 }
 /**
+* Says where else the name already appears, so this finding and MCP-005 read as one problem.
+*
+* Aura converges only the global target, so an entry the application keeps somewhere else leaves
+* both checks with something true to say: this one that the global entry is absent, MCP-005 that
+* the entry it found is not the one Aura manages. Read side by side without this line, "is missing
+* from claude-code" and "is configured in /workspace/.mcp.json" look like a contradiction.
+*/
+function elsewhereDetail(model, target) {
+	const paths = [...new Set(model.mcpServers.filter((server) => server.appId === target.appId && server.name === target.name).map((server) => sourcePath$1(model, server) ?? `${server.scope} configuration`))];
+	return paths.length === 0 ? void 0 : `The name is already configured in ${paths.join(", ")}, which is not the file Aura converges. Adding the global entry here does not remove that one; MCP-005 reports it separately.`;
+}
+function sourcePath$1(model, server) {
+	return model.apps.find((app) => app.adapterId === server.appId)?.sourceFiles.find((file) => file.spec.id === server.sourceId)?.spec.path;
+}
+/**
 * Names Aura still owns that desired state no longer selects.
 *
 * Ownership for an application this scan did not detect is skipped: Aura cannot converge what is
@@ -4767,7 +4742,7 @@ function unsetEnvironmentFindings(model) {
 			metadata: {
 				kind: "environment",
 				serverName: server.name,
-				serverScope: server.scope,
+				serverScope: "global",
 				variableName
 			},
 			severity: "info"
@@ -4837,7 +4812,7 @@ function removeChoice(server, model) {
 }
 function manualRemoval(server, model, blockers) {
 	const path = sourcePath(server, model) ?? "the application's MCP configuration file";
-	const selected = model.manifest.status === "ready" && model.manifest.value.mcpServers.some((entry) => entry.name === server.name && entry.scope === server.scope && entry.apps.includes(server.appId));
+	const selected = model.manifest.status === "ready" && model.manifest.value.mcpServers.some((entry) => entry.name === server.name && entry.apps.includes(server.appId));
 	return {
 		manualSteps: [
 			...blockers,
@@ -4908,156 +4883,24 @@ function isPlacedAt(app, server, target) {
 	const canonical = scopeTarget(app, target.scope);
 	return canonical === void 0 || canonical.spec.id === server.sourceId;
 }
-function isScope(value) {
-	return value === "global" || value === "project";
-}
-//#endregion
-//#region ../../plugins/checks-core/src/mcp-005-fix.ts
-const RERUN = "Run `aura check --only MCP-005` again.";
-function placementFix(finding, model) {
-	const resolved = resolveFinding(finding, model);
-	if (resolved === void 0) return;
-	const { app, server, target } = resolved;
-	const blockers = mcpConvergenceBlockers(model, server.appId);
-	const obstruction = moveObstruction(model, app, server, target, blockers.length > 0);
-	return obstruction === void 0 ? movePlan(model, app, server, target) : manualMove(model, resolved, obstruction, blockers.map((blocker) => blocker.message));
-}
-/**
-* The application-wide convergence write, re-summarized as the move this finding asked for.
-*
-* Converging writes every managed server for the application, not only this one. The summary is
-* what the interactive chooser shows, so it names the move the user selected rather than repeating
-* the planner's own description for every finding on the same application.
-*/
-function movePlan(model, app, server, target) {
-	const plan = planManifestMcpConvergence(model, server.appId).plan;
-	return plan === void 0 ? void 0 : {
-		...plan,
-		summary: `Move MCP server ${server.name} into ${app.displayName}'s ${target.scope} MCP configuration.`
-	};
-}
-function moveObstruction(model, app, server, target, blocked) {
-	if (scopeTarget(app, target.scope) === void 0) return "no-destination";
-	if (model.manifest.status !== "ready" || model.manifest.value.ownership[server.appId]?.mcpServerNames.includes(server.name) !== true) return "unowned";
-	if (scopeTarget(app, server.scope)?.spec.id !== server.sourceId) return "non-canonical-source";
-	return blocked ? "blocked" : void 0;
-}
-function manualMove(model, resolved, obstruction, blockers) {
-	const { app, server, target } = resolved;
-	const source = sourceFile(app, server.sourceId)?.spec.path;
-	if (obstruction === "no-destination" && target.scope === "project") return unsupportedProjectScope(model, resolved, source, blockers);
-	return {
-		manualSteps: [
-			...blockers,
-			obstructionStep(app, server, obstruction),
-			...moveSteps(model, resolved, source, scopeTarget(app, target.scope)?.spec.path),
-			RERUN
-		],
-		operations: [],
-		summary: `Move MCP server ${server.name} into ${app.displayName}'s ${target.scope} MCP configuration manually.`
-	};
-}
-function obstructionStep(app, server, obstruction) {
-	switch (obstruction) {
-		case "blocked": return `Aura did not rewrite ${app.displayName}'s MCP configuration, because it cannot converge that configuration safely.`;
-		case "no-destination": return `Aura cannot tell which file holds ${app.displayName}'s global MCP configuration, so it did not move server ${server.name} itself.`;
-		case "non-canonical-source": {
-			const canonical = scopeTarget(app, server.scope)?.spec.path;
-			return `Aura rewrites only ${canonical === void 0 ? `the ${server.scope}-scope entries it manages for ${app.displayName}` : `the ${server.scope}-scope entries it manages for ${app.displayName} in ${canonical}`}, and server ${server.name} is not one of them.`;
-		}
-		case "unowned": return `MCP server ${server.name} is outside Aura's ownership ledger, so Aura did not change any configuration file.`;
-	}
-}
-/**
-* How to complete the move by hand.
-*
-* One step when both ends are the same file: an application can separate scopes inside a single
-* document — `~/.claude.json` holds Claude Code's global servers and its per-directory ones — and
-* "remove it from this file, then add it to this file" is not an instruction anyone can follow.
-*/
-function moveSteps(model, resolved, source, destination) {
-	const { app, server, target } = resolved;
-	if (source !== void 0 && source === destination) return [`Move MCP server ${server.name} within ${source} into the entries ${app.displayName} applies at ${target.scope} scope, using its transport definition in ${model.manifest.path}.`];
-	return [`Remove MCP server ${server.name} from ${source ?? scopeLabel(app, server.scope)}.`, `Add MCP server ${server.name} to ${destination ?? scopeLabel(app, target.scope)} using its transport definition in ${model.manifest.path}.`];
-}
-function unsupportedProjectScope(model, resolved, source, blockers) {
-	const { app, server } = resolved;
-	return {
-		manualSteps: [
-			...blockers,
-			`${app.displayName} has no project-scope MCP configuration target, so Aura cannot move server ${server.name} out of ${source ?? scopeLabel(app, server.scope)}.`,
-			`Either change server ${server.name} to global scope in ${model.manifest.path}, or remove ${server.appId} from that server's apps and configure a supported team distribution manually.`,
-			RERUN
-		],
-		operations: [],
-		summary: `Resolve MCP server ${server.name}'s unsupported project scope manually.`
-	};
-}
-function scopeLabel(app, scope) {
-	return `${app.displayName}'s ${scope} MCP configuration`;
-}
-function resolveFinding(finding, model) {
-	if (finding.checkId !== "MCP-005") return;
-	const identity = placementIdentity(finding);
-	if (identity === void 0) return;
-	const app = appFor(model, identity.appId);
-	const server = model.mcpServers.find((candidate) => matchesServer(candidate, identity));
-	const target = desiredMcpTargets(model).find((candidate) => matchesTarget(candidate, identity));
-	return app === void 0 || server === void 0 || target === void 0 ? void 0 : {
-		app,
-		server,
-		target
-	};
-}
-function placementIdentity(finding) {
-	const appId = stringMetadata(finding, "appId");
-	const name = stringMetadata(finding, "serverName");
-	const sourceId = stringMetadata(finding, "sourceId");
-	const actualScope = scopeMetadata(finding, "actualScope");
-	const expectedScope = scopeMetadata(finding, "expectedScope");
-	if (appId === void 0 || name === void 0 || sourceId === void 0 || actualScope === void 0 || expectedScope === void 0) return;
-	return {
-		actualScope,
-		appId,
-		expectedScope,
-		name,
-		sourceId
-	};
-}
-function matchesServer(server, identity) {
-	return server.appId === identity.appId && server.name === identity.name && server.sourceId === identity.sourceId && server.scope === identity.actualScope;
-}
-function matchesTarget(target, identity) {
-	return target.appId === identity.appId && target.name === identity.name && target.scope === identity.expectedScope;
-}
-function stringMetadata(finding, key) {
-	const value = finding.metadata?.[key];
-	return typeof value === "string" ? value : void 0;
-}
-function scopeMetadata(finding, key) {
-	const value = finding.metadata?.[key];
-	return isScope(value) ? value : void 0;
-}
 const mcp005 = defineCheck({
 	defaultSeverity: "warn",
 	detect: detectScopePlacement,
-	explain: `The Aura manifest distinguishes personal MCP servers from team servers. Personal servers belong in global configuration; putting one in repository configuration can publish it to teammates through source control. Team servers belong in project configuration; keeping one only in personal configuration means teammates do not receive it and their setup drifts. Placement is judged by the file an entry is written in, not by the scope label alone, because an application can keep both kinds in one document.
+	explain: `Aura-managed MCP servers are personal and belong in global application configuration. Repository MCP files remain visible to diagnostics, but Aura never edits or removes their entries.
 
-Re-run with \`--fix\` to move an Aura-owned entry through the same manifest convergence and undo machinery as other MCP fixes. Aura never removes a name outside its ownership ledger automatically.`,
-	fix: placementFix,
-	fixability: "guided",
+Every finding here is yours to resolve, because the only remaining move is in a file Aura will not write. MCP-001 reports the global entry that is missing and can add it for you; this check reports the entry left behind, which you remove by hand once you no longer want it there.`,
+	fixability: "manual",
 	id: MCP_005_ID,
 	scope: "global",
-	title: "Managed MCP servers use their manifest scope"
+	title: "Managed MCP servers use global configuration"
 });
 function detectScopePlacement(model) {
 	const desired = desiredMcpTargets(model);
 	return model.mcpServers.flatMap((server) => {
 		const app = appFor(model, server.appId);
-		const targets = desired.filter((target) => target.appId === server.appId && target.name === server.name);
-		if (app === void 0 || targets.length === 0 || targets.some((target) => isPlacedAt(app, server, target))) return [];
-		const target = targets.find((candidate) => candidate.scope === server.scope) ?? targets[0];
-		return target === void 0 ? [] : [placementFinding(app, server, target)];
+		const target = desired.find((candidate) => candidate.appId === server.appId && candidate.name === server.name);
+		if (app === void 0 || target === void 0 || isPlacedAt(app, server, target)) return [];
+		return [placementFinding(app, server, target)];
 	});
 }
 function placementFinding(app, server, target) {
@@ -5065,14 +4908,14 @@ function placementFinding(app, server, target) {
 	const destination = scopeTarget(app, target.scope)?.spec.path;
 	const locations = [...new Set([source?.path, destination].filter((path) => path !== void 0))];
 	return {
-		details: placementDetails(app, source?.scope ?? server.scope, target.scope, destination),
-		id: `${server.appId}:${server.sourceId}:${server.name}:${server.scope}-to-${target.scope}`,
+		details: placementDetails(app, source?.scope ?? server.scope, destination),
+		fixability: "manual",
+		id: `${server.appId}:${server.sourceId}:${server.name}:${server.scope}-to-global`,
 		...locations.length === 0 ? {} : { locations: locations.map((path) => ({ path })) },
-		message: `${target.scope === "global" ? "Personal" : "Team"} MCP server ${server.name} for ${app.displayName} is configured in ${source?.path ?? `${app.displayName}'s ${server.scope} MCP configuration`}.`,
+		message: `Personal MCP server ${server.name} for ${app.displayName} is configured in ${source?.path ?? `${app.displayName}'s ${server.scope} MCP configuration`}.`,
 		metadata: {
 			actualScope: server.scope,
 			appId: server.appId,
-			expectedScope: target.scope,
 			serverName: server.name,
 			sourceId: server.sourceId
 		}
@@ -5086,10 +4929,9 @@ function placementFinding(app, server, target) {
 * and saying it could is the one thing that would send someone looking through their repository
 * for a leak that is not there.
 */
-function placementDetails(app, sourceScope, targetScope, destination) {
-	const belongs = destination === void 0 ? `It belongs in ${app.displayName}'s ${targetScope} MCP configuration.` : `It belongs in ${destination}.`;
-	if (targetScope === "global") return sourceScope === "project" ? `The manifest marks this as a personal server, and that file is inside the repository, where it can be committed and shared with teammates. ${belongs}` : `The manifest marks this as a personal server, but that entry applies only where it is configured rather than wherever ${app.displayName} runs. ${belongs}`;
-	return sourceScope === "project" ? `The manifest marks this as a team server, but that is not the repository file ${app.displayName} reads for shared servers, so teammates do not receive it. ${belongs}` : `The manifest marks this as a team server, and that file is personal to you, so teammates do not receive it and their setup can drift. ${belongs}`;
+function placementDetails(app, sourceScope, destination) {
+	const belongs = destination === void 0 ? `It belongs in ${app.displayName}'s global MCP configuration.` : `It belongs in ${destination}.`;
+	return sourceScope === "project" ? `This server is declared in repository configuration. Aura will not edit that file. ${belongs} MCP-001 reports the missing global entry and can add it with \`aura check --fix\`; remove the repository entry by hand once you no longer want it there.` : `This personal server is not in the global configuration target Aura manages. ${belongs} MCP-001 reports the missing global entry and can add it with \`aura check --fix\`; remove this entry by hand once you no longer want it there.`;
 }
 //#endregion
 //#region ../../plugins/checks-core/src/skl-001.ts
@@ -5311,25 +5153,20 @@ function brokenLinkFix(finding, model) {
 const skl004 = defineCheck({
 	defaultSeverity: "error",
 	detect: detectInvocationCollisions,
-	explain: "Two skill entries in one scope of one application must not expose the same invocation name. Otherwise the application cannot offer a stable, unambiguous invocation target. A project skill and a global skill sharing a name is not a collision: applications resolve project skills first, so the project entry deliberately shadows the global one.\n\nRename a skill and its directory together, or remove the entry the application should not load.",
+	explain: "Two skill entries in one application must not expose the same invocation name. Otherwise the application cannot offer a stable, unambiguous invocation target.\n\nRename a skill and its directory together, or remove the entry the application should not load.",
 	fix: guidedCollisionRepair,
 	fixability: "guided",
 	id: "SKL-004",
 	scope: "global",
-	title: "Skill invocation names are unique per application scope"
+	title: "Skill invocation names are unique per application"
 });
 /**
-* Groups by application *and scope*.
-*
-* Deploying one shared skill to every directory an application declares is the intended outcome of
-* SKL-002, and Claude Code declares both a global and a project directory. Grouping across scopes
-* would make SKL-002's own fix raise an error here and tell the user to delete one of the two links
-* Aura had just created.
+* Groups by application because every managed skill directory is global.
 */
 function detectInvocationCollisions(model) {
 	const groups = /* @__PURE__ */ new Map();
 	for (const skill of model.skills) {
-		const key = `${skill.appId}\0${skill.scope}\0${skill.invocationName ?? skill.name}`;
+		const key = `${skill.appId}\0${skill.invocationName ?? skill.name}`;
 		const group = groups.get(key);
 		if (group === void 0) groups.set(key, [skill]);
 		else group.push(skill);
@@ -5342,13 +5179,12 @@ function detectInvocationCollisions(model) {
 		const invocationName = first.invocationName ?? first.name;
 		findings.push({
 			details: group.map((skill) => `${skill.path} (${skill.sourceId ?? "unknown skill source"})`).join("\n"),
-			id: `${first.appId}:${first.scope}:${invocationName}`,
+			id: `${first.appId}:${invocationName}`,
 			locations: group.map((skill) => ({ path: skill.path })),
-			message: `${first.appId} has ${String(group.length)} ${first.scope} skills named "${invocationName}".`,
+			message: `${first.appId} has ${String(group.length)} skills named "${invocationName}".`,
 			metadata: {
 				appId: first.appId,
-				invocationName,
-				scope: first.scope
+				invocationName
 			}
 		});
 	}
@@ -5367,7 +5203,7 @@ function guidedCollisionRepair(finding) {
 //#region src/plugins.ts
 const checksCorePlugin = definePlugin({
 	adapters: [legacyInstructionsAdapter],
-	apiVersion: 1,
+	apiVersion: 2,
 	checks: [
 		env001,
 		env002,