@aligndottech/cli 0.48.0 → 0.50.0

package/dist/commands/setup.js

@@ -16,13 +16,15 @@ import { createLocalDb } from '../lib/local-db.js';
 import { buildFoundSummary, renderFoundSummary } from '../lib/found-summary.js';
 import { createCaptureCollector, toCaptureSource } from '../lib/capture-report.js';
 import { CAPTURE_SOURCES } from '../lib/capture-sources.js';
-import { IMPORT_LIMITS, SLACK_DAYS_BACK } from '../lib/import-defaults.js';
+import { GIT_DEFAULT_LIMIT, SYNC_CEILINGS, SYNC_WINDOW_DEFAULT_DAYS } from '../lib/import-defaults.js';
+import { fetchWindow, parseSince, windowExtras, windowLabel } from '../lib/since.js';
 import { initLocalMode } from '../lib/local-mode.js';
+import { afterSourceConnected } from '../lib/sync/after-connect.js';
+import { connectScopeCtx, fetchUnderScope } from '../lib/scope-connect.js';
 import { loginInteractive } from '../lib/login-flow.js';
 import { resolveAppUrl } from '../lib/env-resolver.js';
 import { collectTokensViaOAuth, oauthFlowLabel } from '../lib/personal-oauth.js';
 import { isAuthExpiry } from '../lib/errors.js';
-import { maybeRequestTelemetryConsent } from '../lib/telemetry-consent.js';
 import { commandIntro } from '../lib/brand.js';
 import pkg from '../../package.json' with { type: 'json' };
 const { version } = pkg;
@@ -30,18 +32,19 @@ import { printBanner } from '../lib/brand.js';
 import { guardedPrompt } from '../lib/prompt-guard.js';
 import { setupSummaryLine, unresolvedGaps } from '../lib/connect-prompt.js';
 import { createSetupFunnel } from '../lib/setup-funnel.js';
-import { agentAskLine, agentConnectedLine, orderAgents, projectAgentsFromWritten } from '../lib/next-step.js';
+import { agentAskLine, agentConnectedLine, firstQuestion, orderAgents, projectAgentsFromWritten } from '../lib/next-step.js';
 import { projectForeignNotice } from '../lib/foreign-env.js';
 import { PICK_CANCELLED, pickAgent } from '../lib/launch/pick-agent.js';
 import { InvalidEnvError, routeSetup } from '../lib/setup-route.js';
 import { agentByName } from '../lib/launch/agents.js';
+import { launchesAfterWizard } from '../lib/launch/launch.js';
+import { PROVIDER_LABEL, STORABLE_PROVIDERS } from '../lib/llm-providers.js';
 import { firstDecision } from '../lib/first-decision.js';
-import { hasConfiguredProvider } from '../lib/local-llm.js';
 const TIER_ORDER = { personal: 0, site: 1, workspace: 2 };
 // How many connectors import concurrently after auth. Each import is itself
 // batch-parallel (runPersonalImport), so this bounds total gateway load.
 const IMPORT_CONCURRENCY = 4;
-function buildSources(gitAvailable) {
+export function buildSources(gitAvailable) {
     const sources = [];
     if (gitAvailable) {
         sources.push({
@@ -50,7 +53,8 @@ function buildSources(gitAvailable) {
             description: 'Commit history from this repo - no token needed',
             fetch: async () => {
                 const { fetchGitItems } = await import('../lib/fetchers/git.js');
-                return fetchGitItems({ limit: IMPORT_LIMITS.git });
+                // The newest commits however old, as before the window (GIT_DEFAULT_LIMIT); only --since changes it.
+                return fetchGitItems({ limit: GIT_DEFAULT_LIMIT });
             },
         });
     }
@@ -72,14 +76,12 @@ function buildSources(gitAvailable) {
             '&description=Read-only+import+of+your+PRs+and+issues+into+your+local+Align+graph' +
             '&expires_in=90' +
             '&contents=read&issues=read&pull_requests=read',
-        fetch: async (t) => {
+        fetch: async (t, w = parseSince(undefined), o = {}) => {
             const { fetchGitHubItems, resolveGitHubRepoScope } = await import('../lib/fetchers/github.js');
-            // ALI-917: this interactive source has no --repo/--all of its own, so it takes
-            // resolveGitHubRepoScope's auto-detect-only path (an empty opts object) - the
-            // same default `align connect github` uses. Without it, a token spanning several
-            // unrelated repos returns everything across all of them, undifferentiated.
-            const repo = await resolveGitHubRepoScope({});
-            return fetchGitHubItems({ token: t['token'], limit: IMPORT_LIMITS.github, ...(repo ? { repo } : {}) });
+            // L4: when the caller has resolved the scope (`resolved`), its `repo` is the whole answer and the folder is not consulted.
+            // Without it (cloud setup) this is ALI-917's auto-detect: the repo narrows the search, and team scope only when asked.
+            const repo = o.resolved ? o.repo : await resolveGitHubRepoScope({});
+            return fetchGitHubItems({ token: t['token'], ...fetchWindow('github', w), ...(repo ? { repo, ...(o.team || o.resolved ? { scope: 'team' } : {}) } : {}) });
         },
     }, {
         id: 'jira',
@@ -97,9 +99,9 @@ function buildSources(gitAvailable) {
             { key: 'email', label: 'Atlassian account email' },
             { key: 'domain', label: 'Atlassian domain (yourorg.atlassian.net)' },
         ],
-        fetch: async (t) => {
+        fetch: async (t, w = parseSince(undefined), o) => {
             const { fetchJiraItems } = await import('../lib/fetchers/jira.js');
-            return fetchJiraItems({ token: t['token'], cloudId: t['cloudId'], email: t['email'], domain: t['domain'], limit: IMPORT_LIMITS.jira });
+            return fetchJiraItems({ token: t['token'], cloudId: t['cloudId'], email: t['email'], domain: t['domain'], ...fetchWindow('jira', w), ...windowExtras(o) });
         },
     }, {
         id: 'confluence',
@@ -116,9 +118,9 @@ function buildSources(gitAvailable) {
             { key: 'email', label: 'Atlassian account email' },
             { key: 'domain', label: 'Atlassian domain (yourorg.atlassian.net)' },
         ],
-        fetch: async (t) => {
+        fetch: async (t, w = parseSince(undefined), o) => {
             const { fetchConfluenceItems } = await import('../lib/fetchers/confluence.js');
-            return fetchConfluenceItems({ token: t['token'], cloudId: t['cloudId'], email: t['email'], domain: t['domain'], limit: IMPORT_LIMITS.confluence });
+            return fetchConfluenceItems({ token: t['token'], cloudId: t['cloudId'], email: t['email'], domain: t['domain'], ...fetchWindow('confluence', w), ...windowExtras(o) });
         },
     }, {
         id: 'slack',
@@ -132,9 +134,9 @@ function buildSources(gitAvailable) {
         tokenLabel: 'User token (xoxp-...)',
         tokenHint: 'User token with read scopes only: channels:read, channels:history, groups:read, groups:history',
         tokenUrl: 'https://api.slack.com/apps',
-        fetch: async (t) => {
+        fetch: async (t, w = parseSince(undefined), o) => {
             const { fetchSlackItems } = await import('../lib/fetchers/slack.js');
-            return fetchSlackItems({ token: t['token'], limit: IMPORT_LIMITS.slack, daysBack: SLACK_DAYS_BACK });
+            return fetchSlackItems({ token: t['token'], ...fetchWindow('slack', w), ...windowExtras(o) });
         },
     }, {
         id: 'teams',
@@ -152,9 +154,9 @@ function buildSources(gitAvailable) {
             'The token expires after about an hour; re-run setup to paste a fresh one.',
         tokenUrl: 'https://developer.microsoft.com/en-us/graph/graph-explorer',
         tokenShortLived: true,
-        fetch: async (t) => {
+        fetch: async (t, w = parseSince(undefined), o) => {
             const { fetchTeamsItems } = await import('../lib/fetchers/teams.js');
-            return fetchTeamsItems({ token: t['token'], limit: IMPORT_LIMITS.teams });
+            return fetchTeamsItems({ token: t['token'], ...fetchWindow('teams', w), ...windowExtras(o) });
         },
     }, {
         id: 'zoom',
@@ -162,9 +164,9 @@ function buildSources(gitAvailable) {
         description: 'Cloud recording transcripts from your meetings',
         tier: 'personal',
         oauthKey: 'zoom',
-        fetch: async (t) => {
+        fetch: async (t, w = parseSince(undefined), o) => {
             const { fetchZoomItems } = await import('../lib/fetchers/zoom.js');
-            return fetchZoomItems({ token: t['token'], limit: IMPORT_LIMITS.zoom });
+            return fetchZoomItems({ token: t['token'], ...fetchWindow('zoom', w), ...windowExtras(o) });
         },
     }, {
         id: 'gitlab',
@@ -189,9 +191,9 @@ function buildSources(gitAvailable) {
         extraFields: [
             { key: 'domain', label: 'GitLab domain (leave blank for gitlab.com)' },
         ],
-        fetch: async (t) => {
+        fetch: async (t, w = parseSince(undefined), o) => {
             const { fetchGitLabItems } = await import('../lib/fetchers/gitlab.js');
-            return fetchGitLabItems({ token: t['token'], domain: t['domain'] || undefined, limit: IMPORT_LIMITS.gitlab });
+            return fetchGitLabItems({ token: t['token'], domain: t['domain'] || undefined, ...fetchWindow('gitlab', w), ...windowExtras(o) });
         },
     }, {
         id: 'linear',
@@ -209,9 +211,9 @@ function buildSources(gitAvailable) {
         // a workspace slug here, it 404s for everyone outside that workspace.
         tokenHint: 'Click Create key, then copy it here',
         tokenUrl: 'https://linear.app/settings/account/security/api-keys/new',
-        fetch: async (t) => {
+        fetch: async (t, w = parseSince(undefined), o) => {
             const { fetchLinearItems } = await import('../lib/fetchers/linear.js');
-            return fetchLinearItems({ token: t['token'], limit: IMPORT_LIMITS.linear });
+            return fetchLinearItems({ token: t['token'], ...fetchWindow('linear', w), ...windowExtras(o) });
         },
     }, {
         id: 'notion',
@@ -232,9 +234,9 @@ function buildSources(gitAvailable) {
         // landing (both resolve; this one is where the secret actually lives - Tom,
         // from a live run, 2026-08-31).
         tokenUrl: 'https://app.notion.com/developers/tokens',
-        fetch: async (t) => {
+        fetch: async (t, w = parseSince(undefined), o) => {
             const { fetchNotionItems } = await import('../lib/fetchers/notion.js');
-            return fetchNotionItems({ token: t['token'], limit: IMPORT_LIMITS.notion });
+            return fetchNotionItems({ token: t['token'], ...fetchWindow('notion', w), ...windowExtras(o) });
         },
     });
     return sources;
@@ -367,182 +369,48 @@ function writeAgentAlignment(envName) {
     }
 }
 // ---------------------------------------------------------------------------
-// Guided free-tier AI provider key (ALI-1284)
+// Saved AI provider keys
 // ---------------------------------------------------------------------------
 /**
- * ALI-1283 made BYOK mandatory for every tenant, including free/solo, retiring the
- * Align-managed LLM fallback. Before this, `align ask` without a provider key just
- * returned a ranked list with no guidance toward getting one - "bring any key" with
- * nothing pointing at where to get one fast. That is a cliff against this project's own
- * target (a useful first answer within an hour), so the guided default is Groq (no card,
- * ever; fastest free-tier inference) with Gemini Flash-Lite offered as a second key for
- * when Groq's daily request cap is hit. Both DECIDED 2026-09-24 - see the ALI-1284 ticket
- * for the free-tier limits that were checked before picking Groq+Gemini over Cerebras
- * (now needs a card for its trial) and OpenRouter's `:free` tier (tighter, weaker models).
+ * The wizard asks for no AI-provider key. It used to end on ALI-1284's guided Groq + Gemini
+ * offer, immediately before bare `align` opened the coding agent - and read in that position
+ * the keys looked like something the agent needed (a founder's own 0.48.0 run). They only
+ * serve align's own terminal `align ask` prose; inside a wrapped agent the agent writes the
+ * prose from the MCP results. `align ask` now offers a key itself, lazily, the first time it
+ * has nothing to write prose with (lib/ask-key-offer.ts), and `align ai` chooses or adds one.
  *
- * Skipped entirely, in order:
- *  - under --approve: a scripted run has no terminal to paste a key into.
- *  - when a DIFFERENT provider is already configured via env: nothing to fix, with or
- *    without --reset - this wizard only ever owns Groq and Gemini, so it must never
- *    re-open itself over someone's genuinely separate ANTHROPIC_API_KEY (Copilot review,
- *    PR #322: hasConfiguredProvider(['groq', 'gemini']) is what makes this true under
- *    --reset too, since the plain no-argument form would also count a --reset'd Groq/
- *    Gemini key hydrateProviderKeyEnv already wrote into process.env before this ran).
- *  - when a key from a PREVIOUS run of this offer is already stored, UNLESS --reset: do not
- *    re-ask every time, but give `--reset` the same "clear and redo" meaning here it already
- *    has for OAuth connectors - without this there was no way to act on the Gemini-backup
- *    documentation once Groq was stored: hydration restores the stored Groq key on every
- *    later invocation regardless of what the user unsets in their shell, so
- *    `align setup --reset` is the real (and now the documented) remedy. Declining either
- *    re-offered key under --reset CLEARS it (clearProviderKey), not just skips re-asking -
- *    otherwise a stale stored Gemini key could never actually be removed.
- *
- * Declining costs nothing - `align ask` still returns a ranked list - so every question
- * here defaults to a plain confirm the user can say no to without losing anything.
- */
-/**
- * The non-interactive half of --reset for the Groq/Gemini pair: drop whichever of them is
- * stored, so hydrateProviderKeyEnv has nothing left to re-apply on the next invocation.
- * Called unconditionally and EARLY in runSetup (Copilot review, PR #323) - not from inside
- * offerFreeProviderKey, which is reached too late and too conditionally to guarantee this:
- * runLocalConnectorPhase only calls that function when `interactive` (always false under
- * --approve, by construction - no TTY), so `align setup --local --reset --approve` never
- * reached it at all; a cloud --approve run that is not yet logged in exits even earlier.
- * Calling this before mode selection means neither path matters.
+ * What --reset keeps doing: clear every saved key and the saved provider choice, so local-llm
+ * has nothing saved to use on the next invocation, and re-arm the first-ask offer a "Not now" turned off,
+ * so the next `align ask` on a terminal offers again ("redo their setup", lazily). Called
+ * early in runSetup, before any auth/TTY-gated exit can skip it (Copilot review, PR #323).
  */
 function clearStoredProviderKeys(config) {
     // Clears the STORED (on-disk) value only, and never touches process.env (Copilot review,
-    // PR #323, "previously missed" - deeper than an earlier fix here). The earlier version
-    // deleted the env var when it equalled the stored value, reasoning that equality meant
-    // hydration had put it there. It does not: hydrateProviderKeyEnv never overwrites a real
-    // shell-exported value, so a shell that happens to export the SAME string the stored
-    // value holds (set up once, then also added to a shell profile, say) is indistinguishable
-    // from "hydration injected it" by equality alone - there is no way to tell the two apart
-    // from process.env state. Clearing the stored value is what actually matters: it is what
-    // future invocations hydrate from, so this is enough to make the backup take over on the
-    // NEXT run. The cost is that THIS run may still see the old value in its own process.env
-    // for its own remaining work - a stale-for-one-run concession, not a destroyed credential.
-    config.clearProviderKey('groq');
-    config.clearProviderKey('gemini');
-}
-async function offerFreeProviderKey(config, opts) {
-    // --approve never prompts, full stop. The non-prompting --reset clear it still needs
-    // (Copilot review, PR #323) runs unconditionally in runSetup, BEFORE mode selection -
-    // not here, because this function is reached late and conditionally: runLocalConnectorPhase
-    // only calls it when `interactive` (false under --approve by construction, so --local
-    // --reset --approve never reached it at all), and an unauthenticated cloud --approve run
-    // exits earlier still. clearStoredProviderKeys running up front means neither path matters.
-    if (opts.approve)
-        return;
-    if (!opts.reset) {
-        if (hasConfiguredProvider())
-            return;
-        if (config.getProviderKey('groq') || config.getProviderKey('gemini'))
-            return;
-    }
-    else if (hasConfiguredProvider(['groq', 'gemini'])) {
-        // --reset only concerns the Groq/Gemini pair THIS wizard manages, so skip only the
-        // stored-key guard, not the real-env one (Copilot review, PR #322): --reset must not
-        // re-open the wizard for someone who genuinely configured a DIFFERENT provider
-        // (ANTHROPIC_API_KEY, say) - that still means "nothing to fix" regardless of the flag.
-        // hydrateProviderKeyEnv (cli.ts's preAction) already wrote any stored Groq/Gemini key
-        // into process.env before this command's action started, so the plain
-        // hasConfiguredProvider() the non-reset branch uses would read a --reset'd stored
-        // value as "already configured" and never reach the re-offer at all - hence the
-        // exclusion rather than reusing that call directly.
-        return;
-    }
-    console.log('');
-    const wantGroq = await p.confirm({
-        message: `${chalk.bold('align ask')} needs an AI provider key to write prose answers ` +
-            `(without one it still returns a ranked list of matching decisions). ` +
-            `Set up a free Groq key now? No card, ever - and it's the fastest free tier.`,
-        initialValue: true,
-    });
-    // Cancel (Ctrl-C) and an explicit "no" are NOT the same thing (Copilot review, PR #322):
-    // cancelling means "stop asking me", and must never have the side effect of deleting a
-    // saved credential - unaffected by round-4's fix moving the --reset clear to the top of
-    // runSetup, which runs unconditionally before this prompt is ever reached. Round 4
-    // (Copilot review): a bare `return` here let the wizard fall through to the normal
-    // outro and report `setup_completed`, silently swallowing the cancel - inconsistent with
-    // every other top-level prompt in this file (`p.cancel(...)` + `process.exit(0)`, lines
-    // ~1208/1260). Matched here too, so Ctrl-C at this LAST step aborts the wizard rather than
-    // reporting success for a run the user explicitly cut short.
-    if (p.isCancel(wantGroq)) {
-        p.cancel('Cancelled.');
-        process.exit(0);
-    }
-    if (!wantGroq) {
-        // --reset declining Groq is the one way to make a previously stored Gemini key (or no
-        // key at all) actually take over: hydration re-applies whatever is stored on every
-        // invocation regardless of what the shell does, so "decline" has to mean "forget it",
-        // not merely "don't re-ask".
-        if (opts.reset && config.getProviderKey('groq')) {
-            // Clears only the STORED value, deliberately never process.env - see
-            // clearStoredProviderKeys's comment: equality with the stored value does not prove
-            // the current env value came from hydration rather than the user's own shell.
-            config.clearProviderKey('groq');
-            p.log.info('Cleared the saved Groq key.');
-        }
-        return;
-    }
-    p.log.info(`Get one free: ${chalk.bold('https://console.groq.com/keys')}`);
-    const groqKey = await guardedPrompt('Groq API key', () => p.password({ message: '  Groq API key:' }));
-    // Cancel here needs the same abort as the confirm above it (Copilot review, PR #323,
-    // "previously missed" - the confirm fix alone left this prompt's own Ctrl-C still
-    // falling through to the outro). `null` (guardedPrompt already warned about a crashed
-    // prompt) and an empty paste are not cancellation and keep the softer skip-and-continue.
-    if (p.isCancel(groqKey)) {
-        p.cancel('Cancelled.');
-        process.exit(0);
-    }
-    if (groqKey === null || !groqKey) {
-        // Under --reset, a plain re-run would hydrate the still-stored key and skip this offer
-        // entirely (Copilot review, PR #323, "previously missed") - pointing back at plain
-        // `align setup` here repeats the exact documentation bug this PR exists to fix.
-        const retryHint = opts.reset ? 'align setup --reset' : 'align setup';
-        p.log.warn(`No key entered - skipping. Set ${chalk.bold('GROQ_API_KEY')} yourself any time, or run ${chalk.bold(retryHint)} again.`);
-        return;
-    }
-    config.setProviderKey('groq', groqKey);
-    process.env['GROQ_API_KEY'] = groqKey; // usable immediately, this run
-    p.log.success(`Saved - ${chalk.bold('align ask')} will use it on this machine from now on.`);
-    const wantGemini = await p.confirm({
-        message: `Also add a Gemini key as backup for when Groq's daily limit is hit? (also free, no card)`,
-        initialValue: true,
-    });
-    // Same cancel/decline split as Groq above, including round 4's fix: terminate rather
-    // than fall through to the outro.
-    if (p.isCancel(wantGemini)) {
-        p.cancel('Cancelled.');
-        process.exit(0);
-    }
-    if (!wantGemini) {
-        // Symmetric with the Groq decline above: without this, clearProviderKey('gemini') had
-        // no caller anywhere, and `--reset` could remove a stored Groq key but never a stored
-        // Gemini one - so "clears saved AI provider keys" (the option's own help text) was not
-        // actually true for Gemini.
-        if (opts.reset && config.getProviderKey('gemini')) {
-            // Same reasoning as the Groq decline above: clears only the stored value.
-            config.clearProviderKey('gemini');
-            p.log.info('Cleared the saved Gemini key.');
-        }
-        return;
-    }
-    p.log.info(`Get one free: ${chalk.bold('https://aistudio.google.com/apikey')}`);
-    const geminiKey = await guardedPrompt('Gemini API key', () => p.password({ message: '  Gemini API key:' }));
-    // Same split as the Groq password prompt above.
-    if (p.isCancel(geminiKey)) {
-        p.cancel('Cancelled.');
-        process.exit(0);
+    // PR #323, "previously missed"): a key the shell exported is the user's, whatever its value.
+    // One line per key actually cleared (M3) - deleting a credential silently is the wrong
+    // default for a command people run to fix something else.
+    for (const provider of STORABLE_PROVIDERS) {
+        if (!config.getProviderKey(provider))
+            continue;
+        config.clearProviderKey(provider);
+        p.log.info(`Cleared the saved ${PROVIDER_LABEL[provider]} key.`);
     }
-    if (geminiKey === null || !geminiKey) {
-        p.log.warn('No key entered - skipping the backup.');
-        return;
+    const pref = config.getLlmPreference().provider;
+    if (pref) {
+        config.clearLlmPreference();
+        p.log.info(`Cleared your saved AI provider choice (${pref}).`);
     }
-    config.setProviderKey('gemini', geminiKey);
-    process.env['GEMINI_API_KEY'] = geminiKey;
-    p.log.success('Saved as backup.');
+    config.setAskKeyOfferDismissed(false);
+}
+/**
+ * Whether bare `align` opens the agent the moment this wizard ends. default-action.ts launches
+ * after a launchNext setup when an agent was chosen, and launchIfChosen then declines under
+ * ALIGN_WRAPPED / ALIGN_NO_LAUNCH or without a terminal - the same conditions, read here so the
+ * outro never says "Opening" for a run where nothing opens.
+ */
+function willLaunchAgent(agent, launchNext) {
+    // localGraph: true - the outro runs only once the local phase has built it.
+    return launchNext && launchesAfterWizard({ localGraph: true, agent, isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY) });
 }
 /**
  * The local outro's one next step, or nothing. No link: the only place to go from here is the
@@ -550,10 +418,10 @@ async function offerFreeProviderKey(config, opts) {
  * second and then be false, so it is dropped. With no agent the install hints were already
  * printed once by the pick, and are not repeated here.
  */
-function nextStepLine(agent, launchNext) {
+function nextStepLine(agent, launching) {
     const label = agent ? agentByName(agent)?.label : undefined;
     if (label)
-        return launchNext ? null : `Run ${chalk.bold('align')} to open ${label} with your graph.`;
+        return launching ? null : `Run ${chalk.bold('align')} to open ${label} with your graph.`;
     return `Run ${chalk.bold('align')} once a coding agent is installed.`;
 }
 /** Thrown inside the docs block to leave it without starting a read; never surfaces. */
@@ -628,7 +496,7 @@ async function runLocalValuePhase(opts) {
         try {
             const gitSource = buildSources(true).find(s => s.id === 'git');
             const fetched = await gitSource.fetch({});
-            capture.add(toCaptureSource(gitSource, fetched));
+            const gitCs = capture.add(toCaptureSource(gitSource, fetched));
             const { items } = fetched;
             if (items.length) {
                 gitSpinner.stop(`Found ${items.length} commits worth importing`);
@@ -636,6 +504,7 @@ async function runLocalValuePhase(opts) {
                 // runPersonalImport prints by default (component 2's whole point) - the one compact
                 // line quiet mode DOES print is a fine progress marker while the summary is built.
                 await runPersonalImport(items, localClient, {
+                    result: gitCs,
                     label: 'Git',
                     approve: true,
                     appUrl: resolveAppUrl(localEnv),
@@ -696,12 +565,13 @@ async function runLocalValuePhase(opts) {
     try {
         if (docsKnown)
             throw new SkipDocs();
-        const docs = await fetchDocsItems({ limit: IMPORT_LIMITS.docs });
-        capture.add(toCaptureSource(CAPTURE_SOURCES.docs, docs));
+        const docs = await fetchDocsItems({ limit: SYNC_CEILINGS.docs });
+        const docsCs = capture.add(toCaptureSource(CAPTURE_SOURCES.docs, docs));
         const docsItems = docs.items;
         if (docsItems.length) {
             localDocsSpinner.stop(`Found ${docsItems.length} item(s) worth importing`);
             await runPersonalImport(docsItems, localClient, {
+                result: docsCs,
                 label: 'repo docs',
                 approve: true,
                 appUrl: resolveAppUrl(localEnv),
@@ -745,13 +615,9 @@ async function runLocalValuePhase(opts) {
         console.log('');
         p.log.info(chalk.dim(connectedLine));
     }
-    // ALI-618: one-time, never asked again once answered. Local mode has no account, so consent
-    // is the only thing that can ever turn this on - see usage-telemetry.ts's local-embedded
-    // branch, which reads this same stored decision.
-    await maybeRequestTelemetryConsent(config, Boolean(interactive));
-    // ALI-949: the first checkpoint at which a local-mode setup_started CAN send - consent is
-    // only now on disk (or was already, on a re-run). The wizard-start offer in runSetup could
-    // not send for a fresh install, so the funnel object is offered the local env again here.
+    // ALI-949: the first checkpoint at which the local env is initialised, so a local-mode
+    // setup_started is offered against it here. (C6: there is no consent question any more - the
+    // one-time notice in cli.ts's preAction is the disclosure local sends wait on.)
     void opts.funnel.started(localEnv);
     return { interactive, config, localEnv, localClient, dbPath, opts, capture, funnel: opts.funnel, agents, firstFoundTitle, agent };
 }
@@ -773,7 +639,9 @@ export function localConnectorIds() {
 export async function connectLocalSources(o) {
     const { interactive, config, localEnv, localClient, capture, approve } = o;
     const quiet = o.json === true;
+    const window = o.window ?? parseSince(undefined);
     const results = [];
+    const scopeCtx = connectScopeCtx({ config, dbPath: localEnv.localDbPath, interactive, quiet, flags: o.scopeFlags });
     // Connectors: local mode connects by a read-only token the user mints themselves,
     // for every connector - their personal graph, their credential. OAuth belongs to
     // the personal-cloud path, where the hosted broker holds the client secrets. (This
@@ -945,20 +813,22 @@ export async function connectLocalSources(o) {
     // is only the automatic import for the paste-token connectors just collected.
     for (const { source, tokens, reused } of localReady) {
         const spinner = quiet ? { start() { }, stop() { } } : p.spinner();
-        spinner.start(`Fetching from ${source.label}...`);
+        let sourceCs;
         try {
-            const fetched = await source.fetch(tokens);
-            capture.add(toCaptureSource(source, fetched));
+            const fetched = await fetchUnderScope(source, tokens, window, scopeCtx, () => spinner.start(`Fetching from ${source.label}...`));
+            sourceCs = capture.add(toCaptureSource(source, fetched, windowLabel(window.days)));
             const { items } = fetched;
             // Saved only once the fetch it unlocked has succeeded. A token that never worked is not
             // worth remembering, and storing one would turn the next run's honest "paste a token"
             // into a silent empty import. Re-saving an already-saved token is a harmless no-op, so
             // there is one rule here rather than a branch that has to stay in step with the reuse.
             config.saveConnectorFields('local', source.id, tokens);
+            afterSourceConnected(localEnv.localDbPath, source.id, (id) => Boolean(config.getConnectorFields('local', id)?.['token']));
             spinner.stop(`Found ${items.length} items`);
             let imported = 0;
             if (items.length) {
                 imported = await runPersonalImport(items, localClient, {
+                    result: sourceCs,
                     label: source.label,
                     approve: true,
                     appUrl: resolveAppUrl(localEnv),
@@ -968,10 +838,15 @@ export async function connectLocalSources(o) {
                     funnel: { env: localEnv, source: source.id },
                 });
             }
-            results.push({ id: source.id, label: source.label, found: items.length, imported });
+            results.push({ id: source.id, label: source.label, found: items.length, imported, ...(fetched.report.scopeNote ? { reads: fetched.report.scopeNote } : {}), ...(fetched.report.disclosurePending ? { disclosure_pending: true } : {}) });
         }
         catch (e) {
             const msg = e.message;
+            // An import that threw stored an unknown amount: never leave the report saying all of it.
+            if (sourceCs) {
+                sourceCs.stored ??= 0;
+                sourceCs.failedBatches = Math.max(sourceCs.failedBatches ?? 0, 1);
+            }
             if (reused && isAuthExpiry(e)) {
                 // The provider said the SAVED token is dead. Left saved it would keep the connector
                 // "connected" on every later run and hide the gap line the graph would otherwise
@@ -1033,22 +908,23 @@ async function runLocalConnectorPhase(ctx) {
     const gaps = unresolvedGaps(refsDb.getAllRefs(), isConnected);
     refsDb.close();
     const gapLine = setupSummaryLine(gaps);
-    // ALI-1284: the same guided free-tier key as the cloud path - local mode needs one too,
-    // `align ask` resolves providers identically either way. Gated on `interactive` like
-    // every other prompt in this phase, rather than only on `opts.approve`, since local mode
-    // (unlike cloud) is routinely run non-interactively with no terminal to paste a key into.
-    if (interactive)
-        await offerFreeProviderKey(config, opts);
     // ALI-950: the last line is the next step, and it happens in the agent - named, with a
     // question about a decision the wizard just found, and no CLI verb. This used to end on
     // `align ask "why <a thing you decided>"`, a prompt verb on the one screen whose job is to
     // send the user into their agent. The gap line, when there is one, sits above it.
-    const nextStep = nextStepLine(agent, Boolean(opts.launchNext));
+    // The 0.48.0 outro said "Open Claude Code in this repo and ask: ..." and align then opened
+    // Claude Code itself. When it is about to, the last line says so instead.
+    const launching = willLaunchAgent(agent, Boolean(opts.launchNext));
+    const launchLabel = launching && agent ? agentByName(agent)?.label : undefined;
+    const nextStep = nextStepLine(agent, launching);
+    const askLine = launchLabel
+        ? `Opening ${launchLabel}. Ask it: ${firstQuestion(firstFoundTitle)}`
+        : agentAskLine({ agents, firstTitle: firstFoundTitle, inRepo: true, envName: 'local' });
     p.outro(`${chalk.green('You are set up in local mode.')}\n` +
         `  Graph: ${chalk.dim(dbPath)}\n` +
         `${nextStep ? `  ${nextStep}\n` : ''}` +
         `${gapLine ? `\n  ${chalk.dim(gapLine)}\n` : ''}\n` +
-        `  ${chalk.bold(agentAskLine({ agents, firstTitle: firstFoundTitle, inRepo: true, envName: 'local' }))}`);
+        `  ${chalk.bold(askLine)}`);
     // ALI-949: after the outro, never before it - telemetry must not delay what the user is
     // waiting for. Awaited (unlike the other emitters) because this is the wizard's last act
     // and the one row the funnel was blind to; there is nothing left for a 2s worst case to hold up.
@@ -1068,7 +944,7 @@ export function registerSetupCommand(program) {
         .option('--env <env>', 'local, preview or prod. Logged in to a team? Setup uses it; --env local builds the local graph instead')
         .option('--approve', 'Skip confirmation prompts (for scripted use)')
         .option('--local', 'Same as --env local: build the local graph even if you are logged in to a team')
-        .option('--reset', 'Clear cached OAuth tokens and saved AI provider keys, and redo their setup')
+        .option('--reset', 'Clear cached OAuth tokens, saved AI provider keys and the saved AI provider choice, and redo their setup')
         .option('--verbose', 'List every agent config file setup left as is, with the command to switch it')
         .action(runSetup);
 }
@@ -1097,14 +973,10 @@ export async function runSetup(opts = {}) {
         console.error(err.message);
         process.exit(1);
     }
-    // --reset --approve: clear unconditionally, before any auth/TTY-gated exit can skip it
-    // (Copilot review, PR #323). Gated on BOTH flags, deliberately: a plain interactive
-    // `--reset` (no --approve) must NOT wipe the stored key here, or offerFreeProviderKey's
-    // re-offer below would find nothing to re-offer and the user would never get the chance
-    // to choose - only the non-prompting --approve case needs this early, unconditional
-    // clear. See clearStoredProviderKeys's own comment for why this cannot live inside
-    // offerFreeProviderKey instead.
-    if (opts.approve && opts.reset)
+    // --reset: clear saved AI provider keys before any auth/TTY-gated exit can skip it
+    // (Copilot review, PR #323). Interactive or not - the wizard no longer re-offers keys, so
+    // there is nothing for an interactive --reset to wait for; `align ask` offers lazily.
+    if (opts.reset)
         clearStoredProviderKeys(config);
     const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
     if (route.kind === 'team') {
@@ -1306,13 +1178,14 @@ async function runCloudSetup(ctx) {
         try {
             const gitSource = buildSources(true).find(s => s.id === 'git');
             const fetched = await gitSource.fetch({});
-            capture.add(toCaptureSource(gitSource, fetched));
+            const gitCs = capture.add(toCaptureSource(gitSource, fetched));
             const { items } = fetched;
             // Stop the scan spinner before runPersonalImport - it starts its own
             // progress spinner, and two animated spinners on one line flicker.
             if (items.length) {
                 gitSpinner.stop(`Found ${items.length} commits worth importing`);
                 const ingested = await runPersonalImport(items, client, {
+                    result: gitCs,
                     label: 'Git',
                     approve: true,
                     appUrl: resolveAppUrl(env),
@@ -1336,12 +1209,13 @@ async function runCloudSetup(ctx) {
     const docsSpinner = p.spinner();
     docsSpinner.start('Reading ADRs and CLAUDE.md/AGENTS.md...');
     try {
-        const docs = await fetchDocsItems({ limit: IMPORT_LIMITS.docs });
-        capture.add(toCaptureSource(CAPTURE_SOURCES.docs, docs));
+        const docs = await fetchDocsItems({ limit: SYNC_CEILINGS.docs });
+        const docsCs = capture.add(toCaptureSource(CAPTURE_SOURCES.docs, docs));
         const docsItems = docs.items;
         if (docsItems.length) {
             docsSpinner.stop(`Found ${docsItems.length} item(s) worth importing`);
             const ingested = await runPersonalImport(docsItems, client, {
+                result: docsCs,
                 label: 'repo docs',
                 approve: true,
                 appUrl: resolveAppUrl(env),
@@ -1383,10 +1257,10 @@ async function runCloudSetup(ctx) {
     for (const result of fetched) {
         const source = result.source;
         if ('fetched' in result) {
-            capture.add(toCaptureSource(source, result.fetched));
+            const cs = capture.add(toCaptureSource(source, result.fetched, windowLabel(SYNC_WINDOW_DEFAULT_DAYS)));
             const { items } = result.fetched;
             if (items.length)
-                ready.push({ source, items });
+                ready.push({ source, items, cs });
             else
                 p.log.warn(`No items found in ${source.label}.`);
         }
@@ -1414,11 +1288,11 @@ async function runCloudSetup(ctx) {
             retrySpinner.start(`Retrying ${source.label}...`);
             try {
                 const fetched = await source.fetch(fresh);
-                capture.add(toCaptureSource(source, fetched));
+                const cs = capture.add(toCaptureSource(source, fetched, windowLabel(SYNC_WINDOW_DEFAULT_DAYS)));
                 const { items } = fetched;
                 retrySpinner.stop(`Found ${items.length} items`);
                 if (items.length)
-                    ready.push({ source, items });
+                    ready.push({ source, items, cs });
                 else
                     p.log.warn(`No items found in ${source.label}.`);
             }
@@ -1437,8 +1311,9 @@ async function runCloudSetup(ctx) {
     if (ready.length) {
         console.log('');
         p.log.step(`Importing from ${ready.length} source${ready.length === 1 ? '' : 's'} in parallel...`);
-        const importResults = await runWithConcurrency(ready.map(({ source, items }) => async () => {
+        const importResults = await runWithConcurrency(ready.map(({ source, items, cs }) => async () => {
             const total = await runPersonalImport(items, client, {
+                result: cs,
                 label: source.label,
                 approve: true,
                 appUrl: resolveAppUrl(env),
@@ -1450,13 +1325,17 @@ async function runCloudSetup(ctx) {
             });
             return { label: source.label, total };
         }), IMPORT_CONCURRENCY);
-        for (const r of importResults) {
+        for (const [i, r] of importResults.entries()) {
             if (r.status === 'fulfilled') {
                 totalDecisions += r.value.total;
                 if (r.value.total > 0)
                     sourcesImported.push(r.value.label);
             }
             else {
+                // The import threw before reporting: the capture line must not say all of it was imported.
+                const cs = ready[i].cs;
+                cs.stored ??= 0;
+                cs.failedBatches = Math.max(cs.failedBatches ?? 0, 1);
                 p.log.warn(`Import failed: ${r.reason.message}`);
             }
         }
@@ -1471,8 +1350,6 @@ async function runCloudSetup(ctx) {
         console.log(captureText);
         console.log('');
     }
-    // ---- Step 7b: guided free-tier AI provider key (ALI-1284) ----
-    await offerFreeProviderKey(config, opts);
     // ---- Outro ----
     const decisionsLine = totalDecisions > 0
         ? `  ${totalDecisions} decisions in your graph`