@aligndottech/cli 0.49.0 → 0.51.0

package/dist/commands/setup.d.ts

@@ -2,6 +2,37 @@ import type { Command } from 'commander';
 import { createConfigStore, type EnvName } from '../lib/config.js';
 import { createGatewayClient } from '../lib/gateway-client.js';
 import { createCaptureCollector } from '../lib/capture-report.js';
+import type { CaptureFetchResult } from '../lib/fetchers/capture.js';
+import { type FetchExtras, type SyncWindow } from '../lib/since.js';
+import { type ScopeFlags } from '../lib/scope-connect.js';
+type ConnectorTier = 'personal' | 'site' | 'workspace';
+export interface SetupSource {
+    id: string;
+    label: string;
+    description: string;
+    tier?: ConnectorTier;
+    oauthKey?: string;
+    hostGatedOAuth?: {
+        field: string;
+    };
+    tokenLabel?: string;
+    tokenHint?: string;
+    /** The pasted token expires within hours (a Graph access token), so a saved one is usually
+     *  dead by the next run: the re-import question defaults to pasting a fresh one. */
+    tokenShortLived?: true;
+    tokenUrl?: string | ((tokens: Record<string, string>) => string);
+    extraFields?: Array<{
+        key: string;
+        label: string;
+        hint?: string;
+        secret?: boolean;
+    }>;
+    /** What one fetched item IS, for the capture report (ALI-827) - from CAPTURE_SOURCES. */
+    unit: string;
+    /** L3: `window` defaults to the plan's six months; `align connect --since` passes its own. */
+    fetch: (tokens: Record<string, string>, window?: SyncWindow, opts?: FetchExtras) => Promise<CaptureFetchResult>;
+}
+export declare function buildSources(gitAvailable: boolean): SetupSource[];
 /**
  * The retry command printed when a connector import fails mid-setup (ALI-675).
  *
@@ -27,6 +58,9 @@ export interface ConnectedSourceResult {
     imported: number;
     /** Set when the fetch threw; found and imported are 0 then. */
     error?: string;
+    /** L3: whose items a team-scope read covered, when it was one. */
+    reads?: string;
+    disclosure_pending?: boolean;
 }
 export interface ConnectLocalSourcesOptions {
     interactive: boolean;
@@ -41,6 +75,10 @@ export interface ConnectLocalSourcesOptions {
     seedTokens?: Record<string, string>;
     /** ALI-951 (`align connect --json`): print nothing per source; the caller prints one summary. */
     json?: boolean;
+    /** L3 (`align connect --since`): how far back to read. Absent means the plan's six months. */
+    window?: SyncWindow;
+    /** L4 (`align connect --scope/--projects/...`): which part of a source to read. */
+    scopeFlags?: ScopeFlags;
 }
 /** The ids `align connect --source` accepts: every local paste-token source, in picker order. */
 export declare function localConnectorIds(): string[];
@@ -71,4 +109,5 @@ export declare function runSetup(opts?: {
     launchNext?: boolean;
     verbose?: boolean;
 }): Promise<void>;
+export {};
 //# sourceMappingURL=setup.d.ts.map

package/dist/commands/setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/commands/setup.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,OAAO,EAAE,iBAAiB,EAAE,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAS/D,OAAO,EAAE,sBAAsB,EAAmB,MAAM,0BAA0B,CAAC;AAgYnF;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAE1E;AA0TD;;;;;;;GAOG;AACH,kGAAkG;AAClG,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;IAC7C,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC7E,WAAW,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;IACpD,OAAO,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC;IACnD,OAAO,EAAE,OAAO,CAAC;IACjB,yFAAyF;IACzF,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,iGAAiG;IACjG,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,iGAAiG;AACjG,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAK5C;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAuNzG;AAuFD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAU3D;AAED;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GACxH,OAAO,CAAC,IAAI,CAAC,CAgDf"}
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/commands/setup.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,OAAO,EAAE,iBAAiB,EAAE,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAS/D,OAAO,EAAsB,sBAAsB,EAAmB,MAAM,0BAA0B,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGrE,OAAO,EAAE,KAAK,WAAW,EAA2B,KAAK,UAAU,EAA6B,MAAM,iBAAiB,CAAC;AAGxH,OAAO,EAAoC,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AA+B5F,KAAK,aAAa,GAAG,UAAU,GAAG,MAAM,GAAG,WAAW,CAAC;AAOvD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAIlB,cAAc,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;wFACoF;IACpF,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,CAAC;IACjE,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACrF,yFAAyF;IACzF,IAAI,EAAE,MAAM,CAAC;IACb,8FAA8F;IAC9F,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACjH;AAED,wBAAgB,YAAY,CAAC,YAAY,EAAE,OAAO,GAAG,WAAW,EAAE,CAmNjE;AA2GD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAE1E;AAwTD;;;;;;;GAOG;AACH,kGAAkG;AAClG,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;IAC7C,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC7E,WAAW,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;IACpD,OAAO,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC;IACnD,OAAO,EAAE,OAAO,CAAC;IACjB,yFAAyF;IACzF,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,iGAAiG;IACjG,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8FAA8F;IAC9F,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,mFAAmF;IACnF,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,iGAAiG;AACjG,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAK5C;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CA6NzG;AAuFD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAU3D;AAED;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GACxH,OAAO,CAAC,IAAI,CAAC,CAgDf"}

package/dist/commands/setup.js

@@ -16,13 +16,15 @@ import { createLocalDb } from '../lib/local-db.js';
 import { buildFoundSummary, renderFoundSummary } from '../lib/found-summary.js';
 import { createCaptureCollector, toCaptureSource } from '../lib/capture-report.js';
 import { CAPTURE_SOURCES } from '../lib/capture-sources.js';
-import { IMPORT_LIMITS, SLACK_DAYS_BACK } from '../lib/import-defaults.js';
+import { GIT_DEFAULT_LIMIT, SYNC_CEILINGS, SYNC_WINDOW_DEFAULT_DAYS } from '../lib/import-defaults.js';
+import { fetchWindow, parseSince, windowExtras, windowLabel } from '../lib/since.js';
 import { initLocalMode } from '../lib/local-mode.js';
+import { afterSourceConnected } from '../lib/sync/after-connect.js';
+import { connectScopeCtx, fetchUnderScope } from '../lib/scope-connect.js';
 import { loginInteractive } from '../lib/login-flow.js';
 import { resolveAppUrl } from '../lib/env-resolver.js';
 import { collectTokensViaOAuth, oauthFlowLabel } from '../lib/personal-oauth.js';
 import { isAuthExpiry } from '../lib/errors.js';
-import { maybeRequestTelemetryConsent } from '../lib/telemetry-consent.js';
 import { commandIntro } from '../lib/brand.js';
 import pkg from '../../package.json' with { type: 'json' };
 const { version } = pkg;
@@ -42,7 +44,7 @@ const TIER_ORDER = { personal: 0, site: 1, workspace: 2 };
 // How many connectors import concurrently after auth. Each import is itself
 // batch-parallel (runPersonalImport), so this bounds total gateway load.
 const IMPORT_CONCURRENCY = 4;
-function buildSources(gitAvailable) {
+export function buildSources(gitAvailable) {
     const sources = [];
     if (gitAvailable) {
         sources.push({
@@ -51,7 +53,8 @@ function buildSources(gitAvailable) {
             description: 'Commit history from this repo - no token needed',
             fetch: async () => {
                 const { fetchGitItems } = await import('../lib/fetchers/git.js');
-                return fetchGitItems({ limit: IMPORT_LIMITS.git });
+                // The newest commits however old, as before the window (GIT_DEFAULT_LIMIT); only --since changes it.
+                return fetchGitItems({ limit: GIT_DEFAULT_LIMIT });
             },
         });
     }
@@ -73,14 +76,12 @@ function buildSources(gitAvailable) {
             '&description=Read-only+import+of+your+PRs+and+issues+into+your+local+Align+graph' +
             '&expires_in=90' +
             '&contents=read&issues=read&pull_requests=read',
-        fetch: async (t) => {
+        fetch: async (t, w = parseSince(undefined), o = {}) => {
             const { fetchGitHubItems, resolveGitHubRepoScope } = await import('../lib/fetchers/github.js');
-            // ALI-917: this interactive source has no --repo/--all of its own, so it takes
-            // resolveGitHubRepoScope's auto-detect-only path (an empty opts object) - the
-            // same default `align connect github` uses. Without it, a token spanning several
-            // unrelated repos returns everything across all of them, undifferentiated.
-            const repo = await resolveGitHubRepoScope({});
-            return fetchGitHubItems({ token: t['token'], limit: IMPORT_LIMITS.github, ...(repo ? { repo } : {}) });
+            // L4: when the caller has resolved the scope (`resolved`), its `repo` is the whole answer and the folder is not consulted.
+            // Without it (cloud setup) this is ALI-917's auto-detect: the repo narrows the search, and team scope only when asked.
+            const repo = o.resolved ? o.repo : await resolveGitHubRepoScope({});
+            return fetchGitHubItems({ token: t['token'], ...fetchWindow('github', w), ...(repo ? { repo, ...(o.team || o.resolved ? { scope: 'team' } : {}) } : {}) });
         },
     }, {
         id: 'jira',
@@ -98,9 +99,9 @@ function buildSources(gitAvailable) {
             { key: 'email', label: 'Atlassian account email' },
             { key: 'domain', label: 'Atlassian domain (yourorg.atlassian.net)' },
         ],
-        fetch: async (t) => {
+        fetch: async (t, w = parseSince(undefined), o) => {
             const { fetchJiraItems } = await import('../lib/fetchers/jira.js');
-            return fetchJiraItems({ token: t['token'], cloudId: t['cloudId'], email: t['email'], domain: t['domain'], limit: IMPORT_LIMITS.jira });
+            return fetchJiraItems({ token: t['token'], cloudId: t['cloudId'], email: t['email'], domain: t['domain'], ...fetchWindow('jira', w), ...windowExtras(o) });
         },
     }, {
         id: 'confluence',
@@ -117,9 +118,9 @@ function buildSources(gitAvailable) {
             { key: 'email', label: 'Atlassian account email' },
             { key: 'domain', label: 'Atlassian domain (yourorg.atlassian.net)' },
         ],
-        fetch: async (t) => {
+        fetch: async (t, w = parseSince(undefined), o) => {
             const { fetchConfluenceItems } = await import('../lib/fetchers/confluence.js');
-            return fetchConfluenceItems({ token: t['token'], cloudId: t['cloudId'], email: t['email'], domain: t['domain'], limit: IMPORT_LIMITS.confluence });
+            return fetchConfluenceItems({ token: t['token'], cloudId: t['cloudId'], email: t['email'], domain: t['domain'], ...fetchWindow('confluence', w), ...windowExtras(o) });
         },
     }, {
         id: 'slack',
@@ -133,9 +134,9 @@ function buildSources(gitAvailable) {
         tokenLabel: 'User token (xoxp-...)',
         tokenHint: 'User token with read scopes only: channels:read, channels:history, groups:read, groups:history',
         tokenUrl: 'https://api.slack.com/apps',
-        fetch: async (t) => {
+        fetch: async (t, w = parseSince(undefined), o) => {
             const { fetchSlackItems } = await import('../lib/fetchers/slack.js');
-            return fetchSlackItems({ token: t['token'], limit: IMPORT_LIMITS.slack, daysBack: SLACK_DAYS_BACK });
+            return fetchSlackItems({ token: t['token'], ...fetchWindow('slack', w), ...windowExtras(o) });
         },
     }, {
         id: 'teams',
@@ -153,9 +154,9 @@ function buildSources(gitAvailable) {
             'The token expires after about an hour; re-run setup to paste a fresh one.',
         tokenUrl: 'https://developer.microsoft.com/en-us/graph/graph-explorer',
         tokenShortLived: true,
-        fetch: async (t) => {
+        fetch: async (t, w = parseSince(undefined), o) => {
             const { fetchTeamsItems } = await import('../lib/fetchers/teams.js');
-            return fetchTeamsItems({ token: t['token'], limit: IMPORT_LIMITS.teams });
+            return fetchTeamsItems({ token: t['token'], ...fetchWindow('teams', w), ...windowExtras(o) });
         },
     }, {
         id: 'zoom',
@@ -163,9 +164,9 @@ function buildSources(gitAvailable) {
         description: 'Cloud recording transcripts from your meetings',
         tier: 'personal',
         oauthKey: 'zoom',
-        fetch: async (t) => {
+        fetch: async (t, w = parseSince(undefined), o) => {
             const { fetchZoomItems } = await import('../lib/fetchers/zoom.js');
-            return fetchZoomItems({ token: t['token'], limit: IMPORT_LIMITS.zoom });
+            return fetchZoomItems({ token: t['token'], ...fetchWindow('zoom', w), ...windowExtras(o) });
         },
     }, {
         id: 'gitlab',
@@ -190,9 +191,9 @@ function buildSources(gitAvailable) {
         extraFields: [
             { key: 'domain', label: 'GitLab domain (leave blank for gitlab.com)' },
         ],
-        fetch: async (t) => {
+        fetch: async (t, w = parseSince(undefined), o) => {
             const { fetchGitLabItems } = await import('../lib/fetchers/gitlab.js');
-            return fetchGitLabItems({ token: t['token'], domain: t['domain'] || undefined, limit: IMPORT_LIMITS.gitlab });
+            return fetchGitLabItems({ token: t['token'], domain: t['domain'] || undefined, ...fetchWindow('gitlab', w), ...windowExtras(o) });
         },
     }, {
         id: 'linear',
@@ -210,9 +211,9 @@ function buildSources(gitAvailable) {
         // a workspace slug here, it 404s for everyone outside that workspace.
         tokenHint: 'Click Create key, then copy it here',
         tokenUrl: 'https://linear.app/settings/account/security/api-keys/new',
-        fetch: async (t) => {
+        fetch: async (t, w = parseSince(undefined), o) => {
             const { fetchLinearItems } = await import('../lib/fetchers/linear.js');
-            return fetchLinearItems({ token: t['token'], limit: IMPORT_LIMITS.linear });
+            return fetchLinearItems({ token: t['token'], ...fetchWindow('linear', w), ...windowExtras(o) });
         },
     }, {
         id: 'notion',
@@ -233,9 +234,9 @@ function buildSources(gitAvailable) {
         // landing (both resolve; this one is where the secret actually lives - Tom,
         // from a live run, 2026-08-31).
         tokenUrl: 'https://app.notion.com/developers/tokens',
-        fetch: async (t) => {
+        fetch: async (t, w = parseSince(undefined), o) => {
             const { fetchNotionItems } = await import('../lib/fetchers/notion.js');
-            return fetchNotionItems({ token: t['token'], limit: IMPORT_LIMITS.notion });
+            return fetchNotionItems({ token: t['token'], ...fetchWindow('notion', w), ...windowExtras(o) });
         },
     });
     return sources;
@@ -495,7 +496,7 @@ async function runLocalValuePhase(opts) {
         try {
             const gitSource = buildSources(true).find(s => s.id === 'git');
             const fetched = await gitSource.fetch({});
-            capture.add(toCaptureSource(gitSource, fetched));
+            const gitCs = capture.add(toCaptureSource(gitSource, fetched));
             const { items } = fetched;
             if (items.length) {
                 gitSpinner.stop(`Found ${items.length} commits worth importing`);
@@ -503,6 +504,7 @@ async function runLocalValuePhase(opts) {
                 // runPersonalImport prints by default (component 2's whole point) - the one compact
                 // line quiet mode DOES print is a fine progress marker while the summary is built.
                 await runPersonalImport(items, localClient, {
+                    result: gitCs,
                     label: 'Git',
                     approve: true,
                     appUrl: resolveAppUrl(localEnv),
@@ -563,12 +565,13 @@ async function runLocalValuePhase(opts) {
     try {
         if (docsKnown)
             throw new SkipDocs();
-        const docs = await fetchDocsItems({ limit: IMPORT_LIMITS.docs });
-        capture.add(toCaptureSource(CAPTURE_SOURCES.docs, docs));
+        const docs = await fetchDocsItems({ limit: SYNC_CEILINGS.docs });
+        const docsCs = capture.add(toCaptureSource(CAPTURE_SOURCES.docs, docs));
         const docsItems = docs.items;
         if (docsItems.length) {
             localDocsSpinner.stop(`Found ${docsItems.length} item(s) worth importing`);
             await runPersonalImport(docsItems, localClient, {
+                result: docsCs,
                 label: 'repo docs',
                 approve: true,
                 appUrl: resolveAppUrl(localEnv),
@@ -612,13 +615,9 @@ async function runLocalValuePhase(opts) {
         console.log('');
         p.log.info(chalk.dim(connectedLine));
     }
-    // ALI-618: one-time, never asked again once answered. Local mode has no account, so consent
-    // is the only thing that can ever turn this on - see usage-telemetry.ts's local-embedded
-    // branch, which reads this same stored decision.
-    await maybeRequestTelemetryConsent(config, Boolean(interactive));
-    // ALI-949: the first checkpoint at which a local-mode setup_started CAN send - consent is
-    // only now on disk (or was already, on a re-run). The wizard-start offer in runSetup could
-    // not send for a fresh install, so the funnel object is offered the local env again here.
+    // ALI-949: the first checkpoint at which the local env is initialised, so a local-mode
+    // setup_started is offered against it here. (C6: there is no consent question any more - the
+    // one-time notice in cli.ts's preAction is the disclosure local sends wait on.)
     void opts.funnel.started(localEnv);
     return { interactive, config, localEnv, localClient, dbPath, opts, capture, funnel: opts.funnel, agents, firstFoundTitle, agent };
 }
@@ -640,7 +639,9 @@ export function localConnectorIds() {
 export async function connectLocalSources(o) {
     const { interactive, config, localEnv, localClient, capture, approve } = o;
     const quiet = o.json === true;
+    const window = o.window ?? parseSince(undefined);
     const results = [];
+    const scopeCtx = connectScopeCtx({ config, dbPath: localEnv.localDbPath, interactive, quiet, flags: o.scopeFlags });
     // Connectors: local mode connects by a read-only token the user mints themselves,
     // for every connector - their personal graph, their credential. OAuth belongs to
     // the personal-cloud path, where the hosted broker holds the client secrets. (This
@@ -812,20 +813,22 @@ export async function connectLocalSources(o) {
     // is only the automatic import for the paste-token connectors just collected.
     for (const { source, tokens, reused } of localReady) {
         const spinner = quiet ? { start() { }, stop() { } } : p.spinner();
-        spinner.start(`Fetching from ${source.label}...`);
+        let sourceCs;
         try {
-            const fetched = await source.fetch(tokens);
-            capture.add(toCaptureSource(source, fetched));
+            const fetched = await fetchUnderScope(source, tokens, window, scopeCtx, () => spinner.start(`Fetching from ${source.label}...`));
+            sourceCs = capture.add(toCaptureSource(source, fetched, windowLabel(window.days)));
             const { items } = fetched;
             // Saved only once the fetch it unlocked has succeeded. A token that never worked is not
             // worth remembering, and storing one would turn the next run's honest "paste a token"
             // into a silent empty import. Re-saving an already-saved token is a harmless no-op, so
             // there is one rule here rather than a branch that has to stay in step with the reuse.
             config.saveConnectorFields('local', source.id, tokens);
+            afterSourceConnected(localEnv.localDbPath, source.id, (id) => Boolean(config.getConnectorFields('local', id)?.['token']));
             spinner.stop(`Found ${items.length} items`);
             let imported = 0;
             if (items.length) {
                 imported = await runPersonalImport(items, localClient, {
+                    result: sourceCs,
                     label: source.label,
                     approve: true,
                     appUrl: resolveAppUrl(localEnv),
@@ -835,10 +838,15 @@ export async function connectLocalSources(o) {
                     funnel: { env: localEnv, source: source.id },
                 });
             }
-            results.push({ id: source.id, label: source.label, found: items.length, imported });
+            results.push({ id: source.id, label: source.label, found: items.length, imported, ...(fetched.report.scopeNote ? { reads: fetched.report.scopeNote } : {}), ...(fetched.report.disclosurePending ? { disclosure_pending: true } : {}) });
         }
         catch (e) {
             const msg = e.message;
+            // An import that threw stored an unknown amount: never leave the report saying all of it.
+            if (sourceCs) {
+                sourceCs.stored ??= 0;
+                sourceCs.failedBatches = Math.max(sourceCs.failedBatches ?? 0, 1);
+            }
             if (reused && isAuthExpiry(e)) {
                 // The provider said the SAVED token is dead. Left saved it would keep the connector
                 // "connected" on every later run and hide the gap line the graph would otherwise
@@ -1170,13 +1178,14 @@ async function runCloudSetup(ctx) {
         try {
             const gitSource = buildSources(true).find(s => s.id === 'git');
             const fetched = await gitSource.fetch({});
-            capture.add(toCaptureSource(gitSource, fetched));
+            const gitCs = capture.add(toCaptureSource(gitSource, fetched));
             const { items } = fetched;
             // Stop the scan spinner before runPersonalImport - it starts its own
             // progress spinner, and two animated spinners on one line flicker.
             if (items.length) {
                 gitSpinner.stop(`Found ${items.length} commits worth importing`);
                 const ingested = await runPersonalImport(items, client, {
+                    result: gitCs,
                     label: 'Git',
                     approve: true,
                     appUrl: resolveAppUrl(env),
@@ -1200,12 +1209,13 @@ async function runCloudSetup(ctx) {
     const docsSpinner = p.spinner();
     docsSpinner.start('Reading ADRs and CLAUDE.md/AGENTS.md...');
     try {
-        const docs = await fetchDocsItems({ limit: IMPORT_LIMITS.docs });
-        capture.add(toCaptureSource(CAPTURE_SOURCES.docs, docs));
+        const docs = await fetchDocsItems({ limit: SYNC_CEILINGS.docs });
+        const docsCs = capture.add(toCaptureSource(CAPTURE_SOURCES.docs, docs));
         const docsItems = docs.items;
         if (docsItems.length) {
             docsSpinner.stop(`Found ${docsItems.length} item(s) worth importing`);
             const ingested = await runPersonalImport(docsItems, client, {
+                result: docsCs,
                 label: 'repo docs',
                 approve: true,
                 appUrl: resolveAppUrl(env),
@@ -1247,10 +1257,10 @@ async function runCloudSetup(ctx) {
     for (const result of fetched) {
         const source = result.source;
         if ('fetched' in result) {
-            capture.add(toCaptureSource(source, result.fetched));
+            const cs = capture.add(toCaptureSource(source, result.fetched, windowLabel(SYNC_WINDOW_DEFAULT_DAYS)));
             const { items } = result.fetched;
             if (items.length)
-                ready.push({ source, items });
+                ready.push({ source, items, cs });
             else
                 p.log.warn(`No items found in ${source.label}.`);
         }
@@ -1278,11 +1288,11 @@ async function runCloudSetup(ctx) {
             retrySpinner.start(`Retrying ${source.label}...`);
             try {
                 const fetched = await source.fetch(fresh);
-                capture.add(toCaptureSource(source, fetched));
+                const cs = capture.add(toCaptureSource(source, fetched, windowLabel(SYNC_WINDOW_DEFAULT_DAYS)));
                 const { items } = fetched;
                 retrySpinner.stop(`Found ${items.length} items`);
                 if (items.length)
-                    ready.push({ source, items });
+                    ready.push({ source, items, cs });
                 else
                     p.log.warn(`No items found in ${source.label}.`);
             }
@@ -1301,8 +1311,9 @@ async function runCloudSetup(ctx) {
     if (ready.length) {
         console.log('');
         p.log.step(`Importing from ${ready.length} source${ready.length === 1 ? '' : 's'} in parallel...`);
-        const importResults = await runWithConcurrency(ready.map(({ source, items }) => async () => {
+        const importResults = await runWithConcurrency(ready.map(({ source, items, cs }) => async () => {
             const total = await runPersonalImport(items, client, {
+                result: cs,
                 label: source.label,
                 approve: true,
                 appUrl: resolveAppUrl(env),
@@ -1314,13 +1325,17 @@ async function runCloudSetup(ctx) {
             });
             return { label: source.label, total };
         }), IMPORT_CONCURRENCY);
-        for (const r of importResults) {
+        for (const [i, r] of importResults.entries()) {
             if (r.status === 'fulfilled') {
                 totalDecisions += r.value.total;
                 if (r.value.total > 0)
                     sourcesImported.push(r.value.label);
             }
             else {
+                // The import threw before reporting: the capture line must not say all of it was imported.
+                const cs = ready[i].cs;
+                cs.stored ??= 0;
+                cs.failedBatches = Math.max(cs.failedBatches ?? 0, 1);
                 p.log.warn(`Import failed: ${r.reason.message}`);
             }
         }