agenttwin 0.3.4 → 0.3.6

package/dist/cli.js

@@ -789,11 +789,84 @@ var init_dashboard_transfer = __esm({
   }
 });
 
+// src/inventory/store.ts
+import { mkdir, readFile as readFile4, writeFile } from "fs/promises";
+import { join as join4 } from "path";
+function storeDir(cwd) {
+  return join4(cwd, STORE_DIR);
+}
+function storePath(cwd, name) {
+  return join4(storeDir(cwd), name);
+}
+async function ensureStore(cwd) {
+  await mkdir(storeDir(cwd), { recursive: true });
+  await writeFile(storePath(cwd, ".gitignore"), STORE_GITIGNORE, "utf8");
+}
+async function readJson(path) {
+  try {
+    return JSON.parse(await readFile4(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+async function writeJson(path, value) {
+  await writeFile(path, `${JSON.stringify(value, null, 2)}
+`, "utf8");
+}
+function defaultSources() {
+  return {
+    schema: "sources/v1",
+    note: "Declares desired discovery sources only. This file grants NO authorization.",
+    local: [
+      "static",
+      "environment",
+      "inspect:git-remotes",
+      "inspect:git-root",
+      "inspect:docker-images",
+      "inspect:docker-ps",
+      "inspect:docker-contexts",
+      "inspect:kubectl-contexts",
+      "inspect:aws-profiles"
+    ]
+  };
+}
+var STORE_DIR, STORE_GITIGNORE, readInventory, writeInventory, readDecisions, writeDecisions, readPlan, writePlan, readPermissions, writePermissions, readSources, writeSources;
+var init_store = __esm({
+  "src/inventory/store.ts"() {
+    "use strict";
+    STORE_DIR = ".agenttwin";
+    STORE_GITIGNORE = [
+      "inventory.json",
+      "plan.json",
+      "permissions.local.json",
+      "report.html",
+      "demo/",
+      "trial/",
+      "feedback.json",
+      "cache/",
+      "logs/",
+      "connections/",
+      ""
+    ].join("\n");
+    readInventory = (cwd) => readJson(storePath(cwd, "inventory.json"));
+    writeInventory = (cwd, value) => writeJson(storePath(cwd, "inventory.json"), value);
+    readDecisions = (cwd) => readJson(storePath(cwd, "decisions.json"));
+    writeDecisions = (cwd, value) => writeJson(storePath(cwd, "decisions.json"), value);
+    readPlan = (cwd) => readJson(storePath(cwd, "plan.json"));
+    writePlan = (cwd, value) => writeJson(storePath(cwd, "plan.json"), value);
+    readPermissions = (cwd) => readJson(storePath(cwd, "permissions.local.json"));
+    writePermissions = (cwd, value) => writeJson(storePath(cwd, "permissions.local.json"), value);
+    readSources = (cwd) => readJson(storePath(cwd, "sources.json"));
+    writeSources = (cwd, value) => writeJson(storePath(cwd, "sources.json"), value);
+  }
+});
+
 // src/inventory/project-products.ts
 async function projectProducts(cwd, data, base) {
   const current = new Set(base.tools.map((t) => t.id));
   const known = new Set(PROVIDERS.map((p) => p.title));
-  const tools = data.tools.filter((t) => current.has(t.id) || !known.has(t.title) && t.category !== "access" && t.category !== "tooling");
+  const excluded = new Set(((await readDecisions(cwd))?.items ?? []).filter((d) => d.kind === "exclude_tool").map((d) => d.target));
+  const tools = data.tools.filter((t) => !excluded.has(t.id) && (current.has(t.id) || !known.has(t.title) && t.category !== "access" && t.category !== "tooling"));
   const ids = new Set(tools.map((t) => t.id));
   const workflows = data.workflows.map((w) => ({ ...w, tools: w.tools.filter((id) => ids.has(id)), steps: w.steps.filter((s) => ids.has(s.tool)) }));
   const google = tools.find((t) => /Google \(Gmail/.test(t.title));
@@ -847,6 +920,7 @@ var init_project_products = __esm({
     init_entrypoints();
     init_catalog();
     init_dashboard_transfer();
+    init_store();
   }
 });
 
@@ -872,8 +946,8 @@ var init_sanitize = __esm({
 });
 
 // src/commands/dashboard.ts
-import { cp, mkdir, readFile as readFile4, writeFile } from "fs/promises";
-import { basename, join as join4 } from "path";
+import { cp, mkdir as mkdir2, readFile as readFile5, writeFile as writeFile2 } from "fs/promises";
+import { basename, join as join5 } from "path";
 import { fileURLToPath } from "url";
 function dashboardInventory(cwd, inventory) {
   return JSON.parse(sanitizeOutput(JSON.stringify({
@@ -892,26 +966,26 @@ function dashboardInventory(cwd, inventory) {
   })));
 }
 async function writeDashboard(cwd, inventory) {
-  const directory = join4(cwd, ".agenttwin", "dashboard");
+  const directory = join5(cwd, ".agenttwin", "dashboard");
   let bundle = fileURLToPath(new URL("./dashboard/", import.meta.url));
   try {
-    await readFile4(join4(bundle, "index.html"));
+    await readFile5(join5(bundle, "index.html"));
   } catch {
-    bundle = fileURLToPath(new URL("../../../../site/", import.meta.url));
+    bundle = fileURLToPath(new URL("../../dist/dashboard/", import.meta.url));
   }
-  await mkdir(join4(directory, "assets", "dashboard"), { recursive: true });
-  const html = await readFile4(join4(bundle, bundle.endsWith("/site/") ? "dashboard.html" : "index.html"), "utf8");
-  for (const folder of ["dashboard", "icons", "logo", "fonts", "vendor"]) {
-    await cp(join4(bundle, "assets", folder), join4(directory, "assets", folder), { recursive: true });
+  await mkdir2(join5(directory, "assets", "dashboard"), { recursive: true });
+  const html = await readFile5(join5(bundle, "index.html"), "utf8");
+  for (const folder of ["dashboard", "icons", "logo", "fonts", "next"]) {
+    await cp(join5(bundle, "assets", folder), join5(directory, "assets", folder), { recursive: true });
   }
-  await cp(join4(bundle, "assets", "brand.css"), join4(directory, "assets", "brand.css"));
+  await cp(join5(bundle, "assets", "brand.css"), join5(directory, "assets", "brand.css"));
   const data = await loadDashboardDiscovery(cwd, inventory);
   const payload = JSON.stringify(data).replace(/</g, "\\u003c");
-  const page2 = html.replaceAll('type="module"', "defer").replace('<script src="assets/dashboard/dashboard.js', `<script id="agenttwin-discovery" type="application/json">${payload}</script><script src="assets/dashboard/dashboard.js`).replace(/href="index.html"/g, 'href="../report.html"').replace(/href="docs\/"/g, 'href="../report.html"').replace("Docs \u2197", "Discovery report \u2197").replace("Runtime documentation \u2197", "Coverage report \u2197").replace("Back to website \u2197", "Discovery report \u2197");
-  await writeFile(join4(directory, "index.html"), page2, "utf8");
-  await writeFile(join4(directory, "assets", "dashboard", "inventory.json"), JSON.stringify(data), "utf8");
-  await writeFile(join4(directory, "assets", "dashboard", "runs.json"), '{"runs":[]}', "utf8");
-  return join4(directory, "index.html");
+  const page2 = html.replace("</head>", `<script id="agenttwin-discovery" type="application/json">${payload}</script></head>`).replace(/href="index.html"/g, 'href="../report.html"').replace(/href="docs\/"/g, 'href="../report.html"').replace("Docs \u2197", "Discovery report \u2197").replace("Runtime documentation \u2197", "Coverage report \u2197").replace("Back to website \u2197", "Discovery report \u2197");
+  await writeFile2(join5(directory, "index.html"), page2, "utf8");
+  await writeFile2(join5(directory, "assets", "dashboard", "inventory.json"), JSON.stringify(data), "utf8");
+  await writeFile2(join5(directory, "assets", "dashboard", "runs.json"), '{"runs":[]}', "utf8");
+  return join5(directory, "index.html");
 }
 var init_dashboard = __esm({
   "src/commands/dashboard.ts"() {
@@ -931,8 +1005,8 @@ __export(session_exports, {
   writeSessionTask: () => writeSessionTask
 });
 import { spawn, spawnSync } from "child_process";
-import { writeFile as writeFile2, readFile as readFile5 } from "fs/promises";
-import { join as join5 } from "path";
+import { writeFile as writeFile3, readFile as readFile6 } from "fs/promises";
+import { join as join6 } from "path";
 function sessionTask() {
   return `# Prepare this repository for AgentTwin
 
@@ -957,8 +1031,8 @@ function installedOpenCode() {
   return spawnSync("opencode", ["--version"], { stdio: "ignore", timeout: 5e3 }).status === 0;
 }
 async function writeSessionTask(cwd) {
-  const path = join5(cwd, ".agenttwin/AGENT-TASK.md");
-  await writeFile2(path, sessionTask(), "utf8");
+  const path = join6(cwd, ".agenttwin/AGENT-TASK.md");
+  await writeFile3(path, sessionTask(), "utf8");
   return path;
 }
 async function launchSession(cwd) {
@@ -973,14 +1047,14 @@ async function launchSession(cwd) {
 async function loadDashboardDiscovery(cwd, inventory) {
   let previousHead;
   try {
-    previousHead = JSON.parse(await readFile5(join5(cwd, ".agenttwin/git.json"), "utf8")).head;
+    previousHead = JSON.parse(await readFile6(join6(cwd, ".agenttwin/git.json"), "utf8")).head;
   } catch {
   }
   const git = await captureGit(cwd, previousHead);
   const base = discoveryTransfer({ ...dashboardInventory(cwd, inventory), ...git ? { git } : {} });
   let raw;
   try {
-    raw = await readFile5(join5(cwd, ".agenttwin/agent-discovery.json"), "utf8");
+    raw = await readFile6(join6(cwd, ".agenttwin/agent-discovery.json"), "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return projectProducts(cwd, base, base);
     throw error;
@@ -1055,8 +1129,8 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 import { parseArgs } from "util";
 
 // src/commands/sync.ts
-import { readFile as readFile6, writeFile as writeFile3 } from "fs/promises";
-import { join as join6 } from "path";
+import { readFile as readFile7, writeFile as writeFile4 } from "fs/promises";
+import { join as join7 } from "path";
 
 // src/runtime/receipt-sync.ts
 init_git();
@@ -1204,28 +1278,28 @@ async function runSync(cwd) {
   const token = process.env.AGENTTWIN_TOKEN;
   if (!token || !/^at_user_[a-f0-9]{64}$/.test(token)) throw new Error("Set AGENTTWIN_TOKEN to your individual account token.");
   const base = apiBase(process.env.AGENTTWIN_API_URL || "https://agenttwin-api.212.56.40.125.sslip.io");
-  const inventory = JSON.parse(await readFile6(join6(cwd, ".agenttwin/inventory.json"), "utf8"));
+  const inventory = JSON.parse(await readFile7(join7(cwd, ".agenttwin/inventory.json"), "utf8"));
   const payload = await loadDashboardDiscovery(cwd, inventory);
   const git = payload.git;
   const response = await fetch(base + "/v1/discovery", { method: "POST", headers: { authorization: "Bearer " + token, "content-type": "application/json" }, body: JSON.stringify(payload), redirect: "error", signal: AbortSignal.timeout(2e4) });
   const result = await response.json();
   if (!response.ok) throw new Error(result.error || "Discovery sync failed: " + response.status);
-  if (git) await writeFile3(join6(cwd, ".agenttwin/git.json"), JSON.stringify(git) + "\n", { mode: 384 });
+  if (git) await writeFile4(join7(cwd, ".agenttwin/git.json"), JSON.stringify(git) + "\n", { mode: 384 });
   const receipts = await syncReceipts(cwd, base, token);
-  return { receipts, synced: true, tools: payload.tools.length, workflows: payload.workflows.length, dashboard: "https://agenttwin.si/site/dashboard.html", uploaded: "discovery, Git metadata and run evidence; no application source or credentials" };
+  return { receipts, synced: true, tools: payload.tools.length, workflows: payload.workflows.length, dashboard: "https://agenttwin.si/dashboard/", uploaded: "discovery, Git metadata and run evidence; no application source or credentials" };
 }
 
 // src/commands/prepare.ts
 init_git();
-import { mkdir as mkdir3, mkdtemp as mkdtemp2, readFile as readFile9, writeFile as writeFile5, rm as rm2 } from "fs/promises";
-import { join as join9, resolve as resolve2, dirname as dirname2 } from "path";
+import { mkdir as mkdir4, mkdtemp as mkdtemp2, readFile as readFile10, writeFile as writeFile6, rm as rm2 } from "fs/promises";
+import { join as join10, resolve as resolve2, dirname as dirname2 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
 
 // src/commands/run.ts
-import { mkdtemp, mkdir as mkdir2, readFile as readFile8, writeFile as writeFile4, realpath, lstat, rm, copyFile } from "fs/promises";
+import { mkdtemp, mkdir as mkdir3, readFile as readFile9, writeFile as writeFile5, realpath, lstat, rm, copyFile } from "fs/promises";
 import { tmpdir } from "os";
-import { basename as basename2, dirname, isAbsolute, join as join8, relative as relative2, resolve, sep as sep2 } from "path";
+import { basename as basename2, dirname, isAbsolute, join as join9, relative as relative2, resolve, sep as sep2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { createHash, randomUUID } from "crypto";
 
@@ -1478,17 +1552,17 @@ init_git();
 
 // src/runtime/e2b.ts
 import { Sandbox } from "e2b";
-import { readFile as readFile7 } from "fs/promises";
+import { readFile as readFile8 } from "fs/promises";
 import { randomBytes as randomBytes2 } from "crypto";
 import { homedir } from "os";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 async function executeE2B(stage, spec, log, signal) {
   signal?.throwIfAborted();
   const apiKey = process.env.E2B_API_KEY;
   if (!apiKey) throw new CliError("E2B_API_KEY is not configured", { code: EXIT.BLOCKED, action: "Set E2B_API_KEY in your shell. It remains on the host and is never passed to the application." });
   let saved = {};
   try {
-    saved = JSON.parse(await readFile7(join7(homedir(), ".agenttwin/runtime.json"), "utf8"));
+    saved = JSON.parse(await readFile8(join8(homedir(), ".agenttwin/runtime.json"), "utf8"));
   } catch {
   }
   const template = process.env.E2B_TEMPLATE_ID ?? saved.templateId;
@@ -1507,7 +1581,7 @@ async function executeE2B(stage, spec, log, signal) {
     signal?.throwIfAborted();
     await sandbox.commands.run("mkdir -p /input/app && chmod 755 /input /input/app", { user: "root" });
     for (const file of ["world.json", "worker.js", ...spec.files.map((f) => `app/${f}`)]) {
-      await sandbox.files.write(`/input/${file}`, new Uint8Array(await readFile7(join7(stage, file))).buffer, { user: "root" });
+      await sandbox.files.write(`/input/${file}`, new Uint8Array(await readFile8(join8(stage, file))).buffer, { user: "root" });
     }
     await sandbox.commands.run("chmod -R a+rX /input", { user: "root" });
     const runtimeEnv = {};
@@ -1630,12 +1704,12 @@ async function stageApplication(root, files, destination) {
     const source = await realpath(resolve(canonicalRoot, file));
     const rel = relative2(canonicalRoot, source);
     if (rel.startsWith(`..${sep2}`) || rel === ".." || isAbsolute(rel) || source !== resolve(canonicalRoot, file) || !(await lstat(source)).isFile()) throw new CliError(`Files must be regular files within the project, without symlinks: ${file}`, { code: EXIT.USAGE });
-    const contents = await readFile8(source);
+    const contents = await readFile9(source);
     bytes += contents.length;
     if (bytes > 20 * 1024 * 1024) throw new CliError("Application files exceed 20 MiB; supply a smaller built bundle", { code: EXIT.USAGE });
-    const target = join8(destination, file);
-    await mkdir2(dirname(target), { recursive: true });
-    await writeFile4(target, contents, { mode: 420 });
+    const target = join9(destination, file);
+    await mkdir3(dirname(target), { recursive: true });
+    await writeFile5(target, contents, { mode: 420 });
     digests[file] = createHash("sha256").update(contents).digest("hex");
   }
   return digests;
@@ -1644,14 +1718,14 @@ async function runWorld(cwd, opts) {
   const file = resolve(cwd, opts.file ?? "agenttwin.world.json");
   let spec;
   try {
-    spec = parseWorld(JSON.parse(await readFile8(file, "utf8")));
+    spec = parseWorld(JSON.parse(await readFile9(file, "utf8")));
   } catch (error) {
     throw new CliError(String(error), { code: EXIT.USAGE, action: "Create agenttwin.world.json; run agenttwin example --out ./agenttwin-example for a working example." });
   }
   if (spec.workflowId) {
     let inventory;
     try {
-      inventory = JSON.parse(await readFile8(join8(cwd, ".agenttwin/inventory.json"), "utf8"));
+      inventory = JSON.parse(await readFile9(join9(cwd, ".agenttwin/inventory.json"), "utf8"));
     } catch {
       throw new CliError("Linked workflow needs discovery inventory; run init first", { code: EXIT.BLOCKED });
     }
@@ -1664,26 +1738,26 @@ async function runWorld(cwd, opts) {
   const runtime = opts.runtime ?? "local";
   if (!["local", "e2b", "hosted"].includes(runtime)) throw new CliError("runtime must be local, hosted or e2b", { code: EXIT.USAGE });
   if (runtime === "e2b" && !process.env.E2B_API_KEY) throw new CliError("E2B_API_KEY is not configured", { code: EXIT.BLOCKED, action: "Configure your E2B key in the shell; it will not be uploaded." });
-  const stage = await mkdtemp(join8(tmpdir(), "agenttwin-world-"));
+  const stage = await mkdtemp(join9(tmpdir(), "agenttwin-world-"));
   try {
-    const sourceDigests = await stageApplication(dirname(file), spec.files, join8(stage, "app"));
-    await writeFile4(join8(stage, "world.json"), JSON.stringify(spec), { mode: 420 });
+    const sourceDigests = await stageApplication(dirname(file), spec.files, join9(stage, "app"));
+    await writeFile5(join9(stage, "world.json"), JSON.stringify(spec), { mode: 420 });
     const git = await captureGit(cwd);
     let project;
     try {
-      project = JSON.parse(await readFile8(join8(cwd, ".agenttwin/inventory.json"), "utf8")).name ?? basename2(cwd);
+      project = JSON.parse(await readFile9(join9(cwd, ".agenttwin/inventory.json"), "utf8")).name ?? basename2(cwd);
     } catch {
     }
     if (runtime === "local") {
       opts.log("Testing through the CLI with in-process service twins. No cloud VM or containers.");
-      const report2 = await executeLocal(join8(stage, "app"), spec, opts.signal);
+      const report2 = await executeLocal(join9(stage, "app"), spec, opts.signal);
       const runId2 = randomUUID();
       const receipt2 = { ...report2, runId: runId2, runtime, project, git, createdAt: (/* @__PURE__ */ new Date()).toISOString(), sourceDigests, specDigest: createHash("sha256").update(JSON.stringify(spec)).digest("hex"), provenance: "CLI-reported execution" };
       const out2 = resolve(cwd, opts.out ?? `.agenttwin/runs/${runId2}`);
-      await mkdir2(out2, { recursive: true });
-      const evidencePath = join8(out2, "run.json"), reportPath = join8(out2, "report.md");
-      await writeFile4(evidencePath, JSON.stringify(receipt2, null, 2) + "\n", { mode: 384 });
-      await writeFile4(reportPath, `# ${spec.name}: ${receipt2.status}
+      await mkdir3(out2, { recursive: true });
+      const evidencePath = join9(out2, "run.json"), reportPath = join9(out2, "report.md");
+      await writeFile5(evidencePath, JSON.stringify(receipt2, null, 2) + "\n", { mode: 384 });
+      await writeFile5(reportPath, `# ${spec.name}: ${receipt2.status}
 
 Runner: CLI
 Git: ${git?.head ?? "unavailable"}
@@ -1691,8 +1765,8 @@ Git: ${git?.head ?? "unavailable"}
 ` + receipt2.assertions.map((a) => `- ${a.passed ? "PASS" : "FAIL"} ${a.service}${a.path}: expected ${a.count}, observed ${a.actual}`).join("\n") + "\n\nSee run.json for activities, fault and initial/final state.\n");
       return { ...receipt2, reportPath, evidencePath };
     }
-    const worker = join8(dirname(fileURLToPath2(import.meta.url)), "worker.js");
-    await copyFile(worker, join8(stage, "worker.js"));
+    const worker = join9(dirname(fileURLToPath2(import.meta.url)), "worker.js");
+    await copyFile(worker, join9(stage, "worker.js"));
     if (runtime === "hosted") {
       const receipt2 = await executeRemote(stage, spec, opts.log, { git, project });
       if (receipt2.schema !== "agenttwin/run-v1" || typeof receipt2.runId !== "string" || !/^[a-f0-9-]{36}$/.test(receipt2.runId) || !["passed", "failed", "error", "incomplete"].includes(String(receipt2.status))) throw new CliError("Invalid hosted receipt");
@@ -1700,11 +1774,11 @@ Git: ${git?.head ?? "unavailable"}
       const reportedSources = receipt2.sourceDigests;
       if (receipt2.specDigest !== expectedSpec || !reportedSources || Object.keys(reportedSources).length !== Object.keys(sourceDigests).length || Object.entries(sourceDigests).some(([path, digest]) => reportedSources[path] !== digest)) throw new CliError("Hosted receipt does not match the submitted source/specification");
       const out2 = resolve(cwd, opts.out ?? `.agenttwin/runs/${receipt2.runId}`);
-      await mkdir2(out2, { recursive: true });
-      const evidencePath = join8(out2, "run.json");
-      const reportPath = join8(out2, "report.md");
-      await writeFile4(evidencePath, JSON.stringify(receipt2, null, 2) + "\n", { mode: 384 });
-      await writeFile4(reportPath, `# ${spec.name}: ${receipt2.status}
+      await mkdir3(out2, { recursive: true });
+      const evidencePath = join9(out2, "run.json");
+      const reportPath = join9(out2, "report.md");
+      await writeFile5(evidencePath, JSON.stringify(receipt2, null, 2) + "\n", { mode: 384 });
+      await writeFile5(reportPath, `# ${spec.name}: ${receipt2.status}
 
 Run: ${receipt2.runId}
 
@@ -1738,12 +1812,12 @@ See run.json for assertions, service state, application output and isolation met
       isolation
     };
     const out = resolve(cwd, opts.out ?? `.agenttwin/runs/${runId}`);
-    await mkdir2(out, { recursive: true });
-    await writeFile4(join8(out, "run.json"), JSON.stringify(receipt, null, 2) + "\n", { mode: 384 });
-    await writeFile4(join8(out, "world.json"), JSON.stringify(spec, null, 2) + "\n", { mode: 384 });
+    await mkdir3(out, { recursive: true });
+    await writeFile5(join9(out, "run.json"), JSON.stringify(receipt, null, 2) + "\n", { mode: 384 });
+    await writeFile5(join9(out, "world.json"), JSON.stringify(spec, null, 2) + "\n", { mode: 384 });
     const summary = [`# ${spec.name}: ${report.status}`, "", `Run: ${runId}`, `Image: ${image}`, "", "## Assertions", "", ...report.assertions.map((a) => `- ${a.passed ? "PASS" : "FAIL"} ${a.service}${a.path}: expected ${a.count}, observed ${a.actual}`), "", "## Infrastructure assertions", "", ...(report.infrastructureAssertions ?? []).map((a) => `- ${a.passed ? "PASS" : "FAIL"} ${a.service}: ${JSON.stringify(a.actual)}`), "", "## Coverage", "", report.coverage, "", "External networking disabled. Only explicitly listed source files were uploaded. New state and tokens are created for each run.", "", "See run.json for application output, faults, events, and initial/final state.", ""].join("\n");
-    await writeFile4(join8(out, "report.md"), summary);
-    return { ...receipt, reportPath: join8(out, "report.md"), evidencePath: join8(out, "run.json") };
+    await writeFile5(join9(out, "report.md"), summary);
+    return { ...receipt, reportPath: join9(out, "report.md"), evidencePath: join9(out, "run.json") };
   } finally {
     await rm(stage, { recursive: true, force: true });
   }
@@ -1797,36 +1871,36 @@ function reviewPreparation(inventory, input) {
 async function runPrepare(cwd, opts) {
   if (!opts.file) throw new CliError("prepare requires --file preparation.json", { code: EXIT.USAGE });
   const file = resolve2(cwd, opts.file);
-  const inventory = JSON.parse(await readFile9(join9(cwd, ".agenttwin/inventory.json"), "utf8"));
+  const inventory = JSON.parse(await readFile10(join10(cwd, ".agenttwin/inventory.json"), "utf8"));
   const discovered = await loadDashboardDiscovery(cwd, inventory);
   const known = new Set(inventory.workflows.map((w) => w.id));
   for (const w of discovered.workflows) if (!known.has(w.id)) {
     inventory.workflows.push({ ...w, confidence: "low", apps: [], sharedEntities: [], evidence: [{ source: "agent-analysis", ref: ".agenttwin/agent-discovery.json" }], steps: w.steps.map((s) => ({ ...s, app: "", evidence: [] })), risk: "high", rank: 0, supported: false, hypothesis: true, linkingSignals: ["Coding-agent analysis requires user review"], scopeUncertain: true, verified: false });
   }
   for (const t of discovered.tools) if (!inventory.tools.some((tool) => tool.id === t.id)) throw new Error("Agent-discovered dependencies must be classified in init before preparation. Review the additional tool, then rerun init.");
-  const { spec, workflow, mappings } = reviewPreparation(inventory, JSON.parse(await readFile9(file, "utf8")));
+  const { spec, workflow, mappings } = reviewPreparation(inventory, JSON.parse(await readFile10(file, "utf8")));
   const directory = resolve2(cwd, opts.out ?? `.agenttwin/prepared/${spec.name}-${randomUUID2().slice(0, 8)}`);
-  const stage = await mkdtemp2(join9(tmpdir2(), "agenttwin-prepare-"));
+  const stage = await mkdtemp2(join10(tmpdir2(), "agenttwin-prepare-"));
   try {
     const sourceDigests = await stageApplication(dirname2(file), spec.files, stage);
     const files = /* @__PURE__ */ Object.create(null);
-    for (const name of spec.files) files[name] = (await readFile9(join9(stage, name))).toString("base64");
+    for (const name of spec.files) files[name] = (await readFile10(join10(stage, name))).toString("base64");
     const manifest = { project: discovered.name, git: await captureGit(cwd), schema: "agenttwin/prepared-v1", workflowId: workflow.id, invocation: spec.command, sourceDigests, specDigest: createHash2("sha256").update(JSON.stringify(spec)).digest("hex"), mappings, provenance: "user-reviewed invocation and operation contracts; discovery does not verify runtime fidelity", createdAt: (/* @__PURE__ */ new Date()).toISOString() };
-    await writeFile5(join9(stage, "agenttwin.world.json"), JSON.stringify(spec, null, 2) + "\n", { mode: 384 });
-    await writeFile5(join9(stage, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n", { mode: 384 });
-    await writeFile5(join9(stage, "agenttwin.bundle.json"), JSON.stringify({ schema: "agenttwin/upload-v1", spec, files, manifest }, null, 2) + "\n", { mode: 384 });
-    await mkdir3(join9(stage, ".agenttwin"), { recursive: true });
-    await writeFile5(join9(stage, ".agenttwin/inventory.json"), JSON.stringify({ name: discovered.name, workflows: [{ id: workflow.id }] }), { mode: 384 });
-    await mkdir3(dirname2(directory), { recursive: true });
-    await mkdir3(directory, { mode: 448 });
+    await writeFile6(join10(stage, "agenttwin.world.json"), JSON.stringify(spec, null, 2) + "\n", { mode: 384 });
+    await writeFile6(join10(stage, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n", { mode: 384 });
+    await writeFile6(join10(stage, "agenttwin.bundle.json"), JSON.stringify({ schema: "agenttwin/upload-v1", spec, files, manifest }, null, 2) + "\n", { mode: 384 });
+    await mkdir4(join10(stage, ".agenttwin"), { recursive: true });
+    await writeFile6(join10(stage, ".agenttwin/inventory.json"), JSON.stringify({ name: discovered.name, workflows: [{ id: workflow.id }] }), { mode: 384 });
+    await mkdir4(dirname2(directory), { recursive: true });
+    await mkdir4(directory, { mode: 448 });
     try {
       const { cp: cp2, readdir: readdir3 } = await import("fs/promises");
-      for (const entry of await readdir3(stage)) await cp2(join9(stage, entry), join9(directory, entry), { recursive: true, force: false, errorOnExist: true });
+      for (const entry of await readdir3(stage)) await cp2(join10(stage, entry), join10(directory, entry), { recursive: true, force: false, errorOnExist: true });
     } catch (error) {
       await rm2(directory, { recursive: true, force: true });
       throw error;
     }
-    return { directory, worldPath: join9(directory, "agenttwin.world.json"), bundlePath: join9(directory, "agenttwin.bundle.json"), manifest };
+    return { directory, worldPath: join10(directory, "agenttwin.world.json"), bundlePath: join10(directory, "agenttwin.bundle.json"), manifest };
   } finally {
     await rm2(stage, { recursive: true, force: true });
   }
@@ -1834,9 +1908,9 @@ async function runPrepare(cwd, opts) {
 
 // src/commands/setup.ts
 import { Template } from "e2b";
-import { mkdir as mkdir4, writeFile as writeFile6 } from "fs/promises";
+import { mkdir as mkdir5, writeFile as writeFile7 } from "fs/promises";
 import { homedir as homedir2 } from "os";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 async function runSetup(log) {
   if (!process.env.E2B_API_KEY) throw new CliError("Set E2B_API_KEY before creating your hosted runtime template", { code: EXIT.BLOCKED });
   log("Building the AgentTwin template on E2B (Node 22, PostgreSQL 15, Redis). No local containers are used.");
@@ -1844,16 +1918,16 @@ async function runSetup(log) {
   const result = await Template.build(template, "agenttwin-node-v2", { apiKey: process.env.E2B_API_KEY, cpuCount: 2, memoryMB: 2048, onBuildLogs: (entry) => {
     if (!entry.message.includes("[stdout]") && !entry.message.includes("[stderr]")) log(entry.message);
   } });
-  const directory = join10(homedir2(), ".agenttwin");
-  await mkdir4(directory, { recursive: true, mode: 448 });
-  const path = join10(directory, "runtime.json");
-  await writeFile6(path, JSON.stringify({ provider: "e2b", templateId: result.templateId, buildId: result.buildId }, null, 2) + "\n", { mode: 384 });
+  const directory = join11(homedir2(), ".agenttwin");
+  await mkdir5(directory, { recursive: true, mode: 448 });
+  const path = join11(directory, "runtime.json");
+  await writeFile7(path, JSON.stringify({ provider: "e2b", templateId: result.templateId, buildId: result.buildId }, null, 2) + "\n", { mode: 384 });
   return { provider: "e2b", templateId: result.templateId, buildId: result.buildId, configPath: path };
 }
 
 // src/commands/example.ts
-import { mkdir as mkdir5, writeFile as writeFile7, stat as stat2 } from "fs/promises";
-import { resolve as resolve3, join as join11 } from "path";
+import { mkdir as mkdir6, writeFile as writeFile8, stat as stat2 } from "fs/promises";
+import { resolve as resolve3, join as join12 } from "path";
 var exampleSource = `// Replace this file with your own bundled Node workflow.
 const safe = process.argv.includes('--safe');
 const crm = process.env.AGENTTWIN_CRM_URL;
@@ -1897,17 +1971,17 @@ function exampleWorld(safe = false) {
 async function runExample(cwd, out) {
   const directory = resolve3(cwd, out ?? "agenttwin-example");
   if (await stat2(directory).then(() => true, () => false)) throw new CliError(`Destination exists: ${directory}`, { code: EXIT.USAGE, action: "Choose a new --out directory." });
-  await mkdir5(directory, { recursive: true });
-  await writeFile7(join11(directory, "workflow.mjs"), exampleSource);
-  await writeFile7(join11(directory, "agenttwin.world.json"), JSON.stringify(exampleWorld(), null, 2) + "\n");
-  await writeFile7(join11(directory, "safe.world.json"), JSON.stringify(exampleWorld(true), null, 2) + "\n");
-  await writeFile7(join11(directory, "README.md"), `# Support workflow
+  await mkdir6(directory, { recursive: true });
+  await writeFile8(join12(directory, "workflow.mjs"), exampleSource);
+  await writeFile8(join12(directory, "agenttwin.world.json"), JSON.stringify(exampleWorld(), null, 2) + "\n");
+  await writeFile8(join12(directory, "safe.world.json"), JSON.stringify(exampleWorld(true), null, 2) + "\n");
+  await writeFile8(join12(directory, "README.md"), `# Support workflow
 
 Run with agenttwin run --file agenttwin.world.json (expected FAIL), then --file safe.world.json (expected PASS). Runs through the CLI with in-process service twins by default. No VM or containers. Use --runtime hosted or --runtime e2b explicitly only when a cloud machine is needed.
 
 This is actual application code using a synthetic custom ticket API plus the supported Slack JSON subset. It is not a clone of a CRM vendor. Replace workflow.mjs with your own built code and edit the explicit file list, endpoints, seed records and assertions. No npm install runs in the sandbox; dependencies must be bundled into your application.
 `);
-  return { directory, worldPath: join11(directory, "agenttwin.world.json") };
+  return { directory, worldPath: join12(directory, "agenttwin.world.json") };
 }
 
 // src/commands/init.ts
@@ -2513,7 +2587,7 @@ async function scanProvider(ctx, provider, files) {
   for (const path of files) {
     if (evidence.length >= MAX_EVIDENCE) break;
     if (isNonUsagePath(path)) continue;
-    const text = await ctx.files.read(path, 2e5);
+    const text = await ctx.files.read(path, 1e6);
     if (!text) continue;
     for (const re of importRes) {
       const m = text.match(re);
@@ -2742,13 +2816,13 @@ var containerDetector = {
 // src/discovery/detectors/cloud-creds.ts
 import { stat as stat3 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 var CREDENTIALS = [
-  { path: join12(homedir3(), ".aws", "config"), subject: "aws", title: "AWS" },
-  { path: join12(homedir3(), ".aws", "credentials"), subject: "aws", title: "AWS" },
-  { path: join12(homedir3(), ".config", "gcloud"), subject: "gcp", title: "Google Cloud" },
-  { path: join12(homedir3(), ".azure"), subject: "azure", title: "Azure" },
-  { path: join12(homedir3(), ".kube", "config"), subject: "kubernetes", title: "Kubernetes" }
+  { path: join13(homedir3(), ".aws", "config"), subject: "aws", title: "AWS" },
+  { path: join13(homedir3(), ".aws", "credentials"), subject: "aws", title: "AWS" },
+  { path: join13(homedir3(), ".config", "gcloud"), subject: "gcp", title: "Google Cloud" },
+  { path: join13(homedir3(), ".azure"), subject: "azure", title: "Azure" },
+  { path: join13(homedir3(), ".kube", "config"), subject: "kubernetes", title: "Kubernetes" }
 ];
 async function exists(path) {
   try {
@@ -2833,7 +2907,7 @@ import { createServer as createServer2 } from "http";
 import { connect } from "net";
 import { readFileSync, rmSync, writeFileSync } from "fs";
 import { tmpdir as tmpdir3 } from "os";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 var EGRESS_HOOK = `
 const fs = require('fs');
 const dns = require('dns');
@@ -2903,8 +2977,8 @@ function startProxy(onHost) {
 async function observeEgress(opts) {
   const hosts = /* @__PURE__ */ new Set();
   const { server, url } = await startProxy((host) => hosts.add(host));
-  const logFile = join13(tmpdir3(), `agenttwin-egress-${process.pid}.log`);
-  const hookFile = join13(tmpdir3(), `agenttwin-egress-hook-${process.pid}.cjs`);
+  const logFile = join14(tmpdir3(), `agenttwin-egress-${process.pid}.log`);
+  const hookFile = join14(tmpdir3(), `agenttwin-egress-hook-${process.pid}.cjs`);
   try {
     writeFileSync(hookFile, EGRESS_HOOK, "utf8");
     writeFileSync(logFile, "", "utf8");
@@ -3614,7 +3688,7 @@ async function buildRelationships(apps, tools, files, decisions) {
   const entrypointCalls = [];
   const sourceText = /* @__PURE__ */ new Map();
   for (const path of sourceFiles) {
-    const text = await files.read(path, 2e5);
+    const text = await files.read(path, 1e6);
     if (!text) continue;
     sourceText.set(path, text);
     const app = appForPath(apps, path);
@@ -3921,7 +3995,7 @@ function categoryOfFinding(finding) {
     return envOrCredOnly ? "access" : "dependency";
   }
   if (finding.kind === "infra" || finding.kind === "datastore") {
-    return finding.evidence.length > 0 && finding.evidence.every((e) => e.signal === "credential") ? "access" : "dependency";
+    return finding.evidence.length > 0 && finding.evidence.every((e) => ["credential", "env", "container", "iac", "ci"].includes(e.signal)) ? "access" : "dependency";
   }
   if (finding.kind === "language" || finding.kind === "ci") return "tooling";
   return "dependency";
@@ -4072,7 +4146,8 @@ async function buildInventory({
       confidence: "medium"
     });
   }
-  const toolList = [...tools.values()].sort((a, b) => a.id.localeCompare(b.id));
+  const excluded = new Set(decisions.filter((d) => d.kind === "exclude_tool").map((d) => d.target));
+  const toolList = [...tools.values()].filter((t) => !excluded.has(t.id) && !t.aliases.some((a) => excluded.has(a))).sort((a, b) => a.id.localeCompare(b.id));
   const apps = await detectApps(files);
   const services = apps.map((app) => ({ id: app.id, title: app.title, frameworks: app.frameworks })).sort((a, b) => a.id.localeCompare(b.id));
   const { relationships, workflows, gaps, uncertainOperations } = await buildRelationships(
@@ -4135,71 +4210,8 @@ async function buildInventory({
   });
 }
 
-// src/inventory/store.ts
-import { mkdir as mkdir6, readFile as readFile10, writeFile as writeFile8 } from "fs/promises";
-import { join as join14 } from "path";
-var STORE_DIR = ".agenttwin";
-var STORE_GITIGNORE = [
-  "inventory.json",
-  "plan.json",
-  "permissions.local.json",
-  "report.html",
-  "demo/",
-  "trial/",
-  "feedback.json",
-  "cache/",
-  "logs/",
-  "connections/",
-  ""
-].join("\n");
-function storeDir(cwd) {
-  return join14(cwd, STORE_DIR);
-}
-function storePath(cwd, name) {
-  return join14(storeDir(cwd), name);
-}
-async function ensureStore(cwd) {
-  await mkdir6(storeDir(cwd), { recursive: true });
-  await writeFile8(storePath(cwd, ".gitignore"), STORE_GITIGNORE, "utf8");
-}
-async function readJson(path) {
-  try {
-    return JSON.parse(await readFile10(path, "utf8"));
-  } catch {
-    return void 0;
-  }
-}
-async function writeJson(path, value) {
-  await writeFile8(path, `${JSON.stringify(value, null, 2)}
-`, "utf8");
-}
-var readInventory = (cwd) => readJson(storePath(cwd, "inventory.json"));
-var writeInventory = (cwd, value) => writeJson(storePath(cwd, "inventory.json"), value);
-var readDecisions = (cwd) => readJson(storePath(cwd, "decisions.json"));
-var writeDecisions = (cwd, value) => writeJson(storePath(cwd, "decisions.json"), value);
-var readPlan = (cwd) => readJson(storePath(cwd, "plan.json"));
-var writePlan = (cwd, value) => writeJson(storePath(cwd, "plan.json"), value);
-var readPermissions = (cwd) => readJson(storePath(cwd, "permissions.local.json"));
-var writePermissions = (cwd, value) => writeJson(storePath(cwd, "permissions.local.json"), value);
-var readSources = (cwd) => readJson(storePath(cwd, "sources.json"));
-var writeSources = (cwd, value) => writeJson(storePath(cwd, "sources.json"), value);
-function defaultSources() {
-  return {
-    schema: "sources/v1",
-    note: "Declares desired discovery sources only. This file grants NO authorization.",
-    local: [
-      "static",
-      "environment",
-      "inspect:git-remotes",
-      "inspect:git-root",
-      "inspect:docker-images",
-      "inspect:docker-ps",
-      "inspect:docker-contexts",
-      "inspect:kubectl-contexts",
-      "inspect:aws-profiles"
-    ]
-  };
-}
+// src/commands/inventory.ts
+init_store();
 
 // src/inspect/registry.ts
 function record(store, finding) {
@@ -5131,7 +5143,7 @@ var CONFIRM_RELATIONSHIP_PREFIX = "confirm_relationship:";
 function generateQuestions(inventory, max = 5, stored = {}) {
   const questions = [];
   for (const tool of inventory.tools) {
-    if (tool.confidence !== "low") continue;
+    if (tool.confidence !== "low" || tool.category !== "dependency") continue;
     const id = `${TOOL_EXCLUDE_PREFIX}${tool.id}`;
     questions.push({
       id,
@@ -5145,6 +5157,7 @@ function generateQuestions(inventory, max = 5, stored = {}) {
     });
   }
   for (const evidence of inventory.unclassified) {
+    if (evidence.signal === "env") continue;
     const id = `${UNKNOWN_INCLUDE_PREFIX}${evidence.ref}`;
     questions.push({
       id,
@@ -5205,7 +5218,9 @@ function applyInventoryAnswers(inventory, answers) {
   return withCanonicalHash({
     ...inventory,
     tools: tools.sort((a, b) => a.id.localeCompare(b.id)),
-    workflows: inventory.workflows.map(
+    relationships: inventory.relationships.filter((r) => !drop.has(r.from) && !drop.has(r.to)),
+    coverage: { ...inventory.coverage, counts: { ...inventory.coverage.counts, tools: tools.length, classified: tools.filter((t) => t.kind !== "unknown").length } },
+    workflows: inventory.workflows.filter((w) => !w.tools.some((t) => drop.has(t))).map(
       (w) => confirmedWorkflows.has(w.id) ? { ...w, supported: true, hypothesis: false, linkingSignals: [...w.linkingSignals, "confirmed by decision"] } : w
     )
   });
@@ -5229,6 +5244,9 @@ function storedAnswers(decisions) {
   return map;
 }
 
+// src/commands/init.ts
+init_store();
+
 // src/discovery/questions/ask.ts
 import { createInterface } from "readline/promises";
 
@@ -5383,6 +5401,7 @@ init_session();
 // src/commands/preview.ts
 import { mkdir as mkdir7, readFile as readFile12, writeFile as writeFile10 } from "fs/promises";
 import { dirname as dirname3, join as join16, resolve as resolve4 } from "path";
+init_store();
 
 // src/preview/html.ts
 init_sanitize();
@@ -5498,26 +5517,27 @@ function renderOverview(inventory) {
     }
     for (const tool of tools.slice(0, limit)) {
       lines.push(
-        `    ${tool.title.padEnd(22)}${tool.kind.padEnd(16)}${facts2 ? tool.facts.map((f) => f.kind).join(",") : ""}`
+        `    ${tool.title} (${tool.kind})${facts2 ? " \u2014 " + tool.facts.map((f) => f.kind).join(", ") : ""}`
       );
     }
     if (tools.length > limit) lines.push(dim(`    \u2026 +${tools.length - limit} more`));
   };
-  bucket("Application dependencies", byCategory("dependency"), 12, true);
+  bucket("Integrations referenced by code or installed packages (usage not verified)", byCategory("dependency"), 20, false);
   bucket("Development tooling", byCategory("tooling"), 8, false);
-  bucket("Available access & configuration (not dependencies)", byCategory("access"), 8, false);
+  const configuration = byCategory("access");
+  if (configuration.length) lines.push(dim(`
+  ${configuration.length} configuration/access clues saved separately; not included as application dependencies.`));
   const failed = inventory.coverage.sources.filter((s) => s.status !== "ok" && s.status !== "skipped");
   lines.push("");
   lines.push(
-    `  Coverage: ${counts.tools} tools \xB7 ${counts.unclassified} unknown \xB7 ${failed.length} sources with gaps`
+    `  Discovery: ${inventory.workflows.length} workflow candidates \xB7 ${failed.length} scan limitations`
   );
   if (failed.length > 0) {
     lines.push(dim(`  Gaps: ${failed.map((s) => `${s.id}=${s.status}`).join(", ")}`));
   }
   if (inventory.unclassified.length > 0) {
     lines.push("");
-    lines.push("  Unknown (needs confirmation)");
-    for (const u of inventory.unclassified.slice(0, 5)) lines.push(`    ${u.ref} \u2014 ${u.reason}`);
+    lines.push(dim(`  ${inventory.unclassified.length} unmatched configuration clues saved for review. No setup required.`));
   }
   lines.push("");
   const supported = inventory.workflows.find((w) => w.supported);
@@ -5565,7 +5585,7 @@ async function runInit(opts) {
   setQuiet(opts.json);
   const interactive = !opts.json && !opts.yes && !opts.dryRun && (opts.interactive === true || !opts.json && process.stdin.isTTY === true && process.stdout.isTTY === true);
   const log = (message) => {
-    process.stderr.write(`${message}
+    if (!message.startsWith("inspect ")) process.stderr.write(`${message}
 `);
   };
   if (!opts.json) info(bold("Investigating your development environment\u2026"));
@@ -5581,7 +5601,12 @@ async function runInit(opts) {
     incremental: true,
     persist: false
   });
-  const inventory = result.inventory;
+  let inventory = result.inventory;
+  const excludedNames = new Set((opts.exclude ?? []).flatMap((v) => v.split(",")).map((v) => v.trim().toLowerCase()).filter(Boolean));
+  const excludedTools = inventory.tools.filter((t) => excludedNames.has(t.title.toLowerCase()) || excludedNames.has(t.id.toLowerCase()));
+  const unmatched = [...excludedNames].filter((n) => !excludedTools.some((t) => t.title.toLowerCase() === n || t.id.toLowerCase() === n));
+  if (unmatched.length) throw new Error(`Unknown exclusion: ${unmatched.join(", ")}. Use an exact integration name from discovery.`);
+  inventory = applyInventoryAnswers(inventory, Object.fromEntries(excludedTools.map((t) => [`tool.exclude:${t.id}`, false])));
   if (!opts.json) {
     info("");
     info(renderOverview(inventory));
@@ -5599,7 +5624,7 @@ async function runInit(opts) {
     const asked = await askQuestions(questions);
     answers = { ...answers, ...asked.answers };
   }
-  answers = { ...defaultAnswers(questions), ...answers };
+  answers = { ...stored, ...defaultAnswers(questions), ...answers };
   const finalInventory = applyInventoryAnswers(inventory, answers);
   const plan = buildPlan(finalInventory);
   if (interactive) {
@@ -5612,6 +5637,8 @@ async function runInit(opts) {
   }
   const existing = opts.force ? void 0 : await readConfig(opts.cwd);
   const config = buildConfigFromInventory(finalInventory, existing);
+  const excludedIds = /* @__PURE__ */ new Set([...excludedTools.map((t) => t.id), ...decisions.filter((d) => d.kind === "exclude_tool").map((d) => d.target)]);
+  config.twins = config.twins.filter((id) => !excludedIds.has(id));
   let wrote = false;
   let reportPath;
   let dashboardPath;
@@ -5619,7 +5646,7 @@ async function runInit(opts) {
     await ensureStore(opts.cwd);
     await writeDecisions(opts.cwd, {
       schema: "decisions/v1",
-      items: mergeDecisions(decisions, answersToDecisions(answers, (/* @__PURE__ */ new Date()).toISOString()))
+      items: mergeDecisions(decisions, [...answersToDecisions(answers, (/* @__PURE__ */ new Date()).toISOString()), ...excludedTools.map((t) => ({ id: `exclude_tool:${t.id}`, kind: "exclude_tool", target: t.id, value: true, at: (/* @__PURE__ */ new Date()).toISOString(), note: "Excluded by repository owner during init" }))])
     });
     await writeInventory(opts.cwd, finalInventory);
     await writePlan(opts.cwd, plan);
@@ -5727,6 +5754,7 @@ function helpText() {
     `  ${"--incremental".padEnd(20)}Reconcile against the previous inventory`,
     `  ${"--yes / --non-interactive".padEnd(20)}Never prompt`,
     `  ${"--dry-run".padEnd(20)}init: discover without writing any files`,
+    `  ${"--exclude <names>".padEnd(20)}init: remember unused integrations (comma-separated names)`,
     `  ${"--out <path>".padEnd(20)}run/example: output directory; report: HTML file`,
     `  ${"--runtime <local|hosted|e2b>".padEnd(20)}run: local CLI by default; hosted API or E2B when a cloud VM is needed`,
     `  ${"-v, --version".padEnd(20)}Print the installed version`,
@@ -5751,6 +5779,7 @@ async function main() {
         observe: { type: "boolean" },
         "observe-run": { type: "string" },
         answers: { type: "string" },
+        exclude: { type: "string", multiple: true },
         "max-questions": { type: "string" },
         interactive: { type: "boolean" },
         agent: { type: "string" },
@@ -5862,7 +5891,8 @@ ${result.uploaded}`);
           maxQuestions: Number(str("max-questions") ?? 8) || 8,
           interactive: flag("interactive"),
           agent: str("agent"),
-          sync: flag("sync")
+          sync: flag("sync"),
+          exclude: arr("exclude")
         });
         return;
       case "discover": {