getaura 0.1.5 → 0.1.7

package/dist/index.js

@@ -9,8 +9,8 @@ var __export = (target, all) => {
 import { Command, Option } from "commander";
 
 // src/commands/apply.ts
-import { existsSync as existsSync15, rmSync as rmSync6 } from "fs";
-import path17 from "path";
+import { existsSync as existsSync16, rmSync as rmSync6 } from "fs";
+import path18 from "path";
 
 // src/core/agents.ts
 var AGENT_LAYOUT = {
@@ -36,6 +36,25 @@ function uniqueSkillDirs(agents) {
 }
 var AURA_BLOCK_START = "<!-- aura:start -->";
 var AURA_BLOCK_END = "<!-- aura:end -->";
+function detectAgentsFrom(exists2) {
+  const found = [];
+  if (exists2("CLAUDE.md") || exists2(".claude")) found.push("claude");
+  if (exists2(".codex")) found.push("codex");
+  if (exists2(".cursor") || exists2(".cursorrules")) found.push("cursor");
+  if (exists2(".pi")) found.push("pi");
+  if (found.length === 0 && exists2("AGENTS.md")) found.push("codex");
+  return found;
+}
+function runningAgent(env = process.env) {
+  if (env.CLAUDECODE) return "claude";
+  if (env.CODEX_THREAD_ID) return "codex";
+  if (env.CURSOR_AGENT) return "cursor";
+  if (env.PI_CODING_AGENT) return "pi";
+  return null;
+}
+function inCI(env = process.env) {
+  return Boolean(env.CI) && !runningAgent(env);
+}
 
 // ../shared/src/types.ts
 var CATEGORIES = ["security", "agent-setup", "foundations", "structure"];
@@ -990,10 +1009,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path21) {
-  if (!path21)
+function getElementAtPath(obj, path25) {
+  if (!path25)
     return obj;
-  return path21.reduce((acc, key) => acc?.[key], obj);
+  return path25.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -1333,11 +1352,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path21, issues) {
+function prefixIssues(path25, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path21);
+    iss.path.unshift(path25);
     return iss;
   });
 }
@@ -1787,16 +1806,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path21 = []) => {
+  const processError = (error63, path25 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path21, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path25, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path21, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path25, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path21, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path25, ...issue2.path]);
       } else {
-        const fullpath = [...path21, ...issue2.path];
+        const fullpath = [...path25, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -1835,17 +1854,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path21 = []) => {
+  const processError = (error63, path25 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path21, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path25, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path21, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path25, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path21, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path25, ...issue2.path]);
       } else {
-        const fullpath = [...path21, ...issue2.path];
+        const fullpath = [...path25, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -1884,8 +1903,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path21 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path21) {
+  const path25 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path25) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -18987,13 +19006,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path21 = ref.slice(1).split("/").filter(Boolean);
-  if (path21.length === 0) {
+  const path25 = ref.slice(1).split("/").filter(Boolean);
+  if (path25.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path21[0] === defsKey) {
-    const key = path21[1] === void 0 ? void 0 : decodeJSONPointerSegment(path21[1]);
+  if (path25[0] === defsKey) {
+    const key = path25[1] === void 0 ? void 0 : decodeJSONPointerSegment(path25[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -19939,14 +19958,58 @@ var SummaryRequest = external_exports.object({
   resolvedFindings: external_exports.array(external_exports.string().max(300)).max(50)
 });
 var SummaryResponse = external_exports.object({ summary: external_exports.string() });
+var SETUP_STEPS = [
+  "started",
+  "key_connected",
+  "brief_written",
+  "skill_installed",
+  "command_installed",
+  "command_install_failed",
+  "first_scan"
+];
+var FIX_OUTCOMES = [
+  "pr_opened",
+  "committed",
+  "no_changes",
+  "failed",
+  "cancelled",
+  "task_written",
+  "shown",
+  "merged",
+  "closed",
+  "resolved",
+  "not_resolved"
+];
 var TelemetryRequest = external_exports.object({
-  event: external_exports.enum(["scan", "action"]),
+  event: external_exports.enum(["scan", "action", "setup", "fix_result", "error"]),
   auraVersion: external_exports.string().max(40),
   /** Anonymous, stable per-repo id (hash of the first commit), never the repo name. */
   repoId: external_exports.string().max(80),
+  /** Who ran Aura: a person at a terminal, a coding agent or CI. */
+  source: external_exports.enum(["terminal", "agent", "ci"]).optional(),
+  /** The coding agent that ran this command, when it could be told. */
+  agent: external_exports.enum(["claude", "codex", "cursor", "pi"]).optional(),
+  /** The coding agents set up in this repo. */
+  agents: external_exports.array(external_exports.enum(["claude", "codex", "cursor", "pi"])).max(4).optional(),
+  os: external_exports.enum(["darwin", "win32", "linux", "other"]).optional(),
+  nodeVersion: external_exports.string().regex(/^v?\d+\.\d+\.\d+$/).optional(),
   score: external_exports.number().optional(),
   categories: external_exports.record(external_exports.string(), external_exports.number().nullable()).optional(),
-  actionId: external_exports.string().max(80).optional()
+  /** Findings by severity, and the ids of checks that didn't fully pass (never file names). */
+  findings: external_exports.record(severity, external_exports.number().int().nonnegative()).optional(),
+  failingChecks: external_exports.array(external_exports.string().regex(/^[a-z-]+\.[a-z-]+$/)).max(40).optional(),
+  actionId: external_exports.string().regex(/^[a-z0-9-]{1,80}$/).optional(),
+  step: external_exports.enum(SETUP_STEPS).optional(),
+  outcome: external_exports.enum(FIX_OUTCOMES).optional(),
+  delivery: external_exports.enum(["pr", "agent-fix", "agent-task", "guide", "checklist"]).optional(),
+  /** Whether the user picked it from the next-steps checklist or ran the command. */
+  via: external_exports.enum(["checklist", "command"]).optional(),
+  durationMs: external_exports.number().int().nonnegative().max(864e5).optional(),
+  agentSteps: external_exports.number().int().nonnegative().max(1e3).optional(),
+  scoreChange: external_exports.number().optional(),
+  command: external_exports.string().regex(/^[a-z-]{1,30}$/).optional(),
+  /** The kind of error (its class or code), never its message, which can contain paths. */
+  errorType: external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,59}$/).optional()
 });
 var MeResponse = external_exports.object({
   name: external_exports.string(),
@@ -19969,7 +20032,6 @@ var ConnectStartResponse = external_exports.object({
 var ConnectPollRequest = external_exports.object({ deviceSecret: external_exports.string().min(20).max(200) });
 var ConnectPollResponse = external_exports.discriminatedUnion("status", [
   external_exports.object({ status: external_exports.literal("pending") }),
-  external_exports.object({ status: external_exports.literal("skipped") }),
   external_exports.object({ status: external_exports.literal("expired") }),
   /** `encryptedKey` is base64 RSA-OAEP (SHA-256) ciphertext of the pilot key. */
   external_exports.object({ status: external_exports.literal("complete"), encryptedKey: external_exports.string(), name: external_exports.string() })
@@ -20036,15 +20098,17 @@ function quoteForCmd(arg) {
   return /^[\w@%+=:,./\\-]+$/.test(arg) ? arg : `"${arg.replace(/"/g, '\\"')}"`;
 }
 function spawnPlan(cmd, args, platform = process.platform) {
-  const direct = platform !== "win32" || cmd.includes("/") || cmd.includes("\\") || WINDOWS_PROGRAMS.has(cmd.toLowerCase());
-  return direct ? { args, shell: false } : { args: args.map(quoteForCmd), shell: true };
+  const isPath = cmd.includes("/") || cmd.includes("\\");
+  const script = /\.(?:cmd|bat)$/i.test(cmd);
+  const direct = platform !== "win32" || isPath && !script || WINDOWS_PROGRAMS.has(cmd.toLowerCase());
+  return direct ? { command: cmd, args, shell: false } : { command: quoteForCmd(cmd), args: args.map(quoteForCmd), shell: true };
 }
 function run(cmd, args, opts = {}) {
   return new Promise((resolve) => {
     let child;
     try {
       const plan = spawnPlan(cmd, args);
-      child = spawn(cmd, plan.args, { cwd: opts.cwd, env: opts.env ?? process.env, stdio: ["pipe", "pipe", "pipe"], shell: plan.shell });
+      child = spawn(plan.command, plan.args, { cwd: opts.cwd, env: opts.env ?? process.env, stdio: ["pipe", "pipe", "pipe"], shell: plan.shell });
     } catch (err) {
       resolve({ code: 127, stdout: "", stderr: String(err) });
       return;
@@ -20203,6 +20267,7 @@ var AURA_GITIGNORE = `# Aura local files: they can describe security weaknesses,
 report.md
 scan.json
 history.json
+fixes.json
 cache/
 tasks/
 `;
@@ -20267,6 +20332,12 @@ var ENV_SERVICES = [
   [/^SLACK_/, "Slack"]
 ];
 var BUILTIN_ENV = /* @__PURE__ */ new Set([
+  "USERPROFILE",
+  "APPDATA",
+  "LOCALAPPDATA",
+  "SYSTEMROOT",
+  "COMSPEC",
+  "PROGRAMFILES",
   "NODE_ENV",
   "CI",
   "PORT",
@@ -20288,7 +20359,7 @@ var BUILTIN_ENV = /* @__PURE__ */ new Set([
   "TMPDIR",
   "HOSTNAME"
 ]);
-var ENV_REF = /process\.env\.([A-Z][A-Z0-9_]*)|process\.env\[\s*['"]([A-Z][A-Z0-9_]*)['"]\s*\]|import\.meta\.env\.([A-Z][A-Z0-9_]*)|Deno\.env\.get\(\s*['"]([A-Z][A-Z0-9_]*)['"]\s*\)/g;
+var ENV_REF = /process\.env\.([A-Za-z_][A-Za-z0-9_]*)|process\.env\[\s*['"]([A-Za-z_][A-Za-z0-9_]*)['"]\s*\]|import\.meta\.env\.([A-Za-z_][A-Za-z0-9_]*)|Deno\.env\.get\(\s*['"]([A-Za-z_][A-Za-z0-9_]*)['"]\s*\)/g;
 function serviceForEnv(name) {
   return ENV_SERVICES.find(([re]) => re.test(name))?.[1];
 }
@@ -20320,7 +20391,7 @@ function findEnvRefs(files, read2) {
     if (!text) continue;
     for (const m of text.matchAll(ENV_REF)) {
       const name = m[1] ?? m[2] ?? m[3] ?? m[4];
-      if (!name || BUILTIN_ENV.has(name) || inStringLiteral(text, m.index)) continue;
+      if (!name || /[a-z]/.test(name) || BUILTIN_ENV.has(name) || inStringLiteral(text, m.index)) continue;
       if (!map2.has(name)) map2.set(name, /* @__PURE__ */ new Set());
       map2.get(name).add(f);
     }
@@ -20429,7 +20500,7 @@ function pmCommands(pm) {
 // package.json
 var package_default = {
   name: "getaura",
-  version: "0.1.5",
+  version: "0.1.7",
   description: "Aura helps you and your coding agent follow best practices while you vibe code.",
   type: "module",
   bin: {
@@ -20438,7 +20509,9 @@ var package_default = {
   files: [
     "dist",
     "templates",
-    "README.md"
+    "README.md",
+    ".claude-plugin",
+    "plugin"
   ],
   engines: {
     node: ">=22"
@@ -20553,7 +20626,7 @@ function templateVars(root, scan, pkg, extra = {}) {
     scriptLine(pkg, cmds.run, "lint", "lint the code"),
     scriptLine(pkg, cmds.run, "typecheck", "check types") ?? (scan.stack.typescript ? `- \`${cmds.exec} tsc --noEmit\`: check types` : null),
     scriptLine(pkg, cmds.run, "build", "production build"),
-    "- `aura scan`: check the Aura score"
+    "- `aura scan`: check the Aura score (coding agents: `aura scan --json`, which never waits for input)"
   ].filter(Boolean);
   const nodeMajor = pkg?.engines?.node?.match(/(\d{2})/)?.[1];
   return {
@@ -20826,8 +20899,8 @@ function nextSteps(scan, opts = {}) {
 }
 
 // src/actions/generators.ts
-import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
-import path8 from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
+import path9 from "path";
 
 // src/checks/agent-setup.ts
 import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
@@ -20883,16 +20956,13 @@ function skillsIn(ctx, dir) {
 }
 function targetAgents(ctx) {
   if (ctx.config.agents.length) return ctx.config.agents;
-  const seen = [];
-  if (exists(ctx, "CLAUDE.md") || exists(ctx, ".claude")) seen.push("claude");
-  if (exists(ctx, "AGENTS.md")) seen.push("codex");
-  if (exists(ctx, ".cursor") || exists(ctx, ".cursorrules")) seen.push("cursor");
-  if (exists(ctx, ".pi")) seen.push("pi");
-  return seen;
+  return detectAgentsFrom((rel) => exists(ctx, rel));
 }
 function rulesFileFor(ctx, agent) {
   const preferred = AGENT_LAYOUT[agent].rulesFile;
   if (exists(ctx, preferred)) return preferred;
+  if (agent === "claude" && exists(ctx, ".claude/CLAUDE.md")) return ".claude/CLAUDE.md";
+  if (agent === "pi" && exists(ctx, "CLAUDE.md")) return "CLAUDE.md";
   if (agent === "cursor") {
     if (exists(ctx, ".cursorrules")) return ".cursorrules";
     try {
@@ -20973,7 +21043,7 @@ var skills = {
     const agents = targetAgents(ctx);
     const dirs = agents.length ? uniqueSkillDirs(agents) : ALL_SKILLS_DIRS;
     const starterNames = new Set(STARTER_SKILLS.map((s) => s.name));
-    const perDir = dirs.map((d) => ({ dir: d, skills: skillsIn(ctx, d).filter((s) => s !== "aura") }));
+    const perDir = dirs.map((d) => ({ dir: d, skills: skillsIn(ctx, d).filter((s) => s !== "aura" && !s.startsWith("aura-")) }));
     const best = Math.max(0, ...perDir.map((p2) => p2.skills.length));
     const weakest = agents.length ? Math.min(...perDir.map((p2) => p2.skills.length)) : best;
     if (weakest >= 3) return { status: "pass", summary: `${weakest}+ skills installed.` };
@@ -21023,13 +21093,13 @@ var brief = {
   weight: 5,
   run(ctx) {
     const file2 = BRIEF_PATHS.find((f) => exists(ctx, f));
-    const words = file2 ? readDisk(ctx, file2).split(/\s+/).filter(Boolean).length : 0;
+    const words2 = file2 ? readDisk(ctx, file2).split(/\s+/).filter(Boolean).length : 0;
     const committed = file2 && ctx.tracked ? ctx.tracked.has(file2) : true;
-    if (file2 && words >= 80 && committed) return { status: "pass", summary: `${file2} (${words} words).` };
+    if (file2 && words2 >= 80 && committed) return { status: "pass", summary: `${file2} (${words2} words).` };
     const finding = makeFinding(this, {
       severity: "medium",
       title: !file2 ? "No product brief" : !committed ? "Product brief isn\u2019t committed" : "Product brief is too short",
-      detail: !file2 ? "There is no product brief describing what the app does, who it\u2019s for and what data it handles." : !committed ? `${file2} exists on your machine but isn\u2019t committed, so your agent in other sessions and other people can\u2019t see it.` : `${file2} has only ${words} words.`,
+      detail: !file2 ? "There is no product brief describing what the app does, who it\u2019s for and what data it handles." : !committed ? `${file2} exists on your machine but isn\u2019t committed, so your agent in other sessions and other people can\u2019t see it.` : `${file2} has only ${words2} words.`,
       why: "The brief grounds every agent session in what you\u2019re actually building, and becomes page one of any handoff to engineers.",
       locations: file2 ? [{ file: file2 }] : [],
       actionId: "add-brief",
@@ -21128,12 +21198,64 @@ function unreachableFiles(files, read2, pkgScripts) {
   return source.filter((f) => !seen.has(f));
 }
 
-// src/actions/agent-files.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+// src/actions/agent-commands.ts
+import { readFileSync as readFileSync5 } from "fs";
 import path7 from "path";
+var AURA_COMMANDS = ["scan", "next", "fix", "setup"];
+function invocation(agent, command) {
+  return agent === "claude" ? `/aura:${command}` : agent === "codex" ? `$aura-${command}` : `/aura-${command}`;
+}
+function pluginCommand(command) {
+  const text = readFileSync5(path7.join(path7.dirname(templatesDir()), "plugin", "skills", command, "SKILL.md"), "utf8").replace(/\r\n/g, "\n");
+  const [, frontmatter = "", body = ""] = text.match(/^---\n([\s\S]*?)\n---\n+([\s\S]*)$/) ?? [];
+  const description = frontmatter.match(/^description: (.+)$/m)?.[1] ?? "";
+  return { description, body };
+}
+function adapt(agent, body) {
+  const args = agent === "pi" ? "Fix: $@\n\n" : "Fix the action or finding the user named after the command, if any.\n\n";
+  return body.replace(/\/aura:(scan|next|fix|setup)\b/g, (_, c) => invocation(agent, c)).replace("Fix: $ARGUMENTS\n\n", args).replace("--agent claude", `--agent ${agent}`);
+}
+function commandChanges(agents) {
+  const changes = [];
+  for (const agent of new Set(agents)) {
+    for (const command of AURA_COMMANDS) {
+      const { description, body } = pluginCommand(command);
+      const text = adapt(agent, body);
+      if (agent === "cursor") changes.push({ path: `.cursor/commands/aura-${command}.md`, content: `# Aura: ${description}
+
+${text}` });
+      if (agent === "pi") changes.push({ path: `.pi/prompts/aura-${command}.md`, content: `---
+description: ${description}
+---
+
+${text}` });
+      if (agent === "codex") {
+        const dir = `.agents/skills/aura-${command}`;
+        changes.push({
+          path: `${dir}/SKILL.md`,
+          content: `---
+name: aura-${command}
+description: ${description} Only when the user runs ${invocation(agent, command)}.
+---
+
+${text}`
+        });
+        changes.push({ path: `${dir}/agents/openai.yaml`, content: "policy:\n  allow_implicit_invocation: false\n" });
+      }
+    }
+  }
+  return changes;
+}
+function commandList(agent) {
+  return AURA_COMMANDS.map((c) => invocation(agent, c)).join(", ");
+}
+
+// src/actions/agent-files.ts
+import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
+import path8 from "path";
 function current(root, file2) {
-  const full = path7.join(root, file2);
-  return existsSync6(full) ? readFileSync5(full, "utf8") : null;
+  const full = path8.join(root, file2);
+  return existsSync6(full) ? readFileSync6(full, "utf8") : null;
 }
 function upsertBlock(existing, body) {
   const block = `${AURA_BLOCK_START}
@@ -21177,8 +21299,8 @@ function skillChanges(agents, names) {
 
 // src/actions/generators.ts
 function read(root, file2) {
-  const full = path8.join(root, file2);
-  return existsSync7(full) ? readFileSync6(full, "utf8") : null;
+  const full = path9.join(root, file2);
+  return existsSync7(full) ? readFileSync7(full, "utf8") : null;
 }
 function withScripts(root, scripts, overwrite = false) {
   const text = read(root, "package.json");
@@ -21199,7 +21321,7 @@ function findingMeta(scan, checkId, key) {
   return scan.checks.find((c) => c.checkId === checkId)?.findings[0]?.meta?.[key];
 }
 var addBrief = ({ root }) => {
-  const brief2 = BRIEF_PATHS.find((f) => existsSync7(path8.join(root, f)));
+  const brief2 = BRIEF_PATHS.find((f) => existsSync7(path9.join(root, f)));
   if (!brief2) return { skip: "There is no product brief yet. Run `aura init` to draft and confirm it first." };
   const changes = [
     { path: brief2, content: read(root, brief2) },
@@ -21214,22 +21336,24 @@ var addAgentRules = ({ root, agents, vars }) => {
 };
 var installSkills = ({ agents, skills: skills2 }) => {
   const names = [.../* @__PURE__ */ new Set([...skills2 ?? STARTER_SKILLS.map((s) => s.name), "aura"])];
-  const changes = skillChanges(agents, names);
   return {
-    changes,
-    details: names.map((n) => `- \`${n}\`: ${STARTER_SKILLS.find((s) => s.name === n)?.description ?? "check the Aura score and fix findings."}`)
+    changes: [...skillChanges(agents, names), ...commandChanges(agents)],
+    details: [
+      ...names.map((n) => `- \`${n}\`: ${STARTER_SKILLS.find((s) => s.name === n)?.description ?? "check the Aura score and fix findings."}`),
+      ...agents.filter((a) => a !== "claude").map((a) => `- Aura's commands for ${AGENT_LABELS[a]}: ${commandList(a)}`)
+    ]
   };
 };
 var tokenEfficiency = (g) => {
   const changes = [];
-  if (!existsSync7(path8.join(g.root, "docs/index.md"))) changes.push({ path: "docs/index.md", content: render("docs/index.md", g.vars) });
+  if (!existsSync7(path9.join(g.root, "docs/index.md"))) changes.push({ path: "docs/index.md", content: render("docs/index.md", g.vars) });
   changes.push(...rulesChanges(g.root, g.agents, g.vars));
   return { changes, details: ["- `docs/index.md`: a map of the repo your agent reads first", "- Lean-context rules in the agent rules file"] };
 };
 var addCi = ({ root, ctx, vars }) => {
   const existing = ctx.files.filter((f) => /^\.github\/workflows\//.test(f));
   const file2 = existing.includes(".github/workflows/ci.yml") ? ".github/workflows/checks.yml" : ".github/workflows/ci.yml";
-  if (existsSync7(path8.join(root, file2))) return { skip: `${file2} already exists.` };
+  if (existsSync7(path9.join(root, file2))) return { skip: `${file2} already exists.` };
   return {
     changes: [{ path: file2, content: render("github/workflows/ci.yml", vars) }],
     details: [`- \`${file2}\`: lint, type check, tests and build on every pull request`]
@@ -21253,7 +21377,7 @@ var setupTesting = ({ root, ctx, vars }) => {
   };
 };
 var addEnvExample = ({ root, scan }) => {
-  const file2 = [".env.example", ".env.sample", ".env.template"].find((f) => existsSync7(path8.join(root, f))) ?? ".env.example";
+  const file2 = [".env.example", ".env.sample", ".env.template"].find((f) => existsSync7(path9.join(root, f))) ?? ".env.example";
   const existing = read(root, file2);
   const declared = new Set(
     (existing ?? "").split(/\r?\n/).map((l) => l.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/)?.[1]).filter(Boolean)
@@ -21310,7 +21434,7 @@ var addLinting = ({ root, ctx }) => {
   return { changes, devDeps, details };
 };
 var addPreCommit = ({ root, ctx, vars }) => {
-  if (existsSync7(path8.join(root, ".husky/pre-commit"))) return { skip: "A husky pre-commit hook already exists." };
+  if (existsSync7(path9.join(root, ".husky/pre-commit"))) return { skip: "A husky pre-commit hook already exists." };
   const changes = [{ path: ".husky/pre-commit", content: render("configs/husky-pre-commit", vars) }];
   const scripts = withScripts(root, { prepare: "husky" }, false);
   if (scripts) changes.push(scripts);
@@ -21325,10 +21449,10 @@ var addReadme = ({ root, ctx, vars }) => {
   const file2 = ctx.files.find((f) => /^readme\.mdx?$/i.test(f)) ?? "README.md";
   const current2 = read(root, file2);
   const boilerplate = current2 && /create-next-app|bootstrapped with/i.test(current2);
-  const words = current2?.split(/\s+/).filter(Boolean).length ?? 0;
-  if (current2 && !boilerplate && words >= 80) return { skip: `${file2} already describes the app.` };
+  const words2 = current2?.split(/\s+/).filter(Boolean).length ?? 0;
+  if (current2 && !boilerplate && words2 >= 80) return { skip: `${file2} already describes the app.` };
   let content = render("readme/README.md", vars);
-  if (current2 && !boilerplate && words > 0) content = `${content.trimEnd()}
+  if (current2 && !boilerplate && words2 > 0) content = `${content.trimEnd()}
 
 ## Notes
 
@@ -21340,7 +21464,7 @@ ${current2.trim()}
   };
 };
 var enableDependencyUpdates = ({ root, vars }) => {
-  if ([".github/dependabot.yml", ".github/dependabot.yaml", "renovate.json", ".github/renovate.json"].some((f) => existsSync7(path8.join(root, f)))) {
+  if ([".github/dependabot.yml", ".github/dependabot.yaml", "renovate.json", ".github/renovate.json"].some((f) => existsSync7(path9.join(root, f)))) {
     return { skip: "Dependabot or Renovate is already configured." };
   }
   return {
@@ -21420,7 +21544,7 @@ function planMoves(root, ctx, moves) {
       const alias = aliasFor(toFile);
       if (alias) return alias[0] + noExt.slice(alias[1].length);
     }
-    let rel = path8.posix.relative(path8.posix.dirname(fromFile), noExt);
+    let rel = path9.posix.relative(path9.posix.dirname(fromFile), noExt);
     if (!rel.startsWith(".")) rel = `./${rel}`;
     return rel;
   };
@@ -21454,7 +21578,7 @@ function planMoves(root, ctx, moves) {
 }
 var moveMisplacedFiles = ({ root, ctx, scan }) => {
   const raw = findingMeta(scan, "structure.layout", "moves") ?? [];
-  const moves = raw.map((m) => m.split("=>")).filter(([, to]) => !existsSync7(path8.join(root, to))).slice(0, MAX_MOVES);
+  const moves = raw.map((m) => m.split("=>")).filter(([, to]) => !existsSync7(path9.join(root, to))).slice(0, MAX_MOVES);
   if (moves.length === 0) return { skip: "No files to move (or their targets already exist)." };
   return { changes: planMoves(root, ctx, moves), details: moves.map(([from, to]) => `- \`${from}\` \u2192 \`${to}\``), verifyTypes: true };
 };
@@ -21545,7 +21669,7 @@ var AuraClient = class _AuraClient {
   get hasKey() {
     return Boolean(this.key);
   }
-  async request(method, path21, body, timeoutMs = 6e4) {
+  async request(method, path25, body, timeoutMs = 6e4) {
     if (!this.key) throw new AuraApiError("no_key", "No pilot key");
     let payload;
     if (body !== void 0) {
@@ -21555,7 +21679,7 @@ var AuraClient = class _AuraClient {
     }
     let res;
     try {
-      res = await fetch(`${this.baseUrl}/v1/${path21}`, {
+      res = await fetch(`${this.baseUrl}/v1/${path25}`, {
         method,
         headers: { authorization: `Bearer ${this.key}`, "content-type": "application/json", "user-agent": `getaura/${AURA_VERSION}` },
         body: payload,
@@ -21580,22 +21704,162 @@ var AuraClient = class _AuraClient {
 
 // src/api/telemetry.ts
 import { createHash as createHash2 } from "crypto";
+
+// src/ui.ts
+import * as p from "@clack/prompts";
+import pc from "picocolors";
+function interactive() {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY && !inCI() && !runningAgent());
+}
+var UserCancelled = class extends Error {
+};
+function unwrap(value) {
+  if (p.isCancel(value)) {
+    p.cancel("Cancelled.");
+    throw new UserCancelled();
+  }
+  return value;
+}
+function spin(enabled) {
+  if (!enabled || !process.stdout.isTTY) {
+    return { start: (_m) => {
+    }, message: (_m) => {
+    }, stop: (_m) => {
+    }, error: (_m) => {
+    } };
+  }
+  const s = p.spinner();
+  return { start: (m) => s.start(m), message: (m) => s.message(m), stop: (m) => s.stop(m), error: (m) => s.error(m) };
+}
+function printJson(value) {
+  process.stdout.write(JSON.stringify(value, null, 2) + "\n");
+}
+var say = {
+  info: (m) => console.log(m),
+  ok: (m) => console.log(`${pc.green("\u2714")} ${m}`),
+  warn: (m) => console.error(`${pc.yellow("!")} ${m}`),
+  error: (m) => console.error(`${pc.red("\u2716")} ${m}`),
+  dim: (m) => console.log(pc.dim(m))
+};
+
+// src/fix-tracking.ts
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
+var FILE = "fixes.json";
+var MAX_AGE_MS = 60 * 24 * 60 * 60 * 1e3;
+var MAX_CHECKS_PER_SCAN = 5;
+function loadTrackedFixes(root) {
+  try {
+    return existsSync8(auraPath(root, FILE)) ? JSON.parse(readFileSync8(auraPath(root, FILE), "utf8")) : [];
+  } catch {
+    return [];
+  }
+}
+function save(root, fixes) {
+  writeAuraFile(root, FILE, JSON.stringify(fixes, null, 2));
+}
+function trackFix(root, config2, fix) {
+  if (!sharesUsage(config2)) return;
+  save(root, [...loadTrackedFixes(root).filter((f) => f.branch !== fix.branch), { ...fix, openedAt: (/* @__PURE__ */ new Date()).toISOString() }]);
+}
+async function prState(root, branch) {
+  const r = await run("gh", ["pr", "view", branch, "--json", "state,mergeCommit", "--jq", '[.state, .mergeCommit.oid // ""] | join(" ")'], {
+    cwd: root,
+    timeoutMs: 15e3
+  });
+  const [state, sha] = r.stdout.trim().split(" ");
+  if (r.code !== 0) return null;
+  if (state === "OPEN" || state === "CLOSED") return { state };
+  if (state !== "MERGED") return null;
+  const inCheckout = Boolean(sha) && (await run("git", ["merge-base", "--is-ancestor", sha, "HEAD"], { cwd: root })).code === 0;
+  return { state, inCheckout };
+}
+async function followUpFixes(root, config2, scan, state = prState) {
+  const tracked = loadTrackedFixes(root);
+  if (tracked.length === 0 || !sharesUsage(config2)) return;
+  const current2 = new Set(scan.checks.flatMap((c) => c.findings.map((f) => f.id)));
+  const keep = [];
+  for (const [i, fix] of tracked.entries()) {
+    if (Date.now() - Date.parse(fix.openedAt) > MAX_AGE_MS) continue;
+    const s = i < MAX_CHECKS_PER_SCAN ? await state(root, fix.branch) : null;
+    if (s?.state === "MERGED") {
+      if (!fix.merged) await recordUsage(root, config2, { event: "fix_result", actionId: fix.actionId, outcome: "merged" });
+      if (!s.inCheckout) {
+        keep.push({ ...fix, merged: true });
+        continue;
+      }
+      const stillThere = fix.findingIds.some((id) => current2.has(id));
+      await recordUsage(root, config2, {
+        event: "fix_result",
+        actionId: fix.actionId,
+        outcome: stillThere ? "not_resolved" : "resolved",
+        scoreChange: scan.score - fix.scoreBefore
+      });
+    } else if (s?.state === "CLOSED") {
+      await recordUsage(root, config2, { event: "fix_result", actionId: fix.actionId, outcome: "closed" });
+    } else keep.push(fix);
+  }
+  save(root, keep);
+}
+
+// src/api/telemetry.ts
+function sharesUsage(config2, key = getApiKey()) {
+  if (!key) return false;
+  if (config2.shareUsage !== void 0) return config2.shareUsage;
+  return key.startsWith("aura_live_") || config2.telemetry === true;
+}
+function runSource() {
+  return inCI() ? "ci" : interactive() ? "terminal" : "agent";
+}
+function osName() {
+  return process.platform === "darwin" || process.platform === "win32" || process.platform === "linux" ? process.platform : "other";
+}
 async function repoId(root) {
   const r = await run("git", ["rev-list", "--max-parents=0", "HEAD"], { cwd: root });
   const seed = r.code === 0 ? r.stdout.trim().split("\n")[0] : root;
   return createHash2("sha256").update(seed).digest("hex").slice(0, 24);
 }
-async function sendTelemetry(root, client, event) {
-  if (!client.hasKey) return;
+async function recordUsage(root, config2, event) {
+  if (!sharesUsage(config2)) return;
   try {
-    await client.request("POST", "telemetry", { ...event, auraVersion: AURA_VERSION, repoId: await repoId(root) }, 5e3);
+    const body = {
+      ...event,
+      auraVersion: AURA_VERSION,
+      repoId: await repoId(root),
+      source: runSource(),
+      agent: runningAgent() ?? void 0,
+      agents: config2.agents.length ? config2.agents : void 0,
+      os: osName(),
+      nodeVersion: process.version
+    };
+    await AuraClient.from(config2).request("POST", "telemetry", body, 5e3);
   } catch {
   }
 }
+function errorKind(err) {
+  const e = err;
+  const kind = typeof e?.code === "string" ? e.code : typeof e?.name === "string" ? e.name : "Error";
+  return /^[A-Za-z_][A-Za-z0-9_]{0,59}$/.test(kind) ? kind : "Error";
+}
+async function recordAction(root, config2, actionId, report, startedAt, via) {
+  if (!report.outcome) return;
+  await recordUsage(root, config2, {
+    event: "action",
+    actionId,
+    outcome: report.outcome,
+    delivery: report.delivery,
+    via,
+    durationMs: Date.now() - startedAt,
+    agentSteps: report.agentSteps,
+    errorType: report.errorType
+  });
+  if (report.outcome === "pr_opened" && report.branch) {
+    trackFix(root, config2, { actionId, branch: report.branch, findingIds: report.findingIds ?? [], scoreBefore: report.scoreBefore ?? 0 });
+  }
+}
 
 // src/core/git.ts
 import { mkdirSync as mkdirSync2, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import path9 from "path";
+import path10 from "path";
 async function git(root, ...args) {
   return run("git", args, { cwd: root });
 }
@@ -21610,7 +21874,7 @@ async function ghStatus(root) {
   const remote = await git(root, "remote", "get-url", "origin");
   return { installed: true, authed: auth.code === 0, hasRemote: remote.code === 0 && /github\.com/.test(remote.stdout) };
 }
-var AURA_OWNED = /^(?:\.aura\/|\.claude\/skills\/aura\/|\.agents\/skills\/aura\/)/;
+var AURA_OWNED = /^(?:\.aura\/|\.claude\/skills\/aura\/|\.agents\/skills\/aura(?:-(?:scan|next|fix|setup))?\/|\.cursor\/commands\/aura-[a-z]+\.md$|\.pi\/prompts\/aura-[a-z]+\.md$|\.claude\/settings\.json$)/;
 async function dirtyFiles(root) {
   const r = await git(root, "status", "--porcelain", "-uall");
   return r.stdout.split("\n").filter(Boolean).map((l) => l.slice(3).replace(/^"|"$/g, "").split(" -> ").pop()).filter((f) => !AURA_OWNED.test(f));
@@ -21629,11 +21893,11 @@ async function freeBranchName(root, base) {
 }
 function writeChanges(root, changes) {
   for (const c of changes) {
-    const full = path9.join(root, c.path);
+    const full = path10.join(root, c.path);
     if (!isInside(root, full)) throw new Error(`Refusing to write outside the repo: ${c.path}`);
     if (c.content === null) rmSync(full, { force: true });
     else {
-      mkdirSync2(path9.dirname(full), { recursive: true });
+      mkdirSync2(path10.dirname(full), { recursive: true });
       writeFileSync2(full, c.content);
     }
   }
@@ -21643,7 +21907,7 @@ async function commitPushPr(root, opts) {
   const base = { branch: opts.branch, url: null };
   if (commit.code !== 0) {
     const out = commit.stderr || commit.stdout;
-    const error62 = /tell me who you are|user\.email/i.test(out) ? 'git doesn\u2019t know your name and email yet. Run: git config --global user.name "Your Name" && git config --global user.email "you@example.com"' : out;
+    const error62 = /tell me who you are|user\.email/i.test(out) ? 'git doesn\u2019t know your name and email yet. Run these two commands:\n  git config --global user.name "Your Name"\n  git config --global user.email "you@example.com"' : out;
     return { ...base, committed: false, pushed: false, error: error62 };
   }
   if (!opts.openPr) return { ...base, committed: true, pushed: false };
@@ -21747,13 +22011,13 @@ var readme = {
   run(ctx) {
     const file2 = ctx.files.find((f) => /^readme(\.md|\.mdx|\.txt)?$/i.test(f));
     const text = file2 ? ctx.read(file2) ?? "" : "";
-    const words = text.split(/\s+/).filter(Boolean).length;
-    if (file2 && !BOILERPLATE.test(text) && words >= 80) return { status: "pass", summary: `${file2} (${words} words).` };
+    const words2 = text.split(/\s+/).filter(Boolean).length;
+    if (file2 && !BOILERPLATE.test(text) && words2 >= 80) return { status: "pass", summary: `${file2} (${words2} words).` };
     const boilerplate = Boolean(file2) && BOILERPLATE.test(text);
     const finding = makeFinding(this, {
       severity: "low",
       title: !file2 ? "No README" : boilerplate ? "README is still the starter template" : "README is very short",
-      detail: !file2 ? "There is no README describing what the app is, how to run it or how it is deployed." : boilerplate ? "The README is the default text from create-next-app and says nothing about this app." : `The README has only ${words} words, so it can't explain how to run or deploy the app.`,
+      detail: !file2 ? "There is no README describing what the app is, how to run it or how it is deployed." : boilerplate ? "The README is the default text from create-next-app and says nothing about this app." : `The README has only ${words2} words, so it can't explain how to run or deploy the app.`,
       why: "A good README is the first thing a new engineer or your coding agent reads; without it they guess.",
       locations: file2 ? [{ file: file2 }] : [],
       actionId: "add-readme",
@@ -21856,10 +22120,10 @@ var typecheck = {
   applies: (ctx) => ctx.stack.typescript,
   async run(ctx) {
     if (ctx.options.fast) return { status: "unknown", summary: "Skipped in fast mode." };
-    const { existsSync: existsSync17 } = await import("fs");
-    const path21 = await import("path");
-    const tsc = path21.join(ctx.root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
-    if (!existsSync17(tsc)) return { status: "unknown", summary: "Dependencies not installed, so the type check was skipped." };
+    const { existsSync: existsSync18 } = await import("fs");
+    const path25 = await import("path");
+    const tsc = path25.join(ctx.root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
+    if (!existsSync18(tsc)) return { status: "unknown", summary: "Dependencies not installed, so the type check was skipped." };
     const r = await run(tsc, ["--noEmit", "--pretty", "false"], { cwd: ctx.root, timeoutMs: 18e4 });
     if (r.timedOut) return { status: "unknown", summary: "Type check timed out." };
     if (r.code === 0) return { status: "pass", summary: "No type errors.", engine: "tsc" };
@@ -21985,9 +22249,9 @@ var apiRoutes = {
 
 // src/core/tools.ts
 import { createHash as createHash3 } from "crypto";
-import { chmodSync as chmodSync2, existsSync as existsSync8, mkdirSync as mkdirSync3, mkdtempSync, readdirSync as readdirSync3, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { chmodSync as chmodSync2, existsSync as existsSync9, mkdirSync as mkdirSync3, mkdtempSync, readdirSync as readdirSync3, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import os2 from "os";
-import path10 from "path";
+import path11 from "path";
 var GITLEAKS_SHA = {
   darwin_arm64: "b40ab0ae55c505963e365f271a8d3846efbc170aa17f2607f13df610a9aeb6a5",
   darwin_x64: "dfe101a4db2255fc85120ac7f3d25e4342c3c20cf749f2c20a18081af1952709",
@@ -22004,13 +22268,16 @@ var OSV_SHA = {
   windows_amd64: "e0ed7644118b717b028c249ee9d3515024e55e8510747ca08906eb96765354d6",
   windows_arm64: "ca1379da0e408279ef2c85cde0846a903495738a91c7b065a208048437c1686c"
 };
+function tarCommand(platform = process.platform, systemRoot = process.env.SystemRoot) {
+  return platform === "win32" ? path11.win32.join(systemRoot || "C:\\Windows", "System32", "tar.exe") : "tar";
+}
 var TOOLS = {
   gitleaks: {
     version: "8.30.1",
     asset(platform, arch) {
       const p2 = platform === "win32" ? "windows" : platform;
-      const a = arch === "arm64" ? "arm64" : "x64";
-      const sha = GITLEAKS_SHA[`${p2}_${a}`];
+      const a = arch === "arm64" ? "arm64" : arch === "x64" ? "x64" : null;
+      const sha = a && GITLEAKS_SHA[`${p2}_${a}`];
       if (!sha) return null;
       const archive = p2 === "windows" ? "zip" : "tar.gz";
       return { file: `gitleaks_8.30.1_${p2}_${a}.${archive}`, sha256: sha, archive };
@@ -22021,8 +22288,8 @@ var TOOLS = {
     version: "2.6.0",
     asset(platform, arch) {
       const p2 = platform === "win32" ? "windows" : platform;
-      const a = arch === "arm64" ? "arm64" : "amd64";
-      const sha = OSV_SHA[`${p2}_${a}`];
+      const a = arch === "arm64" ? "arm64" : arch === "x64" ? "amd64" : null;
+      const sha = a && OSV_SHA[`${p2}_${a}`];
       if (!sha) return null;
       return { file: `osv-scanner_${p2}_${a}${p2 === "windows" ? ".exe" : ""}`, sha256: sha, archive: null };
     },
@@ -22038,8 +22305,8 @@ function ensureTool(name, noDownload = false) {
 async function resolveTool(name, noDownload) {
   const spec = TOOLS[name];
   const exe = process.platform === "win32" ? `${name}.exe` : name;
-  const cached2 = path10.join(auraBinDir(), `${name}-${spec.version}`, exe);
-  if (existsSync8(cached2)) return { path: cached2, version: spec.version };
+  const cached2 = path11.join(auraBinDir(), `${name}-${spec.version}`, exe);
+  if (existsSync9(cached2)) return { path: cached2, version: spec.version };
   if (await commandExists(name)) {
     const v = await run(name, ["version"]);
     return { path: name, version: (v.stdout.match(/\d+\.\d+\.\d+/)?.[0] ?? "system").trim() };
@@ -22059,20 +22326,20 @@ async function download(name, spec, target) {
   const buf = Buffer.from(await res.arrayBuffer());
   const digest = createHash3("sha256").update(buf).digest("hex");
   if (digest !== asset.sha256) throw new Error(`Checksum mismatch for ${asset.file}`);
-  const dir = path10.dirname(target);
+  const dir = path11.dirname(target);
   mkdirSync3(dir, { recursive: true });
-  const tmp = mkdtempSync(path10.join(os2.tmpdir(), `aura-${name}-`));
+  const tmp = mkdtempSync(path11.join(os2.tmpdir(), `aura-${name}-`));
   try {
     if (asset.archive === null) {
       writeFileSync3(target, buf);
     } else {
-      const archivePath = path10.join(tmp, asset.file);
+      const archivePath = path11.join(tmp, asset.file);
       writeFileSync3(archivePath, buf);
-      const r = await run("tar", ["-xf", archivePath, "-C", tmp]);
+      const r = await run(tarCommand(), ["-xf", archivePath, "-C", tmp]);
       if (r.code !== 0) return null;
       const exe = readdirSync3(tmp).find((f) => f === name || f === `${name}.exe`);
       if (!exe) return null;
-      renameSync(path10.join(tmp, exe), target);
+      renameSync(path11.join(tmp, exe), target);
     }
     chmodSync2(target, 493);
     return { path: target, version: spec.version };
@@ -22343,9 +22610,9 @@ var rls = {
 };
 
 // src/checks/security/secrets.ts
-import { existsSync as existsSync9, mkdtempSync as mkdtempSync2, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
+import { existsSync as existsSync10, mkdtempSync as mkdtempSync2, readFileSync as readFileSync9, rmSync as rmSync3 } from "fs";
 import os3 from "os";
-import path11 from "path";
+import path12 from "path";
 
 // src/core/ignore.ts
 function globToRegex(glob) {
@@ -22383,15 +22650,15 @@ async function gitleaksHistory(ctx) {
   if (!ctx.tracked) return null;
   const bin = await ensureTool("gitleaks", ctx.options.noDownload);
   if (!bin) return null;
-  const dir = mkdtempSync2(path11.join(os3.tmpdir(), "aura-gitleaks-"));
-  const report = path11.join(dir, "report.json");
+  const dir = mkdtempSync2(path12.join(os3.tmpdir(), "aura-gitleaks-"));
+  const report = path12.join(dir, "report.json");
   try {
     const r = await run(bin.path, ["git", "--no-banner", "--redact", "--report-format", "json", "--report-path", report, "--exit-code", "0", "."], {
       cwd: ctx.root,
       timeoutMs: 18e4
     });
-    if (r.code !== 0 || !existsSync9(report)) return null;
-    return { hits: JSON.parse(readFileSync7(report, "utf8")), engine: `gitleaks ${bin.version}` };
+    if (r.code !== 0 || !existsSync10(report)) return null;
+    return { hits: JSON.parse(readFileSync9(report, "utf8")), engine: `gitleaks ${bin.version}` };
   } catch {
     return null;
   } finally {
@@ -22506,7 +22773,7 @@ var envFiles = {
 var securityChecks = [secrets, envFiles, deps, rls, apiRoutes, headers];
 
 // src/checks/structure.ts
-import path12 from "path";
+import path13 from "path";
 var GENERATED = /(?:^|\/)(?:supabase\/migrations|generated|__generated__|\.generated)\/|\.(?:d\.ts|min\.js)$|(?:^|\/)(?:database|supabase)\.types\.ts$|(?:^|\/)components\/ui\//;
 function appSource(ctx) {
   return ctx.files.filter((f) => isSourceFile(f) && !GENERATED.test(f));
@@ -22595,7 +22862,7 @@ var duplicates = {
     const findings = pairs.map(
       ([a, b, sim]) => makeFinding(this, {
         severity: "low",
-        title: `${path12.basename(a)} and ${path12.basename(b)} are near-duplicates`,
+        title: `${path13.basename(a)} and ${path13.basename(b)} are near-duplicates`,
         detail: `${a} and ${b} are ${Math.round(sim * 100)}% the same.`,
         why: "Duplicates drift apart over time: a bug gets fixed in one copy and not the other, and your agent can\u2019t tell which one is right.",
         locations: [{ file: a }, { file: b }],
@@ -22609,7 +22876,7 @@ var duplicates = {
 };
 var ROOT_ALLOWED = /^(?:[^/]+\.config\.[cm]?[jt]s|middleware\.[cm]?[jt]s|proxy\.[cm]?[jt]s|instrumentation(?:-client)?\.[cm]?[jt]s|next-env\.d\.ts|global\.d\.ts|env\.d\.ts|sentry\.[\w.]+\.[cm]?[jt]s)$/;
 function suggestTarget(file2, srcDir) {
-  const base = path12.posix.basename(file2);
+  const base = path13.posix.basename(file2);
   const prefix = srcDir ? "src/" : "";
   const isComponent = /^[A-Z][A-Za-z0-9]*\.(?:tsx|jsx)$/.test(base);
   if (isComponent) return `${prefix}components/${base}`;
@@ -22721,59 +22988,22 @@ async function runScan(root, options, onProgress) {
   };
 }
 
-// src/ui.ts
-import * as p from "@clack/prompts";
-import pc from "picocolors";
-function interactive() {
-  return Boolean(process.stdin.isTTY && process.stdout.isTTY && !process.env.CI);
-}
-var UserCancelled = class extends Error {
-};
-function unwrap(value) {
-  if (p.isCancel(value)) {
-    p.cancel("Cancelled.");
-    throw new UserCancelled();
-  }
-  return value;
-}
-function spin(enabled) {
-  if (!enabled || !process.stdout.isTTY) {
-    return { start: (_m) => {
-    }, message: (_m) => {
-    }, stop: (_m) => {
-    }, error: (_m) => {
-    } };
-  }
-  const s = p.spinner();
-  return { start: (m) => s.start(m), message: (m) => s.message(m), stop: (m) => s.stop(m), error: (m) => s.error(m) };
-}
-function printJson(value) {
-  process.stdout.write(JSON.stringify(value, null, 2) + "\n");
-}
-var say = {
-  info: (m) => console.log(m),
-  ok: (m) => console.log(`${pc.green("\u2714")} ${m}`),
-  warn: (m) => console.error(`${pc.yellow("!")} ${m}`),
-  error: (m) => console.error(`${pc.red("\u2716")} ${m}`),
-  dim: (m) => console.log(pc.dim(m))
-};
-
 // src/commands/fix.ts
-import { existsSync as existsSync14, readFileSync as readFileSync14, writeFileSync as writeFileSync6 } from "fs";
-import path16 from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync16, writeFileSync as writeFileSync6 } from "fs";
+import path17 from "path";
 
 // src/agent/tools.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync4, readFileSync as readFileSync8, rmSync as rmSync4, statSync as statSync2, writeFileSync as writeFileSync4 } from "fs";
-import path13 from "path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync4, readFileSync as readFileSync10, rmSync as rmSync4, statSync as statSync2, writeFileSync as writeFileSync4 } from "fs";
+import path14 from "path";
 var MAX_OUTPUT = 12e3;
 var MAX_FILE_LINES = 800;
 var FORBIDDEN = /^(?:\.git|node_modules|\.next|\.vercel)(?:\/|$)|(?:^|\/)\.env(?:\.(?!example$|sample$|template$)[^/]+)?$/;
 function safePath(root, rel) {
   if (typeof rel !== "string" || !rel.trim()) throw new Error("A file path is required.");
-  const normalized = path13.posix.normalize(rel.replace(/\\/g, "/").replace(/^\.\//, ""));
-  if (normalized.startsWith("../") || normalized === ".." || path13.isAbsolute(normalized)) throw new Error(`Path is outside the repo: ${rel}`);
+  const normalized = path14.posix.normalize(rel.replace(/\\/g, "/").replace(/^\.\//, ""));
+  if (normalized.startsWith("../") || normalized === ".." || path14.isAbsolute(normalized)) throw new Error(`Path is outside the repo: ${rel}`);
   if (FORBIDDEN.test(normalized)) throw new Error(`Aura doesn\u2019t let the agent touch ${normalized}.`);
-  const full = path13.join(root, normalized);
+  const full = path14.join(root, normalized);
   if (!isInside(root, full)) throw new Error(`Path is outside the repo: ${rel}`);
   return normalized;
 }
@@ -22794,10 +23024,10 @@ async function runTool(root, call, allowedCommands2) {
     }
     case "read_file": {
       const rel = safePath(root, input2.path);
-      const full = path13.join(root, rel);
-      if (!existsSync10(full)) return { output: `File not found: ${rel}` };
+      const full = path14.join(root, rel);
+      if (!existsSync11(full)) return { output: `File not found: ${rel}` };
       if (statSync2(full).size > 1e6) return { output: `${rel} is too large to read.` };
-      const lines = readFileSync8(full, "utf8").split("\n");
+      const lines = readFileSync10(full, "utf8").split("\n");
       const start = Math.max(1, Number(input2.startLine) || 1);
       const end = Math.min(lines.length, Number(input2.endLine) || start + MAX_FILE_LINES - 1);
       const body = lines.slice(start - 1, end).map((l, i) => `${start + i}: ${l}`).join("\n");
@@ -22814,7 +23044,7 @@ async function runTool(root, call, allowedCommands2) {
         if (FORBIDDEN.test(f) || glob && !glob.test(f)) continue;
         let text;
         try {
-          text = readFileSync8(path13.join(root, f), "utf8");
+          text = readFileSync10(path14.join(root, f), "utf8");
         } catch {
           continue;
         }
@@ -22833,14 +23063,14 @@ async function runTool(root, call, allowedCommands2) {
           output: "Refused: the content contains a [REDACTED:\u2026] placeholder. Secrets are hidden from you on purpose. Read the value from an environment variable (process.env.NAME) instead of writing it."
         };
       }
-      mkdirSync4(path13.dirname(path13.join(root, rel)), { recursive: true });
-      writeFileSync4(path13.join(root, rel), content);
+      mkdirSync4(path14.dirname(path14.join(root, rel)), { recursive: true });
+      writeFileSync4(path14.join(root, rel), content);
       return { output: `Wrote ${rel} (${content.split("\n").length} lines).`, touched: rel };
     }
     case "delete_file": {
       const rel = safePath(root, input2.path);
-      if (!existsSync10(path13.join(root, rel))) return { output: `File not found: ${rel}` };
-      rmSync4(path13.join(root, rel));
+      if (!existsSync11(path14.join(root, rel))) return { output: `File not found: ${rel}` };
+      rmSync4(path14.join(root, rel));
       return { output: `Deleted ${rel}.`, touched: rel };
     }
     case "run_command": {
@@ -22862,7 +23092,7 @@ ${(r.stdout + "\n" + r.stderr).trim().slice(-6e3)}`;
 
 // src/api/explain.ts
 import { createHash as createHash4 } from "crypto";
-import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
 
 // src/report.ts
 import pc2 from "picocolors";
@@ -23051,7 +23281,7 @@ var CACHE_FILE = "cache/explanations.json";
 var MAX_EXPLAIN = 25;
 function loadCache(root) {
   try {
-    return JSON.parse(readFileSync9(auraPath(root, CACHE_FILE), "utf8"));
+    return JSON.parse(readFileSync11(auraPath(root, CACHE_FILE), "utf8"));
   } catch {
     return {};
   }
@@ -23072,8 +23302,8 @@ function excerptFor(root, f, context = 4) {
 }
 function productContext(root) {
   const file2 = auraPath(root, "brief.md");
-  if (!existsSync11(file2)) return void 0;
-  return redact(readFileSync9(file2, "utf8")).slice(0, 1800);
+  if (!existsSync12(file2)) return void 0;
+  return redact(readFileSync11(file2, "utf8")).slice(0, 1800);
 }
 async function addExplanations(root, scan, client) {
   const cache = loadCache(root);
@@ -23117,19 +23347,19 @@ async function addExplanations(root, scan, client) {
 
 // src/commands/simple.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync13, readdirSync as readdirSync4, readFileSync as readFileSync13 } from "fs";
-import path15 from "path";
+import { existsSync as existsSync14, readdirSync as readdirSync4, readFileSync as readFileSync15 } from "fs";
+import path16 from "path";
 import YAML2 from "yaml";
 
 // src/commands/inventory.ts
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 function accountState(root, services) {
   const inv = loadInventory(root);
   return { inventoryComplete: services.every((s) => inv.services[s]?.owner) && Boolean(inv.githubOrg), githubSecurity: Boolean(inv.githubSecurity) };
 }
 function loadInventory(root) {
   try {
-    return JSON.parse(readFileSync10(auraPath(root, "inventory.json"), "utf8"));
+    return JSON.parse(readFileSync12(auraPath(root, "inventory.json"), "utf8"));
   } catch {
     return { version: 1, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), services: {} };
   }
@@ -23216,10 +23446,10 @@ async function inventoryCommand(flags) {
 }
 
 // src/history.ts
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 function loadHistory(root) {
   try {
-    const data = JSON.parse(readFileSync11(auraPath(root, "history.json"), "utf8"));
+    const data = JSON.parse(readFileSync13(auraPath(root, "history.json"), "utf8"));
     return Array.isArray(data) ? data : [];
   } catch {
     return [];
@@ -23267,10 +23497,10 @@ function banner(colors = pc3.isColorSupported) {
 // src/api/connect.ts
 import { spawn as spawn2 } from "child_process";
 import { constants, generateKeyPairSync, privateDecrypt } from "crypto";
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync12, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync5, readFileSync as readFileSync14, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "fs";
 import os4 from "os";
-import path14 from "path";
-var pendingFile = () => path14.join(os4.homedir(), ".aura", "pending-connect.json");
+import path15 from "path";
+var pendingFile = () => path15.join(os4.homedir(), ".aura", "pending-connect.json");
 async function postJson(apiUrl, route, body) {
   let res;
   try {
@@ -23289,14 +23519,14 @@ async function postJson(apiUrl, route, body) {
 }
 function loadPending(apiUrl, now) {
   try {
-    const p2 = JSON.parse(readFileSync12(pendingFile(), "utf8"));
+    const p2 = JSON.parse(readFileSync14(pendingFile(), "utf8"));
     if (p2.apiUrl === apiUrl && Date.parse(p2.expiresAt) - now > 6e4) return p2;
   } catch {
   }
   return null;
 }
 function clearPendingConnect() {
-  if (existsSync12(pendingFile())) rmSync5(pendingFile(), { force: true });
+  if (existsSync13(pendingFile())) rmSync5(pendingFile(), { force: true });
 }
 async function startOrResumeConnect(apiUrl, now = Date.now()) {
   const existing = loadPending(apiUrl, now);
@@ -23308,7 +23538,7 @@ async function startOrResumeConnect(apiUrl, now = Date.now()) {
   });
   const res = ConnectStartResponse.parse(await postJson(apiUrl, "connect", { publicKey }));
   const pending = { apiUrl, privateKey, ...res };
-  mkdirSync5(path14.dirname(pendingFile()), { recursive: true });
+  mkdirSync5(path15.dirname(pendingFile()), { recursive: true });
   writeFileSync5(pendingFile(), JSON.stringify(pending, null, 2) + "\n", { mode: 384 });
   return { ...pending, resumed: false };
 }
@@ -23333,7 +23563,7 @@ async function waitForConnect(pending, waitSeconds, sleep = (ms) => new Promise(
   }
 }
 function openInBrowser(url2) {
-  if (process.env.AURA_NO_BROWSER || process.env.CI) return;
+  if (process.env.AURA_NO_BROWSER || inCI()) return;
   const [cmd, args] = process.platform === "darwin" ? ["open", [url2]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url2]] : ["xdg-open", [url2]];
   try {
     const child = spawn2(cmd, args, { stdio: "ignore", detached: true });
@@ -23362,7 +23592,7 @@ ${pc.magenta("\u2726")} ${pc.bold("Connect your Aura pilot key")}`);
       console.log(pc.dim(`  Check the page shows the code ${pending.code}. Press Ctrl+C to stop.
 `));
     } else {
-      console.log(`  Ask the user to open this link and paste their pilot key there (or choose to continue without one):`);
+      console.log("  Ask the user to open this link and paste their pilot key there:");
       console.log(`  ${pending.url}`);
       console.log(`  Don\u2019t ask for the key in chat. The page sends it to this computer encrypted. Code: ${pending.code}`);
       console.log(`  Waiting up to ${Math.round(wait)} seconds\u2026
@@ -23371,7 +23601,7 @@ ${pc.magenta("\u2726")} ${pc.bold("Connect your Aura pilot key")}`);
     const s = spin(opts.person);
     s.start("Waiting for you to finish in the browser");
     const outcome = await waitForConnect(pending, wait);
-    s.stop(outcome.status === "complete" ? "Key received" : outcome.status === "skipped" ? "Continuing without a key" : "Stopped waiting");
+    s.stop(outcome.status === "complete" ? "Key received" : "Stopped waiting");
     return outcome;
   } catch (err) {
     return { status: "error", message: friendlyApiError(err) };
@@ -23379,18 +23609,15 @@ ${pc.magenta("\u2726")} ${pc.bold("Connect your Aura pilot key")}`);
 }
 function explainSignIn(outcome) {
   switch (outcome.status) {
-    case "skipped":
-      say.dim("No pilot key: Aura will still score your repo, with standard explanations. Add one later with `aura login`.");
-      return true;
     case "pending":
       say.warn("Still waiting for the user to finish in the browser. When they have, run the same command again: it carries on with the same link.");
-      return false;
+      break;
     case "expired":
       say.warn("The sign-in link expired. Run the same command again for a new one.");
-      return false;
+      break;
     case "error":
       say.warn(`Couldn\u2019t start sign-in: ${outcome.message}`);
-      return false;
+      break;
   }
 }
 
@@ -23430,7 +23657,17 @@ async function pickAndRunSteps(steps, limit = 10) {
     console.log(`
 ${pc.magenta("\u2726")} ${pc.bold(step.title)}`);
     const run2 = stepRun(step, hasKey);
-    const code = run2.kind === "apply" ? await applyCommand(run2.actionId, { yes: true }) : run2.kind === "fix" ? await fixCommand(run2.actionId, run2.withOwnAgent ? { agent: true } : { yes: true }) : run2.kind === "guide" ? await guideCommand(run2.topic, {}) : await inventoryCommand({});
+    const code = run2.kind === "apply" ? await applyCommand(run2.actionId, { yes: true, via: "checklist" }) : run2.kind === "fix" ? await fixCommand(run2.actionId, run2.withOwnAgent ? { agent: true, via: "checklist" } : { yes: true, via: "checklist" }) : run2.kind === "guide" ? await guideCommand(run2.topic, {}) : await inventoryCommand({});
+    if (run2.kind === "guide" || run2.kind === "inventory") {
+      const root = await findRepoRoot();
+      await recordUsage(root, loadConfig(root), {
+        event: "action",
+        actionId: step.actionId,
+        delivery: run2.kind === "guide" ? "guide" : "checklist",
+        via: "checklist",
+        outcome: "shown"
+      });
+    }
     results.push({ title: step.title, ok: code === 0 });
   }
   if (results.length > 1) {
@@ -23444,9 +23681,9 @@ ${pc.bold("  Done")}`);
 // src/commands/simple.ts
 async function latestScan(root) {
   const file2 = auraPath(root, "scan.json");
-  if (existsSync13(file2)) {
+  if (existsSync14(file2)) {
     try {
-      const scan = JSON.parse(readFileSync13(file2, "utf8"));
+      const scan = JSON.parse(readFileSync15(file2, "utf8"));
       const head = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
       const dirty = execFileSync("git", ["status", "--porcelain"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
       if (scan.commit === head && !dirty && Date.now() - Date.parse(scan.scannedAt) < 24 * 36e5) return scan;
@@ -23481,14 +23718,14 @@ async function loginCommand(flags) {
   let key = flags.key ?? process.env.AURA_KEY;
   if (!key && flags.paste && person) key = unwrap(await p.password({ message: "Paste your Aura pilot key", mask: "\u2022" }));
   if (!key) {
-    if (process.env.CI) {
+    if (inCI()) {
       say.error("Pass your key with --key or set AURA_KEY.");
       return 1;
     }
     const outcome = await signInWithBrowser(apiUrl, { person, waitSeconds: parseWait(flags.wait) });
     if (outcome.status !== "complete") {
       explainSignIn(outcome);
-      return outcome.status === "skipped" ? 0 : 1;
+      return 1;
     }
     key = outcome.key;
   }
@@ -23534,8 +23771,8 @@ async function configCommand(key, value) {
   const bool = (v) => ["on", "true", "yes", "1"].includes(v.toLowerCase());
   switch (key) {
     case "telemetry":
-      if (value === void 0) return say.info(config2.telemetry ? "on" : "off"), 0;
-      config2.telemetry = bool(value);
+      if (value === void 0) return say.info(sharesUsage(config2) ? "on" : "off"), 0;
+      config2.shareUsage = bool(value);
       break;
     case "ciMaxDrop":
     case "ci-max-drop":
@@ -23561,9 +23798,9 @@ async function configCommand(key, value) {
   return 0;
 }
 function loadGuides() {
-  const dir = path15.join(templatesDir(), "guides");
+  const dir = path16.join(templatesDir(), "guides");
   return readdirSync4(dir).filter((f) => f.endsWith(".md")).map((f) => {
-    const text = readFileSync13(path15.join(dir, f), "utf8");
+    const text = readFileSync15(path16.join(dir, f), "utf8");
     const fm = text.match(/^---\n([\s\S]*?)\n---\n?/);
     const meta3 = fm ? YAML2.parse(fm[1]) : {};
     return { id: f.replace(/\.md$/, ""), title: meta3.title ?? f, summary: meta3.summary ?? "", body: fm ? text.slice(fm[0].length) : text };
@@ -23631,7 +23868,7 @@ function allowedCommands(root, pm, typescript) {
   const pkg = readJson(root, "package.json");
   const run2 = pmCommands(pm).run;
   const cmds = ["test", "lint", "typecheck", "build"].filter((s) => pkg?.scripts?.[s]).map((s) => `${run2} ${s}`);
-  if (typescript && !pkg?.scripts?.typecheck && existsSync14(path16.join(root, "node_modules/.bin/tsc"))) cmds.push(`${pmCommands(pm).exec} tsc --noEmit`);
+  if (typescript && !pkg?.scripts?.typecheck && existsSync15(path17.join(root, "node_modules/.bin/tsc"))) cmds.push(`${pmCommands(pm).exec} tsc --noEmit`);
   return cmds;
 }
 function taskFor(root, scan, action2, findings) {
@@ -23682,8 +23919,8 @@ async function untrackEnvFiles(root, findings) {
   const files = findings.filter((f) => f.checkId === "security.env-files").map((f) => f.locations[0].file);
   for (const f of files) await git(root, "rm", "-q", "--cached", "--", f);
   if (files.length) {
-    const gi = path16.join(root, ".gitignore");
-    const current2 = existsSync14(gi) ? readFileSync14(gi, "utf8") : "";
+    const gi = path17.join(root, ".gitignore");
+    const current2 = existsSync15(gi) ? readFileSync16(gi, "utf8") : "";
     if (!/^\.env\*?$/m.test(current2)) writeFileSync6(gi, `${current2.trimEnd()}
 
 # Environment files hold secrets
@@ -23695,6 +23932,15 @@ async function untrackEnvFiles(root, findings) {
   return files;
 }
 async function fixCommand(target, flags) {
+  const started = Date.now();
+  const report = { delivery: flags.agent ? "agent-task" : "agent-fix" };
+  const actionId = { value: target };
+  const code = await fixAction(target, flags, report, actionId);
+  const root = await findRepoRoot();
+  await recordAction(root, loadConfig(root), actionId.value, report, started, flags.via ?? "command");
+  return code;
+}
+async function fixAction(target, flags, report, resolvedId) {
   const root = await findRepoRoot();
   const config2 = loadConfig(root);
   const scan = await latestScan(root);
@@ -23704,8 +23950,10 @@ async function fixCommand(target, flags) {
     return 1;
   }
   const { action: action2, findings } = resolved;
+  resolvedId.value = action2.id;
   if (findings.length === 0 && !["write-critical-tests"].includes(action2.id)) {
     say.info(`Aura found nothing to fix for "${action2.title}".`);
+    report.outcome = "no_changes";
     return 0;
   }
   const task = taskFor(root, scan, action2, findings);
@@ -23715,11 +23963,13 @@ async function fixCommand(target, flags) {
     console.log(`
 Ask your coding agent:
   ${pc.cyan(`Complete the Aura task in ${file2}`)}`);
+    report.outcome = "task_written";
     return 0;
   }
   const client = AuraClient.from(config2);
   if (!client.hasKey) {
     say.error("Aura\u2019s agent needs a pilot key (aura login). Or run with --agent to hand this to your own coding agent.");
+    Object.assign(report, { outcome: "failed", errorType: "NoPilotKey" });
     return 1;
   }
   console.log(`
@@ -23732,6 +23982,7 @@ ${pc.bold(action2.title)}  ${pc.dim(`${findings.length} finding(s)`)}`);
   const dirty = await dirtyFiles(root);
   if (dirty.length) {
     say.error(`You have uncommitted changes (${dirty.slice(0, 5).join(", ")}). Commit or stash them first.`);
+    Object.assign(report, { outcome: "failed", errorType: "UncommittedChanges" });
     return 1;
   }
   const openPr = flags.pr !== false;
@@ -23739,15 +23990,19 @@ ${pc.bold(action2.title)}  ${pc.dim(`${findings.length} finding(s)`)}`);
     const gh = await ghStatus(root);
     if (!gh.installed || !gh.authed || !gh.hasRemote) {
       say.error("Opening a PR needs the GitHub CLI, signed in, and a GitHub remote. Run with --no-pr to keep the change on a local branch.");
+      Object.assign(report, { outcome: "failed", errorType: gh.installed ? "GhNotReady" : "GhNotInstalled" });
       return 1;
     }
   }
-  if (interactive() && !flags.yes && !unwrap(await p.confirm({ message: "Start Aura\u2019s agent on a new branch? It reads only the files it needs, with secrets hidden." })))
+  if (interactive() && !flags.yes && !unwrap(await p.confirm({ message: "Start Aura\u2019s agent on a new branch? It reads only the files it needs, with secrets hidden." }))) {
+    report.outcome = "cancelled";
     return 0;
+  }
   const original = await currentBranch(root);
   const branch = await freeBranchName(root, `aura/fix-${action2.id}`);
   if ((await git(root, "switch", "-c", branch)).code !== 0) {
     say.error(`Couldn\u2019t create branch ${branch}.`);
+    Object.assign(report, { outcome: "failed", errorType: "BranchFailed" });
     return 1;
   }
   const s = spin(true);
@@ -23757,6 +24012,7 @@ ${pc.bold(action2.title)}  ${pc.dim(`${findings.length} finding(s)`)}`);
   try {
     s.start("Aura\u2019s agent is working");
     for (let step = 0; step <= MAX_STEPS && !finish; step++) {
+      report.agentSteps = step + 1;
       const res = await client.request("POST", "agent/step", { task, messages, step }, 18e4);
       messages = [...messages, ...res.responseMessages];
       if (res.toolCalls.length === 0) break;
@@ -23785,6 +24041,7 @@ ${pc.bold(action2.title)}  ${pc.dim(`${findings.length} finding(s)`)}`);
       say.warn("Aura\u2019s agent didn\u2019t change anything. " + (finish?.summary ?? ""));
       await git(root, "switch", original);
       await git(root, "branch", "-D", branch);
+      report.outcome = "no_changes";
       return 1;
     }
     const guides = [
@@ -23819,11 +24076,12 @@ ${pc.bold(action2.title)}  ${pc.dim(`${findings.length} finding(s)`)}`);
     else if (result.error) say.warn(`Committed on ${branch}, but couldn\u2019t open the PR: ${result.error.trim()}`);
     else say.ok(`Committed on branch ${branch}.`);
     if (finish?.risks.length) say.info(pc.dim(`Check before merging: ${finish.risks.join(" ")}`));
-    if (config2.telemetry) await sendTelemetry(root, client, { event: "action", actionId: action2.id });
+    Object.assign(report, { outcome: result.url ? "pr_opened" : "committed", branch, scoreBefore: scan.score, findingIds: findings.map((f) => f.id) });
     return 0;
   } catch (err) {
     s.error("Aura\u2019s agent hit a problem");
     say.error(friendlyApiError(err));
+    Object.assign(report, { outcome: "failed", errorType: errorKind(err) });
     await git(root, "reset", "-q");
     for (const f of touched) {
       const inHead = (await git(root, "cat-file", "-e", `HEAD:${f}`)).code === 0;
@@ -23842,6 +24100,14 @@ ${pc.bold(action2.title)}  ${pc.dim(`${findings.length} finding(s)`)}`);
 // src/commands/apply.ts
 var LOCKFILES = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb"];
 async function applyCommand(actionId, flags) {
+  const started = Date.now();
+  const report = { delivery: "pr" };
+  const code = await applyAction(actionId, flags, report);
+  const root = await findRepoRoot();
+  await recordAction(root, loadConfig(root), actionId, report, started, flags.via ?? "command");
+  return code;
+}
+async function applyAction(actionId, flags, report) {
   const root = await findRepoRoot();
   const action2 = getAction(actionId);
   if (!action2) {
@@ -23853,7 +24119,7 @@ async function applyCommand(actionId, flags) {
   if (delivery === "guide") return guideCommand(actionId, {});
   if (delivery === "agent-fix") {
     if (fellBack) say.info(pc.dim(`Aura only opens template PRs on stacks it recognizes (Next.js). Handing "${actionId}" to Aura\u2019s agent instead.`));
-    return fixCommand(actionId, { yes: flags.yes, dryRun: flags.dryRun, pr: flags.pr });
+    return fixCommand(actionId, { yes: flags.yes, dryRun: flags.dryRun, pr: flags.pr, via: flags.via });
   }
   if (delivery !== "pr") {
     say.error(`"${actionId}" isn\u2019t a PR action. Try aura ${delivery === "checklist" ? "inventory" : "next"}.`);
@@ -23875,18 +24141,15 @@ async function applyCommand(actionId, flags) {
   }
   const g = { root, scan, ctx, agents: [...agents], vars: templateVars(root, scan, ctx.pkg), skills: skills2 };
   const plan = actionId === "foundation" ? foundationPlan(g) : GENERATORS[actionId]?.(g) ?? { skip: "Nothing to do." };
-  if ("skip" in plan) {
-    say.info(plan.skip);
-    return 0;
-  }
-  if (plan.changes.length === 0 && !plan.commands?.length && !plan.devDeps?.length) {
-    say.info("Nothing to change.");
+  if ("skip" in plan || plan.changes.length === 0 && !plan.commands?.length && !plan.devDeps?.length) {
+    say.info("skip" in plan ? plan.skip : "Nothing to change.");
+    report.outcome = "no_changes";
     return 0;
   }
   console.log(`
 ${pc.bold(action2.title)}`);
   for (const c of plan.changes)
-    console.log(`  ${c.content === null ? pc.red("delete") : existsSync15(path17.join(root, c.path)) ? pc.yellow("update") : pc.green("add   ")} ${c.path}`);
+    console.log(`  ${c.content === null ? pc.red("delete") : existsSync16(path18.join(root, c.path)) ? pc.yellow("update") : pc.green("add   ")} ${c.path}`);
   const pm = pmCommands(scan.stack.packageManager);
   if (plan.devDeps?.length) console.log(`  ${pc.cyan("install")} ${plan.devDeps.join(", ")} ${pc.dim(`(${pm.addDev})`)}`);
   for (const cmd of plan.commands ?? []) console.log(`  ${pc.cyan("run   ")} ${cmd.join(" ")}`);
@@ -23899,6 +24162,7 @@ ${pc.bold(action2.title)}`);
     say.error(
       `You have uncommitted changes (${dirty.slice(0, 5).join(", ")}${dirty.length > 5 ? "\u2026" : ""}). Commit or stash them first so they don\u2019t end up in Aura\u2019s PR.`
     );
+    Object.assign(report, { outcome: "failed", errorType: "UncommittedChanges" });
     return 1;
   }
   const openPr = flags.pr !== false;
@@ -23909,13 +24173,16 @@ ${pc.bold(action2.title)}`);
         !gh.installed ? `The GitHub CLI isn\u2019t installed. ${ghInstallHint()}` : !gh.authed ? "Run `gh auth login` first." : "This repo has no GitHub remote. Push it to GitHub first."
       );
       say.dim("Or run with --no-pr to commit the change on a local branch.");
+      Object.assign(report, { outcome: "failed", errorType: gh.installed ? "GhNotReady" : "GhNotInstalled" });
       return 1;
     }
   }
-  if (interactive() && !flags.yes && !unwrap(await p.confirm({ message: openPr ? "Create a branch and open a pull request?" : "Create a branch and commit?" })))
+  if (interactive() && !flags.yes && !unwrap(await p.confirm({ message: openPr ? "Create a branch and open a pull request?" : "Create a branch and commit?" }))) {
+    report.outcome = "cancelled";
     return 0;
-  const tsc = path17.join(root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
-  const checkTypes = plan.verifyTypes && scan.stack.typescript && existsSync15(tsc);
+  }
+  const tsc = path18.join(root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
+  const checkTypes = plan.verifyTypes && scan.stack.typescript && existsSync16(tsc);
   const typeErrors = async () => {
     const r = await run(tsc, ["--noEmit", "--pretty", "false"], { cwd: root, timeoutMs: 3e5 });
     return (r.stdout.match(/error TS\d+/g) ?? []).length;
@@ -23926,6 +24193,7 @@ ${pc.bold(action2.title)}`);
   const sw = await git(root, "switch", "-c", branch);
   if (sw.code !== 0) {
     say.error(`Couldn\u2019t create branch ${branch}: ${sw.stderr.trim()}`);
+    Object.assign(report, { outcome: "failed", errorType: "BranchFailed" });
     return 1;
   }
   try {
@@ -23953,6 +24221,7 @@ ${r.stderr.slice(-1500)}`);
       say.info("Nothing changed, so there\u2019s no PR to open.");
       await git(root, "switch", original);
       await git(root, "branch", "-D", branch);
+      report.outcome = "no_changes";
       return 0;
     }
     const prTemplate = `pr/${actionId}.md`;
@@ -23963,22 +24232,31 @@ ${plan.details.join("\n")}`;
     const result = await commitPushPr(root, { branch, base: original, title: `Aura: ${action2.title}`, body, openPr });
     if (result.error && result.committed) {
       say.error(`Committed on branch ${branch}, but couldn\u2019t ${result.pushed ? "open the pull request" : "push it"}: ${result.error.trim()}`);
-      say.dim(`Finish by hand: git push -u origin ${branch} && gh pr create --head ${branch}`);
+      say.dim(`Finish by hand with these two commands:
+  git push -u origin ${branch}
+  gh pr create --head ${branch}`);
+      Object.assign(report, { outcome: "failed", errorType: result.pushed ? "PrFailed" : "PushFailed" });
       return 1;
     }
     if (result.error) throw new Error(result.error.trim());
     if (result.url) say.ok(`Opened ${result.url}`);
     else say.ok(`Committed on branch ${branch}.`);
+    Object.assign(report, {
+      outcome: result.url ? "pr_opened" : "committed",
+      branch,
+      scoreBefore: scan.score,
+      findingIds: nextSteps(scan, { includeFoundationBundle: true }).find((s) => s.actionId === actionId)?.findingIds ?? []
+    });
     if (plan.changes.some((c) => /^\.aura\/|\/skills\/aura\//.test(c.path))) {
       say.dim(
         openPr ? "Your brief and Aura files are in this PR. Merge it, then run `git pull` to have them locally again." : `Your brief and Aura files are on ${branch}. Merge that branch to have them locally again.`
       );
     }
     if (plan.changes.some((c) => c.path === ".github/workflows/aura.yml") && openPr && !flags.yes) await offerPilotSecret(root);
-    if (config2.telemetry) await sendTelemetry(root, AuraClient.from(config2), { event: "action", actionId });
     return 0;
   } catch (err) {
     say.error(err.message);
+    Object.assign(report, { outcome: "failed", errorType: errorKind(err) });
     await undoPlan(root, plan);
     await git(root, "switch", original);
     await git(root, "branch", "-D", branch);
@@ -24013,16 +24291,17 @@ async function undoPlan(root, plan) {
   for (const file2 of touched) {
     const inHead = (await git(root, "cat-file", "-e", `HEAD:${file2}`)).code === 0;
     if (inHead) await git(root, "checkout", "HEAD", "--", file2);
-    else if (plan.changes.some((c) => c.path === file2)) rmSync6(path17.join(root, file2), { force: true });
+    else if (plan.changes.some((c) => c.path === file2)) rmSync6(path18.join(root, file2), { force: true });
   }
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync16, readFileSync as readFileSync15 } from "fs";
-import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync17, readFileSync as readFileSync17 } from "fs";
+import { spawnSync as spawnSync3 } from "child_process";
+import path22 from "path";
 
 // src/brief.ts
-import path18 from "path";
+import path19 from "path";
 function repoSummary(ctx) {
   const routes = ctx.files.filter((f) => /^(?:src\/)?app\/(?:.+\/)?(?:page|route)\.[cm]?[jt]sx?$/.test(f) || /^(?:src\/)?pages\/.+\.[cm]?[jt]sx?$/.test(f)).map(
     (f) => "/" + f.replace(/^(?:src\/)?(?:app|pages)\//, "").replace(/(?:^|\/)(?:page|route|index)\.[cm]?[jt]sx?$|\.[cm]?[jt]sx?$/, "").replace(/\([^)]+\)\//g, "")
@@ -24038,7 +24317,7 @@ function repoSummary(ctx) {
   const readme2 = ctx.files.find((f) => /^readme\.mdx?$/i.test(f));
   const readmeText = readme2 ? ctx.read(readme2) ?? "" : "";
   return {
-    name: ctx.pkg?.name ?? path18.basename(ctx.root),
+    name: ctx.pkg?.name ?? path19.basename(ctx.root),
     packageJson: ctx.pkg ? {
       name: ctx.pkg.name,
       description: ctx.pkg.description,
@@ -24110,6 +24389,7 @@ async function draftBrief(client, answers, summary) {
 }
 
 // src/core/aura-command.ts
+import { spawnSync as spawnSync2 } from "child_process";
 function hasAuraCommand() {
   return commandExists("aura");
 }
@@ -24119,18 +24399,144 @@ async function installAuraCommand() {
   if (r.code !== 0) return { ok: false, needsAdmin: /EACCES|EPERM|permission denied/i.test(r.stderr + r.stdout) };
   return { ok: true, onPath: await hasAuraCommand() };
 }
+async function installWithSudo() {
+  const r = spawnSync2("sudo", ["npm", "install", "-g", `getaura@${AURA_VERSION}`], { stdio: "inherit" });
+  return r.status === 0 && await hasAuraCommand();
+}
 function installFallback(result, platform = process.platform) {
   const admin = result.needsAdmin && platform !== "win32" ? `Run \`sudo ${INSTALL_AURA}\` and enter your computer password, or use` : "Use";
   return `${admin} \`npx getaura <command>\` in place of \`aura <command>\` (for example \`npx getaura scan\`).`;
 }
 
-// src/commands/scan.ts
-import { mkdtempSync as mkdtempSync3, rmSync as rmSync7, writeFileSync as writeFileSync7 } from "fs";
+// src/core/claude-plugin.ts
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync7 } from "fs";
 import os5 from "os";
-import path19 from "path";
+import path20 from "path";
+var CLAUDE_PLUGIN_ID = "aura@aura";
+var marketplaceDir = () => path20.join(os5.homedir(), ".aura", "claude-marketplace");
+var MARKETPLACE = {
+  name: "aura",
+  description: "Aura for Claude Code",
+  owner: { name: "Aura" },
+  plugins: [
+    {
+      name: "aura",
+      description: "Slash commands for Aura: /aura:scan, /aura:next, /aura:fix and /aura:setup.",
+      source: { source: "npm", package: "getaura" }
+    }
+  ]
+};
+function writeMarketplace() {
+  const dir = marketplaceDir();
+  mkdirSync6(path20.join(dir, ".claude-plugin"), { recursive: true });
+  writeFileSync7(path20.join(dir, ".claude-plugin", "marketplace.json"), `${JSON.stringify(MARKETPLACE, null, 2)}
+`);
+  return dir;
+}
+function manualInstall() {
+  return [`claude plugin marketplace add "${writeMarketplace()}"`, `claude plugin install ${CLAUDE_PLUGIN_ID} --scope project`];
+}
+async function installClaudePlugin(root) {
+  if (!await commandExists("claude")) return "no-claude";
+  const dir = writeMarketplace();
+  const add = await run("claude", ["plugin", "marketplace", "add", dir], { cwd: root, timeoutMs: 12e4 });
+  if (add.code !== 0) return "failed";
+  const install = await run("claude", ["plugin", "install", CLAUDE_PLUGIN_ID, "--scope", "project"], { cwd: root, timeoutMs: 18e4 });
+  return install.code === 0 ? "installed" : "failed";
+}
+
+// src/onboarding.ts
+var DATA_LABELS2 = {
+  personal: "personal info (names, emails)",
+  payments: "payments",
+  health: "health",
+  legal: "legal",
+  children: "children\u2019s data",
+  none: "none of these"
+};
+var BOILERPLATE2 = /bootstrapped with|create-next-app|getting started|this template|vite \+|turborepo|starter kit/i;
+function whatItDoes(ctx) {
+  const description = ctx.pkg?.description?.trim();
+  if (description && description.length >= 15 && !BOILERPLATE2.test(description)) return { value: description, from: "package.json" };
+  const readme2 = ctx.files.find((f) => /^readme\.mdx?$/i.test(f));
+  const readmeText = readme2 ? ctx.read(readme2) ?? "" : "";
+  if (/create-next-app|create-react-app|create-vite|create-t3-app|bootstrapped with/i.test(readmeText)) return null;
+  const paragraphs = readmeText.replace(/\r\n/g, "\n").split(/\n\s*\n/);
+  for (const raw of paragraphs) {
+    const text = raw.replace(/\s+/g, " ").trim();
+    if (!text || /^(?:#|!\[|\[|<|```|[-*|>]|\d+\.)/.test(text) || text.length < 30 || BOILERPLATE2.test(text)) continue;
+    return { value: text.length > 300 ? `${text.slice(0, 297).replace(/\s+\S*$/, "")}\u2026` : text, from: "the README" };
+  }
+  return null;
+}
+var PAYMENT_PACKAGES = [
+  [/^stripe$|^@stripe\//, "Stripe"],
+  [/^@lemonsqueezy\//, "Lemon Squeezy"],
+  [/^@paddle\//, "Paddle"],
+  [/^@polar-sh\//, "Polar"],
+  [/^@revenuecat\/|^react-native-purchases$/, "RevenueCat"]
+];
+var AUTH_PACKAGES = [
+  [/^@supabase\//, "Supabase"],
+  [/^@clerk\//, "Clerk"],
+  [/^next-auth$|^@auth\//, "Auth.js"],
+  [/^firebase$|^firebase-admin$/, "Firebase"],
+  [/^better-auth$/, "Better Auth"],
+  [/^@kinde-oss\//, "Kinde"],
+  [/^@auth0\//, "Auth0"]
+];
+var words = (list) => new RegExp(`(?<![a-z])(?:${list})(?![a-z])`, "i");
+var SENSITIVE = [
+  ["health", words("patients?|diagnos[a-z]*|medical|medications?|prescriptions?|symptoms?|health_records?"), "health"],
+  ["legal", words("case_number|lawsuits?|attorneys?|legal_matters?|court[a-z]*"), "legal"],
+  ["children", words("child|children|kids?|minors?|guardians?|parental_consent"), "children"]
+];
+function schemaText(ctx) {
+  const files = ctx.files.filter((f) => /\.sql$|schema\.prisma$|(?:^|\/)schema\.[cm]?[jt]s$|(?:^|\/)db\/schema\//.test(f) && !/node_modules\//.test(f));
+  return files.slice(0, 200).map((f) => ctx.read(f) ?? "").join("\n");
+}
+var matchPackage = (deps2, list) => list.find(([re]) => deps2.some((d) => re.test(d)))?.[1];
+function inferAnswers(ctx) {
+  const deps2 = Object.keys(allDeps(ctx.pkg));
+  const payment = matchPackage(deps2, PAYMENT_PACKAGES);
+  const paymentPage = ctx.files.find((f) => /(?:^|\/)(?:pricing|checkout|billing|subscribe)(?:\/|\.|$)/i.test(f));
+  const chargesMoney = payment ? { value: true, from: `${payment} is installed` } : paymentPage ? { value: true, from: `there\u2019s a ${paymentPage.match(/pricing|checkout|billing|subscribe/i)[0].toLowerCase()} page` } : { value: false, from: "no payment provider or pricing page found" };
+  const kinds = [];
+  const reasons = [];
+  const auth = matchPackage(deps2, AUTH_PACKAGES);
+  const schema = schemaText(ctx);
+  if (auth || /\b(?:users?|profiles?|accounts?)\b[\s\S]{0,400}\bemail\b/i.test(schema)) {
+    kinds.push("personal");
+    reasons.push(auth ? `sign-in with ${auth}` : "a users table with emails");
+  }
+  if (chargesMoney.value) {
+    kinds.push("payments");
+    reasons.push("it charges money");
+  }
+  for (const [kind, re, label] of SENSITIVE) {
+    if (re.test(schema)) {
+      kinds.push(kind);
+      reasons.push(`${label} words in the database tables`);
+    }
+  }
+  const dataHandled = kinds.length ? { value: kinds, from: reasons.join("; ") } : { value: ["none"], from: "no sign-in, payments or sensitive tables found" };
+  return { whatItDoes: whatItDoes(ctx), chargesMoney, dataHandled };
+}
+function describeInferred(inferred) {
+  return [
+    `What it does: ${inferred.whatItDoes ? `${inferred.whatItDoes.value} (from ${inferred.whatItDoes.from})` : "not found, please describe it"}`,
+    `Charges money: ${inferred.chargesMoney.value ? "yes" : "no"} (${inferred.chargesMoney.from})`,
+    `Data it handles: ${inferred.dataHandled.value.map((k) => DATA_LABELS2[k]).join(", ")} (${inferred.dataHandled.from})`
+  ];
+}
+
+// src/commands/scan.ts
+import { mkdtempSync as mkdtempSync3, rmSync as rmSync7, writeFileSync as writeFileSync8 } from "fs";
+import os6 from "os";
+import path21 from "path";
 async function scanRef(root, ref, opts) {
-  const dir = mkdtempSync3(path19.join(os5.tmpdir(), "aura-base-"));
-  const wt = path19.join(dir, "tree");
+  const dir = mkdtempSync3(path21.join(os6.tmpdir(), "aura-base-"));
+  const wt = path21.join(dir, "tree");
   const add = await run("git", ["worktree", "add", "--detach", wt, ref], { cwd: root });
   if (add.code !== 0) {
     rmSync7(dir, { recursive: true, force: true });
@@ -24144,6 +24550,7 @@ async function scanRef(root, ref, opts) {
   }
 }
 async function scanCommand(flags) {
+  const started = Date.now();
   const root = await findRepoRoot();
   const config2 = loadConfig(root);
   const quiet = Boolean(flags.json);
@@ -24171,8 +24578,22 @@ async function scanCommand(flags) {
   writeAuraFile(root, "scan.json", JSON.stringify(scan, null, 2));
   writeAuraFile(root, "report.md", renderMarkdown(scan, steps));
   appendHistory(root, scan);
-  if (config2.telemetry)
-    await sendTelemetry(root, client, { event: "scan", score: scan.score, categories: Object.fromEntries(scan.categories.map((c) => [c.category, c.score])) });
+  const findings = scan.checks.flatMap((c) => c.findings);
+  await recordUsage(root, config2, {
+    event: "scan",
+    score: scan.score,
+    categories: Object.fromEntries(scan.categories.map((c) => [c.category, c.score])),
+    findings: {
+      critical: findings.filter((f) => f.severity === "critical").length,
+      high: findings.filter((f) => f.severity === "high").length,
+      medium: findings.filter((f) => f.severity === "medium").length,
+      low: findings.filter((f) => f.severity === "low").length,
+      info: findings.filter((f) => f.severity === "info").length
+    },
+    failingChecks: scan.checks.filter((c) => c.status === "fail" || c.status === "partial").map((c) => c.checkId),
+    durationMs: Date.now() - started
+  });
+  if (!flags.ci) await followUpFixes(root, config2, scan);
   let exitCode = 0;
   let base = null;
   if (flags.base) {
@@ -24183,7 +24604,7 @@ async function scanCommand(flags) {
   const baseIds = new Set(base ? base.checks.flatMap((c) => c.findings.map((f) => f.id)) : []);
   const newCritical = base ? scan.checks.flatMap((c) => c.findings).filter((f) => f.severity === "critical" && !baseIds.has(f.id)) : [];
   if (base && (base.score - scan.score > maxDrop || newCritical.length > 0)) exitCode = 1;
-  if (flags.commentFile) writeFileSync7(flags.commentFile, renderPrComment(scan, base, maxDrop));
+  if (flags.commentFile) writeFileSync8(flags.commentFile, renderPrComment(scan, base, maxDrop));
   if (quiet) {
     printJson({ ...scan, nextSteps: steps, base: base ? { score: base.score, categories: base.categories } : void 0 });
     return exitCode;
@@ -24204,31 +24625,34 @@ async function scanCommand(flags) {
 // src/commands/init.ts
 var AGENT_IDS = ["claude", "codex", "cursor", "pi"];
 function detectAgents(root) {
-  const found = [];
-  if (existsSync16(`${root}/CLAUDE.md`) || existsSync16(`${root}/.claude`)) found.push("claude");
-  if (existsSync16(`${root}/AGENTS.md`)) found.push("codex");
-  if (existsSync16(`${root}/.cursor`) || existsSync16(`${root}/.cursorrules`)) found.push("cursor");
-  if (existsSync16(`${root}/.pi`)) found.push("pi");
-  return found;
+  return detectAgentsFrom((rel) => existsSync17(path22.join(root, rel)));
 }
 function openEditor(file2) {
-  const editor = process.env.VISUAL || process.env.EDITOR || (process.platform === "win32" ? "notepad" : "nano");
-  const r = spawnSync2(editor, [file2], { stdio: "inherit", shell: process.platform === "win32" });
-  return r.status === 0;
+  const fallback = process.platform === "win32" ? "notepad" : spawnSync3("sh", ["-c", "command -v nano"]).status === 0 ? "nano" : "vi";
+  const editor = process.env.VISUAL || process.env.EDITOR || fallback;
+  return spawnSync3(`${editor} "${file2}"`, { stdio: "inherit", shell: true }).status === 0;
+}
+function answersTemplate(inferred) {
+  return JSON.stringify({
+    whatItDoes: inferred.whatItDoes?.value ?? "\u2026",
+    audience: "\u2026",
+    chargesMoney: inferred.chargesMoney.value,
+    dataHandled: inferred.dataHandled.value,
+    userRegions: ["\u2026"]
+  });
 }
-var EXAMPLE_ANSWERS = '{"whatItDoes": "\u2026", "audience": "\u2026", "chargesMoney": false, "dataHandled": ["personal"], "userRegions": ["Canada"]}';
-function briefHandoff() {
+function briefHandoff(inferred) {
   return [
     "",
-    `${pc.magenta("\u2726")} ${pc.bold("Next: write the product brief")}`,
-    "  Ask the user these questions. If you are a coding agent, suggest answers from the code and let the user confirm or correct them:",
-    "  1. What does the app do?",
-    "  2. Who is it for?",
-    "  3. Does it charge money?",
-    "  4. What data does it handle? Any of: personal, payments, health, legal, children, none",
-    "  5. Where are its users? (countries or regions)",
-    "  Save the answers to .aura/answers.json in this shape:",
-    `  ${EXAMPLE_ANSWERS}`,
+    `${pc.magenta("\u2726")} ${pc.bold("Next: check the product brief with the user")}`,
+    "  Aura worked these out from the code. Show them to the user and correct anything they say is wrong:",
+    ...describeInferred(inferred).map((l) => `  - ${l}`),
+    "  Then ask the user:",
+    "  - Who is the app for?",
+    "  - Where are its users? (countries or regions)",
+    '  Save the answers to .aura/answers.json. Start from this and replace each "\u2026":',
+    `  ${answersTemplate(inferred)}`,
+    "  dataHandled can include: personal, payments, health, legal, children, none.",
     "  Then run: npx getaura@latest init --yes --answers .aura/answers.json",
     ""
   ].join("\n");
@@ -24257,6 +24681,8 @@ async function initCommand(flags) {
   else if (!gh.hasRemote) say.warn("This repo has no GitHub remote yet. Push it to GitHub before applying fixes (`gh repo create`).");
   else say.ok("git and the GitHub CLI are ready.");
   const config2 = loadConfig(root);
+  if (flags.telemetry !== void 0) config2.shareUsage = flags.telemetry;
+  const setupStep = (step) => recordUsage(root, config2, { event: "setup", step });
   let agents = (flags.agent ?? []).flatMap((a) => a.split(",")).map((a) => a.trim().toLowerCase());
   const unknown2 = agents.filter((a) => !AGENT_IDS.includes(a));
   if (unknown2.length) {
@@ -24278,20 +24704,15 @@ async function initCommand(flags) {
   }
   config2.agents = agents;
   let key = flags.key ?? getApiKey();
-  let explained = false;
-  if (!key && !process.env.CI && !config2.noKey) {
+  let connectedNow = false;
+  if (!key && !inCI()) {
     const outcome = await signInWithBrowser(getApiUrl(config2), { person: interactive(), waitSeconds: parseWait(flags.wait) });
-    if (outcome.status === "complete") {
-      key = outcome.key;
-      delete config2.noKey;
-    } else {
-      if (outcome.status === "skipped") config2.noKey = true;
-      if (!explainSignIn(outcome)) {
-        if (outcome.status === "pending") return 1;
-        say.dim("Continuing without a pilot key for now. Connect one later with `aura login`.");
-      }
-      explained = true;
+    if (outcome.status !== "complete") {
+      explainSignIn(outcome);
+      return 1;
     }
+    key = outcome.key;
+    connectedNow = true;
   }
   let client = AuraClient.from(config2);
   if (key) {
@@ -24300,11 +24721,18 @@ async function initCommand(flags) {
       const me = await client.request("GET", "me");
       saveApiKey(key);
       say.ok(`Signed in as ${me.name}.`);
+      if (sharesUsage(config2, key)) {
+        say.dim(
+          "During the pilot, Aura shares usage data with the Aura team: scores, fixes and errors, never your code. Turn it off with `aura config telemetry off`."
+        );
+        await setupStep("started");
+        if (connectedNow) await setupStep("key_connected");
+      }
     } catch (err) {
       say.warn(`${friendlyApiError(err)} Continuing without Aura\u2019s agent.`);
       client = new AuraClient(getApiUrl(config2), null);
     }
-  } else if (!explained) {
+  } else {
     say.dim("No pilot key: Aura will still score your repo, with standard explanations.");
   }
   const ctx = await buildContext(root, { fast: true, noDownload: true }, config2);
@@ -24312,35 +24740,49 @@ async function initCommand(flags) {
   let brief2 = null;
   let keptBrief = false;
   if (flags.briefFile) {
-    brief2 = readFileSync15(flags.briefFile, "utf8");
-  } else if (!flags.answers && existsSync16(briefPath) && !(tty && unwrap(await p.confirm({ message: "A product brief already exists. Draft a new one?", initialValue: false })))) {
+    brief2 = readFileSync17(flags.briefFile, "utf8");
+  } else if (!flags.answers && existsSync17(briefPath) && !(tty && unwrap(await p.confirm({ message: "A product brief already exists. Draft a new one?", initialValue: false })))) {
     keptBrief = true;
   } else {
     let answers = null;
     if (flags.answers) {
-      answers = OnboardingAnswersSchema.parse(JSON.parse(readFileSync15(flags.answers, "utf8")));
+      answers = OnboardingAnswersSchema.parse(JSON.parse(readFileSync17(flags.answers, "utf8")));
     } else if (tty) {
-      p.note("A few questions so Aura understands your app. Your answers go into the product brief.", "About your app");
-      const whatItDoes = unwrap(await p.text({ message: "What does your app do?", placeholder: "e.g. Lets dog owners book and pay for walks" }));
-      const audience = unwrap(await p.text({ message: "Who is it for?", placeholder: "e.g. Busy dog owners in Toronto" }));
-      const chargesMoney = unwrap(await p.confirm({ message: "Does it charge money?", initialValue: ctx.stack.services.includes("Stripe") }));
-      const dataHandled = unwrap(
+      const inferred = inferAnswers(ctx);
+      p.note(describeInferred(inferred).join("\n"), "Here\u2019s what Aura found about your app");
+      const fix = new Set(
+        unwrap(
+          await p.multiselect({
+            message: "Anything Aura got wrong? Select it to correct it, or press enter if it\u2019s all right.",
+            options: [
+              { value: "whatItDoes", label: "What it does" },
+              { value: "chargesMoney", label: "Charges money" },
+              { value: "dataHandled", label: "Data it handles" }
+            ],
+            required: false
+          })
+        )
+      );
+      const whatItDoes2 = inferred.whatItDoes && !fix.has("whatItDoes") ? inferred.whatItDoes.value : unwrap(
+        await p.text({
+          message: "What does your app do?",
+          placeholder: "e.g. Lets dog owners book and pay for walks",
+          initialValue: inferred.whatItDoes?.value
+        })
+      );
+      const chargesMoney = fix.has("chargesMoney") ? unwrap(await p.confirm({ message: "Does it charge money?", initialValue: !inferred.chargesMoney.value })) : inferred.chargesMoney.value;
+      const dataHandled = fix.has("dataHandled") ? unwrap(
         await p.multiselect({
           message: "What data does it handle?",
-          options: [
-            { value: "personal", label: "Personal info (names, emails)" },
-            { value: "payments", label: "Payments" },
-            { value: "health", label: "Health" },
-            { value: "legal", label: "Legal" },
-            { value: "children", label: "Children\u2019s data" },
-            { value: "none", label: "None of these" }
-          ],
+          options: Object.entries(DATA_LABELS2).map(([value, label]) => ({ value, label: label[0].toUpperCase() + label.slice(1) })),
+          initialValues: inferred.dataHandled.value,
           required: true
         })
-      );
+      ) : inferred.dataHandled.value;
+      const audience = unwrap(await p.text({ message: "Who is it for?", placeholder: "e.g. Busy dog owners in Toronto" }));
       const regions = unwrap(await p.text({ message: "Where are your users?", placeholder: "e.g. Canada, United States" }));
       answers = {
-        whatItDoes,
+        whatItDoes: whatItDoes2,
         audience,
         chargesMoney,
         dataHandled,
@@ -24363,13 +24805,14 @@ async function initCommand(flags) {
       }
       brief2 ??= offlineBrief(answers, summary, ctx);
     } else {
-      console.log(briefHandoff());
+      console.log(briefHandoff(inferAnswers(ctx)));
     }
   }
   if (keptBrief) {
     say.ok("Kept your existing product brief (.aura/brief.md).");
   } else if (brief2) {
     writeAuraFile(root, "brief.md", brief2);
+    await setupStep("brief_written");
     if (tty) {
       p.note(brief2.split("\n").slice(0, 24).join("\n") + (brief2.split("\n").length > 24 ? "\n\u2026" : ""), "Product brief draft");
       const choice = unwrap(
@@ -24385,27 +24828,36 @@ async function initCommand(flags) {
     }
     say.ok("Saved the product brief to .aura/brief.md. It gets committed in the first-run PR (aura apply foundation).");
   }
-  writeChanges(root, skillChanges(agents, ["aura"]));
+  writeChanges(root, [...skillChanges(agents, ["aura"]), ...commandChanges(agents)]);
   say.ok(`Installed the Aura skill for ${agents.map((a) => AGENT_LABELS[a]).join(", ")}.`);
-  if (flags.telemetry !== void 0) config2.telemetry = flags.telemetry;
-  else if (tty) {
-    config2.telemetry = unwrap(
-      await p.confirm({ message: "Share your Aura score and which actions you take with the Aura team? (Never code. Off by default.)", initialValue: false })
-    );
+  await setupStep("skill_installed");
+  if (agents.includes("claude") && !inCI() && !process.env.AURA_NO_CLAUDE_PLUGIN) {
+    const plugin = await installClaudePlugin(root);
+    if (plugin === "installed")
+      say.ok(
+        "Added Aura\u2019s slash commands to Claude Code: /aura:scan, /aura:next, /aura:fix and /aura:setup. Restart Claude Code (or run /reload-plugins) to use them."
+      );
+    else say.dim(`To add Aura\u2019s slash commands (/aura:scan, /aura:fix\u2026) to Claude Code, run these two commands:
+  ${manualInstall().join("\n  ")}`);
   }
+  for (const agent of agents.filter((a) => a !== "claude")) say.ok(`Added Aura\u2019s commands for ${AGENT_LABELS[agent]}: ${commandList(agent)}.`);
   saveConfig(root, config2);
   ensureGitignore(root);
-  if (!process.env.CI && !await hasAuraCommand()) {
+  if (!inCI() && !await hasAuraCommand()) {
     if (tty) {
       if (unwrap(await p.confirm({ message: "Install the `aura` command so you can run `aura scan` any time?", initialValue: true }))) {
         const s = spin(true);
         s.start("Installing the aura command");
         const installed = await installAuraCommand();
+        await setupStep(installed.ok ? "command_installed" : "command_install_failed");
         if (installed.ok)
           s.stop(installed.onPath ? "Installed. Run `aura scan` from any folder." : "Installed. Open a new terminal window, then run `aura scan`.");
         else {
           s.stop("Couldn\u2019t install the aura command");
-          say.warn(installFallback(installed));
+          const useSudo = installed.needsAdmin && process.platform !== "win32" && unwrap(await p.confirm({ message: "Your computer needs your password to install it. Enter your password now?", initialValue: true }));
+          if (!useSudo) say.warn(installFallback(installed));
+          else if (await installWithSudo()) say.ok("Installed. Run `aura scan` from any folder.");
+          else say.warn(installFallback({ needsAdmin: false }));
         }
       } else say.dim(`Use \`npx getaura <command>\` instead, or install it later with \`${INSTALL_AURA}\`.`);
     } else {
@@ -24420,11 +24872,13 @@ ${pc.magenta("\u2726")} ${pc.bold("Give the user the aura command")}`);
     return 0;
   }
   if (tty) p.outro("Running your first scan\u2026");
-  return scanCommand({});
+  const scanned = await scanCommand({});
+  await setupStep("first_scan");
+  return scanned;
 }
 
 // src/commands/summary.ts
-import path20 from "path";
+import path23 from "path";
 async function activity(root, since) {
   const log = await git(root, "log", `--since=${since.toISOString()}`, "--no-merges", "--format=%H%x09%an%x09%s");
   const commits = log.stdout.split("\n").filter(Boolean).slice(0, 300).map((l) => {
@@ -24481,7 +24935,7 @@ async function summaryCommand(flags) {
   const beforeIds = new Set(before ? allFindings(before).map((f) => f.id) : []);
   const nowIds = new Set(allFindings(now).map((f) => f.id));
   const req = {
-    repo: path20.basename(root),
+    repo: path23.basename(root),
     since: since.toISOString(),
     until: until.toISOString(),
     product: productContext(root),
@@ -24525,10 +24979,62 @@ ${body}`);
   return 0;
 }
 
+// src/index.ts
+import pc4 from "picocolors";
+
+// src/core/update-check.ts
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync18, writeFileSync as writeFileSync9 } from "fs";
+import os7 from "os";
+import path24 from "path";
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var cacheFile = () => path24.join(os7.homedir(), ".aura", "update-check.json");
+function isNewer(a, b) {
+  if (!/^\d+\.\d+\.\d+$/.test(a) || !/^\d+\.\d+\.\d+$/.test(b)) return false;
+  const [x, y] = [a, b].map((v) => v.split(".").map(Number));
+  for (let i = 0; i < 3; i++) if (x[i] !== y[i]) return x[i] > y[i];
+  return false;
+}
+async function fetchLatest() {
+  try {
+    const res = await fetch("https://registry.npmjs.org/getaura/latest", { signal: AbortSignal.timeout(1500) });
+    const body = await res.json();
+    return res.ok && typeof body.version === "string" ? body.version : null;
+  } catch {
+    return null;
+  }
+}
+async function newerVersion(opts = {}) {
+  const now = opts.now ?? Date.now();
+  let latest = null;
+  try {
+    const cached2 = JSON.parse(readFileSync18(cacheFile(), "utf8"));
+    if (now - cached2.checkedAt < DAY_MS) latest = cached2.latest;
+    else throw new Error("stale");
+  } catch {
+    latest = await (opts.fetchLatest ?? fetchLatest)();
+    try {
+      mkdirSync7(path24.dirname(cacheFile()), { recursive: true });
+      writeFileSync9(cacheFile(), JSON.stringify({ checkedAt: now, latest }));
+    } catch {
+    }
+  }
+  return latest && isNewer(latest, opts.current ?? AURA_VERSION) ? latest : null;
+}
+function startUpdateCheck() {
+  if (!process.stdout.isTTY || inCI() || runningAgent() || process.env.AURA_NO_UPDATE_CHECK) return Promise.resolve(null);
+  return newerVersion().catch(() => null);
+}
+function updateNotice(latest, argv1 = process.argv[1] ?? "") {
+  const viaNpx = /[\\/]_npx[\\/]/.test(argv1);
+  const how = viaNpx ? "use `npx getaura@latest`" : "update with `npm install -g getaura@latest`";
+  return `Aura ${latest} is available (you have ${AURA_VERSION}): ${how}.`;
+}
+
 // src/index.ts
 var program = new Command();
 program.name("aura").description("Aura helps you and your coding agent follow best practices while you vibe code.").version(AURA_VERSION).showHelpAfterError();
 program.addHelpText("before", () => interactive() ? banner() : "");
+var update = startUpdateCheck();
 function action(fn) {
   return async (...args) => {
     try {
@@ -24541,7 +25047,16 @@ function action(fn) {
       say.error(err.message);
       if (process.env.AURA_DEBUG) console.error(err);
       process.exitCode = 1;
+      const command = args.at(-1) instanceof Command ? args.at(-1).name() : "unknown";
+      try {
+        const root = await findRepoRoot();
+        await recordUsage(root, loadConfig(root), { event: "error", command, errorType: errorKind(err) });
+      } catch {
+      }
     }
+    const latest = await update;
+    if (latest) console.error(pc4.dim(`
+${updateNotice(latest)}`));
   };
 }
 program.command("init").description("Set up Aura: pick your agent, write the product brief, install the Aura skill and run the first scan").option("--agent <id...>", "coding agent(s): claude, codex, cursor, pi").option("-y, --yes", "no prompts; use detected defaults").option("--key <key>", "Aura pilot key, for CI and scripts (otherwise a browser page asks for it)").option("--wait <seconds>", "how long to wait for the browser sign-in (default: until the link expires; 90 for agents)").option("--brief-file <path>", "use this file as the product brief").option("--answers <path>", "JSON file with the setup answers").option("--no-scan", "skip the first scan").addOption(new Option("--telemetry", "share scores and action names with the Aura team")).addOption(new Option("--no-telemetry", "don\u2019t share anything")).action(action((flags) => initCommand(flags)));