getaura 0.1.6 → 0.1.8

package/dist/index.js

@@ -9,8 +9,8 @@ var __export = (target, all) => {
 import { Command, Option } from "commander";
 
 // src/commands/apply.ts
-import { existsSync as existsSync15, rmSync as rmSync6 } from "fs";
-import path17 from "path";
+import { existsSync as existsSync19, rmSync as rmSync6 } from "fs";
+import path20 from "path";
 
 // src/core/agents.ts
 var AGENT_LAYOUT = {
@@ -36,6 +36,25 @@ function uniqueSkillDirs(agents) {
 }
 var AURA_BLOCK_START = "<!-- aura:start -->";
 var AURA_BLOCK_END = "<!-- aura:end -->";
+function detectAgentsFrom(exists2) {
+  const found = [];
+  if (exists2("CLAUDE.md") || exists2(".claude")) found.push("claude");
+  if (exists2(".codex")) found.push("codex");
+  if (exists2(".cursor") || exists2(".cursorrules")) found.push("cursor");
+  if (exists2(".pi")) found.push("pi");
+  if (found.length === 0 && exists2("AGENTS.md")) found.push("codex");
+  return found;
+}
+function runningAgent(env = process.env) {
+  if (env.CLAUDECODE) return "claude";
+  if (env.CODEX_THREAD_ID) return "codex";
+  if (env.CURSOR_AGENT) return "cursor";
+  if (env.PI_CODING_AGENT) return "pi";
+  return null;
+}
+function inCI(env = process.env) {
+  return Boolean(env.CI) && !runningAgent(env);
+}
 
 // ../shared/src/types.ts
 var CATEGORIES = ["security", "agent-setup", "foundations", "structure"];
@@ -990,10 +1009,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path22) {
-  if (!path22)
+function getElementAtPath(obj, path27) {
+  if (!path27)
     return obj;
-  return path22.reduce((acc, key) => acc?.[key], obj);
+  return path27.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -1333,11 +1352,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path22, issues) {
+function prefixIssues(path27, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path22);
+    iss.path.unshift(path27);
     return iss;
   });
 }
@@ -1787,16 +1806,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path22 = []) => {
+  const processError = (error63, path27 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path22, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path27, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path22, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path27, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path22, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path27, ...issue2.path]);
       } else {
-        const fullpath = [...path22, ...issue2.path];
+        const fullpath = [...path27, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -1835,17 +1854,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path22 = []) => {
+  const processError = (error63, path27 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path22, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path27, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path22, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path27, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path22, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path27, ...issue2.path]);
       } else {
-        const fullpath = [...path22, ...issue2.path];
+        const fullpath = [...path27, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -1884,8 +1903,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path22 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path22) {
+  const path27 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path27) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -2019,18 +2038,18 @@ var validateAsync = async (schema, value, _ctx) => {
   return result.issues.length === 0;
 };
 var _encode = (_Err) => {
-  const parse3 = _parse(_Err);
+  const parse5 = _parse(_Err);
   const fn = (schema, value, _ctx, _params) => {
     const ctx = _ctx ? { ..._ctx, direction: "backward" } : { direction: "backward" };
-    return parse3(schema, value, ctx, finalizeParams(fn, _params));
+    return parse5(schema, value, ctx, finalizeParams(fn, _params));
   };
   return fn;
 };
 var encode = /* @__PURE__ */ _encode($ZodRealError);
 var _decode = (_Err) => {
-  const parse3 = _parse(_Err);
+  const parse5 = _parse(_Err);
   const fn = (schema, value, _ctx, _params) => {
-    return parse3(schema, value, _ctx, finalizeParams(fn, _params));
+    return parse5(schema, value, _ctx, finalizeParams(fn, _params));
   };
   return fn;
 };
@@ -18987,13 +19006,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path22 = ref.slice(1).split("/").filter(Boolean);
-  if (path22.length === 0) {
+  const path27 = ref.slice(1).split("/").filter(Boolean);
+  if (path27.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path22[0] === defsKey) {
-    const key = path22[1] === void 0 ? void 0 : decodeJSONPointerSegment(path22[1]);
+  if (path27[0] === defsKey) {
+    const key = path27[1] === void 0 ? void 0 : decodeJSONPointerSegment(path27[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -19939,14 +19958,59 @@ var SummaryRequest = external_exports.object({
   resolvedFindings: external_exports.array(external_exports.string().max(300)).max(50)
 });
 var SummaryResponse = external_exports.object({ summary: external_exports.string() });
+var SETUP_STEPS = [
+  "started",
+  "key_connected",
+  "brief_written",
+  "skill_installed",
+  "command_installed",
+  "command_install_failed",
+  "first_scan"
+];
+var FIX_OUTCOMES = [
+  "pr_opened",
+  "committed",
+  "no_changes",
+  "failed",
+  "cancelled",
+  "task_written",
+  "shown",
+  "settings_changed",
+  "merged",
+  "closed",
+  "resolved",
+  "not_resolved"
+];
 var TelemetryRequest = external_exports.object({
-  event: external_exports.enum(["scan", "action"]),
+  event: external_exports.enum(["scan", "action", "setup", "fix_result", "error"]),
   auraVersion: external_exports.string().max(40),
   /** Anonymous, stable per-repo id (hash of the first commit), never the repo name. */
   repoId: external_exports.string().max(80),
+  /** Who ran Aura: a person at a terminal, a coding agent or CI. */
+  source: external_exports.enum(["terminal", "agent", "ci"]).optional(),
+  /** The coding agent that ran this command, when it could be told. */
+  agent: external_exports.enum(["claude", "codex", "cursor", "pi"]).optional(),
+  /** The coding agents set up in this repo. */
+  agents: external_exports.array(external_exports.enum(["claude", "codex", "cursor", "pi"])).max(4).optional(),
+  os: external_exports.enum(["darwin", "win32", "linux", "other"]).optional(),
+  nodeVersion: external_exports.string().regex(/^v?\d+\.\d+\.\d+$/).optional(),
   score: external_exports.number().optional(),
   categories: external_exports.record(external_exports.string(), external_exports.number().nullable()).optional(),
-  actionId: external_exports.string().max(80).optional()
+  /** Findings by severity, and the ids of checks that didn't fully pass (never file names). */
+  findings: external_exports.record(severity, external_exports.number().int().nonnegative()).optional(),
+  failingChecks: external_exports.array(external_exports.string().regex(/^[a-z-]+\.[a-z-]+$/)).max(40).optional(),
+  actionId: external_exports.string().regex(/^[a-z0-9-]{1,80}$/).optional(),
+  step: external_exports.enum(SETUP_STEPS).optional(),
+  outcome: external_exports.enum(FIX_OUTCOMES).optional(),
+  delivery: external_exports.enum(["pr", "agent-fix", "agent-task", "guide", "checklist", "settings"]).optional(),
+  /** Whether the user picked it from the next-steps checklist or ran the command. */
+  via: external_exports.enum(["checklist", "command"]).optional(),
+  durationMs: external_exports.number().int().nonnegative().max(864e5).optional(),
+  agentSteps: external_exports.number().int().nonnegative().max(1e3).optional(),
+  scoreChange: external_exports.number().optional(),
+  command: external_exports.string().regex(/^[a-z-]{1,30}$/).optional(),
+  /** The kind of error (its class or code), never its message, which can contain paths. */
+  errorType: external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,59}$/).optional()
 });
 var MeResponse = external_exports.object({
   name: external_exports.string(),
@@ -19969,7 +20033,6 @@ var ConnectStartResponse = external_exports.object({
 var ConnectPollRequest = external_exports.object({ deviceSecret: external_exports.string().min(20).max(200) });
 var ConnectPollResponse = external_exports.discriminatedUnion("status", [
   external_exports.object({ status: external_exports.literal("pending") }),
-  external_exports.object({ status: external_exports.literal("skipped") }),
   external_exports.object({ status: external_exports.literal("expired") }),
   /** `encryptedKey` is base64 RSA-OAEP (SHA-256) ciphertext of the pilot key. */
   external_exports.object({ status: external_exports.literal("complete"), encryptedKey: external_exports.string(), name: external_exports.string() })
@@ -20015,36 +20078,24 @@ function grade(score) {
   return { label: "Generational aura debt", sentence: "You have generational aura debt", color: "red" };
 }
 
-// src/templates.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
-import path4 from "path";
-
-// src/core/config.ts
-import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
-import os from "os";
-import path2 from "path";
-
-// src/core/repo.ts
-import { existsSync, readdirSync, readFileSync, statSync } from "fs";
-import path from "path";
-import { fileURLToPath } from "url";
-
 // src/core/exec.ts
 import { spawn, spawnSync } from "child_process";
-var WINDOWS_PROGRAMS = /* @__PURE__ */ new Set(["git", "gh", "node", "tar", "where"]);
+var WINDOWS_PROGRAMS = /* @__PURE__ */ new Set(["git", "gh", "node", "tar", "where", "powershell"]);
 function quoteForCmd(arg) {
   return /^[\w@%+=:,./\\-]+$/.test(arg) ? arg : `"${arg.replace(/"/g, '\\"')}"`;
 }
 function spawnPlan(cmd, args, platform = process.platform) {
-  const direct = platform !== "win32" || cmd.includes("/") || cmd.includes("\\") || WINDOWS_PROGRAMS.has(cmd.toLowerCase());
-  return direct ? { args, shell: false } : { args: args.map(quoteForCmd), shell: true };
+  const isPath = cmd.includes("/") || cmd.includes("\\");
+  const script = /\.(?:cmd|bat)$/i.test(cmd);
+  const direct = platform !== "win32" || isPath && !script || WINDOWS_PROGRAMS.has(cmd.toLowerCase());
+  return direct ? { command: cmd, args, shell: false } : { command: quoteForCmd(cmd), args: args.map(quoteForCmd), shell: true };
 }
 function run(cmd, args, opts = {}) {
   return new Promise((resolve) => {
     let child;
     try {
       const plan = spawnPlan(cmd, args);
-      child = spawn(cmd, plan.args, { cwd: opts.cwd, env: opts.env ?? process.env, stdio: ["pipe", "pipe", "pipe"], shell: plan.shell });
+      child = spawn(plan.command, plan.args, { cwd: opts.cwd, env: opts.env ?? process.env, stdio: ["pipe", "pipe", "pipe"], shell: plan.shell });
     } catch (err) {
       resolve({ code: 127, stdout: "", stderr: String(err) });
       return;
@@ -20075,7 +20126,14 @@ async function commandExists(cmd) {
   return probe.code === 0;
 }
 
+// src/core/git.ts
+import { mkdirSync, rmSync, writeFileSync } from "fs";
+import path2 from "path";
+
 // src/core/repo.ts
+import { existsSync, readdirSync, readFileSync, statSync } from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
 var AURA_DIR = ".aura";
 var ALWAYS_IGNORED = ["node_modules", ".next", ".git", "dist", "build", "out", ".vercel", ".turbo", "coverage", ".aura"];
 async function findRepoRoot(cwd = process.cwd()) {
@@ -20140,7 +20198,545 @@ var SOURCE_EXT = /\.(?:[cm]?[jt]sx?)$/;
 var isSourceFile = (f) => SOURCE_EXT.test(f) && !f.endsWith(".d.ts");
 var isTestFile = (f) => /(?:^|\/)(?:__tests__|tests?|e2e)\/|\.(?:test|spec)\.[cm]?[jt]sx?$/.test(f);
 
+// src/core/git.ts
+async function git(root, ...args) {
+  return run("git", args, { cwd: root });
+}
+function ghInstallHint(platform = process.platform) {
+  const how = platform === "win32" ? "Install it with `winget install --id GitHub.cli`" : platform === "darwin" ? "Install it with `brew install gh` (or download it from https://cli.github.com)" : "Install it from https://cli.github.com";
+  return `${how}, open a new terminal, then run \`gh auth login\`.`;
+}
+async function ghStatus(root) {
+  const v = await run("gh", ["--version"]);
+  if (v.code !== 0) return { installed: false, authed: false, hasRemote: false };
+  const auth = await run("gh", ["auth", "status"], { cwd: root });
+  const remote = await git(root, "remote", "get-url", "origin");
+  return { installed: true, authed: auth.code === 0, hasRemote: remote.code === 0 && /github\.com/.test(remote.stdout) };
+}
+var AURA_OWNED = /^(?:\.aura\/|\.claude\/skills\/aura\/|\.agents\/skills\/aura(?:-(?:scan|next|fix|setup))?\/|\.cursor\/commands\/aura-[a-z]+\.md$|\.pi\/prompts\/aura-[a-z]+\.md$|\.claude\/settings\.json$)/;
+async function dirtyFiles(root) {
+  const r = await git(root, "status", "--porcelain", "-uall");
+  return r.stdout.split("\n").filter(Boolean).map((l) => l.slice(3).replace(/^"|"$/g, "").split(" -> ").pop()).filter((f) => !AURA_OWNED.test(f));
+}
+async function currentBranch(root) {
+  return (await git(root, "rev-parse", "--abbrev-ref", "HEAD")).stdout.trim();
+}
+async function freeBranchName(root, base) {
+  for (let i = 1; i < 50; i++) {
+    const name = i === 1 ? base : `${base}-${i}`;
+    const local = await git(root, "rev-parse", "--verify", "--quiet", `refs/heads/${name}`);
+    const remote = await git(root, "ls-remote", "--exit-code", "--heads", "origin", name);
+    if (local.code !== 0 && remote.code !== 0) return name;
+  }
+  return `${base}-${Date.now()}`;
+}
+function writeChanges(root, changes) {
+  for (const c of changes) {
+    const full = path2.join(root, c.path);
+    if (!isInside(root, full)) throw new Error(`Refusing to write outside the repo: ${c.path}`);
+    if (c.content === null) rmSync(full, { force: true });
+    else {
+      mkdirSync(path2.dirname(full), { recursive: true });
+      writeFileSync(full, c.content);
+    }
+  }
+}
+async function commitPushPr(root, opts) {
+  const commit = await git(root, "commit", "-m", opts.title, "-m", "Opened by Aura (https://github.com/JohnFazio1/aura).");
+  const base = { branch: opts.branch, url: null };
+  if (commit.code !== 0) {
+    const out = commit.stderr || commit.stdout;
+    const error62 = /tell me who you are|user\.email/i.test(out) ? 'git doesn\u2019t know your name and email yet. Run these two commands:\n  git config --global user.name "Your Name"\n  git config --global user.email "you@example.com"' : out;
+    return { ...base, committed: false, pushed: false, error: error62 };
+  }
+  if (!opts.openPr) return { ...base, committed: true, pushed: false };
+  const push = await git(root, "push", "-u", "origin", opts.branch);
+  if (push.code !== 0) return { ...base, committed: true, pushed: false, error: push.stderr };
+  const pr = await run("gh", ["pr", "create", "--base", opts.base, "--head", opts.branch, "--title", opts.title, "--body-file", "-"], {
+    cwd: root,
+    input: opts.body
+  });
+  if (pr.code !== 0) return { ...base, committed: true, pushed: true, error: pr.stderr };
+  return { ...base, url: pr.stdout.trim().split("\n").pop() ?? null, committed: true, pushed: true };
+}
+
+// src/connectors/github.ts
+var PAID_SECRETS = "needs GitHub Secret Protection (a paid add-on) on private repositories";
+var PAID_RULES = "needs a paid GitHub plan (Pro is about $4/month) on private repositories";
+var PUBLIC_ONLY = "only available on public repositories";
+var RULESET_NAME = "Protect main (Aura)";
+var parse3 = (r) => {
+  try {
+    return JSON.parse(r.stdout);
+  } catch {
+    return null;
+  }
+};
+var needsUpgrade = (r) => /Upgrade to GitHub Pro|HTTP 403|not available|Advanced Security/i.test(r.stderr + r.stdout);
+var done = (r) => r.code === 0 ? { ok: true } : { ok: false };
+async function ciChecks(ctx) {
+  const r = await ctx.gh([
+    "api",
+    `repos/${ctx.repo}/commits/${ctx.defaultBranch}/check-runs`,
+    "--jq",
+    '.check_runs[] | select(.app.slug == "github-actions") | .name'
+  ]);
+  return r.code === 0 ? [
+    ...new Set(
+      r.stdout.split("\n").map((s) => s.trim()).filter(Boolean)
+    )
+  ] : [];
+}
+function protectMainRuleset(checks) {
+  return {
+    name: RULESET_NAME,
+    target: "branch",
+    enforcement: "active",
+    conditions: { ref_name: { include: ["~DEFAULT_BRANCH"], exclude: [] } },
+    rules: [
+      { type: "deletion" },
+      { type: "non_fast_forward" },
+      {
+        // No approvals required, so someone working alone can still merge their own pull requests.
+        type: "pull_request",
+        parameters: {
+          required_approving_review_count: 0,
+          dismiss_stale_reviews_on_push: false,
+          require_code_owner_review: false,
+          require_last_push_approval: false,
+          required_review_thread_resolution: false
+        }
+      },
+      ...checks.length ? [
+        {
+          type: "required_status_checks",
+          parameters: { strict_required_status_checks_policy: false, required_status_checks: checks.map((context) => ({ context })) }
+        }
+      ] : []
+    ]
+  };
+}
+var secretState = (key) => async (ctx) => {
+  const security = parse3(await ctx.get(`repos/${ctx.repo}`))?.security_and_analysis;
+  if (security?.[key]?.status === "enabled") return { state: "on" };
+  return security?.[key] || !ctx.isPrivate ? { state: "off" } : { state: "unavailable", why: PAID_SECRETS };
+};
+var enableSecret = (key) => async (ctx) => {
+  const r = await ctx.gh(
+    ["api", "-X", "PATCH", `repos/${ctx.repo}`, "--input", "-"],
+    JSON.stringify({ security_and_analysis: { [key]: { status: "enabled" } } })
+  );
+  return r.code === 0 ? { ok: true } : { ok: false, unavailable: ctx.isPrivate && needsUpgrade(r) ? PAID_SECRETS : void 0 };
+};
+var github = {
+  id: "github",
+  name: "GitHub",
+  actionId: "github-security",
+  // Offered for every repo; connecting finds out whether it's on GitHub.
+  detect: () => true,
+  async connect(root, fake) {
+    const cli = fake;
+    const gh = cli ?? ((args, input2) => run("gh", args, { cwd: root, input: input2, timeoutMs: 3e4 }));
+    if (!cli) {
+      const status = await ghStatus(root);
+      if (!status.installed) return { ok: false, problem: `The GitHub CLI isn\u2019t installed. ${ghInstallHint()}`, errorType: "CliNotInstalled" };
+      if (!status.authed) return { ok: false, problem: "The GitHub CLI isn\u2019t signed in. Run `gh auth login`, then try again.", errorType: "CliNotSignedIn" };
+      if (!status.hasRemote)
+        return { ok: false, problem: "This repo isn\u2019t on GitHub yet. Push it to GitHub first, for example with `gh repo create`.", errorType: "NoProject" };
+    }
+    const info = parse3(await gh(["repo", "view", "--json", "nameWithOwner,isPrivate,defaultBranchRef,viewerPermission"]));
+    if (!info?.nameWithOwner) return { ok: false, problem: "Couldn\u2019t read this repo from GitHub. Check `gh repo view` works here.", errorType: "NoProject" };
+    if (info.viewerPermission !== "ADMIN")
+      return {
+        ok: false,
+        problem: `Changing these settings needs admin access to ${info.nameWithOwner}. Ask the repo\u2019s owner to run \`aura apply github-security\`.`,
+        errorType: "NotAdmin"
+      };
+    const cache = /* @__PURE__ */ new Map();
+    const ctx = {
+      repo: info.nameWithOwner,
+      isPrivate: Boolean(info.isPrivate),
+      defaultBranch: info.defaultBranchRef?.name || "main",
+      gh,
+      get: (path27) => {
+        if (!cache.has(path27)) cache.set(path27, gh(["api", path27]));
+        return cache.get(path27);
+      }
+    };
+    return { ok: true, ctx, target: `${ctx.repo} ${ctx.isPrivate ? "(private)" : "(public)"}` };
+  },
+  settings: [
+    {
+      id: "dependabot-alerts",
+      label: "Dependabot alerts (warns about vulnerable packages)",
+      impact: "GitHub emails you when a package your app uses has a known security hole.",
+      read: async (ctx) => (await ctx.get(`repos/${ctx.repo}/vulnerability-alerts`)).code === 0 ? { state: "on" } : { state: "off" },
+      enable: async (ctx) => done(await ctx.gh(["api", "-X", "PUT", `repos/${ctx.repo}/vulnerability-alerts`]))
+    },
+    {
+      id: "dependabot-fixes",
+      label: "Dependabot security fixes (opens PRs to update them)",
+      impact: "GitHub opens pull requests that update vulnerable packages. Nothing merges without you.",
+      read: async (ctx) => parse3(await ctx.get(`repos/${ctx.repo}/automated-security-fixes`))?.enabled ? { state: "on" } : { state: "off" },
+      enable: async (ctx) => done(await ctx.gh(["api", "-X", "PUT", `repos/${ctx.repo}/automated-security-fixes`]))
+    },
+    {
+      id: "secret-scanning",
+      label: "Secret scanning (finds keys pushed to GitHub)",
+      impact: "GitHub alerts you when a key or password is pushed to the repo.",
+      read: secretState("secret_scanning"),
+      enable: enableSecret("secret_scanning")
+    },
+    {
+      id: "push-protection",
+      label: "Push protection (blocks pushes that contain a key)",
+      impact: "A push that contains a key is refused until you remove it.",
+      read: secretState("secret_scanning_push_protection"),
+      enable: enableSecret("secret_scanning_push_protection")
+    },
+    {
+      id: "private-reporting",
+      label: "Private vulnerability reporting",
+      impact: "Security researchers can report a problem to you privately instead of in a public issue.",
+      read: async (ctx) => ctx.isPrivate ? { state: "unavailable", why: PUBLIC_ONLY } : parse3(await ctx.get(`repos/${ctx.repo}/private-vulnerability-reporting`))?.enabled ? { state: "on" } : { state: "off" },
+      enable: async (ctx) => done(await ctx.gh(["api", "-X", "PUT", `repos/${ctx.repo}/private-vulnerability-reporting`]))
+    },
+    {
+      id: "protect-main",
+      label: "Protect the main branch (pull requests and passing checks required, no force pushes or deletion)",
+      impact: "You can\u2019t push straight to main any more: changes go through pull requests (you can still merge your own) once the checks pass.",
+      async read(ctx) {
+        const rules = parse3(await ctx.get(`repos/${ctx.repo}/rules/branches/${ctx.defaultBranch}`));
+        const protection = await ctx.get(`repos/${ctx.repo}/branches/${ctx.defaultBranch}/protection`);
+        if (Array.isArray(rules) && rules.some((r) => r.type === "pull_request") || protection.code === 0) return { state: "on" };
+        if (ctx.isPrivate && /Upgrade to GitHub Pro/i.test(protection.stderr)) return { state: "unavailable", why: PAID_RULES };
+        return { state: "off" };
+      },
+      async enable(ctx) {
+        const r = await ctx.gh(["api", "-X", "POST", `repos/${ctx.repo}/rulesets`, "--input", "-"], JSON.stringify(protectMainRuleset(await ciChecks(ctx))));
+        return r.code === 0 ? { ok: true } : { ok: false, unavailable: ctx.isPrivate && needsUpgrade(r) ? PAID_RULES : void 0 };
+      }
+    }
+  ],
+  async explain(ctx, toTurnOn) {
+    if (!toTurnOn.includes("protect-main")) return [];
+    const checks = await ciChecks(ctx);
+    return checks.length ? [`Pull requests to main will need these checks to pass: ${checks.join(", ")}.`] : [];
+  },
+  async leftForYou(ctx, results) {
+    const left = ["Turn on two-factor login for your GitHub account: https://github.com/settings/security"];
+    const r = await ctx.gh(["api", `repos/${ctx.repo}/collaborators`, "--jq", '.[] | "\\(.login) (\\(.role_name))"']);
+    const people = r.code === 0 ? r.stdout.split("\n").filter(Boolean) : [];
+    if (people.length)
+      left.push(`People with access: ${people.join(", ")}. Remove anyone who no longer needs it: https://github.com/${ctx.repo}/settings/access`);
+    if (results.some((x) => x.id === "secret-scanning" && x.result === "unavailable"))
+      left.push("Aura\u2019s own secret check still runs on every `aura scan`, and before each commit if you add the pre-commit hook.");
+    return left;
+  }
+};
+
+// src/connectors/supabase.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import os from "os";
+import path3 from "path";
+var TOKEN = /^sbp_(?:oauth_|v0_)?[a-f0-9]{40}$/;
+function decodeToken(raw) {
+  const value = raw?.trim() ?? "";
+  const token = value.startsWith("go-keyring-base64:") ? Buffer.from(value.slice("go-keyring-base64:".length), "base64").toString("utf8").trim() : value;
+  return TOKEN.test(token) ? token : null;
+}
+function windowsCredentialScript(target) {
+  return `
+$sig = @'
+[DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)] public static extern bool CredRead(string target, int type, int flags, out IntPtr cred);
+[DllImport("advapi32.dll")] public static extern void CredFree(IntPtr cred);
+[StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)] public struct CREDENTIAL { public int Flags; public int Type; public string TargetName; public string Comment; public long LastWritten; public int CredentialBlobSize; public IntPtr CredentialBlob; public int Persist; public int AttributeCount; public IntPtr Attributes; public string TargetAlias; public string UserName; }
+'@
+Add-Type -MemberDefinition $sig -Namespace AuraCred -Name Win
+$p = [IntPtr]::Zero
+if ([AuraCred.Win]::CredRead('${target}', 1, 0, [ref]$p)) {
+  $c = [Runtime.InteropServices.Marshal]::PtrToStructure($p, [type][AuraCred.Win+CREDENTIAL])
+  $b = New-Object byte[] $c.CredentialBlobSize
+  [Runtime.InteropServices.Marshal]::Copy($c.CredentialBlob, $b, 0, $b.Length)
+  [Text.Encoding]::UTF8.GetString($b)
+  [AuraCred.Win]::CredFree($p)
+}`;
+}
+async function supabaseToken() {
+  const fromEnv = decodeToken(process.env.SUPABASE_ACCESS_TOKEN);
+  if (fromEnv) return fromEnv;
+  const home = path3.join(os.homedir(), ".supabase");
+  const profile = process.env.SUPABASE_PROFILE || (existsSync2(path3.join(home, "profile")) ? readFileSync2(path3.join(home, "profile"), "utf8").trim() : "") || "supabase";
+  for (const account of [profile, "access-token"]) {
+    const r = process.platform === "darwin" ? await run("security", ["find-generic-password", "-s", "Supabase CLI", "-a", account, "-w"]) : process.platform === "win32" ? await run("powershell", [
+      "-NoProfile",
+      "-NonInteractive",
+      "-EncodedCommand",
+      Buffer.from(windowsCredentialScript(`Supabase CLI:${account}`), "utf16le").toString("base64")
+    ]) : await run("secret-tool", ["lookup", "service", "Supabase CLI", "username", account]);
+    const token = r.code === 0 ? decodeToken(r.stdout) : null;
+    if (token) return token;
+  }
+  const file2 = path3.join(home, "access-token");
+  return existsSync2(file2) ? decodeToken(readFileSync2(file2, "utf8")) : null;
+}
+var realApi = (token) => async (method, endpoint, body) => {
+  const res = await fetch(`https://api.supabase.com${endpoint}`, {
+    method,
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+    body: body ? JSON.stringify(body) : void 0,
+    signal: AbortSignal.timeout(3e4)
+  });
+  return { status: res.status, json: await res.json().catch(() => null) };
+};
+var PRO_ONLY = "needs a paid Supabase plan (Pro or higher)";
+var authConfig = (ctx) => ctx.get(`/v1/projects/${ctx.ref}/config/auth`);
+async function patchAuth(ctx, body) {
+  const r = await ctx.api("PATCH", `/v1/projects/${ctx.ref}/config/auth`, body);
+  if (r.status >= 200 && r.status < 300) return { ok: true };
+  return { ok: false, unavailable: /plan|pro\b|upgrade|paid/i.test(JSON.stringify(r.json ?? "")) ? PRO_ONLY : void 0 };
+}
+var authFlag = (check2) => async (ctx) => check2(await authConfig(ctx) ?? {}) ? { state: "on" } : { state: "off" };
+async function advisorProblems(ctx) {
+  const lints = (await ctx.get(`/v1/projects/${ctx.ref}/advisors/security`))?.lints ?? [];
+  return lints.filter((l) => l.level === "ERROR" || l.level === "WARN");
+}
+var supabase = {
+  id: "supabase",
+  name: "Supabase",
+  actionId: "supabase-security",
+  detect: (scan) => scan.stack.services.includes("Supabase"),
+  async connect(root, fake) {
+    let api = fake;
+    if (!api) {
+      const token = await supabaseToken();
+      if (!token)
+        return {
+          ok: false,
+          problem: "Aura couldn\u2019t find your Supabase login. Install the Supabase CLI and run `supabase login`, then try again.",
+          errorType: "CliNotSignedIn"
+        };
+      api = realApi(token);
+    }
+    const refFile = path3.join(root, "supabase", ".temp", "project-ref");
+    const ref = process.env.SUPABASE_PROJECT_ID || (existsSync2(refFile) ? readFileSync2(refFile, "utf8").trim() : "");
+    if (!/^[a-z]{20}$/.test(ref))
+      return { ok: false, problem: "This folder isn\u2019t linked to a Supabase project yet. Run `supabase link`, then try again.", errorType: "NoProject" };
+    const cache = /* @__PURE__ */ new Map();
+    const call = api;
+    const ctx = {
+      ref,
+      api: call,
+      get: (endpoint) => {
+        if (!cache.has(endpoint))
+          cache.set(
+            endpoint,
+            call("GET", endpoint).then((r) => r.status === 200 ? r.json : null)
+          );
+        return cache.get(endpoint);
+      }
+    };
+    const project = await ctx.get(`/v1/projects/${ref}`);
+    if (!project?.name) return { ok: false, problem: `Couldn\u2019t read the Supabase project ${ref}. Check your account can open it.`, errorType: "NoProject" };
+    return { ok: true, ctx, target: project.name };
+  },
+  settings: [
+    {
+      id: "email-confirmation",
+      label: "Email confirmation (new users confirm their email before signing in)",
+      impact: "New users must click a link in an email before they can sign in. People already signed up aren\u2019t affected.",
+      read: authFlag((c) => c.mailer_autoconfirm === false),
+      enable: (ctx) => patchAuth(ctx, { mailer_autoconfirm: false })
+    },
+    {
+      id: "password-length",
+      label: "Passwords of at least 8 characters",
+      impact: "New and changed passwords must be at least 8 characters. Existing passwords keep working.",
+      read: authFlag((c) => (c.password_min_length ?? 0) >= 8),
+      enable: (ctx) => patchAuth(ctx, { password_min_length: 8 })
+    },
+    {
+      id: "leaked-passwords",
+      label: "Leaked password protection (refuses passwords found in data breaches)",
+      impact: "Passwords that appear in known data breaches are refused when someone signs up or changes their password.",
+      read: authFlag((c) => c.password_hibp_enabled === true),
+      enable: (ctx) => patchAuth(ctx, { password_hibp_enabled: true })
+    },
+    {
+      id: "app-mfa",
+      label: "Authenticator app sign-in for your users (two-factor, optional for them)",
+      impact: "Your users can protect their account with an authenticator app. It stays optional, and your app needs a screen for it before anyone can use it.",
+      read: authFlag((c) => c.mfa_totp_enroll_enabled === true && c.mfa_totp_verify_enabled === true),
+      enable: (ctx) => patchAuth(ctx, { mfa_totp_enroll_enabled: true, mfa_totp_verify_enabled: true })
+    },
+    {
+      id: "secure-email-change",
+      label: "Secure email change (both the old and new address confirm)",
+      impact: "Changing an account\u2019s email needs confirming from both the old and the new address, so a stolen session can\u2019t take over the account.",
+      read: authFlag((c) => c.mailer_secure_email_change_enabled === true),
+      enable: (ctx) => patchAuth(ctx, { mailer_secure_email_change_enabled: true })
+    },
+    {
+      id: "database-encryption",
+      label: "Encrypted database connections only",
+      impact: "Direct connections to your database must be encrypted. Turning this on restarts the database for a few seconds.",
+      read: async (ctx) => (await ctx.get(`/v1/projects/${ctx.ref}/ssl-enforcement`))?.currentConfig?.database === true ? { state: "on" } : { state: "off" },
+      async enable(ctx) {
+        const r = await ctx.api("PUT", `/v1/projects/${ctx.ref}/ssl-enforcement`, { requestedConfig: { database: true } });
+        return r.status >= 200 && r.status < 300 ? { ok: true } : { ok: false };
+      }
+    },
+    {
+      id: "security-advisor",
+      label: "No problems in Supabase\u2019s security advisor",
+      impact: "Nothing changes on its own: these are fixed in your database code, and Aura lists them below.",
+      read: async (ctx) => (await advisorProblems(ctx)).length ? { state: "off" } : { state: "on" },
+      enable: async () => ({ ok: false, unavailable: "fixed in your database code (see Left for you)" })
+    }
+  ],
+  async leftForYou(ctx, results) {
+    const left = [];
+    const problems = await advisorProblems(ctx);
+    if (problems.length) {
+      const titles = [...new Set(problems.map((p2) => p2.title ?? p2.name ?? "Security problem"))].slice(0, 5);
+      left.push(
+        `Supabase\u2019s security advisor found ${problems.length} problem(s): ${titles.join("; ")}. Fix them in a migration (\`aura fix turn-on-rls\` covers missing row-level security), or see https://supabase.com/dashboard/project/${ctx.ref}/advisors/security`
+      );
+    }
+    if (results.some((r) => r.id === "leaked-passwords" && r.result === "unavailable"))
+      left.push("Leaked password protection needs Supabase Pro. Until then, the 8-character minimum helps.");
+    left.push("Turn on two-factor login for your Supabase account: Supabase dashboard \u2192 Account \u2192 Security.");
+    return left;
+  }
+};
+
+// src/connectors/vercel.ts
+import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
+import path4 from "path";
+var PUBLIC_PREFIX = /^(?:NEXT_PUBLIC_|VITE_|EXPO_PUBLIC_|PUBLIC_)/;
+var SECRET_NAME = /SECRET|SERVICE_ROLE|PRIVATE|PASSWORD|_TOKEN$|API_KEY$/;
+var parse4 = (r) => {
+  try {
+    return r.code === 0 ? JSON.parse(r.stdout) : null;
+  } catch {
+    return null;
+  }
+};
+async function exposedSecrets(ctx) {
+  const envs = (await ctx.get(`/v10/projects/${ctx.projectId}/env?decrypt=true${ctx.team.replace("?", "&")}`))?.envs ?? [];
+  return [...new Set(envs.filter((e) => PUBLIC_PREFIX.test(e.key) && (SECRET_NAME.test(e.key) || e.value && containsSecret(e.value))).map((e) => e.key))];
+}
+async function patchProject(ctx, body) {
+  const r = await ctx.vercel(["api", `/v9/projects/${ctx.projectId}${ctx.team}`, "-X", "PATCH", "--input", "-", "--raw"], JSON.stringify(body));
+  if (r.code === 0) return { ok: true };
+  return { ok: false, unavailable: /plan|upgrade|pro\b|enterprise/i.test(r.stderr + r.stdout) ? "not available on your Vercel plan" : void 0 };
+}
+var vercel = {
+  id: "vercel",
+  name: "Vercel",
+  actionId: "vercel-security",
+  detect: (scan) => scan.stack.services.includes("Vercel"),
+  async connect(root, fake) {
+    const cli = fake ?? ((args, input2) => run("vercel", args, { cwd: root, input: input2, timeoutMs: 6e4 }));
+    if (!fake) {
+      if (!await commandExists("vercel"))
+        return {
+          ok: false,
+          problem: "The Vercel CLI isn\u2019t installed. Install it with `npm install -g vercel`, then run `vercel login`.",
+          errorType: "CliNotInstalled"
+        };
+      if ((await cli(["whoami"])).code !== 0)
+        return { ok: false, problem: "The Vercel CLI isn\u2019t signed in. Run `vercel login`, then try again.", errorType: "CliNotSignedIn" };
+    }
+    const linked = [path4.join(root, ".vercel", "project.json"), ...["apps", "packages"].flatMap((d) => findLinks(path4.join(root, d)))].find(
+      (f) => existsSync3(f)
+    );
+    let project = null;
+    try {
+      project = linked ? JSON.parse(readFileSync3(linked, "utf8")) : null;
+    } catch {
+      project = null;
+    }
+    if (!project?.projectId)
+      return { ok: false, problem: "This folder isn\u2019t linked to a Vercel project yet. Run `vercel link`, then try again.", errorType: "NoProject" };
+    const cache = /* @__PURE__ */ new Map();
+    const ctx = {
+      projectId: project.projectId,
+      team: project.orgId?.startsWith("team_") ? `?teamId=${project.orgId}` : "",
+      vercel: cli,
+      get: (endpoint) => {
+        if (!cache.has(endpoint)) cache.set(endpoint, cli(["api", endpoint, "--raw"]).then(parse4));
+        return cache.get(endpoint);
+      }
+    };
+    const name = (await ctx.get(`/v9/projects/${ctx.projectId}${ctx.team}`))?.name;
+    if (!name)
+      return { ok: false, problem: "Couldn\u2019t read this project from Vercel. Check you have access to it with `vercel project ls`.", errorType: "NoProject" };
+    return { ok: true, ctx, target: name };
+  },
+  settings: [
+    {
+      id: "preview-protection",
+      label: "Protect preview links (only your Vercel team can open them)",
+      impact: "Preview and deployment links need a Vercel login to open. Your live site on your own domain stays public.",
+      read: async (ctx) => (await ctx.get(`/v9/projects/${ctx.projectId}${ctx.team}`))?.ssoProtection ? { state: "on" } : { state: "off" },
+      enable: (ctx) => patchProject(ctx, { ssoProtection: { deploymentType: "all_except_custom_domains" } })
+    },
+    {
+      id: "git-fork-protection",
+      label: "Fork protection (pull requests from forks don\u2019t deploy automatically)",
+      impact: "A pull request from someone else\u2019s copy of your repo only deploys after you approve it, so it can\u2019t read your settings.",
+      read: async (ctx) => (await ctx.get(`/v9/projects/${ctx.projectId}${ctx.team}`))?.gitForkProtection ? { state: "on" } : { state: "off" },
+      enable: (ctx) => patchProject(ctx, { gitForkProtection: true })
+    },
+    {
+      id: "protected-sourcemaps",
+      label: "Protected source maps (your original code isn\u2019t served to the public)",
+      impact: "Source maps, which reveal your original code, are only served to people signed in to your Vercel team.",
+      read: async (ctx) => (await ctx.get(`/v9/projects/${ctx.projectId}${ctx.team}`))?.protectedSourcemaps ? { state: "on" } : { state: "off" },
+      enable: (ctx) => patchProject(ctx, { protectedSourcemaps: true })
+    },
+    {
+      id: "no-public-secrets",
+      label: "No secret keys in browser-visible settings (NEXT_PUBLIC_\u2026 and similar)",
+      impact: "Nothing changes on its own: Aura can\u2019t move a key for you, and lists what to do below.",
+      read: async (ctx) => (await exposedSecrets(ctx)).length ? { state: "off" } : { state: "on" },
+      enable: async () => ({ ok: false, unavailable: "needs you to move the key (see Left for you)" })
+    }
+  ],
+  async leftForYou(ctx) {
+    const left = [];
+    const exposed = await exposedSecrets(ctx);
+    if (exposed.length)
+      left.push(
+        `These settings are visible to anyone using your site: ${exposed.join(", ")}. Rename each without the public prefix, read it only in server code, then rotate the key in its dashboard (\`aura guide rotate-generic-key\`).`
+      );
+    left.push("Turn on two-factor login for your Vercel account: Vercel \u2192 Account Settings \u2192 Authentication.");
+    return left;
+  }
+};
+function findLinks(dir) {
+  try {
+    return readdirSync2(dir).map((d) => path4.join(dir, d, ".vercel", "project.json"));
+  } catch {
+    return [];
+  }
+}
+
+// src/connectors/index.ts
+var CONNECTORS = [github, supabase, vercel];
+function connectorForAction(actionId) {
+  return CONNECTORS.find((c) => c.actionId === actionId);
+}
+
+// src/templates.ts
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+import path7 from "path";
+
 // src/core/config.ts
+import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
+import os2 from "os";
+import path5 from "path";
 var DEFAULT_CONFIG = {
   version: 1,
   agents: [],
@@ -20149,45 +20745,45 @@ var DEFAULT_CONFIG = {
   ciMaxDrop: 0
 };
 function auraPath(root, ...parts) {
-  return path2.join(root, AURA_DIR, ...parts);
+  return path5.join(root, AURA_DIR, ...parts);
 }
 function ensureAuraDir(root) {
-  mkdirSync(auraPath(root), { recursive: true });
+  mkdirSync2(auraPath(root), { recursive: true });
 }
 function loadConfig(root) {
   const file2 = auraPath(root, "config.json");
-  if (!existsSync2(file2)) return { ...DEFAULT_CONFIG };
+  if (!existsSync4(file2)) return { ...DEFAULT_CONFIG };
   try {
-    return { ...DEFAULT_CONFIG, ...JSON.parse(readFileSync2(file2, "utf8")) };
+    return { ...DEFAULT_CONFIG, ...JSON.parse(readFileSync4(file2, "utf8")) };
   } catch {
     return { ...DEFAULT_CONFIG };
   }
 }
 function saveConfig(root, config2) {
   ensureAuraDir(root);
-  writeFileSync(auraPath(root, "config.json"), JSON.stringify(config2, null, 2) + "\n");
+  writeFileSync2(auraPath(root, "config.json"), JSON.stringify(config2, null, 2) + "\n");
 }
 function writeAuraFile(root, name, content) {
   ensureAuraDir(root);
   const file2 = auraPath(root, name);
-  mkdirSync(path2.dirname(file2), { recursive: true });
-  writeFileSync(file2, content);
+  mkdirSync2(path5.dirname(file2), { recursive: true });
+  writeFileSync2(file2, content);
   return file2;
 }
-var homeAuraDir = () => path2.join(os.homedir(), ".aura");
-var credentialsFile = () => path2.join(homeAuraDir(), "credentials.json");
+var homeAuraDir = () => path5.join(os2.homedir(), ".aura");
+var credentialsFile = () => path5.join(homeAuraDir(), "credentials.json");
 function getApiKey() {
   if (process.env.AURA_KEY) return process.env.AURA_KEY.trim();
   try {
-    const data = JSON.parse(readFileSync2(credentialsFile(), "utf8"));
+    const data = JSON.parse(readFileSync4(credentialsFile(), "utf8"));
     return typeof data.key === "string" ? data.key : null;
   } catch {
     return null;
   }
 }
 function saveApiKey(key) {
-  mkdirSync(homeAuraDir(), { recursive: true });
-  writeFileSync(credentialsFile(), JSON.stringify({ key }, null, 2) + "\n", { mode: 384 });
+  mkdirSync2(homeAuraDir(), { recursive: true });
+  writeFileSync2(credentialsFile(), JSON.stringify({ key }, null, 2) + "\n", { mode: 384 });
   try {
     chmodSync(credentialsFile(), 384);
   } catch {
@@ -20197,26 +20793,27 @@ function getApiUrl(config2) {
   return (process.env.AURA_API_URL || config2?.apiUrl || DEFAULT_API_URL).replace(/\/$/, "");
 }
 function auraBinDir() {
-  return path2.join(homeAuraDir(), "bin");
+  return path5.join(homeAuraDir(), "bin");
 }
 var AURA_GITIGNORE = `# Aura local files: they can describe security weaknesses, so they stay on your machine.
 report.md
 scan.json
 history.json
+fixes.json
 cache/
 tasks/
 `;
 function ensureGitignore(root) {
   const file2 = auraPath(root, ".gitignore");
-  if (existsSync2(file2) && readFileSync2(file2, "utf8") === AURA_GITIGNORE) return false;
+  if (existsSync4(file2) && readFileSync4(file2, "utf8") === AURA_GITIGNORE) return false;
   ensureAuraDir(root);
-  writeFileSync(file2, AURA_GITIGNORE);
+  writeFileSync2(file2, AURA_GITIGNORE);
   return true;
 }
 
 // src/core/stack.ts
-import { existsSync as existsSync3 } from "fs";
-import path3 from "path";
+import { existsSync as existsSync5 } from "fs";
+import path6 from "path";
 function allDeps(pkg) {
   return { ...pkg?.dependencies ?? {}, ...pkg?.devDependencies ?? {} };
 }
@@ -20267,6 +20864,12 @@ var ENV_SERVICES = [
   [/^SLACK_/, "Slack"]
 ];
 var BUILTIN_ENV = /* @__PURE__ */ new Set([
+  "USERPROFILE",
+  "APPDATA",
+  "LOCALAPPDATA",
+  "SYSTEMROOT",
+  "COMSPEC",
+  "PROGRAMFILES",
   "NODE_ENV",
   "CI",
   "PORT",
@@ -20288,7 +20891,7 @@ var BUILTIN_ENV = /* @__PURE__ */ new Set([
   "TMPDIR",
   "HOSTNAME"
 ]);
-var ENV_REF = /process\.env\.([A-Z][A-Z0-9_]*)|process\.env\[\s*['"]([A-Z][A-Z0-9_]*)['"]\s*\]|import\.meta\.env\.([A-Z][A-Z0-9_]*)|Deno\.env\.get\(\s*['"]([A-Z][A-Z0-9_]*)['"]\s*\)/g;
+var ENV_REF = /process\.env\.([A-Za-z_][A-Za-z0-9_]*)|process\.env\[\s*['"]([A-Za-z_][A-Za-z0-9_]*)['"]\s*\]|import\.meta\.env\.([A-Za-z_][A-Za-z0-9_]*)|Deno\.env\.get\(\s*['"]([A-Za-z_][A-Za-z0-9_]*)['"]\s*\)/g;
 function serviceForEnv(name) {
   return ENV_SERVICES.find(([re]) => re.test(name))?.[1];
 }
@@ -20320,7 +20923,7 @@ function findEnvRefs(files, read2) {
     if (!text) continue;
     for (const m of text.matchAll(ENV_REF)) {
       const name = m[1] ?? m[2] ?? m[3] ?? m[4];
-      if (!name || BUILTIN_ENV.has(name) || inStringLiteral(text, m.index)) continue;
+      if (!name || /[a-z]/.test(name) || BUILTIN_ENV.has(name) || inStringLiteral(text, m.index)) continue;
       if (!map2.has(name)) map2.set(name, /* @__PURE__ */ new Set());
       map2.get(name).add(f);
     }
@@ -20334,7 +20937,7 @@ function findEnvRefs(files, read2) {
 }
 function detectStack(root, files, pkg, read2) {
   const deps2 = allDeps(pkg);
-  const has = (f) => files.includes(f) || existsSync3(path3.join(root, f));
+  const has = (f) => files.includes(f) || existsSync5(path6.join(root, f));
   const hasDir = (d) => files.some((f) => f.startsWith(`${d}/`));
   let packageManager = null;
   const pmField = pkg?.packageManager?.split("@")[0];
@@ -20359,6 +20962,7 @@ function detectStack(root, files, pkg, read2) {
   }
   if (has("vercel.json") || has(".vercel/project.json")) services.add("Vercel");
   if (hasDir("supabase")) services.add("Supabase");
+  if (has("vercel.json") || has(".vercel/project.json")) services.add("Vercel");
   services.add("GitHub");
   let nextjs = null;
   if (deps2.next) {
@@ -20368,9 +20972,9 @@ function detectStack(root, files, pkg, read2) {
     const pages = hasDir(`${base}pages`);
     nextjs = { version: deps2.next.replace(/^[^\d]*/, ""), router: app && pages ? "both" : app ? "app" : pages ? "pages" : null, srcDir };
   }
-  let supabase = null;
+  let supabase2 = null;
   if (services.has("Supabase")) {
-    supabase = { migrationsDir: hasDir("supabase/migrations") ? "supabase/migrations" : null, hasConfig: has("supabase/config.toml") };
+    supabase2 = { migrationsDir: hasDir("supabase/migrations") ? "supabase/migrations" : null, hasConfig: has("supabase/config.toml") };
   }
   let testRunner = null;
   if (deps2.vitest || files.some((f) => /^vitest\.config\./.test(f))) testRunner = "vitest";
@@ -20385,7 +20989,7 @@ function detectStack(root, files, pkg, read2) {
     frameworks,
     services: [...services].sort(),
     nextjs,
-    supabase,
+    supabase: supabase2,
     typescript: has("tsconfig.json"),
     testRunner,
     envVars,
@@ -20429,7 +21033,7 @@ function pmCommands(pm) {
 // package.json
 var package_default = {
   name: "getaura",
-  version: "0.1.6",
+  version: "0.1.8",
   description: "Aura helps you and your coding agent follow best practices while you vibe code.",
   type: "module",
   bin: {
@@ -20438,7 +21042,9 @@ var package_default = {
   files: [
     "dist",
     "templates",
-    "README.md"
+    "README.md",
+    ".claude-plugin",
+    "plugin"
   ],
   engines: {
     node: ">=22"
@@ -20508,19 +21114,19 @@ function fill(text, vars) {
   return text.replace(/\{\{([a-z_]+)\}\}/g, (m, name) => KNOWN.has(name) ? vars[name] ?? "" : m);
 }
 function readTemplate(rel) {
-  return readFileSync3(path4.join(templatesDir(), rel), "utf8");
+  return readFileSync5(path7.join(templatesDir(), rel), "utf8");
 }
 function render(rel, vars) {
   return fill(readTemplate(rel), vars);
 }
 function templateExists(rel) {
-  return existsSync4(path4.join(templatesDir(), rel));
+  return existsSync6(path7.join(templatesDir(), rel));
 }
 function briefSummary(root, pkg) {
-  const fallbackName = pkg?.name ? pkg.name.replace(/[-_]/g, " ").replace(/\b\w/g, (c) => c.toUpperCase()) : path4.basename(root);
+  const fallbackName = pkg?.name ? pkg.name.replace(/[-_]/g, " ").replace(/\b\w/g, (c) => c.toUpperCase()) : path7.basename(root);
   const file2 = auraPath(root, "brief.md");
-  if (!existsSync4(file2)) return { name: fallbackName, summary: pkg?.description ?? "See `.aura/brief.md` once the product brief is added." };
-  const text = readFileSync3(file2, "utf8");
+  if (!existsSync6(file2)) return { name: fallbackName, summary: pkg?.description ?? "See `.aura/brief.md` once the product brief is added." };
+  const text = readFileSync5(file2, "utf8");
   const title = text.match(/^#\s+(.+)$/m)?.[1]?.replace(/[:\-–—]?\s*product brief$/i, "").trim();
   const paragraph = text.split(/\n\s*\n/).map((p2) => p2.trim()).find((p2) => p2 && !p2.startsWith("#") && !p2.startsWith(">") && !p2.startsWith("-") && !p2.startsWith("|") && p2.length > 40) ?? "";
   const sentences = paragraph.replace(/\s+/g, " ").match(/[^.!?]+[.!?]+/g) ?? [paragraph];
@@ -20553,7 +21159,7 @@ function templateVars(root, scan, pkg, extra = {}) {
     scriptLine(pkg, cmds.run, "lint", "lint the code"),
     scriptLine(pkg, cmds.run, "typecheck", "check types") ?? (scan.stack.typescript ? `- \`${cmds.exec} tsc --noEmit\`: check types` : null),
     scriptLine(pkg, cmds.run, "build", "production build"),
-    "- `aura scan`: check the Aura score"
+    "- `aura scan`: check the Aura score (coding agents: `aura scan --json`, which never waits for input)"
   ].filter(Boolean);
   const nodeMajor = pkg?.engines?.node?.match(/(\d{2})/)?.[1];
   return {
@@ -20685,7 +21291,6 @@ var ACTIONS = [
   },
   // Accounts and ownership
   { id: "inventory", title: "Complete the keys and accounts inventory", category: "security", delivery: "checklist", resolves: [] },
-  { id: "github-security", title: "Enable GitHub security features", category: "security", delivery: "guide", resolves: [] },
   { id: "transfer-ownership", title: "Move accounts to a company owner", category: "security", delivery: "guide", resolves: [] }
 ];
 var FOUNDATION_BUNDLE = ["add-brief", "add-agent-rules", "install-skills", "token-efficiency", "add-ci", "add-env-example", "add-aura-workflow"];
@@ -20700,6 +21305,15 @@ function getAction(id) {
     };
   }
   if (/^rotate-[a-z]+-(?:key|token)$/.test(id)) return { id, title: "Rotate an exposed key", category: "security", delivery: "guide", resolves: [] };
+  const connector = connectorForAction(id);
+  if (connector)
+    return {
+      id,
+      title: `Turn on ${connector.name} security features`,
+      category: "security",
+      delivery: "guide",
+      resolves: [`security.${connector.id}-settings`]
+    };
   return ACTIONS.find((a) => a.id === id);
 }
 var CATEGORY_PRIORITY = ["security", "agent-setup", "foundations", "structure"];
@@ -20735,15 +21349,16 @@ function nextSteps(scan, opts = {}) {
     if (!action2) continue;
     const { delivery, fellBack } = effectiveDelivery(action2, scan);
     const worst = fs.map((f) => f.severity).sort((a, b) => SEVERITY_ORDER.indexOf(a) - SEVERITY_ORDER.indexOf(b))[0];
+    const connected = Boolean(connectorForAction(actionId));
     steps.push({
       actionId,
       title: action2.title,
       delivery,
-      effort: EFFORT[delivery],
+      effort: connected ? "one-click" : EFFORT[delivery],
       category: action2.category,
       why: fs[0].why,
       impact: impactOf(scan.checks, action2.resolves),
-      command: commandFor(actionId, delivery),
+      command: connected ? `aura apply ${actionId}` : commandFor(actionId, delivery),
       findingIds: fs.map((f) => f.id),
       fellBack,
       severity: worst
@@ -20768,16 +21383,16 @@ function nextSteps(scan, opts = {}) {
       severity: "critical"
     });
   }
-  if (opts.accounts && !opts.accounts.githubSecurity) {
+  for (const connector of opts.accounts ? CONNECTORS.filter((c) => c.detect(scan) && !opts.accounts.secured[c.id] && !steps.some((s) => s.actionId === c.actionId)) : []) {
     steps.push({
-      actionId: "github-security",
-      title: "Enable GitHub security features",
+      actionId: connector.actionId,
+      title: `Turn on ${connector.name} security features`,
       delivery: "guide",
-      effort: "follow-guide",
+      effort: "one-click",
       category: "security",
-      why: "Branch protection and secret scanning stop mistakes (and leaked keys) before they reach your main branch.",
+      why: `Aura checks ${connector.name}\u2019s security settings and, once you agree, turns on the ones that are off.`,
       impact: 0,
-      command: "aura guide github-security",
+      command: `aura apply ${connector.actionId}`,
       findingIds: [],
       severity: "low"
     });
@@ -20826,12 +21441,12 @@ function nextSteps(scan, opts = {}) {
 }
 
 // src/actions/generators.ts
-import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
-import path8 from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
+import path12 from "path";
 
 // src/checks/agent-setup.ts
-import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
-import path5 from "path";
+import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync6 } from "fs";
+import path8 from "path";
 
 // src/checks/types.ts
 import { createHash } from "crypto";
@@ -20865,38 +21480,35 @@ function lineOf(text, index) {
 
 // src/checks/agent-setup.ts
 function exists(ctx, file2) {
-  return existsSync5(path5.join(ctx.root, file2));
+  return existsSync7(path8.join(ctx.root, file2));
 }
 function readDisk(ctx, file2) {
   try {
-    return readFileSync4(path5.join(ctx.root, file2), "utf8");
+    return readFileSync6(path8.join(ctx.root, file2), "utf8");
   } catch {
     return "";
   }
 }
 function skillsIn(ctx, dir) {
   try {
-    return readdirSync2(path5.join(ctx.root, dir), { withFileTypes: true }).filter((d) => d.isDirectory() && existsSync5(path5.join(ctx.root, dir, d.name, "SKILL.md"))).map((d) => d.name);
+    return readdirSync3(path8.join(ctx.root, dir), { withFileTypes: true }).filter((d) => d.isDirectory() && existsSync7(path8.join(ctx.root, dir, d.name, "SKILL.md"))).map((d) => d.name);
   } catch {
     return [];
   }
 }
 function targetAgents(ctx) {
   if (ctx.config.agents.length) return ctx.config.agents;
-  const seen = [];
-  if (exists(ctx, "CLAUDE.md") || exists(ctx, ".claude")) seen.push("claude");
-  if (exists(ctx, "AGENTS.md")) seen.push("codex");
-  if (exists(ctx, ".cursor") || exists(ctx, ".cursorrules")) seen.push("cursor");
-  if (exists(ctx, ".pi")) seen.push("pi");
-  return seen;
+  return detectAgentsFrom((rel) => exists(ctx, rel));
 }
 function rulesFileFor(ctx, agent) {
   const preferred = AGENT_LAYOUT[agent].rulesFile;
   if (exists(ctx, preferred)) return preferred;
+  if (agent === "claude" && exists(ctx, ".claude/CLAUDE.md")) return ".claude/CLAUDE.md";
+  if (agent === "pi" && exists(ctx, "CLAUDE.md")) return "CLAUDE.md";
   if (agent === "cursor") {
     if (exists(ctx, ".cursorrules")) return ".cursorrules";
     try {
-      const rules = readdirSync2(path5.join(ctx.root, ".cursor/rules")).filter((f) => /\.mdc?$/.test(f));
+      const rules = readdirSync3(path8.join(ctx.root, ".cursor/rules")).filter((f) => /\.mdc?$/.test(f));
       if (rules.length) return `.cursor/rules/${rules[0]}`;
     } catch {
     }
@@ -20973,7 +21585,7 @@ var skills = {
     const agents = targetAgents(ctx);
     const dirs = agents.length ? uniqueSkillDirs(agents) : ALL_SKILLS_DIRS;
     const starterNames = new Set(STARTER_SKILLS.map((s) => s.name));
-    const perDir = dirs.map((d) => ({ dir: d, skills: skillsIn(ctx, d).filter((s) => s !== "aura") }));
+    const perDir = dirs.map((d) => ({ dir: d, skills: skillsIn(ctx, d).filter((s) => s !== "aura" && !s.startsWith("aura-")) }));
     const best = Math.max(0, ...perDir.map((p2) => p2.skills.length));
     const weakest = agents.length ? Math.min(...perDir.map((p2) => p2.skills.length)) : best;
     if (weakest >= 3) return { status: "pass", summary: `${weakest}+ skills installed.` };
@@ -21023,13 +21635,13 @@ var brief = {
   weight: 5,
   run(ctx) {
     const file2 = BRIEF_PATHS.find((f) => exists(ctx, f));
-    const words = file2 ? readDisk(ctx, file2).split(/\s+/).filter(Boolean).length : 0;
+    const words2 = file2 ? readDisk(ctx, file2).split(/\s+/).filter(Boolean).length : 0;
     const committed = file2 && ctx.tracked ? ctx.tracked.has(file2) : true;
-    if (file2 && words >= 80 && committed) return { status: "pass", summary: `${file2} (${words} words).` };
+    if (file2 && words2 >= 80 && committed) return { status: "pass", summary: `${file2} (${words2} words).` };
     const finding = makeFinding(this, {
       severity: "medium",
       title: !file2 ? "No product brief" : !committed ? "Product brief isn\u2019t committed" : "Product brief is too short",
-      detail: !file2 ? "There is no product brief describing what the app does, who it\u2019s for and what data it handles." : !committed ? `${file2} exists on your machine but isn\u2019t committed, so your agent in other sessions and other people can\u2019t see it.` : `${file2} has only ${words} words.`,
+      detail: !file2 ? "There is no product brief describing what the app does, who it\u2019s for and what data it handles." : !committed ? `${file2} exists on your machine but isn\u2019t committed, so your agent in other sessions and other people can\u2019t see it.` : `${file2} has only ${words2} words.`,
       why: "The brief grounds every agent session in what you\u2019re actually building, and becomes page one of any handoff to engineers.",
       locations: file2 ? [{ file: file2 }] : [],
       actionId: "add-brief",
@@ -21041,7 +21653,7 @@ var brief = {
 var agentChecks = [rulesFile, rulesCurrent, skills, auraSkill, brief];
 
 // src/core/graph.ts
-import path6 from "path";
+import path9 from "path";
 var EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".mts", ".cts"];
 var IMPORT_RE = /(?:import|export)\s+(?:type\s+)?(?:[\w*{}\s,$]+?\s+from\s+)?(['"])([^'"\n]+)\1|import\s*\(\s*(['"])([^'"\n]+)\3\s*\)|require\s*\(\s*(['"])([^'"\n]+)\5\s*\)/g;
 function parseImports(text) {
@@ -21069,7 +21681,7 @@ function readAliases(read2) {
       for (const [key, targets] of Object.entries(json2.compilerOptions?.paths ?? {})) {
         const target = targets[0];
         if (!key.endsWith("/*") || !target?.endsWith("/*")) continue;
-        const resolved = path6.posix.normalize(path6.posix.join(base || ".", target.slice(0, -1)));
+        const resolved = path9.posix.normalize(path9.posix.join(base || ".", target.slice(0, -1)));
         entries.push([key.slice(0, -1), resolved === "." || resolved === "./" ? "" : resolved.replace(/\/?$/, "/")]);
       }
     } catch {
@@ -21080,10 +21692,10 @@ function readAliases(read2) {
 }
 function resolveImport(from, spec, files, aliases) {
   let base = null;
-  if (spec.startsWith(".")) base = path6.posix.normalize(path6.posix.join(path6.posix.dirname(from), spec));
+  if (spec.startsWith(".")) base = path9.posix.normalize(path9.posix.join(path9.posix.dirname(from), spec));
   else {
     const alias = aliases.entries.find(([prefix]) => spec.startsWith(prefix));
-    if (alias) base = path6.posix.normalize(alias[1] + spec.slice(alias[0].length));
+    if (alias) base = path9.posix.normalize(alias[1] + spec.slice(alias[0].length));
   }
   if (base === null) return null;
   const withoutJs = base.replace(/\.(?:js|jsx|mjs|cjs)$/, "");
@@ -21128,12 +21740,64 @@ function unreachableFiles(files, read2, pkgScripts) {
   return source.filter((f) => !seen.has(f));
 }
 
+// src/actions/agent-commands.ts
+import { readFileSync as readFileSync7 } from "fs";
+import path10 from "path";
+var AURA_COMMANDS = ["scan", "next", "fix", "setup"];
+function invocation(agent, command) {
+  return agent === "claude" ? `/aura:${command}` : agent === "codex" ? `$aura-${command}` : `/aura-${command}`;
+}
+function pluginCommand(command) {
+  const text = readFileSync7(path10.join(path10.dirname(templatesDir()), "plugin", "skills", command, "SKILL.md"), "utf8").replace(/\r\n/g, "\n");
+  const [, frontmatter = "", body = ""] = text.match(/^---\n([\s\S]*?)\n---\n+([\s\S]*)$/) ?? [];
+  const description = frontmatter.match(/^description: (.+)$/m)?.[1] ?? "";
+  return { description, body };
+}
+function adapt(agent, body) {
+  const args = agent === "pi" ? "Fix: $@\n\n" : "Fix the action or finding the user named after the command, if any.\n\n";
+  return body.replace(/\/aura:(scan|next|fix|setup)\b/g, (_, c) => invocation(agent, c)).replace("Fix: $ARGUMENTS\n\n", args).replace("--agent claude", `--agent ${agent}`);
+}
+function commandChanges(agents) {
+  const changes = [];
+  for (const agent of new Set(agents)) {
+    for (const command of AURA_COMMANDS) {
+      const { description, body } = pluginCommand(command);
+      const text = adapt(agent, body);
+      if (agent === "cursor") changes.push({ path: `.cursor/commands/aura-${command}.md`, content: `# Aura: ${description}
+
+${text}` });
+      if (agent === "pi") changes.push({ path: `.pi/prompts/aura-${command}.md`, content: `---
+description: ${description}
+---
+
+${text}` });
+      if (agent === "codex") {
+        const dir = `.agents/skills/aura-${command}`;
+        changes.push({
+          path: `${dir}/SKILL.md`,
+          content: `---
+name: aura-${command}
+description: ${description} Only when the user runs ${invocation(agent, command)}.
+---
+
+${text}`
+        });
+        changes.push({ path: `${dir}/agents/openai.yaml`, content: "policy:\n  allow_implicit_invocation: false\n" });
+      }
+    }
+  }
+  return changes;
+}
+function commandList(agent) {
+  return AURA_COMMANDS.map((c) => invocation(agent, c)).join(", ");
+}
+
 // src/actions/agent-files.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
-import path7 from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
+import path11 from "path";
 function current(root, file2) {
-  const full = path7.join(root, file2);
-  return existsSync6(full) ? readFileSync5(full, "utf8") : null;
+  const full = path11.join(root, file2);
+  return existsSync8(full) ? readFileSync8(full, "utf8") : null;
 }
 function upsertBlock(existing, body) {
   const block = `${AURA_BLOCK_START}
@@ -21177,8 +21841,8 @@ function skillChanges(agents, names) {
 
 // src/actions/generators.ts
 function read(root, file2) {
-  const full = path8.join(root, file2);
-  return existsSync7(full) ? readFileSync6(full, "utf8") : null;
+  const full = path12.join(root, file2);
+  return existsSync9(full) ? readFileSync9(full, "utf8") : null;
 }
 function withScripts(root, scripts, overwrite = false) {
   const text = read(root, "package.json");
@@ -21199,13 +21863,13 @@ function findingMeta(scan, checkId, key) {
   return scan.checks.find((c) => c.checkId === checkId)?.findings[0]?.meta?.[key];
 }
 var addBrief = ({ root }) => {
-  const brief2 = BRIEF_PATHS.find((f) => existsSync7(path8.join(root, f)));
+  const brief2 = BRIEF_PATHS.find((f) => existsSync9(path12.join(root, f)));
   if (!brief2) return { skip: "There is no product brief yet. Run `aura init` to draft and confirm it first." };
   const changes = [
     { path: brief2, content: read(root, brief2) },
     { path: ".aura/.gitignore", content: AURA_GITIGNORE }
   ];
-  if (existsSync7(auraPath(root, "config.json"))) changes.push({ path: ".aura/config.json", content: read(root, ".aura/config.json") });
+  if (existsSync9(auraPath(root, "config.json"))) changes.push({ path: ".aura/config.json", content: read(root, ".aura/config.json") });
   return { changes, details: [`- Adds \`${brief2}\`, \`.aura/config.json\` and \`.aura/.gitignore\` (keeps Aura's local reports out of git)`] };
 };
 var addAgentRules = ({ root, agents, vars }) => {
@@ -21214,22 +21878,24 @@ var addAgentRules = ({ root, agents, vars }) => {
 };
 var installSkills = ({ agents, skills: skills2 }) => {
   const names = [.../* @__PURE__ */ new Set([...skills2 ?? STARTER_SKILLS.map((s) => s.name), "aura"])];
-  const changes = skillChanges(agents, names);
   return {
-    changes,
-    details: names.map((n) => `- \`${n}\`: ${STARTER_SKILLS.find((s) => s.name === n)?.description ?? "check the Aura score and fix findings."}`)
+    changes: [...skillChanges(agents, names), ...commandChanges(agents)],
+    details: [
+      ...names.map((n) => `- \`${n}\`: ${STARTER_SKILLS.find((s) => s.name === n)?.description ?? "check the Aura score and fix findings."}`),
+      ...agents.filter((a) => a !== "claude").map((a) => `- Aura's commands for ${AGENT_LABELS[a]}: ${commandList(a)}`)
+    ]
   };
 };
 var tokenEfficiency = (g) => {
   const changes = [];
-  if (!existsSync7(path8.join(g.root, "docs/index.md"))) changes.push({ path: "docs/index.md", content: render("docs/index.md", g.vars) });
+  if (!existsSync9(path12.join(g.root, "docs/index.md"))) changes.push({ path: "docs/index.md", content: render("docs/index.md", g.vars) });
   changes.push(...rulesChanges(g.root, g.agents, g.vars));
   return { changes, details: ["- `docs/index.md`: a map of the repo your agent reads first", "- Lean-context rules in the agent rules file"] };
 };
 var addCi = ({ root, ctx, vars }) => {
   const existing = ctx.files.filter((f) => /^\.github\/workflows\//.test(f));
   const file2 = existing.includes(".github/workflows/ci.yml") ? ".github/workflows/checks.yml" : ".github/workflows/ci.yml";
-  if (existsSync7(path8.join(root, file2))) return { skip: `${file2} already exists.` };
+  if (existsSync9(path12.join(root, file2))) return { skip: `${file2} already exists.` };
   return {
     changes: [{ path: file2, content: render("github/workflows/ci.yml", vars) }],
     details: [`- \`${file2}\`: lint, type check, tests and build on every pull request`]
@@ -21253,7 +21919,7 @@ var setupTesting = ({ root, ctx, vars }) => {
   };
 };
 var addEnvExample = ({ root, scan }) => {
-  const file2 = [".env.example", ".env.sample", ".env.template"].find((f) => existsSync7(path8.join(root, f))) ?? ".env.example";
+  const file2 = [".env.example", ".env.sample", ".env.template"].find((f) => existsSync9(path12.join(root, f))) ?? ".env.example";
   const existing = read(root, file2);
   const declared = new Set(
     (existing ?? "").split(/\r?\n/).map((l) => l.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/)?.[1]).filter(Boolean)
@@ -21310,7 +21976,7 @@ var addLinting = ({ root, ctx }) => {
   return { changes, devDeps, details };
 };
 var addPreCommit = ({ root, ctx, vars }) => {
-  if (existsSync7(path8.join(root, ".husky/pre-commit"))) return { skip: "A husky pre-commit hook already exists." };
+  if (existsSync9(path12.join(root, ".husky/pre-commit"))) return { skip: "A husky pre-commit hook already exists." };
   const changes = [{ path: ".husky/pre-commit", content: render("configs/husky-pre-commit", vars) }];
   const scripts = withScripts(root, { prepare: "husky" }, false);
   if (scripts) changes.push(scripts);
@@ -21325,10 +21991,10 @@ var addReadme = ({ root, ctx, vars }) => {
   const file2 = ctx.files.find((f) => /^readme\.mdx?$/i.test(f)) ?? "README.md";
   const current2 = read(root, file2);
   const boilerplate = current2 && /create-next-app|bootstrapped with/i.test(current2);
-  const words = current2?.split(/\s+/).filter(Boolean).length ?? 0;
-  if (current2 && !boilerplate && words >= 80) return { skip: `${file2} already describes the app.` };
+  const words2 = current2?.split(/\s+/).filter(Boolean).length ?? 0;
+  if (current2 && !boilerplate && words2 >= 80) return { skip: `${file2} already describes the app.` };
   let content = render("readme/README.md", vars);
-  if (current2 && !boilerplate && words > 0) content = `${content.trimEnd()}
+  if (current2 && !boilerplate && words2 > 0) content = `${content.trimEnd()}
 
 ## Notes
 
@@ -21340,7 +22006,7 @@ ${current2.trim()}
   };
 };
 var enableDependencyUpdates = ({ root, vars }) => {
-  if ([".github/dependabot.yml", ".github/dependabot.yaml", "renovate.json", ".github/renovate.json"].some((f) => existsSync7(path8.join(root, f)))) {
+  if ([".github/dependabot.yml", ".github/dependabot.yaml", "renovate.json", ".github/renovate.json"].some((f) => existsSync9(path12.join(root, f)))) {
     return { skip: "Dependabot or Renovate is already configured." };
   }
   return {
@@ -21420,7 +22086,7 @@ function planMoves(root, ctx, moves) {
       const alias = aliasFor(toFile);
       if (alias) return alias[0] + noExt.slice(alias[1].length);
     }
-    let rel = path8.posix.relative(path8.posix.dirname(fromFile), noExt);
+    let rel = path12.posix.relative(path12.posix.dirname(fromFile), noExt);
     if (!rel.startsWith(".")) rel = `./${rel}`;
     return rel;
   };
@@ -21454,7 +22120,7 @@ function planMoves(root, ctx, moves) {
 }
 var moveMisplacedFiles = ({ root, ctx, scan }) => {
   const raw = findingMeta(scan, "structure.layout", "moves") ?? [];
-  const moves = raw.map((m) => m.split("=>")).filter(([, to]) => !existsSync7(path8.join(root, to))).slice(0, MAX_MOVES);
+  const moves = raw.map((m) => m.split("=>")).filter(([, to]) => !existsSync9(path12.join(root, to))).slice(0, MAX_MOVES);
   if (moves.length === 0) return { skip: "No files to move (or their targets already exist)." };
   return { changes: planMoves(root, ctx, moves), details: moves.map(([from, to]) => `- \`${from}\` \u2192 \`${to}\``), verifyTypes: true };
 };
@@ -21545,7 +22211,7 @@ var AuraClient = class _AuraClient {
   get hasKey() {
     return Boolean(this.key);
   }
-  async request(method, path22, body, timeoutMs = 6e4) {
+  async request(method, path27, body, timeoutMs = 6e4) {
     if (!this.key) throw new AuraApiError("no_key", "No pilot key");
     let payload;
     if (body !== void 0) {
@@ -21555,7 +22221,7 @@ var AuraClient = class _AuraClient {
     }
     let res;
     try {
-      res = await fetch(`${this.baseUrl}/v1/${path22}`, {
+      res = await fetch(`${this.baseUrl}/v1/${path27}`, {
         method,
         headers: { authorization: `Bearer ${this.key}`, "content-type": "application/json", "user-agent": `getaura/${AURA_VERSION}` },
         body: payload,
@@ -21580,81 +22246,157 @@ var AuraClient = class _AuraClient {
 
 // src/api/telemetry.ts
 import { createHash as createHash2 } from "crypto";
-async function repoId(root) {
-  const r = await run("git", ["rev-list", "--max-parents=0", "HEAD"], { cwd: root });
-  const seed = r.code === 0 ? r.stdout.trim().split("\n")[0] : root;
-  return createHash2("sha256").update(seed).digest("hex").slice(0, 24);
-}
-async function sendTelemetry(root, client, event) {
-  if (!client.hasKey) return;
-  try {
-    await client.request("POST", "telemetry", { ...event, auraVersion: AURA_VERSION, repoId: await repoId(root) }, 5e3);
-  } catch {
-  }
-}
 
-// src/core/git.ts
-import { mkdirSync as mkdirSync2, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import path9 from "path";
-async function git(root, ...args) {
-  return run("git", args, { cwd: root });
+// src/ui.ts
+import * as p from "@clack/prompts";
+import pc from "picocolors";
+function interactive() {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY && !inCI() && !runningAgent());
 }
-function ghInstallHint(platform = process.platform) {
-  const how = platform === "win32" ? "Install it with `winget install --id GitHub.cli`" : platform === "darwin" ? "Install it with `brew install gh` (or download it from https://cli.github.com)" : "Install it from https://cli.github.com";
-  return `${how}, open a new terminal, then run \`gh auth login\`.`;
+var UserCancelled = class extends Error {
+};
+function unwrap(value) {
+  if (p.isCancel(value)) {
+    p.cancel("Cancelled.");
+    throw new UserCancelled();
+  }
+  return value;
 }
-async function ghStatus(root) {
-  const v = await run("gh", ["--version"]);
-  if (v.code !== 0) return { installed: false, authed: false, hasRemote: false };
-  const auth = await run("gh", ["auth", "status"], { cwd: root });
-  const remote = await git(root, "remote", "get-url", "origin");
-  return { installed: true, authed: auth.code === 0, hasRemote: remote.code === 0 && /github\.com/.test(remote.stdout) };
-}
-var AURA_OWNED = /^(?:\.aura\/|\.claude\/skills\/aura\/|\.agents\/skills\/aura\/)/;
-async function dirtyFiles(root) {
-  const r = await git(root, "status", "--porcelain", "-uall");
-  return r.stdout.split("\n").filter(Boolean).map((l) => l.slice(3).replace(/^"|"$/g, "").split(" -> ").pop()).filter((f) => !AURA_OWNED.test(f));
+function spin(enabled) {
+  if (!enabled || !process.stdout.isTTY) {
+    return { start: (_m) => {
+    }, message: (_m) => {
+    }, stop: (_m) => {
+    }, error: (_m) => {
+    } };
+  }
+  const s = p.spinner();
+  return { start: (m) => s.start(m), message: (m) => s.message(m), stop: (m) => s.stop(m), error: (m) => s.error(m) };
 }
-async function currentBranch(root) {
-  return (await git(root, "rev-parse", "--abbrev-ref", "HEAD")).stdout.trim();
+function printJson(value) {
+  process.stdout.write(JSON.stringify(value, null, 2) + "\n");
 }
-async function freeBranchName(root, base) {
-  for (let i = 1; i < 50; i++) {
-    const name = i === 1 ? base : `${base}-${i}`;
-    const local = await git(root, "rev-parse", "--verify", "--quiet", `refs/heads/${name}`);
-    const remote = await git(root, "ls-remote", "--exit-code", "--heads", "origin", name);
-    if (local.code !== 0 && remote.code !== 0) return name;
+var say = {
+  info: (m) => console.log(m),
+  ok: (m) => console.log(`${pc.green("\u2714")} ${m}`),
+  warn: (m) => console.error(`${pc.yellow("!")} ${m}`),
+  error: (m) => console.error(`${pc.red("\u2716")} ${m}`),
+  dim: (m) => console.log(pc.dim(m))
+};
+
+// src/fix-tracking.ts
+import { existsSync as existsSync10, readFileSync as readFileSync10 } from "fs";
+var FILE = "fixes.json";
+var MAX_AGE_MS = 60 * 24 * 60 * 60 * 1e3;
+var MAX_CHECKS_PER_SCAN = 5;
+function loadTrackedFixes(root) {
+  try {
+    return existsSync10(auraPath(root, FILE)) ? JSON.parse(readFileSync10(auraPath(root, FILE), "utf8")) : [];
+  } catch {
+    return [];
   }
-  return `${base}-${Date.now()}`;
 }
-function writeChanges(root, changes) {
-  for (const c of changes) {
-    const full = path9.join(root, c.path);
-    if (!isInside(root, full)) throw new Error(`Refusing to write outside the repo: ${c.path}`);
-    if (c.content === null) rmSync(full, { force: true });
-    else {
-      mkdirSync2(path9.dirname(full), { recursive: true });
-      writeFileSync2(full, c.content);
-    }
+function save(root, fixes) {
+  writeAuraFile(root, FILE, JSON.stringify(fixes, null, 2));
+}
+function trackFix(root, config2, fix) {
+  if (!sharesUsage(config2)) return;
+  save(root, [...loadTrackedFixes(root).filter((f) => f.branch !== fix.branch), { ...fix, openedAt: (/* @__PURE__ */ new Date()).toISOString() }]);
+}
+async function prState(root, branch) {
+  const r = await run("gh", ["pr", "view", branch, "--json", "state,mergeCommit", "--jq", '[.state, .mergeCommit.oid // ""] | join(" ")'], {
+    cwd: root,
+    timeoutMs: 15e3
+  });
+  const [state, sha] = r.stdout.trim().split(" ");
+  if (r.code !== 0) return null;
+  if (state === "OPEN" || state === "CLOSED") return { state };
+  if (state !== "MERGED") return null;
+  const inCheckout = Boolean(sha) && (await run("git", ["merge-base", "--is-ancestor", sha, "HEAD"], { cwd: root })).code === 0;
+  return { state, inCheckout };
+}
+async function followUpFixes(root, config2, scan, state = prState) {
+  const tracked = loadTrackedFixes(root);
+  if (tracked.length === 0 || !sharesUsage(config2)) return;
+  const current2 = new Set(scan.checks.flatMap((c) => c.findings.map((f) => f.id)));
+  const keep = [];
+  for (const [i, fix] of tracked.entries()) {
+    if (Date.now() - Date.parse(fix.openedAt) > MAX_AGE_MS) continue;
+    const s = i < MAX_CHECKS_PER_SCAN ? await state(root, fix.branch) : null;
+    if (s?.state === "MERGED") {
+      if (!fix.merged) await recordUsage(root, config2, { event: "fix_result", actionId: fix.actionId, outcome: "merged" });
+      if (!s.inCheckout) {
+        keep.push({ ...fix, merged: true });
+        continue;
+      }
+      const stillThere = fix.findingIds.some((id) => current2.has(id));
+      await recordUsage(root, config2, {
+        event: "fix_result",
+        actionId: fix.actionId,
+        outcome: stillThere ? "not_resolved" : "resolved",
+        scoreChange: scan.score - fix.scoreBefore
+      });
+    } else if (s?.state === "CLOSED") {
+      await recordUsage(root, config2, { event: "fix_result", actionId: fix.actionId, outcome: "closed" });
+    } else keep.push(fix);
   }
+  save(root, keep);
 }
-async function commitPushPr(root, opts) {
-  const commit = await git(root, "commit", "-m", opts.title, "-m", "Opened by Aura (https://github.com/JohnFazio1/aura).");
-  const base = { branch: opts.branch, url: null };
-  if (commit.code !== 0) {
-    const out = commit.stderr || commit.stdout;
-    const error62 = /tell me who you are|user\.email/i.test(out) ? 'git doesn\u2019t know your name and email yet. Run: git config --global user.name "Your Name" && git config --global user.email "you@example.com"' : out;
-    return { ...base, committed: false, pushed: false, error: error62 };
+
+// src/api/telemetry.ts
+function sharesUsage(config2, key = getApiKey()) {
+  if (!key) return false;
+  if (config2.shareUsage !== void 0) return config2.shareUsage;
+  return key.startsWith("aura_live_") || config2.telemetry === true;
+}
+function runSource() {
+  return inCI() ? "ci" : interactive() ? "terminal" : "agent";
+}
+function osName() {
+  return process.platform === "darwin" || process.platform === "win32" || process.platform === "linux" ? process.platform : "other";
+}
+async function repoId(root) {
+  const r = await run("git", ["rev-list", "--max-parents=0", "HEAD"], { cwd: root });
+  const seed = r.code === 0 ? r.stdout.trim().split("\n")[0] : root;
+  return createHash2("sha256").update(seed).digest("hex").slice(0, 24);
+}
+async function recordUsage(root, config2, event) {
+  if (!sharesUsage(config2)) return;
+  try {
+    const body = {
+      ...event,
+      auraVersion: AURA_VERSION,
+      repoId: await repoId(root),
+      source: runSource(),
+      agent: runningAgent() ?? void 0,
+      agents: config2.agents.length ? config2.agents : void 0,
+      os: osName(),
+      nodeVersion: process.version
+    };
+    await AuraClient.from(config2).request("POST", "telemetry", body, 5e3);
+  } catch {
   }
-  if (!opts.openPr) return { ...base, committed: true, pushed: false };
-  const push = await git(root, "push", "-u", "origin", opts.branch);
-  if (push.code !== 0) return { ...base, committed: true, pushed: false, error: push.stderr };
-  const pr = await run("gh", ["pr", "create", "--base", opts.base, "--head", opts.branch, "--title", opts.title, "--body-file", "-"], {
-    cwd: root,
-    input: opts.body
+}
+function errorKind(err) {
+  const e = err;
+  const kind = typeof e?.code === "string" ? e.code : typeof e?.name === "string" ? e.name : "Error";
+  return /^[A-Za-z_][A-Za-z0-9_]{0,59}$/.test(kind) ? kind : "Error";
+}
+async function recordAction(root, config2, actionId, report, startedAt, via) {
+  if (!report.outcome) return;
+  await recordUsage(root, config2, {
+    event: "action",
+    actionId,
+    outcome: report.outcome,
+    delivery: report.delivery,
+    via,
+    durationMs: Date.now() - startedAt,
+    agentSteps: report.agentSteps,
+    errorType: report.errorType
   });
-  if (pr.code !== 0) return { ...base, committed: true, pushed: true, error: pr.stderr };
-  return { ...base, url: pr.stdout.trim().split("\n").pop() ?? null, committed: true, pushed: true };
+  if (report.outcome === "pr_opened" && report.branch) {
+    trackFix(root, config2, { actionId, branch: report.branch, findingIds: report.findingIds ?? [], scoreBefore: report.scoreBefore ?? 0 });
+  }
 }
 
 // src/checks/foundations.ts
@@ -21747,13 +22489,13 @@ var readme = {
   run(ctx) {
     const file2 = ctx.files.find((f) => /^readme(\.md|\.mdx|\.txt)?$/i.test(f));
     const text = file2 ? ctx.read(file2) ?? "" : "";
-    const words = text.split(/\s+/).filter(Boolean).length;
-    if (file2 && !BOILERPLATE.test(text) && words >= 80) return { status: "pass", summary: `${file2} (${words} words).` };
+    const words2 = text.split(/\s+/).filter(Boolean).length;
+    if (file2 && !BOILERPLATE.test(text) && words2 >= 80) return { status: "pass", summary: `${file2} (${words2} words).` };
     const boilerplate = Boolean(file2) && BOILERPLATE.test(text);
     const finding = makeFinding(this, {
       severity: "low",
       title: !file2 ? "No README" : boilerplate ? "README is still the starter template" : "README is very short",
-      detail: !file2 ? "There is no README describing what the app is, how to run it or how it is deployed." : boilerplate ? "The README is the default text from create-next-app and says nothing about this app." : `The README has only ${words} words, so it can't explain how to run or deploy the app.`,
+      detail: !file2 ? "There is no README describing what the app is, how to run it or how it is deployed." : boilerplate ? "The README is the default text from create-next-app and says nothing about this app." : `The README has only ${words2} words, so it can't explain how to run or deploy the app.`,
       why: "A good README is the first thing a new engineer or your coding agent reads; without it they guess.",
       locations: file2 ? [{ file: file2 }] : [],
       actionId: "add-readme",
@@ -21856,10 +22598,10 @@ var typecheck = {
   applies: (ctx) => ctx.stack.typescript,
   async run(ctx) {
     if (ctx.options.fast) return { status: "unknown", summary: "Skipped in fast mode." };
-    const { existsSync: existsSync17 } = await import("fs");
-    const path22 = await import("path");
-    const tsc = path22.join(ctx.root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
-    if (!existsSync17(tsc)) return { status: "unknown", summary: "Dependencies not installed, so the type check was skipped." };
+    const { existsSync: existsSync21 } = await import("fs");
+    const path27 = await import("path");
+    const tsc = path27.join(ctx.root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
+    if (!existsSync21(tsc)) return { status: "unknown", summary: "Dependencies not installed, so the type check was skipped." };
     const r = await run(tsc, ["--noEmit", "--pretty", "false"], { cwd: ctx.root, timeoutMs: 18e4 });
     if (r.timedOut) return { status: "unknown", summary: "Type check timed out." };
     if (r.code === 0) return { status: "pass", summary: "No type errors.", engine: "tsc" };
@@ -21879,6 +22621,56 @@ var typecheck = {
 };
 var foundationChecks = [ciWorkflow, tests, readme, envExample, lockfile, lintFormat, typecheck];
 
+// src/connectors/snapshot.ts
+import { existsSync as existsSync11, readFileSync as readFileSync11 } from "fs";
+var FILE2 = "cache/connectors.json";
+function loadSnapshots(root) {
+  try {
+    return existsSync11(auraPath(root, FILE2)) ? JSON.parse(readFileSync11(auraPath(root, FILE2), "utf8")) : {};
+  } catch {
+    return {};
+  }
+}
+function saveSnapshot(root, toolId, states) {
+  const all = loadSnapshots(root);
+  all[toolId] = { checkedAt: (/* @__PURE__ */ new Date()).toISOString(), settings: Object.fromEntries(Object.entries(states).map(([id, s]) => [id, s.state])) };
+  writeAuraFile(root, FILE2, `${JSON.stringify(all, null, 2)}
+`);
+}
+var isStale = (snap, now = Date.now()) => !snap || now - Date.parse(snap.checkedAt) > 24 * 60 * 60 * 1e3;
+
+// src/checks/security/tool-settings.ts
+function toolSettingsCheck(connector) {
+  return {
+    id: `security.${connector.id}-settings`,
+    category: "security",
+    title: `${connector.name} security settings`,
+    weight: 3,
+    applies: (ctx) => {
+      const snap = loadSnapshots(ctx.root)[connector.id];
+      return Boolean(snap && Object.values(snap.settings).some((s) => s !== "unavailable"));
+    },
+    run(ctx) {
+      const snap = loadSnapshots(ctx.root)[connector.id];
+      const available = connector.settings.filter((s) => snap.settings[s.id] === "on" || snap.settings[s.id] === "off");
+      const off = available.filter((s) => snap.settings[s.id] === "off");
+      const engine = `${connector.name}, checked ${snap.checkedAt.slice(0, 10)}`;
+      if (off.length === 0) return { status: "pass", summary: `All ${available.length} available ${connector.name} security settings are on.`, engine };
+      const finding = makeFinding(this, {
+        severity: off.some((s) => /protect|push|secret/.test(s.id)) ? "medium" : "low",
+        title: `${off.length} ${connector.name} security setting(s) off`,
+        detail: `Off in ${connector.name}: ${off.map((s) => s.label).join("; ")}.`,
+        why: "These settings catch leaked keys, vulnerable packages and risky changes before they cause harm, and they cost nothing to turn on.",
+        locations: [],
+        actionId: connector.actionId,
+        key: `${connector.id}-settings`
+      });
+      const score = (available.length - off.length) / available.length;
+      return { status: score === 0 ? "fail" : "partial", score, summary: finding.title, findings: [finding], engine };
+    }
+  };
+}
+
 // src/checks/security/api-routes.ts
 var AUTH_SIGNALS = [
   /\bauth\.getUser\s*\(/,
@@ -21985,9 +22777,9 @@ var apiRoutes = {
 
 // src/core/tools.ts
 import { createHash as createHash3 } from "crypto";
-import { chmodSync as chmodSync2, existsSync as existsSync8, mkdirSync as mkdirSync3, mkdtempSync, readdirSync as readdirSync3, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import os2 from "os";
-import path10 from "path";
+import { chmodSync as chmodSync2, existsSync as existsSync12, mkdirSync as mkdirSync3, mkdtempSync, readdirSync as readdirSync4, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import os3 from "os";
+import path13 from "path";
 var GITLEAKS_SHA = {
   darwin_arm64: "b40ab0ae55c505963e365f271a8d3846efbc170aa17f2607f13df610a9aeb6a5",
   darwin_x64: "dfe101a4db2255fc85120ac7f3d25e4342c3c20cf749f2c20a18081af1952709",
@@ -22004,13 +22796,16 @@ var OSV_SHA = {
   windows_amd64: "e0ed7644118b717b028c249ee9d3515024e55e8510747ca08906eb96765354d6",
   windows_arm64: "ca1379da0e408279ef2c85cde0846a903495738a91c7b065a208048437c1686c"
 };
+function tarCommand(platform = process.platform, systemRoot = process.env.SystemRoot) {
+  return platform === "win32" ? path13.win32.join(systemRoot || "C:\\Windows", "System32", "tar.exe") : "tar";
+}
 var TOOLS = {
   gitleaks: {
     version: "8.30.1",
     asset(platform, arch) {
       const p2 = platform === "win32" ? "windows" : platform;
-      const a = arch === "arm64" ? "arm64" : "x64";
-      const sha = GITLEAKS_SHA[`${p2}_${a}`];
+      const a = arch === "arm64" ? "arm64" : arch === "x64" ? "x64" : null;
+      const sha = a && GITLEAKS_SHA[`${p2}_${a}`];
       if (!sha) return null;
       const archive = p2 === "windows" ? "zip" : "tar.gz";
       return { file: `gitleaks_8.30.1_${p2}_${a}.${archive}`, sha256: sha, archive };
@@ -22021,8 +22816,8 @@ var TOOLS = {
     version: "2.6.0",
     asset(platform, arch) {
       const p2 = platform === "win32" ? "windows" : platform;
-      const a = arch === "arm64" ? "arm64" : "amd64";
-      const sha = OSV_SHA[`${p2}_${a}`];
+      const a = arch === "arm64" ? "arm64" : arch === "x64" ? "amd64" : null;
+      const sha = a && OSV_SHA[`${p2}_${a}`];
       if (!sha) return null;
       return { file: `osv-scanner_${p2}_${a}${p2 === "windows" ? ".exe" : ""}`, sha256: sha, archive: null };
     },
@@ -22038,8 +22833,8 @@ function ensureTool(name, noDownload = false) {
 async function resolveTool(name, noDownload) {
   const spec = TOOLS[name];
   const exe = process.platform === "win32" ? `${name}.exe` : name;
-  const cached2 = path10.join(auraBinDir(), `${name}-${spec.version}`, exe);
-  if (existsSync8(cached2)) return { path: cached2, version: spec.version };
+  const cached2 = path13.join(auraBinDir(), `${name}-${spec.version}`, exe);
+  if (existsSync12(cached2)) return { path: cached2, version: spec.version };
   if (await commandExists(name)) {
     const v = await run(name, ["version"]);
     return { path: name, version: (v.stdout.match(/\d+\.\d+\.\d+/)?.[0] ?? "system").trim() };
@@ -22059,20 +22854,20 @@ async function download(name, spec, target) {
   const buf = Buffer.from(await res.arrayBuffer());
   const digest = createHash3("sha256").update(buf).digest("hex");
   if (digest !== asset.sha256) throw new Error(`Checksum mismatch for ${asset.file}`);
-  const dir = path10.dirname(target);
+  const dir = path13.dirname(target);
   mkdirSync3(dir, { recursive: true });
-  const tmp = mkdtempSync(path10.join(os2.tmpdir(), `aura-${name}-`));
+  const tmp = mkdtempSync(path13.join(os3.tmpdir(), `aura-${name}-`));
   try {
     if (asset.archive === null) {
       writeFileSync3(target, buf);
     } else {
-      const archivePath = path10.join(tmp, asset.file);
+      const archivePath = path13.join(tmp, asset.file);
       writeFileSync3(archivePath, buf);
-      const r = await run("tar", ["-xf", archivePath, "-C", tmp]);
+      const r = await run(tarCommand(), ["-xf", archivePath, "-C", tmp]);
       if (r.code !== 0) return null;
-      const exe = readdirSync3(tmp).find((f) => f === name || f === `${name}.exe`);
+      const exe = readdirSync4(tmp).find((f) => f === name || f === `${name}.exe`);
       if (!exe) return null;
-      renameSync(path10.join(tmp, exe), target);
+      renameSync(path13.join(tmp, exe), target);
     }
     chmodSync2(target, 493);
     return { path: target, version: spec.version };
@@ -22343,9 +23138,9 @@ var rls = {
 };
 
 // src/checks/security/secrets.ts
-import { existsSync as existsSync9, mkdtempSync as mkdtempSync2, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
-import os3 from "os";
-import path11 from "path";
+import { existsSync as existsSync13, mkdtempSync as mkdtempSync2, readFileSync as readFileSync12, rmSync as rmSync3 } from "fs";
+import os4 from "os";
+import path14 from "path";
 
 // src/core/ignore.ts
 function globToRegex(glob) {
@@ -22383,15 +23178,15 @@ async function gitleaksHistory(ctx) {
   if (!ctx.tracked) return null;
   const bin = await ensureTool("gitleaks", ctx.options.noDownload);
   if (!bin) return null;
-  const dir = mkdtempSync2(path11.join(os3.tmpdir(), "aura-gitleaks-"));
-  const report = path11.join(dir, "report.json");
+  const dir = mkdtempSync2(path14.join(os4.tmpdir(), "aura-gitleaks-"));
+  const report = path14.join(dir, "report.json");
   try {
     const r = await run(bin.path, ["git", "--no-banner", "--redact", "--report-format", "json", "--report-path", report, "--exit-code", "0", "."], {
       cwd: ctx.root,
       timeoutMs: 18e4
     });
-    if (r.code !== 0 || !existsSync9(report)) return null;
-    return { hits: JSON.parse(readFileSync7(report, "utf8")), engine: `gitleaks ${bin.version}` };
+    if (r.code !== 0 || !existsSync13(report)) return null;
+    return { hits: JSON.parse(readFileSync12(report, "utf8")), engine: `gitleaks ${bin.version}` };
   } catch {
     return null;
   } finally {
@@ -22503,10 +23298,10 @@ var envFiles = {
 };
 
 // src/checks/security.ts
-var securityChecks = [secrets, envFiles, deps, rls, apiRoutes, headers];
+var securityChecks = [secrets, envFiles, deps, rls, apiRoutes, headers, ...CONNECTORS.map(toolSettingsCheck)];
 
 // src/checks/structure.ts
-import path12 from "path";
+import path15 from "path";
 var GENERATED = /(?:^|\/)(?:supabase\/migrations|generated|__generated__|\.generated)\/|\.(?:d\.ts|min\.js)$|(?:^|\/)(?:database|supabase)\.types\.ts$|(?:^|\/)components\/ui\//;
 function appSource(ctx) {
   return ctx.files.filter((f) => isSourceFile(f) && !GENERATED.test(f));
@@ -22595,7 +23390,7 @@ var duplicates = {
     const findings = pairs.map(
       ([a, b, sim]) => makeFinding(this, {
         severity: "low",
-        title: `${path12.basename(a)} and ${path12.basename(b)} are near-duplicates`,
+        title: `${path15.basename(a)} and ${path15.basename(b)} are near-duplicates`,
         detail: `${a} and ${b} are ${Math.round(sim * 100)}% the same.`,
         why: "Duplicates drift apart over time: a bug gets fixed in one copy and not the other, and your agent can\u2019t tell which one is right.",
         locations: [{ file: a }, { file: b }],
@@ -22609,7 +23404,7 @@ var duplicates = {
 };
 var ROOT_ALLOWED = /^(?:[^/]+\.config\.[cm]?[jt]s|middleware\.[cm]?[jt]s|proxy\.[cm]?[jt]s|instrumentation(?:-client)?\.[cm]?[jt]s|next-env\.d\.ts|global\.d\.ts|env\.d\.ts|sentry\.[\w.]+\.[cm]?[jt]s)$/;
 function suggestTarget(file2, srcDir) {
-  const base = path12.posix.basename(file2);
+  const base = path15.posix.basename(file2);
   const prefix = srcDir ? "src/" : "";
   const isComponent = /^[A-Z][A-Za-z0-9]*\.(?:tsx|jsx)$/.test(base);
   if (isComponent) return `${prefix}components/${base}`;
@@ -22721,59 +23516,22 @@ async function runScan(root, options, onProgress) {
   };
 }
 
-// src/ui.ts
-import * as p from "@clack/prompts";
-import pc from "picocolors";
-function interactive() {
-  return Boolean(process.stdin.isTTY && process.stdout.isTTY && !process.env.CI);
-}
-var UserCancelled = class extends Error {
-};
-function unwrap(value) {
-  if (p.isCancel(value)) {
-    p.cancel("Cancelled.");
-    throw new UserCancelled();
-  }
-  return value;
-}
-function spin(enabled) {
-  if (!enabled || !process.stdout.isTTY) {
-    return { start: (_m) => {
-    }, message: (_m) => {
-    }, stop: (_m) => {
-    }, error: (_m) => {
-    } };
-  }
-  const s = p.spinner();
-  return { start: (m) => s.start(m), message: (m) => s.message(m), stop: (m) => s.stop(m), error: (m) => s.error(m) };
-}
-function printJson(value) {
-  process.stdout.write(JSON.stringify(value, null, 2) + "\n");
-}
-var say = {
-  info: (m) => console.log(m),
-  ok: (m) => console.log(`${pc.green("\u2714")} ${m}`),
-  warn: (m) => console.error(`${pc.yellow("!")} ${m}`),
-  error: (m) => console.error(`${pc.red("\u2716")} ${m}`),
-  dim: (m) => console.log(pc.dim(m))
-};
-
 // src/commands/fix.ts
-import { existsSync as existsSync14, readFileSync as readFileSync14, writeFileSync as writeFileSync6 } from "fs";
-import path16 from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync19, writeFileSync as writeFileSync6 } from "fs";
+import path19 from "path";
 
 // src/agent/tools.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync4, readFileSync as readFileSync8, rmSync as rmSync4, statSync as statSync2, writeFileSync as writeFileSync4 } from "fs";
-import path13 from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync4, readFileSync as readFileSync13, rmSync as rmSync4, statSync as statSync2, writeFileSync as writeFileSync4 } from "fs";
+import path16 from "path";
 var MAX_OUTPUT = 12e3;
 var MAX_FILE_LINES = 800;
 var FORBIDDEN = /^(?:\.git|node_modules|\.next|\.vercel)(?:\/|$)|(?:^|\/)\.env(?:\.(?!example$|sample$|template$)[^/]+)?$/;
 function safePath(root, rel) {
   if (typeof rel !== "string" || !rel.trim()) throw new Error("A file path is required.");
-  const normalized = path13.posix.normalize(rel.replace(/\\/g, "/").replace(/^\.\//, ""));
-  if (normalized.startsWith("../") || normalized === ".." || path13.isAbsolute(normalized)) throw new Error(`Path is outside the repo: ${rel}`);
+  const normalized = path16.posix.normalize(rel.replace(/\\/g, "/").replace(/^\.\//, ""));
+  if (normalized.startsWith("../") || normalized === ".." || path16.isAbsolute(normalized)) throw new Error(`Path is outside the repo: ${rel}`);
   if (FORBIDDEN.test(normalized)) throw new Error(`Aura doesn\u2019t let the agent touch ${normalized}.`);
-  const full = path13.join(root, normalized);
+  const full = path16.join(root, normalized);
   if (!isInside(root, full)) throw new Error(`Path is outside the repo: ${rel}`);
   return normalized;
 }
@@ -22794,10 +23552,10 @@ async function runTool(root, call, allowedCommands2) {
     }
     case "read_file": {
       const rel = safePath(root, input2.path);
-      const full = path13.join(root, rel);
-      if (!existsSync10(full)) return { output: `File not found: ${rel}` };
+      const full = path16.join(root, rel);
+      if (!existsSync14(full)) return { output: `File not found: ${rel}` };
       if (statSync2(full).size > 1e6) return { output: `${rel} is too large to read.` };
-      const lines = readFileSync8(full, "utf8").split("\n");
+      const lines = readFileSync13(full, "utf8").split("\n");
       const start = Math.max(1, Number(input2.startLine) || 1);
       const end = Math.min(lines.length, Number(input2.endLine) || start + MAX_FILE_LINES - 1);
       const body = lines.slice(start - 1, end).map((l, i) => `${start + i}: ${l}`).join("\n");
@@ -22814,7 +23572,7 @@ async function runTool(root, call, allowedCommands2) {
         if (FORBIDDEN.test(f) || glob && !glob.test(f)) continue;
         let text;
         try {
-          text = readFileSync8(path13.join(root, f), "utf8");
+          text = readFileSync13(path16.join(root, f), "utf8");
         } catch {
           continue;
         }
@@ -22833,14 +23591,14 @@ async function runTool(root, call, allowedCommands2) {
           output: "Refused: the content contains a [REDACTED:\u2026] placeholder. Secrets are hidden from you on purpose. Read the value from an environment variable (process.env.NAME) instead of writing it."
         };
       }
-      mkdirSync4(path13.dirname(path13.join(root, rel)), { recursive: true });
-      writeFileSync4(path13.join(root, rel), content);
+      mkdirSync4(path16.dirname(path16.join(root, rel)), { recursive: true });
+      writeFileSync4(path16.join(root, rel), content);
       return { output: `Wrote ${rel} (${content.split("\n").length} lines).`, touched: rel };
     }
     case "delete_file": {
       const rel = safePath(root, input2.path);
-      if (!existsSync10(path13.join(root, rel))) return { output: `File not found: ${rel}` };
-      rmSync4(path13.join(root, rel));
+      if (!existsSync14(path16.join(root, rel))) return { output: `File not found: ${rel}` };
+      rmSync4(path16.join(root, rel));
       return { output: `Deleted ${rel}.`, touched: rel };
     }
     case "run_command": {
@@ -22862,7 +23620,7 @@ ${(r.stdout + "\n" + r.stderr).trim().slice(-6e3)}`;
 
 // src/api/explain.ts
 import { createHash as createHash4 } from "crypto";
-import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
 
 // src/report.ts
 import pc2 from "picocolors";
@@ -23051,7 +23809,7 @@ var CACHE_FILE = "cache/explanations.json";
 var MAX_EXPLAIN = 25;
 function loadCache(root) {
   try {
-    return JSON.parse(readFileSync9(auraPath(root, CACHE_FILE), "utf8"));
+    return JSON.parse(readFileSync14(auraPath(root, CACHE_FILE), "utf8"));
   } catch {
     return {};
   }
@@ -23072,8 +23830,8 @@ function excerptFor(root, f, context = 4) {
 }
 function productContext(root) {
   const file2 = auraPath(root, "brief.md");
-  if (!existsSync11(file2)) return void 0;
-  return redact(readFileSync9(file2, "utf8")).slice(0, 1800);
+  if (!existsSync15(file2)) return void 0;
+  return redact(readFileSync14(file2, "utf8")).slice(0, 1800);
 }
 async function addExplanations(root, scan, client) {
   const cache = loadCache(root);
@@ -23117,19 +23875,22 @@ async function addExplanations(root, scan, client) {
 
 // src/commands/simple.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync13, readdirSync as readdirSync4, readFileSync as readFileSync13 } from "fs";
-import path15 from "path";
+import { existsSync as existsSync17, readdirSync as readdirSync5, readFileSync as readFileSync18 } from "fs";
+import path18 from "path";
 import YAML2 from "yaml";
 
 // src/commands/inventory.ts
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync15 } from "fs";
 function accountState(root, services) {
   const inv = loadInventory(root);
-  return { inventoryComplete: services.every((s) => inv.services[s]?.owner) && Boolean(inv.githubOrg), githubSecurity: Boolean(inv.githubSecurity) };
+  return {
+    inventoryComplete: services.every((s) => inv.services[s]?.owner) && Boolean(inv.githubOrg),
+    secured: { ...inv.secured, github: Boolean(inv.githubSecurity || inv.secured?.github) }
+  };
 }
 function loadInventory(root) {
   try {
-    return JSON.parse(readFileSync10(auraPath(root, "inventory.json"), "utf8"));
+    return JSON.parse(readFileSync15(auraPath(root, "inventory.json"), "utf8"));
   } catch {
     return { version: 1, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), services: {} };
   }
@@ -23216,10 +23977,10 @@ async function inventoryCommand(flags) {
 }
 
 // src/history.ts
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync16 } from "fs";
 function loadHistory(root) {
   try {
-    const data = JSON.parse(readFileSync11(auraPath(root, "history.json"), "utf8"));
+    const data = JSON.parse(readFileSync16(auraPath(root, "history.json"), "utf8"));
     return Array.isArray(data) ? data : [];
   } catch {
     return [];
@@ -23267,10 +24028,10 @@ function banner(colors = pc3.isColorSupported) {
 // src/api/connect.ts
 import { spawn as spawn2 } from "child_process";
 import { constants, generateKeyPairSync, privateDecrypt } from "crypto";
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync12, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "fs";
-import os4 from "os";
-import path14 from "path";
-var pendingFile = () => path14.join(os4.homedir(), ".aura", "pending-connect.json");
+import { existsSync as existsSync16, mkdirSync as mkdirSync5, readFileSync as readFileSync17, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "fs";
+import os5 from "os";
+import path17 from "path";
+var pendingFile = () => path17.join(os5.homedir(), ".aura", "pending-connect.json");
 async function postJson(apiUrl, route, body) {
   let res;
   try {
@@ -23289,14 +24050,14 @@ async function postJson(apiUrl, route, body) {
 }
 function loadPending(apiUrl, now) {
   try {
-    const p2 = JSON.parse(readFileSync12(pendingFile(), "utf8"));
+    const p2 = JSON.parse(readFileSync17(pendingFile(), "utf8"));
     if (p2.apiUrl === apiUrl && Date.parse(p2.expiresAt) - now > 6e4) return p2;
   } catch {
   }
   return null;
 }
 function clearPendingConnect() {
-  if (existsSync12(pendingFile())) rmSync5(pendingFile(), { force: true });
+  if (existsSync16(pendingFile())) rmSync5(pendingFile(), { force: true });
 }
 async function startOrResumeConnect(apiUrl, now = Date.now()) {
   const existing = loadPending(apiUrl, now);
@@ -23308,7 +24069,7 @@ async function startOrResumeConnect(apiUrl, now = Date.now()) {
   });
   const res = ConnectStartResponse.parse(await postJson(apiUrl, "connect", { publicKey }));
   const pending = { apiUrl, privateKey, ...res };
-  mkdirSync5(path14.dirname(pendingFile()), { recursive: true });
+  mkdirSync5(path17.dirname(pendingFile()), { recursive: true });
   writeFileSync5(pendingFile(), JSON.stringify(pending, null, 2) + "\n", { mode: 384 });
   return { ...pending, resumed: false };
 }
@@ -23333,7 +24094,7 @@ async function waitForConnect(pending, waitSeconds, sleep = (ms) => new Promise(
   }
 }
 function openInBrowser(url2) {
-  if (process.env.AURA_NO_BROWSER || process.env.CI) return;
+  if (process.env.AURA_NO_BROWSER || inCI()) return;
   const [cmd, args] = process.platform === "darwin" ? ["open", [url2]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url2]] : ["xdg-open", [url2]];
   try {
     const child = spawn2(cmd, args, { stdio: "ignore", detached: true });
@@ -23362,7 +24123,7 @@ ${pc.magenta("\u2726")} ${pc.bold("Connect your Aura pilot key")}`);
       console.log(pc.dim(`  Check the page shows the code ${pending.code}. Press Ctrl+C to stop.
 `));
     } else {
-      console.log(`  Ask the user to open this link and paste their pilot key there (or choose to continue without one):`);
+      console.log("  Ask the user to open this link and paste their pilot key there:");
       console.log(`  ${pending.url}`);
       console.log(`  Don\u2019t ask for the key in chat. The page sends it to this computer encrypted. Code: ${pending.code}`);
       console.log(`  Waiting up to ${Math.round(wait)} seconds\u2026
@@ -23371,7 +24132,7 @@ ${pc.magenta("\u2726")} ${pc.bold("Connect your Aura pilot key")}`);
     const s = spin(opts.person);
     s.start("Waiting for you to finish in the browser");
     const outcome = await waitForConnect(pending, wait);
-    s.stop(outcome.status === "complete" ? "Key received" : outcome.status === "skipped" ? "Continuing without a key" : "Stopped waiting");
+    s.stop(outcome.status === "complete" ? "Key received" : "Stopped waiting");
     return outcome;
   } catch (err) {
     return { status: "error", message: friendlyApiError(err) };
@@ -23379,18 +24140,15 @@ ${pc.magenta("\u2726")} ${pc.bold("Connect your Aura pilot key")}`);
 }
 function explainSignIn(outcome) {
   switch (outcome.status) {
-    case "skipped":
-      say.dim("No pilot key: Aura will still score your repo, with standard explanations. Add one later with `aura login`.");
-      return true;
     case "pending":
       say.warn("Still waiting for the user to finish in the browser. When they have, run the same command again: it carries on with the same link.");
-      return false;
+      break;
     case "expired":
       say.warn("The sign-in link expired. Run the same command again for a new one.");
-      return false;
+      break;
     case "error":
       say.warn(`Couldn\u2019t start sign-in: ${outcome.message}`);
-      return false;
+      break;
   }
 }
 
@@ -23404,7 +24162,7 @@ function stepRun(step, hasKey) {
 }
 function hint(step, hasKey) {
   const run2 = stepRun(step, hasKey);
-  const what = run2.kind === "apply" ? "opens a pull request" : run2.kind === "fix" ? run2.withOwnAgent ? "writes a task for your coding agent" : "Aura\u2019s agent fixes it in a pull request" : run2.kind === "guide" ? "shows step-by-step instructions" : "a few questions";
+  const what = connectorForAction(step.actionId) ? `turns on ${connectorForAction(step.actionId).name}\u2019s security settings, after you agree` : run2.kind === "apply" ? "opens a pull request" : run2.kind === "fix" ? run2.withOwnAgent ? "writes a task for your coding agent" : "Aura\u2019s agent fixes it in a pull request" : run2.kind === "guide" ? "shows step-by-step instructions" : "a few questions";
   return [what, step.impact > 0 ? `+${step.impact} points` : "", effortLabel(step.effort)].filter(Boolean).join(" \xB7 ");
 }
 async function pickAndRunSteps(steps, limit = 10) {
@@ -23430,7 +24188,20 @@ async function pickAndRunSteps(steps, limit = 10) {
     console.log(`
 ${pc.magenta("\u2726")} ${pc.bold(step.title)}`);
     const run2 = stepRun(step, hasKey);
-    const code = run2.kind === "apply" ? await applyCommand(run2.actionId, { yes: true }) : run2.kind === "fix" ? await fixCommand(run2.actionId, run2.withOwnAgent ? { agent: true } : { yes: true }) : run2.kind === "guide" ? await guideCommand(run2.topic, {}) : await inventoryCommand({});
+    const code = run2.kind === "apply" ? (
+      // Settings changes always ask first, even when picked here; pull requests don't need to.
+      await applyCommand(run2.actionId, { yes: !connectorForAction(run2.actionId), via: "checklist" })
+    ) : run2.kind === "fix" ? await fixCommand(run2.actionId, run2.withOwnAgent ? { agent: true, via: "checklist" } : { yes: true, via: "checklist" }) : run2.kind === "guide" ? await guideCommand(run2.topic, {}) : await inventoryCommand({});
+    if (run2.kind === "guide" || run2.kind === "inventory") {
+      const root = await findRepoRoot();
+      await recordUsage(root, loadConfig(root), {
+        event: "action",
+        actionId: step.actionId,
+        delivery: run2.kind === "guide" ? "guide" : "checklist",
+        via: "checklist",
+        outcome: "shown"
+      });
+    }
     results.push({ title: step.title, ok: code === 0 });
   }
   if (results.length > 1) {
@@ -23444,9 +24215,9 @@ ${pc.bold("  Done")}`);
 // src/commands/simple.ts
 async function latestScan(root) {
   const file2 = auraPath(root, "scan.json");
-  if (existsSync13(file2)) {
+  if (existsSync17(file2)) {
     try {
-      const scan = JSON.parse(readFileSync13(file2, "utf8"));
+      const scan = JSON.parse(readFileSync18(file2, "utf8"));
       const head = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
       const dirty = execFileSync("git", ["status", "--porcelain"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
       if (scan.commit === head && !dirty && Date.now() - Date.parse(scan.scannedAt) < 24 * 36e5) return scan;
@@ -23481,14 +24252,14 @@ async function loginCommand(flags) {
   let key = flags.key ?? process.env.AURA_KEY;
   if (!key && flags.paste && person) key = unwrap(await p.password({ message: "Paste your Aura pilot key", mask: "\u2022" }));
   if (!key) {
-    if (process.env.CI) {
+    if (inCI()) {
       say.error("Pass your key with --key or set AURA_KEY.");
       return 1;
     }
     const outcome = await signInWithBrowser(apiUrl, { person, waitSeconds: parseWait(flags.wait) });
     if (outcome.status !== "complete") {
       explainSignIn(outcome);
-      return outcome.status === "skipped" ? 0 : 1;
+      return 1;
     }
     key = outcome.key;
   }
@@ -23534,8 +24305,8 @@ async function configCommand(key, value) {
   const bool = (v) => ["on", "true", "yes", "1"].includes(v.toLowerCase());
   switch (key) {
     case "telemetry":
-      if (value === void 0) return say.info(config2.telemetry ? "on" : "off"), 0;
-      config2.telemetry = bool(value);
+      if (value === void 0) return say.info(sharesUsage(config2) ? "on" : "off"), 0;
+      config2.shareUsage = bool(value);
       break;
     case "ciMaxDrop":
     case "ci-max-drop":
@@ -23561,9 +24332,9 @@ async function configCommand(key, value) {
   return 0;
 }
 function loadGuides() {
-  const dir = path15.join(templatesDir(), "guides");
-  return readdirSync4(dir).filter((f) => f.endsWith(".md")).map((f) => {
-    const text = readFileSync13(path15.join(dir, f), "utf8");
+  const dir = path18.join(templatesDir(), "guides");
+  return readdirSync5(dir).filter((f) => f.endsWith(".md")).map((f) => {
+    const text = readFileSync18(path18.join(dir, f), "utf8");
     const fm = text.match(/^---\n([\s\S]*?)\n---\n?/);
     const meta3 = fm ? YAML2.parse(fm[1]) : {};
     return { id: f.replace(/\.md$/, ""), title: meta3.title ?? f, summary: meta3.summary ?? "", body: fm ? text.slice(fm[0].length) : text };
@@ -23631,7 +24402,7 @@ function allowedCommands(root, pm, typescript) {
   const pkg = readJson(root, "package.json");
   const run2 = pmCommands(pm).run;
   const cmds = ["test", "lint", "typecheck", "build"].filter((s) => pkg?.scripts?.[s]).map((s) => `${run2} ${s}`);
-  if (typescript && !pkg?.scripts?.typecheck && existsSync14(path16.join(root, "node_modules/.bin/tsc"))) cmds.push(`${pmCommands(pm).exec} tsc --noEmit`);
+  if (typescript && !pkg?.scripts?.typecheck && existsSync18(path19.join(root, "node_modules/.bin/tsc"))) cmds.push(`${pmCommands(pm).exec} tsc --noEmit`);
   return cmds;
 }
 function taskFor(root, scan, action2, findings) {
@@ -23682,8 +24453,8 @@ async function untrackEnvFiles(root, findings) {
   const files = findings.filter((f) => f.checkId === "security.env-files").map((f) => f.locations[0].file);
   for (const f of files) await git(root, "rm", "-q", "--cached", "--", f);
   if (files.length) {
-    const gi = path16.join(root, ".gitignore");
-    const current2 = existsSync14(gi) ? readFileSync14(gi, "utf8") : "";
+    const gi = path19.join(root, ".gitignore");
+    const current2 = existsSync18(gi) ? readFileSync19(gi, "utf8") : "";
     if (!/^\.env\*?$/m.test(current2)) writeFileSync6(gi, `${current2.trimEnd()}
 
 # Environment files hold secrets
@@ -23695,6 +24466,15 @@ async function untrackEnvFiles(root, findings) {
   return files;
 }
 async function fixCommand(target, flags) {
+  const started = Date.now();
+  const report = { delivery: flags.agent ? "agent-task" : "agent-fix" };
+  const actionId = { value: target };
+  const code = await fixAction(target, flags, report, actionId);
+  const root = await findRepoRoot();
+  await recordAction(root, loadConfig(root), actionId.value, report, started, flags.via ?? "command");
+  return code;
+}
+async function fixAction(target, flags, report, resolvedId) {
   const root = await findRepoRoot();
   const config2 = loadConfig(root);
   const scan = await latestScan(root);
@@ -23704,8 +24484,10 @@ async function fixCommand(target, flags) {
     return 1;
   }
   const { action: action2, findings } = resolved;
+  resolvedId.value = action2.id;
   if (findings.length === 0 && !["write-critical-tests"].includes(action2.id)) {
     say.info(`Aura found nothing to fix for "${action2.title}".`);
+    report.outcome = "no_changes";
     return 0;
   }
   const task = taskFor(root, scan, action2, findings);
@@ -23715,11 +24497,13 @@ async function fixCommand(target, flags) {
     console.log(`
 Ask your coding agent:
   ${pc.cyan(`Complete the Aura task in ${file2}`)}`);
+    report.outcome = "task_written";
     return 0;
   }
   const client = AuraClient.from(config2);
   if (!client.hasKey) {
     say.error("Aura\u2019s agent needs a pilot key (aura login). Or run with --agent to hand this to your own coding agent.");
+    Object.assign(report, { outcome: "failed", errorType: "NoPilotKey" });
     return 1;
   }
   console.log(`
@@ -23732,6 +24516,7 @@ ${pc.bold(action2.title)}  ${pc.dim(`${findings.length} finding(s)`)}`);
   const dirty = await dirtyFiles(root);
   if (dirty.length) {
     say.error(`You have uncommitted changes (${dirty.slice(0, 5).join(", ")}). Commit or stash them first.`);
+    Object.assign(report, { outcome: "failed", errorType: "UncommittedChanges" });
     return 1;
   }
   const openPr = flags.pr !== false;
@@ -23739,15 +24524,19 @@ ${pc.bold(action2.title)}  ${pc.dim(`${findings.length} finding(s)`)}`);
     const gh = await ghStatus(root);
     if (!gh.installed || !gh.authed || !gh.hasRemote) {
       say.error("Opening a PR needs the GitHub CLI, signed in, and a GitHub remote. Run with --no-pr to keep the change on a local branch.");
+      Object.assign(report, { outcome: "failed", errorType: gh.installed ? "GhNotReady" : "GhNotInstalled" });
       return 1;
     }
   }
-  if (interactive() && !flags.yes && !unwrap(await p.confirm({ message: "Start Aura\u2019s agent on a new branch? It reads only the files it needs, with secrets hidden." })))
+  if (interactive() && !flags.yes && !unwrap(await p.confirm({ message: "Start Aura\u2019s agent on a new branch? It reads only the files it needs, with secrets hidden." }))) {
+    report.outcome = "cancelled";
     return 0;
+  }
   const original = await currentBranch(root);
   const branch = await freeBranchName(root, `aura/fix-${action2.id}`);
   if ((await git(root, "switch", "-c", branch)).code !== 0) {
     say.error(`Couldn\u2019t create branch ${branch}.`);
+    Object.assign(report, { outcome: "failed", errorType: "BranchFailed" });
     return 1;
   }
   const s = spin(true);
@@ -23757,6 +24546,7 @@ ${pc.bold(action2.title)}  ${pc.dim(`${findings.length} finding(s)`)}`);
   try {
     s.start("Aura\u2019s agent is working");
     for (let step = 0; step <= MAX_STEPS && !finish; step++) {
+      report.agentSteps = step + 1;
       const res = await client.request("POST", "agent/step", { task, messages, step }, 18e4);
       messages = [...messages, ...res.responseMessages];
       if (res.toolCalls.length === 0) break;
@@ -23785,6 +24575,7 @@ ${pc.bold(action2.title)}  ${pc.dim(`${findings.length} finding(s)`)}`);
       say.warn("Aura\u2019s agent didn\u2019t change anything. " + (finish?.summary ?? ""));
       await git(root, "switch", original);
       await git(root, "branch", "-D", branch);
+      report.outcome = "no_changes";
       return 1;
     }
     const guides = [
@@ -23819,11 +24610,12 @@ ${pc.bold(action2.title)}  ${pc.dim(`${findings.length} finding(s)`)}`);
     else if (result.error) say.warn(`Committed on ${branch}, but couldn\u2019t open the PR: ${result.error.trim()}`);
     else say.ok(`Committed on branch ${branch}.`);
     if (finish?.risks.length) say.info(pc.dim(`Check before merging: ${finish.risks.join(" ")}`));
-    if (config2.telemetry) await sendTelemetry(root, client, { event: "action", actionId: action2.id });
+    Object.assign(report, { outcome: result.url ? "pr_opened" : "committed", branch, scoreBefore: scan.score, findingIds: findings.map((f) => f.id) });
     return 0;
   } catch (err) {
     s.error("Aura\u2019s agent hit a problem");
     say.error(friendlyApiError(err));
+    Object.assign(report, { outcome: "failed", errorType: errorKind(err) });
     await git(root, "reset", "-q");
     for (const f of touched) {
       const inHead = (await git(root, "cat-file", "-e", `HEAD:${f}`)).code === 0;
@@ -23839,9 +24631,132 @@ ${pc.bold(action2.title)}  ${pc.dim(`${findings.length} finding(s)`)}`);
   }
 }
 
+// src/connectors/engine.ts
+async function readSettings(connector, ctx) {
+  const states = await Promise.all(connector.settings.map((s) => s.read(ctx).catch(() => ({ state: "off" }))));
+  return Object.fromEntries(connector.settings.map((s, i) => [s.id, states[i]]));
+}
+async function enableSettings(connector, ctx, states) {
+  const results = [];
+  for (const setting of connector.settings) {
+    const s = states[setting.id];
+    if (s.state === "on") results.push({ id: setting.id, result: "already-on" });
+    else if (s.state === "unavailable") results.push({ id: setting.id, result: "unavailable", why: s.why });
+    else {
+      const out = await setting.enable(ctx).catch(() => ({ ok: false }));
+      results.push(
+        out.ok ? { id: setting.id, result: "turned-on" } : out.unavailable ? { id: setting.id, result: "unavailable", why: out.unavailable } : { id: setting.id, result: "failed", why: `${connector.name} refused the change` }
+      );
+    }
+  }
+  return results;
+}
+var securityDone = (results) => results.every((r) => r.result !== "failed");
+async function secureCommand(connector, flags, report = {}, fake) {
+  const root = await findRepoRoot();
+  report.delivery = "settings";
+  const connection = await connector.connect(root, fake);
+  if (!connection.ok) {
+    say.error(connection.problem);
+    Object.assign(report, { outcome: "failed", errorType: connection.errorType });
+    return 1;
+  }
+  const { ctx, target } = connection;
+  const states = await readSettings(connector, ctx);
+  saveSnapshot(root, connector.id, states);
+  const toTurnOn = connector.settings.filter((s) => states[s.id].state === "off").map((s) => s.id);
+  console.log(`
+${pc.magenta("\u2726")} ${pc.bold(`${connector.name} security for ${target}`)}`);
+  for (const setting of connector.settings) {
+    const s = states[setting.id];
+    const line = s.state === "on" ? pc.green("\u2714 already on") : s.state === "off" ? pc.cyan("\u2192 Aura will turn this on") : pc.dim(`\u2013 not available: ${s.why}`);
+    console.log(`  ${setting.label}
+    ${line}`);
+  }
+  for (const line of await connector.explain?.(ctx, toTurnOn) ?? []) say.dim(`  ${line}`);
+  const label = (id) => connector.settings.find((s) => s.id === id).label;
+  const impact = (id) => connector.settings.find((s) => s.id === id).impact;
+  if (toTurnOn.length && !flags.dryRun) {
+    console.log(`
+${pc.bold("  What changes for you")}`);
+    for (const id of toTurnOn) console.log(`  \u2022 ${impact(id)}`);
+  }
+  if (flags.dryRun) {
+    say.dim(toTurnOn.length ? "\nDry run: nothing was changed." : "\nEverything Aura can turn on here is already on.");
+    return 0;
+  }
+  let chosen = toTurnOn;
+  if (toTurnOn.length && !flags.yes) {
+    if (!interactive()) {
+      say.info(`
+Nothing was changed. Show the user the changes above, and once they agree run: aura apply ${connector.actionId} --yes`);
+      report.outcome = "shown";
+      return 0;
+    }
+    chosen = unwrap(
+      await p.multiselect({
+        message: `Which should Aura turn on in ${connector.name}? (untick any you don\u2019t want)`,
+        options: toTurnOn.map((id) => ({ value: id, label: label(id) })),
+        initialValues: toTurnOn,
+        required: false
+      })
+    );
+    if (chosen.length === 0) {
+      say.dim("Nothing was changed.");
+      report.outcome = "cancelled";
+      return 0;
+    }
+  }
+  const skipped = toTurnOn.filter((id) => !chosen.includes(id));
+  let results;
+  if (toTurnOn.length === 0) {
+    say.ok("Everything Aura can turn on here is already on.");
+    results = await enableSettings(connector, ctx, states);
+    report.outcome = "no_changes";
+  } else {
+    const attempt = Object.fromEntries(
+      Object.entries(states).map(([id, s]) => [id, skipped.includes(id) ? { state: "unavailable", why: "you chose to leave it off" } : s])
+    );
+    results = await enableSettings(connector, ctx, attempt);
+    console.log("");
+    for (const r of results.filter((x) => chosen.includes(x.id))) {
+      if (r.result === "turned-on") say.ok(`${label(r.id)}: on`);
+      else if (r.result === "unavailable") say.dim(`\u2013 ${label(r.id)}: ${r.why}`);
+      else say.warn(`${label(r.id)}: ${r.why}.`);
+    }
+    report.outcome = results.some((r) => r.result === "failed") ? "failed" : "settings_changed";
+  }
+  saveSnapshot(
+    root,
+    connector.id,
+    Object.fromEntries(Object.entries(states).map(([id, s]) => [id, results.find((r) => r.id === id)?.result === "turned-on" ? { state: "on" } : s]))
+  );
+  const left = await connector.leftForYou(ctx, results);
+  if (left.length) {
+    console.log(`
+${pc.bold("  Left for you")}`);
+    for (const line of left) console.log(`  \u2022 ${line}`);
+  }
+  const inv = loadInventory(root);
+  inv.secured = { ...inv.secured, [connector.id]: securityDone(results) };
+  if (connector.id === "github") inv.githubSecurity = inv.secured.github;
+  inv.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  writeAuraFile(root, "inventory.json", `${JSON.stringify(inv, null, 2)}
+`);
+  return results.some((r) => r.result === "failed") ? 1 : 0;
+}
+
 // src/commands/apply.ts
 var LOCKFILES = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb"];
 async function applyCommand(actionId, flags) {
+  const started = Date.now();
+  const report = { delivery: "pr" };
+  const code = await applyAction(actionId, flags, report);
+  const root = await findRepoRoot();
+  await recordAction(root, loadConfig(root), actionId, report, started, flags.via ?? "command");
+  return code;
+}
+async function applyAction(actionId, flags, report) {
   const root = await findRepoRoot();
   const action2 = getAction(actionId);
   if (!action2) {
@@ -23850,10 +24765,12 @@ async function applyCommand(actionId, flags) {
   }
   const scan = await latestScan(root);
   const { delivery, fellBack } = effectiveDelivery(action2, scan);
+  const connector = connectorForAction(actionId);
+  if (connector) return secureCommand(connector, flags, report);
   if (delivery === "guide") return guideCommand(actionId, {});
   if (delivery === "agent-fix") {
     if (fellBack) say.info(pc.dim(`Aura only opens template PRs on stacks it recognizes (Next.js). Handing "${actionId}" to Aura\u2019s agent instead.`));
-    return fixCommand(actionId, { yes: flags.yes, dryRun: flags.dryRun, pr: flags.pr });
+    return fixCommand(actionId, { yes: flags.yes, dryRun: flags.dryRun, pr: flags.pr, via: flags.via });
   }
   if (delivery !== "pr") {
     say.error(`"${actionId}" isn\u2019t a PR action. Try aura ${delivery === "checklist" ? "inventory" : "next"}.`);
@@ -23875,18 +24792,15 @@ async function applyCommand(actionId, flags) {
   }
   const g = { root, scan, ctx, agents: [...agents], vars: templateVars(root, scan, ctx.pkg), skills: skills2 };
   const plan = actionId === "foundation" ? foundationPlan(g) : GENERATORS[actionId]?.(g) ?? { skip: "Nothing to do." };
-  if ("skip" in plan) {
-    say.info(plan.skip);
-    return 0;
-  }
-  if (plan.changes.length === 0 && !plan.commands?.length && !plan.devDeps?.length) {
-    say.info("Nothing to change.");
+  if ("skip" in plan || plan.changes.length === 0 && !plan.commands?.length && !plan.devDeps?.length) {
+    say.info("skip" in plan ? plan.skip : "Nothing to change.");
+    report.outcome = "no_changes";
     return 0;
   }
   console.log(`
 ${pc.bold(action2.title)}`);
   for (const c of plan.changes)
-    console.log(`  ${c.content === null ? pc.red("delete") : existsSync15(path17.join(root, c.path)) ? pc.yellow("update") : pc.green("add   ")} ${c.path}`);
+    console.log(`  ${c.content === null ? pc.red("delete") : existsSync19(path20.join(root, c.path)) ? pc.yellow("update") : pc.green("add   ")} ${c.path}`);
   const pm = pmCommands(scan.stack.packageManager);
   if (plan.devDeps?.length) console.log(`  ${pc.cyan("install")} ${plan.devDeps.join(", ")} ${pc.dim(`(${pm.addDev})`)}`);
   for (const cmd of plan.commands ?? []) console.log(`  ${pc.cyan("run   ")} ${cmd.join(" ")}`);
@@ -23899,6 +24813,7 @@ ${pc.bold(action2.title)}`);
     say.error(
       `You have uncommitted changes (${dirty.slice(0, 5).join(", ")}${dirty.length > 5 ? "\u2026" : ""}). Commit or stash them first so they don\u2019t end up in Aura\u2019s PR.`
     );
+    Object.assign(report, { outcome: "failed", errorType: "UncommittedChanges" });
     return 1;
   }
   const openPr = flags.pr !== false;
@@ -23909,13 +24824,16 @@ ${pc.bold(action2.title)}`);
         !gh.installed ? `The GitHub CLI isn\u2019t installed. ${ghInstallHint()}` : !gh.authed ? "Run `gh auth login` first." : "This repo has no GitHub remote. Push it to GitHub first."
       );
       say.dim("Or run with --no-pr to commit the change on a local branch.");
+      Object.assign(report, { outcome: "failed", errorType: gh.installed ? "GhNotReady" : "GhNotInstalled" });
       return 1;
     }
   }
-  if (interactive() && !flags.yes && !unwrap(await p.confirm({ message: openPr ? "Create a branch and open a pull request?" : "Create a branch and commit?" })))
+  if (interactive() && !flags.yes && !unwrap(await p.confirm({ message: openPr ? "Create a branch and open a pull request?" : "Create a branch and commit?" }))) {
+    report.outcome = "cancelled";
     return 0;
-  const tsc = path17.join(root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
-  const checkTypes = plan.verifyTypes && scan.stack.typescript && existsSync15(tsc);
+  }
+  const tsc = path20.join(root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
+  const checkTypes = plan.verifyTypes && scan.stack.typescript && existsSync19(tsc);
   const typeErrors = async () => {
     const r = await run(tsc, ["--noEmit", "--pretty", "false"], { cwd: root, timeoutMs: 3e5 });
     return (r.stdout.match(/error TS\d+/g) ?? []).length;
@@ -23926,6 +24844,7 @@ ${pc.bold(action2.title)}`);
   const sw = await git(root, "switch", "-c", branch);
   if (sw.code !== 0) {
     say.error(`Couldn\u2019t create branch ${branch}: ${sw.stderr.trim()}`);
+    Object.assign(report, { outcome: "failed", errorType: "BranchFailed" });
     return 1;
   }
   try {
@@ -23953,6 +24872,7 @@ ${r.stderr.slice(-1500)}`);
       say.info("Nothing changed, so there\u2019s no PR to open.");
       await git(root, "switch", original);
       await git(root, "branch", "-D", branch);
+      report.outcome = "no_changes";
       return 0;
     }
     const prTemplate = `pr/${actionId}.md`;
@@ -23963,22 +24883,31 @@ ${plan.details.join("\n")}`;
     const result = await commitPushPr(root, { branch, base: original, title: `Aura: ${action2.title}`, body, openPr });
     if (result.error && result.committed) {
       say.error(`Committed on branch ${branch}, but couldn\u2019t ${result.pushed ? "open the pull request" : "push it"}: ${result.error.trim()}`);
-      say.dim(`Finish by hand: git push -u origin ${branch} && gh pr create --head ${branch}`);
+      say.dim(`Finish by hand with these two commands:
+  git push -u origin ${branch}
+  gh pr create --head ${branch}`);
+      Object.assign(report, { outcome: "failed", errorType: result.pushed ? "PrFailed" : "PushFailed" });
       return 1;
     }
     if (result.error) throw new Error(result.error.trim());
     if (result.url) say.ok(`Opened ${result.url}`);
     else say.ok(`Committed on branch ${branch}.`);
+    Object.assign(report, {
+      outcome: result.url ? "pr_opened" : "committed",
+      branch,
+      scoreBefore: scan.score,
+      findingIds: nextSteps(scan, { includeFoundationBundle: true }).find((s) => s.actionId === actionId)?.findingIds ?? []
+    });
     if (plan.changes.some((c) => /^\.aura\/|\/skills\/aura\//.test(c.path))) {
       say.dim(
         openPr ? "Your brief and Aura files are in this PR. Merge it, then run `git pull` to have them locally again." : `Your brief and Aura files are on ${branch}. Merge that branch to have them locally again.`
       );
     }
     if (plan.changes.some((c) => c.path === ".github/workflows/aura.yml") && openPr && !flags.yes) await offerPilotSecret(root);
-    if (config2.telemetry) await sendTelemetry(root, AuraClient.from(config2), { event: "action", actionId });
     return 0;
   } catch (err) {
     say.error(err.message);
+    Object.assign(report, { outcome: "failed", errorType: errorKind(err) });
     await undoPlan(root, plan);
     await git(root, "switch", original);
     await git(root, "branch", "-D", branch);
@@ -24013,16 +24942,17 @@ async function undoPlan(root, plan) {
   for (const file2 of touched) {
     const inHead = (await git(root, "cat-file", "-e", `HEAD:${file2}`)).code === 0;
     if (inHead) await git(root, "checkout", "HEAD", "--", file2);
-    else if (plan.changes.some((c) => c.path === file2)) rmSync6(path17.join(root, file2), { force: true });
+    else if (plan.changes.some((c) => c.path === file2)) rmSync6(path20.join(root, file2), { force: true });
   }
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync16, readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync21 } from "fs";
 import { spawnSync as spawnSync3 } from "child_process";
+import path24 from "path";
 
 // src/brief.ts
-import path18 from "path";
+import path21 from "path";
 function repoSummary(ctx) {
   const routes = ctx.files.filter((f) => /^(?:src\/)?app\/(?:.+\/)?(?:page|route)\.[cm]?[jt]sx?$/.test(f) || /^(?:src\/)?pages\/.+\.[cm]?[jt]sx?$/.test(f)).map(
     (f) => "/" + f.replace(/^(?:src\/)?(?:app|pages)\//, "").replace(/(?:^|\/)(?:page|route|index)\.[cm]?[jt]sx?$|\.[cm]?[jt]sx?$/, "").replace(/\([^)]+\)\//g, "")
@@ -24038,7 +24968,7 @@ function repoSummary(ctx) {
   const readme2 = ctx.files.find((f) => /^readme\.mdx?$/i.test(f));
   const readmeText = readme2 ? ctx.read(readme2) ?? "" : "";
   return {
-    name: ctx.pkg?.name ?? path18.basename(ctx.root),
+    name: ctx.pkg?.name ?? path21.basename(ctx.root),
     packageJson: ctx.pkg ? {
       name: ctx.pkg.name,
       description: ctx.pkg.description,
@@ -24129,13 +25059,154 @@ function installFallback(result, platform = process.platform) {
   return `${admin} \`npx getaura <command>\` in place of \`aura <command>\` (for example \`npx getaura scan\`).`;
 }
 
+// src/core/claude-plugin.ts
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync7 } from "fs";
+import os6 from "os";
+import path22 from "path";
+var CLAUDE_PLUGIN_ID = "aura@aura";
+var marketplaceDir = () => path22.join(os6.homedir(), ".aura", "claude-marketplace");
+var MARKETPLACE = {
+  name: "aura",
+  description: "Aura for Claude Code",
+  owner: { name: "Aura" },
+  plugins: [
+    {
+      name: "aura",
+      description: "Slash commands for Aura: /aura:scan, /aura:next, /aura:fix and /aura:setup.",
+      source: { source: "npm", package: "getaura" }
+    }
+  ]
+};
+function writeMarketplace() {
+  const dir = marketplaceDir();
+  mkdirSync6(path22.join(dir, ".claude-plugin"), { recursive: true });
+  writeFileSync7(path22.join(dir, ".claude-plugin", "marketplace.json"), `${JSON.stringify(MARKETPLACE, null, 2)}
+`);
+  return dir;
+}
+function manualInstall() {
+  return [`claude plugin marketplace add "${writeMarketplace()}"`, `claude plugin install ${CLAUDE_PLUGIN_ID} --scope project`];
+}
+async function installClaudePlugin(root) {
+  if (!await commandExists("claude")) return "no-claude";
+  const dir = writeMarketplace();
+  const add = await run("claude", ["plugin", "marketplace", "add", dir], { cwd: root, timeoutMs: 12e4 });
+  if (add.code !== 0) return "failed";
+  const install = await run("claude", ["plugin", "install", CLAUDE_PLUGIN_ID, "--scope", "project"], { cwd: root, timeoutMs: 18e4 });
+  return install.code === 0 ? "installed" : "failed";
+}
+
+// src/onboarding.ts
+var DATA_LABELS2 = {
+  personal: "personal info (names, emails)",
+  payments: "payments",
+  health: "health",
+  legal: "legal",
+  children: "children\u2019s data",
+  none: "none of these"
+};
+var BOILERPLATE2 = /bootstrapped with|create-next-app|getting started|this template|vite \+|turborepo|starter kit/i;
+function whatItDoes(ctx) {
+  const description = ctx.pkg?.description?.trim();
+  if (description && description.length >= 15 && !BOILERPLATE2.test(description)) return { value: description, from: "package.json" };
+  const readme2 = ctx.files.find((f) => /^readme\.mdx?$/i.test(f));
+  const readmeText = readme2 ? ctx.read(readme2) ?? "" : "";
+  if (/create-next-app|create-react-app|create-vite|create-t3-app|bootstrapped with/i.test(readmeText)) return null;
+  const paragraphs = readmeText.replace(/\r\n/g, "\n").split(/\n\s*\n/);
+  for (const raw of paragraphs) {
+    const text = raw.replace(/\s+/g, " ").trim();
+    if (!text || /^(?:#|!\[|\[|<|```|[-*|>]|\d+\.)/.test(text) || text.length < 30 || BOILERPLATE2.test(text)) continue;
+    return { value: text.length > 300 ? `${text.slice(0, 297).replace(/\s+\S*$/, "")}\u2026` : text, from: "the README" };
+  }
+  return null;
+}
+var PAYMENT_PACKAGES = [
+  [/^stripe$|^@stripe\//, "Stripe"],
+  [/^@lemonsqueezy\//, "Lemon Squeezy"],
+  [/^@paddle\//, "Paddle"],
+  [/^@polar-sh\//, "Polar"],
+  [/^@revenuecat\/|^react-native-purchases$/, "RevenueCat"]
+];
+var AUTH_PACKAGES = [
+  [/^@supabase\//, "Supabase"],
+  [/^@clerk\//, "Clerk"],
+  [/^next-auth$|^@auth\//, "Auth.js"],
+  [/^firebase$|^firebase-admin$/, "Firebase"],
+  [/^better-auth$/, "Better Auth"],
+  [/^@kinde-oss\//, "Kinde"],
+  [/^@auth0\//, "Auth0"]
+];
+var words = (list) => new RegExp(`(?<![a-z])(?:${list})(?![a-z])`, "i");
+var SENSITIVE = [
+  ["health", words("patients?|diagnos[a-z]*|medical|medications?|prescriptions?|symptoms?|health_records?"), "health"],
+  ["legal", words("case_number|lawsuits?|attorneys?|legal_matters?|court[a-z]*"), "legal"],
+  ["children", words("child|children|kids?|minors?|guardians?|parental_consent"), "children"]
+];
+function schemaText(ctx) {
+  const files = ctx.files.filter((f) => /\.sql$|schema\.prisma$|(?:^|\/)schema\.[cm]?[jt]s$|(?:^|\/)db\/schema\//.test(f) && !/node_modules\//.test(f));
+  return files.slice(0, 200).map((f) => ctx.read(f) ?? "").join("\n");
+}
+var matchPackage = (deps2, list) => list.find(([re]) => deps2.some((d) => re.test(d)))?.[1];
+function inferAnswers(ctx) {
+  const deps2 = Object.keys(allDeps(ctx.pkg));
+  const payment = matchPackage(deps2, PAYMENT_PACKAGES);
+  const paymentPage = ctx.files.find((f) => /(?:^|\/)(?:pricing|checkout|billing|subscribe)(?:\/|\.|$)/i.test(f));
+  const chargesMoney = payment ? { value: true, from: `${payment} is installed` } : paymentPage ? { value: true, from: `there\u2019s a ${paymentPage.match(/pricing|checkout|billing|subscribe/i)[0].toLowerCase()} page` } : { value: false, from: "no payment provider or pricing page found" };
+  const kinds = [];
+  const reasons = [];
+  const auth = matchPackage(deps2, AUTH_PACKAGES);
+  const schema = schemaText(ctx);
+  if (auth || /\b(?:users?|profiles?|accounts?)\b[\s\S]{0,400}\bemail\b/i.test(schema)) {
+    kinds.push("personal");
+    reasons.push(auth ? `sign-in with ${auth}` : "a users table with emails");
+  }
+  if (chargesMoney.value) {
+    kinds.push("payments");
+    reasons.push("it charges money");
+  }
+  for (const [kind, re, label] of SENSITIVE) {
+    if (re.test(schema)) {
+      kinds.push(kind);
+      reasons.push(`${label} words in the database tables`);
+    }
+  }
+  const dataHandled = kinds.length ? { value: kinds, from: reasons.join("; ") } : { value: ["none"], from: "no sign-in, payments or sensitive tables found" };
+  return { whatItDoes: whatItDoes(ctx), chargesMoney, dataHandled };
+}
+function describeInferred(inferred) {
+  return [
+    `What it does: ${inferred.whatItDoes ? `${inferred.whatItDoes.value} (from ${inferred.whatItDoes.from})` : "not found, please describe it"}`,
+    `Charges money: ${inferred.chargesMoney.value ? "yes" : "no"} (${inferred.chargesMoney.from})`,
+    `Data it handles: ${inferred.dataHandled.value.map((k) => DATA_LABELS2[k]).join(", ")} (${inferred.dataHandled.from})`
+  ];
+}
+
+// src/commands/scan.ts
+import { mkdtempSync as mkdtempSync3, rmSync as rmSync7, writeFileSync as writeFileSync8 } from "fs";
+import os7 from "os";
+import path23 from "path";
+
+// src/connectors/refresh.ts
+import { readFileSync as readFileSync20 } from "fs";
+async function refreshToolSettings(root) {
+  if (process.env.AURA_NO_CONNECTORS) return;
+  let previous = null;
+  try {
+    previous = JSON.parse(readFileSync20(auraPath(root, "scan.json"), "utf8"));
+  } catch {
+  }
+  const snapshots = loadSnapshots(root);
+  for (const connector of CONNECTORS) {
+    if (!(previous ? connector.detect(previous) : connector.id === "github") || !isStale(snapshots[connector.id])) continue;
+    const connection = await connector.connect(root).catch(() => null);
+    if (connection?.ok) saveSnapshot(root, connector.id, await readSettings(connector, connection.ctx));
+  }
+}
+
 // src/commands/scan.ts
-import { mkdtempSync as mkdtempSync3, rmSync as rmSync7, writeFileSync as writeFileSync7 } from "fs";
-import os5 from "os";
-import path19 from "path";
 async function scanRef(root, ref, opts) {
-  const dir = mkdtempSync3(path19.join(os5.tmpdir(), "aura-base-"));
-  const wt = path19.join(dir, "tree");
+  const dir = mkdtempSync3(path23.join(os7.tmpdir(), "aura-base-"));
+  const wt = path23.join(dir, "tree");
   const add = await run("git", ["worktree", "add", "--detach", wt, ref], { cwd: root });
   if (add.code !== 0) {
     rmSync7(dir, { recursive: true, force: true });
@@ -24149,12 +25220,14 @@ async function scanRef(root, ref, opts) {
   }
 }
 async function scanCommand(flags) {
+  const started = Date.now();
   const root = await findRepoRoot();
   const config2 = loadConfig(root);
   const quiet = Boolean(flags.json);
   const opts = { fast: Boolean(flags.fast || flags.base), noDownload: flags.download === false };
   const s = spin(!quiet && !flags.ci);
   s.start("Scanning");
+  if (!flags.ci) await refreshToolSettings(root);
   const scan = await runScan(root, opts, (m) => s.message(`Checking: ${m}`));
   s.stop(`Scanned ${scan.checks.filter((c) => c.status !== "not-applicable").length} checks`);
   const client = AuraClient.from(config2);
@@ -24176,8 +25249,22 @@ async function scanCommand(flags) {
   writeAuraFile(root, "scan.json", JSON.stringify(scan, null, 2));
   writeAuraFile(root, "report.md", renderMarkdown(scan, steps));
   appendHistory(root, scan);
-  if (config2.telemetry)
-    await sendTelemetry(root, client, { event: "scan", score: scan.score, categories: Object.fromEntries(scan.categories.map((c) => [c.category, c.score])) });
+  const findings = scan.checks.flatMap((c) => c.findings);
+  await recordUsage(root, config2, {
+    event: "scan",
+    score: scan.score,
+    categories: Object.fromEntries(scan.categories.map((c) => [c.category, c.score])),
+    findings: {
+      critical: findings.filter((f) => f.severity === "critical").length,
+      high: findings.filter((f) => f.severity === "high").length,
+      medium: findings.filter((f) => f.severity === "medium").length,
+      low: findings.filter((f) => f.severity === "low").length,
+      info: findings.filter((f) => f.severity === "info").length
+    },
+    failingChecks: scan.checks.filter((c) => c.status === "fail" || c.status === "partial").map((c) => c.checkId),
+    durationMs: Date.now() - started
+  });
+  if (!flags.ci) await followUpFixes(root, config2, scan);
   let exitCode = 0;
   let base = null;
   if (flags.base) {
@@ -24188,7 +25275,7 @@ async function scanCommand(flags) {
   const baseIds = new Set(base ? base.checks.flatMap((c) => c.findings.map((f) => f.id)) : []);
   const newCritical = base ? scan.checks.flatMap((c) => c.findings).filter((f) => f.severity === "critical" && !baseIds.has(f.id)) : [];
   if (base && (base.score - scan.score > maxDrop || newCritical.length > 0)) exitCode = 1;
-  if (flags.commentFile) writeFileSync7(flags.commentFile, renderPrComment(scan, base, maxDrop));
+  if (flags.commentFile) writeFileSync8(flags.commentFile, renderPrComment(scan, base, maxDrop));
   if (quiet) {
     printJson({ ...scan, nextSteps: steps, base: base ? { score: base.score, categories: base.categories } : void 0 });
     return exitCode;
@@ -24209,31 +25296,34 @@ async function scanCommand(flags) {
 // src/commands/init.ts
 var AGENT_IDS = ["claude", "codex", "cursor", "pi"];
 function detectAgents(root) {
-  const found = [];
-  if (existsSync16(`${root}/CLAUDE.md`) || existsSync16(`${root}/.claude`)) found.push("claude");
-  if (existsSync16(`${root}/AGENTS.md`)) found.push("codex");
-  if (existsSync16(`${root}/.cursor`) || existsSync16(`${root}/.cursorrules`)) found.push("cursor");
-  if (existsSync16(`${root}/.pi`)) found.push("pi");
-  return found;
+  return detectAgentsFrom((rel) => existsSync20(path24.join(root, rel)));
 }
 function openEditor(file2) {
-  const editor = process.env.VISUAL || process.env.EDITOR || (process.platform === "win32" ? "notepad" : "nano");
-  const r = spawnSync3(editor, [file2], { stdio: "inherit", shell: process.platform === "win32" });
-  return r.status === 0;
+  const fallback = process.platform === "win32" ? "notepad" : spawnSync3("sh", ["-c", "command -v nano"]).status === 0 ? "nano" : "vi";
+  const editor = process.env.VISUAL || process.env.EDITOR || fallback;
+  return spawnSync3(`${editor} "${file2}"`, { stdio: "inherit", shell: true }).status === 0;
+}
+function answersTemplate(inferred) {
+  return JSON.stringify({
+    whatItDoes: inferred.whatItDoes?.value ?? "\u2026",
+    audience: "\u2026",
+    chargesMoney: inferred.chargesMoney.value,
+    dataHandled: inferred.dataHandled.value,
+    userRegions: ["\u2026"]
+  });
 }
-var EXAMPLE_ANSWERS = '{"whatItDoes": "\u2026", "audience": "\u2026", "chargesMoney": false, "dataHandled": ["personal"], "userRegions": ["Canada"]}';
-function briefHandoff() {
+function briefHandoff(inferred) {
   return [
     "",
-    `${pc.magenta("\u2726")} ${pc.bold("Next: write the product brief")}`,
-    "  Ask the user these questions. If you are a coding agent, suggest answers from the code and let the user confirm or correct them:",
-    "  1. What does the app do?",
-    "  2. Who is it for?",
-    "  3. Does it charge money?",
-    "  4. What data does it handle? Any of: personal, payments, health, legal, children, none",
-    "  5. Where are its users? (countries or regions)",
-    "  Save the answers to .aura/answers.json in this shape:",
-    `  ${EXAMPLE_ANSWERS}`,
+    `${pc.magenta("\u2726")} ${pc.bold("Next: check the product brief with the user")}`,
+    "  Aura worked these out from the code. Show them to the user and correct anything they say is wrong:",
+    ...describeInferred(inferred).map((l) => `  - ${l}`),
+    "  Then ask the user:",
+    "  - Who is the app for?",
+    "  - Where are its users? (countries or regions)",
+    '  Save the answers to .aura/answers.json. Start from this and replace each "\u2026":',
+    `  ${answersTemplate(inferred)}`,
+    "  dataHandled can include: personal, payments, health, legal, children, none.",
     "  Then run: npx getaura@latest init --yes --answers .aura/answers.json",
     ""
   ].join("\n");
@@ -24262,6 +25352,8 @@ async function initCommand(flags) {
   else if (!gh.hasRemote) say.warn("This repo has no GitHub remote yet. Push it to GitHub before applying fixes (`gh repo create`).");
   else say.ok("git and the GitHub CLI are ready.");
   const config2 = loadConfig(root);
+  if (flags.telemetry !== void 0) config2.shareUsage = flags.telemetry;
+  const setupStep = (step) => recordUsage(root, config2, { event: "setup", step });
   let agents = (flags.agent ?? []).flatMap((a) => a.split(",")).map((a) => a.trim().toLowerCase());
   const unknown2 = agents.filter((a) => !AGENT_IDS.includes(a));
   if (unknown2.length) {
@@ -24283,20 +25375,15 @@ async function initCommand(flags) {
   }
   config2.agents = agents;
   let key = flags.key ?? getApiKey();
-  let explained = false;
-  if (!key && !process.env.CI && !config2.noKey) {
+  let connectedNow = false;
+  if (!key && !inCI()) {
     const outcome = await signInWithBrowser(getApiUrl(config2), { person: interactive(), waitSeconds: parseWait(flags.wait) });
-    if (outcome.status === "complete") {
-      key = outcome.key;
-      delete config2.noKey;
-    } else {
-      if (outcome.status === "skipped") config2.noKey = true;
-      if (!explainSignIn(outcome)) {
-        if (outcome.status === "pending") return 1;
-        say.dim("Continuing without a pilot key for now. Connect one later with `aura login`.");
-      }
-      explained = true;
+    if (outcome.status !== "complete") {
+      explainSignIn(outcome);
+      return 1;
     }
+    key = outcome.key;
+    connectedNow = true;
   }
   let client = AuraClient.from(config2);
   if (key) {
@@ -24305,11 +25392,18 @@ async function initCommand(flags) {
       const me = await client.request("GET", "me");
       saveApiKey(key);
       say.ok(`Signed in as ${me.name}.`);
+      if (sharesUsage(config2, key)) {
+        say.dim(
+          "During the pilot, Aura shares usage data with the Aura team: scores, fixes and errors, never your code. Turn it off with `aura config telemetry off`."
+        );
+        await setupStep("started");
+        if (connectedNow) await setupStep("key_connected");
+      }
     } catch (err) {
       say.warn(`${friendlyApiError(err)} Continuing without Aura\u2019s agent.`);
       client = new AuraClient(getApiUrl(config2), null);
     }
-  } else if (!explained) {
+  } else {
     say.dim("No pilot key: Aura will still score your repo, with standard explanations.");
   }
   const ctx = await buildContext(root, { fast: true, noDownload: true }, config2);
@@ -24317,35 +25411,49 @@ async function initCommand(flags) {
   let brief2 = null;
   let keptBrief = false;
   if (flags.briefFile) {
-    brief2 = readFileSync15(flags.briefFile, "utf8");
-  } else if (!flags.answers && existsSync16(briefPath) && !(tty && unwrap(await p.confirm({ message: "A product brief already exists. Draft a new one?", initialValue: false })))) {
+    brief2 = readFileSync21(flags.briefFile, "utf8");
+  } else if (!flags.answers && existsSync20(briefPath) && !(tty && unwrap(await p.confirm({ message: "A product brief already exists. Draft a new one?", initialValue: false })))) {
     keptBrief = true;
   } else {
     let answers = null;
     if (flags.answers) {
-      answers = OnboardingAnswersSchema.parse(JSON.parse(readFileSync15(flags.answers, "utf8")));
+      answers = OnboardingAnswersSchema.parse(JSON.parse(readFileSync21(flags.answers, "utf8")));
     } else if (tty) {
-      p.note("A few questions so Aura understands your app. Your answers go into the product brief.", "About your app");
-      const whatItDoes = unwrap(await p.text({ message: "What does your app do?", placeholder: "e.g. Lets dog owners book and pay for walks" }));
-      const audience = unwrap(await p.text({ message: "Who is it for?", placeholder: "e.g. Busy dog owners in Toronto" }));
-      const chargesMoney = unwrap(await p.confirm({ message: "Does it charge money?", initialValue: ctx.stack.services.includes("Stripe") }));
-      const dataHandled = unwrap(
+      const inferred = inferAnswers(ctx);
+      p.note(describeInferred(inferred).join("\n"), "Here\u2019s what Aura found about your app");
+      const fix = new Set(
+        unwrap(
+          await p.multiselect({
+            message: "Anything Aura got wrong? Select it to correct it, or press enter if it\u2019s all right.",
+            options: [
+              { value: "whatItDoes", label: "What it does" },
+              { value: "chargesMoney", label: "Charges money" },
+              { value: "dataHandled", label: "Data it handles" }
+            ],
+            required: false
+          })
+        )
+      );
+      const whatItDoes2 = inferred.whatItDoes && !fix.has("whatItDoes") ? inferred.whatItDoes.value : unwrap(
+        await p.text({
+          message: "What does your app do?",
+          placeholder: "e.g. Lets dog owners book and pay for walks",
+          initialValue: inferred.whatItDoes?.value
+        })
+      );
+      const chargesMoney = fix.has("chargesMoney") ? unwrap(await p.confirm({ message: "Does it charge money?", initialValue: !inferred.chargesMoney.value })) : inferred.chargesMoney.value;
+      const dataHandled = fix.has("dataHandled") ? unwrap(
         await p.multiselect({
           message: "What data does it handle?",
-          options: [
-            { value: "personal", label: "Personal info (names, emails)" },
-            { value: "payments", label: "Payments" },
-            { value: "health", label: "Health" },
-            { value: "legal", label: "Legal" },
-            { value: "children", label: "Children\u2019s data" },
-            { value: "none", label: "None of these" }
-          ],
+          options: Object.entries(DATA_LABELS2).map(([value, label]) => ({ value, label: label[0].toUpperCase() + label.slice(1) })),
+          initialValues: inferred.dataHandled.value,
           required: true
         })
-      );
+      ) : inferred.dataHandled.value;
+      const audience = unwrap(await p.text({ message: "Who is it for?", placeholder: "e.g. Busy dog owners in Toronto" }));
       const regions = unwrap(await p.text({ message: "Where are your users?", placeholder: "e.g. Canada, United States" }));
       answers = {
-        whatItDoes,
+        whatItDoes: whatItDoes2,
         audience,
         chargesMoney,
         dataHandled,
@@ -24368,13 +25476,14 @@ async function initCommand(flags) {
       }
       brief2 ??= offlineBrief(answers, summary, ctx);
     } else {
-      console.log(briefHandoff());
+      console.log(briefHandoff(inferAnswers(ctx)));
     }
   }
   if (keptBrief) {
     say.ok("Kept your existing product brief (.aura/brief.md).");
   } else if (brief2) {
     writeAuraFile(root, "brief.md", brief2);
+    await setupStep("brief_written");
     if (tty) {
       p.note(brief2.split("\n").slice(0, 24).join("\n") + (brief2.split("\n").length > 24 ? "\n\u2026" : ""), "Product brief draft");
       const choice = unwrap(
@@ -24390,22 +25499,28 @@ async function initCommand(flags) {
     }
     say.ok("Saved the product brief to .aura/brief.md. It gets committed in the first-run PR (aura apply foundation).");
   }
-  writeChanges(root, skillChanges(agents, ["aura"]));
+  writeChanges(root, [...skillChanges(agents, ["aura"]), ...commandChanges(agents)]);
   say.ok(`Installed the Aura skill for ${agents.map((a) => AGENT_LABELS[a]).join(", ")}.`);
-  if (flags.telemetry !== void 0) config2.telemetry = flags.telemetry;
-  else if (tty) {
-    config2.telemetry = unwrap(
-      await p.confirm({ message: "Share your Aura score and which actions you take with the Aura team? (Never code. Off by default.)", initialValue: false })
-    );
+  await setupStep("skill_installed");
+  if (agents.includes("claude") && !inCI() && !process.env.AURA_NO_CLAUDE_PLUGIN) {
+    const plugin = await installClaudePlugin(root);
+    if (plugin === "installed")
+      say.ok(
+        "Added Aura\u2019s slash commands to Claude Code: /aura:scan, /aura:next, /aura:fix and /aura:setup. Restart Claude Code (or run /reload-plugins) to use them."
+      );
+    else say.dim(`To add Aura\u2019s slash commands (/aura:scan, /aura:fix\u2026) to Claude Code, run these two commands:
+  ${manualInstall().join("\n  ")}`);
   }
+  for (const agent of agents.filter((a) => a !== "claude")) say.ok(`Added Aura\u2019s commands for ${AGENT_LABELS[agent]}: ${commandList(agent)}.`);
   saveConfig(root, config2);
   ensureGitignore(root);
-  if (!process.env.CI && !await hasAuraCommand()) {
+  if (!inCI() && !await hasAuraCommand()) {
     if (tty) {
       if (unwrap(await p.confirm({ message: "Install the `aura` command so you can run `aura scan` any time?", initialValue: true }))) {
         const s = spin(true);
         s.start("Installing the aura command");
         const installed = await installAuraCommand();
+        await setupStep(installed.ok ? "command_installed" : "command_install_failed");
         if (installed.ok)
           s.stop(installed.onPath ? "Installed. Run `aura scan` from any folder." : "Installed. Open a new terminal window, then run `aura scan`.");
         else {
@@ -24428,11 +25543,13 @@ ${pc.magenta("\u2726")} ${pc.bold("Give the user the aura command")}`);
     return 0;
   }
   if (tty) p.outro("Running your first scan\u2026");
-  return scanCommand({});
+  const scanned = await scanCommand({});
+  await setupStep("first_scan");
+  return scanned;
 }
 
 // src/commands/summary.ts
-import path20 from "path";
+import path25 from "path";
 async function activity(root, since) {
   const log = await git(root, "log", `--since=${since.toISOString()}`, "--no-merges", "--format=%H%x09%an%x09%s");
   const commits = log.stdout.split("\n").filter(Boolean).slice(0, 300).map((l) => {
@@ -24489,7 +25606,7 @@ async function summaryCommand(flags) {
   const beforeIds = new Set(before ? allFindings(before).map((f) => f.id) : []);
   const nowIds = new Set(allFindings(now).map((f) => f.id));
   const req = {
-    repo: path20.basename(root),
+    repo: path25.basename(root),
     since: since.toISOString(),
     until: until.toISOString(),
     product: productContext(root),
@@ -24537,11 +25654,11 @@ ${body}`);
 import pc4 from "picocolors";
 
 // src/core/update-check.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync16, writeFileSync as writeFileSync8 } from "fs";
-import os6 from "os";
-import path21 from "path";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync22, writeFileSync as writeFileSync9 } from "fs";
+import os8 from "os";
+import path26 from "path";
 var DAY_MS = 24 * 60 * 60 * 1e3;
-var cacheFile = () => path21.join(os6.homedir(), ".aura", "update-check.json");
+var cacheFile = () => path26.join(os8.homedir(), ".aura", "update-check.json");
 function isNewer(a, b) {
   if (!/^\d+\.\d+\.\d+$/.test(a) || !/^\d+\.\d+\.\d+$/.test(b)) return false;
   const [x, y] = [a, b].map((v) => v.split(".").map(Number));
@@ -24561,21 +25678,21 @@ async function newerVersion(opts = {}) {
   const now = opts.now ?? Date.now();
   let latest = null;
   try {
-    const cached2 = JSON.parse(readFileSync16(cacheFile(), "utf8"));
+    const cached2 = JSON.parse(readFileSync22(cacheFile(), "utf8"));
     if (now - cached2.checkedAt < DAY_MS) latest = cached2.latest;
     else throw new Error("stale");
   } catch {
     latest = await (opts.fetchLatest ?? fetchLatest)();
     try {
-      mkdirSync6(path21.dirname(cacheFile()), { recursive: true });
-      writeFileSync8(cacheFile(), JSON.stringify({ checkedAt: now, latest }));
+      mkdirSync7(path26.dirname(cacheFile()), { recursive: true });
+      writeFileSync9(cacheFile(), JSON.stringify({ checkedAt: now, latest }));
     } catch {
     }
   }
   return latest && isNewer(latest, opts.current ?? AURA_VERSION) ? latest : null;
 }
 function startUpdateCheck() {
-  if (!process.stdout.isTTY || process.env.CI || process.env.AURA_NO_UPDATE_CHECK) return Promise.resolve(null);
+  if (!process.stdout.isTTY || inCI() || runningAgent() || process.env.AURA_NO_UPDATE_CHECK) return Promise.resolve(null);
   return newerVersion().catch(() => null);
 }
 function updateNotice(latest, argv1 = process.argv[1] ?? "") {
@@ -24601,6 +25718,12 @@ function action(fn) {
       say.error(err.message);
       if (process.env.AURA_DEBUG) console.error(err);
       process.exitCode = 1;
+      const command = args.at(-1) instanceof Command ? args.at(-1).name() : "unknown";
+      try {
+        const root = await findRepoRoot();
+        await recordUsage(root, loadConfig(root), { event: "error", command, errorType: errorKind(err) });
+      } catch {
+      }
     }
     const latest = await update;
     if (latest) console.error(pc4.dim(`