getaura 0.1.7 → 0.1.9

package/dist/index.js

@@ -9,8 +9,8 @@ var __export = (target, all) => {
 import { Command, Option } from "commander";
 
 // src/commands/apply.ts
-import { existsSync as existsSync16, rmSync as rmSync6 } from "fs";
-import path18 from "path";
+import { existsSync as existsSync19, rmSync as rmSync6 } from "fs";
+import path20 from "path";
 
 // src/core/agents.ts
 var AGENT_LAYOUT = {
@@ -1009,10 +1009,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path25) {
-  if (!path25)
+function getElementAtPath(obj, path27) {
+  if (!path27)
     return obj;
-  return path25.reduce((acc, key) => acc?.[key], obj);
+  return path27.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -1352,11 +1352,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path25, issues) {
+function prefixIssues(path27, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path25);
+    iss.path.unshift(path27);
     return iss;
   });
 }
@@ -1806,16 +1806,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path25 = []) => {
+  const processError = (error63, path27 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path25, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path27, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path25, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path27, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path25, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path27, ...issue2.path]);
       } else {
-        const fullpath = [...path25, ...issue2.path];
+        const fullpath = [...path27, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -1854,17 +1854,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path25 = []) => {
+  const processError = (error63, path27 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path25, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path27, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path25, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path27, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path25, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path27, ...issue2.path]);
       } else {
-        const fullpath = [...path25, ...issue2.path];
+        const fullpath = [...path27, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -1903,8 +1903,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path25 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path25) {
+  const path27 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path27) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -2038,18 +2038,18 @@ var validateAsync = async (schema, value, _ctx) => {
   return result.issues.length === 0;
 };
 var _encode = (_Err) => {
-  const parse3 = _parse(_Err);
+  const parse5 = _parse(_Err);
   const fn = (schema, value, _ctx, _params) => {
     const ctx = _ctx ? { ..._ctx, direction: "backward" } : { direction: "backward" };
-    return parse3(schema, value, ctx, finalizeParams(fn, _params));
+    return parse5(schema, value, ctx, finalizeParams(fn, _params));
   };
   return fn;
 };
 var encode = /* @__PURE__ */ _encode($ZodRealError);
 var _decode = (_Err) => {
-  const parse3 = _parse(_Err);
+  const parse5 = _parse(_Err);
   const fn = (schema, value, _ctx, _params) => {
-    return parse3(schema, value, _ctx, finalizeParams(fn, _params));
+    return parse5(schema, value, _ctx, finalizeParams(fn, _params));
   };
   return fn;
 };
@@ -19006,13 +19006,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path25 = ref.slice(1).split("/").filter(Boolean);
-  if (path25.length === 0) {
+  const path27 = ref.slice(1).split("/").filter(Boolean);
+  if (path27.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path25[0] === defsKey) {
-    const key = path25[1] === void 0 ? void 0 : decodeJSONPointerSegment(path25[1]);
+  if (path27[0] === defsKey) {
+    const key = path27[1] === void 0 ? void 0 : decodeJSONPointerSegment(path27[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -19975,6 +19975,7 @@ var FIX_OUTCOMES = [
   "cancelled",
   "task_written",
   "shown",
+  "settings_changed",
   "merged",
   "closed",
   "resolved",
@@ -20001,7 +20002,7 @@ var TelemetryRequest = external_exports.object({
   actionId: external_exports.string().regex(/^[a-z0-9-]{1,80}$/).optional(),
   step: external_exports.enum(SETUP_STEPS).optional(),
   outcome: external_exports.enum(FIX_OUTCOMES).optional(),
-  delivery: external_exports.enum(["pr", "agent-fix", "agent-task", "guide", "checklist"]).optional(),
+  delivery: external_exports.enum(["pr", "agent-fix", "agent-task", "guide", "checklist", "settings"]).optional(),
   /** Whether the user picked it from the next-steps checklist or ran the command. */
   via: external_exports.enum(["checklist", "command"]).optional(),
   durationMs: external_exports.number().int().nonnegative().max(864e5).optional(),
@@ -20077,23 +20078,9 @@ function grade(score) {
   return { label: "Generational aura debt", sentence: "You have generational aura debt", color: "red" };
 }
 
-// src/templates.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
-import path4 from "path";
-
-// src/core/config.ts
-import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
-import os from "os";
-import path2 from "path";
-
-// src/core/repo.ts
-import { existsSync, readdirSync, readFileSync, statSync } from "fs";
-import path from "path";
-import { fileURLToPath } from "url";
-
 // src/core/exec.ts
 import { spawn, spawnSync } from "child_process";
-var WINDOWS_PROGRAMS = /* @__PURE__ */ new Set(["git", "gh", "node", "tar", "where"]);
+var WINDOWS_PROGRAMS = /* @__PURE__ */ new Set(["git", "gh", "node", "tar", "where", "powershell"]);
 function quoteForCmd(arg) {
   return /^[\w@%+=:,./\\-]+$/.test(arg) ? arg : `"${arg.replace(/"/g, '\\"')}"`;
 }
@@ -20139,7 +20126,14 @@ async function commandExists(cmd) {
   return probe.code === 0;
 }
 
+// src/core/git.ts
+import { mkdirSync, rmSync, writeFileSync } from "fs";
+import path2 from "path";
+
 // src/core/repo.ts
+import { existsSync, readdirSync, readFileSync, statSync } from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
 var AURA_DIR = ".aura";
 var ALWAYS_IGNORED = ["node_modules", ".next", ".git", "dist", "build", "out", ".vercel", ".turbo", "coverage", ".aura"];
 async function findRepoRoot(cwd = process.cwd()) {
@@ -20204,7 +20198,558 @@ var SOURCE_EXT = /\.(?:[cm]?[jt]sx?)$/;
 var isSourceFile = (f) => SOURCE_EXT.test(f) && !f.endsWith(".d.ts");
 var isTestFile = (f) => /(?:^|\/)(?:__tests__|tests?|e2e)\/|\.(?:test|spec)\.[cm]?[jt]sx?$/.test(f);
 
+// src/core/git.ts
+async function git(root, ...args) {
+  return run("git", args, { cwd: root });
+}
+function ghInstallHint(platform = process.platform) {
+  const how = platform === "win32" ? "Install it with `winget install --id GitHub.cli`" : platform === "darwin" ? "Install it with `brew install gh` (or download it from https://cli.github.com)" : "Install it from https://cli.github.com";
+  return `${how}, open a new terminal, then run \`gh auth login\`.`;
+}
+async function ghStatus(root) {
+  const v = await run("gh", ["--version"]);
+  if (v.code !== 0) return { installed: false, authed: false, hasRemote: false };
+  const auth = await run("gh", ["auth", "status"], { cwd: root });
+  const remote = await git(root, "remote", "get-url", "origin");
+  return { installed: true, authed: auth.code === 0, hasRemote: remote.code === 0 && /github\.com/.test(remote.stdout) };
+}
+var AURA_OWNED = /^(?:\.aura\/|\.claude\/skills\/aura\/|\.agents\/skills\/aura(?:-(?:scan|next|fix|setup))?\/|\.cursor\/commands\/aura-[a-z]+\.md$|\.pi\/prompts\/aura-[a-z]+\.md$|\.claude\/settings\.json$)/;
+async function dirtyFiles(root) {
+  const r = await git(root, "status", "--porcelain", "-uall");
+  return r.stdout.split("\n").filter(Boolean).map((l) => l.slice(3).replace(/^"|"$/g, "").split(" -> ").pop()).filter((f) => !AURA_OWNED.test(f));
+}
+async function currentBranch(root) {
+  return (await git(root, "rev-parse", "--abbrev-ref", "HEAD")).stdout.trim();
+}
+async function freeBranchName(root, base) {
+  for (let i = 1; i < 50; i++) {
+    const name = i === 1 ? base : `${base}-${i}`;
+    const local = await git(root, "rev-parse", "--verify", "--quiet", `refs/heads/${name}`);
+    const remote = await git(root, "ls-remote", "--exit-code", "--heads", "origin", name);
+    if (local.code !== 0 && remote.code !== 0) return name;
+  }
+  return `${base}-${Date.now()}`;
+}
+function writeChanges(root, changes) {
+  for (const c of changes) {
+    const full = path2.join(root, c.path);
+    if (!isInside(root, full)) throw new Error(`Refusing to write outside the repo: ${c.path}`);
+    if (c.content === null) rmSync(full, { force: true });
+    else {
+      mkdirSync(path2.dirname(full), { recursive: true });
+      writeFileSync(full, c.content);
+    }
+  }
+}
+async function commitPushPr(root, opts) {
+  const commit = await git(root, "commit", "-m", opts.title, "-m", "Opened by Aura (https://github.com/JohnFazio1/aura).");
+  const base = { branch: opts.branch, url: null };
+  if (commit.code !== 0) {
+    const out = commit.stderr || commit.stdout;
+    const error62 = /tell me who you are|user\.email/i.test(out) ? 'git doesn\u2019t know your name and email yet. Run these two commands:\n  git config --global user.name "Your Name"\n  git config --global user.email "you@example.com"' : out;
+    return { ...base, committed: false, pushed: false, error: error62 };
+  }
+  if (!opts.openPr) return { ...base, committed: true, pushed: false };
+  const push = await git(root, "push", "-u", "origin", opts.branch);
+  if (push.code !== 0) return { ...base, committed: true, pushed: false, error: push.stderr };
+  const pr = await run("gh", ["pr", "create", "--base", opts.base, "--head", opts.branch, "--title", opts.title, "--body-file", "-"], {
+    cwd: root,
+    input: opts.body
+  });
+  if (pr.code !== 0) return { ...base, committed: true, pushed: true, error: pr.stderr };
+  return { ...base, url: pr.stdout.trim().split("\n").pop() ?? null, committed: true, pushed: true };
+}
+
+// src/connectors/github.ts
+var PAID_SECRETS = "needs GitHub Secret Protection (a paid add-on) on private repositories";
+var PAID_RULES = "needs a paid GitHub plan (Pro is about $4/month) on private repositories";
+var PUBLIC_ONLY = "only available on public repositories";
+var RULESET_NAME = "Protect main (Aura)";
+var parse3 = (r) => {
+  try {
+    return JSON.parse(r.stdout);
+  } catch {
+    return null;
+  }
+};
+var needsUpgrade = (r) => /Upgrade to GitHub Pro|HTTP 403|not available|Advanced Security/i.test(r.stderr + r.stdout);
+var done = (r) => r.code === 0 ? { ok: true } : { ok: false };
+async function ciChecks(ctx) {
+  const r = await ctx.gh([
+    "api",
+    `repos/${ctx.repo}/commits/${ctx.defaultBranch}/check-runs`,
+    "--jq",
+    '.check_runs[] | select(.app.slug == "github-actions") | .name'
+  ]);
+  return r.code === 0 ? [
+    ...new Set(
+      r.stdout.split("\n").map((s) => s.trim()).filter(Boolean)
+    )
+  ] : [];
+}
+function protectMainRuleset(checks) {
+  return {
+    name: RULESET_NAME,
+    target: "branch",
+    enforcement: "active",
+    conditions: { ref_name: { include: ["~DEFAULT_BRANCH"], exclude: [] } },
+    rules: [
+      { type: "deletion" },
+      { type: "non_fast_forward" },
+      {
+        // No approvals required, so someone working alone can still merge their own pull requests.
+        type: "pull_request",
+        parameters: {
+          required_approving_review_count: 0,
+          dismiss_stale_reviews_on_push: false,
+          require_code_owner_review: false,
+          require_last_push_approval: false,
+          required_review_thread_resolution: false
+        }
+      },
+      ...checks.length ? [
+        {
+          type: "required_status_checks",
+          parameters: { strict_required_status_checks_policy: false, required_status_checks: checks.map((context) => ({ context })) }
+        }
+      ] : []
+    ]
+  };
+}
+var secretState = (key) => async (ctx) => {
+  const security = parse3(await ctx.get(`repos/${ctx.repo}`))?.security_and_analysis;
+  if (security?.[key]?.status === "enabled") return { state: "on" };
+  return security?.[key] || !ctx.isPrivate ? { state: "off" } : { state: "unavailable", why: PAID_SECRETS };
+};
+var enableSecret = (key) => async (ctx) => {
+  const r = await ctx.gh(
+    ["api", "-X", "PATCH", `repos/${ctx.repo}`, "--input", "-"],
+    JSON.stringify({ security_and_analysis: { [key]: { status: "enabled" } } })
+  );
+  return r.code === 0 ? { ok: true } : { ok: false, unavailable: ctx.isPrivate && needsUpgrade(r) ? PAID_SECRETS : void 0 };
+};
+var github = {
+  id: "github",
+  name: "GitHub",
+  actionId: "github-security",
+  // Offered for every repo; connecting finds out whether it's on GitHub.
+  detect: () => true,
+  async connect(root, fake) {
+    const cli = fake;
+    const gh = cli ?? ((args, input2) => run("gh", args, { cwd: root, input: input2, timeoutMs: 3e4 }));
+    if (!cli) {
+      const status = await ghStatus(root);
+      if (!status.installed) return { ok: false, problem: `The GitHub CLI isn\u2019t installed. ${ghInstallHint()}`, errorType: "CliNotInstalled" };
+      if (!status.authed) return { ok: false, problem: "The GitHub CLI isn\u2019t signed in. Run `gh auth login`, then try again.", errorType: "CliNotSignedIn" };
+      if (!status.hasRemote)
+        return { ok: false, problem: "This repo isn\u2019t on GitHub yet. Push it to GitHub first, for example with `gh repo create`.", errorType: "NoProject" };
+    }
+    const info = parse3(await gh(["repo", "view", "--json", "nameWithOwner,isPrivate,defaultBranchRef,viewerPermission"]));
+    if (!info?.nameWithOwner) return { ok: false, problem: "Couldn\u2019t read this repo from GitHub. Check `gh repo view` works here.", errorType: "NoProject" };
+    if (info.viewerPermission !== "ADMIN")
+      return {
+        ok: false,
+        problem: `Changing these settings needs admin access to ${info.nameWithOwner}. Ask the repo\u2019s owner to run \`aura apply github-security\`.`,
+        errorType: "NotAdmin"
+      };
+    const cache = /* @__PURE__ */ new Map();
+    const ctx = {
+      repo: info.nameWithOwner,
+      isPrivate: Boolean(info.isPrivate),
+      defaultBranch: info.defaultBranchRef?.name || "main",
+      gh,
+      get: (path27) => {
+        if (!cache.has(path27)) cache.set(path27, gh(["api", path27]));
+        return cache.get(path27);
+      }
+    };
+    return { ok: true, ctx, target: `${ctx.repo} ${ctx.isPrivate ? "(private)" : "(public)"}` };
+  },
+  settings: [
+    {
+      id: "dependabot-alerts",
+      label: "Dependabot alerts (warns about vulnerable packages)",
+      impact: "GitHub emails you when a package your app uses has a known security hole.",
+      read: async (ctx) => (await ctx.get(`repos/${ctx.repo}/vulnerability-alerts`)).code === 0 ? { state: "on" } : { state: "off" },
+      enable: async (ctx) => done(await ctx.gh(["api", "-X", "PUT", `repos/${ctx.repo}/vulnerability-alerts`]))
+    },
+    {
+      id: "dependabot-fixes",
+      label: "Dependabot security fixes (opens PRs to update them)",
+      impact: "GitHub opens pull requests that update vulnerable packages. Nothing merges without you.",
+      read: async (ctx) => parse3(await ctx.get(`repos/${ctx.repo}/automated-security-fixes`))?.enabled ? { state: "on" } : { state: "off" },
+      enable: async (ctx) => done(await ctx.gh(["api", "-X", "PUT", `repos/${ctx.repo}/automated-security-fixes`]))
+    },
+    {
+      id: "secret-scanning",
+      label: "Secret scanning (finds keys pushed to GitHub)",
+      impact: "GitHub alerts you when a key or password is pushed to the repo.",
+      read: secretState("secret_scanning"),
+      enable: enableSecret("secret_scanning")
+    },
+    {
+      id: "push-protection",
+      label: "Push protection (blocks pushes that contain a key)",
+      impact: "A push that contains a key is refused until you remove it.",
+      read: secretState("secret_scanning_push_protection"),
+      enable: enableSecret("secret_scanning_push_protection")
+    },
+    {
+      id: "private-reporting",
+      label: "Private vulnerability reporting",
+      impact: "Security researchers can report a problem to you privately instead of in a public issue.",
+      read: async (ctx) => ctx.isPrivate ? { state: "unavailable", why: PUBLIC_ONLY } : parse3(await ctx.get(`repos/${ctx.repo}/private-vulnerability-reporting`))?.enabled ? { state: "on" } : { state: "off" },
+      enable: async (ctx) => done(await ctx.gh(["api", "-X", "PUT", `repos/${ctx.repo}/private-vulnerability-reporting`]))
+    },
+    {
+      id: "protect-main",
+      label: "Protect the main branch (pull requests and passing checks required, no force pushes or deletion)",
+      impact: "You can\u2019t push straight to main any more: changes go through pull requests (you can still merge your own) once the checks pass.",
+      async read(ctx) {
+        const rules = parse3(await ctx.get(`repos/${ctx.repo}/rules/branches/${ctx.defaultBranch}`));
+        const protection = await ctx.get(`repos/${ctx.repo}/branches/${ctx.defaultBranch}/protection`);
+        if (Array.isArray(rules) && rules.some((r) => r.type === "pull_request") || protection.code === 0) return { state: "on" };
+        if (ctx.isPrivate && /Upgrade to GitHub Pro/i.test(protection.stderr)) return { state: "unavailable", why: PAID_RULES };
+        return { state: "off" };
+      },
+      async enable(ctx) {
+        const r = await ctx.gh(["api", "-X", "POST", `repos/${ctx.repo}/rulesets`, "--input", "-"], JSON.stringify(protectMainRuleset(await ciChecks(ctx))));
+        return r.code === 0 ? { ok: true } : { ok: false, unavailable: ctx.isPrivate && needsUpgrade(r) ? PAID_RULES : void 0 };
+      }
+    }
+  ],
+  async explain(ctx, toTurnOn) {
+    if (!toTurnOn.includes("protect-main")) return [];
+    const checks = await ciChecks(ctx);
+    return checks.length ? [`Pull requests to main will need these checks to pass: ${checks.join(", ")}.`] : [];
+  },
+  async leftForYou(ctx, results) {
+    const left = ["Turn on two-factor login for your GitHub account: https://github.com/settings/security"];
+    const r = await ctx.gh(["api", `repos/${ctx.repo}/collaborators`, "--jq", '.[] | "\\(.login) (\\(.role_name))"']);
+    const people = r.code === 0 ? r.stdout.split("\n").filter(Boolean) : [];
+    if (people.length)
+      left.push(`People with access: ${people.join(", ")}. Remove anyone who no longer needs it: https://github.com/${ctx.repo}/settings/access`);
+    if (results.some((x) => x.id === "secret-scanning" && x.result === "unavailable"))
+      left.push("Aura\u2019s own secret check still runs on every `aura scan`, and before each commit if you add the pre-commit hook.");
+    return left;
+  }
+};
+
+// src/connectors/supabase.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import os from "os";
+import path3 from "path";
+var TOKEN = /^sbp_(?:oauth_|v0_)?[a-f0-9]{40}$/;
+function decodeToken(raw) {
+  const value = raw?.trim() ?? "";
+  const token = value.startsWith("go-keyring-base64:") ? Buffer.from(value.slice("go-keyring-base64:".length), "base64").toString("utf8").trim() : value;
+  return TOKEN.test(token) ? token : null;
+}
+function windowsCredentialScript(target) {
+  return `
+$sig = @'
+[DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)] public static extern bool CredRead(string target, int type, int flags, out IntPtr cred);
+[DllImport("advapi32.dll")] public static extern void CredFree(IntPtr cred);
+[StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)] public struct CREDENTIAL { public int Flags; public int Type; public string TargetName; public string Comment; public long LastWritten; public int CredentialBlobSize; public IntPtr CredentialBlob; public int Persist; public int AttributeCount; public IntPtr Attributes; public string TargetAlias; public string UserName; }
+'@
+Add-Type -MemberDefinition $sig -Namespace AuraCred -Name Win
+$p = [IntPtr]::Zero
+if ([AuraCred.Win]::CredRead('${target}', 1, 0, [ref]$p)) {
+  $c = [Runtime.InteropServices.Marshal]::PtrToStructure($p, [type][AuraCred.Win+CREDENTIAL])
+  $b = New-Object byte[] $c.CredentialBlobSize
+  [Runtime.InteropServices.Marshal]::Copy($c.CredentialBlob, $b, 0, $b.Length)
+  [Text.Encoding]::UTF8.GetString($b)
+  [AuraCred.Win]::CredFree($p)
+}`;
+}
+async function supabaseToken() {
+  const fromEnv = decodeToken(process.env.SUPABASE_ACCESS_TOKEN);
+  if (fromEnv) return fromEnv;
+  const home = path3.join(os.homedir(), ".supabase");
+  const profile = process.env.SUPABASE_PROFILE || (existsSync2(path3.join(home, "profile")) ? readFileSync2(path3.join(home, "profile"), "utf8").trim() : "") || "supabase";
+  for (const account of [profile, "access-token"]) {
+    const r = process.platform === "darwin" ? await run("security", ["find-generic-password", "-s", "Supabase CLI", "-a", account, "-w"]) : process.platform === "win32" ? await run("powershell", [
+      "-NoProfile",
+      "-NonInteractive",
+      "-EncodedCommand",
+      Buffer.from(windowsCredentialScript(`Supabase CLI:${account}`), "utf16le").toString("base64")
+    ]) : await run("secret-tool", ["lookup", "service", "Supabase CLI", "username", account]);
+    const token = r.code === 0 ? decodeToken(r.stdout) : null;
+    if (token) return token;
+  }
+  const file2 = path3.join(home, "access-token");
+  return existsSync2(file2) ? decodeToken(readFileSync2(file2, "utf8")) : null;
+}
+var realApi = (token) => async (method, endpoint, body) => {
+  const res = await fetch(`https://api.supabase.com${endpoint}`, {
+    method,
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+    body: body ? JSON.stringify(body) : void 0,
+    signal: AbortSignal.timeout(3e4)
+  });
+  return { status: res.status, json: await res.json().catch(() => null) };
+};
+var PRO_ONLY = "needs a paid Supabase plan (Pro or higher)";
+var authConfig = (ctx) => ctx.get(`/v1/projects/${ctx.ref}/config/auth`);
+async function patchAuth(ctx, body) {
+  const r = await ctx.api("PATCH", `/v1/projects/${ctx.ref}/config/auth`, body);
+  if (r.status >= 200 && r.status < 300) return { ok: true };
+  return { ok: false, unavailable: /plan|pro\b|upgrade|paid/i.test(JSON.stringify(r.json ?? "")) ? PRO_ONLY : void 0 };
+}
+var authFlag = (check2) => async (ctx) => check2(await authConfig(ctx) ?? {}) ? { state: "on" } : { state: "off" };
+async function advisorProblems(ctx) {
+  const lints = (await ctx.get(`/v1/projects/${ctx.ref}/advisors/security`))?.lints ?? [];
+  return lints.filter((l) => l.level === "ERROR" || l.level === "WARN");
+}
+var supabase = {
+  id: "supabase",
+  name: "Supabase",
+  actionId: "supabase-security",
+  detect: (scan) => scan.stack.services.includes("Supabase"),
+  async connect(root, fake) {
+    let api = fake;
+    if (!api) {
+      const token = await supabaseToken();
+      if (!token)
+        return {
+          ok: false,
+          problem: "Aura couldn\u2019t find your Supabase login. Install the Supabase CLI and run `supabase login`, then try again.",
+          errorType: "CliNotSignedIn"
+        };
+      api = realApi(token);
+    }
+    const refFile = path3.join(root, "supabase", ".temp", "project-ref");
+    const ref = process.env.SUPABASE_PROJECT_ID || (existsSync2(refFile) ? readFileSync2(refFile, "utf8").trim() : "");
+    if (!/^[a-z]{20}$/.test(ref))
+      return { ok: false, problem: "This folder isn\u2019t linked to a Supabase project yet. Run `supabase link`, then try again.", errorType: "NoProject" };
+    const cache = /* @__PURE__ */ new Map();
+    const call = api;
+    const ctx = {
+      ref,
+      api: call,
+      get: (endpoint) => {
+        if (!cache.has(endpoint))
+          cache.set(
+            endpoint,
+            call("GET", endpoint).then((r) => r.status === 200 ? r.json : null)
+          );
+        return cache.get(endpoint);
+      }
+    };
+    const read2 = await call("GET", `/v1/projects/${ref}`);
+    if (read2.status === 401)
+      return { ok: false, problem: "Your Supabase login has expired. Run `npx supabase login`, then try again.", errorType: "CliNotSignedIn" };
+    if (read2.status !== 200 || !read2.json?.name)
+      return {
+        ok: false,
+        // Projects created through Vercel's Supabase integration live in a Supabase account linked to Vercel.
+        problem: [
+          `The Supabase account you\u2019re signed in to can\u2019t open this project (${ref}).`,
+          "If you created the database through Vercel: in Vercel open Storage, click the database, then Open in Supabase. In that same browser, run `npx supabase login` and approve it. Then try again.",
+          "Otherwise run `npx supabase login` with the Supabase account that owns the project."
+        ].join("\n  "),
+        errorType: "NoAccess"
+      };
+    const project = read2.json;
+    return { ok: true, ctx, target: project.name };
+  },
+  settings: [
+    {
+      id: "email-confirmation",
+      label: "Email confirmation (new users confirm their email before signing in)",
+      impact: "New users must click a link in an email before they can sign in. People already signed up aren\u2019t affected.",
+      read: authFlag((c) => c.mailer_autoconfirm === false),
+      enable: (ctx) => patchAuth(ctx, { mailer_autoconfirm: false })
+    },
+    {
+      id: "password-length",
+      label: "Passwords of at least 8 characters",
+      impact: "New and changed passwords must be at least 8 characters. Existing passwords keep working.",
+      read: authFlag((c) => (c.password_min_length ?? 0) >= 8),
+      enable: (ctx) => patchAuth(ctx, { password_min_length: 8 })
+    },
+    {
+      id: "leaked-passwords",
+      label: "Leaked password protection (refuses passwords found in data breaches)",
+      impact: "Passwords that appear in known data breaches are refused when someone signs up or changes their password.",
+      read: authFlag((c) => c.password_hibp_enabled === true),
+      enable: (ctx) => patchAuth(ctx, { password_hibp_enabled: true })
+    },
+    {
+      id: "app-mfa",
+      label: "Authenticator app sign-in for your users (two-factor, optional for them)",
+      impact: "Your users can protect their account with an authenticator app. It stays optional, and your app needs a screen for it before anyone can use it.",
+      read: authFlag((c) => c.mfa_totp_enroll_enabled === true && c.mfa_totp_verify_enabled === true),
+      enable: (ctx) => patchAuth(ctx, { mfa_totp_enroll_enabled: true, mfa_totp_verify_enabled: true })
+    },
+    {
+      id: "secure-email-change",
+      label: "Secure email change (both the old and new address confirm)",
+      impact: "Changing an account\u2019s email needs confirming from both the old and the new address, so a stolen session can\u2019t take over the account.",
+      read: authFlag((c) => c.mailer_secure_email_change_enabled === true),
+      enable: (ctx) => patchAuth(ctx, { mailer_secure_email_change_enabled: true })
+    },
+    {
+      id: "database-encryption",
+      label: "Encrypted database connections only",
+      impact: "Direct connections to your database must be encrypted. Turning this on restarts the database for a few seconds.",
+      read: async (ctx) => (await ctx.get(`/v1/projects/${ctx.ref}/ssl-enforcement`))?.currentConfig?.database === true ? { state: "on" } : { state: "off" },
+      async enable(ctx) {
+        const r = await ctx.api("PUT", `/v1/projects/${ctx.ref}/ssl-enforcement`, { requestedConfig: { database: true } });
+        return r.status >= 200 && r.status < 300 ? { ok: true } : { ok: false };
+      }
+    },
+    {
+      id: "security-advisor",
+      label: "No problems in Supabase\u2019s security advisor",
+      impact: "Nothing changes on its own: these are fixed in your database code, and Aura lists them below.",
+      read: async (ctx) => (await advisorProblems(ctx)).length ? { state: "off" } : { state: "on" },
+      enable: async () => ({ ok: false, unavailable: "fixed in your database code (see Left for you)" })
+    }
+  ],
+  async leftForYou(ctx, results) {
+    const left = [];
+    const problems = await advisorProblems(ctx);
+    if (problems.length) {
+      const titles = [...new Set(problems.map((p2) => p2.title ?? p2.name ?? "Security problem"))].slice(0, 5);
+      left.push(
+        `Supabase\u2019s security advisor found ${problems.length} problem(s): ${titles.join("; ")}. Fix them in a migration (\`aura fix turn-on-rls\` covers missing row-level security), or see https://supabase.com/dashboard/project/${ctx.ref}/advisors/security`
+      );
+    }
+    if (results.some((r) => r.id === "leaked-passwords" && r.result === "unavailable"))
+      left.push("Leaked password protection needs Supabase Pro. Until then, the 8-character minimum helps.");
+    left.push("Turn on two-factor login for your Supabase account: Supabase dashboard \u2192 Account \u2192 Security.");
+    return left;
+  }
+};
+
+// src/connectors/vercel.ts
+import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
+import path4 from "path";
+var PUBLIC_PREFIX = /^(?:NEXT_PUBLIC_|VITE_|EXPO_PUBLIC_|PUBLIC_)/;
+var SECRET_NAME = /SECRET|SERVICE_ROLE|PRIVATE|PASSWORD|_TOKEN$|API_KEY$/;
+var parse4 = (r) => {
+  try {
+    return r.code === 0 ? JSON.parse(r.stdout) : null;
+  } catch {
+    return null;
+  }
+};
+async function exposedSecrets(ctx) {
+  const envs = (await ctx.get(`/v10/projects/${ctx.projectId}/env?decrypt=true${ctx.team.replace("?", "&")}`))?.envs ?? [];
+  return [...new Set(envs.filter((e) => PUBLIC_PREFIX.test(e.key) && (SECRET_NAME.test(e.key) || e.value && containsSecret(e.value))).map((e) => e.key))];
+}
+async function patchProject(ctx, body) {
+  const r = await ctx.vercel(["api", `/v9/projects/${ctx.projectId}${ctx.team}`, "-X", "PATCH", "--input", "-", "--raw"], JSON.stringify(body));
+  if (r.code === 0) return { ok: true };
+  return { ok: false, unavailable: /plan|upgrade|pro\b|enterprise/i.test(r.stderr + r.stdout) ? "not available on your Vercel plan" : void 0 };
+}
+var vercel = {
+  id: "vercel",
+  name: "Vercel",
+  actionId: "vercel-security",
+  detect: (scan) => scan.stack.services.includes("Vercel"),
+  async connect(root, fake) {
+    const cli = fake ?? ((args, input2) => run("vercel", args, { cwd: root, input: input2, timeoutMs: 6e4 }));
+    if (!fake) {
+      if (!await commandExists("vercel"))
+        return {
+          ok: false,
+          problem: "The Vercel CLI isn\u2019t installed. Install it with `npm install -g vercel`, then run `vercel login`.",
+          errorType: "CliNotInstalled"
+        };
+      if ((await cli(["whoami"])).code !== 0)
+        return { ok: false, problem: "The Vercel CLI isn\u2019t signed in. Run `vercel login`, then try again.", errorType: "CliNotSignedIn" };
+    }
+    const linked = [path4.join(root, ".vercel", "project.json"), ...["apps", "packages"].flatMap((d) => findLinks(path4.join(root, d)))].find(
+      (f) => existsSync3(f)
+    );
+    let project = null;
+    try {
+      project = linked ? JSON.parse(readFileSync3(linked, "utf8")) : null;
+    } catch {
+      project = null;
+    }
+    if (!project?.projectId)
+      return { ok: false, problem: "This folder isn\u2019t linked to a Vercel project yet. Run `vercel link`, then try again.", errorType: "NoProject" };
+    const cache = /* @__PURE__ */ new Map();
+    const ctx = {
+      projectId: project.projectId,
+      team: project.orgId?.startsWith("team_") ? `?teamId=${project.orgId}` : "",
+      vercel: cli,
+      get: (endpoint) => {
+        if (!cache.has(endpoint)) cache.set(endpoint, cli(["api", endpoint, "--raw"]).then(parse4));
+        return cache.get(endpoint);
+      }
+    };
+    const name = (await ctx.get(`/v9/projects/${ctx.projectId}${ctx.team}`))?.name;
+    if (!name)
+      return { ok: false, problem: "Couldn\u2019t read this project from Vercel. Check you have access to it with `vercel project ls`.", errorType: "NoProject" };
+    return { ok: true, ctx, target: name };
+  },
+  settings: [
+    {
+      id: "preview-protection",
+      label: "Protect preview links (only your Vercel team can open them)",
+      impact: "Preview and deployment links need a Vercel login to open. Your live site on your own domain stays public.",
+      read: async (ctx) => (await ctx.get(`/v9/projects/${ctx.projectId}${ctx.team}`))?.ssoProtection ? { state: "on" } : { state: "off" },
+      enable: (ctx) => patchProject(ctx, { ssoProtection: { deploymentType: "all_except_custom_domains" } })
+    },
+    {
+      id: "git-fork-protection",
+      label: "Fork protection (pull requests from forks don\u2019t deploy automatically)",
+      impact: "A pull request from someone else\u2019s copy of your repo only deploys after you approve it, so it can\u2019t read your settings.",
+      read: async (ctx) => (await ctx.get(`/v9/projects/${ctx.projectId}${ctx.team}`))?.gitForkProtection ? { state: "on" } : { state: "off" },
+      enable: (ctx) => patchProject(ctx, { gitForkProtection: true })
+    },
+    {
+      id: "protected-sourcemaps",
+      label: "Protected source maps (your original code isn\u2019t served to the public)",
+      impact: "Source maps, which reveal your original code, are only served to people signed in to your Vercel team.",
+      read: async (ctx) => (await ctx.get(`/v9/projects/${ctx.projectId}${ctx.team}`))?.protectedSourcemaps ? { state: "on" } : { state: "off" },
+      enable: (ctx) => patchProject(ctx, { protectedSourcemaps: true })
+    },
+    {
+      id: "no-public-secrets",
+      label: "No secret keys in browser-visible settings (NEXT_PUBLIC_\u2026 and similar)",
+      impact: "Nothing changes on its own: Aura can\u2019t move a key for you, and lists what to do below.",
+      read: async (ctx) => (await exposedSecrets(ctx)).length ? { state: "off" } : { state: "on" },
+      enable: async () => ({ ok: false, unavailable: "needs you to move the key (see Left for you)" })
+    }
+  ],
+  async leftForYou(ctx) {
+    const left = [];
+    const exposed = await exposedSecrets(ctx);
+    if (exposed.length)
+      left.push(
+        `These settings are visible to anyone using your site: ${exposed.join(", ")}. Rename each without the public prefix, read it only in server code, then rotate the key in its dashboard (\`aura guide rotate-generic-key\`).`
+      );
+    left.push("Turn on two-factor login for your Vercel account: Vercel \u2192 Account Settings \u2192 Authentication.");
+    return left;
+  }
+};
+function findLinks(dir) {
+  try {
+    return readdirSync2(dir).map((d) => path4.join(dir, d, ".vercel", "project.json"));
+  } catch {
+    return [];
+  }
+}
+
+// src/connectors/index.ts
+var CONNECTORS = [github, supabase, vercel];
+function connectorForAction(actionId) {
+  return CONNECTORS.find((c) => c.actionId === actionId);
+}
+
+// src/templates.ts
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+import path7 from "path";
+
 // src/core/config.ts
+import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
+import os2 from "os";
+import path5 from "path";
 var DEFAULT_CONFIG = {
   version: 1,
   agents: [],
@@ -20213,45 +20758,45 @@ var DEFAULT_CONFIG = {
   ciMaxDrop: 0
 };
 function auraPath(root, ...parts) {
-  return path2.join(root, AURA_DIR, ...parts);
+  return path5.join(root, AURA_DIR, ...parts);
 }
 function ensureAuraDir(root) {
-  mkdirSync(auraPath(root), { recursive: true });
+  mkdirSync2(auraPath(root), { recursive: true });
 }
 function loadConfig(root) {
   const file2 = auraPath(root, "config.json");
-  if (!existsSync2(file2)) return { ...DEFAULT_CONFIG };
+  if (!existsSync4(file2)) return { ...DEFAULT_CONFIG };
   try {
-    return { ...DEFAULT_CONFIG, ...JSON.parse(readFileSync2(file2, "utf8")) };
+    return { ...DEFAULT_CONFIG, ...JSON.parse(readFileSync4(file2, "utf8")) };
   } catch {
     return { ...DEFAULT_CONFIG };
   }
 }
 function saveConfig(root, config2) {
   ensureAuraDir(root);
-  writeFileSync(auraPath(root, "config.json"), JSON.stringify(config2, null, 2) + "\n");
+  writeFileSync2(auraPath(root, "config.json"), JSON.stringify(config2, null, 2) + "\n");
 }
 function writeAuraFile(root, name, content) {
   ensureAuraDir(root);
   const file2 = auraPath(root, name);
-  mkdirSync(path2.dirname(file2), { recursive: true });
-  writeFileSync(file2, content);
+  mkdirSync2(path5.dirname(file2), { recursive: true });
+  writeFileSync2(file2, content);
   return file2;
 }
-var homeAuraDir = () => path2.join(os.homedir(), ".aura");
-var credentialsFile = () => path2.join(homeAuraDir(), "credentials.json");
+var homeAuraDir = () => path5.join(os2.homedir(), ".aura");
+var credentialsFile = () => path5.join(homeAuraDir(), "credentials.json");
 function getApiKey() {
   if (process.env.AURA_KEY) return process.env.AURA_KEY.trim();
   try {
-    const data = JSON.parse(readFileSync2(credentialsFile(), "utf8"));
+    const data = JSON.parse(readFileSync4(credentialsFile(), "utf8"));
     return typeof data.key === "string" ? data.key : null;
   } catch {
     return null;
   }
 }
 function saveApiKey(key) {
-  mkdirSync(homeAuraDir(), { recursive: true });
-  writeFileSync(credentialsFile(), JSON.stringify({ key }, null, 2) + "\n", { mode: 384 });
+  mkdirSync2(homeAuraDir(), { recursive: true });
+  writeFileSync2(credentialsFile(), JSON.stringify({ key }, null, 2) + "\n", { mode: 384 });
   try {
     chmodSync(credentialsFile(), 384);
   } catch {
@@ -20261,7 +20806,7 @@ function getApiUrl(config2) {
   return (process.env.AURA_API_URL || config2?.apiUrl || DEFAULT_API_URL).replace(/\/$/, "");
 }
 function auraBinDir() {
-  return path2.join(homeAuraDir(), "bin");
+  return path5.join(homeAuraDir(), "bin");
 }
 var AURA_GITIGNORE = `# Aura local files: they can describe security weaknesses, so they stay on your machine.
 report.md
@@ -20273,15 +20818,15 @@ tasks/
 `;
 function ensureGitignore(root) {
   const file2 = auraPath(root, ".gitignore");
-  if (existsSync2(file2) && readFileSync2(file2, "utf8") === AURA_GITIGNORE) return false;
+  if (existsSync4(file2) && readFileSync4(file2, "utf8") === AURA_GITIGNORE) return false;
   ensureAuraDir(root);
-  writeFileSync(file2, AURA_GITIGNORE);
+  writeFileSync2(file2, AURA_GITIGNORE);
   return true;
 }
 
 // src/core/stack.ts
-import { existsSync as existsSync3 } from "fs";
-import path3 from "path";
+import { existsSync as existsSync5 } from "fs";
+import path6 from "path";
 function allDeps(pkg) {
   return { ...pkg?.dependencies ?? {}, ...pkg?.devDependencies ?? {} };
 }
@@ -20405,7 +20950,7 @@ function findEnvRefs(files, read2) {
 }
 function detectStack(root, files, pkg, read2) {
   const deps2 = allDeps(pkg);
-  const has = (f) => files.includes(f) || existsSync3(path3.join(root, f));
+  const has = (f) => files.includes(f) || existsSync5(path6.join(root, f));
   const hasDir = (d) => files.some((f) => f.startsWith(`${d}/`));
   let packageManager = null;
   const pmField = pkg?.packageManager?.split("@")[0];
@@ -20430,6 +20975,7 @@ function detectStack(root, files, pkg, read2) {
   }
   if (has("vercel.json") || has(".vercel/project.json")) services.add("Vercel");
   if (hasDir("supabase")) services.add("Supabase");
+  if (has("vercel.json") || has(".vercel/project.json")) services.add("Vercel");
   services.add("GitHub");
   let nextjs = null;
   if (deps2.next) {
@@ -20439,9 +20985,9 @@ function detectStack(root, files, pkg, read2) {
     const pages = hasDir(`${base}pages`);
     nextjs = { version: deps2.next.replace(/^[^\d]*/, ""), router: app && pages ? "both" : app ? "app" : pages ? "pages" : null, srcDir };
   }
-  let supabase = null;
+  let supabase2 = null;
   if (services.has("Supabase")) {
-    supabase = { migrationsDir: hasDir("supabase/migrations") ? "supabase/migrations" : null, hasConfig: has("supabase/config.toml") };
+    supabase2 = { migrationsDir: hasDir("supabase/migrations") ? "supabase/migrations" : null, hasConfig: has("supabase/config.toml") };
   }
   let testRunner = null;
   if (deps2.vitest || files.some((f) => /^vitest\.config\./.test(f))) testRunner = "vitest";
@@ -20456,7 +21002,7 @@ function detectStack(root, files, pkg, read2) {
     frameworks,
     services: [...services].sort(),
     nextjs,
-    supabase,
+    supabase: supabase2,
     typescript: has("tsconfig.json"),
     testRunner,
     envVars,
@@ -20500,7 +21046,7 @@ function pmCommands(pm) {
 // package.json
 var package_default = {
   name: "getaura",
-  version: "0.1.7",
+  version: "0.1.9",
   description: "Aura helps you and your coding agent follow best practices while you vibe code.",
   type: "module",
   bin: {
@@ -20581,19 +21127,19 @@ function fill(text, vars) {
   return text.replace(/\{\{([a-z_]+)\}\}/g, (m, name) => KNOWN.has(name) ? vars[name] ?? "" : m);
 }
 function readTemplate(rel) {
-  return readFileSync3(path4.join(templatesDir(), rel), "utf8");
+  return readFileSync5(path7.join(templatesDir(), rel), "utf8");
 }
 function render(rel, vars) {
   return fill(readTemplate(rel), vars);
 }
 function templateExists(rel) {
-  return existsSync4(path4.join(templatesDir(), rel));
+  return existsSync6(path7.join(templatesDir(), rel));
 }
 function briefSummary(root, pkg) {
-  const fallbackName = pkg?.name ? pkg.name.replace(/[-_]/g, " ").replace(/\b\w/g, (c) => c.toUpperCase()) : path4.basename(root);
+  const fallbackName = pkg?.name ? pkg.name.replace(/[-_]/g, " ").replace(/\b\w/g, (c) => c.toUpperCase()) : path7.basename(root);
   const file2 = auraPath(root, "brief.md");
-  if (!existsSync4(file2)) return { name: fallbackName, summary: pkg?.description ?? "See `.aura/brief.md` once the product brief is added." };
-  const text = readFileSync3(file2, "utf8");
+  if (!existsSync6(file2)) return { name: fallbackName, summary: pkg?.description ?? "See `.aura/brief.md` once the product brief is added." };
+  const text = readFileSync5(file2, "utf8");
   const title = text.match(/^#\s+(.+)$/m)?.[1]?.replace(/[:\-–—]?\s*product brief$/i, "").trim();
   const paragraph = text.split(/\n\s*\n/).map((p2) => p2.trim()).find((p2) => p2 && !p2.startsWith("#") && !p2.startsWith(">") && !p2.startsWith("-") && !p2.startsWith("|") && p2.length > 40) ?? "";
   const sentences = paragraph.replace(/\s+/g, " ").match(/[^.!?]+[.!?]+/g) ?? [paragraph];
@@ -20758,7 +21304,6 @@ var ACTIONS = [
   },
   // Accounts and ownership
   { id: "inventory", title: "Complete the keys and accounts inventory", category: "security", delivery: "checklist", resolves: [] },
-  { id: "github-security", title: "Enable GitHub security features", category: "security", delivery: "guide", resolves: [] },
   { id: "transfer-ownership", title: "Move accounts to a company owner", category: "security", delivery: "guide", resolves: [] }
 ];
 var FOUNDATION_BUNDLE = ["add-brief", "add-agent-rules", "install-skills", "token-efficiency", "add-ci", "add-env-example", "add-aura-workflow"];
@@ -20773,6 +21318,15 @@ function getAction(id) {
     };
   }
   if (/^rotate-[a-z]+-(?:key|token)$/.test(id)) return { id, title: "Rotate an exposed key", category: "security", delivery: "guide", resolves: [] };
+  const connector = connectorForAction(id);
+  if (connector)
+    return {
+      id,
+      title: `Turn on ${connector.name} security features`,
+      category: "security",
+      delivery: "guide",
+      resolves: [`security.${connector.id}-settings`]
+    };
   return ACTIONS.find((a) => a.id === id);
 }
 var CATEGORY_PRIORITY = ["security", "agent-setup", "foundations", "structure"];
@@ -20808,15 +21362,16 @@ function nextSteps(scan, opts = {}) {
     if (!action2) continue;
     const { delivery, fellBack } = effectiveDelivery(action2, scan);
     const worst = fs.map((f) => f.severity).sort((a, b) => SEVERITY_ORDER.indexOf(a) - SEVERITY_ORDER.indexOf(b))[0];
+    const connected = Boolean(connectorForAction(actionId));
     steps.push({
       actionId,
       title: action2.title,
       delivery,
-      effort: EFFORT[delivery],
+      effort: connected ? "one-click" : EFFORT[delivery],
       category: action2.category,
       why: fs[0].why,
       impact: impactOf(scan.checks, action2.resolves),
-      command: commandFor(actionId, delivery),
+      command: connected ? `aura apply ${actionId}` : commandFor(actionId, delivery),
       findingIds: fs.map((f) => f.id),
       fellBack,
       severity: worst
@@ -20841,16 +21396,16 @@ function nextSteps(scan, opts = {}) {
       severity: "critical"
     });
   }
-  if (opts.accounts && !opts.accounts.githubSecurity) {
+  for (const connector of opts.accounts ? CONNECTORS.filter((c) => c.detect(scan) && !opts.accounts.secured[c.id] && !steps.some((s) => s.actionId === c.actionId)) : []) {
     steps.push({
-      actionId: "github-security",
-      title: "Enable GitHub security features",
+      actionId: connector.actionId,
+      title: `Turn on ${connector.name} security features`,
       delivery: "guide",
-      effort: "follow-guide",
+      effort: "one-click",
       category: "security",
-      why: "Branch protection and secret scanning stop mistakes (and leaked keys) before they reach your main branch.",
+      why: `Aura checks ${connector.name}\u2019s security settings and, once you agree, turns on the ones that are off.`,
       impact: 0,
-      command: "aura guide github-security",
+      command: `aura apply ${connector.actionId}`,
       findingIds: [],
       severity: "low"
     });
@@ -20899,12 +21454,12 @@ function nextSteps(scan, opts = {}) {
 }
 
 // src/actions/generators.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
-import path9 from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
+import path12 from "path";
 
 // src/checks/agent-setup.ts
-import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
-import path5 from "path";
+import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync6 } from "fs";
+import path8 from "path";
 
 // src/checks/types.ts
 import { createHash } from "crypto";
@@ -20938,18 +21493,18 @@ function lineOf(text, index) {
 
 // src/checks/agent-setup.ts
 function exists(ctx, file2) {
-  return existsSync5(path5.join(ctx.root, file2));
+  return existsSync7(path8.join(ctx.root, file2));
 }
 function readDisk(ctx, file2) {
   try {
-    return readFileSync4(path5.join(ctx.root, file2), "utf8");
+    return readFileSync6(path8.join(ctx.root, file2), "utf8");
   } catch {
     return "";
   }
 }
 function skillsIn(ctx, dir) {
   try {
-    return readdirSync2(path5.join(ctx.root, dir), { withFileTypes: true }).filter((d) => d.isDirectory() && existsSync5(path5.join(ctx.root, dir, d.name, "SKILL.md"))).map((d) => d.name);
+    return readdirSync3(path8.join(ctx.root, dir), { withFileTypes: true }).filter((d) => d.isDirectory() && existsSync7(path8.join(ctx.root, dir, d.name, "SKILL.md"))).map((d) => d.name);
   } catch {
     return [];
   }
@@ -20966,7 +21521,7 @@ function rulesFileFor(ctx, agent) {
   if (agent === "cursor") {
     if (exists(ctx, ".cursorrules")) return ".cursorrules";
     try {
-      const rules = readdirSync2(path5.join(ctx.root, ".cursor/rules")).filter((f) => /\.mdc?$/.test(f));
+      const rules = readdirSync3(path8.join(ctx.root, ".cursor/rules")).filter((f) => /\.mdc?$/.test(f));
       if (rules.length) return `.cursor/rules/${rules[0]}`;
     } catch {
     }
@@ -21111,7 +21666,7 @@ var brief = {
 var agentChecks = [rulesFile, rulesCurrent, skills, auraSkill, brief];
 
 // src/core/graph.ts
-import path6 from "path";
+import path9 from "path";
 var EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".mts", ".cts"];
 var IMPORT_RE = /(?:import|export)\s+(?:type\s+)?(?:[\w*{}\s,$]+?\s+from\s+)?(['"])([^'"\n]+)\1|import\s*\(\s*(['"])([^'"\n]+)\3\s*\)|require\s*\(\s*(['"])([^'"\n]+)\5\s*\)/g;
 function parseImports(text) {
@@ -21139,7 +21694,7 @@ function readAliases(read2) {
       for (const [key, targets] of Object.entries(json2.compilerOptions?.paths ?? {})) {
         const target = targets[0];
         if (!key.endsWith("/*") || !target?.endsWith("/*")) continue;
-        const resolved = path6.posix.normalize(path6.posix.join(base || ".", target.slice(0, -1)));
+        const resolved = path9.posix.normalize(path9.posix.join(base || ".", target.slice(0, -1)));
         entries.push([key.slice(0, -1), resolved === "." || resolved === "./" ? "" : resolved.replace(/\/?$/, "/")]);
       }
     } catch {
@@ -21150,10 +21705,10 @@ function readAliases(read2) {
 }
 function resolveImport(from, spec, files, aliases) {
   let base = null;
-  if (spec.startsWith(".")) base = path6.posix.normalize(path6.posix.join(path6.posix.dirname(from), spec));
+  if (spec.startsWith(".")) base = path9.posix.normalize(path9.posix.join(path9.posix.dirname(from), spec));
   else {
     const alias = aliases.entries.find(([prefix]) => spec.startsWith(prefix));
-    if (alias) base = path6.posix.normalize(alias[1] + spec.slice(alias[0].length));
+    if (alias) base = path9.posix.normalize(alias[1] + spec.slice(alias[0].length));
   }
   if (base === null) return null;
   const withoutJs = base.replace(/\.(?:js|jsx|mjs|cjs)$/, "");
@@ -21199,14 +21754,14 @@ function unreachableFiles(files, read2, pkgScripts) {
 }
 
 // src/actions/agent-commands.ts
-import { readFileSync as readFileSync5 } from "fs";
-import path7 from "path";
+import { readFileSync as readFileSync7 } from "fs";
+import path10 from "path";
 var AURA_COMMANDS = ["scan", "next", "fix", "setup"];
 function invocation(agent, command) {
   return agent === "claude" ? `/aura:${command}` : agent === "codex" ? `$aura-${command}` : `/aura-${command}`;
 }
 function pluginCommand(command) {
-  const text = readFileSync5(path7.join(path7.dirname(templatesDir()), "plugin", "skills", command, "SKILL.md"), "utf8").replace(/\r\n/g, "\n");
+  const text = readFileSync7(path10.join(path10.dirname(templatesDir()), "plugin", "skills", command, "SKILL.md"), "utf8").replace(/\r\n/g, "\n");
   const [, frontmatter = "", body = ""] = text.match(/^---\n([\s\S]*?)\n---\n+([\s\S]*)$/) ?? [];
   const description = frontmatter.match(/^description: (.+)$/m)?.[1] ?? "";
   return { description, body };
@@ -21251,11 +21806,11 @@ function commandList(agent) {
 }
 
 // src/actions/agent-files.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
-import path8 from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
+import path11 from "path";
 function current(root, file2) {
-  const full = path8.join(root, file2);
-  return existsSync6(full) ? readFileSync6(full, "utf8") : null;
+  const full = path11.join(root, file2);
+  return existsSync8(full) ? readFileSync8(full, "utf8") : null;
 }
 function upsertBlock(existing, body) {
   const block = `${AURA_BLOCK_START}
@@ -21299,8 +21854,8 @@ function skillChanges(agents, names) {
 
 // src/actions/generators.ts
 function read(root, file2) {
-  const full = path9.join(root, file2);
-  return existsSync7(full) ? readFileSync7(full, "utf8") : null;
+  const full = path12.join(root, file2);
+  return existsSync9(full) ? readFileSync9(full, "utf8") : null;
 }
 function withScripts(root, scripts, overwrite = false) {
   const text = read(root, "package.json");
@@ -21321,13 +21876,13 @@ function findingMeta(scan, checkId, key) {
   return scan.checks.find((c) => c.checkId === checkId)?.findings[0]?.meta?.[key];
 }
 var addBrief = ({ root }) => {
-  const brief2 = BRIEF_PATHS.find((f) => existsSync7(path9.join(root, f)));
+  const brief2 = BRIEF_PATHS.find((f) => existsSync9(path12.join(root, f)));
   if (!brief2) return { skip: "There is no product brief yet. Run `aura init` to draft and confirm it first." };
   const changes = [
     { path: brief2, content: read(root, brief2) },
     { path: ".aura/.gitignore", content: AURA_GITIGNORE }
   ];
-  if (existsSync7(auraPath(root, "config.json"))) changes.push({ path: ".aura/config.json", content: read(root, ".aura/config.json") });
+  if (existsSync9(auraPath(root, "config.json"))) changes.push({ path: ".aura/config.json", content: read(root, ".aura/config.json") });
   return { changes, details: [`- Adds \`${brief2}\`, \`.aura/config.json\` and \`.aura/.gitignore\` (keeps Aura's local reports out of git)`] };
 };
 var addAgentRules = ({ root, agents, vars }) => {
@@ -21346,14 +21901,14 @@ var installSkills = ({ agents, skills: skills2 }) => {
 };
 var tokenEfficiency = (g) => {
   const changes = [];
-  if (!existsSync7(path9.join(g.root, "docs/index.md"))) changes.push({ path: "docs/index.md", content: render("docs/index.md", g.vars) });
+  if (!existsSync9(path12.join(g.root, "docs/index.md"))) changes.push({ path: "docs/index.md", content: render("docs/index.md", g.vars) });
   changes.push(...rulesChanges(g.root, g.agents, g.vars));
   return { changes, details: ["- `docs/index.md`: a map of the repo your agent reads first", "- Lean-context rules in the agent rules file"] };
 };
 var addCi = ({ root, ctx, vars }) => {
   const existing = ctx.files.filter((f) => /^\.github\/workflows\//.test(f));
   const file2 = existing.includes(".github/workflows/ci.yml") ? ".github/workflows/checks.yml" : ".github/workflows/ci.yml";
-  if (existsSync7(path9.join(root, file2))) return { skip: `${file2} already exists.` };
+  if (existsSync9(path12.join(root, file2))) return { skip: `${file2} already exists.` };
   return {
     changes: [{ path: file2, content: render("github/workflows/ci.yml", vars) }],
     details: [`- \`${file2}\`: lint, type check, tests and build on every pull request`]
@@ -21377,7 +21932,7 @@ var setupTesting = ({ root, ctx, vars }) => {
   };
 };
 var addEnvExample = ({ root, scan }) => {
-  const file2 = [".env.example", ".env.sample", ".env.template"].find((f) => existsSync7(path9.join(root, f))) ?? ".env.example";
+  const file2 = [".env.example", ".env.sample", ".env.template"].find((f) => existsSync9(path12.join(root, f))) ?? ".env.example";
   const existing = read(root, file2);
   const declared = new Set(
     (existing ?? "").split(/\r?\n/).map((l) => l.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/)?.[1]).filter(Boolean)
@@ -21434,7 +21989,7 @@ var addLinting = ({ root, ctx }) => {
   return { changes, devDeps, details };
 };
 var addPreCommit = ({ root, ctx, vars }) => {
-  if (existsSync7(path9.join(root, ".husky/pre-commit"))) return { skip: "A husky pre-commit hook already exists." };
+  if (existsSync9(path12.join(root, ".husky/pre-commit"))) return { skip: "A husky pre-commit hook already exists." };
   const changes = [{ path: ".husky/pre-commit", content: render("configs/husky-pre-commit", vars) }];
   const scripts = withScripts(root, { prepare: "husky" }, false);
   if (scripts) changes.push(scripts);
@@ -21464,7 +22019,7 @@ ${current2.trim()}
   };
 };
 var enableDependencyUpdates = ({ root, vars }) => {
-  if ([".github/dependabot.yml", ".github/dependabot.yaml", "renovate.json", ".github/renovate.json"].some((f) => existsSync7(path9.join(root, f)))) {
+  if ([".github/dependabot.yml", ".github/dependabot.yaml", "renovate.json", ".github/renovate.json"].some((f) => existsSync9(path12.join(root, f)))) {
     return { skip: "Dependabot or Renovate is already configured." };
   }
   return {
@@ -21544,7 +22099,7 @@ function planMoves(root, ctx, moves) {
       const alias = aliasFor(toFile);
       if (alias) return alias[0] + noExt.slice(alias[1].length);
     }
-    let rel = path9.posix.relative(path9.posix.dirname(fromFile), noExt);
+    let rel = path12.posix.relative(path12.posix.dirname(fromFile), noExt);
     if (!rel.startsWith(".")) rel = `./${rel}`;
     return rel;
   };
@@ -21578,7 +22133,7 @@ function planMoves(root, ctx, moves) {
 }
 var moveMisplacedFiles = ({ root, ctx, scan }) => {
   const raw = findingMeta(scan, "structure.layout", "moves") ?? [];
-  const moves = raw.map((m) => m.split("=>")).filter(([, to]) => !existsSync7(path9.join(root, to))).slice(0, MAX_MOVES);
+  const moves = raw.map((m) => m.split("=>")).filter(([, to]) => !existsSync9(path12.join(root, to))).slice(0, MAX_MOVES);
   if (moves.length === 0) return { skip: "No files to move (or their targets already exist)." };
   return { changes: planMoves(root, ctx, moves), details: moves.map(([from, to]) => `- \`${from}\` \u2192 \`${to}\``), verifyTypes: true };
 };
@@ -21669,7 +22224,7 @@ var AuraClient = class _AuraClient {
   get hasKey() {
     return Boolean(this.key);
   }
-  async request(method, path25, body, timeoutMs = 6e4) {
+  async request(method, path27, body, timeoutMs = 6e4) {
     if (!this.key) throw new AuraApiError("no_key", "No pilot key");
     let payload;
     if (body !== void 0) {
@@ -21679,7 +22234,7 @@ var AuraClient = class _AuraClient {
     }
     let res;
     try {
-      res = await fetch(`${this.baseUrl}/v1/${path25}`, {
+      res = await fetch(`${this.baseUrl}/v1/${path27}`, {
         method,
         headers: { authorization: `Bearer ${this.key}`, "content-type": "application/json", "user-agent": `getaura/${AURA_VERSION}` },
         body: payload,
@@ -21743,13 +22298,13 @@ var say = {
 };
 
 // src/fix-tracking.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync10 } from "fs";
 var FILE = "fixes.json";
 var MAX_AGE_MS = 60 * 24 * 60 * 60 * 1e3;
 var MAX_CHECKS_PER_SCAN = 5;
 function loadTrackedFixes(root) {
   try {
-    return existsSync8(auraPath(root, FILE)) ? JSON.parse(readFileSync8(auraPath(root, FILE), "utf8")) : [];
+    return existsSync10(auraPath(root, FILE)) ? JSON.parse(readFileSync10(auraPath(root, FILE), "utf8")) : [];
   } catch {
     return [];
   }
@@ -21857,70 +22412,6 @@ async function recordAction(root, config2, actionId, report, startedAt, via) {
   }
 }
 
-// src/core/git.ts
-import { mkdirSync as mkdirSync2, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import path10 from "path";
-async function git(root, ...args) {
-  return run("git", args, { cwd: root });
-}
-function ghInstallHint(platform = process.platform) {
-  const how = platform === "win32" ? "Install it with `winget install --id GitHub.cli`" : platform === "darwin" ? "Install it with `brew install gh` (or download it from https://cli.github.com)" : "Install it from https://cli.github.com";
-  return `${how}, open a new terminal, then run \`gh auth login\`.`;
-}
-async function ghStatus(root) {
-  const v = await run("gh", ["--version"]);
-  if (v.code !== 0) return { installed: false, authed: false, hasRemote: false };
-  const auth = await run("gh", ["auth", "status"], { cwd: root });
-  const remote = await git(root, "remote", "get-url", "origin");
-  return { installed: true, authed: auth.code === 0, hasRemote: remote.code === 0 && /github\.com/.test(remote.stdout) };
-}
-var AURA_OWNED = /^(?:\.aura\/|\.claude\/skills\/aura\/|\.agents\/skills\/aura(?:-(?:scan|next|fix|setup))?\/|\.cursor\/commands\/aura-[a-z]+\.md$|\.pi\/prompts\/aura-[a-z]+\.md$|\.claude\/settings\.json$)/;
-async function dirtyFiles(root) {
-  const r = await git(root, "status", "--porcelain", "-uall");
-  return r.stdout.split("\n").filter(Boolean).map((l) => l.slice(3).replace(/^"|"$/g, "").split(" -> ").pop()).filter((f) => !AURA_OWNED.test(f));
-}
-async function currentBranch(root) {
-  return (await git(root, "rev-parse", "--abbrev-ref", "HEAD")).stdout.trim();
-}
-async function freeBranchName(root, base) {
-  for (let i = 1; i < 50; i++) {
-    const name = i === 1 ? base : `${base}-${i}`;
-    const local = await git(root, "rev-parse", "--verify", "--quiet", `refs/heads/${name}`);
-    const remote = await git(root, "ls-remote", "--exit-code", "--heads", "origin", name);
-    if (local.code !== 0 && remote.code !== 0) return name;
-  }
-  return `${base}-${Date.now()}`;
-}
-function writeChanges(root, changes) {
-  for (const c of changes) {
-    const full = path10.join(root, c.path);
-    if (!isInside(root, full)) throw new Error(`Refusing to write outside the repo: ${c.path}`);
-    if (c.content === null) rmSync(full, { force: true });
-    else {
-      mkdirSync2(path10.dirname(full), { recursive: true });
-      writeFileSync2(full, c.content);
-    }
-  }
-}
-async function commitPushPr(root, opts) {
-  const commit = await git(root, "commit", "-m", opts.title, "-m", "Opened by Aura (https://github.com/JohnFazio1/aura).");
-  const base = { branch: opts.branch, url: null };
-  if (commit.code !== 0) {
-    const out = commit.stderr || commit.stdout;
-    const error62 = /tell me who you are|user\.email/i.test(out) ? 'git doesn\u2019t know your name and email yet. Run these two commands:\n  git config --global user.name "Your Name"\n  git config --global user.email "you@example.com"' : out;
-    return { ...base, committed: false, pushed: false, error: error62 };
-  }
-  if (!opts.openPr) return { ...base, committed: true, pushed: false };
-  const push = await git(root, "push", "-u", "origin", opts.branch);
-  if (push.code !== 0) return { ...base, committed: true, pushed: false, error: push.stderr };
-  const pr = await run("gh", ["pr", "create", "--base", opts.base, "--head", opts.branch, "--title", opts.title, "--body-file", "-"], {
-    cwd: root,
-    input: opts.body
-  });
-  if (pr.code !== 0) return { ...base, committed: true, pushed: true, error: pr.stderr };
-  return { ...base, url: pr.stdout.trim().split("\n").pop() ?? null, committed: true, pushed: true };
-}
-
 // src/checks/foundations.ts
 import YAML from "yaml";
 var ciWorkflow = {
@@ -22120,10 +22611,10 @@ var typecheck = {
   applies: (ctx) => ctx.stack.typescript,
   async run(ctx) {
     if (ctx.options.fast) return { status: "unknown", summary: "Skipped in fast mode." };
-    const { existsSync: existsSync18 } = await import("fs");
-    const path25 = await import("path");
-    const tsc = path25.join(ctx.root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
-    if (!existsSync18(tsc)) return { status: "unknown", summary: "Dependencies not installed, so the type check was skipped." };
+    const { existsSync: existsSync21 } = await import("fs");
+    const path27 = await import("path");
+    const tsc = path27.join(ctx.root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
+    if (!existsSync21(tsc)) return { status: "unknown", summary: "Dependencies not installed, so the type check was skipped." };
     const r = await run(tsc, ["--noEmit", "--pretty", "false"], { cwd: ctx.root, timeoutMs: 18e4 });
     if (r.timedOut) return { status: "unknown", summary: "Type check timed out." };
     if (r.code === 0) return { status: "pass", summary: "No type errors.", engine: "tsc" };
@@ -22143,6 +22634,73 @@ var typecheck = {
 };
 var foundationChecks = [ciWorkflow, tests, readme, envExample, lockfile, lintFormat, typecheck];
 
+// src/connectors/snapshot.ts
+import { existsSync as existsSync11, readFileSync as readFileSync11 } from "fs";
+var REFUSAL_MS = 30 * 24 * 60 * 60 * 1e3;
+function withRefusals(states, snap, now = Date.now()) {
+  return Object.fromEntries(
+    Object.entries(states).map(([id, s]) => {
+      const refusal = snap?.refused?.[id];
+      return [id, s.state === "off" && refusal && now - Date.parse(refusal.at) < REFUSAL_MS ? { state: "unavailable", why: refusal.why } : s];
+    })
+  );
+}
+var FILE2 = "cache/connectors.json";
+function loadSnapshots(root) {
+  try {
+    return existsSync11(auraPath(root, FILE2)) ? JSON.parse(readFileSync11(auraPath(root, FILE2), "utf8")) : {};
+  } catch {
+    return {};
+  }
+}
+function saveSnapshot(root, toolId, states, refusedNow = {}) {
+  const all = loadSnapshots(root);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const refused = { ...all[toolId]?.refused };
+  for (const [id, why] of Object.entries(refusedNow)) refused[id] = { why, at: now };
+  for (const [id, s] of Object.entries(states)) if (s.state === "on") delete refused[id];
+  all[toolId] = {
+    checkedAt: now,
+    settings: Object.fromEntries(Object.entries(states).map(([id, s]) => [id, s.state])),
+    ...Object.keys(refused).length ? { refused } : {}
+  };
+  writeAuraFile(root, FILE2, `${JSON.stringify(all, null, 2)}
+`);
+}
+var isStale = (snap, now = Date.now()) => !snap || now - Date.parse(snap.checkedAt) > 24 * 60 * 60 * 1e3;
+
+// src/checks/security/tool-settings.ts
+function toolSettingsCheck(connector) {
+  return {
+    id: `security.${connector.id}-settings`,
+    category: "security",
+    title: `${connector.name} security settings`,
+    weight: 3,
+    applies: (ctx) => {
+      const snap = loadSnapshots(ctx.root)[connector.id];
+      return Boolean(snap && Object.values(snap.settings).some((s) => s !== "unavailable"));
+    },
+    run(ctx) {
+      const snap = loadSnapshots(ctx.root)[connector.id];
+      const available = connector.settings.filter((s) => snap.settings[s.id] === "on" || snap.settings[s.id] === "off");
+      const off = available.filter((s) => snap.settings[s.id] === "off");
+      const engine = `${connector.name}, checked ${snap.checkedAt.slice(0, 10)}`;
+      if (off.length === 0) return { status: "pass", summary: `All ${available.length} available ${connector.name} security settings are on.`, engine };
+      const finding = makeFinding(this, {
+        severity: off.some((s) => /protect|push|secret/.test(s.id)) ? "medium" : "low",
+        title: `${off.length} ${connector.name} security setting(s) off`,
+        detail: `Off in ${connector.name}: ${off.map((s) => s.label).join("; ")}.`,
+        why: "These settings catch leaked keys, vulnerable packages and risky changes before they cause harm, and they cost nothing to turn on.",
+        locations: [],
+        actionId: connector.actionId,
+        key: `${connector.id}-settings`
+      });
+      const score = (available.length - off.length) / available.length;
+      return { status: score === 0 ? "fail" : "partial", score, summary: finding.title, findings: [finding], engine };
+    }
+  };
+}
+
 // src/checks/security/api-routes.ts
 var AUTH_SIGNALS = [
   /\bauth\.getUser\s*\(/,
@@ -22249,9 +22807,9 @@ var apiRoutes = {
 
 // src/core/tools.ts
 import { createHash as createHash3 } from "crypto";
-import { chmodSync as chmodSync2, existsSync as existsSync9, mkdirSync as mkdirSync3, mkdtempSync, readdirSync as readdirSync3, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import os2 from "os";
-import path11 from "path";
+import { chmodSync as chmodSync2, existsSync as existsSync12, mkdirSync as mkdirSync3, mkdtempSync, readdirSync as readdirSync4, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import os3 from "os";
+import path13 from "path";
 var GITLEAKS_SHA = {
   darwin_arm64: "b40ab0ae55c505963e365f271a8d3846efbc170aa17f2607f13df610a9aeb6a5",
   darwin_x64: "dfe101a4db2255fc85120ac7f3d25e4342c3c20cf749f2c20a18081af1952709",
@@ -22269,7 +22827,7 @@ var OSV_SHA = {
   windows_arm64: "ca1379da0e408279ef2c85cde0846a903495738a91c7b065a208048437c1686c"
 };
 function tarCommand(platform = process.platform, systemRoot = process.env.SystemRoot) {
-  return platform === "win32" ? path11.win32.join(systemRoot || "C:\\Windows", "System32", "tar.exe") : "tar";
+  return platform === "win32" ? path13.win32.join(systemRoot || "C:\\Windows", "System32", "tar.exe") : "tar";
 }
 var TOOLS = {
   gitleaks: {
@@ -22305,8 +22863,8 @@ function ensureTool(name, noDownload = false) {
 async function resolveTool(name, noDownload) {
   const spec = TOOLS[name];
   const exe = process.platform === "win32" ? `${name}.exe` : name;
-  const cached2 = path11.join(auraBinDir(), `${name}-${spec.version}`, exe);
-  if (existsSync9(cached2)) return { path: cached2, version: spec.version };
+  const cached2 = path13.join(auraBinDir(), `${name}-${spec.version}`, exe);
+  if (existsSync12(cached2)) return { path: cached2, version: spec.version };
   if (await commandExists(name)) {
     const v = await run(name, ["version"]);
     return { path: name, version: (v.stdout.match(/\d+\.\d+\.\d+/)?.[0] ?? "system").trim() };
@@ -22326,20 +22884,20 @@ async function download(name, spec, target) {
   const buf = Buffer.from(await res.arrayBuffer());
   const digest = createHash3("sha256").update(buf).digest("hex");
   if (digest !== asset.sha256) throw new Error(`Checksum mismatch for ${asset.file}`);
-  const dir = path11.dirname(target);
+  const dir = path13.dirname(target);
   mkdirSync3(dir, { recursive: true });
-  const tmp = mkdtempSync(path11.join(os2.tmpdir(), `aura-${name}-`));
+  const tmp = mkdtempSync(path13.join(os3.tmpdir(), `aura-${name}-`));
   try {
     if (asset.archive === null) {
       writeFileSync3(target, buf);
     } else {
-      const archivePath = path11.join(tmp, asset.file);
+      const archivePath = path13.join(tmp, asset.file);
       writeFileSync3(archivePath, buf);
       const r = await run(tarCommand(), ["-xf", archivePath, "-C", tmp]);
       if (r.code !== 0) return null;
-      const exe = readdirSync3(tmp).find((f) => f === name || f === `${name}.exe`);
+      const exe = readdirSync4(tmp).find((f) => f === name || f === `${name}.exe`);
       if (!exe) return null;
-      renameSync(path11.join(tmp, exe), target);
+      renameSync(path13.join(tmp, exe), target);
     }
     chmodSync2(target, 493);
     return { path: target, version: spec.version };
@@ -22610,9 +23168,9 @@ var rls = {
 };
 
 // src/checks/security/secrets.ts
-import { existsSync as existsSync10, mkdtempSync as mkdtempSync2, readFileSync as readFileSync9, rmSync as rmSync3 } from "fs";
-import os3 from "os";
-import path12 from "path";
+import { existsSync as existsSync13, mkdtempSync as mkdtempSync2, readFileSync as readFileSync12, rmSync as rmSync3 } from "fs";
+import os4 from "os";
+import path14 from "path";
 
 // src/core/ignore.ts
 function globToRegex(glob) {
@@ -22650,15 +23208,15 @@ async function gitleaksHistory(ctx) {
   if (!ctx.tracked) return null;
   const bin = await ensureTool("gitleaks", ctx.options.noDownload);
   if (!bin) return null;
-  const dir = mkdtempSync2(path12.join(os3.tmpdir(), "aura-gitleaks-"));
-  const report = path12.join(dir, "report.json");
+  const dir = mkdtempSync2(path14.join(os4.tmpdir(), "aura-gitleaks-"));
+  const report = path14.join(dir, "report.json");
   try {
     const r = await run(bin.path, ["git", "--no-banner", "--redact", "--report-format", "json", "--report-path", report, "--exit-code", "0", "."], {
       cwd: ctx.root,
       timeoutMs: 18e4
     });
-    if (r.code !== 0 || !existsSync10(report)) return null;
-    return { hits: JSON.parse(readFileSync9(report, "utf8")), engine: `gitleaks ${bin.version}` };
+    if (r.code !== 0 || !existsSync13(report)) return null;
+    return { hits: JSON.parse(readFileSync12(report, "utf8")), engine: `gitleaks ${bin.version}` };
   } catch {
     return null;
   } finally {
@@ -22770,10 +23328,10 @@ var envFiles = {
 };
 
 // src/checks/security.ts
-var securityChecks = [secrets, envFiles, deps, rls, apiRoutes, headers];
+var securityChecks = [secrets, envFiles, deps, rls, apiRoutes, headers, ...CONNECTORS.map(toolSettingsCheck)];
 
 // src/checks/structure.ts
-import path13 from "path";
+import path15 from "path";
 var GENERATED = /(?:^|\/)(?:supabase\/migrations|generated|__generated__|\.generated)\/|\.(?:d\.ts|min\.js)$|(?:^|\/)(?:database|supabase)\.types\.ts$|(?:^|\/)components\/ui\//;
 function appSource(ctx) {
   return ctx.files.filter((f) => isSourceFile(f) && !GENERATED.test(f));
@@ -22862,7 +23420,7 @@ var duplicates = {
     const findings = pairs.map(
       ([a, b, sim]) => makeFinding(this, {
         severity: "low",
-        title: `${path13.basename(a)} and ${path13.basename(b)} are near-duplicates`,
+        title: `${path15.basename(a)} and ${path15.basename(b)} are near-duplicates`,
         detail: `${a} and ${b} are ${Math.round(sim * 100)}% the same.`,
         why: "Duplicates drift apart over time: a bug gets fixed in one copy and not the other, and your agent can\u2019t tell which one is right.",
         locations: [{ file: a }, { file: b }],
@@ -22876,7 +23434,7 @@ var duplicates = {
 };
 var ROOT_ALLOWED = /^(?:[^/]+\.config\.[cm]?[jt]s|middleware\.[cm]?[jt]s|proxy\.[cm]?[jt]s|instrumentation(?:-client)?\.[cm]?[jt]s|next-env\.d\.ts|global\.d\.ts|env\.d\.ts|sentry\.[\w.]+\.[cm]?[jt]s)$/;
 function suggestTarget(file2, srcDir) {
-  const base = path13.posix.basename(file2);
+  const base = path15.posix.basename(file2);
   const prefix = srcDir ? "src/" : "";
   const isComponent = /^[A-Z][A-Za-z0-9]*\.(?:tsx|jsx)$/.test(base);
   if (isComponent) return `${prefix}components/${base}`;
@@ -22989,21 +23547,21 @@ async function runScan(root, options, onProgress) {
 }
 
 // src/commands/fix.ts
-import { existsSync as existsSync15, readFileSync as readFileSync16, writeFileSync as writeFileSync6 } from "fs";
-import path17 from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync19, writeFileSync as writeFileSync6 } from "fs";
+import path19 from "path";
 
 // src/agent/tools.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync4, readFileSync as readFileSync10, rmSync as rmSync4, statSync as statSync2, writeFileSync as writeFileSync4 } from "fs";
-import path14 from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync4, readFileSync as readFileSync13, rmSync as rmSync4, statSync as statSync2, writeFileSync as writeFileSync4 } from "fs";
+import path16 from "path";
 var MAX_OUTPUT = 12e3;
 var MAX_FILE_LINES = 800;
 var FORBIDDEN = /^(?:\.git|node_modules|\.next|\.vercel)(?:\/|$)|(?:^|\/)\.env(?:\.(?!example$|sample$|template$)[^/]+)?$/;
 function safePath(root, rel) {
   if (typeof rel !== "string" || !rel.trim()) throw new Error("A file path is required.");
-  const normalized = path14.posix.normalize(rel.replace(/\\/g, "/").replace(/^\.\//, ""));
-  if (normalized.startsWith("../") || normalized === ".." || path14.isAbsolute(normalized)) throw new Error(`Path is outside the repo: ${rel}`);
+  const normalized = path16.posix.normalize(rel.replace(/\\/g, "/").replace(/^\.\//, ""));
+  if (normalized.startsWith("../") || normalized === ".." || path16.isAbsolute(normalized)) throw new Error(`Path is outside the repo: ${rel}`);
   if (FORBIDDEN.test(normalized)) throw new Error(`Aura doesn\u2019t let the agent touch ${normalized}.`);
-  const full = path14.join(root, normalized);
+  const full = path16.join(root, normalized);
   if (!isInside(root, full)) throw new Error(`Path is outside the repo: ${rel}`);
   return normalized;
 }
@@ -23024,10 +23582,10 @@ async function runTool(root, call, allowedCommands2) {
     }
     case "read_file": {
       const rel = safePath(root, input2.path);
-      const full = path14.join(root, rel);
-      if (!existsSync11(full)) return { output: `File not found: ${rel}` };
+      const full = path16.join(root, rel);
+      if (!existsSync14(full)) return { output: `File not found: ${rel}` };
       if (statSync2(full).size > 1e6) return { output: `${rel} is too large to read.` };
-      const lines = readFileSync10(full, "utf8").split("\n");
+      const lines = readFileSync13(full, "utf8").split("\n");
       const start = Math.max(1, Number(input2.startLine) || 1);
       const end = Math.min(lines.length, Number(input2.endLine) || start + MAX_FILE_LINES - 1);
       const body = lines.slice(start - 1, end).map((l, i) => `${start + i}: ${l}`).join("\n");
@@ -23044,7 +23602,7 @@ async function runTool(root, call, allowedCommands2) {
         if (FORBIDDEN.test(f) || glob && !glob.test(f)) continue;
         let text;
         try {
-          text = readFileSync10(path14.join(root, f), "utf8");
+          text = readFileSync13(path16.join(root, f), "utf8");
         } catch {
           continue;
         }
@@ -23063,14 +23621,14 @@ async function runTool(root, call, allowedCommands2) {
           output: "Refused: the content contains a [REDACTED:\u2026] placeholder. Secrets are hidden from you on purpose. Read the value from an environment variable (process.env.NAME) instead of writing it."
         };
       }
-      mkdirSync4(path14.dirname(path14.join(root, rel)), { recursive: true });
-      writeFileSync4(path14.join(root, rel), content);
+      mkdirSync4(path16.dirname(path16.join(root, rel)), { recursive: true });
+      writeFileSync4(path16.join(root, rel), content);
       return { output: `Wrote ${rel} (${content.split("\n").length} lines).`, touched: rel };
     }
     case "delete_file": {
       const rel = safePath(root, input2.path);
-      if (!existsSync11(path14.join(root, rel))) return { output: `File not found: ${rel}` };
-      rmSync4(path14.join(root, rel));
+      if (!existsSync14(path16.join(root, rel))) return { output: `File not found: ${rel}` };
+      rmSync4(path16.join(root, rel));
       return { output: `Deleted ${rel}.`, touched: rel };
     }
     case "run_command": {
@@ -23092,7 +23650,7 @@ ${(r.stdout + "\n" + r.stderr).trim().slice(-6e3)}`;
 
 // src/api/explain.ts
 import { createHash as createHash4 } from "crypto";
-import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
 
 // src/report.ts
 import pc2 from "picocolors";
@@ -23281,7 +23839,7 @@ var CACHE_FILE = "cache/explanations.json";
 var MAX_EXPLAIN = 25;
 function loadCache(root) {
   try {
-    return JSON.parse(readFileSync11(auraPath(root, CACHE_FILE), "utf8"));
+    return JSON.parse(readFileSync14(auraPath(root, CACHE_FILE), "utf8"));
   } catch {
     return {};
   }
@@ -23302,8 +23860,8 @@ function excerptFor(root, f, context = 4) {
 }
 function productContext(root) {
   const file2 = auraPath(root, "brief.md");
-  if (!existsSync12(file2)) return void 0;
-  return redact(readFileSync11(file2, "utf8")).slice(0, 1800);
+  if (!existsSync15(file2)) return void 0;
+  return redact(readFileSync14(file2, "utf8")).slice(0, 1800);
 }
 async function addExplanations(root, scan, client) {
   const cache = loadCache(root);
@@ -23347,19 +23905,22 @@ async function addExplanations(root, scan, client) {
 
 // src/commands/simple.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync14, readdirSync as readdirSync4, readFileSync as readFileSync15 } from "fs";
-import path16 from "path";
+import { existsSync as existsSync17, readdirSync as readdirSync5, readFileSync as readFileSync18 } from "fs";
+import path18 from "path";
 import YAML2 from "yaml";
 
 // src/commands/inventory.ts
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync15 } from "fs";
 function accountState(root, services) {
   const inv = loadInventory(root);
-  return { inventoryComplete: services.every((s) => inv.services[s]?.owner) && Boolean(inv.githubOrg), githubSecurity: Boolean(inv.githubSecurity) };
+  return {
+    inventoryComplete: services.every((s) => inv.services[s]?.owner) && Boolean(inv.githubOrg),
+    secured: { ...inv.secured, github: Boolean(inv.githubSecurity || inv.secured?.github) }
+  };
 }
 function loadInventory(root) {
   try {
-    return JSON.parse(readFileSync12(auraPath(root, "inventory.json"), "utf8"));
+    return JSON.parse(readFileSync15(auraPath(root, "inventory.json"), "utf8"));
   } catch {
     return { version: 1, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), services: {} };
   }
@@ -23446,10 +24007,10 @@ async function inventoryCommand(flags) {
 }
 
 // src/history.ts
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync16 } from "fs";
 function loadHistory(root) {
   try {
-    const data = JSON.parse(readFileSync13(auraPath(root, "history.json"), "utf8"));
+    const data = JSON.parse(readFileSync16(auraPath(root, "history.json"), "utf8"));
     return Array.isArray(data) ? data : [];
   } catch {
     return [];
@@ -23497,10 +24058,10 @@ function banner(colors = pc3.isColorSupported) {
 // src/api/connect.ts
 import { spawn as spawn2 } from "child_process";
 import { constants, generateKeyPairSync, privateDecrypt } from "crypto";
-import { existsSync as existsSync13, mkdirSync as mkdirSync5, readFileSync as readFileSync14, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "fs";
-import os4 from "os";
-import path15 from "path";
-var pendingFile = () => path15.join(os4.homedir(), ".aura", "pending-connect.json");
+import { existsSync as existsSync16, mkdirSync as mkdirSync5, readFileSync as readFileSync17, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "fs";
+import os5 from "os";
+import path17 from "path";
+var pendingFile = () => path17.join(os5.homedir(), ".aura", "pending-connect.json");
 async function postJson(apiUrl, route, body) {
   let res;
   try {
@@ -23519,14 +24080,14 @@ async function postJson(apiUrl, route, body) {
 }
 function loadPending(apiUrl, now) {
   try {
-    const p2 = JSON.parse(readFileSync14(pendingFile(), "utf8"));
+    const p2 = JSON.parse(readFileSync17(pendingFile(), "utf8"));
     if (p2.apiUrl === apiUrl && Date.parse(p2.expiresAt) - now > 6e4) return p2;
   } catch {
   }
   return null;
 }
 function clearPendingConnect() {
-  if (existsSync13(pendingFile())) rmSync5(pendingFile(), { force: true });
+  if (existsSync16(pendingFile())) rmSync5(pendingFile(), { force: true });
 }
 async function startOrResumeConnect(apiUrl, now = Date.now()) {
   const existing = loadPending(apiUrl, now);
@@ -23538,7 +24099,7 @@ async function startOrResumeConnect(apiUrl, now = Date.now()) {
   });
   const res = ConnectStartResponse.parse(await postJson(apiUrl, "connect", { publicKey }));
   const pending = { apiUrl, privateKey, ...res };
-  mkdirSync5(path15.dirname(pendingFile()), { recursive: true });
+  mkdirSync5(path17.dirname(pendingFile()), { recursive: true });
   writeFileSync5(pendingFile(), JSON.stringify(pending, null, 2) + "\n", { mode: 384 });
   return { ...pending, resumed: false };
 }
@@ -23631,7 +24192,7 @@ function stepRun(step, hasKey) {
 }
 function hint(step, hasKey) {
   const run2 = stepRun(step, hasKey);
-  const what = run2.kind === "apply" ? "opens a pull request" : run2.kind === "fix" ? run2.withOwnAgent ? "writes a task for your coding agent" : "Aura\u2019s agent fixes it in a pull request" : run2.kind === "guide" ? "shows step-by-step instructions" : "a few questions";
+  const what = connectorForAction(step.actionId) ? `turns on ${connectorForAction(step.actionId).name}\u2019s security settings, after you agree` : run2.kind === "apply" ? "opens a pull request" : run2.kind === "fix" ? run2.withOwnAgent ? "writes a task for your coding agent" : "Aura\u2019s agent fixes it in a pull request" : run2.kind === "guide" ? "shows step-by-step instructions" : "a few questions";
   return [what, step.impact > 0 ? `+${step.impact} points` : "", effortLabel(step.effort)].filter(Boolean).join(" \xB7 ");
 }
 async function pickAndRunSteps(steps, limit = 10) {
@@ -23657,7 +24218,10 @@ async function pickAndRunSteps(steps, limit = 10) {
     console.log(`
 ${pc.magenta("\u2726")} ${pc.bold(step.title)}`);
     const run2 = stepRun(step, hasKey);
-    const code = run2.kind === "apply" ? await applyCommand(run2.actionId, { yes: true, via: "checklist" }) : run2.kind === "fix" ? await fixCommand(run2.actionId, run2.withOwnAgent ? { agent: true, via: "checklist" } : { yes: true, via: "checklist" }) : run2.kind === "guide" ? await guideCommand(run2.topic, {}) : await inventoryCommand({});
+    const code = run2.kind === "apply" ? (
+      // Settings changes always ask first, even when picked here; pull requests don't need to.
+      await applyCommand(run2.actionId, { yes: !connectorForAction(run2.actionId), via: "checklist" })
+    ) : run2.kind === "fix" ? await fixCommand(run2.actionId, run2.withOwnAgent ? { agent: true, via: "checklist" } : { yes: true, via: "checklist" }) : run2.kind === "guide" ? await guideCommand(run2.topic, {}) : await inventoryCommand({});
     if (run2.kind === "guide" || run2.kind === "inventory") {
       const root = await findRepoRoot();
       await recordUsage(root, loadConfig(root), {
@@ -23681,9 +24245,9 @@ ${pc.bold("  Done")}`);
 // src/commands/simple.ts
 async function latestScan(root) {
   const file2 = auraPath(root, "scan.json");
-  if (existsSync14(file2)) {
+  if (existsSync17(file2)) {
     try {
-      const scan = JSON.parse(readFileSync15(file2, "utf8"));
+      const scan = JSON.parse(readFileSync18(file2, "utf8"));
       const head = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
       const dirty = execFileSync("git", ["status", "--porcelain"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
       if (scan.commit === head && !dirty && Date.now() - Date.parse(scan.scannedAt) < 24 * 36e5) return scan;
@@ -23798,9 +24362,9 @@ async function configCommand(key, value) {
   return 0;
 }
 function loadGuides() {
-  const dir = path16.join(templatesDir(), "guides");
-  return readdirSync4(dir).filter((f) => f.endsWith(".md")).map((f) => {
-    const text = readFileSync15(path16.join(dir, f), "utf8");
+  const dir = path18.join(templatesDir(), "guides");
+  return readdirSync5(dir).filter((f) => f.endsWith(".md")).map((f) => {
+    const text = readFileSync18(path18.join(dir, f), "utf8");
     const fm = text.match(/^---\n([\s\S]*?)\n---\n?/);
     const meta3 = fm ? YAML2.parse(fm[1]) : {};
     return { id: f.replace(/\.md$/, ""), title: meta3.title ?? f, summary: meta3.summary ?? "", body: fm ? text.slice(fm[0].length) : text };
@@ -23868,7 +24432,7 @@ function allowedCommands(root, pm, typescript) {
   const pkg = readJson(root, "package.json");
   const run2 = pmCommands(pm).run;
   const cmds = ["test", "lint", "typecheck", "build"].filter((s) => pkg?.scripts?.[s]).map((s) => `${run2} ${s}`);
-  if (typescript && !pkg?.scripts?.typecheck && existsSync15(path17.join(root, "node_modules/.bin/tsc"))) cmds.push(`${pmCommands(pm).exec} tsc --noEmit`);
+  if (typescript && !pkg?.scripts?.typecheck && existsSync18(path19.join(root, "node_modules/.bin/tsc"))) cmds.push(`${pmCommands(pm).exec} tsc --noEmit`);
   return cmds;
 }
 function taskFor(root, scan, action2, findings) {
@@ -23919,8 +24483,8 @@ async function untrackEnvFiles(root, findings) {
   const files = findings.filter((f) => f.checkId === "security.env-files").map((f) => f.locations[0].file);
   for (const f of files) await git(root, "rm", "-q", "--cached", "--", f);
   if (files.length) {
-    const gi = path17.join(root, ".gitignore");
-    const current2 = existsSync15(gi) ? readFileSync16(gi, "utf8") : "";
+    const gi = path19.join(root, ".gitignore");
+    const current2 = existsSync18(gi) ? readFileSync19(gi, "utf8") : "";
     if (!/^\.env\*?$/m.test(current2)) writeFileSync6(gi, `${current2.trimEnd()}
 
 # Environment files hold secrets
@@ -24097,6 +24661,128 @@ ${pc.bold(action2.title)}  ${pc.dim(`${findings.length} finding(s)`)}`);
   }
 }
 
+// src/connectors/engine.ts
+async function readSettings(connector, ctx) {
+  const states = await Promise.all(connector.settings.map((s) => s.read(ctx).catch(() => ({ state: "off" }))));
+  return Object.fromEntries(connector.settings.map((s, i) => [s.id, states[i]]));
+}
+async function enableSettings(connector, ctx, states) {
+  const results = [];
+  for (const setting of connector.settings) {
+    const s = states[setting.id];
+    if (s.state === "on") results.push({ id: setting.id, result: "already-on" });
+    else if (s.state === "unavailable") results.push({ id: setting.id, result: "unavailable", why: s.why });
+    else {
+      const out = await setting.enable(ctx).catch(() => ({ ok: false }));
+      results.push(
+        out.ok ? { id: setting.id, result: "turned-on" } : out.unavailable ? { id: setting.id, result: "unavailable", why: out.unavailable } : { id: setting.id, result: "failed", why: `${connector.name} refused the change` }
+      );
+    }
+  }
+  return results;
+}
+var securityDone = (results) => results.every((r) => r.result !== "failed");
+async function secureCommand(connector, flags, report = {}, fake) {
+  const root = await findRepoRoot();
+  report.delivery = "settings";
+  const connection = await connector.connect(root, fake);
+  if (!connection.ok) {
+    say.error(connection.problem);
+    Object.assign(report, { outcome: "failed", errorType: connection.errorType });
+    return 1;
+  }
+  const { ctx, target } = connection;
+  const states = withRefusals(await readSettings(connector, ctx), loadSnapshots(root)[connector.id]);
+  saveSnapshot(root, connector.id, states);
+  const toTurnOn = connector.settings.filter((s) => states[s.id].state === "off").map((s) => s.id);
+  console.log(`
+${pc.magenta("\u2726")} ${pc.bold(`${connector.name} security for ${target}`)}`);
+  for (const setting of connector.settings) {
+    const s = states[setting.id];
+    const line = s.state === "on" ? pc.green("\u2714 already on") : s.state === "off" ? pc.cyan("\u2192 Aura will turn this on") : pc.dim(`\u2013 not available: ${s.why}`);
+    console.log(`  ${setting.label}
+    ${line}`);
+  }
+  for (const line of await connector.explain?.(ctx, toTurnOn) ?? []) say.dim(`  ${line}`);
+  const label = (id) => connector.settings.find((s) => s.id === id).label;
+  const impact = (id) => connector.settings.find((s) => s.id === id).impact;
+  if (toTurnOn.length && !flags.dryRun) {
+    console.log(`
+${pc.bold("  What changes for you")}`);
+    for (const id of toTurnOn) console.log(`  \u2022 ${impact(id)}`);
+  }
+  if (flags.dryRun) {
+    say.dim(toTurnOn.length ? "\nDry run: nothing was changed." : "\nEverything Aura can turn on here is already on.");
+    return 0;
+  }
+  let chosen = toTurnOn;
+  if (toTurnOn.length && !flags.yes) {
+    if (!interactive()) {
+      say.info(`
+Nothing was changed. Show the user the changes above, and once they agree run: aura apply ${connector.actionId} --yes`);
+      report.outcome = "shown";
+      return 0;
+    }
+    chosen = unwrap(
+      await p.multiselect({
+        message: `Which should Aura turn on in ${connector.name}? (untick any you don\u2019t want)`,
+        options: toTurnOn.map((id) => ({ value: id, label: label(id) })),
+        initialValues: toTurnOn,
+        required: false
+      })
+    );
+    if (chosen.length === 0) {
+      say.dim("Nothing was changed.");
+      report.outcome = "cancelled";
+      return 0;
+    }
+  }
+  const skipped = toTurnOn.filter((id) => !chosen.includes(id));
+  let results;
+  if (toTurnOn.length === 0) {
+    say.ok("Everything Aura can turn on here is already on.");
+    results = await enableSettings(connector, ctx, states);
+    report.outcome = "no_changes";
+  } else {
+    const attempt = Object.fromEntries(
+      Object.entries(states).map(([id, s]) => [id, skipped.includes(id) ? { state: "unavailable", why: "you chose to leave it off" } : s])
+    );
+    results = await enableSettings(connector, ctx, attempt);
+    console.log("");
+    for (const r of results.filter((x) => chosen.includes(x.id))) {
+      if (r.result === "turned-on") say.ok(`${label(r.id)}: on`);
+      else if (r.result === "unavailable") say.dim(`\u2013 ${label(r.id)}: ${r.why}`);
+      else say.warn(`${label(r.id)}: ${r.why}.`);
+    }
+    report.outcome = results.some((r) => r.result === "failed") ? "failed" : "settings_changed";
+  }
+  const refusedNow = Object.fromEntries(results.filter((r) => r.result === "unavailable" && states[r.id].state === "off" && r.why).map((r) => [r.id, r.why]));
+  saveSnapshot(
+    root,
+    connector.id,
+    Object.fromEntries(
+      Object.entries(states).map(([id, s]) => {
+        const r = results.find((x) => x.id === id);
+        return [id, r?.result === "turned-on" ? { state: "on" } : refusedNow[id] ? { state: "unavailable", why: refusedNow[id] } : s];
+      })
+    ),
+    refusedNow
+  );
+  const left = await connector.leftForYou(ctx, results);
+  if (left.length) {
+    console.log(`
+${pc.bold("  Left for you")}`);
+    for (const line of left) console.log(`  \u2022 ${line}`);
+  }
+  const inv = loadInventory(root);
+  inv.secured = { ...inv.secured, [connector.id]: securityDone(results) };
+  if (connector.id === "github") inv.githubSecurity = inv.secured.github;
+  inv.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  writeAuraFile(root, "inventory.json", `${JSON.stringify(inv, null, 2)}
+`);
+  return results.some((r) => r.result === "failed") ? 1 : 0;
+}
+
 // src/commands/apply.ts
 var LOCKFILES = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb"];
 async function applyCommand(actionId, flags) {
@@ -24116,6 +24802,8 @@ async function applyAction(actionId, flags, report) {
   }
   const scan = await latestScan(root);
   const { delivery, fellBack } = effectiveDelivery(action2, scan);
+  const connector = connectorForAction(actionId);
+  if (connector) return secureCommand(connector, flags, report);
   if (delivery === "guide") return guideCommand(actionId, {});
   if (delivery === "agent-fix") {
     if (fellBack) say.info(pc.dim(`Aura only opens template PRs on stacks it recognizes (Next.js). Handing "${actionId}" to Aura\u2019s agent instead.`));
@@ -24149,7 +24837,7 @@ async function applyAction(actionId, flags, report) {
   console.log(`
 ${pc.bold(action2.title)}`);
   for (const c of plan.changes)
-    console.log(`  ${c.content === null ? pc.red("delete") : existsSync16(path18.join(root, c.path)) ? pc.yellow("update") : pc.green("add   ")} ${c.path}`);
+    console.log(`  ${c.content === null ? pc.red("delete") : existsSync19(path20.join(root, c.path)) ? pc.yellow("update") : pc.green("add   ")} ${c.path}`);
   const pm = pmCommands(scan.stack.packageManager);
   if (plan.devDeps?.length) console.log(`  ${pc.cyan("install")} ${plan.devDeps.join(", ")} ${pc.dim(`(${pm.addDev})`)}`);
   for (const cmd of plan.commands ?? []) console.log(`  ${pc.cyan("run   ")} ${cmd.join(" ")}`);
@@ -24181,8 +24869,8 @@ ${pc.bold(action2.title)}`);
     report.outcome = "cancelled";
     return 0;
   }
-  const tsc = path18.join(root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
-  const checkTypes = plan.verifyTypes && scan.stack.typescript && existsSync16(tsc);
+  const tsc = path20.join(root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
+  const checkTypes = plan.verifyTypes && scan.stack.typescript && existsSync19(tsc);
   const typeErrors = async () => {
     const r = await run(tsc, ["--noEmit", "--pretty", "false"], { cwd: root, timeoutMs: 3e5 });
     return (r.stdout.match(/error TS\d+/g) ?? []).length;
@@ -24291,17 +24979,17 @@ async function undoPlan(root, plan) {
   for (const file2 of touched) {
     const inHead = (await git(root, "cat-file", "-e", `HEAD:${file2}`)).code === 0;
     if (inHead) await git(root, "checkout", "HEAD", "--", file2);
-    else if (plan.changes.some((c) => c.path === file2)) rmSync6(path18.join(root, file2), { force: true });
+    else if (plan.changes.some((c) => c.path === file2)) rmSync6(path20.join(root, file2), { force: true });
   }
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync17, readFileSync as readFileSync17 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync21 } from "fs";
 import { spawnSync as spawnSync3 } from "child_process";
-import path22 from "path";
+import path24 from "path";
 
 // src/brief.ts
-import path19 from "path";
+import path21 from "path";
 function repoSummary(ctx) {
   const routes = ctx.files.filter((f) => /^(?:src\/)?app\/(?:.+\/)?(?:page|route)\.[cm]?[jt]sx?$/.test(f) || /^(?:src\/)?pages\/.+\.[cm]?[jt]sx?$/.test(f)).map(
     (f) => "/" + f.replace(/^(?:src\/)?(?:app|pages)\//, "").replace(/(?:^|\/)(?:page|route|index)\.[cm]?[jt]sx?$|\.[cm]?[jt]sx?$/, "").replace(/\([^)]+\)\//g, "")
@@ -24317,7 +25005,7 @@ function repoSummary(ctx) {
   const readme2 = ctx.files.find((f) => /^readme\.mdx?$/i.test(f));
   const readmeText = readme2 ? ctx.read(readme2) ?? "" : "";
   return {
-    name: ctx.pkg?.name ?? path19.basename(ctx.root),
+    name: ctx.pkg?.name ?? path21.basename(ctx.root),
     packageJson: ctx.pkg ? {
       name: ctx.pkg.name,
       description: ctx.pkg.description,
@@ -24410,10 +25098,10 @@ function installFallback(result, platform = process.platform) {
 
 // src/core/claude-plugin.ts
 import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync7 } from "fs";
-import os5 from "os";
-import path20 from "path";
+import os6 from "os";
+import path22 from "path";
 var CLAUDE_PLUGIN_ID = "aura@aura";
-var marketplaceDir = () => path20.join(os5.homedir(), ".aura", "claude-marketplace");
+var marketplaceDir = () => path22.join(os6.homedir(), ".aura", "claude-marketplace");
 var MARKETPLACE = {
   name: "aura",
   description: "Aura for Claude Code",
@@ -24428,8 +25116,8 @@ var MARKETPLACE = {
 };
 function writeMarketplace() {
   const dir = marketplaceDir();
-  mkdirSync6(path20.join(dir, ".claude-plugin"), { recursive: true });
-  writeFileSync7(path20.join(dir, ".claude-plugin", "marketplace.json"), `${JSON.stringify(MARKETPLACE, null, 2)}
+  mkdirSync6(path22.join(dir, ".claude-plugin"), { recursive: true });
+  writeFileSync7(path22.join(dir, ".claude-plugin", "marketplace.json"), `${JSON.stringify(MARKETPLACE, null, 2)}
 `);
   return dir;
 }
@@ -24532,11 +25220,30 @@ function describeInferred(inferred) {
 
 // src/commands/scan.ts
 import { mkdtempSync as mkdtempSync3, rmSync as rmSync7, writeFileSync as writeFileSync8 } from "fs";
-import os6 from "os";
-import path21 from "path";
+import os7 from "os";
+import path23 from "path";
+
+// src/connectors/refresh.ts
+import { readFileSync as readFileSync20 } from "fs";
+async function refreshToolSettings(root) {
+  if (process.env.AURA_NO_CONNECTORS) return;
+  let previous = null;
+  try {
+    previous = JSON.parse(readFileSync20(auraPath(root, "scan.json"), "utf8"));
+  } catch {
+  }
+  const snapshots = loadSnapshots(root);
+  for (const connector of CONNECTORS) {
+    if (!(previous ? connector.detect(previous) : connector.id === "github") || !isStale(snapshots[connector.id])) continue;
+    const connection = await connector.connect(root).catch(() => null);
+    if (connection?.ok) saveSnapshot(root, connector.id, withRefusals(await readSettings(connector, connection.ctx), snapshots[connector.id]));
+  }
+}
+
+// src/commands/scan.ts
 async function scanRef(root, ref, opts) {
-  const dir = mkdtempSync3(path21.join(os6.tmpdir(), "aura-base-"));
-  const wt = path21.join(dir, "tree");
+  const dir = mkdtempSync3(path23.join(os7.tmpdir(), "aura-base-"));
+  const wt = path23.join(dir, "tree");
   const add = await run("git", ["worktree", "add", "--detach", wt, ref], { cwd: root });
   if (add.code !== 0) {
     rmSync7(dir, { recursive: true, force: true });
@@ -24557,6 +25264,7 @@ async function scanCommand(flags) {
   const opts = { fast: Boolean(flags.fast || flags.base), noDownload: flags.download === false };
   const s = spin(!quiet && !flags.ci);
   s.start("Scanning");
+  if (!flags.ci) await refreshToolSettings(root);
   const scan = await runScan(root, opts, (m) => s.message(`Checking: ${m}`));
   s.stop(`Scanned ${scan.checks.filter((c) => c.status !== "not-applicable").length} checks`);
   const client = AuraClient.from(config2);
@@ -24625,7 +25333,7 @@ async function scanCommand(flags) {
 // src/commands/init.ts
 var AGENT_IDS = ["claude", "codex", "cursor", "pi"];
 function detectAgents(root) {
-  return detectAgentsFrom((rel) => existsSync17(path22.join(root, rel)));
+  return detectAgentsFrom((rel) => existsSync20(path24.join(root, rel)));
 }
 function openEditor(file2) {
   const fallback = process.platform === "win32" ? "notepad" : spawnSync3("sh", ["-c", "command -v nano"]).status === 0 ? "nano" : "vi";
@@ -24740,13 +25448,13 @@ async function initCommand(flags) {
   let brief2 = null;
   let keptBrief = false;
   if (flags.briefFile) {
-    brief2 = readFileSync17(flags.briefFile, "utf8");
-  } else if (!flags.answers && existsSync17(briefPath) && !(tty && unwrap(await p.confirm({ message: "A product brief already exists. Draft a new one?", initialValue: false })))) {
+    brief2 = readFileSync21(flags.briefFile, "utf8");
+  } else if (!flags.answers && existsSync20(briefPath) && !(tty && unwrap(await p.confirm({ message: "A product brief already exists. Draft a new one?", initialValue: false })))) {
     keptBrief = true;
   } else {
     let answers = null;
     if (flags.answers) {
-      answers = OnboardingAnswersSchema.parse(JSON.parse(readFileSync17(flags.answers, "utf8")));
+      answers = OnboardingAnswersSchema.parse(JSON.parse(readFileSync21(flags.answers, "utf8")));
     } else if (tty) {
       const inferred = inferAnswers(ctx);
       p.note(describeInferred(inferred).join("\n"), "Here\u2019s what Aura found about your app");
@@ -24878,7 +25586,7 @@ ${pc.magenta("\u2726")} ${pc.bold("Give the user the aura command")}`);
 }
 
 // src/commands/summary.ts
-import path23 from "path";
+import path25 from "path";
 async function activity(root, since) {
   const log = await git(root, "log", `--since=${since.toISOString()}`, "--no-merges", "--format=%H%x09%an%x09%s");
   const commits = log.stdout.split("\n").filter(Boolean).slice(0, 300).map((l) => {
@@ -24935,7 +25643,7 @@ async function summaryCommand(flags) {
   const beforeIds = new Set(before ? allFindings(before).map((f) => f.id) : []);
   const nowIds = new Set(allFindings(now).map((f) => f.id));
   const req = {
-    repo: path23.basename(root),
+    repo: path25.basename(root),
     since: since.toISOString(),
     until: until.toISOString(),
     product: productContext(root),
@@ -24983,11 +25691,11 @@ ${body}`);
 import pc4 from "picocolors";
 
 // src/core/update-check.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync18, writeFileSync as writeFileSync9 } from "fs";
-import os7 from "os";
-import path24 from "path";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync22, writeFileSync as writeFileSync9 } from "fs";
+import os8 from "os";
+import path26 from "path";
 var DAY_MS = 24 * 60 * 60 * 1e3;
-var cacheFile = () => path24.join(os7.homedir(), ".aura", "update-check.json");
+var cacheFile = () => path26.join(os8.homedir(), ".aura", "update-check.json");
 function isNewer(a, b) {
   if (!/^\d+\.\d+\.\d+$/.test(a) || !/^\d+\.\d+\.\d+$/.test(b)) return false;
   const [x, y] = [a, b].map((v) => v.split(".").map(Number));
@@ -25007,13 +25715,13 @@ async function newerVersion(opts = {}) {
   const now = opts.now ?? Date.now();
   let latest = null;
   try {
-    const cached2 = JSON.parse(readFileSync18(cacheFile(), "utf8"));
+    const cached2 = JSON.parse(readFileSync22(cacheFile(), "utf8"));
     if (now - cached2.checkedAt < DAY_MS) latest = cached2.latest;
     else throw new Error("stale");
   } catch {
     latest = await (opts.fetchLatest ?? fetchLatest)();
     try {
-      mkdirSync7(path24.dirname(cacheFile()), { recursive: true });
+      mkdirSync7(path26.dirname(cacheFile()), { recursive: true });
       writeFileSync9(cacheFile(), JSON.stringify({ checkedAt: now, latest }));
     } catch {
     }