getaura 0.1.8 → 0.1.10

package/dist/index.js

@@ -10,7 +10,7 @@ import { Command, Option } from "commander";
 
 // src/commands/apply.ts
 import { existsSync as existsSync19, rmSync as rmSync6 } from "fs";
-import path20 from "path";
+import path21 from "path";
 
 // src/core/agents.ts
 var AGENT_LAYOUT = {
@@ -1009,10 +1009,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path27) {
-  if (!path27)
+function getElementAtPath(obj, path28) {
+  if (!path28)
     return obj;
-  return path27.reduce((acc, key) => acc?.[key], obj);
+  return path28.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -1352,11 +1352,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path27, issues) {
+function prefixIssues(path28, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path27);
+    iss.path.unshift(path28);
     return iss;
   });
 }
@@ -1806,16 +1806,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path27 = []) => {
+  const processError = (error63, path28 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path27, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path28, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path27, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path28, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path27, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path28, ...issue2.path]);
       } else {
-        const fullpath = [...path27, ...issue2.path];
+        const fullpath = [...path28, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -1854,17 +1854,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path27 = []) => {
+  const processError = (error63, path28 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path27, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path28, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path27, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path28, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path27, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path28, ...issue2.path]);
       } else {
-        const fullpath = [...path27, ...issue2.path];
+        const fullpath = [...path28, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -1903,8 +1903,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path27 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path27) {
+  const path28 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path28) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -19006,13 +19006,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path27 = ref.slice(1).split("/").filter(Boolean);
-  if (path27.length === 0) {
+  const path28 = ref.slice(1).split("/").filter(Boolean);
+  if (path28.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path27[0] === defsKey) {
-    const key = path27[1] === void 0 ? void 0 : decodeJSONPointerSegment(path27[1]);
+  if (path28[0] === defsKey) {
+    const key = path28[1] === void 0 ? void 0 : decodeJSONPointerSegment(path28[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -20130,6 +20130,26 @@ async function commandExists(cmd) {
 import { mkdirSync, rmSync, writeFileSync } from "fs";
 import path2 from "path";
 
+// src/core/local-files.ts
+var LOCAL_ONLY = [
+  { rule: "node_modules/", test: /(?:^|\/)node_modules\//, what: "installed packages" },
+  { rule: ".next/", test: /(?:^|\/)\.next\//, what: "Next.js build output" },
+  { rule: ".vercel/", test: /(?:^|\/)\.vercel\//, what: "the Vercel project link" },
+  { rule: "supabase/.temp/", test: /(?:^|\/)supabase\/\.temp\//, what: "Supabase CLI working files" },
+  { rule: ".turbo/", test: /(?:^|\/)\.turbo\//, what: "Turborepo cache" },
+  { rule: "coverage/", test: /(?:^|\/)coverage\//, what: "test coverage reports" },
+  { rule: ".env*.local", test: /(?:^|\/)\.env(?:\.[^/]+)?\.local$/, what: "local secrets" },
+  { rule: ".claude/settings.local.json", test: /(?:^|\/)\.claude\/settings\.local\.json$/, what: "personal Claude Code settings" },
+  { rule: ".DS_Store", test: /(?:^|\/)\.DS_Store$/, what: "macOS folder files" },
+  { rule: "Thumbs.db", test: /(?:^|\/)Thumbs\.db$/i, what: "Windows thumbnail files" },
+  { rule: "*.log", test: /\.log$/, what: "log files" },
+  { rule: "*.tsbuildinfo", test: /\.tsbuildinfo$/, what: "TypeScript build caches" },
+  { rule: ".eslintcache", test: /(?:^|\/)\.eslintcache$/, what: "ESLint cache" }
+];
+function isLocalOnly(file2) {
+  return LOCAL_ONLY.some(({ test }) => test.test(file2) || test.test(`${file2}x`));
+}
+
 // src/core/repo.ts
 import { existsSync, readdirSync, readFileSync, statSync } from "fs";
 import path from "path";
@@ -20216,7 +20236,7 @@ async function ghStatus(root) {
 var AURA_OWNED = /^(?:\.aura\/|\.claude\/skills\/aura\/|\.agents\/skills\/aura(?:-(?:scan|next|fix|setup))?\/|\.cursor\/commands\/aura-[a-z]+\.md$|\.pi\/prompts\/aura-[a-z]+\.md$|\.claude\/settings\.json$)/;
 async function dirtyFiles(root) {
   const r = await git(root, "status", "--porcelain", "-uall");
-  return r.stdout.split("\n").filter(Boolean).map((l) => l.slice(3).replace(/^"|"$/g, "").split(" -> ").pop()).filter((f) => !AURA_OWNED.test(f));
+  return r.stdout.split("\n").filter(Boolean).map((l) => l.slice(3).replace(/^"|"$/g, "").split(" -> ").pop()).filter((f) => !AURA_OWNED.test(f) && !isLocalOnly(f));
 }
 async function currentBranch(root) {
   return (await git(root, "rev-parse", "--abbrev-ref", "HEAD")).stdout.trim();
@@ -20358,9 +20378,9 @@ var github = {
       isPrivate: Boolean(info.isPrivate),
       defaultBranch: info.defaultBranchRef?.name || "main",
       gh,
-      get: (path27) => {
-        if (!cache.has(path27)) cache.set(path27, gh(["api", path27]));
-        return cache.get(path27);
+      get: (path28) => {
+        if (!cache.has(path28)) cache.set(path28, gh(["api", path28]));
+        return cache.get(path28);
       }
     };
     return { ok: true, ctx, target: `${ctx.repo} ${ctx.isPrivate ? "(private)" : "(public)"}` };
@@ -20536,8 +20556,21 @@ var supabase = {
         return cache.get(endpoint);
       }
     };
-    const project = await ctx.get(`/v1/projects/${ref}`);
-    if (!project?.name) return { ok: false, problem: `Couldn\u2019t read the Supabase project ${ref}. Check your account can open it.`, errorType: "NoProject" };
+    const read2 = await call("GET", `/v1/projects/${ref}`);
+    if (read2.status === 401)
+      return { ok: false, problem: "Your Supabase login has expired. Run `npx supabase login`, then try again.", errorType: "CliNotSignedIn" };
+    if (read2.status !== 200 || !read2.json?.name)
+      return {
+        ok: false,
+        // Projects created through Vercel's Supabase integration live in a Supabase account linked to Vercel.
+        problem: [
+          `The Supabase account you\u2019re signed in to can\u2019t open this project (${ref}).`,
+          "If you created the database through Vercel: in Vercel open Storage, click the database, then Open in Supabase. In that same browser, run `npx supabase login` and approve it. Then try again.",
+          "Otherwise run `npx supabase login` with the Supabase account that owns the project."
+        ].join("\n  "),
+        errorType: "NoAccess"
+      };
+    const project = read2.json;
     return { ok: true, ctx, target: project.name };
   },
   settings: [
@@ -21033,7 +21066,7 @@ function pmCommands(pm) {
 // package.json
 var package_default = {
   name: "getaura",
-  version: "0.1.8",
+  version: "0.1.10",
   description: "Aura helps you and your coding agent follow best practices while you vibe code.",
   type: "module",
   bin: {
@@ -21271,6 +21304,15 @@ var ACTIONS = [
   },
   { id: "add-security-headers", title: "Add security headers", category: "security", delivery: "pr", resolves: ["security.headers"] },
   // Structure
+  {
+    id: "ignore-local-files",
+    buildSafe: true,
+    title: "Keep local and tool files out of git",
+    category: "structure",
+    delivery: "pr",
+    resolves: ["structure.local-files"]
+  },
+  { id: "save-aura-setup", buildSafe: true, title: "Save Aura\u2019s setup in git", category: "agent-setup", delivery: "pr", resolves: ["agent.setup-saved"] },
   { id: "remove-dead-files", title: "Remove dead files", category: "structure", delivery: "pr", resolves: ["structure.dead-files"] },
   { id: "move-misplaced-files", title: "Move misplaced files", category: "structure", delivery: "pr", resolves: ["structure.layout"] },
   {
@@ -21441,8 +21483,8 @@ function nextSteps(scan, opts = {}) {
 }
 
 // src/actions/generators.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
-import path12 from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync10 } from "fs";
+import path13 from "path";
 
 // src/checks/agent-setup.ts
 import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync6 } from "fs";
@@ -21478,6 +21520,81 @@ function lineOf(text, index) {
   return line;
 }
 
+// src/checks/git-hygiene.ts
+async function untracked(root, collapse) {
+  const r = await run("git", ["ls-files", "--others", "--exclude-standard", ...collapse ? ["--directory"] : []], { cwd: root });
+  return r.code === 0 ? r.stdout.split("\n").filter(Boolean) : null;
+}
+async function modified(root) {
+  const r = await run("git", ["diff", "--name-only", "HEAD"], { cwd: root });
+  return r.code === 0 ? r.stdout.split("\n").filter(Boolean) : [];
+}
+async function localFileProblems(ctx) {
+  const loose = await untracked(ctx.root, true);
+  if (!loose || !ctx.tracked) return null;
+  return LOCAL_ONLY.map(({ rule, test, what }) => ({
+    rule,
+    what,
+    // Committed .env files are already a security finding, so they aren't counted twice here.
+    committed: rule === ".env*.local" ? [] : [...ctx.tracked].filter((f) => test.test(f)),
+    // A collapsed folder like "supabase/.temp/" matches through a file inside it.
+    notIgnored: loose.filter((f) => test.test(f) || test.test(`${f}x`))
+  })).filter((p2) => p2.committed.length || p2.notIgnored.length);
+}
+var localFiles = {
+  id: "structure.local-files",
+  category: "structure",
+  title: "Local and tool files are kept out of git",
+  weight: 2,
+  applies: (ctx) => ctx.tracked !== null,
+  async run(ctx) {
+    const problems = await localFileProblems(ctx);
+    if (!problems) return { status: "unknown", summary: "Couldn\u2019t ask git which files it ignores." };
+    if (problems.length === 0) return { status: "pass", summary: "Tool and machine files are ignored by git." };
+    const committed = problems.flatMap((p2) => p2.committed);
+    const finding = makeFinding(this, {
+      severity: committed.length ? "medium" : "low",
+      title: committed.length ? `${committed.length} local file(s) are committed to git` : `${problems.length} kind(s) of local file aren\u2019t ignored by git`,
+      detail: problems.map(
+        (p2) => `${p2.what} (${[...p2.committed, ...p2.notIgnored].slice(0, 3).join(", ")}): add \`${p2.rule}\` to .gitignore${p2.committed.length ? " and stop tracking them" : ""}`
+      ).join("; "),
+      why: "Files your computer or a tool makes for itself can hold logins and machine paths, and they clutter every change. Ignored, they can\u2019t be committed by accident.",
+      locations: [{ file: ".gitignore" }],
+      actionId: "ignore-local-files",
+      key: "local-files"
+    });
+    return { status: committed.length ? "fail" : "partial", score: committed.length ? 0 : 0.5, summary: finding.title, findings: [finding] };
+  }
+};
+async function unsavedSetup(ctx) {
+  const loose = await untracked(ctx.root, false);
+  if (!loose) return null;
+  return [.../* @__PURE__ */ new Set([...loose, ...await modified(ctx.root)])].filter((f) => AURA_OWNED.test(f)).sort();
+}
+var setupSaved = {
+  id: "agent.setup-saved",
+  category: "agent-setup",
+  title: "Aura\u2019s setup is saved in git",
+  weight: 2,
+  // Before the first-run PR is merged, that PR is the next step, not this.
+  applies: (ctx) => Boolean(ctx.tracked?.has(".aura/brief.md")),
+  async run(ctx) {
+    const files = await unsavedSetup(ctx);
+    if (!files) return { status: "unknown", summary: "Couldn\u2019t ask git for uncommitted files." };
+    if (files.length === 0) return { status: "pass", summary: "Everything Aura set up is committed." };
+    const finding = makeFinding(this, {
+      severity: "low",
+      title: `${files.length} Aura setup file(s) aren\u2019t committed`,
+      detail: `Not in git yet: ${files.slice(0, 8).join(", ")}${files.length > 8 ? "\u2026" : ""}.`,
+      why: "Your teammates, CI and your coding agent on other computers only get the setup that\u2019s committed.",
+      locations: files.map((file2) => ({ file: file2 })),
+      actionId: "save-aura-setup",
+      key: "setup-saved"
+    });
+    return { status: "partial", score: 0.5, summary: finding.title, findings: [finding] };
+  }
+};
+
 // src/checks/agent-setup.ts
 function exists(ctx, file2) {
   return existsSync7(path8.join(ctx.root, file2));
@@ -21650,7 +21767,7 @@ var brief = {
     return { status: file2 ? "partial" : "fail", score: file2 ? 0.5 : 0, summary: finding.title, findings: [finding] };
   }
 };
-var agentChecks = [rulesFile, rulesCurrent, skills, auraSkill, brief];
+var agentChecks = [rulesFile, rulesCurrent, skills, auraSkill, brief, setupSaved];
 
 // src/core/graph.ts
 import path9 from "path";
@@ -21792,12 +21909,54 @@ function commandList(agent) {
   return AURA_COMMANDS.map((c) => invocation(agent, c)).join(", ");
 }
 
-// src/actions/agent-files.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
+// src/actions/git-hygiene.ts
+import { readFileSync as readFileSync8 } from "fs";
 import path11 from "path";
+var ignoreLocalFiles = async ({ root, ctx }) => {
+  const problems = await localFileProblems(ctx) ?? [];
+  if (problems.length === 0) return { skip: "Tool and machine files are already ignored." };
+  let current2 = "";
+  try {
+    current2 = readFileSync8(path11.join(root, ".gitignore"), "utf8");
+  } catch {
+  }
+  const lines = new Set(current2.split(/\r?\n/).map((l) => l.trim()));
+  const missing = problems.map((p2) => p2.rule).filter((rule) => !lines.has(rule));
+  const committed = problems.flatMap((p2) => p2.committed);
+  const changes = missing.length ? [
+    {
+      path: ".gitignore",
+      content: `${current2}${current2 && !current2.endsWith("\n") ? "\n" : ""}
+# Local and tool files (added by Aura)
+${missing.join("\n")}
+`
+    }
+  ] : [];
+  return {
+    changes,
+    commands: committed.length ? [["git", "rm", "-r", "-q", "--cached", "--", ...committed]] : [],
+    details: [
+      ...problems.map(
+        (p2) => `- ${p2.what}: \`${p2.rule}\`${p2.committed.length ? ` (stops tracking ${p2.committed.length} file(s); they stay on your computer)` : ""}`
+      )
+    ]
+  };
+};
+var saveAuraSetup = async ({ root }) => {
+  const files = await unsavedSetup({ root }) ?? [];
+  if (files.length === 0) return { skip: "Everything Aura set up is already committed." };
+  return {
+    changes: files.map((file2) => ({ path: file2, content: readFileSync8(path11.join(root, file2), "utf8") })),
+    details: files.map((f) => `- \`${f}\``)
+  };
+};
+
+// src/actions/agent-files.ts
+import { existsSync as existsSync8, readFileSync as readFileSync9 } from "fs";
+import path12 from "path";
 function current(root, file2) {
-  const full = path11.join(root, file2);
-  return existsSync8(full) ? readFileSync8(full, "utf8") : null;
+  const full = path12.join(root, file2);
+  return existsSync8(full) ? readFileSync9(full, "utf8") : null;
 }
 function upsertBlock(existing, body) {
   const block = `${AURA_BLOCK_START}
@@ -21841,8 +22000,8 @@ function skillChanges(agents, names) {
 
 // src/actions/generators.ts
 function read(root, file2) {
-  const full = path12.join(root, file2);
-  return existsSync9(full) ? readFileSync9(full, "utf8") : null;
+  const full = path13.join(root, file2);
+  return existsSync9(full) ? readFileSync10(full, "utf8") : null;
 }
 function withScripts(root, scripts, overwrite = false) {
   const text = read(root, "package.json");
@@ -21863,7 +22022,7 @@ function findingMeta(scan, checkId, key) {
   return scan.checks.find((c) => c.checkId === checkId)?.findings[0]?.meta?.[key];
 }
 var addBrief = ({ root }) => {
-  const brief2 = BRIEF_PATHS.find((f) => existsSync9(path12.join(root, f)));
+  const brief2 = BRIEF_PATHS.find((f) => existsSync9(path13.join(root, f)));
   if (!brief2) return { skip: "There is no product brief yet. Run `aura init` to draft and confirm it first." };
   const changes = [
     { path: brief2, content: read(root, brief2) },
@@ -21888,14 +22047,14 @@ var installSkills = ({ agents, skills: skills2 }) => {
 };
 var tokenEfficiency = (g) => {
   const changes = [];
-  if (!existsSync9(path12.join(g.root, "docs/index.md"))) changes.push({ path: "docs/index.md", content: render("docs/index.md", g.vars) });
+  if (!existsSync9(path13.join(g.root, "docs/index.md"))) changes.push({ path: "docs/index.md", content: render("docs/index.md", g.vars) });
   changes.push(...rulesChanges(g.root, g.agents, g.vars));
   return { changes, details: ["- `docs/index.md`: a map of the repo your agent reads first", "- Lean-context rules in the agent rules file"] };
 };
 var addCi = ({ root, ctx, vars }) => {
   const existing = ctx.files.filter((f) => /^\.github\/workflows\//.test(f));
   const file2 = existing.includes(".github/workflows/ci.yml") ? ".github/workflows/checks.yml" : ".github/workflows/ci.yml";
-  if (existsSync9(path12.join(root, file2))) return { skip: `${file2} already exists.` };
+  if (existsSync9(path13.join(root, file2))) return { skip: `${file2} already exists.` };
   return {
     changes: [{ path: file2, content: render("github/workflows/ci.yml", vars) }],
     details: [`- \`${file2}\`: lint, type check, tests and build on every pull request`]
@@ -21919,7 +22078,7 @@ var setupTesting = ({ root, ctx, vars }) => {
   };
 };
 var addEnvExample = ({ root, scan }) => {
-  const file2 = [".env.example", ".env.sample", ".env.template"].find((f) => existsSync9(path12.join(root, f))) ?? ".env.example";
+  const file2 = [".env.example", ".env.sample", ".env.template"].find((f) => existsSync9(path13.join(root, f))) ?? ".env.example";
   const existing = read(root, file2);
   const declared = new Set(
     (existing ?? "").split(/\r?\n/).map((l) => l.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/)?.[1]).filter(Boolean)
@@ -21976,7 +22135,7 @@ var addLinting = ({ root, ctx }) => {
   return { changes, devDeps, details };
 };
 var addPreCommit = ({ root, ctx, vars }) => {
-  if (existsSync9(path12.join(root, ".husky/pre-commit"))) return { skip: "A husky pre-commit hook already exists." };
+  if (existsSync9(path13.join(root, ".husky/pre-commit"))) return { skip: "A husky pre-commit hook already exists." };
   const changes = [{ path: ".husky/pre-commit", content: render("configs/husky-pre-commit", vars) }];
   const scripts = withScripts(root, { prepare: "husky" }, false);
   if (scripts) changes.push(scripts);
@@ -22006,7 +22165,7 @@ ${current2.trim()}
   };
 };
 var enableDependencyUpdates = ({ root, vars }) => {
-  if ([".github/dependabot.yml", ".github/dependabot.yaml", "renovate.json", ".github/renovate.json"].some((f) => existsSync9(path12.join(root, f)))) {
+  if ([".github/dependabot.yml", ".github/dependabot.yaml", "renovate.json", ".github/renovate.json"].some((f) => existsSync9(path13.join(root, f)))) {
     return { skip: "Dependabot or Renovate is already configured." };
   }
   return {
@@ -22086,7 +22245,7 @@ function planMoves(root, ctx, moves) {
       const alias = aliasFor(toFile);
       if (alias) return alias[0] + noExt.slice(alias[1].length);
     }
-    let rel = path12.posix.relative(path12.posix.dirname(fromFile), noExt);
+    let rel = path13.posix.relative(path13.posix.dirname(fromFile), noExt);
     if (!rel.startsWith(".")) rel = `./${rel}`;
     return rel;
   };
@@ -22120,7 +22279,7 @@ function planMoves(root, ctx, moves) {
 }
 var moveMisplacedFiles = ({ root, ctx, scan }) => {
   const raw = findingMeta(scan, "structure.layout", "moves") ?? [];
-  const moves = raw.map((m) => m.split("=>")).filter(([, to]) => !existsSync9(path12.join(root, to))).slice(0, MAX_MOVES);
+  const moves = raw.map((m) => m.split("=>")).filter(([, to]) => !existsSync9(path13.join(root, to))).slice(0, MAX_MOVES);
   if (moves.length === 0) return { skip: "No files to move (or their targets already exist)." };
   return { changes: planMoves(root, ctx, moves), details: moves.map(([from, to]) => `- \`${from}\` \u2192 \`${to}\``), verifyTypes: true };
 };
@@ -22156,16 +22315,20 @@ var GENERATORS = {
   "add-security-headers": addSecurityHeaders,
   "remove-dead-files": removeDeadFiles,
   "move-misplaced-files": moveMisplacedFiles,
-  "add-aura-workflow": addAuraWorkflow
+  "add-aura-workflow": addAuraWorkflow,
+  "ignore-local-files": ignoreLocalFiles,
+  "save-aura-setup": saveAuraSetup
 };
-function foundationPlan(g) {
+
+// src/actions/foundation.ts
+async function foundationPlan(g) {
   const parts = ["add-brief", "install-skills", "token-efficiency", "add-env-example", "add-aura-workflow"];
   const ciFailing = g.scan.checks.find((c) => c.checkId === "foundations.ci")?.status !== "pass";
   if (g.scan.stack.recognized && ciFailing) parts.push("add-ci");
   const byPath = /* @__PURE__ */ new Map();
   const details = [];
   for (const id of parts) {
-    const plan = GENERATORS[id](g);
+    const plan = await GENERATORS[id](g);
     if ("skip" in plan) continue;
     for (const c of plan.changes) byPath.set(c.path, c);
     details.push(`**${id.replace(/-/g, " ").replace(/^\w/, (c) => c.toUpperCase())}**`, ...plan.details, "");
@@ -22211,7 +22374,7 @@ var AuraClient = class _AuraClient {
   get hasKey() {
     return Boolean(this.key);
   }
-  async request(method, path27, body, timeoutMs = 6e4) {
+  async request(method, path28, body, timeoutMs = 6e4) {
     if (!this.key) throw new AuraApiError("no_key", "No pilot key");
     let payload;
     if (body !== void 0) {
@@ -22221,7 +22384,7 @@ var AuraClient = class _AuraClient {
     }
     let res;
     try {
-      res = await fetch(`${this.baseUrl}/v1/${path27}`, {
+      res = await fetch(`${this.baseUrl}/v1/${path28}`, {
         method,
         headers: { authorization: `Bearer ${this.key}`, "content-type": "application/json", "user-agent": `getaura/${AURA_VERSION}` },
         body: payload,
@@ -22285,13 +22448,13 @@ var say = {
 };
 
 // src/fix-tracking.ts
-import { existsSync as existsSync10, readFileSync as readFileSync10 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync11 } from "fs";
 var FILE = "fixes.json";
 var MAX_AGE_MS = 60 * 24 * 60 * 60 * 1e3;
 var MAX_CHECKS_PER_SCAN = 5;
 function loadTrackedFixes(root) {
   try {
-    return existsSync10(auraPath(root, FILE)) ? JSON.parse(readFileSync10(auraPath(root, FILE), "utf8")) : [];
+    return existsSync10(auraPath(root, FILE)) ? JSON.parse(readFileSync11(auraPath(root, FILE), "utf8")) : [];
   } catch {
     return [];
   }
@@ -22599,8 +22762,8 @@ var typecheck = {
   async run(ctx) {
     if (ctx.options.fast) return { status: "unknown", summary: "Skipped in fast mode." };
     const { existsSync: existsSync21 } = await import("fs");
-    const path27 = await import("path");
-    const tsc = path27.join(ctx.root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
+    const path28 = await import("path");
+    const tsc = path28.join(ctx.root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
     if (!existsSync21(tsc)) return { status: "unknown", summary: "Dependencies not installed, so the type check was skipped." };
     const r = await run(tsc, ["--noEmit", "--pretty", "false"], { cwd: ctx.root, timeoutMs: 18e4 });
     if (r.timedOut) return { status: "unknown", summary: "Type check timed out." };
@@ -22622,18 +22785,35 @@ var typecheck = {
 var foundationChecks = [ciWorkflow, tests, readme, envExample, lockfile, lintFormat, typecheck];
 
 // src/connectors/snapshot.ts
-import { existsSync as existsSync11, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync12 } from "fs";
+var REFUSAL_MS = 30 * 24 * 60 * 60 * 1e3;
+function withRefusals(states, snap, now = Date.now()) {
+  return Object.fromEntries(
+    Object.entries(states).map(([id, s]) => {
+      const refusal = snap?.refused?.[id];
+      return [id, s.state === "off" && refusal && now - Date.parse(refusal.at) < REFUSAL_MS ? { state: "unavailable", why: refusal.why } : s];
+    })
+  );
+}
 var FILE2 = "cache/connectors.json";
 function loadSnapshots(root) {
   try {
-    return existsSync11(auraPath(root, FILE2)) ? JSON.parse(readFileSync11(auraPath(root, FILE2), "utf8")) : {};
+    return existsSync11(auraPath(root, FILE2)) ? JSON.parse(readFileSync12(auraPath(root, FILE2), "utf8")) : {};
   } catch {
     return {};
   }
 }
-function saveSnapshot(root, toolId, states) {
+function saveSnapshot(root, toolId, states, refusedNow = {}) {
   const all = loadSnapshots(root);
-  all[toolId] = { checkedAt: (/* @__PURE__ */ new Date()).toISOString(), settings: Object.fromEntries(Object.entries(states).map(([id, s]) => [id, s.state])) };
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const refused = { ...all[toolId]?.refused };
+  for (const [id, why] of Object.entries(refusedNow)) refused[id] = { why, at: now };
+  for (const [id, s] of Object.entries(states)) if (s.state === "on") delete refused[id];
+  all[toolId] = {
+    checkedAt: now,
+    settings: Object.fromEntries(Object.entries(states).map(([id, s]) => [id, s.state])),
+    ...Object.keys(refused).length ? { refused } : {}
+  };
   writeAuraFile(root, FILE2, `${JSON.stringify(all, null, 2)}
 `);
 }
@@ -22779,7 +22959,7 @@ var apiRoutes = {
 import { createHash as createHash3 } from "crypto";
 import { chmodSync as chmodSync2, existsSync as existsSync12, mkdirSync as mkdirSync3, mkdtempSync, readdirSync as readdirSync4, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import os3 from "os";
-import path13 from "path";
+import path14 from "path";
 var GITLEAKS_SHA = {
   darwin_arm64: "b40ab0ae55c505963e365f271a8d3846efbc170aa17f2607f13df610a9aeb6a5",
   darwin_x64: "dfe101a4db2255fc85120ac7f3d25e4342c3c20cf749f2c20a18081af1952709",
@@ -22797,7 +22977,7 @@ var OSV_SHA = {
   windows_arm64: "ca1379da0e408279ef2c85cde0846a903495738a91c7b065a208048437c1686c"
 };
 function tarCommand(platform = process.platform, systemRoot = process.env.SystemRoot) {
-  return platform === "win32" ? path13.win32.join(systemRoot || "C:\\Windows", "System32", "tar.exe") : "tar";
+  return platform === "win32" ? path14.win32.join(systemRoot || "C:\\Windows", "System32", "tar.exe") : "tar";
 }
 var TOOLS = {
   gitleaks: {
@@ -22833,7 +23013,7 @@ function ensureTool(name, noDownload = false) {
 async function resolveTool(name, noDownload) {
   const spec = TOOLS[name];
   const exe = process.platform === "win32" ? `${name}.exe` : name;
-  const cached2 = path13.join(auraBinDir(), `${name}-${spec.version}`, exe);
+  const cached2 = path14.join(auraBinDir(), `${name}-${spec.version}`, exe);
   if (existsSync12(cached2)) return { path: cached2, version: spec.version };
   if (await commandExists(name)) {
     const v = await run(name, ["version"]);
@@ -22854,20 +23034,20 @@ async function download(name, spec, target) {
   const buf = Buffer.from(await res.arrayBuffer());
   const digest = createHash3("sha256").update(buf).digest("hex");
   if (digest !== asset.sha256) throw new Error(`Checksum mismatch for ${asset.file}`);
-  const dir = path13.dirname(target);
+  const dir = path14.dirname(target);
   mkdirSync3(dir, { recursive: true });
-  const tmp = mkdtempSync(path13.join(os3.tmpdir(), `aura-${name}-`));
+  const tmp = mkdtempSync(path14.join(os3.tmpdir(), `aura-${name}-`));
   try {
     if (asset.archive === null) {
       writeFileSync3(target, buf);
     } else {
-      const archivePath = path13.join(tmp, asset.file);
+      const archivePath = path14.join(tmp, asset.file);
       writeFileSync3(archivePath, buf);
       const r = await run(tarCommand(), ["-xf", archivePath, "-C", tmp]);
       if (r.code !== 0) return null;
       const exe = readdirSync4(tmp).find((f) => f === name || f === `${name}.exe`);
       if (!exe) return null;
-      renameSync(path13.join(tmp, exe), target);
+      renameSync(path14.join(tmp, exe), target);
     }
     chmodSync2(target, 493);
     return { path: target, version: spec.version };
@@ -23138,9 +23318,9 @@ var rls = {
 };
 
 // src/checks/security/secrets.ts
-import { existsSync as existsSync13, mkdtempSync as mkdtempSync2, readFileSync as readFileSync12, rmSync as rmSync3 } from "fs";
+import { existsSync as existsSync13, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, rmSync as rmSync3 } from "fs";
 import os4 from "os";
-import path14 from "path";
+import path15 from "path";
 
 // src/core/ignore.ts
 function globToRegex(glob) {
@@ -23178,15 +23358,15 @@ async function gitleaksHistory(ctx) {
   if (!ctx.tracked) return null;
   const bin = await ensureTool("gitleaks", ctx.options.noDownload);
   if (!bin) return null;
-  const dir = mkdtempSync2(path14.join(os4.tmpdir(), "aura-gitleaks-"));
-  const report = path14.join(dir, "report.json");
+  const dir = mkdtempSync2(path15.join(os4.tmpdir(), "aura-gitleaks-"));
+  const report = path15.join(dir, "report.json");
   try {
     const r = await run(bin.path, ["git", "--no-banner", "--redact", "--report-format", "json", "--report-path", report, "--exit-code", "0", "."], {
       cwd: ctx.root,
       timeoutMs: 18e4
     });
     if (r.code !== 0 || !existsSync13(report)) return null;
-    return { hits: JSON.parse(readFileSync12(report, "utf8")), engine: `gitleaks ${bin.version}` };
+    return { hits: JSON.parse(readFileSync13(report, "utf8")), engine: `gitleaks ${bin.version}` };
   } catch {
     return null;
   } finally {
@@ -23301,7 +23481,7 @@ var envFiles = {
 var securityChecks = [secrets, envFiles, deps, rls, apiRoutes, headers, ...CONNECTORS.map(toolSettingsCheck)];
 
 // src/checks/structure.ts
-import path15 from "path";
+import path16 from "path";
 var GENERATED = /(?:^|\/)(?:supabase\/migrations|generated|__generated__|\.generated)\/|\.(?:d\.ts|min\.js)$|(?:^|\/)(?:database|supabase)\.types\.ts$|(?:^|\/)components\/ui\//;
 function appSource(ctx) {
   return ctx.files.filter((f) => isSourceFile(f) && !GENERATED.test(f));
@@ -23390,7 +23570,7 @@ var duplicates = {
     const findings = pairs.map(
       ([a, b, sim]) => makeFinding(this, {
         severity: "low",
-        title: `${path15.basename(a)} and ${path15.basename(b)} are near-duplicates`,
+        title: `${path16.basename(a)} and ${path16.basename(b)} are near-duplicates`,
         detail: `${a} and ${b} are ${Math.round(sim * 100)}% the same.`,
         why: "Duplicates drift apart over time: a bug gets fixed in one copy and not the other, and your agent can\u2019t tell which one is right.",
         locations: [{ file: a }, { file: b }],
@@ -23404,7 +23584,7 @@ var duplicates = {
 };
 var ROOT_ALLOWED = /^(?:[^/]+\.config\.[cm]?[jt]s|middleware\.[cm]?[jt]s|proxy\.[cm]?[jt]s|instrumentation(?:-client)?\.[cm]?[jt]s|next-env\.d\.ts|global\.d\.ts|env\.d\.ts|sentry\.[\w.]+\.[cm]?[jt]s)$/;
 function suggestTarget(file2, srcDir) {
-  const base = path15.posix.basename(file2);
+  const base = path16.posix.basename(file2);
   const prefix = srcDir ? "src/" : "";
   const isComponent = /^[A-Z][A-Za-z0-9]*\.(?:tsx|jsx)$/.test(base);
   if (isComponent) return `${prefix}components/${base}`;
@@ -23454,7 +23634,7 @@ var layout = {
     return { status: "fail", score: Math.max(0, 1 - misplaced.length / 8), summary: finding.title, findings: [finding] };
   }
 };
-var structureChecks = [deadFiles, oversized, duplicates, layout];
+var structureChecks = [deadFiles, oversized, duplicates, layout, localFiles];
 
 // src/scan.ts
 var ALL_CHECKS = [...securityChecks, ...agentChecks, ...foundationChecks, ...structureChecks];
@@ -23517,21 +23697,21 @@ async function runScan(root, options, onProgress) {
 }
 
 // src/commands/fix.ts
-import { existsSync as existsSync18, readFileSync as readFileSync19, writeFileSync as writeFileSync6 } from "fs";
-import path19 from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync20, writeFileSync as writeFileSync6 } from "fs";
+import path20 from "path";
 
 // src/agent/tools.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync4, readFileSync as readFileSync13, rmSync as rmSync4, statSync as statSync2, writeFileSync as writeFileSync4 } from "fs";
-import path16 from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync4, readFileSync as readFileSync14, rmSync as rmSync4, statSync as statSync2, writeFileSync as writeFileSync4 } from "fs";
+import path17 from "path";
 var MAX_OUTPUT = 12e3;
 var MAX_FILE_LINES = 800;
 var FORBIDDEN = /^(?:\.git|node_modules|\.next|\.vercel)(?:\/|$)|(?:^|\/)\.env(?:\.(?!example$|sample$|template$)[^/]+)?$/;
 function safePath(root, rel) {
   if (typeof rel !== "string" || !rel.trim()) throw new Error("A file path is required.");
-  const normalized = path16.posix.normalize(rel.replace(/\\/g, "/").replace(/^\.\//, ""));
-  if (normalized.startsWith("../") || normalized === ".." || path16.isAbsolute(normalized)) throw new Error(`Path is outside the repo: ${rel}`);
+  const normalized = path17.posix.normalize(rel.replace(/\\/g, "/").replace(/^\.\//, ""));
+  if (normalized.startsWith("../") || normalized === ".." || path17.isAbsolute(normalized)) throw new Error(`Path is outside the repo: ${rel}`);
   if (FORBIDDEN.test(normalized)) throw new Error(`Aura doesn\u2019t let the agent touch ${normalized}.`);
-  const full = path16.join(root, normalized);
+  const full = path17.join(root, normalized);
   if (!isInside(root, full)) throw new Error(`Path is outside the repo: ${rel}`);
   return normalized;
 }
@@ -23552,10 +23732,10 @@ async function runTool(root, call, allowedCommands2) {
     }
     case "read_file": {
       const rel = safePath(root, input2.path);
-      const full = path16.join(root, rel);
+      const full = path17.join(root, rel);
       if (!existsSync14(full)) return { output: `File not found: ${rel}` };
       if (statSync2(full).size > 1e6) return { output: `${rel} is too large to read.` };
-      const lines = readFileSync13(full, "utf8").split("\n");
+      const lines = readFileSync14(full, "utf8").split("\n");
       const start = Math.max(1, Number(input2.startLine) || 1);
       const end = Math.min(lines.length, Number(input2.endLine) || start + MAX_FILE_LINES - 1);
       const body = lines.slice(start - 1, end).map((l, i) => `${start + i}: ${l}`).join("\n");
@@ -23572,7 +23752,7 @@ async function runTool(root, call, allowedCommands2) {
         if (FORBIDDEN.test(f) || glob && !glob.test(f)) continue;
         let text;
         try {
-          text = readFileSync13(path16.join(root, f), "utf8");
+          text = readFileSync14(path17.join(root, f), "utf8");
         } catch {
           continue;
         }
@@ -23591,14 +23771,14 @@ async function runTool(root, call, allowedCommands2) {
           output: "Refused: the content contains a [REDACTED:\u2026] placeholder. Secrets are hidden from you on purpose. Read the value from an environment variable (process.env.NAME) instead of writing it."
         };
       }
-      mkdirSync4(path16.dirname(path16.join(root, rel)), { recursive: true });
-      writeFileSync4(path16.join(root, rel), content);
+      mkdirSync4(path17.dirname(path17.join(root, rel)), { recursive: true });
+      writeFileSync4(path17.join(root, rel), content);
       return { output: `Wrote ${rel} (${content.split("\n").length} lines).`, touched: rel };
     }
     case "delete_file": {
       const rel = safePath(root, input2.path);
-      if (!existsSync14(path16.join(root, rel))) return { output: `File not found: ${rel}` };
-      rmSync4(path16.join(root, rel));
+      if (!existsSync14(path17.join(root, rel))) return { output: `File not found: ${rel}` };
+      rmSync4(path17.join(root, rel));
       return { output: `Deleted ${rel}.`, touched: rel };
     }
     case "run_command": {
@@ -23620,7 +23800,7 @@ ${(r.stdout + "\n" + r.stderr).trim().slice(-6e3)}`;
 
 // src/api/explain.ts
 import { createHash as createHash4 } from "crypto";
-import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync15 } from "fs";
 
 // src/report.ts
 import pc2 from "picocolors";
@@ -23809,7 +23989,7 @@ var CACHE_FILE = "cache/explanations.json";
 var MAX_EXPLAIN = 25;
 function loadCache(root) {
   try {
-    return JSON.parse(readFileSync14(auraPath(root, CACHE_FILE), "utf8"));
+    return JSON.parse(readFileSync15(auraPath(root, CACHE_FILE), "utf8"));
   } catch {
     return {};
   }
@@ -23831,7 +24011,7 @@ function excerptFor(root, f, context = 4) {
 function productContext(root) {
   const file2 = auraPath(root, "brief.md");
   if (!existsSync15(file2)) return void 0;
-  return redact(readFileSync14(file2, "utf8")).slice(0, 1800);
+  return redact(readFileSync15(file2, "utf8")).slice(0, 1800);
 }
 async function addExplanations(root, scan, client) {
   const cache = loadCache(root);
@@ -23875,22 +24055,30 @@ async function addExplanations(root, scan, client) {
 
 // src/commands/simple.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync17, readdirSync as readdirSync5, readFileSync as readFileSync18 } from "fs";
-import path18 from "path";
+import { existsSync as existsSync17, readdirSync as readdirSync5, readFileSync as readFileSync19 } from "fs";
+import path19 from "path";
 import YAML2 from "yaml";
 
 // src/commands/inventory.ts
-import { readFileSync as readFileSync15 } from "fs";
+import { readFileSync as readFileSync16 } from "fs";
 function accountState(root, services) {
   const inv = loadInventory(root);
+  const read2 = Object.fromEntries(
+    Object.entries(loadSnapshots(root)).map(([id, snap]) => [id, Object.values(snap.settings).every((state) => state !== "off")])
+  );
   return {
     inventoryComplete: services.every((s) => inv.services[s]?.owner) && Boolean(inv.githubOrg),
-    secured: { ...inv.secured, github: Boolean(inv.githubSecurity || inv.secured?.github) }
+    secured: Object.fromEntries(
+      [.../* @__PURE__ */ new Set([...Object.keys(read2), ...Object.keys(inv.secured ?? {}), "github"])].map((id) => [
+        id,
+        Boolean(read2[id] || inv.secured?.[id] || id === "github" && inv.githubSecurity)
+      ])
+    )
   };
 }
 function loadInventory(root) {
   try {
-    return JSON.parse(readFileSync15(auraPath(root, "inventory.json"), "utf8"));
+    return JSON.parse(readFileSync16(auraPath(root, "inventory.json"), "utf8"));
   } catch {
     return { version: 1, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), services: {} };
   }
@@ -23977,10 +24165,10 @@ async function inventoryCommand(flags) {
 }
 
 // src/history.ts
-import { readFileSync as readFileSync16 } from "fs";
+import { readFileSync as readFileSync17 } from "fs";
 function loadHistory(root) {
   try {
-    const data = JSON.parse(readFileSync16(auraPath(root, "history.json"), "utf8"));
+    const data = JSON.parse(readFileSync17(auraPath(root, "history.json"), "utf8"));
     return Array.isArray(data) ? data : [];
   } catch {
     return [];
@@ -24028,10 +24216,10 @@ function banner(colors = pc3.isColorSupported) {
 // src/api/connect.ts
 import { spawn as spawn2 } from "child_process";
 import { constants, generateKeyPairSync, privateDecrypt } from "crypto";
-import { existsSync as existsSync16, mkdirSync as mkdirSync5, readFileSync as readFileSync17, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync5, readFileSync as readFileSync18, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "fs";
 import os5 from "os";
-import path17 from "path";
-var pendingFile = () => path17.join(os5.homedir(), ".aura", "pending-connect.json");
+import path18 from "path";
+var pendingFile = () => path18.join(os5.homedir(), ".aura", "pending-connect.json");
 async function postJson(apiUrl, route, body) {
   let res;
   try {
@@ -24050,7 +24238,7 @@ async function postJson(apiUrl, route, body) {
 }
 function loadPending(apiUrl, now) {
   try {
-    const p2 = JSON.parse(readFileSync17(pendingFile(), "utf8"));
+    const p2 = JSON.parse(readFileSync18(pendingFile(), "utf8"));
     if (p2.apiUrl === apiUrl && Date.parse(p2.expiresAt) - now > 6e4) return p2;
   } catch {
   }
@@ -24069,7 +24257,7 @@ async function startOrResumeConnect(apiUrl, now = Date.now()) {
   });
   const res = ConnectStartResponse.parse(await postJson(apiUrl, "connect", { publicKey }));
   const pending = { apiUrl, privateKey, ...res };
-  mkdirSync5(path17.dirname(pendingFile()), { recursive: true });
+  mkdirSync5(path18.dirname(pendingFile()), { recursive: true });
   writeFileSync5(pendingFile(), JSON.stringify(pending, null, 2) + "\n", { mode: 384 });
   return { ...pending, resumed: false };
 }
@@ -24217,7 +24405,7 @@ async function latestScan(root) {
   const file2 = auraPath(root, "scan.json");
   if (existsSync17(file2)) {
     try {
-      const scan = JSON.parse(readFileSync18(file2, "utf8"));
+      const scan = JSON.parse(readFileSync19(file2, "utf8"));
       const head = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
       const dirty = execFileSync("git", ["status", "--porcelain"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
       if (scan.commit === head && !dirty && Date.now() - Date.parse(scan.scannedAt) < 24 * 36e5) return scan;
@@ -24332,9 +24520,9 @@ async function configCommand(key, value) {
   return 0;
 }
 function loadGuides() {
-  const dir = path18.join(templatesDir(), "guides");
+  const dir = path19.join(templatesDir(), "guides");
   return readdirSync5(dir).filter((f) => f.endsWith(".md")).map((f) => {
-    const text = readFileSync18(path18.join(dir, f), "utf8");
+    const text = readFileSync19(path19.join(dir, f), "utf8");
     const fm = text.match(/^---\n([\s\S]*?)\n---\n?/);
     const meta3 = fm ? YAML2.parse(fm[1]) : {};
     return { id: f.replace(/\.md$/, ""), title: meta3.title ?? f, summary: meta3.summary ?? "", body: fm ? text.slice(fm[0].length) : text };
@@ -24402,7 +24590,7 @@ function allowedCommands(root, pm, typescript) {
   const pkg = readJson(root, "package.json");
   const run2 = pmCommands(pm).run;
   const cmds = ["test", "lint", "typecheck", "build"].filter((s) => pkg?.scripts?.[s]).map((s) => `${run2} ${s}`);
-  if (typescript && !pkg?.scripts?.typecheck && existsSync18(path19.join(root, "node_modules/.bin/tsc"))) cmds.push(`${pmCommands(pm).exec} tsc --noEmit`);
+  if (typescript && !pkg?.scripts?.typecheck && existsSync18(path20.join(root, "node_modules/.bin/tsc"))) cmds.push(`${pmCommands(pm).exec} tsc --noEmit`);
   return cmds;
 }
 function taskFor(root, scan, action2, findings) {
@@ -24453,8 +24641,8 @@ async function untrackEnvFiles(root, findings) {
   const files = findings.filter((f) => f.checkId === "security.env-files").map((f) => f.locations[0].file);
   for (const f of files) await git(root, "rm", "-q", "--cached", "--", f);
   if (files.length) {
-    const gi = path19.join(root, ".gitignore");
-    const current2 = existsSync18(gi) ? readFileSync19(gi, "utf8") : "";
+    const gi = path20.join(root, ".gitignore");
+    const current2 = existsSync18(gi) ? readFileSync20(gi, "utf8") : "";
     if (!/^\.env\*?$/m.test(current2)) writeFileSync6(gi, `${current2.trimEnd()}
 
 # Environment files hold secrets
@@ -24568,7 +24756,7 @@ ${pc.bold(action2.title)}  ${pc.dim(`${findings.length} finding(s)`)}`);
       messages.push({ role: "tool", content: results });
     }
     s.stop(finish ? "Aura\u2019s agent finished" : "Aura\u2019s agent stopped");
-    const untracked = action2.id === "remove-leaked-secrets" ? await untrackEnvFiles(root, findings) : [];
+    const untracked2 = action2.id === "remove-leaked-secrets" ? await untrackEnvFiles(root, findings) : [];
     for (const f of touched) await git(root, "add", "-A", "--", f);
     const staged = (await git(root, "diff", "--cached", "--name-only")).stdout.trim();
     if (!staged) {
@@ -24590,7 +24778,7 @@ ${pc.bold(action2.title)}  ${pc.dim(`${findings.length} finding(s)`)}`);
       "",
       ...findings.slice(0, 20).map((f) => `- ${f.title}`),
       "",
-      ...untracked.length ? ["### Removed from git", "", ...untracked.map((f) => `- \`${f}\` (still on your computer, now ignored by git)`), ""] : [],
+      ...untracked2.length ? ["### Removed from git", "", ...untracked2.map((f) => `- \`${f}\` (still on your computer, now ignored by git)`), ""] : [],
       ...finish?.testsRun.length ? ["### Checks run", "", ...finish.testsRun.map((t) => `- ${t}`), ""] : [],
       ...finish?.risks.length ? ["### Things to check before merging", "", ...finish.risks.map((r) => `- ${r}`), ""] : [],
       ...guides.length ? [
@@ -24662,7 +24850,7 @@ async function secureCommand(connector, flags, report = {}, fake) {
     return 1;
   }
   const { ctx, target } = connection;
-  const states = await readSettings(connector, ctx);
+  const states = withRefusals(await readSettings(connector, ctx), loadSnapshots(root)[connector.id]);
   saveSnapshot(root, connector.id, states);
   const toTurnOn = connector.settings.filter((s) => states[s.id].state === "off").map((s) => s.id);
   console.log(`
@@ -24726,10 +24914,17 @@ Nothing was changed. Show the user the changes above, and once they agree run: a
     }
     report.outcome = results.some((r) => r.result === "failed") ? "failed" : "settings_changed";
   }
+  const refusedNow = Object.fromEntries(results.filter((r) => r.result === "unavailable" && states[r.id].state === "off" && r.why).map((r) => [r.id, r.why]));
   saveSnapshot(
     root,
     connector.id,
-    Object.fromEntries(Object.entries(states).map(([id, s]) => [id, results.find((r) => r.id === id)?.result === "turned-on" ? { state: "on" } : s]))
+    Object.fromEntries(
+      Object.entries(states).map(([id, s]) => {
+        const r = results.find((x) => x.id === id);
+        return [id, r?.result === "turned-on" ? { state: "on" } : refusedNow[id] ? { state: "unavailable", why: refusedNow[id] } : s];
+      })
+    ),
+    refusedNow
   );
   const left = await connector.leftForYou(ctx, results);
   if (left.length) {
@@ -24791,7 +24986,7 @@ async function applyAction(actionId, flags, report) {
     );
   }
   const g = { root, scan, ctx, agents: [...agents], vars: templateVars(root, scan, ctx.pkg), skills: skills2 };
-  const plan = actionId === "foundation" ? foundationPlan(g) : GENERATORS[actionId]?.(g) ?? { skip: "Nothing to do." };
+  const plan = actionId === "foundation" ? await foundationPlan(g) : await GENERATORS[actionId]?.(g) ?? { skip: "Nothing to do." };
   if ("skip" in plan || plan.changes.length === 0 && !plan.commands?.length && !plan.devDeps?.length) {
     say.info("skip" in plan ? plan.skip : "Nothing to change.");
     report.outcome = "no_changes";
@@ -24800,7 +24995,7 @@ async function applyAction(actionId, flags, report) {
   console.log(`
 ${pc.bold(action2.title)}`);
   for (const c of plan.changes)
-    console.log(`  ${c.content === null ? pc.red("delete") : existsSync19(path20.join(root, c.path)) ? pc.yellow("update") : pc.green("add   ")} ${c.path}`);
+    console.log(`  ${c.content === null ? pc.red("delete") : existsSync19(path21.join(root, c.path)) ? pc.yellow("update") : pc.green("add   ")} ${c.path}`);
   const pm = pmCommands(scan.stack.packageManager);
   if (plan.devDeps?.length) console.log(`  ${pc.cyan("install")} ${plan.devDeps.join(", ")} ${pc.dim(`(${pm.addDev})`)}`);
   for (const cmd of plan.commands ?? []) console.log(`  ${pc.cyan("run   ")} ${cmd.join(" ")}`);
@@ -24832,7 +25027,7 @@ ${pc.bold(action2.title)}`);
     report.outcome = "cancelled";
     return 0;
   }
-  const tsc = path20.join(root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
+  const tsc = path21.join(root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
   const checkTypes = plan.verifyTypes && scan.stack.typescript && existsSync19(tsc);
   const typeErrors = async () => {
     const r = await run(tsc, ["--noEmit", "--pretty", "false"], { cwd: root, timeoutMs: 3e5 });
@@ -24942,17 +25137,17 @@ async function undoPlan(root, plan) {
   for (const file2 of touched) {
     const inHead = (await git(root, "cat-file", "-e", `HEAD:${file2}`)).code === 0;
     if (inHead) await git(root, "checkout", "HEAD", "--", file2);
-    else if (plan.changes.some((c) => c.path === file2)) rmSync6(path20.join(root, file2), { force: true });
+    else if (plan.changes.some((c) => c.path === file2)) rmSync6(path21.join(root, file2), { force: true });
   }
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync20, readFileSync as readFileSync21 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync22 } from "fs";
 import { spawnSync as spawnSync3 } from "child_process";
-import path24 from "path";
+import path25 from "path";
 
 // src/brief.ts
-import path21 from "path";
+import path22 from "path";
 function repoSummary(ctx) {
   const routes = ctx.files.filter((f) => /^(?:src\/)?app\/(?:.+\/)?(?:page|route)\.[cm]?[jt]sx?$/.test(f) || /^(?:src\/)?pages\/.+\.[cm]?[jt]sx?$/.test(f)).map(
     (f) => "/" + f.replace(/^(?:src\/)?(?:app|pages)\//, "").replace(/(?:^|\/)(?:page|route|index)\.[cm]?[jt]sx?$|\.[cm]?[jt]sx?$/, "").replace(/\([^)]+\)\//g, "")
@@ -24968,7 +25163,7 @@ function repoSummary(ctx) {
   const readme2 = ctx.files.find((f) => /^readme\.mdx?$/i.test(f));
   const readmeText = readme2 ? ctx.read(readme2) ?? "" : "";
   return {
-    name: ctx.pkg?.name ?? path21.basename(ctx.root),
+    name: ctx.pkg?.name ?? path22.basename(ctx.root),
     packageJson: ctx.pkg ? {
       name: ctx.pkg.name,
       description: ctx.pkg.description,
@@ -25062,9 +25257,9 @@ function installFallback(result, platform = process.platform) {
 // src/core/claude-plugin.ts
 import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync7 } from "fs";
 import os6 from "os";
-import path22 from "path";
+import path23 from "path";
 var CLAUDE_PLUGIN_ID = "aura@aura";
-var marketplaceDir = () => path22.join(os6.homedir(), ".aura", "claude-marketplace");
+var marketplaceDir = () => path23.join(os6.homedir(), ".aura", "claude-marketplace");
 var MARKETPLACE = {
   name: "aura",
   description: "Aura for Claude Code",
@@ -25079,8 +25274,8 @@ var MARKETPLACE = {
 };
 function writeMarketplace() {
   const dir = marketplaceDir();
-  mkdirSync6(path22.join(dir, ".claude-plugin"), { recursive: true });
-  writeFileSync7(path22.join(dir, ".claude-plugin", "marketplace.json"), `${JSON.stringify(MARKETPLACE, null, 2)}
+  mkdirSync6(path23.join(dir, ".claude-plugin"), { recursive: true });
+  writeFileSync7(path23.join(dir, ".claude-plugin", "marketplace.json"), `${JSON.stringify(MARKETPLACE, null, 2)}
 `);
   return dir;
 }
@@ -25184,29 +25379,29 @@ function describeInferred(inferred) {
 // src/commands/scan.ts
 import { mkdtempSync as mkdtempSync3, rmSync as rmSync7, writeFileSync as writeFileSync8 } from "fs";
 import os7 from "os";
-import path23 from "path";
+import path24 from "path";
 
 // src/connectors/refresh.ts
-import { readFileSync as readFileSync20 } from "fs";
+import { readFileSync as readFileSync21 } from "fs";
 async function refreshToolSettings(root) {
   if (process.env.AURA_NO_CONNECTORS) return;
   let previous = null;
   try {
-    previous = JSON.parse(readFileSync20(auraPath(root, "scan.json"), "utf8"));
+    previous = JSON.parse(readFileSync21(auraPath(root, "scan.json"), "utf8"));
   } catch {
   }
   const snapshots = loadSnapshots(root);
   for (const connector of CONNECTORS) {
     if (!(previous ? connector.detect(previous) : connector.id === "github") || !isStale(snapshots[connector.id])) continue;
     const connection = await connector.connect(root).catch(() => null);
-    if (connection?.ok) saveSnapshot(root, connector.id, await readSettings(connector, connection.ctx));
+    if (connection?.ok) saveSnapshot(root, connector.id, withRefusals(await readSettings(connector, connection.ctx), snapshots[connector.id]));
   }
 }
 
 // src/commands/scan.ts
 async function scanRef(root, ref, opts) {
-  const dir = mkdtempSync3(path23.join(os7.tmpdir(), "aura-base-"));
-  const wt = path23.join(dir, "tree");
+  const dir = mkdtempSync3(path24.join(os7.tmpdir(), "aura-base-"));
+  const wt = path24.join(dir, "tree");
   const add = await run("git", ["worktree", "add", "--detach", wt, ref], { cwd: root });
   if (add.code !== 0) {
     rmSync7(dir, { recursive: true, force: true });
@@ -25296,7 +25491,7 @@ async function scanCommand(flags) {
 // src/commands/init.ts
 var AGENT_IDS = ["claude", "codex", "cursor", "pi"];
 function detectAgents(root) {
-  return detectAgentsFrom((rel) => existsSync20(path24.join(root, rel)));
+  return detectAgentsFrom((rel) => existsSync20(path25.join(root, rel)));
 }
 function openEditor(file2) {
   const fallback = process.platform === "win32" ? "notepad" : spawnSync3("sh", ["-c", "command -v nano"]).status === 0 ? "nano" : "vi";
@@ -25411,13 +25606,13 @@ async function initCommand(flags) {
   let brief2 = null;
   let keptBrief = false;
   if (flags.briefFile) {
-    brief2 = readFileSync21(flags.briefFile, "utf8");
+    brief2 = readFileSync22(flags.briefFile, "utf8");
   } else if (!flags.answers && existsSync20(briefPath) && !(tty && unwrap(await p.confirm({ message: "A product brief already exists. Draft a new one?", initialValue: false })))) {
     keptBrief = true;
   } else {
     let answers = null;
     if (flags.answers) {
-      answers = OnboardingAnswersSchema.parse(JSON.parse(readFileSync21(flags.answers, "utf8")));
+      answers = OnboardingAnswersSchema.parse(JSON.parse(readFileSync22(flags.answers, "utf8")));
     } else if (tty) {
       const inferred = inferAnswers(ctx);
       p.note(describeInferred(inferred).join("\n"), "Here\u2019s what Aura found about your app");
@@ -25549,7 +25744,7 @@ ${pc.magenta("\u2726")} ${pc.bold("Give the user the aura command")}`);
 }
 
 // src/commands/summary.ts
-import path25 from "path";
+import path26 from "path";
 async function activity(root, since) {
   const log = await git(root, "log", `--since=${since.toISOString()}`, "--no-merges", "--format=%H%x09%an%x09%s");
   const commits = log.stdout.split("\n").filter(Boolean).slice(0, 300).map((l) => {
@@ -25606,7 +25801,7 @@ async function summaryCommand(flags) {
   const beforeIds = new Set(before ? allFindings(before).map((f) => f.id) : []);
   const nowIds = new Set(allFindings(now).map((f) => f.id));
   const req = {
-    repo: path25.basename(root),
+    repo: path26.basename(root),
     since: since.toISOString(),
     until: until.toISOString(),
     product: productContext(root),
@@ -25654,11 +25849,11 @@ ${body}`);
 import pc4 from "picocolors";
 
 // src/core/update-check.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync22, writeFileSync as writeFileSync9 } from "fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync23, writeFileSync as writeFileSync9 } from "fs";
 import os8 from "os";
-import path26 from "path";
+import path27 from "path";
 var DAY_MS = 24 * 60 * 60 * 1e3;
-var cacheFile = () => path26.join(os8.homedir(), ".aura", "update-check.json");
+var cacheFile = () => path27.join(os8.homedir(), ".aura", "update-check.json");
 function isNewer(a, b) {
   if (!/^\d+\.\d+\.\d+$/.test(a) || !/^\d+\.\d+\.\d+$/.test(b)) return false;
   const [x, y] = [a, b].map((v) => v.split(".").map(Number));
@@ -25678,13 +25873,13 @@ async function newerVersion(opts = {}) {
   const now = opts.now ?? Date.now();
   let latest = null;
   try {
-    const cached2 = JSON.parse(readFileSync22(cacheFile(), "utf8"));
+    const cached2 = JSON.parse(readFileSync23(cacheFile(), "utf8"));
     if (now - cached2.checkedAt < DAY_MS) latest = cached2.latest;
     else throw new Error("stale");
   } catch {
     latest = await (opts.fetchLatest ?? fetchLatest)();
     try {
-      mkdirSync7(path26.dirname(cacheFile()), { recursive: true });
+      mkdirSync7(path27.dirname(cacheFile()), { recursive: true });
       writeFileSync9(cacheFile(), JSON.stringify({ checkedAt: now, latest }));
     } catch {
     }