@posthog/wizard 2.33.0 → 2.35.0

package/dist/{agent-interface-DCeQ5Oiw.js → agent-interface-CXL9i_vX.js}

@@ -1,14 +1,15 @@
 import { n as __require } from "./rolldown-runtime-B_-DWIq7.js";
-import { J as WIZARD_ORCHESTRATOR_FLAG_KEY, L as POSTHOG_FLAG_HEADER_PREFIX, Q as WIZARD_USER_AGENT, V as POSTHOG_PROPERTY_HEADER_PREFIX, X as WIZARD_REMARK_EVENT_NAME, a as getLogFilePath, f as skillTmpPath, o as initLogFile, p as getUI, r as debug, rt as runtimeEnv, s as logToFile, u as WIZARD_YARA_REPORT_FILE } from "./debug-BGMe1wP6.js";
-import { t as analytics } from "./analytics-CU4o3eF8.js";
-import { i as getLlmGatewayUrlFromHost } from "./urls-DrR6F_A3.js";
-import { n as ADDITIONAL_FEATURE_PROMPTS } from "./wizard-session-CN55LYyZ.js";
-import { i as wizardAbort, n as registerCleanup, t as WizardError } from "./wizard-abort-Cw818xPr.js";
+import { B as POSTHOG_PROPERTY_HEADER_PREFIX, L as POSTHOG_FLAG_HEADER_PREFIX, Y as WIZARD_REMARK_EVENT_NAME, Z as WIZARD_USER_AGENT, a as getLogFilePath, f as skillTmpPath, nt as runtimeEnv, o as initLogFile, p as getUI, q as WIZARD_ORCHESTRATOR_FLAG_KEY, r as debug, s as logToFile, u as WIZARD_YARA_REPORT_FILE } from "./debug-DXWxKT5f.js";
+import { t as analytics } from "./analytics-DP_j88IC.js";
+import { t as HostResolution } from "./host-resolution-Dw0fS8h5.js";
+import { n as ADDITIONAL_FEATURE_PROMPTS } from "./wizard-session-BHoLQueN.js";
+import { i as wizardAbort, n as registerCleanup, t as WizardError } from "./wizard-abort-BE_j8xUt.js";
 import { createRequire } from "node:module";
 import * as fs$1 from "fs";
 import fs from "fs";
 import * as path$1 from "path";
 import path from "path";
+import { spawnSync } from "node:child_process";
 import axios from "axios";
 import { z } from "zod";
 import fg from "fast-glob";
@@ -1362,6 +1363,35 @@ function writeScanReport() {
 	}
 	return WIZARD_YARA_REPORT_FILE;
 }
+const CATEGORY_DESCRIPTIONS = {
+	prompt_injection: "hit hidden instructions in a file it read, a possible attempt to hijack the setup",
+	exfiltration: "tried to send data to an outside location",
+	destructive_operations: "tried to run a destructive command",
+	supply_chain: "tried to pull in untrusted code",
+	posthog_pii: "tried to write personal data (PII) into your project",
+	posthog_hardcoded_key: "tried to hardcode a PostHog key into your project",
+	hardcoded_secret: "tried to hardcode a secret into your project"
+};
+/** Most recent violation that terminated the run, or null. */
+function lastTerminatingViolation() {
+	for (let i = scanViolations.length - 1; i >= 0; i--) if (scanViolations[i].action === "aborted") return scanViolations[i];
+	return null;
+}
+/**
+* Build the user-facing copy for the security abort screen: what the scanner
+* caught and what we did about it. This screen renders only because the run was
+* stopped, so the "what we did" half is constant. Falls back to a generic line
+* when no specific violation was recorded (e.g. the scanner itself errored and
+* failed closed before a match was logged).
+*/
+function formatYaraAbortMessage() {
+	const v = lastTerminatingViolation();
+	return `Security check stopped the setup.
+
+The agent ${(v && CATEGORY_DESCRIPTIONS[v.category]) ?? "did something our security scanner flagged"}. We stopped the run to keep your project safe.\nNo unsafe changes were left in your project.
+
+If this looks wrong, let us know: wizard@posthog.com`;
+}
 /** Timeout for scan hooks (PreToolUse, PostToolUse Write/Edit/Read/Grep) */
 const HOOK_TIMEOUT_MS = 3e4;
 /** Timeout for the skill install hook (filesystem I/O + multiple scans) */
@@ -1909,10 +1939,31 @@ const OUTPUT_SIGNALS = {
 const SIGNAL_NEEDLES = Object.values(OUTPUT_SIGNALS);
 var AgentOutputSignals = class {
 	lines = [];
+	apiKeySourceValue;
 	/** Parse step: keep the line only if it carries a known signal; drop prose. */
 	push(text) {
 		if (SIGNAL_NEEDLES.some((n) => text.includes(n))) this.lines.push(text);
 	}
+	/**
+	* Record the SDK's `apiKeySource` from its `init` message (e.g.
+	* `"/login managed key"`, `"ANTHROPIC_API_KEY"`). Used to triage a 401:
+	* a managed-login source means the SDK authenticated with a stored Claude
+	* login rather than the gateway token the wizard injected.
+	*/
+	recordApiKeySource(source) {
+		if (source) this.apiKeySourceValue = source;
+	}
+	get apiKeySource() {
+		return this.apiKeySourceValue;
+	}
+	/**
+	* True when the SDK authed from a stored `/login` credential (the
+	* "managed key") instead of an explicit `ANTHROPIC_API_KEY` — the signature
+	* of conflicting Anthropic credentials behind a gateway 401.
+	*/
+	usedManagedLogin() {
+		return /login|managed key/i.test(this.apiKeySourceValue ?? "");
+	}
 	get text() {
 		return this.lines.join("\n");
 	}
@@ -1939,6 +1990,128 @@ var AgentOutputSignals = class {
 	}
 };
 //#endregion
+//#region src/lib/agent/agent-env-isolation.ts
+/**
+* Credential isolation for the Claude Agent SDK subprocess.
+*
+* The SDK doesn't authenticate in-process — `query()` extracts and spawns a
+* native `claude` binary that resolves model routing and credentials from its
+* own environment. That binary honors a large, ever-growing surface of
+* `ANTHROPIC_*` / `CLAUDE_CODE_*` env vars: provider-activation flags
+* (`CLAUDE_CODE_USE_BEDROCK` / `_VERTEX` / `_FOUNDRY` / `_MANTLE` /
+* `_ANTHROPIC_AWS`), alternate base URLs, file-descriptor / indirection token
+* sources, inline identity / OAuth / bearer tokens, and host-auth-deferral
+* flags. ANY of them, inherited from the user's shell, can route the agent OFF
+* the PostHog LLM gateway — billing the user's own Anthropic / Bedrock / Vertex
+* account ("wrong credits") or redirecting the binary to an arbitrary endpoint
+* and leaking the gateway token.
+*
+* Rather than chase each new knob by name — a denylist the binary outpaces every
+* release — we DROP THE ENTIRE PROVIDER NAMESPACE from the subprocess env and
+* re-inject the wizard's own gateway routing explicitly at the spawn site (see
+* `agent-interface.ts` / `mcp-prompt-streaming.ts`). The spawned binary then
+* runs with exactly the `ANTHROPIC_*` / `CLAUDE_CODE_*` values the wizard sets
+* and nothing else — no user shell/env value can leak in or outrank them.
+*
+* Generic system / build env (`PATH`, `HOME`, proxies, toolchain, `AWS_*` /
+* `GOOGLE_*`) is deliberately preserved: the agent's install / build commands
+* need it, and it's inert for model routing once every provider-activation flag
+* is stripped.
+*/
+/**
+* The model-provider env namespace. Every routing / credential knob the binary
+* honors lives under one of these prefixes, so stripping the whole namespace is
+* a complete, maintenance-free replacement for an enumerated denylist.
+*/
+const PROVIDER_ENV_NAMESPACE = /^(ANTHROPIC_|CLAUDE_CODE_)/;
+/**
+* Off-namespace credential that the binary can use without a provider-activation
+* flag, so the namespace rule alone wouldn't catch it. (Bedrock ignores it once
+* `CLAUDE_CODE_USE_BEDROCK` is gone, but strip it anyway — defense in depth.)
+*/
+const BLOCKED_OFF_NAMESPACE_KEYS = new Set(["AWS_BEARER_TOKEN_BEDROCK"]);
+/**
+* Credential / routing knobs that, set in an on-disk Claude **settings** `env`
+* block, redirect the binary. A settings file is applied by the binary itself,
+* so the subprocess-env strip below cannot remove it — `claude-settings.ts`
+* detects these in settings files and backs up / fails closed instead. Kept as
+* a curated list there (not the broad namespace rule) so a benign
+* `CLAUDE_CODE_*` toggle in an org-managed settings file doesn't needlessly
+* fail the run closed. The subprocess env needs no such list — it strips the
+* whole namespace (`sanitizeAgentSubprocessEnv`).
+*
+* Keep `ANTHROPIC_BASE_URL` / `ANTHROPIC_AUTH_TOKEN` / `CLAUDE_CODE_OAUTH_TOKEN`
+* OUT of this list — `claude-settings.ts` adds those (the gateway routing the
+* wizard sets) to its own detection set separately.
+*/
+const BLOCKED_AGENT_ENV_KEYS = [
+	"ANTHROPIC_API_KEY",
+	"CLAUDE_CODE_USE_BEDROCK",
+	"CLAUDE_CODE_USE_VERTEX",
+	"CLAUDE_CODE_USE_FOUNDRY",
+	"CLAUDE_CODE_USE_MANTLE",
+	"CLAUDE_CODE_USE_ANTHROPIC_AWS",
+	"ANTHROPIC_BEDROCK_BASE_URL",
+	"ANTHROPIC_AWS_BASE_URL",
+	"ANTHROPIC_VERTEX_BASE_URL",
+	"ANTHROPIC_FOUNDRY_BASE_URL",
+	"ANTHROPIC_BEDROCK_MANTLE_BASE_URL",
+	"CLAUDE_CODE_API_BASE_URL",
+	"ANTHROPIC_AWS_API_KEY",
+	"ANTHROPIC_FOUNDRY_API_KEY",
+	"AWS_BEARER_TOKEN_BEDROCK",
+	"ANTHROPIC_VERTEX_PROJECT_ID",
+	"ANTHROPIC_PROFILE",
+	"ANTHROPIC_ENVIRONMENT_KEY",
+	"ANTHROPIC_IDENTITY_TOKEN",
+	"ANTHROPIC_FEDERATION_RULE_ID",
+	"ANTHROPIC_SERVICE_ACCOUNT_ID",
+	"CLAUDE_CODE_API_KEY_FILE_DESCRIPTOR",
+	"CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR",
+	"CLAUDE_CODE_WEBSOCKET_AUTH_FILE_DESCRIPTOR",
+	"ANTHROPIC_IDENTITY_TOKEN_FILE",
+	"CLAUDE_CODE_SESSION_ACCESS_TOKEN",
+	"CLAUDE_CODE_CLIENT_KEY",
+	"CLAUDE_CODE_OAUTH_REFRESH_TOKEN",
+	"CLAUDE_CODE_HFI_BEARER_TOKEN",
+	"CLAUDE_CODE_HOST_AUTH_ENV_VAR",
+	"CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST",
+	"CLAUDE_CODE_SDK_HAS_HOST_AUTH_REFRESH",
+	"CLAUDE_CODE_SDK_HAS_OAUTH_REFRESH",
+	"CLAUDE_CODE_API_KEY_HELPER_TTL_MS"
+];
+/**
+* Pattern-matched settings-file knobs (companion to {@link BLOCKED_AGENT_ENV_KEYS}):
+*  - `CLAUDE_CODE_SKIP_*_AUTH` — skip-auth flags for every alt provider.
+*  - `ANTHROPIC_*_BASE_URL` — alternate base URLs (NOT bare `ANTHROPIC_BASE_URL`,
+*    which is the gateway routing the wizard sets).
+*/
+const BLOCKED_AGENT_ENV_PATTERNS = [/^CLAUDE_CODE_SKIP_.+_AUTH$/, /^ANTHROPIC_.+_BASE_URL$/];
+/**
+* True if `key` must NOT be inherited by the agent subprocess: anything in the
+* provider namespace (the wizard re-injects its own values at the spawn site),
+* plus the lone off-namespace credential.
+*/
+function isBlockedAgentEnvKey(key) {
+	return PROVIDER_ENV_NAMESPACE.test(key) || BLOCKED_OFF_NAMESPACE_KEYS.has(key);
+}
+/**
+* Return a copy of `env` with the entire model-provider namespace removed, so
+* the spawned `claude` binary inherits no `ANTHROPIC_*` / `CLAUDE_CODE_*` value
+* from the user's shell. The wizard's own gateway routing is injected back
+* explicitly at the spawn site, so the binary can authenticate only through it.
+* Removed keys are absent from the result (Node's spawn omits them), not set to
+* `undefined`.
+*/
+function sanitizeAgentSubprocessEnv(env = process.env) {
+	const sanitized = {};
+	for (const [key, value] of Object.entries(env)) {
+		if (isBlockedAgentEnvKey(key)) continue;
+		sanitized[key] = value;
+	}
+	return sanitized;
+}
+//#endregion
 //#region src/lib/agent/claude-settings.ts
 /**
 * Claude Code settings handling: conflict detection, backup/restore, and
@@ -1948,10 +2121,31 @@ var AgentOutputSignals = class {
 * process start without dragging in the agent stack (wizard-tools, yara
 * hooks, the SDK loader).
 */
+/** The file names Claude Code accepts for project settings, in priority order. */
+const SETTINGS_FILENAMES = ["settings.json", "settings"];
+/** Suffix for the wizard's pristine-copy backup of a settings file. */
+const BACKUP_SUFFIX = ".wizard-backup";
+/**
+* The candidate settings files under `<workingDirectory>/.claude` and their
+* backup paths. Centralizes the file-name list + backup suffix that backup,
+* restore, and orphan-recovery all walk.
+*/
+function settingsBackupTargets(workingDirectory) {
+	const claudeDir = path.join(workingDirectory, ".claude");
+	return SETTINGS_FILENAMES.map((name) => {
+		const original = path.join(claudeDir, name);
+		return {
+			claudeDir,
+			original,
+			backup: original + BACKUP_SUFFIX
+		};
+	});
+}
 const BLOCKING_ENV_KEYS = [
-	"ANTHROPIC_API_KEY",
 	"ANTHROPIC_BASE_URL",
-	"ANTHROPIC_AUTH_TOKEN"
+	"ANTHROPIC_AUTH_TOKEN",
+	"CLAUDE_CODE_OAUTH_TOKEN",
+	...BLOCKED_AGENT_ENV_KEYS
 ];
 const BLOCKING_SETTINGS_KEYS = ["apiKeyHelper"];
 /**
@@ -1964,18 +2158,31 @@ function checkSettingsFile(filePath) {
 		const parsed = JSON.parse(raw);
 		const matched = [];
 		const envBlock = parsed?.env;
-		if (envBlock && typeof envBlock === "object") matched.push(...BLOCKING_ENV_KEYS.filter((key) => key in envBlock));
+		if (envBlock && typeof envBlock === "object") {
+			matched.push(...BLOCKING_ENV_KEYS.filter((key) => key in envBlock));
+			matched.push(...Object.keys(envBlock).filter((key) => BLOCKED_AGENT_ENV_PATTERNS.some((pattern) => pattern.test(key))));
+		}
 		matched.push(...BLOCKING_SETTINGS_KEYS.filter((key) => key in parsed && parsed[key] !== "" && parsed[key] != null));
-		return matched;
+		return [...new Set(matched)];
 	} catch {
 		return [];
 	}
 }
 /**
-* Managed settings path on macOS.
-* IT/MDM-deployed settings — readable by all users, writable only by root.
+* Org-managed (IT/MDM-deployed) settings path, per platform. Readable by all
+* users, writable only by root/admin. Claude Code always reads this file
+* regardless of `settingSources`, so an `apiKeyHelper` / `env` override here
+* redirects the agent off the gateway and the wizard cannot remove it — it
+* must fail closed. Checking only the macOS path (the prior behavior) let a
+* Linux/Windows managed override slip past the fail-closed gate undetected.
 */
-const MANAGED_SETTINGS_PATH = "/Library/Application Support/ClaudeCode/managed-settings.json";
+function managedSettingsPath(platform = process.platform) {
+	switch (platform) {
+		case "darwin": return "/Library/Application Support/ClaudeCode/managed-settings.json";
+		case "win32": return path.join(process.env.ProgramData || "C:\\ProgramData", "ClaudeCode", "managed-settings.json");
+		default: return "/etc/claude-code/managed-settings.json";
+	}
+}
 /**
 * Check every settings file Claude Code reads for blocking keys that conflict
 * with the wizard's gateway auth: org-managed, the user's global config, the
@@ -1983,13 +2190,13 @@ const MANAGED_SETTINGS_PATH = "/Library/Application Support/ClaudeCode/managed-s
 * an `apiKeyHelper` or `ANTHROPIC_*` override commonly lives, and any of them
 * can outrank the env the wizard sets and make every agent call 401.
 */
-function checkAllSettingsConflicts(workingDirectory, homeDir = os.homedir()) {
+function checkAllSettingsConflicts(workingDirectory, homeDir = os.homedir(), platform = process.platform) {
 	const conflicts = [];
 	const home = homeDir;
 	const sources = [
 		{
 			source: "managed",
-			paths: [MANAGED_SETTINGS_PATH],
+			paths: [managedSettingsPath(platform)],
 			writable: false
 		},
 		{
@@ -1999,7 +2206,7 @@ function checkAllSettingsConflicts(workingDirectory, homeDir = os.homedir()) {
 		},
 		{
 			source: "project",
-			paths: [path.join(workingDirectory, ".claude", "settings.json"), path.join(workingDirectory, ".claude", "settings")],
+			paths: SETTINGS_FILENAMES.map((name) => path.join(workingDirectory, ".claude", name)),
 			writable: true
 		},
 		{
@@ -2023,6 +2230,22 @@ function checkAllSettingsConflicts(workingDirectory, homeDir = os.homedir()) {
 	return conflicts;
 }
 /**
+* Sort detected conflicts by how the wizard can respond, following the rule:
+* **neutralize where possible; where it can't, let the user make the change.**
+*
+* NOTE: the `warnOnly` bucket assumes the agent runs with
+* `settingSources: ['project']` (set in `agent-interface.ts` and
+* `mcp-prompt-streaming.ts`). If that ever widens to include `'user'` / `'local'`,
+* those sources stop being neutralized and must move out of `warnOnly`.
+*/
+function classifySettingsConflicts(conflicts) {
+	return {
+		autoFix: conflicts.filter((c) => c.writable),
+		failClosed: conflicts.filter((c) => !c.writable && c.source === "managed"),
+		warnOnly: conflicts.filter((c) => !c.writable && c.source !== "managed")
+	};
+}
+/**
 * Ensure `.claude/.gitignore` excludes `*.wizard-backup` so a backup left
 * orphaned by an interrupted run can't get committed to git — settings files
 * commonly hold `apiKeyHelper` or `ANTHROPIC_API_KEY`, which we don't want
@@ -2030,7 +2253,7 @@ function checkAllSettingsConflicts(workingDirectory, homeDir = os.homedir()) {
 */
 function ensureBackupGitignored(claudeDir) {
 	const gitignorePath = path.join(claudeDir, ".gitignore");
-	const entry = "*.wizard-backup";
+	const entry = `*${BACKUP_SUFFIX}`;
 	try {
 		const existing = fs$1.existsSync(gitignorePath) ? fs$1.readFileSync(gitignorePath, "utf-8") : "";
 		if (existing.split("\n").map((l) => l.trim()).includes(entry)) return;
@@ -2046,18 +2269,16 @@ function ensureBackupGitignored(claudeDir) {
 * cleanup.
 */
 function backupAndFixClaudeSettings(workingDirectory) {
-	for (const name of ["settings.json", "settings"]) {
-		const filePath = path.join(workingDirectory, ".claude", name);
-		if (!fs$1.existsSync(filePath)) continue;
-		const backupPath = `${filePath}.wizard-backup`;
+	for (const { claudeDir, original, backup } of settingsBackupTargets(workingDirectory)) {
+		if (!fs$1.existsSync(original)) continue;
 		try {
-			if (!fs$1.existsSync(backupPath)) {
-				fs$1.copyFileSync(filePath, backupPath);
-				const mode = fs$1.statSync(filePath).mode & 511;
-				fs$1.chmodSync(backupPath, mode);
+			if (!fs$1.existsSync(backup)) {
+				fs$1.copyFileSync(original, backup);
+				const mode = fs$1.statSync(original).mode & 511;
+				fs$1.chmodSync(backup, mode);
 			}
-			ensureBackupGitignored(path.join(workingDirectory, ".claude"));
-			fs$1.unlinkSync(filePath);
+			ensureBackupGitignored(claudeDir);
+			fs$1.unlinkSync(original);
 			analytics.wizardCapture("backedup-claude-settings");
 			registerCleanup(() => {
 				try {
@@ -2083,9 +2304,7 @@ function backupAndFixClaudeSettings(workingDirectory) {
 * calls (outro then cleanup) idempotent and avoids leaving an orphan behind.
 */
 function restoreClaudeSettings(workingDirectory) {
-	for (const name of ["settings.json", "settings"]) {
-		const original = path.join(workingDirectory, ".claude", name);
-		const backup = `${original}.wizard-backup`;
+	for (const { original, backup } of settingsBackupTargets(workingDirectory)) {
 		if (!fs$1.existsSync(backup)) continue;
 		try {
 			fs$1.copyFileSync(backup, original);
@@ -2112,9 +2331,7 @@ function restoreClaudeSettings(workingDirectory) {
 * already moved them aside.
 */
 function recoverOrphanedSettingsBackups(workingDirectory) {
-	for (const name of ["settings.json", "settings"]) {
-		const original = path.join(workingDirectory, ".claude", name);
-		const backup = `${original}.wizard-backup`;
+	for (const { original, backup } of settingsBackupTargets(workingDirectory)) {
 		if (!fs$1.existsSync(backup) || fs$1.existsSync(original)) continue;
 		try {
 			fs$1.copyFileSync(backup, original);
@@ -2126,6 +2343,70 @@ function recoverOrphanedSettingsBackups(workingDirectory) {
 	}
 }
 //#endregion
+//#region src/lib/agent/stored-login.ts
+/**
+* Detect a pre-existing Claude Code login on the machine.
+*
+* The wizard authenticates the agent's LLM calls by injecting its PostHog OAuth
+* token via `CLAUDE_CODE_OAUTH_TOKEN` / `ANTHROPIC_AUTH_TOKEN`. If the user is
+* already logged into Claude Code/Desktop, the Agent SDK can instead use that
+* stored `/login` credential (reported as `apiKeySource: "/login managed key"`)
+* and send it to the PostHog gateway, which rejects it with a 401.
+*
+* The settings-conflict scan ({@link checkAllSettingsConflicts}) only inspects
+* `settings.json` for `ANTHROPIC_*` overrides / `apiKeyHelper`; it has no
+* awareness of an actual logged-in session. This fills that gap so a run can
+* log and report the potential conflict behind a gateway 401.
+*
+* Existence-only: it never reads the credential value (no `-w`), so no secret
+* is ever exposed. The locations checked mirror the SDK's own resolution
+* (npmjs.com/package/@anthropic-ai/claude-agent-sdk → sdk.mjs): a
+* `.credentials.json` under `CLAUDE_CONFIG_DIR` / `~/.claude`, and the macOS
+* keychain item below.
+*/
+/** macOS keychain service name Claude Code stores its login under. */
+const KEYCHAIN_SERVICE = "Claude Code-credentials";
+/** True when any stored login was found. */
+const hasStoredClaudeLogin = (login) => login.credentialsFile || login.keychain;
+/**
+* The directory Claude Code resolves credentials/config from — `CLAUDE_CONFIG_DIR`
+* if set, else `~/.claude`. Mirrors the SDK's own resolution; single source of
+* truth so callers can't drift from it.
+*/
+const claudeConfigDir = (homeDir = os.homedir()) => process.env.CLAUDE_CONFIG_DIR || path.join(homeDir, ".claude");
+/**
+* Look for a stored Claude login. `homeDir` / `platform` are injectable for
+* tests; production uses the real home dir and platform.
+*/
+function detectStoredClaudeLogin(homeDir = os.homedir(), platform = process.platform) {
+	const credentialsPath = path.join(claudeConfigDir(homeDir), ".credentials.json");
+	let credentialsFile = false;
+	try {
+		credentialsFile = fs$1.existsSync(credentialsPath);
+	} catch (error) {
+		logToFile(`[stored-login] checked ${credentialsPath} — unreadable (${error instanceof Error ? error.message : String(error)}), treating as absent`);
+		analytics.wizardCapture("stored login check failed", { step: "credentials-file" });
+	}
+	let keychain = false;
+	if (platform === "darwin") try {
+		keychain = spawnSync("security", [
+			"find-generic-password",
+			"-s",
+			KEYCHAIN_SERVICE
+		], {
+			stdio: "ignore",
+			timeout: 5e3
+		}).status === 0;
+	} catch (error) {
+		logToFile(`[stored-login] checked keychain '${KEYCHAIN_SERVICE}' — lookup cleared (${error instanceof Error ? error.message : String(error)}), treating as absent`);
+		analytics.wizardCapture("stored login check failed", { step: "keychain" });
+	}
+	return {
+		credentialsFile,
+		keychain
+	};
+}
+//#endregion
 //#region src/lib/agent/agent-interface.ts
 /**
 * Shared agent interface for PostHog wizards
@@ -2149,15 +2430,29 @@ function regionFromGatewayUrl(gatewayUrl) {
 	if (gatewayUrl.includes("localhost")) return "local";
 	return gatewayUrl.includes("gateway.eu.") ? "eu" : "us";
 }
-function buildAuthErrorContext(workingDirectory, gatewayUrl, homeDir = os.homedir()) {
+/** Places the agent could have picked up a non-PostHog credential. */
+function findCredentialPlaces(conflicts, homeDir) {
+	const places = [];
+	const stored = detectStoredClaudeLogin(homeDir);
+	const configDir = claudeConfigDir(homeDir);
+	if (stored.credentialsFile) places.push(`A logged-in Claude session: ${path.join(configDir, ".credentials.json")}`);
+	if (stored.keychain) places.push("A logged-in Claude session: macOS keychain item \"Claude Code-credentials\"");
+	for (const c of conflicts) places.push(`${c.path} sets ${c.keys.join(", ")}`);
+	return places;
+}
+function buildAuthErrorContext(workingDirectory, gatewayUrl, homeDir = os.homedir(), apiKeySource) {
 	const conflicts = checkAllSettingsConflicts(workingDirectory, homeDir);
+	const usingManagedLogin = /login|managed key/i.test(apiKeySource ?? "");
 	return {
 		hasSettingsConflict: conflicts.length > 0,
 		conflicts,
 		conflictSources: conflicts.map((c) => c.source),
 		conflictKeys: [...new Set(conflicts.flatMap((c) => c.keys))],
 		gatewayUrl,
-		region: regionFromGatewayUrl(gatewayUrl)
+		region: regionFromGatewayUrl(gatewayUrl),
+		apiKeySource,
+		usingManagedLogin,
+		credentialPlaces: findCredentialPlaces(conflicts, homeDir)
 	};
 }
 /**
@@ -2444,13 +2739,21 @@ async function initializeAgent(config, options) {
 	logToFile("Agent initialization starting");
 	logToFile("Install directory:", options.installDir);
 	try {
+		const gatewayUrl = HostResolution.fromApiHost(config.posthogApiHost).gatewayUrl;
 		process.env.CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS = "true";
-		const gatewayUrl = getLlmGatewayUrlFromHost(config.posthogApiHost);
 		process.env.ANTHROPIC_BASE_URL = gatewayUrl;
 		process.env.ANTHROPIC_AUTH_TOKEN = config.posthogApiKey;
 		process.env.CLAUDE_CODE_OAUTH_TOKEN = config.posthogApiKey;
 		logToFile("Configured LLM gateway:", gatewayUrl);
 		logToFile("API key prefix:", config.posthogApiKey ? `${config.posthogApiKey.slice(0, 4)}***` : "(missing)");
+		const storedLogin = detectStoredClaudeLogin();
+		if (hasStoredClaudeLogin(storedLogin)) {
+			logToFile(`Pre-existing Claude login detected (credentialsFile=${storedLogin.credentialsFile}, keychain=${storedLogin.keychain}). It can outrank the wizard's gateway token and cause a 401 — 'claude auth logout' clears it.`);
+			analytics.wizardCapture("claude stored login detected", {
+				credentials_file: storedLogin.credentialsFile,
+				keychain: storedLogin.keychain
+			});
+		}
 		const initConflicts = checkAllSettingsConflicts(options.installDir);
 		logToFile("Settings conflicts at agent init:", initConflicts.length > 0 ? initConflicts.map((c) => `${c.source}(${c.keys.join(",")})`).join("; ") : "none");
 		const mcpServers = {
@@ -2650,8 +2953,11 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 					] }
 				},
 				env: {
-					...process.env,
-					ANTHROPIC_API_KEY: void 0,
+					...sanitizeAgentSubprocessEnv(process.env),
+					ANTHROPIC_BASE_URL: process.env.ANTHROPIC_BASE_URL,
+					ANTHROPIC_AUTH_TOKEN: process.env.ANTHROPIC_AUTH_TOKEN,
+					CLAUDE_CODE_OAUTH_TOKEN: process.env.CLAUDE_CODE_OAUTH_TOKEN,
+					CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS: "true",
 					ENABLE_TOOL_SEARCH: "auto:0",
 					MCP_CONNECTION_NONBLOCKING: "0",
 					ANTHROPIC_CUSTOM_HEADERS: buildAgentEnv(agentConfig.wizardMetadata ?? {}, agentConfig.wizardFlags ?? {})
@@ -2728,11 +3034,13 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 			if (message.type === "assistant" && signals.hasApiErrorStatus(401)) {
 				signalDone();
 				spinner.stop("Authentication failed");
-				const authError = buildAuthErrorContext(options.installDir, process.env.ANTHROPIC_BASE_URL ?? "");
+				const authError = buildAuthErrorContext(options.installDir, process.env.ANTHROPIC_BASE_URL ?? "", os.homedir(), signals.apiKeySource);
 				logToFile("Agent error: 401, showing auth error screen", authError);
 				getUI().showAuthError({
 					hasSettingsConflict: authError.hasSettingsConflict,
 					conflicts: authError.conflicts,
+					usingManagedLogin: authError.usingManagedLogin,
+					credentialPlaces: authError.credentialPlaces,
 					logFilePath: getLogFilePath()
 				});
 				await wizardAbort({
@@ -2742,7 +3050,9 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 						conflictSources: authError.conflictSources,
 						conflictKeys: authError.conflictKeys,
 						gatewayUrl: authError.gatewayUrl,
-						region: authError.region
+						region: authError.region,
+						usingManagedLogin: authError.usingManagedLogin,
+						apiKeySource: authError.apiKeySource
 					})
 				});
 			}
@@ -2761,7 +3071,7 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 		}
 		if (yaraViolationReason) {
 			logToFile("Agent error: YARA_VIOLATION");
-			spinner.stop("Security violation detected");
+			spinner.stop("Security check stopped the setup");
 			return { error: "WIZARD_YARA_VIOLATION" };
 		}
 		if (abortReason) {
@@ -2804,7 +3114,7 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 		signalDone();
 		if (yaraViolationReason) {
 			logToFile("Agent error: YARA_VIOLATION");
-			spinner.stop("Security violation detected");
+			spinner.stop("Security check stopped the setup");
 			return { error: "WIZARD_YARA_VIOLATION" };
 		}
 		if (abortReason) {
@@ -3044,11 +3354,15 @@ function handleSDKMessage(message, options, spinner, signals, receivedSuccessRes
 			}
 			break;
 		case "system":
-			if (message.subtype === "init") logToFile("Agent session initialized", {
-				model: message.model,
-				tools: message.tools?.length,
-				mcpServers: message.mcp_servers
-			});
+			if (message.subtype === "init") {
+				signals.recordApiKeySource(message.apiKeySource);
+				logToFile("Agent session initialized", {
+					model: message.model,
+					tools: message.tools?.length,
+					mcpServers: message.mcp_servers,
+					apiKeySource: message.apiKeySource
+				});
+			}
 			break;
 		default:
 			if (options.debug) debug(`Unhandled message type: ${message.type}`);
@@ -3056,6 +3370,6 @@ function handleSDKMessage(message, options, spinner, signals, receivedSuccessRes
 	}
 }
 //#endregion
-export { AUDIT_CHECKS_FILE as C, coerceAuditChecks as D, AUDIT_SEVERITY_STYLE as E, getAuditChecks as O, TaskStatus as S, AUDIT_REPORT_FILE as T, downloadSkill as _, runAgent as a, QUEUE_DIR_NAME as b, recoverOrphanedSettingsBackups as c, flushScanReport as d, formatScanReport as f, WIZARD_TOOL_NAMES as g, SETUP_REPORT_FILE as h, isOrchestratorEnabled as i, restoreClaudeSettings as l, EVENT_PLAN_FILE as m, buildRunTags as n, backupAndFixClaudeSettings as o, writeScanReport as p, initializeAgent as r, checkAllSettingsConflicts as s, buildAgentEnv as t, AgentSignals as u, fetchSkillMenu as v, AUDIT_CHECKS_KEY as w, QueueStore as x, installSkillById as y };
+export { coerceAuditChecks as A, QUEUE_DIR_NAME as C, AUDIT_CHECKS_KEY as D, AUDIT_CHECKS_FILE as E, AUDIT_REPORT_FILE as O, installSkillById as S, TaskStatus as T, EVENT_PLAN_FILE as _, runAgent as a, downloadSkill as b, classifySettingsConflicts as c, sanitizeAgentSubprocessEnv as d, AgentSignals as f, writeScanReport as g, formatYaraAbortMessage as h, isOrchestratorEnabled as i, getAuditChecks as j, AUDIT_SEVERITY_STYLE as k, recoverOrphanedSettingsBackups as l, formatScanReport as m, buildRunTags as n, backupAndFixClaudeSettings as o, flushScanReport as p, initializeAgent as r, checkAllSettingsConflicts as s, buildAgentEnv as t, restoreClaudeSettings as u, SETUP_REPORT_FILE as v, QueueStore as w, fetchSkillMenu as x, WIZARD_TOOL_NAMES as y };
 
-//# sourceMappingURL=agent-interface-DCeQ5Oiw.js.map
+//# sourceMappingURL=agent-interface-CXL9i_vX.js.map