@posthog/wizard 2.35.0 → 2.37.0

package/dist/{agent-interface-CXL9i_vX.js → agent-interface-D8jnkEnB.js}

@@ -1,9 +1,9 @@
 import { n as __require } from "./rolldown-runtime-B_-DWIq7.js";
-import { B as POSTHOG_PROPERTY_HEADER_PREFIX, L as POSTHOG_FLAG_HEADER_PREFIX, Y as WIZARD_REMARK_EVENT_NAME, Z as WIZARD_USER_AGENT, a as getLogFilePath, f as skillTmpPath, nt as runtimeEnv, o as initLogFile, p as getUI, q as WIZARD_ORCHESTRATOR_FLAG_KEY, r as debug, s as logToFile, u as WIZARD_YARA_REPORT_FILE } from "./debug-DXWxKT5f.js";
-import { t as analytics } from "./analytics-DP_j88IC.js";
-import { t as HostResolution } from "./host-resolution-Dw0fS8h5.js";
-import { n as ADDITIONAL_FEATURE_PROMPTS } from "./wizard-session-BHoLQueN.js";
-import { i as wizardAbort, n as registerCleanup, t as WizardError } from "./wizard-abort-BE_j8xUt.js";
+import { B as POSTHOG_PROPERTY_HEADER_PREFIX, L as POSTHOG_FLAG_HEADER_PREFIX, Y as WIZARD_REMARK_EVENT_NAME, Z as WIZARD_USER_AGENT, a as getLogFilePath, f as skillTmpPath, nt as runtimeEnv, o as initLogFile, p as getUI, q as WIZARD_ORCHESTRATOR_FLAG_KEY, r as debug, s as logToFile, u as WIZARD_YARA_REPORT_FILE } from "./debug-CZwmzyDx.js";
+import { t as analytics } from "./analytics-Du8Z_3oX.js";
+import { t as HostResolution } from "./host-resolution-DrOzdKdY.js";
+import { n as ADDITIONAL_FEATURE_PROMPTS } from "./wizard-session-CqihOtk3.js";
+import { i as wizardAbort, n as registerCleanup, t as WizardError } from "./wizard-abort-BG8VNOI9.js";
 import { createRequire } from "node:module";
 import * as fs$1 from "fs";
 import fs from "fs";
@@ -13,9 +13,173 @@ import { spawnSync } from "node:child_process";
 import axios from "axios";
 import { z } from "zod";
 import fg from "fast-glob";
+import * as os from "os";
 import { execFileSync } from "child_process";
 import { randomUUID } from "crypto";
-import * as os from "os";
+//#region src/utils/custom-headers.ts
+/**
+* Builds a list of custom headers for ANTHROPIC_CUSTOM_HEADERS.
+*/
+function createCustomHeaders() {
+	const entries = [];
+	return {
+		add(key, value) {
+			const name = key.startsWith("x-") || key.startsWith("X-") ? key : `X-${key}`;
+			entries.push({
+				key: name,
+				value
+			});
+		},
+		addFlag(flagKey, variant) {
+			const headerName = POSTHOG_FLAG_HEADER_PREFIX + flagKey.toUpperCase();
+			entries.push({
+				key: headerName,
+				value: variant
+			});
+		},
+		encode() {
+			return entries.map(({ key, value }) => `${key}: ${value}`).join("\n");
+		}
+	};
+}
+//#endregion
+//#region src/lib/safe-tools.ts
+const LINTING_TOOLS = [
+	"codespell",
+	"cspell",
+	"git-diff-check",
+	"gitleaks",
+	"trufflehog",
+	"asl-validator",
+	"ansible-lint",
+	"pmd",
+	"biome",
+	"cfn-lint",
+	"cfnlint",
+	"checkov",
+	"trivy",
+	"test-aztemplate",
+	"shellcheck",
+	"shfmt",
+	"buildifier",
+	"cpplint",
+	"clang-format",
+	"clang-tidy",
+	"cmake-format",
+	"iwyu",
+	"pragma-once",
+	"dotnet-format",
+	"circleci",
+	"clj-kondo",
+	"coffeelint",
+	"commitlint",
+	"jscpd",
+	"stylelint",
+	"prettier",
+	"cue-fmt",
+	"dart",
+	"hadolint",
+	"dotenv-linter",
+	"editorconfig-checker",
+	"actionlint",
+	"zizmor",
+	"gofmt",
+	"gofumpt",
+	"goimports",
+	"gokart",
+	"golangci-lint",
+	"golines",
+	"semgrep",
+	"goreleaser",
+	"graphql-schema-linter",
+	"npm-groovy-lint",
+	"haml-lint",
+	"htmlhint",
+	"djlint",
+	"checkstyle",
+	"google-java-format",
+	"eslint",
+	"next lint",
+	"deno",
+	"rome",
+	"eslint-plugin-jsonc",
+	"eslint-plugin-json",
+	"eslint-plugin-jsx-a11y",
+	"eslint-plugin-react",
+	"nbqa",
+	"detekt",
+	"ktlint",
+	"kubeconform",
+	"kube-linter",
+	"chktex",
+	"luacheck",
+	"stylua",
+	"markdownlint",
+	"markdownlint-cli2",
+	"markdown-link-check",
+	"markdown-table-prettify",
+	"remark-lint",
+	"textlint",
+	"vale",
+	"nixpkgs-fmt",
+	"spectral",
+	"sort-package-json",
+	"perlcritic",
+	"perltidy",
+	"php-cs-fixer",
+	"phpcs",
+	"phpstan",
+	"psalm",
+	"oxipng",
+	"psscriptanalyzer",
+	"prisma",
+	"protolint",
+	"buf",
+	"pylint",
+	"flake8",
+	"isort",
+	"ruff",
+	"black",
+	"autopep8",
+	"bandit",
+	"mypy",
+	"pyright",
+	"sourcery",
+	"yapf",
+	"lintr",
+	"opa",
+	"regal",
+	"rubocop",
+	"brakeman",
+	"rufo",
+	"standardrb",
+	"clippy",
+	"rustfmt",
+	"scalafmt",
+	"osv-scanner",
+	"terrascan",
+	"tfsec",
+	"snakemake --lint",
+	"snakefmt",
+	"sqlfluff",
+	"sql-formatter",
+	"sqlfmt",
+	"squawk",
+	"svgo",
+	"stringslint",
+	"swiftformat",
+	"swiftlint",
+	"tflint",
+	"terraform",
+	"tofu",
+	"terragrunt",
+	"txtpbfmt",
+	"taplo",
+	"eslint-plugin-vue",
+	"xmllint",
+	"yamllint"
+];
+//#endregion
 //#region src/utils/atomic-ledger.ts
 /**
 * Small shared primitives for on-disk ledgers: an atomic JSON writer and a
@@ -87,6 +251,68 @@ function coerceAuditChecks(parsed) {
 	return Array.isArray(parsed) ? parsed : [];
 }
 //#endregion
+//#region src/lib/wizard-ask-bridge.ts
+/**
+* WizardAskBridge — host-side promise broker for the `wizard_ask` MCP tool.
+*
+* The `wizard_ask` tool needs to (a) read information from the wizard
+* session (the active skill id, used as the analytics `source`) and
+* (b) drive the TUI overlay. Wiring `wizard-tools.ts` directly to either
+* would couple our pure-data MCP server to the runtime UI layer.
+*
+* The bridge is the seam: `wizard-tools.ts` depends on this interface,
+* and `agent-runner.ts` constructs an implementation that knows about
+* both the session and `getUI()`.
+*/
+/** Sentinel returned for unanswered fields on cancellation or timeout. */
+const CANCELLED_SENTINEL = "__cancelled__";
+function buildCancelledAnswers(questions) {
+	const out = {};
+	for (const q of questions) out[q.id] = CANCELLED_SENTINEL;
+	return out;
+}
+function isFullyCancelled(answers) {
+	const values = Object.values(answers);
+	if (values.length === 0) return false;
+	return values.every((v) => v === CANCELLED_SENTINEL);
+}
+function createWizardAskBridge(opts) {
+	const timeoutMs = opts.timeoutMs ?? 3e5;
+	return { async request({ questions }) {
+		const pending = {
+			id: randomUUID(),
+			questions,
+			source: opts.getSource(),
+			richLinks: opts.richLinks ?? false
+		};
+		const startedAt = Date.now();
+		let timer;
+		const timeoutPromise = new Promise((resolve) => {
+			timer = setTimeout(() => {
+				resolve(buildCancelledAnswers(questions));
+			}, timeoutMs);
+		});
+		try {
+			const answers = await Promise.race([opts.showQuestion(pending), timeoutPromise]);
+			const durationMs = Date.now() - startedAt;
+			if (isFullyCancelled(answers)) analytics.wizardCapture("wizard_ask cancelled", {
+				source: pending.source,
+				question_count: questions.length,
+				duration_ms: durationMs,
+				timed_out: durationMs >= timeoutMs
+			});
+			else analytics.wizardCapture("wizard_ask answered", {
+				source: pending.source,
+				question_count: questions.length,
+				duration_ms: durationMs
+			});
+			return answers;
+		} finally {
+			if (timer) clearTimeout(timer);
+		}
+	} };
+}
+//#endregion
 //#region src/lib/secret-vault.ts
 /**
 * Session-scoped secret vault.
@@ -931,7 +1157,7 @@ async function createWizardToolsServer(options) {
 			description: z.string().optional().describe("Optional secondary line shown dimmed and wrapped beneath the label (multi-select only). Use when a choice needs more than a title — e.g. what a custom scout watches and what makes it speak up.")
 		})).optional().describe("Required for kind=single|multi; ignored for kind=text"),
 		required: z.boolean().optional().describe("Defaults to true"),
-		sensitive: z.boolean().optional().describe("Only valid for kind='text'. When true, the user's answer is stored in the wizard's secret vault and returned to you as { secretRef: 'secret:...' } instead of the raw string. Use for API keys, tokens, and any other secret the user types in.")
+		sensitive: z.boolean().optional().describe("Only valid for kind='text'. When true, the user's answer is stored in the wizard's secret vault and returned to you as { secretRef: 'secret:...' } instead of the raw string. Use for API keys, tokens, and any other secret the user types in. The secretRef is only resolved by wizard-tools that accept it (e.g. set_env_values) — it is NOT resolved when passed to other MCP tools (e.g. PostHog data-warehouse tools), which will reject it. For a secret that must reach another tool, write it to the env with set_env_values first, or use that tool's own credential-reference flow.")
 	});
 	return createSdkMcpServer({
 		name: SERVER_NAME,
@@ -945,7 +1171,7 @@ async function createWizardToolsServer(options) {
 			auditSeedChecks,
 			auditAddChecks,
 			auditResolveChecks,
-			tool("wizard_ask", "Ask the user one or more structured questions and wait for their answers. Use this whenever you would otherwise inline a question in your text output. Batch related questions into a single call — do not call this multiple times in a row.", { questions: z.array(askQuestionSchema).min(1).max(8) }, async (args) => {
+			tool("wizard_ask", "Ask the user one or more structured questions and wait for their answers. Use this whenever you would otherwise inline a question in your text output. Batch related questions into a single call (up to 8) rather than asking one at a time; sequential calls are fine when later questions genuinely depend on earlier answers. A fully cancelled or timed-out response does NOT count against the per-run cap — treat it as \"the user declined\" and fall back gracefully (e.g. hand over a deep link) without worrying about a wasted call.", { questions: z.array(askQuestionSchema).min(1).max(8) }, async (args) => {
 				if (!askBridge) return {
 					content: [{
 						type: "text",
@@ -999,6 +1225,7 @@ async function createWizardToolsServer(options) {
 				askCallCount += 1;
 				try {
 					const answers = await askBridge.request({ questions: args.questions });
+					if (isFullyCancelled(answers)) askCallCount -= 1;
 					const sensitiveById = new Map(args.questions.filter((q) => q.sensitive).map((q) => [q.id, q.prompt]));
 					const sanitised = {};
 					for (const [id, answer] of Object.entries(answers)) {
@@ -1048,170 +1275,6 @@ const WIZARD_TOOL_NAMES = {
 	readHandoffs: `mcp__${SERVER_NAME}__read_handoffs`
 };
 //#endregion
-//#region src/utils/custom-headers.ts
-/**
-* Builds a list of custom headers for ANTHROPIC_CUSTOM_HEADERS.
-*/
-function createCustomHeaders() {
-	const entries = [];
-	return {
-		add(key, value) {
-			const name = key.startsWith("x-") || key.startsWith("X-") ? key : `X-${key}`;
-			entries.push({
-				key: name,
-				value
-			});
-		},
-		addFlag(flagKey, variant) {
-			const headerName = POSTHOG_FLAG_HEADER_PREFIX + flagKey.toUpperCase();
-			entries.push({
-				key: headerName,
-				value: variant
-			});
-		},
-		encode() {
-			return entries.map(({ key, value }) => `${key}: ${value}`).join("\n");
-		}
-	};
-}
-//#endregion
-//#region src/lib/safe-tools.ts
-const LINTING_TOOLS = [
-	"codespell",
-	"cspell",
-	"git-diff-check",
-	"gitleaks",
-	"trufflehog",
-	"asl-validator",
-	"ansible-lint",
-	"pmd",
-	"biome",
-	"cfn-lint",
-	"cfnlint",
-	"checkov",
-	"trivy",
-	"test-aztemplate",
-	"shellcheck",
-	"shfmt",
-	"buildifier",
-	"cpplint",
-	"clang-format",
-	"clang-tidy",
-	"cmake-format",
-	"iwyu",
-	"pragma-once",
-	"dotnet-format",
-	"circleci",
-	"clj-kondo",
-	"coffeelint",
-	"commitlint",
-	"jscpd",
-	"stylelint",
-	"prettier",
-	"cue-fmt",
-	"dart",
-	"hadolint",
-	"dotenv-linter",
-	"editorconfig-checker",
-	"actionlint",
-	"zizmor",
-	"gofmt",
-	"gofumpt",
-	"goimports",
-	"gokart",
-	"golangci-lint",
-	"golines",
-	"semgrep",
-	"goreleaser",
-	"graphql-schema-linter",
-	"npm-groovy-lint",
-	"haml-lint",
-	"htmlhint",
-	"djlint",
-	"checkstyle",
-	"google-java-format",
-	"eslint",
-	"next lint",
-	"deno",
-	"rome",
-	"eslint-plugin-jsonc",
-	"eslint-plugin-json",
-	"eslint-plugin-jsx-a11y",
-	"eslint-plugin-react",
-	"nbqa",
-	"detekt",
-	"ktlint",
-	"kubeconform",
-	"kube-linter",
-	"chktex",
-	"luacheck",
-	"stylua",
-	"markdownlint",
-	"markdownlint-cli2",
-	"markdown-link-check",
-	"markdown-table-prettify",
-	"remark-lint",
-	"textlint",
-	"vale",
-	"nixpkgs-fmt",
-	"spectral",
-	"sort-package-json",
-	"perlcritic",
-	"perltidy",
-	"php-cs-fixer",
-	"phpcs",
-	"phpstan",
-	"psalm",
-	"oxipng",
-	"psscriptanalyzer",
-	"prisma",
-	"protolint",
-	"buf",
-	"pylint",
-	"flake8",
-	"isort",
-	"ruff",
-	"black",
-	"autopep8",
-	"bandit",
-	"mypy",
-	"pyright",
-	"sourcery",
-	"yapf",
-	"lintr",
-	"opa",
-	"regal",
-	"rubocop",
-	"brakeman",
-	"rufo",
-	"standardrb",
-	"clippy",
-	"rustfmt",
-	"scalafmt",
-	"osv-scanner",
-	"terrascan",
-	"tfsec",
-	"snakemake --lint",
-	"snakefmt",
-	"sqlfluff",
-	"sql-formatter",
-	"sqlfmt",
-	"squawk",
-	"svgo",
-	"stringslint",
-	"swiftformat",
-	"swiftlint",
-	"tflint",
-	"terraform",
-	"tofu",
-	"terragrunt",
-	"txtpbfmt",
-	"taplo",
-	"eslint-plugin-vue",
-	"xmllint",
-	"yamllint"
-];
-//#endregion
 //#region src/lib/skill-install.ts
 /**
 * Check if command is a PostHog skill installation from MCP.
@@ -3370,6 +3433,6 @@ function handleSDKMessage(message, options, spinner, signals, receivedSuccessRes
 	}
 }
 //#endregion
-export { coerceAuditChecks as A, QUEUE_DIR_NAME as C, AUDIT_CHECKS_KEY as D, AUDIT_CHECKS_FILE as E, AUDIT_REPORT_FILE as O, installSkillById as S, TaskStatus as T, EVENT_PLAN_FILE as _, runAgent as a, downloadSkill as b, classifySettingsConflicts as c, sanitizeAgentSubprocessEnv as d, AgentSignals as f, writeScanReport as g, formatYaraAbortMessage as h, isOrchestratorEnabled as i, getAuditChecks as j, AUDIT_SEVERITY_STYLE as k, recoverOrphanedSettingsBackups as l, formatScanReport as m, buildRunTags as n, backupAndFixClaudeSettings as o, flushScanReport as p, initializeAgent as r, checkAllSettingsConflicts as s, buildAgentEnv as t, restoreClaudeSettings as u, SETUP_REPORT_FILE as v, QueueStore as w, fetchSkillMenu as x, WIZARD_TOOL_NAMES as y };
+export { AUDIT_SEVERITY_STYLE as A, QUEUE_DIR_NAME as C, AUDIT_CHECKS_FILE as D, createWizardAskBridge as E, getAuditChecks as M, AUDIT_CHECKS_KEY as O, installSkillById as S, TaskStatus as T, EVENT_PLAN_FILE as _, runAgent as a, downloadSkill as b, classifySettingsConflicts as c, sanitizeAgentSubprocessEnv as d, AgentSignals as f, writeScanReport as g, formatYaraAbortMessage as h, isOrchestratorEnabled as i, coerceAuditChecks as j, AUDIT_REPORT_FILE as k, recoverOrphanedSettingsBackups as l, formatScanReport as m, buildRunTags as n, backupAndFixClaudeSettings as o, flushScanReport as p, initializeAgent as r, checkAllSettingsConflicts as s, buildAgentEnv as t, restoreClaudeSettings as u, SETUP_REPORT_FILE as v, QueueStore as w, fetchSkillMenu as x, WIZARD_TOOL_NAMES as y };
 
-//# sourceMappingURL=agent-interface-CXL9i_vX.js.map
+//# sourceMappingURL=agent-interface-D8jnkEnB.js.map