@posthog/wizard 2.38.2 → 2.39.0

package/dist/{agent-interface-DExARWay.js → agent-interface-BR3zAUpM.js}

@@ -1,17 +1,16 @@
 import { n as __require } from "./rolldown-runtime-B_-DWIq7.js";
-import { V as POSTHOG_FLAG_HEADER_PREFIX, W as POSTHOG_PROPERTY_HEADER_PREFIX, a as getLogFilePath, at as WIZARD_REMARK_EVENT_NAME, f as getUI, o as initLogFile, pt as runtimeEnv, r as debug, s as logToFile, st as WIZARD_USER_AGENT, tt as WIZARD_ORCHESTRATOR_FLAG_KEY, u as WIZARD_YARA_REPORT_FILE } from "./debug-D1lORUFs.js";
-import { n as analytics } from "./analytics-Ciob-x8a.js";
-import { t as HostResolution } from "./host-resolution-BnUJZKId.js";
+import { V as POSTHOG_FLAG_HEADER_PREFIX, W as POSTHOG_PROPERTY_HEADER_PREFIX, a as getLogFilePath, at as WIZARD_REMARK_EVENT_NAME, f as getUI, o as initLogFile, pt as runtimeEnv, r as debug, s as logToFile, st as WIZARD_USER_AGENT, tt as WIZARD_ORCHESTRATOR_FLAG_KEY } from "./debug-BZnZ7Gvh.js";
+import { n as analytics } from "./analytics-C7Oc3yWZ.js";
+import { t as HostResolution } from "./host-resolution-DjQvur4X.js";
 import { n as ADDITIONAL_FEATURE_PROMPTS } from "./wizard-session-BoXAZEOf.js";
-import { i as wizardAbort, n as registerCleanup, t as WizardError } from "./wizard-abort-Cp5Y7f8C.js";
-import { h as AUDIT_REPORT_FILE, n as createWizardToolsServer, t as WIZARD_TOOL_NAMES } from "./wizard-tools-DQTfAzSV.js";
+import { i as wizardAbort, n as registerCleanup, t as WizardError } from "./wizard-abort-5fOIcY8w.js";
+import { n as createWizardToolsServer, t as WIZARD_TOOL_NAMES } from "./wizard-tools-xvIrJeNN.js";
+import { l as prewarmYaraScanner, n as createPostToolUseYaraHooks, r as createPreToolUseYaraHooks } from "./yara-hooks-DNn1Jqih.js";
 import { createRequire } from "node:module";
 import * as fs$1 from "fs";
-import fs from "fs";
 import path from "path";
 import { spawnSync } from "node:child_process";
 import axios from "axios";
-import fg from "fast-glob";
 import * as os from "os";
 //#region src/utils/custom-headers.ts
 /**
@@ -177,604 +176,6 @@ const LINTING_TOOLS = [
 	"yamllint"
 ];
 //#endregion
-//#region src/lib/skill-install.ts
-/**
-* Check if command is a PostHog skill installation from MCP.
-* We control the MCP server, so we only need to verify:
-* 1. It installs to .claude/skills/
-* 2. It downloads from our GitHub releases or localhost (dev)
-*
-* Extracted to its own module to avoid a circular dependency
-* between agent-interface.ts and yara-hooks.ts.
-*/
-function isSkillInstallCommand(command) {
-	if (!command.startsWith("mkdir -p .claude/skills/")) return false;
-	const urlMatch = command.match(/curl -sL ['"]([^'"]+)['"]/);
-	if (!urlMatch) return false;
-	const url = urlMatch[1];
-	return url.startsWith("https://github.com/PostHog/context-mill/releases/") || /^http:\/\/localhost:\d+\//.test(url);
-}
-//#endregion
-//#region src/lib/programs/events-audit/constants.ts
-/**
-* Leaf-level constants for the events-audit program.
-*
-* Kept separate from `index.ts` so files like `yara-hooks.ts` can import
-* the filename constants without dragging in `index.ts`'s heavier imports
-* (agent-runner, audit/seed, etc.) — which can create import cycles.
-*/
-const SETUP_REPORT_FILE = "posthog-events-audit-report.md";
-const EVENT_INVENTORY_FILE = ".posthog-events-inventory.json";
-/** Per-part filename pattern emitted by events-audit subagents (e.g. `.posthog-events-inventory.part-3.json`). */
-const EVENT_INVENTORY_PART_PATTERN = /^\.posthog-events-inventory\.part-\d+\.json$/;
-//#endregion
-//#region src/lib/programs/posthog-integration/constants.ts
-/**
-* Leaf-level constants for the posthog-integration program.
-*
-* Kept separate from `index.ts` so files like `yara-hooks.ts` can import
-* the filename constants without dragging in `index.ts`'s heavier imports
-* (agent-interface, framework-config, etc.) — which would create an import
-* cycle through agent-interface → yara-hooks.
-*/
-const EVENT_PLAN_FILE = ".posthog-events.json";
-//#endregion
-//#region src/lib/yara-hooks.ts
-/**
-* YARA hook wiring for the Claude Agent SDK.
-*
-* Creates PreToolUse and PostToolUse hook callback arrays that integrate the
-* real @posthog/warlock security scanner (YARA-X via WASM) into the wizard's
-* agent loop. These hooks are registered in the SDK's query() options alongside
-* the existing Stop hook.
-*
-* PreToolUse hooks block dangerous commands before execution. PostToolUse hooks
-* detect violations in written code and prompt injection in read content, and
-* scan context-mill skill downloads.
-*
-* Warlock owns the rules; this file owns the *policy* — how a match maps to a
-* block / revert / terminate response, plus the optional LLM triage pass that
-* filters false positives before we act.
-*
-* Naming: "yara" is the technique — scanning content against YARA rules — so the
-* wizard-side wiring keeps that name. "warlock" is the engine package that runs
-* the rules. Both names showing up here is intentional.
-*
-* This is Layer 2 (L2) in the wizard's defense-in-depth model, complementing the
-* prompt-based commandments (L0) and the canUseTool() allowlist (L1).
-*/
-let warlockModulePromise = null;
-function getWarlock() {
-	if (!warlockModulePromise) warlockModulePromise = import("@posthog/warlock").catch((err) => {
-		warlockModulePromise = null;
-		throw err;
-	});
-	return warlockModulePromise;
-}
-/**
-* Pay the WASM-init + rule-compile cost up front, off the hook path, so the
-* first real tool-call scan doesn't eat cold-start under a hook timeout.
-* Best-effort: a failure here is non-fatal — hooks still fail closed per scan.
-*/
-async function prewarmYaraScanner() {
-	try {
-		await (await getWarlock()).scan("");
-		logToFile("[YARA] warlock pre-warmed");
-	} catch (err) {
-		logToFile("[YARA] warlock pre-warm failed:", err);
-	}
-}
-let scanCount = 0;
-const scanViolations = [];
-function recordScan() {
-	scanCount++;
-}
-/**
-* Log a match to the run log + PostHog, and record it in the run's scan report.
-* Single entry point so every violation is reported consistently.
-*/
-function recordMatch(phase, tool, match, action) {
-	const triage = match.triage;
-	logYaraMatch(phase, tool, match, action);
-	scanViolations.push({
-		rule: match.rule,
-		severity: match.metadata.severity ?? "unknown",
-		category: match.metadata.category ?? "unknown",
-		action,
-		phase,
-		tool,
-		description: match.metadata.description ?? "",
-		triageVerdict: triage?.verdict,
-		triageReason: triage?.reason
-	});
-}
-/**
-* Scan bookkeeping for harnesses that run a scanner outside these hooks (pi):
-* counts the scan and routes violations through `recordMatch`, so they reach
-* the run log, per-match telemetry, and the end-of-run scan report.
-*/
-function recordExternalScan(phase, tool, violations, action) {
-	recordScan();
-	for (const v of violations) recordMatch(phase, tool, {
-		rule: v.rule,
-		metadata: {
-			severity: v.severity,
-			category: v.category,
-			description: v.description
-		},
-		matchedStrings: []
-	}, action);
-}
-/** Format the scan report summary. Returns null if no scans occurred */
-function formatScanReport() {
-	if (scanCount === 0) return null;
-	const lines = ["", "— YARA Scanner Summary —"];
-	const violationCount = scanViolations.length;
-	const cleanCount = scanCount - violationCount;
-	lines.push(`✓ ${scanCount} tool calls scanned, ${violationCount} violation${violationCount !== 1 ? "s" : ""} detected`);
-	if (violationCount > 0) {
-		lines.push("");
-		for (const v of scanViolations) {
-			const tag = v.action.toUpperCase();
-			lines.push(`  [${tag}] ${v.rule} (${v.severity.toUpperCase()}) — ${v.phase}:${v.tool}`);
-		}
-	}
-	if (cleanCount > 0) {
-		lines.push("");
-		lines.push(`No violations: ✓ ${cleanCount} clean scan${cleanCount !== 1 ? "s" : ""}`);
-	}
-	lines.push("");
-	return lines.join("\n");
-}
-/** Write the scan report to a JSON file. Returns the file path, or null if no scans occurred. */
-function writeScanReport() {
-	if (scanCount === 0) return null;
-	const report = {
-		summary: {
-			totalScans: scanCount,
-			violations: scanViolations.length,
-			clean: scanCount - scanViolations.length
-		},
-		violations: scanViolations
-	};
-	try {
-		fs.writeFileSync(WIZARD_YARA_REPORT_FILE, JSON.stringify(report, null, 2));
-	} catch (err) {
-		logToFile("[YARA] Failed to write scan report:", err);
-		return null;
-	}
-	return WIZARD_YARA_REPORT_FILE;
-}
-const CATEGORY_DESCRIPTIONS = {
-	prompt_injection: "hit hidden instructions in a file it read, a possible attempt to hijack the setup",
-	exfiltration: "tried to send data to an outside location",
-	destructive_operations: "tried to run a destructive command",
-	supply_chain: "tried to pull in untrusted code",
-	posthog_pii: "tried to write personal data (PII) into your project",
-	posthog_hardcoded_key: "tried to hardcode a PostHog key into your project",
-	hardcoded_secret: "tried to hardcode a secret into your project"
-};
-/** Most recent violation that terminated the run, or null. */
-function lastTerminatingViolation() {
-	for (let i = scanViolations.length - 1; i >= 0; i--) if (scanViolations[i].action === "aborted") return scanViolations[i];
-	return null;
-}
-/**
-* Build the user-facing copy for the security abort screen: what the scanner
-* caught and what we did about it. This screen renders only because the run was
-* stopped, so the "what we did" half is constant. Falls back to a generic line
-* when no specific violation was recorded (e.g. the scanner itself errored and
-* failed closed before a match was logged).
-*/
-function formatYaraAbortMessage() {
-	const v = lastTerminatingViolation();
-	return `Security check stopped the setup.
-
-The agent ${(v && CATEGORY_DESCRIPTIONS[v.category]) ?? "did something our security scanner flagged"}. We stopped the run to keep your project safe.\nNo unsafe changes were left in your project.
-
-If this looks wrong, let us know: wizard@posthog.com`;
-}
-/** Timeout for scan hooks (PreToolUse, PostToolUse Write/Edit/Read/Grep) */
-const HOOK_TIMEOUT_MS = 3e4;
-/** Timeout for the skill install hook (filesystem I/O + multiple scans) */
-const SKILL_SCAN_HOOK_TIMEOUT_MS = 3e4;
-/**
-* Chunk size for scanning (100 KB). Oversized content is scanned in
-* overlapping chunks so coverage is complete — nothing is silently truncated.
-* The size also bounds what a single triage call pastes into the LLM prompt
-* (~25K tokens), so triage always sees the chunk its matches came from.
-*/
-const SCAN_CHUNK_SIZE = 1e5;
-/**
-* Overlap between adjacent chunks so a pattern straddling a chunk boundary
-* still lands whole inside at least one chunk. YARA rule strings are at most
-* a few hundred bytes; 4 KB is generous.
-*/
-const SCAN_CHUNK_OVERLAP = 4096;
-function logYaraMatch(phase, tool, match, action) {
-	const severity = match.metadata.severity ?? "unknown";
-	const category = match.metadata.category ?? "unknown";
-	const ruleAction = match.metadata.action ?? "unknown";
-	const description = match.metadata.description ?? "";
-	logToFile(`[YARA] ${phase}:${tool} [${action.toUpperCase()}] rule "${match.rule}" (severity: ${severity}, category: ${category}, action: ${ruleAction})\n  Description: ${description}`);
-	analytics.wizardCapture("yara rule matched", {
-		rule: match.rule,
-		severity: match.metadata.severity,
-		category: match.metadata.category,
-		rule_action: match.metadata.action,
-		action,
-		phase,
-		tool,
-		description: match.metadata.description,
-		triage_verdict: match.triage?.verdict
-	});
-}
-/**
-* Send the run's full scan report to PostHog so maintainers can see why a run
-* was flagged, warned, or aborted. This is the maintainer-facing report — it is
-* NEVER shown to the user. No-op if nothing was scanned. The free-text triage
-* reason is omitted to avoid sending scanned content off the user's machine.
-*/
-function captureScanReport() {
-	if (scanCount === 0) return;
-	analytics.wizardCapture("yara scan report", {
-		total_scans: scanCount,
-		violation_count: scanViolations.length,
-		clean_count: scanCount - scanViolations.length,
-		violations: scanViolations.map((v) => ({
-			rule: v.rule,
-			severity: v.severity,
-			category: v.category,
-			action: v.action,
-			phase: v.phase,
-			tool: v.tool,
-			description: v.description,
-			triage_verdict: v.triageVerdict
-		}))
-	});
-	scanCount = 0;
-	scanViolations.length = 0;
-}
-/**
-* End-of-run flush for the scan report. Wired once at the runner seam so every
-* harness (linear, orchestrator, and any future shape) reports without having
-* to know warlock exists — scanning is already harness-agnostic (it runs from
-* SDK Pre/PostToolUse hooks), and this keeps reporting at a single shared seam.
-*
-* Order matters: write the local --yara-report file FIRST (it reads scanCount /
-* scanViolations), THEN send telemetry. captureScanReport() zeroes scan state,
-* which is what makes this whole function idempotent — a second call from
-* another termination path (e.g. finally after an abort already flushed) finds
-* scanCount === 0 and every step no-ops.
-*/
-function flushScanReport(session) {
-	if (session.yaraReport) {
-		const reportPath = writeScanReport();
-		if (reportPath) {
-			const summary = formatScanReport();
-			getUI().log.info(`YARA scan report: ${reportPath}${summary ?? ""}`);
-		}
-	}
-	captureScanReport();
-}
-const WIZARD_DOC_BASENAMES = new Set([
-	EVENT_INVENTORY_FILE,
-	SETUP_REPORT_FILE,
-	AUDIT_REPORT_FILE,
-	EVENT_PLAN_FILE
-]);
-const WIZARD_DOC_PATTERNS = [EVENT_INVENTORY_PART_PATTERN];
-function isWizardDocumentationPath(filePath) {
-	if (!filePath) return false;
-	const basename = path.basename(filePath);
-	if (WIZARD_DOC_BASENAMES.has(basename)) return true;
-	return WIZARD_DOC_PATTERNS.some((re) => re.test(basename));
-}
-const SEVERITY_RANK = {
-	critical: 4,
-	high: 3,
-	medium: 2,
-	low: 1
-};
-/** Return the highest-severity match from a list of matches. */
-function highestSeverityMatch(matches) {
-	return matches.reduce((worst, m) => (SEVERITY_RANK[m.metadata.severity ?? ""] ?? 0) > (SEVERITY_RANK[worst.metadata.severity ?? ""] ?? 0) ? m : worst);
-}
-/**
-* Keep only matches whose rule targets this content surface. Rules carry a
-* `scan_context` of 'command' | 'input' | 'output'. An undefined context is
-* treated as "applies everywhere" (fail-safe — a rule that forgets the tag
-* still gets enforced rather than silently skipped).
-*/
-function matchesForContext(matches, ctx) {
-	return matches.filter((m) => {
-		const c = m.metadata.scan_context;
-		return c === ctx || c === void 0;
-	});
-}
-/**
-* Drop false positives via warlock's LLM triage. Fail-closed: if no provider is
-* available, or the triage call throws, every match is treated as real — we
-* never silently suppress a flagged match.
-*
-* Every overruled match is reported to PostHog (rule metadata only, never the
-* free-text reason) so maintainers can alert on triage-overrule patterns — the
-* signal that someone is either tripping a noisy rule or trying to talk the
-* triage model out of a real finding.
-*/
-async function triageFilter(content, matches, ctx, llmProvider) {
-	if (matches.length === 0) return [];
-	if (!llmProvider) {
-		logToFile(`[YARA] triage skipped (no provider) — treating ${matches.length} match(es) as real`);
-		return matches;
-	}
-	try {
-		const triaged = await (await getWarlock()).triageMatches(content, matches, llmProvider);
-		const kept = triaged.filter((m) => m.triage.verdict === "true_positive");
-		for (const m of triaged) {
-			if (m.triage.verdict === "true_positive") continue;
-			logToFile(`[YARA] triage overruled rule "${m.rule}" (${m.metadata.severity ?? "unknown"}) — not acting on it`);
-			analytics.wizardCapture("yara triage overruled", {
-				rule: m.rule,
-				severity: m.metadata.severity,
-				category: m.metadata.category,
-				scan_context: ctx
-			});
-		}
-		logToFile(`[YARA] triage: ${matches.length} flagged → ${kept.length} kept as real`);
-		return kept;
-	} catch (err) {
-		logToFile("[YARA] triage failed — treating all matches as real:", err);
-		return matches;
-	}
-}
-/**
-* Split oversized content into overlapping chunks so the scanner covers all
-* of it. Content that fits in one chunk is returned as-is.
-*/
-function chunkContent(content) {
-	if (content.length <= SCAN_CHUNK_SIZE) return [content];
-	const chunks = [];
-	const step = SCAN_CHUNK_SIZE - SCAN_CHUNK_OVERLAP;
-	for (let start = 0; start < content.length; start += step) {
-		chunks.push(content.slice(start, start + SCAN_CHUNK_SIZE));
-		if (start + SCAN_CHUNK_SIZE >= content.length) break;
-	}
-	return chunks;
-}
-/**
-* Scan content against warlock rules — chunked when oversized, so nothing is
-* skipped — and keep only matches for this content surface. Chunks scan
-* sequentially (the WASM engine is single-threaded; parallelism buys nothing).
-* Returns each flagged chunk with its matches so triage can later judge every
-* match against the exact content it came from.
-*/
-async function scanForContext(content, ctx) {
-	const warlock = await getWarlock();
-	const chunks = chunkContent(content);
-	if (chunks.length > 1) {
-		logToFile(`[YARA] content is ${content.length} chars — scanning ${chunks.length} overlapping chunks`);
-		analytics.wizardCapture("yara scan chunked", {
-			content_length: content.length,
-			chunk_count: chunks.length,
-			scan_context: ctx
-		});
-	}
-	const flagged = [];
-	for (const chunk of chunks) {
-		const result = await warlock.scan(chunk);
-		if (!result.matched) continue;
-		const matches = matchesForContext(result.matches, ctx);
-		if (matches.length === 0) continue;
-		flagged.push({
-			chunk,
-			matches
-		});
-	}
-	return flagged;
-}
-/** The overlap between chunks can surface the same rule twice; count it once. */
-function dedupeByRule(matches) {
-	const seen = /* @__PURE__ */ new Set();
-	return matches.filter((m) => {
-		if (seen.has(m.rule)) return false;
-		seen.add(m.rule);
-		return true;
-	});
-}
-/**
-* Triage each flagged chunk against its own content — the evidence is always
-* inside the window the LLM sees. Triage calls run in parallel (each is just
-* an HTTP round trip) so N flagged chunks cost ~1× triage latency, not N×.
-*/
-async function triageFlagged(flagged, ctx, llmProvider) {
-	return dedupeByRule((await Promise.all(flagged.map(({ chunk, matches }) => triageFilter(chunk, matches, ctx, llmProvider)))).flat());
-}
-/** Scan content, filter to the relevant context, triage. Returns real matches. */
-async function scanAndTriage(content, ctx, llmProvider) {
-	return triageFlagged(await scanForContext(content, ctx), ctx, llmProvider);
-}
-/**
-* Create PreToolUse hook matchers for YARA scanning.
-* Scans Bash commands before execution for exfiltration, destructive
-* operations, and supply chain violations ('command'-context rules).
-*/
-function createPreToolUseYaraHooks(_llmProvider) {
-	return [{
-		hooks: [async (input) => {
-			try {
-				if (input.tool_name !== "Bash") return {};
-				const toolInput = input.tool_input;
-				const command = typeof toolInput?.command === "string" ? toolInput.command : "";
-				if (!command) return {};
-				recordScan();
-				const matches = await scanAndTriage(command, "command", void 0);
-				if (matches.length === 0) return {};
-				const match = highestSeverityMatch(matches);
-				recordMatch("PreToolUse", "Bash", match, "blocked");
-				return {
-					decision: "block",
-					reason: `[YARA] ${match.rule}: ${match.metadata.description ?? "security policy violation"}. Command blocked for security.`
-				};
-			} catch (error) {
-				logToFile("[YARA] PreToolUse hook error:", error);
-				return {
-					decision: "block",
-					reason: "[YARA] Scanner error — command blocked as a precaution."
-				};
-			}
-		}],
-		timeout: HOOK_TIMEOUT_MS
-	}];
-}
-/**
-* Create PostToolUse hook matchers for YARA scanning.
-*
-* Three matchers:
-* 1. Write/Edit — scan written content ('output'-context rules: PII, secrets)
-* 2. Read/Grep — scan read content ('input'-context rules: prompt injection)
-* 3. Bash (skill install) — scan downloaded skill files for poisoned content
-*
-* `onTerminate` is invoked on the terminal paths (critical prompt injection in
-* read content, a poisoned skill, or a scanner error under fail-closed). It is
-* what ACTUALLY stops the run — returning `stopReason` from a PostToolUse hook
-* is not honored by the SDK, so the caller wires this to the run's
-* AbortController (see agent-interface).
-*/
-function createPostToolUseYaraHooks(llmProvider, onTerminate) {
-	return [
-		{
-			hooks: [async (input) => {
-				try {
-					const toolName = input.tool_name;
-					if (toolName !== "Write" && toolName !== "Edit") return {};
-					const toolInput = input.tool_input;
-					const content = toolName === "Write" ? toolInput?.content ?? "" : toolInput?.new_string ?? "";
-					if (!content) return {};
-					recordScan();
-					const flagged = await scanForContext(content, "output");
-					if (flagged.length === 0) return {};
-					const filePath = toolInput?.file_path;
-					const activeFlagged = isWizardDocumentationPath(filePath) ? flagged.map(({ chunk, matches }) => ({
-						chunk,
-						matches: matches.filter((m) => m.metadata.category !== "posthog_pii")
-					})).filter(({ matches }) => matches.length > 0) : flagged;
-					if (activeFlagged.length === 0) {
-						logToFile(`[YARA] posthog_pii match suppressed on wizard doc ${path.basename(filePath ?? "")} (rule: ${flagged[0]?.matches[0]?.rule})`);
-						return {};
-					}
-					const matches = await triageFlagged(activeFlagged, "output", llmProvider);
-					if (matches.length === 0) return {};
-					const match = highestSeverityMatch(matches);
-					recordMatch("PostToolUse", toolName, match, "reverted");
-					return { hookSpecificOutput: {
-						hookEventName: "PostToolUse",
-						additionalContext: `[YARA VIOLATION] ${match.rule}: ${match.metadata.description ?? ""}. You MUST revert this change immediately. The content you just wrote violates security policy.`
-					} };
-				} catch (error) {
-					logToFile("[YARA] PostToolUse Write/Edit hook error:", error);
-					const reason = "[YARA] Scanner error while scanning written content — session terminated as a precaution.";
-					onTerminate(reason);
-					return { stopReason: reason };
-				}
-			}],
-			timeout: HOOK_TIMEOUT_MS
-		},
-		{
-			hooks: [async (input) => {
-				try {
-					const toolName = input.tool_name;
-					if (toolName !== "Read" && toolName !== "Grep") return {};
-					const toolResponse = input.tool_response;
-					if (toolResponse == null) return {};
-					const content = typeof toolResponse === "string" ? toolResponse : JSON.stringify(toolResponse);
-					if (!content) return {};
-					recordScan();
-					const matches = await scanAndTriage(content, "input", llmProvider);
-					if (matches.length === 0) return {};
-					const match = highestSeverityMatch(matches);
-					if (match.metadata.severity === "critical" || match.metadata.action === "block") {
-						recordMatch("PostToolUse", toolName, match, "aborted");
-						const reason = `[YARA CRITICAL] ${match.rule}: Prompt injection detected in file content. Agent context is potentially poisoned. Session terminated for safety.`;
-						onTerminate(reason);
-						return { stopReason: reason };
-					}
-					recordMatch("PostToolUse", toolName, match, "warned");
-					return { hookSpecificOutput: {
-						hookEventName: "PostToolUse",
-						additionalContext: `[YARA WARNING] ${match.rule}: ${match.metadata.description ?? ""}`
-					} };
-				} catch (error) {
-					logToFile("[YARA] PostToolUse Read/Grep hook error:", error);
-					const reason = "[YARA] Scanner error while scanning read content — session terminated as a precaution.";
-					onTerminate(reason);
-					return { stopReason: reason };
-				}
-			}],
-			timeout: HOOK_TIMEOUT_MS
-		},
-		{
-			hooks: [async (input) => {
-				try {
-					if (input.tool_name !== "Bash") return {};
-					const toolInput = input.tool_input;
-					const command = typeof toolInput?.command === "string" ? toolInput.command : "";
-					if (!isSkillInstallCommand(command)) return {};
-					const dirMatch = command.match(/mkdir -p (.claude\/skills\/[^\s&]+)/);
-					if (!dirMatch) return {};
-					const skillDir = dirMatch[1];
-					const cwd = input.cwd ?? process.cwd();
-					recordScan();
-					const matches = await scanSkillFiles(cwd, skillDir, llmProvider);
-					if (matches.length === 0) return {};
-					const match = highestSeverityMatch(matches);
-					recordMatch("PostToolUse", "Bash (skill install)", match, "aborted");
-					const reason = `[YARA CRITICAL] Poisoned skill detected in ${skillDir}: ${match.rule}. The downloaded skill contains potential prompt injection. Session terminated for safety.`;
-					onTerminate(reason);
-					return { stopReason: reason };
-				} catch (error) {
-					logToFile("[YARA] PostToolUse skill install hook error:", error);
-					const reason = "[YARA] Scanner error while scanning skill files — session terminated as a precaution.";
-					onTerminate(reason);
-					return { stopReason: reason };
-				}
-			}],
-			timeout: SKILL_SCAN_HOOK_TIMEOUT_MS
-		}
-	];
-}
-/**
-* Read and scan all text files in a skill directory for prompt injection.
-* Scans each file sequentially (single-threaded WASM — parallelism buys
-* nothing), unions the 'input'-context matches, then triages once across the
-* combined content. Returns the real (post-triage) matches.
-*/
-async function scanSkillFiles(cwd, skillDir, llmProvider) {
-	const absoluteDir = path.resolve(cwd, skillDir);
-	if (!fs.existsSync(absoluteDir)) {
-		logToFile(`[YARA] Skill directory does not exist: ${absoluteDir}`);
-		return [];
-	}
-	const files = await fg("**/*.{md,txt,yaml,yml,json,js,ts,py,rb,sh}", {
-		cwd: absoluteDir,
-		absolute: true
-	});
-	const fileContents = [];
-	for (const filePath of files) try {
-		fileContents.push(fs.readFileSync(filePath, "utf-8"));
-	} catch (err) {
-		logToFile(`[YARA] Could not read skill file ${filePath}:`, err);
-	}
-	if (fileContents.length === 0) {
-		logToFile(`[YARA] No text files found in skill directory: ${absoluteDir}`);
-		return [];
-	}
-	logToFile(`[YARA] Scanning ${fileContents.length} files in skill directory: ${skillDir}`);
-	const flagged = [];
-	for (const content of fileContents) flagged.push(...await scanForContext(content, "input"));
-	return triageFlagged(flagged, "input", llmProvider);
-}
-//#endregion
 //#region src/lib/agent/triage-provider.ts
 /**
 * LLM provider for warlock security-scan triage.
@@ -790,14 +191,20 @@ const TRIAGE_MODEL = "claude-haiku-4-5";
 const TRIAGE_MAX_TOKENS = 16384;
 const TRIAGE_TIMEOUT_MS = 2e4;
 /**
-* Build the triage LLM provider from the gateway auth on process.env (set by
-* initializeAgent before any agent run). Returns undefined if auth isn't
+* Build the triage LLM provider. Auth comes from the explicit `auth` param
+* when given (the pi harness — it auths the gateway programmatically and never
+* sets the env vars), otherwise from the gateway auth on process.env (set by
+* initializeAgent on the anthropic path). Returns undefined if neither is
 * configured — callers then skip triage and fail closed (act on every flagged
 * match), so a missing key never silently disables the scanner.
+*
+* The triage model is independent of the agent's model: it is a classifier
+* judging scan matches, and the gateway routes it by model id regardless of
+* which model runs the coding agent.
 */
-function createTriageLLMProvider() {
-	const baseURL = process.env.ANTHROPIC_BASE_URL;
-	const authToken = process.env.ANTHROPIC_AUTH_TOKEN;
+function createTriageLLMProvider(auth) {
+	const baseURL = auth?.baseURL ?? process.env.ANTHROPIC_BASE_URL;
+	const authToken = auth?.authToken ?? process.env.ANTHROPIC_AUTH_TOKEN;
 	if (!baseURL || !authToken) {
 		logToFile("[YARA] triage provider unavailable (no gateway auth) — flagged scans will fail closed");
 		return;
@@ -1509,15 +916,15 @@ function buildRunTags(args) {
 	};
 }
 /**
-* Whether the Warlock/YARA kill switch is engaged for this run. Off by default:
-* scanning is disabled only when the feature flag resolves to the explicit
-* string 'true', or the local POSTHOG_WIZARD_WARLOCK_DISABLED env override is
-* set. A missing flag, an empty flag map (the safe default returned when the
-* flag fetch fails), or any other value all leave scanning ON — a network blip
-* must never silently disable a security control.
+* Whether Warlock/YARA scanning is disabled for this run. Off by default:
+* scanning is disabled only by the local POSTHOG_WIZARD_WARLOCK_DISABLED env
+* override, set to the explicit string 'true'. This is a local/CI escape hatch
+* only — there is deliberately no remote flag to switch off a security control
+* (we rely on version-locking @posthog/warlock + the release-gate smoke test
+* instead). Any other value leaves scanning ON.
 */
-function isWarlockDisabled(flags = {}) {
-	return flags["wizard-warlock-disabled"] === "true" || runtimeEnv("POSTHOG_WIZARD_WARLOCK_DISABLED") === "true";
+function isWarlockDisabled() {
+	return runtimeEnv("POSTHOG_WIZARD_WARLOCK_DISABLED") === "true";
 }
 /**
 * Build env for the SDK subprocess: process.env plus ANTHROPIC_CUSTOM_HEADERS, which always
@@ -1880,10 +1287,10 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 			abortController.abort();
 			signalDone();
 		};
-		const warlockDisabled = isWarlockDisabled(agentConfig.wizardFlags);
+		const warlockDisabled = isWarlockDisabled();
 		if (warlockDisabled) {
-			logToFile("[warlock] kill switch active — YARA scanning disabled for run");
-			analytics.wizardCapture("warlock disabled", { reason: "kill-switch" });
+			logToFile("[warlock] scanning disabled for run (local env override)");
+			analytics.wizardCapture("warlock disabled", { reason: "env-override" });
 		}
 		const response = query({
 			prompt: createPromptStream(),
@@ -2383,6 +1790,6 @@ function handleSDKMessage(message, options, spinner, signals, receivedSuccessRes
 	}
 }
 //#endregion
-export { SETUP_REPORT_FILE as C, EVENT_PLAN_FILE as S, formatScanReport as _, wizardCanUseTool as a, recordExternalScan as b, classifySettingsConflicts as c, sanitizeAgentSubprocessEnv as d, AgentOutputSignals as f, flushScanReport as g, getWizardCommandments as h, runAgent as i, recoverOrphanedSettingsBackups as l, REMARK_INSTRUCTION as m, buildRunTags as n, backupAndFixClaudeSettings as o, AgentSignals as p, initializeAgent as r, checkAllSettingsConflicts as s, buildAgentEnv as t, restoreClaudeSettings as u, formatYaraAbortMessage as v, writeScanReport as x, isWizardDocumentationPath as y };
+export { wizardCanUseTool as a, classifySettingsConflicts as c, sanitizeAgentSubprocessEnv as d, AgentOutputSignals as f, createTriageLLMProvider as g, getWizardCommandments as h, runAgent as i, recoverOrphanedSettingsBackups as l, REMARK_INSTRUCTION as m, buildRunTags as n, backupAndFixClaudeSettings as o, AgentSignals as p, initializeAgent as r, checkAllSettingsConflicts as s, buildAgentEnv as t, restoreClaudeSettings as u };
 
-//# sourceMappingURL=agent-interface-DExARWay.js.map
+//# sourceMappingURL=agent-interface-BR3zAUpM.js.map