@posthog/wizard 2.45.0 → 2.46.0

package/dist/wizard-tools-Dg8o2lcH.js

@@ -1,783 +0,0 @@
-import { s as logToFile } from "./debug-DBmxx59Q.js";
-import { n as analytics } from "./analytics-DQEuL6qS.js";
-import { c as makeMutex, i as buildOrchestratorTools, l as writeJsonAtomic } from "./queue-tools-Bw-AANLM.js";
-import { a as coerceAuditChecks, t as AUDIT_CHECKS_FILE } from "./types-BRe_EzTW.js";
-import fs from "fs";
-import path from "path";
-import { z } from "zod";
-import { unzipSync } from "fflate";
-import { randomUUID } from "crypto";
-//#region src/lib/wizard-ask-bridge.ts
-/**
-* WizardAskBridge — host-side promise broker for the `wizard_ask` MCP tool.
-*
-* The `wizard_ask` tool needs to (a) read information from the wizard
-* session (the active skill id, used as the analytics `source`) and
-* (b) drive the TUI overlay. Wiring `wizard-tools.ts` directly to either
-* would couple our pure-data MCP server to the runtime UI layer.
-*
-* The bridge is the seam: `wizard-tools.ts` depends on this interface,
-* and `agent-runner.ts` constructs an implementation that knows about
-* both the session and `getUI()`.
-*/
-/** Sentinel returned for unanswered fields on cancellation or timeout. */
-const CANCELLED_SENTINEL = "__cancelled__";
-function buildCancelledAnswers(questions) {
-	const out = {};
-	for (const q of questions) out[q.id] = CANCELLED_SENTINEL;
-	return out;
-}
-function isFullyCancelled(answers) {
-	const values = Object.values(answers);
-	if (values.length === 0) return false;
-	return values.every((v) => v === CANCELLED_SENTINEL);
-}
-function createWizardAskBridge(opts) {
-	const timeoutMs = opts.timeoutMs ?? 3e5;
-	return { async request({ questions }) {
-		const pending = {
-			id: randomUUID(),
-			questions,
-			source: opts.getSource(),
-			richLinks: opts.richLinks ?? false
-		};
-		const startedAt = Date.now();
-		let timer;
-		const timeoutPromise = new Promise((resolve) => {
-			timer = setTimeout(() => {
-				opts.cancelQuestion?.();
-				resolve(buildCancelledAnswers(questions));
-			}, timeoutMs);
-		});
-		try {
-			const answers = await Promise.race([opts.showQuestion(pending), timeoutPromise]);
-			const durationMs = Date.now() - startedAt;
-			if (isFullyCancelled(answers)) analytics.wizardCapture("wizard_ask cancelled", {
-				source: pending.source,
-				question_count: questions.length,
-				duration_ms: durationMs,
-				timed_out: durationMs >= timeoutMs
-			});
-			else analytics.wizardCapture("wizard_ask answered", {
-				source: pending.source,
-				question_count: questions.length,
-				duration_ms: durationMs
-			});
-			return answers;
-		} finally {
-			if (timer) clearTimeout(timer);
-		}
-	} };
-}
-//#endregion
-//#region src/lib/secret-vault.ts
-/**
-* Session-scoped secret vault.
-*
-* Tools that handle sensitive values (personal API keys pasted by the user
-* or minted by the wizard, OAuth tokens, etc.) store them here and return
-* an opaque `secret:<uuid>` ref to the agent. The agent passes the ref
-* around to subsequent tools — `set_env_values` resolves it host-side
-* before writing — but the raw value never enters the LLM conversation.
-*
-* The vault is created once per `createWizardToolsServer` call and lives
-* for the duration of a single wizard run. There is no persistence and
-* no cross-session sharing; refs minted in one run cannot be resolved in
-* another.
-*/
-const REF_PREFIX = "secret:";
-function createSecretVault() {
-	const store = /* @__PURE__ */ new Map();
-	return {
-		put(value, meta) {
-			const ref = `${REF_PREFIX}${randomUUID()}`;
-			store.set(ref, {
-				value,
-				meta: {
-					ref,
-					label: meta.label,
-					source: meta.source,
-					createdAt: Date.now()
-				}
-			});
-			return ref;
-		},
-		get(ref) {
-			return store.get(ref)?.value;
-		},
-		has(ref) {
-			return store.has(ref);
-		},
-		list() {
-			return [...store.values()].map((s) => s.meta);
-		},
-		clear() {
-			store.clear();
-		}
-	};
-}
-//#endregion
-//#region src/lib/fetch-retry.ts
-/**
-* Retry wrapper for fetching from the skills/agents server (GitHub releases in
-* production). GitHub releases blips transiently, so every fetch on the run's
-* critical path — skill menu, skill zips, agent menu, agent prompt bodies —
-* goes through here rather than a bare `fetch`.
-*/
-const DEFAULT_TIMEOUT_MS = 6e4;
-const DEFAULT_MAX_ATTEMPTS = 3;
-const DEFAULT_BACKOFF_MS = 500;
-function sleep(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
-}
-/** Fetch a URL, retrying transient failures (network error or non-ok HTTP) with backoff. */
-async function fetchWithRetry(url, opts = {}) {
-	const { fetchImpl = fetch, sleepImpl = sleep, timeoutMs = DEFAULT_TIMEOUT_MS, maxAttempts = DEFAULT_MAX_ATTEMPTS, backoffMs = DEFAULT_BACKOFF_MS } = opts;
-	const failures = [];
-	for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
-		const resp = await fetchImpl(url, { signal: AbortSignal.timeout(timeoutMs) });
-		if (!resp.ok) throw new Error(`HTTP ${resp.status} ${resp.statusText}`);
-		return resp;
-	} catch (err) {
-		failures.push(`attempt ${attempt}: ${err.message}`);
-		if (attempt < maxAttempts) await sleepImpl(backoffMs * 2 ** (attempt - 1));
-	}
-	throw new Error(`fetch ${url} failed — ${failures.join("; ")}`);
-}
-//#endregion
-//#region src/lib/wizard-tools.ts
-/**
-* Unified in-process MCP server for the PostHog wizard.
-*
-* Provides tools that run locally (secret values never leave the machine):
-* - check_env_keys: Check which env var keys exist in a .env file
-* - set_env_values: Create/update env vars in a .env file
-* - detect_package_manager: Detect the project's package manager(s)
-* - load_skill_menu / install_skill: Skill installation
-* - audit_seed_checks / audit_add_checks / audit_resolve_checks: Audit ledger ownership
-*/
-let _sdkModule = null;
-async function getSDKModule() {
-	if (!_sdkModule) _sdkModule = await import("@anthropic-ai/claude-agent-sdk");
-	return _sdkModule;
-}
-/** Expand a bundle entry into one entry per variant, so the menu reads the same whether a group ships bundled or as zips. */
-function expandBundleEntry(entry) {
-	if (!entry.bundle || !entry.variants) return [entry];
-	return entry.variants.map((variant) => ({
-		...variant,
-		name: entry.name,
-		group: entry.group,
-		bundle: true,
-		downloadUrl: entry.downloadUrl
-	}));
-}
-/**
-* Fetch the skill menu from the skills server.
-* Returns parsed data on success, `null` on failure.
-*/
-async function fetchSkillMenu(skillsBaseUrl, opts = {}) {
-	const menuUrl = `${skillsBaseUrl}/skill-menu.json`;
-	try {
-		logToFile(`fetchSkillMenu: fetching from ${menuUrl}`);
-		const data = await (await fetchWithRetry(menuUrl, opts)).json();
-		for (const [category, entries] of Object.entries(data.categories)) data.categories[category] = entries.flatMap(expandBundleEntry);
-		logToFile(`fetchSkillMenu: loaded (${Object.keys(data.categories).length} categories)`);
-		return data;
-	} catch (err) {
-		logToFile(`fetchSkillMenu: error: ${err.message}`);
-		return null;
-	}
-}
-/** Extract a zip buffer, refusing entries that escape destDir (zip-slip). */
-function extractZipArchive(zip, destDir) {
-	const root = path.resolve(destDir);
-	let written = 0;
-	for (const [entryPath, data] of Object.entries(unzipSync(zip))) {
-		const target = path.resolve(root, entryPath);
-		if (target !== root && !target.startsWith(root + path.sep)) throw new Error(`zip entry escapes destination: ${entryPath}`);
-		if (entryPath.endsWith("/")) {
-			fs.mkdirSync(target, { recursive: true });
-			continue;
-		}
-		fs.mkdirSync(path.dirname(target), { recursive: true });
-		fs.writeFileSync(target, data);
-		written++;
-	}
-	return written;
-}
-/** Unpack the one variant this entry names out of a bundle; the rest is noise and never hits disk. */
-function extractBundle(bundle, destDir, entryId) {
-	if (typeof bundle?.id !== "string" || typeof bundle?.variants !== "object" || bundle.variants === null) throw new Error("malformed bundle: expected { id, variants }");
-	const files = bundle.variants[entryId.slice(bundle.id.length + 1)];
-	if (!files) throw new Error(`bundle ${bundle.id} has no variant "${entryId}"`);
-	const root = path.resolve(destDir);
-	let written = 0;
-	for (const [entryPath, contents] of Object.entries(files)) {
-		const target = path.resolve(root, entryPath);
-		if (target !== root && !target.startsWith(root + path.sep)) throw new Error(`bundle entry escapes destination: ${entryPath}`);
-		fs.mkdirSync(path.dirname(target), { recursive: true });
-		fs.writeFileSync(target, contents);
-		written++;
-	}
-	return written;
-}
-/** Download a URL to a buffer, retrying transient failures with backoff. */
-async function downloadWithRetry(url, opts = {}) {
-	const resp = await fetchWithRetry(url, opts);
-	return new Uint8Array(await resp.arrayBuffer());
-}
-/**
-* Download and extract a skill.
-* By default installs to `<installDir>/.claude/skills/<id>/`.
-* Pass `skillsRoot` to override the base directory (e.g. `.posthog/skills`).
-*/
-async function downloadSkill(skillEntry, installDir, skillsRoot) {
-	const skillDir = skillsRoot ? path.join(installDir, skillsRoot, skillEntry.id) : path.join(installDir, ".claude", "skills", skillEntry.id);
-	let step = "download";
-	try {
-		fs.mkdirSync(skillDir, { recursive: true });
-		const data = await downloadWithRetry(skillEntry.downloadUrl);
-		step = "extract";
-		const fileCount = skillEntry.bundle ? extractBundle(JSON.parse(Buffer.from(data).toString("utf8")), skillDir, skillEntry.id) : extractZipArchive(data, skillDir);
-		fs.writeFileSync(path.join(skillDir, ".posthog-wizard"), "");
-		logToFile(`downloadSkill: installed ${skillEntry.id} from ${skillEntry.downloadUrl} (${fileCount} files)`);
-		return { success: true };
-	} catch (err) {
-		logToFile(`downloadSkill: error: ${err.message}`);
-		analytics.wizardCapture("skill install failed", {
-			skill_id: skillEntry.id,
-			step,
-			platform: process.platform,
-			error: String(err.message).slice(0, 500)
-		});
-		return {
-			success: false,
-			error: err.message
-		};
-	}
-}
-/**
-* High-level "install a skill by ID" helper. Fetches the skill menu,
-* finds the skill, downloads and extracts it. Programs should use this
-* instead of composing fetchSkillMenu + downloadSkill themselves.
-*/
-async function installSkillById(skillId, installDir, skillsBaseUrl, skillsRoot) {
-	const menu = await fetchSkillMenu(skillsBaseUrl);
-	if (!menu) return { kind: "menu-fetch-failed" };
-	const skill = Object.values(menu.categories).flat().find((s) => s.id === skillId);
-	if (!skill) return {
-		kind: "skill-not-found",
-		skillId
-	};
-	const result = await downloadSkill(skill, installDir, skillsRoot);
-	if (!result.success) return {
-		kind: "download-failed",
-		message: result.error ?? "unknown"
-	};
-	return {
-		kind: "ok",
-		path: skillsRoot ? `${skillsRoot}/${skillId}` : `.claude/skills/${skillId}`
-	};
-}
-/**
-* Pure decision function for the wizard_ask caps. Returns whether the
-* upcoming call should proceed and, if not, the error message to surface
-* to the agent. Extracted so the policy can be unit-tested without
-* spinning up an MCP server.
-*
-* The adjacency nudge fires exactly once per run (the caller records it
-* via `adjacencyNudged`) — flows that legitimately need several
-* sequential, answer-dependent asks then proceed up to `maxQuestions`.
-* Without the flag the rejected call would never advance the counter and
-* every later call would be rejected, making caps above the threshold
-* unreachable.
-*/
-function evaluateAskCap(callCount, maxQuestions, adjacencyNudged = false) {
-	if (callCount >= maxQuestions) return {
-		kind: "capped",
-		reason: "max_questions",
-		message: `Error: wizard_ask cap reached (${maxQuestions} calls in this run). Proceed with sensible defaults using the answers you already have, or emit [ABORT] requirements-incomplete.`
-	};
-	if (!adjacencyNudged && callCount >= 3) return {
-		kind: "capped",
-		reason: "adjacency",
-		message: `Error: too many wizard_ask calls in a row (${callCount} so far). Batch the remaining questions into a single call — the schema accepts up to 8 questions per invocation. If the remaining questions truly depend on earlier answers, ask again and they will go through.`
-	};
-	return { kind: "ok" };
-}
-/**
-* Resolve filePath relative to workingDirectory, rejecting path traversal.
-*/
-function resolveEnvPath(workingDirectory, filePath) {
-	const resolved = path.resolve(workingDirectory, filePath);
-	if (!resolved.startsWith(workingDirectory + path.sep) && resolved !== workingDirectory) throw new Error(`Path traversal rejected: "${filePath}" resolves outside working directory`);
-	return resolved;
-}
-/**
-* Ensure the given env file basename is covered by .gitignore in the working directory.
-* Creates .gitignore if it doesn't exist; appends the entry if missing.
-*/
-function ensureGitignoreCoverage(workingDirectory, envFileName) {
-	const gitignorePath = path.join(workingDirectory, ".gitignore");
-	if (fs.existsSync(gitignorePath)) {
-		const content = fs.readFileSync(gitignorePath, "utf8");
-		if (content.split("\n").some((line) => line.trim() === envFileName)) return;
-		const newContent = content.endsWith("\n") ? `${content}${envFileName}\n` : `${content}\n${envFileName}\n`;
-		fs.writeFileSync(gitignorePath, newContent, "utf8");
-	} else fs.writeFileSync(gitignorePath, `${envFileName}\n`, "utf8");
-}
-/**
-* Parse a .env file's content and return the set of defined key names.
-*/
-function parseEnvKeys(content) {
-	const keys = /* @__PURE__ */ new Set();
-	for (const line of content.split("\n")) {
-		const match = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=/);
-		if (match) keys.add(match[1]);
-	}
-	return keys;
-}
-/**
-* Merge key-value pairs into existing .env content.
-* Updates existing keys in-place, appends new keys at the end.
-*/
-function mergeEnvValues(content, values) {
-	let result = content;
-	const updatedKeys = /* @__PURE__ */ new Set();
-	for (const [key, value] of Object.entries(values)) {
-		const regex = new RegExp(`^(\\s*${key}\\s*=).*$`, "m");
-		if (regex.test(result)) {
-			result = result.replace(regex, `$1${value}`);
-			updatedKeys.add(key);
-		}
-	}
-	const newKeys = Object.entries(values).filter(([key]) => !updatedKeys.has(key));
-	if (newKeys.length > 0) {
-		if (result.length > 0 && !result.endsWith("\n")) result += "\n";
-		for (const [key, value] of newKeys) result += `${key}=${value}\n`;
-	}
-	return result;
-}
-const AUDIT_STATUSES = [
-	"pending",
-	"pass",
-	"error",
-	"warning",
-	"suggestion"
-];
-const auditCheckSchema = z.object({
-	id: z.string().min(1),
-	area: z.string().min(1),
-	label: z.string().min(1),
-	status: z.enum(AUDIT_STATUSES),
-	file: z.string().optional(),
-	details: z.string().optional()
-});
-const auditUpdateSchema = z.object({
-	id: z.string().min(1),
-	status: z.enum(AUDIT_STATUSES),
-	file: z.string().optional(),
-	details: z.string().optional()
-});
-/** Atomically write the audit ledger. Thin typed wrapper over writeJsonAtomic. */
-function writeLedgerAtomic(targetPath, checks) {
-	writeJsonAtomic(targetPath, checks);
-}
-/**
-* Apply a batch of patches to the ledger by id. Returns the new array and the
-* list of update ids that didn't match any existing check.
-*/
-function applyAuditUpdates(current, updates) {
-	const byId = new Map(current.map((c) => [c.id, c]));
-	const unknown = [];
-	for (const u of updates) {
-		const existing = byId.get(u.id);
-		if (!existing) {
-			unknown.push(u.id);
-			continue;
-		}
-		byId.set(u.id, {
-			...existing,
-			status: u.status,
-			...u.file !== void 0 ? { file: u.file } : {},
-			...u.details !== void 0 ? { details: u.details } : {}
-		});
-	}
-	return {
-		next: current.map((c) => byId.get(c.id) ?? c),
-		unknown
-	};
-}
-/**
-* Append new checks to a seeded ledger. Duplicate ids are reported without
-* mutating the current ledger, including duplicates inside the additions.
-*/
-function applyAuditAdditions(current, additions) {
-	const existingIds = new Set(current.map((c) => c.id));
-	const additionIds = /* @__PURE__ */ new Set();
-	const duplicates = [];
-	for (const check of additions) {
-		if (existingIds.has(check.id) || additionIds.has(check.id)) {
-			duplicates.push(check.id);
-			continue;
-		}
-		additionIds.add(check.id);
-	}
-	if (duplicates.length > 0) return {
-		next: current,
-		duplicates
-	};
-	return {
-		next: [...current, ...additions],
-		duplicates: []
-	};
-}
-function readLedger(targetPath) {
-	if (!fs.existsSync(targetPath)) return [];
-	try {
-		return coerceAuditChecks(JSON.parse(fs.readFileSync(targetPath, "utf8")));
-	} catch {
-		return [];
-	}
-}
-function appendAuditChecksToLedger(targetPath, additions) {
-	if (!fs.existsSync(targetPath)) return {
-		ok: false,
-		reason: "missing-ledger"
-	};
-	const { next, duplicates } = applyAuditAdditions(readLedger(targetPath), additions);
-	if (duplicates.length > 0) return {
-		ok: false,
-		reason: "duplicate-ids",
-		ids: duplicates
-	};
-	writeLedgerAtomic(targetPath, next);
-	return {
-		ok: true,
-		added: additions.length
-	};
-}
-const SERVER_NAME = "wizard-tools";
-/**
-* Create the unified in-process MCP server with all wizard tools.
-* Must be called asynchronously because the SDK is an ESM module loaded via dynamic import.
-*/
-async function createWizardToolsServer(options) {
-	const { workingDirectory, detectPackageManager, skillsBaseUrl, askBridge, askMaxQuestions = 10, secretVault = createSecretVault(), orchestrator } = options;
-	const { tool, createSdkMcpServer } = await getSDKModule();
-	let askCallCount = 0;
-	let askAdjacencyNudged = false;
-	let cachedSkillMenu = {};
-	let categoryNames = ["integration"];
-	const menu = await fetchSkillMenu(skillsBaseUrl);
-	if (menu) cachedSkillMenu = menu.categories;
-	const keys = Object.keys(cachedSkillMenu);
-	if (keys.length > 0) categoryNames = keys;
-	const checkEnvKeys = tool("check_env_keys", "Check which environment variable keys are present or missing in a .env file. Never reveals values.", {
-		filePath: z.string().describe("Path to the .env file, relative to the project root"),
-		keys: z.array(z.string()).describe("Environment variable key names to check")
-	}, (args) => {
-		const resolved = resolveEnvPath(workingDirectory, args.filePath);
-		logToFile(`check_env_keys: ${resolved}, keys: ${args.keys.join(", ")}`);
-		const existingKeys = fs.existsSync(resolved) ? parseEnvKeys(fs.readFileSync(resolved, "utf8")) : /* @__PURE__ */ new Set();
-		const results = {};
-		for (const key of args.keys) results[key] = existingKeys.has(key) ? "present" : "missing";
-		return { content: [{
-			type: "text",
-			text: JSON.stringify(results, null, 2)
-		}] };
-	});
-	const setEnvValues = tool("set_env_values", "Create or update environment variable keys in a .env file. Creates the file if it does not exist. Ensures .gitignore coverage. Each value can be either a literal string or a secret reference of the form `{ \"secretRef\": \"secret:...\" }` returned by another tool (e.g. wizard_ask). Secret references are resolved locally — the actual value is written to the file but never returned to the agent.", {
-		filePath: z.string().describe("Path to the .env file, relative to the project root"),
-		values: z.record(z.string(), z.union([z.string(), z.object({ secretRef: z.string() })])).describe("Key → (literal string OR { secretRef } pointing to a vaulted secret)")
-	}, (args) => {
-		const forbidden = Object.keys(args.values).find((k) => k.toUpperCase() === "POSTHOG_KEY");
-		if (forbidden) return {
-			content: [{
-				type: "text",
-				text: `Error: "${forbidden}" is not a valid PostHog env var name. Use the project-specific key name from your framework's integration guide (e.g. NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN).`
-			}],
-			isError: true
-		};
-		const resolvedValues = {};
-		const resolvedRefKeys = [];
-		for (const [key, val] of Object.entries(args.values)) if (typeof val === "string") resolvedValues[key] = val;
-		else {
-			const secret = secretVault.get(val.secretRef);
-			if (secret === void 0) return {
-				content: [{
-					type: "text",
-					text: `Error: secret reference "${val.secretRef}" for key "${key}" is not known to the vault. The ref may have expired, been minted in a different run, or been mistyped.`
-				}],
-				isError: true
-			};
-			resolvedValues[key] = secret;
-			resolvedRefKeys.push(key);
-		}
-		const resolved = resolveEnvPath(workingDirectory, args.filePath);
-		logToFile(`set_env_values: ${resolved}, keys: ${Object.keys(resolvedValues).join(", ")}${resolvedRefKeys.length > 0 ? ` (secret refs: ${resolvedRefKeys.join(", ")})` : ""}`);
-		const content = mergeEnvValues(fs.existsSync(resolved) ? fs.readFileSync(resolved, "utf8") : "", resolvedValues);
-		const dir = path.dirname(resolved);
-		if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-		fs.writeFileSync(resolved, content, "utf8");
-		ensureGitignoreCoverage(workingDirectory, path.basename(resolved));
-		return { content: [{
-			type: "text",
-			text: `Updated ${Object.keys(args.values).length} key(s) in ${args.filePath}`
-		}] };
-	});
-	const detectPM = tool("detect_package_manager", "Detect which package manager(s) the project uses. Returns the name, install command, and run command for each detected package manager. Call this before running any install commands.", {}, async () => {
-		logToFile(`detect_package_manager: scanning ${workingDirectory}`);
-		const result = await detectPackageManager(workingDirectory);
-		logToFile(`detect_package_manager: detected ${result.detected.length} package manager(s)`);
-		return { content: [{
-			type: "text",
-			text: JSON.stringify(result, null, 2)
-		}] };
-	});
-	const loadSkillMenu = tool("load_skill_menu", "Load available PostHog skills for a category. Returns skill IDs and names. Call this first, then use install_skill with the chosen ID.", { category: z.enum(categoryNames).describe("Skill category") }, (args) => {
-		const skills = cachedSkillMenu[args.category];
-		if (!skills || skills.length === 0) return {
-			content: [{
-				type: "text",
-				text: `No skills found for category "${args.category}".`
-			}],
-			isError: true
-		};
-		const menuText = skills.map((s) => `- ${s.id}: ${s.name}`).join("\n");
-		logToFile(`load_skill_menu: returning ${skills.length} skills for "${args.category}"`);
-		return { content: [{
-			type: "text",
-			text: menuText
-		}] };
-	});
-	const installSkill = tool("install_skill", "Download and install a PostHog skill by ID. Call load_skill_menu first to see available skills. Extracts the skill to .claude/skills/<skillId>/.", { skillId: z.string().describe("Skill ID from the skill menu (e.g., \"integration-nextjs-app-router\")") }, async (args) => {
-		if (!/^[a-z0-9][a-z0-9_-]*$/.test(args.skillId)) return {
-			content: [{
-				type: "text",
-				text: "Error: skillId must be lowercase alphanumeric with hyphens."
-			}],
-			isError: true
-		};
-		const skill = Object.values(cachedSkillMenu).flat().find((s) => s.id === args.skillId);
-		if (!skill) return {
-			content: [{
-				type: "text",
-				text: `Error: skill "${args.skillId}" not found. Use load_skill_menu to see available skills.`
-			}],
-			isError: true
-		};
-		const result = await downloadSkill(skill, workingDirectory);
-		if (result.success) return { content: [{
-			type: "text",
-			text: `Skill installed to .claude/skills/${args.skillId}/`
-		}] };
-		else {
-			analytics.captureException(/* @__PURE__ */ new Error("Skill install failed: download-failed"), {
-				source: "install_skill_tool",
-				skill_id: args.skillId,
-				error_detail: String(result.error).slice(0, 500),
-				platform: process.platform
-			});
-			return {
-				content: [{
-					type: "text",
-					text: `Error installing skill: ${result.error}`
-				}],
-				isError: true
-			};
-		}
-	});
-	const auditLedgerPath = path.join(workingDirectory, AUDIT_CHECKS_FILE);
-	const auditMutex = makeMutex();
-	const auditSeedChecks = tool("audit_seed_checks", "Seed the audit ledger at .posthog-audit-checks.json with the full set of pending checks. Call this once at the start of the audit. Atomically replaces any existing ledger.", { checks: z.array(auditCheckSchema).describe("Full pending checklist to write to the ledger") }, async (args) => {
-		return auditMutex(() => {
-			writeLedgerAtomic(auditLedgerPath, args.checks);
-			logToFile(`audit_seed_checks: wrote ${args.checks.length} entries`);
-			return { content: [{
-				type: "text",
-				text: `Seeded ${args.checks.length} audit checks.`
-			}] };
-		});
-	});
-	const auditAddChecks = tool("audit_add_checks", "Append one or more pending checks to the existing audit ledger at .posthog-audit-checks.json. Call audit_seed_checks first. Atomically rejects duplicate ids without changing the ledger.", { checks: z.array(auditCheckSchema).min(1).describe("Additional checks to append to the existing ledger") }, async (args) => {
-		return auditMutex(() => {
-			const result = appendAuditChecksToLedger(auditLedgerPath, args.checks);
-			if (!result.ok) {
-				if (result.reason === "missing-ledger") return {
-					content: [{
-						type: "text",
-						text: "Error: audit ledger does not exist. Run audit_seed_checks first."
-					}],
-					isError: true
-				};
-				return {
-					content: [{
-						type: "text",
-						text: `Error: duplicate check id(s): ${result.ids.join(", ")}. Check ids must be unique.`
-					}],
-					isError: true
-				};
-			}
-			logToFile(`audit_add_checks: added ${result.added} entries`);
-			return { content: [{
-				type: "text",
-				text: `Added ${result.added} audit check(s).`
-			}] };
-		});
-	});
-	const auditResolveChecks = tool("audit_resolve_checks", "Resolve one or more audit checks by id. Patches each entry's status (and optional file/details) and writes the ledger back atomically. Concurrent calls serialize.", { updates: z.array(auditUpdateSchema).min(1).describe("Patches to apply, keyed by check id") }, async (args) => {
-		return auditMutex(() => {
-			const { next, unknown } = applyAuditUpdates(readLedger(auditLedgerPath), args.updates);
-			if (unknown.length > 0) return {
-				content: [{
-					type: "text",
-					text: `Error: unknown check id(s): ${unknown.join(", ")}. Run audit_seed_checks first or check the id.`
-				}],
-				isError: true
-			};
-			writeLedgerAtomic(auditLedgerPath, next);
-			logToFile(`audit_resolve_checks: applied ${args.updates.length} update(s)`);
-			return { content: [{
-				type: "text",
-				text: `Resolved ${args.updates.length} check(s).`
-			}] };
-		});
-	});
-	const askQuestionSchema = z.object({
-		id: z.string().min(1).describe("Stable key for the answer in the response map"),
-		prompt: z.string().min(1).describe("Question text shown to the user"),
-		kind: z.enum([
-			"single",
-			"multi",
-			"text"
-		]).describe("'single' = pick one option, 'multi' = pick any, 'text' = free-form single-line answer"),
-		options: z.array(z.object({
-			label: z.string(),
-			value: z.string(),
-			description: z.string().optional().describe("Optional secondary line shown dimmed and wrapped beneath the label (multi-select only). Use when a choice needs more than a title — e.g. what a custom scout watches and what makes it speak up.")
-		})).optional().describe("Required for kind=single|multi; ignored for kind=text"),
-		required: z.boolean().optional().describe("Defaults to true"),
-		sensitive: z.boolean().optional().describe("Only valid for kind='text'. When true, the user's answer is stored in the wizard's secret vault and returned to you as { secretRef: 'secret:...' } instead of the raw string. Use for API keys, tokens, and any other secret the user types in. The secretRef is only resolved by wizard-tools that accept it (e.g. set_env_values) — it is NOT resolved when passed to other MCP tools (e.g. PostHog data-warehouse tools), which will reject it. For a secret that must reach another tool, write it to the env with set_env_values first, or use that tool's own credential-reference flow.")
-	});
-	return createSdkMcpServer({
-		name: SERVER_NAME,
-		version: "1.0.0",
-		tools: [
-			checkEnvKeys,
-			setEnvValues,
-			detectPM,
-			loadSkillMenu,
-			installSkill,
-			auditSeedChecks,
-			auditAddChecks,
-			auditResolveChecks,
-			tool("wizard_ask", "Ask the user one or more structured questions and wait for their answers. Use this whenever you would otherwise inline a question in your text output. Batch related questions into a single call (up to 8) rather than asking one at a time; sequential calls are fine when later questions genuinely depend on earlier answers. A fully cancelled or timed-out response does NOT count against the per-run cap — treat it as \"the user declined\" and fall back gracefully (e.g. hand over a deep link) without worrying about a wasted call.", { questions: z.array(askQuestionSchema).min(1).max(8) }, async (args) => {
-				if (!askBridge) return {
-					content: [{
-						type: "text",
-						text: "Error: wizard_ask is not available in this environment (CI / non-interactive). Proceed with sensible defaults or emit [ABORT] requirements-incomplete."
-					}],
-					isError: true
-				};
-				const capDecision = evaluateAskCap(askCallCount, askMaxQuestions, askAdjacencyNudged);
-				if (capDecision.kind === "capped") {
-					if (capDecision.reason === "adjacency") askAdjacencyNudged = true;
-					analytics.wizardCapture("wizard_ask capped", {
-						reason: capDecision.reason,
-						call_count: askCallCount,
-						max_questions: askMaxQuestions
-					});
-					return {
-						content: [{
-							type: "text",
-							text: capDecision.message
-						}],
-						isError: true
-					};
-				}
-				for (const q of args.questions) {
-					if ((q.kind === "single" || q.kind === "multi") && (!q.options || q.options.length === 0)) return {
-						content: [{
-							type: "text",
-							text: `Error: question "${q.id}" has kind="${q.kind}" but no options. Provide at least one { label, value } option, or change kind to "text".`
-						}],
-						isError: true
-					};
-					if (q.sensitive && q.kind !== "text") return {
-						content: [{
-							type: "text",
-							text: `Error: question "${q.id}" sets sensitive=true but kind="${q.kind}". Only kind="text" answers can be vaulted as secrets.`
-						}],
-						isError: true
-					};
-				}
-				const ids = /* @__PURE__ */ new Set();
-				for (const q of args.questions) {
-					if (ids.has(q.id)) return {
-						content: [{
-							type: "text",
-							text: `Error: duplicate question id "${q.id}". Each question must have a unique id.`
-						}],
-						isError: true
-					};
-					ids.add(q.id);
-				}
-				askCallCount += 1;
-				try {
-					const answers = await askBridge.request({ questions: args.questions });
-					if (isFullyCancelled(answers)) askCallCount -= 1;
-					const sensitiveById = new Map(args.questions.filter((q) => q.sensitive).map((q) => [q.id, q.prompt]));
-					const sanitised = {};
-					for (const [id, answer] of Object.entries(answers)) {
-						const label = sensitiveById.get(id);
-						if (label !== void 0 && typeof answer === "string" && answer !== "__cancelled__") {
-							const ref = secretVault.put(answer, {
-								label,
-								source: "wizard_ask"
-							});
-							sanitised[id] = { secretRef: ref };
-							logToFile(`wizard_ask: vaulted answer for "${id}" as ${ref}`);
-						} else sanitised[id] = answer;
-					}
-					logToFile(`wizard_ask: resolved ${Object.keys(answers).length} answer(s) for ${args.questions.length} question(s)`);
-					return { content: [{
-						type: "text",
-						text: JSON.stringify({ answers: sanitised }, null, 2)
-					}] };
-				} catch (err) {
-					askCallCount -= 1;
-					logToFile(`wizard_ask: error: ${err?.message ?? err}`);
-					return {
-						content: [{
-							type: "text",
-							text: `Error: wizard_ask failed: ${err?.message ?? String(err)}`
-						}],
-						isError: true
-					};
-				}
-			}),
-			...orchestrator ? buildOrchestratorTools(tool, orchestrator) : []
-		]
-	});
-}
-/** Tool names exposed by the wizard-tools server, keyed for selective use. */
-const WIZARD_TOOL_NAMES = {
-	checkEnvKeys: `mcp__${SERVER_NAME}__check_env_keys`,
-	setEnvValues: `mcp__${SERVER_NAME}__set_env_values`,
-	detectPackageManager: `mcp__${SERVER_NAME}__detect_package_manager`,
-	loadSkillMenu: `mcp__${SERVER_NAME}__load_skill_menu`,
-	installSkill: `mcp__${SERVER_NAME}__install_skill`,
-	auditSeedChecks: `mcp__${SERVER_NAME}__audit_seed_checks`,
-	auditAddChecks: `mcp__${SERVER_NAME}__audit_add_checks`,
-	auditResolveChecks: `mcp__${SERVER_NAME}__audit_resolve_checks`,
-	wizardAsk: `mcp__${SERVER_NAME}__wizard_ask`,
-	enqueueTask: `mcp__${SERVER_NAME}__enqueue_task`,
-	completeTask: `mcp__${SERVER_NAME}__complete_task`,
-	readHandoffs: `mcp__${SERVER_NAME}__read_handoffs`
-};
-//#endregion
-export { installSkillById as a, resolveEnvPath as c, fetchSkillMenu as i, fetchWithRetry as l, createWizardToolsServer as n, mergeEnvValues as o, downloadSkill as r, parseEnvKeys as s, WIZARD_TOOL_NAMES as t, createWizardAskBridge as u };
-
-//# sourceMappingURL=wizard-tools-Dg8o2lcH.js.map