@posthog/wizard 2.63.0 → 2.64.1

package/dist/{tools-BcXOgEvh.js → tools-DQO5tKJg.js}

@@ -1,8 +1,8 @@
-import { s as logToFile } from "./debug-BYIoy1Oz.js";
-import { n as analytics } from "./analytics-YLZKudpE.js";
-import { A as resolveEnvSecretRefs, D as mergeEnvValues, E as installSkillById, O as parseEnvKeys, P as isFullyCancelled, S as WIZARD_TOOL_NAMES, T as fetchSkillMenu, _ as PUBLISH_HANDOFF_CONTENT_DESCRIPTION, b as publishHandoff, g as createSecretVault, j as vaultSensitiveAnswers, k as resolveEnvPath, v as PUBLISH_HANDOFF_DESCRIPTION, w as evaluateAskCap, x as ENV_FILE_PATH_DESCRIPTION, y as PUBLISH_HANDOFF_TOOL_NAME } from "./agent-interface-C4CV7p0L.js";
-import { o as withMode } from "./pi-DeF8mWlb.js";
-import { r as detectNodePackageManagers } from "./package-manager-FyJmIsqr.js";
+import { s as logToFile } from "./debug-hy6aWAyk.js";
+import { n as analytics } from "./analytics-D3vKvr3l.js";
+import { A as resolveEnvSecretRefs, D as mergeEnvValues, E as installSkillById, O as parseEnvKeys, P as isFullyCancelled, S as WIZARD_TOOL_NAMES, T as fetchSkillMenu, _ as PUBLISH_HANDOFF_CONTENT_DESCRIPTION, b as publishHandoff, g as createSecretVault, j as vaultSensitiveAnswers, k as resolveEnvPath, v as PUBLISH_HANDOFF_DESCRIPTION, w as evaluateAskCap, x as ENV_FILE_PATH_DESCRIPTION, y as PUBLISH_HANDOFF_TOOL_NAME } from "./agent-interface-NurnwA01.js";
+import { o as withMode } from "./pi-B4p4gpr0.js";
+import { r as detectNodePackageManagers } from "./package-manager-KweKX3u_.js";
 import fs from "fs";
 import path from "path";
 import { Type } from "typebox";
@@ -208,4 +208,4 @@ function createWizardPiTools(ctx) {
 //#endregion
 export { createWizardPiTools };
 
-//# sourceMappingURL=tools-BcXOgEvh.js.map
+//# sourceMappingURL=tools-DQO5tKJg.js.map

package/dist/{tools-BcXOgEvh.js.map → tools-DQO5tKJg.js.map}

@@ -1 +1 @@
-{"version":3,"file":"tools-BcXOgEvh.js","names":[],"sources":["../src/lib/agent/runner/harness/pi/tools.ts"],"sourcesContent":["/**\n * Wizard capabilities as pi custom tools (#5). pi does not mount MCP servers,\n * so the tools the wizard prompt depends on — skill discovery/install and\n * fenced `.env` edits — are exposed to pi as native `defineTool` tools backed\n * by the same helpers the claude-agent-sdk path uses (`fetchSkillMenu`,\n * `installSkillById`, `parseEnvKeys`, `mergeEnvValues`). Same tool names as the\n * MCP server so the shared prompt is unchanged. `wizard_ask` is wired here too\n * (same schema, caps, and askBridge as the MCP tool) so interactive programs\n * can interview the user on pi; without a bridge (CI) it errors on call.\n * Sensitive answers are vaulted to `{secretRef}` and resolved host-side by\n * set_env_values — the raw value never enters the model conversation.\n */\n\nimport fs from 'fs';\nimport path from 'path';\nimport { Type } from 'typebox';\nimport { defineTool } from '@earendil-works/pi-coding-agent';\nimport type { ToolDefinition } from '@earendil-works/pi-coding-agent';\nimport { analytics } from '@utils/analytics';\nimport { logToFile } from '@utils/debug';\nimport {\n  DEFAULT_ASK_MAX_QUESTIONS,\n  ENV_FILE_PATH_DESCRIPTION,\n  WIZARD_TOOL_NAMES,\n  evaluateAskCap,\n  fetchSkillMenu,\n  installSkillById,\n  mergeEnvValues,\n  parseEnvKeys,\n  resolveEnvPath,\n  resolveEnvSecretRefs,\n  vaultSensitiveAnswers,\n} from '@lib/wizard-tools/tools';\nimport type { LLMProvider } from '@posthog/warlock';\nimport { isFullyCancelled, type WizardAskBridge } from '@lib/wizard-ask-bridge';\nimport {\n  PUBLISH_HANDOFF_CONTENT_DESCRIPTION,\n  PUBLISH_HANDOFF_DESCRIPTION,\n  PUBLISH_HANDOFF_TOOL_NAME,\n  publishHandoff,\n} from '@lib/wizard-tools/handoff';\nimport { createSecretVault } from '@lib/secret-vault';\nimport { withMode } from './index';\nimport {\n  detectNodePackageManagers,\n  type PackageManagerDetector,\n} from '@lib/detection/package-manager';\n\nfunction text(s: string): {\n  content: [{ type: 'text'; text: string }];\n  details: unknown;\n} {\n  return { content: [{ type: 'text', text: s }], details: {} };\n}\n\nexport interface PiToolsContext {\n  workingDirectory: string;\n  skillsBaseUrl: string;\n  /** Framework's package-manager detector. Defaults to Node detection. */\n  detectPackageManager?: PackageManagerDetector;\n  /** Drives the `wizard_ask` overlay. Omitted in CI → the tool errors on call. */\n  askBridge?: WizardAskBridge;\n  /** Per-run cap on wizard_ask calls. Defaults to {@link DEFAULT_ASK_MAX_QUESTIONS}. */\n  maxQuestions?: number;\n  /** Overlay open/closed signal — the security gate blocks Write/Edit while open. */\n  onAskPendingChange?: (pending: boolean) => void;\n  /** Program disallow list; gates wizard_ask here since pi tools carry bare names the MCP-prefixed security gate misses. */\n  disallowedTools?: readonly string[];\n  /** Scan-triage classifier, resolved once in bootstrap. Absent → scans fail closed. */\n  triageProvider?: LLMProvider;\n}\n\nexport function createWizardPiTools(ctx: PiToolsContext): ToolDefinition[] {\n  const {\n    workingDirectory,\n    skillsBaseUrl,\n    askBridge,\n    onAskPendingChange,\n    triageProvider,\n  } = ctx;\n  const detectPackageManager =\n    ctx.detectPackageManager ?? detectNodePackageManagers;\n  const askMaxQuestions = ctx.maxQuestions ?? DEFAULT_ASK_MAX_QUESTIONS;\n  // Per-run wizard_ask accounting (total cap + one-time adjacency nudge),\n  // mirroring the MCP server's counters.\n  let askCallCount = 0;\n  let askAdjacencyNudged = false;\n  // Session-scoped secret vault, same contract as the MCP server: wizard_ask\n  // mints `{secretRef}` for sensitive answers, set_env_values resolves them.\n  const secretVault = createSecretVault();\n\n  // Fetch the skill menu at most once per run — the agent calls load_skill_menu\n  // 2-3× otherwise, each a fresh HTTP round-trip (profiled slowness).\n  let menuPromise: ReturnType<typeof fetchSkillMenu> | undefined;\n  const getSkillMenu = () => (menuPromise ??= fetchSkillMenu(skillsBaseUrl));\n\n  const loadSkillMenu = defineTool({\n    name: 'load_skill_menu',\n    label: 'Load skill menu',\n    description:\n      'Load available PostHog skills for a category. Returns skill IDs and names. Call this first, then install_skill with the chosen ID.',\n    promptSnippet:\n      'load_skill_menu(category) — list installable PostHog skills',\n    parameters: Type.Object({\n      category: Type.String({\n        description: 'Skill category, e.g. \"integration\"',\n      }),\n    }),\n    async execute(_id, args) {\n      const menu = await getSkillMenu();\n      if (!menu) return text('Error: could not load the skill menu.');\n      const skills = menu.categories[args.category] ?? [];\n      if (skills.length === 0) {\n        return text(`No skills found for category \"${args.category}\".`);\n      }\n      logToFile(`[pi] load_skill_menu: ${skills.length} skills`);\n      return text(skills.map((s) => `- ${s.id}: ${s.name}`).join('\\n'));\n    },\n  });\n\n  const installSkill = defineTool({\n    name: 'install_skill',\n    label: 'Install skill',\n    description:\n      'Download and install a PostHog skill by ID into .claude/skills/<skillId>/. Call load_skill_menu first. Then read the installed SKILL.md and follow it.',\n    promptSnippet:\n      'install_skill(skillId) — install a skill, then read its SKILL.md',\n    parameters: Type.Object({\n      skillId: Type.String({ description: 'Skill ID from load_skill_menu' }),\n    }),\n    async execute(_id, args) {\n      const result = await installSkillById(\n        args.skillId,\n        workingDirectory,\n        skillsBaseUrl,\n        { triage: triageProvider },\n      );\n      if (result.kind !== 'ok') {\n        logToFile(`[pi] install_skill ${args.skillId}: ${result.kind}`);\n        return text(\n          `Error installing skill \"${args.skillId}\": ${result.kind}. Use load_skill_menu to see valid IDs.`,\n        );\n      }\n      logToFile(`[pi] install_skill ${args.skillId} -> ${result.path}`);\n      return text(\n        `Installed \"${args.skillId}\" at ${result.path}. Read ${result.path}/SKILL.md and follow it.`,\n      );\n    },\n  });\n\n  const checkEnvKeys = defineTool({\n    name: 'check_env_keys',\n    label: 'Check env keys',\n    description:\n      'Check which environment variable keys are present or missing in a .env file. Never reveals values.',\n    promptSnippet: 'check_env_keys(filePath, keys) — see which .env keys exist',\n    parameters: Type.Object({\n      filePath: Type.String({\n        description: ENV_FILE_PATH_DESCRIPTION,\n      }),\n      keys: Type.Array(Type.String(), {\n        description: 'Environment variable key names to check',\n      }),\n    }),\n    async execute(_id, args) {\n      const resolved = resolveEnvPath(workingDirectory, args.filePath);\n      const existing = fs.existsSync(resolved)\n        ? parseEnvKeys(await fs.promises.readFile(resolved, 'utf8'))\n        : new Set<string>();\n      const results: Record<string, 'present' | 'missing'> = {};\n      for (const key of args.keys) {\n        results[key] = existing.has(key) ? 'present' : 'missing';\n      }\n      return text(JSON.stringify(results, null, 2));\n    },\n  });\n\n  const setEnvValues = defineTool({\n    name: 'set_env_values',\n    label: 'Set env values',\n    description:\n      'Create or update environment variable keys in a .env file (creates the file if missing). Each value is either a literal string or a secret reference `{ \"secretRef\": \"secret:...\" }` returned by wizard_ask — refs are resolved locally, so the actual value is written to the file but never returned to the agent.',\n    promptSnippet:\n      'set_env_values(filePath, values) — write .env keys (never hardcode secrets in source)',\n    parameters: Type.Object({\n      filePath: Type.String({\n        description: ENV_FILE_PATH_DESCRIPTION,\n      }),\n      values: Type.Record(\n        Type.String(),\n        Type.Union([Type.String(), Type.Object({ secretRef: Type.String() })]),\n        {\n          description:\n            'Key → (literal string OR { secretRef } pointing to a vaulted secret)',\n        },\n      ),\n    }),\n    async execute(_id, args) {\n      const forbidden = Object.keys(args.values).find(\n        (k) => k.toUpperCase() === 'POSTHOG_KEY',\n      );\n      if (forbidden) {\n        return text(\n          `Error: \"${forbidden}\" is not a valid PostHog env var name. Use the framework-specific key (e.g. NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN).`,\n        );\n      }\n      // Resolve secret refs host-side; the value never reaches the agent.\n      const resolution = resolveEnvSecretRefs(args.values, secretVault);\n      if (!resolution.ok) {\n        return text(\n          `Error: secret reference \"${resolution.secretRef}\" for key \"${resolution.key}\" is not known to the vault. The ref may have expired, been minted in a different run, or been mistyped.`,\n        );\n      }\n      const resolved = resolveEnvPath(workingDirectory, args.filePath);\n      const existing = fs.existsSync(resolved)\n        ? await fs.promises.readFile(resolved, 'utf8')\n        : '';\n      const merged = mergeEnvValues(existing, resolution.values);\n      const dir = path.dirname(resolved);\n      if (!fs.existsSync(dir))\n        await fs.promises.mkdir(dir, { recursive: true });\n      await fs.promises.writeFile(resolved, merged, 'utf8');\n      logToFile(\n        `[pi] set_env_values: ${resolved} keys=${Object.keys(args.values).join(\n          ',',\n        )}`,\n      );\n      return text(\n        `Wrote ${Object.keys(args.values).length} key(s) to ${args.filePath}.`,\n      );\n    },\n  });\n\n  const detectPm = defineTool({\n    name: 'detect_package_manager',\n    label: 'Detect package manager',\n    description:\n      \"Detect the project's package manager(s). Returns the name and the install command for each. Call this before installing a dependency, then RUN the returned install command (with the posthog package) via bash — the SDK package must end up in the project manifest, or the app will not build.\",\n    promptSnippet:\n      'detect_package_manager() — find the PM + install command, then run it via bash to add the SDK',\n    parameters: Type.Object({}),\n    async execute() {\n      const result = await detectPackageManager(workingDirectory);\n      logToFile(\n        `[pi] detect_package_manager: ${result.detected.length} detected`,\n      );\n      return text(JSON.stringify(result, null, 2));\n    },\n  });\n\n  // Native mirror of the MCP `wizard_ask` tool: same name, schema, and\n  // askBridge, so the shared prompt is unchanged.\n  const wizardAsk = defineTool({\n    name: 'wizard_ask',\n    label: 'Ask the user',\n    description:\n      'Ask the user one or more structured questions and wait for their answers. ' +\n      'Use this whenever you would otherwise inline a question in your text output. ' +\n      'Batch related questions into a single call (up to 8) rather than asking one at ' +\n      'a time; sequential calls are fine when later questions genuinely depend on ' +\n      'earlier answers. A fully cancelled or timed-out response does NOT count against ' +\n      'the per-run cap — treat it as \"the user declined\" and fall back gracefully.',\n    promptSnippet:\n      'wizard_ask(questions) — ask the user structured questions and wait for answers',\n    parameters: Type.Object({\n      questions: Type.Array(\n        Type.Object({\n          id: Type.String({\n            description: 'Stable key for the answer in the response map',\n          }),\n          prompt: Type.String({\n            description: 'Question text shown to the user',\n          }),\n          kind: Type.Union(\n            [\n              Type.Literal('single'),\n              Type.Literal('multi'),\n              Type.Literal('text'),\n            ],\n            {\n              description:\n                \"'single' = pick one option, 'multi' = pick any, 'text' = free-form single-line answer\",\n            },\n          ),\n          options: Type.Optional(\n            Type.Array(\n              Type.Object({\n                label: Type.String(),\n                value: Type.String(),\n                description: Type.Optional(Type.String()),\n              }),\n              {\n                description:\n                  'Required for kind=single|multi; ignored for kind=text',\n              },\n            ),\n          ),\n          required: Type.Optional(\n            Type.Boolean({ description: 'Defaults to true' }),\n          ),\n          sensitive: Type.Optional(\n            Type.Boolean({\n              description:\n                \"Only valid for kind='text'. The answer is stored in the wizard's secret vault and returned as { secretRef: 'secret:...' } instead of the raw string. Use for API keys and tokens; the ref is resolved only by tools that accept it (e.g. set_env_values).\",\n            }),\n          ),\n        }),\n        { minItems: 1, maxItems: 8 },\n      ),\n    }),\n    async execute(_id, args) {\n      if (!askBridge) {\n        return text(\n          'Error: wizard_ask is not available in this environment (CI / non-interactive). Proceed with sensible defaults or emit [ABORT] requirements-incomplete.',\n        );\n      }\n\n      const cap = evaluateAskCap(\n        askCallCount,\n        askMaxQuestions,\n        askAdjacencyNudged,\n      );\n      if (cap.kind === 'capped') {\n        if (cap.reason === 'adjacency') askAdjacencyNudged = true;\n        logToFile(\n          `[pi] wizard_ask capped: reason=${cap.reason} count=${askCallCount}`,\n        );\n        analytics.wizardCapture('wizard_ask capped', {\n          reason: cap.reason,\n          call_count: askCallCount,\n          max_questions: askMaxQuestions,\n        });\n        return text(cap.message);\n      }\n\n      // The schema can't enforce per-kind requirements or unique ids.\n      const ids = new Set<string>();\n      for (const q of args.questions) {\n        if ((q.kind === 'single' || q.kind === 'multi') && !q.options?.length) {\n          return text(\n            `Error: question \"${q.id}\" has kind=\"${q.kind}\" but no options. Provide at least one { label, value }, or use kind=\"text\".`,\n          );\n        }\n        if (q.sensitive && q.kind !== 'text') {\n          return text(\n            `Error: question \"${q.id}\" sets sensitive=true but kind=\"${q.kind}\". Only kind=\"text\" answers can be sensitive.`,\n          );\n        }\n        if (ids.has(q.id)) {\n          return text(\n            `Error: duplicate question id \"${q.id}\". Each question needs a unique id.`,\n          );\n        }\n        ids.add(q.id);\n      }\n\n      // Optimistically take the slot; refund it on a cancellation or a bridge\n      // error so a declined/failed ask doesn't burn the budget for later ones.\n      askCallCount += 1;\n      // Block Write/Edit for as long as the overlay is open, so the agent can't\n      // mutate files while it's waiting on the user's answer.\n      onAskPendingChange?.(true);\n      try {\n        const answers = await askBridge.request({ questions: args.questions });\n        if (isFullyCancelled(answers)) askCallCount -= 1;\n        // Sensitive answers go to the vault; the agent sees an opaque ref\n        // (same contract as the MCP wizard_ask).\n        const sanitised = vaultSensitiveAnswers(\n          args.questions,\n          answers,\n          secretVault,\n        );\n        logToFile(\n          `[pi] wizard_ask: resolved ${\n            Object.keys(answers).length\n          } answer(s) for ${args.questions.length} question(s)`,\n        );\n        return text(JSON.stringify({ answers: sanitised }, null, 2));\n      } catch (err) {\n        askCallCount -= 1;\n        const message = err instanceof Error ? err.message : String(err);\n        logToFile(`[pi] wizard_ask: error: ${message}`);\n        return text(`Error: wizard_ask failed: ${message}`);\n      } finally {\n        onAskPendingChange?.(false);\n      }\n    },\n  });\n\n  // Native mirror of the MCP `publish_handoff` tool (shared description, so no drift).\n  const publishHandoffTool = defineTool({\n    name: PUBLISH_HANDOFF_TOOL_NAME,\n    label: 'Publish handoff',\n    description: PUBLISH_HANDOFF_DESCRIPTION,\n    promptSnippet:\n      'publish_handoff(content) — publish the full report markdown to the wizard session',\n    parameters: Type.Object({\n      content: Type.String({\n        description: PUBLISH_HANDOFF_CONTENT_DESCRIPTION,\n      }),\n    }),\n    execute(_id, args) {\n      const result = publishHandoff(args.content);\n      logToFile(`[pi] publish_handoff: ${result.message}`);\n      return Promise.resolve(text(result.message));\n    },\n  });\n\n  const tools = [\n    loadSkillMenu,\n    installSkill,\n    checkEnvKeys,\n    setEnvValues,\n    detectPm,\n    // Sequential: it mutates the store's handoff state.\n    withMode(publishHandoffTool, 'sequential'),\n  ];\n  // Register wizard_ask only when the program allows it. posthog-integration\n  // disallows it (runs without structured user input); self-driving keeps it.\n  // Sequential: the ask bridge holds a single in-flight question slot, so a\n  // batched turn must never dispatch two asks (or an ask + a write) at once.\n  const askDisallowed =\n    ctx.disallowedTools?.includes(WIZARD_TOOL_NAMES.wizardAsk) ?? false;\n  if (!askDisallowed) tools.push(withMode(wizardAsk, 'sequential'));\n  return tools;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgDA,SAAS,KAAK,GAGZ;AACA,QAAO;EAAE,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM;GAAG,CAAC;EAAE,SAAS,EAAE;EAAE;;AAoB9D,SAAgB,oBAAoB,KAAuC;CACzE,MAAM,EACJ,kBACA,eACA,WACA,oBACA,mBACE;CACJ,MAAM,uBACJ,IAAI,wBAAwB;CAC9B,MAAM,kBAAkB,IAAI,gBAAA;CAG5B,IAAI,eAAe;CACnB,IAAI,qBAAqB;CAGzB,MAAM,cAAc,mBAAmB;CAIvC,IAAI;CACJ,MAAM,qBAAsB,gBAAgB,eAAe,cAAc;CAEzE,MAAM,gBAAgB,WAAW;EAC/B,MAAM;EACN,OAAO;EACP,aACE;EACF,eACE;EACF,YAAY,KAAK,OAAO,EACtB,UAAU,KAAK,OAAO,EACpB,aAAa,wCACd,CAAC,EACH,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;GACvB,MAAM,OAAO,MAAM,cAAc;AACjC,OAAI,CAAC,KAAM,QAAO,KAAK,wCAAwC;GAC/D,MAAM,SAAS,KAAK,WAAW,KAAK,aAAa,EAAE;AACnD,OAAI,OAAO,WAAW,EACpB,QAAO,KAAK,iCAAiC,KAAK,SAAS,IAAI;AAEjE,aAAU,yBAAyB,OAAO,OAAO,SAAS;AAC1D,UAAO,KAAK,OAAO,KAAK,MAAM,KAAK,EAAE,GAAG,IAAI,EAAE,OAAO,CAAC,KAAK,KAAK,CAAC;;EAEpE,CAAC;CAEF,MAAM,eAAe,WAAW;EAC9B,MAAM;EACN,OAAO;EACP,aACE;EACF,eACE;EACF,YAAY,KAAK,OAAO,EACtB,SAAS,KAAK,OAAO,EAAE,aAAa,iCAAiC,CAAC,EACvE,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;GACvB,MAAM,SAAS,MAAM,iBACnB,KAAK,SACL,kBACA,eACA,EAAE,QAAQ,gBAAgB,CAC3B;AACD,OAAI,OAAO,SAAS,MAAM;AACxB,cAAU,sBAAsB,KAAK,QAAQ,IAAI,OAAO,OAAO;AAC/D,WAAO,KACL,2BAA2B,KAAK,QAAQ,KAAK,OAAO,KAAK,yCAC1D;;AAEH,aAAU,sBAAsB,KAAK,QAAQ,MAAM,OAAO,OAAO;AACjE,UAAO,KACL,cAAc,KAAK,QAAQ,OAAO,OAAO,KAAK,SAAS,OAAO,KAAK,0BACpE;;EAEJ,CAAC;CAEF,MAAM,eAAe,WAAW;EAC9B,MAAM;EACN,OAAO;EACP,aACE;EACF,eAAe;EACf,YAAY,KAAK,OAAO;GACtB,UAAU,KAAK,OAAO,EACpB,aAAa,2BACd,CAAC;GACF,MAAM,KAAK,MAAM,KAAK,QAAQ,EAAE,EAC9B,aAAa,2CACd,CAAC;GACH,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;GACvB,MAAM,WAAW,eAAe,kBAAkB,KAAK,SAAS;GAChE,MAAM,WAAW,GAAG,WAAW,SAAS,GACpC,aAAa,MAAM,GAAG,SAAS,SAAS,UAAU,OAAO,CAAC,mBAC1D,IAAI,KAAa;GACrB,MAAM,UAAiD,EAAE;AACzD,QAAK,MAAM,OAAO,KAAK,KACrB,SAAQ,OAAO,SAAS,IAAI,IAAI,GAAG,YAAY;AAEjD,UAAO,KAAK,KAAK,UAAU,SAAS,MAAM,EAAE,CAAC;;EAEhD,CAAC;CAEF,MAAM,eAAe,WAAW;EAC9B,MAAM;EACN,OAAO;EACP,aACE;EACF,eACE;EACF,YAAY,KAAK,OAAO;GACtB,UAAU,KAAK,OAAO,EACpB,aAAa,2BACd,CAAC;GACF,QAAQ,KAAK,OACX,KAAK,QAAQ,EACb,KAAK,MAAM,CAAC,KAAK,QAAQ,EAAE,KAAK,OAAO,EAAE,WAAW,KAAK,QAAQ,EAAE,CAAC,CAAC,CAAC,EACtE,EACE,aACE,wEACH,CACF;GACF,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;GACvB,MAAM,YAAY,OAAO,KAAK,KAAK,OAAO,CAAC,MACxC,MAAM,EAAE,aAAa,KAAK,cAC5B;AACD,OAAI,UACF,QAAO,KACL,WAAW,UAAU,iHACtB;GAGH,MAAM,aAAa,qBAAqB,KAAK,QAAQ,YAAY;AACjE,OAAI,CAAC,WAAW,GACd,QAAO,KACL,4BAA4B,WAAW,UAAU,aAAa,WAAW,IAAI,0GAC9E;GAEH,MAAM,WAAW,eAAe,kBAAkB,KAAK,SAAS;GAIhE,MAAM,SAAS,eAHE,GAAG,WAAW,SAAS,GACpC,MAAM,GAAG,SAAS,SAAS,UAAU,OAAO,GAC5C,IACoC,WAAW,OAAO;GAC1D,MAAM,MAAM,KAAK,QAAQ,SAAS;AAClC,OAAI,CAAC,GAAG,WAAW,IAAI,CACrB,OAAM,GAAG,SAAS,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC;AACnD,SAAM,GAAG,SAAS,UAAU,UAAU,QAAQ,OAAO;AACrD,aACE,wBAAwB,SAAS,QAAQ,OAAO,KAAK,KAAK,OAAO,CAAC,KAChE,IACD,GACF;AACD,UAAO,KACL,SAAS,OAAO,KAAK,KAAK,OAAO,CAAC,OAAO,aAAa,KAAK,SAAS,GACrE;;EAEJ,CAAC;CAEF,MAAM,WAAW,WAAW;EAC1B,MAAM;EACN,OAAO;EACP,aACE;EACF,eACE;EACF,YAAY,KAAK,OAAO,EAAE,CAAC;EAC3B,MAAM,UAAU;GACd,MAAM,SAAS,MAAM,qBAAqB,iBAAiB;AAC3D,aACE,gCAAgC,OAAO,SAAS,OAAO,WACxD;AACD,UAAO,KAAK,KAAK,UAAU,QAAQ,MAAM,EAAE,CAAC;;EAE/C,CAAC;CAIF,MAAM,YAAY,WAAW;EAC3B,MAAM;EACN,OAAO;EACP,aACE;EAMF,eACE;EACF,YAAY,KAAK,OAAO,EACtB,WAAW,KAAK,MACd,KAAK,OAAO;GACV,IAAI,KAAK,OAAO,EACd,aAAa,iDACd,CAAC;GACF,QAAQ,KAAK,OAAO,EAClB,aAAa,mCACd,CAAC;GACF,MAAM,KAAK,MACT;IACE,KAAK,QAAQ,SAAS;IACtB,KAAK,QAAQ,QAAQ;IACrB,KAAK,QAAQ,OAAO;IACrB,EACD,EACE,aACE,yFACH,CACF;GACD,SAAS,KAAK,SACZ,KAAK,MACH,KAAK,OAAO;IACV,OAAO,KAAK,QAAQ;IACpB,OAAO,KAAK,QAAQ;IACpB,aAAa,KAAK,SAAS,KAAK,QAAQ,CAAC;IAC1C,CAAC,EACF,EACE,aACE,yDACH,CACF,CACF;GACD,UAAU,KAAK,SACb,KAAK,QAAQ,EAAE,aAAa,oBAAoB,CAAC,CAClD;GACD,WAAW,KAAK,SACd,KAAK,QAAQ,EACX,aACE,6PACH,CAAC,CACH;GACF,CAAC,EACF;GAAE,UAAU;GAAG,UAAU;GAAG,CAC7B,EACF,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;AACvB,OAAI,CAAC,UACH,QAAO,KACL,yJACD;GAGH,MAAM,MAAM,eACV,cACA,iBACA,mBACD;AACD,OAAI,IAAI,SAAS,UAAU;AACzB,QAAI,IAAI,WAAW,YAAa,sBAAqB;AACrD,cACE,kCAAkC,IAAI,OAAO,SAAS,eACvD;AACD,cAAU,cAAc,qBAAqB;KAC3C,QAAQ,IAAI;KACZ,YAAY;KACZ,eAAe;KAChB,CAAC;AACF,WAAO,KAAK,IAAI,QAAQ;;GAI1B,MAAM,sBAAM,IAAI,KAAa;AAC7B,QAAK,MAAM,KAAK,KAAK,WAAW;AAC9B,SAAK,EAAE,SAAS,YAAY,EAAE,SAAS,YAAY,CAAC,EAAE,SAAS,OAC7D,QAAO,KACL,oBAAoB,EAAE,GAAG,cAAc,EAAE,KAAK,8EAC/C;AAEH,QAAI,EAAE,aAAa,EAAE,SAAS,OAC5B,QAAO,KACL,oBAAoB,EAAE,GAAG,kCAAkC,EAAE,KAAK,+CACnE;AAEH,QAAI,IAAI,IAAI,EAAE,GAAG,CACf,QAAO,KACL,iCAAiC,EAAE,GAAG,qCACvC;AAEH,QAAI,IAAI,EAAE,GAAG;;AAKf,mBAAgB;AAGhB,wBAAqB,KAAK;AAC1B,OAAI;IACF,MAAM,UAAU,MAAM,UAAU,QAAQ,EAAE,WAAW,KAAK,WAAW,CAAC;AACtE,QAAI,iBAAiB,QAAQ,CAAE,iBAAgB;IAG/C,MAAM,YAAY,sBAChB,KAAK,WACL,SACA,YACD;AACD,cACE,6BACE,OAAO,KAAK,QAAQ,CAAC,OACtB,iBAAiB,KAAK,UAAU,OAAO,cACzC;AACD,WAAO,KAAK,KAAK,UAAU,EAAE,SAAS,WAAW,EAAE,MAAM,EAAE,CAAC;YACrD,KAAK;AACZ,oBAAgB;IAChB,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAChE,cAAU,2BAA2B,UAAU;AAC/C,WAAO,KAAK,6BAA6B,UAAU;aAC3C;AACR,yBAAqB,MAAM;;;EAGhC,CAAC;CAqBF,MAAM,QAAQ;EACZ;EACA;EACA;EACA;EACA;EAEA,SAzByB,WAAW;GACpC,MAAM;GACN,OAAO;GACP,aAAa;GACb,eACE;GACF,YAAY,KAAK,OAAO,EACtB,SAAS,KAAK,OAAO,EACnB,aAAa,qCACd,CAAC,EACH,CAAC;GACF,QAAQ,KAAK,MAAM;IACjB,MAAM,SAAS,eAAe,KAAK,QAAQ;AAC3C,cAAU,yBAAyB,OAAO,UAAU;AACpD,WAAO,QAAQ,QAAQ,KAAK,OAAO,QAAQ,CAAC;;GAE/C,CAAC,EAS6B,aAAa;EAC3C;AAOD,KAAI,EADF,IAAI,iBAAiB,SAAS,kBAAkB,UAAU,IAAI,OAC5C,OAAM,KAAK,SAAS,WAAW,aAAa,CAAC;AACjE,QAAO"}
+{"version":3,"file":"tools-DQO5tKJg.js","names":[],"sources":["../src/lib/agent/runner/harness/pi/tools.ts"],"sourcesContent":["/**\n * Wizard capabilities as pi custom tools (#5). pi does not mount MCP servers,\n * so the tools the wizard prompt depends on — skill discovery/install and\n * fenced `.env` edits — are exposed to pi as native `defineTool` tools backed\n * by the same helpers the claude-agent-sdk path uses (`fetchSkillMenu`,\n * `installSkillById`, `parseEnvKeys`, `mergeEnvValues`). Same tool names as the\n * MCP server so the shared prompt is unchanged. `wizard_ask` is wired here too\n * (same schema, caps, and askBridge as the MCP tool) so interactive programs\n * can interview the user on pi; without a bridge (CI) it errors on call.\n * Sensitive answers are vaulted to `{secretRef}` and resolved host-side by\n * set_env_values — the raw value never enters the model conversation.\n */\n\nimport fs from 'fs';\nimport path from 'path';\nimport { Type } from 'typebox';\nimport { defineTool } from '@earendil-works/pi-coding-agent';\nimport type { ToolDefinition } from '@earendil-works/pi-coding-agent';\nimport { analytics } from '@utils/analytics';\nimport { logToFile } from '@utils/debug';\nimport {\n  DEFAULT_ASK_MAX_QUESTIONS,\n  ENV_FILE_PATH_DESCRIPTION,\n  WIZARD_TOOL_NAMES,\n  evaluateAskCap,\n  fetchSkillMenu,\n  installSkillById,\n  mergeEnvValues,\n  parseEnvKeys,\n  resolveEnvPath,\n  resolveEnvSecretRefs,\n  vaultSensitiveAnswers,\n} from '@lib/wizard-tools/tools';\nimport type { LLMProvider } from '@posthog/warlock';\nimport { isFullyCancelled, type WizardAskBridge } from '@lib/wizard-ask-bridge';\nimport {\n  PUBLISH_HANDOFF_CONTENT_DESCRIPTION,\n  PUBLISH_HANDOFF_DESCRIPTION,\n  PUBLISH_HANDOFF_TOOL_NAME,\n  publishHandoff,\n} from '@lib/wizard-tools/handoff';\nimport { createSecretVault } from '@lib/secret-vault';\nimport { withMode } from './index';\nimport {\n  detectNodePackageManagers,\n  type PackageManagerDetector,\n} from '@lib/detection/package-manager';\n\nfunction text(s: string): {\n  content: [{ type: 'text'; text: string }];\n  details: unknown;\n} {\n  return { content: [{ type: 'text', text: s }], details: {} };\n}\n\nexport interface PiToolsContext {\n  workingDirectory: string;\n  skillsBaseUrl: string;\n  /** Framework's package-manager detector. Defaults to Node detection. */\n  detectPackageManager?: PackageManagerDetector;\n  /** Drives the `wizard_ask` overlay. Omitted in CI → the tool errors on call. */\n  askBridge?: WizardAskBridge;\n  /** Per-run cap on wizard_ask calls. Defaults to {@link DEFAULT_ASK_MAX_QUESTIONS}. */\n  maxQuestions?: number;\n  /** Overlay open/closed signal — the security gate blocks Write/Edit while open. */\n  onAskPendingChange?: (pending: boolean) => void;\n  /** Program disallow list; gates wizard_ask here since pi tools carry bare names the MCP-prefixed security gate misses. */\n  disallowedTools?: readonly string[];\n  /** Scan-triage classifier, resolved once in bootstrap. Absent → scans fail closed. */\n  triageProvider?: LLMProvider;\n}\n\nexport function createWizardPiTools(ctx: PiToolsContext): ToolDefinition[] {\n  const {\n    workingDirectory,\n    skillsBaseUrl,\n    askBridge,\n    onAskPendingChange,\n    triageProvider,\n  } = ctx;\n  const detectPackageManager =\n    ctx.detectPackageManager ?? detectNodePackageManagers;\n  const askMaxQuestions = ctx.maxQuestions ?? DEFAULT_ASK_MAX_QUESTIONS;\n  // Per-run wizard_ask accounting (total cap + one-time adjacency nudge),\n  // mirroring the MCP server's counters.\n  let askCallCount = 0;\n  let askAdjacencyNudged = false;\n  // Session-scoped secret vault, same contract as the MCP server: wizard_ask\n  // mints `{secretRef}` for sensitive answers, set_env_values resolves them.\n  const secretVault = createSecretVault();\n\n  // Fetch the skill menu at most once per run — the agent calls load_skill_menu\n  // 2-3× otherwise, each a fresh HTTP round-trip (profiled slowness).\n  let menuPromise: ReturnType<typeof fetchSkillMenu> | undefined;\n  const getSkillMenu = () => (menuPromise ??= fetchSkillMenu(skillsBaseUrl));\n\n  const loadSkillMenu = defineTool({\n    name: 'load_skill_menu',\n    label: 'Load skill menu',\n    description:\n      'Load available PostHog skills for a category. Returns skill IDs and names. Call this first, then install_skill with the chosen ID.',\n    promptSnippet:\n      'load_skill_menu(category) — list installable PostHog skills',\n    parameters: Type.Object({\n      category: Type.String({\n        description: 'Skill category, e.g. \"integration\"',\n      }),\n    }),\n    async execute(_id, args) {\n      const menu = await getSkillMenu();\n      if (!menu) return text('Error: could not load the skill menu.');\n      const skills = menu.categories[args.category] ?? [];\n      if (skills.length === 0) {\n        return text(`No skills found for category \"${args.category}\".`);\n      }\n      logToFile(`[pi] load_skill_menu: ${skills.length} skills`);\n      return text(skills.map((s) => `- ${s.id}: ${s.name}`).join('\\n'));\n    },\n  });\n\n  const installSkill = defineTool({\n    name: 'install_skill',\n    label: 'Install skill',\n    description:\n      'Download and install a PostHog skill by ID into .claude/skills/<skillId>/. Call load_skill_menu first. Then read the installed SKILL.md and follow it.',\n    promptSnippet:\n      'install_skill(skillId) — install a skill, then read its SKILL.md',\n    parameters: Type.Object({\n      skillId: Type.String({ description: 'Skill ID from load_skill_menu' }),\n    }),\n    async execute(_id, args) {\n      const result = await installSkillById(\n        args.skillId,\n        workingDirectory,\n        skillsBaseUrl,\n        { triage: triageProvider },\n      );\n      if (result.kind !== 'ok') {\n        logToFile(`[pi] install_skill ${args.skillId}: ${result.kind}`);\n        return text(\n          `Error installing skill \"${args.skillId}\": ${result.kind}. Use load_skill_menu to see valid IDs.`,\n        );\n      }\n      logToFile(`[pi] install_skill ${args.skillId} -> ${result.path}`);\n      return text(\n        `Installed \"${args.skillId}\" at ${result.path}. Read ${result.path}/SKILL.md and follow it.`,\n      );\n    },\n  });\n\n  const checkEnvKeys = defineTool({\n    name: 'check_env_keys',\n    label: 'Check env keys',\n    description:\n      'Check which environment variable keys are present or missing in a .env file. Never reveals values.',\n    promptSnippet: 'check_env_keys(filePath, keys) — see which .env keys exist',\n    parameters: Type.Object({\n      filePath: Type.String({\n        description: ENV_FILE_PATH_DESCRIPTION,\n      }),\n      keys: Type.Array(Type.String(), {\n        description: 'Environment variable key names to check',\n      }),\n    }),\n    async execute(_id, args) {\n      const resolved = resolveEnvPath(workingDirectory, args.filePath);\n      const existing = fs.existsSync(resolved)\n        ? parseEnvKeys(await fs.promises.readFile(resolved, 'utf8'))\n        : new Set<string>();\n      const results: Record<string, 'present' | 'missing'> = {};\n      for (const key of args.keys) {\n        results[key] = existing.has(key) ? 'present' : 'missing';\n      }\n      return text(JSON.stringify(results, null, 2));\n    },\n  });\n\n  const setEnvValues = defineTool({\n    name: 'set_env_values',\n    label: 'Set env values',\n    description:\n      'Create or update environment variable keys in a .env file (creates the file if missing). Each value is either a literal string or a secret reference `{ \"secretRef\": \"secret:...\" }` returned by wizard_ask — refs are resolved locally, so the actual value is written to the file but never returned to the agent.',\n    promptSnippet:\n      'set_env_values(filePath, values) — write .env keys (never hardcode secrets in source)',\n    parameters: Type.Object({\n      filePath: Type.String({\n        description: ENV_FILE_PATH_DESCRIPTION,\n      }),\n      values: Type.Record(\n        Type.String(),\n        Type.Union([Type.String(), Type.Object({ secretRef: Type.String() })]),\n        {\n          description:\n            'Key → (literal string OR { secretRef } pointing to a vaulted secret)',\n        },\n      ),\n    }),\n    async execute(_id, args) {\n      const forbidden = Object.keys(args.values).find(\n        (k) => k.toUpperCase() === 'POSTHOG_KEY',\n      );\n      if (forbidden) {\n        return text(\n          `Error: \"${forbidden}\" is not a valid PostHog env var name. Use the framework-specific key (e.g. NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN).`,\n        );\n      }\n      // Resolve secret refs host-side; the value never reaches the agent.\n      const resolution = resolveEnvSecretRefs(args.values, secretVault);\n      if (!resolution.ok) {\n        return text(\n          `Error: secret reference \"${resolution.secretRef}\" for key \"${resolution.key}\" is not known to the vault. The ref may have expired, been minted in a different run, or been mistyped.`,\n        );\n      }\n      const resolved = resolveEnvPath(workingDirectory, args.filePath);\n      const existing = fs.existsSync(resolved)\n        ? await fs.promises.readFile(resolved, 'utf8')\n        : '';\n      const merged = mergeEnvValues(existing, resolution.values);\n      const dir = path.dirname(resolved);\n      if (!fs.existsSync(dir))\n        await fs.promises.mkdir(dir, { recursive: true });\n      await fs.promises.writeFile(resolved, merged, 'utf8');\n      logToFile(\n        `[pi] set_env_values: ${resolved} keys=${Object.keys(args.values).join(\n          ',',\n        )}`,\n      );\n      return text(\n        `Wrote ${Object.keys(args.values).length} key(s) to ${args.filePath}.`,\n      );\n    },\n  });\n\n  const detectPm = defineTool({\n    name: 'detect_package_manager',\n    label: 'Detect package manager',\n    description:\n      \"Detect the project's package manager(s). Returns the name and the install command for each. Call this before installing a dependency, then RUN the returned install command (with the posthog package) via bash — the SDK package must end up in the project manifest, or the app will not build.\",\n    promptSnippet:\n      'detect_package_manager() — find the PM + install command, then run it via bash to add the SDK',\n    parameters: Type.Object({}),\n    async execute() {\n      const result = await detectPackageManager(workingDirectory);\n      logToFile(\n        `[pi] detect_package_manager: ${result.detected.length} detected`,\n      );\n      return text(JSON.stringify(result, null, 2));\n    },\n  });\n\n  // Native mirror of the MCP `wizard_ask` tool: same name, schema, and\n  // askBridge, so the shared prompt is unchanged.\n  const wizardAsk = defineTool({\n    name: 'wizard_ask',\n    label: 'Ask the user',\n    description:\n      'Ask the user one or more structured questions and wait for their answers. ' +\n      'Use this whenever you would otherwise inline a question in your text output. ' +\n      'Batch related questions into a single call (up to 8) rather than asking one at ' +\n      'a time; sequential calls are fine when later questions genuinely depend on ' +\n      'earlier answers. A fully cancelled or timed-out response does NOT count against ' +\n      'the per-run cap — treat it as \"the user declined\" and fall back gracefully.',\n    promptSnippet:\n      'wizard_ask(questions) — ask the user structured questions and wait for answers',\n    parameters: Type.Object({\n      questions: Type.Array(\n        Type.Object({\n          id: Type.String({\n            description: 'Stable key for the answer in the response map',\n          }),\n          prompt: Type.String({\n            description: 'Question text shown to the user',\n          }),\n          kind: Type.Union(\n            [\n              Type.Literal('single'),\n              Type.Literal('multi'),\n              Type.Literal('text'),\n            ],\n            {\n              description:\n                \"'single' = pick one option, 'multi' = pick any, 'text' = free-form single-line answer\",\n            },\n          ),\n          options: Type.Optional(\n            Type.Array(\n              Type.Object({\n                label: Type.String(),\n                value: Type.String(),\n                description: Type.Optional(Type.String()),\n              }),\n              {\n                description:\n                  'Required for kind=single|multi; ignored for kind=text',\n              },\n            ),\n          ),\n          required: Type.Optional(\n            Type.Boolean({ description: 'Defaults to true' }),\n          ),\n          sensitive: Type.Optional(\n            Type.Boolean({\n              description:\n                \"Only valid for kind='text'. The answer is stored in the wizard's secret vault and returned as { secretRef: 'secret:...' } instead of the raw string. Use for API keys and tokens; the ref is resolved only by tools that accept it (e.g. set_env_values).\",\n            }),\n          ),\n        }),\n        { minItems: 1, maxItems: 8 },\n      ),\n    }),\n    async execute(_id, args) {\n      if (!askBridge) {\n        return text(\n          'Error: wizard_ask is not available in this environment (CI / non-interactive). Proceed with sensible defaults or emit [ABORT] requirements-incomplete.',\n        );\n      }\n\n      const cap = evaluateAskCap(\n        askCallCount,\n        askMaxQuestions,\n        askAdjacencyNudged,\n      );\n      if (cap.kind === 'capped') {\n        if (cap.reason === 'adjacency') askAdjacencyNudged = true;\n        logToFile(\n          `[pi] wizard_ask capped: reason=${cap.reason} count=${askCallCount}`,\n        );\n        analytics.wizardCapture('wizard_ask capped', {\n          reason: cap.reason,\n          call_count: askCallCount,\n          max_questions: askMaxQuestions,\n        });\n        return text(cap.message);\n      }\n\n      // The schema can't enforce per-kind requirements or unique ids.\n      const ids = new Set<string>();\n      for (const q of args.questions) {\n        if ((q.kind === 'single' || q.kind === 'multi') && !q.options?.length) {\n          return text(\n            `Error: question \"${q.id}\" has kind=\"${q.kind}\" but no options. Provide at least one { label, value }, or use kind=\"text\".`,\n          );\n        }\n        if (q.sensitive && q.kind !== 'text') {\n          return text(\n            `Error: question \"${q.id}\" sets sensitive=true but kind=\"${q.kind}\". Only kind=\"text\" answers can be sensitive.`,\n          );\n        }\n        if (ids.has(q.id)) {\n          return text(\n            `Error: duplicate question id \"${q.id}\". Each question needs a unique id.`,\n          );\n        }\n        ids.add(q.id);\n      }\n\n      // Optimistically take the slot; refund it on a cancellation or a bridge\n      // error so a declined/failed ask doesn't burn the budget for later ones.\n      askCallCount += 1;\n      // Block Write/Edit for as long as the overlay is open, so the agent can't\n      // mutate files while it's waiting on the user's answer.\n      onAskPendingChange?.(true);\n      try {\n        const answers = await askBridge.request({ questions: args.questions });\n        if (isFullyCancelled(answers)) askCallCount -= 1;\n        // Sensitive answers go to the vault; the agent sees an opaque ref\n        // (same contract as the MCP wizard_ask).\n        const sanitised = vaultSensitiveAnswers(\n          args.questions,\n          answers,\n          secretVault,\n        );\n        logToFile(\n          `[pi] wizard_ask: resolved ${\n            Object.keys(answers).length\n          } answer(s) for ${args.questions.length} question(s)`,\n        );\n        return text(JSON.stringify({ answers: sanitised }, null, 2));\n      } catch (err) {\n        askCallCount -= 1;\n        const message = err instanceof Error ? err.message : String(err);\n        logToFile(`[pi] wizard_ask: error: ${message}`);\n        return text(`Error: wizard_ask failed: ${message}`);\n      } finally {\n        onAskPendingChange?.(false);\n      }\n    },\n  });\n\n  // Native mirror of the MCP `publish_handoff` tool (shared description, so no drift).\n  const publishHandoffTool = defineTool({\n    name: PUBLISH_HANDOFF_TOOL_NAME,\n    label: 'Publish handoff',\n    description: PUBLISH_HANDOFF_DESCRIPTION,\n    promptSnippet:\n      'publish_handoff(content) — publish the full report markdown to the wizard session',\n    parameters: Type.Object({\n      content: Type.String({\n        description: PUBLISH_HANDOFF_CONTENT_DESCRIPTION,\n      }),\n    }),\n    execute(_id, args) {\n      const result = publishHandoff(args.content);\n      logToFile(`[pi] publish_handoff: ${result.message}`);\n      return Promise.resolve(text(result.message));\n    },\n  });\n\n  const tools = [\n    loadSkillMenu,\n    installSkill,\n    checkEnvKeys,\n    setEnvValues,\n    detectPm,\n    // Sequential: it mutates the store's handoff state.\n    withMode(publishHandoffTool, 'sequential'),\n  ];\n  // Register wizard_ask only when the program allows it. posthog-integration\n  // disallows it (runs without structured user input); self-driving keeps it.\n  // Sequential: the ask bridge holds a single in-flight question slot, so a\n  // batched turn must never dispatch two asks (or an ask + a write) at once.\n  const askDisallowed =\n    ctx.disallowedTools?.includes(WIZARD_TOOL_NAMES.wizardAsk) ?? false;\n  if (!askDisallowed) tools.push(withMode(wizardAsk, 'sequential'));\n  return tools;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgDA,SAAS,KAAK,GAGZ;AACA,QAAO;EAAE,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM;GAAG,CAAC;EAAE,SAAS,EAAE;EAAE;;AAoB9D,SAAgB,oBAAoB,KAAuC;CACzE,MAAM,EACJ,kBACA,eACA,WACA,oBACA,mBACE;CACJ,MAAM,uBACJ,IAAI,wBAAwB;CAC9B,MAAM,kBAAkB,IAAI,gBAAA;CAG5B,IAAI,eAAe;CACnB,IAAI,qBAAqB;CAGzB,MAAM,cAAc,mBAAmB;CAIvC,IAAI;CACJ,MAAM,qBAAsB,gBAAgB,eAAe,cAAc;CAEzE,MAAM,gBAAgB,WAAW;EAC/B,MAAM;EACN,OAAO;EACP,aACE;EACF,eACE;EACF,YAAY,KAAK,OAAO,EACtB,UAAU,KAAK,OAAO,EACpB,aAAa,wCACd,CAAC,EACH,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;GACvB,MAAM,OAAO,MAAM,cAAc;AACjC,OAAI,CAAC,KAAM,QAAO,KAAK,wCAAwC;GAC/D,MAAM,SAAS,KAAK,WAAW,KAAK,aAAa,EAAE;AACnD,OAAI,OAAO,WAAW,EACpB,QAAO,KAAK,iCAAiC,KAAK,SAAS,IAAI;AAEjE,aAAU,yBAAyB,OAAO,OAAO,SAAS;AAC1D,UAAO,KAAK,OAAO,KAAK,MAAM,KAAK,EAAE,GAAG,IAAI,EAAE,OAAO,CAAC,KAAK,KAAK,CAAC;;EAEpE,CAAC;CAEF,MAAM,eAAe,WAAW;EAC9B,MAAM;EACN,OAAO;EACP,aACE;EACF,eACE;EACF,YAAY,KAAK,OAAO,EACtB,SAAS,KAAK,OAAO,EAAE,aAAa,iCAAiC,CAAC,EACvE,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;GACvB,MAAM,SAAS,MAAM,iBACnB,KAAK,SACL,kBACA,eACA,EAAE,QAAQ,gBAAgB,CAC3B;AACD,OAAI,OAAO,SAAS,MAAM;AACxB,cAAU,sBAAsB,KAAK,QAAQ,IAAI,OAAO,OAAO;AAC/D,WAAO,KACL,2BAA2B,KAAK,QAAQ,KAAK,OAAO,KAAK,yCAC1D;;AAEH,aAAU,sBAAsB,KAAK,QAAQ,MAAM,OAAO,OAAO;AACjE,UAAO,KACL,cAAc,KAAK,QAAQ,OAAO,OAAO,KAAK,SAAS,OAAO,KAAK,0BACpE;;EAEJ,CAAC;CAEF,MAAM,eAAe,WAAW;EAC9B,MAAM;EACN,OAAO;EACP,aACE;EACF,eAAe;EACf,YAAY,KAAK,OAAO;GACtB,UAAU,KAAK,OAAO,EACpB,aAAa,2BACd,CAAC;GACF,MAAM,KAAK,MAAM,KAAK,QAAQ,EAAE,EAC9B,aAAa,2CACd,CAAC;GACH,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;GACvB,MAAM,WAAW,eAAe,kBAAkB,KAAK,SAAS;GAChE,MAAM,WAAW,GAAG,WAAW,SAAS,GACpC,aAAa,MAAM,GAAG,SAAS,SAAS,UAAU,OAAO,CAAC,mBAC1D,IAAI,KAAa;GACrB,MAAM,UAAiD,EAAE;AACzD,QAAK,MAAM,OAAO,KAAK,KACrB,SAAQ,OAAO,SAAS,IAAI,IAAI,GAAG,YAAY;AAEjD,UAAO,KAAK,KAAK,UAAU,SAAS,MAAM,EAAE,CAAC;;EAEhD,CAAC;CAEF,MAAM,eAAe,WAAW;EAC9B,MAAM;EACN,OAAO;EACP,aACE;EACF,eACE;EACF,YAAY,KAAK,OAAO;GACtB,UAAU,KAAK,OAAO,EACpB,aAAa,2BACd,CAAC;GACF,QAAQ,KAAK,OACX,KAAK,QAAQ,EACb,KAAK,MAAM,CAAC,KAAK,QAAQ,EAAE,KAAK,OAAO,EAAE,WAAW,KAAK,QAAQ,EAAE,CAAC,CAAC,CAAC,EACtE,EACE,aACE,wEACH,CACF;GACF,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;GACvB,MAAM,YAAY,OAAO,KAAK,KAAK,OAAO,CAAC,MACxC,MAAM,EAAE,aAAa,KAAK,cAC5B;AACD,OAAI,UACF,QAAO,KACL,WAAW,UAAU,iHACtB;GAGH,MAAM,aAAa,qBAAqB,KAAK,QAAQ,YAAY;AACjE,OAAI,CAAC,WAAW,GACd,QAAO,KACL,4BAA4B,WAAW,UAAU,aAAa,WAAW,IAAI,0GAC9E;GAEH,MAAM,WAAW,eAAe,kBAAkB,KAAK,SAAS;GAIhE,MAAM,SAAS,eAHE,GAAG,WAAW,SAAS,GACpC,MAAM,GAAG,SAAS,SAAS,UAAU,OAAO,GAC5C,IACoC,WAAW,OAAO;GAC1D,MAAM,MAAM,KAAK,QAAQ,SAAS;AAClC,OAAI,CAAC,GAAG,WAAW,IAAI,CACrB,OAAM,GAAG,SAAS,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC;AACnD,SAAM,GAAG,SAAS,UAAU,UAAU,QAAQ,OAAO;AACrD,aACE,wBAAwB,SAAS,QAAQ,OAAO,KAAK,KAAK,OAAO,CAAC,KAChE,IACD,GACF;AACD,UAAO,KACL,SAAS,OAAO,KAAK,KAAK,OAAO,CAAC,OAAO,aAAa,KAAK,SAAS,GACrE;;EAEJ,CAAC;CAEF,MAAM,WAAW,WAAW;EAC1B,MAAM;EACN,OAAO;EACP,aACE;EACF,eACE;EACF,YAAY,KAAK,OAAO,EAAE,CAAC;EAC3B,MAAM,UAAU;GACd,MAAM,SAAS,MAAM,qBAAqB,iBAAiB;AAC3D,aACE,gCAAgC,OAAO,SAAS,OAAO,WACxD;AACD,UAAO,KAAK,KAAK,UAAU,QAAQ,MAAM,EAAE,CAAC;;EAE/C,CAAC;CAIF,MAAM,YAAY,WAAW;EAC3B,MAAM;EACN,OAAO;EACP,aACE;EAMF,eACE;EACF,YAAY,KAAK,OAAO,EACtB,WAAW,KAAK,MACd,KAAK,OAAO;GACV,IAAI,KAAK,OAAO,EACd,aAAa,iDACd,CAAC;GACF,QAAQ,KAAK,OAAO,EAClB,aAAa,mCACd,CAAC;GACF,MAAM,KAAK,MACT;IACE,KAAK,QAAQ,SAAS;IACtB,KAAK,QAAQ,QAAQ;IACrB,KAAK,QAAQ,OAAO;IACrB,EACD,EACE,aACE,yFACH,CACF;GACD,SAAS,KAAK,SACZ,KAAK,MACH,KAAK,OAAO;IACV,OAAO,KAAK,QAAQ;IACpB,OAAO,KAAK,QAAQ;IACpB,aAAa,KAAK,SAAS,KAAK,QAAQ,CAAC;IAC1C,CAAC,EACF,EACE,aACE,yDACH,CACF,CACF;GACD,UAAU,KAAK,SACb,KAAK,QAAQ,EAAE,aAAa,oBAAoB,CAAC,CAClD;GACD,WAAW,KAAK,SACd,KAAK,QAAQ,EACX,aACE,6PACH,CAAC,CACH;GACF,CAAC,EACF;GAAE,UAAU;GAAG,UAAU;GAAG,CAC7B,EACF,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;AACvB,OAAI,CAAC,UACH,QAAO,KACL,yJACD;GAGH,MAAM,MAAM,eACV,cACA,iBACA,mBACD;AACD,OAAI,IAAI,SAAS,UAAU;AACzB,QAAI,IAAI,WAAW,YAAa,sBAAqB;AACrD,cACE,kCAAkC,IAAI,OAAO,SAAS,eACvD;AACD,cAAU,cAAc,qBAAqB;KAC3C,QAAQ,IAAI;KACZ,YAAY;KACZ,eAAe;KAChB,CAAC;AACF,WAAO,KAAK,IAAI,QAAQ;;GAI1B,MAAM,sBAAM,IAAI,KAAa;AAC7B,QAAK,MAAM,KAAK,KAAK,WAAW;AAC9B,SAAK,EAAE,SAAS,YAAY,EAAE,SAAS,YAAY,CAAC,EAAE,SAAS,OAC7D,QAAO,KACL,oBAAoB,EAAE,GAAG,cAAc,EAAE,KAAK,8EAC/C;AAEH,QAAI,EAAE,aAAa,EAAE,SAAS,OAC5B,QAAO,KACL,oBAAoB,EAAE,GAAG,kCAAkC,EAAE,KAAK,+CACnE;AAEH,QAAI,IAAI,IAAI,EAAE,GAAG,CACf,QAAO,KACL,iCAAiC,EAAE,GAAG,qCACvC;AAEH,QAAI,IAAI,EAAE,GAAG;;AAKf,mBAAgB;AAGhB,wBAAqB,KAAK;AAC1B,OAAI;IACF,MAAM,UAAU,MAAM,UAAU,QAAQ,EAAE,WAAW,KAAK,WAAW,CAAC;AACtE,QAAI,iBAAiB,QAAQ,CAAE,iBAAgB;IAG/C,MAAM,YAAY,sBAChB,KAAK,WACL,SACA,YACD;AACD,cACE,6BACE,OAAO,KAAK,QAAQ,CAAC,OACtB,iBAAiB,KAAK,UAAU,OAAO,cACzC;AACD,WAAO,KAAK,KAAK,UAAU,EAAE,SAAS,WAAW,EAAE,MAAM,EAAE,CAAC;YACrD,KAAK;AACZ,oBAAgB;IAChB,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAChE,cAAU,2BAA2B,UAAU;AAC/C,WAAO,KAAK,6BAA6B,UAAU;aAC3C;AACR,yBAAqB,MAAM;;;EAGhC,CAAC;CAqBF,MAAM,QAAQ;EACZ;EACA;EACA;EACA;EACA;EAEA,SAzByB,WAAW;GACpC,MAAM;GACN,OAAO;GACP,aAAa;GACb,eACE;GACF,YAAY,KAAK,OAAO,EACtB,SAAS,KAAK,OAAO,EACnB,aAAa,qCACd,CAAC,EACH,CAAC;GACF,QAAQ,KAAK,MAAM;IACjB,MAAM,SAAS,eAAe,KAAK,QAAQ;AAC3C,cAAU,yBAAyB,OAAO,UAAU;AACpD,WAAO,QAAQ,QAAQ,KAAK,OAAO,QAAQ,CAAC;;GAE/C,CAAC,EAS6B,aAAa;EAC3C;AAOD,KAAI,EADF,IAAI,iBAAiB,SAAS,kBAAkB,UAAU,IAAI,OAC5C,OAAM,KAAK,SAAS,WAAW,aAAa,CAAC;AACjE,QAAO"}

package/dist/{wizard-abort-DRscjUOg.js → wizard-abort-D6jJh8u5.js}

@@ -1,5 +1,5 @@
-import { f as getUI, s as logToFile } from "./debug-BYIoy1Oz.js";
-import { n as analytics } from "./analytics-YLZKudpE.js";
+import { f as getUI, s as logToFile } from "./debug-hy6aWAyk.js";
+import { n as analytics } from "./analytics-D3vKvr3l.js";
 import "./wizard-session-BUhlJ1b8.js";
 //#region src/utils/wizard-abort.ts
 /**
@@ -46,4 +46,4 @@ async function wizardAbort(options) {
 //#endregion
 export { wizardAbort as i, registerCleanup as n, runCleanups as r, WizardError as t };
 
-//# sourceMappingURL=wizard-abort-DRscjUOg.js.map
+//# sourceMappingURL=wizard-abort-D6jJh8u5.js.map

package/dist/{wizard-abort-DRscjUOg.js.map → wizard-abort-D6jJh8u5.js.map}

@@ -1 +1 @@
-{"version":3,"file":"wizard-abort-DRscjUOg.js","names":[],"sources":["../src/utils/wizard-abort.ts"],"sourcesContent":["/**\n * Single exit point for the wizard. Use instead of process.exit() directly.\n *\n * Sequence: cleanup -> error capture (optional) -> analytics shutdown -> outro -> process.exit\n *\n * WizardError is a data carrier passed to wizardAbort() for analytics context, never thrown.\n * The legacy abort() in setup-utils.ts delegates here.\n */\nimport { analytics } from './analytics';\nimport { logToFile } from './debug';\nimport { getUI } from '@ui';\nimport { OutroKind, type OutroData } from '@lib/wizard-session';\n\nexport class WizardError extends Error {\n  constructor(\n    message: string,\n    public readonly context?: Record<string, unknown>,\n  ) {\n    super(message);\n    this.name = 'WizardError';\n  }\n}\n\ninterface WizardAbortOptions {\n  message?: string;\n  /** Structured error data. Renders via `outroError` instead of `outro`. */\n  outroData?: OutroData;\n  error?: Error | WizardError;\n  exitCode?: number;\n}\n\nconst cleanupFns: Array<() => void> = [];\n\nexport function registerCleanup(fn: () => void): void {\n  cleanupFns.push(fn);\n}\n\nexport function clearCleanup(): void {\n  cleanupFns.length = 0;\n}\n\n/** Runs all registered cleanup functions and drains the array. */\nexport function runCleanups(): void {\n  const fns = cleanupFns.splice(0);\n  for (const fn of fns) {\n    try {\n      fn();\n    } catch {\n      /* cleanup should not prevent exit */\n    }\n  }\n}\n\nexport async function wizardAbort(\n  options?: WizardAbortOptions,\n): Promise<never> {\n  const {\n    message = 'Wizard setup cancelled.',\n    outroData,\n    error,\n    exitCode = 1,\n  } = options ?? {};\n\n  logToFile(`[wizard-abort] exitCode=${exitCode}, message: ${message}`);\n  if (error) {\n    logToFile('[wizard-abort] error:', error);\n  }\n\n  // 1. Run registered cleanup functions\n  runCleanups();\n\n  // 2. Capture error in analytics (if provided)\n  if (error) {\n    analytics.captureException(error, {\n      ...((error instanceof WizardError && error.context) || {}),\n    });\n  }\n\n  // 3. Shutdown analytics\n  await analytics.shutdown(error ? 'error' : 'cancelled');\n\n  // 4. Render the error outro. Synthesize OutroData from `message`\n  //    when the caller didn't provide structured data.\n  const ui = getUI();\n  ui.outroError(outroData ?? { kind: OutroKind.Error, message });\n\n  // 5. Wait for the user to dismiss the outro screen. In a TUI this gives\n  //    them time to read the error; in non-TUI environments it resolves\n  //    immediately.\n  await ui.waitForOutroDismissed();\n\n  // 6. Exit (fires 'exit' event so TUI cleanup runs)\n  return process.exit(exitCode);\n}\n"],"mappings":";;;;;;;;;;;;AAaA,IAAa,cAAb,cAAiC,MAAM;CACrC,YACE,SACA,SACA;AACA,QAAM,QAAQ;AAFE,OAAA,UAAA;AAGhB,OAAK,OAAO;;;AAYhB,MAAM,aAAgC,EAAE;AAExC,SAAgB,gBAAgB,IAAsB;AACpD,YAAW,KAAK,GAAG;;;AAQrB,SAAgB,cAAoB;CAClC,MAAM,MAAM,WAAW,OAAO,EAAE;AAChC,MAAK,MAAM,MAAM,IACf,KAAI;AACF,MAAI;SACE;;AAMZ,eAAsB,YACpB,SACgB;CAChB,MAAM,EACJ,UAAU,2BACV,WACA,OACA,WAAW,MACT,WAAW,EAAE;AAEjB,WAAU,2BAA2B,SAAS,aAAa,UAAU;AACrE,KAAI,MACF,WAAU,yBAAyB,MAAM;AAI3C,cAAa;AAGb,KAAI,MACF,WAAU,iBAAiB,OAAO,EAChC,GAAK,iBAAiB,eAAe,MAAM,WAAY,EAAE,EAC1D,CAAC;AAIJ,OAAM,UAAU,SAAS,QAAQ,UAAU,YAAY;CAIvD,MAAM,KAAK,OAAO;AAClB,IAAG,WAAW,aAAa;EAAE,MAAA;EAAuB;EAAS,CAAC;AAK9D,OAAM,GAAG,uBAAuB;AAGhC,QAAO,QAAQ,KAAK,SAAS"}
+{"version":3,"file":"wizard-abort-D6jJh8u5.js","names":[],"sources":["../src/utils/wizard-abort.ts"],"sourcesContent":["/**\n * Single exit point for the wizard. Use instead of process.exit() directly.\n *\n * Sequence: cleanup -> error capture (optional) -> analytics shutdown -> outro -> process.exit\n *\n * WizardError is a data carrier passed to wizardAbort() for analytics context, never thrown.\n * The legacy abort() in setup-utils.ts delegates here.\n */\nimport { analytics } from './analytics';\nimport { logToFile } from './debug';\nimport { getUI } from '@ui';\nimport { OutroKind, type OutroData } from '@lib/wizard-session';\n\nexport class WizardError extends Error {\n  constructor(\n    message: string,\n    public readonly context?: Record<string, unknown>,\n  ) {\n    super(message);\n    this.name = 'WizardError';\n  }\n}\n\ninterface WizardAbortOptions {\n  message?: string;\n  /** Structured error data. Renders via `outroError` instead of `outro`. */\n  outroData?: OutroData;\n  error?: Error | WizardError;\n  exitCode?: number;\n}\n\nconst cleanupFns: Array<() => void> = [];\n\nexport function registerCleanup(fn: () => void): void {\n  cleanupFns.push(fn);\n}\n\nexport function clearCleanup(): void {\n  cleanupFns.length = 0;\n}\n\n/** Runs all registered cleanup functions and drains the array. */\nexport function runCleanups(): void {\n  const fns = cleanupFns.splice(0);\n  for (const fn of fns) {\n    try {\n      fn();\n    } catch {\n      /* cleanup should not prevent exit */\n    }\n  }\n}\n\nexport async function wizardAbort(\n  options?: WizardAbortOptions,\n): Promise<never> {\n  const {\n    message = 'Wizard setup cancelled.',\n    outroData,\n    error,\n    exitCode = 1,\n  } = options ?? {};\n\n  logToFile(`[wizard-abort] exitCode=${exitCode}, message: ${message}`);\n  if (error) {\n    logToFile('[wizard-abort] error:', error);\n  }\n\n  // 1. Run registered cleanup functions\n  runCleanups();\n\n  // 2. Capture error in analytics (if provided)\n  if (error) {\n    analytics.captureException(error, {\n      ...((error instanceof WizardError && error.context) || {}),\n    });\n  }\n\n  // 3. Shutdown analytics\n  await analytics.shutdown(error ? 'error' : 'cancelled');\n\n  // 4. Render the error outro. Synthesize OutroData from `message`\n  //    when the caller didn't provide structured data.\n  const ui = getUI();\n  ui.outroError(outroData ?? { kind: OutroKind.Error, message });\n\n  // 5. Wait for the user to dismiss the outro screen. In a TUI this gives\n  //    them time to read the error; in non-TUI environments it resolves\n  //    immediately.\n  await ui.waitForOutroDismissed();\n\n  // 6. Exit (fires 'exit' event so TUI cleanup runs)\n  return process.exit(exitCode);\n}\n"],"mappings":";;;;;;;;;;;;AAaA,IAAa,cAAb,cAAiC,MAAM;CACrC,YACE,SACA,SACA;AACA,QAAM,QAAQ;AAFE,OAAA,UAAA;AAGhB,OAAK,OAAO;;;AAYhB,MAAM,aAAgC,EAAE;AAExC,SAAgB,gBAAgB,IAAsB;AACpD,YAAW,KAAK,GAAG;;;AAQrB,SAAgB,cAAoB;CAClC,MAAM,MAAM,WAAW,OAAO,EAAE;AAChC,MAAK,MAAM,MAAM,IACf,KAAI;AACF,MAAI;SACE;;AAMZ,eAAsB,YACpB,SACgB;CAChB,MAAM,EACJ,UAAU,2BACV,WACA,OACA,WAAW,MACT,WAAW,EAAE;AAEjB,WAAU,2BAA2B,SAAS,aAAa,UAAU;AACrE,KAAI,MACF,WAAU,yBAAyB,MAAM;AAI3C,cAAa;AAGb,KAAI,MACF,WAAU,iBAAiB,OAAO,EAChC,GAAK,iBAAiB,eAAe,MAAM,WAAY,EAAE,EAC1D,CAAC;AAIJ,OAAM,UAAU,SAAS,QAAQ,UAAU,YAAY;CAIvD,MAAM,KAAK,OAAO;AAClB,IAAG,WAAW,aAAa;EAAE,MAAA;EAAuB;EAAS,CAAC;AAK9D,OAAM,GAAG,uBAAuB;AAGhC,QAAO,QAAQ,KAAK,SAAS"}

package/dist/{wizard-abort-BUpx4qnK.js → wizard-abort-PgTdRS1l.js}

@@ -1,2 +1,2 @@
-import { i as wizardAbort, t as WizardError } from "./wizard-abort-DRscjUOg.js";
+import { i as wizardAbort, t as WizardError } from "./wizard-abort-D6jJh8u5.js";
 export { WizardError, wizardAbort };

package/dist/yara-hooks-CN_uFGCu.js

@@ -0,0 +1,2 @@
+import { l as prewarmYaraScanner } from "./yara-hooks-DjReXmTQ.js";
+export { prewarmYaraScanner };

package/dist/{yara-hooks-DKRsn0lN.js → yara-hooks-DjReXmTQ.js}

@@ -1,6 +1,6 @@
-import { f as getUI, s as logToFile, u as WIZARD_YARA_REPORT_FILE } from "./debug-BYIoy1Oz.js";
-import { n as analytics } from "./analytics-YLZKudpE.js";
-import { r as readFileHead } from "./bounded-fs-CYxETRCt.js";
+import { f as getUI, s as logToFile, u as WIZARD_YARA_REPORT_FILE } from "./debug-hy6aWAyk.js";
+import { n as analytics } from "./analytics-D3vKvr3l.js";
+import { r as readFileHead } from "./bounded-fs-BeWc675I.js";
 import fs from "fs";
 import path from "path";
 import fg from "fast-glob";
@@ -732,4 +732,4 @@ async function scanSkillFiles(cwd, skillDir, llmProvider) {
 //#endregion
 export { scanVerdict as C, SETUP_REPORT_FILE as S, AUDIT_CHECKS_KEY as _, flushScanReport as a, coerceAuditChecks as b, isWizardDocumentationPath as c, repeatBlockReason as d, scanAndTriage as f, AUDIT_CHECKS_FILE as g, EVENT_PLAN_FILE as h, createRepeatBlockTracker as i, prewarmYaraScanner as l, writeScanReport as m, createPostToolUseYaraHooks as n, formatScanReport as o, scanInstalledSkill as p, createPreToolUseYaraHooks as r, formatYaraAbortMessage as s, captureScanReport as t, recordExternalScan as u, AUDIT_REPORT_FILE as v, getAuditChecks as x, AUDIT_SEVERITY_STYLE as y };
 
-//# sourceMappingURL=yara-hooks-DKRsn0lN.js.map
+//# sourceMappingURL=yara-hooks-DjReXmTQ.js.map

package/dist/{yara-hooks-DKRsn0lN.js.map → yara-hooks-DjReXmTQ.js.map}

@@ -1 +1 @@
-{"version":3,"file":"yara-hooks-DKRsn0lN.js","names":["EVENTS_AUDIT_REPORT_FILE"],"sources":["../src/lib/skill-install.ts","../src/lib/yara-policy.ts","../src/lib/programs/events-audit/constants.ts","../src/lib/programs/audit/types.ts","../src/lib/programs/posthog-integration/constants.ts","../src/lib/yara-hooks.ts"],"sourcesContent":["/**\n * Check if command is a PostHog skill installation from MCP.\n * We control the MCP server, so we only need to verify:\n * 1. It installs to .claude/skills/\n * 2. It downloads from our GitHub releases or localhost (dev)\n *\n * Extracted to its own module to avoid a circular dependency\n * between agent-interface.ts and yara-hooks.ts.\n */\nexport function isSkillInstallCommand(command: string): boolean {\n  if (!command.startsWith('mkdir -p .claude/skills/')) return false;\n\n  const urlMatch = command.match(/curl -sL ['\"]([^'\"]+)['\"]/);\n  if (!urlMatch) return false;\n\n  const url = urlMatch[1];\n  return (\n    url.startsWith('https://github.com/PostHog/context-mill/releases/') ||\n    /^http:\\/\\/localhost:\\d+\\//.test(url)\n  );\n}\n","/**\n * Shared YARA scan policy: the vocabulary every scan surface speaks, and the\n * one decision they all make — does a set of matches terminate the session, or\n * only warn. Both fences (the anthropic PostToolUse hooks in `yara-hooks.ts`\n * and the pi tool_result extension in `harness/pi/security.ts`) resolve a\n * verdict here rather than each re-deriving it from severity and action.\n */\n\nimport type { ScanMatch } from '@posthog/warlock';\n\n/** Which content surface a warlock rule applies to (from rule `scan_context`). */\nexport type ScanContext = 'command' | 'input' | 'output';\n\n/** What a fence did about a match, as recorded in the scan report. */\nexport type ScanAction = 'blocked' | 'reverted' | 'warned' | 'aborted';\n\n/** Severity order, highest first, for picking the match worth reporting. */\nconst SEVERITY_RANK: Record<string, number> = {\n  critical: 4,\n  high: 3,\n  medium: 2,\n  low: 1,\n};\n\n/** Severities that end the session. Critical only — nothing below it is worth killing a run over. */\nconst TERMINAL_SEVERITIES = new Set(['critical']);\n\n/**\n * The match that ends the session rather than just warning. Severity alone\n * decides: a rule's `action: 'block'` is a recommendation about the *operation*\n * (PreToolUse still refuses the command), not a licence to end the run. Medium\n * and high `block` rules fire on first-party content often enough that\n * terminating on them costs more than it prevents.\n */\nexport function isTerminalMatch(match: ScanMatch): boolean {\n  return TERMINAL_SEVERITIES.has(match.metadata.severity ?? '');\n}\n\n/** Return the highest-severity match from a list of matches. */\nexport function highestSeverityMatch(matches: ScanMatch[]): ScanMatch {\n  return matches.reduce((worst, m) =>\n    (SEVERITY_RANK[m.metadata.severity ?? ''] ?? 0) >\n    (SEVERITY_RANK[worst.metadata.severity ?? ''] ?? 0)\n      ? m\n      : worst,\n  );\n}\n\nexport interface ScanVerdict {\n  /** The match worth reporting: the highest-severity one. */\n  match: ScanMatch;\n  /** Session ends now; anything else is advisory. */\n  terminal: boolean;\n  /** How the scan report records it. */\n  action: ScanAction;\n}\n\n/** Resolve what a fence should do about a set of matches. Null when clean. */\nexport function scanVerdict(matches: ScanMatch[]): ScanVerdict | null {\n  if (matches.length === 0) return null;\n  const match = highestSeverityMatch(matches);\n  const terminal = isTerminalMatch(match);\n  return { match, terminal, action: terminal ? 'aborted' : 'warned' };\n}\n","/**\n * Leaf-level constants for the events-audit program.\n *\n * Kept separate from `index.ts` so files like `yara-hooks.ts` can import\n * the filename constants without dragging in `index.ts`'s heavier imports\n * (agent-runner, audit/seed, etc.) — which can create import cycles.\n */\n\nexport const SETUP_REPORT_FILE = 'posthog-events-audit-report.md';\nexport const EVENT_INVENTORY_FILE = '.posthog-events-inventory.json';\n/** Per-part filename pattern emitted by events-audit subagents (e.g. `.posthog-events-inventory.part-3.json`). */\nexport const EVENT_INVENTORY_PART_PATTERN =\n  /^\\.posthog-events-inventory\\.part-\\d+\\.json$/;\n","import type { WizardSession } from '@lib/wizard-session';\n\nexport type AuditStatus =\n  | 'pending'\n  | 'pass'\n  | 'error'\n  | 'warning'\n  | 'suggestion';\n\nexport interface AuditCheck {\n  id: string;\n  area: string;\n  label: string;\n  status: AuditStatus;\n  file?: string;\n  details?: string;\n}\n\nexport interface AuditSeverityStyle {\n  glyph: string;\n  color: string;\n}\n\n/** Single source of truth for status glyph + color across audit views. */\nexport const AUDIT_SEVERITY_STYLE: Record<AuditStatus, AuditSeverityStyle> = {\n  pending: { glyph: '◌', color: 'gray' },\n  pass: { glyph: '✔', color: 'green' },\n  error: { glyph: '✘', color: 'red' },\n  warning: { glyph: '⚠', color: 'yellow' },\n  suggestion: { glyph: '•', color: 'cyan' },\n};\n\nexport const AUDIT_CHECKS_FILE = '.posthog-audit-checks.json';\nexport const AUDIT_REPORT_FILE = 'posthog-audit-report.md';\nexport const AUDIT_CHECKS_KEY = 'auditChecks';\n\nexport function getAuditChecks(session: WizardSession): AuditCheck[] {\n  const raw = session.frameworkContext[AUDIT_CHECKS_KEY];\n  return Array.isArray(raw) ? (raw as AuditCheck[]) : [];\n}\n\n/**\n * Read the audit checks ledger off disk. Validation lives at write time —\n * every writer (`audit_seed_checks` / `audit_add_checks` / `audit_resolve_checks`\n * MCP tools, `seedAuditLedger`) zod-parses entries before the atomic write,\n * so by the time the file watcher fires we trust the shape and only guard\n * against the file not being a JSON array (corrupted / hand-edited / not yet\n * seeded).\n */\nexport function coerceAuditChecks(parsed: unknown): AuditCheck[] {\n  return Array.isArray(parsed) ? (parsed as AuditCheck[]) : [];\n}\n","/**\n * Leaf-level constants for the posthog-integration program.\n *\n * Kept separate from `index.ts` so files like `yara-hooks.ts` can import\n * the filename constants without dragging in `index.ts`'s heavier imports\n * (agent-interface, framework-config, etc.) — which would create an import\n * cycle through agent-interface → yara-hooks.\n */\n\nexport const EVENT_PLAN_FILE = '.posthog-events.json';\n","/**\n * YARA hook wiring for the Claude Agent SDK.\n *\n * Creates PreToolUse and PostToolUse hook callback arrays that integrate the\n * real @posthog/warlock security scanner (YARA-X via WASM) into the wizard's\n * agent loop. These hooks are registered in the SDK's query() options alongside\n * the existing Stop hook.\n *\n * PreToolUse hooks block dangerous commands before execution. PostToolUse hooks\n * detect violations in written code and prompt injection in read content, and\n * scan context-mill skill downloads.\n *\n * Warlock owns the rules; this file owns the *policy* — how a match maps to a\n * block / revert / terminate response, plus the optional LLM triage pass that\n * filters false positives before we act.\n *\n * Naming: \"yara\" is the technique — scanning content against YARA rules — so the\n * wizard-side wiring keeps that name. \"warlock\" is the engine package that runs\n * the rules. Both names showing up here is intentional.\n *\n * This is Layer 2 (L2) in the wizard's defense-in-depth model, complementing the\n * prompt-based commandments (L0) and the canUseTool() allowlist (L1).\n */\n\nimport fs from 'fs';\nimport path from 'path';\nimport { createHash } from 'crypto';\nimport fg from 'fast-glob';\nimport type {\n  ScanMatch,\n  TriageMatch,\n  LLMProvider,\n  Category,\n} from '@posthog/warlock';\nimport { logToFile } from '@utils/debug';\nimport { readFileHead } from '@utils/bounded-fs';\nimport { analytics } from '@utils/analytics';\nimport { getUI } from '@ui';\nimport type { WizardSession } from '@lib/wizard-session';\nimport { isSkillInstallCommand } from './skill-install';\nimport { highestSeverityMatch, scanVerdict } from './yara-policy';\nimport type { ScanAction, ScanContext } from './yara-policy';\nimport { WIZARD_YARA_REPORT_FILE } from '@utils/paths';\n// TODO(wizard#594): invert this dependency.\n// L2 infra (yara-hooks) imports product-specific filename constants from\n// individual programs. The leaf `constants.ts` modules break the *import*\n// cycle but don't fix the *layering* concern: this file knowing about\n// `events-audit`, `posthog-integration`, and `audit` violates \"product\n// knowledge never enters infrastructure code.\" Proper fix is inverted —\n// programs declare their own doc paths, the hooks read from a generic\n// registry. For now: every new program emitting a PII-shaped report has\n// to be added here. Land that cleanup before adding a fourth entry.\nimport {\n  SETUP_REPORT_FILE as EVENTS_AUDIT_REPORT_FILE,\n  EVENT_INVENTORY_FILE,\n  EVENT_INVENTORY_PART_PATTERN,\n} from '@lib/programs/events-audit/constants';\nimport { AUDIT_REPORT_FILE } from '@lib/programs/audit/types';\nimport { EVENT_PLAN_FILE } from '@lib/programs/posthog-integration/constants';\n\n// ─── Warlock module accessor ─────────────────────────────────────\n// Warlock is ESM-only and lazily inits its WASM engine + compiles rules on the\n// first scan() call. We import it once and cache the module promise so the\n// warmed engine (a warlock-internal singleton) is shared across every hook.\n// Mirrors the lazy `await import(...)` pattern used for the agent SDK.\n\ntype WarlockModule = typeof import('@posthog/warlock');\n\nlet warlockModulePromise: Promise<WarlockModule> | null = null;\n\nfunction getWarlock(): Promise<WarlockModule> {\n  if (!warlockModulePromise) {\n    // Clear the cache on rejection so a transient failure (flaky disk, ESM\n    // resolver hiccup) doesn't poison the cache for the rest of the process\n    // lifetime. Without this, one rejected import permanently locks every\n    // hook into fail-closed-terminate until restart.\n    warlockModulePromise = import('@posthog/warlock').catch((err) => {\n      warlockModulePromise = null;\n      throw err;\n    });\n  }\n  return warlockModulePromise;\n}\n\n/**\n * Pay the WASM-init + rule-compile cost up front, off the hook path, so the\n * first real tool-call scan doesn't eat cold-start under a hook timeout.\n * Best-effort: a failure here is non-fatal — hooks still fail closed per scan.\n */\nexport async function prewarmYaraScanner(): Promise<void> {\n  try {\n    const warlock = await getWarlock();\n    await warlock.scan('');\n    logToFile('[YARA] warlock pre-warmed');\n  } catch (err) {\n    logToFile('[YARA] warlock pre-warm failed:', err);\n  }\n}\n\n// ─── Types ───────────────────────────────────────────────────────\n// Loose hook types to avoid tight coupling to the SDK version.\n// The SDK hook types are: HookCallbackMatcher[], where each matcher\n// has { matcher?: string, hooks: HookCallback[], timeout?: number }\n\ntype HookInput = Record<string, unknown>;\ntype HookOutput = Record<string, unknown>;\ntype HookCallback = (\n  input: HookInput,\n  toolUseID: string | undefined,\n  options: { signal: AbortSignal },\n) => Promise<HookOutput>;\n\nexport interface HookCallbackMatcher {\n  matcher?: string;\n  hooks: HookCallback[];\n  timeout?: number;\n}\n\nexport type { ScanAction, ScanContext } from './yara-policy';\n\n// ─── Scan Report Accumulator ─────────────────────────────────────\n\ninterface ScanReportEntry {\n  rule: string;\n  severity: string;\n  category: string;\n  action: ScanAction;\n  phase: string;\n  tool: string;\n  /** Rule description — the human-readable \"why\". Rule-static, safe to report. */\n  description: string;\n  /** Triage outcome, when triage ran. */\n  triageVerdict?: string;\n  /**\n   * Free-text triage rationale. May quote scanned content, so it is written to\n   * the local report file only — NEVER sent to PostHog (see captureScanReport).\n   */\n  triageReason?: string;\n}\n\nlet scanCount = 0;\nconst scanViolations: ScanReportEntry[] = [];\n\nfunction recordScan(): void {\n  scanCount++;\n}\n\n// recordMatch is the single entry point for a violation (log + telemetry +\n// report). scanViolations is appended only there.\n\n/**\n * Log a match to the run log + PostHog, and record it in the run's scan report.\n * Single entry point so every violation is reported consistently.\n */\nfunction recordMatch(\n  phase: string,\n  tool: string,\n  match: ScanMatch,\n  action: ScanAction,\n): void {\n  const triage = (match as TriageMatch).triage;\n  logYaraMatch(phase, tool, match, action);\n  scanViolations.push({\n    rule: match.rule,\n    severity: match.metadata.severity ?? 'unknown',\n    category: match.metadata.category ?? 'unknown',\n    action,\n    phase,\n    tool,\n    description: match.metadata.description ?? '',\n    triageVerdict: triage?.verdict,\n    triageReason: triage?.reason,\n  });\n}\n\n/** Reset counters (for testing) */\nexport function resetScanReport(): void {\n  scanCount = 0;\n  scanViolations.length = 0;\n}\n\n/**\n * Scan bookkeeping for harnesses that run a scanner outside these hooks (pi):\n * counts the scan and routes violations through `recordMatch`, so they reach\n * the run log, per-match telemetry, and the end-of-run scan report.\n */\nexport function recordExternalScan(\n  phase: string,\n  tool: string,\n  violations: Array<{\n    rule: string;\n    severity: string;\n    category: string;\n    description: string;\n  }>,\n  action: ScanAction,\n): void {\n  recordScan();\n  for (const v of violations) {\n    recordMatch(\n      phase,\n      tool,\n      {\n        rule: v.rule,\n        metadata: {\n          severity: v.severity as ScanMatch['metadata']['severity'],\n          category: v.category as ScanMatch['metadata']['category'],\n          description: v.description,\n        },\n        matchedStrings: [],\n      },\n      action,\n    );\n  }\n}\n\n/** Format the scan report summary. Returns null if no scans occurred */\nexport function formatScanReport(): string | null {\n  if (scanCount === 0) return null;\n\n  const lines: string[] = ['', '— YARA Scanner Summary —'];\n  const violationCount = scanViolations.length;\n  const cleanCount = scanCount - violationCount;\n\n  lines.push(\n    `✓ ${scanCount} tool calls scanned, ${violationCount} violation${\n      violationCount !== 1 ? 's' : ''\n    } detected`,\n  );\n\n  if (violationCount > 0) {\n    lines.push('');\n    for (const v of scanViolations) {\n      const tag = v.action.toUpperCase();\n      lines.push(\n        `  [${tag}] ${v.rule} (${v.severity.toUpperCase()}) — ${v.phase}:${\n          v.tool\n        }`,\n      );\n    }\n  }\n\n  if (cleanCount > 0) {\n    lines.push('');\n    lines.push(\n      `No violations: ✓ ${cleanCount} clean scan${cleanCount !== 1 ? 's' : ''}`,\n    );\n  }\n\n  lines.push('');\n  return lines.join('\\n');\n}\n\n/** Write the scan report to a JSON file. Returns the file path, or null if no scans occurred. */\nexport function writeScanReport(): string | null {\n  if (scanCount === 0) return null;\n\n  const report = {\n    summary: {\n      totalScans: scanCount,\n      violations: scanViolations.length,\n      clean: scanCount - scanViolations.length,\n    },\n    violations: scanViolations,\n  };\n\n  try {\n    fs.writeFileSync(WIZARD_YARA_REPORT_FILE, JSON.stringify(report, null, 2));\n  } catch (err) {\n    logToFile('[YARA] Failed to write scan report:', err);\n    return null;\n  }\n  return WIZARD_YARA_REPORT_FILE;\n}\n\n// ─── User-facing abort copy ──────────────────────────────────────\n//\n// The abort screen is the one security surface a user actually sees, so it must\n// say what was caught and that we protected them, in plain language, instead of\n// a bare \"Security violation detected.\" Warlock owns the rules and categories;\n// this map is the wizard's *presentation* of a category it already detected. We\n// deliberately do not surface warlock's own rule `description` here: it is\n// written for maintainers (it ships to telemetry) and reads as technical. The\n// `Category` type is a stable, append-only warlock API, so a new category just\n// falls through to the generic line below rather than breaking the build.\n\nconst CATEGORY_DESCRIPTIONS: Record<Category, string> = {\n  prompt_injection:\n    'hit hidden instructions in a file it read, a possible attempt to hijack the setup',\n  exfiltration: 'tried to send data to an outside location',\n  destructive_operations: 'tried to run a destructive command',\n  supply_chain: 'tried to pull in untrusted code',\n  posthog_pii: 'tried to write personal data (PII) into your project',\n  posthog_hardcoded_key: 'tried to hardcode a PostHog key into your project',\n  hardcoded_secret: 'tried to hardcode a secret into your project',\n};\n\n/** Most recent violation that terminated the run, or null. */\nfunction lastTerminatingViolation(): ScanReportEntry | null {\n  for (let i = scanViolations.length - 1; i >= 0; i--) {\n    if (scanViolations[i].action === 'aborted') return scanViolations[i];\n  }\n  return null;\n}\n\n/**\n * Build the user-facing copy for the security abort screen: what the scanner\n * caught and what we did about it. This screen renders only because the run was\n * stopped, so the \"what we did\" half is constant. Falls back to a generic line\n * when no specific violation was recorded (e.g. the scanner itself errored and\n * failed closed before a match was logged).\n */\nexport function formatYaraAbortMessage(): string {\n  const v = lastTerminatingViolation();\n  const what =\n    (v && CATEGORY_DESCRIPTIONS[v.category as Category]) ??\n    'did something our security scanner flagged';\n\n  return (\n    'Security check stopped the setup.\\n\\n' +\n    `The agent ${what}. We stopped the run to keep your project safe.\\n` +\n    'No unsafe changes were left in your project.\\n\\n' +\n    'If this looks wrong, let us know: wizard@posthog.com'\n  );\n}\n\n// ─── Hook Timeouts (ms) ─────────────────────────────────────────\n// Generous because triage adds an LLM round-trip, and because a *fired* hook\n// timeout means the protective action is dropped (fail-open). The triage HTTP\n// call has its own shorter internal timeout (see agent-interface), so a hung\n// triage fails inside our catch (fail-closed) before these fire.\n\n/** Timeout for scan hooks (PreToolUse, PostToolUse Write/Edit/Read/Grep) */\nconst HOOK_TIMEOUT_MS = 30_000;\n/** Timeout for the skill install hook (filesystem I/O + multiple scans) */\nconst SKILL_SCAN_HOOK_TIMEOUT_MS = 30_000;\n\n/**\n * Chunk size for scanning (100 KB). Oversized content is scanned in\n * overlapping chunks so coverage is complete — nothing is silently truncated.\n * The size also bounds what a single triage call pastes into the LLM prompt\n * (~25K tokens), so triage always sees the chunk its matches came from.\n */\nconst SCAN_CHUNK_SIZE = 100_000;\n\n// A skill file is read at most this far; the rest is head-scanned and logged.\nconst SKILL_FILE_SCAN_BYTES = 10 * 1024 * 1024;\n/**\n * Overlap between adjacent chunks so a pattern straddling a chunk boundary\n * still lands whole inside at least one chunk. YARA rule strings are at most\n * a few hundred bytes; 4 KB is generous.\n */\nconst SCAN_CHUNK_OVERLAP = 4_096;\n\n// ─── Logging ─────────────────────────────────────────────────────\n\nfunction logYaraMatch(\n  phase: string,\n  tool: string,\n  match: ScanMatch,\n  action: ScanAction,\n): void {\n  const severity = match.metadata.severity ?? 'unknown';\n  const category = match.metadata.category ?? 'unknown';\n  const ruleAction = match.metadata.action ?? 'unknown';\n  const description = match.metadata.description ?? '';\n  logToFile(\n    `[YARA] ${phase}:${tool} [${action.toUpperCase()}] rule \"${match.rule}\" ` +\n      `(severity: ${severity}, category: ${category}, action: ${ruleAction})\\n` +\n      `  Description: ${description}`,\n  );\n  analytics.wizardCapture('yara rule matched', {\n    rule: match.rule,\n    severity: match.metadata.severity,\n    category: match.metadata.category,\n    rule_action: match.metadata.action,\n    action,\n    phase,\n    tool,\n    // Rule-static description — the \"why\". The free-text triage reason is\n    // deliberately omitted (it can quote scanned content; stays local-only).\n    description: match.metadata.description,\n    triage_verdict: (match as TriageMatch).triage?.verdict,\n  });\n}\n\n/**\n * Send the run's full scan report to PostHog so maintainers can see why a run\n * was flagged, warned, or aborted. This is the maintainer-facing report — it is\n * NEVER shown to the user. No-op if nothing was scanned. The free-text triage\n * reason is omitted to avoid sending scanned content off the user's machine.\n */\nexport function captureScanReport(): void {\n  if (scanCount === 0) return;\n  analytics.wizardCapture('yara scan report', {\n    total_scans: scanCount,\n    violation_count: scanViolations.length,\n    clean_count: scanCount - scanViolations.length,\n    violations: scanViolations.map((v) => ({\n      rule: v.rule,\n      severity: v.severity,\n      category: v.category,\n      action: v.action,\n      phase: v.phase,\n      tool: v.tool,\n      description: v.description,\n      triage_verdict: v.triageVerdict,\n    })),\n  });\n  // Reset after sending so a second captureScanReport on this same run\n  // (e.g. success-path call followed by an abort during shutdown) can't\n  // ship duplicate telemetry. Also protects future chained-program runs.\n  scanCount = 0;\n  scanViolations.length = 0;\n}\n\n/**\n * End-of-run flush for the scan report. Wired once at the runner seam so every\n * harness (linear, orchestrator, and any future shape) reports without having\n * to know warlock exists — scanning is already harness-agnostic (it runs from\n * SDK Pre/PostToolUse hooks), and this keeps reporting at a single shared seam.\n *\n * Order matters: write the local --yara-report file FIRST (it reads scanCount /\n * scanViolations), THEN send telemetry. captureScanReport() zeroes scan state,\n * which is what makes this whole function idempotent — a second call from\n * another termination path (e.g. finally after an abort already flushed) finds\n * scanCount === 0 and every step no-ops.\n */\nexport function flushScanReport(\n  session: Pick<WizardSession, 'yaraReport'>,\n): void {\n  if (session.yaraReport) {\n    const reportPath = writeScanReport();\n    if (reportPath) {\n      const summary = formatScanReport();\n      getUI().log.info(`YARA scan report: ${reportPath}${summary ?? ''}`);\n    }\n  }\n  captureScanReport();\n}\n\n// ─── Wizard-documentation allowlist ───────────────────────────────\n//\n// Files the wizard's own programs write to describe events the user's\n// codebase already captures, or events the integration program is\n// proposing to add. When the agent copies a literal\n// `posthog.capture('event', { email: ... })` snippet (or a property\n// list including PII-shaped keys) into one of these files, the\n// `pii_in_capture_call` rule (category: posthog_pii) fires even though\n// the wizard is documenting / planning, not introducing, the pattern.\n// Suppress posthog_pii matches on these paths only; every other rule\n// (secrets, prompt injection, supply chain, destructive ops) still\n// fires normally so the file cannot be used as a smuggling vector for\n// actual violations.\n\nconst WIZARD_DOC_BASENAMES = new Set([\n  EVENT_INVENTORY_FILE,\n  EVENTS_AUDIT_REPORT_FILE,\n  AUDIT_REPORT_FILE,\n  EVENT_PLAN_FILE,\n]);\n\nconst WIZARD_DOC_PATTERNS: RegExp[] = [EVENT_INVENTORY_PART_PATTERN];\n\nexport function isWizardDocumentationPath(\n  filePath: string | undefined,\n): boolean {\n  if (!filePath) return false;\n  const basename = path.basename(filePath);\n  if (WIZARD_DOC_BASENAMES.has(basename)) return true;\n  return WIZARD_DOC_PATTERNS.some((re) => re.test(basename));\n}\n\n// ─── Repeat-block tracker ─────────────────────────────────────────\n//\n// Field data (switchboard YARA tile): an agent whose edit gets blocked often\n// retries the identical payload — the scan is deterministic, so every retry\n// blocks again and the run burns turns (~4.2 blocks per affected run). The\n// runtime notes already say \"don't retry\"; the data shows the prompt alone\n// doesn't hold. This is the code-side guard: remember the exact payloads we\n// blocked, and when the same content comes back, escalate the block reason —\n// first to \"change the code, not the retry\", then to \"report it and move on\".\n// Used by both fences: the anthropic PreToolUse Bash hook below, and the pi\n// security extension's pre-execution scan (bash/write/edit).\n\n/** Identical-payload attempt at which the agent is told to move on. */\nconst REPEAT_BLOCK_MOVE_ON_ATTEMPT = 3;\n\nexport interface RepeatBlockTracker {\n  /**\n   * Record a YARA block of `content` on `tool`; returns the attempt count\n   * for that exact payload (1 = first time blocked).\n   */\n  attempt(tool: string, content: string): number;\n}\n\n/** Per-run tracker of YARA-blocked payloads (keyed by tool + content hash). */\nexport function createRepeatBlockTracker(): RepeatBlockTracker {\n  const counts = new Map<string, number>();\n  return {\n    attempt(tool: string, content: string): number {\n      const key = `${tool} ${createHash('sha256')\n        .update(content)\n        .digest('hex')}`;\n      const next = (counts.get(key) ?? 0) + 1;\n      counts.set(key, next);\n      return next;\n    },\n  };\n}\n\n/**\n * The block reason for the given attempt: the plain reason the first time,\n * an explicit \"this exact retry can never work\" on the second, and a\n * \"report it and move on\" instruction from the third on.\n */\nexport function repeatBlockReason(\n  attempt: number,\n  tool: string,\n  baseReason: string,\n): string {\n  if (attempt <= 1) return baseReason;\n  if (attempt < REPEAT_BLOCK_MOVE_ON_ATTEMPT) {\n    return (\n      `${baseReason} This exact ${tool} content was ALREADY blocked — the scan is ` +\n      'deterministic, so retrying identical content will always block again. ' +\n      'Change the code to remove the flagged pattern instead of retrying.'\n    );\n  }\n  return (\n    `${baseReason} This exact ${tool} content has now been blocked ${attempt} times. ` +\n    'STOP retrying it. Note the blocked change in the setup report and move on to the next task.'\n  );\n}\n\n// ─── Severity helpers ────────────────────────────────────────────\n// Severity vocabulary and the terminate-or-warn decision live in yara-policy.\n\n// ─── Scan + triage core ──────────────────────────────────────────\n\n/**\n * Keep only matches whose rule targets this content surface. Rules carry a\n * `scan_context` of 'command' | 'input' | 'output'. An undefined context is\n * treated as \"applies everywhere\" (fail-safe — a rule that forgets the tag\n * still gets enforced rather than silently skipped).\n */\nfunction matchesForContext(\n  matches: ScanMatch[],\n  ctx: ScanContext,\n): ScanMatch[] {\n  return matches.filter((m) => {\n    const c = m.metadata.scan_context as string | undefined;\n    return c === ctx || c === undefined;\n  });\n}\n\n/**\n * Drop false positives via warlock's LLM triage. Fail-closed: if no provider is\n * available, or the triage call throws, every match is treated as real — we\n * never silently suppress a flagged match.\n *\n * Every overruled match is reported to PostHog (rule metadata only, never the\n * free-text reason) so maintainers can alert on triage-overrule patterns — the\n * signal that someone is either tripping a noisy rule or trying to talk the\n * triage model out of a real finding.\n */\nasync function triageFilter(\n  content: string,\n  matches: ScanMatch[],\n  ctx: ScanContext,\n  llmProvider: LLMProvider | undefined,\n): Promise<ScanMatch[]> {\n  if (matches.length === 0) return [];\n  if (!llmProvider) {\n    logToFile(\n      `[YARA] triage skipped (no provider) — treating ${matches.length} match(es) as real`,\n    );\n    return matches;\n  }\n  try {\n    const warlock = await getWarlock();\n    const triaged = await warlock.triageMatches(content, matches, llmProvider);\n    const kept = triaged.filter((m) => m.triage.verdict === 'true_positive');\n    for (const m of triaged) {\n      if (m.triage.verdict === 'true_positive') continue;\n      logToFile(\n        `[YARA] triage overruled rule \"${m.rule}\" (${\n          m.metadata.severity ?? 'unknown'\n        }) — not acting on it`,\n      );\n      analytics.wizardCapture('yara triage overruled', {\n        rule: m.rule,\n        severity: m.metadata.severity,\n        category: m.metadata.category,\n        scan_context: ctx,\n        // The free-text triage reason is deliberately omitted — it can quote\n        // scanned content, which must never leave the user's machine.\n      });\n    }\n    logToFile(\n      `[YARA] triage: ${matches.length} flagged → ${kept.length} kept as real`,\n    );\n    return kept;\n  } catch (err) {\n    logToFile('[YARA] triage failed — treating all matches as real:', err);\n    return matches;\n  }\n}\n\n/** A chunk of scanned content together with the matches found inside it. */\ninterface FlaggedChunk {\n  chunk: string;\n  matches: ScanMatch[];\n}\n\n/**\n * Split oversized content into overlapping chunks so the scanner covers all\n * of it. Content that fits in one chunk is returned as-is.\n */\nfunction chunkContent(content: string): string[] {\n  if (content.length <= SCAN_CHUNK_SIZE) return [content];\n  const chunks: string[] = [];\n  const step = SCAN_CHUNK_SIZE - SCAN_CHUNK_OVERLAP;\n  for (let start = 0; start < content.length; start += step) {\n    chunks.push(content.slice(start, start + SCAN_CHUNK_SIZE));\n    if (start + SCAN_CHUNK_SIZE >= content.length) break;\n  }\n  return chunks;\n}\n\n/**\n * Scan content against warlock rules — chunked when oversized, so nothing is\n * skipped — and keep only matches for this content surface. Chunks scan\n * sequentially (the WASM engine is single-threaded; parallelism buys nothing).\n * Returns each flagged chunk with its matches so triage can later judge every\n * match against the exact content it came from.\n */\nasync function scanForContext(\n  content: string,\n  ctx: ScanContext,\n): Promise<FlaggedChunk[]> {\n  const warlock = await getWarlock();\n  const chunks = chunkContent(content);\n  if (chunks.length > 1) {\n    logToFile(\n      `[YARA] content is ${content.length} chars — scanning ${chunks.length} overlapping chunks`,\n    );\n    // Alertable signal: oversized content should be rare; a spike could mean\n    // someone is padding content to probe the scanner.\n    analytics.wizardCapture('yara scan chunked', {\n      content_length: content.length,\n      chunk_count: chunks.length,\n      scan_context: ctx,\n    });\n  }\n  const flagged: FlaggedChunk[] = [];\n  for (const chunk of chunks) {\n    const result = await warlock.scan(chunk);\n    if (!result.matched) continue;\n    const matches = matchesForContext(result.matches, ctx);\n    if (matches.length === 0) continue;\n    flagged.push({ chunk, matches });\n  }\n  return flagged;\n}\n\n/** The overlap between chunks can surface the same rule twice; count it once. */\nfunction dedupeByRule(matches: ScanMatch[]): ScanMatch[] {\n  const seen = new Set<string>();\n  return matches.filter((m) => {\n    if (seen.has(m.rule)) return false;\n    seen.add(m.rule);\n    return true;\n  });\n}\n\n/**\n * Triage each flagged chunk against its own content — the evidence is always\n * inside the window the LLM sees. Triage calls run in parallel (each is just\n * an HTTP round trip) so N flagged chunks cost ~1× triage latency, not N×.\n */\nasync function triageFlagged(\n  flagged: FlaggedChunk[],\n  ctx: ScanContext,\n  llmProvider: LLMProvider | undefined,\n): Promise<ScanMatch[]> {\n  const triaged = await Promise.all(\n    flagged.map(({ chunk, matches }) =>\n      triageFilter(chunk, matches, ctx, llmProvider),\n    ),\n  );\n  return dedupeByRule(triaged.flat());\n}\n\n/**\n * Scan content, filter to the relevant context, triage. Returns real matches.\n * Exported for harnesses that run their own hook loop (pi) so every harness\n * scans through the same warlock engine, chunking, and triage policy.\n */\nexport async function scanAndTriage(\n  content: string,\n  ctx: ScanContext,\n  llmProvider: LLMProvider | undefined,\n): Promise<ScanMatch[]> {\n  const flagged = await scanForContext(content, ctx);\n  return triageFlagged(flagged, ctx, llmProvider);\n}\n\n// ─── PreToolUse Hooks ────────────────────────────────────────────\n\n/**\n * Create PreToolUse hook matchers for YARA scanning.\n * Scans Bash commands before execution for exfiltration, destructive\n * operations, and supply chain violations ('command'-context rules).\n */\nexport function createPreToolUseYaraHooks(\n  // Accepted for API symmetry with createPostToolUseYaraHooks, but\n  // intentionally unused: PreToolUse Bash always blocks on any flagged\n  // command regardless of triage verdict, so the LLM call would be wasted.\n  // Future PreToolUse hooks that need triage can wire this through.\n  _llmProvider?: LLMProvider,\n): HookCallbackMatcher[] {\n  const repeatTracker = createRepeatBlockTracker();\n  return [\n    {\n      hooks: [\n        async (input: HookInput): Promise<HookOutput> => {\n          try {\n            const toolName = input.tool_name as string;\n            if (toolName !== 'Bash') return {};\n\n            const toolInput = input.tool_input as Record<string, unknown>;\n            const command =\n              typeof toolInput?.command === 'string' ? toolInput.command : '';\n\n            if (!command) return {};\n\n            recordScan();\n            // Skip triage on PreToolUse Bash: any flagged command is blocked\n            // regardless of triage verdict, so the LLM call would be wasted.\n            const matches = await scanAndTriage(command, 'command', undefined);\n            if (matches.length === 0) return {};\n\n            const match = highestSeverityMatch(matches);\n            recordMatch('PreToolUse', 'Bash', match, 'blocked');\n\n            const attempt = repeatTracker.attempt('Bash', command);\n            return {\n              decision: 'block',\n              reason: repeatBlockReason(\n                attempt,\n                'Bash',\n                `[YARA] ${match.rule}: ${\n                  match.metadata.description ?? 'security policy violation'\n                }. Command blocked for security.`,\n              ),\n            };\n          } catch (error) {\n            logToFile('[YARA] PreToolUse hook error:', error);\n            // Fail closed: block the command if scanning fails\n            return {\n              decision: 'block',\n              reason: '[YARA] Scanner error — command blocked as a precaution.',\n            };\n          }\n        },\n      ],\n      timeout: HOOK_TIMEOUT_MS,\n    },\n  ];\n}\n\n// ─── PostToolUse Hooks ───────────────────────────────────────────\n\n/**\n * Create PostToolUse hook matchers for YARA scanning.\n *\n * Three matchers:\n * 1. Write/Edit — scan written content ('output'-context rules: PII, secrets)\n * 2. Read/Grep — scan read content ('input'-context rules: prompt injection)\n * 3. Bash (skill install) — scan downloaded skill files for poisoned content\n *\n * `onTerminate` is invoked on the terminal paths (critical prompt injection in\n * read content, a poisoned skill, or a scanner error under fail-closed). It is\n * what ACTUALLY stops the run — returning `stopReason` from a PostToolUse hook\n * is not honored by the SDK, so the caller wires this to the run's\n * AbortController (see agent-interface).\n */\nexport function createPostToolUseYaraHooks(\n  llmProvider: LLMProvider | undefined,\n  // REQUIRED, not optional: the SDK ignores `stopReason` from PostToolUse\n  // hooks, so terminal paths (critical prompt injection, poisoned skill,\n  // fail-closed scanner error) depend entirely on this callback firing.\n  // Making it required at compile time prevents a future caller from\n  // silently regressing every terminal path to a no-op.\n  onTerminate: (reason: string) => void,\n): HookCallbackMatcher[] {\n  return [\n    // ── Write/Edit content scanning ──\n    {\n      hooks: [\n        async (input: HookInput): Promise<HookOutput> => {\n          try {\n            const toolName = input.tool_name as string;\n            if (toolName !== 'Write' && toolName !== 'Edit') return {};\n\n            const toolInput = input.tool_input as Record<string, unknown>;\n            // For Write, scan the content being written.\n            // For Edit, scan the new_string (replacement text).\n            const content =\n              toolName === 'Write'\n                ? (toolInput?.content as string) ?? ''\n                : (toolInput?.new_string as string) ?? '';\n\n            if (!content) return {};\n\n            recordScan();\n            const flagged = await scanForContext(content, 'output');\n            if (flagged.length === 0) return {};\n\n            // Wizard-documentation paths: suppress posthog_pii matches that\n            // come from the agent verbatim-copying the user's existing\n            // capture calls into an inventory / report, or planning new\n            // events with PII-shaped property keys. Every other category\n            // still triggers the revert. Suppression runs BEFORE triage so\n            // we never pay an LLM round trip for a match we're about to\n            // discard anyway.\n            // TODO(warlock#33): once warlock PR #33 lands with its\n            // more-precise PII rules, the wizard-side suppression below\n            // should become unnecessary — remove `WIZARD_DOC_BASENAMES`,\n            // `WIZARD_DOC_PATTERNS`, and `isWizardDocumentationPath` and\n            // verify the noisy-PII issue stays fixed.\n            const filePath = toolInput?.file_path as string | undefined;\n            const activeFlagged = isWizardDocumentationPath(filePath)\n              ? flagged\n                  .map(({ chunk, matches }) => ({\n                    chunk,\n                    matches: matches.filter(\n                      (m) => m.metadata.category !== 'posthog_pii',\n                    ),\n                  }))\n                  .filter(({ matches }) => matches.length > 0)\n              : flagged;\n            if (activeFlagged.length === 0) {\n              logToFile(\n                `[YARA] posthog_pii match suppressed on wizard doc ${path.basename(\n                  filePath ?? '',\n                )} (rule: ${flagged[0]?.matches[0]?.rule})`,\n              );\n              return {};\n            }\n\n            const matches = await triageFlagged(\n              activeFlagged,\n              'output',\n              llmProvider,\n            );\n            if (matches.length === 0) return {};\n\n            const match = highestSeverityMatch(matches);\n            recordMatch('PostToolUse', toolName, match, 'reverted');\n\n            return {\n              hookSpecificOutput: {\n                hookEventName: 'PostToolUse',\n                additionalContext:\n                  `[YARA VIOLATION] ${match.rule}: ${\n                    match.metadata.description ?? ''\n                  }. ` +\n                  `You MUST revert this change immediately. The content you just wrote violates security policy.`,\n              },\n            };\n          } catch (error) {\n            logToFile('[YARA] PostToolUse Write/Edit hook error:', error);\n            // Fail closed: if scanning is broken on a Write/Edit, the next\n            // Read/skill-install scan is also going to be broken — terminate\n            // cleanly instead of looping the agent through \"please revert\"\n            // until a Read finally aborts. Matches Read/Grep + skill-install\n            // catch behavior; consistent fail-closed across all PostToolUse.\n            const reason =\n              '[YARA] Scanner error while scanning written content — session terminated as a precaution.';\n            onTerminate(reason);\n            return { stopReason: reason };\n          }\n        },\n      ],\n      timeout: HOOK_TIMEOUT_MS,\n    },\n\n    // ── Read/Grep prompt injection scanning ──\n    {\n      hooks: [\n        async (input: HookInput): Promise<HookOutput> => {\n          try {\n            const toolName = input.tool_name as string;\n            if (toolName !== 'Read' && toolName !== 'Grep') return {};\n\n            const toolResponse = input.tool_response;\n            // Guard before stringify: `JSON.stringify(undefined ?? '')`\n            // returns the 2-char string '\"\"', which is truthy and slips\n            // past the empty-content check below. Exit early when the SDK\n            // gave us no response payload.\n            if (toolResponse == null) return {};\n            const content =\n              typeof toolResponse === 'string'\n                ? toolResponse\n                : JSON.stringify(toolResponse);\n\n            if (!content) return {};\n\n            recordScan();\n            const matches = await scanAndTriage(content, 'input', llmProvider);\n            const verdict = scanVerdict(matches);\n            if (!verdict) return {};\n\n            const { match } = verdict;\n            recordMatch('PostToolUse', toolName, match, verdict.action);\n\n            if (verdict.terminal) {\n              const reason =\n                `[YARA CRITICAL] ${match.rule}: Prompt injection detected in file content. ` +\n                `Agent context is potentially poisoned. Session terminated for safety.`;\n              onTerminate(reason);\n              return { stopReason: reason };\n            }\n\n            return {\n              hookSpecificOutput: {\n                hookEventName: 'PostToolUse',\n                additionalContext: `[YARA WARNING] ${match.rule}: ${\n                  match.metadata.description ?? ''\n                }`,\n              },\n            };\n          } catch (error) {\n            logToFile('[YARA] PostToolUse Read/Grep hook error:', error);\n            // Fail closed: terminate session if scanning fails on read content\n            const reason =\n              '[YARA] Scanner error while scanning read content — session terminated as a precaution.';\n            onTerminate(reason);\n            return { stopReason: reason };\n          }\n        },\n      ],\n      timeout: HOOK_TIMEOUT_MS,\n    },\n\n    // ── Context-mill skill install scanning ──\n    {\n      hooks: [\n        async (input: HookInput): Promise<HookOutput> => {\n          try {\n            const toolName = input.tool_name as string;\n            if (toolName !== 'Bash') return {};\n\n            const toolInput = input.tool_input as Record<string, unknown>;\n            const command =\n              typeof toolInput?.command === 'string' ? toolInput.command : '';\n\n            // Only scan after skill install commands\n            if (!isSkillInstallCommand(command)) return {};\n\n            // Extract skill directory from command\n            const dirMatch = command.match(\n              /mkdir -p (.claude\\/skills\\/[^\\s&]+)/,\n            );\n            if (!dirMatch) return {};\n\n            const skillDir = dirMatch[1];\n            const cwd = (input.cwd as string) ?? process.cwd();\n            recordScan();\n            const matches = await scanSkillFiles(cwd, skillDir, llmProvider);\n\n            const verdict = scanVerdict(matches);\n            if (!verdict) return {};\n\n            recordMatch(\n              'PostToolUse',\n              'Bash (skill install)',\n              verdict.match,\n              verdict.action,\n            );\n            // Same verdict as every other surface: critical terminates, the\n            // rest warn. These rules fire on first-party skill prose often\n            // enough that terminating costs more than it prevents.\n            if (!verdict.terminal) return {};\n\n            const reason =\n              `[YARA CRITICAL] Poisoned skill detected in ${skillDir}: ${verdict.match.rule}. ` +\n              `The downloaded skill contains potential prompt injection. Session terminated for safety.`;\n            onTerminate(reason);\n            return { stopReason: reason };\n          } catch (error) {\n            logToFile('[YARA] PostToolUse skill install hook error:', error);\n            // Fail closed: terminate if skill scanning fails\n            const reason =\n              '[YARA] Scanner error while scanning skill files — session terminated as a precaution.';\n            onTerminate(reason);\n            return { stopReason: reason };\n          }\n        },\n      ],\n      timeout: SKILL_SCAN_HOOK_TIMEOUT_MS,\n    },\n  ];\n}\n\n// ─── Skill File Scanner ──────────────────────────────────────────\n\n/**\n * Scan a freshly installed skill directory (any root — .claude/skills or the\n * orchestrator's run cache) and return a terminate reason when it is poisoned,\n * else null. The choke point for TS-path installs (downloadSkill); agent Bash\n * installs are covered by the PostToolUse matcher above. Runs the same LLM\n * triage as the tool-use scans; fail-closed to treating every match as real when\n * no provider is configured, so a missing key never weakens the check.\n * `llmProvider` is explicit — pi and the orchestrator never set the env fallback.\n *\n * Terminates on the same verdict as every other surface (critical only). A\n * non-terminal match is recorded and the skill is kept: these rules fire on\n * first-party skill prose, and deleting the skill leaves the agent working blind\n * on the very content it needed.\n */\nexport async function scanInstalledSkill(\n  absoluteSkillDir: string,\n  llmProvider: LLMProvider | undefined,\n): Promise<string | null> {\n  recordScan();\n  const matches = await scanSkillFiles(absoluteSkillDir, '.', llmProvider);\n  const verdict = scanVerdict(matches);\n  if (!verdict) return null;\n  recordMatch(\n    'skill-install',\n    'installSkillById',\n    verdict.match,\n    verdict.action,\n  );\n  if (!verdict.terminal) {\n    logToFile(\n      `[YARA] ${verdict.match.rule} (${\n        verdict.match.metadata.severity ?? 'unknown'\n      }) in ${absoluteSkillDir} — non-terminal, keeping the skill`,\n    );\n    return null;\n  }\n  return `Poisoned skill detected: ${verdict.match.rule} (${\n    verdict.match.metadata.severity ?? 'unknown'\n  }) in ${absoluteSkillDir}`;\n}\n\n/**\n * Read and scan all text files in a skill directory for prompt injection.\n * Scans each file sequentially (single-threaded WASM — parallelism buys\n * nothing), unions the 'input'-context matches, then triages once across the\n * combined content. Returns the real (post-triage) matches.\n */\nasync function scanSkillFiles(\n  cwd: string,\n  skillDir: string,\n  llmProvider: LLMProvider | undefined,\n): Promise<ScanMatch[]> {\n  const absoluteDir = path.resolve(cwd, skillDir);\n\n  if (!fs.existsSync(absoluteDir)) {\n    logToFile(`[YARA] Skill directory does not exist: ${absoluteDir}`);\n    return [];\n  }\n\n  const files = await fg('**/*.{md,txt,yaml,yml,json,js,ts,py,rb,sh}', {\n    cwd: absoluteDir,\n    absolute: true,\n  });\n\n  if (files.length === 0) {\n    logToFile(`[YARA] No text files found in skill directory: ${absoluteDir}`);\n    return [];\n  }\n\n  logToFile(\n    `[YARA] Scanning ${files.length} files in skill directory: ${skillDir}`,\n  );\n\n  // Pass 1 (sequential): read and scan ONE file at a time through the\n  // chunk-aware path. Oversized files are scanned up to the cap and logged —\n  // never silently skipped. Flagged chunks keep a reference to the exact\n  // content their matches came from.\n  const flagged: FlaggedChunk[] = [];\n  for (const filePath of files) {\n    let content: string | null;\n    try {\n      if (fs.statSync(filePath).size > SKILL_FILE_SCAN_BYTES) {\n        logToFile(\n          `[YARA] Skill file over ${SKILL_FILE_SCAN_BYTES} bytes; scanning its head only: ${filePath}`,\n        );\n        content = readFileHead(filePath, SKILL_FILE_SCAN_BYTES);\n      } else {\n        content = fs.readFileSync(filePath, 'utf-8');\n      }\n    } catch (err) {\n      logToFile(`[YARA] Could not read skill file ${filePath}:`, err);\n      continue;\n    }\n    if (content) {\n      flagged.push(...(await scanForContext(content, 'input')));\n    }\n  }\n\n  // Pass 2 (parallel, inside triageFlagged): triage each flagged chunk\n  // against its own content concurrently. Triage is just an axios call —\n  // running them in parallel cuts total wall-clock from N × triage-timeout\n  // to ~1×. Important because the hook's HOOK_TIMEOUT_MS is 30s; serial\n  // triage on 2+ matched files could blow the hook timeout under a slow\n  // Haiku.\n  return triageFlagged(flagged, 'input', llmProvider);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AASA,SAAgB,sBAAsB,SAA0B;AAC9D,KAAI,CAAC,QAAQ,WAAW,2BAA2B,CAAE,QAAO;CAE5D,MAAM,WAAW,QAAQ,MAAM,4BAA4B;AAC3D,KAAI,CAAC,SAAU,QAAO;CAEtB,MAAM,MAAM,SAAS;AACrB,QACE,IAAI,WAAW,oDAAoD,IACnE,4BAA4B,KAAK,IAAI;;;;;ACDzC,MAAM,gBAAwC;CAC5C,UAAU;CACV,MAAM;CACN,QAAQ;CACR,KAAK;CACN;;AAGD,MAAM,sBAAsB,IAAI,IAAI,CAAC,WAAW,CAAC;;;;;;;;AASjD,SAAgB,gBAAgB,OAA2B;AACzD,QAAO,oBAAoB,IAAI,MAAM,SAAS,YAAY,GAAG;;;AAI/D,SAAgB,qBAAqB,SAAiC;AACpE,QAAO,QAAQ,QAAQ,OAAO,OAC3B,cAAc,EAAE,SAAS,YAAY,OAAO,MAC5C,cAAc,MAAM,SAAS,YAAY,OAAO,KAC7C,IACA,MACL;;;AAaH,SAAgB,YAAY,SAA0C;AACpE,KAAI,QAAQ,WAAW,EAAG,QAAO;CACjC,MAAM,QAAQ,qBAAqB,QAAQ;CAC3C,MAAM,WAAW,gBAAgB,MAAM;AACvC,QAAO;EAAE;EAAO;EAAU,QAAQ,WAAW,YAAY;EAAU;;;;;;;;;;;ACtDrE,MAAa,oBAAoB;AACjC,MAAa,uBAAuB;;AAEpC,MAAa,+BACX;;;;ACYF,MAAa,uBAAgE;CAC3E,SAAS;EAAE,OAAO;EAAK,OAAO;EAAQ;CACtC,MAAM;EAAE,OAAO;EAAK,OAAO;EAAS;CACpC,OAAO;EAAE,OAAO;EAAK,OAAO;EAAO;CACnC,SAAS;EAAE,OAAO;EAAK,OAAO;EAAU;CACxC,YAAY;EAAE,OAAO;EAAK,OAAO;EAAQ;CAC1C;AAED,MAAa,oBAAoB;AACjC,MAAa,oBAAoB;AACjC,MAAa,mBAAmB;AAEhC,SAAgB,eAAe,SAAsC;CACnE,MAAM,MAAM,QAAQ,iBAAiB;AACrC,QAAO,MAAM,QAAQ,IAAI,GAAI,MAAuB,EAAE;;;;;;;;;;AAWxD,SAAgB,kBAAkB,QAA+B;AAC/D,QAAO,MAAM,QAAQ,OAAO,GAAI,SAA0B,EAAE;;;;;;;;;;;;ACzC9D,MAAa,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;AC2D/B,IAAI,uBAAsD;AAE1D,SAAS,aAAqC;AAC5C,KAAI,CAAC,qBAKH,wBAAuB,OAAO,oBAAoB,OAAO,QAAQ;AAC/D,yBAAuB;AACvB,QAAM;GACN;AAEJ,QAAO;;;;;;;AAQT,eAAsB,qBAAoC;AACxD,KAAI;AAEF,SADgB,MAAM,YAAY,EACpB,KAAK,GAAG;AACtB,YAAU,4BAA4B;UAC/B,KAAK;AACZ,YAAU,mCAAmC,IAAI;;;AA6CrD,IAAI,YAAY;AAChB,MAAM,iBAAoC,EAAE;AAE5C,SAAS,aAAmB;AAC1B;;;;;;AAUF,SAAS,YACP,OACA,MACA,OACA,QACM;CACN,MAAM,SAAU,MAAsB;AACtC,cAAa,OAAO,MAAM,OAAO,OAAO;AACxC,gBAAe,KAAK;EAClB,MAAM,MAAM;EACZ,UAAU,MAAM,SAAS,YAAY;EACrC,UAAU,MAAM,SAAS,YAAY;EACrC;EACA;EACA;EACA,aAAa,MAAM,SAAS,eAAe;EAC3C,eAAe,QAAQ;EACvB,cAAc,QAAQ;EACvB,CAAC;;;;;;;AAcJ,SAAgB,mBACd,OACA,MACA,YAMA,QACM;AACN,aAAY;AACZ,MAAK,MAAM,KAAK,WACd,aACE,OACA,MACA;EACE,MAAM,EAAE;EACR,UAAU;GACR,UAAU,EAAE;GACZ,UAAU,EAAE;GACZ,aAAa,EAAE;GAChB;EACD,gBAAgB,EAAE;EACnB,EACD,OACD;;;AAKL,SAAgB,mBAAkC;AAChD,KAAI,cAAc,EAAG,QAAO;CAE5B,MAAM,QAAkB,CAAC,IAAI,2BAA2B;CACxD,MAAM,iBAAiB,eAAe;CACtC,MAAM,aAAa,YAAY;AAE/B,OAAM,KACJ,KAAK,UAAU,uBAAuB,eAAe,YACnD,mBAAmB,IAAI,MAAM,GAC9B,WACF;AAED,KAAI,iBAAiB,GAAG;AACtB,QAAM,KAAK,GAAG;AACd,OAAK,MAAM,KAAK,gBAAgB;GAC9B,MAAM,MAAM,EAAE,OAAO,aAAa;AAClC,SAAM,KACJ,MAAM,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,SAAS,aAAa,CAAC,MAAM,EAAE,MAAM,GAC9D,EAAE,OAEL;;;AAIL,KAAI,aAAa,GAAG;AAClB,QAAM,KAAK,GAAG;AACd,QAAM,KACJ,oBAAoB,WAAW,aAAa,eAAe,IAAI,MAAM,KACtE;;AAGH,OAAM,KAAK,GAAG;AACd,QAAO,MAAM,KAAK,KAAK;;;AAIzB,SAAgB,kBAAiC;AAC/C,KAAI,cAAc,EAAG,QAAO;CAE5B,MAAM,SAAS;EACb,SAAS;GACP,YAAY;GACZ,YAAY,eAAe;GAC3B,OAAO,YAAY,eAAe;GACnC;EACD,YAAY;EACb;AAED,KAAI;AACF,KAAG,cAAc,yBAAyB,KAAK,UAAU,QAAQ,MAAM,EAAE,CAAC;UACnE,KAAK;AACZ,YAAU,uCAAuC,IAAI;AACrD,SAAO;;AAET,QAAO;;AAcT,MAAM,wBAAkD;CACtD,kBACE;CACF,cAAc;CACd,wBAAwB;CACxB,cAAc;CACd,aAAa;CACb,uBAAuB;CACvB,kBAAkB;CACnB;;AAGD,SAAS,2BAAmD;AAC1D,MAAK,IAAI,IAAI,eAAe,SAAS,GAAG,KAAK,GAAG,IAC9C,KAAI,eAAe,GAAG,WAAW,UAAW,QAAO,eAAe;AAEpE,QAAO;;;;;;;;;AAUT,SAAgB,yBAAiC;CAC/C,MAAM,IAAI,0BAA0B;AAKpC,QACE;;aAJC,KAAK,sBAAsB,EAAE,cAC9B,6CAIkB;;;;;AAatB,MAAM,kBAAkB;;AAExB,MAAM,6BAA6B;;;;;;;AAQnC,MAAM,kBAAkB;AAGxB,MAAM,wBAAwB,KAAK,OAAO;;;;;;AAM1C,MAAM,qBAAqB;AAI3B,SAAS,aACP,OACA,MACA,OACA,QACM;CACN,MAAM,WAAW,MAAM,SAAS,YAAY;CAC5C,MAAM,WAAW,MAAM,SAAS,YAAY;CAC5C,MAAM,aAAa,MAAM,SAAS,UAAU;CAC5C,MAAM,cAAc,MAAM,SAAS,eAAe;AAClD,WACE,UAAU,MAAM,GAAG,KAAK,IAAI,OAAO,aAAa,CAAC,UAAU,MAAM,KAAK,eACtD,SAAS,cAAc,SAAS,YAAY,WAAW,oBACnD,cACrB;AACD,WAAU,cAAc,qBAAqB;EAC3C,MAAM,MAAM;EACZ,UAAU,MAAM,SAAS;EACzB,UAAU,MAAM,SAAS;EACzB,aAAa,MAAM,SAAS;EAC5B;EACA;EACA;EAGA,aAAa,MAAM,SAAS;EAC5B,gBAAiB,MAAsB,QAAQ;EAChD,CAAC;;;;;;;;AASJ,SAAgB,oBAA0B;AACxC,KAAI,cAAc,EAAG;AACrB,WAAU,cAAc,oBAAoB;EAC1C,aAAa;EACb,iBAAiB,eAAe;EAChC,aAAa,YAAY,eAAe;EACxC,YAAY,eAAe,KAAK,OAAO;GACrC,MAAM,EAAE;GACR,UAAU,EAAE;GACZ,UAAU,EAAE;GACZ,QAAQ,EAAE;GACV,OAAO,EAAE;GACT,MAAM,EAAE;GACR,aAAa,EAAE;GACf,gBAAgB,EAAE;GACnB,EAAE;EACJ,CAAC;AAIF,aAAY;AACZ,gBAAe,SAAS;;;;;;;;;;;;;;AAe1B,SAAgB,gBACd,SACM;AACN,KAAI,QAAQ,YAAY;EACtB,MAAM,aAAa,iBAAiB;AACpC,MAAI,YAAY;GACd,MAAM,UAAU,kBAAkB;AAClC,UAAO,CAAC,IAAI,KAAK,qBAAqB,aAAa,WAAW,KAAK;;;AAGvE,oBAAmB;;AAiBrB,MAAM,uBAAuB,IAAI,IAAI;CACnC;CACAA;CACA;CACA;CACD,CAAC;AAEF,MAAM,sBAAgC,CAAC,6BAA6B;AAEpE,SAAgB,0BACd,UACS;AACT,KAAI,CAAC,SAAU,QAAO;CACtB,MAAM,WAAW,KAAK,SAAS,SAAS;AACxC,KAAI,qBAAqB,IAAI,SAAS,CAAE,QAAO;AAC/C,QAAO,oBAAoB,MAAM,OAAO,GAAG,KAAK,SAAS,CAAC;;;AAgB5D,MAAM,+BAA+B;;AAWrC,SAAgB,2BAA+C;CAC7D,MAAM,yBAAS,IAAI,KAAqB;AACxC,QAAO,EACL,QAAQ,MAAc,SAAyB;EAC7C,MAAM,MAAM,GAAG,KAAK,GAAG,WAAW,SAAS,CACxC,OAAO,QAAQ,CACf,OAAO,MAAM;EAChB,MAAM,QAAQ,OAAO,IAAI,IAAI,IAAI,KAAK;AACtC,SAAO,IAAI,KAAK,KAAK;AACrB,SAAO;IAEV;;;;;;;AAQH,SAAgB,kBACd,SACA,MACA,YACQ;AACR,KAAI,WAAW,EAAG,QAAO;AACzB,KAAI,UAAU,6BACZ,QACE,GAAG,WAAW,cAAc,KAAK;AAKrC,QACE,GAAG,WAAW,cAAc,KAAK,gCAAgC,QAAQ;;;;;;;;AAgB7E,SAAS,kBACP,SACA,KACa;AACb,QAAO,QAAQ,QAAQ,MAAM;EAC3B,MAAM,IAAI,EAAE,SAAS;AACrB,SAAO,MAAM,OAAO,MAAM,KAAA;GAC1B;;;;;;;;;;;;AAaJ,eAAe,aACb,SACA,SACA,KACA,aACsB;AACtB,KAAI,QAAQ,WAAW,EAAG,QAAO,EAAE;AACnC,KAAI,CAAC,aAAa;AAChB,YACE,kDAAkD,QAAQ,OAAO,oBAClE;AACD,SAAO;;AAET,KAAI;EAEF,MAAM,UAAU,OADA,MAAM,YAAY,EACJ,cAAc,SAAS,SAAS,YAAY;EAC1E,MAAM,OAAO,QAAQ,QAAQ,MAAM,EAAE,OAAO,YAAY,gBAAgB;AACxE,OAAK,MAAM,KAAK,SAAS;AACvB,OAAI,EAAE,OAAO,YAAY,gBAAiB;AAC1C,aACE,iCAAiC,EAAE,KAAK,KACtC,EAAE,SAAS,YAAY,UACxB,sBACF;AACD,aAAU,cAAc,yBAAyB;IAC/C,MAAM,EAAE;IACR,UAAU,EAAE,SAAS;IACrB,UAAU,EAAE,SAAS;IACrB,cAAc;IAGf,CAAC;;AAEJ,YACE,kBAAkB,QAAQ,OAAO,aAAa,KAAK,OAAO,eAC3D;AACD,SAAO;UACA,KAAK;AACZ,YAAU,wDAAwD,IAAI;AACtE,SAAO;;;;;;;AAcX,SAAS,aAAa,SAA2B;AAC/C,KAAI,QAAQ,UAAU,gBAAiB,QAAO,CAAC,QAAQ;CACvD,MAAM,SAAmB,EAAE;CAC3B,MAAM,OAAO,kBAAkB;AAC/B,MAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS,MAAM;AACzD,SAAO,KAAK,QAAQ,MAAM,OAAO,QAAQ,gBAAgB,CAAC;AAC1D,MAAI,QAAQ,mBAAmB,QAAQ,OAAQ;;AAEjD,QAAO;;;;;;;;;AAUT,eAAe,eACb,SACA,KACyB;CACzB,MAAM,UAAU,MAAM,YAAY;CAClC,MAAM,SAAS,aAAa,QAAQ;AACpC,KAAI,OAAO,SAAS,GAAG;AACrB,YACE,qBAAqB,QAAQ,OAAO,oBAAoB,OAAO,OAAO,qBACvE;AAGD,YAAU,cAAc,qBAAqB;GAC3C,gBAAgB,QAAQ;GACxB,aAAa,OAAO;GACpB,cAAc;GACf,CAAC;;CAEJ,MAAM,UAA0B,EAAE;AAClC,MAAK,MAAM,SAAS,QAAQ;EAC1B,MAAM,SAAS,MAAM,QAAQ,KAAK,MAAM;AACxC,MAAI,CAAC,OAAO,QAAS;EACrB,MAAM,UAAU,kBAAkB,OAAO,SAAS,IAAI;AACtD,MAAI,QAAQ,WAAW,EAAG;AAC1B,UAAQ,KAAK;GAAE;GAAO;GAAS,CAAC;;AAElC,QAAO;;;AAIT,SAAS,aAAa,SAAmC;CACvD,MAAM,uBAAO,IAAI,KAAa;AAC9B,QAAO,QAAQ,QAAQ,MAAM;AAC3B,MAAI,KAAK,IAAI,EAAE,KAAK,CAAE,QAAO;AAC7B,OAAK,IAAI,EAAE,KAAK;AAChB,SAAO;GACP;;;;;;;AAQJ,eAAe,cACb,SACA,KACA,aACsB;AAMtB,QAAO,cALS,MAAM,QAAQ,IAC5B,QAAQ,KAAK,EAAE,OAAO,cACpB,aAAa,OAAO,SAAS,KAAK,YAAY,CAC/C,CACF,EAC2B,MAAM,CAAC;;;;;;;AAQrC,eAAsB,cACpB,SACA,KACA,aACsB;AAEtB,QAAO,cADS,MAAM,eAAe,SAAS,IAAI,EACpB,KAAK,YAAY;;;;;;;AAUjD,SAAgB,0BAKd,cACuB;CACvB,MAAM,gBAAgB,0BAA0B;AAChD,QAAO,CACL;EACE,OAAO,CACL,OAAO,UAA0C;AAC/C,OAAI;AAEF,QADiB,MAAM,cACN,OAAQ,QAAO,EAAE;IAElC,MAAM,YAAY,MAAM;IACxB,MAAM,UACJ,OAAO,WAAW,YAAY,WAAW,UAAU,UAAU;AAE/D,QAAI,CAAC,QAAS,QAAO,EAAE;AAEvB,gBAAY;IAGZ,MAAM,UAAU,MAAM,cAAc,SAAS,WAAW,KAAA,EAAU;AAClE,QAAI,QAAQ,WAAW,EAAG,QAAO,EAAE;IAEnC,MAAM,QAAQ,qBAAqB,QAAQ;AAC3C,gBAAY,cAAc,QAAQ,OAAO,UAAU;AAGnD,WAAO;KACL,UAAU;KACV,QAAQ,kBAHM,cAAc,QAAQ,QAAQ,QAAQ,EAKlD,QACA,UAAU,MAAM,KAAK,IACnB,MAAM,SAAS,eAAe,4BAC/B,iCACF;KACF;YACM,OAAO;AACd,cAAU,iCAAiC,MAAM;AAEjD,WAAO;KACL,UAAU;KACV,QAAQ;KACT;;IAGN;EACD,SAAS;EACV,CACF;;;;;;;;;;;;;;;;AAmBH,SAAgB,2BACd,aAMA,aACuB;AACvB,QAAO;EAEL;GACE,OAAO,CACL,OAAO,UAA0C;AAC/C,QAAI;KACF,MAAM,WAAW,MAAM;AACvB,SAAI,aAAa,WAAW,aAAa,OAAQ,QAAO,EAAE;KAE1D,MAAM,YAAY,MAAM;KAGxB,MAAM,UACJ,aAAa,UACR,WAAW,WAAsB,KACjC,WAAW,cAAyB;AAE3C,SAAI,CAAC,QAAS,QAAO,EAAE;AAEvB,iBAAY;KACZ,MAAM,UAAU,MAAM,eAAe,SAAS,SAAS;AACvD,SAAI,QAAQ,WAAW,EAAG,QAAO,EAAE;KAcnC,MAAM,WAAW,WAAW;KAC5B,MAAM,gBAAgB,0BAA0B,SAAS,GACrD,QACG,KAAK,EAAE,OAAO,eAAe;MAC5B;MACA,SAAS,QAAQ,QACd,MAAM,EAAE,SAAS,aAAa,cAChC;MACF,EAAE,CACF,QAAQ,EAAE,cAAc,QAAQ,SAAS,EAAE,GAC9C;AACJ,SAAI,cAAc,WAAW,GAAG;AAC9B,gBACE,qDAAqD,KAAK,SACxD,YAAY,GACb,CAAC,UAAU,QAAQ,IAAI,QAAQ,IAAI,KAAK,GAC1C;AACD,aAAO,EAAE;;KAGX,MAAM,UAAU,MAAM,cACpB,eACA,UACA,YACD;AACD,SAAI,QAAQ,WAAW,EAAG,QAAO,EAAE;KAEnC,MAAM,QAAQ,qBAAqB,QAAQ;AAC3C,iBAAY,eAAe,UAAU,OAAO,WAAW;AAEvD,YAAO,EACL,oBAAoB;MAClB,eAAe;MACf,mBACE,oBAAoB,MAAM,KAAK,IAC7B,MAAM,SAAS,eAAe,GAC/B;MAEJ,EACF;aACM,OAAO;AACd,eAAU,6CAA6C,MAAM;KAM7D,MAAM,SACJ;AACF,iBAAY,OAAO;AACnB,YAAO,EAAE,YAAY,QAAQ;;KAGlC;GACD,SAAS;GACV;EAGD;GACE,OAAO,CACL,OAAO,UAA0C;AAC/C,QAAI;KACF,MAAM,WAAW,MAAM;AACvB,SAAI,aAAa,UAAU,aAAa,OAAQ,QAAO,EAAE;KAEzD,MAAM,eAAe,MAAM;AAK3B,SAAI,gBAAgB,KAAM,QAAO,EAAE;KACnC,MAAM,UACJ,OAAO,iBAAiB,WACpB,eACA,KAAK,UAAU,aAAa;AAElC,SAAI,CAAC,QAAS,QAAO,EAAE;AAEvB,iBAAY;KAEZ,MAAM,UAAU,YADA,MAAM,cAAc,SAAS,SAAS,YAAY,CAC9B;AACpC,SAAI,CAAC,QAAS,QAAO,EAAE;KAEvB,MAAM,EAAE,UAAU;AAClB,iBAAY,eAAe,UAAU,OAAO,QAAQ,OAAO;AAE3D,SAAI,QAAQ,UAAU;MACpB,MAAM,SACJ,mBAAmB,MAAM,KAAK;AAEhC,kBAAY,OAAO;AACnB,aAAO,EAAE,YAAY,QAAQ;;AAG/B,YAAO,EACL,oBAAoB;MAClB,eAAe;MACf,mBAAmB,kBAAkB,MAAM,KAAK,IAC9C,MAAM,SAAS,eAAe;MAEjC,EACF;aACM,OAAO;AACd,eAAU,4CAA4C,MAAM;KAE5D,MAAM,SACJ;AACF,iBAAY,OAAO;AACnB,YAAO,EAAE,YAAY,QAAQ;;KAGlC;GACD,SAAS;GACV;EAGD;GACE,OAAO,CACL,OAAO,UAA0C;AAC/C,QAAI;AAEF,SADiB,MAAM,cACN,OAAQ,QAAO,EAAE;KAElC,MAAM,YAAY,MAAM;KACxB,MAAM,UACJ,OAAO,WAAW,YAAY,WAAW,UAAU,UAAU;AAG/D,SAAI,CAAC,sBAAsB,QAAQ,CAAE,QAAO,EAAE;KAG9C,MAAM,WAAW,QAAQ,MACvB,sCACD;AACD,SAAI,CAAC,SAAU,QAAO,EAAE;KAExB,MAAM,WAAW,SAAS;KAC1B,MAAM,MAAO,MAAM,OAAkB,QAAQ,KAAK;AAClD,iBAAY;KAGZ,MAAM,UAAU,YAFA,MAAM,eAAe,KAAK,UAAU,YAAY,CAE5B;AACpC,SAAI,CAAC,QAAS,QAAO,EAAE;AAEvB,iBACE,eACA,wBACA,QAAQ,OACR,QAAQ,OACT;AAID,SAAI,CAAC,QAAQ,SAAU,QAAO,EAAE;KAEhC,MAAM,SACJ,8CAA8C,SAAS,IAAI,QAAQ,MAAM,KAAK;AAEhF,iBAAY,OAAO;AACnB,YAAO,EAAE,YAAY,QAAQ;aACtB,OAAO;AACd,eAAU,gDAAgD,MAAM;KAEhE,MAAM,SACJ;AACF,iBAAY,OAAO;AACnB,YAAO,EAAE,YAAY,QAAQ;;KAGlC;GACD,SAAS;GACV;EACF;;;;;;;;;;;;;;;;AAmBH,eAAsB,mBACpB,kBACA,aACwB;AACxB,aAAY;CAEZ,MAAM,UAAU,YADA,MAAM,eAAe,kBAAkB,KAAK,YAAY,CACpC;AACpC,KAAI,CAAC,QAAS,QAAO;AACrB,aACE,iBACA,oBACA,QAAQ,OACR,QAAQ,OACT;AACD,KAAI,CAAC,QAAQ,UAAU;AACrB,YACE,UAAU,QAAQ,MAAM,KAAK,IAC3B,QAAQ,MAAM,SAAS,YAAY,UACpC,OAAO,iBAAiB,oCAC1B;AACD,SAAO;;AAET,QAAO,4BAA4B,QAAQ,MAAM,KAAK,IACpD,QAAQ,MAAM,SAAS,YAAY,UACpC,OAAO;;;;;;;;AASV,eAAe,eACb,KACA,UACA,aACsB;CACtB,MAAM,cAAc,KAAK,QAAQ,KAAK,SAAS;AAE/C,KAAI,CAAC,GAAG,WAAW,YAAY,EAAE;AAC/B,YAAU,0CAA0C,cAAc;AAClE,SAAO,EAAE;;CAGX,MAAM,QAAQ,MAAM,GAAG,8CAA8C;EACnE,KAAK;EACL,UAAU;EACX,CAAC;AAEF,KAAI,MAAM,WAAW,GAAG;AACtB,YAAU,kDAAkD,cAAc;AAC1E,SAAO,EAAE;;AAGX,WACE,mBAAmB,MAAM,OAAO,6BAA6B,WAC9D;CAMD,MAAM,UAA0B,EAAE;AAClC,MAAK,MAAM,YAAY,OAAO;EAC5B,IAAI;AACJ,MAAI;AACF,OAAI,GAAG,SAAS,SAAS,CAAC,OAAO,uBAAuB;AACtD,cACE,0BAA0B,sBAAsB,kCAAkC,WACnF;AACD,cAAU,aAAa,UAAU,sBAAsB;SAEvD,WAAU,GAAG,aAAa,UAAU,QAAQ;WAEvC,KAAK;AACZ,aAAU,oCAAoC,SAAS,IAAI,IAAI;AAC/D;;AAEF,MAAI,QACF,SAAQ,KAAK,GAAI,MAAM,eAAe,SAAS,QAAQ,CAAE;;AAU7D,QAAO,cAAc,SAAS,SAAS,YAAY"}
+{"version":3,"file":"yara-hooks-DjReXmTQ.js","names":["EVENTS_AUDIT_REPORT_FILE"],"sources":["../src/lib/skill-install.ts","../src/lib/yara-policy.ts","../src/lib/programs/events-audit/constants.ts","../src/lib/programs/audit/types.ts","../src/lib/programs/posthog-integration/constants.ts","../src/lib/yara-hooks.ts"],"sourcesContent":["/**\n * Check if command is a PostHog skill installation from MCP.\n * We control the MCP server, so we only need to verify:\n * 1. It installs to .claude/skills/\n * 2. It downloads from our GitHub releases or localhost (dev)\n *\n * Extracted to its own module to avoid a circular dependency\n * between agent-interface.ts and yara-hooks.ts.\n */\nexport function isSkillInstallCommand(command: string): boolean {\n  if (!command.startsWith('mkdir -p .claude/skills/')) return false;\n\n  const urlMatch = command.match(/curl -sL ['\"]([^'\"]+)['\"]/);\n  if (!urlMatch) return false;\n\n  const url = urlMatch[1];\n  return (\n    url.startsWith('https://github.com/PostHog/context-mill/releases/') ||\n    /^http:\\/\\/localhost:\\d+\\//.test(url)\n  );\n}\n","/**\n * Shared YARA scan policy: the vocabulary every scan surface speaks, and the\n * one decision they all make — does a set of matches terminate the session, or\n * only warn. Both fences (the anthropic PostToolUse hooks in `yara-hooks.ts`\n * and the pi tool_result extension in `harness/pi/security.ts`) resolve a\n * verdict here rather than each re-deriving it from severity and action.\n */\n\nimport type { ScanMatch } from '@posthog/warlock';\n\n/** Which content surface a warlock rule applies to (from rule `scan_context`). */\nexport type ScanContext = 'command' | 'input' | 'output';\n\n/** What a fence did about a match, as recorded in the scan report. */\nexport type ScanAction = 'blocked' | 'reverted' | 'warned' | 'aborted';\n\n/** Severity order, highest first, for picking the match worth reporting. */\nconst SEVERITY_RANK: Record<string, number> = {\n  critical: 4,\n  high: 3,\n  medium: 2,\n  low: 1,\n};\n\n/** Severities that end the session. Critical only — nothing below it is worth killing a run over. */\nconst TERMINAL_SEVERITIES = new Set(['critical']);\n\n/**\n * The match that ends the session rather than just warning. Severity alone\n * decides: a rule's `action: 'block'` is a recommendation about the *operation*\n * (PreToolUse still refuses the command), not a licence to end the run. Medium\n * and high `block` rules fire on first-party content often enough that\n * terminating on them costs more than it prevents.\n */\nexport function isTerminalMatch(match: ScanMatch): boolean {\n  return TERMINAL_SEVERITIES.has(match.metadata.severity ?? '');\n}\n\n/** Return the highest-severity match from a list of matches. */\nexport function highestSeverityMatch(matches: ScanMatch[]): ScanMatch {\n  return matches.reduce((worst, m) =>\n    (SEVERITY_RANK[m.metadata.severity ?? ''] ?? 0) >\n    (SEVERITY_RANK[worst.metadata.severity ?? ''] ?? 0)\n      ? m\n      : worst,\n  );\n}\n\nexport interface ScanVerdict {\n  /** The match worth reporting: the highest-severity one. */\n  match: ScanMatch;\n  /** Session ends now; anything else is advisory. */\n  terminal: boolean;\n  /** How the scan report records it. */\n  action: ScanAction;\n}\n\n/** Resolve what a fence should do about a set of matches. Null when clean. */\nexport function scanVerdict(matches: ScanMatch[]): ScanVerdict | null {\n  if (matches.length === 0) return null;\n  const match = highestSeverityMatch(matches);\n  const terminal = isTerminalMatch(match);\n  return { match, terminal, action: terminal ? 'aborted' : 'warned' };\n}\n","/**\n * Leaf-level constants for the events-audit program.\n *\n * Kept separate from `index.ts` so files like `yara-hooks.ts` can import\n * the filename constants without dragging in `index.ts`'s heavier imports\n * (agent-runner, audit/seed, etc.) — which can create import cycles.\n */\n\nexport const SETUP_REPORT_FILE = 'posthog-events-audit-report.md';\nexport const EVENT_INVENTORY_FILE = '.posthog-events-inventory.json';\n/** Per-part filename pattern emitted by events-audit subagents (e.g. `.posthog-events-inventory.part-3.json`). */\nexport const EVENT_INVENTORY_PART_PATTERN =\n  /^\\.posthog-events-inventory\\.part-\\d+\\.json$/;\n","import type { WizardSession } from '@lib/wizard-session';\n\nexport type AuditStatus =\n  | 'pending'\n  | 'pass'\n  | 'error'\n  | 'warning'\n  | 'suggestion';\n\nexport interface AuditCheck {\n  id: string;\n  area: string;\n  label: string;\n  status: AuditStatus;\n  file?: string;\n  details?: string;\n}\n\nexport interface AuditSeverityStyle {\n  glyph: string;\n  color: string;\n}\n\n/** Single source of truth for status glyph + color across audit views. */\nexport const AUDIT_SEVERITY_STYLE: Record<AuditStatus, AuditSeverityStyle> = {\n  pending: { glyph: '◌', color: 'gray' },\n  pass: { glyph: '✔', color: 'green' },\n  error: { glyph: '✘', color: 'red' },\n  warning: { glyph: '⚠', color: 'yellow' },\n  suggestion: { glyph: '•', color: 'cyan' },\n};\n\nexport const AUDIT_CHECKS_FILE = '.posthog-audit-checks.json';\nexport const AUDIT_REPORT_FILE = 'posthog-audit-report.md';\nexport const AUDIT_CHECKS_KEY = 'auditChecks';\n\nexport function getAuditChecks(session: WizardSession): AuditCheck[] {\n  const raw = session.frameworkContext[AUDIT_CHECKS_KEY];\n  return Array.isArray(raw) ? (raw as AuditCheck[]) : [];\n}\n\n/**\n * Read the audit checks ledger off disk. Validation lives at write time —\n * every writer (`audit_seed_checks` / `audit_add_checks` / `audit_resolve_checks`\n * MCP tools, `seedAuditLedger`) zod-parses entries before the atomic write,\n * so by the time the file watcher fires we trust the shape and only guard\n * against the file not being a JSON array (corrupted / hand-edited / not yet\n * seeded).\n */\nexport function coerceAuditChecks(parsed: unknown): AuditCheck[] {\n  return Array.isArray(parsed) ? (parsed as AuditCheck[]) : [];\n}\n","/**\n * Leaf-level constants for the posthog-integration program.\n *\n * Kept separate from `index.ts` so files like `yara-hooks.ts` can import\n * the filename constants without dragging in `index.ts`'s heavier imports\n * (agent-interface, framework-config, etc.) — which would create an import\n * cycle through agent-interface → yara-hooks.\n */\n\nexport const EVENT_PLAN_FILE = '.posthog-events.json';\n","/**\n * YARA hook wiring for the Claude Agent SDK.\n *\n * Creates PreToolUse and PostToolUse hook callback arrays that integrate the\n * real @posthog/warlock security scanner (YARA-X via WASM) into the wizard's\n * agent loop. These hooks are registered in the SDK's query() options alongside\n * the existing Stop hook.\n *\n * PreToolUse hooks block dangerous commands before execution. PostToolUse hooks\n * detect violations in written code and prompt injection in read content, and\n * scan context-mill skill downloads.\n *\n * Warlock owns the rules; this file owns the *policy* — how a match maps to a\n * block / revert / terminate response, plus the optional LLM triage pass that\n * filters false positives before we act.\n *\n * Naming: \"yara\" is the technique — scanning content against YARA rules — so the\n * wizard-side wiring keeps that name. \"warlock\" is the engine package that runs\n * the rules. Both names showing up here is intentional.\n *\n * This is Layer 2 (L2) in the wizard's defense-in-depth model, complementing the\n * prompt-based commandments (L0) and the canUseTool() allowlist (L1).\n */\n\nimport fs from 'fs';\nimport path from 'path';\nimport { createHash } from 'crypto';\nimport fg from 'fast-glob';\nimport type {\n  ScanMatch,\n  TriageMatch,\n  LLMProvider,\n  Category,\n} from '@posthog/warlock';\nimport { logToFile } from '@utils/debug';\nimport { readFileHead } from '@utils/bounded-fs';\nimport { analytics } from '@utils/analytics';\nimport { getUI } from '@ui';\nimport type { WizardSession } from '@lib/wizard-session';\nimport { isSkillInstallCommand } from './skill-install';\nimport { highestSeverityMatch, scanVerdict } from './yara-policy';\nimport type { ScanAction, ScanContext } from './yara-policy';\nimport { WIZARD_YARA_REPORT_FILE } from '@utils/paths';\n// TODO(wizard#594): invert this dependency.\n// L2 infra (yara-hooks) imports product-specific filename constants from\n// individual programs. The leaf `constants.ts` modules break the *import*\n// cycle but don't fix the *layering* concern: this file knowing about\n// `events-audit`, `posthog-integration`, and `audit` violates \"product\n// knowledge never enters infrastructure code.\" Proper fix is inverted —\n// programs declare their own doc paths, the hooks read from a generic\n// registry. For now: every new program emitting a PII-shaped report has\n// to be added here. Land that cleanup before adding a fourth entry.\nimport {\n  SETUP_REPORT_FILE as EVENTS_AUDIT_REPORT_FILE,\n  EVENT_INVENTORY_FILE,\n  EVENT_INVENTORY_PART_PATTERN,\n} from '@lib/programs/events-audit/constants';\nimport { AUDIT_REPORT_FILE } from '@lib/programs/audit/types';\nimport { EVENT_PLAN_FILE } from '@lib/programs/posthog-integration/constants';\n\n// ─── Warlock module accessor ─────────────────────────────────────\n// Warlock is ESM-only and lazily inits its WASM engine + compiles rules on the\n// first scan() call. We import it once and cache the module promise so the\n// warmed engine (a warlock-internal singleton) is shared across every hook.\n// Mirrors the lazy `await import(...)` pattern used for the agent SDK.\n\ntype WarlockModule = typeof import('@posthog/warlock');\n\nlet warlockModulePromise: Promise<WarlockModule> | null = null;\n\nfunction getWarlock(): Promise<WarlockModule> {\n  if (!warlockModulePromise) {\n    // Clear the cache on rejection so a transient failure (flaky disk, ESM\n    // resolver hiccup) doesn't poison the cache for the rest of the process\n    // lifetime. Without this, one rejected import permanently locks every\n    // hook into fail-closed-terminate until restart.\n    warlockModulePromise = import('@posthog/warlock').catch((err) => {\n      warlockModulePromise = null;\n      throw err;\n    });\n  }\n  return warlockModulePromise;\n}\n\n/**\n * Pay the WASM-init + rule-compile cost up front, off the hook path, so the\n * first real tool-call scan doesn't eat cold-start under a hook timeout.\n * Best-effort: a failure here is non-fatal — hooks still fail closed per scan.\n */\nexport async function prewarmYaraScanner(): Promise<void> {\n  try {\n    const warlock = await getWarlock();\n    await warlock.scan('');\n    logToFile('[YARA] warlock pre-warmed');\n  } catch (err) {\n    logToFile('[YARA] warlock pre-warm failed:', err);\n  }\n}\n\n// ─── Types ───────────────────────────────────────────────────────\n// Loose hook types to avoid tight coupling to the SDK version.\n// The SDK hook types are: HookCallbackMatcher[], where each matcher\n// has { matcher?: string, hooks: HookCallback[], timeout?: number }\n\ntype HookInput = Record<string, unknown>;\ntype HookOutput = Record<string, unknown>;\ntype HookCallback = (\n  input: HookInput,\n  toolUseID: string | undefined,\n  options: { signal: AbortSignal },\n) => Promise<HookOutput>;\n\nexport interface HookCallbackMatcher {\n  matcher?: string;\n  hooks: HookCallback[];\n  timeout?: number;\n}\n\nexport type { ScanAction, ScanContext } from './yara-policy';\n\n// ─── Scan Report Accumulator ─────────────────────────────────────\n\ninterface ScanReportEntry {\n  rule: string;\n  severity: string;\n  category: string;\n  action: ScanAction;\n  phase: string;\n  tool: string;\n  /** Rule description — the human-readable \"why\". Rule-static, safe to report. */\n  description: string;\n  /** Triage outcome, when triage ran. */\n  triageVerdict?: string;\n  /**\n   * Free-text triage rationale. May quote scanned content, so it is written to\n   * the local report file only — NEVER sent to PostHog (see captureScanReport).\n   */\n  triageReason?: string;\n}\n\nlet scanCount = 0;\nconst scanViolations: ScanReportEntry[] = [];\n\nfunction recordScan(): void {\n  scanCount++;\n}\n\n// recordMatch is the single entry point for a violation (log + telemetry +\n// report). scanViolations is appended only there.\n\n/**\n * Log a match to the run log + PostHog, and record it in the run's scan report.\n * Single entry point so every violation is reported consistently.\n */\nfunction recordMatch(\n  phase: string,\n  tool: string,\n  match: ScanMatch,\n  action: ScanAction,\n): void {\n  const triage = (match as TriageMatch).triage;\n  logYaraMatch(phase, tool, match, action);\n  scanViolations.push({\n    rule: match.rule,\n    severity: match.metadata.severity ?? 'unknown',\n    category: match.metadata.category ?? 'unknown',\n    action,\n    phase,\n    tool,\n    description: match.metadata.description ?? '',\n    triageVerdict: triage?.verdict,\n    triageReason: triage?.reason,\n  });\n}\n\n/** Reset counters (for testing) */\nexport function resetScanReport(): void {\n  scanCount = 0;\n  scanViolations.length = 0;\n}\n\n/**\n * Scan bookkeeping for harnesses that run a scanner outside these hooks (pi):\n * counts the scan and routes violations through `recordMatch`, so they reach\n * the run log, per-match telemetry, and the end-of-run scan report.\n */\nexport function recordExternalScan(\n  phase: string,\n  tool: string,\n  violations: Array<{\n    rule: string;\n    severity: string;\n    category: string;\n    description: string;\n  }>,\n  action: ScanAction,\n): void {\n  recordScan();\n  for (const v of violations) {\n    recordMatch(\n      phase,\n      tool,\n      {\n        rule: v.rule,\n        metadata: {\n          severity: v.severity as ScanMatch['metadata']['severity'],\n          category: v.category as ScanMatch['metadata']['category'],\n          description: v.description,\n        },\n        matchedStrings: [],\n      },\n      action,\n    );\n  }\n}\n\n/** Format the scan report summary. Returns null if no scans occurred */\nexport function formatScanReport(): string | null {\n  if (scanCount === 0) return null;\n\n  const lines: string[] = ['', '— YARA Scanner Summary —'];\n  const violationCount = scanViolations.length;\n  const cleanCount = scanCount - violationCount;\n\n  lines.push(\n    `✓ ${scanCount} tool calls scanned, ${violationCount} violation${\n      violationCount !== 1 ? 's' : ''\n    } detected`,\n  );\n\n  if (violationCount > 0) {\n    lines.push('');\n    for (const v of scanViolations) {\n      const tag = v.action.toUpperCase();\n      lines.push(\n        `  [${tag}] ${v.rule} (${v.severity.toUpperCase()}) — ${v.phase}:${\n          v.tool\n        }`,\n      );\n    }\n  }\n\n  if (cleanCount > 0) {\n    lines.push('');\n    lines.push(\n      `No violations: ✓ ${cleanCount} clean scan${cleanCount !== 1 ? 's' : ''}`,\n    );\n  }\n\n  lines.push('');\n  return lines.join('\\n');\n}\n\n/** Write the scan report to a JSON file. Returns the file path, or null if no scans occurred. */\nexport function writeScanReport(): string | null {\n  if (scanCount === 0) return null;\n\n  const report = {\n    summary: {\n      totalScans: scanCount,\n      violations: scanViolations.length,\n      clean: scanCount - scanViolations.length,\n    },\n    violations: scanViolations,\n  };\n\n  try {\n    fs.writeFileSync(WIZARD_YARA_REPORT_FILE, JSON.stringify(report, null, 2));\n  } catch (err) {\n    logToFile('[YARA] Failed to write scan report:', err);\n    return null;\n  }\n  return WIZARD_YARA_REPORT_FILE;\n}\n\n// ─── User-facing abort copy ──────────────────────────────────────\n//\n// The abort screen is the one security surface a user actually sees, so it must\n// say what was caught and that we protected them, in plain language, instead of\n// a bare \"Security violation detected.\" Warlock owns the rules and categories;\n// this map is the wizard's *presentation* of a category it already detected. We\n// deliberately do not surface warlock's own rule `description` here: it is\n// written for maintainers (it ships to telemetry) and reads as technical. The\n// `Category` type is a stable, append-only warlock API, so a new category just\n// falls through to the generic line below rather than breaking the build.\n\nconst CATEGORY_DESCRIPTIONS: Record<Category, string> = {\n  prompt_injection:\n    'hit hidden instructions in a file it read, a possible attempt to hijack the setup',\n  exfiltration: 'tried to send data to an outside location',\n  destructive_operations: 'tried to run a destructive command',\n  supply_chain: 'tried to pull in untrusted code',\n  posthog_pii: 'tried to write personal data (PII) into your project',\n  posthog_hardcoded_key: 'tried to hardcode a PostHog key into your project',\n  hardcoded_secret: 'tried to hardcode a secret into your project',\n};\n\n/** Most recent violation that terminated the run, or null. */\nfunction lastTerminatingViolation(): ScanReportEntry | null {\n  for (let i = scanViolations.length - 1; i >= 0; i--) {\n    if (scanViolations[i].action === 'aborted') return scanViolations[i];\n  }\n  return null;\n}\n\n/**\n * Build the user-facing copy for the security abort screen: what the scanner\n * caught and what we did about it. This screen renders only because the run was\n * stopped, so the \"what we did\" half is constant. Falls back to a generic line\n * when no specific violation was recorded (e.g. the scanner itself errored and\n * failed closed before a match was logged).\n */\nexport function formatYaraAbortMessage(): string {\n  const v = lastTerminatingViolation();\n  const what =\n    (v && CATEGORY_DESCRIPTIONS[v.category as Category]) ??\n    'did something our security scanner flagged';\n\n  return (\n    'Security check stopped the setup.\\n\\n' +\n    `The agent ${what}. We stopped the run to keep your project safe.\\n` +\n    'No unsafe changes were left in your project.\\n\\n' +\n    'If this looks wrong, let us know: wizard@posthog.com'\n  );\n}\n\n// ─── Hook Timeouts (ms) ─────────────────────────────────────────\n// Generous because triage adds an LLM round-trip, and because a *fired* hook\n// timeout means the protective action is dropped (fail-open). The triage HTTP\n// call has its own shorter internal timeout (see agent-interface), so a hung\n// triage fails inside our catch (fail-closed) before these fire.\n\n/** Timeout for scan hooks (PreToolUse, PostToolUse Write/Edit/Read/Grep) */\nconst HOOK_TIMEOUT_MS = 30_000;\n/** Timeout for the skill install hook (filesystem I/O + multiple scans) */\nconst SKILL_SCAN_HOOK_TIMEOUT_MS = 30_000;\n\n/**\n * Chunk size for scanning (100 KB). Oversized content is scanned in\n * overlapping chunks so coverage is complete — nothing is silently truncated.\n * The size also bounds what a single triage call pastes into the LLM prompt\n * (~25K tokens), so triage always sees the chunk its matches came from.\n */\nconst SCAN_CHUNK_SIZE = 100_000;\n\n// A skill file is read at most this far; the rest is head-scanned and logged.\nconst SKILL_FILE_SCAN_BYTES = 10 * 1024 * 1024;\n/**\n * Overlap between adjacent chunks so a pattern straddling a chunk boundary\n * still lands whole inside at least one chunk. YARA rule strings are at most\n * a few hundred bytes; 4 KB is generous.\n */\nconst SCAN_CHUNK_OVERLAP = 4_096;\n\n// ─── Logging ─────────────────────────────────────────────────────\n\nfunction logYaraMatch(\n  phase: string,\n  tool: string,\n  match: ScanMatch,\n  action: ScanAction,\n): void {\n  const severity = match.metadata.severity ?? 'unknown';\n  const category = match.metadata.category ?? 'unknown';\n  const ruleAction = match.metadata.action ?? 'unknown';\n  const description = match.metadata.description ?? '';\n  logToFile(\n    `[YARA] ${phase}:${tool} [${action.toUpperCase()}] rule \"${match.rule}\" ` +\n      `(severity: ${severity}, category: ${category}, action: ${ruleAction})\\n` +\n      `  Description: ${description}`,\n  );\n  analytics.wizardCapture('yara rule matched', {\n    rule: match.rule,\n    severity: match.metadata.severity,\n    category: match.metadata.category,\n    rule_action: match.metadata.action,\n    action,\n    phase,\n    tool,\n    // Rule-static description — the \"why\". The free-text triage reason is\n    // deliberately omitted (it can quote scanned content; stays local-only).\n    description: match.metadata.description,\n    triage_verdict: (match as TriageMatch).triage?.verdict,\n  });\n}\n\n/**\n * Send the run's full scan report to PostHog so maintainers can see why a run\n * was flagged, warned, or aborted. This is the maintainer-facing report — it is\n * NEVER shown to the user. No-op if nothing was scanned. The free-text triage\n * reason is omitted to avoid sending scanned content off the user's machine.\n */\nexport function captureScanReport(): void {\n  if (scanCount === 0) return;\n  analytics.wizardCapture('yara scan report', {\n    total_scans: scanCount,\n    violation_count: scanViolations.length,\n    clean_count: scanCount - scanViolations.length,\n    violations: scanViolations.map((v) => ({\n      rule: v.rule,\n      severity: v.severity,\n      category: v.category,\n      action: v.action,\n      phase: v.phase,\n      tool: v.tool,\n      description: v.description,\n      triage_verdict: v.triageVerdict,\n    })),\n  });\n  // Reset after sending so a second captureScanReport on this same run\n  // (e.g. success-path call followed by an abort during shutdown) can't\n  // ship duplicate telemetry. Also protects future chained-program runs.\n  scanCount = 0;\n  scanViolations.length = 0;\n}\n\n/**\n * End-of-run flush for the scan report. Wired once at the runner seam so every\n * harness (linear, orchestrator, and any future shape) reports without having\n * to know warlock exists — scanning is already harness-agnostic (it runs from\n * SDK Pre/PostToolUse hooks), and this keeps reporting at a single shared seam.\n *\n * Order matters: write the local --yara-report file FIRST (it reads scanCount /\n * scanViolations), THEN send telemetry. captureScanReport() zeroes scan state,\n * which is what makes this whole function idempotent — a second call from\n * another termination path (e.g. finally after an abort already flushed) finds\n * scanCount === 0 and every step no-ops.\n */\nexport function flushScanReport(\n  session: Pick<WizardSession, 'yaraReport'>,\n): void {\n  if (session.yaraReport) {\n    const reportPath = writeScanReport();\n    if (reportPath) {\n      const summary = formatScanReport();\n      getUI().log.info(`YARA scan report: ${reportPath}${summary ?? ''}`);\n    }\n  }\n  captureScanReport();\n}\n\n// ─── Wizard-documentation allowlist ───────────────────────────────\n//\n// Files the wizard's own programs write to describe events the user's\n// codebase already captures, or events the integration program is\n// proposing to add. When the agent copies a literal\n// `posthog.capture('event', { email: ... })` snippet (or a property\n// list including PII-shaped keys) into one of these files, the\n// `pii_in_capture_call` rule (category: posthog_pii) fires even though\n// the wizard is documenting / planning, not introducing, the pattern.\n// Suppress posthog_pii matches on these paths only; every other rule\n// (secrets, prompt injection, supply chain, destructive ops) still\n// fires normally so the file cannot be used as a smuggling vector for\n// actual violations.\n\nconst WIZARD_DOC_BASENAMES = new Set([\n  EVENT_INVENTORY_FILE,\n  EVENTS_AUDIT_REPORT_FILE,\n  AUDIT_REPORT_FILE,\n  EVENT_PLAN_FILE,\n]);\n\nconst WIZARD_DOC_PATTERNS: RegExp[] = [EVENT_INVENTORY_PART_PATTERN];\n\nexport function isWizardDocumentationPath(\n  filePath: string | undefined,\n): boolean {\n  if (!filePath) return false;\n  const basename = path.basename(filePath);\n  if (WIZARD_DOC_BASENAMES.has(basename)) return true;\n  return WIZARD_DOC_PATTERNS.some((re) => re.test(basename));\n}\n\n// ─── Repeat-block tracker ─────────────────────────────────────────\n//\n// Field data (switchboard YARA tile): an agent whose edit gets blocked often\n// retries the identical payload — the scan is deterministic, so every retry\n// blocks again and the run burns turns (~4.2 blocks per affected run). The\n// runtime notes already say \"don't retry\"; the data shows the prompt alone\n// doesn't hold. This is the code-side guard: remember the exact payloads we\n// blocked, and when the same content comes back, escalate the block reason —\n// first to \"change the code, not the retry\", then to \"report it and move on\".\n// Used by both fences: the anthropic PreToolUse Bash hook below, and the pi\n// security extension's pre-execution scan (bash/write/edit).\n\n/** Identical-payload attempt at which the agent is told to move on. */\nconst REPEAT_BLOCK_MOVE_ON_ATTEMPT = 3;\n\nexport interface RepeatBlockTracker {\n  /**\n   * Record a YARA block of `content` on `tool`; returns the attempt count\n   * for that exact payload (1 = first time blocked).\n   */\n  attempt(tool: string, content: string): number;\n}\n\n/** Per-run tracker of YARA-blocked payloads (keyed by tool + content hash). */\nexport function createRepeatBlockTracker(): RepeatBlockTracker {\n  const counts = new Map<string, number>();\n  return {\n    attempt(tool: string, content: string): number {\n      const key = `${tool} ${createHash('sha256')\n        .update(content)\n        .digest('hex')}`;\n      const next = (counts.get(key) ?? 0) + 1;\n      counts.set(key, next);\n      return next;\n    },\n  };\n}\n\n/**\n * The block reason for the given attempt: the plain reason the first time,\n * an explicit \"this exact retry can never work\" on the second, and a\n * \"report it and move on\" instruction from the third on.\n */\nexport function repeatBlockReason(\n  attempt: number,\n  tool: string,\n  baseReason: string,\n): string {\n  if (attempt <= 1) return baseReason;\n  if (attempt < REPEAT_BLOCK_MOVE_ON_ATTEMPT) {\n    return (\n      `${baseReason} This exact ${tool} content was ALREADY blocked — the scan is ` +\n      'deterministic, so retrying identical content will always block again. ' +\n      'Change the code to remove the flagged pattern instead of retrying.'\n    );\n  }\n  return (\n    `${baseReason} This exact ${tool} content has now been blocked ${attempt} times. ` +\n    'STOP retrying it. Note the blocked change in the setup report and move on to the next task.'\n  );\n}\n\n// ─── Severity helpers ────────────────────────────────────────────\n// Severity vocabulary and the terminate-or-warn decision live in yara-policy.\n\n// ─── Scan + triage core ──────────────────────────────────────────\n\n/**\n * Keep only matches whose rule targets this content surface. Rules carry a\n * `scan_context` of 'command' | 'input' | 'output'. An undefined context is\n * treated as \"applies everywhere\" (fail-safe — a rule that forgets the tag\n * still gets enforced rather than silently skipped).\n */\nfunction matchesForContext(\n  matches: ScanMatch[],\n  ctx: ScanContext,\n): ScanMatch[] {\n  return matches.filter((m) => {\n    const c = m.metadata.scan_context as string | undefined;\n    return c === ctx || c === undefined;\n  });\n}\n\n/**\n * Drop false positives via warlock's LLM triage. Fail-closed: if no provider is\n * available, or the triage call throws, every match is treated as real — we\n * never silently suppress a flagged match.\n *\n * Every overruled match is reported to PostHog (rule metadata only, never the\n * free-text reason) so maintainers can alert on triage-overrule patterns — the\n * signal that someone is either tripping a noisy rule or trying to talk the\n * triage model out of a real finding.\n */\nasync function triageFilter(\n  content: string,\n  matches: ScanMatch[],\n  ctx: ScanContext,\n  llmProvider: LLMProvider | undefined,\n): Promise<ScanMatch[]> {\n  if (matches.length === 0) return [];\n  if (!llmProvider) {\n    logToFile(\n      `[YARA] triage skipped (no provider) — treating ${matches.length} match(es) as real`,\n    );\n    return matches;\n  }\n  try {\n    const warlock = await getWarlock();\n    const triaged = await warlock.triageMatches(content, matches, llmProvider);\n    const kept = triaged.filter((m) => m.triage.verdict === 'true_positive');\n    for (const m of triaged) {\n      if (m.triage.verdict === 'true_positive') continue;\n      logToFile(\n        `[YARA] triage overruled rule \"${m.rule}\" (${\n          m.metadata.severity ?? 'unknown'\n        }) — not acting on it`,\n      );\n      analytics.wizardCapture('yara triage overruled', {\n        rule: m.rule,\n        severity: m.metadata.severity,\n        category: m.metadata.category,\n        scan_context: ctx,\n        // The free-text triage reason is deliberately omitted — it can quote\n        // scanned content, which must never leave the user's machine.\n      });\n    }\n    logToFile(\n      `[YARA] triage: ${matches.length} flagged → ${kept.length} kept as real`,\n    );\n    return kept;\n  } catch (err) {\n    logToFile('[YARA] triage failed — treating all matches as real:', err);\n    return matches;\n  }\n}\n\n/** A chunk of scanned content together with the matches found inside it. */\ninterface FlaggedChunk {\n  chunk: string;\n  matches: ScanMatch[];\n}\n\n/**\n * Split oversized content into overlapping chunks so the scanner covers all\n * of it. Content that fits in one chunk is returned as-is.\n */\nfunction chunkContent(content: string): string[] {\n  if (content.length <= SCAN_CHUNK_SIZE) return [content];\n  const chunks: string[] = [];\n  const step = SCAN_CHUNK_SIZE - SCAN_CHUNK_OVERLAP;\n  for (let start = 0; start < content.length; start += step) {\n    chunks.push(content.slice(start, start + SCAN_CHUNK_SIZE));\n    if (start + SCAN_CHUNK_SIZE >= content.length) break;\n  }\n  return chunks;\n}\n\n/**\n * Scan content against warlock rules — chunked when oversized, so nothing is\n * skipped — and keep only matches for this content surface. Chunks scan\n * sequentially (the WASM engine is single-threaded; parallelism buys nothing).\n * Returns each flagged chunk with its matches so triage can later judge every\n * match against the exact content it came from.\n */\nasync function scanForContext(\n  content: string,\n  ctx: ScanContext,\n): Promise<FlaggedChunk[]> {\n  const warlock = await getWarlock();\n  const chunks = chunkContent(content);\n  if (chunks.length > 1) {\n    logToFile(\n      `[YARA] content is ${content.length} chars — scanning ${chunks.length} overlapping chunks`,\n    );\n    // Alertable signal: oversized content should be rare; a spike could mean\n    // someone is padding content to probe the scanner.\n    analytics.wizardCapture('yara scan chunked', {\n      content_length: content.length,\n      chunk_count: chunks.length,\n      scan_context: ctx,\n    });\n  }\n  const flagged: FlaggedChunk[] = [];\n  for (const chunk of chunks) {\n    const result = await warlock.scan(chunk);\n    if (!result.matched) continue;\n    const matches = matchesForContext(result.matches, ctx);\n    if (matches.length === 0) continue;\n    flagged.push({ chunk, matches });\n  }\n  return flagged;\n}\n\n/** The overlap between chunks can surface the same rule twice; count it once. */\nfunction dedupeByRule(matches: ScanMatch[]): ScanMatch[] {\n  const seen = new Set<string>();\n  return matches.filter((m) => {\n    if (seen.has(m.rule)) return false;\n    seen.add(m.rule);\n    return true;\n  });\n}\n\n/**\n * Triage each flagged chunk against its own content — the evidence is always\n * inside the window the LLM sees. Triage calls run in parallel (each is just\n * an HTTP round trip) so N flagged chunks cost ~1× triage latency, not N×.\n */\nasync function triageFlagged(\n  flagged: FlaggedChunk[],\n  ctx: ScanContext,\n  llmProvider: LLMProvider | undefined,\n): Promise<ScanMatch[]> {\n  const triaged = await Promise.all(\n    flagged.map(({ chunk, matches }) =>\n      triageFilter(chunk, matches, ctx, llmProvider),\n    ),\n  );\n  return dedupeByRule(triaged.flat());\n}\n\n/**\n * Scan content, filter to the relevant context, triage. Returns real matches.\n * Exported for harnesses that run their own hook loop (pi) so every harness\n * scans through the same warlock engine, chunking, and triage policy.\n */\nexport async function scanAndTriage(\n  content: string,\n  ctx: ScanContext,\n  llmProvider: LLMProvider | undefined,\n): Promise<ScanMatch[]> {\n  const flagged = await scanForContext(content, ctx);\n  return triageFlagged(flagged, ctx, llmProvider);\n}\n\n// ─── PreToolUse Hooks ────────────────────────────────────────────\n\n/**\n * Create PreToolUse hook matchers for YARA scanning.\n * Scans Bash commands before execution for exfiltration, destructive\n * operations, and supply chain violations ('command'-context rules).\n */\nexport function createPreToolUseYaraHooks(\n  // Accepted for API symmetry with createPostToolUseYaraHooks, but\n  // intentionally unused: PreToolUse Bash always blocks on any flagged\n  // command regardless of triage verdict, so the LLM call would be wasted.\n  // Future PreToolUse hooks that need triage can wire this through.\n  _llmProvider?: LLMProvider,\n): HookCallbackMatcher[] {\n  const repeatTracker = createRepeatBlockTracker();\n  return [\n    {\n      hooks: [\n        async (input: HookInput): Promise<HookOutput> => {\n          try {\n            const toolName = input.tool_name as string;\n            if (toolName !== 'Bash') return {};\n\n            const toolInput = input.tool_input as Record<string, unknown>;\n            const command =\n              typeof toolInput?.command === 'string' ? toolInput.command : '';\n\n            if (!command) return {};\n\n            recordScan();\n            // Skip triage on PreToolUse Bash: any flagged command is blocked\n            // regardless of triage verdict, so the LLM call would be wasted.\n            const matches = await scanAndTriage(command, 'command', undefined);\n            if (matches.length === 0) return {};\n\n            const match = highestSeverityMatch(matches);\n            recordMatch('PreToolUse', 'Bash', match, 'blocked');\n\n            const attempt = repeatTracker.attempt('Bash', command);\n            return {\n              decision: 'block',\n              reason: repeatBlockReason(\n                attempt,\n                'Bash',\n                `[YARA] ${match.rule}: ${\n                  match.metadata.description ?? 'security policy violation'\n                }. Command blocked for security.`,\n              ),\n            };\n          } catch (error) {\n            logToFile('[YARA] PreToolUse hook error:', error);\n            // Fail closed: block the command if scanning fails\n            return {\n              decision: 'block',\n              reason: '[YARA] Scanner error — command blocked as a precaution.',\n            };\n          }\n        },\n      ],\n      timeout: HOOK_TIMEOUT_MS,\n    },\n  ];\n}\n\n// ─── PostToolUse Hooks ───────────────────────────────────────────\n\n/**\n * Create PostToolUse hook matchers for YARA scanning.\n *\n * Three matchers:\n * 1. Write/Edit — scan written content ('output'-context rules: PII, secrets)\n * 2. Read/Grep — scan read content ('input'-context rules: prompt injection)\n * 3. Bash (skill install) — scan downloaded skill files for poisoned content\n *\n * `onTerminate` is invoked on the terminal paths (critical prompt injection in\n * read content, a poisoned skill, or a scanner error under fail-closed). It is\n * what ACTUALLY stops the run — returning `stopReason` from a PostToolUse hook\n * is not honored by the SDK, so the caller wires this to the run's\n * AbortController (see agent-interface).\n */\nexport function createPostToolUseYaraHooks(\n  llmProvider: LLMProvider | undefined,\n  // REQUIRED, not optional: the SDK ignores `stopReason` from PostToolUse\n  // hooks, so terminal paths (critical prompt injection, poisoned skill,\n  // fail-closed scanner error) depend entirely on this callback firing.\n  // Making it required at compile time prevents a future caller from\n  // silently regressing every terminal path to a no-op.\n  onTerminate: (reason: string) => void,\n): HookCallbackMatcher[] {\n  return [\n    // ── Write/Edit content scanning ──\n    {\n      hooks: [\n        async (input: HookInput): Promise<HookOutput> => {\n          try {\n            const toolName = input.tool_name as string;\n            if (toolName !== 'Write' && toolName !== 'Edit') return {};\n\n            const toolInput = input.tool_input as Record<string, unknown>;\n            // For Write, scan the content being written.\n            // For Edit, scan the new_string (replacement text).\n            const content =\n              toolName === 'Write'\n                ? (toolInput?.content as string) ?? ''\n                : (toolInput?.new_string as string) ?? '';\n\n            if (!content) return {};\n\n            recordScan();\n            const flagged = await scanForContext(content, 'output');\n            if (flagged.length === 0) return {};\n\n            // Wizard-documentation paths: suppress posthog_pii matches that\n            // come from the agent verbatim-copying the user's existing\n            // capture calls into an inventory / report, or planning new\n            // events with PII-shaped property keys. Every other category\n            // still triggers the revert. Suppression runs BEFORE triage so\n            // we never pay an LLM round trip for a match we're about to\n            // discard anyway.\n            // TODO(warlock#33): once warlock PR #33 lands with its\n            // more-precise PII rules, the wizard-side suppression below\n            // should become unnecessary — remove `WIZARD_DOC_BASENAMES`,\n            // `WIZARD_DOC_PATTERNS`, and `isWizardDocumentationPath` and\n            // verify the noisy-PII issue stays fixed.\n            const filePath = toolInput?.file_path as string | undefined;\n            const activeFlagged = isWizardDocumentationPath(filePath)\n              ? flagged\n                  .map(({ chunk, matches }) => ({\n                    chunk,\n                    matches: matches.filter(\n                      (m) => m.metadata.category !== 'posthog_pii',\n                    ),\n                  }))\n                  .filter(({ matches }) => matches.length > 0)\n              : flagged;\n            if (activeFlagged.length === 0) {\n              logToFile(\n                `[YARA] posthog_pii match suppressed on wizard doc ${path.basename(\n                  filePath ?? '',\n                )} (rule: ${flagged[0]?.matches[0]?.rule})`,\n              );\n              return {};\n            }\n\n            const matches = await triageFlagged(\n              activeFlagged,\n              'output',\n              llmProvider,\n            );\n            if (matches.length === 0) return {};\n\n            const match = highestSeverityMatch(matches);\n            recordMatch('PostToolUse', toolName, match, 'reverted');\n\n            return {\n              hookSpecificOutput: {\n                hookEventName: 'PostToolUse',\n                additionalContext:\n                  `[YARA VIOLATION] ${match.rule}: ${\n                    match.metadata.description ?? ''\n                  }. ` +\n                  `You MUST revert this change immediately. The content you just wrote violates security policy.`,\n              },\n            };\n          } catch (error) {\n            logToFile('[YARA] PostToolUse Write/Edit hook error:', error);\n            // Fail closed: if scanning is broken on a Write/Edit, the next\n            // Read/skill-install scan is also going to be broken — terminate\n            // cleanly instead of looping the agent through \"please revert\"\n            // until a Read finally aborts. Matches Read/Grep + skill-install\n            // catch behavior; consistent fail-closed across all PostToolUse.\n            const reason =\n              '[YARA] Scanner error while scanning written content — session terminated as a precaution.';\n            onTerminate(reason);\n            return { stopReason: reason };\n          }\n        },\n      ],\n      timeout: HOOK_TIMEOUT_MS,\n    },\n\n    // ── Read/Grep prompt injection scanning ──\n    {\n      hooks: [\n        async (input: HookInput): Promise<HookOutput> => {\n          try {\n            const toolName = input.tool_name as string;\n            if (toolName !== 'Read' && toolName !== 'Grep') return {};\n\n            const toolResponse = input.tool_response;\n            // Guard before stringify: `JSON.stringify(undefined ?? '')`\n            // returns the 2-char string '\"\"', which is truthy and slips\n            // past the empty-content check below. Exit early when the SDK\n            // gave us no response payload.\n            if (toolResponse == null) return {};\n            const content =\n              typeof toolResponse === 'string'\n                ? toolResponse\n                : JSON.stringify(toolResponse);\n\n            if (!content) return {};\n\n            recordScan();\n            const matches = await scanAndTriage(content, 'input', llmProvider);\n            const verdict = scanVerdict(matches);\n            if (!verdict) return {};\n\n            const { match } = verdict;\n            recordMatch('PostToolUse', toolName, match, verdict.action);\n\n            if (verdict.terminal) {\n              const reason =\n                `[YARA CRITICAL] ${match.rule}: Prompt injection detected in file content. ` +\n                `Agent context is potentially poisoned. Session terminated for safety.`;\n              onTerminate(reason);\n              return { stopReason: reason };\n            }\n\n            return {\n              hookSpecificOutput: {\n                hookEventName: 'PostToolUse',\n                additionalContext: `[YARA WARNING] ${match.rule}: ${\n                  match.metadata.description ?? ''\n                }`,\n              },\n            };\n          } catch (error) {\n            logToFile('[YARA] PostToolUse Read/Grep hook error:', error);\n            // Fail closed: terminate session if scanning fails on read content\n            const reason =\n              '[YARA] Scanner error while scanning read content — session terminated as a precaution.';\n            onTerminate(reason);\n            return { stopReason: reason };\n          }\n        },\n      ],\n      timeout: HOOK_TIMEOUT_MS,\n    },\n\n    // ── Context-mill skill install scanning ──\n    {\n      hooks: [\n        async (input: HookInput): Promise<HookOutput> => {\n          try {\n            const toolName = input.tool_name as string;\n            if (toolName !== 'Bash') return {};\n\n            const toolInput = input.tool_input as Record<string, unknown>;\n            const command =\n              typeof toolInput?.command === 'string' ? toolInput.command : '';\n\n            // Only scan after skill install commands\n            if (!isSkillInstallCommand(command)) return {};\n\n            // Extract skill directory from command\n            const dirMatch = command.match(\n              /mkdir -p (.claude\\/skills\\/[^\\s&]+)/,\n            );\n            if (!dirMatch) return {};\n\n            const skillDir = dirMatch[1];\n            const cwd = (input.cwd as string) ?? process.cwd();\n            recordScan();\n            const matches = await scanSkillFiles(cwd, skillDir, llmProvider);\n\n            const verdict = scanVerdict(matches);\n            if (!verdict) return {};\n\n            recordMatch(\n              'PostToolUse',\n              'Bash (skill install)',\n              verdict.match,\n              verdict.action,\n            );\n            // Same verdict as every other surface: critical terminates, the\n            // rest warn. These rules fire on first-party skill prose often\n            // enough that terminating costs more than it prevents.\n            if (!verdict.terminal) return {};\n\n            const reason =\n              `[YARA CRITICAL] Poisoned skill detected in ${skillDir}: ${verdict.match.rule}. ` +\n              `The downloaded skill contains potential prompt injection. Session terminated for safety.`;\n            onTerminate(reason);\n            return { stopReason: reason };\n          } catch (error) {\n            logToFile('[YARA] PostToolUse skill install hook error:', error);\n            // Fail closed: terminate if skill scanning fails\n            const reason =\n              '[YARA] Scanner error while scanning skill files — session terminated as a precaution.';\n            onTerminate(reason);\n            return { stopReason: reason };\n          }\n        },\n      ],\n      timeout: SKILL_SCAN_HOOK_TIMEOUT_MS,\n    },\n  ];\n}\n\n// ─── Skill File Scanner ──────────────────────────────────────────\n\n/**\n * Scan a freshly installed skill directory (any root — .claude/skills or the\n * orchestrator's run cache) and return a terminate reason when it is poisoned,\n * else null. The choke point for TS-path installs (downloadSkill); agent Bash\n * installs are covered by the PostToolUse matcher above. Runs the same LLM\n * triage as the tool-use scans; fail-closed to treating every match as real when\n * no provider is configured, so a missing key never weakens the check.\n * `llmProvider` is explicit — pi and the orchestrator never set the env fallback.\n *\n * Terminates on the same verdict as every other surface (critical only). A\n * non-terminal match is recorded and the skill is kept: these rules fire on\n * first-party skill prose, and deleting the skill leaves the agent working blind\n * on the very content it needed.\n */\nexport async function scanInstalledSkill(\n  absoluteSkillDir: string,\n  llmProvider: LLMProvider | undefined,\n): Promise<string | null> {\n  recordScan();\n  const matches = await scanSkillFiles(absoluteSkillDir, '.', llmProvider);\n  const verdict = scanVerdict(matches);\n  if (!verdict) return null;\n  recordMatch(\n    'skill-install',\n    'installSkillById',\n    verdict.match,\n    verdict.action,\n  );\n  if (!verdict.terminal) {\n    logToFile(\n      `[YARA] ${verdict.match.rule} (${\n        verdict.match.metadata.severity ?? 'unknown'\n      }) in ${absoluteSkillDir} — non-terminal, keeping the skill`,\n    );\n    return null;\n  }\n  return `Poisoned skill detected: ${verdict.match.rule} (${\n    verdict.match.metadata.severity ?? 'unknown'\n  }) in ${absoluteSkillDir}`;\n}\n\n/**\n * Read and scan all text files in a skill directory for prompt injection.\n * Scans each file sequentially (single-threaded WASM — parallelism buys\n * nothing), unions the 'input'-context matches, then triages once across the\n * combined content. Returns the real (post-triage) matches.\n */\nasync function scanSkillFiles(\n  cwd: string,\n  skillDir: string,\n  llmProvider: LLMProvider | undefined,\n): Promise<ScanMatch[]> {\n  const absoluteDir = path.resolve(cwd, skillDir);\n\n  if (!fs.existsSync(absoluteDir)) {\n    logToFile(`[YARA] Skill directory does not exist: ${absoluteDir}`);\n    return [];\n  }\n\n  const files = await fg('**/*.{md,txt,yaml,yml,json,js,ts,py,rb,sh}', {\n    cwd: absoluteDir,\n    absolute: true,\n  });\n\n  if (files.length === 0) {\n    logToFile(`[YARA] No text files found in skill directory: ${absoluteDir}`);\n    return [];\n  }\n\n  logToFile(\n    `[YARA] Scanning ${files.length} files in skill directory: ${skillDir}`,\n  );\n\n  // Pass 1 (sequential): read and scan ONE file at a time through the\n  // chunk-aware path. Oversized files are scanned up to the cap and logged —\n  // never silently skipped. Flagged chunks keep a reference to the exact\n  // content their matches came from.\n  const flagged: FlaggedChunk[] = [];\n  for (const filePath of files) {\n    let content: string | null;\n    try {\n      if (fs.statSync(filePath).size > SKILL_FILE_SCAN_BYTES) {\n        logToFile(\n          `[YARA] Skill file over ${SKILL_FILE_SCAN_BYTES} bytes; scanning its head only: ${filePath}`,\n        );\n        content = readFileHead(filePath, SKILL_FILE_SCAN_BYTES);\n      } else {\n        content = fs.readFileSync(filePath, 'utf-8');\n      }\n    } catch (err) {\n      logToFile(`[YARA] Could not read skill file ${filePath}:`, err);\n      continue;\n    }\n    if (content) {\n      flagged.push(...(await scanForContext(content, 'input')));\n    }\n  }\n\n  // Pass 2 (parallel, inside triageFlagged): triage each flagged chunk\n  // against its own content concurrently. Triage is just an axios call —\n  // running them in parallel cuts total wall-clock from N × triage-timeout\n  // to ~1×. Important because the hook's HOOK_TIMEOUT_MS is 30s; serial\n  // triage on 2+ matched files could blow the hook timeout under a slow\n  // Haiku.\n  return triageFlagged(flagged, 'input', llmProvider);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AASA,SAAgB,sBAAsB,SAA0B;AAC9D,KAAI,CAAC,QAAQ,WAAW,2BAA2B,CAAE,QAAO;CAE5D,MAAM,WAAW,QAAQ,MAAM,4BAA4B;AAC3D,KAAI,CAAC,SAAU,QAAO;CAEtB,MAAM,MAAM,SAAS;AACrB,QACE,IAAI,WAAW,oDAAoD,IACnE,4BAA4B,KAAK,IAAI;;;;;ACDzC,MAAM,gBAAwC;CAC5C,UAAU;CACV,MAAM;CACN,QAAQ;CACR,KAAK;CACN;;AAGD,MAAM,sBAAsB,IAAI,IAAI,CAAC,WAAW,CAAC;;;;;;;;AASjD,SAAgB,gBAAgB,OAA2B;AACzD,QAAO,oBAAoB,IAAI,MAAM,SAAS,YAAY,GAAG;;;AAI/D,SAAgB,qBAAqB,SAAiC;AACpE,QAAO,QAAQ,QAAQ,OAAO,OAC3B,cAAc,EAAE,SAAS,YAAY,OAAO,MAC5C,cAAc,MAAM,SAAS,YAAY,OAAO,KAC7C,IACA,MACL;;;AAaH,SAAgB,YAAY,SAA0C;AACpE,KAAI,QAAQ,WAAW,EAAG,QAAO;CACjC,MAAM,QAAQ,qBAAqB,QAAQ;CAC3C,MAAM,WAAW,gBAAgB,MAAM;AACvC,QAAO;EAAE;EAAO;EAAU,QAAQ,WAAW,YAAY;EAAU;;;;;;;;;;;ACtDrE,MAAa,oBAAoB;AACjC,MAAa,uBAAuB;;AAEpC,MAAa,+BACX;;;;ACYF,MAAa,uBAAgE;CAC3E,SAAS;EAAE,OAAO;EAAK,OAAO;EAAQ;CACtC,MAAM;EAAE,OAAO;EAAK,OAAO;EAAS;CACpC,OAAO;EAAE,OAAO;EAAK,OAAO;EAAO;CACnC,SAAS;EAAE,OAAO;EAAK,OAAO;EAAU;CACxC,YAAY;EAAE,OAAO;EAAK,OAAO;EAAQ;CAC1C;AAED,MAAa,oBAAoB;AACjC,MAAa,oBAAoB;AACjC,MAAa,mBAAmB;AAEhC,SAAgB,eAAe,SAAsC;CACnE,MAAM,MAAM,QAAQ,iBAAiB;AACrC,QAAO,MAAM,QAAQ,IAAI,GAAI,MAAuB,EAAE;;;;;;;;;;AAWxD,SAAgB,kBAAkB,QAA+B;AAC/D,QAAO,MAAM,QAAQ,OAAO,GAAI,SAA0B,EAAE;;;;;;;;;;;;ACzC9D,MAAa,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;AC2D/B,IAAI,uBAAsD;AAE1D,SAAS,aAAqC;AAC5C,KAAI,CAAC,qBAKH,wBAAuB,OAAO,oBAAoB,OAAO,QAAQ;AAC/D,yBAAuB;AACvB,QAAM;GACN;AAEJ,QAAO;;;;;;;AAQT,eAAsB,qBAAoC;AACxD,KAAI;AAEF,SADgB,MAAM,YAAY,EACpB,KAAK,GAAG;AACtB,YAAU,4BAA4B;UAC/B,KAAK;AACZ,YAAU,mCAAmC,IAAI;;;AA6CrD,IAAI,YAAY;AAChB,MAAM,iBAAoC,EAAE;AAE5C,SAAS,aAAmB;AAC1B;;;;;;AAUF,SAAS,YACP,OACA,MACA,OACA,QACM;CACN,MAAM,SAAU,MAAsB;AACtC,cAAa,OAAO,MAAM,OAAO,OAAO;AACxC,gBAAe,KAAK;EAClB,MAAM,MAAM;EACZ,UAAU,MAAM,SAAS,YAAY;EACrC,UAAU,MAAM,SAAS,YAAY;EACrC;EACA;EACA;EACA,aAAa,MAAM,SAAS,eAAe;EAC3C,eAAe,QAAQ;EACvB,cAAc,QAAQ;EACvB,CAAC;;;;;;;AAcJ,SAAgB,mBACd,OACA,MACA,YAMA,QACM;AACN,aAAY;AACZ,MAAK,MAAM,KAAK,WACd,aACE,OACA,MACA;EACE,MAAM,EAAE;EACR,UAAU;GACR,UAAU,EAAE;GACZ,UAAU,EAAE;GACZ,aAAa,EAAE;GAChB;EACD,gBAAgB,EAAE;EACnB,EACD,OACD;;;AAKL,SAAgB,mBAAkC;AAChD,KAAI,cAAc,EAAG,QAAO;CAE5B,MAAM,QAAkB,CAAC,IAAI,2BAA2B;CACxD,MAAM,iBAAiB,eAAe;CACtC,MAAM,aAAa,YAAY;AAE/B,OAAM,KACJ,KAAK,UAAU,uBAAuB,eAAe,YACnD,mBAAmB,IAAI,MAAM,GAC9B,WACF;AAED,KAAI,iBAAiB,GAAG;AACtB,QAAM,KAAK,GAAG;AACd,OAAK,MAAM,KAAK,gBAAgB;GAC9B,MAAM,MAAM,EAAE,OAAO,aAAa;AAClC,SAAM,KACJ,MAAM,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,SAAS,aAAa,CAAC,MAAM,EAAE,MAAM,GAC9D,EAAE,OAEL;;;AAIL,KAAI,aAAa,GAAG;AAClB,QAAM,KAAK,GAAG;AACd,QAAM,KACJ,oBAAoB,WAAW,aAAa,eAAe,IAAI,MAAM,KACtE;;AAGH,OAAM,KAAK,GAAG;AACd,QAAO,MAAM,KAAK,KAAK;;;AAIzB,SAAgB,kBAAiC;AAC/C,KAAI,cAAc,EAAG,QAAO;CAE5B,MAAM,SAAS;EACb,SAAS;GACP,YAAY;GACZ,YAAY,eAAe;GAC3B,OAAO,YAAY,eAAe;GACnC;EACD,YAAY;EACb;AAED,KAAI;AACF,KAAG,cAAc,yBAAyB,KAAK,UAAU,QAAQ,MAAM,EAAE,CAAC;UACnE,KAAK;AACZ,YAAU,uCAAuC,IAAI;AACrD,SAAO;;AAET,QAAO;;AAcT,MAAM,wBAAkD;CACtD,kBACE;CACF,cAAc;CACd,wBAAwB;CACxB,cAAc;CACd,aAAa;CACb,uBAAuB;CACvB,kBAAkB;CACnB;;AAGD,SAAS,2BAAmD;AAC1D,MAAK,IAAI,IAAI,eAAe,SAAS,GAAG,KAAK,GAAG,IAC9C,KAAI,eAAe,GAAG,WAAW,UAAW,QAAO,eAAe;AAEpE,QAAO;;;;;;;;;AAUT,SAAgB,yBAAiC;CAC/C,MAAM,IAAI,0BAA0B;AAKpC,QACE;;aAJC,KAAK,sBAAsB,EAAE,cAC9B,6CAIkB;;;;;AAatB,MAAM,kBAAkB;;AAExB,MAAM,6BAA6B;;;;;;;AAQnC,MAAM,kBAAkB;AAGxB,MAAM,wBAAwB,KAAK,OAAO;;;;;;AAM1C,MAAM,qBAAqB;AAI3B,SAAS,aACP,OACA,MACA,OACA,QACM;CACN,MAAM,WAAW,MAAM,SAAS,YAAY;CAC5C,MAAM,WAAW,MAAM,SAAS,YAAY;CAC5C,MAAM,aAAa,MAAM,SAAS,UAAU;CAC5C,MAAM,cAAc,MAAM,SAAS,eAAe;AAClD,WACE,UAAU,MAAM,GAAG,KAAK,IAAI,OAAO,aAAa,CAAC,UAAU,MAAM,KAAK,eACtD,SAAS,cAAc,SAAS,YAAY,WAAW,oBACnD,cACrB;AACD,WAAU,cAAc,qBAAqB;EAC3C,MAAM,MAAM;EACZ,UAAU,MAAM,SAAS;EACzB,UAAU,MAAM,SAAS;EACzB,aAAa,MAAM,SAAS;EAC5B;EACA;EACA;EAGA,aAAa,MAAM,SAAS;EAC5B,gBAAiB,MAAsB,QAAQ;EAChD,CAAC;;;;;;;;AASJ,SAAgB,oBAA0B;AACxC,KAAI,cAAc,EAAG;AACrB,WAAU,cAAc,oBAAoB;EAC1C,aAAa;EACb,iBAAiB,eAAe;EAChC,aAAa,YAAY,eAAe;EACxC,YAAY,eAAe,KAAK,OAAO;GACrC,MAAM,EAAE;GACR,UAAU,EAAE;GACZ,UAAU,EAAE;GACZ,QAAQ,EAAE;GACV,OAAO,EAAE;GACT,MAAM,EAAE;GACR,aAAa,EAAE;GACf,gBAAgB,EAAE;GACnB,EAAE;EACJ,CAAC;AAIF,aAAY;AACZ,gBAAe,SAAS;;;;;;;;;;;;;;AAe1B,SAAgB,gBACd,SACM;AACN,KAAI,QAAQ,YAAY;EACtB,MAAM,aAAa,iBAAiB;AACpC,MAAI,YAAY;GACd,MAAM,UAAU,kBAAkB;AAClC,UAAO,CAAC,IAAI,KAAK,qBAAqB,aAAa,WAAW,KAAK;;;AAGvE,oBAAmB;;AAiBrB,MAAM,uBAAuB,IAAI,IAAI;CACnC;CACAA;CACA;CACA;CACD,CAAC;AAEF,MAAM,sBAAgC,CAAC,6BAA6B;AAEpE,SAAgB,0BACd,UACS;AACT,KAAI,CAAC,SAAU,QAAO;CACtB,MAAM,WAAW,KAAK,SAAS,SAAS;AACxC,KAAI,qBAAqB,IAAI,SAAS,CAAE,QAAO;AAC/C,QAAO,oBAAoB,MAAM,OAAO,GAAG,KAAK,SAAS,CAAC;;;AAgB5D,MAAM,+BAA+B;;AAWrC,SAAgB,2BAA+C;CAC7D,MAAM,yBAAS,IAAI,KAAqB;AACxC,QAAO,EACL,QAAQ,MAAc,SAAyB;EAC7C,MAAM,MAAM,GAAG,KAAK,GAAG,WAAW,SAAS,CACxC,OAAO,QAAQ,CACf,OAAO,MAAM;EAChB,MAAM,QAAQ,OAAO,IAAI,IAAI,IAAI,KAAK;AACtC,SAAO,IAAI,KAAK,KAAK;AACrB,SAAO;IAEV;;;;;;;AAQH,SAAgB,kBACd,SACA,MACA,YACQ;AACR,KAAI,WAAW,EAAG,QAAO;AACzB,KAAI,UAAU,6BACZ,QACE,GAAG,WAAW,cAAc,KAAK;AAKrC,QACE,GAAG,WAAW,cAAc,KAAK,gCAAgC,QAAQ;;;;;;;;AAgB7E,SAAS,kBACP,SACA,KACa;AACb,QAAO,QAAQ,QAAQ,MAAM;EAC3B,MAAM,IAAI,EAAE,SAAS;AACrB,SAAO,MAAM,OAAO,MAAM,KAAA;GAC1B;;;;;;;;;;;;AAaJ,eAAe,aACb,SACA,SACA,KACA,aACsB;AACtB,KAAI,QAAQ,WAAW,EAAG,QAAO,EAAE;AACnC,KAAI,CAAC,aAAa;AAChB,YACE,kDAAkD,QAAQ,OAAO,oBAClE;AACD,SAAO;;AAET,KAAI;EAEF,MAAM,UAAU,OADA,MAAM,YAAY,EACJ,cAAc,SAAS,SAAS,YAAY;EAC1E,MAAM,OAAO,QAAQ,QAAQ,MAAM,EAAE,OAAO,YAAY,gBAAgB;AACxE,OAAK,MAAM,KAAK,SAAS;AACvB,OAAI,EAAE,OAAO,YAAY,gBAAiB;AAC1C,aACE,iCAAiC,EAAE,KAAK,KACtC,EAAE,SAAS,YAAY,UACxB,sBACF;AACD,aAAU,cAAc,yBAAyB;IAC/C,MAAM,EAAE;IACR,UAAU,EAAE,SAAS;IACrB,UAAU,EAAE,SAAS;IACrB,cAAc;IAGf,CAAC;;AAEJ,YACE,kBAAkB,QAAQ,OAAO,aAAa,KAAK,OAAO,eAC3D;AACD,SAAO;UACA,KAAK;AACZ,YAAU,wDAAwD,IAAI;AACtE,SAAO;;;;;;;AAcX,SAAS,aAAa,SAA2B;AAC/C,KAAI,QAAQ,UAAU,gBAAiB,QAAO,CAAC,QAAQ;CACvD,MAAM,SAAmB,EAAE;CAC3B,MAAM,OAAO,kBAAkB;AAC/B,MAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS,MAAM;AACzD,SAAO,KAAK,QAAQ,MAAM,OAAO,QAAQ,gBAAgB,CAAC;AAC1D,MAAI,QAAQ,mBAAmB,QAAQ,OAAQ;;AAEjD,QAAO;;;;;;;;;AAUT,eAAe,eACb,SACA,KACyB;CACzB,MAAM,UAAU,MAAM,YAAY;CAClC,MAAM,SAAS,aAAa,QAAQ;AACpC,KAAI,OAAO,SAAS,GAAG;AACrB,YACE,qBAAqB,QAAQ,OAAO,oBAAoB,OAAO,OAAO,qBACvE;AAGD,YAAU,cAAc,qBAAqB;GAC3C,gBAAgB,QAAQ;GACxB,aAAa,OAAO;GACpB,cAAc;GACf,CAAC;;CAEJ,MAAM,UAA0B,EAAE;AAClC,MAAK,MAAM,SAAS,QAAQ;EAC1B,MAAM,SAAS,MAAM,QAAQ,KAAK,MAAM;AACxC,MAAI,CAAC,OAAO,QAAS;EACrB,MAAM,UAAU,kBAAkB,OAAO,SAAS,IAAI;AACtD,MAAI,QAAQ,WAAW,EAAG;AAC1B,UAAQ,KAAK;GAAE;GAAO;GAAS,CAAC;;AAElC,QAAO;;;AAIT,SAAS,aAAa,SAAmC;CACvD,MAAM,uBAAO,IAAI,KAAa;AAC9B,QAAO,QAAQ,QAAQ,MAAM;AAC3B,MAAI,KAAK,IAAI,EAAE,KAAK,CAAE,QAAO;AAC7B,OAAK,IAAI,EAAE,KAAK;AAChB,SAAO;GACP;;;;;;;AAQJ,eAAe,cACb,SACA,KACA,aACsB;AAMtB,QAAO,cALS,MAAM,QAAQ,IAC5B,QAAQ,KAAK,EAAE,OAAO,cACpB,aAAa,OAAO,SAAS,KAAK,YAAY,CAC/C,CACF,EAC2B,MAAM,CAAC;;;;;;;AAQrC,eAAsB,cACpB,SACA,KACA,aACsB;AAEtB,QAAO,cADS,MAAM,eAAe,SAAS,IAAI,EACpB,KAAK,YAAY;;;;;;;AAUjD,SAAgB,0BAKd,cACuB;CACvB,MAAM,gBAAgB,0BAA0B;AAChD,QAAO,CACL;EACE,OAAO,CACL,OAAO,UAA0C;AAC/C,OAAI;AAEF,QADiB,MAAM,cACN,OAAQ,QAAO,EAAE;IAElC,MAAM,YAAY,MAAM;IACxB,MAAM,UACJ,OAAO,WAAW,YAAY,WAAW,UAAU,UAAU;AAE/D,QAAI,CAAC,QAAS,QAAO,EAAE;AAEvB,gBAAY;IAGZ,MAAM,UAAU,MAAM,cAAc,SAAS,WAAW,KAAA,EAAU;AAClE,QAAI,QAAQ,WAAW,EAAG,QAAO,EAAE;IAEnC,MAAM,QAAQ,qBAAqB,QAAQ;AAC3C,gBAAY,cAAc,QAAQ,OAAO,UAAU;AAGnD,WAAO;KACL,UAAU;KACV,QAAQ,kBAHM,cAAc,QAAQ,QAAQ,QAAQ,EAKlD,QACA,UAAU,MAAM,KAAK,IACnB,MAAM,SAAS,eAAe,4BAC/B,iCACF;KACF;YACM,OAAO;AACd,cAAU,iCAAiC,MAAM;AAEjD,WAAO;KACL,UAAU;KACV,QAAQ;KACT;;IAGN;EACD,SAAS;EACV,CACF;;;;;;;;;;;;;;;;AAmBH,SAAgB,2BACd,aAMA,aACuB;AACvB,QAAO;EAEL;GACE,OAAO,CACL,OAAO,UAA0C;AAC/C,QAAI;KACF,MAAM,WAAW,MAAM;AACvB,SAAI,aAAa,WAAW,aAAa,OAAQ,QAAO,EAAE;KAE1D,MAAM,YAAY,MAAM;KAGxB,MAAM,UACJ,aAAa,UACR,WAAW,WAAsB,KACjC,WAAW,cAAyB;AAE3C,SAAI,CAAC,QAAS,QAAO,EAAE;AAEvB,iBAAY;KACZ,MAAM,UAAU,MAAM,eAAe,SAAS,SAAS;AACvD,SAAI,QAAQ,WAAW,EAAG,QAAO,EAAE;KAcnC,MAAM,WAAW,WAAW;KAC5B,MAAM,gBAAgB,0BAA0B,SAAS,GACrD,QACG,KAAK,EAAE,OAAO,eAAe;MAC5B;MACA,SAAS,QAAQ,QACd,MAAM,EAAE,SAAS,aAAa,cAChC;MACF,EAAE,CACF,QAAQ,EAAE,cAAc,QAAQ,SAAS,EAAE,GAC9C;AACJ,SAAI,cAAc,WAAW,GAAG;AAC9B,gBACE,qDAAqD,KAAK,SACxD,YAAY,GACb,CAAC,UAAU,QAAQ,IAAI,QAAQ,IAAI,KAAK,GAC1C;AACD,aAAO,EAAE;;KAGX,MAAM,UAAU,MAAM,cACpB,eACA,UACA,YACD;AACD,SAAI,QAAQ,WAAW,EAAG,QAAO,EAAE;KAEnC,MAAM,QAAQ,qBAAqB,QAAQ;AAC3C,iBAAY,eAAe,UAAU,OAAO,WAAW;AAEvD,YAAO,EACL,oBAAoB;MAClB,eAAe;MACf,mBACE,oBAAoB,MAAM,KAAK,IAC7B,MAAM,SAAS,eAAe,GAC/B;MAEJ,EACF;aACM,OAAO;AACd,eAAU,6CAA6C,MAAM;KAM7D,MAAM,SACJ;AACF,iBAAY,OAAO;AACnB,YAAO,EAAE,YAAY,QAAQ;;KAGlC;GACD,SAAS;GACV;EAGD;GACE,OAAO,CACL,OAAO,UAA0C;AAC/C,QAAI;KACF,MAAM,WAAW,MAAM;AACvB,SAAI,aAAa,UAAU,aAAa,OAAQ,QAAO,EAAE;KAEzD,MAAM,eAAe,MAAM;AAK3B,SAAI,gBAAgB,KAAM,QAAO,EAAE;KACnC,MAAM,UACJ,OAAO,iBAAiB,WACpB,eACA,KAAK,UAAU,aAAa;AAElC,SAAI,CAAC,QAAS,QAAO,EAAE;AAEvB,iBAAY;KAEZ,MAAM,UAAU,YADA,MAAM,cAAc,SAAS,SAAS,YAAY,CAC9B;AACpC,SAAI,CAAC,QAAS,QAAO,EAAE;KAEvB,MAAM,EAAE,UAAU;AAClB,iBAAY,eAAe,UAAU,OAAO,QAAQ,OAAO;AAE3D,SAAI,QAAQ,UAAU;MACpB,MAAM,SACJ,mBAAmB,MAAM,KAAK;AAEhC,kBAAY,OAAO;AACnB,aAAO,EAAE,YAAY,QAAQ;;AAG/B,YAAO,EACL,oBAAoB;MAClB,eAAe;MACf,mBAAmB,kBAAkB,MAAM,KAAK,IAC9C,MAAM,SAAS,eAAe;MAEjC,EACF;aACM,OAAO;AACd,eAAU,4CAA4C,MAAM;KAE5D,MAAM,SACJ;AACF,iBAAY,OAAO;AACnB,YAAO,EAAE,YAAY,QAAQ;;KAGlC;GACD,SAAS;GACV;EAGD;GACE,OAAO,CACL,OAAO,UAA0C;AAC/C,QAAI;AAEF,SADiB,MAAM,cACN,OAAQ,QAAO,EAAE;KAElC,MAAM,YAAY,MAAM;KACxB,MAAM,UACJ,OAAO,WAAW,YAAY,WAAW,UAAU,UAAU;AAG/D,SAAI,CAAC,sBAAsB,QAAQ,CAAE,QAAO,EAAE;KAG9C,MAAM,WAAW,QAAQ,MACvB,sCACD;AACD,SAAI,CAAC,SAAU,QAAO,EAAE;KAExB,MAAM,WAAW,SAAS;KAC1B,MAAM,MAAO,MAAM,OAAkB,QAAQ,KAAK;AAClD,iBAAY;KAGZ,MAAM,UAAU,YAFA,MAAM,eAAe,KAAK,UAAU,YAAY,CAE5B;AACpC,SAAI,CAAC,QAAS,QAAO,EAAE;AAEvB,iBACE,eACA,wBACA,QAAQ,OACR,QAAQ,OACT;AAID,SAAI,CAAC,QAAQ,SAAU,QAAO,EAAE;KAEhC,MAAM,SACJ,8CAA8C,SAAS,IAAI,QAAQ,MAAM,KAAK;AAEhF,iBAAY,OAAO;AACnB,YAAO,EAAE,YAAY,QAAQ;aACtB,OAAO;AACd,eAAU,gDAAgD,MAAM;KAEhE,MAAM,SACJ;AACF,iBAAY,OAAO;AACnB,YAAO,EAAE,YAAY,QAAQ;;KAGlC;GACD,SAAS;GACV;EACF;;;;;;;;;;;;;;;;AAmBH,eAAsB,mBACpB,kBACA,aACwB;AACxB,aAAY;CAEZ,MAAM,UAAU,YADA,MAAM,eAAe,kBAAkB,KAAK,YAAY,CACpC;AACpC,KAAI,CAAC,QAAS,QAAO;AACrB,aACE,iBACA,oBACA,QAAQ,OACR,QAAQ,OACT;AACD,KAAI,CAAC,QAAQ,UAAU;AACrB,YACE,UAAU,QAAQ,MAAM,KAAK,IAC3B,QAAQ,MAAM,SAAS,YAAY,UACpC,OAAO,iBAAiB,oCAC1B;AACD,SAAO;;AAET,QAAO,4BAA4B,QAAQ,MAAM,KAAK,IACpD,QAAQ,MAAM,SAAS,YAAY,UACpC,OAAO;;;;;;;;AASV,eAAe,eACb,KACA,UACA,aACsB;CACtB,MAAM,cAAc,KAAK,QAAQ,KAAK,SAAS;AAE/C,KAAI,CAAC,GAAG,WAAW,YAAY,EAAE;AAC/B,YAAU,0CAA0C,cAAc;AAClE,SAAO,EAAE;;CAGX,MAAM,QAAQ,MAAM,GAAG,8CAA8C;EACnE,KAAK;EACL,UAAU;EACX,CAAC;AAEF,KAAI,MAAM,WAAW,GAAG;AACtB,YAAU,kDAAkD,cAAc;AAC1E,SAAO,EAAE;;AAGX,WACE,mBAAmB,MAAM,OAAO,6BAA6B,WAC9D;CAMD,MAAM,UAA0B,EAAE;AAClC,MAAK,MAAM,YAAY,OAAO;EAC5B,IAAI;AACJ,MAAI;AACF,OAAI,GAAG,SAAS,SAAS,CAAC,OAAO,uBAAuB;AACtD,cACE,0BAA0B,sBAAsB,kCAAkC,WACnF;AACD,cAAU,aAAa,UAAU,sBAAsB;SAEvD,WAAU,GAAG,aAAa,UAAU,QAAQ;WAEvC,KAAK;AACZ,aAAU,oCAAoC,SAAS,IAAI,IAAI;AAC/D;;AAEF,MAAI,QACF,SAAQ,KAAK,GAAI,MAAM,eAAe,SAAS,QAAQ,CAAE;;AAU7D,QAAO,cAAc,SAAS,SAAS,YAAY"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@posthog/wizard",
-  "version": "2.63.0",
+  "version": "2.64.1",
   "homepage": "https://github.com/PostHog/wizard",
   "repository": "https://github.com/PostHog/wizard",
   "description": "The PostHog wizard helps you to configure your project",

package/dist/agent-prompt-loader-DiM8xfSZ.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-prompt-loader-DiM8xfSZ.js","names":[],"sources":["../src/lib/agent/agent-prompt-loader.ts"],"sourcesContent":["/**\n * Agent-prompt loader + registry.\n *\n * Agent prompts are the WHAT of a task: a markdown file per type, served from\n * context-mill as the `agents` content type (parallel to skills). The frontmatter\n * carries the artifacts the executor needs — model, the mini-skills to load (the\n * HOW), the tools the task may use, and its dependencies — and the body is the\n * instruction the agent reads.\n *\n * The registry is fetched once at startup and scoped to one flow — agents\n * declare `flow` and (for the planner) `seed: true` in frontmatter, so each\n * program (integration, audit, migration, ...) ships its own agent set and the\n * loader stays generic. Every prompt is downloaded and parsed up front, so\n * resolving a task to its run config is synchronous and adds no mid-drain\n * network latency. The registry's type list also drives `enqueue_task`\n * validation.\n */\nimport type {\n  QueueStore,\n  QueuedTask,\n} from './runner/sequence/orchestrator/queue';\nimport type { ResolvedTask } from './runner/sequence/orchestrator/executor';\nimport type { HostResolution } from '@lib/host-resolution';\nimport {\n  isThinkingLevel,\n  type ThinkingLevel,\n} from './runner/switchboard/models';\nimport { logToFile } from '@utils/debug';\nimport { analytics } from '@utils/analytics';\nimport { fetchWithRetry } from '@lib/fetch-retry';\nimport { WIZARD_TOOL_NAMES } from '@lib/wizard-tools/tools';\n\n/**\n * The basics the client injects around every agent-prompt body. The `/agents/`\n * files carry intent only (goal, success criteria); the wizard owns the I/O\n * contract — who the agent is, how it reports, how it surfaces progress — so the\n * authored prompts never restate it.\n */\nexport interface OrchestratorPromptContext {\n  projectId: number;\n  projectApiKey: string;\n  host: HostResolution;\n  /** Path to the framework's reference implementation (EXAMPLE.md), if available. */\n  examplePath?: string;\n  /** Path to the framework's rules (COMMANDMENTS.md), if available. */\n  commandmentsPath?: string;\n}\n\nfunction projectContext(ctx: OrchestratorPromptContext): string {\n  return `You have access to the PostHog MCP server and the wizard tools.\n\nProject context:\n- PostHog Project ID: ${ctx.projectId}\n- PostHog public token: ${ctx.projectApiKey}\n- PostHog Host: ${ctx.host.apiHost}`;\n}\n\n/** Points the agent at the framework's reference integration to learn patterns from. */\nfunction exampleReference(ctx: OrchestratorPromptContext): string | null {\n  if (!ctx.examplePath) return null;\n  return `A reference PostHog integration for this framework is at \\`${ctx.examplePath}\\`. It shows the target implementation pattern. Reference its patterns and conventions, adapting them to this codebase.`;\n}\n\n/** The framework's rules ship with the reference skill; every task follows them. */\nfunction commandmentsReference(ctx: OrchestratorPromptContext): string | null {\n  if (!ctx.commandmentsPath) return null;\n  return `Framework rules for this integration are at \\`${ctx.commandmentsPath}\\`. Read them before you edit and follow them.`;\n}\n\n/**\n * The task's own tool list, injected so an agent never has to discover a tool's\n * absence by trying it — and never reports that absence as a finding. Later\n * tasks hold tools this one does not, so work it cannot do is handed on rather\n * than attempted.\n */\n/** Renders the inventory from the tool names a harness actually registered for\n *  the run — the one complete list, in the vocabulary the agent will call. */\nexport function renderToolInventory(toolNames: readonly string[]): string {\n  if (toolNames.length === 0) return '';\n  return `Your tools for this task: ${toolNames.join(\n    ', ',\n  )}. Do not look for a tool that is not listed or treat its absence as a problem to report. Later tasks in this run hold tools you do not: when your task needs one, hand that work off in your handoff for the task that can do it, or note it for the final report.`;\n}\n\nconst TASK_BASICS = `You are one step in a larger PostHog workflow made of several tasks, run as a fresh agent with no memory of the other tasks beyond the context you are given. Other tasks — before and after you — own the rest of the work, so stay strictly on your own task: do not do a neighbouring step's job, redo what an upstream handoff already did, or reach beyond what you were asked. Do only your task, then report exactly once by calling complete_task with a structured handoff: what your goal was, what you did, and what the next agent should know. When you are given context from previous steps, trust it — those agents already did their work, so do not re-verify or re-read what their handoffs tell you. Build on it and move fast. Read a file before you edit it, so your own changes do not duplicate what is already there. Work only inside this project's own directory: never read, list, or search (find, ls, grep, glob) outside it — not the OS, not other projects, not global package caches. If your task seems to need something outside this directory, it does not — skip that part and say so in your handoff rather than hunting across the filesystem. If your task does not apply to this project — there is genuinely nothing for it to do — report it with status \\`not needed\\` and say why, rather than marking it done.`;\n\nconst SEED_BASICS = `You are the orchestrator. Plan the work and seed the queue with enqueue_task — each call returns an id you can pass as a dependency to a later task. Give each task a short label for the UI — the action in a few words, not file names, class names, or other specifics. The last task you queue, the one that reports on the run, must depend on every other task in the queue — directly, or through a task it already depends on. You are not a task yourself: do not call complete_task and do not edit the project.`;\n\n/**\n * Tasks the wizard queued before the planner ran. It has to see them: they are\n * part of the run it is planning around, and the task that reports last has to\n * depend on them. Their ids are real, so it can wire the edge directly.\n *\n * The one-way rule matters as much as the sink edge. These tasks are deferred to\n * the end of the drain after planning (`seeded-deps.ts`) and may block on a\n * person, so a task the planner hangs off one would wait on the user too — which\n * is the interruption deferring them removed. The resolver drops such a task\n * from the seeded task's own dependencies to stay acyclic, so the damage is\n * silent; saying so here is what prevents it.\n */\nfunction preQueuedTasks(\n  tasks: readonly { id: string; type: string }[],\n): string | null {\n  if (tasks.length === 0) return null;\n  const lines = tasks.map((t) => `- ${t.type} (id: ${t.id})`);\n  return `The queue already holds these tasks, placed by the wizard from what it found in this project. Do not queue them again. They run late — after every task you queue — and one may stop to ask the user for input, so make the reporting task depend on each one and hang nothing else off them: any other task you made depend on one would end up waiting on a person.\\n${lines.join(\n    '\\n',\n  )}`;\n}\n\n/**\n * Points the agent at its installed task instructions (the HOW). They live under\n * the wizard's run dir, not `.claude/skills/`, so the SDK does not auto-load\n * them — the prompt has to name them.\n */\nfunction skillReference(paths: readonly string[]): string | null {\n  if (paths.length === 0) return null;\n  const list = paths.map((p) => `\\`${p}\\``).join(', ');\n  return `Your task instructions are at ${list}. Read them before you start and follow them. They are wizard scaffolding, not part of the project.`;\n}\n\n/** A task agent's full prompt: injected basics, then the authored intent. */\nexport function assembleTaskPrompt(\n  ctx: OrchestratorPromptContext,\n  body: string,\n  skillPaths: readonly string[] = [],\n): string {\n  return [\n    projectContext(ctx),\n    exampleReference(ctx),\n    commandmentsReference(ctx),\n    skillReference(skillPaths),\n    TASK_BASICS,\n    body,\n  ]\n    .filter(Boolean)\n    .join('\\n\\n');\n}\n\n/** The seed agent's full prompt: injected basics, then the authored intent. */\nexport function assembleSeedPrompt(\n  ctx: OrchestratorPromptContext,\n  body: string,\n  preQueued: readonly { id: string; type: string }[] = [],\n): string {\n  return [projectContext(ctx), SEED_BASICS, preQueuedTasks(preQueued), body]\n    .filter(Boolean)\n    .join('\\n\\n');\n}\n\n/** Orchestrator tools are MCP tools under the `posthog-wizard` server. Frontmatter\n *  names them short (e.g. `enqueue_task`); the SDK gates on the full name. */\nconst ORCHESTRATOR_TOOL_PREFIX = 'mcp__posthog-wizard__';\nconst ORCHESTRATOR_TOOLS = new Set([\n  'enqueue_task',\n  'complete_task',\n  'read_handoffs',\n]);\n\n/** The one tool that stops a task until a person answers. Named short in frontmatter. */\nexport const ASK_TOOL = 'wizard_ask';\n\n/**\n * The PostHog MCP, as an agent asks for it in frontmatter. Every tool a task\n * gets is granted by its own prompt, this one included: a task that never names\n * it never has the server wired in, and one that does gets it under this name\n * on both harnesses.\n */\nexport const POSTHOG_MCP_TOOL = 'posthog_exec';\n/** The same tool as the anthropic SDK names it, on the hosted PostHog server. */\nconst POSTHOG_MCP_SDK_TOOL = 'mcp__posthog-wizard__exec';\n\n/** Whether a task asked for the PostHog MCP — accepts either spelling. */\nexport function allowsPostHogMcp(\n  allowedTools: readonly string[] | undefined,\n): boolean {\n  return (allowedTools ?? []).some(\n    (name) => name === POSTHOG_MCP_TOOL || name === POSTHOG_MCP_SDK_TOOL,\n  );\n}\n\n/** The queue tools a task holds — all of them minus its disallows. Short names.\n *  Single source for both the injected inventory and the harness's tool grant. */\nexport function queueTools(disallowedTools: readonly string[]): string[] {\n  const disallowed = new Set(\n    disallowedTools.map((n) => n.replace(ORCHESTRATOR_TOOL_PREFIX, '')),\n  );\n  return [...ORCHESTRATOR_TOOLS].filter((t) => !disallowed.has(t));\n}\n\n/** A parsed agent prompt. The frontmatter fields plus the markdown body. */\nexport interface AgentPrompt {\n  type: string;\n  /** Human-readable title for the TUI; falls back to `type` when absent. */\n  label?: string;\n  /** The flow this agent belongs to (the program id, e.g. \\`posthog-integration\\`). */\n  flow?: string;\n  /** Marks the flow's planner: it seeds the queue and is not an enqueueable task. */\n  seed: boolean;\n  /** Marks a task that runs last: it must depend on every other task in the queue. */\n  sink: boolean;\n  /**\n   * Marks a task only the wizard may queue. The planner never sees the type, so\n   * whether it runs is a decision the client makes from what it detected, not\n   * one an agent can reach — it can neither invent the task nor forget it.\n   */\n  runnerSeeded: boolean;\n  /** Per-profile model + effort. `pi` = the gpt/pi harness, `sdk` = the anthropic\n   * harness. The mapping is not 1:1 across providers, so each agent names both. */\n  modelPi?: string;\n  effortPi?: ThinkingLevel;\n  modelSdk?: string;\n  effortSdk?: ThinkingLevel;\n  skills: string[];\n  allowedTools: string[];\n  disallowedTools: string[];\n  /**\n   * Task types this one runs after. Read differently by the two kinds of task:\n   *\n   * - **Enqueueable types**: advisory. The planner authors the real graph with\n   *   `enqueue_task`, passing ids, and its seed prompt describes the shape it\n   *   should build. Nothing resolves this field for them.\n   * - **`runnerSeeded` types**: authoritative. Such a task is queued before the\n   *   planner runs, so it cannot name ids; the runner resolves these types to\n   *   the ids the planner produced and applies them (see `seeded-deps.ts`).\n   *   Empty means \"after everything that is not the sink\".\n   */\n  dependsOn: string[];\n  body: string;\n}\n\n/** The model + effort an agent runs on for a given harness — `pi` picks the gpt\n * column, anything else the sdk (anthropic) column. */\nexport function promptModelFor(\n  prompt: AgentPrompt,\n  harness: string,\n): { model?: string; effort?: ThinkingLevel } {\n  const pi = harness === 'pi';\n  return {\n    model: pi ? prompt.modelPi : prompt.modelSdk,\n    effort: pi ? prompt.effortPi : prompt.effortSdk,\n  };\n}\n\nexport interface AgentRegistry {\n  /** The flow's task types — every prompt except the seed. */\n  readonly types: string[];\n  /** The types an agent may enqueue: `types` minus the runner-seeded ones. */\n  readonly enqueueableTypes: string[];\n  /** The types that run last and must depend on the whole queue. */\n  readonly sinkTypes: string[];\n  /** The types only the wizard queues, from what it detected before the run. */\n  readonly runnerSeededTypes: string[];\n  /** The flow's planner, the one prompt marked `seed: true` in its frontmatter. */\n  readonly seed?: AgentPrompt;\n  get(type: string): AgentPrompt | undefined;\n}\n\n/** The registry for one flow's prompts. Pure; the loader feeds it the fetched set. */\nexport function buildRegistry(\n  prompts: readonly AgentPrompt[],\n  flow: string,\n  opts?: {\n    exclude?: readonly string[];\n    /** Per-stage pi model/effort overlays, keyed by task type ('seed' for the planner). Applied here — the one place prompts enter the wizard — so every downstream read sees the effective spec. */\n    overrides?: Record<\n      string,\n      { model?: string; effort?: ThinkingLevel } | undefined\n    >;\n  },\n): AgentRegistry {\n  // The harness can exclude task types (CI excludes dashboards). An excluded\n  // type does not exist for the run: the seed cannot enqueue it and no agent\n  // is ever spun up for it.\n  const excluded = new Set(opts?.exclude ?? []);\n  const inFlow = prompts\n    .filter((p) => p.flow === flow && !excluded.has(p.type))\n    .map((p) => {\n      const o = opts?.overrides?.[p.seed ? 'seed' : p.type];\n      if (!o) return p;\n      return {\n        ...p,\n        modelPi: o.model ?? p.modelPi,\n        effortPi: o.effort ?? p.effortPi,\n      };\n    });\n  const byType = new Map(inFlow.map((p) => [p.type, p]));\n  const tasks = inFlow.filter((p) => !p.seed);\n  return {\n    types: tasks.map((p) => p.type),\n    enqueueableTypes: tasks.filter((p) => !p.runnerSeeded).map((p) => p.type),\n    sinkTypes: tasks.filter((p) => p.sink).map((p) => p.type),\n    runnerSeededTypes: tasks.filter((p) => p.runnerSeeded).map((p) => p.type),\n    seed: inFlow.find((p) => p.seed),\n    get: (type) => byType.get(type),\n  };\n}\n\ninterface AgentMenu {\n  /** `flow` arrived with context-mill's flow-scoped agents folder; older menus omit it. */\n  agents: { id: string; flow?: string; downloadUrl: string }[];\n}\n\n/** A native tool passes through; an MCP tool gets its fully-qualified name. */\nfunction expandToolName(name: string): string {\n  if (name === ASK_TOOL) return WIZARD_TOOL_NAMES.wizardAsk;\n  if (name === POSTHOG_MCP_TOOL) return POSTHOG_MCP_SDK_TOOL;\n  return ORCHESTRATOR_TOOLS.has(name)\n    ? `${ORCHESTRATOR_TOOL_PREFIX}${name}`\n    : name;\n}\n\n/** A prompt's allow/disallow lists with orchestrator tool names MCP-qualified. */\nexport function agentRunTools(prompt: AgentPrompt): {\n  allowedTools: string[];\n  disallowedTools: string[];\n} {\n  return {\n    allowedTools: prompt.allowedTools.map(expandToolName),\n    disallowedTools: prompt.disallowedTools.map(expandToolName),\n  };\n}\n\nfunction toStringArray(value: unknown): string[] {\n  if (!Array.isArray(value)) return [];\n  return value.filter((v): v is string => typeof v === 'string');\n}\n\n/**\n * Parse the leading `---` frontmatter block and the markdown body. The\n * frontmatter is a small, known schema (scalars and inline `[a, b]` arrays), so\n * a tiny parser covers it without a YAML dependency. Inline `# comments` after a\n * value are stripped. `fallbackType` (the menu id) and `fallbackFlow` (the\n * menu entry's flow) apply when the frontmatter omits `type:`/`flow:`.\n */\nexport function parseAgentPrompt(\n  text: string,\n  fallbackType: string,\n  fallbackFlow?: string,\n): AgentPrompt {\n  const match = text.match(/^---\\r?\\n([\\s\\S]*?)\\r?\\n---\\r?\\n?([\\s\\S]*)$/);\n  const frontmatter = match ? match[1] : '';\n  const body = (match ? match[2] : text).trim();\n\n  const fields: Record<string, unknown> = {};\n  for (const rawLine of frontmatter.split(/\\r?\\n/)) {\n    const line = rawLine.replace(/\\s+#.*$/, '').trim();\n    if (!line || line.startsWith('#')) continue;\n    const kv = line.match(/^([\\w-]+):\\s*(.*)$/);\n    if (!kv) continue;\n    const [, key, raw] = kv;\n    if (raw.startsWith('[') && raw.endsWith(']')) {\n      fields[key] = raw\n        .slice(1, -1)\n        .split(',')\n        .map((s) => s.trim().replace(/^['\"]|['\"]$/g, ''))\n        .filter(Boolean);\n    } else {\n      fields[key] = raw.replace(/^['\"]|['\"]$/g, '');\n    }\n  }\n\n  const str = (v: unknown) => (typeof v === 'string' ? v : undefined);\n  // Effort is remote data — reject typos here so downstream carries ThinkingLevel.\n  const effort = (v: unknown, key: string): ThinkingLevel | undefined => {\n    if (v === undefined) return undefined;\n    if (isThinkingLevel(v)) return v;\n    logToFile(\n      `[agent-prompt] ${fallbackType}: ignoring invalid ${key} \"${String(v)}\"`,\n    );\n    analytics.wizardCapture('agent prompt invalid effort', {\n      task_type: fallbackType,\n      key,\n      value: String(v),\n    });\n    return undefined;\n  };\n  return {\n    type: typeof fields.type === 'string' ? fields.type : fallbackType,\n    label: typeof fields.label === 'string' ? fields.label : undefined,\n    flow: typeof fields.flow === 'string' ? fields.flow : fallbackFlow,\n    seed: fields.seed === 'true',\n    sink: fields.sink === 'true',\n    runnerSeeded: fields.runnerSeeded === 'true',\n    modelPi: str(fields.model_pi),\n    effortPi: effort(fields.effort_pi, 'effort_pi'),\n    modelSdk: str(fields.model_sdk),\n    effortSdk: effort(fields.effort_sdk, 'effort_sdk'),\n    skills: toStringArray(fields.skills),\n    allowedTools: toStringArray(fields.allowedTools),\n    disallowedTools: toStringArray(fields.disallowedTools),\n    dependsOn: toStringArray(fields.dependsOn),\n    body,\n  };\n}\n\nasync function fetchText(url: string): Promise<string> {\n  const res = await fetchWithRetry(url);\n  return res.text();\n}\n\n/**\n * Fetch the agent menu and every agent prompt it lists, parse them, and build\n * the registry for one flow. Throws if the menu cannot be fetched — the\n * orchestrator cannot run without its prompts.\n */\nexport async function loadAgentRegistry(\n  skillsBaseUrl: string,\n  flow: string,\n  opts?: Parameters<typeof buildRegistry>[2],\n): Promise<AgentRegistry> {\n  const menuRaw = await fetchText(`${skillsBaseUrl}/agent-menu.json`);\n  const menu = JSON.parse(menuRaw) as AgentMenu;\n\n  // Menus that carry a flow per entry let us skip other flows' prompts before\n  // fetching them; entries without one are fetched and filtered by their\n  // frontmatter in buildRegistry, as before.\n  const entries = (menu.agents ?? []).filter(\n    (entry) => !entry.flow || entry.flow === flow,\n  );\n  const prompts = await Promise.all(\n    entries.map(async (entry) => {\n      const text = await fetchText(entry.downloadUrl);\n      return parseAgentPrompt(text, entry.id, entry.flow);\n    }),\n  );\n\n  return buildRegistry(prompts, flow, opts);\n}\n\n/**\n * Render a task's own inputs into a section, so a fanned-out task (e.g. one\n * `capture` per event) sees the specific thing it owns. Empty when there are none.\n */\nfunction renderInputs(task: QueuedTask): string {\n  const entries = Object.entries(task.inputs ?? {});\n  if (entries.length === 0) return '';\n  const lines = entries.map(([k, v]) => `- ${k}: ${formatInputValue(v)}`);\n  return `## Your task input\\n\\n${lines.join('\\n')}`;\n}\n\nfunction formatInputValue(value: unknown): string {\n  if (typeof value === 'string') return value;\n  return JSON.stringify(value);\n}\n\n/**\n * The ids of every task `task` transitively depends on — the full upstream\n * chain, not just direct dependencies — ordered roots-first, each once. A `seen`\n * set dedupes diamonds and guards against cycles.\n */\nfunction ancestorIds(task: QueuedTask, store: QueueStore): string[] {\n  const seen = new Set<string>();\n  const ordered: string[] = [];\n  const visit = (id: string): void => {\n    if (seen.has(id)) return;\n    seen.add(id);\n    const t = store.get(id);\n    if (!t) return;\n    for (const dep of t.dependsOn) visit(dep); // ancestors before dependents\n    ordered.push(id);\n  };\n  for (const dep of task.dependsOn) visit(dep);\n  return ordered;\n}\n\n/**\n * Render the handoffs of every step `task` transitively depends on into a context\n * section, so a fresh agent sees the whole upstream chain — not just its direct\n * dependencies. Reliability over token economy: a step must never have to\n * re-discover what any ancestor already established just because an intermediate\n * handoff happened to omit it. Empty when there are no completed ancestors.\n */\nfunction renderHandoffContext(task: QueuedTask, store: QueueStore): string {\n  const lines: string[] = [];\n  for (const id of ancestorIds(task, store)) {\n    const dep = store.get(id);\n    const handoff = store.readHandoff(id);\n    if (!dep || !handoff) continue;\n    lines.push(`### ${dep.type}`);\n    lines.push(`- did: ${handoff.did}`);\n    lines.push(`- for you: ${handoff.forNextAgent}`);\n    if (handoff.filesTouched?.length) {\n      lines.push(`- files: ${handoff.filesTouched.join(', ')}`);\n    }\n    if (handoff.evidence) {\n      lines.push(`- evidence: ${handoff.evidence}`);\n    }\n    if (handoff.assumptions) {\n      lines.push(`- assumed: ${handoff.assumptions}`);\n    }\n    if (handoff.reportSection) {\n      lines.push(`- report section:\\n${handoff.reportSection}`);\n    }\n    lines.push('');\n  }\n  if (lines.length === 0) return '';\n  return `## Context from previous steps\\n\\n${lines.join('\\n')}`.trim();\n}\n\n/**\n * Resolve a queued task to its run config: the prompt body (with upstream\n * handoffs appended), the model, and the tool lists with orchestrator tool names\n * MCP-qualified. The model precedence is enqueue override, then prompt, then\n * default. Throws if no prompt is registered for the task's type.\n */\nexport function resolveTask(\n  registry: AgentRegistry,\n  task: QueuedTask,\n  store: QueueStore,\n): ResolvedTask {\n  const prompt = registry.get(task.type);\n  if (!prompt) {\n    throw new Error(`No agent prompt registered for task type \"${task.type}\"`);\n  }\n\n  const body = [\n    renderInputs(task),\n    prompt.body,\n    renderHandoffContext(task, store),\n  ]\n    .filter(Boolean)\n    .join('\\n\\n');\n\n  return {\n    ...agentRunTools(prompt),\n    prompt: body,\n    skills: prompt.skills,\n  };\n}\n\n/** The model + effort a task runs on for a harness: enqueue override, then the\n * prompt's per-profile frontmatter; the caller's switchboard pick is the fallback. */\nexport function taskModelSpec(\n  registry: AgentRegistry,\n  task: QueuedTask,\n  harness: string,\n): { model?: string; effort?: ThinkingLevel } {\n  const picked = promptModelFor(\n    registry.get(task.type) ?? EMPTY_PROMPT,\n    harness,\n  );\n  return {\n    model: task.model ?? picked.model,\n    effort: picked.effort,\n  };\n}\n\nconst EMPTY_PROMPT = {} as AgentPrompt;\n"],"mappings":";;;;;AAgDA,SAAS,eAAe,KAAwC;AAC9D,QAAO;;;wBAGe,IAAI,UAAU;0BACZ,IAAI,cAAc;kBAC1B,IAAI,KAAK;;;AAI3B,SAAS,iBAAiB,KAA+C;AACvE,KAAI,CAAC,IAAI,YAAa,QAAO;AAC7B,QAAO,8DAA8D,IAAI,YAAY;;;AAIvF,SAAS,sBAAsB,KAA+C;AAC5E,KAAI,CAAC,IAAI,iBAAkB,QAAO;AAClC,QAAO,iDAAiD,IAAI,iBAAiB;;;;;;;;;;AAW/E,SAAgB,oBAAoB,WAAsC;AACxE,KAAI,UAAU,WAAW,EAAG,QAAO;AACnC,QAAO,6BAA6B,UAAU,KAC5C,KACD,CAAC;;AAGJ,MAAM,cAAc;AAEpB,MAAM,cAAc;;;;;;;;;;;;;AAcpB,SAAS,eACP,OACe;AACf,KAAI,MAAM,WAAW,EAAG,QAAO;AAE/B,QAAO,0WADO,MAAM,KAAK,MAAM,KAAK,EAAE,KAAK,QAAQ,EAAE,GAAG,GAAG,CAC4T,KACrX,KACD;;;;;;;AAQH,SAAS,eAAe,OAAyC;AAC/D,KAAI,MAAM,WAAW,EAAG,QAAO;AAE/B,QAAO,iCADM,MAAM,KAAK,MAAM,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,CACP;;;AAI/C,SAAgB,mBACd,KACA,MACA,aAAgC,EAAE,EAC1B;AACR,QAAO;EACL,eAAe,IAAI;EACnB,iBAAiB,IAAI;EACrB,sBAAsB,IAAI;EAC1B,eAAe,WAAW;EAC1B;EACA;EACD,CACE,OAAO,QAAQ,CACf,KAAK,OAAO;;;AAIjB,SAAgB,mBACd,KACA,MACA,YAAqD,EAAE,EAC/C;AACR,QAAO;EAAC,eAAe,IAAI;EAAE;EAAa,eAAe,UAAU;EAAE;EAAK,CACvE,OAAO,QAAQ,CACf,KAAK,OAAO;;;;AAKjB,MAAM,2BAA2B;AACjC,MAAM,qBAAqB,IAAI,IAAI;CACjC;CACA;CACA;CACD,CAAC;;AAGF,MAAa,WAAW;;AAUxB,MAAM,uBAAuB;;AAG7B,SAAgB,iBACd,cACS;AACT,SAAQ,gBAAgB,EAAE,EAAE,MACzB,SAAS,SAAA,kBAA6B,SAAS,qBACjD;;;;AAKH,SAAgB,WAAW,iBAA8C;CACvE,MAAM,aAAa,IAAI,IACrB,gBAAgB,KAAK,MAAM,EAAE,QAAQ,0BAA0B,GAAG,CAAC,CACpE;AACD,QAAO,CAAC,GAAG,mBAAmB,CAAC,QAAQ,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;;;;AA8ClE,SAAgB,eACd,QACA,SAC4C;CAC5C,MAAM,KAAK,YAAY;AACvB,QAAO;EACL,OAAO,KAAK,OAAO,UAAU,OAAO;EACpC,QAAQ,KAAK,OAAO,WAAW,OAAO;EACvC;;;AAkBH,SAAgB,cACd,SACA,MACA,MAQe;CAIf,MAAM,WAAW,IAAI,IAAI,MAAM,WAAW,EAAE,CAAC;CAC7C,MAAM,SAAS,QACZ,QAAQ,MAAM,EAAE,SAAS,QAAQ,CAAC,SAAS,IAAI,EAAE,KAAK,CAAC,CACvD,KAAK,MAAM;EACV,MAAM,IAAI,MAAM,YAAY,EAAE,OAAO,SAAS,EAAE;AAChD,MAAI,CAAC,EAAG,QAAO;AACf,SAAO;GACL,GAAG;GACH,SAAS,EAAE,SAAS,EAAE;GACtB,UAAU,EAAE,UAAU,EAAE;GACzB;GACD;CACJ,MAAM,SAAS,IAAI,IAAI,OAAO,KAAK,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;CACtD,MAAM,QAAQ,OAAO,QAAQ,MAAM,CAAC,EAAE,KAAK;AAC3C,QAAO;EACL,OAAO,MAAM,KAAK,MAAM,EAAE,KAAK;EAC/B,kBAAkB,MAAM,QAAQ,MAAM,CAAC,EAAE,aAAa,CAAC,KAAK,MAAM,EAAE,KAAK;EACzE,WAAW,MAAM,QAAQ,MAAM,EAAE,KAAK,CAAC,KAAK,MAAM,EAAE,KAAK;EACzD,mBAAmB,MAAM,QAAQ,MAAM,EAAE,aAAa,CAAC,KAAK,MAAM,EAAE,KAAK;EACzE,MAAM,OAAO,MAAM,MAAM,EAAE,KAAK;EAChC,MAAM,SAAS,OAAO,IAAI,KAAK;EAChC;;;AASH,SAAS,eAAe,MAAsB;AAC5C,KAAI,SAAA,aAAmB,QAAO,kBAAkB;AAChD,KAAI,SAAA,eAA2B,QAAO;AACtC,QAAO,mBAAmB,IAAI,KAAK,GAC/B,GAAG,2BAA2B,SAC9B;;;AAIN,SAAgB,cAAc,QAG5B;AACA,QAAO;EACL,cAAc,OAAO,aAAa,IAAI,eAAe;EACrD,iBAAiB,OAAO,gBAAgB,IAAI,eAAe;EAC5D;;AAGH,SAAS,cAAc,OAA0B;AAC/C,KAAI,CAAC,MAAM,QAAQ,MAAM,CAAE,QAAO,EAAE;AACpC,QAAO,MAAM,QAAQ,MAAmB,OAAO,MAAM,SAAS;;;;;;;;;AAUhE,SAAgB,iBACd,MACA,cACA,cACa;CACb,MAAM,QAAQ,KAAK,MAAM,8CAA8C;CACvE,MAAM,cAAc,QAAQ,MAAM,KAAK;CACvC,MAAM,QAAQ,QAAQ,MAAM,KAAK,MAAM,MAAM;CAE7C,MAAM,SAAkC,EAAE;AAC1C,MAAK,MAAM,WAAW,YAAY,MAAM,QAAQ,EAAE;EAChD,MAAM,OAAO,QAAQ,QAAQ,WAAW,GAAG,CAAC,MAAM;AAClD,MAAI,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAE;EACnC,MAAM,KAAK,KAAK,MAAM,qBAAqB;AAC3C,MAAI,CAAC,GAAI;EACT,MAAM,GAAG,KAAK,OAAO;AACrB,MAAI,IAAI,WAAW,IAAI,IAAI,IAAI,SAAS,IAAI,CAC1C,QAAO,OAAO,IACX,MAAM,GAAG,GAAG,CACZ,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,QAAQ,gBAAgB,GAAG,CAAC,CAChD,OAAO,QAAQ;MAElB,QAAO,OAAO,IAAI,QAAQ,gBAAgB,GAAG;;CAIjD,MAAM,OAAO,MAAgB,OAAO,MAAM,WAAW,IAAI,KAAA;CAEzD,MAAM,UAAU,GAAY,QAA2C;AACrE,MAAI,MAAM,KAAA,EAAW,QAAO,KAAA;AAC5B,MAAI,gBAAgB,EAAE,CAAE,QAAO;AAC/B,YACE,kBAAkB,aAAa,qBAAqB,IAAI,IAAI,OAAO,EAAE,CAAC,GACvE;AACD,YAAU,cAAc,+BAA+B;GACrD,WAAW;GACX;GACA,OAAO,OAAO,EAAE;GACjB,CAAC;;AAGJ,QAAO;EACL,MAAM,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;EACtD,OAAO,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ,KAAA;EACzD,MAAM,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;EACtD,MAAM,OAAO,SAAS;EACtB,MAAM,OAAO,SAAS;EACtB,cAAc,OAAO,iBAAiB;EACtC,SAAS,IAAI,OAAO,SAAS;EAC7B,UAAU,OAAO,OAAO,WAAW,YAAY;EAC/C,UAAU,IAAI,OAAO,UAAU;EAC/B,WAAW,OAAO,OAAO,YAAY,aAAa;EAClD,QAAQ,cAAc,OAAO,OAAO;EACpC,cAAc,cAAc,OAAO,aAAa;EAChD,iBAAiB,cAAc,OAAO,gBAAgB;EACtD,WAAW,cAAc,OAAO,UAAU;EAC1C;EACD;;AAGH,eAAe,UAAU,KAA8B;AAErD,SADY,MAAM,eAAe,IAAI,EAC1B,MAAM;;;;;;;AAQnB,eAAsB,kBACpB,eACA,MACA,MACwB;CACxB,MAAM,UAAU,MAAM,UAAU,GAAG,cAAc,kBAAkB;CAMnE,MAAM,WALO,KAAK,MAAM,QAAQ,CAKV,UAAU,EAAE,EAAE,QACjC,UAAU,CAAC,MAAM,QAAQ,MAAM,SAAS,KAC1C;AAQD,QAAO,cAPS,MAAM,QAAQ,IAC5B,QAAQ,IAAI,OAAO,UAAU;AAE3B,SAAO,iBADM,MAAM,UAAU,MAAM,YAAY,EACjB,MAAM,IAAI,MAAM,KAAK;GACnD,CACH,EAE6B,MAAM,KAAK;;;;;;AAO3C,SAAS,aAAa,MAA0B;CAC9C,MAAM,UAAU,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;AACjD,KAAI,QAAQ,WAAW,EAAG,QAAO;AAEjC,QAAO,yBADO,QAAQ,KAAK,CAAC,GAAG,OAAO,KAAK,EAAE,IAAI,iBAAiB,EAAE,GAAG,CACjC,KAAK,KAAK;;AAGlD,SAAS,iBAAiB,OAAwB;AAChD,KAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAO,KAAK,UAAU,MAAM;;;;;;;AAQ9B,SAAS,YAAY,MAAkB,OAA6B;CAClE,MAAM,uBAAO,IAAI,KAAa;CAC9B,MAAM,UAAoB,EAAE;CAC5B,MAAM,SAAS,OAAqB;AAClC,MAAI,KAAK,IAAI,GAAG,CAAE;AAClB,OAAK,IAAI,GAAG;EACZ,MAAM,IAAI,MAAM,IAAI,GAAG;AACvB,MAAI,CAAC,EAAG;AACR,OAAK,MAAM,OAAO,EAAE,UAAW,OAAM,IAAI;AACzC,UAAQ,KAAK,GAAG;;AAElB,MAAK,MAAM,OAAO,KAAK,UAAW,OAAM,IAAI;AAC5C,QAAO;;;;;;;;;AAUT,SAAS,qBAAqB,MAAkB,OAA2B;CACzE,MAAM,QAAkB,EAAE;AAC1B,MAAK,MAAM,MAAM,YAAY,MAAM,MAAM,EAAE;EACzC,MAAM,MAAM,MAAM,IAAI,GAAG;EACzB,MAAM,UAAU,MAAM,YAAY,GAAG;AACrC,MAAI,CAAC,OAAO,CAAC,QAAS;AACtB,QAAM,KAAK,OAAO,IAAI,OAAO;AAC7B,QAAM,KAAK,UAAU,QAAQ,MAAM;AACnC,QAAM,KAAK,cAAc,QAAQ,eAAe;AAChD,MAAI,QAAQ,cAAc,OACxB,OAAM,KAAK,YAAY,QAAQ,aAAa,KAAK,KAAK,GAAG;AAE3D,MAAI,QAAQ,SACV,OAAM,KAAK,eAAe,QAAQ,WAAW;AAE/C,MAAI,QAAQ,YACV,OAAM,KAAK,cAAc,QAAQ,cAAc;AAEjD,MAAI,QAAQ,cACV,OAAM,KAAK,sBAAsB,QAAQ,gBAAgB;AAE3D,QAAM,KAAK,GAAG;;AAEhB,KAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAO,qCAAqC,MAAM,KAAK,KAAK,GAAG,MAAM;;;;;;;;AASvE,SAAgB,YACd,UACA,MACA,OACc;CACd,MAAM,SAAS,SAAS,IAAI,KAAK,KAAK;AACtC,KAAI,CAAC,OACH,OAAM,IAAI,MAAM,6CAA6C,KAAK,KAAK,GAAG;CAG5E,MAAM,OAAO;EACX,aAAa,KAAK;EAClB,OAAO;EACP,qBAAqB,MAAM,MAAM;EAClC,CACE,OAAO,QAAQ,CACf,KAAK,OAAO;AAEf,QAAO;EACL,GAAG,cAAc,OAAO;EACxB,QAAQ;EACR,QAAQ,OAAO;EAChB;;;;AAKH,SAAgB,cACd,UACA,MACA,SAC4C;CAC5C,MAAM,SAAS,eACb,SAAS,IAAI,KAAK,KAAK,IAAI,cAC3B,QACD;AACD,QAAO;EACL,OAAO,KAAK,SAAS,OAAO;EAC5B,QAAQ,OAAO;EAChB;;AAGH,MAAM,eAAe,EAAE"}

package/dist/analytics-F6z7o3N2.js

@@ -1,2 +0,0 @@
-import { n as analytics } from "./analytics-YLZKudpE.js";
-export { analytics };