@posthog/wizard 2.66.0 → 2.67.0

package/dist/{agent-interface-D3MNaDp3.js → agent-interface-tM_b0l__.js}

@@ -1,16 +1,20 @@
 import { n as __require } from "./rolldown-runtime-B_-DWIq7.js";
-import { G as POSTHOG_FLAG_HEADER_PREFIX, J as POSTHOG_PROPERTY_HEADER_PREFIX, a as getLogFilePath, dt as WIZARD_REMARK_EVENT_NAME, f as getUI, ht as wizardUserAgentForProgram, o as initLogFile, r as debug, s as logToFile, xt as runtimeEnv } from "./debug-BKqv-yfT.js";
-import { n as analytics } from "./analytics-D8JNuPAT.js";
-import { a as safeReadFile, i as readProjectFile, o as walkProjectFiles } from "./bounded-fs-C6OjqZst.js";
-import { n as ADDITIONAL_FEATURE_PROMPTS } from "./wizard-session-DTyLMPsX.js";
-import { i as wizardAbort, n as registerCleanup, t as WizardError } from "./wizard-abort-D9jiMkZA.js";
-import { _ as modelCapabilities, m as writeJsonAtomic, o as buildOrchestratorTools, p as makeMutex, y as triageModelFor } from "./queue-tools-DABh1Ssc.js";
-import { b as coerceAuditChecks, g as AUDIT_CHECKS_FILE, l as prewarmYaraScanner, n as createPostToolUseYaraHooks, p as scanInstalledSkill, r as createPreToolUseYaraHooks } from "./yara-hooks-BXDBIOBq.js";
+import { a as AgentSignals, o as REMARK_INSTRUCTION, s as classifyAuthFailure } from "./errors-BHervYGs.js";
+import { G as POSTHOG_FLAG_HEADER_PREFIX, J as POSTHOG_PROPERTY_HEADER_PREFIX, a as getLogFilePath, dt as WIZARD_REMARK_EVENT_NAME, f as getUI, ht as wizardUserAgentForProgram, o as initLogFile, r as debug, s as logToFile, xt as runtimeEnv } from "./debug-BsHD83Vy.js";
+import { n as analytics } from "./analytics-CtIYzkK4.js";
+import { a as safeReadFile, i as readProjectFile, o as walkProjectFiles } from "./bounded-fs-BWqoFQvQ.js";
+import { n as ADDITIONAL_FEATURE_PROMPTS } from "./wizard-session-Cex1BiXs.js";
+import { i as wizardAbort, n as registerCleanup, t as WizardError } from "./wizard-abort-CGv3lVxw.js";
+import { _ as modelCapabilities, m as writeJsonAtomic, o as buildOrchestratorTools, p as makeMutex, y as triageModelFor } from "./queue-tools-BC9HxOV6.js";
+import { b as coerceAuditChecks, g as AUDIT_CHECKS_FILE, l as prewarmYaraScanner, n as createPostToolUseYaraHooks, p as scanInstalledSkill, r as createPreToolUseYaraHooks } from "./yara-hooks-DZIVzhA6.js";
 import { createRequire } from "node:module";
 import * as fs$1 from "fs";
 import fs from "fs";
 import path from "path";
+import path$1 from "node:path";
 import { spawnSync } from "node:child_process";
+import { closeSync, constants, fchmodSync, lstatSync, openSync, renameSync, unlinkSync, writeSync } from "node:fs";
+import { randomBytes } from "node:crypto";
 import { z } from "zod";
 import * as os from "os";
 import { unzipSync } from "fflate";
@@ -1462,8 +1466,68 @@ const WIZARD_TOOL_NAMES = {
 const MAX_HANDOFF_TEXT_CHARS = 64 * 1024;
 const PUBLISH_HANDOFF_TOOL_NAME = "publish_handoff";
 /** Shared between the MCP server and the pi facade so the contract can't drift. */
-const PUBLISH_HANDOFF_DESCRIPTION = "Publish the handoff document — the full markdown report of what this run did — to the wizard session. Call it exactly once, at the end of the run, passing the complete report as `content`. This call is the only way the report reaches the user; do not write the report to a file instead.";
+const PUBLISH_HANDOFF_DESCRIPTION = "Publish the handoff document — the full markdown report of what this run did — to the wizard session. Call it exactly once, at the end of the run, passing the complete report as `content`. This call is the required way to deliver the report to the user; do not write the report to a file yourself.";
 const PUBLISH_HANDOFF_CONTENT_DESCRIPTION = "The complete handoff report as markdown, starting with an H1 heading.";
+/**
+* Write the handoff report to the host-designated `targetPath`.
+*
+* The destination comes from the host (`POSTHOG_HANDOFF_OUTPUT_PATH`,
+* process-env only — the agent can neither set nor see it) while the bytes come
+* from the agent, so the write is treated as a trust-boundary crossing:
+* - relative paths are refused (a relative destination would silently resolve
+*   against whatever CWD the wizard happens to run in);
+* - a pre-existing non-regular destination (symlink, directory, FIFO, device)
+*   is refused, so a primed symlink can't redirect the write at another file;
+* - content lands in a unique sibling temp file opened with O_NOFOLLOW |
+*   O_EXCL and is then rename()d over the destination — atomic for a polling
+*   reader, and rename replaces the *link* rather than following it;
+* - the final file is chmod'd to 0o600 even when the host pre-created it with
+*   looser permissions (the report quotes the user's code).
+*
+* `reason` is safe to surface to the agent (it names no path); `detail` carries
+* the specifics for the local log only.
+*/
+function writeHandoffFileAtomically(targetPath, text) {
+	if (!path$1.isAbsolute(targetPath)) return {
+		ok: false,
+		reason: "destination is not an absolute path",
+		detail: `relative destination refused: ${targetPath}`
+	};
+	let stat;
+	try {
+		stat = lstatSync(targetPath);
+	} catch {
+		stat = void 0;
+	}
+	if (stat && !stat.isFile()) return {
+		ok: false,
+		reason: "destination is not a regular file",
+		detail: `non-regular destination refused: ${targetPath}`
+	};
+	const tmpPath = `${targetPath}.tmp-${process.pid}-${randomBytes(6).toString("hex")}`;
+	let fd;
+	try {
+		fd = openSync(tmpPath, constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW | constants.O_EXCL, 384);
+		writeSync(fd, text, null, "utf8");
+		fchmodSync(fd, 384);
+		closeSync(fd);
+		fd = void 0;
+		renameSync(tmpPath, targetPath);
+		return { ok: true };
+	} catch (err) {
+		if (fd !== void 0) try {
+			closeSync(fd);
+		} catch {}
+		try {
+			unlinkSync(tmpPath);
+		} catch {}
+		return {
+			ok: false,
+			reason: (typeof err === "object" && err !== null && "code" in err ? String(err.code) : void 0) ?? "write error",
+			detail: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
 function publishHandoff(content) {
 	if (content.trim() === "") {
 		analytics.wizardCapture("handoff published", {
@@ -1478,14 +1542,29 @@ function publishHandoff(content) {
 	const truncated = content.length > MAX_HANDOFF_TEXT_CHARS;
 	const text = truncated ? content.slice(0, MAX_HANDOFF_TEXT_CHARS) : content;
 	getUI().setHandoffText(text);
+	const handoffOutputPath = runtimeEnv("POSTHOG_HANDOFF_OUTPUT_PATH");
+	let handoffOutputWritten;
+	let handoffOutputError;
+	if (handoffOutputPath) {
+		const write = writeHandoffFileAtomically(handoffOutputPath, text);
+		handoffOutputWritten = write.ok;
+		if (!write.ok) {
+			handoffOutputError = write.reason;
+			logToFile(`[publish_handoff] host output write failed (${write.reason}): ${write.detail}`);
+		}
+	}
 	analytics.wizardCapture("handoff published", {
 		handoff_ok: true,
 		handoff_chars: text.length,
-		handoff_truncated: truncated
+		handoff_truncated: truncated,
+		handoff_output_written: handoffOutputWritten
 	});
+	const notes = [];
+	if (truncated) notes.push("truncated to the 64 KB limit");
+	if (handoffOutputError) notes.push(`host output write failed: ${handoffOutputError}`);
 	return {
 		ok: true,
-		message: `Handoff published (${text.length} chars${truncated ? ", truncated to the 64 KB limit" : ""}).`
+		message: `Handoff published (${text.length} chars${notes.length > 0 ? `, ${notes.join("; ")}` : ""}).`
 	};
 }
 //#endregion
@@ -2032,31 +2111,6 @@ function classifyToolToStage(toolName) {
 	return null;
 }
 //#endregion
-//#region src/lib/agent/signals.ts
-/**
-* Agent signal vocabulary — the marker strings the agent emits and the error
-* taxonomy the runner returns. Kept as a dependency-free leaf module so both
-* `agent-interface.ts` and `output-signals.ts` can import it without a cycle.
-*/
-const AgentSignals = {
-	STATUS: "[STATUS]",
-	ERROR_MCP_MISSING: "[ERROR-MCP-MISSING]",
-	ERROR_RESOURCE_MISSING: "[ERROR-RESOURCE-MISSING]",
-	SKILL_INSTALL_FAILED: "[SKILL-INSTALL-FAILED]",
-	ABORT: "[ABORT]",
-	WIZARD_REMARK: "[WIZARD-REMARK]",
-	BENCHMARK: "[BENCHMARK]",
-	DASHBOARD_URL: "[DASHBOARD_URL]",
-	NOTEBOOK_URL: "[NOTEBOOK_URL]"
-};
-/**
-* End-of-run reflection ask, shared by both harnesses so remarks are
-* comparable. The format clause comes FIRST and nothing trails the marker —
-* literal models (gpt-5-mini) echo whatever text follows it. The parser also
-* drops remarks that quote this instruction (see AgentOutputSignals.remark).
-*/
-const REMARK_INSTRUCTION = `Reply with a single line that starts with ${AgentSignals.WIZARD_REMARK} and no other lines. In that line, state briefly what information or guidance would have been useful to have in the integration prompt or documentation for this run — specifically anything that would have prevented tool failures, erroneous edits, or other wasted turns.`;
-//#endregion
 //#region src/lib/agent/output-signals.ts
 /**
 * Parses the signal-bearing lines out of agent output and discards the rest.
@@ -2196,6 +2250,32 @@ const PROVIDER_ENV_NAMESPACE = /^(ANTHROPIC_|CLAUDE_CODE_)/;
 */
 const BLOCKED_OFF_NAMESPACE_KEYS = new Set(["AWS_BEARER_TOKEN_BEDROCK"]);
 /**
+* Host-orchestration values read only by the wizard process itself (via
+* `runtimeEnv` in src/env.ts). None of them is ever consumed by the spawned
+* agent subprocess — the `publish_handoff` MCP tool executes in the wizard's
+* own process — so the subprocess only ever loses attack surface:
+*
+* - `POSTHOG_HANDOFF_OUTPUT_PATH` names the host file the wizard writes the
+*   agent's handoff report to. Handing it to the subprocess tells a
+*   (prompt-injected) agent exactly which file its own report content lands
+*   in, turning the write into a pre-plantable symlink/same-UID overwrite
+*   target. The write itself refuses symlinks, but the agent has no business
+*   knowing the destination at all.
+* - `POSTHOG_TASK_RUN_ID` / `POSTHOG_TASK_ID` identify the sandbox run and are
+*   read by the wizard's analytics only; they let the agent fingerprint the
+*   run directory where the handoff path typically sits.
+*
+* Deliberately NOT stripped: `POSTHOG_API_KEY` / `POSTHOG_HOST` — pre-existing
+* passthrough that the agent may rely on when writing the user's project key
+* into the project's own .env. Changing that disposition is a separate,
+* deliberate decision, not part of this hardening.
+*/
+const HOST_ONLY_ENV_KEYS = new Set([
+	"POSTHOG_HANDOFF_OUTPUT_PATH",
+	"POSTHOG_TASK_RUN_ID",
+	"POSTHOG_TASK_ID"
+]);
+/**
 * Credential / routing knobs that, set in an on-disk Claude **settings** `env`
 * block, redirect the binary. A settings file is applied by the binary itself,
 * so the subprocess-env strip below cannot remove it — `claude-settings.ts`
@@ -2255,10 +2335,11 @@ const BLOCKED_AGENT_ENV_PATTERNS = [/^CLAUDE_CODE_SKIP_.+_AUTH$/, /^ANTHROPIC_.+
 /**
 * True if `key` must NOT be inherited by the agent subprocess: anything in the
 * provider namespace (the wizard re-injects its own values at the spawn site),
-* plus the lone off-namespace credential.
+* the lone off-namespace credential, and host-only orchestration values the
+* subprocess never reads.
 */
 function isBlockedAgentEnvKey(key) {
-	return PROVIDER_ENV_NAMESPACE.test(key) || BLOCKED_OFF_NAMESPACE_KEYS.has(key);
+	return PROVIDER_ENV_NAMESPACE.test(key) || BLOCKED_OFF_NAMESPACE_KEYS.has(key) || HOST_ONLY_ENV_KEYS.has(key);
 }
 /**
 * Return a copy of `env` with the entire model-provider namespace removed, so
@@ -3072,7 +3153,7 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 					if (options.debug) debug("CLI stderr:", data);
 				},
 				hooks: {
-					PreToolUse: warlockDisabled ? [] : createPreToolUseYaraHooks(triageProvider),
+					PreToolUse: warlockDisabled ? [] : createPreToolUseYaraHooks(triageProvider, onYaraTerminate),
 					PostToolUse: warlockDisabled ? [] : createPostToolUseYaraHooks(triageProvider, onYaraTerminate),
 					Stop: [{
 						hooks: [createStopHook(config?.additionalFeatureQueue ?? [], signals, config?.requestRemark ?? true)],
@@ -3120,6 +3201,13 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 				signalDone();
 				spinner.stop("Authentication failed");
 				const authError = buildAuthErrorContext(options.installDir, process.env.ANTHROPIC_BASE_URL ?? "", os.homedir(), signals.apiKeySource);
+				const authCode = classifyAuthFailure({
+					hasSettingsConflict: authError.hasSettingsConflict,
+					usingManagedLogin: authError.usingManagedLogin,
+					apiKey: options.apiKey,
+					gatewayRegion: authError.region,
+					sessionRegion: options.cloudRegion
+				});
 				logToFile("Agent error: 401, showing auth error screen", authError);
 				getUI().showAuthError({
 					hasSettingsConflict: authError.hasSettingsConflict,
@@ -3129,6 +3217,7 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 					logFilePath: getLogFilePath()
 				});
 				await wizardAbort({
+					code: authCode,
 					message: "Authentication failed (401)",
 					error: new WizardError("Authentication failed", {
 						hasSettingsConflict: authError.hasSettingsConflict,
@@ -3138,7 +3227,7 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 						region: authError.region,
 						usingManagedLogin: authError.usingManagedLogin,
 						apiKeySource: authError.apiKeySource
-					})
+					}, authCode)
 				});
 			}
 			try {
@@ -3483,6 +3572,6 @@ function handleSDKMessage(message, options, spinner, signals, receivedSuccessRes
 	}
 }
 //#endregion
-export { downloadSkill as A, isFullyCancelled as B, ENV_FILE_PATH_DESCRIPTION as C, WIZARD_TOOL_NAMES as D, WIZARD_ASK_TOOL_DESCRIPTION as E, resolveEnvSecretRefs as F, createTriageLLMProvider as G, isEnvFileName as H, templateEnvWriteRefusal as I, GATEWAY_PROVIDER as K, vaultSensitiveAnswers as L, installSkillById as M, mergeEnvValues as N, checkEnvKeys as O, resolveEnvPath as P, fetchWithRetry as R, CHECK_ENV_KEYS_FILE_PATH_DESCRIPTION as S, WIZARD_ASK_SUBJECT_DESCRIPTION as T, parseEnvKeyNames as U, MAX_ENV_KEY_SET as V, toPromptSafeRelativePath as W, PUBLISH_HANDOFF_CONTENT_DESCRIPTION as _, wizardCanUseTool as a, publishHandoff as b, classifySettingsConflicts as c, sanitizeAgentSubprocessEnv as d, AgentOutputSignals as f, createSecretVault as g, assembleCommandments as h, runAgent as i, fetchSkillMenu as j, createAskAccounting as k, recoverOrphanedSettingsBackups as l, REMARK_INSTRUCTION as m, buildRunTags as n, backupAndFixClaudeSettings as o, AgentSignals as p, buildGatewayProvider as q, initializeAgent as r, checkAllSettingsConflicts as s, buildAgentEnv as t, restoreClaudeSettings as u, PUBLISH_HANDOFF_DESCRIPTION as v, WIZARD_ASK_SENSITIVE_DESCRIPTION as w, CHECK_ENV_KEYS_DESCRIPTION as x, PUBLISH_HANDOFF_TOOL_NAME as y, createWizardAskBridge as z };
+export { installSkillById as A, isEnvFileName as B, WIZARD_ASK_SUBJECT_DESCRIPTION as C, createAskAccounting as D, checkEnvKeys as E, vaultSensitiveAnswers as F, buildGatewayProvider as G, toPromptSafeRelativePath as H, fetchWithRetry as I, createWizardAskBridge as L, resolveEnvPath as M, resolveEnvSecretRefs as N, downloadSkill as O, templateEnvWriteRefusal as P, isFullyCancelled as R, WIZARD_ASK_SENSITIVE_DESCRIPTION as S, WIZARD_TOOL_NAMES as T, createTriageLLMProvider as U, parseEnvKeyNames as V, GATEWAY_PROVIDER as W, PUBLISH_HANDOFF_TOOL_NAME as _, wizardCanUseTool as a, CHECK_ENV_KEYS_FILE_PATH_DESCRIPTION as b, classifySettingsConflicts as c, sanitizeAgentSubprocessEnv as d, AgentOutputSignals as f, PUBLISH_HANDOFF_DESCRIPTION as g, PUBLISH_HANDOFF_CONTENT_DESCRIPTION as h, runAgent as i, mergeEnvValues as j, fetchSkillMenu as k, recoverOrphanedSettingsBackups as l, createSecretVault as m, buildRunTags as n, backupAndFixClaudeSettings as o, assembleCommandments as p, initializeAgent as r, checkAllSettingsConflicts as s, buildAgentEnv as t, restoreClaudeSettings as u, publishHandoff as v, WIZARD_ASK_TOOL_DESCRIPTION as w, ENV_FILE_PATH_DESCRIPTION as x, CHECK_ENV_KEYS_DESCRIPTION as y, MAX_ENV_KEY_SET as z };
 
-//# sourceMappingURL=agent-interface-D3MNaDp3.js.map
+//# sourceMappingURL=agent-interface-tM_b0l__.js.map