@posthog/wizard 2.66.0 → 2.68.0

package/dist/{agent-interface-D3MNaDp3.js → agent-interface-CaEptZuu.js}

@@ -1,20 +1,243 @@
 import { n as __require } from "./rolldown-runtime-B_-DWIq7.js";
-import { G as POSTHOG_FLAG_HEADER_PREFIX, J as POSTHOG_PROPERTY_HEADER_PREFIX, a as getLogFilePath, dt as WIZARD_REMARK_EVENT_NAME, f as getUI, ht as wizardUserAgentForProgram, o as initLogFile, r as debug, s as logToFile, xt as runtimeEnv } from "./debug-BKqv-yfT.js";
-import { n as analytics } from "./analytics-D8JNuPAT.js";
-import { a as safeReadFile, i as readProjectFile, o as walkProjectFiles } from "./bounded-fs-C6OjqZst.js";
-import { n as ADDITIONAL_FEATURE_PROMPTS } from "./wizard-session-DTyLMPsX.js";
-import { i as wizardAbort, n as registerCleanup, t as WizardError } from "./wizard-abort-D9jiMkZA.js";
-import { _ as modelCapabilities, m as writeJsonAtomic, o as buildOrchestratorTools, p as makeMutex, y as triageModelFor } from "./queue-tools-DABh1Ssc.js";
-import { b as coerceAuditChecks, g as AUDIT_CHECKS_FILE, l as prewarmYaraScanner, n as createPostToolUseYaraHooks, p as scanInstalledSkill, r as createPreToolUseYaraHooks } from "./yara-hooks-BXDBIOBq.js";
+import { a as AgentSignals, o as REMARK_INSTRUCTION, s as classifyAuthFailure } from "./errors-BHervYGs.js";
+import { G as POSTHOG_FLAG_HEADER_PREFIX, J as POSTHOG_PROPERTY_HEADER_PREFIX, a as getLogFilePath, dt as WIZARD_REMARK_EVENT_NAME, f as getUI, ht as wizardUserAgentForProgram, o as initLogFile, r as debug, s as logToFile, xt as runtimeEnv } from "./debug-aA5dm2MR.js";
+import { n as analytics } from "./analytics-tF06lcmE.js";
+import { a as safeReadFile, i as readProjectFile, o as walkProjectFiles } from "./bounded-fs-BwuqKpBH.js";
+import { n as ADDITIONAL_FEATURE_PROMPTS } from "./wizard-session-C_7r3-rO.js";
+import { i as wizardAbort, n as registerCleanup, t as WizardError } from "./wizard-abort-Bv87YVSp.js";
+import { _ as modelCapabilities, m as writeJsonAtomic, o as buildOrchestratorTools, p as makeMutex, y as triageModelFor } from "./queue-tools-i_TmeI02.js";
+import { b as coerceAuditChecks, g as AUDIT_CHECKS_FILE, l as prewarmYaraScanner, n as createPostToolUseYaraHooks, p as scanInstalledSkill, r as createPreToolUseYaraHooks } from "./yara-hooks-DeonKbE_.js";
 import { createRequire } from "node:module";
 import * as fs$1 from "fs";
 import fs from "fs";
 import path from "path";
+import path$1 from "node:path";
 import { spawnSync } from "node:child_process";
+import { closeSync, constants, fchmodSync, lstatSync, openSync, renameSync, unlinkSync, writeSync } from "node:fs";
+import { randomBytes } from "node:crypto";
 import { z } from "zod";
 import * as os from "os";
 import { unzipSync } from "fflate";
 import { randomUUID } from "crypto";
+//#region src/lib/gateway-session.ts
+/**
+* Gateway auth for a wizard run: a `phe_` scoped token the backend mints, with
+* pinned attribution, a spend cap and an expiry.
+*
+* A 404 resolves to the legacy posture (OAuth token, Python gateway); every
+* other failure throws, because the legacy path enforces none of those, so a
+* silent downgrade spends unattributed money to hide an outage.
+*/
+let cached = null;
+/**
+* Shared so concurrent callers mint once. The orchestrator starts every runnable
+* task at once, and each would otherwise take its own token and its own cap.
+*/
+let inFlight = null;
+/**
+* Adoption floor. The anthropic subprocess holds its credential for the whole
+* session, so a token below this 401s mid-run.
+*/
+const MIN_USABLE_TTL_MS = 120 * 1e3;
+/** Re-resolve at this fraction of the token's life, leaving a usable remainder. */
+const REFRESH_AT_FRACTION = .8;
+/** How long a legacy fallback sticks before the mint endpoint is retried. */
+const LEGACY_RETRY_MS = 600 * 1e3;
+const MINT_TIMEOUT_MS = 2e4;
+/** Resolve this run's gateway auth, minting and re-minting near expiry. */
+async function gatewayAuth(host, accessToken, program) {
+	const key = `${host.apiHost}\n${accessToken}\n${program ?? ""}`;
+	if (cached && cached.key === key && Date.now() < cached.staleAtMs) return cached.auth;
+	if (inFlight && inFlight.key === key) return inFlight.promise;
+	const promise = resolveGatewayAuth(host, accessToken, key, program);
+	inFlight = {
+		key,
+		promise
+	};
+	try {
+		return await promise;
+	} finally {
+		if (inFlight?.promise === promise) inFlight = null;
+	}
+}
+async function resolveGatewayAuth(host, accessToken, key, program) {
+	if (!program) {
+		logToFile("[gateway] run has no program id; failing the run");
+		throw new GatewayMintFailed("this run has no program to attribute its spend to");
+	}
+	const minted = await mintGatewayToken(host, accessToken, program);
+	if (!minted) {
+		const auth = legacyAuth(host, accessToken);
+		cached = {
+			key,
+			auth,
+			staleAtMs: Date.now() + LEGACY_RETRY_MS
+		};
+		return auth;
+	}
+	const expiresAtMs = Date.parse(minted.expiresAt);
+	const ttlMs = expiresAtMs - Date.now();
+	if (!Number.isFinite(expiresAtMs) || ttlMs < MIN_USABLE_TTL_MS) {
+		logToFile(`[gateway] mint returned a token with ${ttlMs}ms of life; failing the run`);
+		throw new GatewayMintFailed(`the PostHog gateway issued a token with ${ttlMs}ms of life`);
+	}
+	const staleAtMs = Date.now() + ttlMs * REFRESH_AT_FRACTION;
+	const auth = {
+		gatewayUrl: minted.gatewayUrl,
+		token: minted.token,
+		edition: "v2",
+		teamId: minted.teamId
+	};
+	cached = {
+		key,
+		auth,
+		staleAtMs
+	};
+	return auth;
+}
+/** The legacy posture: the user's OAuth token against the Python gateway. */
+function legacyAuth(host, accessToken) {
+	return {
+		gatewayUrl: host.gatewayUrl,
+		token: accessToken,
+		edition: "legacy"
+	};
+}
+/**
+* Whether a server-supplied origin may receive a bearer and prompt content:
+* https (loopback excepted), and either a posthog.com host or the one the run
+* authenticated against.
+*/
+function isTrustedGatewayUrl(value, apiHost) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return false;
+	}
+	if (url.pathname !== "/" || url.search || url.hash || url.username || url.password) return false;
+	if (url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "host.docker.internal") return true;
+	if (url.protocol !== "https:") return false;
+	if (url.hostname.endsWith(".posthog.com")) return true;
+	try {
+		return url.hostname === new URL(apiHost).hostname;
+	} catch {
+		return false;
+	}
+}
+/**
+* A deliberate refusal from the mint endpoint, as opposed to the mint being
+* unavailable. Thrown rather than folded into the legacy fallback, so the run
+* stops instead of proceeding without the controls the refusal was enforcing.
+*/
+var GatewayMintRefused = class extends Error {
+	status;
+	constructor(status, message) {
+		super(message);
+		this.name = "GatewayMintRefused";
+		this.status = status;
+	}
+};
+/**
+* The mint could not produce a usable credential: unreachable, a 5xx, or a
+* response the client cannot use.
+*/
+var GatewayMintFailed = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "GatewayMintFailed";
+	}
+};
+/**
+* Whether a mint status means "refused this run" rather than "not available".
+* 429 is the daily run limit, 403 revoked project access, 401 a credential that
+* may not mint. Only 404 falls back; it is the rollout switch.
+*/
+function isMintRefusal(status) {
+	return status === 400 || status === 401 || status === 403 || status === 429;
+}
+function mintRefusalMessage(status) {
+	switch (status) {
+		case 429: return "This wizard program has used its daily run limit. Try again tomorrow.";
+		case 403: return "Your access to this project has changed. Re-authenticate and try again.";
+		case 400: return "Your PostHog login must cover exactly one project. Re-authenticate and try again.";
+		default: return "The wizard could not authenticate to the PostHog gateway.";
+	}
+}
+async function mintGatewayToken(host, accessToken, program) {
+	try {
+		const resp = await fetch(`${host.apiHost}/api/wizard/gateway_token/`, {
+			method: "POST",
+			headers: {
+				Authorization: `Bearer ${accessToken}`,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify({ program }),
+			signal: AbortSignal.timeout(MINT_TIMEOUT_MS)
+		});
+		if (!resp.ok) {
+			if (isMintRefusal(resp.status)) {
+				logToFile(`[gateway] mint refused with HTTP ${resp.status}; failing the run`);
+				throw new GatewayMintRefused(resp.status, mintRefusalMessage(resp.status));
+			}
+			if (resp.status === 404) {
+				logToFile("[gateway] mint not enabled for this org; staying on the existing gateway");
+				return null;
+			}
+			logToFile(`[gateway] mint failed with HTTP ${resp.status}; failing the run`);
+			throw new GatewayMintFailed(`the PostHog gateway could not issue a token (HTTP ${resp.status})`);
+		}
+		const body = await resp.json();
+		if (!body.token) {
+			logToFile("[gateway] mint response omitted token; failing the run");
+			throw new GatewayMintFailed("mint response omitted token");
+		}
+		if (!body.expires_at) {
+			logToFile("[gateway] mint response omitted expires_at; failing the run");
+			throw new GatewayMintFailed("mint response omitted expires_at");
+		}
+		if (!body.gateway_url) {
+			logToFile("[gateway] mint response omitted gateway_url; failing the run");
+			throw new GatewayMintFailed("mint response omitted gateway_url");
+		}
+		if (!isTrustedGatewayUrl(body.gateway_url, host.apiHost)) {
+			logToFile("[gateway] mint returned an untrusted gateway url; failing the run");
+			throw new GatewayMintFailed("mint returned an untrusted gateway url");
+		}
+		return {
+			token: body.token,
+			expiresAt: body.expires_at,
+			gatewayUrl: body.gateway_url.replace(/\/+$/, ""),
+			teamId: body.team_id
+		};
+	} catch (e) {
+		if (e instanceof GatewayMintRefused || e instanceof GatewayMintFailed) throw e;
+		logToFile(`[gateway] mint transport failure (${String(e)}); failing the run`);
+		throw new GatewayMintFailed(`could not reach the PostHog gateway (${String(e)})`);
+	}
+}
+/**
+* The v2 run-metadata carrier: one JSON blob for the `X-PostHog-Properties`
+* header. Plain keys only, since the gateway strips `$`-prefixed keys as reserved,
+* so feature-flag variants land as `wizard_flag_<key>` instead of the legacy
+* `$feature/<key>` (dashboards keying on `$feature/wizard-*` read the new key
+* post-cutover).
+*/
+function buildWizardPropertiesBlob(wizardMetadata, wizardFlags, teamId) {
+	const props = {};
+	if (teamId !== void 0) props.team_id = teamId;
+	for (const [key, value] of Object.entries(wizardMetadata)) props[stripPropertyPrefix(key)] = value;
+	for (const [flagKey, variant] of Object.entries(wizardFlags)) {
+		if (!flagKey.toLowerCase().startsWith("wizard")) continue;
+		props[`wizard_flag_${flagKey.toLowerCase()}`] = variant;
+	}
+	return JSON.stringify(props);
+}
+const LEGACY_PROPERTY_PREFIX = "X-POSTHOG-PROPERTY-";
+function stripPropertyPrefix(key) {
+	return key.toUpperCase().startsWith(LEGACY_PROPERTY_PREFIX) ? key.slice(19).toLowerCase() : key;
+}
+//#endregion
 //#region src/lib/agent/runner/harness/pi/gateway.ts
 /**
 * PostHog LLM gateway provider spec for pi sessions — shared by the linear run
@@ -36,15 +259,20 @@ function gatewayApiFor(modelId) {
 	return modelId.startsWith("openai/") ? "openai-completions" : "anthropic-messages";
 }
 /**
-* Gateway HTTP headers, mirroring `buildAgentEnv` on the anthropic path: always
-* the Bedrock-fallback header, plus wizard metadata (`X-POSTHOG-PROPERTY-*`) and
-* wizard feature flags (`X-POSTHOG-FLAG-*`).
+* Gateway HTTP headers, mirroring `buildAgentEnv` on the anthropic path. The
+* shape follows the gateway edition: legacy sends per-key metadata/flag
+* headers plus the explicit Bedrock-fallback opt-in; v2 (the Go ai-gateway)
+* takes one `X-PostHog-Properties` JSON blob and falls back natively. The 1M
+* context beta rides both, since pi otherwise runs at 200k and overflows on larger
+* projects (the post-run compaction failures).
 */
-function buildGatewayHeaders(wizardMetadata, wizardFlags) {
-	const headers = {
-		"x-posthog-use-bedrock-fallback": "true",
-		"anthropic-beta": "context-1m-2025-08-07"
-	};
+function buildGatewayHeaders(wizardMetadata, wizardFlags, edition = "legacy", teamId) {
+	const headers = { "anthropic-beta": "context-1m-2025-08-07" };
+	if (edition === "v2") {
+		headers["X-PostHog-Properties"] = buildWizardPropertiesBlob(wizardMetadata, wizardFlags, teamId);
+		return headers;
+	}
+	headers["x-posthog-use-bedrock-fallback"] = "true";
 	for (const [key, value] of Object.entries(wizardMetadata)) {
 		const name = key.startsWith("X-POSTHOG-PROPERTY-") ? key : `${POSTHOG_PROPERTY_HEADER_PREFIX}${key}`;
 		headers[name] = value;
@@ -61,7 +289,7 @@ function buildGatewayHeaders(wizardMetadata, wizardFlags) {
 * callers (scan triage) hand it straight to `completeSimple`.
 */
 function buildGatewayModel(inputs) {
-	const { gatewayUrl, wizardMetadata, wizardFlags, modelId } = inputs;
+	const { gatewayUrl, wizardMetadata, wizardFlags, modelId, edition, teamId } = inputs;
 	const api = gatewayApiFor(modelId);
 	return {
 		id: modelId,
@@ -79,7 +307,7 @@ function buildGatewayModel(inputs) {
 		},
 		contextWindow: 1e6,
 		maxTokens: 64e3,
-		headers: buildGatewayHeaders(wizardMetadata, wizardFlags)
+		headers: buildGatewayHeaders(wizardMetadata, wizardFlags, edition, teamId)
 	};
 }
 /**
@@ -90,9 +318,9 @@ function buildGatewayProvider(inputs) {
 	const { gatewayUrl, accessToken, modelId, effort } = inputs;
 	const api = gatewayApiFor(modelId);
 	const tableCaps = modelCapabilities(modelId);
-	const caps = effort && tableCaps.reasoning ? {
+	const caps = effort && effort !== "off" && tableCaps.reasoning ? modelCapabilities(modelId, effort) : effort === "off" && tableCaps.reasoning ? {
 		...tableCaps,
-		thinkingLevel: effort
+		thinkingLevel: "off"
 	} : tableCaps;
 	const model = buildGatewayModel(inputs);
 	return {
@@ -127,6 +355,8 @@ function createTriageLLMProvider(auth, harness) {
 	const model = buildGatewayModel({
 		gatewayUrl: baseURL,
 		accessToken: authToken,
+		edition: auth.edition,
+		teamId: auth.teamId,
 		wizardMetadata: auth?.wizardMetadata ?? {},
 		wizardFlags: auth?.wizardFlags ?? {},
 		modelId
@@ -832,7 +1062,7 @@ function isFullyCancelled(answers) {
 }
 function createWizardAskBridge(opts) {
 	const timeoutMs = opts.timeoutMs ?? 3e5;
-	return { async request({ questions }) {
+	return { async request({ questions, subject }) {
 		const pending = {
 			id: randomUUID(),
 			questions,
@@ -853,12 +1083,14 @@ function createWizardAskBridge(opts) {
 			const durationMs = Date.now() - startedAt;
 			if (isFullyCancelled(answers)) analytics.wizardCapture("wizard_ask cancelled", {
 				source: pending.source,
+				subject,
 				question_count: questions.length,
 				duration_ms: durationMs,
 				timed_out: durationMs >= timeoutMs
 			});
 			else analytics.wizardCapture("wizard_ask answered", {
 				source: pending.source,
+				subject,
 				question_count: questions.length,
 				duration_ms: durationMs
 			});
@@ -1462,8 +1694,68 @@ const WIZARD_TOOL_NAMES = {
 const MAX_HANDOFF_TEXT_CHARS = 64 * 1024;
 const PUBLISH_HANDOFF_TOOL_NAME = "publish_handoff";
 /** Shared between the MCP server and the pi facade so the contract can't drift. */
-const PUBLISH_HANDOFF_DESCRIPTION = "Publish the handoff document — the full markdown report of what this run did — to the wizard session. Call it exactly once, at the end of the run, passing the complete report as `content`. This call is the only way the report reaches the user; do not write the report to a file instead.";
+const PUBLISH_HANDOFF_DESCRIPTION = "Publish the handoff document — the full markdown report of what this run did — to the wizard session. Call it exactly once, at the end of the run, passing the complete report as `content`. This call is the required way to deliver the report to the user; do not write the report to a file yourself.";
 const PUBLISH_HANDOFF_CONTENT_DESCRIPTION = "The complete handoff report as markdown, starting with an H1 heading.";
+/**
+* Write the handoff report to the host-designated `targetPath`.
+*
+* The destination comes from the host (`POSTHOG_HANDOFF_OUTPUT_PATH`,
+* process-env only — the agent can neither set nor see it) while the bytes come
+* from the agent, so the write is treated as a trust-boundary crossing:
+* - relative paths are refused (a relative destination would silently resolve
+*   against whatever CWD the wizard happens to run in);
+* - a pre-existing non-regular destination (symlink, directory, FIFO, device)
+*   is refused, so a primed symlink can't redirect the write at another file;
+* - content lands in a unique sibling temp file opened with O_NOFOLLOW |
+*   O_EXCL and is then rename()d over the destination — atomic for a polling
+*   reader, and rename replaces the *link* rather than following it;
+* - the final file is chmod'd to 0o600 even when the host pre-created it with
+*   looser permissions (the report quotes the user's code).
+*
+* `reason` is safe to surface to the agent (it names no path); `detail` carries
+* the specifics for the local log only.
+*/
+function writeHandoffFileAtomically(targetPath, text) {
+	if (!path$1.isAbsolute(targetPath)) return {
+		ok: false,
+		reason: "destination is not an absolute path",
+		detail: `relative destination refused: ${targetPath}`
+	};
+	let stat;
+	try {
+		stat = lstatSync(targetPath);
+	} catch {
+		stat = void 0;
+	}
+	if (stat && !stat.isFile()) return {
+		ok: false,
+		reason: "destination is not a regular file",
+		detail: `non-regular destination refused: ${targetPath}`
+	};
+	const tmpPath = `${targetPath}.tmp-${process.pid}-${randomBytes(6).toString("hex")}`;
+	let fd;
+	try {
+		fd = openSync(tmpPath, constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW | constants.O_EXCL, 384);
+		writeSync(fd, text, null, "utf8");
+		fchmodSync(fd, 384);
+		closeSync(fd);
+		fd = void 0;
+		renameSync(tmpPath, targetPath);
+		return { ok: true };
+	} catch (err) {
+		if (fd !== void 0) try {
+			closeSync(fd);
+		} catch {}
+		try {
+			unlinkSync(tmpPath);
+		} catch {}
+		return {
+			ok: false,
+			reason: (typeof err === "object" && err !== null && "code" in err ? String(err.code) : void 0) ?? "write error",
+			detail: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
 function publishHandoff(content) {
 	if (content.trim() === "") {
 		analytics.wizardCapture("handoff published", {
@@ -1478,14 +1770,29 @@ function publishHandoff(content) {
 	const truncated = content.length > MAX_HANDOFF_TEXT_CHARS;
 	const text = truncated ? content.slice(0, MAX_HANDOFF_TEXT_CHARS) : content;
 	getUI().setHandoffText(text);
+	const handoffOutputPath = runtimeEnv("POSTHOG_HANDOFF_OUTPUT_PATH");
+	let handoffOutputWritten;
+	let handoffOutputError;
+	if (handoffOutputPath) {
+		const write = writeHandoffFileAtomically(handoffOutputPath, text);
+		handoffOutputWritten = write.ok;
+		if (!write.ok) {
+			handoffOutputError = write.reason;
+			logToFile(`[publish_handoff] host output write failed (${write.reason}): ${write.detail}`);
+		}
+	}
 	analytics.wizardCapture("handoff published", {
 		handoff_ok: true,
 		handoff_chars: text.length,
-		handoff_truncated: truncated
+		handoff_truncated: truncated,
+		handoff_output_written: handoffOutputWritten
 	});
+	const notes = [];
+	if (truncated) notes.push("truncated to the 64 KB limit");
+	if (handoffOutputError) notes.push(`host output write failed: ${handoffOutputError}`);
 	return {
 		ok: true,
-		message: `Handoff published (${text.length} chars${truncated ? ", truncated to the 64 KB limit" : ""}).`
+		message: `Handoff published (${text.length} chars${notes.length > 0 ? `, ${notes.join("; ")}` : ""}).`
 	};
 }
 //#endregion
@@ -1847,7 +2154,10 @@ async function createWizardToolsServer(options) {
 				}
 				askAccounting.record(args.subject);
 				try {
-					const answers = await askBridge.request({ questions: args.questions });
+					const answers = await askBridge.request({
+						questions: args.questions,
+						subject: normaliseAskSubject(args.subject)
+					});
 					if (isFullyCancelled(answers)) askAccounting.refund(args.subject);
 					const sanitised = vaultSensitiveAnswers(args.questions, answers, secretVault);
 					logToFile(`wizard_ask: resolved ${Object.keys(answers).length} answer(s) for ${args.questions.length} question(s)`);
@@ -2032,31 +2342,6 @@ function classifyToolToStage(toolName) {
 	return null;
 }
 //#endregion
-//#region src/lib/agent/signals.ts
-/**
-* Agent signal vocabulary — the marker strings the agent emits and the error
-* taxonomy the runner returns. Kept as a dependency-free leaf module so both
-* `agent-interface.ts` and `output-signals.ts` can import it without a cycle.
-*/
-const AgentSignals = {
-	STATUS: "[STATUS]",
-	ERROR_MCP_MISSING: "[ERROR-MCP-MISSING]",
-	ERROR_RESOURCE_MISSING: "[ERROR-RESOURCE-MISSING]",
-	SKILL_INSTALL_FAILED: "[SKILL-INSTALL-FAILED]",
-	ABORT: "[ABORT]",
-	WIZARD_REMARK: "[WIZARD-REMARK]",
-	BENCHMARK: "[BENCHMARK]",
-	DASHBOARD_URL: "[DASHBOARD_URL]",
-	NOTEBOOK_URL: "[NOTEBOOK_URL]"
-};
-/**
-* End-of-run reflection ask, shared by both harnesses so remarks are
-* comparable. The format clause comes FIRST and nothing trails the marker —
-* literal models (gpt-5-mini) echo whatever text follows it. The parser also
-* drops remarks that quote this instruction (see AgentOutputSignals.remark).
-*/
-const REMARK_INSTRUCTION = `Reply with a single line that starts with ${AgentSignals.WIZARD_REMARK} and no other lines. In that line, state briefly what information or guidance would have been useful to have in the integration prompt or documentation for this run — specifically anything that would have prevented tool failures, erroneous edits, or other wasted turns.`;
-//#endregion
 //#region src/lib/agent/output-signals.ts
 /**
 * Parses the signal-bearing lines out of agent output and discards the rest.
@@ -2196,6 +2481,32 @@ const PROVIDER_ENV_NAMESPACE = /^(ANTHROPIC_|CLAUDE_CODE_)/;
 */
 const BLOCKED_OFF_NAMESPACE_KEYS = new Set(["AWS_BEARER_TOKEN_BEDROCK"]);
 /**
+* Host-orchestration values read only by the wizard process itself (via
+* `runtimeEnv` in src/env.ts). None of them is ever consumed by the spawned
+* agent subprocess — the `publish_handoff` MCP tool executes in the wizard's
+* own process — so the subprocess only ever loses attack surface:
+*
+* - `POSTHOG_HANDOFF_OUTPUT_PATH` names the host file the wizard writes the
+*   agent's handoff report to. Handing it to the subprocess tells a
+*   (prompt-injected) agent exactly which file its own report content lands
+*   in, turning the write into a pre-plantable symlink/same-UID overwrite
+*   target. The write itself refuses symlinks, but the agent has no business
+*   knowing the destination at all.
+* - `POSTHOG_TASK_RUN_ID` / `POSTHOG_TASK_ID` identify the sandbox run and are
+*   read by the wizard's analytics only; they let the agent fingerprint the
+*   run directory where the handoff path typically sits.
+*
+* Deliberately NOT stripped: `POSTHOG_API_KEY` / `POSTHOG_HOST` — pre-existing
+* passthrough that the agent may rely on when writing the user's project key
+* into the project's own .env. Changing that disposition is a separate,
+* deliberate decision, not part of this hardening.
+*/
+const HOST_ONLY_ENV_KEYS = new Set([
+	"POSTHOG_HANDOFF_OUTPUT_PATH",
+	"POSTHOG_TASK_RUN_ID",
+	"POSTHOG_TASK_ID"
+]);
+/**
 * Credential / routing knobs that, set in an on-disk Claude **settings** `env`
 * block, redirect the binary. A settings file is applied by the binary itself,
 * so the subprocess-env strip below cannot remove it — `claude-settings.ts`
@@ -2255,10 +2566,11 @@ const BLOCKED_AGENT_ENV_PATTERNS = [/^CLAUDE_CODE_SKIP_.+_AUTH$/, /^ANTHROPIC_.+
 /**
 * True if `key` must NOT be inherited by the agent subprocess: anything in the
 * provider namespace (the wizard re-injects its own values at the spawn site),
-* plus the lone off-namespace credential.
+* the lone off-namespace credential, and host-only orchestration values the
+* subprocess never reads.
 */
 function isBlockedAgentEnvKey(key) {
-	return PROVIDER_ENV_NAMESPACE.test(key) || BLOCKED_OFF_NAMESPACE_KEYS.has(key);
+	return PROVIDER_ENV_NAMESPACE.test(key) || BLOCKED_OFF_NAMESPACE_KEYS.has(key) || HOST_ONLY_ENV_KEYS.has(key);
 }
 /**
 * Return a copy of `env` with the entire model-provider namespace removed, so
@@ -2693,17 +3005,23 @@ function isWarlockDisabled() {
 	return runtimeEnv("POSTHOG_WIZARD_WARLOCK_DISABLED") === "true";
 }
 /**
-* Build env for the SDK subprocess: process.env plus ANTHROPIC_CUSTOM_HEADERS, which always
-* includes `x-posthog-use-bedrock-fallback: true` so the LLM gateway falls back to Bedrock on
-* Anthropic 5xx, plus any wizard metadata/flags.
+* Build env for the SDK subprocess: process.env plus ANTHROPIC_CUSTOM_HEADERS.
+* The header shape follows the gateway edition. Legacy (Python gateway):
+* per-key `X-POSTHOG-PROPERTY-*`/`X-POSTHOG-FLAG-*` plus the explicit
+* `x-posthog-use-bedrock-fallback` opt-in. v2 (Go ai-gateway): one
+* `X-PostHog-Properties` JSON blob. Bedrock fallback is native there, and
+* per-key metadata headers are not read.
 */
-function buildAgentEnv(wizardMetadata, wizardFlags) {
+function buildAgentEnv(wizardMetadata, wizardFlags, auth) {
 	const headers = createCustomHeaders();
-	headers.add("x-posthog-use-bedrock-fallback", "true");
-	for (const [key, value] of Object.entries(wizardMetadata)) headers.add(key.startsWith("X-POSTHOG-PROPERTY-") ? key : `${POSTHOG_PROPERTY_HEADER_PREFIX}${key}`, value);
-	for (const [flagKey, variant] of Object.entries(wizardFlags)) {
-		if (!flagKey.toLowerCase().startsWith("wizard")) continue;
-		headers.addFlag(flagKey, variant);
+	if (auth?.edition === "v2") headers.add("X-PostHog-Properties", buildWizardPropertiesBlob(wizardMetadata, wizardFlags, auth.teamId));
+	else {
+		headers.add("x-posthog-use-bedrock-fallback", "true");
+		for (const [key, value] of Object.entries(wizardMetadata)) headers.add(key.startsWith("X-POSTHOG-PROPERTY-") ? key : `${POSTHOG_PROPERTY_HEADER_PREFIX}${key}`, value);
+		for (const [flagKey, variant] of Object.entries(wizardFlags)) {
+			if (!flagKey.toLowerCase().startsWith("wizard")) continue;
+			headers.addFlag(flagKey, variant);
+		}
 	}
 	const encoded = headers.encode();
 	logToFile("ANTHROPIC_CUSTOM_HEADERS", encoded);
@@ -2798,13 +3116,17 @@ async function initializeAgent(config, options) {
 	logToFile("Install directory:", options.installDir);
 	try {
 		process.env.CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS = "true";
-		const gatewayUrl = config.host.gatewayUrl;
+		const auth = await gatewayAuth(config.host, config.posthogApiKey, config.programId);
+		const gatewayUrl = auth.gatewayUrl;
 		process.env.ANTHROPIC_BASE_URL = gatewayUrl;
-		process.env.ANTHROPIC_AUTH_TOKEN = config.posthogApiKey;
-		process.env.CLAUDE_CODE_OAUTH_TOKEN = config.posthogApiKey;
+		process.env.ANTHROPIC_AUTH_TOKEN = auth.token;
+		process.env.CLAUDE_CODE_OAUTH_TOKEN = auth.token;
+		logToFile("Gateway edition:", auth.edition);
 		const triageProvider = createTriageLLMProvider({
 			baseURL: gatewayUrl,
-			authToken: config.posthogApiKey,
+			authToken: auth.token,
+			edition: auth.edition,
+			teamId: auth.teamId,
 			wizardMetadata: {
 				...config.wizardMetadata ?? {},
 				call_type: "yara-triage"
@@ -2861,6 +3183,7 @@ async function initializeAgent(config, options) {
 			suppressTaskRender: !!config.orchestrator,
 			capture: config.capture,
 			triageProvider,
+			gatewayAuth: auth,
 			program: config.integrationLabel,
 			sequence: config.orchestrator ? "orchestrator" : "linear"
 		};
@@ -3034,13 +3357,13 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 				},
 				env: {
 					...sanitizeAgentSubprocessEnv(process.env),
-					ANTHROPIC_BASE_URL: process.env.ANTHROPIC_BASE_URL,
-					ANTHROPIC_AUTH_TOKEN: process.env.ANTHROPIC_AUTH_TOKEN,
-					CLAUDE_CODE_OAUTH_TOKEN: process.env.CLAUDE_CODE_OAUTH_TOKEN,
+					ANTHROPIC_BASE_URL: agentConfig.gatewayAuth.gatewayUrl,
+					ANTHROPIC_AUTH_TOKEN: agentConfig.gatewayAuth.token,
+					CLAUDE_CODE_OAUTH_TOKEN: agentConfig.gatewayAuth.token,
 					CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS: "true",
 					POSTHOG_MCP_TOKEN: agentConfig.posthogApiKey,
 					MCP_CONNECTION_NONBLOCKING: "0",
-					ANTHROPIC_CUSTOM_HEADERS: buildAgentEnv(agentConfig.wizardMetadata ?? {}, agentConfig.wizardFlags ?? {})
+					ANTHROPIC_CUSTOM_HEADERS: buildAgentEnv(agentConfig.wizardMetadata ?? {}, agentConfig.wizardFlags ?? {}, agentConfig.gatewayAuth)
 				},
 				canUseTool: (toolName, input) => {
 					logToFile("canUseTool called:", {
@@ -3072,7 +3395,7 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 					if (options.debug) debug("CLI stderr:", data);
 				},
 				hooks: {
-					PreToolUse: warlockDisabled ? [] : createPreToolUseYaraHooks(triageProvider),
+					PreToolUse: warlockDisabled ? [] : createPreToolUseYaraHooks(triageProvider, onYaraTerminate),
 					PostToolUse: warlockDisabled ? [] : createPostToolUseYaraHooks(triageProvider, onYaraTerminate),
 					Stop: [{
 						hooks: [createStopHook(config?.additionalFeatureQueue ?? [], signals, config?.requestRemark ?? true)],
@@ -3119,7 +3442,14 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 			if (message.type === "assistant" && signals.hasApiErrorStatus(401)) {
 				signalDone();
 				spinner.stop("Authentication failed");
-				const authError = buildAuthErrorContext(options.installDir, process.env.ANTHROPIC_BASE_URL ?? "", os.homedir(), signals.apiKeySource);
+				const authError = buildAuthErrorContext(options.installDir, agentConfig.gatewayAuth.gatewayUrl, os.homedir(), signals.apiKeySource);
+				const authCode = classifyAuthFailure({
+					hasSettingsConflict: authError.hasSettingsConflict,
+					usingManagedLogin: authError.usingManagedLogin,
+					apiKey: options.apiKey,
+					gatewayRegion: authError.region,
+					sessionRegion: options.cloudRegion
+				});
 				logToFile("Agent error: 401, showing auth error screen", authError);
 				getUI().showAuthError({
 					hasSettingsConflict: authError.hasSettingsConflict,
@@ -3129,6 +3459,7 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 					logFilePath: getLogFilePath()
 				});
 				await wizardAbort({
+					code: authCode,
 					message: "Authentication failed (401)",
 					error: new WizardError("Authentication failed", {
 						hasSettingsConflict: authError.hasSettingsConflict,
@@ -3138,7 +3469,7 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 						region: authError.region,
 						usingManagedLogin: authError.usingManagedLogin,
 						apiKeySource: authError.apiKeySource
-					})
+					}, authCode)
 				});
 			}
 			try {
@@ -3483,6 +3814,6 @@ function handleSDKMessage(message, options, spinner, signals, receivedSuccessRes
 	}
 }
 //#endregion
-export { downloadSkill as A, isFullyCancelled as B, ENV_FILE_PATH_DESCRIPTION as C, WIZARD_TOOL_NAMES as D, WIZARD_ASK_TOOL_DESCRIPTION as E, resolveEnvSecretRefs as F, createTriageLLMProvider as G, isEnvFileName as H, templateEnvWriteRefusal as I, GATEWAY_PROVIDER as K, vaultSensitiveAnswers as L, installSkillById as M, mergeEnvValues as N, checkEnvKeys as O, resolveEnvPath as P, fetchWithRetry as R, CHECK_ENV_KEYS_FILE_PATH_DESCRIPTION as S, WIZARD_ASK_SUBJECT_DESCRIPTION as T, parseEnvKeyNames as U, MAX_ENV_KEY_SET as V, toPromptSafeRelativePath as W, PUBLISH_HANDOFF_CONTENT_DESCRIPTION as _, wizardCanUseTool as a, publishHandoff as b, classifySettingsConflicts as c, sanitizeAgentSubprocessEnv as d, AgentOutputSignals as f, createSecretVault as g, assembleCommandments as h, runAgent as i, fetchSkillMenu as j, createAskAccounting as k, recoverOrphanedSettingsBackups as l, REMARK_INSTRUCTION as m, buildRunTags as n, backupAndFixClaudeSettings as o, AgentSignals as p, buildGatewayProvider as q, initializeAgent as r, checkAllSettingsConflicts as s, buildAgentEnv as t, restoreClaudeSettings as u, PUBLISH_HANDOFF_DESCRIPTION as v, WIZARD_ASK_SENSITIVE_DESCRIPTION as w, CHECK_ENV_KEYS_DESCRIPTION as x, PUBLISH_HANDOFF_TOOL_NAME as y, createWizardAskBridge as z };
+export { installSkillById as A, MAX_ENV_KEY_SET as B, WIZARD_ASK_SUBJECT_DESCRIPTION as C, createAskAccounting as D, checkEnvKeys as E, templateEnvWriteRefusal as F, GATEWAY_PROVIDER as G, parseEnvKeyNames as H, vaultSensitiveAnswers as I, buildGatewayProvider as K, fetchWithRetry as L, normaliseAskSubject as M, resolveEnvPath as N, downloadSkill as O, resolveEnvSecretRefs as P, createWizardAskBridge as R, WIZARD_ASK_SENSITIVE_DESCRIPTION as S, WIZARD_TOOL_NAMES as T, toPromptSafeRelativePath as U, isEnvFileName as V, createTriageLLMProvider as W, PUBLISH_HANDOFF_TOOL_NAME as _, wizardCanUseTool as a, CHECK_ENV_KEYS_FILE_PATH_DESCRIPTION as b, classifySettingsConflicts as c, sanitizeAgentSubprocessEnv as d, AgentOutputSignals as f, PUBLISH_HANDOFF_DESCRIPTION as g, PUBLISH_HANDOFF_CONTENT_DESCRIPTION as h, runAgent as i, mergeEnvValues as j, fetchSkillMenu as k, recoverOrphanedSettingsBackups as l, createSecretVault as m, buildRunTags as n, backupAndFixClaudeSettings as o, assembleCommandments as p, gatewayAuth as q, initializeAgent as r, checkAllSettingsConflicts as s, buildAgentEnv as t, restoreClaudeSettings as u, publishHandoff as v, WIZARD_ASK_TOOL_DESCRIPTION as w, ENV_FILE_PATH_DESCRIPTION as x, CHECK_ENV_KEYS_DESCRIPTION as y, isFullyCancelled as z };
 
-//# sourceMappingURL=agent-interface-D3MNaDp3.js.map
+//# sourceMappingURL=agent-interface-CaEptZuu.js.map