@posthog/wizard 2.71.0 → 2.73.0

package/dist/{tools-CJw5vnZd.js → tools-DZ9lZgJI.js}

@@ -1,8 +1,8 @@
-import { s as logToFile } from "./debug-YQdeZulR.js";
-import { n as analytics } from "./analytics-D54mLptm.js";
-import { A as fetchSkillMenu, B as isFullyCancelled, C as WIZARD_ASK_SENSITIVE_DESCRIPTION, D as checkEnvKeys, E as WIZARD_TOOL_NAMES, F as resolveEnvSecretRefs, I as templateEnvWriteRefusal, L as vaultSensitiveAnswers, M as mergeEnvValues, N as normaliseAskSubject, O as createAskAccounting, P as resolveEnvPath, S as ENV_FILE_PATH_DESCRIPTION, T as WIZARD_ASK_TOOL_DESCRIPTION, _ as PUBLISH_HANDOFF_DESCRIPTION, b as CHECK_ENV_KEYS_DESCRIPTION, g as PUBLISH_HANDOFF_CONTENT_DESCRIPTION, h as createSecretVault, j as installSkillById, v as PUBLISH_HANDOFF_TOOL_NAME, w as WIZARD_ASK_SUBJECT_DESCRIPTION, x as CHECK_ENV_KEYS_FILE_PATH_DESCRIPTION, y as publishHandoff } from "./agent-interface-DFm4jB4d.js";
-import { o as withMode } from "./pi-D4JQMC-7.js";
-import { a as detectNodePackageManagers } from "./package-manager-DMbzbdkL.js";
+import { s as logToFile } from "./debug-aXxgvtal.js";
+import { n as analytics } from "./analytics-DsMH06jo.js";
+import { A as checkEnvKeys, B as vaultSensitiveAnswers, C as CHECK_ENV_KEYS_DESCRIPTION, D as WIZARD_ASK_SUBJECT_DESCRIPTION, E as WIZARD_ASK_SENSITIVE_DESCRIPTION, F as mergeEnvValues, I as normaliseAskSubject, L as resolveEnvPath, N as fetchSkillMenu, O as WIZARD_ASK_TOOL_DESCRIPTION, P as installSkillById, R as resolveEnvSecretRefs, S as publishHandoff, T as ENV_FILE_PATH_DESCRIPTION, U as isFullyCancelled, b as PUBLISH_HANDOFF_DESCRIPTION, j as createAskAccounting, k as WIZARD_TOOL_NAMES, v as createSecretVault, w as CHECK_ENV_KEYS_FILE_PATH_DESCRIPTION, x as PUBLISH_HANDOFF_TOOL_NAME, y as PUBLISH_HANDOFF_CONTENT_DESCRIPTION, z as templateEnvWriteRefusal } from "./agent-interface-tcCEmyPQ.js";
+import { a as detectNodePackageManagers } from "./package-manager-B-Z3IVYu.js";
+import { o as withMode } from "./pi-CLLkGrND.js";
 import fs from "fs";
 import path from "path";
 import { Type } from "typebox";
@@ -218,4 +218,4 @@ function createWizardPiTools(ctx) {
 //#endregion
 export { createWizardPiTools };
 
-//# sourceMappingURL=tools-CJw5vnZd.js.map
+//# sourceMappingURL=tools-DZ9lZgJI.js.map

package/dist/{tools-CJw5vnZd.js.map → tools-DZ9lZgJI.js.map}

@@ -1 +1 @@
-{"version":3,"file":"tools-CJw5vnZd.js","names":["checkEnvKeys","checkEnvKeysCore"],"sources":["../src/lib/agent/runner/harness/pi/tools.ts"],"sourcesContent":["/**\n * Wizard capabilities as pi custom tools (#5). pi does not mount MCP servers,\n * so the tools the wizard prompt depends on — skill discovery/install and\n * fenced `.env` edits — are exposed to pi as native `defineTool` tools backed\n * by the same helpers the claude-agent-sdk path uses (`fetchSkillMenu`,\n * `installSkillById`, `checkEnvKeys`, `mergeEnvValues`). Same tool names as the\n * MCP server so the shared prompt is unchanged. `wizard_ask` is wired here too\n * (same schema, caps, and askBridge as the MCP tool) so interactive programs\n * can interview the user on pi; without a bridge (CI) it errors on call.\n * Sensitive answers are vaulted to `{secretRef}` and resolved host-side by\n * set_env_values — the raw value never enters the model conversation.\n */\n\nimport fs from 'fs';\nimport path from 'path';\nimport { Type } from 'typebox';\nimport { defineTool } from '@earendil-works/pi-coding-agent';\nimport type { ToolDefinition } from '@earendil-works/pi-coding-agent';\nimport { analytics } from '@utils/analytics';\nimport { logToFile } from '@utils/debug';\nimport {\n  CHECK_ENV_KEYS_DESCRIPTION,\n  CHECK_ENV_KEYS_FILE_PATH_DESCRIPTION,\n  DEFAULT_ASK_MAX_QUESTIONS,\n  ENV_FILE_PATH_DESCRIPTION,\n  WIZARD_TOOL_NAMES,\n  checkEnvKeys as checkEnvKeysCore,\n  createAskAccounting,\n  fetchSkillMenu,\n  installSkillById,\n  mergeEnvValues,\n  normaliseAskSubject,\n  resolveEnvPath,\n  resolveEnvSecretRefs,\n  templateEnvWriteRefusal,\n  vaultSensitiveAnswers,\n  WIZARD_ASK_SENSITIVE_DESCRIPTION,\n  WIZARD_ASK_SUBJECT_DESCRIPTION,\n  WIZARD_ASK_TOOL_DESCRIPTION,\n} from '@lib/wizard-tools/tools';\nimport type { LLMProvider } from '@posthog/warlock';\nimport { isFullyCancelled, type WizardAskBridge } from '@lib/wizard-ask-bridge';\nimport {\n  PUBLISH_HANDOFF_CONTENT_DESCRIPTION,\n  PUBLISH_HANDOFF_DESCRIPTION,\n  PUBLISH_HANDOFF_TOOL_NAME,\n  publishHandoff,\n} from '@lib/wizard-tools/handoff';\nimport { createSecretVault } from '@lib/secret-vault';\nimport { withMode } from './index';\nimport {\n  detectNodePackageManagers,\n  type PackageManagerDetector,\n} from '@lib/detection/package-manager';\n\nfunction text(s: string): {\n  content: [{ type: 'text'; text: string }];\n  details: unknown;\n} {\n  return { content: [{ type: 'text', text: s }], details: {} };\n}\n\nexport interface PiToolsContext {\n  workingDirectory: string;\n  skillsBaseUrl: string;\n  /** Framework's package-manager detector. Defaults to Node detection. */\n  detectPackageManager?: PackageManagerDetector;\n  /** Drives the `wizard_ask` overlay. Omitted in CI → the tool errors on call. */\n  askBridge?: WizardAskBridge;\n  /** Per-run cap on wizard_ask calls. Defaults to {@link DEFAULT_ASK_MAX_QUESTIONS}. */\n  maxQuestions?: number;\n  /** Overlay open/closed signal — the security gate blocks Write/Edit while open. */\n  onAskPendingChange?: (pending: boolean) => void;\n  /** Program disallow list; gates wizard_ask here since pi tools carry bare names the MCP-prefixed security gate misses. */\n  disallowedTools?: readonly string[];\n  /** Scan-triage classifier, resolved once in bootstrap. Absent → scans fail closed. */\n  triageProvider?: LLMProvider;\n}\n\nexport function createWizardPiTools(ctx: PiToolsContext): ToolDefinition[] {\n  const {\n    workingDirectory,\n    skillsBaseUrl,\n    askBridge,\n    onAskPendingChange,\n    triageProvider,\n  } = ctx;\n  const detectPackageManager =\n    ctx.detectPackageManager ?? detectNodePackageManagers;\n  const askMaxQuestions = ctx.maxQuestions ?? DEFAULT_ASK_MAX_QUESTIONS;\n  // Per-run wizard_ask accounting (total cap + one-time per-subject adjacency\n  // nudge). Same shared implementation the MCP server drives, so the two\n  // facades cannot diverge on the cap, the nudge or the refund.\n  const askAccounting = createAskAccounting(askMaxQuestions);\n  // Session-scoped secret vault, same contract as the MCP server: wizard_ask\n  // mints `{secretRef}` for sensitive answers, set_env_values resolves them.\n  const secretVault = createSecretVault();\n\n  // Fetch the skill menu at most once per run — the agent calls load_skill_menu\n  // 2-3× otherwise, each a fresh HTTP round-trip (profiled slowness).\n  let menuPromise: ReturnType<typeof fetchSkillMenu> | undefined;\n  const getSkillMenu = () => (menuPromise ??= fetchSkillMenu(skillsBaseUrl));\n\n  const loadSkillMenu = defineTool({\n    name: 'load_skill_menu',\n    label: 'Load skill menu',\n    description:\n      'Load available PostHog skills for a category. Returns skill IDs and names. Call this first, then install_skill with the chosen ID.',\n    promptSnippet:\n      'load_skill_menu(category) — list installable PostHog skills',\n    parameters: Type.Object({\n      category: Type.String({\n        description: 'Skill category, e.g. \"integration\"',\n      }),\n    }),\n    async execute(_id, args) {\n      const menu = await getSkillMenu();\n      if (!menu) return text('Error: could not load the skill menu.');\n      const skills = menu.categories[args.category] ?? [];\n      if (skills.length === 0) {\n        return text(`No skills found for category \"${args.category}\".`);\n      }\n      logToFile(`[pi] load_skill_menu: ${skills.length} skills`);\n      return text(skills.map((s) => `- ${s.id}: ${s.name}`).join('\\n'));\n    },\n  });\n\n  const installSkill = defineTool({\n    name: 'install_skill',\n    label: 'Install skill',\n    description:\n      'Download and install a PostHog skill by ID into .claude/skills/<skillId>/. Call load_skill_menu first. Then read the installed SKILL.md and follow it.',\n    promptSnippet:\n      'install_skill(skillId) — install a skill, then read its SKILL.md',\n    parameters: Type.Object({\n      skillId: Type.String({ description: 'Skill ID from load_skill_menu' }),\n    }),\n    async execute(_id, args) {\n      const result = await installSkillById(\n        args.skillId,\n        workingDirectory,\n        skillsBaseUrl,\n        { triage: triageProvider },\n      );\n      if (result.kind !== 'ok') {\n        logToFile(`[pi] install_skill ${args.skillId}: ${result.kind}`);\n        return text(\n          `Error installing skill \"${args.skillId}\": ${result.kind}. Use load_skill_menu to see valid IDs.`,\n        );\n      }\n      logToFile(`[pi] install_skill ${args.skillId} -> ${result.path}`);\n      return text(\n        `Installed \"${args.skillId}\" at ${result.path}. Read ${result.path}/SKILL.md and follow it.`,\n      );\n    },\n  });\n\n  const checkEnvKeys = defineTool({\n    name: 'check_env_keys',\n    label: 'Check env keys',\n    description: CHECK_ENV_KEYS_DESCRIPTION,\n    promptSnippet:\n      'check_env_keys(keys) — see which .env keys exist, and in which file',\n    parameters: Type.Object({\n      filePath: Type.Optional(\n        Type.String({\n          description: CHECK_ENV_KEYS_FILE_PATH_DESCRIPTION,\n        }),\n      ),\n      keys: Type.Array(Type.String(), {\n        description: 'Environment variable key names to check',\n      }),\n    }),\n    // `async` with nothing to await, on purpose: it is what turns a thrown\n    // error into a rejection. `checkEnvKeys` throws on a filePath that escapes\n    // the working directory, and pi wraps `execute` in a plain (non-async)\n    // arrow, so without this the throw leaves the tool synchronously instead\n    // of arriving as a failed tool call. The scan replaced an awaited read,\n    // which is the only reason there is nothing left to await.\n    // eslint-disable-next-line @typescript-eslint/require-await\n    async execute(_id, args) {\n      const results = checkEnvKeysCore(\n        workingDirectory,\n        args.keys,\n        args.filePath,\n      );\n      return text(JSON.stringify(results, null, 2));\n    },\n  });\n\n  const setEnvValues = defineTool({\n    name: 'set_env_values',\n    label: 'Set env values',\n    description:\n      'Create or update environment variable keys in a .env file (creates the file if missing). Each value is either a literal string or a secret reference `{ \"secretRef\": \"secret:...\" }` returned by wizard_ask — refs are resolved locally, so the actual value is written to the file but never returned to the agent.',\n    promptSnippet:\n      'set_env_values(filePath, values) — write .env keys (never hardcode secrets in source)',\n    parameters: Type.Object({\n      filePath: Type.String({\n        description: ENV_FILE_PATH_DESCRIPTION,\n      }),\n      values: Type.Record(\n        Type.String(),\n        Type.Union([Type.String(), Type.Object({ secretRef: Type.String() })]),\n        {\n          description:\n            'Key → (literal string OR { secretRef } pointing to a vaulted secret)',\n        },\n      ),\n    }),\n    async execute(_id, args) {\n      const forbidden = Object.keys(args.values).find(\n        (k) => k.toUpperCase() === 'POSTHOG_KEY',\n      );\n      if (forbidden) {\n        return text(\n          `Error: \"${forbidden}\" is not a valid PostHog env var name. Use the framework-specific key (e.g. NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN).`,\n        );\n      }\n      // Resolve secret refs host-side; the value never reaches the agent.\n      const resolution = resolveEnvSecretRefs(args.values, secretVault);\n      if (!resolution.ok) {\n        return text(\n          `Error: secret reference \"${resolution.secretRef}\" for key \"${resolution.key}\" is not known to the vault. The ref may have expired, been minted in a different run, or been mistyped.`,\n        );\n      }\n      const resolved = resolveEnvPath(workingDirectory, args.filePath);\n      const templateRefusal = templateEnvWriteRefusal(resolved);\n      if (templateRefusal) {\n        logToFile(`[pi] set_env_values: refused template target ${resolved}`);\n        analytics.wizardCapture('set_env_values template target refused', {\n          file_name: path.basename(resolved),\n        });\n        return text(templateRefusal);\n      }\n      const existing = fs.existsSync(resolved)\n        ? await fs.promises.readFile(resolved, 'utf8')\n        : '';\n      const merged = mergeEnvValues(existing, resolution.values);\n      const dir = path.dirname(resolved);\n      if (!fs.existsSync(dir))\n        await fs.promises.mkdir(dir, { recursive: true });\n      await fs.promises.writeFile(resolved, merged, 'utf8');\n      logToFile(\n        `[pi] set_env_values: ${resolved} keys=${Object.keys(args.values).join(\n          ',',\n        )}`,\n      );\n      return text(\n        `Wrote ${Object.keys(args.values).length} key(s) to ${args.filePath}.`,\n      );\n    },\n  });\n\n  const detectPm = defineTool({\n    name: 'detect_package_manager',\n    label: 'Detect package manager',\n    description:\n      \"Detect the project's package manager(s). Returns the name and the install command for each. Call this before installing a dependency, then RUN the returned install command (with the posthog package) via bash — the SDK package must end up in the project manifest, or the app will not build.\",\n    promptSnippet:\n      'detect_package_manager() — find the PM + install command, then run it via bash to add the SDK',\n    parameters: Type.Object({}),\n    async execute() {\n      const result = await detectPackageManager(workingDirectory);\n      logToFile(\n        `[pi] detect_package_manager: ${result.detected.length} detected`,\n      );\n      return text(JSON.stringify(result, null, 2));\n    },\n  });\n\n  // Native mirror of the MCP `wizard_ask` tool: same name, schema, and\n  // askBridge, so the shared prompt is unchanged.\n  const wizardAsk = defineTool({\n    name: 'wizard_ask',\n    label: 'Ask the user',\n    description: WIZARD_ASK_TOOL_DESCRIPTION,\n    promptSnippet:\n      'wizard_ask(questions, subject) — ask the user structured questions and wait for answers; tag each call with the subject it collects for',\n    parameters: Type.Object({\n      questions: Type.Array(\n        Type.Object({\n          id: Type.String({\n            description: 'Stable key for the answer in the response map',\n          }),\n          prompt: Type.String({\n            description: 'Question text shown to the user',\n          }),\n          kind: Type.Union(\n            [\n              Type.Literal('single'),\n              Type.Literal('multi'),\n              Type.Literal('text'),\n            ],\n            {\n              description:\n                \"'single' = pick one option, 'multi' = pick any, 'text' = free-form single-line answer\",\n            },\n          ),\n          options: Type.Optional(\n            Type.Array(\n              Type.Object({\n                label: Type.String(),\n                value: Type.String(),\n                description: Type.Optional(Type.String()),\n              }),\n              {\n                description:\n                  'Required for kind=single|multi; ignored for kind=text',\n              },\n            ),\n          ),\n          required: Type.Optional(\n            Type.Boolean({ description: 'Defaults to true' }),\n          ),\n          sensitive: Type.Optional(\n            Type.Boolean({\n              description: WIZARD_ASK_SENSITIVE_DESCRIPTION,\n            }),\n          ),\n        }),\n        { minItems: 1, maxItems: 8 },\n      ),\n      subject: Type.Optional(\n        Type.String({ description: WIZARD_ASK_SUBJECT_DESCRIPTION }),\n      ),\n    }),\n    async execute(_id, args) {\n      if (!askBridge) {\n        return text(\n          'Error: wizard_ask is not available in this environment (CI / non-interactive). Proceed with sensible defaults or emit [ABORT] requirements-incomplete.',\n        );\n      }\n\n      const cap = askAccounting.evaluate(args.subject);\n      if (cap.kind === 'capped') {\n        const { callCount } = askAccounting.snapshot();\n        logToFile(\n          `[pi] wizard_ask capped: reason=${cap.reason} count=${callCount} subject=${cap.subject} run=${cap.subjectRunLength}`,\n        );\n        analytics.wizardCapture('wizard_ask capped', {\n          reason: cap.reason,\n          call_count: callCount,\n          max_questions: askMaxQuestions,\n          subject: cap.subject,\n          subject_run_length: cap.subjectRunLength,\n        });\n        return text(cap.message);\n      }\n\n      // The schema can't enforce per-kind requirements or unique ids.\n      const ids = new Set<string>();\n      for (const q of args.questions) {\n        if ((q.kind === 'single' || q.kind === 'multi') && !q.options?.length) {\n          return text(\n            `Error: question \"${q.id}\" has kind=\"${q.kind}\" but no options. Provide at least one { label, value }, or use kind=\"text\".`,\n          );\n        }\n        if (q.sensitive && q.kind !== 'text') {\n          return text(\n            `Error: question \"${q.id}\" sets sensitive=true but kind=\"${q.kind}\". Only kind=\"text\" answers can be sensitive.`,\n          );\n        }\n        if (ids.has(q.id)) {\n          return text(\n            `Error: duplicate question id \"${q.id}\". Each question needs a unique id.`,\n          );\n        }\n        ids.add(q.id);\n      }\n\n      // Optimistically take the slot; refund it on a cancellation or a bridge\n      // error so a declined/failed ask doesn't burn the budget for later ones.\n      askAccounting.record(args.subject);\n      // Block Write/Edit for as long as the overlay is open, so the agent can't\n      // mutate files while it's waiting on the user's answer.\n      onAskPendingChange?.(true);\n      try {\n        const answers = await askBridge.request({\n          questions: args.questions,\n          subject: normaliseAskSubject(args.subject),\n        });\n        if (isFullyCancelled(answers)) askAccounting.refund(args.subject);\n        // Sensitive answers go to the vault; the agent sees an opaque ref\n        // (same contract as the MCP wizard_ask).\n        const sanitised = vaultSensitiveAnswers(\n          args.questions,\n          answers,\n          secretVault,\n        );\n        logToFile(\n          `[pi] wizard_ask: resolved ${\n            Object.keys(answers).length\n          } answer(s) for ${args.questions.length} question(s)`,\n        );\n        return text(JSON.stringify({ answers: sanitised }, null, 2));\n      } catch (err) {\n        askAccounting.refund(args.subject);\n        const message = err instanceof Error ? err.message : String(err);\n        logToFile(`[pi] wizard_ask: error: ${message}`);\n        return text(`Error: wizard_ask failed: ${message}`);\n      } finally {\n        onAskPendingChange?.(false);\n      }\n    },\n  });\n\n  // Native mirror of the MCP `publish_handoff` tool (shared description, so no drift).\n  const publishHandoffTool = defineTool({\n    name: PUBLISH_HANDOFF_TOOL_NAME,\n    label: 'Publish handoff',\n    description: PUBLISH_HANDOFF_DESCRIPTION,\n    promptSnippet:\n      'publish_handoff(content) — publish the full report markdown to the wizard session',\n    parameters: Type.Object({\n      content: Type.String({\n        description: PUBLISH_HANDOFF_CONTENT_DESCRIPTION,\n      }),\n    }),\n    execute(_id, args) {\n      const result = publishHandoff(args.content);\n      logToFile(`[pi] publish_handoff: ${result.message}`);\n      return Promise.resolve(text(result.message));\n    },\n  });\n\n  const tools = [\n    loadSkillMenu,\n    installSkill,\n    checkEnvKeys,\n    setEnvValues,\n    detectPm,\n    // Sequential: it mutates the store's handoff state.\n    withMode(publishHandoffTool, 'sequential'),\n  ];\n  // Register wizard_ask only when the program allows it. posthog-integration\n  // disallows it (runs without structured user input); self-driving keeps it.\n  // Sequential: the ask bridge holds a single in-flight question slot, so a\n  // batched turn must never dispatch two asks (or an ask + a write) at once.\n  const askDisallowed =\n    ctx.disallowedTools?.includes(WIZARD_TOOL_NAMES.wizardAsk) ?? false;\n  if (!askDisallowed) tools.push(withMode(wizardAsk, 'sequential'));\n  return tools;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAuDA,SAAS,KAAK,GAGZ;AACA,QAAO;EAAE,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM;GAAG,CAAC;EAAE,SAAS,EAAE;EAAE;;AAoB9D,SAAgB,oBAAoB,KAAuC;CACzE,MAAM,EACJ,kBACA,eACA,WACA,oBACA,mBACE;CACJ,MAAM,uBACJ,IAAI,wBAAwB;CAC9B,MAAM,kBAAkB,IAAI,gBAAA;CAI5B,MAAM,gBAAgB,oBAAoB,gBAAgB;CAG1D,MAAM,cAAc,mBAAmB;CAIvC,IAAI;CACJ,MAAM,qBAAsB,gBAAgB,eAAe,cAAc;CAEzE,MAAM,gBAAgB,WAAW;EAC/B,MAAM;EACN,OAAO;EACP,aACE;EACF,eACE;EACF,YAAY,KAAK,OAAO,EACtB,UAAU,KAAK,OAAO,EACpB,aAAa,wCACd,CAAC,EACH,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;GACvB,MAAM,OAAO,MAAM,cAAc;AACjC,OAAI,CAAC,KAAM,QAAO,KAAK,wCAAwC;GAC/D,MAAM,SAAS,KAAK,WAAW,KAAK,aAAa,EAAE;AACnD,OAAI,OAAO,WAAW,EACpB,QAAO,KAAK,iCAAiC,KAAK,SAAS,IAAI;AAEjE,aAAU,yBAAyB,OAAO,OAAO,SAAS;AAC1D,UAAO,KAAK,OAAO,KAAK,MAAM,KAAK,EAAE,GAAG,IAAI,EAAE,OAAO,CAAC,KAAK,KAAK,CAAC;;EAEpE,CAAC;CAEF,MAAM,eAAe,WAAW;EAC9B,MAAM;EACN,OAAO;EACP,aACE;EACF,eACE;EACF,YAAY,KAAK,OAAO,EACtB,SAAS,KAAK,OAAO,EAAE,aAAa,iCAAiC,CAAC,EACvE,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;GACvB,MAAM,SAAS,MAAM,iBACnB,KAAK,SACL,kBACA,eACA,EAAE,QAAQ,gBAAgB,CAC3B;AACD,OAAI,OAAO,SAAS,MAAM;AACxB,cAAU,sBAAsB,KAAK,QAAQ,IAAI,OAAO,OAAO;AAC/D,WAAO,KACL,2BAA2B,KAAK,QAAQ,KAAK,OAAO,KAAK,yCAC1D;;AAEH,aAAU,sBAAsB,KAAK,QAAQ,MAAM,OAAO,OAAO;AACjE,UAAO,KACL,cAAc,KAAK,QAAQ,OAAO,OAAO,KAAK,SAAS,OAAO,KAAK,0BACpE;;EAEJ,CAAC;CAEF,MAAMA,iBAAe,WAAW;EAC9B,MAAM;EACN,OAAO;EACP,aAAa;EACb,eACE;EACF,YAAY,KAAK,OAAO;GACtB,UAAU,KAAK,SACb,KAAK,OAAO,EACV,aAAa,sCACd,CAAC,CACH;GACD,MAAM,KAAK,MAAM,KAAK,QAAQ,EAAE,EAC9B,aAAa,2CACd,CAAC;GACH,CAAC;EAQF,MAAM,QAAQ,KAAK,MAAM;GACvB,MAAM,UAAUC,aACd,kBACA,KAAK,MACL,KAAK,SACN;AACD,UAAO,KAAK,KAAK,UAAU,SAAS,MAAM,EAAE,CAAC;;EAEhD,CAAC;CAEF,MAAM,eAAe,WAAW;EAC9B,MAAM;EACN,OAAO;EACP,aACE;EACF,eACE;EACF,YAAY,KAAK,OAAO;GACtB,UAAU,KAAK,OAAO,EACpB,aAAa,2BACd,CAAC;GACF,QAAQ,KAAK,OACX,KAAK,QAAQ,EACb,KAAK,MAAM,CAAC,KAAK,QAAQ,EAAE,KAAK,OAAO,EAAE,WAAW,KAAK,QAAQ,EAAE,CAAC,CAAC,CAAC,EACtE,EACE,aACE,wEACH,CACF;GACF,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;GACvB,MAAM,YAAY,OAAO,KAAK,KAAK,OAAO,CAAC,MACxC,MAAM,EAAE,aAAa,KAAK,cAC5B;AACD,OAAI,UACF,QAAO,KACL,WAAW,UAAU,iHACtB;GAGH,MAAM,aAAa,qBAAqB,KAAK,QAAQ,YAAY;AACjE,OAAI,CAAC,WAAW,GACd,QAAO,KACL,4BAA4B,WAAW,UAAU,aAAa,WAAW,IAAI,0GAC9E;GAEH,MAAM,WAAW,eAAe,kBAAkB,KAAK,SAAS;GAChE,MAAM,kBAAkB,wBAAwB,SAAS;AACzD,OAAI,iBAAiB;AACnB,cAAU,gDAAgD,WAAW;AACrE,cAAU,cAAc,0CAA0C,EAChE,WAAW,KAAK,SAAS,SAAS,EACnC,CAAC;AACF,WAAO,KAAK,gBAAgB;;GAK9B,MAAM,SAAS,eAHE,GAAG,WAAW,SAAS,GACpC,MAAM,GAAG,SAAS,SAAS,UAAU,OAAO,GAC5C,IACoC,WAAW,OAAO;GAC1D,MAAM,MAAM,KAAK,QAAQ,SAAS;AAClC,OAAI,CAAC,GAAG,WAAW,IAAI,CACrB,OAAM,GAAG,SAAS,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC;AACnD,SAAM,GAAG,SAAS,UAAU,UAAU,QAAQ,OAAO;AACrD,aACE,wBAAwB,SAAS,QAAQ,OAAO,KAAK,KAAK,OAAO,CAAC,KAChE,IACD,GACF;AACD,UAAO,KACL,SAAS,OAAO,KAAK,KAAK,OAAO,CAAC,OAAO,aAAa,KAAK,SAAS,GACrE;;EAEJ,CAAC;CAEF,MAAM,WAAW,WAAW;EAC1B,MAAM;EACN,OAAO;EACP,aACE;EACF,eACE;EACF,YAAY,KAAK,OAAO,EAAE,CAAC;EAC3B,MAAM,UAAU;GACd,MAAM,SAAS,MAAM,qBAAqB,iBAAiB;AAC3D,aACE,gCAAgC,OAAO,SAAS,OAAO,WACxD;AACD,UAAO,KAAK,KAAK,UAAU,QAAQ,MAAM,EAAE,CAAC;;EAE/C,CAAC;CAIF,MAAM,YAAY,WAAW;EAC3B,MAAM;EACN,OAAO;EACP,aAAa;EACb,eACE;EACF,YAAY,KAAK,OAAO;GACtB,WAAW,KAAK,MACd,KAAK,OAAO;IACV,IAAI,KAAK,OAAO,EACd,aAAa,iDACd,CAAC;IACF,QAAQ,KAAK,OAAO,EAClB,aAAa,mCACd,CAAC;IACF,MAAM,KAAK,MACT;KACE,KAAK,QAAQ,SAAS;KACtB,KAAK,QAAQ,QAAQ;KACrB,KAAK,QAAQ,OAAO;KACrB,EACD,EACE,aACE,yFACH,CACF;IACD,SAAS,KAAK,SACZ,KAAK,MACH,KAAK,OAAO;KACV,OAAO,KAAK,QAAQ;KACpB,OAAO,KAAK,QAAQ;KACpB,aAAa,KAAK,SAAS,KAAK,QAAQ,CAAC;KAC1C,CAAC,EACF,EACE,aACE,yDACH,CACF,CACF;IACD,UAAU,KAAK,SACb,KAAK,QAAQ,EAAE,aAAa,oBAAoB,CAAC,CAClD;IACD,WAAW,KAAK,SACd,KAAK,QAAQ,EACX,aAAa,kCACd,CAAC,CACH;IACF,CAAC,EACF;IAAE,UAAU;IAAG,UAAU;IAAG,CAC7B;GACD,SAAS,KAAK,SACZ,KAAK,OAAO,EAAE,aAAa,gCAAgC,CAAC,CAC7D;GACF,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;AACvB,OAAI,CAAC,UACH,QAAO,KACL,yJACD;GAGH,MAAM,MAAM,cAAc,SAAS,KAAK,QAAQ;AAChD,OAAI,IAAI,SAAS,UAAU;IACzB,MAAM,EAAE,cAAc,cAAc,UAAU;AAC9C,cACE,kCAAkC,IAAI,OAAO,SAAS,UAAU,WAAW,IAAI,QAAQ,OAAO,IAAI,mBACnG;AACD,cAAU,cAAc,qBAAqB;KAC3C,QAAQ,IAAI;KACZ,YAAY;KACZ,eAAe;KACf,SAAS,IAAI;KACb,oBAAoB,IAAI;KACzB,CAAC;AACF,WAAO,KAAK,IAAI,QAAQ;;GAI1B,MAAM,sBAAM,IAAI,KAAa;AAC7B,QAAK,MAAM,KAAK,KAAK,WAAW;AAC9B,SAAK,EAAE,SAAS,YAAY,EAAE,SAAS,YAAY,CAAC,EAAE,SAAS,OAC7D,QAAO,KACL,oBAAoB,EAAE,GAAG,cAAc,EAAE,KAAK,8EAC/C;AAEH,QAAI,EAAE,aAAa,EAAE,SAAS,OAC5B,QAAO,KACL,oBAAoB,EAAE,GAAG,kCAAkC,EAAE,KAAK,+CACnE;AAEH,QAAI,IAAI,IAAI,EAAE,GAAG,CACf,QAAO,KACL,iCAAiC,EAAE,GAAG,qCACvC;AAEH,QAAI,IAAI,EAAE,GAAG;;AAKf,iBAAc,OAAO,KAAK,QAAQ;AAGlC,wBAAqB,KAAK;AAC1B,OAAI;IACF,MAAM,UAAU,MAAM,UAAU,QAAQ;KACtC,WAAW,KAAK;KAChB,SAAS,oBAAoB,KAAK,QAAQ;KAC3C,CAAC;AACF,QAAI,iBAAiB,QAAQ,CAAE,eAAc,OAAO,KAAK,QAAQ;IAGjE,MAAM,YAAY,sBAChB,KAAK,WACL,SACA,YACD;AACD,cACE,6BACE,OAAO,KAAK,QAAQ,CAAC,OACtB,iBAAiB,KAAK,UAAU,OAAO,cACzC;AACD,WAAO,KAAK,KAAK,UAAU,EAAE,SAAS,WAAW,EAAE,MAAM,EAAE,CAAC;YACrD,KAAK;AACZ,kBAAc,OAAO,KAAK,QAAQ;IAClC,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAChE,cAAU,2BAA2B,UAAU;AAC/C,WAAO,KAAK,6BAA6B,UAAU;aAC3C;AACR,yBAAqB,MAAM;;;EAGhC,CAAC;CAqBF,MAAM,QAAQ;EACZ;EACA;EACAD;EACA;EACA;EAEA,SAzByB,WAAW;GACpC,MAAM;GACN,OAAO;GACP,aAAa;GACb,eACE;GACF,YAAY,KAAK,OAAO,EACtB,SAAS,KAAK,OAAO,EACnB,aAAa,qCACd,CAAC,EACH,CAAC;GACF,QAAQ,KAAK,MAAM;IACjB,MAAM,SAAS,eAAe,KAAK,QAAQ;AAC3C,cAAU,yBAAyB,OAAO,UAAU;AACpD,WAAO,QAAQ,QAAQ,KAAK,OAAO,QAAQ,CAAC;;GAE/C,CAAC,EAS6B,aAAa;EAC3C;AAOD,KAAI,EADF,IAAI,iBAAiB,SAAS,kBAAkB,UAAU,IAAI,OAC5C,OAAM,KAAK,SAAS,WAAW,aAAa,CAAC;AACjE,QAAO"}
+{"version":3,"file":"tools-DZ9lZgJI.js","names":["checkEnvKeys","checkEnvKeysCore"],"sources":["../src/lib/agent/runner/harness/pi/tools.ts"],"sourcesContent":["/**\n * Wizard capabilities as pi custom tools (#5). pi does not mount MCP servers,\n * so the tools the wizard prompt depends on — skill discovery/install and\n * fenced `.env` edits — are exposed to pi as native `defineTool` tools backed\n * by the same helpers the claude-agent-sdk path uses (`fetchSkillMenu`,\n * `installSkillById`, `checkEnvKeys`, `mergeEnvValues`). Same tool names as the\n * MCP server so the shared prompt is unchanged. `wizard_ask` is wired here too\n * (same schema, caps, and askBridge as the MCP tool) so interactive programs\n * can interview the user on pi; without a bridge (CI) it errors on call.\n * Sensitive answers are vaulted to `{secretRef}` and resolved host-side by\n * set_env_values — the raw value never enters the model conversation.\n */\n\nimport fs from 'fs';\nimport path from 'path';\nimport { Type } from 'typebox';\nimport { defineTool } from '@earendil-works/pi-coding-agent';\nimport type { ToolDefinition } from '@earendil-works/pi-coding-agent';\nimport { analytics } from '@utils/analytics';\nimport { logToFile } from '@utils/debug';\nimport {\n  CHECK_ENV_KEYS_DESCRIPTION,\n  CHECK_ENV_KEYS_FILE_PATH_DESCRIPTION,\n  DEFAULT_ASK_MAX_QUESTIONS,\n  ENV_FILE_PATH_DESCRIPTION,\n  WIZARD_TOOL_NAMES,\n  checkEnvKeys as checkEnvKeysCore,\n  createAskAccounting,\n  fetchSkillMenu,\n  installSkillById,\n  mergeEnvValues,\n  normaliseAskSubject,\n  resolveEnvPath,\n  resolveEnvSecretRefs,\n  templateEnvWriteRefusal,\n  vaultSensitiveAnswers,\n  WIZARD_ASK_SENSITIVE_DESCRIPTION,\n  WIZARD_ASK_SUBJECT_DESCRIPTION,\n  WIZARD_ASK_TOOL_DESCRIPTION,\n} from '@lib/wizard-tools/tools';\nimport type { LLMProvider } from '@posthog/warlock';\nimport { isFullyCancelled, type WizardAskBridge } from '@lib/wizard-ask-bridge';\nimport {\n  PUBLISH_HANDOFF_CONTENT_DESCRIPTION,\n  PUBLISH_HANDOFF_DESCRIPTION,\n  PUBLISH_HANDOFF_TOOL_NAME,\n  publishHandoff,\n} from '@lib/wizard-tools/handoff';\nimport { createSecretVault } from '@lib/secret-vault';\nimport { withMode } from './index';\nimport {\n  detectNodePackageManagers,\n  type PackageManagerDetector,\n} from '@lib/detection/package-manager';\n\nfunction text(s: string): {\n  content: [{ type: 'text'; text: string }];\n  details: unknown;\n} {\n  return { content: [{ type: 'text', text: s }], details: {} };\n}\n\nexport interface PiToolsContext {\n  workingDirectory: string;\n  skillsBaseUrl: string;\n  /** Framework's package-manager detector. Defaults to Node detection. */\n  detectPackageManager?: PackageManagerDetector;\n  /** Drives the `wizard_ask` overlay. Omitted in CI → the tool errors on call. */\n  askBridge?: WizardAskBridge;\n  /** Per-run cap on wizard_ask calls. Defaults to {@link DEFAULT_ASK_MAX_QUESTIONS}. */\n  maxQuestions?: number;\n  /** Overlay open/closed signal — the security gate blocks Write/Edit while open. */\n  onAskPendingChange?: (pending: boolean) => void;\n  /** Program disallow list; gates wizard_ask here since pi tools carry bare names the MCP-prefixed security gate misses. */\n  disallowedTools?: readonly string[];\n  /** Scan-triage classifier, resolved once in bootstrap. Absent → scans fail closed. */\n  triageProvider?: LLMProvider;\n}\n\nexport function createWizardPiTools(ctx: PiToolsContext): ToolDefinition[] {\n  const {\n    workingDirectory,\n    skillsBaseUrl,\n    askBridge,\n    onAskPendingChange,\n    triageProvider,\n  } = ctx;\n  const detectPackageManager =\n    ctx.detectPackageManager ?? detectNodePackageManagers;\n  const askMaxQuestions = ctx.maxQuestions ?? DEFAULT_ASK_MAX_QUESTIONS;\n  // Per-run wizard_ask accounting (total cap + one-time per-subject adjacency\n  // nudge). Same shared implementation the MCP server drives, so the two\n  // facades cannot diverge on the cap, the nudge or the refund.\n  const askAccounting = createAskAccounting(askMaxQuestions);\n  // Session-scoped secret vault, same contract as the MCP server: wizard_ask\n  // mints `{secretRef}` for sensitive answers, set_env_values resolves them.\n  const secretVault = createSecretVault();\n\n  // Fetch the skill menu at most once per run — the agent calls load_skill_menu\n  // 2-3× otherwise, each a fresh HTTP round-trip (profiled slowness).\n  let menuPromise: ReturnType<typeof fetchSkillMenu> | undefined;\n  const getSkillMenu = () => (menuPromise ??= fetchSkillMenu(skillsBaseUrl));\n\n  const loadSkillMenu = defineTool({\n    name: 'load_skill_menu',\n    label: 'Load skill menu',\n    description:\n      'Load available PostHog skills for a category. Returns skill IDs and names. Call this first, then install_skill with the chosen ID.',\n    promptSnippet:\n      'load_skill_menu(category) — list installable PostHog skills',\n    parameters: Type.Object({\n      category: Type.String({\n        description: 'Skill category, e.g. \"integration\"',\n      }),\n    }),\n    async execute(_id, args) {\n      const menu = await getSkillMenu();\n      if (!menu) return text('Error: could not load the skill menu.');\n      const skills = menu.categories[args.category] ?? [];\n      if (skills.length === 0) {\n        return text(`No skills found for category \"${args.category}\".`);\n      }\n      logToFile(`[pi] load_skill_menu: ${skills.length} skills`);\n      return text(skills.map((s) => `- ${s.id}: ${s.name}`).join('\\n'));\n    },\n  });\n\n  const installSkill = defineTool({\n    name: 'install_skill',\n    label: 'Install skill',\n    description:\n      'Download and install a PostHog skill by ID into .claude/skills/<skillId>/. Call load_skill_menu first. Then read the installed SKILL.md and follow it.',\n    promptSnippet:\n      'install_skill(skillId) — install a skill, then read its SKILL.md',\n    parameters: Type.Object({\n      skillId: Type.String({ description: 'Skill ID from load_skill_menu' }),\n    }),\n    async execute(_id, args) {\n      const result = await installSkillById(\n        args.skillId,\n        workingDirectory,\n        skillsBaseUrl,\n        { triage: triageProvider },\n      );\n      if (result.kind !== 'ok') {\n        logToFile(`[pi] install_skill ${args.skillId}: ${result.kind}`);\n        return text(\n          `Error installing skill \"${args.skillId}\": ${result.kind}. Use load_skill_menu to see valid IDs.`,\n        );\n      }\n      logToFile(`[pi] install_skill ${args.skillId} -> ${result.path}`);\n      return text(\n        `Installed \"${args.skillId}\" at ${result.path}. Read ${result.path}/SKILL.md and follow it.`,\n      );\n    },\n  });\n\n  const checkEnvKeys = defineTool({\n    name: 'check_env_keys',\n    label: 'Check env keys',\n    description: CHECK_ENV_KEYS_DESCRIPTION,\n    promptSnippet:\n      'check_env_keys(keys) — see which .env keys exist, and in which file',\n    parameters: Type.Object({\n      filePath: Type.Optional(\n        Type.String({\n          description: CHECK_ENV_KEYS_FILE_PATH_DESCRIPTION,\n        }),\n      ),\n      keys: Type.Array(Type.String(), {\n        description: 'Environment variable key names to check',\n      }),\n    }),\n    // `async` with nothing to await, on purpose: it is what turns a thrown\n    // error into a rejection. `checkEnvKeys` throws on a filePath that escapes\n    // the working directory, and pi wraps `execute` in a plain (non-async)\n    // arrow, so without this the throw leaves the tool synchronously instead\n    // of arriving as a failed tool call. The scan replaced an awaited read,\n    // which is the only reason there is nothing left to await.\n    // eslint-disable-next-line @typescript-eslint/require-await\n    async execute(_id, args) {\n      const results = checkEnvKeysCore(\n        workingDirectory,\n        args.keys,\n        args.filePath,\n      );\n      return text(JSON.stringify(results, null, 2));\n    },\n  });\n\n  const setEnvValues = defineTool({\n    name: 'set_env_values',\n    label: 'Set env values',\n    description:\n      'Create or update environment variable keys in a .env file (creates the file if missing). Each value is either a literal string or a secret reference `{ \"secretRef\": \"secret:...\" }` returned by wizard_ask — refs are resolved locally, so the actual value is written to the file but never returned to the agent.',\n    promptSnippet:\n      'set_env_values(filePath, values) — write .env keys (never hardcode secrets in source)',\n    parameters: Type.Object({\n      filePath: Type.String({\n        description: ENV_FILE_PATH_DESCRIPTION,\n      }),\n      values: Type.Record(\n        Type.String(),\n        Type.Union([Type.String(), Type.Object({ secretRef: Type.String() })]),\n        {\n          description:\n            'Key → (literal string OR { secretRef } pointing to a vaulted secret)',\n        },\n      ),\n    }),\n    async execute(_id, args) {\n      const forbidden = Object.keys(args.values).find(\n        (k) => k.toUpperCase() === 'POSTHOG_KEY',\n      );\n      if (forbidden) {\n        return text(\n          `Error: \"${forbidden}\" is not a valid PostHog env var name. Use the framework-specific key (e.g. NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN).`,\n        );\n      }\n      // Resolve secret refs host-side; the value never reaches the agent.\n      const resolution = resolveEnvSecretRefs(args.values, secretVault);\n      if (!resolution.ok) {\n        return text(\n          `Error: secret reference \"${resolution.secretRef}\" for key \"${resolution.key}\" is not known to the vault. The ref may have expired, been minted in a different run, or been mistyped.`,\n        );\n      }\n      const resolved = resolveEnvPath(workingDirectory, args.filePath);\n      const templateRefusal = templateEnvWriteRefusal(resolved);\n      if (templateRefusal) {\n        logToFile(`[pi] set_env_values: refused template target ${resolved}`);\n        analytics.wizardCapture('set_env_values template target refused', {\n          file_name: path.basename(resolved),\n        });\n        return text(templateRefusal);\n      }\n      const existing = fs.existsSync(resolved)\n        ? await fs.promises.readFile(resolved, 'utf8')\n        : '';\n      const merged = mergeEnvValues(existing, resolution.values);\n      const dir = path.dirname(resolved);\n      if (!fs.existsSync(dir))\n        await fs.promises.mkdir(dir, { recursive: true });\n      await fs.promises.writeFile(resolved, merged, 'utf8');\n      logToFile(\n        `[pi] set_env_values: ${resolved} keys=${Object.keys(args.values).join(\n          ',',\n        )}`,\n      );\n      return text(\n        `Wrote ${Object.keys(args.values).length} key(s) to ${args.filePath}.`,\n      );\n    },\n  });\n\n  const detectPm = defineTool({\n    name: 'detect_package_manager',\n    label: 'Detect package manager',\n    description:\n      \"Detect the project's package manager(s). Returns the name and the install command for each. Call this before installing a dependency, then RUN the returned install command (with the posthog package) via bash — the SDK package must end up in the project manifest, or the app will not build.\",\n    promptSnippet:\n      'detect_package_manager() — find the PM + install command, then run it via bash to add the SDK',\n    parameters: Type.Object({}),\n    async execute() {\n      const result = await detectPackageManager(workingDirectory);\n      logToFile(\n        `[pi] detect_package_manager: ${result.detected.length} detected`,\n      );\n      return text(JSON.stringify(result, null, 2));\n    },\n  });\n\n  // Native mirror of the MCP `wizard_ask` tool: same name, schema, and\n  // askBridge, so the shared prompt is unchanged.\n  const wizardAsk = defineTool({\n    name: 'wizard_ask',\n    label: 'Ask the user',\n    description: WIZARD_ASK_TOOL_DESCRIPTION,\n    promptSnippet:\n      'wizard_ask(questions, subject) — ask the user structured questions and wait for answers; tag each call with the subject it collects for',\n    parameters: Type.Object({\n      questions: Type.Array(\n        Type.Object({\n          id: Type.String({\n            description: 'Stable key for the answer in the response map',\n          }),\n          prompt: Type.String({\n            description: 'Question text shown to the user',\n          }),\n          kind: Type.Union(\n            [\n              Type.Literal('single'),\n              Type.Literal('multi'),\n              Type.Literal('text'),\n            ],\n            {\n              description:\n                \"'single' = pick one option, 'multi' = pick any, 'text' = free-form single-line answer\",\n            },\n          ),\n          options: Type.Optional(\n            Type.Array(\n              Type.Object({\n                label: Type.String(),\n                value: Type.String(),\n                description: Type.Optional(Type.String()),\n              }),\n              {\n                description:\n                  'Required for kind=single|multi; ignored for kind=text',\n              },\n            ),\n          ),\n          required: Type.Optional(\n            Type.Boolean({ description: 'Defaults to true' }),\n          ),\n          sensitive: Type.Optional(\n            Type.Boolean({\n              description: WIZARD_ASK_SENSITIVE_DESCRIPTION,\n            }),\n          ),\n        }),\n        { minItems: 1, maxItems: 8 },\n      ),\n      subject: Type.Optional(\n        Type.String({ description: WIZARD_ASK_SUBJECT_DESCRIPTION }),\n      ),\n    }),\n    async execute(_id, args) {\n      if (!askBridge) {\n        return text(\n          'Error: wizard_ask is not available in this environment (CI / non-interactive). Proceed with sensible defaults or emit [ABORT] requirements-incomplete.',\n        );\n      }\n\n      const cap = askAccounting.evaluate(args.subject);\n      if (cap.kind === 'capped') {\n        const { callCount } = askAccounting.snapshot();\n        logToFile(\n          `[pi] wizard_ask capped: reason=${cap.reason} count=${callCount} subject=${cap.subject} run=${cap.subjectRunLength}`,\n        );\n        analytics.wizardCapture('wizard_ask capped', {\n          reason: cap.reason,\n          call_count: callCount,\n          max_questions: askMaxQuestions,\n          subject: cap.subject,\n          subject_run_length: cap.subjectRunLength,\n        });\n        return text(cap.message);\n      }\n\n      // The schema can't enforce per-kind requirements or unique ids.\n      const ids = new Set<string>();\n      for (const q of args.questions) {\n        if ((q.kind === 'single' || q.kind === 'multi') && !q.options?.length) {\n          return text(\n            `Error: question \"${q.id}\" has kind=\"${q.kind}\" but no options. Provide at least one { label, value }, or use kind=\"text\".`,\n          );\n        }\n        if (q.sensitive && q.kind !== 'text') {\n          return text(\n            `Error: question \"${q.id}\" sets sensitive=true but kind=\"${q.kind}\". Only kind=\"text\" answers can be sensitive.`,\n          );\n        }\n        if (ids.has(q.id)) {\n          return text(\n            `Error: duplicate question id \"${q.id}\". Each question needs a unique id.`,\n          );\n        }\n        ids.add(q.id);\n      }\n\n      // Optimistically take the slot; refund it on a cancellation or a bridge\n      // error so a declined/failed ask doesn't burn the budget for later ones.\n      askAccounting.record(args.subject);\n      // Block Write/Edit for as long as the overlay is open, so the agent can't\n      // mutate files while it's waiting on the user's answer.\n      onAskPendingChange?.(true);\n      try {\n        const answers = await askBridge.request({\n          questions: args.questions,\n          subject: normaliseAskSubject(args.subject),\n        });\n        if (isFullyCancelled(answers)) askAccounting.refund(args.subject);\n        // Sensitive answers go to the vault; the agent sees an opaque ref\n        // (same contract as the MCP wizard_ask).\n        const sanitised = vaultSensitiveAnswers(\n          args.questions,\n          answers,\n          secretVault,\n        );\n        logToFile(\n          `[pi] wizard_ask: resolved ${\n            Object.keys(answers).length\n          } answer(s) for ${args.questions.length} question(s)`,\n        );\n        return text(JSON.stringify({ answers: sanitised }, null, 2));\n      } catch (err) {\n        askAccounting.refund(args.subject);\n        const message = err instanceof Error ? err.message : String(err);\n        logToFile(`[pi] wizard_ask: error: ${message}`);\n        return text(`Error: wizard_ask failed: ${message}`);\n      } finally {\n        onAskPendingChange?.(false);\n      }\n    },\n  });\n\n  // Native mirror of the MCP `publish_handoff` tool (shared description, so no drift).\n  const publishHandoffTool = defineTool({\n    name: PUBLISH_HANDOFF_TOOL_NAME,\n    label: 'Publish handoff',\n    description: PUBLISH_HANDOFF_DESCRIPTION,\n    promptSnippet:\n      'publish_handoff(content) — publish the full report markdown to the wizard session',\n    parameters: Type.Object({\n      content: Type.String({\n        description: PUBLISH_HANDOFF_CONTENT_DESCRIPTION,\n      }),\n    }),\n    execute(_id, args) {\n      const result = publishHandoff(args.content);\n      logToFile(`[pi] publish_handoff: ${result.message}`);\n      return Promise.resolve(text(result.message));\n    },\n  });\n\n  const tools = [\n    loadSkillMenu,\n    installSkill,\n    checkEnvKeys,\n    setEnvValues,\n    detectPm,\n    // Sequential: it mutates the store's handoff state.\n    withMode(publishHandoffTool, 'sequential'),\n  ];\n  // Register wizard_ask only when the program allows it. posthog-integration\n  // disallows it (runs without structured user input); self-driving keeps it.\n  // Sequential: the ask bridge holds a single in-flight question slot, so a\n  // batched turn must never dispatch two asks (or an ask + a write) at once.\n  const askDisallowed =\n    ctx.disallowedTools?.includes(WIZARD_TOOL_NAMES.wizardAsk) ?? false;\n  if (!askDisallowed) tools.push(withMode(wizardAsk, 'sequential'));\n  return tools;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAuDA,SAAS,KAAK,GAGZ;AACA,QAAO;EAAE,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM;GAAG,CAAC;EAAE,SAAS,EAAE;EAAE;;AAoB9D,SAAgB,oBAAoB,KAAuC;CACzE,MAAM,EACJ,kBACA,eACA,WACA,oBACA,mBACE;CACJ,MAAM,uBACJ,IAAI,wBAAwB;CAC9B,MAAM,kBAAkB,IAAI,gBAAA;CAI5B,MAAM,gBAAgB,oBAAoB,gBAAgB;CAG1D,MAAM,cAAc,mBAAmB;CAIvC,IAAI;CACJ,MAAM,qBAAsB,gBAAgB,eAAe,cAAc;CAEzE,MAAM,gBAAgB,WAAW;EAC/B,MAAM;EACN,OAAO;EACP,aACE;EACF,eACE;EACF,YAAY,KAAK,OAAO,EACtB,UAAU,KAAK,OAAO,EACpB,aAAa,wCACd,CAAC,EACH,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;GACvB,MAAM,OAAO,MAAM,cAAc;AACjC,OAAI,CAAC,KAAM,QAAO,KAAK,wCAAwC;GAC/D,MAAM,SAAS,KAAK,WAAW,KAAK,aAAa,EAAE;AACnD,OAAI,OAAO,WAAW,EACpB,QAAO,KAAK,iCAAiC,KAAK,SAAS,IAAI;AAEjE,aAAU,yBAAyB,OAAO,OAAO,SAAS;AAC1D,UAAO,KAAK,OAAO,KAAK,MAAM,KAAK,EAAE,GAAG,IAAI,EAAE,OAAO,CAAC,KAAK,KAAK,CAAC;;EAEpE,CAAC;CAEF,MAAM,eAAe,WAAW;EAC9B,MAAM;EACN,OAAO;EACP,aACE;EACF,eACE;EACF,YAAY,KAAK,OAAO,EACtB,SAAS,KAAK,OAAO,EAAE,aAAa,iCAAiC,CAAC,EACvE,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;GACvB,MAAM,SAAS,MAAM,iBACnB,KAAK,SACL,kBACA,eACA,EAAE,QAAQ,gBAAgB,CAC3B;AACD,OAAI,OAAO,SAAS,MAAM;AACxB,cAAU,sBAAsB,KAAK,QAAQ,IAAI,OAAO,OAAO;AAC/D,WAAO,KACL,2BAA2B,KAAK,QAAQ,KAAK,OAAO,KAAK,yCAC1D;;AAEH,aAAU,sBAAsB,KAAK,QAAQ,MAAM,OAAO,OAAO;AACjE,UAAO,KACL,cAAc,KAAK,QAAQ,OAAO,OAAO,KAAK,SAAS,OAAO,KAAK,0BACpE;;EAEJ,CAAC;CAEF,MAAMA,iBAAe,WAAW;EAC9B,MAAM;EACN,OAAO;EACP,aAAa;EACb,eACE;EACF,YAAY,KAAK,OAAO;GACtB,UAAU,KAAK,SACb,KAAK,OAAO,EACV,aAAa,sCACd,CAAC,CACH;GACD,MAAM,KAAK,MAAM,KAAK,QAAQ,EAAE,EAC9B,aAAa,2CACd,CAAC;GACH,CAAC;EAQF,MAAM,QAAQ,KAAK,MAAM;GACvB,MAAM,UAAUC,aACd,kBACA,KAAK,MACL,KAAK,SACN;AACD,UAAO,KAAK,KAAK,UAAU,SAAS,MAAM,EAAE,CAAC;;EAEhD,CAAC;CAEF,MAAM,eAAe,WAAW;EAC9B,MAAM;EACN,OAAO;EACP,aACE;EACF,eACE;EACF,YAAY,KAAK,OAAO;GACtB,UAAU,KAAK,OAAO,EACpB,aAAa,2BACd,CAAC;GACF,QAAQ,KAAK,OACX,KAAK,QAAQ,EACb,KAAK,MAAM,CAAC,KAAK,QAAQ,EAAE,KAAK,OAAO,EAAE,WAAW,KAAK,QAAQ,EAAE,CAAC,CAAC,CAAC,EACtE,EACE,aACE,wEACH,CACF;GACF,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;GACvB,MAAM,YAAY,OAAO,KAAK,KAAK,OAAO,CAAC,MACxC,MAAM,EAAE,aAAa,KAAK,cAC5B;AACD,OAAI,UACF,QAAO,KACL,WAAW,UAAU,iHACtB;GAGH,MAAM,aAAa,qBAAqB,KAAK,QAAQ,YAAY;AACjE,OAAI,CAAC,WAAW,GACd,QAAO,KACL,4BAA4B,WAAW,UAAU,aAAa,WAAW,IAAI,0GAC9E;GAEH,MAAM,WAAW,eAAe,kBAAkB,KAAK,SAAS;GAChE,MAAM,kBAAkB,wBAAwB,SAAS;AACzD,OAAI,iBAAiB;AACnB,cAAU,gDAAgD,WAAW;AACrE,cAAU,cAAc,0CAA0C,EAChE,WAAW,KAAK,SAAS,SAAS,EACnC,CAAC;AACF,WAAO,KAAK,gBAAgB;;GAK9B,MAAM,SAAS,eAHE,GAAG,WAAW,SAAS,GACpC,MAAM,GAAG,SAAS,SAAS,UAAU,OAAO,GAC5C,IACoC,WAAW,OAAO;GAC1D,MAAM,MAAM,KAAK,QAAQ,SAAS;AAClC,OAAI,CAAC,GAAG,WAAW,IAAI,CACrB,OAAM,GAAG,SAAS,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC;AACnD,SAAM,GAAG,SAAS,UAAU,UAAU,QAAQ,OAAO;AACrD,aACE,wBAAwB,SAAS,QAAQ,OAAO,KAAK,KAAK,OAAO,CAAC,KAChE,IACD,GACF;AACD,UAAO,KACL,SAAS,OAAO,KAAK,KAAK,OAAO,CAAC,OAAO,aAAa,KAAK,SAAS,GACrE;;EAEJ,CAAC;CAEF,MAAM,WAAW,WAAW;EAC1B,MAAM;EACN,OAAO;EACP,aACE;EACF,eACE;EACF,YAAY,KAAK,OAAO,EAAE,CAAC;EAC3B,MAAM,UAAU;GACd,MAAM,SAAS,MAAM,qBAAqB,iBAAiB;AAC3D,aACE,gCAAgC,OAAO,SAAS,OAAO,WACxD;AACD,UAAO,KAAK,KAAK,UAAU,QAAQ,MAAM,EAAE,CAAC;;EAE/C,CAAC;CAIF,MAAM,YAAY,WAAW;EAC3B,MAAM;EACN,OAAO;EACP,aAAa;EACb,eACE;EACF,YAAY,KAAK,OAAO;GACtB,WAAW,KAAK,MACd,KAAK,OAAO;IACV,IAAI,KAAK,OAAO,EACd,aAAa,iDACd,CAAC;IACF,QAAQ,KAAK,OAAO,EAClB,aAAa,mCACd,CAAC;IACF,MAAM,KAAK,MACT;KACE,KAAK,QAAQ,SAAS;KACtB,KAAK,QAAQ,QAAQ;KACrB,KAAK,QAAQ,OAAO;KACrB,EACD,EACE,aACE,yFACH,CACF;IACD,SAAS,KAAK,SACZ,KAAK,MACH,KAAK,OAAO;KACV,OAAO,KAAK,QAAQ;KACpB,OAAO,KAAK,QAAQ;KACpB,aAAa,KAAK,SAAS,KAAK,QAAQ,CAAC;KAC1C,CAAC,EACF,EACE,aACE,yDACH,CACF,CACF;IACD,UAAU,KAAK,SACb,KAAK,QAAQ,EAAE,aAAa,oBAAoB,CAAC,CAClD;IACD,WAAW,KAAK,SACd,KAAK,QAAQ,EACX,aAAa,kCACd,CAAC,CACH;IACF,CAAC,EACF;IAAE,UAAU;IAAG,UAAU;IAAG,CAC7B;GACD,SAAS,KAAK,SACZ,KAAK,OAAO,EAAE,aAAa,gCAAgC,CAAC,CAC7D;GACF,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;AACvB,OAAI,CAAC,UACH,QAAO,KACL,yJACD;GAGH,MAAM,MAAM,cAAc,SAAS,KAAK,QAAQ;AAChD,OAAI,IAAI,SAAS,UAAU;IACzB,MAAM,EAAE,cAAc,cAAc,UAAU;AAC9C,cACE,kCAAkC,IAAI,OAAO,SAAS,UAAU,WAAW,IAAI,QAAQ,OAAO,IAAI,mBACnG;AACD,cAAU,cAAc,qBAAqB;KAC3C,QAAQ,IAAI;KACZ,YAAY;KACZ,eAAe;KACf,SAAS,IAAI;KACb,oBAAoB,IAAI;KACzB,CAAC;AACF,WAAO,KAAK,IAAI,QAAQ;;GAI1B,MAAM,sBAAM,IAAI,KAAa;AAC7B,QAAK,MAAM,KAAK,KAAK,WAAW;AAC9B,SAAK,EAAE,SAAS,YAAY,EAAE,SAAS,YAAY,CAAC,EAAE,SAAS,OAC7D,QAAO,KACL,oBAAoB,EAAE,GAAG,cAAc,EAAE,KAAK,8EAC/C;AAEH,QAAI,EAAE,aAAa,EAAE,SAAS,OAC5B,QAAO,KACL,oBAAoB,EAAE,GAAG,kCAAkC,EAAE,KAAK,+CACnE;AAEH,QAAI,IAAI,IAAI,EAAE,GAAG,CACf,QAAO,KACL,iCAAiC,EAAE,GAAG,qCACvC;AAEH,QAAI,IAAI,EAAE,GAAG;;AAKf,iBAAc,OAAO,KAAK,QAAQ;AAGlC,wBAAqB,KAAK;AAC1B,OAAI;IACF,MAAM,UAAU,MAAM,UAAU,QAAQ;KACtC,WAAW,KAAK;KAChB,SAAS,oBAAoB,KAAK,QAAQ;KAC3C,CAAC;AACF,QAAI,iBAAiB,QAAQ,CAAE,eAAc,OAAO,KAAK,QAAQ;IAGjE,MAAM,YAAY,sBAChB,KAAK,WACL,SACA,YACD;AACD,cACE,6BACE,OAAO,KAAK,QAAQ,CAAC,OACtB,iBAAiB,KAAK,UAAU,OAAO,cACzC;AACD,WAAO,KAAK,KAAK,UAAU,EAAE,SAAS,WAAW,EAAE,MAAM,EAAE,CAAC;YACrD,KAAK;AACZ,kBAAc,OAAO,KAAK,QAAQ;IAClC,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAChE,cAAU,2BAA2B,UAAU;AAC/C,WAAO,KAAK,6BAA6B,UAAU;aAC3C;AACR,yBAAqB,MAAM;;;EAGhC,CAAC;CAqBF,MAAM,QAAQ;EACZ;EACA;EACAD;EACA;EACA;EAEA,SAzByB,WAAW;GACpC,MAAM;GACN,OAAO;GACP,aAAa;GACb,eACE;GACF,YAAY,KAAK,OAAO,EACtB,SAAS,KAAK,OAAO,EACnB,aAAa,qCACd,CAAC,EACH,CAAC;GACF,QAAQ,KAAK,MAAM;IACjB,MAAM,SAAS,eAAe,KAAK,QAAQ;AAC3C,cAAU,yBAAyB,OAAO,UAAU;AACpD,WAAO,QAAQ,QAAQ,KAAK,OAAO,QAAQ,CAAC;;GAE/C,CAAC,EAS6B,aAAa;EAC3C;AAOD,KAAI,EADF,IAAI,iBAAiB,SAAS,kBAAkB,UAAU,IAAI,OAC5C,OAAM,KAAK,SAAS,WAAW,aAAa,CAAC;AACjE,QAAO"}

package/dist/{wizard-abort-D54j2gmb.js → wizard-abort-CUT8MXXt.js}

@@ -1,7 +1,7 @@
 import { c as emitWizardError, t as sanitizeErrorDetail } from "./errors-u8z27V-x.js";
-import { f as getUI, m as LoggingUI, s as logToFile } from "./debug-YQdeZulR.js";
-import "./wizard-session-CwQPZN4y.js";
-import { n as analytics } from "./analytics-D54mLptm.js";
+import { f as getUI, m as LoggingUI, s as logToFile } from "./debug-aXxgvtal.js";
+import "./wizard-session-GdDN_aMS.js";
+import { n as analytics } from "./analytics-DsMH06jo.js";
 //#region src/utils/wizard-abort.ts
 /**
 * Single exit point for the wizard. Use instead of process.exit() directly.
@@ -68,4 +68,4 @@ async function wizardAbort(options) {
 //#endregion
 export { wizardAbort as i, registerCleanup as n, runCleanups as r, WizardError as t };
 
-//# sourceMappingURL=wizard-abort-D54j2gmb.js.map
+//# sourceMappingURL=wizard-abort-CUT8MXXt.js.map

package/dist/{wizard-abort-D54j2gmb.js.map → wizard-abort-CUT8MXXt.js.map}

@@ -1 +1 @@
-{"version":3,"file":"wizard-abort-D54j2gmb.js","names":[],"sources":["../src/utils/wizard-abort.ts"],"sourcesContent":["/**\n * Single exit point for the wizard. Use instead of process.exit() directly.\n *\n * Sequence: cleanup -> error capture (optional) -> analytics shutdown -> outro -> process.exit\n *\n * WizardError is a data carrier passed to wizardAbort() for analytics context, never thrown.\n * The legacy abort() in setup-utils.ts delegates here.\n */\nimport { analytics } from './analytics';\nimport { logToFile } from './debug';\nimport { getUI } from '@ui';\nimport { LoggingUI } from '@ui/logging-ui';\nimport { OutroKind, type OutroData } from '@lib/wizard-session';\nimport type { ErrorCode } from '@lib/errors';\nimport { emitWizardError, sanitizeErrorDetail } from '@lib/errors';\n\nexport class WizardError extends Error {\n  readonly code?: ErrorCode;\n\n  constructor(\n    message: string,\n    public readonly context?: Record<string, unknown>,\n    code?: ErrorCode,\n  ) {\n    super(message);\n    this.name = 'WizardError';\n    this.code = code;\n  }\n}\n\ninterface WizardAbortOptions {\n  message?: string;\n  /** Structured error data. Renders via `outroError` instead of `outro`. */\n  outroData?: OutroData;\n  error?: Error | WizardError;\n  exitCode?: number;\n  code?: ErrorCode;\n  detail?: Record<string, unknown>;\n}\n\nconst cleanupFns: Array<() => void> = [];\n\nexport function registerCleanup(fn: () => void): void {\n  cleanupFns.push(fn);\n}\n\nexport function clearCleanup(): void {\n  cleanupFns.length = 0;\n}\n\n/** Runs all registered cleanup functions and drains the array. */\nexport function runCleanups(): void {\n  const fns = cleanupFns.splice(0);\n  for (const fn of fns) {\n    try {\n      fn();\n    } catch {\n      /* cleanup should not prevent exit */\n    }\n  }\n}\n\nfunction resolveErrorCode(\n  options: WizardAbortOptions,\n  error: Error | WizardError | undefined,\n): ErrorCode | undefined {\n  if (options.code) return options.code;\n  if (error instanceof WizardError) return error.code;\n  return undefined;\n}\n\nexport async function wizardAbort(\n  options?: WizardAbortOptions,\n): Promise<never> {\n  const {\n    message = 'Wizard setup cancelled.',\n    outroData,\n    error,\n    exitCode = 1,\n  } = options ?? {};\n\n  const code = resolveErrorCode(options ?? {}, error);\n  const detail = options?.detail;\n\n  logToFile(\n    `[wizard-abort] exitCode=${exitCode}, code=${\n      code ?? 'none'\n    }, message: ${message}`,\n  );\n  if (error) {\n    logToFile('[wizard-abort] error:', error);\n  }\n\n  // 1. Run registered cleanup functions\n  runCleanups();\n\n  // 2. Capture error in analytics (if provided)\n  if (error) {\n    analytics.captureException(error, {\n      ...((error instanceof WizardError && error.context) || {}),\n      ...(code ? { error_code: code } : {}),\n    });\n  }\n\n  // 3. Shutdown analytics\n  await analytics.shutdown(error ? 'error' : 'cancelled');\n\n  // 4. Render the error outro. Synthesize OutroData from `message`\n  //    when the caller didn't provide structured data.\n  const ui = getUI();\n  const resolvedOutroData: OutroData = outroData ?? {\n    kind: OutroKind.Error,\n    message,\n  };\n  if (code && resolvedOutroData.kind === OutroKind.Error) {\n    resolvedOutroData.errorCode ??= code;\n    if (detail) resolvedOutroData.errorDetail ??= detail;\n  }\n  ui.outroError(resolvedOutroData);\n\n  // 5. Wait for the user to dismiss the outro screen. In a TUI this gives\n  //    them time to read the error; in non-TUI environments it resolves\n  //    immediately.\n  await ui.waitForOutroDismissed();\n\n  // 6. Emit the machine-readable error line for non-interactive hosts\n  //    (LoggingUI and its HeadlessUI subclass); the TUI never sees it.\n  if (code && ui instanceof LoggingUI) {\n    emitWizardError({\n      code,\n      message: resolvedOutroData.message ?? message,\n      detail: sanitizeErrorDetail(resolvedOutroData.errorDetail ?? detail),\n    });\n  }\n\n  // 7. Exit (fires 'exit' event so TUI cleanup runs)\n  return process.exit(exitCode);\n}\n"],"mappings":";;;;;;;;;;;;;AAgBA,IAAa,cAAb,cAAiC,MAAM;CACrC;CAEA,YACE,SACA,SACA,MACA;AACA,QAAM,QAAQ;AAHE,OAAA,UAAA;AAIhB,OAAK,OAAO;AACZ,OAAK,OAAO;;;AAchB,MAAM,aAAgC,EAAE;AAExC,SAAgB,gBAAgB,IAAsB;AACpD,YAAW,KAAK,GAAG;;;AAQrB,SAAgB,cAAoB;CAClC,MAAM,MAAM,WAAW,OAAO,EAAE;AAChC,MAAK,MAAM,MAAM,IACf,KAAI;AACF,MAAI;SACE;;AAMZ,SAAS,iBACP,SACA,OACuB;AACvB,KAAI,QAAQ,KAAM,QAAO,QAAQ;AACjC,KAAI,iBAAiB,YAAa,QAAO,MAAM;;AAIjD,eAAsB,YACpB,SACgB;CAChB,MAAM,EACJ,UAAU,2BACV,WACA,OACA,WAAW,MACT,WAAW,EAAE;CAEjB,MAAM,OAAO,iBAAiB,WAAW,EAAE,EAAE,MAAM;CACnD,MAAM,SAAS,SAAS;AAExB,WACE,2BAA2B,SAAS,SAClC,QAAQ,OACT,aAAa,UACf;AACD,KAAI,MACF,WAAU,yBAAyB,MAAM;AAI3C,cAAa;AAGb,KAAI,MACF,WAAU,iBAAiB,OAAO;EAChC,GAAK,iBAAiB,eAAe,MAAM,WAAY,EAAE;EACzD,GAAI,OAAO,EAAE,YAAY,MAAM,GAAG,EAAE;EACrC,CAAC;AAIJ,OAAM,UAAU,SAAS,QAAQ,UAAU,YAAY;CAIvD,MAAM,KAAK,OAAO;CAClB,MAAM,oBAA+B,aAAa;EAChD,MAAA;EACA;EACD;AACD,KAAI,QAAQ,kBAAkB,SAAA,SAA0B;AACtD,oBAAkB,cAAc;AAChC,MAAI,OAAQ,mBAAkB,gBAAgB;;AAEhD,IAAG,WAAW,kBAAkB;AAKhC,OAAM,GAAG,uBAAuB;AAIhC,KAAI,QAAQ,cAAc,UACxB,iBAAgB;EACd;EACA,SAAS,kBAAkB,WAAW;EACtC,QAAQ,oBAAoB,kBAAkB,eAAe,OAAO;EACrE,CAAC;AAIJ,QAAO,QAAQ,KAAK,SAAS"}
+{"version":3,"file":"wizard-abort-CUT8MXXt.js","names":[],"sources":["../src/utils/wizard-abort.ts"],"sourcesContent":["/**\n * Single exit point for the wizard. Use instead of process.exit() directly.\n *\n * Sequence: cleanup -> error capture (optional) -> analytics shutdown -> outro -> process.exit\n *\n * WizardError is a data carrier passed to wizardAbort() for analytics context, never thrown.\n * The legacy abort() in setup-utils.ts delegates here.\n */\nimport { analytics } from './analytics';\nimport { logToFile } from './debug';\nimport { getUI } from '@ui';\nimport { LoggingUI } from '@ui/logging-ui';\nimport { OutroKind, type OutroData } from '@lib/wizard-session';\nimport type { ErrorCode } from '@lib/errors';\nimport { emitWizardError, sanitizeErrorDetail } from '@lib/errors';\n\nexport class WizardError extends Error {\n  readonly code?: ErrorCode;\n\n  constructor(\n    message: string,\n    public readonly context?: Record<string, unknown>,\n    code?: ErrorCode,\n  ) {\n    super(message);\n    this.name = 'WizardError';\n    this.code = code;\n  }\n}\n\ninterface WizardAbortOptions {\n  message?: string;\n  /** Structured error data. Renders via `outroError` instead of `outro`. */\n  outroData?: OutroData;\n  error?: Error | WizardError;\n  exitCode?: number;\n  code?: ErrorCode;\n  detail?: Record<string, unknown>;\n}\n\nconst cleanupFns: Array<() => void> = [];\n\nexport function registerCleanup(fn: () => void): void {\n  cleanupFns.push(fn);\n}\n\nexport function clearCleanup(): void {\n  cleanupFns.length = 0;\n}\n\n/** Runs all registered cleanup functions and drains the array. */\nexport function runCleanups(): void {\n  const fns = cleanupFns.splice(0);\n  for (const fn of fns) {\n    try {\n      fn();\n    } catch {\n      /* cleanup should not prevent exit */\n    }\n  }\n}\n\nfunction resolveErrorCode(\n  options: WizardAbortOptions,\n  error: Error | WizardError | undefined,\n): ErrorCode | undefined {\n  if (options.code) return options.code;\n  if (error instanceof WizardError) return error.code;\n  return undefined;\n}\n\nexport async function wizardAbort(\n  options?: WizardAbortOptions,\n): Promise<never> {\n  const {\n    message = 'Wizard setup cancelled.',\n    outroData,\n    error,\n    exitCode = 1,\n  } = options ?? {};\n\n  const code = resolveErrorCode(options ?? {}, error);\n  const detail = options?.detail;\n\n  logToFile(\n    `[wizard-abort] exitCode=${exitCode}, code=${\n      code ?? 'none'\n    }, message: ${message}`,\n  );\n  if (error) {\n    logToFile('[wizard-abort] error:', error);\n  }\n\n  // 1. Run registered cleanup functions\n  runCleanups();\n\n  // 2. Capture error in analytics (if provided)\n  if (error) {\n    analytics.captureException(error, {\n      ...((error instanceof WizardError && error.context) || {}),\n      ...(code ? { error_code: code } : {}),\n    });\n  }\n\n  // 3. Shutdown analytics\n  await analytics.shutdown(error ? 'error' : 'cancelled');\n\n  // 4. Render the error outro. Synthesize OutroData from `message`\n  //    when the caller didn't provide structured data.\n  const ui = getUI();\n  const resolvedOutroData: OutroData = outroData ?? {\n    kind: OutroKind.Error,\n    message,\n  };\n  if (code && resolvedOutroData.kind === OutroKind.Error) {\n    resolvedOutroData.errorCode ??= code;\n    if (detail) resolvedOutroData.errorDetail ??= detail;\n  }\n  ui.outroError(resolvedOutroData);\n\n  // 5. Wait for the user to dismiss the outro screen. In a TUI this gives\n  //    them time to read the error; in non-TUI environments it resolves\n  //    immediately.\n  await ui.waitForOutroDismissed();\n\n  // 6. Emit the machine-readable error line for non-interactive hosts\n  //    (LoggingUI and its HeadlessUI subclass); the TUI never sees it.\n  if (code && ui instanceof LoggingUI) {\n    emitWizardError({\n      code,\n      message: resolvedOutroData.message ?? message,\n      detail: sanitizeErrorDetail(resolvedOutroData.errorDetail ?? detail),\n    });\n  }\n\n  // 7. Exit (fires 'exit' event so TUI cleanup runs)\n  return process.exit(exitCode);\n}\n"],"mappings":";;;;;;;;;;;;;AAgBA,IAAa,cAAb,cAAiC,MAAM;CACrC;CAEA,YACE,SACA,SACA,MACA;AACA,QAAM,QAAQ;AAHE,OAAA,UAAA;AAIhB,OAAK,OAAO;AACZ,OAAK,OAAO;;;AAchB,MAAM,aAAgC,EAAE;AAExC,SAAgB,gBAAgB,IAAsB;AACpD,YAAW,KAAK,GAAG;;;AAQrB,SAAgB,cAAoB;CAClC,MAAM,MAAM,WAAW,OAAO,EAAE;AAChC,MAAK,MAAM,MAAM,IACf,KAAI;AACF,MAAI;SACE;;AAMZ,SAAS,iBACP,SACA,OACuB;AACvB,KAAI,QAAQ,KAAM,QAAO,QAAQ;AACjC,KAAI,iBAAiB,YAAa,QAAO,MAAM;;AAIjD,eAAsB,YACpB,SACgB;CAChB,MAAM,EACJ,UAAU,2BACV,WACA,OACA,WAAW,MACT,WAAW,EAAE;CAEjB,MAAM,OAAO,iBAAiB,WAAW,EAAE,EAAE,MAAM;CACnD,MAAM,SAAS,SAAS;AAExB,WACE,2BAA2B,SAAS,SAClC,QAAQ,OACT,aAAa,UACf;AACD,KAAI,MACF,WAAU,yBAAyB,MAAM;AAI3C,cAAa;AAGb,KAAI,MACF,WAAU,iBAAiB,OAAO;EAChC,GAAK,iBAAiB,eAAe,MAAM,WAAY,EAAE;EACzD,GAAI,OAAO,EAAE,YAAY,MAAM,GAAG,EAAE;EACrC,CAAC;AAIJ,OAAM,UAAU,SAAS,QAAQ,UAAU,YAAY;CAIvD,MAAM,KAAK,OAAO;CAClB,MAAM,oBAA+B,aAAa;EAChD,MAAA;EACA;EACD;AACD,KAAI,QAAQ,kBAAkB,SAAA,SAA0B;AACtD,oBAAkB,cAAc;AAChC,MAAI,OAAQ,mBAAkB,gBAAgB;;AAEhD,IAAG,WAAW,kBAAkB;AAKhC,OAAM,GAAG,uBAAuB;AAIhC,KAAI,QAAQ,cAAc,UACxB,iBAAgB;EACd;EACA,SAAS,kBAAkB,WAAW;EACtC,QAAQ,oBAAoB,kBAAkB,eAAe,OAAO;EACrE,CAAC;AAIJ,QAAO,QAAQ,KAAK,SAAS"}

package/dist/{wizard-abort-Q1NiYELE.js → wizard-abort-CfKnrSlX.js}

@@ -1,2 +1,2 @@
-import { i as wizardAbort, t as WizardError } from "./wizard-abort-D54j2gmb.js";
+import { i as wizardAbort, t as WizardError } from "./wizard-abort-CUT8MXXt.js";
 export { WizardError, wizardAbort };

package/dist/{wizard-session-Dwc1Rh_7.js → wizard-session-BWAQoi9q.js}

@@ -1,2 +1,2 @@
-import { a as buildSession, i as RunPhase, r as OutroKind } from "./wizard-session-CwQPZN4y.js";
+import { a as buildSession, i as RunPhase, r as OutroKind } from "./wizard-session-GdDN_aMS.js";
 export { OutroKind, RunPhase, buildSession };

package/dist/{wizard-session-CwQPZN4y.js → wizard-session-GdDN_aMS.js}

@@ -67,6 +67,7 @@ function buildSession(args) {
 		setupConfirmed: false,
 		scanConsent: args.ci ? "granted" : "undecided",
 		warehouseSourcesReported: false,
+		aiSdkStampReported: false,
 		integration: args.integration ?? null,
 		frameworkContext: {},
 		typescript: false,
@@ -124,4 +125,4 @@ function reportableDiscoveredFeatures(session) {
 //#endregion
 export { buildSession as a, RunPhase as i, ADDITIONAL_FEATURE_PROMPTS as n, mayReportScanResults as o, OutroKind as r, reportableDiscoveredFeatures as s, ADDITIONAL_FEATURE_LABELS as t };
 
-//# sourceMappingURL=wizard-session-CwQPZN4y.js.map
+//# sourceMappingURL=wizard-session-GdDN_aMS.js.map

package/dist/wizard-session-GdDN_aMS.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wizard-session-GdDN_aMS.js","names":[],"sources":["../src/lib/wizard-session.ts"],"sourcesContent":["/**\n * WizardSession — single source of truth for every decision the wizard needs.\n *\n * Populated in layers:\n *   CLI args / env vars  →  populate fields directly\n *   Auto-detection       →  framework, typescript, package manager\n *   TUI screens          →  region, framework disambiguation, etc.\n *   OAuth                →  credentials\n *\n * Business logic reads from the session. Never calls a prompt.\n */\n\nimport { POSTHOG_LOCAL_URL, resolveLocalDev } from './local-dev';\nimport type { Harness, Integration, Sequence } from './constants';\nimport type { FrameworkConfig } from './framework-config';\nimport type { WizardReadinessResult } from './health-checks/readiness';\nimport type { SettingsConflict } from './agent/claude-settings';\nimport type { ApiUser, ApiProject } from './api';\nimport type { HostResolution } from './host-resolution';\n\nexport interface Credentials {\n  accessToken: string;\n  /** OAuth refresh token when the grant carried one; absent on CI api-key runs. */\n  refreshToken?: string;\n  /** Epoch ms when `accessToken` expires — drives the pre-run refresh. */\n  expiresAt?: number;\n  /** Minting OAuth client when it differs from the default login app (provisioning signups). */\n  oauthClientId?: string;\n  projectApiKey: string;\n  /** Resolved at auth time and immutable thereafter — see {@link HostResolution}. */\n  host: HostResolution;\n  projectId: number;\n  /**\n   * Requested OAuth scopes the grant came back without — deselected on the\n   * consent screen or clamped by the app's ceiling. Read when a run fails so\n   * the error can name the missing permission and the fix (re-run and grant\n   * it during the OAuth flow) instead of the generic report-a-bug line.\n   * Empty/absent on CI api-key runs, where there is no scope request to diff\n   * against.\n   */\n  missingScopes?: readonly string[];\n}\n\nfunction parseProjectIdArg(value: string | undefined): number | undefined {\n  if (value === undefined || value === '') return undefined;\n  const n = Number(value);\n  return Number.isInteger(n) && n > 0 ? n : undefined;\n}\n\nexport type CloudRegion = 'us' | 'eu';\n\n/** Lifecycle phase of the main work (agent run, MCP install, etc.) */\nexport enum RunPhase {\n  /** Still gathering input (intro, setup screens) */\n  Idle = 'idle',\n  /** Main work is in progress */\n  Running = 'running',\n  /** Main work finished successfully */\n  Completed = 'completed',\n  /** Main work finished with an error */\n  Error = 'error',\n}\n\n/** Features discovered by the feature-discovery subagent */\nexport enum DiscoveredFeature {\n  Stripe = 'stripe',\n  LLM = 'llm',\n}\n\n/** Consent to report what local detection found (see `scanConsent` below). */\nexport enum ScanConsent {\n  Undecided = 'undecided',\n  Granted = 'granted',\n  Declined = 'declined',\n}\n\n/** Additional features the agent can integrate after the main setup */\nexport enum AdditionalFeature {\n  LLM = 'llm',\n}\n\n/** Human-readable labels for additional features (used in TUI progress) */\nexport const ADDITIONAL_FEATURE_LABELS: Record<AdditionalFeature, string> = {\n  [AdditionalFeature.LLM]: 'AI observability',\n};\n\n/** Agent prompts for each additional feature, injected via the stop hook */\nexport const ADDITIONAL_FEATURE_PROMPTS: Record<AdditionalFeature, string> = {\n  [AdditionalFeature.LLM]: `Now integrate AI observability with PostHog. Use the PostHog MCP server to find the appropriate AI observability skill, install it, and follow its workflow. PostHog basics are already installed. Update the setup report markdown file when complete with additions from this task. `,\n};\n\n/** Outcome of the MCP server installation step */\nexport enum McpOutcome {\n  NoClients = 'no_clients',\n  Skipped = 'skipped',\n  Installed = 'installed',\n  Failed = 'failed',\n}\n\n/** Outcome kind for the outro screen */\nexport enum OutroKind {\n  Success = 'success',\n  Error = 'error',\n  Cancel = 'cancel',\n}\n\nexport interface OutroData {\n  kind: OutroKind;\n  /** Main headline (green check for Success, red X for Error, etc.) */\n  message?: string;\n  /** Free-form body text shown under the headline. Use \\n for paragraph breaks. */\n  body?: string;\n  /** Success-only: bulleted list of \"what the agent did\" */\n  changes?: string[];\n  /**\n   * Success-only: a prominent, labeled link to where the user should go\n   * next (e.g. an inbox the program just configured). Rendered right under\n   * the headline and shown verbatim — no UTM tagging — so the URL stays\n   * clean and copy-pasteable. Set per-program in buildOutroData.\n   */\n  primaryLink?: { label: string; url: string };\n  /**\n   * Success-only: a short \"what to do next\" checklist with its own heading,\n   * rendered as a bulleted list. Distinct from `changes`, which recaps what\n   * the agent already did.\n   */\n  nextSteps?: { heading: string; items: string[] };\n  docsUrl?: string;\n  continueUrl?: string;\n  /** Report file the agent wrote (e.g. \"posthog-setup-report.md\") */\n  reportFile?: string;\n  /** Stable machine-readable error code from the error catalog (@lib/errors). */\n  errorCode?: import('@lib/errors').ErrorCode;\n  /** Structured context for the error code; safe for telemetry payloads. */\n  errorDetail?: Record<string, unknown>;\n  /** PostHog dashboard URL the program created on the user's behalf. */\n  dashboardUrl?: string;\n  /** PostHog notebook URL the program uploaded the report to. */\n  notebookUrl?: string;\n  /**\n   * Copy-paste prompt the operator hands to their coding agent to finish the\n   * job (work the report's checklist). Printed to the terminal's main buffer on\n   * exit (see getExitLine in start-tui.ts) — the TUI's alternate screen is wiped\n   * on exit, so the scrollback line is where it survives and can be\n   * triple-click-selected. Set per-program in buildOutroData.\n   */\n  handoffPrompt?: string;\n}\n\n/** A single question rendered by the WizardAsk overlay. */\nexport interface AskQuestion {\n  /** Key for the response map */\n  id: string;\n  prompt: string;\n  /** text = single-line free input; single/multi = picker */\n  kind: 'single' | 'multi' | 'text';\n  /** Required for `single` and `multi`. Ignored for `text`. */\n  options?: { label: string; value: string; description?: string }[];\n  /** Defaults to true */\n  required?: boolean;\n  /**\n   * Only meaningful for kind='text'. When true, the wizard-tools `wizard_ask`\n   * tool stores the user's answer in the session secret vault and returns\n   * `{ secretRef }` to the agent instead of the plain string — so the value\n   * never enters the LLM conversation. The TUI may also mask input\n   * accordingly. See `secret-vault.ts`.\n   */\n  sensitive?: boolean;\n}\n\n/**\n * Copy for a modal shown before an optional step runs, so the user can decline\n * it. The program that owns the step supplies the words; the runner and the\n * screen only carry them.\n */\nexport interface TaskNotice {\n  title: string;\n  /** Paragraphs, in order. */\n  body: string[];\n  /** Optional highlighted list, e.g. what was detected. */\n  items?: string[];\n  docsLabel?: string;\n  docsUrl?: string;\n  confirmLabel: string;\n  cancelLabel: string;\n  prompt: string;\n}\n\n/** Map of question id → answer (string for single/text, string[] for multi). */\nexport type AskAnswers = Record<string, string | string[]>;\n\n/** A pending wizard_ask request held by the store. */\nexport interface PendingQuestion {\n  id: string;\n  questions: AskQuestion[];\n  /**\n   * UTC ISO 8601 timestamp of when the ask was created. Published on the\n   * task stream as `pending_input.asked_at` so the web app can age the\n   * prompt; stable across pushes for the lifetime of one ask.\n   */\n  askedAt?: string;\n  /** Skill id of the caller. Set by the wizard from session.skillId. */\n  source: string;\n  /**\n   * When true, the ask overlay renders standalone URLs in prompt text as\n   * OSC 8 hyperlinks and copies a lone URL to the clipboard. Opt-in per\n   * program (set from `ProgramRun.richLinks` via the ask bridge); defaults\n   * to false so existing flows render prompts exactly as before. See\n   * `LinkText` / `link-helpers`.\n   */\n  richLinks?: boolean;\n}\n\n/**\n * PostHog dashboard URL emitted by the agent during a program run.\n * Populated via the `[DASHBOARD_URL]` text marker in agent assistant messages\n * — see `handleSDKMessage` in `agent/agent-interface.ts`. Read by programs\n * (e.g. events-audit) inside `buildOutroData` to surface a dashboard link\n * the agent actually created.\n */\n\nexport interface WizardSession {\n  // From CLI args\n  debug: boolean;\n  installDir: string;\n  ci: boolean;\n  signup: boolean;\n  /**\n   * Harness-only escape hatch: keep the `wizard_ask` bridge wired in a `ci`\n   * session so an e2e run can answer the agent's questions.\n   *\n   * Only the e2e TUI host sets it, from the `E2E_ASK` env var. There is no CLI\n   * flag, `bin.ts` never populates it, and nothing in a published build reads\n   * the env var — so a normal `--ci` run is unchanged. See `shouldDisableAsk`.\n   *\n   * Guarding `E2E_ASK` is not enough on its own: the CI runner spreads the\n   * whole `POSTHOG_WIZARD_*` bag into `buildSession`, which would let\n   * `POSTHOG_WIZARD_e2e_ask=true` set this field. `readEnvironment` drops it —\n   * see `NEVER_FROM_ENV`, and keep that list in step with this comment.\n   */\n  e2eAsk: boolean;\n  /**\n   * `--local-posthog` folds into `baseUrl`, and `--local-context-mill` is read\n   * from `getLocalDev()` — neither belongs here. This one stays because\n   * `mcp add|remove|tutorial --local` populate it from their own flag.\n   */\n  localMcp: boolean;\n  mcpFeatures?: string[];\n  apiKey?: string;\n  email?: string;\n  region?: CloudRegion;\n  /**\n   * Explicit PostHog base URL (`--base-url`). When set, it pins every PostHog\n   * origin — API host, cloud/app URL, OAuth server — and `region` is ignored.\n   * The runtime equivalent of the dev-build localhost routing; lets the shipped\n   * wizard target a local/self-hosted stack. Threaded into the URL helpers in\n   * `@utils/urls`. Empty/unset → region-based resolution.\n   */\n  baseUrl?: string;\n  benchmark: boolean;\n  yaraReport: boolean;\n  projectId?: number;\n  noTelemetry: boolean;\n\n  /**\n   * `--capture-aio`: mirror every wizard LLM call as an `$ai_generation` event\n   * into the authenticated project's AI Observability tab. Dev/test builds\n   * only — the flag is undeclared in published builds so this stays `false`\n   * there. See `src/lib/agent/aio-capture.ts`.\n   */\n  captureAio: boolean;\n\n  /** `--harness` override, read by `resolveHarness`. Wins over the runner flag. */\n  harness?: Harness;\n  /** `--sequence` override, read in `runProgram`. Wins over the orchestrator flag. */\n  sequence?: Sequence;\n  /** `--model` override (gateway id), read by `resolveHarness`. Wins over the binding's model. */\n  model?: string;\n\n  // From detection + screens\n  setupConfirmed: boolean;\n  /**\n   * Gates reporting only; local detection runs either way. Reporting treats\n   * 'undecided' as 'declined', so a path that reports before the user was\n   * asked sends nothing rather than everything.\n   */\n  scanConsent: ScanConsent;\n  /** Guards against reporting twice; consent resolves from two paths. */\n  warehouseSourcesReported: boolean;\n  /**\n   * Guards `maybeStampAiSdkDetected` against running twice: it is called from\n   * both run-wizard.ts's auth step and bootstrap.ts, since either can be the\n   * first real `authenticate()` to complete depending on the program.\n   */\n  aiSdkStampReported: boolean;\n  integration: Integration | null;\n  frameworkContext: Record<string, unknown>;\n  typescript: boolean;\n\n  /** Human-readable label for the detected framework variant (e.g., \"Django with Wagtail CMS\") */\n  detectedFrameworkLabel: string | null;\n\n  /** True once framework detection has run (whether it found something or not) */\n  detectionComplete: boolean;\n\n  /** Set when the detected framework version is too old for the wizard */\n  unsupportedVersion: {\n    current: string;\n    minimum: string;\n    docsUrl: string;\n  } | null;\n\n  // From OAuth\n  credentials: Credentials | null;\n\n  /**\n   * `role_at_organization` from `/api/users/@me/`. Null when the upstream\n   * value is missing (older accounts, fresh signups before onboarding).\n   * Drives role-tailored MCP prompt suggestions on the McpSuggestedPromptsScreen.\n   *\n   * Mirrors `apiUser?.role_at_organization` — kept as a top-level convenience\n   * because it has dedicated UI semantics (role-tailored kits) and pre-dates\n   * the broader `apiUser` plumbing.\n   */\n  roleAtOrganization: string | null;\n\n  /**\n   * Full user payload from `/api/users/@me/` — identifiers, profile,\n   * current team + organization, preferences, etc. Null until OAuth /\n   * CI-key auth populates it. Schema lives in `src/lib/api.ts` and\n   * passes through unknown upstream fields so downstream features can\n   * read account context (plan, org name, email, etc.) without\n   * re-fetching.\n   */\n  apiUser: ApiUser | null;\n\n  /**\n   * Project payload resolved at authentication, kept so a second agent run in\n   * the same invocation (e.g. self-driving's integration phase) reuses the\n   * first login wholesale instead of re-authenticating. The resolved region\n   * lives on `credentials.host.region`.\n   */\n  apiProject: ApiProject | null;\n\n  // Lifecycle\n  runPhase: RunPhase;\n  loginUrl: string | null;\n  // Direct PostHog authorize URL, shown in the manual-paste modal for\n  // headless/remote shells (the localhost loginUrl is unreachable there).\n  authorizeUrl: string | null;\n\n  // Feature discovery\n  discoveredFeatures: DiscoveredFeature[];\n  llmOptIn: boolean;\n\n  // ScreenId completion\n  mcpComplete: boolean;\n  mcpOutcome: McpOutcome | null;\n  mcpInstalledClients: string[];\n  /** Editor-owned login commands still to run (e.g. `claude mcp login posthog`), echoed at exit. */\n  mcpLoginCommands: string[];\n  mcpSuggestedPromptsDismissed: boolean;\n  /** True once the user has acted on (opened or skipped) the Connect-Slack step. */\n  slackStepDismissed: boolean;\n  /**\n   * Whether the project already has a Slack integration connected.\n   * `null` until detected. Prefetched by the tutorial screen as soon as\n   * credentials exist so the Connect-Slack step renders the right\n   * variant immediately instead of flashing the nudge first.\n   */\n  slackConnected: boolean | null;\n  skillsComplete: boolean;\n  outroDismissed: boolean;\n\n  /**\n   * Self-driving only: whether to integrate PostHog as part of this run.\n   * `null` until decided. When detection finds no PostHog SDK, the\n   * integration-check screen sets this to `true` (Self-driving needs an SDK,\n   * so we always integrate in that case) — and, on the same screen, asks\n   * whether the user already has a PostHog account: \"yes\" leaves `signup`\n   * false (OAuth login); \"no\" flips `signup` and collects `email`/`region`\n   * so auth provisions a new account. The `--integrate` flag pre-sets this to\n   * `true`, skipping the screen entirely and defaulting to the OAuth login.\n   * When `true`, the self-driving prompt has the agent set up the SDK before\n   * the Self-driving steps. Unused by other programs.\n   */\n  integrate: boolean | null;\n\n  /**\n   * Ids of composed run steps that have completed — e.g. self-driving's\n   * `integrate-run`. Lets a run step's `isComplete` hold after it ran,\n   * independent of the shared `runPhase`.\n   */\n  completedRuns: string[];\n\n  /**\n   * Self-driving only: whether the user confirmed the handoff screen shown\n   * after the integration run (\"PostHog is installed — now set up Self-driving\").\n   * Gates the Self-driving run so it doesn't start until acknowledged. Only\n   * reached in the integrate path; the already-has-PostHog path skips it.\n   */\n  selfDrivingHandoffConfirmed: boolean;\n\n  /**\n   * Self-driving only: whether the project has the PostHog GitHub App\n   * connected. `null` until the GitHub gate's first check resolves. Self-driving\n   * cannot research issues or open fixes without it, so the gate holds the run\n   * until this is `true`.\n   */\n  githubConnected: boolean | null;\n\n  /**\n   * Self-driving only: the user answered \"I can't connect right now\" on the\n   * GitHub gate. Completes the gate step and hides the run step, so the flow\n   * lands on the outro without starting the agent.\n   */\n  githubDeclined: boolean;\n\n  // Runtime\n  readinessResult: WizardReadinessResult | null;\n  outageDismissed: boolean;\n  settingsOverrideKeys: string[] | null;\n  settingsConflicts: SettingsConflict[] | null;\n  /** Mirrors `AuthErrorDetail` in `@ui/wizard-ui` — keep the two in step. */\n  authErrorDetail: {\n    hasSettingsConflict: boolean;\n    conflicts?: SettingsConflict[];\n    usingManagedLogin?: boolean;\n    credentialPlaces?: string[];\n    sessionExpired?: boolean;\n    logFilePath: string;\n  } | null;\n  portConflictProcess: {\n    command: string;\n    pid: string;\n    port: number;\n    user: string;\n  } | null;\n  /** Copy for the task-notice modal, set while it is open. */\n  taskNotice: TaskNotice | null;\n  outroData: OutroData | null;\n  dashboardUrl: string | null;\n  notebookUrl: string | null;\n\n  // Additional features queue (drained via stop hook after main integration)\n  additionalFeatureQueue: AdditionalFeature[];\n\n  // Program metadata (set by runWizard in bin.ts)\n  programLabel: string | null;\n  skillId: string | null;\n\n  // Resolved framework config (set after integration is known)\n  frameworkConfig: FrameworkConfig | null;\n\n  /** Active wizard_ask request, set by the bridge when the agent calls the tool. */\n  pendingQuestion: PendingQuestion | null;\n}\n\n/**\n * Build a WizardSession from CLI args, pre-populating whatever is known.\n */\nexport function buildSession(args: {\n  debug?: boolean;\n  installDir?: string;\n  ci?: boolean;\n  signup?: boolean;\n  /** Harness-only. Set by the e2e TUI host from `E2E_ASK`, never by a flag. */\n  e2eAsk?: boolean;\n  localDev?: boolean;\n  localMcp?: boolean;\n  localPosthog?: boolean;\n  mcpFeatures?: string[];\n  apiKey?: string;\n  email?: string;\n  region?: CloudRegion;\n  baseUrl?: string;\n  integration?: Integration;\n  benchmark?: boolean;\n  yaraReport?: boolean;\n  projectId?: string;\n  noTelemetry?: boolean;\n  harness?: Harness;\n  sequence?: Sequence;\n  model?: string;\n  integrate?: boolean;\n  captureAio?: boolean;\n}): WizardSession {\n  const local = resolveLocalDev(args);\n  return {\n    debug: args.debug ?? false,\n    installDir: args.installDir ?? process.cwd(),\n    ci: args.ci ?? false,\n    signup: args.signup ?? false,\n    e2eAsk: args.e2eAsk ?? false,\n    localMcp: local.localMcp,\n    mcpFeatures: args.mcpFeatures,\n    apiKey: args.apiKey,\n    email: args.email,\n    region: args.region,\n    // `--local-posthog` is sugar over `--base-url`, which every downstream URL\n    // helper already honours. An explicit `--base-url` is more specific, so it wins.\n    baseUrl:\n      args.baseUrl ?? (local.localPosthog ? POSTHOG_LOCAL_URL : undefined),\n    benchmark: args.benchmark ?? false,\n    yaraReport: args.yaraReport ?? false,\n    projectId: parseProjectIdArg(args.projectId),\n    noTelemetry: args.noTelemetry ?? false,\n    captureAio: args.captureAio ?? false,\n    harness: args.harness,\n    sequence: args.sequence,\n    model: args.model,\n\n    setupConfirmed: false,\n    // No screen can ask in a scripted CI run, so granting keeps CI's\n    // telemetry as it was. --signup alone still provisions a brand-new\n    // account headlessly, and that user has never seen the disclosure — a\n    // headless `--ci --signup` run stays covered by the ci branch above.\n    scanConsent: args.ci ? ScanConsent.Granted : ScanConsent.Undecided,\n    warehouseSourcesReported: false,\n    aiSdkStampReported: false,\n    integration: args.integration ?? null,\n    frameworkContext: {},\n    typescript: false,\n    detectedFrameworkLabel: null,\n    detectionComplete: false,\n    unsupportedVersion: null,\n\n    runPhase: RunPhase.Idle,\n    discoveredFeatures: [],\n    llmOptIn: false,\n    mcpComplete: false,\n    mcpOutcome: null,\n    mcpInstalledClients: [],\n    mcpLoginCommands: [],\n    mcpSuggestedPromptsDismissed: false,\n    slackStepDismissed: false,\n    slackConnected: null,\n    skillsComplete: false,\n    outroDismissed: false,\n    // `--integrate` forces integration (skip the question); otherwise the\n    // integration-check screen resolves it from null.\n    integrate: args.integrate === true ? true : null,\n    completedRuns: [],\n    selfDrivingHandoffConfirmed: false,\n    githubConnected: null,\n    githubDeclined: false,\n    loginUrl: null,\n    authorizeUrl: null,\n    credentials: null,\n    roleAtOrganization: null,\n    apiUser: null,\n    apiProject: null,\n    readinessResult: null,\n    outageDismissed: false,\n    settingsOverrideKeys: null,\n    settingsConflicts: null,\n    authErrorDetail: null,\n    portConflictProcess: null,\n    taskNotice: null,\n    outroData: null,\n    dashboardUrl: null,\n    notebookUrl: null,\n    additionalFeatureQueue: [],\n    programLabel: null,\n    skillId: null,\n    frameworkConfig: null,\n    pendingQuestion: null,\n  };\n}\n\n/** One place to ask, so a new consent state does not need three edits. */\nexport function mayReportScanResults(session: WizardSession): boolean {\n  return session.scanConsent === ScanConsent.Granted;\n}\n\n/** Lives here so analytics infrastructure never learns what consent means. */\nexport function reportableDiscoveredFeatures(\n  session: WizardSession,\n): DiscoveredFeature[] | undefined {\n  return mayReportScanResults(session) ? session.discoveredFeatures : undefined;\n}\n"],"mappings":";;;;;;;;;;;;;AA2CA,SAAS,kBAAkB,OAA+C;AACxE,KAAI,UAAU,KAAA,KAAa,UAAU,GAAI,QAAO,KAAA;CAChD,MAAM,IAAI,OAAO,MAAM;AACvB,QAAO,OAAO,UAAU,EAAE,IAAI,IAAI,IAAI,IAAI,KAAA;;;AAM5C,IAAY,WAAL,yBAAA,UAAA;;AAEL,UAAA,UAAA;;AAEA,UAAA,aAAA;;AAEA,UAAA,eAAA;;AAEA,UAAA,WAAA;;KACD;;AAqBD,MAAa,4BAA+D,GAAA,QACjD,oBAC1B;;AAGD,MAAa,6BAAgE,GAAA,QAClD,0RAC1B;;AAWD,IAAY,YAAL,yBAAA,WAAA;AACL,WAAA,aAAA;AACA,WAAA,WAAA;AACA,WAAA,YAAA;;KACD;;;;AAqWD,SAAgB,aAAa,MAyBX;CAChB,MAAM,QAAQ,gBAAgB,KAAK;AACnC,QAAO;EACL,OAAO,KAAK,SAAS;EACrB,YAAY,KAAK,cAAc,QAAQ,KAAK;EAC5C,IAAI,KAAK,MAAM;EACf,QAAQ,KAAK,UAAU;EACvB,QAAQ,KAAK,UAAU;EACvB,UAAU,MAAM;EAChB,aAAa,KAAK;EAClB,QAAQ,KAAK;EACb,OAAO,KAAK;EACZ,QAAQ,KAAK;EAGb,SACE,KAAK,YAAY,MAAM,eAAA,0BAAmC,KAAA;EAC5D,WAAW,KAAK,aAAa;EAC7B,YAAY,KAAK,cAAc;EAC/B,WAAW,kBAAkB,KAAK,UAAU;EAC5C,aAAa,KAAK,eAAe;EACjC,YAAY,KAAK,cAAc;EAC/B,SAAS,KAAK;EACd,UAAU,KAAK;EACf,OAAO,KAAK;EAEZ,gBAAgB;EAKhB,aAAa,KAAK,KAAA,YAAA;EAClB,0BAA0B;EAC1B,oBAAoB;EACpB,aAAa,KAAK,eAAe;EACjC,kBAAkB,EAAE;EACpB,YAAY;EACZ,wBAAwB;EACxB,mBAAmB;EACnB,oBAAoB;EAEpB,UAAA;EACA,oBAAoB,EAAE;EACtB,UAAU;EACV,aAAa;EACb,YAAY;EACZ,qBAAqB,EAAE;EACvB,kBAAkB,EAAE;EACpB,8BAA8B;EAC9B,oBAAoB;EACpB,gBAAgB;EAChB,gBAAgB;EAChB,gBAAgB;EAGhB,WAAW,KAAK,cAAc,OAAO,OAAO;EAC5C,eAAe,EAAE;EACjB,6BAA6B;EAC7B,iBAAiB;EACjB,gBAAgB;EAChB,UAAU;EACV,cAAc;EACd,aAAa;EACb,oBAAoB;EACpB,SAAS;EACT,YAAY;EACZ,iBAAiB;EACjB,iBAAiB;EACjB,sBAAsB;EACtB,mBAAmB;EACnB,iBAAiB;EACjB,qBAAqB;EACrB,YAAY;EACZ,WAAW;EACX,cAAc;EACd,aAAa;EACb,wBAAwB,EAAE;EAC1B,cAAc;EACd,SAAS;EACT,iBAAiB;EACjB,iBAAiB;EAClB;;;AAIH,SAAgB,qBAAqB,SAAiC;AACpE,QAAO,QAAQ,gBAAA;;;AAIjB,SAAgB,6BACd,SACiC;AACjC,QAAO,qBAAqB,QAAQ,GAAG,QAAQ,qBAAqB,KAAA"}

package/dist/yara-hooks-CLeMu2EY.js

@@ -0,0 +1,2 @@
+import { l as prewarmYaraScanner } from "./yara-hooks-VvwkZn5s.js";
+export { prewarmYaraScanner };

package/dist/{yara-hooks-CL2LVEgO.js → yara-hooks-VvwkZn5s.js}

@@ -1,6 +1,6 @@
-import { f as getUI, s as logToFile, u as WIZARD_YARA_REPORT_FILE } from "./debug-YQdeZulR.js";
-import { n as analytics } from "./analytics-D54mLptm.js";
-import { r as readFileHead } from "./bounded-fs-DHIaH3Sc.js";
+import { f as getUI, s as logToFile, u as WIZARD_YARA_REPORT_FILE } from "./debug-aXxgvtal.js";
+import { n as analytics } from "./analytics-DsMH06jo.js";
+import { r as readFileHead } from "./bounded-fs-BV-KhOtU.js";
 import fs from "fs";
 import path from "path";
 import fg from "fast-glob";
@@ -10,7 +10,8 @@ import { createHash } from "crypto";
 * Check if command is a PostHog skill installation from MCP.
 * We control the MCP server, so we only need to verify:
 * 1. It installs to .claude/skills/
-* 2. It downloads from our GitHub releases or localhost (dev)
+* 2. It downloads from a context-mill release origin (GitHub Releases or the
+*    AWS mirror) or localhost (dev)
 *
 * Extracted to its own module to avoid a circular dependency
 * between agent-interface.ts and yara-hooks.ts.
@@ -20,7 +21,7 @@ function isSkillInstallCommand(command) {
 	const urlMatch = command.match(/curl -sL ['"]([^'"]+)['"]/);
 	if (!urlMatch) return false;
 	const url = urlMatch[1];
-	return url.startsWith("https://github.com/PostHog/context-mill/releases/") || /^http:\/\/localhost:\d+\//.test(url);
+	return url.startsWith("https://github.com/PostHog/context-mill/releases/") || url.startsWith("https://context-mill.posthog.com/") || /^http:\/\/localhost:\d+\//.test(url);
 }
 //#endregion
 //#region src/lib/yara-policy.ts
@@ -781,4 +782,4 @@ async function scanSkillFiles(cwd, skillDir, llmProvider) {
 //#endregion
 export { publishBlockingMatch as C, SETUP_REPORT_FILE as S, AUDIT_CHECKS_KEY as _, flushScanReport as a, coerceAuditChecks as b, isWizardDocumentationPath as c, repeatBlockReason as d, scanAndTriage as f, AUDIT_CHECKS_FILE as g, EVENT_PLAN_FILE as h, createRepeatBlockTracker as i, prewarmYaraScanner as l, writeScanReport as m, createPostToolUseYaraHooks as n, formatScanReport as o, scanInstalledSkill as p, createPreToolUseYaraHooks as r, formatYaraAbortMessage as s, captureScanReport as t, recordExternalScan as u, AUDIT_REPORT_FILE as v, scanVerdict as w, getAuditChecks as x, AUDIT_SEVERITY_STYLE as y };
 
-//# sourceMappingURL=yara-hooks-CL2LVEgO.js.map
+//# sourceMappingURL=yara-hooks-VvwkZn5s.js.map

package/dist/yara-hooks-VvwkZn5s.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"yara-hooks-VvwkZn5s.js","names":["EVENTS_AUDIT_REPORT_FILE"],"sources":["../src/lib/skill-install.ts","../src/lib/yara-policy.ts","../src/lib/programs/events-audit/constants.ts","../src/lib/programs/audit/types.ts","../src/lib/programs/posthog-integration/constants.ts","../src/lib/yara-hooks.ts"],"sourcesContent":["/**\n * Check if command is a PostHog skill installation from MCP.\n * We control the MCP server, so we only need to verify:\n * 1. It installs to .claude/skills/\n * 2. It downloads from a context-mill release origin (GitHub Releases or the\n *    AWS mirror) or localhost (dev)\n *\n * Extracted to its own module to avoid a circular dependency\n * between agent-interface.ts and yara-hooks.ts.\n */\nexport function isSkillInstallCommand(command: string): boolean {\n  if (!command.startsWith('mkdir -p .claude/skills/')) return false;\n\n  const urlMatch = command.match(/curl -sL ['\"]([^'\"]+)['\"]/);\n  if (!urlMatch) return false;\n\n  // Literal prefixes rather than the constants in `@lib/constants`: an\n  // allow-list is easier to audit when it reads as the URLs themselves.\n  const url = urlMatch[1];\n  return (\n    url.startsWith('https://github.com/PostHog/context-mill/releases/') ||\n    url.startsWith('https://context-mill.posthog.com/') ||\n    /^http:\\/\\/localhost:\\d+\\//.test(url)\n  );\n}\n","/**\n * Shared YARA scan policy: the vocabulary every scan surface speaks, and the\n * one decision they all make — does a set of matches terminate the session, or\n * only warn. Both fences (the anthropic PostToolUse hooks in `yara-hooks.ts`\n * and the pi tool_result extension in `harness/pi/security.ts`) resolve a\n * verdict here rather than each re-deriving it from severity and action.\n */\n\nimport type { ScanMatch } from '@posthog/warlock';\n\n/** Which content surface a warlock rule applies to (from rule `scan_context`). */\nexport type ScanContext = 'command' | 'input' | 'output';\n\n/** What a fence did about a match, as recorded in the scan report. */\nexport type ScanAction = 'blocked' | 'reverted' | 'warned' | 'aborted';\n\n/** Severity order, highest first, for picking the match worth reporting. */\nconst SEVERITY_RANK: Record<string, number> = {\n  critical: 4,\n  high: 3,\n  medium: 2,\n  low: 1,\n};\n\n/** Severities that end the session. Critical only — nothing below it is worth killing a run over. */\nconst TERMINAL_SEVERITIES = new Set(['critical']);\n\n/**\n * The match that ends the session rather than just warning. Severity alone\n * decides: a rule's `action: 'block'` is a recommendation about the *operation*\n * (PreToolUse still refuses the command), not a licence to end the run. Medium\n * and high `block` rules fire on first-party content often enough that\n * terminating on them costs more than it prevents.\n */\nexport function isTerminalMatch(match: ScanMatch): boolean {\n  return TERMINAL_SEVERITIES.has(match.metadata.severity ?? '');\n}\n\n/** Return the highest-severity match from a list of matches. */\nexport function highestSeverityMatch(matches: ScanMatch[]): ScanMatch {\n  return matches.reduce((worst, m) =>\n    (SEVERITY_RANK[m.metadata.severity ?? ''] ?? 0) >\n    (SEVERITY_RANK[worst.metadata.severity ?? ''] ?? 0)\n      ? m\n      : worst,\n  );\n}\n\n/**\n * The match that refuses a publish, or null to allow. Critical only — every\n * 'output' rule asks for `remediate`, and the handoff has no second channel.\n */\nexport function publishBlockingMatch(matches: ScanMatch[]): ScanMatch | null {\n  if (matches.length === 0) return null;\n  const match = highestSeverityMatch(matches);\n  return isTerminalMatch(match) ? match : null;\n}\n\nexport interface ScanVerdict {\n  /** The match worth reporting: the highest-severity one. */\n  match: ScanMatch;\n  /** Session ends now; anything else is advisory. */\n  terminal: boolean;\n  /** How the scan report records it. */\n  action: ScanAction;\n}\n\n/** Resolve what a fence should do about a set of matches. Null when clean. */\nexport function scanVerdict(matches: ScanMatch[]): ScanVerdict | null {\n  if (matches.length === 0) return null;\n  const match = highestSeverityMatch(matches);\n  const terminal = isTerminalMatch(match);\n  return { match, terminal, action: terminal ? 'aborted' : 'warned' };\n}\n","/**\n * Leaf-level constants for the events-audit program.\n *\n * Kept separate from `index.ts` so files like `yara-hooks.ts` can import\n * the filename constants without dragging in `index.ts`'s heavier imports\n * (agent-runner, audit/seed, etc.) — which can create import cycles.\n */\n\nexport const SETUP_REPORT_FILE = 'posthog-events-audit-report.md';\nexport const EVENT_INVENTORY_FILE = '.posthog-events-inventory.json';\n/** Per-part filename pattern emitted by events-audit subagents (e.g. `.posthog-events-inventory.part-3.json`). */\nexport const EVENT_INVENTORY_PART_PATTERN =\n  /^\\.posthog-events-inventory\\.part-\\d+\\.json$/;\n","import type { WizardSession } from '@lib/wizard-session';\n\nexport type AuditStatus =\n  | 'pending'\n  | 'pass'\n  | 'error'\n  | 'warning'\n  | 'suggestion';\n\nexport interface AuditCheck {\n  id: string;\n  area: string;\n  label: string;\n  status: AuditStatus;\n  file?: string;\n  details?: string;\n}\n\nexport interface AuditSeverityStyle {\n  glyph: string;\n  color: string;\n}\n\n/** Single source of truth for status glyph + color across audit views. */\nexport const AUDIT_SEVERITY_STYLE: Record<AuditStatus, AuditSeverityStyle> = {\n  pending: { glyph: '◌', color: 'gray' },\n  pass: { glyph: '✔', color: 'green' },\n  error: { glyph: '✘', color: 'red' },\n  warning: { glyph: '⚠', color: 'yellow' },\n  suggestion: { glyph: '•', color: 'cyan' },\n};\n\nexport const AUDIT_CHECKS_FILE = '.posthog-audit-checks.json';\nexport const AUDIT_REPORT_FILE = 'posthog-audit-report.md';\nexport const AUDIT_CHECKS_KEY = 'auditChecks';\n\nexport function getAuditChecks(session: WizardSession): AuditCheck[] {\n  const raw = session.frameworkContext[AUDIT_CHECKS_KEY];\n  return Array.isArray(raw) ? (raw as AuditCheck[]) : [];\n}\n\n/**\n * Read the audit checks ledger off disk. Validation lives at write time —\n * every writer (`audit_seed_checks` / `audit_add_checks` / `audit_resolve_checks`\n * MCP tools, `seedAuditLedger`) zod-parses entries before the atomic write,\n * so by the time the file watcher fires we trust the shape and only guard\n * against the file not being a JSON array (corrupted / hand-edited / not yet\n * seeded).\n */\nexport function coerceAuditChecks(parsed: unknown): AuditCheck[] {\n  return Array.isArray(parsed) ? (parsed as AuditCheck[]) : [];\n}\n","/**\n * Leaf-level constants for the posthog-integration program.\n *\n * Kept separate from `index.ts` so files like `yara-hooks.ts` can import\n * the filename constants without dragging in `index.ts`'s heavier imports\n * (agent-interface, framework-config, etc.) — which would create an import\n * cycle through agent-interface → yara-hooks.\n */\n\nexport const EVENT_PLAN_FILE = '.posthog-events.json';\n","/**\n * YARA hook wiring for the Claude Agent SDK.\n *\n * Creates PreToolUse and PostToolUse hook callback arrays that integrate the\n * real @posthog/warlock security scanner (YARA-X via WASM) into the wizard's\n * agent loop. These hooks are registered in the SDK's query() options alongside\n * the existing Stop hook.\n *\n * PreToolUse hooks block dangerous commands before execution. PostToolUse hooks\n * detect violations in written code and prompt injection in read content, and\n * scan context-mill skill downloads.\n *\n * Warlock owns the rules; this file owns the *policy* — how a match maps to a\n * block / revert / terminate response, plus the optional LLM triage pass that\n * filters false positives before we act.\n *\n * Naming: \"yara\" is the technique — scanning content against YARA rules — so the\n * wizard-side wiring keeps that name. \"warlock\" is the engine package that runs\n * the rules. Both names showing up here is intentional.\n *\n * This is Layer 2 (L2) in the wizard's defense-in-depth model, complementing the\n * prompt-based commandments (L0) and the canUseTool() allowlist (L1).\n */\n\nimport fs from 'fs';\nimport path from 'path';\nimport { createHash } from 'crypto';\nimport fg from 'fast-glob';\nimport type {\n  ScanMatch,\n  TriageMatch,\n  LLMProvider,\n  Category,\n} from '@posthog/warlock';\nimport { logToFile } from '@utils/debug';\nimport { readFileHead } from '@utils/bounded-fs';\nimport { analytics } from '@utils/analytics';\nimport { getUI } from '@ui';\nimport type { WizardSession } from '@lib/wizard-session';\nimport { isSkillInstallCommand } from './skill-install';\nimport {\n  highestSeverityMatch,\n  publishBlockingMatch,\n  scanVerdict,\n} from './yara-policy';\nimport type { ScanAction, ScanContext } from './yara-policy';\nimport { WIZARD_YARA_REPORT_FILE } from '@utils/paths';\n// TODO(wizard#594): invert this dependency.\n// L2 infra (yara-hooks) imports product-specific filename constants from\n// individual programs. The leaf `constants.ts` modules break the *import*\n// cycle but don't fix the *layering* concern: this file knowing about\n// `events-audit`, `posthog-integration`, and `audit` violates \"product\n// knowledge never enters infrastructure code.\" Proper fix is inverted —\n// programs declare their own doc paths, the hooks read from a generic\n// registry. For now: every new program emitting a PII-shaped report has\n// to be added here. Land that cleanup before adding a fourth entry.\nimport {\n  SETUP_REPORT_FILE as EVENTS_AUDIT_REPORT_FILE,\n  EVENT_INVENTORY_FILE,\n  EVENT_INVENTORY_PART_PATTERN,\n} from '@lib/programs/events-audit/constants';\nimport { AUDIT_REPORT_FILE } from '@lib/programs/audit/types';\nimport { EVENT_PLAN_FILE } from '@lib/programs/posthog-integration/constants';\n\n// ─── Warlock module accessor ─────────────────────────────────────\n// Warlock is ESM-only and lazily inits its WASM engine + compiles rules on the\n// first scan() call. We import it once and cache the module promise so the\n// warmed engine (a warlock-internal singleton) is shared across every hook.\n// Mirrors the lazy `await import(...)` pattern used for the agent SDK.\n\ntype WarlockModule = typeof import('@posthog/warlock');\n\nlet warlockModulePromise: Promise<WarlockModule> | null = null;\n\nfunction getWarlock(): Promise<WarlockModule> {\n  if (!warlockModulePromise) {\n    // Clear the cache on rejection so a transient failure (flaky disk, ESM\n    // resolver hiccup) doesn't poison the cache for the rest of the process\n    // lifetime. Without this, one rejected import permanently locks every\n    // hook into fail-closed-terminate until restart.\n    warlockModulePromise = import('@posthog/warlock').catch((err) => {\n      warlockModulePromise = null;\n      throw err;\n    });\n  }\n  return warlockModulePromise;\n}\n\n/**\n * Pay the WASM-init + rule-compile cost up front, off the hook path, so the\n * first real tool-call scan doesn't eat cold-start under a hook timeout.\n * Best-effort: a failure here is non-fatal — hooks still fail closed per scan.\n */\nexport async function prewarmYaraScanner(): Promise<void> {\n  try {\n    const warlock = await getWarlock();\n    await warlock.scan('');\n    logToFile('[YARA] warlock pre-warmed');\n  } catch (err) {\n    logToFile('[YARA] warlock pre-warm failed:', err);\n  }\n}\n\n// ─── Types ───────────────────────────────────────────────────────\n// Loose hook types to avoid tight coupling to the SDK version.\n// The SDK hook types are: HookCallbackMatcher[], where each matcher\n// has { matcher?: string, hooks: HookCallback[], timeout?: number }\n\ntype HookInput = Record<string, unknown>;\ntype HookOutput = Record<string, unknown>;\ntype HookCallback = (\n  input: HookInput,\n  toolUseID: string | undefined,\n  options: { signal: AbortSignal },\n) => Promise<HookOutput>;\n\nexport interface HookCallbackMatcher {\n  matcher?: string;\n  hooks: HookCallback[];\n  timeout?: number;\n}\n\nexport type { ScanAction, ScanContext } from './yara-policy';\n\n// ─── Scan Report Accumulator ─────────────────────────────────────\n\ninterface ScanReportEntry {\n  rule: string;\n  severity: string;\n  category: string;\n  action: ScanAction;\n  phase: string;\n  tool: string;\n  /** Rule description — the human-readable \"why\". Rule-static, safe to report. */\n  description: string;\n  /** Triage outcome, when triage ran. */\n  triageVerdict?: string;\n  /**\n   * Free-text triage rationale. May quote scanned content, so it is written to\n   * the local report file only — NEVER sent to PostHog (see captureScanReport).\n   */\n  triageReason?: string;\n}\n\nlet scanCount = 0;\nconst scanViolations: ScanReportEntry[] = [];\n\nfunction recordScan(): void {\n  scanCount++;\n}\n\n// recordMatch is the single entry point for a violation (log + telemetry +\n// report). scanViolations is appended only there.\n\n/**\n * Log a match to the run log + PostHog, and record it in the run's scan report.\n * Single entry point so every violation is reported consistently.\n */\nfunction recordMatch(\n  phase: string,\n  tool: string,\n  match: ScanMatch,\n  action: ScanAction,\n): void {\n  const triage = (match as TriageMatch).triage;\n  logYaraMatch(phase, tool, match, action);\n  scanViolations.push({\n    rule: match.rule,\n    severity: match.metadata.severity ?? 'unknown',\n    category: match.metadata.category ?? 'unknown',\n    action,\n    phase,\n    tool,\n    description: match.metadata.description ?? '',\n    triageVerdict: triage?.verdict,\n    triageReason: triage?.reason,\n  });\n}\n\n/** Reset counters (for testing) */\nexport function resetScanReport(): void {\n  scanCount = 0;\n  scanViolations.length = 0;\n}\n\n/**\n * Scan bookkeeping for harnesses that run a scanner outside these hooks (pi):\n * counts the scan and routes violations through `recordMatch`, so they reach\n * the run log, per-match telemetry, and the end-of-run scan report.\n */\nexport function recordExternalScan(\n  phase: string,\n  tool: string,\n  violations: Array<{\n    rule: string;\n    severity: string;\n    category: string;\n    description: string;\n  }>,\n  action: ScanAction,\n): void {\n  recordScan();\n  for (const v of violations) {\n    recordMatch(\n      phase,\n      tool,\n      {\n        rule: v.rule,\n        metadata: {\n          severity: v.severity as ScanMatch['metadata']['severity'],\n          category: v.category as ScanMatch['metadata']['category'],\n          description: v.description,\n        },\n        matchedStrings: [],\n      },\n      action,\n    );\n  }\n}\n\n/** Format the scan report summary. Returns null if no scans occurred */\nexport function formatScanReport(): string | null {\n  if (scanCount === 0) return null;\n\n  const lines: string[] = ['', '— YARA Scanner Summary —'];\n  const violationCount = scanViolations.length;\n  const cleanCount = scanCount - violationCount;\n\n  lines.push(\n    `✓ ${scanCount} tool calls scanned, ${violationCount} violation${\n      violationCount !== 1 ? 's' : ''\n    } detected`,\n  );\n\n  if (violationCount > 0) {\n    lines.push('');\n    for (const v of scanViolations) {\n      const tag = v.action.toUpperCase();\n      lines.push(\n        `  [${tag}] ${v.rule} (${v.severity.toUpperCase()}) — ${v.phase}:${\n          v.tool\n        }`,\n      );\n    }\n  }\n\n  if (cleanCount > 0) {\n    lines.push('');\n    lines.push(\n      `No violations: ✓ ${cleanCount} clean scan${cleanCount !== 1 ? 's' : ''}`,\n    );\n  }\n\n  lines.push('');\n  return lines.join('\\n');\n}\n\n/** Write the scan report to a JSON file. Returns the file path, or null if no scans occurred. */\nexport function writeScanReport(): string | null {\n  if (scanCount === 0) return null;\n\n  const report = {\n    summary: {\n      totalScans: scanCount,\n      violations: scanViolations.length,\n      clean: scanCount - scanViolations.length,\n    },\n    violations: scanViolations,\n  };\n\n  try {\n    fs.writeFileSync(WIZARD_YARA_REPORT_FILE, JSON.stringify(report, null, 2));\n  } catch (err) {\n    logToFile('[YARA] Failed to write scan report:', err);\n    return null;\n  }\n  return WIZARD_YARA_REPORT_FILE;\n}\n\n// ─── User-facing abort copy ──────────────────────────────────────\n//\n// The abort screen is the one security surface a user actually sees, so it must\n// say what was caught and that we protected them, in plain language, instead of\n// a bare \"Security violation detected.\" Warlock owns the rules and categories;\n// this map is the wizard's *presentation* of a category it already detected. We\n// deliberately do not surface warlock's own rule `description` here: it is\n// written for maintainers (it ships to telemetry) and reads as technical. The\n// `Category` type is a stable, append-only warlock API, so a new category just\n// falls through to the generic line below rather than breaking the build.\n\nconst CATEGORY_DESCRIPTIONS: Record<Category, string> = {\n  prompt_injection:\n    'hit hidden instructions in a file it read, a possible attempt to hijack the setup',\n  exfiltration: 'tried to send data to an outside location',\n  destructive_operations: 'tried to run a destructive command',\n  supply_chain: 'tried to pull in untrusted code',\n  posthog_pii: 'tried to write personal data (PII) into your project',\n  posthog_hardcoded_key: 'tried to hardcode a PostHog key into your project',\n  hardcoded_secret: 'tried to hardcode a secret into your project',\n};\n\n/** Most recent violation that terminated the run, or null. */\nfunction lastTerminatingViolation(): ScanReportEntry | null {\n  for (let i = scanViolations.length - 1; i >= 0; i--) {\n    if (scanViolations[i].action === 'aborted') return scanViolations[i];\n  }\n  return null;\n}\n\n/**\n * Build the user-facing copy for the security abort screen: what the scanner\n * caught and what we did about it. This screen renders only because the run was\n * stopped, so the \"what we did\" half is constant. Falls back to a generic line\n * when no specific violation was recorded (e.g. the scanner itself errored and\n * failed closed before a match was logged).\n */\nexport function formatYaraAbortMessage(): string {\n  const v = lastTerminatingViolation();\n  const what =\n    (v && CATEGORY_DESCRIPTIONS[v.category as Category]) ??\n    'did something our security scanner flagged';\n\n  return (\n    'Security check stopped the setup.\\n\\n' +\n    `The agent ${what}. We stopped the run to keep your project safe.\\n` +\n    'No unsafe changes were left in your project.\\n\\n' +\n    'If this looks wrong, let us know: wizard@posthog.com'\n  );\n}\n\n// ─── Hook Timeouts (ms) ─────────────────────────────────────────\n// Generous because triage adds an LLM round-trip, and because a *fired* hook\n// timeout means the protective action is dropped (fail-open). The triage HTTP\n// call has its own shorter internal timeout (see agent-interface), so a hung\n// triage fails inside our catch (fail-closed) before these fire.\n\n/** Timeout for scan hooks (PreToolUse, PostToolUse Write/Edit/Read/Grep) */\nconst HOOK_TIMEOUT_MS = 30_000;\n/** Timeout for the skill install hook (filesystem I/O + multiple scans) */\nconst SKILL_SCAN_HOOK_TIMEOUT_MS = 30_000;\n\n/**\n * Chunk size for scanning (100 KB). Oversized content is scanned in\n * overlapping chunks so coverage is complete — nothing is silently truncated.\n * The size also bounds what a single triage call pastes into the LLM prompt\n * (~25K tokens), so triage always sees the chunk its matches came from.\n */\nconst SCAN_CHUNK_SIZE = 100_000;\n\n// A skill file is read at most this far; the rest is head-scanned and logged.\nconst SKILL_FILE_SCAN_BYTES = 10 * 1024 * 1024;\n/**\n * Overlap between adjacent chunks so a pattern straddling a chunk boundary\n * still lands whole inside at least one chunk. YARA rule strings are at most\n * a few hundred bytes; 4 KB is generous.\n */\nconst SCAN_CHUNK_OVERLAP = 4_096;\n\n// ─── Logging ─────────────────────────────────────────────────────\n\nfunction logYaraMatch(\n  phase: string,\n  tool: string,\n  match: ScanMatch,\n  action: ScanAction,\n): void {\n  const severity = match.metadata.severity ?? 'unknown';\n  const category = match.metadata.category ?? 'unknown';\n  const ruleAction = match.metadata.action ?? 'unknown';\n  const description = match.metadata.description ?? '';\n  logToFile(\n    `[YARA] ${phase}:${tool} [${action.toUpperCase()}] rule \"${match.rule}\" ` +\n      `(severity: ${severity}, category: ${category}, action: ${ruleAction})\\n` +\n      `  Description: ${description}`,\n  );\n  analytics.wizardCapture('yara rule matched', {\n    rule: match.rule,\n    severity: match.metadata.severity,\n    category: match.metadata.category,\n    rule_action: match.metadata.action,\n    action,\n    phase,\n    tool,\n    // Rule-static description — the \"why\". The free-text triage reason is\n    // deliberately omitted (it can quote scanned content; stays local-only).\n    description: match.metadata.description,\n    triage_verdict: (match as TriageMatch).triage?.verdict,\n  });\n}\n\n/**\n * Send the run's full scan report to PostHog so maintainers can see why a run\n * was flagged, warned, or aborted. This is the maintainer-facing report — it is\n * NEVER shown to the user. No-op if nothing was scanned. The free-text triage\n * reason is omitted to avoid sending scanned content off the user's machine.\n */\nexport function captureScanReport(): void {\n  if (scanCount === 0) return;\n  analytics.wizardCapture('yara scan report', {\n    total_scans: scanCount,\n    violation_count: scanViolations.length,\n    clean_count: scanCount - scanViolations.length,\n    violations: scanViolations.map((v) => ({\n      rule: v.rule,\n      severity: v.severity,\n      category: v.category,\n      action: v.action,\n      phase: v.phase,\n      tool: v.tool,\n      description: v.description,\n      triage_verdict: v.triageVerdict,\n    })),\n  });\n  // Reset after sending so a second captureScanReport on this same run\n  // (e.g. success-path call followed by an abort during shutdown) can't\n  // ship duplicate telemetry. Also protects future chained-program runs.\n  scanCount = 0;\n  scanViolations.length = 0;\n}\n\n/**\n * End-of-run flush for the scan report. Wired once at the runner seam so every\n * harness (linear, orchestrator, and any future shape) reports without having\n * to know warlock exists — scanning is already harness-agnostic (it runs from\n * SDK Pre/PostToolUse hooks), and this keeps reporting at a single shared seam.\n *\n * Order matters: write the local --yara-report file FIRST (it reads scanCount /\n * scanViolations), THEN send telemetry. captureScanReport() zeroes scan state,\n * which is what makes this whole function idempotent — a second call from\n * another termination path (e.g. finally after an abort already flushed) finds\n * scanCount === 0 and every step no-ops.\n */\nexport function flushScanReport(\n  session: Pick<WizardSession, 'yaraReport'>,\n): void {\n  if (session.yaraReport) {\n    const reportPath = writeScanReport();\n    if (reportPath) {\n      const summary = formatScanReport();\n      getUI().log.info(`YARA scan report: ${reportPath}${summary ?? ''}`);\n    }\n  }\n  captureScanReport();\n}\n\n// ─── Wizard-documentation allowlist ───────────────────────────────\n//\n// Files the wizard's own programs write to describe events the user's\n// codebase already captures, or events the integration program is\n// proposing to add. When the agent copies a literal\n// `posthog.capture('event', { email: ... })` snippet (or a property\n// list including PII-shaped keys) into one of these files, the\n// `pii_in_capture_call` rule (category: posthog_pii) fires even though\n// the wizard is documenting / planning, not introducing, the pattern.\n// Suppress posthog_pii matches on these paths only; every other rule\n// (secrets, prompt injection, supply chain, destructive ops) still\n// fires normally so the file cannot be used as a smuggling vector for\n// actual violations.\n\nconst WIZARD_DOC_BASENAMES = new Set([\n  EVENT_INVENTORY_FILE,\n  EVENTS_AUDIT_REPORT_FILE,\n  AUDIT_REPORT_FILE,\n  EVENT_PLAN_FILE,\n]);\n\nconst WIZARD_DOC_PATTERNS: RegExp[] = [EVENT_INVENTORY_PART_PATTERN];\n\nexport function isWizardDocumentationPath(\n  filePath: string | undefined,\n): boolean {\n  if (!filePath) return false;\n  const basename = path.basename(filePath);\n  if (WIZARD_DOC_BASENAMES.has(basename)) return true;\n  return WIZARD_DOC_PATTERNS.some((re) => re.test(basename));\n}\n\n// ─── Repeat-block tracker ─────────────────────────────────────────\n//\n// Field data (switchboard YARA tile): an agent whose edit gets blocked often\n// retries the identical payload — the scan is deterministic, so every retry\n// blocks again and the run burns turns (~4.2 blocks per affected run). The\n// runtime notes already say \"don't retry\"; the data shows the prompt alone\n// doesn't hold. This is the code-side guard: remember the exact payloads we\n// blocked, and when the same content comes back, escalate the block reason —\n// first to \"change the code, not the retry\", then to \"report it and move on\".\n// Used by both fences: the anthropic PreToolUse Bash hook below, and the pi\n// security extension's pre-execution scan (bash/write/edit).\n\n/** Identical-payload attempt at which the agent is told to move on. */\nconst REPEAT_BLOCK_MOVE_ON_ATTEMPT = 3;\n\nexport interface RepeatBlockTracker {\n  /**\n   * Record a YARA block of `content` on `tool`; returns the attempt count\n   * for that exact payload (1 = first time blocked).\n   */\n  attempt(tool: string, content: string): number;\n}\n\n/** Per-run tracker of YARA-blocked payloads (keyed by tool + content hash). */\nexport function createRepeatBlockTracker(): RepeatBlockTracker {\n  const counts = new Map<string, number>();\n  return {\n    attempt(tool: string, content: string): number {\n      const key = `${tool} ${createHash('sha256')\n        .update(content)\n        .digest('hex')}`;\n      const next = (counts.get(key) ?? 0) + 1;\n      counts.set(key, next);\n      return next;\n    },\n  };\n}\n\n/**\n * The block reason for the given attempt: the plain reason the first time,\n * an explicit \"this exact retry can never work\" on the second, and a\n * \"report it and move on\" instruction from the third on.\n */\nexport function repeatBlockReason(\n  attempt: number,\n  tool: string,\n  baseReason: string,\n): string {\n  if (attempt <= 1) return baseReason;\n  if (attempt < REPEAT_BLOCK_MOVE_ON_ATTEMPT) {\n    return (\n      `${baseReason} This exact ${tool} content was ALREADY blocked — the scan is ` +\n      'deterministic, so retrying identical content will always block again. ' +\n      'Change the code to remove the flagged pattern instead of retrying.'\n    );\n  }\n  return (\n    `${baseReason} This exact ${tool} content has now been blocked ${attempt} times. ` +\n    'STOP retrying it. Note the blocked change in the setup report and move on to the next task.'\n  );\n}\n\n// ─── Severity helpers ────────────────────────────────────────────\n// Severity vocabulary and the terminate-or-warn decision live in yara-policy.\n\n// ─── Scan + triage core ──────────────────────────────────────────\n\n/**\n * Keep only matches whose rule targets this content surface. Rules carry a\n * `scan_context` of 'command' | 'input' | 'output'. An undefined context is\n * treated as \"applies everywhere\" (fail-safe — a rule that forgets the tag\n * still gets enforced rather than silently skipped).\n */\nfunction matchesForContext(\n  matches: ScanMatch[],\n  ctx: ScanContext,\n): ScanMatch[] {\n  return matches.filter((m) => {\n    const c = m.metadata.scan_context as string | undefined;\n    return c === ctx || c === undefined;\n  });\n}\n\n/**\n * Drop false positives via warlock's LLM triage. Fail-closed: if no provider is\n * available, or the triage call throws, every match is treated as real — we\n * never silently suppress a flagged match.\n *\n * Every overruled match is reported to PostHog (rule metadata only, never the\n * free-text reason) so maintainers can alert on triage-overrule patterns — the\n * signal that someone is either tripping a noisy rule or trying to talk the\n * triage model out of a real finding.\n */\nasync function triageFilter(\n  content: string,\n  matches: ScanMatch[],\n  ctx: ScanContext,\n  llmProvider: LLMProvider | undefined,\n): Promise<ScanMatch[]> {\n  if (matches.length === 0) return [];\n  if (!llmProvider) {\n    logToFile(\n      `[YARA] triage skipped (no provider) — treating ${matches.length} match(es) as real`,\n    );\n    return matches;\n  }\n  try {\n    const warlock = await getWarlock();\n    const triaged = await warlock.triageMatches(content, matches, llmProvider);\n    const kept = triaged.filter((m) => m.triage.verdict === 'true_positive');\n    for (const m of triaged) {\n      if (m.triage.verdict === 'true_positive') continue;\n      logToFile(\n        `[YARA] triage overruled rule \"${m.rule}\" (${\n          m.metadata.severity ?? 'unknown'\n        }) — not acting on it`,\n      );\n      analytics.wizardCapture('yara triage overruled', {\n        rule: m.rule,\n        severity: m.metadata.severity,\n        category: m.metadata.category,\n        scan_context: ctx,\n        // The free-text triage reason is deliberately omitted — it can quote\n        // scanned content, which must never leave the user's machine.\n      });\n    }\n    logToFile(\n      `[YARA] triage: ${matches.length} flagged → ${kept.length} kept as real`,\n    );\n    return kept;\n  } catch (err) {\n    logToFile('[YARA] triage failed — treating all matches as real:', err);\n    return matches;\n  }\n}\n\n/** A chunk of scanned content together with the matches found inside it. */\ninterface FlaggedChunk {\n  chunk: string;\n  matches: ScanMatch[];\n}\n\n/**\n * Split oversized content into overlapping chunks so the scanner covers all\n * of it. Content that fits in one chunk is returned as-is.\n */\nfunction chunkContent(content: string): string[] {\n  if (content.length <= SCAN_CHUNK_SIZE) return [content];\n  const chunks: string[] = [];\n  const step = SCAN_CHUNK_SIZE - SCAN_CHUNK_OVERLAP;\n  for (let start = 0; start < content.length; start += step) {\n    chunks.push(content.slice(start, start + SCAN_CHUNK_SIZE));\n    if (start + SCAN_CHUNK_SIZE >= content.length) break;\n  }\n  return chunks;\n}\n\n/**\n * Scan content against warlock rules — chunked when oversized, so nothing is\n * skipped — and keep only matches for this content surface. Chunks scan\n * sequentially (the WASM engine is single-threaded; parallelism buys nothing).\n * Returns each flagged chunk with its matches so triage can later judge every\n * match against the exact content it came from.\n */\nasync function scanForContext(\n  content: string,\n  ctx: ScanContext,\n): Promise<FlaggedChunk[]> {\n  const warlock = await getWarlock();\n  const chunks = chunkContent(content);\n  if (chunks.length > 1) {\n    logToFile(\n      `[YARA] content is ${content.length} chars — scanning ${chunks.length} overlapping chunks`,\n    );\n    // Alertable signal: oversized content should be rare; a spike could mean\n    // someone is padding content to probe the scanner.\n    analytics.wizardCapture('yara scan chunked', {\n      content_length: content.length,\n      chunk_count: chunks.length,\n      scan_context: ctx,\n    });\n  }\n  const flagged: FlaggedChunk[] = [];\n  for (const chunk of chunks) {\n    const result = await warlock.scan(chunk);\n    if (!result.matched) continue;\n    const matches = matchesForContext(result.matches, ctx);\n    if (matches.length === 0) continue;\n    flagged.push({ chunk, matches });\n  }\n  return flagged;\n}\n\n/** The overlap between chunks can surface the same rule twice; count it once. */\nfunction dedupeByRule(matches: ScanMatch[]): ScanMatch[] {\n  const seen = new Set<string>();\n  return matches.filter((m) => {\n    if (seen.has(m.rule)) return false;\n    seen.add(m.rule);\n    return true;\n  });\n}\n\n/**\n * Triage each flagged chunk against its own content — the evidence is always\n * inside the window the LLM sees. Triage calls run in parallel (each is just\n * an HTTP round trip) so N flagged chunks cost ~1× triage latency, not N×.\n */\nasync function triageFlagged(\n  flagged: FlaggedChunk[],\n  ctx: ScanContext,\n  llmProvider: LLMProvider | undefined,\n): Promise<ScanMatch[]> {\n  const triaged = await Promise.all(\n    flagged.map(({ chunk, matches }) =>\n      triageFilter(chunk, matches, ctx, llmProvider),\n    ),\n  );\n  return dedupeByRule(triaged.flat());\n}\n\n/**\n * Scan content, filter to the relevant context, triage. Returns real matches.\n * Exported for harnesses that run their own hook loop (pi) so every harness\n * scans through the same warlock engine, chunking, and triage policy.\n */\nexport async function scanAndTriage(\n  content: string,\n  ctx: ScanContext,\n  llmProvider: LLMProvider | undefined,\n): Promise<ScanMatch[]> {\n  const flagged = await scanForContext(content, ctx);\n  return triageFlagged(flagged, ctx, llmProvider);\n}\n\n// ─── PreToolUse Hooks ────────────────────────────────────────────\n\n/**\n * Create PreToolUse hook matchers for YARA scanning.\n * 1. Bash — scans commands before execution for exfiltration, destructive\n *    operations, and supply chain violations ('command'-context rules).\n * 2. publish_handoff — scans the report content with the same 'output'-context\n *    rules + triage as the PostToolUse Write/Edit hook, but BEFORE the MCP\n *    tool runs: the report is agent-authored and is persisted to a\n *    host-designated file (POSTHOG_HANDOFF_OUTPUT_PATH) as well as pushed to\n *    the task stream. Only a CRITICAL match refuses the publish; below that\n *    the report goes out with the match recorded.\n */\nexport function createPreToolUseYaraHooks(\n  // Used only by the publish_handoff matcher below (output-context triage,\n  // same fail-closed semantics as Write/Edit). The Bash matcher still passes\n  // undefined — any flagged command blocks regardless of triage verdict, so\n  // the LLM call would be wasted.\n  llmProvider?: LLMProvider,\n  // Ends the run when a handoff scan errors — without it that path just blocks,\n  // which is the old behavior, so it stays optional.\n  onTerminate?: (reason: string) => void,\n): HookCallbackMatcher[] {\n  const repeatTracker = createRepeatBlockTracker();\n  return [\n    {\n      hooks: [\n        async (input: HookInput): Promise<HookOutput> => {\n          try {\n            const toolName = input.tool_name as string;\n            if (toolName !== 'Bash') return {};\n\n            const toolInput = input.tool_input as Record<string, unknown>;\n            const command =\n              typeof toolInput?.command === 'string' ? toolInput.command : '';\n\n            if (!command) return {};\n\n            recordScan();\n            // Skip triage on PreToolUse Bash: any flagged command is blocked\n            // regardless of triage verdict, so the LLM call would be wasted.\n            const matches = await scanAndTriage(command, 'command', undefined);\n            if (matches.length === 0) return {};\n\n            const match = highestSeverityMatch(matches);\n            recordMatch('PreToolUse', 'Bash', match, 'blocked');\n\n            const attempt = repeatTracker.attempt('Bash', command);\n            return {\n              decision: 'block',\n              reason: repeatBlockReason(\n                attempt,\n                'Bash',\n                `[YARA] ${match.rule}: ${\n                  match.metadata.description ?? 'security policy violation'\n                }. Command blocked for security.`,\n              ),\n            };\n          } catch (error) {\n            logToFile('[YARA] PreToolUse hook error:', error);\n            // Fail closed: block the command if scanning fails\n            return {\n              decision: 'block',\n              reason: '[YARA] Scanner error — command blocked as a precaution.',\n            };\n          }\n        },\n      ],\n      timeout: HOOK_TIMEOUT_MS,\n    },\n    {\n      // ── publish_handoff content scanning ──\n      hooks: [\n        async (input: HookInput): Promise<HookOutput> => {\n          try {\n            const toolName = input.tool_name as string;\n            // The wizard's publish_handoff MCP tool, fully qualified by the\n            // SDK (e.g. mcp__wizard-tools__publish_handoff). Matched by\n            // suffix so a server rename can't silently reopen the gap — the\n            // exact FQN lives in WIZARD_TOOL_NAMES (wizard-tools/tools.ts),\n            // which this module can't import without a cycle (tools.ts\n            // imports scanInstalledSkill from here).\n            if (\n              typeof toolName !== 'string' ||\n              !toolName.endsWith('__publish_handoff')\n            ) {\n              return {};\n            }\n\n            const toolInput = input.tool_input as Record<string, unknown>;\n            const content =\n              typeof toolInput?.content === 'string' ? toolInput.content : '';\n\n            if (!content) return {};\n\n            recordScan();\n            // Same 'output'-context scan + triage as the Write/Edit hook:\n            // the report is agent-authored, quotes the user's code, and now\n            // reaches a second persisted consumer (the host file + the cloud\n            // worker's PR body) — so it must clear the bar of any other\n            // agent-driven write BEFORE the tool executes.\n            const matches = await scanAndTriage(content, 'output', llmProvider);\n            if (matches.length === 0) return {};\n\n            // Below critical: record it, don't cost the run its only report.\n            const match = publishBlockingMatch(matches);\n            if (!match) {\n              const worst = highestSeverityMatch(matches);\n              recordMatch('PreToolUse', 'publish_handoff', worst, 'warned');\n              logToFile(\n                `[YARA] publish_handoff allowed with a ${\n                  worst.metadata.severity ?? 'unknown'\n                } match (${worst.rule}) — below the critical publish bar`,\n              );\n              return {};\n            }\n\n            recordMatch('PreToolUse', 'publish_handoff', match, 'blocked');\n\n            const attempt = repeatTracker.attempt('publish_handoff', content);\n            return {\n              decision: 'block',\n              reason: repeatBlockReason(\n                attempt,\n                'publish_handoff',\n                `[YARA] ${match.rule}: ${\n                  match.metadata.description ?? 'security policy violation'\n                }. Handoff blocked for security — remove the flagged content from the report.`,\n              ),\n            };\n          } catch (error) {\n            logToFile('[YARA] PreToolUse publish_handoff hook error:', error);\n            // Fail closed, but end the run: a silent block would just leave\n            // the agent rewording a report that can never publish.\n            const reason =\n              '[YARA] Scanner error while scanning the handoff report — session terminated as a precaution.';\n            onTerminate?.(reason);\n            return { decision: 'block', reason };\n          }\n        },\n      ],\n      timeout: HOOK_TIMEOUT_MS,\n    },\n  ];\n}\n\n// ─── PostToolUse Hooks ───────────────────────────────────────────\n\n/**\n * Create PostToolUse hook matchers for YARA scanning.\n *\n * Three matchers:\n * 1. Write/Edit — scan written content ('output'-context rules: PII, secrets)\n * 2. Read/Grep — scan read content ('input'-context rules: prompt injection)\n * 3. Bash (skill install) — scan downloaded skill files for poisoned content\n *\n * `onTerminate` is invoked on the terminal paths (critical prompt injection in\n * read content, a poisoned skill, or a scanner error under fail-closed). It is\n * what ACTUALLY stops the run — returning `stopReason` from a PostToolUse hook\n * is not honored by the SDK, so the caller wires this to the run's\n * AbortController (see agent-interface).\n */\nexport function createPostToolUseYaraHooks(\n  llmProvider: LLMProvider | undefined,\n  // REQUIRED, not optional: the SDK ignores `stopReason` from PostToolUse\n  // hooks, so terminal paths (critical prompt injection, poisoned skill,\n  // fail-closed scanner error) depend entirely on this callback firing.\n  // Making it required at compile time prevents a future caller from\n  // silently regressing every terminal path to a no-op.\n  onTerminate: (reason: string) => void,\n): HookCallbackMatcher[] {\n  return [\n    // ── Write/Edit content scanning ──\n    {\n      hooks: [\n        async (input: HookInput): Promise<HookOutput> => {\n          try {\n            const toolName = input.tool_name as string;\n            if (toolName !== 'Write' && toolName !== 'Edit') return {};\n\n            const toolInput = input.tool_input as Record<string, unknown>;\n            // For Write, scan the content being written.\n            // For Edit, scan the new_string (replacement text).\n            const content =\n              toolName === 'Write'\n                ? (toolInput?.content as string) ?? ''\n                : (toolInput?.new_string as string) ?? '';\n\n            if (!content) return {};\n\n            recordScan();\n            const flagged = await scanForContext(content, 'output');\n            if (flagged.length === 0) return {};\n\n            // Wizard-documentation paths: suppress posthog_pii matches that\n            // come from the agent verbatim-copying the user's existing\n            // capture calls into an inventory / report, or planning new\n            // events with PII-shaped property keys. Every other category\n            // still triggers the revert. Suppression runs BEFORE triage so\n            // we never pay an LLM round trip for a match we're about to\n            // discard anyway.\n            // TODO(warlock#33): once warlock PR #33 lands with its\n            // more-precise PII rules, the wizard-side suppression below\n            // should become unnecessary — remove `WIZARD_DOC_BASENAMES`,\n            // `WIZARD_DOC_PATTERNS`, and `isWizardDocumentationPath` and\n            // verify the noisy-PII issue stays fixed.\n            const filePath = toolInput?.file_path as string | undefined;\n            const activeFlagged = isWizardDocumentationPath(filePath)\n              ? flagged\n                  .map(({ chunk, matches }) => ({\n                    chunk,\n                    matches: matches.filter(\n                      (m) => m.metadata.category !== 'posthog_pii',\n                    ),\n                  }))\n                  .filter(({ matches }) => matches.length > 0)\n              : flagged;\n            if (activeFlagged.length === 0) {\n              logToFile(\n                `[YARA] posthog_pii match suppressed on wizard doc ${path.basename(\n                  filePath ?? '',\n                )} (rule: ${flagged[0]?.matches[0]?.rule})`,\n              );\n              return {};\n            }\n\n            const matches = await triageFlagged(\n              activeFlagged,\n              'output',\n              llmProvider,\n            );\n            if (matches.length === 0) return {};\n\n            const match = highestSeverityMatch(matches);\n            recordMatch('PostToolUse', toolName, match, 'reverted');\n\n            return {\n              hookSpecificOutput: {\n                hookEventName: 'PostToolUse',\n                additionalContext:\n                  `[YARA VIOLATION] ${match.rule}: ${\n                    match.metadata.description ?? ''\n                  }. ` +\n                  `You MUST revert this change immediately. The content you just wrote violates security policy.`,\n              },\n            };\n          } catch (error) {\n            logToFile('[YARA] PostToolUse Write/Edit hook error:', error);\n            // Fail closed: if scanning is broken on a Write/Edit, the next\n            // Read/skill-install scan is also going to be broken — terminate\n            // cleanly instead of looping the agent through \"please revert\"\n            // until a Read finally aborts. Matches Read/Grep + skill-install\n            // catch behavior; consistent fail-closed across all PostToolUse.\n            const reason =\n              '[YARA] Scanner error while scanning written content — session terminated as a precaution.';\n            onTerminate(reason);\n            return { stopReason: reason };\n          }\n        },\n      ],\n      timeout: HOOK_TIMEOUT_MS,\n    },\n\n    // ── Read/Grep prompt injection scanning ──\n    {\n      hooks: [\n        async (input: HookInput): Promise<HookOutput> => {\n          try {\n            const toolName = input.tool_name as string;\n            if (toolName !== 'Read' && toolName !== 'Grep') return {};\n\n            const toolResponse = input.tool_response;\n            // Guard before stringify: `JSON.stringify(undefined ?? '')`\n            // returns the 2-char string '\"\"', which is truthy and slips\n            // past the empty-content check below. Exit early when the SDK\n            // gave us no response payload.\n            if (toolResponse == null) return {};\n            const content =\n              typeof toolResponse === 'string'\n                ? toolResponse\n                : JSON.stringify(toolResponse);\n\n            if (!content) return {};\n\n            recordScan();\n            const matches = await scanAndTriage(content, 'input', llmProvider);\n            const verdict = scanVerdict(matches);\n            if (!verdict) return {};\n\n            const { match } = verdict;\n            recordMatch('PostToolUse', toolName, match, verdict.action);\n\n            if (verdict.terminal) {\n              const reason =\n                `[YARA CRITICAL] ${match.rule}: Prompt injection detected in file content. ` +\n                `Agent context is potentially poisoned. Session terminated for safety.`;\n              onTerminate(reason);\n              return { stopReason: reason };\n            }\n\n            return {\n              hookSpecificOutput: {\n                hookEventName: 'PostToolUse',\n                additionalContext: `[YARA WARNING] ${match.rule}: ${\n                  match.metadata.description ?? ''\n                }`,\n              },\n            };\n          } catch (error) {\n            logToFile('[YARA] PostToolUse Read/Grep hook error:', error);\n            // Fail closed: terminate session if scanning fails on read content\n            const reason =\n              '[YARA] Scanner error while scanning read content — session terminated as a precaution.';\n            onTerminate(reason);\n            return { stopReason: reason };\n          }\n        },\n      ],\n      timeout: HOOK_TIMEOUT_MS,\n    },\n\n    // ── Context-mill skill install scanning ──\n    {\n      hooks: [\n        async (input: HookInput): Promise<HookOutput> => {\n          try {\n            const toolName = input.tool_name as string;\n            if (toolName !== 'Bash') return {};\n\n            const toolInput = input.tool_input as Record<string, unknown>;\n            const command =\n              typeof toolInput?.command === 'string' ? toolInput.command : '';\n\n            // Only scan after skill install commands\n            if (!isSkillInstallCommand(command)) return {};\n\n            // Extract skill directory from command\n            const dirMatch = command.match(\n              /mkdir -p (.claude\\/skills\\/[^\\s&]+)/,\n            );\n            if (!dirMatch) return {};\n\n            const skillDir = dirMatch[1];\n            const cwd = (input.cwd as string) ?? process.cwd();\n            recordScan();\n            const matches = await scanSkillFiles(cwd, skillDir, llmProvider);\n\n            const verdict = scanVerdict(matches);\n            if (!verdict) return {};\n\n            recordMatch(\n              'PostToolUse',\n              'Bash (skill install)',\n              verdict.match,\n              verdict.action,\n            );\n            // Same verdict as every other surface: critical terminates, the\n            // rest warn. These rules fire on first-party skill prose often\n            // enough that terminating costs more than it prevents.\n            if (!verdict.terminal) return {};\n\n            const reason =\n              `[YARA CRITICAL] Poisoned skill detected in ${skillDir}: ${verdict.match.rule}. ` +\n              `The downloaded skill contains potential prompt injection. Session terminated for safety.`;\n            onTerminate(reason);\n            return { stopReason: reason };\n          } catch (error) {\n            logToFile('[YARA] PostToolUse skill install hook error:', error);\n            // Fail closed: terminate if skill scanning fails\n            const reason =\n              '[YARA] Scanner error while scanning skill files — session terminated as a precaution.';\n            onTerminate(reason);\n            return { stopReason: reason };\n          }\n        },\n      ],\n      timeout: SKILL_SCAN_HOOK_TIMEOUT_MS,\n    },\n  ];\n}\n\n// ─── Skill File Scanner ──────────────────────────────────────────\n\n/**\n * Scan a freshly installed skill directory (any root — .claude/skills or the\n * orchestrator's run cache) and return a terminate reason when it is poisoned,\n * else null. The choke point for TS-path installs (downloadSkill); agent Bash\n * installs are covered by the PostToolUse matcher above. Runs the same LLM\n * triage as the tool-use scans; fail-closed to treating every match as real when\n * no provider is configured, so a missing key never weakens the check.\n * `llmProvider` is explicit — pi and the orchestrator never set the env fallback.\n *\n * Terminates on the same verdict as every other surface (critical only). A\n * non-terminal match is recorded and the skill is kept: these rules fire on\n * first-party skill prose, and deleting the skill leaves the agent working blind\n * on the very content it needed.\n */\nexport async function scanInstalledSkill(\n  absoluteSkillDir: string,\n  llmProvider: LLMProvider | undefined,\n): Promise<string | null> {\n  recordScan();\n  const matches = await scanSkillFiles(absoluteSkillDir, '.', llmProvider);\n  const verdict = scanVerdict(matches);\n  if (!verdict) return null;\n  recordMatch(\n    'skill-install',\n    'installSkillById',\n    verdict.match,\n    verdict.action,\n  );\n  if (!verdict.terminal) {\n    logToFile(\n      `[YARA] ${verdict.match.rule} (${\n        verdict.match.metadata.severity ?? 'unknown'\n      }) in ${absoluteSkillDir} — non-terminal, keeping the skill`,\n    );\n    return null;\n  }\n  return `Poisoned skill detected: ${verdict.match.rule} (${\n    verdict.match.metadata.severity ?? 'unknown'\n  }) in ${absoluteSkillDir}`;\n}\n\n/**\n * Read and scan all text files in a skill directory for prompt injection.\n * Scans each file sequentially (single-threaded WASM — parallelism buys\n * nothing), unions the 'input'-context matches, then triages once across the\n * combined content. Returns the real (post-triage) matches.\n */\nasync function scanSkillFiles(\n  cwd: string,\n  skillDir: string,\n  llmProvider: LLMProvider | undefined,\n): Promise<ScanMatch[]> {\n  const absoluteDir = path.resolve(cwd, skillDir);\n\n  if (!fs.existsSync(absoluteDir)) {\n    logToFile(`[YARA] Skill directory does not exist: ${absoluteDir}`);\n    return [];\n  }\n\n  const files = await fg('**/*.{md,txt,yaml,yml,json,js,ts,py,rb,sh}', {\n    cwd: absoluteDir,\n    absolute: true,\n  });\n\n  if (files.length === 0) {\n    logToFile(`[YARA] No text files found in skill directory: ${absoluteDir}`);\n    return [];\n  }\n\n  logToFile(\n    `[YARA] Scanning ${files.length} files in skill directory: ${skillDir}`,\n  );\n\n  // Pass 1 (sequential): read and scan ONE file at a time through the\n  // chunk-aware path. Oversized files are scanned up to the cap and logged —\n  // never silently skipped. Flagged chunks keep a reference to the exact\n  // content their matches came from.\n  const flagged: FlaggedChunk[] = [];\n  for (const filePath of files) {\n    let content: string | null;\n    try {\n      if (fs.statSync(filePath).size > SKILL_FILE_SCAN_BYTES) {\n        logToFile(\n          `[YARA] Skill file over ${SKILL_FILE_SCAN_BYTES} bytes; scanning its head only: ${filePath}`,\n        );\n        content = readFileHead(filePath, SKILL_FILE_SCAN_BYTES);\n      } else {\n        content = fs.readFileSync(filePath, 'utf-8');\n      }\n    } catch (err) {\n      logToFile(`[YARA] Could not read skill file ${filePath}:`, err);\n      continue;\n    }\n    if (content) {\n      flagged.push(...(await scanForContext(content, 'input')));\n    }\n  }\n\n  // Pass 2 (parallel, inside triageFlagged): triage each flagged chunk\n  // against its own content concurrently. Triage is just an axios call —\n  // running them in parallel cuts total wall-clock from N × triage-timeout\n  // to ~1×. Important because the hook's HOOK_TIMEOUT_MS is 30s; serial\n  // triage on 2+ matched files could blow the hook timeout under a slow\n  // Haiku.\n  return triageFlagged(flagged, 'input', llmProvider);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAUA,SAAgB,sBAAsB,SAA0B;AAC9D,KAAI,CAAC,QAAQ,WAAW,2BAA2B,CAAE,QAAO;CAE5D,MAAM,WAAW,QAAQ,MAAM,4BAA4B;AAC3D,KAAI,CAAC,SAAU,QAAO;CAItB,MAAM,MAAM,SAAS;AACrB,QACE,IAAI,WAAW,oDAAoD,IACnE,IAAI,WAAW,oCAAoC,IACnD,4BAA4B,KAAK,IAAI;;;;;ACLzC,MAAM,gBAAwC;CAC5C,UAAU;CACV,MAAM;CACN,QAAQ;CACR,KAAK;CACN;;AAGD,MAAM,sBAAsB,IAAI,IAAI,CAAC,WAAW,CAAC;;;;;;;;AASjD,SAAgB,gBAAgB,OAA2B;AACzD,QAAO,oBAAoB,IAAI,MAAM,SAAS,YAAY,GAAG;;;AAI/D,SAAgB,qBAAqB,SAAiC;AACpE,QAAO,QAAQ,QAAQ,OAAO,OAC3B,cAAc,EAAE,SAAS,YAAY,OAAO,MAC5C,cAAc,MAAM,SAAS,YAAY,OAAO,KAC7C,IACA,MACL;;;;;;AAOH,SAAgB,qBAAqB,SAAwC;AAC3E,KAAI,QAAQ,WAAW,EAAG,QAAO;CACjC,MAAM,QAAQ,qBAAqB,QAAQ;AAC3C,QAAO,gBAAgB,MAAM,GAAG,QAAQ;;;AAa1C,SAAgB,YAAY,SAA0C;AACpE,KAAI,QAAQ,WAAW,EAAG,QAAO;CACjC,MAAM,QAAQ,qBAAqB,QAAQ;CAC3C,MAAM,WAAW,gBAAgB,MAAM;AACvC,QAAO;EAAE;EAAO;EAAU,QAAQ,WAAW,YAAY;EAAU;;;;;;;;;;;AChErE,MAAa,oBAAoB;AACjC,MAAa,uBAAuB;;AAEpC,MAAa,+BACX;;;;ACYF,MAAa,uBAAgE;CAC3E,SAAS;EAAE,OAAO;EAAK,OAAO;EAAQ;CACtC,MAAM;EAAE,OAAO;EAAK,OAAO;EAAS;CACpC,OAAO;EAAE,OAAO;EAAK,OAAO;EAAO;CACnC,SAAS;EAAE,OAAO;EAAK,OAAO;EAAU;CACxC,YAAY;EAAE,OAAO;EAAK,OAAO;EAAQ;CAC1C;AAED,MAAa,oBAAoB;AACjC,MAAa,oBAAoB;AACjC,MAAa,mBAAmB;AAEhC,SAAgB,eAAe,SAAsC;CACnE,MAAM,MAAM,QAAQ,iBAAiB;AACrC,QAAO,MAAM,QAAQ,IAAI,GAAI,MAAuB,EAAE;;;;;;;;;;AAWxD,SAAgB,kBAAkB,QAA+B;AAC/D,QAAO,MAAM,QAAQ,OAAO,GAAI,SAA0B,EAAE;;;;;;;;;;;;ACzC9D,MAAa,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;AC+D/B,IAAI,uBAAsD;AAE1D,SAAS,aAAqC;AAC5C,KAAI,CAAC,qBAKH,wBAAuB,OAAO,oBAAoB,OAAO,QAAQ;AAC/D,yBAAuB;AACvB,QAAM;GACN;AAEJ,QAAO;;;;;;;AAQT,eAAsB,qBAAoC;AACxD,KAAI;AAEF,SADgB,MAAM,YAAY,EACpB,KAAK,GAAG;AACtB,YAAU,4BAA4B;UAC/B,KAAK;AACZ,YAAU,mCAAmC,IAAI;;;AA6CrD,IAAI,YAAY;AAChB,MAAM,iBAAoC,EAAE;AAE5C,SAAS,aAAmB;AAC1B;;;;;;AAUF,SAAS,YACP,OACA,MACA,OACA,QACM;CACN,MAAM,SAAU,MAAsB;AACtC,cAAa,OAAO,MAAM,OAAO,OAAO;AACxC,gBAAe,KAAK;EAClB,MAAM,MAAM;EACZ,UAAU,MAAM,SAAS,YAAY;EACrC,UAAU,MAAM,SAAS,YAAY;EACrC;EACA;EACA;EACA,aAAa,MAAM,SAAS,eAAe;EAC3C,eAAe,QAAQ;EACvB,cAAc,QAAQ;EACvB,CAAC;;;;;;;AAcJ,SAAgB,mBACd,OACA,MACA,YAMA,QACM;AACN,aAAY;AACZ,MAAK,MAAM,KAAK,WACd,aACE,OACA,MACA;EACE,MAAM,EAAE;EACR,UAAU;GACR,UAAU,EAAE;GACZ,UAAU,EAAE;GACZ,aAAa,EAAE;GAChB;EACD,gBAAgB,EAAE;EACnB,EACD,OACD;;;AAKL,SAAgB,mBAAkC;AAChD,KAAI,cAAc,EAAG,QAAO;CAE5B,MAAM,QAAkB,CAAC,IAAI,2BAA2B;CACxD,MAAM,iBAAiB,eAAe;CACtC,MAAM,aAAa,YAAY;AAE/B,OAAM,KACJ,KAAK,UAAU,uBAAuB,eAAe,YACnD,mBAAmB,IAAI,MAAM,GAC9B,WACF;AAED,KAAI,iBAAiB,GAAG;AACtB,QAAM,KAAK,GAAG;AACd,OAAK,MAAM,KAAK,gBAAgB;GAC9B,MAAM,MAAM,EAAE,OAAO,aAAa;AAClC,SAAM,KACJ,MAAM,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,SAAS,aAAa,CAAC,MAAM,EAAE,MAAM,GAC9D,EAAE,OAEL;;;AAIL,KAAI,aAAa,GAAG;AAClB,QAAM,KAAK,GAAG;AACd,QAAM,KACJ,oBAAoB,WAAW,aAAa,eAAe,IAAI,MAAM,KACtE;;AAGH,OAAM,KAAK,GAAG;AACd,QAAO,MAAM,KAAK,KAAK;;;AAIzB,SAAgB,kBAAiC;AAC/C,KAAI,cAAc,EAAG,QAAO;CAE5B,MAAM,SAAS;EACb,SAAS;GACP,YAAY;GACZ,YAAY,eAAe;GAC3B,OAAO,YAAY,eAAe;GACnC;EACD,YAAY;EACb;AAED,KAAI;AACF,KAAG,cAAc,yBAAyB,KAAK,UAAU,QAAQ,MAAM,EAAE,CAAC;UACnE,KAAK;AACZ,YAAU,uCAAuC,IAAI;AACrD,SAAO;;AAET,QAAO;;AAcT,MAAM,wBAAkD;CACtD,kBACE;CACF,cAAc;CACd,wBAAwB;CACxB,cAAc;CACd,aAAa;CACb,uBAAuB;CACvB,kBAAkB;CACnB;;AAGD,SAAS,2BAAmD;AAC1D,MAAK,IAAI,IAAI,eAAe,SAAS,GAAG,KAAK,GAAG,IAC9C,KAAI,eAAe,GAAG,WAAW,UAAW,QAAO,eAAe;AAEpE,QAAO;;;;;;;;;AAUT,SAAgB,yBAAiC;CAC/C,MAAM,IAAI,0BAA0B;AAKpC,QACE;;aAJC,KAAK,sBAAsB,EAAE,cAC9B,6CAIkB;;;;;AAatB,MAAM,kBAAkB;;AAExB,MAAM,6BAA6B;;;;;;;AAQnC,MAAM,kBAAkB;AAGxB,MAAM,wBAAwB,KAAK,OAAO;;;;;;AAM1C,MAAM,qBAAqB;AAI3B,SAAS,aACP,OACA,MACA,OACA,QACM;CACN,MAAM,WAAW,MAAM,SAAS,YAAY;CAC5C,MAAM,WAAW,MAAM,SAAS,YAAY;CAC5C,MAAM,aAAa,MAAM,SAAS,UAAU;CAC5C,MAAM,cAAc,MAAM,SAAS,eAAe;AAClD,WACE,UAAU,MAAM,GAAG,KAAK,IAAI,OAAO,aAAa,CAAC,UAAU,MAAM,KAAK,eACtD,SAAS,cAAc,SAAS,YAAY,WAAW,oBACnD,cACrB;AACD,WAAU,cAAc,qBAAqB;EAC3C,MAAM,MAAM;EACZ,UAAU,MAAM,SAAS;EACzB,UAAU,MAAM,SAAS;EACzB,aAAa,MAAM,SAAS;EAC5B;EACA;EACA;EAGA,aAAa,MAAM,SAAS;EAC5B,gBAAiB,MAAsB,QAAQ;EAChD,CAAC;;;;;;;;AASJ,SAAgB,oBAA0B;AACxC,KAAI,cAAc,EAAG;AACrB,WAAU,cAAc,oBAAoB;EAC1C,aAAa;EACb,iBAAiB,eAAe;EAChC,aAAa,YAAY,eAAe;EACxC,YAAY,eAAe,KAAK,OAAO;GACrC,MAAM,EAAE;GACR,UAAU,EAAE;GACZ,UAAU,EAAE;GACZ,QAAQ,EAAE;GACV,OAAO,EAAE;GACT,MAAM,EAAE;GACR,aAAa,EAAE;GACf,gBAAgB,EAAE;GACnB,EAAE;EACJ,CAAC;AAIF,aAAY;AACZ,gBAAe,SAAS;;;;;;;;;;;;;;AAe1B,SAAgB,gBACd,SACM;AACN,KAAI,QAAQ,YAAY;EACtB,MAAM,aAAa,iBAAiB;AACpC,MAAI,YAAY;GACd,MAAM,UAAU,kBAAkB;AAClC,UAAO,CAAC,IAAI,KAAK,qBAAqB,aAAa,WAAW,KAAK;;;AAGvE,oBAAmB;;AAiBrB,MAAM,uBAAuB,IAAI,IAAI;CACnC;CACAA;CACA;CACA;CACD,CAAC;AAEF,MAAM,sBAAgC,CAAC,6BAA6B;AAEpE,SAAgB,0BACd,UACS;AACT,KAAI,CAAC,SAAU,QAAO;CACtB,MAAM,WAAW,KAAK,SAAS,SAAS;AACxC,KAAI,qBAAqB,IAAI,SAAS,CAAE,QAAO;AAC/C,QAAO,oBAAoB,MAAM,OAAO,GAAG,KAAK,SAAS,CAAC;;;AAgB5D,MAAM,+BAA+B;;AAWrC,SAAgB,2BAA+C;CAC7D,MAAM,yBAAS,IAAI,KAAqB;AACxC,QAAO,EACL,QAAQ,MAAc,SAAyB;EAC7C,MAAM,MAAM,GAAG,KAAK,GAAG,WAAW,SAAS,CACxC,OAAO,QAAQ,CACf,OAAO,MAAM;EAChB,MAAM,QAAQ,OAAO,IAAI,IAAI,IAAI,KAAK;AACtC,SAAO,IAAI,KAAK,KAAK;AACrB,SAAO;IAEV;;;;;;;AAQH,SAAgB,kBACd,SACA,MACA,YACQ;AACR,KAAI,WAAW,EAAG,QAAO;AACzB,KAAI,UAAU,6BACZ,QACE,GAAG,WAAW,cAAc,KAAK;AAKrC,QACE,GAAG,WAAW,cAAc,KAAK,gCAAgC,QAAQ;;;;;;;;AAgB7E,SAAS,kBACP,SACA,KACa;AACb,QAAO,QAAQ,QAAQ,MAAM;EAC3B,MAAM,IAAI,EAAE,SAAS;AACrB,SAAO,MAAM,OAAO,MAAM,KAAA;GAC1B;;;;;;;;;;;;AAaJ,eAAe,aACb,SACA,SACA,KACA,aACsB;AACtB,KAAI,QAAQ,WAAW,EAAG,QAAO,EAAE;AACnC,KAAI,CAAC,aAAa;AAChB,YACE,kDAAkD,QAAQ,OAAO,oBAClE;AACD,SAAO;;AAET,KAAI;EAEF,MAAM,UAAU,OADA,MAAM,YAAY,EACJ,cAAc,SAAS,SAAS,YAAY;EAC1E,MAAM,OAAO,QAAQ,QAAQ,MAAM,EAAE,OAAO,YAAY,gBAAgB;AACxE,OAAK,MAAM,KAAK,SAAS;AACvB,OAAI,EAAE,OAAO,YAAY,gBAAiB;AAC1C,aACE,iCAAiC,EAAE,KAAK,KACtC,EAAE,SAAS,YAAY,UACxB,sBACF;AACD,aAAU,cAAc,yBAAyB;IAC/C,MAAM,EAAE;IACR,UAAU,EAAE,SAAS;IACrB,UAAU,EAAE,SAAS;IACrB,cAAc;IAGf,CAAC;;AAEJ,YACE,kBAAkB,QAAQ,OAAO,aAAa,KAAK,OAAO,eAC3D;AACD,SAAO;UACA,KAAK;AACZ,YAAU,wDAAwD,IAAI;AACtE,SAAO;;;;;;;AAcX,SAAS,aAAa,SAA2B;AAC/C,KAAI,QAAQ,UAAU,gBAAiB,QAAO,CAAC,QAAQ;CACvD,MAAM,SAAmB,EAAE;CAC3B,MAAM,OAAO,kBAAkB;AAC/B,MAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS,MAAM;AACzD,SAAO,KAAK,QAAQ,MAAM,OAAO,QAAQ,gBAAgB,CAAC;AAC1D,MAAI,QAAQ,mBAAmB,QAAQ,OAAQ;;AAEjD,QAAO;;;;;;;;;AAUT,eAAe,eACb,SACA,KACyB;CACzB,MAAM,UAAU,MAAM,YAAY;CAClC,MAAM,SAAS,aAAa,QAAQ;AACpC,KAAI,OAAO,SAAS,GAAG;AACrB,YACE,qBAAqB,QAAQ,OAAO,oBAAoB,OAAO,OAAO,qBACvE;AAGD,YAAU,cAAc,qBAAqB;GAC3C,gBAAgB,QAAQ;GACxB,aAAa,OAAO;GACpB,cAAc;GACf,CAAC;;CAEJ,MAAM,UAA0B,EAAE;AAClC,MAAK,MAAM,SAAS,QAAQ;EAC1B,MAAM,SAAS,MAAM,QAAQ,KAAK,MAAM;AACxC,MAAI,CAAC,OAAO,QAAS;EACrB,MAAM,UAAU,kBAAkB,OAAO,SAAS,IAAI;AACtD,MAAI,QAAQ,WAAW,EAAG;AAC1B,UAAQ,KAAK;GAAE;GAAO;GAAS,CAAC;;AAElC,QAAO;;;AAIT,SAAS,aAAa,SAAmC;CACvD,MAAM,uBAAO,IAAI,KAAa;AAC9B,QAAO,QAAQ,QAAQ,MAAM;AAC3B,MAAI,KAAK,IAAI,EAAE,KAAK,CAAE,QAAO;AAC7B,OAAK,IAAI,EAAE,KAAK;AAChB,SAAO;GACP;;;;;;;AAQJ,eAAe,cACb,SACA,KACA,aACsB;AAMtB,QAAO,cALS,MAAM,QAAQ,IAC5B,QAAQ,KAAK,EAAE,OAAO,cACpB,aAAa,OAAO,SAAS,KAAK,YAAY,CAC/C,CACF,EAC2B,MAAM,CAAC;;;;;;;AAQrC,eAAsB,cACpB,SACA,KACA,aACsB;AAEtB,QAAO,cADS,MAAM,eAAe,SAAS,IAAI,EACpB,KAAK,YAAY;;;;;;;;;;;;;AAgBjD,SAAgB,0BAKd,aAGA,aACuB;CACvB,MAAM,gBAAgB,0BAA0B;AAChD,QAAO,CACL;EACE,OAAO,CACL,OAAO,UAA0C;AAC/C,OAAI;AAEF,QADiB,MAAM,cACN,OAAQ,QAAO,EAAE;IAElC,MAAM,YAAY,MAAM;IACxB,MAAM,UACJ,OAAO,WAAW,YAAY,WAAW,UAAU,UAAU;AAE/D,QAAI,CAAC,QAAS,QAAO,EAAE;AAEvB,gBAAY;IAGZ,MAAM,UAAU,MAAM,cAAc,SAAS,WAAW,KAAA,EAAU;AAClE,QAAI,QAAQ,WAAW,EAAG,QAAO,EAAE;IAEnC,MAAM,QAAQ,qBAAqB,QAAQ;AAC3C,gBAAY,cAAc,QAAQ,OAAO,UAAU;AAGnD,WAAO;KACL,UAAU;KACV,QAAQ,kBAHM,cAAc,QAAQ,QAAQ,QAAQ,EAKlD,QACA,UAAU,MAAM,KAAK,IACnB,MAAM,SAAS,eAAe,4BAC/B,iCACF;KACF;YACM,OAAO;AACd,cAAU,iCAAiC,MAAM;AAEjD,WAAO;KACL,UAAU;KACV,QAAQ;KACT;;IAGN;EACD,SAAS;EACV,EACD;EAEE,OAAO,CACL,OAAO,UAA0C;AAC/C,OAAI;IACF,MAAM,WAAW,MAAM;AAOvB,QACE,OAAO,aAAa,YACpB,CAAC,SAAS,SAAS,oBAAoB,CAEvC,QAAO,EAAE;IAGX,MAAM,YAAY,MAAM;IACxB,MAAM,UACJ,OAAO,WAAW,YAAY,WAAW,UAAU,UAAU;AAE/D,QAAI,CAAC,QAAS,QAAO,EAAE;AAEvB,gBAAY;IAMZ,MAAM,UAAU,MAAM,cAAc,SAAS,UAAU,YAAY;AACnE,QAAI,QAAQ,WAAW,EAAG,QAAO,EAAE;IAGnC,MAAM,QAAQ,qBAAqB,QAAQ;AAC3C,QAAI,CAAC,OAAO;KACV,MAAM,QAAQ,qBAAqB,QAAQ;AAC3C,iBAAY,cAAc,mBAAmB,OAAO,SAAS;AAC7D,eACE,yCACE,MAAM,SAAS,YAAY,UAC5B,UAAU,MAAM,KAAK,oCACvB;AACD,YAAO,EAAE;;AAGX,gBAAY,cAAc,mBAAmB,OAAO,UAAU;AAG9D,WAAO;KACL,UAAU;KACV,QAAQ,kBAHM,cAAc,QAAQ,mBAAmB,QAAQ,EAK7D,mBACA,UAAU,MAAM,KAAK,IACnB,MAAM,SAAS,eAAe,4BAC/B,8EACF;KACF;YACM,OAAO;AACd,cAAU,iDAAiD,MAAM;IAGjE,MAAM,SACJ;AACF,kBAAc,OAAO;AACrB,WAAO;KAAE,UAAU;KAAS;KAAQ;;IAGzC;EACD,SAAS;EACV,CACF;;;;;;;;;;;;;;;;AAmBH,SAAgB,2BACd,aAMA,aACuB;AACvB,QAAO;EAEL;GACE,OAAO,CACL,OAAO,UAA0C;AAC/C,QAAI;KACF,MAAM,WAAW,MAAM;AACvB,SAAI,aAAa,WAAW,aAAa,OAAQ,QAAO,EAAE;KAE1D,MAAM,YAAY,MAAM;KAGxB,MAAM,UACJ,aAAa,UACR,WAAW,WAAsB,KACjC,WAAW,cAAyB;AAE3C,SAAI,CAAC,QAAS,QAAO,EAAE;AAEvB,iBAAY;KACZ,MAAM,UAAU,MAAM,eAAe,SAAS,SAAS;AACvD,SAAI,QAAQ,WAAW,EAAG,QAAO,EAAE;KAcnC,MAAM,WAAW,WAAW;KAC5B,MAAM,gBAAgB,0BAA0B,SAAS,GACrD,QACG,KAAK,EAAE,OAAO,eAAe;MAC5B;MACA,SAAS,QAAQ,QACd,MAAM,EAAE,SAAS,aAAa,cAChC;MACF,EAAE,CACF,QAAQ,EAAE,cAAc,QAAQ,SAAS,EAAE,GAC9C;AACJ,SAAI,cAAc,WAAW,GAAG;AAC9B,gBACE,qDAAqD,KAAK,SACxD,YAAY,GACb,CAAC,UAAU,QAAQ,IAAI,QAAQ,IAAI,KAAK,GAC1C;AACD,aAAO,EAAE;;KAGX,MAAM,UAAU,MAAM,cACpB,eACA,UACA,YACD;AACD,SAAI,QAAQ,WAAW,EAAG,QAAO,EAAE;KAEnC,MAAM,QAAQ,qBAAqB,QAAQ;AAC3C,iBAAY,eAAe,UAAU,OAAO,WAAW;AAEvD,YAAO,EACL,oBAAoB;MAClB,eAAe;MACf,mBACE,oBAAoB,MAAM,KAAK,IAC7B,MAAM,SAAS,eAAe,GAC/B;MAEJ,EACF;aACM,OAAO;AACd,eAAU,6CAA6C,MAAM;KAM7D,MAAM,SACJ;AACF,iBAAY,OAAO;AACnB,YAAO,EAAE,YAAY,QAAQ;;KAGlC;GACD,SAAS;GACV;EAGD;GACE,OAAO,CACL,OAAO,UAA0C;AAC/C,QAAI;KACF,MAAM,WAAW,MAAM;AACvB,SAAI,aAAa,UAAU,aAAa,OAAQ,QAAO,EAAE;KAEzD,MAAM,eAAe,MAAM;AAK3B,SAAI,gBAAgB,KAAM,QAAO,EAAE;KACnC,MAAM,UACJ,OAAO,iBAAiB,WACpB,eACA,KAAK,UAAU,aAAa;AAElC,SAAI,CAAC,QAAS,QAAO,EAAE;AAEvB,iBAAY;KAEZ,MAAM,UAAU,YADA,MAAM,cAAc,SAAS,SAAS,YAAY,CAC9B;AACpC,SAAI,CAAC,QAAS,QAAO,EAAE;KAEvB,MAAM,EAAE,UAAU;AAClB,iBAAY,eAAe,UAAU,OAAO,QAAQ,OAAO;AAE3D,SAAI,QAAQ,UAAU;MACpB,MAAM,SACJ,mBAAmB,MAAM,KAAK;AAEhC,kBAAY,OAAO;AACnB,aAAO,EAAE,YAAY,QAAQ;;AAG/B,YAAO,EACL,oBAAoB;MAClB,eAAe;MACf,mBAAmB,kBAAkB,MAAM,KAAK,IAC9C,MAAM,SAAS,eAAe;MAEjC,EACF;aACM,OAAO;AACd,eAAU,4CAA4C,MAAM;KAE5D,MAAM,SACJ;AACF,iBAAY,OAAO;AACnB,YAAO,EAAE,YAAY,QAAQ;;KAGlC;GACD,SAAS;GACV;EAGD;GACE,OAAO,CACL,OAAO,UAA0C;AAC/C,QAAI;AAEF,SADiB,MAAM,cACN,OAAQ,QAAO,EAAE;KAElC,MAAM,YAAY,MAAM;KACxB,MAAM,UACJ,OAAO,WAAW,YAAY,WAAW,UAAU,UAAU;AAG/D,SAAI,CAAC,sBAAsB,QAAQ,CAAE,QAAO,EAAE;KAG9C,MAAM,WAAW,QAAQ,MACvB,sCACD;AACD,SAAI,CAAC,SAAU,QAAO,EAAE;KAExB,MAAM,WAAW,SAAS;KAC1B,MAAM,MAAO,MAAM,OAAkB,QAAQ,KAAK;AAClD,iBAAY;KAGZ,MAAM,UAAU,YAFA,MAAM,eAAe,KAAK,UAAU,YAAY,CAE5B;AACpC,SAAI,CAAC,QAAS,QAAO,EAAE;AAEvB,iBACE,eACA,wBACA,QAAQ,OACR,QAAQ,OACT;AAID,SAAI,CAAC,QAAQ,SAAU,QAAO,EAAE;KAEhC,MAAM,SACJ,8CAA8C,SAAS,IAAI,QAAQ,MAAM,KAAK;AAEhF,iBAAY,OAAO;AACnB,YAAO,EAAE,YAAY,QAAQ;aACtB,OAAO;AACd,eAAU,gDAAgD,MAAM;KAEhE,MAAM,SACJ;AACF,iBAAY,OAAO;AACnB,YAAO,EAAE,YAAY,QAAQ;;KAGlC;GACD,SAAS;GACV;EACF;;;;;;;;;;;;;;;;AAmBH,eAAsB,mBACpB,kBACA,aACwB;AACxB,aAAY;CAEZ,MAAM,UAAU,YADA,MAAM,eAAe,kBAAkB,KAAK,YAAY,CACpC;AACpC,KAAI,CAAC,QAAS,QAAO;AACrB,aACE,iBACA,oBACA,QAAQ,OACR,QAAQ,OACT;AACD,KAAI,CAAC,QAAQ,UAAU;AACrB,YACE,UAAU,QAAQ,MAAM,KAAK,IAC3B,QAAQ,MAAM,SAAS,YAAY,UACpC,OAAO,iBAAiB,oCAC1B;AACD,SAAO;;AAET,QAAO,4BAA4B,QAAQ,MAAM,KAAK,IACpD,QAAQ,MAAM,SAAS,YAAY,UACpC,OAAO;;;;;;;;AASV,eAAe,eACb,KACA,UACA,aACsB;CACtB,MAAM,cAAc,KAAK,QAAQ,KAAK,SAAS;AAE/C,KAAI,CAAC,GAAG,WAAW,YAAY,EAAE;AAC/B,YAAU,0CAA0C,cAAc;AAClE,SAAO,EAAE;;CAGX,MAAM,QAAQ,MAAM,GAAG,8CAA8C;EACnE,KAAK;EACL,UAAU;EACX,CAAC;AAEF,KAAI,MAAM,WAAW,GAAG;AACtB,YAAU,kDAAkD,cAAc;AAC1E,SAAO,EAAE;;AAGX,WACE,mBAAmB,MAAM,OAAO,6BAA6B,WAC9D;CAMD,MAAM,UAA0B,EAAE;AAClC,MAAK,MAAM,YAAY,OAAO;EAC5B,IAAI;AACJ,MAAI;AACF,OAAI,GAAG,SAAS,SAAS,CAAC,OAAO,uBAAuB;AACtD,cACE,0BAA0B,sBAAsB,kCAAkC,WACnF;AACD,cAAU,aAAa,UAAU,sBAAsB;SAEvD,WAAU,GAAG,aAAa,UAAU,QAAQ;WAEvC,KAAK;AACZ,aAAU,oCAAoC,SAAS,IAAI,IAAI;AAC/D;;AAEF,MAAI,QACF,SAAQ,KAAK,GAAI,MAAM,eAAe,SAAS,QAAQ,CAAE;;AAU7D,QAAO,cAAc,SAAS,SAAS,YAAY"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@posthog/wizard",
-  "version": "2.71.0",
+  "version": "2.73.0",
   "homepage": "https://github.com/PostHog/wizard",
   "repository": "https://github.com/PostHog/wizard",
   "description": "The PostHog wizard helps you to configure your project",
@@ -60,6 +60,7 @@
     "recast": "^0.23.3",
     "semver": "^7.5.3",
     "typebox": "1.1.38",
+    "undici": "8.5.0",
     "uuid": "^11.1.0",
     "xcode": "3.0.1",
     "xml-js": "^1.6.11",