@posthog/wizard 2.74.0 → 2.75.0

package/dist/analytics-CfadnLFG.js

@@ -1,2 +0,0 @@
-import { n as analytics } from "./analytics-DZNb3aRN.js";
-export { analytics };

package/dist/analytics-DZNb3aRN.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"analytics-DZNb3aRN.js","names":["uuidv4"],"sources":["../src/utils/ci-flag-overrides.ts","../src/utils/analytics.ts"],"sourcesContent":["/**\n * CI-only feature-flag overrides.\n *\n * CI must route deterministically: a run that tests the orchestrator arm says\n * so explicitly instead of depending on a live feature flag someone can edit\n * mid-week. The override env var (see the allowlist in `env.ts`) is a JSON\n * object of flag key → value, merged over whatever PostHog returned.\n *\n * The override path exists only in CI builds (`pnpm build:ci`). Published\n * builds inline NODE_ENV as the literal \"production\", the guards collapse,\n * and tsdown strips the rest from the bundle — and the smoke test asserts the\n * env var names are physically absent from production output (which is also\n * why no comment in this file may spell them out), so this can never quietly\n * become a production surface.\n */\nimport { runtimeEnv } from '@env';\nimport { logToFile } from './debug';\n\nexport function applyCiFlagOverrides(\n  flags: Record<string, string>,\n  payloads: Record<string, unknown> = {},\n): { flags: Record<string, string>; payloads: Record<string, unknown> } {\n  // Compared inline (not via env.ts's IS_PRODUCTION_BUILD) so tsdown replaces\n  // it with a literal right here and the bundler can prove the rest of this\n  // function unreachable in production builds. The smoke test enforces that.\n  if (process.env.NODE_ENV === 'production') return { flags, payloads };\n\n  const raw = runtimeEnv('WIZARD_CI_FLAG_OVERRIDES');\n  if (!raw) return { flags, payloads };\n\n  let overrides: Record<string, unknown>;\n  try {\n    overrides = JSON.parse(raw) as Record<string, unknown>;\n  } catch {\n    // A malformed override is a CI misconfiguration. Fail the run loudly\n    // rather than silently testing whatever the live flags happen to say.\n    throw new Error(\n      'The CI flag-override env var is not valid JSON (expected {\"flag-key\": value, ...}).',\n    );\n  }\n\n  const mergedFlags = { ...flags };\n  const mergedPayloads = { ...payloads };\n  for (const [key, value] of Object.entries(overrides)) {\n    // An object/array override is a flag payload: the flag reads 'true' and\n    // the value rides the payload channel, matching a payload-carrying flag.\n    if (typeof value === 'object' && value !== null) {\n      mergedFlags[key] = 'true';\n      mergedPayloads[key] = value;\n    } else {\n      mergedFlags[key] = String(value);\n    }\n  }\n  logToFile('[flags] CI overrides applied', overrides);\n  return { flags: mergedFlags, payloads: mergedPayloads };\n}\n\n/**\n * Task types excluded from this run. The exclusion env var (see the allowlist\n * in `env.ts`) is a comma-separated list (e.g. `dashboard`), set by the CI\n * harness that owns the policy — the wizard and the served content stay\n * run-mode agnostic. CI-build only, same as the flag overrides: published\n * builds strip this path.\n */\nexport function ciExcludedTaskTypes(): readonly string[] {\n  if (process.env.NODE_ENV === 'production') return [];\n\n  const raw = runtimeEnv('WIZARD_CI_EXCLUDE_TASKS');\n  if (!raw) return [];\n  const types = raw\n    .split(',')\n    .map((t) => t.trim())\n    .filter(Boolean);\n  if (types.length > 0) logToFile('[flags] CI task exclusions', types);\n  return types;\n}\n","import { PostHog } from 'posthog-node';\nimport {\n  ANALYTICS_HOST_URL,\n  ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY,\n  ANALYTICS_TEAM_TAG,\n  WIZARD_FLAG_KEYS,\n} from '@lib/constants';\nimport {\n  reportableDiscoveredFeatures,\n  type WizardSession,\n} from '@lib/wizard-session';\nimport type { ApiUser } from '@lib/api';\nimport { v4 as uuidv4 } from 'uuid';\nimport { IS_PRODUCTION_BUILD, RUN_SURFACE, TASK_ID, TASK_RUN_ID } from '@env';\nimport { VERSION } from '@lib/version';\nimport { debug, logToFile } from './debug';\nimport { applyCiFlagOverrides } from './ci-flag-overrides';\n\n/**\n * The invocation, reduced to flag-safe strings: the command word (first\n * positional, 'default' for the bare flow) and the sorted option NAMES.\n * Option values never leave the machine — they carry paths, emails, keys.\n */\nfunction invocationProperties(): { command: string; cli_flags: string } {\n  const args = process.argv.slice(2);\n  const command = args.find((a) => !a.startsWith('-')) ?? 'default';\n  const flags = [\n    ...new Set(\n      args\n        .filter((a) => a.startsWith('--'))\n        .map((a) => a.slice(2).split('=')[0]),\n    ),\n  ].sort();\n  return { command, cli_flags: flags.join(',') };\n}\n\n/**\n * Extract a standard property bag from the current session.\n * Used by store-level analytics and available for ad-hoc captures.\n */\nexport function sessionProperties(\n  session: WizardSession,\n): Record<string, unknown> {\n  // reportableDiscoveredFeatures() owns the consent decision; this file\n  // never needs to know what `scanConsent` means, only that the result\n  // might be absent. An absent key is unambiguous, while an empty array\n  // would read as \"we looked and found nothing\" instead of \"not reported\".\n  const discoveredFeatures = reportableDiscoveredFeatures(session);\n\n  return {\n    integration: session.integration,\n    detected_framework: session.detectedFrameworkLabel,\n    typescript: session.typescript,\n    project_id: session.credentials?.projectId,\n    ...(discoveredFeatures !== undefined\n      ? { discovered_features: discoveredFeatures }\n      : {}),\n    scan_consent: session.scanConsent,\n    additional_features: session.additionalFeatureQueue,\n    run_phase: session.runPhase,\n  };\n}\n\nexport function groupsFromUser(\n  user: ApiUser | null,\n  host: string,\n): Record<string, string> {\n  const groups: Record<string, string> = { instance: host };\n  if (!user) return groups;\n\n  const organizationId = user.organization?.id;\n  if (organizationId) groups.organization = organizationId;\n\n  const customerId = user.organization?.customer_id;\n  if (customerId) groups.customer = customerId;\n\n  const projectUuid = user.team?.uuid;\n  if (projectUuid) groups.project = projectUuid;\n\n  return groups;\n}\n\nconst WIZARD_FLAGS: ReadonlySet<string> = new Set(WIZARD_FLAG_KEYS);\n\n// Widen back to the SDK's shape — a filter on `true` never matches `'true'`.\nfunction flagResponseValue(value: string): string | boolean {\n  if (value === 'true') return true;\n  if (value === 'false') return false;\n  return value;\n}\n\nexport class Analytics {\n  private client: PostHog;\n  private tags: Record<string, string | boolean | number | null | undefined> =\n    {};\n  private distinctId?: string;\n  private anonymousId: string;\n  private _runId: string;\n  private sessionId: string | null = null;\n  private appName = 'wizard';\n  private activeFlags: Record<string, string> | null = null;\n  private activeFlagPayloads: Record<string, unknown> = {};\n  private groups: Record<string, string> = {};\n  private personProperties: Record<string, string> = {};\n  private terminalEventSent = false;\n\n  constructor() {\n    this.client = new PostHog(ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY, {\n      host: ANALYTICS_HOST_URL,\n      flushAt: 1,\n      flushInterval: 0,\n      enableExceptionAutocapture: true,\n      before_send: (event) => {\n        if (!event) return event;\n        if (Object.keys(this.groups).length > 0) {\n          event.groups = { ...this.groups, ...event.groups };\n        }\n        // Autocaptured exceptions arrive with a random uuid and\n        // `$process_person_profile: false` — reattach the run's identity\n        // and tags so they land on the same person as everything else.\n        if (event.event === '$exception') {\n          event.distinctId = this.distinctId ?? this.anonymousId;\n          const { $process_person_profile, ...properties } =\n            event.properties ?? {};\n          void $process_person_profile;\n          event.properties = { ...this.tags, ...properties };\n        }\n        // The SDK captures this one itself, bypassing capture(), so tags merge here.\n        if (event.event === '$feature_flag_called') {\n          event.properties = { ...this.tags, ...(event.properties ?? {}) };\n        }\n        return event;\n      },\n    });\n\n    this.tags = { $app_name: this.appName };\n    // Tag every run with its build type so prod / dev / ci / headless segment\n    // cleanly in analytics. tsdown inlines IS_PRODUCTION_BUILD to `true` in\n    // published builds and `false` for dev/tsx/test runs. Non-interactive runs\n    // upgrade this in runWizardCI: dev `--ci` runs to 'ci', published headless\n    // runs to 'headless'.\n    this.tags.build = IS_PRODUCTION_BUILD ? 'prod' : 'dev';\n\n    this.tags.run_surface = RUN_SURFACE;\n\n    // The build this run came from. Already sent as a flag-evaluation person\n    // property; tagging it makes every event attributable to a release, so a\n    // regression can be bounded to the versions that carry it.\n    this.tags.version = VERSION;\n\n    // Cloud runs only: the task run that owns the sandbox. Without these the\n    // wizard's events and the run that launched it are two unrelated streams,\n    // since run_id above is minted per process and never leaves the wizard.\n    // Left unset for local runs so the properties stay absent rather than null.\n    if (TASK_RUN_ID) this.tags.task_run_id = TASK_RUN_ID;\n    if (TASK_ID) this.tags.task_id = TASK_ID;\n\n    this.anonymousId = uuidv4();\n\n    // One id per process = one id per wizard run, registered in the tag bag\n    // so it rides on every capture, exception, and autocaptured exception\n    // (all of which merge `this.tags`). Lets you separate two runs by the\n    // same logged-in user, who otherwise share one distinct id. Distinct\n    // from `anonymousId`, the pre-login *person* id that gets aliased onto\n    // the real user at login. `$session_id` is intentionally not set here —\n    // it stays null until OAuth completes (see identifyUser).\n    this._runId = uuidv4();\n    this.tags.run_id = this._runId;\n\n    this.distinctId = undefined;\n  }\n\n  /** Per-process run id, tagged on every event and gateway trace. */\n  get runId(): string {\n    return this._runId;\n  }\n\n  /** Build type for this run ('prod' | 'dev' | 'ci' | 'headless') — the same value tagged on every analytics event. */\n  get build(): string {\n    return String(this.tags.build ?? 'dev');\n  }\n\n  /**\n   * Associate the run with the logged-in user, once per id. Identifies them\n   * (email, name) and records those person properties so events carry them and\n   * feature flags can target the individual user — without the email here the\n   * wizard only sends `$app_name`, so email-targeted flags never match. Opens\n   * the analytics session on first login, then aliases the run's anonymous id\n   * onto the identified person so pre-login events merge in.\n   */\n  identifyUser(user: ApiUser) {\n    const distinctId = user.distinct_id;\n    if (this.distinctId === distinctId || distinctId === this.anonymousId) {\n      return;\n    }\n    this.distinctId = distinctId;\n    // Open the analytics session on first login. Null until here, so\n    // pre-OAuth events carry only `run_id`; from now on every event also\n    // carries `$session_id` and PostHog groups the authenticated run into a\n    // native Session. Stored in the tag bag so it rides on every subsequent\n    // capture and exception.\n    if (!this.sessionId) {\n      this.sessionId = uuidv4();\n      this.tags.$session_id = this.sessionId;\n    }\n    const props: Record<string, string> = {};\n    if (user.email) props.email = user.email;\n    const name = [user.first_name, user.last_name]\n      .filter(Boolean)\n      .join(' ')\n      .trim();\n    if (name) props.name = name;\n    this.personProperties = props;\n    this.client.identify({ distinctId, properties: { $set: props } });\n    this.client.alias({\n      distinctId,\n      alias: this.anonymousId,\n    });\n    // The flag snapshot is per identity. Anything evaluated before login (the\n    // intro screen reads the tools-menu flag) was anonymous — drop it so the\n    // next read re-evaluates as this user.\n    this.activeFlags = null;\n    this.activeFlagPayloads = {};\n  }\n\n  /** Person properties sent with flag evaluation: app name plus the user's. */\n  private flagPersonProperties(): Record<string, string> {\n    // Environment facts flag conditions can scope on — evaluation-time only,\n    // never persisted onto the person. `version` gates an experiment to\n    // releases that implement it (a condition on a property older builds\n    // don't send silently never matches them); `run_surface`/`build` scope\n    // by invocation surface; `command`/`cli_flags` by subcommand; `os`/\n    // `node_major` by platform.\n    return {\n      $app_name: this.appName,\n      version: VERSION,\n      run_surface: RUN_SURFACE,\n      build: String(this.tags.build ?? 'dev'),\n      os: process.platform,\n      node_major: process.versions.node.split('.')[0],\n      ...invocationProperties(),\n      ...this.personProperties,\n    };\n  }\n\n  setTag(key: string, value: string | boolean | number | null | undefined) {\n    this.tags[key] = value;\n  }\n\n  setGroups(groups: Record<string, string>) {\n    this.groups = groups;\n  }\n\n  captureException(error: Error, properties: Record<string, unknown> = {}) {\n    this.client.captureException(error, this.distinctId ?? this.anonymousId, {\n      team: ANALYTICS_TEAM_TAG,\n      ...this.tags,\n      ...properties,\n    });\n  }\n\n  capture(eventName: string, properties?: Record<string, unknown>) {\n    this.client.capture({\n      distinctId: this.distinctId ?? this.anonymousId,\n      event: eventName,\n      properties: {\n        ...this.tags,\n        ...this.wizardFlagFeatureProperties(),\n        ...properties,\n      },\n    });\n  }\n\n  groupIdentify(\n    groupType: string,\n    groupKey: string,\n    properties: Record<string, unknown>,\n  ) {\n    this.client.groupIdentify({ groupType, groupKey, properties });\n  }\n\n  // Built from the resolved map, not the SDK snapshot: a CI-forced variant must own its events.\n  private wizardFlagFeatureProperties(): Record<string, unknown> {\n    if (this.activeFlags === null) return {};\n    const props: Record<string, unknown> = {};\n    const active: string[] = [];\n    for (const [key, value] of Object.entries(this.activeFlags)) {\n      if (!WIZARD_FLAGS.has(key)) continue;\n      const resolved = flagResponseValue(value);\n      props[`$feature/${key}`] = resolved;\n      if (resolved !== false) active.push(key);\n    }\n    if (active.length > 0) props.$active_feature_flags = active.sort();\n    return props;\n  }\n\n  /**\n   * Capture a wizard-specific event. Automatically prepends \"wizard: \" to the event name.\n   * All new wizard analytics should use this method instead of capture() directly.\n   */\n  wizardCapture(eventName: string, properties?: Record<string, unknown>): void {\n    this.capture(`wizard: ${eventName}`, properties);\n  }\n\n  /**\n   * Flush pending events without firing the \"setup wizard finished\" terminal\n   * event. Use this from CLI error paths that exit before any wizard run\n   * starts — `shutdown()` would inflate the run count with a \"finished\" event\n   * for a parse error that never actually ran the wizard.\n   */\n  async flush(): Promise<void> {\n    await this.client.shutdown();\n  }\n\n  /**\n   * Evaluate all feature flags for the current user at the start of a run.\n   * Result is cached; subsequent calls in the same run return the same map.\n   * Returns flag key -> string value (booleans become 'true'/'false').\n   */\n  // Only a getFlag read records an exposure; the bulk response records none.\n  async getAllFlagsForWizard(): Promise<Record<string, string>> {\n    if (this.activeFlags !== null) {\n      return this.activeFlags;\n    }\n    const out: Record<string, string> = {};\n    const payloads: Record<string, unknown> = {};\n    try {\n      const distinctId = this.distinctId ?? this.anonymousId;\n      logToFile('[flags] evaluating as', {\n        distinctId,\n        identified: this.distinctId !== undefined,\n        personProperties: this.flagPersonProperties(),\n      });\n      const evaluation = await this.client.evaluateFlags(distinctId, {\n        personProperties: this.flagPersonProperties(),\n      });\n      for (const key of WIZARD_FLAG_KEYS) {\n        const value = evaluation.getFlag(key);\n        if (value === undefined) continue;\n        out[key] = String(value);\n        const payload = evaluation.getFlagPayload(key);\n        if (payload !== undefined) payloads[key] = payload;\n      }\n    } catch (error) {\n      debug('Failed to get all feature flags:', error);\n      this.captureException(\n        error instanceof Error ? error : new Error(String(error)),\n        { step: 'get_all_flags' },\n      );\n    }\n    // Outside the fetch guard on purpose: a malformed CI override must fail\n    // the run loudly, and a valid one applies even when the fetch failed —\n    // CI routing stays deterministic either way.\n    const merged = applyCiFlagOverrides(out, payloads);\n    this.activeFlags = merged.flags;\n    this.activeFlagPayloads = merged.payloads;\n    logToFile('[flags] evaluated', this.activeFlags);\n    return this.activeFlags;\n  }\n\n  /** Flag payloads from the same snapshot; empty until the flags are fetched. */\n  getWizardFlagPayloads(): Record<string, unknown> {\n    return this.activeFlagPayloads;\n  }\n\n  async shutdown(status: 'success' | 'error' | 'cancelled') {\n    if (Object.keys(this.tags).length === 0) {\n      return;\n    }\n\n    // First status wins. The interrupt fallback in start-tui fires\n    // shutdown('cancelled') on every TUI teardown; without this guard a run\n    // that already reported 'success' would emit a second, contradicting\n    // terminal event when the user dismisses the outro.\n    if (this.terminalEventSent) {\n      return;\n    }\n    this.terminalEventSent = true;\n\n    this.client.capture({\n      distinctId: this.distinctId ?? this.anonymousId,\n      event: 'setup wizard finished',\n      properties: {\n        // Flat for filtering; the nested `tags` snapshot stays for back-compat.\n        ...this.tags,\n        run_id: this._runId,\n        ...(this.sessionId ? { $session_id: this.sessionId } : {}),\n        status,\n        tags: this.tags,\n      },\n    });\n\n    await this.client.shutdown();\n  }\n}\n\nexport const analytics = new Analytics();\n"],"mappings":";;;;;AAkBA,SAAgB,qBACd,OACA,WAAoC,EAAE,EACgC;AAI3B,QAAO;EAAE;EAAO;EAAU;;;;;;;;;AAuCvE,SAAgB,sBAAyC;AACZ,QAAO,EAAE;;;;;;;;;AC1CtD,SAAS,uBAA+D;CACtE,MAAM,OAAO,QAAQ,KAAK,MAAM,EAAE;AASlC,QAAO;EAAE,SARO,KAAK,MAAM,MAAM,CAAC,EAAE,WAAW,IAAI,CAAC,IAAI;EAQtC,WAPJ,CACZ,GAAG,IAAI,IACL,KACG,QAAQ,MAAM,EAAE,WAAW,KAAK,CAAC,CACjC,KAAK,MAAM,EAAE,MAAM,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,CACxC,CACF,CAAC,MAAM,CAC2B,KAAK,IAAI;EAAE;;;;;;AAOhD,SAAgB,kBACd,SACyB;CAKzB,MAAM,qBAAqB,6BAA6B,QAAQ;AAEhE,QAAO;EACL,aAAa,QAAQ;EACrB,oBAAoB,QAAQ;EAC5B,YAAY,QAAQ;EACpB,YAAY,QAAQ,aAAa;EACjC,GAAI,uBAAuB,KAAA,IACvB,EAAE,qBAAqB,oBAAoB,GAC3C,EAAE;EACN,cAAc,QAAQ;EACtB,qBAAqB,QAAQ;EAC7B,WAAW,QAAQ;EACpB;;AAGH,SAAgB,eACd,MACA,MACwB;CACxB,MAAM,SAAiC,EAAE,UAAU,MAAM;AACzD,KAAI,CAAC,KAAM,QAAO;CAElB,MAAM,iBAAiB,KAAK,cAAc;AAC1C,KAAI,eAAgB,QAAO,eAAe;CAE1C,MAAM,aAAa,KAAK,cAAc;AACtC,KAAI,WAAY,QAAO,WAAW;CAElC,MAAM,cAAc,KAAK,MAAM;AAC/B,KAAI,YAAa,QAAO,UAAU;AAElC,QAAO;;AAGT,MAAM,eAAoC,IAAI,IAAI,iBAAiB;AAGnE,SAAS,kBAAkB,OAAiC;AAC1D,KAAI,UAAU,OAAQ,QAAO;AAC7B,KAAI,UAAU,QAAS,QAAO;AAC9B,QAAO;;AAGT,IAAa,YAAb,MAAuB;CACrB;CACA,OACE,EAAE;CACJ;CACA;CACA;CACA,YAAmC;CACnC,UAAkB;CAClB,cAAqD;CACrD,qBAAsD,EAAE;CACxD,SAAyC,EAAE;CAC3C,mBAAmD,EAAE;CACrD,oBAA4B;CAE5B,cAAc;AACZ,OAAK,SAAS,IAAI,QAAQ,4CAA4C;GACpE,MAAM;GACN,SAAS;GACT,eAAe;GACf,4BAA4B;GAC5B,cAAc,UAAU;AACtB,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,OAAO,KAAK,KAAK,OAAO,CAAC,SAAS,EACpC,OAAM,SAAS;KAAE,GAAG,KAAK;KAAQ,GAAG,MAAM;KAAQ;AAKpD,QAAI,MAAM,UAAU,cAAc;AAChC,WAAM,aAAa,KAAK,cAAc,KAAK;KAC3C,MAAM,EAAE,yBAAyB,GAAG,eAClC,MAAM,cAAc,EAAE;AAExB,WAAM,aAAa;MAAE,GAAG,KAAK;MAAM,GAAG;MAAY;;AAGpD,QAAI,MAAM,UAAU,uBAClB,OAAM,aAAa;KAAE,GAAG,KAAK;KAAM,GAAI,MAAM,cAAc,EAAE;KAAG;AAElE,WAAO;;GAEV,CAAC;AAEF,OAAK,OAAO,EAAE,WAAW,KAAK,SAAS;AAMvC,OAAK,KAAK,QAA8B;AAExC,OAAK,KAAK,cAAc;AAKxB,OAAK,KAAK,UAAU;AAMpB,MAAI,YAAa,MAAK,KAAK,cAAc;AACzC,MAAI,QAAS,MAAK,KAAK,UAAU;AAEjC,OAAK,cAAcA,IAAQ;AAS3B,OAAK,SAASA,IAAQ;AACtB,OAAK,KAAK,SAAS,KAAK;AAExB,OAAK,aAAa,KAAA;;;CAIpB,IAAI,QAAgB;AAClB,SAAO,KAAK;;;CAId,IAAI,QAAgB;AAClB,SAAO,OAAO,KAAK,KAAK,SAAS,MAAM;;;;;;;;;;CAWzC,aAAa,MAAe;EAC1B,MAAM,aAAa,KAAK;AACxB,MAAI,KAAK,eAAe,cAAc,eAAe,KAAK,YACxD;AAEF,OAAK,aAAa;AAMlB,MAAI,CAAC,KAAK,WAAW;AACnB,QAAK,YAAYA,IAAQ;AACzB,QAAK,KAAK,cAAc,KAAK;;EAE/B,MAAM,QAAgC,EAAE;AACxC,MAAI,KAAK,MAAO,OAAM,QAAQ,KAAK;EACnC,MAAM,OAAO,CAAC,KAAK,YAAY,KAAK,UAAU,CAC3C,OAAO,QAAQ,CACf,KAAK,IAAI,CACT,MAAM;AACT,MAAI,KAAM,OAAM,OAAO;AACvB,OAAK,mBAAmB;AACxB,OAAK,OAAO,SAAS;GAAE;GAAY,YAAY,EAAE,MAAM,OAAO;GAAE,CAAC;AACjE,OAAK,OAAO,MAAM;GAChB;GACA,OAAO,KAAK;GACb,CAAC;AAIF,OAAK,cAAc;AACnB,OAAK,qBAAqB,EAAE;;;CAI9B,uBAAuD;AAOrD,SAAO;GACL,WAAW,KAAK;GAChB,SAAS;GACT,aAAa;GACb,OAAO,OAAO,KAAK,KAAK,SAAS,MAAM;GACvC,IAAI,QAAQ;GACZ,YAAY,QAAQ,SAAS,KAAK,MAAM,IAAI,CAAC;GAC7C,GAAG,sBAAsB;GACzB,GAAG,KAAK;GACT;;CAGH,OAAO,KAAa,OAAqD;AACvE,OAAK,KAAK,OAAO;;CAGnB,UAAU,QAAgC;AACxC,OAAK,SAAS;;CAGhB,iBAAiB,OAAc,aAAsC,EAAE,EAAE;AACvE,OAAK,OAAO,iBAAiB,OAAO,KAAK,cAAc,KAAK,aAAa;GACvE,MAAM;GACN,GAAG,KAAK;GACR,GAAG;GACJ,CAAC;;CAGJ,QAAQ,WAAmB,YAAsC;AAC/D,OAAK,OAAO,QAAQ;GAClB,YAAY,KAAK,cAAc,KAAK;GACpC,OAAO;GACP,YAAY;IACV,GAAG,KAAK;IACR,GAAG,KAAK,6BAA6B;IACrC,GAAG;IACJ;GACF,CAAC;;CAGJ,cACE,WACA,UACA,YACA;AACA,OAAK,OAAO,cAAc;GAAE;GAAW;GAAU;GAAY,CAAC;;CAIhE,8BAA+D;AAC7D,MAAI,KAAK,gBAAgB,KAAM,QAAO,EAAE;EACxC,MAAM,QAAiC,EAAE;EACzC,MAAM,SAAmB,EAAE;AAC3B,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,YAAY,EAAE;AAC3D,OAAI,CAAC,aAAa,IAAI,IAAI,CAAE;GAC5B,MAAM,WAAW,kBAAkB,MAAM;AACzC,SAAM,YAAY,SAAS;AAC3B,OAAI,aAAa,MAAO,QAAO,KAAK,IAAI;;AAE1C,MAAI,OAAO,SAAS,EAAG,OAAM,wBAAwB,OAAO,MAAM;AAClE,SAAO;;;;;;CAOT,cAAc,WAAmB,YAA4C;AAC3E,OAAK,QAAQ,WAAW,aAAa,WAAW;;;;;;;;CASlD,MAAM,QAAuB;AAC3B,QAAM,KAAK,OAAO,UAAU;;;;;;;CAS9B,MAAM,uBAAwD;AAC5D,MAAI,KAAK,gBAAgB,KACvB,QAAO,KAAK;EAEd,MAAM,MAA8B,EAAE;EACtC,MAAM,WAAoC,EAAE;AAC5C,MAAI;GACF,MAAM,aAAa,KAAK,cAAc,KAAK;AAC3C,aAAU,yBAAyB;IACjC;IACA,YAAY,KAAK,eAAe,KAAA;IAChC,kBAAkB,KAAK,sBAAsB;IAC9C,CAAC;GACF,MAAM,aAAa,MAAM,KAAK,OAAO,cAAc,YAAY,EAC7D,kBAAkB,KAAK,sBAAsB,EAC9C,CAAC;AACF,QAAK,MAAM,OAAO,kBAAkB;IAClC,MAAM,QAAQ,WAAW,QAAQ,IAAI;AACrC,QAAI,UAAU,KAAA,EAAW;AACzB,QAAI,OAAO,OAAO,MAAM;IACxB,MAAM,UAAU,WAAW,eAAe,IAAI;AAC9C,QAAI,YAAY,KAAA,EAAW,UAAS,OAAO;;WAEtC,OAAO;AACd,SAAM,oCAAoC,MAAM;AAChD,QAAK,iBACH,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC,EACzD,EAAE,MAAM,iBAAiB,CAC1B;;EAKH,MAAM,SAAS,qBAAqB,KAAK,SAAS;AAClD,OAAK,cAAc,OAAO;AAC1B,OAAK,qBAAqB,OAAO;AACjC,YAAU,qBAAqB,KAAK,YAAY;AAChD,SAAO,KAAK;;;CAId,wBAAiD;AAC/C,SAAO,KAAK;;CAGd,MAAM,SAAS,QAA2C;AACxD,MAAI,OAAO,KAAK,KAAK,KAAK,CAAC,WAAW,EACpC;AAOF,MAAI,KAAK,kBACP;AAEF,OAAK,oBAAoB;AAEzB,OAAK,OAAO,QAAQ;GAClB,YAAY,KAAK,cAAc,KAAK;GACpC,OAAO;GACP,YAAY;IAEV,GAAG,KAAK;IACR,QAAQ,KAAK;IACb,GAAI,KAAK,YAAY,EAAE,aAAa,KAAK,WAAW,GAAG,EAAE;IACzD;IACA,MAAM,KAAK;IACZ;GACF,CAAC;AAEF,QAAM,KAAK,OAAO,UAAU;;;AAIhC,MAAa,YAAY,IAAI,WAAW"}

package/dist/debug-ECdmmlDM.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"debug-ECdmmlDM.js","names":["errResult","join","sep"],"sources":["../src/lib/headless-mode.ts","../src/env.ts","../src/lib/version.ts","../src/lib/constants.ts","../src/ui/wizard-ui.ts","../src/lib/health-checks/statuspage.ts","../src/lib/health-checks/incidentio.ts","../src/lib/health-checks/endpoints.ts","../src/lib/health-checks/readiness.ts","../src/ui/logging-ui.ts","../src/ui/index.ts","../src/utils/paths.ts","../src/utils/debug.ts"],"sourcesContent":["/**\n * Headless mode — the published-build, non-interactive run path.\n *\n * The headless flag and `--ci` both drive a non-interactive install\n * (session.ci === true), but through dedicated entry points so they can\n * diverge: runHeadlessInstall → runWizardHeadless for headless,\n * runCIInstall → runWizardCI for `--ci`. Both delegate to one shared pipeline\n * (runNonInteractive) today; the only forks are the api-key prefixes accepted\n * (ci-install) and the analytics build tag (the mode passed to the runner).\n *\n * The flag is deliberately named `--headless-DONOTUSE-EXPERIMENTAL` and hidden\n * from `--help`: the contract is still unstable and subject to breaking\n * changes, so it must not be advertised or relied on by external callers. This\n * module is the single source of truth for the flag's name and detection — keep\n * the scary name out of every other file so a future rename is one edit here.\n */\n\nimport type { Options } from 'yargs';\n\n/**\n * The on-CLI flag name. Intentionally ugly + undocumented; do not surface it in\n * `--help`, the README, or user-facing error messages.\n */\nexport const HEADLESS_FLAG = 'headless-DONOTUSE-EXPERIMENTAL';\n\n/**\n * The yargs option declaration for the headless flag. Declared per-command\n * (basic integration + audit) rather than globally, so no other command\n * accepts it. Spread into a command's `options` to opt it into headless.\n */\nexport const headlessOption: Record<string, Options> = {\n  [HEADLESS_FLAG]: {\n    default: false,\n    // EXPERIMENTAL + UNSTABLE: the non-interactive published-build run path.\n    // Declared unconditionally (unlike --ci) so it works in the shipped\n    // package, but hidden and intentionally ugly-named — the contract may\n    // break without notice, so it must not be advertised.\n    describe:\n      'EXPERIMENTAL — do not use. Unstable, subject to breaking changes.',\n    type: 'boolean',\n    hidden: true,\n  },\n};\n\n/**\n * Read the headless signal off a parsed argv / options bag. yargs always sets\n * the value under the declared key (`HEADLESS_FLAG`), so reading that key is\n * reliable regardless of camel-case expansion.\n */\nexport function isHeadless(options: Record<string, unknown>): boolean {\n  return options[HEADLESS_FLAG] === true;\n}\n\n// `--region` only means something non-interactively (API-key auth has no OAuth\n// token response to read `posthog_region` from), so only headless-capable\n// commands declare it.\nexport const regionOption: Record<string, Options> = {\n  region: {\n    describe: 'PostHog cloud region\\nenv: POSTHOG_WIZARD_REGION',\n    choices: ['us', 'eu'],\n    type: 'string',\n    hidden: true,\n  },\n};\n","/**\n * Central environment variable access for the PostHog wizard.\n *\n * ── Build-time constants ────────────────────────────────────────────\n * Inlined by tsdown's `env` option at compile time. After build, the\n * runtime value of these env vars has zero effect on the wizard.\n *\n * ── Runtime variables ───────────────────────────────────────────────\n * Read through `runtimeEnv()` with a typed allowlist. This makes every\n * runtime dependency on the environment explicit and grep-able.\n *\n * ── Direct process.env access ───────────────────────────────────────\n * Reserved for subprocess environment configuration (writes) and\n * vendored code. Production source outside those cases should use\n * this module instead.\n */\n\nimport { HEADLESS_FLAG } from '@lib/headless-mode';\n\n// ── Build-time constants ─────────────────────────────────────────────\n// tsdown replaces `process.env.NODE_ENV` with a string literal.\n// After build these are just `\"production\"`, `false`, etc.\n\nexport const NODE_ENV = process.env.NODE_ENV as string;\nexport const IS_DEV =\n  process.env.NODE_ENV === 'development' || process.env.NODE_ENV === 'test';\n\n/**\n * True only in published/production builds. tsdown inlines\n * `process.env.NODE_ENV` as the literal `\"production\"` at build time, so this\n * collapses to `true` in `dist/` and stays `false` for `tsx`/dev/test runs\n * (where NODE_ENV is unset, `development`, or `test`). Used to gate features\n * that aren't supported in the shipped package — e.g. `--ci` mode.\n */\nexport const IS_PRODUCTION_BUILD = process.env.NODE_ENV === 'production';\n\n/** 'cloud' when launched with the experimental headless flag, else 'local' — resolved once from argv at launch. */\nexport const RUN_SURFACE: 'cloud' | 'local' = process.argv.some(\n  (a) => a === `--${HEADLESS_FLAG}` || a.startsWith(`--${HEADLESS_FLAG}=`),\n)\n  ? 'cloud'\n  : 'local';\n\n// ── Runtime environment ──────────────────────────────────────────────\n\n/**\n * Exhaustive allowlist of env vars the wizard reads at runtime.\n * Add new keys here when a new runtime dependency is needed.\n */\ntype RuntimeEnvKey =\n  // CI-build-only flag overrides (see utils/ci-flag-overrides.ts).\n  // Deliberately NOT POSTHOG_WIZARD_-prefixed: yargs .env('POSTHOG_WIZARD')\n  // would claim it as an unknown CLI option and strict-reject the run.\n  | 'WIZARD_CI_FLAG_OVERRIDES'\n  | 'WIZARD_CI_EXCLUDE_TASKS'\n  // Wizard CLI configuration (yargs POSTHOG_WIZARD_ prefix)\n  | 'POSTHOG_WIZARD_BENCHMARK_CONFIG'\n  | 'POSTHOG_WIZARD_BENCHMARK_FILE'\n  | 'POSTHOG_WIZARD_LOG_DIR'\n  | 'POSTHOG_WIZARD_DEBUG'\n  // Identity of the PostHog task run whose sandbox launched this wizard. Set by\n  // the sandbox for every run it starts, agent or wizard. Deliberately NOT\n  // POSTHOG_WIZARD_-prefixed, for the same reason as the two keys above:\n  // yargs .env('POSTHOG_WIZARD') would claim them as CLI options and\n  // .strictOptions() would reject the run unless the wizard also declared them,\n  // which would tie every sandbox deploy to an npm release of this package.\n  | 'POSTHOG_TASK_RUN_ID'\n  | 'POSTHOG_TASK_ID'\n  | 'POSTHOG_HANDOFF_OUTPUT_PATH'\n  // Local/CI escape hatch to disable Warlock scanning without the PostHog flag.\n  | 'POSTHOG_WIZARD_WARLOCK_DISABLED'\n  | 'DEBUG'\n  // Agent / MCP\n  | 'MCP_URL'\n  | 'POSTHOG_API_KEY'\n  // Platform: terminal detection\n  | 'TERM'\n  | 'TERM_PROGRAM'\n  | 'TERMINAL_EMULATOR'\n  | 'CI'\n  | 'WT_SESSION'\n  | 'TERMINUS_SUBLIME'\n  | 'ConEmuTask'\n  // Platform: paths\n  | 'APPDATA'\n  | 'OPENCODE_CONFIG_DIR'\n  | 'XDG_CONFIG_HOME';\n\n/** Read a runtime environment variable. Only allowlisted keys compile. */\nexport function runtimeEnv(key: RuntimeEnvKey): string | undefined {\n  return process.env[key];\n}\n\n/**\n * The PostHog task run that launched this wizard, when one did. A cloud run's\n * sandbox exports both ids into the wizard's environment; every local run\n * leaves them undefined. Resolved once at launch, like RUN_SURFACE above.\n */\nexport const TASK_RUN_ID: string | undefined =\n  runtimeEnv('POSTHOG_TASK_RUN_ID') || undefined;\nexport const TASK_ID: string | undefined =\n  runtimeEnv('POSTHOG_TASK_ID') || undefined;\n","// Auto-generated by scripts/generate-version.js — do not edit\nexport const VERSION = '2.74.0';\n","/**\n * Shared constants for the PostHog wizard.\n */\n\nimport { VERSION } from './version';\n\n// ── Models ──────────────────────────────────────────────────────────\n// Coordinate IDs/efforts with the mint allowlists and gateway transport/required prompt policy; see agent/runner/README.md.\n\n/** Next sonnet generation (a `MODEL_FLAG_VARIANTS` key in the switchboard). */\nexport const SONNET_5_MODEL = 'claude-sonnet-5';\n\n/**\n * Default model for agent runs. Bare model IDs (no `anthropic/` prefix) so the\n * LLM gateway's Bedrock fallback can match map_to_bedrock_model().\n */\nexport const DEFAULT_AGENT_MODEL = SONNET_5_MODEL;\n\n/** Undated haiku, for scan triage. The alias tracks the current 4.5 release rather than pinning one. */\nexport const HAIKU_TRIAGE_MODEL = 'claude-haiku-4-5';\n\n/**\n * Cheaper, faster model for mechanical agent work (e.g. repo classification\n * during source-map detection). Passed via AgentConfig.modelOverride.\n */\nexport const HAIKU_MODEL = HAIKU_TRIAGE_MODEL;\n\n// Locally supported OpenAI models; constants alone do not authorize gateway use.\nexport const GPT5_6_LUNA_MODEL = 'openai/gpt-5.6-luna';\nexport const GPT5_6_TERRA_MODEL = 'openai/gpt-5.6-terra';\nexport const GPT5_6_SOL_MODEL = 'openai/gpt-5.6-sol';\n\n// ── Agent runner routing axes ────────────────────────────────────────\n\n/**\n * The two agent runner routing axes: **harness** (which agent SDK drives the LLM)\n * and **sequence** (which pipeline shape orchestrates the work). Single source\n * of truth for yargs `choices`, session fields, the runner registry, and tests\n * — `Object.values(Harness)` gives an iterable of the values when an array is\n * needed. Adding a member is enough to pick it up everywhere.\n *\n * Naming matches the directory layout — see `src/lib/agent/runner/harness/`\n * and `src/lib/agent/runner/sequence/`.\n */\nexport enum Harness {\n  anthropic = 'anthropic',\n  pi = 'pi',\n}\n\nexport enum Sequence {\n  linear = 'linear',\n  orchestrator = 'orchestrator',\n}\n\n/**\n * What kind of call produced a gateway generation — the `call_type` trace tag.\n * Splits a program's LLM spend by workload. Every member is sent explicitly so\n * an absent value means \"old build\", not \"agent\".\n */\nexport enum CallType {\n  /** The agent doing the work the user asked for. */\n  agent = 'agent',\n  /** Warlock's classifier deciding whether a YARA match is a true positive. */\n  yaraTriage = 'yara-triage',\n  /** The cheap repo scan that classifies which projects a program acts on. */\n  detection = 'detection',\n}\n\n// ── Integration / CLI ───────────────────────────────────────────────\n\n/**\n * Detection order matters: put framework-specific integrations BEFORE basic language fallbacks.\n */\nexport enum Integration {\n  // Frameworks\n  nextjs = 'nextjs',\n  nuxt = 'nuxt',\n  vue = 'vue',\n  reactRouter = 'react-router',\n  tanstackStart = 'tanstack-start',\n  tanstackRouter = 'tanstack-router',\n  reactNative = 'react-native',\n  angular = 'angular',\n  astro = 'astro',\n  django = 'django',\n  flask = 'flask',\n  fastapi = 'fastapi',\n  laravel = 'laravel',\n  sveltekit = 'sveltekit',\n  flutter = 'flutter',\n  kmp = 'kmp',\n  swift = 'swift',\n  android = 'android',\n  rails = 'rails',\n  elixir = 'elixir',\n  go = 'go',\n  rust = 'rust',\n  // Must stay after kmp/swift/android: those claim gradle projects first.\n  java = 'java',\n\n  // Language fallbacks. Keep javascriptNode last: it matches any package.json.\n  python = 'python',\n  ruby = 'ruby',\n  javascript_web = 'javascript_web',\n  javascriptNode = 'javascript_node',\n}\n\nexport interface Args {\n  debug: boolean;\n  integration: Integration;\n}\n\n// ── Environment ──────────────────────────────────────────────────────\n\nimport { IS_DEV } from '@env';\nimport {\n  CONTEXT_MILL_LOCAL_URL,\n  getLocalDev,\n  POSTHOG_LOCAL_URL,\n} from './local-dev';\nexport { IS_DEV };\nexport const DEBUG = false;\n\n// ── URLs ─────────────────────────────────────────────────────────────\n\nexport const DEFAULT_URL = IS_DEV\n  ? POSTHOG_LOCAL_URL\n  : 'https://us.posthog.com';\n/**\n * Region-agnostic PostHog app URL. Resolves to us.posthog.com or\n * eu.posthog.com server-side based on the signed-in user's profile.\n * Use this for share-with-user links (e.g. settings pages) so they\n * land on the right region without us needing to know it client-side.\n */\nexport const POSTHOG_APP_URL = IS_DEV\n  ? POSTHOG_LOCAL_URL\n  : 'https://app.posthog.com';\nexport const DEFAULT_HOST_URL = IS_DEV\n  ? POSTHOG_LOCAL_URL\n  : 'https://us.i.posthog.com';\nexport const ISSUES_URL = 'https://github.com/posthog/wizard/issues';\n/** Public status page, linked from transient-failure guidance (e.g. OAuth server_error). */\nexport const POSTHOG_STATUS_PAGE_URL = 'https://www.posthogstatus.com';\nexport const CONTEXT_MILL_URL = 'https://github.com/PostHog/context-mill';\n/**\n * Latest context-mill release page — the BYOAI download link shown in\n * the privacy panel. Deliberately the release PAGE, not a direct asset\n * URL: asset URLs are ~89 chars and hard-wrap inside the 64-col panel,\n * which corrupts terminal copy/paste with a mid-URL line break. This\n * stays under one line; the panel names the exact asset to grab.\n */\nexport const CONTEXT_MILL_RELEASES_URL =\n  'https://github.com/PostHog/context-mill/releases/latest';\nexport const POSTHOG_DOCS_URL = 'https://posthog.com/docs';\nexport const POSTHOG_WIZARD_REPO_URL = 'https://github.com/PostHog/wizard';\nexport const POSTHOG_TERMS_URL = 'https://posthog.com/terms';\nexport const POSTHOG_PRIVACY_URL = 'https://posthog.com/privacy';\nexport const POSTHOG_ORG_AI_SETTINGS_URL =\n  'https://app.posthog.com/settings/organization-details#setting=organization-ai-consent';\nexport const WIZARD_CONTACT_EMAIL = 'wizard@posthog.com';\n\n/**\n * Two origins for the same release, same filenames. Interchangeable bases, so\n * making AWS primary is a `getSkillsBaseUrl` change, not a code change.\n */\nexport const GITHUB_SKILLS_BASE_URL =\n  'https://github.com/PostHog/context-mill/releases/latest/download';\nexport const AWS_SKILLS_BASE_URL = 'https://context-mill.posthog.com/latest';\n/** Alias of `@lib/local-dev`'s constant, kept for existing importers. */\nexport const LOCAL_SKILLS_BASE_URL = CONTEXT_MILL_LOCAL_URL;\n\n/**\n * Driven by `--local-context-mill`, NOT `--local-mcp` (which used to select\n * both). Takes no argument on purpose: callers can't pass the wrong flag.\n */\nexport function getSkillsBaseUrl(): string {\n  return getLocalDev().localContextMill\n    ? LOCAL_SKILLS_BASE_URL\n    : GITHUB_SKILLS_BASE_URL;\n}\n\n// ── Analytics (internal) ──────────────────────────────────────────────\n\nexport const ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY = 'sTMFPsFhdP1Ssg';\nexport const ANALYTICS_HOST_URL = 'https://internal-j.posthog.com';\nexport const ANALYTICS_TEAM_TAG = 'docs-and-wizard';\n\n// ── OAuth / Auth ────────────────────────────────────────────────────\n\nexport const OAUTH_PORTS = [8239, 8238, 8240, 8237, 8236, 8235] as const;\nexport const POSTHOG_US_CLIENT_ID = 'c4Rdw8DIxgtQfA80IiSnGKlNX8QN00cFWF00QQhM';\nexport const POSTHOG_EU_CLIENT_ID = 'bx2C5sZRN03TkdjraCcetvQFPGH6N2Y9vRLkcKEy';\nexport const POSTHOG_DEV_CLIENT_ID = 'DC5uRLVbGI02YQ82grxgnK6Qn12SXWpCqdPb60oZ';\nexport const POSTHOG_PROXY_CLIENT_ID = POSTHOG_US_CLIENT_ID;\nexport const DUMMY_PROJECT_API_KEY = '_YOUR_POSTHOG_PROJECT_TOKEN_';\n\n/**\n * Scopes the wizard requests during the agentic provisioning signup flow.\n *\n * Each entry is justified by what the wizard's agent step does after signup:\n * - user:read         identify the user for analytics + agent context\n * - project:read      look up the freshly-provisioned project\n * - llm_gateway:read  authenticate to gateway.{us,eu}.posthog.com/wizard\n *                     (the agent's LLM calls — without this scope, every\n *                     agent message returns 401)\n * - query:read        run HogQL queries when the agent needs data\n * - dashboard:write   create the onboarding dashboard during setup\n * - insight:write     create the onboarding insights during setup\n * - notebook:write    upload the events-audit report as a PostHog notebook\n *                     in step 6 of the events-audit skill (notebooks-create\n *                     MCP tool requires this scope)\n * - event_definition:write\n *                     create event definitions from the completed wizard\n *                     session's event plan\n *\n * Must be a subset of `ALLOWED_PROVISIONING_SCOPES` in\n * `ee/api/agentic_provisioning/views.py` on the backend.\n */\nexport const WIZARD_PROVISIONING_SCOPES = [\n  'user:read',\n  'project:read',\n  'llm_gateway:read',\n  'dashboard:write',\n  'insight:write',\n  'query:read',\n  'notebook:write',\n  'event_definition:write',\n] as const;\n\n/**\n * Scopes the wizard requests during the OAuth login flow. Superset of\n * `WIZARD_PROVISIONING_SCOPES` with scopes that only apply to the login\n * path and are not in the provisioning allowlist:\n * - health_issue:read     used by `wizard doctor`\n * - wizard_session:read   list / retrieve / stream sessions\n * - wizard_session:write  stream run state to /api/projects/{id}/wizard/sessions/\n * - event_definition:write\n *                          create event definitions when a session completes\n * - organization:read     read `organization.is_ai_data_processing_approved`\n *                         from /api/users/@me/ for the AI opt-in gate\n *\n * NOTE: every scope here must be within the wizard OAuth application's\n * server-side scope ceiling (`OAuthApplication.scopes` in posthog, set\n * via Django admin on BOTH prod regions). A scope outside the ceiling\n * does NOT fail the authorize request — the server silently clamps the\n * request to the ceiling (`clamp_scopes_to_ceiling` in posthog) and the\n * token comes back without it. Separately, the consent screen lets the\n * user deselect any scope the app doesn't mark required. Both paths\n * yield a granted `scope` narrower than requested, with no error, so\n * never assume the token carries this list — the token response's\n * `scope` field is the truth, and `missingOAuthScopes` (utils/oauth.ts)\n * diffs it at login. Ceiling procedure: the \"scope-ceiling-invalid-scope\"\n * runbook in PostHog/runbooks. Keep its worked example in sync when this\n * list changes.\n */\nexport const WIZARD_OAUTH_SCOPES = [\n  ...WIZARD_PROVISIONING_SCOPES,\n  'health_issue:read',\n  'wizard_session:read',\n  'wizard_session:write',\n  'organization:read',\n] as const;\n\n// ── Wizard run / variants ───────────────────────────────────────────\n\nexport const WIZARD_INTERACTION_EVENT_NAME = 'wizard interaction';\nexport const WIZARD_REMARK_EVENT_NAME = 'wizard remark';\n/** Boolean feature flag that routes a run to the experimental orchestrator runner. */\nexport const WIZARD_ORCHESTRATOR_FLAG_KEY = 'wizard-orchestrator';\n/** Multivariate flag: per-stage orchestrator overrides ride each variant's JSON payload (`{stage: {model?, effort?}}`). */\nexport const WIZARD_ORCHESTRATOR_OVERRIDE_FLAG_KEY =\n  'wizard-orchestrator-override';\n/** Boolean flag: on → pi for self-driving. Payload carries `{model, effort?, harness?, sequence?}` (model = a `MODEL_FLAG_VARIANTS` key); missing/invalid payload keeps the non-flagged default. */\nexport const WIZARD_SELF_DRIVING_USE_PI_HARNESS_FLAG_KEY =\n  'wizard-self-driving-use-pi-harness';\n/** Boolean flag: agentic project scoping for non-interactive basic-integration runs. */\nexport const WIZARD_BASIC_INTEGRATION_AGENTIC_DETECTION_FLAG_KEY =\n  'wizard-basic-integration-agentic-detection';\n/** Boolean flag: the orchestrator queues the program's runner-seeded tasks (the warehouse step). Off, no task is queued and the run is byte-identical to a no-sources project. */\nexport const WIZARD_ORCHESTRATOR_SEEDED_TASKS_FLAG_KEY =\n  'wizard-orchestrator-seeded-tasks';\n// Reading a flag enters this run into that flag's experiment, so a closed set — not a\n// `wizard-` prefix anyone can name into — decides what a run evaluates. Test-pinned exhaustive.\nexport const WIZARD_FLAG_KEYS = [\n  WIZARD_ORCHESTRATOR_FLAG_KEY,\n  WIZARD_ORCHESTRATOR_OVERRIDE_FLAG_KEY,\n  WIZARD_ORCHESTRATOR_SEEDED_TASKS_FLAG_KEY,\n  WIZARD_SELF_DRIVING_USE_PI_HARNESS_FLAG_KEY,\n  WIZARD_BASIC_INTEGRATION_AGENTIC_DETECTION_FLAG_KEY,\n] as const;\n/** User-Agent for wizard HTTP requests and MCP server identification. */\nexport const WIZARD_USER_AGENT = `posthog/wizard; version: ${VERSION}`;\n\n/**\n * User-Agent for a specific program's MCP calls, tagged with `program: <id>` so the\n * backend can attribute work per program (e.g. the `self-driving` program's warehouse\n * sources are recorded as `created_via=self_driving` rather than plain `wizard`). The\n * base `posthog/wizard` token is preserved, so anything keying only on that still matches.\n */\nexport function wizardUserAgentForProgram(programId?: string): string {\n  return programId\n    ? `${WIZARD_USER_AGENT}; program: ${programId}`\n    : WIZARD_USER_AGENT;\n}\n\n// ── Timeouts ─────────────────────────────────────────────────────────\n\n/** Timeout for framework / project detection probes (ms). */\nexport const DETECTION_TIMEOUT_MS = 10_000;\n\n/** Timeout for the agentic project scan (ms); past it the run falls back to root detection. */\nexport const AGENTIC_DETECTION_TIMEOUT_MS = 60_000;\n\n/**\n * Timeout for the OAuth authorization flow (ms).\n *\n * How long the user has to complete the browser login. The authorization\n * code is minted at approval and exchanged immediately on callback, so the\n * server-side code expiry (`AUTHORIZATION_CODE_EXPIRE_SECONDS`, 5 minutes)\n * bounds only the approval→exchange gap — manual-paste users have 5 minutes\n * from approval to submit the code — not how long this window may stay open.\n */\nexport const OAUTH_TIMEOUT_MS = 1_800_000;\n","/**\n * WizardUI — abstraction layer for all user-facing operations.\n *\n * Business logic calls `getUI()` instead of importing the store directly.\n * Implementations: InkUI (TUI), LoggingUI (CI).\n *\n * No prompt methods — the TUI screens own all user input.\n * Session-mutating methods trigger reactive screen resolution in the TUI.\n */\n\nimport type { SettingsConflict } from '@lib/agent/claude-settings';\nimport type { WizardReadinessResult } from '@lib/health-checks/readiness';\nimport type { ApiUser } from '@lib/api';\nimport type { Credentials, TaskNotice } from '@lib/wizard-session';\nimport type {\n  AskAnswers,\n  OutroData,\n  PendingQuestion,\n} from '@lib/wizard-session';\n\nexport enum TaskStatus {\n  Pending = 'pending',\n  InProgress = 'in_progress',\n  Completed = 'completed',\n  Skipped = 'skipped',\n}\n\nexport function isTaskStatus(value: string): value is TaskStatus {\n  return (Object.values(TaskStatus) as string[]).includes(value);\n}\n\n/**\n * One assistant turn's token usage, for the hidden Ctrl+T token/cost HUD.\n * `model` is the model that produced *this* turn (e.g. the SDK's\n * `message.message.model`) — a subagent can run on a different model than\n * the main session, and some programs override to Haiku, so pricing must key\n * off the per-turn model rather than a single run-wide assumption. Omit only\n * when the caller genuinely has no model context (falls back to Sonnet\n * pricing — see `pricePerMtokForModel` in `@lib/agent/token-pricing`).\n */\nexport interface TokenUsageDelta {\n  inputTokens: number;\n  outputTokens: number;\n  cacheReadTokens: number;\n  cacheCreationTokens: number;\n  cacheCreation5m: number;\n  cacheCreation1h: number;\n  model?: string;\n}\n\nexport interface SpinnerHandle {\n  start(message?: string): void;\n  stop(message?: string): void;\n  message(msg?: string): void;\n}\n\n/**\n * Context passed to `showAuthError` so the screen can pick the right copy.\n *\n * `hasSettingsConflict` is true when a Claude Code settings file (project,\n * project-local, the user's global config, or managed) actually overrides the\n * LLM Gateway auth. `conflicts` carries the exact files and keys so the screen\n * can name them. When there is no conflict, the 401 has a different cause (bad\n * PAT prefix, missing scope, expired key, region mismatch) and we should not\n * advise the user to log out of Claude Code.\n */\nexport interface AuthErrorDetail {\n  hasSettingsConflict: boolean;\n  conflicts?: SettingsConflict[];\n  /**\n   * True when the agent SDK authenticated from a stored Claude login\n   * (`apiKeySource: \"/login managed key\"`) instead of the wizard's gateway\n   * token — conflicting Anthropic credentials. Takes priority in the screen.\n   */\n  usingManagedLogin?: boolean;\n  /** Human-readable places a conflicting Anthropic credential may live. */\n  credentialPlaces?: string[];\n  /**\n   * True when a pre-run refresh already failed on a dead grant. The login is\n   * gone and re-running is the only fix, so this outranks every other branch —\n   * none of the usual advice (key type, scopes, region) applies.\n   */\n  sessionExpired?: boolean;\n  logFilePath: string;\n}\n\nexport interface WizardUI {\n  // ── Lifecycle messages ────────────────────────────────────────────\n  intro(message: string): void;\n  /** Success outro with a plain text message. */\n  outro(message: string): void;\n  /**\n   * Error outro. Sets structured outroData and transitions run phase so\n   * the router advances to the outro screen. Use for abort/failure paths\n   * that need a custom error render — do NOT build the outroData by\n   * mutating session directly (nanostore holds a shallow copy).\n   */\n  outroError(data: OutroData): void;\n  /** Resolves when the user dismisses the outro screen (presses any key).\n   *  Lets the abort path wait for the user to read the error before the\n   *  process exits. Resolves immediately in non-TUI environments. */\n  waitForOutroDismissed(): Promise<void>;\n  cancel(message: string): void;\n\n  // ── Logging ───────────────────────────────────────────────────────\n  log: {\n    info(message: string): void;\n    warn(message: string): void;\n    error(message: string): void;\n    success(message: string): void;\n    step(message: string): void;\n  };\n\n  note(message: string): void;\n  pushStatus(message: string): void;\n\n  // ── Spinner ───────────────────────────────────────────────────────\n  spinner(): SpinnerHandle;\n\n  // ── Session state (triggers reactive screen resolution in TUI) ────\n  /** Signal that the main work (agent run) has started. */\n  startRun(): void;\n\n  /** Store OAuth/API credentials. Resolves past AuthScreen in TUI. */\n  setCredentials(credentials: Credentials): void;\n\n  /**\n   * Replace the credentials after a token refresh. Same store write as\n   * {@link setCredentials} without the `auth complete` capture — the user\n   * authenticated once, and a refresh is not a second login.\n   */\n  setAccessToken(credentials: Credentials): void;\n\n  /**\n   * Persist the user's `role_at_organization` once it's been fetched from\n   * `/api/users/@me/`. Drives role-tailored prompt suggestions on the\n   * McpSuggestedPromptsScreen. Pass `null` to clear / when unknown.\n   */\n  setRoleAtOrganization(role: string | null): void;\n\n  /**\n   * Persist the full user payload from `/api/users/@me/` so downstream\n   * screens can read account context (current org, team, plan, email,\n   * preferences, etc.) without re-fetching. Pass `null` to clear or\n   * when the request failed.\n   */\n  setApiUser(user: ApiUser | null): void;\n\n  /**\n   * Park until the org's AI opt-in gate clears\n   * (`organization.is_ai_data_processing_approved === true`, or the\n   * program never registered the gate — requiresAi: false / no auth\n   * step / CI session). The agent runner awaits this after setApiUser\n   * and BEFORE skill install or agent start: this is the enforcement\n   * point that keeps source on the machine while the TUI shows\n   * AiOptInRequiredScreen. Resolves immediately in non-TUI\n   * environments (CI auto-consents to AI usage).\n   */\n  waitForAiOptIn(): Promise<void>;\n\n  /** Show blocking service outage (pushes outage overlay in TUI). Blocks until dismissed. */\n  showBlockingOutage(result: WizardReadinessResult): Promise<void>;\n\n  /** Store non-blocking readiness warnings (shown as Health tab in RunScreen). */\n  setReadinessWarnings(result: WizardReadinessResult): void;\n\n  /** Warn that another process is blocking the OAuth port (pushes overlay in TUI). */\n  showPortConflict(processInfo: {\n    command: string;\n    pid: string;\n    port: number;\n    user: string;\n  }): Promise<void>;\n\n  /**\n   * Resolve with an OAuth authorization code the user enters by hand — the\n   * fallback for headless/remote shells where the browser can't reach the\n   * local callback server. The OAuth flow races this against the callback\n   * server. Implementations that can't prompt (CI/logging) never resolve.\n   */\n  waitForManualAuthCode(): Promise<string>;\n\n  showSettingsOverride(\n    conflicts: SettingsConflict[],\n    backupAndFix: () => boolean,\n  ): Promise<void>;\n\n  /**\n   * Show an optional step's notice and return whether to keep that step. Hosts\n   * that cannot prompt resolve false: a step nobody can answer must not run.\n   */\n  showTaskNotice(notice: TaskNotice): Promise<boolean>;\n\n  /**\n   * Dismiss an in-flight task notice as declined. Called when the offer times\n   * out: the notice sits in front of the run's final steps, so left unanswered\n   * it would hold the report behind a modal nobody is looking at.\n   */\n  cancelTaskNotice(): void;\n\n  /** Show auth error overlay when Anthropic API returns 401. */\n  showAuthError(detail?: AuthErrorDetail): void;\n\n  /** Show the session-timeout overlay when the OAuth login window expires. */\n  showSessionTimeout(): void;\n\n  /**\n   * Open the wizard_ask overlay and resolve with the user's answers.\n   * Implementations that can't ask (CI/logging) reject so the bridge can\n   * surface a clear \"not available\" error to the agent.\n   */\n  requestQuestion(question: PendingQuestion): Promise<AskAnswers>;\n\n  /**\n   * Dismiss the in-flight wizard_ask overlay, resolving its request with\n   * cancelled sentinels. No-op when nothing is pending. The ask bridge calls\n   * this on timeout so a stale pending question can't block later asks.\n   */\n  cancelPendingQuestion(): void;\n\n  // ── Display state ──────────────────────────────────────────────────\n  /** Set the detected framework label (e.g., \"Django with Wagtail CMS\") */\n  setDetectedFramework(label: string): void;\n\n  /** Register a callback to run when the TUI transitions onto the given screen. */\n  onEnterScreen(screen: string, fn: () => void): void;\n\n  setLoginUrl(url: string | null): void;\n\n  /** Direct PostHog authorize URL, shown in the manual-paste modal. */\n  setAuthorizeUrl(url: string | null): void;\n\n  // ── Task tracking from SDK TaskCreate/TaskUpdate events ───────────\n  // Receives the full materialised task list each call. The caller (agent\n  // loop) maintains a Map<taskId, …> from incremental Task* events and\n  // re-emits the snapshot here, preserving the existing store semantics.\n  syncTodos(\n    todos: Array<{ content: string; status: string; activeForm?: string }>,\n  ): void;\n\n  // ── Event plan from .posthog-events.json ────────────────────\n  setEventPlan(events: Array<{ name: string; description: string }>): void;\n\n  // ── Dashboard URL emitted by the agent via [DASHBOARD_URL] marker ──\n  setDashboardUrl(url: string): void;\n\n  /** Current \"stage of work\" — derived from the active tool call. Drives the\n   *  Visualizer tab's NOW PLAYING display. Pass an AgentPhase value. */\n  setStage(stage: string): void;\n\n  // ── Notebook URL emitted by the agent via [NOTEBOOK_URL] marker ──\n  setNotebookUrl(url: string): void;\n\n  /** Handoff doc from the `publish_handoff` tool; the task-stream push carries it as `handoff_text`. */\n  setHandoffText(text: string): void;\n\n  /** Accumulate one assistant turn's token usage into the hidden Ctrl+T\n   *  token/cost HUD's running estimate. No-op outside the TUI. */\n  addTokenUsage(delta: TokenUsageDelta): void;\n\n  /** Reconcile the HUD's running cost estimate to the SDK's authoritative\n   *  `total_cost_usd` once the agent run completes. No-op outside the TUI. */\n  setFinalTokenCostUsd(costUsd: number): void;\n\n  // ── Outro payload built by agent-runner ──\n  // Replaces the direct `session.outroData = X` mutation that breaks once\n  // setKey-based store mutations have forked the session reference.\n  setOutroData(data: OutroData): void;\n\n  // ── Generic frameworkContext setter for program file watchers ─────\n  setFrameworkContext(key: string, value: unknown): void;\n\n  /** Read a frameworkContext value from the LIVE session (store may have\n   * forked the reference the runner holds). Used by run configs to read\n   * values written by post-auth screens (e.g. the source-maps picker). */\n  getFrameworkContext(key: string): unknown;\n\n  /** Park until the named program step's gate predicate flips true. Resolves\n   * immediately if the step has no gate. Mirrors waitForAiOptIn for any\n   * post-auth interactive step the agent run must wait on. */\n  waitForGate(stepId: string): Promise<void>;\n}\n","import {\n  ServiceHealthStatus,\n  type BaseHealthResult,\n  type ComponentHealthResult,\n} from './types';\n\n// ---------------------------------------------------------------------------\n// Statuspage.io v2 API helpers\n// https://metastatuspage.com/api\n//\n// status.json  – page-level rollup; indicator is one of: none | minor | major | critical\n// summary.json – same rollup + component list; component status is one of:\n//   operational | degraded_performance | partial_outage | major_outage | under_maintenance\n//   https://support.atlassian.com/statuspage/docs/show-service-status-with-components\n// ---------------------------------------------------------------------------\n\ninterface StatuspageStatusResponse {\n  status?: { indicator?: string; description?: string };\n}\n\ninterface StatuspageSummaryResponse extends StatuspageStatusResponse {\n  components?: { id: string; name: string; status: string }[];\n}\n\nfunction mapIndicator(v: string | null | undefined): ServiceHealthStatus {\n  switch (v) {\n    case 'none':\n      return ServiceHealthStatus.Healthy;\n    case 'minor':\n      return ServiceHealthStatus.Degraded;\n    case 'major':\n    case 'critical':\n      return ServiceHealthStatus.Down;\n    default:\n      return ServiceHealthStatus.Degraded;\n  }\n}\n\nfunction mapComponentRaw(v: string | null | undefined): ServiceHealthStatus {\n  switch (v) {\n    case 'operational':\n      return ServiceHealthStatus.Healthy;\n    case 'degraded_performance':\n    case 'under_maintenance':\n      return ServiceHealthStatus.Degraded;\n    case 'partial_outage':\n    case 'major_outage':\n      return ServiceHealthStatus.Down;\n    default:\n      return ServiceHealthStatus.Degraded;\n  }\n}\n\nfunction errResult(error: string): BaseHealthResult {\n  return { status: ServiceHealthStatus.Degraded, error };\n}\n\nasync function fetchStatuspageIndicator(\n  url: string,\n  timeoutMs = 5000,\n): Promise<BaseHealthResult> {\n  try {\n    const controller = new AbortController();\n    const tid = setTimeout(() => controller.abort(), timeoutMs);\n    const res = await fetch(url, { signal: controller.signal });\n    clearTimeout(tid);\n\n    if (!res.ok) return errResult(`HTTP ${res.status}`);\n\n    const data = (await res.json()) as StatuspageStatusResponse;\n    const indicator = data.status?.indicator ?? null;\n    return {\n      status: mapIndicator(indicator),\n      rawIndicator: indicator ?? undefined,\n    };\n  } catch (e) {\n    if (e instanceof Error && e.name === 'AbortError')\n      return errResult('Request timed out');\n    return errResult(e instanceof Error ? e.message : 'Unknown error');\n  }\n}\n\nasync function fetchStatuspageSummary(\n  url: string,\n  timeoutMs = 5000,\n): Promise<ComponentHealthResult> {\n  try {\n    const controller = new AbortController();\n    const tid = setTimeout(() => controller.abort(), timeoutMs);\n    const res = await fetch(url, { signal: controller.signal });\n    clearTimeout(tid);\n\n    if (!res.ok) return errResult(`HTTP ${res.status}`);\n\n    const data = (await res.json()) as StatuspageSummaryResponse;\n    const indicator = data.status?.indicator ?? null;\n    const overall = mapIndicator(indicator);\n\n    const affected = (data.components ?? [])\n      .map((c) => ({\n        name: c.name,\n        status: mapComponentRaw(c.status),\n        rawStatus: c.status,\n      }))\n      .filter((c) => c.status !== ServiceHealthStatus.Healthy);\n\n    return {\n      status: affected.length > 0 ? ServiceHealthStatus.Degraded : overall,\n      rawIndicator: indicator ?? undefined,\n      degradedOrDownComponents: affected.length > 0 ? affected : undefined,\n    };\n  } catch (e) {\n    if (e instanceof Error && e.name === 'AbortError')\n      return errResult('Request timed out');\n    return errResult(e instanceof Error ? e.message : 'Unknown error');\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Individual statuspage-backed checks\n// ---------------------------------------------------------------------------\n\nexport const checkAnthropicHealth = (): Promise<BaseHealthResult> =>\n  fetchStatuspageIndicator('https://status.claude.com/api/v2/status.json');\n\nexport const checkGithubHealth = (): Promise<BaseHealthResult> =>\n  fetchStatuspageIndicator('https://www.githubstatus.com/api/v2/status.json');\n\nexport const checkNpmOverallHealth = (): Promise<BaseHealthResult> =>\n  fetchStatuspageIndicator('https://status.npmjs.org/api/v2/status.json');\n\nexport const checkNpmComponentHealth = (): Promise<ComponentHealthResult> =>\n  fetchStatuspageSummary('https://status.npmjs.org/api/v2/summary.json');\n\nexport const checkCloudflareOverallHealth = (): Promise<BaseHealthResult> =>\n  fetchStatuspageIndicator(\n    'https://www.cloudflarestatus.com/api/v2/status.json',\n  );\n\nexport const checkCloudflareComponentHealth =\n  (): Promise<ComponentHealthResult> =>\n    fetchStatuspageSummary(\n      'https://www.cloudflarestatus.com/api/v2/summary.json',\n    );\n","import {\n  ServiceHealthStatus,\n  type BaseHealthResult,\n  type ComponentHealthResult,\n  type ComponentStatus,\n} from './types';\n\ninterface IncidentIoAffectedComponent {\n  id: string;\n  name: string;\n  group_name?: string;\n  current_status: string;\n}\n\ninterface IncidentIoIncident {\n  id: string;\n  name: string;\n  status: string;\n  current_worst_impact: string;\n  affected_components: IncidentIoAffectedComponent[];\n}\n\ninterface IncidentIoSummary {\n  ongoing_incidents: IncidentIoIncident[];\n  in_progress_maintenances: unknown[];\n}\n\nfunction mapIncidentImpact(impact: string): ServiceHealthStatus {\n  switch (impact) {\n    case 'full_outage':\n      return ServiceHealthStatus.Down;\n    case 'partial_outage':\n    case 'degraded_performance':\n      return ServiceHealthStatus.Degraded;\n    default:\n      return ServiceHealthStatus.Degraded;\n  }\n}\n\nfunction mapComponentStatus(status: string): ServiceHealthStatus {\n  switch (status) {\n    case 'operational':\n      return ServiceHealthStatus.Healthy;\n    case 'full_outage':\n      return ServiceHealthStatus.Down;\n    case 'partial_outage':\n    case 'degraded_performance':\n      return ServiceHealthStatus.Degraded;\n    default:\n      return ServiceHealthStatus.Degraded;\n  }\n}\n\n/**\n * Build an error result for fetch failures. The kind matters for\n * downstream reconciliation:\n *\n *   - 'http' (incident.io returned a bad status code) → `Down`. We\n *     reached the status page but it told us something is wrong on\n *     its side. We have a definitive response.\n *   - 'network' (timeout, DNS failure, TCP/TLS failure) → `NoConnection`.\n *     We never reached the status page. Treating this as `Degraded`\n *     (the previous behavior) silently flipped the reconciliation in\n *     `readiness.ts` from \"soft\" to \"confirmed outage\" whenever the\n *     user's own network was flaky — exactly the false positive this\n *     module is meant to help diagnose.\n */\nfunction errResult(error: string, kind: 'http' | 'network'): BaseHealthResult {\n  return {\n    status:\n      kind === 'http'\n        ? ServiceHealthStatus.Down\n        : ServiceHealthStatus.NoConnection,\n    error,\n  };\n}\n\nconst POSTHOG_STATUS_URL = 'https://www.posthogstatus.com/api/v1/summary';\n\nasync function fetchPosthogStatus(\n  timeoutMs = 5000,\n): Promise<{ overall: BaseHealthResult; components: ComponentHealthResult }> {\n  try {\n    const controller = new AbortController();\n    const tid = setTimeout(() => controller.abort(), timeoutMs);\n    const res = await fetch(POSTHOG_STATUS_URL, { signal: controller.signal });\n    clearTimeout(tid);\n\n    if (!res.ok) {\n      const err = errResult(`HTTP ${res.status}`, 'http');\n      return { overall: err, components: err };\n    }\n\n    const data = (await res.json()) as IncidentIoSummary;\n    const incidents = data.ongoing_incidents ?? [];\n\n    if (incidents.length === 0) {\n      return {\n        overall: { status: ServiceHealthStatus.Healthy },\n        components: { status: ServiceHealthStatus.Healthy },\n      };\n    }\n\n    let worstOverall = ServiceHealthStatus.Degraded;\n    const affected: ComponentStatus[] = [];\n\n    for (const incident of incidents) {\n      const impact = mapIncidentImpact(incident.current_worst_impact);\n      if (impact === ServiceHealthStatus.Down) {\n        worstOverall = ServiceHealthStatus.Down;\n      }\n\n      for (const comp of incident.affected_components ?? []) {\n        const compStatus = mapComponentStatus(comp.current_status);\n        if (compStatus !== ServiceHealthStatus.Healthy) {\n          affected.push({\n            name: comp.group_name\n              ? `${comp.group_name} — ${comp.name}`\n              : comp.name,\n            status: compStatus,\n            rawStatus: comp.current_status,\n          });\n        }\n      }\n    }\n\n    return {\n      overall: { status: worstOverall },\n      components: {\n        status:\n          affected.length > 0 ? ServiceHealthStatus.Degraded : worstOverall,\n        degradedOrDownComponents: affected.length > 0 ? affected : undefined,\n      },\n    };\n  } catch (e) {\n    if (e instanceof Error && e.name === 'AbortError') {\n      const err = errResult('Request timed out', 'network');\n      return { overall: err, components: err };\n    }\n    const err = errResult(\n      e instanceof Error ? e.message : 'Unknown error',\n      'network',\n    );\n    return { overall: err, components: err };\n  }\n}\n\nlet _cache: Promise<{\n  overall: BaseHealthResult;\n  components: ComponentHealthResult;\n}> | null = null;\n\nfunction getPosthogHealth() {\n  if (!_cache) _cache = fetchPosthogStatus();\n  return _cache;\n}\n\nexport function resetPosthogHealthCache(): void {\n  _cache = null;\n}\n\nexport const checkPosthogOverallHealth = async (): Promise<BaseHealthResult> =>\n  (await getPosthogHealth()).overall;\n\nexport const checkPosthogComponentHealth =\n  async (): Promise<ComponentHealthResult> =>\n    (await getPosthogHealth()).components;\n","import { AWS_SKILLS_BASE_URL, GITHUB_SKILLS_BASE_URL } from '@lib/constants';\nimport { logToFile } from '@utils/debug';\nimport { ServiceHealthStatus, type BaseHealthResult } from './types';\n\n// ---------------------------------------------------------------------------\n// Direct endpoint health checks\n//\n// These ping PostHog-owned services directly (no Statuspage intermediary).\n// Result taxonomy:\n//   - HTTP 2xx-3xx (per `isExpectedStatus`)        → Healthy\n//   - HTTP 4xx / 5xx                                → Down (confirmed)\n//   - Network error / DNS / timeout (after retries) → NoConnection\n// NoConnection means we don't know whose fault it is; readiness reconciles\n// against the status page before deciding how to surface it to the user.\n//\n// MCP – Cloudflare Worker\n//   Source: posthog/services/mcp/src/index.ts\n//   GET / → 302 to posthog.com docs. The redirect proves the worker is up.\n//\n// Skills download – context-mill releases\n//   GET <origin>/skill-menu.json on both origins; see checkSkillsOriginHealth.\n// ---------------------------------------------------------------------------\n\nfunction noConnectionResult(error: string, attempts: number): BaseHealthResult {\n  return {\n    status: ServiceHealthStatus.NoConnection,\n    error,\n    rawIndicator: attempts > 1 ? `attempts=${attempts}` : undefined,\n  };\n}\n\nfunction downResult(error: string): BaseHealthResult {\n  return { status: ServiceHealthStatus.Down, error };\n}\n\n// Backoffs sized to cover typical wifi flakiness — a single dropped\n// packet recovers via the 500ms retry; a wifi access point reconnect\n// or wifi↔LTE handoff (2-5s) is caught by the 2000ms retry. Tighter\n// schedules miss multi-second blips because all retries land in the\n// same dead window.\nconst RETRY_BACKOFFS_MS = [500, 2000];\n\nasync function attemptFetch(\n  url: string,\n  timeoutMs: number,\n  redirect: 'follow' | 'manual' | 'error',\n): Promise<\n  | { kind: 'response'; res: Response }\n  | { kind: 'error'; error: Error; timedOut: boolean }\n> {\n  const controller = new AbortController();\n  const tid = setTimeout(() => controller.abort(), timeoutMs);\n  try {\n    const res = await fetch(url, { signal: controller.signal, redirect });\n    clearTimeout(tid);\n    return { kind: 'response', res };\n  } catch (e) {\n    clearTimeout(tid);\n    const err = e instanceof Error ? e : new Error('Unknown error');\n    return { kind: 'error', error: err, timedOut: err.name === 'AbortError' };\n  }\n}\n\n// Exported so tests can pin the retry/taxonomy machinery directly.\nexport async function fetchEndpointHealth(\n  url: string,\n  timeoutMs = 5000,\n  isExpectedStatus: (status: number) => boolean = (s) => s === 200,\n  redirect: 'follow' | 'manual' | 'error' = 'follow',\n): Promise<BaseHealthResult> {\n  // Total attempts = 1 initial + RETRY_BACKOFFS_MS.length retries. Both\n  // unexpected HTTP statuses (4xx/5xx) and network errors trigger a retry:\n  // transient 5xx and Cloudflare edge blips often recover on a retry, and\n  // even nominally deterministic 4xx can be transient (CDN propagation\n  // lag after a release, token rotation, rate-limit window resets). GETs\n  // are idempotent so retrying is safe.\n  //\n  // Final status if every attempt fails:\n  //   - At least one HTTP response observed → `Down` (server-side evidence)\n  //   - Only network errors observed         → `NoConnection`\n  let lastHttpStatus: number | null = null;\n  let lastError = 'Unknown error';\n  let attempts = 0;\n\n  for (let i = 0; i <= RETRY_BACKOFFS_MS.length; i++) {\n    if (i > 0) {\n      const wait = RETRY_BACKOFFS_MS[i - 1];\n      logToFile(\n        `[health-checks] retry ${i}/${RETRY_BACKOFFS_MS.length} for ${url} in ${wait}ms (last: ${lastError})`,\n      );\n      await new Promise((r) => setTimeout(r, wait));\n    }\n    attempts++;\n\n    const outcome = await attemptFetch(url, timeoutMs, redirect);\n\n    if (outcome.kind === 'response') {\n      const res = outcome.res;\n      if (isExpectedStatus(res.status)) {\n        const result: BaseHealthResult = {\n          status: ServiceHealthStatus.Healthy,\n          rawIndicator:\n            attempts > 1\n              ? `HTTP ${res.status} (attempts=${attempts})`\n              : `HTTP ${res.status}`,\n        };\n        logToFile(\n          `[health-checks] GET ${url} -> ${result.status}` +\n            ` (${result.rawIndicator})`,\n        );\n        return result;\n      }\n      lastHttpStatus = res.status;\n      lastError = `HTTP ${res.status}`;\n      continue;\n    }\n\n    lastError = outcome.timedOut\n      ? `Request timed out after ${timeoutMs}ms`\n      : outcome.error.message;\n  }\n\n  const result =\n    lastHttpStatus !== null\n      ? downResult(\n          `HTTP ${lastHttpStatus} (attempts=${attempts})`,\n          lastHttpStatus,\n        )\n      : noConnectionResult(lastError, attempts);\n  logToFile(\n    `[health-checks] GET ${url} -> ${result.status}` +\n      ` (attempts=${attempts}, ${result.error})`,\n  );\n  return result;\n}\n\nexport const checkMcpHealth = (): Promise<BaseHealthResult> =>\n  fetchEndpointHealth(\n    'https://mcp.posthog.com/',\n    5000,\n    // 2xx-3xx counts as up (redirect to docs)\n    (s) => s >= 200 && s < 400,\n    'manual',\n  );\n\n/**\n * Skills are published to two origins under the same filenames and\n * `fetchWithRetry` fails over between them, so the run is only blocked when\n * neither answers. Probed in parallel — sequential probes would double the\n * worst case past `READINESS_TIMEOUT_MS`.\n */\nexport const checkSkillsOriginHealth = async (): Promise<BaseHealthResult> => {\n  const [github, aws] = await Promise.all([\n    fetchEndpointHealth(`${GITHUB_SKILLS_BASE_URL}/skill-menu.json`),\n    fetchEndpointHealth(`${AWS_SKILLS_BASE_URL}/skill-menu.json`),\n  ]);\n  return combineOriginHealth(github, aws);\n};\n\n/**\n * Mirrors `fetchWithRetry`: a download tries GitHub, then AWS, so the run is\n * only blocked when neither origin answers. Whichever failure the probes saw,\n * one origin serving means skills are reachable.\n */\nfunction combineOriginHealth(\n  github: BaseHealthResult,\n  aws: BaseHealthResult,\n): BaseHealthResult {\n  if (github.status === ServiceHealthStatus.Healthy) {\n    // Naming the dead origin makes a one-sided outage legible in the log and\n    // in the readiness reasons, where the status alone reads as \"fine\".\n    return aws.status === ServiceHealthStatus.Healthy\n      ? github\n      : withIndicatorSuffix(github, 'aws unavailable');\n  }\n\n  if (aws.status === ServiceHealthStatus.Healthy) {\n    return withIndicatorSuffix(aws, 'via aws, github unavailable');\n  }\n\n  const error = `github: ${github.error ?? 'unknown'} | aws: ${\n    aws.error ?? 'unknown'\n  }`;\n  const confirmedDown =\n    github.status === ServiceHealthStatus.Down ||\n    aws.status === ServiceHealthStatus.Down;\n  return {\n    status: confirmedDown\n      ? ServiceHealthStatus.Down\n      : ServiceHealthStatus.NoConnection,\n    error,\n    // Keeps the `attempts=N` the blocked-readiness analytics parses.\n    rawIndicator: github.rawIndicator ?? aws.rawIndicator,\n  };\n}\n\nfunction withIndicatorSuffix(\n  result: BaseHealthResult,\n  suffix: string,\n): BaseHealthResult {\n  return {\n    ...result,\n    rawIndicator: result.rawIndicator\n      ? `${result.rawIndicator} (${suffix})`\n      : suffix,\n  };\n}\n","import {\n  ServiceHealthStatus,\n  type AllServicesHealth,\n  type BaseHealthResult,\n  type ComponentHealthResult,\n  type HealthCheckKey,\n} from './types';\nimport {\n  checkAnthropicHealth,\n  checkGithubHealth,\n  checkNpmOverallHealth,\n  checkNpmComponentHealth,\n  checkCloudflareOverallHealth,\n  checkCloudflareComponentHealth,\n} from './statuspage';\nimport {\n  checkPosthogOverallHealth,\n  checkPosthogComponentHealth,\n} from './incidentio';\nimport { checkMcpHealth, checkSkillsOriginHealth } from './endpoints';\nimport { logToFile } from '@utils/debug';\n\n// ---------------------------------------------------------------------------\n// Service labels (used in human-readable reason strings)\n// ---------------------------------------------------------------------------\n\nexport const SERVICE_LABELS: Record<HealthCheckKey, string> = {\n  anthropic: 'Anthropic',\n  posthogOverall: 'PostHog',\n  posthogComponents: 'PostHog (components)',\n  github: 'GitHub',\n  npmOverall: 'npm',\n  npmComponents: 'npm (components)',\n  cloudflareOverall: 'Cloudflare',\n  cloudflareComponents: 'Cloudflare (components)',\n  mcp: 'MCP',\n  skillsOrigin: 'Skills download',\n};\n\n// ---------------------------------------------------------------------------\n// Readiness config\n// ---------------------------------------------------------------------------\n\nexport interface WizardReadinessConfig {\n  /** Services where status=Down blocks the run (readiness=No). */\n  downBlocksRun: HealthCheckKey[];\n  /** Services where status=Degraded (or worse) blocks the run (readiness=No). */\n  degradedBlocksRun?: HealthCheckKey[];\n}\n\n/**\n * See README section \"Health checks\" for the full rationale.\n * Adjust these arrays to change what blocks a wizard run.\n *\n * The AI gateway is not probed: its URL is only known from the run's token\n * mint, and a failed mint already stops the run at bootstrap with the\n * server's reason.\n */\nexport const DEFAULT_WIZARD_READINESS_CONFIG: WizardReadinessConfig = {\n  downBlocksRun: ['anthropic', 'npmOverall', 'mcp', 'skillsOrigin'],\n  degradedBlocksRun: ['anthropic'],\n};\n\n/**\n * Reduced readiness config for --signup provisioning flows.\n *\n * Provisioning only needs PostHog - it doesn't use Anthropic directly, npm,\n * the skills origins, or MCP.\n */\nexport const SIGNUP_WIZARD_READINESS_CONFIG: WizardReadinessConfig = {\n  downBlocksRun: ['posthogOverall'],\n};\n\n// ---------------------------------------------------------------------------\n// Aggregate check\n// ---------------------------------------------------------------------------\n\nexport async function checkAllExternalServices(): Promise<AllServicesHealth> {\n  const [\n    anthropic,\n    posthogOverall,\n    posthogComponents,\n    github,\n    npmOverall,\n    npmComponents,\n    cloudflareOverall,\n    cloudflareComponents,\n    mcp,\n    skillsOrigin,\n  ] = await Promise.all([\n    checkAnthropicHealth(),\n    checkPosthogOverallHealth(),\n    checkPosthogComponentHealth(),\n    checkGithubHealth(),\n    checkNpmOverallHealth(),\n    checkNpmComponentHealth(),\n    checkCloudflareOverallHealth(),\n    checkCloudflareComponentHealth(),\n    checkMcpHealth(),\n    checkSkillsOriginHealth(),\n  ]);\n\n  const health: AllServicesHealth = {\n    anthropic,\n    posthogOverall,\n    posthogComponents,\n    github,\n    npmOverall,\n    npmComponents,\n    cloudflareOverall,\n    cloudflareComponents,\n    mcp,\n    skillsOrigin,\n  };\n  return reconcilePosthogReachability(health);\n}\n\n/**\n * When a PostHog-owned endpoint probe returns `NoConnection`, decide\n * whether it's a real outage or a likely-local issue by checking the\n * official status page (`posthogstatus.com`):\n *\n *   - Status page says PostHog is `Down` / `Degraded` → upgrade\n *     mcp to `Down`. The status page corroborates.\n *   - Status page is `Healthy` → keep `NoConnection`. The status page\n *     contradicts; this is probably the user's network.\n *   - Status page is also `NoConnection` → keep `NoConnection`. User\n *     can't reach two independent PostHog properties; almost\n *     certainly their network. (This case relies on incidentio.ts\n *     correctly emitting `NoConnection` for fetch failures rather\n *     than the previous `Degraded`, which used to silently flip the\n *     reconciliation into a false positive.)\n *\n * Why `Degraded` corroborates: a `Degraded` reading here only fires\n * when incident.io's API parsed successfully and reported a real\n * `partial_outage` or `degraded_performance` for some component. That's\n * PostHog acknowledging an issue, even if narrower than a full outage.\n * If our MCP probe is also failing, those two signals together\n * justify pointing at PostHog rather than the user.\n *\n * A narrower variant — only corroborate when the affected component is\n * MCP-related (US/EU Cloud, app) — would be more precise. We\n * have the data in `posthogComponents` but don't use it here. If the\n * analytics show false positives concentrated in this case, it's a\n * cheap follow-up.\n *\n * Mutates a copy of `health` and returns it.\n */\nexport function reconcilePosthogReachability(\n  health: AllServicesHealth,\n): AllServicesHealth {\n  const posthogStatus = health.posthogOverall.status;\n  const corroboratesOutage =\n    posthogStatus === ServiceHealthStatus.Down ||\n    posthogStatus === ServiceHealthStatus.Degraded;\n\n  if (!corroboratesOutage) return health;\n\n  const upgrade = (r: BaseHealthResult): BaseHealthResult =>\n    r.status === ServiceHealthStatus.NoConnection\n      ? {\n          ...r,\n          status: ServiceHealthStatus.Down,\n          error: r.error\n            ? `${r.error} (corroborated by status page)`\n            : 'corroborated by status page',\n        }\n      : r;\n\n  return {\n    ...health,\n    mcp: upgrade(health.mcp),\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Wizard readiness evaluation\n// ---------------------------------------------------------------------------\n\nexport enum WizardReadiness {\n  Yes = 'yes',\n  No = 'no',\n  YesWithWarnings = 'yes_with_warnings',\n}\n\nexport interface WizardReadinessResult {\n  decision: WizardReadiness;\n  health: AllServicesHealth;\n  reasons: string[];\n}\n\nfunction describeResult(label: string, h: BaseHealthResult): string {\n  const parts = [`${label}: ${h.status}`];\n  if (h.rawIndicator) parts.push(`indicator=${h.rawIndicator}`);\n  if (h.error) parts.push(h.error);\n  return parts.join(' — ');\n}\n\nconst MAX_COMPONENT_NAMES = 8;\n\nfunction describeComponents(label: string, h: ComponentHealthResult): string {\n  const affected = h.degradedOrDownComponents;\n  if (!affected || affected.length === 0)\n    return `${label} components: all operational`;\n  const shown = affected\n    .slice(0, MAX_COMPONENT_NAMES)\n    .map((c) => `${c.name} (${c.status})`);\n  const suffix =\n    affected.length > MAX_COMPONENT_NAMES\n      ? `, +${affected.length - MAX_COMPONENT_NAMES} more`\n      : '';\n  return `${label} components impacted: ${shown.join(', ')}${suffix}`;\n}\n\n// Each probe can take up to one base timeout + two retries with the\n// 500ms / 2000ms backoffs in endpoints.ts (worst case ~17.5s for a\n// network failure that exhausts retries). Probes run in parallel so\n// the aggregate ceiling is one probe, not the sum.\nconst READINESS_TIMEOUT_MS = 20_000;\n\nexport async function evaluateWizardReadiness(\n  config: WizardReadinessConfig = DEFAULT_WIZARD_READINESS_CONFIG,\n): Promise<WizardReadinessResult> {\n  try {\n    const health = await Promise.race([\n      checkAllExternalServices(),\n      new Promise<AllServicesHealth>((resolve) =>\n        setTimeout(\n          () => resolve(allUnknown('Health check timed out')),\n          READINESS_TIMEOUT_MS,\n        ),\n      ),\n    ]);\n\n    const reasons: string[] = [];\n\n    for (const key of Object.keys(health) as HealthCheckKey[]) {\n      const result = health[key];\n      const label = SERVICE_LABELS[key];\n\n      reasons.push(describeResult(label, result));\n\n      if ('degradedOrDownComponents' in result) {\n        reasons.push(describeComponents(label, result));\n      }\n    }\n\n    const blockingKeys = getBlockingServiceKeys(health, config);\n    if (blockingKeys.length > 0) {\n      const blockingDetails = blockingKeys.map((key) => {\n        const h = health[key];\n        return `${key} (${h.status}${h.error ? ` — ${h.error}` : ''})`;\n      });\n      logToFile(`[health-checks] blocked by: ${blockingDetails.join(', ')}`);\n      return { decision: WizardReadiness.No, health, reasons };\n    }\n\n    const hasWarnings = Object.values(health).some(\n      (h) => h.status !== ServiceHealthStatus.Healthy,\n    );\n\n    if (hasWarnings) {\n      return { decision: WizardReadiness.YesWithWarnings, health, reasons };\n    }\n\n    return { decision: WizardReadiness.Yes, health, reasons };\n  } catch (err) {\n    logToFile(\n      `[health-checks] error: ${err instanceof Error ? err.message : err}`,\n    );\n    // Health checks must never block the wizard run\n    return {\n      decision: WizardReadiness.Yes,\n      health: allUnknown('Unexpected error'),\n      reasons: ['Health check failed unexpectedly — proceeding anyway'],\n    };\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Blocking service detection\n// ---------------------------------------------------------------------------\n\n/** Keys that are component-level detail, not top-level services. */\nconst COMPONENT_KEYS: HealthCheckKey[] = [\n  'posthogComponents',\n  'npmComponents',\n  'cloudflareComponents',\n];\n\n/**\n * Get the keys of services that would block a wizard run per the given config.\n *\n * `NoConnection` blocks the same services as `Down` — the wizard genuinely\n * can't continue if it can't reach the gateway. The screen shows softer\n * framing in that case (HealthCheckScreen) so we don't falsely accuse\n * PostHog of an outage when the user's network is the likely cause.\n */\nexport function getBlockingServiceKeys(\n  health: AllServicesHealth,\n  config: WizardReadinessConfig = DEFAULT_WIZARD_READINESS_CONFIG,\n): HealthCheckKey[] {\n  return (Object.keys(health) as HealthCheckKey[]).filter((key) => {\n    if (COMPONENT_KEYS.includes(key)) return false;\n    const result = health[key];\n    if (\n      config.downBlocksRun.includes(key) &&\n      (result.status === ServiceHealthStatus.Down ||\n        result.status === ServiceHealthStatus.NoConnection)\n    ) {\n      return true;\n    }\n    if (\n      (config.degradedBlocksRun ?? []).includes(key) &&\n      result.status !== ServiceHealthStatus.Healthy\n    ) {\n      return true;\n    }\n    return false;\n  });\n}\n\n/** Build an AllServicesHealth where every service is Degraded with the given error. */\nfunction allUnknown(error: string): AllServicesHealth {\n  const base: BaseHealthResult = {\n    status: ServiceHealthStatus.Degraded,\n    error,\n  };\n  return {\n    anthropic: base,\n    posthogOverall: base,\n    posthogComponents: { ...base },\n    github: base,\n    npmOverall: base,\n    npmComponents: { ...base },\n    cloudflareOverall: base,\n    cloudflareComponents: { ...base },\n    mcp: base,\n    skillsOrigin: base,\n  };\n}\n","/* eslint-disable no-console */\n/**\n * LoggingUI — Logging-only implementation for CI mode.\n * No prompts, no TUI, no interactivity. Just console output.\n */\n\nimport {\n  TaskStatus,\n  type WizardUI,\n  type SpinnerHandle,\n  type AuthErrorDetail,\n  type TokenUsageDelta,\n} from './wizard-ui';\nimport type { SettingsConflict } from '@lib/agent/claude-settings';\nimport type { ApiUser } from '@lib/api';\nimport { OAUTH_TIMEOUT_MS } from '@lib/constants';\nimport {\n  type WizardReadinessResult,\n  getBlockingServiceKeys,\n  SERVICE_LABELS,\n} from '@lib/health-checks/readiness';\nimport type {\n  AskAnswers,\n  Credentials,\n  OutroData,\n  PendingQuestion,\n  TaskNotice,\n} from '@lib/wizard-session';\n\nexport class LoggingUI implements WizardUI {\n  intro(message: string): void {\n    console.log(`┌  ${message}`);\n  }\n\n  outro(message: string): void {\n    console.log(`└  ${message}`);\n  }\n\n  outroError(data: OutroData): void {\n    console.log(`✖  ${data.message ?? 'Wizard aborted'}`);\n    if (data.body) console.log(`│  ${data.body}`);\n    if (data.docsUrl) console.log(`│  Docs: ${data.docsUrl}`);\n  }\n\n  waitForOutroDismissed(): Promise<void> {\n    return Promise.resolve();\n  }\n\n  waitForAiOptIn(): Promise<void> {\n    // Non-TUI runs are CI runs, which auto-consent to AI usage.\n    return Promise.resolve();\n  }\n\n  cancel(message: string): void {\n    console.log(`■  ${message}`);\n  }\n\n  log = {\n    info(message: string): void {\n      console.log(`│  ${message}`);\n    },\n    warn(message: string): void {\n      console.log(`▲  ${message}`);\n    },\n    error(message: string): void {\n      console.log(`✖  ${message}`);\n    },\n    success(message: string): void {\n      console.log(`✔  ${message}`);\n    },\n    step(message: string): void {\n      console.log(`◇  ${message}`);\n    },\n  };\n\n  note(message: string): void {\n    console.log(`│  ${message}`);\n  }\n\n  spinner(): SpinnerHandle {\n    return {\n      start(message?: string) {\n        if (message) console.log(`◌  ${message}`);\n      },\n      stop(message?: string) {\n        if (message) console.log(`●  ${message}`);\n      },\n      message(msg?: string) {\n        if (msg) console.log(`◌  ${msg}`);\n      },\n    };\n  }\n\n  pushStatus(message: string): void {\n    console.log(`◇  ${message}`);\n  }\n\n  setDetectedFramework(label: string): void {\n    console.log(`✔  Framework: ${label}`);\n  }\n\n  onEnterScreen(_screen: string, _fn: () => void): void {\n    // No screen transitions in CI\n  }\n\n  setLoginUrl(url: string | null): void {\n    if (url) {\n      console.log(\n        `│  If the browser didn't open automatically, use this link:`,\n      );\n      console.log(`│  ${url}`);\n    }\n  }\n\n  setAuthorizeUrl(_url: string | null): void {\n    // Manual-paste modal is TUI-only; CI/non-interactive runs don't use it.\n  }\n\n  showBlockingOutage(result: WizardReadinessResult): Promise<void> {\n    console.log(`▲  Service health issues detected.`);\n    const blockingKeys = getBlockingServiceKeys(result.health);\n    if (blockingKeys.length > 0) {\n      console.log(`│`);\n      console.log(`│  Blocking services:`);\n      for (const key of blockingKeys) {\n        const status = result.health[key].status;\n        const error = result.health[key].error;\n        const label = SERVICE_LABELS[key];\n        const detail = error ? ` — ${error}` : '';\n        console.log(`│    ✖ ${label}: ${status}${detail}`);\n      }\n      console.log(`│`);\n    }\n    for (const reason of result.reasons) {\n      console.log(`│  ${reason}`);\n    }\n    console.log(\n      `│  Continuing anyway — health checks are advisory in non-interactive runs.`,\n    );\n    return Promise.resolve();\n  }\n\n  setReadinessWarnings(result: WizardReadinessResult): void {\n    console.log(`▲  Service health warnings detected.`);\n    for (const reason of result.reasons) {\n      console.log(`│  ${reason}`);\n    }\n  }\n\n  showPortConflict(_processInfo: {\n    command: string;\n    pid: string;\n    port: number;\n    user: string;\n  }): Promise<void> {\n    return Promise.resolve();\n  }\n\n  waitForManualAuthCode(): Promise<string> {\n    // No interactive prompt in CI/logging mode — never resolves. CI bypasses\n    // OAuth entirely, so this is only here to satisfy the interface.\n    return new Promise<string>(() => {\n      /* intentionally never resolves */\n    });\n  }\n\n  showTaskNotice(_notice: TaskNotice): Promise<boolean> {\n    return Promise.resolve(false);\n  }\n\n  cancelTaskNotice(): void {\n    // Nothing to dismiss — showTaskNotice never opened anything.\n  }\n\n  showSettingsOverride(\n    _conflicts: SettingsConflict[],\n    _backupAndFix: () => boolean,\n  ): Promise<void> {\n    return Promise.resolve();\n  }\n\n  requestQuestion(_question: PendingQuestion): Promise<AskAnswers> {\n    return Promise.reject(\n      new Error(\n        'wizard_ask is not available in CI / non-interactive mode. ' +\n          'Re-run the wizard without --ci to answer interactively.',\n      ),\n    );\n  }\n\n  cancelPendingQuestion(): void {\n    // Nothing to dismiss — requestQuestion never opens an overlay here.\n  }\n\n  showAuthError(detail?: AuthErrorDetail): void {\n    console.log(`✖  Authentication failed (401)`);\n    if (detail?.hasSettingsConflict) {\n      console.log(\n        `│  Claude Code auth is conflicting with the wizard. Please try again after logging out:`,\n      );\n      console.log(`│    claude auth logout`);\n    } else {\n      console.log(\n        `│  The PostHog LLM Gateway rejected the API key. Common causes:`,\n      );\n      console.log(\n        `│    - Wrong key type: pass a personal API key (phx_xxx). pha_ is an OAuth access token, phc_ is a project key.`,\n      );\n      console.log(\n        `│    - Missing scope: the personal API key needs the \"llm_gateway:read\" scope.`,\n      );\n      console.log(`│    - Expired or revoked key.`);\n      console.log(\n        `│    - Region mismatch: --region must match the region the key was issued in (us vs eu).`,\n      );\n    }\n    if (detail?.logFilePath) {\n      console.log(`│  Verbose log: ${detail.logFilePath}`);\n    }\n  }\n\n  showSessionTimeout(): void {\n    const minutes = Math.round(OAUTH_TIMEOUT_MS / 60_000);\n    console.log(\n      `✖  Login timed out. The OAuth link timed out after ${minutes} minutes.`,\n    );\n    console.log(`│  Re-run the wizard to get a fresh link and try again.`);\n  }\n\n  startRun(): void {\n    // No-op in CI mode\n  }\n\n  setCredentials(_credentials: Credentials): void {\n    // No-op in CI mode — credentials are handled directly\n  }\n\n  setAccessToken(_credentials: Credentials): void {\n    // No-op in CI mode — CI runs on a non-expiring key and never refreshes\n  }\n\n  setRoleAtOrganization(_role: string | null): void {\n    // No-op in CI mode — there's no TUI to render role-tailored prompts\n  }\n\n  setApiUser(_user: ApiUser | null): void {\n    // No-op in CI mode — there's no TUI to read account context from\n    // the session.\n  }\n\n  private lastTodoLine = '';\n\n  syncTodos(\n    todos: Array<{ content: string; status: string; activeForm?: string }>,\n  ): void {\n    const completed = todos.filter(\n      (t) => t.status === TaskStatus.Completed,\n    ).length;\n    const active = todos.filter((t) => t.status === TaskStatus.InProgress);\n    if (active.length === 0) return;\n    const labels = active.map((t) => t.activeForm || t.content).join(' · ');\n    const line = `◌  [${completed}/${todos.length}] ${labels}`;\n    // The queue re-renders on every transition; print only what changed.\n    if (line === this.lastTodoLine) return;\n    this.lastTodoLine = line;\n    console.log(line);\n  }\n\n  setEventPlan(_events: Array<{ name: string; description: string }>): void {\n    // No-op in CI mode\n  }\n\n  setDashboardUrl(_url: string): void {\n    // No-op in CI mode\n  }\n\n  setStage(_stage: string): void {\n    // No-op in CI mode\n  }\n\n  setNotebookUrl(_url: string): void {\n    // No-op in CI mode\n  }\n\n  setHandoffText(_text: string): void {\n    // No-op without a store — HeadlessUI overrides to feed the session sync\n  }\n\n  addTokenUsage(_delta: TokenUsageDelta): void {\n    // No-op — the hidden Ctrl+T HUD is TUI-only\n  }\n\n  setFinalTokenCostUsd(_costUsd: number): void {\n    // No-op — the hidden Ctrl+T HUD is TUI-only\n  }\n\n  setOutroData(_data: import('@lib/wizard-session').OutroData): void {\n    // No-op in CI mode\n  }\n\n  setFrameworkContext(_key: string, _value: unknown): void {\n    // No-op in CI mode\n  }\n\n  getFrameworkContext(_key: string): unknown {\n    // No frameworkContext in CI mode\n    return undefined;\n  }\n\n  waitForGate(_stepId: string): Promise<void> {\n    // No interactive gates in CI mode\n    return Promise.resolve();\n  }\n}\n","/**\n * UI singleton — provides getUI() and setUI() for the wizard.\n * Default: LoggingUI. Swap to InkUI at startup for TUI mode.\n */\n\nimport type { WizardUI } from './wizard-ui';\nimport { LoggingUI } from './logging-ui';\n\nlet currentUI: WizardUI = new LoggingUI();\n\nexport function getUI(): WizardUI {\n  return currentUI;\n}\n\nexport function setUI(ui: WizardUI): void {\n  currentUI = ui;\n}\n\nexport type { WizardUI, SpinnerHandle } from './wizard-ui';\n","import { tmpdir } from 'node:os';\nimport { join, sep } from 'node:path';\n\n// /tmp is stable and discoverable on macOS/Linux; Windows needs os.tmpdir()\nconst TMP = process.platform === 'win32' ? tmpdir() : '/tmp';\n\nexport const WIZARD_LOG_FILE = join(TMP, 'posthog-wizard.log');\nexport const WIZARD_BENCHMARK_FILE = join(TMP, 'posthog-wizard-benchmark.json');\nexport const WIZARD_YARA_REPORT_FILE = join(\n  TMP,\n  'posthog-wizard-yara-report.json',\n);\n/**\n * Strip an absolute installDir prefix off a project file path so the UI\n * renders `index.js:12` instead of `/Users/.../index.js:12`. Defends\n * against false matches like `/Users/foo` ⊂ `/Users/foobar/x.js` by\n * normalizing to a trailing path separator before the prefix check.\n */\nexport function relativeToInstallDir(file: string, installDir: string): string {\n  const prefix = installDir.endsWith(sep) ? installDir : installDir + sep;\n  return file.startsWith(prefix) ? file.slice(prefix.length) : file;\n}\n","import { appendFileSync, mkdirSync } from 'fs';\nimport path from 'path';\nimport { inspect } from 'node:util';\nimport { getUI } from '@ui';\nimport { IS_DEV, runtimeEnv } from '@env';\nimport { WIZARD_LOG_FILE } from './paths';\n\n// Dev builds may redirect the log so concurrent runs don't interleave one file.\nlet logFilePath =\n  (IS_DEV && process.env.POSTHOG_WIZARD_LOG_FILE) || WIZARD_LOG_FILE;\nlet fileLoggingEnabled = true;\nlet consoleLoggingEnabled = false;\n\nfunction stringify(value: unknown): string {\n  if (typeof value === 'string') return value;\n  if (value instanceof Error) return value.stack ?? String(value);\n  try {\n    // JSON.stringify throws on cycles and skips some values — fall back to\n    // inspect so a crash log line is never dropped.\n    return JSON.stringify(value, null, 2) ?? inspect(value, { depth: 3 });\n  } catch {\n    return inspect(value, { depth: 3 });\n  }\n}\n\nfunction renderLine(args: readonly unknown[]): string {\n  return args.map(stringify).join(' ');\n}\n\nexport function getLogFilePath(): string {\n  return logFilePath;\n}\n\nexport function configureLogFile(opts: {\n  path?: string;\n  enabled?: boolean;\n}): void {\n  if (opts.path !== undefined) {\n    logFilePath = opts.path;\n    ensuredLogDir = false;\n  }\n  if (opts.enabled !== undefined) fileLoggingEnabled = opts.enabled;\n}\n\nlet ensuredLogDir = false;\nlet reportedLogFailure = false;\n\n// Failed log writes go to error tracking, once per process. Dynamic import:\n// analytics logs through this module, so a static import would be a cycle.\nfunction reportLogFailureOnce(err: unknown): void {\n  if (reportedLogFailure) return;\n  reportedLogFailure = true;\n  void import('./analytics')\n    .then(({ analytics }) =>\n      analytics.captureException(\n        err instanceof Error ? err : new Error(String(err)),\n        {\n          source: 'log-file-write',\n          log_path: logFilePath,\n          platform: process.platform,\n        },\n      ),\n    )\n    .catch(() => {\n      // Reporting must never crash the wizard either.\n    });\n}\n\n// The log's directory isn't guaranteed to exist (Windows %TEMP%,\n// POSTHOG_WIZARD_LOG_DIR) — create it on first failure.\nfunction appendLine(text: string): void {\n  try {\n    appendFileSync(logFilePath, text);\n  } catch (err) {\n    if (ensuredLogDir) {\n      reportLogFailureOnce(err);\n      return;\n    }\n    ensuredLogDir = true;\n    try {\n      mkdirSync(path.dirname(logFilePath), { recursive: true });\n      appendFileSync(logFilePath, text);\n    } catch (retryErr) {\n      reportLogFailureOnce(retryErr);\n    }\n  }\n}\n\nexport function configureLogFileFromEnvironment(): void {\n  const dir = runtimeEnv('POSTHOG_WIZARD_LOG_DIR');\n  if (dir) {\n    configureLogFile({ path: path.join(dir, 'posthog-wizard.log') });\n  }\n}\n\nexport function initLogFile(): void {\n  if (!fileLoggingEnabled) return;\n  const divider = '='.repeat(60);\n  appendLine(\n    `\\n${divider}\\nPostHog Wizard Run: ${new Date().toISOString()}\\n${divider}\\n`,\n  );\n}\n\nexport function logToFile(...args: unknown[]): void {\n  if (!fileLoggingEnabled) return;\n  const ts = new Date().toISOString();\n  appendLine(`[${ts}] ${renderLine(args)}\\n`);\n}\n\nexport function debug(...args: unknown[]): void {\n  if (!consoleLoggingEnabled) return;\n  getUI().log.info(renderLine(args));\n}\n\nexport function enableDebugLogs(): void {\n  consoleLoggingEnabled = true;\n}\n"],"mappings":";;;;;;;;;;;AAuBA,MAAa,gBAAgB;;;;;;AAO7B,MAAa,iBAA0C,GACpD,gBAAgB;CACf,SAAS;CAKT,UACE;CACF,MAAM;CACN,QAAQ;CACT,EACF;;;;;;AAOD,SAAgB,WAAW,SAA2C;AACpE,QAAO,QAAQ,mBAAmB;;AAMpC,MAAa,eAAwC,EACnD,QAAQ;CACN,UAAU;CACV,SAAS,CAAC,MAAM,KAAK;CACrB,MAAM;CACN,QAAQ;CACT,EACF;;;;;;;;;;;;;;;;;;;ACxCD,MAAa,WAAA;;AAcb,MAAa,cAAiC,QAAQ,KAAK,MACxD,MAAM,MAAM,sCAAwB,EAAE,WAAW,oCAAsB,CACzE,GACG,UACA;;AAgDJ,SAAgB,WAAW,KAAwC;AACjE,QAAO,QAAQ,IAAI;;;;;;;AAQrB,MAAa,cACX,WAAW,sBAAsB,IAAI,KAAA;AACvC,MAAa,UACX,WAAW,kBAAkB,IAAI,KAAA;;;ACpGnC,MAAa,UAAU;;;;;;;ACSvB,MAAa,iBAAiB;;;;;AAM9B,MAAa,sBAAsB;;AAGnC,MAAa,qBAAqB;;;;;AAMlC,MAAa,cAAc;AAG3B,MAAa,oBAAoB;AACjC,MAAa,qBAAqB;AAClC,MAAa,mBAAmB;;;;;;;;;;;AAchC,IAAY,UAAL,yBAAA,SAAA;AACL,SAAA,eAAA;AACA,SAAA,QAAA;;KACD;AAED,IAAY,WAAL,yBAAA,UAAA;AACL,UAAA,YAAA;AACA,UAAA,kBAAA;;KACD;;;;AAqBD,IAAY,cAAL,yBAAA,aAAA;AAEL,aAAA,YAAA;AACA,aAAA,UAAA;AACA,aAAA,SAAA;AACA,aAAA,iBAAA;AACA,aAAA,mBAAA;AACA,aAAA,oBAAA;AACA,aAAA,iBAAA;AACA,aAAA,aAAA;AACA,aAAA,WAAA;AACA,aAAA,YAAA;AACA,aAAA,WAAA;AACA,aAAA,aAAA;AACA,aAAA,aAAA;AACA,aAAA,eAAA;AACA,aAAA,aAAA;AACA,aAAA,SAAA;AACA,aAAA,WAAA;AACA,aAAA,aAAA;AACA,aAAA,WAAA;AACA,aAAA,YAAA;AACA,aAAA,QAAA;AACA,aAAA,UAAA;AAEA,aAAA,UAAA;AAGA,aAAA,YAAA;AACA,aAAA,UAAA;AACA,aAAA,oBAAA;AACA,aAAA,oBAAA;;KACD;;;;;;;AA6BD,MAAa,kBAET;AAIJ,MAAa,aAAa;;AAE1B,MAAa,0BAA0B;AACvC,MAAa,mBAAmB;;;;;;;;AAQhC,MAAa,4BACX;AACF,MAAa,mBAAmB;AAEhC,MAAa,oBAAoB;AACjC,MAAa,sBAAsB;AACnC,MAAa,8BACX;AACF,MAAa,uBAAuB;;;;;AAMpC,MAAa,yBACX;AACF,MAAa,sBAAsB;;AAEnC,MAAa,wBAAwB;;;;;AAMrC,SAAgB,mBAA2B;AACzC,QAAO,aAAa,CAAC,mBACjB,wBACA;;AAKN,MAAa,6CAA6C;AAC1D,MAAa,qBAAqB;AAClC,MAAa,qBAAqB;AAIlC,MAAa,cAAc;CAAC;CAAM;CAAM;CAAM;CAAM;CAAM;CAAK;AAC/D,MAAa,uBAAuB;AACpC,MAAa,uBAAuB;AACpC,MAAa,wBAAwB;AACrC,MAAa,0BAA0B;AACvC,MAAa,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;AAwBrC,MAAa,6BAA6B;CACxC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BD,MAAa,sBAAsB;CACjC,GAAG;CACH;CACA;CACA;CACA;CACD;AAID,MAAa,gCAAgC;AAC7C,MAAa,2BAA2B;;AAExC,MAAa,+BAA+B;;AAE5C,MAAa,wCACX;;AAEF,MAAa,8CACX;;AAEF,MAAa,sDACX;;AAEF,MAAa,4CACX;AAGF,MAAa,mBAAmB;CAC9B;CACA;CACA;CACA;CACA;CACD;;AAED,MAAa,oBAAoB,4BAA4B;;;;;;;AAQ7D,SAAgB,0BAA0B,WAA4B;AACpE,QAAO,YACH,GAAG,kBAAkB,aAAa,cAClC;;;AAMN,MAAa,uBAAuB;;AAGpC,MAAa,+BAA+B;;;;;;;;;;AAW5C,MAAa,mBAAmB;;;AC9ShC,IAAY,aAAL,yBAAA,YAAA;AACL,YAAA,aAAA;AACA,YAAA,gBAAA;AACA,YAAA,eAAA;AACA,YAAA,aAAA;;KACD;AAED,SAAgB,aAAa,OAAoC;AAC/D,QAAQ,OAAO,OAAO,WAAW,CAAc,SAAS,MAAM;;;;ACJhE,SAAS,aAAa,GAAmD;AACvE,SAAQ,GAAR;EACE,KAAK,OACH,QAAA;EACF,KAAK,QACH,QAAA;EACF,KAAK;EACL,KAAK,WACH,QAAA;EACF,QACE,QAAA;;;AAIN,SAAS,gBAAgB,GAAmD;AAC1E,SAAQ,GAAR;EACE,KAAK,cACH,QAAA;EACF,KAAK;EACL,KAAK,oBACH,QAAA;EACF,KAAK;EACL,KAAK,eACH,QAAA;EACF,QACE,QAAA;;;AAIN,SAASA,YAAU,OAAiC;AAClD,QAAO;EAAE,QAAA;EAAsC;EAAO;;AAGxD,eAAe,yBACb,KACA,YAAY,KACe;AAC3B,KAAI;EACF,MAAM,aAAa,IAAI,iBAAiB;EACxC,MAAM,MAAM,iBAAiB,WAAW,OAAO,EAAE,UAAU;EAC3D,MAAM,MAAM,MAAM,MAAM,KAAK,EAAE,QAAQ,WAAW,QAAQ,CAAC;AAC3D,eAAa,IAAI;AAEjB,MAAI,CAAC,IAAI,GAAI,QAAOA,YAAU,QAAQ,IAAI,SAAS;EAGnD,MAAM,aADQ,MAAM,IAAI,MAAM,EACP,QAAQ,aAAa;AAC5C,SAAO;GACL,QAAQ,aAAa,UAAU;GAC/B,cAAc,aAAa,KAAA;GAC5B;UACM,GAAG;AACV,MAAI,aAAa,SAAS,EAAE,SAAS,aACnC,QAAOA,YAAU,oBAAoB;AACvC,SAAOA,YAAU,aAAa,QAAQ,EAAE,UAAU,gBAAgB;;;AAItE,eAAe,uBACb,KACA,YAAY,KACoB;AAChC,KAAI;EACF,MAAM,aAAa,IAAI,iBAAiB;EACxC,MAAM,MAAM,iBAAiB,WAAW,OAAO,EAAE,UAAU;EAC3D,MAAM,MAAM,MAAM,MAAM,KAAK,EAAE,QAAQ,WAAW,QAAQ,CAAC;AAC3D,eAAa,IAAI;AAEjB,MAAI,CAAC,IAAI,GAAI,QAAOA,YAAU,QAAQ,IAAI,SAAS;EAEnD,MAAM,OAAQ,MAAM,IAAI,MAAM;EAC9B,MAAM,YAAY,KAAK,QAAQ,aAAa;EAC5C,MAAM,UAAU,aAAa,UAAU;EAEvC,MAAM,YAAY,KAAK,cAAc,EAAE,EACpC,KAAK,OAAO;GACX,MAAM,EAAE;GACR,QAAQ,gBAAgB,EAAE,OAAO;GACjC,WAAW,EAAE;GACd,EAAE,CACF,QAAQ,MAAM,EAAE,WAAA,UAAuC;AAE1D,SAAO;GACL,QAAQ,SAAS,SAAS,IAAA,aAAmC;GAC7D,cAAc,aAAa,KAAA;GAC3B,0BAA0B,SAAS,SAAS,IAAI,WAAW,KAAA;GAC5D;UACM,GAAG;AACV,MAAI,aAAa,SAAS,EAAE,SAAS,aACnC,QAAOA,YAAU,oBAAoB;AACvC,SAAOA,YAAU,aAAa,QAAQ,EAAE,UAAU,gBAAgB;;;AAQtE,MAAa,6BACX,yBAAyB,+CAA+C;AAE1E,MAAa,0BACX,yBAAyB,kDAAkD;AAE7E,MAAa,8BACX,yBAAyB,8CAA8C;AAEzE,MAAa,gCACX,uBAAuB,+CAA+C;AAExE,MAAa,qCACX,yBACE,sDACD;AAEH,MAAa,uCAET,uBACE,uDACD;;;ACpHL,SAAS,kBAAkB,QAAqC;AAC9D,SAAQ,QAAR;EACE,KAAK,cACH,QAAA;EACF,KAAK;EACL,KAAK,uBACH,QAAA;EACF,QACE,QAAA;;;AAIN,SAAS,mBAAmB,QAAqC;AAC/D,SAAQ,QAAR;EACE,KAAK,cACH,QAAA;EACF,KAAK,cACH,QAAA;EACF,KAAK;EACL,KAAK,uBACH,QAAA;EACF,QACE,QAAA;;;;;;;;;;;;;;;;;AAkBN,SAAS,UAAU,OAAe,MAA4C;AAC5E,QAAO;EACL,QACE,SAAS,SAAA,SAAA;EAGX;EACD;;AAGH,MAAM,qBAAqB;AAE3B,eAAe,mBACb,YAAY,KAC+D;AAC3E,KAAI;EACF,MAAM,aAAa,IAAI,iBAAiB;EACxC,MAAM,MAAM,iBAAiB,WAAW,OAAO,EAAE,UAAU;EAC3D,MAAM,MAAM,MAAM,MAAM,oBAAoB,EAAE,QAAQ,WAAW,QAAQ,CAAC;AAC1E,eAAa,IAAI;AAEjB,MAAI,CAAC,IAAI,IAAI;GACX,MAAM,MAAM,UAAU,QAAQ,IAAI,UAAU,OAAO;AACnD,UAAO;IAAE,SAAS;IAAK,YAAY;IAAK;;EAI1C,MAAM,aADQ,MAAM,IAAI,MAAM,EACP,qBAAqB,EAAE;AAE9C,MAAI,UAAU,WAAW,EACvB,QAAO;GACL,SAAS,EAAE,QAAA,WAAqC;GAChD,YAAY,EAAE,QAAA,WAAqC;GACpD;EAGH,IAAI,eAAA;EACJ,MAAM,WAA8B,EAAE;AAEtC,OAAK,MAAM,YAAY,WAAW;AAEhC,OADe,kBAAkB,SAAS,qBAAqB,KAAA,OAE7D,gBAAA;AAGF,QAAK,MAAM,QAAQ,SAAS,uBAAuB,EAAE,EAAE;IACrD,MAAM,aAAa,mBAAmB,KAAK,eAAe;AAC1D,QAAI,eAAA,UACF,UAAS,KAAK;KACZ,MAAM,KAAK,aACP,GAAG,KAAK,WAAW,KAAK,KAAK,SAC7B,KAAK;KACT,QAAQ;KACR,WAAW,KAAK;KACjB,CAAC;;;AAKR,SAAO;GACL,SAAS,EAAE,QAAQ,cAAc;GACjC,YAAY;IACV,QACE,SAAS,SAAS,IAAA,aAAmC;IACvD,0BAA0B,SAAS,SAAS,IAAI,WAAW,KAAA;IAC5D;GACF;UACM,GAAG;AACV,MAAI,aAAa,SAAS,EAAE,SAAS,cAAc;GACjD,MAAM,MAAM,UAAU,qBAAqB,UAAU;AACrD,UAAO;IAAE,SAAS;IAAK,YAAY;IAAK;;EAE1C,MAAM,MAAM,UACV,aAAa,QAAQ,EAAE,UAAU,iBACjC,UACD;AACD,SAAO;GAAE,SAAS;GAAK,YAAY;GAAK;;;AAI5C,IAAI,SAGQ;AAEZ,SAAS,mBAAmB;AAC1B,KAAI,CAAC,OAAQ,UAAS,oBAAoB;AAC1C,QAAO;;AAOT,MAAa,4BAA4B,aACtC,MAAM,kBAAkB,EAAE;AAE7B,MAAa,8BACX,aACG,MAAM,kBAAkB,EAAE;;;AC/I/B,SAAS,mBAAmB,OAAe,UAAoC;AAC7E,QAAO;EACL,QAAA;EACA;EACA,cAAc,WAAW,IAAI,YAAY,aAAa,KAAA;EACvD;;AAGH,SAAS,WAAW,OAAiC;AACnD,QAAO;EAAE,QAAA;EAAkC;EAAO;;AAQpD,MAAM,oBAAoB,CAAC,KAAK,IAAK;AAErC,eAAe,aACb,KACA,WACA,UAIA;CACA,MAAM,aAAa,IAAI,iBAAiB;CACxC,MAAM,MAAM,iBAAiB,WAAW,OAAO,EAAE,UAAU;AAC3D,KAAI;EACF,MAAM,MAAM,MAAM,MAAM,KAAK;GAAE,QAAQ,WAAW;GAAQ;GAAU,CAAC;AACrE,eAAa,IAAI;AACjB,SAAO;GAAE,MAAM;GAAY;GAAK;UACzB,GAAG;AACV,eAAa,IAAI;EACjB,MAAM,MAAM,aAAa,QAAQ,oBAAI,IAAI,MAAM,gBAAgB;AAC/D,SAAO;GAAE,MAAM;GAAS,OAAO;GAAK,UAAU,IAAI,SAAS;GAAc;;;AAK7E,eAAsB,oBACpB,KACA,YAAY,KACZ,oBAAiD,MAAM,MAAM,KAC7D,WAA0C,UACf;CAW3B,IAAI,iBAAgC;CACpC,IAAI,YAAY;CAChB,IAAI,WAAW;AAEf,MAAK,IAAI,IAAI,GAAG,KAAK,kBAAkB,QAAQ,KAAK;AAClD,MAAI,IAAI,GAAG;GACT,MAAM,OAAO,kBAAkB,IAAI;AACnC,aACE,yBAAyB,EAAE,GAAG,kBAAkB,OAAO,OAAO,IAAI,MAAM,KAAK,YAAY,UAAU,GACpG;AACD,SAAM,IAAI,SAAS,MAAM,WAAW,GAAG,KAAK,CAAC;;AAE/C;EAEA,MAAM,UAAU,MAAM,aAAa,KAAK,WAAW,SAAS;AAE5D,MAAI,QAAQ,SAAS,YAAY;GAC/B,MAAM,MAAM,QAAQ;AACpB,OAAI,iBAAiB,IAAI,OAAO,EAAE;IAChC,MAAM,SAA2B;KAC/B,QAAA;KACA,cACE,WAAW,IACP,QAAQ,IAAI,OAAO,aAAa,SAAS,KACzC,QAAQ,IAAI;KACnB;AACD,cACE,uBAAuB,IAAI,MAAM,OAAO,OAAA,IACjC,OAAO,aAAa,GAC5B;AACD,WAAO;;AAET,oBAAiB,IAAI;AACrB,eAAY,QAAQ,IAAI;AACxB;;AAGF,cAAY,QAAQ,WAChB,2BAA2B,UAAU,MACrC,QAAQ,MAAM;;CAGpB,MAAM,SACJ,mBAAmB,OACf,WACE,QAAQ,eAAe,aAAa,SAAS,IAC7C,eACD,GACD,mBAAmB,WAAW,SAAS;AAC7C,WACE,uBAAuB,IAAI,MAAM,OAAO,OAAA,aACxB,SAAS,IAAI,OAAO,MAAM,GAC3C;AACD,QAAO;;AAGT,MAAa,uBACX,oBACE,4BACA,MAEC,MAAM,KAAK,OAAO,IAAI,KACvB,SACD;;;;;;;AAQH,MAAa,0BAA0B,YAAuC;CAC5E,MAAM,CAAC,QAAQ,OAAO,MAAM,QAAQ,IAAI,CACtC,oBAAoB,GAAG,uBAAuB,kBAAkB,EAChE,oBAAoB,GAAG,oBAAoB,kBAAkB,CAC9D,CAAC;AACF,QAAO,oBAAoB,QAAQ,IAAI;;;;;;;AAQzC,SAAS,oBACP,QACA,KACkB;AAClB,KAAI,OAAO,WAAA,UAGT,QAAO,IAAI,WAAA,YACP,SACA,oBAAoB,QAAQ,kBAAkB;AAGpD,KAAI,IAAI,WAAA,UACN,QAAO,oBAAoB,KAAK,8BAA8B;CAGhE,MAAM,QAAQ,WAAW,OAAO,SAAS,UAAU,UACjD,IAAI,SAAS;AAKf,QAAO;EACL,QAHA,OAAO,WAAA,UACP,IAAI,WAAA,SAAA,SAAA;EAKJ;EAEA,cAAc,OAAO,gBAAgB,IAAI;EAC1C;;AAGH,SAAS,oBACP,QACA,QACkB;AAClB,QAAO;EACL,GAAG;EACH,cAAc,OAAO,eACjB,GAAG,OAAO,aAAa,IAAI,OAAO,KAClC;EACL;;;;ACnLH,MAAa,iBAAiD;CAC5D,WAAW;CACX,gBAAgB;CAChB,mBAAmB;CACnB,QAAQ;CACR,YAAY;CACZ,eAAe;CACf,mBAAmB;CACnB,sBAAsB;CACtB,KAAK;CACL,cAAc;CACf;;;;;;;;;AAqBD,MAAa,kCAAyD;CACpE,eAAe;EAAC;EAAa;EAAc;EAAO;EAAe;CACjE,mBAAmB,CAAC,YAAY;CACjC;;;;;;;AAQD,MAAa,iCAAwD,EACnE,eAAe,CAAC,iBAAiB,EAClC;AAMD,eAAsB,2BAAuD;CAC3E,MAAM,CACJ,WACA,gBACA,mBACA,QACA,YACA,eACA,mBACA,sBACA,KACA,gBACE,MAAM,QAAQ,IAAI;EACpB,sBAAsB;EACtB,2BAA2B;EAC3B,6BAA6B;EAC7B,mBAAmB;EACnB,uBAAuB;EACvB,yBAAyB;EACzB,8BAA8B;EAC9B,gCAAgC;EAChC,gBAAgB;EAChB,yBAAyB;EAC1B,CAAC;AAcF,QAAO,6BAZ2B;EAChC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAC0C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkC7C,SAAgB,6BACd,QACmB;CACnB,MAAM,gBAAgB,OAAO,eAAe;AAK5C,KAAI,EAHF,kBAAA,UACA,kBAAA,YAEuB,QAAO;CAEhC,MAAM,WAAW,MACf,EAAE,WAAA,kBACE;EACE,GAAG;EACH,QAAA;EACA,OAAO,EAAE,QACL,GAAG,EAAE,MAAM,kCACX;EACL,GACD;AAEN,QAAO;EACL,GAAG;EACH,KAAK,QAAQ,OAAO,IAAI;EACzB;;AAmBH,SAAS,eAAe,OAAe,GAA6B;CAClE,MAAM,QAAQ,CAAC,GAAG,MAAM,IAAI,EAAE,SAAS;AACvC,KAAI,EAAE,aAAc,OAAM,KAAK,aAAa,EAAE,eAAe;AAC7D,KAAI,EAAE,MAAO,OAAM,KAAK,EAAE,MAAM;AAChC,QAAO,MAAM,KAAK,MAAM;;AAG1B,MAAM,sBAAsB;AAE5B,SAAS,mBAAmB,OAAe,GAAkC;CAC3E,MAAM,WAAW,EAAE;AACnB,KAAI,CAAC,YAAY,SAAS,WAAW,EACnC,QAAO,GAAG,MAAM;CAClB,MAAM,QAAQ,SACX,MAAM,GAAG,oBAAoB,CAC7B,KAAK,MAAM,GAAG,EAAE,KAAK,IAAI,EAAE,OAAO,GAAG;CACxC,MAAM,SACJ,SAAS,SAAS,sBACd,MAAM,SAAS,SAAS,oBAAoB,SAC5C;AACN,QAAO,GAAG,MAAM,wBAAwB,MAAM,KAAK,KAAK,GAAG;;AAO7D,MAAM,uBAAuB;AAE7B,eAAsB,wBACpB,SAAgC,iCACA;AAChC,KAAI;EACF,MAAM,SAAS,MAAM,QAAQ,KAAK,CAChC,0BAA0B,EAC1B,IAAI,SAA4B,YAC9B,iBACQ,QAAQ,WAAW,yBAAyB,CAAC,EACnD,qBACD,CACF,CACF,CAAC;EAEF,MAAM,UAAoB,EAAE;AAE5B,OAAK,MAAM,OAAO,OAAO,KAAK,OAAO,EAAsB;GACzD,MAAM,SAAS,OAAO;GACtB,MAAM,QAAQ,eAAe;AAE7B,WAAQ,KAAK,eAAe,OAAO,OAAO,CAAC;AAE3C,OAAI,8BAA8B,OAChC,SAAQ,KAAK,mBAAmB,OAAO,OAAO,CAAC;;EAInD,MAAM,eAAe,uBAAuB,QAAQ,OAAO;AAC3D,MAAI,aAAa,SAAS,GAAG;AAK3B,aAAU,+BAJc,aAAa,KAAK,QAAQ;IAChD,MAAM,IAAI,OAAO;AACjB,WAAO,GAAG,IAAI,IAAI,EAAE,SAAS,EAAE,QAAQ,MAAM,EAAE,UAAU,GAAG;KAC5D,CACuD,KAAK,KAAK,GAAG;AACtE,UAAO;IAAE,UAAA;IAA8B;IAAQ;IAAS;;AAO1D,MAJoB,OAAO,OAAO,OAAO,CAAC,MACvC,MAAM,EAAE,WAAA,UACV,CAGC,QAAO;GAAE,UAAA;GAA2C;GAAQ;GAAS;AAGvE,SAAO;GAAE,UAAA;GAA+B;GAAQ;GAAS;UAClD,KAAK;AACZ,YACE,0BAA0B,eAAe,QAAQ,IAAI,UAAU,MAChE;AAED,SAAO;GACL,UAAA;GACA,QAAQ,WAAW,mBAAmB;GACtC,SAAS,CAAC,uDAAuD;GAClE;;;;AASL,MAAM,iBAAmC;CACvC;CACA;CACA;CACD;;;;;;;;;AAUD,SAAgB,uBACd,QACA,SAAgC,iCACd;AAClB,QAAQ,OAAO,KAAK,OAAO,CAAsB,QAAQ,QAAQ;AAC/D,MAAI,eAAe,SAAS,IAAI,CAAE,QAAO;EACzC,MAAM,SAAS,OAAO;AACtB,MACE,OAAO,cAAc,SAAS,IAAI,KACjC,OAAO,WAAA,UACN,OAAO,WAAA,iBAET,QAAO;AAET,OACG,OAAO,qBAAqB,EAAE,EAAE,SAAS,IAAI,IAC9C,OAAO,WAAA,UAEP,QAAO;AAET,SAAO;GACP;;;AAIJ,SAAS,WAAW,OAAkC;CACpD,MAAM,OAAyB;EAC7B,QAAA;EACA;EACD;AACD,QAAO;EACL,WAAW;EACX,gBAAgB;EAChB,mBAAmB,EAAE,GAAG,MAAM;EAC9B,QAAQ;EACR,YAAY;EACZ,eAAe,EAAE,GAAG,MAAM;EAC1B,mBAAmB;EACnB,sBAAsB,EAAE,GAAG,MAAM;EACjC,KAAK;EACL,cAAc;EACf;;;;ACtTH,IAAa,YAAb,MAA2C;CACzC,MAAM,SAAuB;AAC3B,UAAQ,IAAI,MAAM,UAAU;;CAG9B,MAAM,SAAuB;AAC3B,UAAQ,IAAI,MAAM,UAAU;;CAG9B,WAAW,MAAuB;AAChC,UAAQ,IAAI,MAAM,KAAK,WAAW,mBAAmB;AACrD,MAAI,KAAK,KAAM,SAAQ,IAAI,MAAM,KAAK,OAAO;AAC7C,MAAI,KAAK,QAAS,SAAQ,IAAI,YAAY,KAAK,UAAU;;CAG3D,wBAAuC;AACrC,SAAO,QAAQ,SAAS;;CAG1B,iBAAgC;AAE9B,SAAO,QAAQ,SAAS;;CAG1B,OAAO,SAAuB;AAC5B,UAAQ,IAAI,MAAM,UAAU;;CAG9B,MAAM;EACJ,KAAK,SAAuB;AAC1B,WAAQ,IAAI,MAAM,UAAU;;EAE9B,KAAK,SAAuB;AAC1B,WAAQ,IAAI,MAAM,UAAU;;EAE9B,MAAM,SAAuB;AAC3B,WAAQ,IAAI,MAAM,UAAU;;EAE9B,QAAQ,SAAuB;AAC7B,WAAQ,IAAI,MAAM,UAAU;;EAE9B,KAAK,SAAuB;AAC1B,WAAQ,IAAI,MAAM,UAAU;;EAE/B;CAED,KAAK,SAAuB;AAC1B,UAAQ,IAAI,MAAM,UAAU;;CAG9B,UAAyB;AACvB,SAAO;GACL,MAAM,SAAkB;AACtB,QAAI,QAAS,SAAQ,IAAI,MAAM,UAAU;;GAE3C,KAAK,SAAkB;AACrB,QAAI,QAAS,SAAQ,IAAI,MAAM,UAAU;;GAE3C,QAAQ,KAAc;AACpB,QAAI,IAAK,SAAQ,IAAI,MAAM,MAAM;;GAEpC;;CAGH,WAAW,SAAuB;AAChC,UAAQ,IAAI,MAAM,UAAU;;CAG9B,qBAAqB,OAAqB;AACxC,UAAQ,IAAI,iBAAiB,QAAQ;;CAGvC,cAAc,SAAiB,KAAuB;CAItD,YAAY,KAA0B;AACpC,MAAI,KAAK;AACP,WAAQ,IACN,8DACD;AACD,WAAQ,IAAI,MAAM,MAAM;;;CAI5B,gBAAgB,MAA2B;CAI3C,mBAAmB,QAA8C;AAC/D,UAAQ,IAAI,qCAAqC;EACjD,MAAM,eAAe,uBAAuB,OAAO,OAAO;AAC1D,MAAI,aAAa,SAAS,GAAG;AAC3B,WAAQ,IAAI,IAAI;AAChB,WAAQ,IAAI,wBAAwB;AACpC,QAAK,MAAM,OAAO,cAAc;IAC9B,MAAM,SAAS,OAAO,OAAO,KAAK;IAClC,MAAM,QAAQ,OAAO,OAAO,KAAK;IACjC,MAAM,QAAQ,eAAe;IAC7B,MAAM,SAAS,QAAQ,MAAM,UAAU;AACvC,YAAQ,IAAI,UAAU,MAAM,IAAI,SAAS,SAAS;;AAEpD,WAAQ,IAAI,IAAI;;AAElB,OAAK,MAAM,UAAU,OAAO,QAC1B,SAAQ,IAAI,MAAM,SAAS;AAE7B,UAAQ,IACN,6EACD;AACD,SAAO,QAAQ,SAAS;;CAG1B,qBAAqB,QAAqC;AACxD,UAAQ,IAAI,uCAAuC;AACnD,OAAK,MAAM,UAAU,OAAO,QAC1B,SAAQ,IAAI,MAAM,SAAS;;CAI/B,iBAAiB,cAKC;AAChB,SAAO,QAAQ,SAAS;;CAG1B,wBAAyC;AAGvC,SAAO,IAAI,cAAsB,GAE/B;;CAGJ,eAAe,SAAuC;AACpD,SAAO,QAAQ,QAAQ,MAAM;;CAG/B,mBAAyB;CAIzB,qBACE,YACA,eACe;AACf,SAAO,QAAQ,SAAS;;CAG1B,gBAAgB,WAAiD;AAC/D,SAAO,QAAQ,uBACb,IAAI,MACF,oHAED,CACF;;CAGH,wBAA8B;CAI9B,cAAc,QAAgC;AAC5C,UAAQ,IAAI,iCAAiC;AAC7C,MAAI,QAAQ,qBAAqB;AAC/B,WAAQ,IACN,0FACD;AACD,WAAQ,IAAI,0BAA0B;SACjC;AACL,WAAQ,IACN,kEACD;AACD,WAAQ,IACN,kHACD;AACD,WAAQ,IACN,iFACD;AACD,WAAQ,IAAI,iCAAiC;AAC7C,WAAQ,IACN,2FACD;;AAEH,MAAI,QAAQ,YACV,SAAQ,IAAI,mBAAmB,OAAO,cAAc;;CAIxD,qBAA2B;EACzB,MAAM,UAAU,KAAK,MAAM,mBAAmB,IAAO;AACrD,UAAQ,IACN,sDAAsD,QAAQ,WAC/D;AACD,UAAQ,IAAI,0DAA0D;;CAGxE,WAAiB;CAIjB,eAAe,cAAiC;CAIhD,eAAe,cAAiC;CAIhD,sBAAsB,OAA4B;CAIlD,WAAW,OAA6B;CAKxC,eAAuB;CAEvB,UACE,OACM;EACN,MAAM,YAAY,MAAM,QACrB,MAAM,EAAE,WAAA,YACV,CAAC;EACF,MAAM,SAAS,MAAM,QAAQ,MAAM,EAAE,WAAA,cAAiC;AACtE,MAAI,OAAO,WAAW,EAAG;EACzB,MAAM,SAAS,OAAO,KAAK,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,KAAK,MAAM;EACvE,MAAM,OAAO,OAAO,UAAU,GAAG,MAAM,OAAO,IAAI;AAElD,MAAI,SAAS,KAAK,aAAc;AAChC,OAAK,eAAe;AACpB,UAAQ,IAAI,KAAK;;CAGnB,aAAa,SAA6D;CAI1E,gBAAgB,MAAoB;CAIpC,SAAS,QAAsB;CAI/B,eAAe,MAAoB;CAInC,eAAe,OAAqB;CAIpC,cAAc,QAA+B;CAI7C,qBAAqB,UAAwB;CAI7C,aAAa,OAAsD;CAInE,oBAAoB,MAAc,QAAuB;CAIzD,oBAAoB,MAAuB;CAK3C,YAAY,SAAgC;AAE1C,SAAO,QAAQ,SAAS;;;;;AC/S5B,IAAI,YAAsB,IAAI,WAAW;AAEzC,SAAgB,QAAkB;AAChC,QAAO;;AAGT,SAAgB,MAAM,IAAoB;AACxC,aAAY;;;;ACXd,MAAM,MAAM,QAAQ,aAAa,UAAU,QAAQ,GAAG;AAEtD,MAAa,kBAAkBC,OAAK,KAAK,qBAAqB;AAC9D,MAAa,wBAAwBA,OAAK,KAAK,gCAAgC;AAC/E,MAAa,0BAA0BA,OACrC,KACA,kCACD;;;;;;;AAOD,SAAgB,qBAAqB,MAAc,YAA4B;CAC7E,MAAM,SAAS,WAAW,SAASC,MAAI,GAAG,aAAa,aAAaA;AACpE,QAAO,KAAK,WAAW,OAAO,GAAG,KAAK,MAAM,OAAO,OAAO,GAAG;;;;ACZ/D,IAAI,cACiD;AACrD,IAAI,qBAAqB;AACzB,IAAI,wBAAwB;AAE5B,SAAS,UAAU,OAAwB;AACzC,KAAI,OAAO,UAAU,SAAU,QAAO;AACtC,KAAI,iBAAiB,MAAO,QAAO,MAAM,SAAS,OAAO,MAAM;AAC/D,KAAI;AAGF,SAAO,KAAK,UAAU,OAAO,MAAM,EAAE,IAAI,QAAQ,OAAO,EAAE,OAAO,GAAG,CAAC;SAC/D;AACN,SAAO,QAAQ,OAAO,EAAE,OAAO,GAAG,CAAC;;;AAIvC,SAAS,WAAW,MAAkC;AACpD,QAAO,KAAK,IAAI,UAAU,CAAC,KAAK,IAAI;;AAGtC,SAAgB,iBAAyB;AACvC,QAAO;;AAGT,SAAgB,iBAAiB,MAGxB;AACP,KAAI,KAAK,SAAS,KAAA,GAAW;AAC3B,gBAAc,KAAK;AACnB,kBAAgB;;AAElB,KAAI,KAAK,YAAY,KAAA,EAAW,sBAAqB,KAAK;;AAG5D,IAAI,gBAAgB;AACpB,IAAI,qBAAqB;AAIzB,SAAS,qBAAqB,KAAoB;AAChD,KAAI,mBAAoB;AACxB,sBAAqB;AAChB,QAAO,2BACT,MAAM,EAAE,gBACP,UAAU,iBACR,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,IAAI,CAAC,EACnD;EACE,QAAQ;EACR,UAAU;EACV,UAAU,QAAQ;EACnB,CACF,CACF,CACA,YAAY,GAEX;;AAKN,SAAS,WAAW,MAAoB;AACtC,KAAI;AACF,iBAAe,aAAa,KAAK;UAC1B,KAAK;AACZ,MAAI,eAAe;AACjB,wBAAqB,IAAI;AACzB;;AAEF,kBAAgB;AAChB,MAAI;AACF,aAAU,KAAK,QAAQ,YAAY,EAAE,EAAE,WAAW,MAAM,CAAC;AACzD,kBAAe,aAAa,KAAK;WAC1B,UAAU;AACjB,wBAAqB,SAAS;;;;AAKpC,SAAgB,kCAAwC;CACtD,MAAM,MAAM,WAAW,yBAAyB;AAChD,KAAI,IACF,kBAAiB,EAAE,MAAM,KAAK,KAAK,KAAK,qBAAqB,EAAE,CAAC;;AAIpE,SAAgB,cAAoB;AAClC,KAAI,CAAC,mBAAoB;CACzB,MAAM,UAAU,IAAI,OAAO,GAAG;AAC9B,YACE,KAAK,QAAQ,yCAAwB,IAAI,MAAM,EAAC,aAAa,CAAC,IAAI,QAAQ,IAC3E;;AAGH,SAAgB,UAAU,GAAG,MAAuB;AAClD,KAAI,CAAC,mBAAoB;AAEzB,YAAW,qBADA,IAAI,MAAM,EAAC,aAAa,CACjB,IAAI,WAAW,KAAK,CAAC,IAAI;;AAG7C,SAAgB,MAAM,GAAG,MAAuB;AAC9C,KAAI,CAAC,sBAAuB;AAC5B,QAAO,CAAC,IAAI,KAAK,WAAW,KAAK,CAAC;;AAGpC,SAAgB,kBAAwB;AACtC,yBAAwB"}

package/dist/orchestrator-tools-CTpKnk5-.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"orchestrator-tools-CTpKnk5-.js","names":[],"sources":["../src/lib/agent/runner/harness/pi/orchestrator-tools.ts"],"sourcesContent":["/**\n * Orchestrator queue tools as pi custom tools. The queue lives in-process, and\n * `applyEnqueue` / `applyComplete` / `applyReadHandoffs` are plain exported\n * functions — so pi needs no MCP transport, just `defineTool` wrappers around\n * the same guards and apply logic the anthropic path mounts through the\n * wizard-tools MCP server. Tool names match the MCP short names so the shared\n * agent prompts are unchanged.\n *\n * Lazily imported (typebox is ESM and must stay out of the static module graph\n * so CommonJS unit tests can load the backend seam without parsing it).\n */\n\nimport { Type } from 'typebox';\nimport { defineTool } from '@earendil-works/pi-coding-agent';\nimport type { ToolDefinition } from '@earendil-works/pi-coding-agent';\nimport { analytics } from '@utils/analytics';\nimport {\n  applyComplete,\n  applyEnqueue,\n  applyReadHandoffs,\n  ENQUEUE_MODEL_DESCRIPTION,\n  HANDOFF_FIELDS,\n  NOT_NEEDED_REASON_ASK,\n  REMARK_ASK,\n  type CompleteArgs,\n  type EnqueueArgs,\n  type OrchestratorToolsContext,\n} from '../../sequence/orchestrator/queue-tools';\nimport { NotNeededReason } from '../../sequence/orchestrator/queue';\n\nfunction text(s: string): {\n  content: [{ type: 'text'; text: string }];\n  details: unknown;\n} {\n  return { content: [{ type: 'text', text: s }], details: {} };\n}\n\n/** Mirrors the zod `HANDOFF_SHAPE`; both read their text from HANDOFF_FIELDS. */\nconst HANDOFF_PARAMS = Type.Object({\n  goals: Type.String({ description: HANDOFF_FIELDS.goals }),\n  did: Type.String({ description: HANDOFF_FIELDS.did }),\n  forNextAgent: Type.String({ description: HANDOFF_FIELDS.forNextAgent }),\n  filesTouched: Type.Optional(\n    Type.Array(Type.String(), { description: HANDOFF_FIELDS.filesTouched }),\n  ),\n  evidence: Type.Optional(\n    Type.String({ description: HANDOFF_FIELDS.evidence }),\n  ),\n  assumptions: Type.Optional(\n    Type.String({ description: HANDOFF_FIELDS.assumptions }),\n  ),\n  conflict: Type.Optional(\n    Type.String({ description: HANDOFF_FIELDS.conflict }),\n  ),\n  reportSection: Type.Optional(\n    Type.String({ description: HANDOFF_FIELDS.reportSection }),\n  ),\n});\n\n/** Exported so the parity test can compare both harnesses' field sets. */\nexport const PI_HANDOFF_PARAM_KEYS: readonly string[] = Object.keys(\n  HANDOFF_PARAMS.properties,\n);\n\n/** Mirrors the zod `COMPLETE_SHAPE`; ctx-independent, so it lives out here. */\nconst COMPLETE_PARAMS = Type.Object({\n  status: Type.Union([\n    Type.Literal('done'),\n    Type.Literal('failed'),\n    Type.Literal('not needed'),\n  ]),\n  handoff: HANDOFF_PARAMS,\n  remark: Type.Optional(Type.String({ description: REMARK_ASK })),\n  notNeededReason: Type.Optional(\n    Type.Union(\n      [\n        Type.Literal(NotNeededReason.NotApplicable),\n        Type.Literal(NotNeededReason.UserDeclined),\n        Type.Literal(NotNeededReason.Blocked),\n      ],\n      { description: NOT_NEEDED_REASON_ASK },\n    ),\n  ),\n});\n\n/** Exported so the parity test can compare both harnesses' field sets. */\nexport const PI_COMPLETE_PARAM_KEYS: readonly string[] = Object.keys(\n  COMPLETE_PARAMS.properties,\n);\n\n/** The three queue tools bound to one agent's orchestrator context. */\nexport function createPiOrchestratorTools(\n  ctx: OrchestratorToolsContext,\n): ToolDefinition[] {\n  const enqueueTask = defineTool({\n    name: 'enqueue_task',\n    label: 'Enqueue task',\n    description:\n      'Add a task to the orchestrator queue. Use it to seed work and to enqueue follow-up work you discover. Keep tasks small and discrete.',\n    promptSnippet:\n      'enqueue_task(type, label, dependsOn, reason) — add a task to the queue; returns its id',\n    parameters: Type.Object({\n      type: Type.String({\n        description: `The task type. One of: ${ctx.validTypes.join(', ')}.`,\n      }),\n      label: Type.Optional(\n        Type.String({\n          description:\n            'A short label for the UI — the action in a few words (e.g. \"Add the PostHog SDK\", \"Initialize PostHog\"). Leave out file names, class names, and other specifics.',\n        }),\n      ),\n      inputs: Type.Optional(Type.Record(Type.String(), Type.Unknown())),\n      dependsOn: Type.Optional(\n        Type.Array(Type.String(), {\n          description: 'Task ids that must be done before this task runs.',\n        }),\n      ),\n      model: Type.Optional(\n        Type.String({ description: ENQUEUE_MODEL_DESCRIPTION }),\n      ),\n      reason: Type.String({\n        description: 'One line on why this task is needed.',\n      }),\n    }),\n    execute(_id, args) {\n      const res = applyEnqueue(ctx, args as EnqueueArgs);\n      if (!res.ok) {\n        analytics.wizardCapture('orchestrator guard tripped', {\n          guard: res.guard,\n          type: (args as EnqueueArgs).type,\n        });\n        return Promise.resolve(text(`Error: ${res.message}`));\n      }\n      return Promise.resolve(text(JSON.stringify({ id: res.task.id })));\n    },\n  });\n\n  const completeTask = defineTool({\n    name: 'complete_task',\n    label: 'Complete task',\n    description:\n      \"Report the outcome of your task. Always call this exactly once when you finish, with a structured handoff for the next agent. Use status 'not needed' when the task does not apply to this project and you cannot do it (say why in the handoff) — not 'done'.\",\n    promptSnippet:\n      'complete_task(status, handoff) — report your outcome exactly once when done',\n    parameters: COMPLETE_PARAMS,\n    execute(_id, args) {\n      const res = applyComplete(ctx, args as CompleteArgs);\n      if (!res.ok) return Promise.resolve(text(`Error: ${res.message}`));\n      return Promise.resolve(text('ok'));\n    },\n  });\n\n  const readHandoffs = defineTool({\n    name: 'read_handoffs',\n    label: 'Read handoffs',\n    description:\n      'Read structured handoffs from earlier tasks. With no argument, returns the handoffs of your dependencies.',\n    promptSnippet:\n      'read_handoffs() — read what earlier tasks handed off (defaults to your dependencies)',\n    parameters: Type.Object({\n      type: Type.Optional(Type.String()),\n      taskId: Type.Optional(Type.String()),\n    }),\n    execute(_id, args) {\n      const handoffs = applyReadHandoffs(\n        ctx,\n        args as { type?: string; taskId?: string },\n      );\n      return Promise.resolve(text(JSON.stringify(handoffs, null, 2)));\n    },\n  });\n\n  return [enqueueTask, completeTask, readHandoffs];\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA8BA,SAAS,KAAK,GAGZ;AACA,QAAO;EAAE,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM;GAAG,CAAC;EAAE,SAAS,EAAE;EAAE;;;AAI9D,MAAM,iBAAiB,KAAK,OAAO;CACjC,OAAO,KAAK,OAAO,EAAE,aAAa,eAAe,OAAO,CAAC;CACzD,KAAK,KAAK,OAAO,EAAE,aAAa,eAAe,KAAK,CAAC;CACrD,cAAc,KAAK,OAAO,EAAE,aAAa,eAAe,cAAc,CAAC;CACvE,cAAc,KAAK,SACjB,KAAK,MAAM,KAAK,QAAQ,EAAE,EAAE,aAAa,eAAe,cAAc,CAAC,CACxE;CACD,UAAU,KAAK,SACb,KAAK,OAAO,EAAE,aAAa,eAAe,UAAU,CAAC,CACtD;CACD,aAAa,KAAK,SAChB,KAAK,OAAO,EAAE,aAAa,eAAe,aAAa,CAAC,CACzD;CACD,UAAU,KAAK,SACb,KAAK,OAAO,EAAE,aAAa,eAAe,UAAU,CAAC,CACtD;CACD,eAAe,KAAK,SAClB,KAAK,OAAO,EAAE,aAAa,eAAe,eAAe,CAAC,CAC3D;CACF,CAAC;AAGsD,OAAO,KAC7D,eAAe,WAChB;;AAGD,MAAM,kBAAkB,KAAK,OAAO;CAClC,QAAQ,KAAK,MAAM;EACjB,KAAK,QAAQ,OAAO;EACpB,KAAK,QAAQ,SAAS;EACtB,KAAK,QAAQ,aAAa;EAC3B,CAAC;CACF,SAAS;CACT,QAAQ,KAAK,SAAS,KAAK,OAAO,EAAE,aAAa,YAAY,CAAC,CAAC;CAC/D,iBAAiB,KAAK,SACpB,KAAK,MACH;EACE,KAAK,QAAQ,gBAAgB,cAAc;EAC3C,KAAK,QAAQ,gBAAgB,aAAa;EAC1C,KAAK,QAAQ,gBAAgB,QAAQ;EACtC,EACD,EAAE,aAAa,uBAAuB,CACvC,CACF;CACF,CAAC;AAGuD,OAAO,KAC9D,gBAAgB,WACjB;;AAGD,SAAgB,0BACd,KACkB;AA+ElB,QAAO;EA9Ea,WAAW;GAC7B,MAAM;GACN,OAAO;GACP,aACE;GACF,eACE;GACF,YAAY,KAAK,OAAO;IACtB,MAAM,KAAK,OAAO,EAChB,aAAa,0BAA0B,IAAI,WAAW,KAAK,KAAK,CAAC,IAClE,CAAC;IACF,OAAO,KAAK,SACV,KAAK,OAAO,EACV,aACE,wKACH,CAAC,CACH;IACD,QAAQ,KAAK,SAAS,KAAK,OAAO,KAAK,QAAQ,EAAE,KAAK,SAAS,CAAC,CAAC;IACjE,WAAW,KAAK,SACd,KAAK,MAAM,KAAK,QAAQ,EAAE,EACxB,aAAa,qDACd,CAAC,CACH;IACD,OAAO,KAAK,SACV,KAAK,OAAO,EAAE,aAAa,2BAA2B,CAAC,CACxD;IACD,QAAQ,KAAK,OAAO,EAClB,aAAa,wCACd,CAAC;IACH,CAAC;GACF,QAAQ,KAAK,MAAM;IACjB,MAAM,MAAM,aAAa,KAAK,KAAoB;AAClD,QAAI,CAAC,IAAI,IAAI;AACX,eAAU,cAAc,8BAA8B;MACpD,OAAO,IAAI;MACX,MAAO,KAAqB;MAC7B,CAAC;AACF,YAAO,QAAQ,QAAQ,KAAK,UAAU,IAAI,UAAU,CAAC;;AAEvD,WAAO,QAAQ,QAAQ,KAAK,KAAK,UAAU,EAAE,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC;;GAEpE,CAAC;EAEmB,WAAW;GAC9B,MAAM;GACN,OAAO;GACP,aACE;GACF,eACE;GACF,YAAY;GACZ,QAAQ,KAAK,MAAM;IACjB,MAAM,MAAM,cAAc,KAAK,KAAqB;AACpD,QAAI,CAAC,IAAI,GAAI,QAAO,QAAQ,QAAQ,KAAK,UAAU,IAAI,UAAU,CAAC;AAClE,WAAO,QAAQ,QAAQ,KAAK,KAAK,CAAC;;GAErC,CAAC;EAEmB,WAAW;GAC9B,MAAM;GACN,OAAO;GACP,aACE;GACF,eACE;GACF,YAAY,KAAK,OAAO;IACtB,MAAM,KAAK,SAAS,KAAK,QAAQ,CAAC;IAClC,QAAQ,KAAK,SAAS,KAAK,QAAQ,CAAC;IACrC,CAAC;GACF,QAAQ,KAAK,MAAM;IACjB,MAAM,WAAW,kBACf,KACA,KACD;AACD,WAAO,QAAQ,QAAQ,KAAK,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC,CAAC;;GAElE,CAAC;EAE8C"}

package/dist/pi-DpWFwz5u.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pi-DpWFwz5u.js","names":[],"sources":["../src/lib/agent/aio-capture.ts","../src/lib/agent/runner/harness/pi/completion.ts","../src/lib/agent/runner/harness/pi/index.ts"],"sourcesContent":["/**\n * aio-capture — mirror wizard LLM calls into the authenticated project's\n * AI Observability tab as `$ai_generation` events. Gated on `--capture-aio`\n * (dev/test builds only); returns a no-op instance when disabled so the\n * wire-in points stay a no-op with zero overhead.\n *\n * The wizard's LLM calls happen inside subprocesses we don't own (the\n * claude-agent-sdk CLI on the anthropic path, pi's own runtime on pi), so we\n * can't wrap the client with `posthog-node`'s `wrapAnthropic`. Instead, each\n * harness surfaces assistant turns on the way back — the SDK message stream\n * on anthropic, `agentSession.subscribe(message_end)` on pi — and this module\n * composes an `$ai_generation` event from either shape.\n *\n * For the Conversation tab in AIO to render anything, each generation needs\n * `$ai_input` (the messages the model saw when it produced this turn). The\n * initial prompt is passed to the SDK subprocess and never echoed back on\n * the stream, so callers must hand it to `setInitialPrompt` before the run\n * starts. From there we track user/assistant turns as they flow through the\n * stream, snapshotting the running conversation into each generation's\n * `$ai_input` and firing `$ai_input_state` / `$ai_output_state` on the\n * terminal `$ai_trace` event.\n *\n * POSTs are fire-and-forget: failures are debug-logged and never surfaced to\n * the main agent flow. Losing an AIO event must never break a run.\n */\n\nimport { logToFile } from '@utils/debug';\nimport { VERSION } from '@lib/version';\n\n/** Conversation turn shape both harnesses normalize to. Matches Anthropic\n *  message role/content conventions, which is also what AIO's Conversation\n *  tab knows how to render. */\ntype Turn = { role: 'user' | 'assistant'; content: unknown };\n\n/** Common shape both harness transforms emit; fed to the shared POST. */\ntype LLMTurn = {\n  provider: 'anthropic' | 'openai';\n  model: string;\n  /** Conversation up to (but not including) this assistant turn — the\n   *  messages the model saw. Sent as `$ai_input`. */\n  input: Turn[];\n  /** Content blocks (text + tool_use), passed through as $ai_output_choices. */\n  outputChoices: unknown[];\n  inputTokens?: number;\n  outputTokens?: number;\n  cacheReadTokens?: number;\n  cacheCreationTokens?: number;\n  /** Wall-clock ms since the previous assistant turn on this stream. */\n  latencyMs: number;\n  generationId?: string;\n  isError: boolean;\n};\n\nexport type AioCapture = {\n  /** Set the initial prompt the harness is about to send to the LLM. The\n   *  wizard passes this into the SDK subprocess out-of-band, so it never\n   *  appears on the return message stream — the caller must hand it to us\n   *  explicitly if we want `$ai_input` to include it. Safe to call multiple\n   *  times: latest wins, prior conversation state resets. */\n  setInitialPrompt(prompt: string): void;\n  /** Called for every SDK message on the anthropic harness stream. */\n  captureFromAnthropicSDKMessage(msg: unknown): void;\n  /** Called for every subscribe event on the pi harness. */\n  captureFromPiMessageEndEvent(event: unknown): void;\n};\n\nconst noop = (_: unknown): void => undefined;\nconst NOOP: AioCapture = {\n  setInitialPrompt: noop,\n  captureFromAnthropicSDKMessage: noop,\n  captureFromPiMessageEndEvent: noop,\n};\n\nexport function createAioCapture(args: {\n  enabled: boolean;\n  projectApiKey: string;\n  apiHost: string;\n  /** Trace tags from `buildRunTags` (program_id, integration, run_id, build, skill_id). */\n  runTags: Record<string, string>;\n}): AioCapture {\n  if (!args.enabled || !args.projectApiKey || !args.apiHost) return NOOP;\n\n  const { projectApiKey, apiHost, runTags } = args;\n  const distinctId = `wizard-cli-${VERSION}`;\n  const captureUrl = `${apiHost.replace(/\\/$/, '')}/capture/`;\n  const runStartAt = Date.now();\n  // Latency is measured against the previous assistant turn on this stream —\n  // a rough proxy for time-to-first-token that doesn't require SDK-internal\n  // timings. Reset per createAioCapture (once per agent run).\n  let prevTurnAt = runStartAt;\n  // Fire the top-level `$ai_trace` event at most once per instance. Both\n  // harnesses can emit terminal signals, and pi in particular may emit\n  // multiple `agent_end` events across nudges — first-wins keeps trace\n  // metadata stable in AIO.\n  let traceEnded = false;\n\n  // Running conversation state — grows as user and assistant turns flow\n  // through the stream. Snapshotted into `$ai_input` on each generation.\n  let initialPrompt: string | undefined;\n  let conversation: Turn[] = [];\n  let lastAssistantContent: unknown[] | undefined;\n\n  const postEvent = (\n    event: string,\n    properties: Record<string, unknown>,\n  ): void => {\n    const body = {\n      api_key: projectApiKey,\n      event,\n      distinct_id: distinctId,\n      properties: {\n        $ai_trace_id: runTags.run_id ?? '',\n        ...runTags,\n        ...properties,\n      },\n      timestamp: new Date().toISOString(),\n    };\n\n    // Fire-and-forget. `.then` + `.catch` (not `await`) so the caller returns\n    // immediately; both branches only log. Errors must never propagate into\n    // the agent stream loop.\n    fetch(captureUrl, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify(body),\n    })\n      .then((res) => {\n        if (!res.ok) {\n          logToFile(`[aio-capture] POST failed status=${res.status}`);\n        }\n      })\n      .catch((err) => {\n        logToFile(\n          `[aio-capture] POST error: ${\n            err instanceof Error ? err.message : String(err)\n          }`,\n        );\n      });\n  };\n\n  const postGeneration = (turn: LLMTurn): void => {\n    postEvent('$ai_generation', {\n      $ai_provider: turn.provider,\n      $ai_model: turn.model,\n      $ai_input: turn.input,\n      $ai_output_choices: turn.outputChoices,\n      $ai_input_tokens: turn.inputTokens ?? 0,\n      $ai_output_tokens: turn.outputTokens ?? 0,\n      $ai_cache_read_input_tokens: turn.cacheReadTokens ?? 0,\n      $ai_cache_creation_input_tokens: turn.cacheCreationTokens ?? 0,\n      $ai_latency: turn.latencyMs / 1000,\n      $ai_generation_id: turn.generationId ?? '',\n      $ai_is_error: turn.isError,\n    });\n  };\n\n  // Emit the top-level `$ai_trace` event. Without this, PostHog builds a\n  // pseudo-trace from the generations — the timeline and aggregates still\n  // work, but the trace has no readable name and the Conversation tab shows\n  // \"No top-level trace event\". Sending this once per run fills that in,\n  // and `$ai_input_state` / `$ai_output_state` populate the trace-level\n  // Conversation view.\n  const sendTraceEnd = (opts: { isError: boolean }): void => {\n    if (traceEnded) return;\n    traceEnded = true;\n    postEvent('$ai_trace', {\n      $ai_span_name: runTags.program_id ?? 'wizard-run',\n      $ai_latency: (Date.now() - runStartAt) / 1000,\n      $ai_is_error: opts.isError,\n      $ai_input_state: initialPrompt\n        ? [{ role: 'user', content: [{ type: 'text', text: initialPrompt }] }]\n        : [],\n      $ai_output_state: lastAssistantContent ?? [],\n    });\n  };\n\n  const anthropicAssistantTurn = (msg: unknown): LLMTurn | null => {\n    const m = msg as {\n      type?: string;\n      message?: {\n        id?: string;\n        model?: string;\n        content?: unknown;\n        usage?: {\n          input_tokens?: number;\n          output_tokens?: number;\n          cache_read_input_tokens?: number;\n          cache_creation_input_tokens?: number;\n        };\n      };\n    };\n    if (m?.type !== 'assistant' || !m.message) return null;\n    const now = Date.now();\n    const latencyMs = now - prevTurnAt;\n    prevTurnAt = now;\n    return {\n      provider: 'anthropic',\n      model: m.message.model ?? 'unknown',\n      input: [...conversation],\n      outputChoices: Array.isArray(m.message.content) ? m.message.content : [],\n      inputTokens: m.message.usage?.input_tokens,\n      outputTokens: m.message.usage?.output_tokens,\n      cacheReadTokens: m.message.usage?.cache_read_input_tokens,\n      cacheCreationTokens: m.message.usage?.cache_creation_input_tokens,\n      latencyMs,\n      generationId: m.message.id,\n      isError: false,\n    };\n  };\n\n  const piAssistantTurn = (event: unknown): LLMTurn | null => {\n    const e = event as {\n      type?: string;\n      message?: {\n        id?: string;\n        role?: string;\n        model?: string;\n        content?: unknown;\n        usage?: {\n          input_tokens?: number;\n          output_tokens?: number;\n          cache_read_input_tokens?: number;\n          cache_creation_input_tokens?: number;\n        };\n      };\n    };\n    // Pi emits message_end for user prompts too — filter to assistant only,\n    // mirroring the existing role guard at harness/pi/index.ts:434.\n    if (e?.type !== 'message_end' || e.message?.role !== 'assistant') {\n      return null;\n    }\n    const now = Date.now();\n    const latencyMs = now - prevTurnAt;\n    prevTurnAt = now;\n    return {\n      provider: 'anthropic',\n      model: e.message.model ?? 'unknown',\n      input: [...conversation],\n      outputChoices: Array.isArray(e.message.content) ? e.message.content : [],\n      inputTokens: e.message.usage?.input_tokens,\n      outputTokens: e.message.usage?.output_tokens,\n      cacheReadTokens: e.message.usage?.cache_read_input_tokens,\n      cacheCreationTokens: e.message.usage?.cache_creation_input_tokens,\n      latencyMs,\n      generationId: e.message.id,\n      isError: false,\n    };\n  };\n\n  return {\n    setInitialPrompt(prompt) {\n      initialPrompt = prompt;\n      // Reset conversation to the initial user turn — this is the only way\n      // the initial prompt gets into `$ai_input` for the first generation,\n      // since the SDK subprocess consumes it internally and doesn't echo it\n      // on the return stream.\n      conversation = [\n        { role: 'user', content: [{ type: 'text', text: prompt }] },\n      ];\n      lastAssistantContent = undefined;\n    },\n    captureFromAnthropicSDKMessage(msg) {\n      try {\n        // User turns (tool_result blocks between assistant turns) accumulate\n        // in the conversation so the next assistant generation carries the\n        // full context the model actually saw.\n        const m = msg as {\n          type?: string;\n          message?: { role?: string; content?: unknown };\n          is_error?: boolean;\n        };\n        if (m?.type === 'user' && m.message) {\n          conversation.push({\n            role: 'user',\n            content: m.message.content ?? [],\n          });\n        }\n        const turn = anthropicAssistantTurn(msg);\n        if (turn) {\n          postGeneration(turn);\n          // Push the assistant turn AFTER posting so the current generation's\n          // $ai_input is the conversation as the model saw it (not including\n          // its own response), and later turns include this one.\n          conversation.push({\n            role: 'assistant',\n            content: turn.outputChoices,\n          });\n          lastAssistantContent = turn.outputChoices;\n        }\n        // Terminal: SDK emits a `result` message at end of run.\n        if (m?.type === 'result') {\n          sendTraceEnd({ isError: !!m.is_error });\n        }\n      } catch (err) {\n        logToFile(\n          `[aio-capture] anthropic compose failed: ${\n            err instanceof Error ? err.message : String(err)\n          }`,\n        );\n      }\n    },\n    captureFromPiMessageEndEvent(event) {\n      try {\n        // Pi's subscribe callback surfaces both user and assistant\n        // message_end events. Accumulate user turns the same way as the\n        // anthropic path so `$ai_input` matches the model's view.\n        const e = event as {\n          type?: string;\n          message?: { role?: string; content?: unknown };\n          willRetry?: boolean;\n        };\n        if (\n          e?.type === 'message_end' &&\n          e.message?.role === 'user' &&\n          e.message\n        ) {\n          conversation.push({\n            role: 'user',\n            content: e.message.content ?? [],\n          });\n        }\n        const turn = piAssistantTurn(event);\n        if (turn) {\n          postGeneration(turn);\n          conversation.push({\n            role: 'assistant',\n            content: turn.outputChoices,\n          });\n          lastAssistantContent = turn.outputChoices;\n        }\n        // Terminal: pi emits `agent_end` when the session's prompt() resolves.\n        if (e?.type === 'agent_end' && !e.willRetry) {\n          sendTraceEnd({ isError: false });\n        }\n      } catch (err) {\n        logToFile(\n          `[aio-capture] pi compose failed: ${\n            err instanceof Error ? err.message : String(err)\n          }`,\n        );\n      }\n    },\n  };\n}\n","import { AgentErrorType } from '@lib/agent/signals';\n\n/** Which completion guard should fail a pi run, or undefined for a clean finish. */\nexport function completionFailure(args: {\n  toolCalls: number;\n  openTasks: boolean;\n}): AgentErrorType | undefined {\n  // No tool call at all — the project was never touched.\n  if (args.toolCalls === 0) return AgentErrorType.NO_PROGRESS;\n  // Acted but left tasks in its own plan unfinished (skill install not required).\n  if (args.openTasks) return AgentErrorType.INCOMPLETE_TASKS;\n  return undefined;\n}\n","/**\n * The `pi` backend — the challenger. Drives pi.dev's coding agent\n * (`@earendil-works/pi-coding-agent`) against the PostHog LLM gateway, behind\n * `wizard-orchestrator`. It owns the agent loop and model transport; prompt\n * assembly, error routing, and the outro stay in `linear.ts`, shared with the\n * `anthropic` control.\n *\n * Transport: the gateway is registered as an `anthropic-messages` provider\n * (same protocol the claude-agent-sdk path uses), bearer auth, Bedrock-fallback\n * + wizard metadata/flag headers, model id matched to `anthropic` for a clean\n * A/B. Security parity (canUseTool + YARA) and skills/MCP discovery are\n * follow-ups (#525, #524 skills) — v1 uses pi's built-in coding tools.\n */\n\nimport fs from 'fs';\nimport path from 'path';\nimport { getUI } from '@ui';\nimport { getLogFilePath, logToFile } from '@utils/debug';\nimport {\n  Harness,\n  Sequence,\n  WIZARD_REMARK_EVENT_NAME,\n  WIZARD_USER_AGENT,\n} from '@lib/constants';\nimport { analytics } from '@utils/analytics';\nimport { AgentErrorType } from '@lib/agent/agent-interface';\nimport { AgentSignals, REMARK_INSTRUCTION } from '@lib/agent/signals';\nimport { AgentOutputSignals } from '@lib/agent/output-signals';\nimport { assembleCommandments } from '../../switchboard/commandments';\nimport { gatewayAuth, type GatewayAuth } from '@lib/gateway-session';\nimport {\n  buildGatewayProvider,\n  GATEWAY_PROVIDER,\n  withGatewayRemint,\n} from './gateway';\nimport { createAioCapture } from '@lib/agent/aio-capture';\nimport type {\n  AgentResult,\n  AgentHarness,\n  BackendRunInputs,\n  TaskRunInputs,\n} from '../types';\nimport type { BootstrapResult } from '@lib/agent/runner/shared/types';\nimport type { TaskStore } from './tasks';\nimport { completionFailure } from './completion';\n\n/** Injects the MCP server `instructions` pi-mcp-adapter drops (project env, skill steer, tool domains) into the system prompt, falling back to a bootstrap-derived project block when the warm-connect captured none. */\nfunction piMcpContext(\n  boot: BootstrapResult,\n  instructions?: string,\n  posthogMcp = true,\n): string {\n  // No tool, no block. The fallback below names `posthog_exec`, so emitting it\n  // after a failed handshake points the agent at a tool that is not registered.\n  if (!posthogMcp) return '';\n  if (instructions) {\n    // Heading + verbatim server instructions (see PR #862 for a full sample).\n    return ['', '## PostHog MCP server', instructions].join('\\n');\n  }\n  const project = boot.project?.name\n    ? `${boot.project.name} (id ${boot.credentials.projectId})`\n    : `id ${boot.credentials.projectId}`;\n  // Fallback: a `## PostHog project` block with name/id, host, region.\n  return [\n    '',\n    '## PostHog project',\n    'Your `posthog_exec` calls run against this project:',\n    `- Project: ${project}`,\n    `- Host: ${boot.credentials.host.apiHost}`,\n    `- Region: ${boot.credentials.host.region}`,\n  ].join('\\n');\n}\n\n/**\n * The ONLY environment variables pi's tool subprocesses (bash → npm/pip/…) are\n * allowed to see. Everything else — every secret (POSTHOG_PERSONAL_API_KEY,\n * ANTHROPIC_*, AWS_*), every ambient credential, the parent process's whole env\n * — is dropped before a child is spawned. pi's own gateway auth is programmatic\n * (the access token never lives in env), so a minimal env costs the agent\n * nothing while closing the leak that exposed the key before. Kept to what a\n * package manager genuinely needs to run.\n */\nconst ALLOWED_SUBPROCESS_ENV_KEYS = [\n  'PATH',\n  'HOME',\n  'SHELL',\n  'USER',\n  'LOGNAME',\n  'TMPDIR',\n  'TMP',\n  'TEMP',\n  'TERM',\n  'LANG',\n  'LC_ALL',\n  'LC_CTYPE',\n  'NODE_EXTRA_CA_CERTS',\n  'SSL_CERT_FILE',\n  'SSL_CERT_DIR',\n  'HTTP_PROXY',\n  'HTTPS_PROXY',\n  'NO_PROXY',\n  'http_proxy',\n  'https_proxy',\n  'no_proxy',\n];\n\n/** A fresh subprocess env holding only the allowlisted keys present in process.env. */\nexport function buildScrubbedEnv(): NodeJS.ProcessEnv {\n  const env: NodeJS.ProcessEnv = {};\n  for (const key of ALLOWED_SUBPROCESS_ENV_KEYS) {\n    const value = process.env[key];\n    if (value !== undefined) env[key] = value;\n  }\n  return env;\n}\n\n/**\n * Tag a tool with an execution mode (mutates + returns it). Read-only tools are\n * `parallel` so a single turn that batches independent reads/searches runs them\n * at once; mutating/install tools are `sequential` so a batch never races writes\n * or concurrent installs. pi-agent-core runs a batch in parallel only when no\n * tool in it is `sequential`.\n */\nexport function withMode<T>(tool: T, mode: 'sequential' | 'parallel'): T {\n  (tool as { executionMode?: 'sequential' | 'parallel' }).executionMode = mode;\n  return tool;\n}\n\n/** Pull plain text out of a pi AgentMessage (content is text/image blocks). */\nexport function extractText(message: unknown): string {\n  const content = (message as { content?: unknown })?.content;\n  if (typeof content === 'string') return content;\n  if (Array.isArray(content)) {\n    return content\n      .filter((c): c is { type: string; text: string } => {\n        const block = c as { type?: string; text?: unknown };\n        return block?.type === 'text' && typeof block.text === 'string';\n      })\n      .map((c) => c.text)\n      .join('');\n  }\n  return '';\n}\n\n/**\n * Surface `[DASHBOARD_URL]` / `[NOTEBOOK_URL]` markers the agent prints (after\n * the MCP creates them) into the outro link, mirroring the anthropic path's\n * signal parsing (#9). The marker carries the URL the MCP returned.\n */\nexport function applyOutroMarkers(textBlock: string): void {\n  const markers: Array<[string, (url: string) => void]> = [\n    [AgentSignals.DASHBOARD_URL, (url) => getUI().setDashboardUrl(url)],\n    [AgentSignals.NOTEBOOK_URL, (url) => getUI().setNotebookUrl(url)],\n  ];\n  for (const [marker, apply] of markers) {\n    const idx = textBlock.indexOf(marker);\n    if (idx === -1) continue;\n    const url = textBlock\n      .slice(idx + marker.length)\n      .trim()\n      .split(/\\s/)[0];\n    if (url) apply(url);\n  }\n}\n\n/**\n * The text of the last `[STATUS] …` line in a block, if any. Last wins so the\n * spinner shows the most recent action when a turn prints several.\n */\nexport function lastStatusLine(textBlock: string): string | undefined {\n  let status: string | undefined;\n  for (const line of textBlock.split('\\n')) {\n    const idx = line.indexOf(AgentSignals.STATUS);\n    if (idx !== -1) {\n      status = line.slice(idx + AgentSignals.STATUS.length).trim();\n    }\n  }\n  return status || undefined;\n}\n\n/** Cap on completion-guard re-prompts while tasks remain open (see the run loop). */\nconst MAX_CONTINUE_NUDGES = 20;\n\n/** Nudge re-sent when the agent stops early with tasks still open. */\nconst CONTINUE_INSTRUCTION =\n  'You still have open tasks in your list (not all are marked `completed`). Do not stop — pick up the next `in_progress` or `pending` task and keep working until every task is `completed`. Continue now.';\n\n/** True while any task in the store is not yet `completed`. */\nfunction hasOpenTasks(store: TaskStore): boolean {\n  for (const t of store.values()) if (t.status !== 'completed') return true;\n  return false;\n}\n\nexport const piBackend: AgentHarness = {\n  name: Harness.pi,\n\n  async run(inputs: BackendRunInputs): Promise<AgentResult> {\n    const { session, boot, prompt, spinner, config, programConfig } = inputs;\n    const modelId = inputs.model;\n\n    const capture = createAioCapture({\n      enabled: session.captureAio,\n      projectApiKey: boot.credentials.projectApiKey,\n      apiHost: boot.credentials.host.apiHost,\n      runTags: boot.wizardMetadata,\n    });\n\n    // Init banner (parity #5).\n    getUI().log.step('Initializing Wizard agent...');\n    getUI().log.step(`Verbose logs: ${getLogFilePath()}`);\n    getUI().log.success(\"Agent initialized. Let's get cooking!\");\n\n    spinner.start(config.spinnerMessage ?? 'Customizing your PostHog setup...');\n\n    // Same `agent completed`/`agent aborted` shape as anthropic.\n    const startTime = Date.now();\n    const signals = new AgentOutputSignals();\n    let assistantTurns = 0;\n    // Tool calls across the whole run. Zero means the agent only ever produced\n    // text and never acted — a no-op that leaves the project untouched.\n    let toolCalls = 0;\n    const runDurations = () => {\n      const durationMs = Date.now() - startTime;\n      return {\n        duration_ms: durationMs,\n        duration_seconds: Math.round(durationMs / 1000),\n      };\n    };\n    const captureAborted = () =>\n      analytics.wizardCapture('agent aborted', {\n        ...runDurations(),\n        model: modelId,\n      });\n\n    try {\n      const {\n        createAgentSession,\n        DefaultResourceLoader,\n        SessionManager,\n        AuthStorage,\n        ModelRegistry,\n        getAgentDir,\n        createLsToolDefinition,\n        createFindToolDefinition,\n        createGrepToolDefinition,\n        createBashToolDefinition,\n        createReadToolDefinition,\n        createEditToolDefinition,\n        createWriteToolDefinition,\n      } = await import('@earendil-works/pi-coding-agent');\n\n      // the claude-agent-sdk path. The provider spec is shared with the\n      // orchestrator's per-task sessions (gateway.ts). gatewayAuth mints the\n      // run's scoped token.\n      const refreshAuth = () =>\n        gatewayAuth(\n          boot.credentials.host,\n          boot.credentials.accessToken,\n          boot.programId,\n        );\n      const auth = await refreshAuth();\n      const providerInputs = (current: GatewayAuth) => ({\n        gatewayUrl: current.gatewayUrl,\n        accessToken: current.token,\n        teamId: current.teamId,\n        legacy: current.legacy,\n        wizardMetadata: boot.wizardMetadata,\n        wizardFlags: boot.wizardFlags,\n        modelId,\n        effort: inputs.thinkingLevel,\n      });\n      const { provider, caps } = buildGatewayProvider(providerInputs(auth));\n      const registry = ModelRegistry.inMemory(AuthStorage.create());\n      registry.registerProvider(GATEWAY_PROVIDER, provider as never);\n\n      const model = registry.find(GATEWAY_PROVIDER, modelId);\n      if (!model) {\n        return {\n          error: AgentErrorType.API_ERROR,\n          message: 'pi: gateway model could not be resolved',\n        };\n      }\n\n      // System prompt = wizard commandments. Skip project context files /\n      // user extensions / skills so the run is hermetic; skills discovery is a\n      // follow-up (#524).\n      //\n      // Fail-closed security (#525): an extension intercepts EVERY tool call —\n      // built-in and custom — and reuses the anthropic policy (canUseTool\n      // allowlist + .env fencing + YARA). `noExtensions: true` only suppresses\n      // disk-discovered extensions; explicit `extensionFactories` still load,\n      // so the fence is on while the target project can't inject its own.\n      // Shared flag: true while a wizard_ask overlay is open. The ask tool\n      // flips it; the security gate reads it to block Write/Edit meanwhile.\n      const askState = { pending: false };\n\n      const { createSecurityExtension } = await import('./security');\n      const security = createSecurityExtension({\n        disallowedTools: programConfig.disallowedTools,\n        getWizardAskPending: () => askState.pending,\n        triageProvider: boot.triageProvider,\n        // Where pi's bash runs; the rm allowance is confined to this tree.\n        workingDirectory: session.installDir,\n      });\n\n      // Pay warlock's WASM-init + rule-compile cost now, off the tool-call\n      // path, so the first scanned call doesn't eat cold-start latency.\n      const { prewarmYaraScanner } = await import('@lib/yara-hooks');\n      void prewarmYaraScanner();\n\n      // Wire the real PostHog MCP into pi (#10): load pi's MCP adapter and point\n      // it at the hosted MCP the anthropic path uses, so dashboards/insights are\n      // created through the sanctioned MCP. Best-effort — if it can't load or\n      // connect, the run continues (minus the dashboard step) rather than failing\n      // the whole integration. The security factory is always first.\n      const extensionFactories = [security.factory] as Array<\n        (pi: unknown) => void\n      >;\n      let mcpCleanup: (() => void) | undefined;\n      let mcpInstructions: string | undefined;\n      // Whether the agent really got the tool. The commandments below claim\n      // `posthog_exec` exists when this is true, so it must track the setup and\n      // not the intent — a hardcoded `true` told the agent to call a tool the\n      // failed handshake never registered. `task.ts` has always done this.\n      let posthogMcp = false;\n      try {\n        const { setupPostHogMcp, fetchInstructions } = await import('./mcp');\n        // Overlaps the network handshake with the adapter's jiti load.\n        const instructionsPromise = fetchInstructions(\n          boot.credentials.host.mcpUrl,\n          boot.credentials.accessToken,\n          WIZARD_USER_AGENT,\n        );\n        const mcp = await setupPostHogMcp({\n          mcpUrl: boot.credentials.host.mcpUrl,\n          accessToken: boot.credentials.accessToken,\n          userAgent: WIZARD_USER_AGENT,\n        });\n        extensionFactories.push(mcp.extensionFactory);\n        mcpCleanup = mcp.cleanup;\n        mcpInstructions = await instructionsPromise;\n        posthogMcp = true;\n      } catch (err) {\n        logToFile(`[pi] PostHog MCP setup skipped: ${String(err)}`);\n        analytics.wizardCapture('mcp setup failed', {\n          harness: 'pi',\n          scope: 'run',\n          error: String(err).slice(0, 300),\n        });\n      }\n\n      const resourceLoader = new DefaultResourceLoader({\n        cwd: session.installDir,\n        agentDir: getAgentDir(),\n        systemPrompt:\n          assembleCommandments({\n            program: programConfig.id,\n            sequence: Sequence.linear,\n            harness: Harness.pi,\n            caps: { bash: true, posthogMcp },\n          }) +\n          '\\n' +\n          piMcpContext(boot, mcpInstructions, posthogMcp),\n        noExtensions: true,\n        noSkills: true,\n        noContextFiles: true,\n        noPromptTemplates: true,\n        noThemes: true,\n        extensionFactories,\n      });\n      await resourceLoader.reload();\n\n      // Wizard capabilities as custom tools (pi has no MCP): skill\n      // discovery/install + fenced .env edits, same names as the MCP server so\n      // the shared prompt is unchanged. pi's built-in Read/Write/Edit/Bash do\n      // the code changes. Loaded lazily — it pulls in typebox (ESM), which must\n      // stay out of the static module graph so CommonJS unit tests can load the\n      // backend seam without parsing it.\n      const { createWizardPiTools } = await import('./tools');\n      const { createWizardPiTaskTools } = await import('./tasks');\n      const { createDispatchAgentTool } = await import('./subagent');\n      // Created once so the run loop can read the store for the completion guard.\n      const wizardTaskTools = createWizardPiTaskTools();\n      // The one bash the agent (and its subagents) may use: every subprocess it\n      // spawns gets a scrubbed env, so no secret or ambient variable reaches an\n      // `npm install`. Shared with the subagent so the lockdown is inherited.\n      const scrubbedBash = withMode(\n        createBashToolDefinition(session.installDir, {\n          spawnHook: (ctx) => ({ ...ctx, env: buildScrubbedEnv() }),\n        }),\n        'sequential',\n      );\n\n      const customTools = [\n        // Built-ins re-registered explicitly. `noTools: 'builtin'` disables pi's\n        // defaults so we can supply the env-scrubbed bash above; read/edit/write\n        // are the stock definitions. Reads run in parallel so a batched turn of\n        // independent reads executes at once; edit/write/bash stay sequential.\n        withMode(createReadToolDefinition(session.installDir), 'parallel'),\n        withMode(createEditToolDefinition(session.installDir), 'sequential'),\n        withMode(createWriteToolDefinition(session.installDir), 'sequential'),\n        scrubbedBash,\n        // Native ls/find/grep so the agent explores with proper tools instead\n        // of fence-blocked `bash {ls/find}` (the profiled retry-spirals came\n        // from this gap). Parallel — exploration batches cleanly.\n        withMode(createLsToolDefinition(session.installDir), 'parallel'),\n        withMode(createFindToolDefinition(session.installDir), 'parallel'),\n        withMode(createGrepToolDefinition(session.installDir), 'parallel'),\n        ...createWizardPiTools({\n          workingDirectory: session.installDir,\n          skillsBaseUrl: boot.skillsBaseUrl,\n          triageProvider: boot.triageProvider,\n          detectPackageManager: config.detectPackageManager,\n          // The host ask bridge — lets interactive programs (self-driving) ask\n          // the user through pi. Threaded from the runner, same path as the\n          // anthropic harness. Absent in CI → the tool errors on call.\n          askBridge: inputs.askBridge,\n          maxQuestions: config.maxQuestions,\n          onAskPendingChange: (pending) => {\n            askState.pending = pending;\n          },\n          // Skip wizard_ask when the program disallows it (bare pi tool names\n          // don't match the MCP-prefixed disallow list at the security gate).\n          disallowedTools: programConfig.disallowedTools,\n        }),\n        // Task/todo tools (#526): render the todo list live in the TUI, parity\n        // with the anthropic path.\n        ...wizardTaskTools.tools,\n        // Controlled subagent dispatch (#526): a nested fenced session with a\n        // read-only toolset and no dispatch_agent of its own, so it can't\n        // escape the fence or recurse.\n        createDispatchAgentTool({\n          model,\n          modelRegistry: registry,\n          cwd: session.installDir,\n          agentDir: getAgentDir(),\n          securityFactory: security.factory as (pi: unknown) => void,\n          bashTool: scrubbedBash,\n          sdk: { createAgentSession, DefaultResourceLoader, SessionManager },\n        }),\n      ];\n\n      const { session: agentSession } = await createAgentSession({\n        model,\n        modelRegistry: registry,\n        // Reasoning effort from the switchboard capability matrix (undefined =\n        // pi's default). Sent as `reasoning_effort` for openai-completions.\n        thinkingLevel: caps.thinkingLevel,\n        cwd: session.installDir,\n        sessionManager: SessionManager.inMemory(session.installDir),\n        resourceLoader,\n        // Disable the default built-in tools; `customTools` re-registers\n        // read/edit/write + an env-scrubbed bash, so no subprocess inherits the\n        // host env. Custom + extension tools stay enabled.\n        noTools: 'builtin',\n        customTools,\n      });\n\n      // Fire the extension lifecycle — what interactive mode does via\n      // rebindCurrentSession. createAgentSession builds the session but does not\n      // emit session_start on its own, and the MCP adapter connects on that\n      // event; without this its tools report \"MCP not initialized\".\n      await agentSession.bindExtensions({});\n\n      // A turn that ends on a 401 from an aged bearer re-mints once and\n      // continues; pi resolves the provider's apiKey per request, so\n      // re-registering is enough.\n      const turns = withGatewayRemint({\n        session: agentSession,\n        registry,\n        auth,\n        refreshAuth,\n        providerInputs,\n        continueText: CONTINUE_INSTRUCTION,\n        onRemint: () => {\n          logToFile('[pi] gateway token renewed after a 401; continuing');\n          analytics.wizardCapture('gateway token reminted', { harness: 'pi' });\n        },\n      });\n\n      // Map pi events onto the run spinner + the log file, mirroring the\n      // anthropic path's log shape (assistant turns + tool I/O) and driving the\n      // single run spinner with one stable status at a time (no overlap).\n      const unsubscribe = agentSession.subscribe((event) => {\n        // Mirror the turn into AIO. No-op when --capture-aio is off. Runs\n        // before the role guard so the module's own filter (assistant-only)\n        // stays the single source of truth for what's captured.\n        capture.captureFromPiMessageEndEvent(event);\n\n        switch (event.type) {\n          case 'message_end': {\n            // User prompts also emit message_end; only assistant turns count.\n            if ((event.message as { role?: string })?.role !== 'assistant') {\n              break;\n            }\n            assistantTurns += 1;\n            turns.noteAssistantTurn(event.message);\n            const assistant = extractText(event.message).trim();\n            if (assistant) {\n              logToFile(`[pi] assistant: ${assistant.slice(0, 1000)}`);\n              applyOutroMarkers(assistant);\n              // Surface [STATUS] lines into the live spinner + status history,\n              // mirroring the anthropic path — pi otherwise drops them.\n              const statusText = lastStatusLine(assistant);\n              if (statusText) {\n                getUI().pushStatus(statusText);\n                spinner.message(statusText);\n              }\n              for (const line of assistant.split('\\n')) signals.push(line);\n            }\n            break;\n          }\n          case 'tool_execution_start': {\n            toolCalls += 1;\n            const args = JSON.stringify(event.args ?? {}).slice(0, 200);\n            logToFile(`[pi] → ${event.toolName} ${args}`);\n            // Don't surface raw tool names in the spinner — the anthropic path\n            // doesn't, and it reads as noise. The Task panel (syncTodos) is the\n            // visible progress, matching the anthropic presentation.\n            break;\n          }\n          case 'tool_execution_end': {\n            // Log every result in full, matching the anthropic path's\n            // SDK-message logging. Call-only logs make failed runs\n            // undiagnosable: a tool can fail (or return something the model\n            // misreads) with no trace of what came back.\n            logToFile(\n              `[pi] ${event.isError ? '✗' : '←'} ${event.toolName}: ${\n                typeof event.result === 'string'\n                  ? event.result\n                  : JSON.stringify(event.result ?? '')\n              }`,\n            );\n            break;\n          }\n          case 'agent_end': {\n            logToFile(`[pi] agent_end (willRetry=${String(event.willRetry)})`);\n            break;\n          }\n          default:\n            break;\n        }\n      });\n\n      // Seed AIO capture with the initial prompt so the first assistant\n      // turn's `$ai_input` includes it — pi's subscribe stream doesn't emit\n      // a message_end for the initial prompt, only for tool_result user\n      // turns that follow.\n      capture.setInitialPrompt(prompt);\n\n      try {\n        // Non-streaming: resolves when the agent run completes. Throws if no\n        // model/api key, or on a transport error.\n        await turns.prompt(prompt);\n\n        // Completion guard: pi's prompt() resolves the moment the model returns\n        // a turn with no tool call (e.g. a lone [STATUS] line), even mid-plan.\n        // While tasks remain open and we're under the cap, nudge it to continue.\n        let continueNudges = 0;\n        while (\n          continueNudges < MAX_CONTINUE_NUDGES &&\n          !security.state.criticalViolation &&\n          hasOpenTasks(wizardTaskTools.store)\n        ) {\n          continueNudges += 1;\n          logToFile(\n            `[pi] completion guard: tasks still open, nudge ${continueNudges}/${MAX_CONTINUE_NUDGES}`,\n          );\n          await turns.prompt(CONTINUE_INSTRUCTION);\n        }\n\n        // Best-effort remark ask — a failed turn never fails a successful run.\n        if (!security.state.criticalViolation) {\n          try {\n            await agentSession.prompt(REMARK_INSTRUCTION);\n          } catch (err) {\n            logToFile(`[pi] remark request failed: ${String(err)}`);\n          }\n        }\n      } finally {\n        unsubscribe();\n        mcpCleanup?.();\n      }\n\n      // A latched post-scan violation terminates the run as a YARA violation,\n      // matching the anthropic path's AgentErrorType.YARA_VIOLATION.\n      if (security.state.criticalViolation) {\n        spinner.stop('Security violation detected');\n        logToFile(\n          `[pi] terminated: YARA violation (blocked ${security.state.blockedCount} call(s))`,\n        );\n        captureAborted();\n        return { error: AgentErrorType.YARA_VIOLATION };\n      }\n\n      // pi ends a run on any tool-call-less turn, so guard against a hollow\n      // success reaching the outro (nothing done, or stopped mid-plan).\n      const openTasks = hasOpenTasks(wizardTaskTools.store);\n      const failure = completionFailure({ toolCalls, openTasks });\n      if (failure === AgentErrorType.NO_PROGRESS) {\n        spinner.stop('Agent made no changes');\n        logToFile(\n          `[pi] no progress: ${assistantTurns} assistant turn(s), 0 tool calls`,\n        );\n        analytics.wizardCapture('agent no progress', {\n          assistant_turns: assistantTurns,\n        });\n        captureAborted();\n        return { error: failure };\n      }\n      if (failure === AgentErrorType.INCOMPLETE_TASKS) {\n        spinner.stop('Agent stopped before finishing');\n        logToFile('[pi] incomplete: tasks left open');\n        analytics.wizardCapture('agent incomplete tasks', { open_tasks: true });\n        captureAborted();\n        return { error: failure };\n      }\n\n      const remark = signals.remark();\n      if (remark) {\n        analytics.capture(WIZARD_REMARK_EVENT_NAME, { remark });\n      }\n\n      // A failed install_skill is non-fatal — the agent continues best-effort\n      // without the skill — but every such run must be measurable.\n      const skillFailure = signals.skillInstallFailure();\n      if (skillFailure !== undefined) {\n        analytics.wizardCapture('agent continued without skill', {\n          detail: skillFailure,\n        });\n      }\n\n      // The skill plans events into .posthog-events.json then asks to remove it\n      // on completion; pi's `rm` is fence-blocked, so the agent can't — clean it\n      // up host-side rather than leave a stale (often empty) artifact (#15).\n      try {\n        const planFile = path.join(session.installDir, '.posthog-events.json');\n        if (fs.existsSync(planFile)) await fs.promises.rm(planFile);\n      } catch (err) {\n        logToFile(`[pi] .posthog-events.json cleanup skipped: ${String(err)}`);\n      }\n\n      const stats = agentSession.getSessionStats();\n      analytics.wizardCapture('agent completed', {\n        ...runDurations(),\n        model: modelId,\n        num_turns: assistantTurns,\n        // API-reported tokens only; no total_cost_usd — the API returns no\n        // cost, and $ai_generation already prices the run authoritatively.\n        input_tokens: stats.tokens.input,\n        output_tokens: stats.tokens.output,\n        cache_creation_input_tokens: stats.tokens.cacheWrite,\n        cache_read_input_tokens: stats.tokens.cacheRead,\n      });\n      spinner.stop(config.successMessage ?? 'PostHog integration complete');\n      return {};\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err);\n      logToFile(`[pi] run error: ${message}`);\n      spinner.stop(config.errorMessage ?? `${config.integrationLabel} failed`);\n      getUI().log.error(`pi backend error: ${message}`);\n      captureAborted();\n\n      const lower = message.toLowerCase();\n      if (lower.includes('rate limit') || lower.includes('429')) {\n        return { error: AgentErrorType.RATE_LIMIT, message };\n      }\n      return { error: AgentErrorType.API_ERROR, message };\n    }\n  },\n\n  // Orchestrator mode: one fresh pi session per seed plan / drained task, with\n  // the in-process queue tools registered as pi custom tools. Lazily imported —\n  // task.ts pulls in typebox (ESM), which must stay out of the static module\n  // graph so CommonJS unit tests can load the backend seam without parsing it.\n  async runTask(inputs: TaskRunInputs): Promise<AgentResult> {\n    const { runPiTask } = await import('./task');\n    return runPiTask(inputs);\n  },\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkEA,MAAM,QAAQ,MAAqB,KAAA;AACnC,MAAM,OAAmB;CACvB,kBAAkB;CAClB,gCAAgC;CAChC,8BAA8B;CAC/B;AAED,SAAgB,iBAAiB,MAMlB;AACb,KAAI,CAAC,KAAK,WAAW,CAAC,KAAK,iBAAiB,CAAC,KAAK,QAAS,QAAO;CAElE,MAAM,EAAE,eAAe,SAAS,YAAY;CAC5C,MAAM,aAAa,cAAc;CACjC,MAAM,aAAa,GAAG,QAAQ,QAAQ,OAAO,GAAG,CAAC;CACjD,MAAM,aAAa,KAAK,KAAK;CAI7B,IAAI,aAAa;CAKjB,IAAI,aAAa;CAIjB,IAAI;CACJ,IAAI,eAAuB,EAAE;CAC7B,IAAI;CAEJ,MAAM,aACJ,OACA,eACS;EACT,MAAM,OAAO;GACX,SAAS;GACT;GACA,aAAa;GACb,YAAY;IACV,cAAc,QAAQ,UAAU;IAChC,GAAG;IACH,GAAG;IACJ;GACD,4BAAW,IAAI,MAAM,EAAC,aAAa;GACpC;AAKD,QAAM,YAAY;GAChB,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAC/C,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC,CACC,MAAM,QAAQ;AACb,OAAI,CAAC,IAAI,GACP,WAAU,oCAAoC,IAAI,SAAS;IAE7D,CACD,OAAO,QAAQ;AACd,aACE,6BACE,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GAEnD;IACD;;CAGN,MAAM,kBAAkB,SAAwB;AAC9C,YAAU,kBAAkB;GAC1B,cAAc,KAAK;GACnB,WAAW,KAAK;GAChB,WAAW,KAAK;GAChB,oBAAoB,KAAK;GACzB,kBAAkB,KAAK,eAAe;GACtC,mBAAmB,KAAK,gBAAgB;GACxC,6BAA6B,KAAK,mBAAmB;GACrD,iCAAiC,KAAK,uBAAuB;GAC7D,aAAa,KAAK,YAAY;GAC9B,mBAAmB,KAAK,gBAAgB;GACxC,cAAc,KAAK;GACpB,CAAC;;CASJ,MAAM,gBAAgB,SAAqC;AACzD,MAAI,WAAY;AAChB,eAAa;AACb,YAAU,aAAa;GACrB,eAAe,QAAQ,cAAc;GACrC,cAAc,KAAK,KAAK,GAAG,cAAc;GACzC,cAAc,KAAK;GACnB,iBAAiB,gBACb,CAAC;IAAE,MAAM;IAAQ,SAAS,CAAC;KAAE,MAAM;KAAQ,MAAM;KAAe,CAAC;IAAE,CAAC,GACpE,EAAE;GACN,kBAAkB,wBAAwB,EAAE;GAC7C,CAAC;;CAGJ,MAAM,0BAA0B,QAAiC;EAC/D,MAAM,IAAI;AAcV,MAAI,GAAG,SAAS,eAAe,CAAC,EAAE,QAAS,QAAO;EAClD,MAAM,MAAM,KAAK,KAAK;EACtB,MAAM,YAAY,MAAM;AACxB,eAAa;AACb,SAAO;GACL,UAAU;GACV,OAAO,EAAE,QAAQ,SAAS;GAC1B,OAAO,CAAC,GAAG,aAAa;GACxB,eAAe,MAAM,QAAQ,EAAE,QAAQ,QAAQ,GAAG,EAAE,QAAQ,UAAU,EAAE;GACxE,aAAa,EAAE,QAAQ,OAAO;GAC9B,cAAc,EAAE,QAAQ,OAAO;GAC/B,iBAAiB,EAAE,QAAQ,OAAO;GAClC,qBAAqB,EAAE,QAAQ,OAAO;GACtC;GACA,cAAc,EAAE,QAAQ;GACxB,SAAS;GACV;;CAGH,MAAM,mBAAmB,UAAmC;EAC1D,MAAM,IAAI;AAiBV,MAAI,GAAG,SAAS,iBAAiB,EAAE,SAAS,SAAS,YACnD,QAAO;EAET,MAAM,MAAM,KAAK,KAAK;EACtB,MAAM,YAAY,MAAM;AACxB,eAAa;AACb,SAAO;GACL,UAAU;GACV,OAAO,EAAE,QAAQ,SAAS;GAC1B,OAAO,CAAC,GAAG,aAAa;GACxB,eAAe,MAAM,QAAQ,EAAE,QAAQ,QAAQ,GAAG,EAAE,QAAQ,UAAU,EAAE;GACxE,aAAa,EAAE,QAAQ,OAAO;GAC9B,cAAc,EAAE,QAAQ,OAAO;GAC/B,iBAAiB,EAAE,QAAQ,OAAO;GAClC,qBAAqB,EAAE,QAAQ,OAAO;GACtC;GACA,cAAc,EAAE,QAAQ;GACxB,SAAS;GACV;;AAGH,QAAO;EACL,iBAAiB,QAAQ;AACvB,mBAAgB;AAKhB,kBAAe,CACb;IAAE,MAAM;IAAQ,SAAS,CAAC;KAAE,MAAM;KAAQ,MAAM;KAAQ,CAAC;IAAE,CAC5D;AACD,0BAAuB,KAAA;;EAEzB,+BAA+B,KAAK;AAClC,OAAI;IAIF,MAAM,IAAI;AAKV,QAAI,GAAG,SAAS,UAAU,EAAE,QAC1B,cAAa,KAAK;KAChB,MAAM;KACN,SAAS,EAAE,QAAQ,WAAW,EAAE;KACjC,CAAC;IAEJ,MAAM,OAAO,uBAAuB,IAAI;AACxC,QAAI,MAAM;AACR,oBAAe,KAAK;AAIpB,kBAAa,KAAK;MAChB,MAAM;MACN,SAAS,KAAK;MACf,CAAC;AACF,4BAAuB,KAAK;;AAG9B,QAAI,GAAG,SAAS,SACd,cAAa,EAAE,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC;YAElC,KAAK;AACZ,cACE,2CACE,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GAEnD;;;EAGL,6BAA6B,OAAO;AAClC,OAAI;IAIF,MAAM,IAAI;AAKV,QACE,GAAG,SAAS,iBACZ,EAAE,SAAS,SAAS,UACpB,EAAE,QAEF,cAAa,KAAK;KAChB,MAAM;KACN,SAAS,EAAE,QAAQ,WAAW,EAAE;KACjC,CAAC;IAEJ,MAAM,OAAO,gBAAgB,MAAM;AACnC,QAAI,MAAM;AACR,oBAAe,KAAK;AACpB,kBAAa,KAAK;MAChB,MAAM;MACN,SAAS,KAAK;MACf,CAAC;AACF,4BAAuB,KAAK;;AAG9B,QAAI,GAAG,SAAS,eAAe,CAAC,EAAE,UAChC,cAAa,EAAE,SAAS,OAAO,CAAC;YAE3B,KAAK;AACZ,cACE,oCACE,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GAEnD;;;EAGN;;;;;ACnVH,SAAgB,kBAAkB,MAGH;AAE7B,KAAI,KAAK,cAAc,EAAG,QAAA;AAE1B,KAAI,KAAK,UAAW,QAAA;;;;;;;;;;;;;;;;;;ACqCtB,SAAS,aACP,MACA,cACA,aAAa,MACL;AAGR,KAAI,CAAC,WAAY,QAAO;AACxB,KAAI,aAEF,QAAO;EAAC;EAAI;EAAyB;EAAa,CAAC,KAAK,KAAK;AAM/D,QAAO;EACL;EACA;EACA;EACA,cARc,KAAK,SAAS,OAC1B,GAAG,KAAK,QAAQ,KAAK,OAAO,KAAK,YAAY,UAAU,KACvD,MAAM,KAAK,YAAY;EAOzB,WAAW,KAAK,YAAY,KAAK;EACjC,aAAa,KAAK,YAAY,KAAK;EACpC,CAAC,KAAK,KAAK;;;;;;;;;;;AAYd,MAAM,8BAA8B;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;;AAGD,SAAgB,mBAAsC;CACpD,MAAM,MAAyB,EAAE;AACjC,MAAK,MAAM,OAAO,6BAA6B;EAC7C,MAAM,QAAQ,QAAQ,IAAI;AAC1B,MAAI,UAAU,KAAA,EAAW,KAAI,OAAO;;AAEtC,QAAO;;;;;;;;;AAUT,SAAgB,SAAY,MAAS,MAAoC;AACtE,MAAuD,gBAAgB;AACxE,QAAO;;;AAIT,SAAgB,YAAY,SAA0B;CACpD,MAAM,UAAW,SAAmC;AACpD,KAAI,OAAO,YAAY,SAAU,QAAO;AACxC,KAAI,MAAM,QAAQ,QAAQ,CACxB,QAAO,QACJ,QAAQ,MAA2C;EAClD,MAAM,QAAQ;AACd,SAAO,OAAO,SAAS,UAAU,OAAO,MAAM,SAAS;GACvD,CACD,KAAK,MAAM,EAAE,KAAK,CAClB,KAAK,GAAG;AAEb,QAAO;;;;;;;AAQT,SAAgB,kBAAkB,WAAyB;CACzD,MAAM,UAAkD,CACtD,CAAC,aAAa,gBAAgB,QAAQ,OAAO,CAAC,gBAAgB,IAAI,CAAC,EACnE,CAAC,aAAa,eAAe,QAAQ,OAAO,CAAC,eAAe,IAAI,CAAC,CAClE;AACD,MAAK,MAAM,CAAC,QAAQ,UAAU,SAAS;EACrC,MAAM,MAAM,UAAU,QAAQ,OAAO;AACrC,MAAI,QAAQ,GAAI;EAChB,MAAM,MAAM,UACT,MAAM,MAAM,OAAO,OAAO,CAC1B,MAAM,CACN,MAAM,KAAK,CAAC;AACf,MAAI,IAAK,OAAM,IAAI;;;;;;;AAQvB,SAAgB,eAAe,WAAuC;CACpE,IAAI;AACJ,MAAK,MAAM,QAAQ,UAAU,MAAM,KAAK,EAAE;EACxC,MAAM,MAAM,KAAK,QAAQ,aAAa,OAAO;AAC7C,MAAI,QAAQ,GACV,UAAS,KAAK,MAAM,MAAM,aAAa,OAAO,OAAO,CAAC,MAAM;;AAGhE,QAAO,UAAU,KAAA;;;AAInB,MAAM,sBAAsB;;AAG5B,MAAM,uBACJ;;AAGF,SAAS,aAAa,OAA2B;AAC/C,MAAK,MAAM,KAAK,MAAM,QAAQ,CAAE,KAAI,EAAE,WAAW,YAAa,QAAO;AACrE,QAAO;;AAGT,MAAa,YAA0B;CACrC,MAAA;CAEA,MAAM,IAAI,QAAgD;EACxD,MAAM,EAAE,SAAS,MAAM,QAAQ,SAAS,QAAQ,kBAAkB;EAClE,MAAM,UAAU,OAAO;EAEvB,MAAM,UAAU,iBAAiB;GAC/B,SAAS,QAAQ;GACjB,eAAe,KAAK,YAAY;GAChC,SAAS,KAAK,YAAY,KAAK;GAC/B,SAAS,KAAK;GACf,CAAC;AAGF,SAAO,CAAC,IAAI,KAAK,+BAA+B;AAChD,SAAO,CAAC,IAAI,KAAK,iBAAiB,gBAAgB,GAAG;AACrD,SAAO,CAAC,IAAI,QAAQ,wCAAwC;AAE5D,UAAQ,MAAM,OAAO,kBAAkB,oCAAoC;EAG3E,MAAM,YAAY,KAAK,KAAK;EAC5B,MAAM,UAAU,IAAI,oBAAoB;EACxC,IAAI,iBAAiB;EAGrB,IAAI,YAAY;EAChB,MAAM,qBAAqB;GACzB,MAAM,aAAa,KAAK,KAAK,GAAG;AAChC,UAAO;IACL,aAAa;IACb,kBAAkB,KAAK,MAAM,aAAa,IAAK;IAChD;;EAEH,MAAM,uBACJ,UAAU,cAAc,iBAAiB;GACvC,GAAG,cAAc;GACjB,OAAO;GACR,CAAC;AAEJ,MAAI;GACF,MAAM,EACJ,oBACA,uBACA,gBACA,aACA,eACA,aACA,wBACA,0BACA,0BACA,0BACA,0BACA,0BACA,8BACE,MAAM,OAAO;GAKjB,MAAM,oBACJ,YACE,KAAK,YAAY,MACjB,KAAK,YAAY,aACjB,KAAK,UACN;GACH,MAAM,OAAO,MAAM,aAAa;GAChC,MAAM,kBAAkB,aAA0B;IAChD,YAAY,QAAQ;IACpB,aAAa,QAAQ;IACrB,QAAQ,QAAQ;IAChB,QAAQ,QAAQ;IAChB,gBAAgB,KAAK;IACrB,aAAa,KAAK;IAClB;IACA,QAAQ,OAAO;IAChB;GACD,MAAM,EAAE,UAAU,SAAS,qBAAqB,eAAe,KAAK,CAAC;GACrE,MAAM,WAAW,cAAc,SAAS,YAAY,QAAQ,CAAC;AAC7D,YAAS,iBAAiB,kBAAkB,SAAkB;GAE9D,MAAM,QAAQ,SAAS,KAAK,kBAAkB,QAAQ;AACtD,OAAI,CAAC,MACH,QAAO;IACL,OAAA;IACA,SAAS;IACV;GAcH,MAAM,WAAW,EAAE,SAAS,OAAO;GAEnC,MAAM,EAAE,4BAA4B,MAAM,OAAO;GACjD,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,cAAc;IAC/B,2BAA2B,SAAS;IACpC,gBAAgB,KAAK;IAErB,kBAAkB,QAAQ;IAC3B,CAAC;GAIF,MAAM,EAAE,uBAAuB,MAAM,OAAO;AACvC,uBAAoB;GAOzB,MAAM,qBAAqB,CAAC,SAAS,QAAQ;GAG7C,IAAI;GACJ,IAAI;GAKJ,IAAI,aAAa;AACjB,OAAI;IACF,MAAM,EAAE,iBAAiB,sBAAsB,MAAM,OAAO;IAE5D,MAAM,sBAAsB,kBAC1B,KAAK,YAAY,KAAK,QACtB,KAAK,YAAY,aACjB,kBACD;IACD,MAAM,MAAM,MAAM,gBAAgB;KAChC,QAAQ,KAAK,YAAY,KAAK;KAC9B,aAAa,KAAK,YAAY;KAC9B,WAAW;KACZ,CAAC;AACF,uBAAmB,KAAK,IAAI,iBAAiB;AAC7C,iBAAa,IAAI;AACjB,sBAAkB,MAAM;AACxB,iBAAa;YACN,KAAK;AACZ,cAAU,mCAAmC,OAAO,IAAI,GAAG;AAC3D,cAAU,cAAc,oBAAoB;KAC1C,SAAS;KACT,OAAO;KACP,OAAO,OAAO,IAAI,CAAC,MAAM,GAAG,IAAI;KACjC,CAAC;;GAGJ,MAAM,iBAAiB,IAAI,sBAAsB;IAC/C,KAAK,QAAQ;IACb,UAAU,aAAa;IACvB,cACE,qBAAqB;KACnB,SAAS,cAAc;KACvB,UAAA;KACA,SAAA;KACA,MAAM;MAAE,MAAM;MAAM;MAAY;KACjC,CAAC,GACF,OACA,aAAa,MAAM,iBAAiB,WAAW;IACjD,cAAc;IACd,UAAU;IACV,gBAAgB;IAChB,mBAAmB;IACnB,UAAU;IACV;IACD,CAAC;AACF,SAAM,eAAe,QAAQ;GAQ7B,MAAM,EAAE,wBAAwB,MAAM,OAAO;GAC7C,MAAM,EAAE,4BAA4B,MAAM,OAAO;GACjD,MAAM,EAAE,4BAA4B,MAAM,OAAO;GAEjD,MAAM,kBAAkB,yBAAyB;GAIjD,MAAM,eAAe,SACnB,yBAAyB,QAAQ,YAAY,EAC3C,YAAY,SAAS;IAAE,GAAG;IAAK,KAAK,kBAAkB;IAAE,GACzD,CAAC,EACF,aACD;GAED,MAAM,cAAc;IAKlB,SAAS,yBAAyB,QAAQ,WAAW,EAAE,WAAW;IAClE,SAAS,yBAAyB,QAAQ,WAAW,EAAE,aAAa;IACpE,SAAS,0BAA0B,QAAQ,WAAW,EAAE,aAAa;IACrE;IAIA,SAAS,uBAAuB,QAAQ,WAAW,EAAE,WAAW;IAChE,SAAS,yBAAyB,QAAQ,WAAW,EAAE,WAAW;IAClE,SAAS,yBAAyB,QAAQ,WAAW,EAAE,WAAW;IAClE,GAAG,oBAAoB;KACrB,kBAAkB,QAAQ;KAC1B,eAAe,KAAK;KACpB,gBAAgB,KAAK;KACrB,sBAAsB,OAAO;KAI7B,WAAW,OAAO;KAClB,cAAc,OAAO;KACrB,qBAAqB,YAAY;AAC/B,eAAS,UAAU;;KAIrB,iBAAiB,cAAc;KAChC,CAAC;IAGF,GAAG,gBAAgB;IAInB,wBAAwB;KACtB;KACA,eAAe;KACf,KAAK,QAAQ;KACb,UAAU,aAAa;KACvB,iBAAiB,SAAS;KAC1B,UAAU;KACV,KAAK;MAAE;MAAoB;MAAuB;MAAgB;KACnE,CAAC;IACH;GAED,MAAM,EAAE,SAAS,iBAAiB,MAAM,mBAAmB;IACzD;IACA,eAAe;IAGf,eAAe,KAAK;IACpB,KAAK,QAAQ;IACb,gBAAgB,eAAe,SAAS,QAAQ,WAAW;IAC3D;IAIA,SAAS;IACT;IACD,CAAC;AAMF,SAAM,aAAa,eAAe,EAAE,CAAC;GAKrC,MAAM,QAAQ,kBAAkB;IAC9B,SAAS;IACT;IACA;IACA;IACA;IACA,cAAc;IACd,gBAAgB;AACd,eAAU,qDAAqD;AAC/D,eAAU,cAAc,0BAA0B,EAAE,SAAS,MAAM,CAAC;;IAEvE,CAAC;GAKF,MAAM,cAAc,aAAa,WAAW,UAAU;AAIpD,YAAQ,6BAA6B,MAAM;AAE3C,YAAQ,MAAM,MAAd;KACE,KAAK,eAAe;AAElB,UAAK,MAAM,SAA+B,SAAS,YACjD;AAEF,wBAAkB;AAClB,YAAM,kBAAkB,MAAM,QAAQ;MACtC,MAAM,YAAY,YAAY,MAAM,QAAQ,CAAC,MAAM;AACnD,UAAI,WAAW;AACb,iBAAU,mBAAmB,UAAU,MAAM,GAAG,IAAK,GAAG;AACxD,yBAAkB,UAAU;OAG5B,MAAM,aAAa,eAAe,UAAU;AAC5C,WAAI,YAAY;AACd,eAAO,CAAC,WAAW,WAAW;AAC9B,gBAAQ,QAAQ,WAAW;;AAE7B,YAAK,MAAM,QAAQ,UAAU,MAAM,KAAK,CAAE,SAAQ,KAAK,KAAK;;AAE9D;;KAEF,KAAK,wBAAwB;AAC3B,mBAAa;MACb,MAAM,OAAO,KAAK,UAAU,MAAM,QAAQ,EAAE,CAAC,CAAC,MAAM,GAAG,IAAI;AAC3D,gBAAU,UAAU,MAAM,SAAS,GAAG,OAAO;AAI7C;;KAEF,KAAK;AAKH,gBACE,QAAQ,MAAM,UAAU,MAAM,IAAI,GAAG,MAAM,SAAS,IAClD,OAAO,MAAM,WAAW,WACpB,MAAM,SACN,KAAK,UAAU,MAAM,UAAU,GAAG,GAEzC;AACD;KAEF,KAAK;AACH,gBAAU,6BAA6B,OAAO,MAAM,UAAU,CAAC,GAAG;AAClE;KAEF,QACE;;KAEJ;AAMF,WAAQ,iBAAiB,OAAO;AAEhC,OAAI;AAGF,UAAM,MAAM,OAAO,OAAO;IAK1B,IAAI,iBAAiB;AACrB,WACE,iBAAiB,uBACjB,CAAC,SAAS,MAAM,qBAChB,aAAa,gBAAgB,MAAM,EACnC;AACA,uBAAkB;AAClB,eACE,kDAAkD,eAAe,GAAG,sBACrE;AACD,WAAM,MAAM,OAAO,qBAAqB;;AAI1C,QAAI,CAAC,SAAS,MAAM,kBAClB,KAAI;AACF,WAAM,aAAa,OAAO,mBAAmB;aACtC,KAAK;AACZ,eAAU,+BAA+B,OAAO,IAAI,GAAG;;aAGnD;AACR,iBAAa;AACb,kBAAc;;AAKhB,OAAI,SAAS,MAAM,mBAAmB;AACpC,YAAQ,KAAK,8BAA8B;AAC3C,cACE,4CAA4C,SAAS,MAAM,aAAa,WACzE;AACD,oBAAgB;AAChB,WAAO,EAAE,OAAA,yBAAsC;;GAKjD,MAAM,YAAY,aAAa,gBAAgB,MAAM;GACrD,MAAM,UAAU,kBAAkB;IAAE;IAAW;IAAW,CAAC;AAC3D,OAAI,YAAA,sBAAwC;AAC1C,YAAQ,KAAK,wBAAwB;AACrC,cACE,qBAAqB,eAAe,kCACrC;AACD,cAAU,cAAc,qBAAqB,EAC3C,iBAAiB,gBAClB,CAAC;AACF,oBAAgB;AAChB,WAAO,EAAE,OAAO,SAAS;;AAE3B,OAAI,YAAA,2BAA6C;AAC/C,YAAQ,KAAK,iCAAiC;AAC9C,cAAU,mCAAmC;AAC7C,cAAU,cAAc,0BAA0B,EAAE,YAAY,MAAM,CAAC;AACvE,oBAAgB;AAChB,WAAO,EAAE,OAAO,SAAS;;GAG3B,MAAM,SAAS,QAAQ,QAAQ;AAC/B,OAAI,OACF,WAAU,QAAQ,0BAA0B,EAAE,QAAQ,CAAC;GAKzD,MAAM,eAAe,QAAQ,qBAAqB;AAClD,OAAI,iBAAiB,KAAA,EACnB,WAAU,cAAc,iCAAiC,EACvD,QAAQ,cACT,CAAC;AAMJ,OAAI;IACF,MAAM,WAAW,KAAK,KAAK,QAAQ,YAAY,uBAAuB;AACtE,QAAI,GAAG,WAAW,SAAS,CAAE,OAAM,GAAG,SAAS,GAAG,SAAS;YACpD,KAAK;AACZ,cAAU,8CAA8C,OAAO,IAAI,GAAG;;GAGxE,MAAM,QAAQ,aAAa,iBAAiB;AAC5C,aAAU,cAAc,mBAAmB;IACzC,GAAG,cAAc;IACjB,OAAO;IACP,WAAW;IAGX,cAAc,MAAM,OAAO;IAC3B,eAAe,MAAM,OAAO;IAC5B,6BAA6B,MAAM,OAAO;IAC1C,yBAAyB,MAAM,OAAO;IACvC,CAAC;AACF,WAAQ,KAAK,OAAO,kBAAkB,+BAA+B;AACrE,UAAO,EAAE;WACF,KAAK;GACZ,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAChE,aAAU,mBAAmB,UAAU;AACvC,WAAQ,KAAK,OAAO,gBAAgB,GAAG,OAAO,iBAAiB,SAAS;AACxE,UAAO,CAAC,IAAI,MAAM,qBAAqB,UAAU;AACjD,mBAAgB;GAEhB,MAAM,QAAQ,QAAQ,aAAa;AACnC,OAAI,MAAM,SAAS,aAAa,IAAI,MAAM,SAAS,MAAM,CACvD,QAAO;IAAE,OAAA;IAAkC;IAAS;AAEtD,UAAO;IAAE,OAAA;IAAiC;IAAS;;;CAQvD,MAAM,QAAQ,QAA6C;EACzD,MAAM,EAAE,cAAc,MAAM,OAAO;AACnC,SAAO,UAAU,OAAO;;CAE3B"}