@posthog/wizard 2.75.0 → 2.76.1

package/dist/{tools-DmwO0eBZ.js → tools-BBdpgcIf.js}

@@ -1,8 +1,10 @@
-import { s as logToFile } from "./debug-DUmMVUHn.js";
-import { n as analytics } from "./analytics-DSK0GXg1.js";
-import { A as WIZARD_ASK_TOOL_DESCRIPTION, B as mergeEnvValues, C as publishHandoff, D as WIZARD_ASK_KIND_DESCRIPTION, E as ENV_FILE_PATH_DESCRIPTION, G as templateEnvWriteRefusal, H as resolveAskQuestionKinds, I as ensureGitignoreCoverage, K as vaultSensitiveAnswers, L as fetchSkillMenu, M as checkEnvKeys, N as createAskAccounting, O as WIZARD_ASK_SENSITIVE_DESCRIPTION, P as describeAskCancellation, R as installSkillById, S as PUBLISH_HANDOFF_TOOL_NAME, T as CHECK_ENV_KEYS_FILE_PATH_DESCRIPTION, U as resolveEnvPath, V as normaliseAskSubject, W as resolveEnvSecretRefs, X as isFullyCancelled, b as PUBLISH_HANDOFF_CONTENT_DESCRIPTION, j as WIZARD_TOOL_NAMES, k as WIZARD_ASK_SUBJECT_DESCRIPTION, w as CHECK_ENV_KEYS_DESCRIPTION, x as PUBLISH_HANDOFF_DESCRIPTION, y as createSecretVault, z as legacyKeyNameRefusal } from "./agent-interface-BKLTDSyN.js";
-import { a as detectNodePackageManagers } from "./package-manager-hyP-CPSZ.js";
-import { o as withMode } from "./pi-DARAk2I_.js";
+import { s as logToFile } from "./debug-DWYDVp0B.js";
+import { n as analytics } from "./analytics-DSVyjIVF.js";
+import { $ as resolveEnvSecretRefs, A as AUDIT_STATUSES, B as checkEnvKeys, C as publishHandoff, D as AUDIT_RESOLVE_CHECKS_PARAM_DESCRIPTION, E as AUDIT_RESOLVE_CHECKS_DESCRIPTION, F as WIZARD_ASK_SENSITIVE_DESCRIPTION, G as fetchSkillMenu, H as describeAskCancellation, I as WIZARD_ASK_SUBJECT_DESCRIPTION, J as mergeEnvValues, K as installSkillById, L as WIZARD_ASK_TOOL_DESCRIPTION, M as CHECK_ENV_KEYS_FILE_PATH_DESCRIPTION, N as ENV_FILE_PATH_DESCRIPTION, O as AUDIT_SEED_CHECKS_DESCRIPTION, P as WIZARD_ASK_KIND_DESCRIPTION, Q as resolveEnvPath, R as WIZARD_TOOL_NAMES, S as PUBLISH_HANDOFF_TOOL_NAME, T as AUDIT_ADD_CHECKS_PARAM_DESCRIPTION, V as createAskAccounting, W as ensureGitignoreCoverage, X as resolveAskQuestionKinds, Y as normaliseAskSubject, Z as resolveAuditChecks, b as PUBLISH_HANDOFF_CONTENT_DESCRIPTION, et as seedAuditChecks, j as CHECK_ENV_KEYS_DESCRIPTION, k as AUDIT_SEED_CHECKS_PARAM_DESCRIPTION, nt as vaultSensitiveAnswers, ot as isFullyCancelled, q as legacyKeyNameRefusal, tt as templateEnvWriteRefusal, w as AUDIT_ADD_CHECKS_DESCRIPTION, x as PUBLISH_HANDOFF_DESCRIPTION, y as createSecretVault, z as addAuditChecks } from "./agent-interface-DPaPdIjS.js";
+import { a as detectNodePackageManagers } from "./package-manager-DU3aVif4.js";
+import { g as AUDIT_CHECKS_FILE } from "./yara-hooks-BaPKsm-B.js";
+import { S as makeMutex } from "./queue-tools-7Oso-fpt.js";
+import { o as withMode } from "./pi-fG5fT50Y.js";
 import fs from "fs";
 import path from "path";
 import { Type } from "typebox";
@@ -112,6 +114,64 @@ function createWizardPiTools(ctx) {
 			return text(`Wrote ${Object.keys(args.values).length} key(s) to ${args.filePath}.`);
 		}
 	});
+	const auditLedgerPath = path.join(workingDirectory, AUDIT_CHECKS_FILE);
+	const auditMutex = makeMutex();
+	const auditStatus = Type.Union(AUDIT_STATUSES.map((s) => Type.Literal(s)), { description: "Check outcome" });
+	const auditCheck = Type.Object({
+		id: Type.String({ description: "Stable kebab-case check id" }),
+		area: Type.String({ description: "Short group name, e.g. Installation" }),
+		label: Type.String({ description: "Short human name for the check" }),
+		status: auditStatus,
+		file: Type.Optional(Type.String({ description: "Optional path:line" })),
+		details: Type.Optional(Type.String({ description: "Optional one-line explanation" }))
+	});
+	const auditSeedChecks = defineTool({
+		name: "audit_seed_checks",
+		label: "Seed audit checks",
+		description: AUDIT_SEED_CHECKS_DESCRIPTION,
+		promptSnippet: "audit_seed_checks(checks) — write the full pending checklist to the audit ledger",
+		parameters: Type.Object({ checks: Type.Array(auditCheck, { description: AUDIT_SEED_CHECKS_PARAM_DESCRIPTION }) }),
+		execute: (_id, args) => auditMutex(() => {
+			const result = seedAuditChecks(auditLedgerPath, args.checks);
+			logToFile(`[pi] audit_seed_checks: ${result.message}`);
+			return text(result.message);
+		})
+	});
+	const auditAddChecks = defineTool({
+		name: "audit_add_checks",
+		label: "Add audit checks",
+		description: AUDIT_ADD_CHECKS_DESCRIPTION,
+		promptSnippet: "audit_add_checks(checks) — append runtime-discovered checks to the ledger",
+		parameters: Type.Object({ checks: Type.Array(auditCheck, {
+			minItems: 1,
+			description: AUDIT_ADD_CHECKS_PARAM_DESCRIPTION
+		}) }),
+		execute: (_id, args) => auditMutex(() => {
+			const result = addAuditChecks(auditLedgerPath, args.checks);
+			logToFile(`[pi] audit_add_checks: ${result.message}`);
+			return text(result.message);
+		})
+	});
+	const auditResolveChecks = defineTool({
+		name: "audit_resolve_checks",
+		label: "Resolve audit checks",
+		description: AUDIT_RESOLVE_CHECKS_DESCRIPTION,
+		promptSnippet: "audit_resolve_checks(updates) — patch each check by id as you finish it",
+		parameters: Type.Object({ updates: Type.Array(Type.Object({
+			id: Type.String({ description: "Existing check id" }),
+			status: auditStatus,
+			file: Type.Optional(Type.String({ description: "Optional path:line" })),
+			details: Type.Optional(Type.String({ description: "Optional one-line explanation" }))
+		}), {
+			minItems: 1,
+			description: AUDIT_RESOLVE_CHECKS_PARAM_DESCRIPTION
+		}) }),
+		execute: (_id, args) => auditMutex(() => {
+			const result = resolveAuditChecks(auditLedgerPath, args.updates);
+			logToFile(`[pi] audit_resolve_checks: ${result.message}`);
+			return text(result.message);
+		})
+	});
 	const detectPm = defineTool({
 		name: "detect_package_manager",
 		label: "Detect package manager",
@@ -199,24 +259,28 @@ function createWizardPiTools(ctx) {
 			}
 		}
 	});
+	const publishHandoffTool = defineTool({
+		name: PUBLISH_HANDOFF_TOOL_NAME,
+		label: "Publish handoff",
+		description: PUBLISH_HANDOFF_DESCRIPTION,
+		promptSnippet: "publish_handoff(content) — publish the full report markdown to the wizard session",
+		parameters: Type.Object({ content: Type.String({ description: PUBLISH_HANDOFF_CONTENT_DESCRIPTION }) }),
+		execute(_id, args) {
+			const result = publishHandoff(args.content);
+			logToFile(`[pi] publish_handoff: ${result.message}`);
+			return Promise.resolve(text(result.message));
+		}
+	});
 	const tools = [
 		loadSkillMenu,
 		installSkill,
 		checkEnvKeys$1,
 		setEnvValues,
 		detectPm,
-		withMode(defineTool({
-			name: PUBLISH_HANDOFF_TOOL_NAME,
-			label: "Publish handoff",
-			description: PUBLISH_HANDOFF_DESCRIPTION,
-			promptSnippet: "publish_handoff(content) — publish the full report markdown to the wizard session",
-			parameters: Type.Object({ content: Type.String({ description: PUBLISH_HANDOFF_CONTENT_DESCRIPTION }) }),
-			execute(_id, args) {
-				const result = publishHandoff(args.content);
-				logToFile(`[pi] publish_handoff: ${result.message}`);
-				return Promise.resolve(text(result.message));
-			}
-		}), "sequential")
+		withMode(auditSeedChecks, "parallel"),
+		withMode(auditAddChecks, "parallel"),
+		withMode(auditResolveChecks, "parallel"),
+		withMode(publishHandoffTool, "sequential")
 	];
 	if (!(ctx.disallowedTools?.includes(WIZARD_TOOL_NAMES.wizardAsk) ?? false)) tools.push(withMode(wizardAsk, "sequential"));
 	return tools;
@@ -224,4 +288,4 @@ function createWizardPiTools(ctx) {
 //#endregion
 export { createWizardPiTools };
 
-//# sourceMappingURL=tools-DmwO0eBZ.js.map
+//# sourceMappingURL=tools-BBdpgcIf.js.map

package/dist/tools-BBdpgcIf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools-BBdpgcIf.js","names":["checkEnvKeys","checkEnvKeysCore"],"sources":["../src/lib/agent/runner/harness/pi/tools.ts"],"sourcesContent":["/**\n * Wizard capabilities as pi custom tools (#5). pi does not mount MCP servers,\n * so the tools the wizard prompt depends on — skill discovery/install and\n * fenced `.env` edits — are exposed to pi as native `defineTool` tools backed\n * by the same helpers the claude-agent-sdk path uses (`fetchSkillMenu`,\n * `installSkillById`, `checkEnvKeys`, `mergeEnvValues`). Same tool names as the\n * MCP server so the shared prompt is unchanged. `wizard_ask` is wired here too\n * (same schema, caps, and askBridge as the MCP tool) so interactive programs\n * can interview the user on pi; without a bridge (CI) it errors on call.\n * Sensitive answers are vaulted to `{secretRef}` and resolved host-side by\n * set_env_values — the raw value never enters the model conversation.\n */\n\nimport fs from 'fs';\nimport path from 'path';\nimport { Type } from 'typebox';\nimport { defineTool } from '@earendil-works/pi-coding-agent';\nimport type { ToolDefinition } from '@earendil-works/pi-coding-agent';\nimport { analytics } from '@utils/analytics';\nimport { logToFile } from '@utils/debug';\nimport {\n  AUDIT_ADD_CHECKS_DESCRIPTION,\n  AUDIT_ADD_CHECKS_PARAM_DESCRIPTION,\n  AUDIT_RESOLVE_CHECKS_DESCRIPTION,\n  AUDIT_RESOLVE_CHECKS_PARAM_DESCRIPTION,\n  AUDIT_SEED_CHECKS_DESCRIPTION,\n  AUDIT_SEED_CHECKS_PARAM_DESCRIPTION,\n  AUDIT_STATUSES,\n  CHECK_ENV_KEYS_DESCRIPTION,\n  CHECK_ENV_KEYS_FILE_PATH_DESCRIPTION,\n  DEFAULT_ASK_MAX_QUESTIONS,\n  ENV_FILE_PATH_DESCRIPTION,\n  WIZARD_TOOL_NAMES,\n  addAuditChecks,\n  checkEnvKeys as checkEnvKeysCore,\n  resolveAuditChecks,\n  seedAuditChecks,\n  createAskAccounting,\n  describeAskCancellation,\n  ensureGitignoreCoverage,\n  fetchSkillMenu,\n  installSkillById,\n  mergeEnvValues,\n  normaliseAskSubject,\n  resolveAskQuestionKinds,\n  resolveEnvPath,\n  resolveEnvSecretRefs,\n  templateEnvWriteRefusal,\n  legacyKeyNameRefusal,\n  vaultSensitiveAnswers,\n  WIZARD_ASK_KIND_DESCRIPTION,\n  WIZARD_ASK_SENSITIVE_DESCRIPTION,\n  WIZARD_ASK_SUBJECT_DESCRIPTION,\n  WIZARD_ASK_TOOL_DESCRIPTION,\n} from '@lib/wizard-tools/tools';\nimport type { LLMProvider } from '@posthog/warlock';\nimport { isFullyCancelled, type WizardAskBridge } from '@lib/wizard-ask-bridge';\nimport {\n  PUBLISH_HANDOFF_CONTENT_DESCRIPTION,\n  PUBLISH_HANDOFF_DESCRIPTION,\n  PUBLISH_HANDOFF_TOOL_NAME,\n  publishHandoff,\n} from '@lib/wizard-tools/handoff';\nimport { createSecretVault } from '@lib/secret-vault';\nimport { AUDIT_CHECKS_FILE } from '@lib/programs/audit/types';\nimport type { AuditCheck, AuditStatus } from '@lib/programs/audit/types';\nimport { makeMutex } from '@utils/atomic-ledger';\nimport { withMode } from './index';\nimport {\n  detectNodePackageManagers,\n  type PackageManagerDetector,\n} from '@lib/detection/package-manager';\n\nfunction text(s: string): {\n  content: [{ type: 'text'; text: string }];\n  details: unknown;\n} {\n  return { content: [{ type: 'text', text: s }], details: {} };\n}\n\nexport interface PiToolsContext {\n  workingDirectory: string;\n  skillsBaseUrl: string;\n  /** Framework's package-manager detector. Defaults to Node detection. */\n  detectPackageManager?: PackageManagerDetector;\n  /** Drives the `wizard_ask` overlay. Omitted in CI → the tool errors on call. */\n  askBridge?: WizardAskBridge;\n  /** Per-run cap on wizard_ask calls. Defaults to {@link DEFAULT_ASK_MAX_QUESTIONS}. */\n  maxQuestions?: number;\n  /** Overlay open/closed signal — the security gate blocks Write/Edit while open. */\n  onAskPendingChange?: (pending: boolean) => void;\n  /** Program disallow list; gates wizard_ask here since pi tools carry bare names the MCP-prefixed security gate misses. */\n  disallowedTools?: readonly string[];\n  /** Scan-triage classifier, resolved once in bootstrap. Absent → scans fail closed. */\n  triageProvider?: LLMProvider;\n}\n\nexport function createWizardPiTools(ctx: PiToolsContext): ToolDefinition[] {\n  const {\n    workingDirectory,\n    skillsBaseUrl,\n    askBridge,\n    onAskPendingChange,\n    triageProvider,\n  } = ctx;\n  const detectPackageManager =\n    ctx.detectPackageManager ?? detectNodePackageManagers;\n  const askMaxQuestions = ctx.maxQuestions ?? DEFAULT_ASK_MAX_QUESTIONS;\n  // Per-run wizard_ask accounting (total cap + one-time per-subject adjacency\n  // nudge). Same shared implementation the MCP server drives, so the two\n  // facades cannot diverge on the cap, the nudge or the refund.\n  const askAccounting = createAskAccounting(askMaxQuestions);\n  // Session-scoped secret vault, same contract as the MCP server: wizard_ask\n  // mints `{secretRef}` for sensitive answers, set_env_values resolves them.\n  const secretVault = createSecretVault();\n\n  // Fetch the skill menu at most once per run — the agent calls load_skill_menu\n  // 2-3× otherwise, each a fresh HTTP round-trip (profiled slowness).\n  let menuPromise: ReturnType<typeof fetchSkillMenu> | undefined;\n  const getSkillMenu = () => (menuPromise ??= fetchSkillMenu(skillsBaseUrl));\n\n  const loadSkillMenu = defineTool({\n    name: 'load_skill_menu',\n    label: 'Load skill menu',\n    description:\n      'Load available PostHog skills for a category. Returns skill IDs and names. Call this first, then install_skill with the chosen ID.',\n    promptSnippet:\n      'load_skill_menu(category) — list installable PostHog skills',\n    parameters: Type.Object({\n      category: Type.String({\n        description: 'Skill category, e.g. \"integration\"',\n      }),\n    }),\n    async execute(_id, args) {\n      const menu = await getSkillMenu();\n      if (!menu) return text('Error: could not load the skill menu.');\n      const skills = menu.categories[args.category] ?? [];\n      if (skills.length === 0) {\n        return text(`No skills found for category \"${args.category}\".`);\n      }\n      logToFile(`[pi] load_skill_menu: ${skills.length} skills`);\n      return text(skills.map((s) => `- ${s.id}: ${s.name}`).join('\\n'));\n    },\n  });\n\n  const installSkill = defineTool({\n    name: 'install_skill',\n    label: 'Install skill',\n    description:\n      'Download and install a PostHog skill by ID into .claude/skills/<skillId>/. Call load_skill_menu first. Then read the installed SKILL.md and follow it.',\n    promptSnippet:\n      'install_skill(skillId) — install a skill, then read its SKILL.md',\n    parameters: Type.Object({\n      skillId: Type.String({ description: 'Skill ID from load_skill_menu' }),\n    }),\n    async execute(_id, args) {\n      const result = await installSkillById(\n        args.skillId,\n        workingDirectory,\n        skillsBaseUrl,\n        { triage: triageProvider },\n      );\n      if (result.kind !== 'ok') {\n        logToFile(`[pi] install_skill ${args.skillId}: ${result.kind}`);\n        return text(\n          `Error installing skill \"${args.skillId}\": ${result.kind}. Use load_skill_menu to see valid IDs.`,\n        );\n      }\n      logToFile(`[pi] install_skill ${args.skillId} -> ${result.path}`);\n      return text(\n        `Installed \"${args.skillId}\" at ${result.path}. Read ${result.path}/SKILL.md and follow it.`,\n      );\n    },\n  });\n\n  const checkEnvKeys = defineTool({\n    name: 'check_env_keys',\n    label: 'Check env keys',\n    description: CHECK_ENV_KEYS_DESCRIPTION,\n    promptSnippet:\n      'check_env_keys(keys) — see which .env keys exist, and in which file',\n    parameters: Type.Object({\n      filePath: Type.Optional(\n        Type.String({\n          description: CHECK_ENV_KEYS_FILE_PATH_DESCRIPTION,\n        }),\n      ),\n      keys: Type.Array(Type.String(), {\n        description: 'Environment variable key names to check',\n      }),\n    }),\n    // `async` with nothing to await, on purpose: it is what turns a thrown\n    // error into a rejection. `checkEnvKeys` throws on a filePath that escapes\n    // the working directory, and pi wraps `execute` in a plain (non-async)\n    // arrow, so without this the throw leaves the tool synchronously instead\n    // of arriving as a failed tool call. The scan replaced an awaited read,\n    // which is the only reason there is nothing left to await.\n    // eslint-disable-next-line @typescript-eslint/require-await\n    async execute(_id, args) {\n      const results = checkEnvKeysCore(\n        workingDirectory,\n        args.keys,\n        args.filePath,\n      );\n      return text(JSON.stringify(results, null, 2));\n    },\n  });\n\n  const setEnvValues = defineTool({\n    name: 'set_env_values',\n    label: 'Set env values',\n    description:\n      'Create or update environment variable keys in a .env file (creates the file if missing). Each value is either a literal string or a secret reference `{ \"secretRef\": \"secret:...\" }` returned by wizard_ask — refs are resolved locally, so the actual value is written to the file but never returned to the agent.',\n    promptSnippet:\n      'set_env_values(filePath, values) — write .env keys (never hardcode secrets in source)',\n    parameters: Type.Object({\n      filePath: Type.String({\n        description: ENV_FILE_PATH_DESCRIPTION,\n      }),\n      values: Type.Record(\n        Type.String(),\n        Type.Union([Type.String(), Type.Object({ secretRef: Type.String() })]),\n        {\n          description:\n            'Key → (literal string OR { secretRef } pointing to a vaulted secret)',\n        },\n      ),\n    }),\n    async execute(_id, args) {\n      const keyRefusal = legacyKeyNameRefusal(\n        workingDirectory,\n        Object.keys(args.values),\n      );\n      if (keyRefusal) return text(keyRefusal);\n      // Resolve secret refs host-side; the value never reaches the agent.\n      const resolution = resolveEnvSecretRefs(args.values, secretVault);\n      if (!resolution.ok) {\n        return text(\n          `Error: secret reference \"${resolution.secretRef}\" for key \"${resolution.key}\" is not known to the vault. The ref may have expired, been minted in a different run, or been mistyped.`,\n        );\n      }\n      const resolved = resolveEnvPath(workingDirectory, args.filePath);\n      const templateRefusal = templateEnvWriteRefusal(resolved);\n      if (templateRefusal) {\n        logToFile(`[pi] set_env_values: refused template target ${resolved}`);\n        analytics.wizardCapture('set_env_values template target refused', {\n          file_name: path.basename(resolved),\n        });\n        return text(templateRefusal);\n      }\n      const existing = fs.existsSync(resolved)\n        ? await fs.promises.readFile(resolved, 'utf8')\n        : '';\n      const merged = mergeEnvValues(existing, resolution.values);\n      const dir = path.dirname(resolved);\n      if (!fs.existsSync(dir))\n        await fs.promises.mkdir(dir, { recursive: true });\n      await fs.promises.writeFile(resolved, merged, 'utf8');\n      // Same post-write pass as the MCP facade: a credential file the\n      // project does not ignore yet gets committed by the next `git add`.\n      ensureGitignoreCoverage(workingDirectory, path.basename(resolved));\n      logToFile(\n        `[pi] set_env_values: ${resolved} keys=${Object.keys(args.values).join(\n          ',',\n        )}`,\n      );\n      return text(\n        `Wrote ${Object.keys(args.values).length} key(s) to ${args.filePath}.`,\n      );\n    },\n  });\n\n  // ── Audit ledger ────────────────────────────────────────────────────\n  // Native mirror of the three MCP audit tools; pi mounts no MCP server, so\n  // without these an audit cannot move a check off pending. Descriptions and\n  // write semantics come from the shared helpers, so the facades cannot drift.\n  const auditLedgerPath = path.join(workingDirectory, AUDIT_CHECKS_FILE);\n  const auditMutex = makeMutex();\n  const auditStatus = Type.Union(\n    AUDIT_STATUSES.map((s) => Type.Literal(s)),\n    { description: 'Check outcome' },\n  );\n  const auditCheck = Type.Object({\n    id: Type.String({ description: 'Stable kebab-case check id' }),\n    area: Type.String({ description: 'Short group name, e.g. Installation' }),\n    label: Type.String({ description: 'Short human name for the check' }),\n    status: auditStatus,\n    file: Type.Optional(Type.String({ description: 'Optional path:line' })),\n    details: Type.Optional(\n      Type.String({ description: 'Optional one-line explanation' }),\n    ),\n  });\n\n  const auditSeedChecks = defineTool({\n    name: 'audit_seed_checks',\n    label: 'Seed audit checks',\n    description: AUDIT_SEED_CHECKS_DESCRIPTION,\n    promptSnippet:\n      'audit_seed_checks(checks) — write the full pending checklist to the audit ledger',\n    parameters: Type.Object({\n      checks: Type.Array(auditCheck, {\n        description: AUDIT_SEED_CHECKS_PARAM_DESCRIPTION,\n      }),\n    }),\n    execute: (_id, args) =>\n      auditMutex(() => {\n        const result = seedAuditChecks(\n          auditLedgerPath,\n          args.checks as AuditCheck[],\n        );\n        logToFile(`[pi] audit_seed_checks: ${result.message}`);\n        return text(result.message);\n      }),\n  });\n\n  const auditAddChecks = defineTool({\n    name: 'audit_add_checks',\n    label: 'Add audit checks',\n    description: AUDIT_ADD_CHECKS_DESCRIPTION,\n    promptSnippet:\n      'audit_add_checks(checks) — append runtime-discovered checks to the ledger',\n    parameters: Type.Object({\n      checks: Type.Array(auditCheck, {\n        minItems: 1,\n        description: AUDIT_ADD_CHECKS_PARAM_DESCRIPTION,\n      }),\n    }),\n    execute: (_id, args) =>\n      auditMutex(() => {\n        const result = addAuditChecks(\n          auditLedgerPath,\n          args.checks as AuditCheck[],\n        );\n        logToFile(`[pi] audit_add_checks: ${result.message}`);\n        return text(result.message);\n      }),\n  });\n\n  const auditResolveChecks = defineTool({\n    name: 'audit_resolve_checks',\n    label: 'Resolve audit checks',\n    description: AUDIT_RESOLVE_CHECKS_DESCRIPTION,\n    promptSnippet:\n      'audit_resolve_checks(updates) — patch each check by id as you finish it',\n    parameters: Type.Object({\n      updates: Type.Array(\n        Type.Object({\n          id: Type.String({ description: 'Existing check id' }),\n          status: auditStatus,\n          file: Type.Optional(\n            Type.String({ description: 'Optional path:line' }),\n          ),\n          details: Type.Optional(\n            Type.String({ description: 'Optional one-line explanation' }),\n          ),\n        }),\n        { minItems: 1, description: AUDIT_RESOLVE_CHECKS_PARAM_DESCRIPTION },\n      ),\n    }),\n    execute: (_id, args) =>\n      auditMutex(() => {\n        const result = resolveAuditChecks(\n          auditLedgerPath,\n          args.updates as Array<{\n            id: string;\n            status: AuditStatus;\n            file?: string;\n            details?: string;\n          }>,\n        );\n        logToFile(`[pi] audit_resolve_checks: ${result.message}`);\n        return text(result.message);\n      }),\n  });\n\n  const detectPm = defineTool({\n    name: 'detect_package_manager',\n    label: 'Detect package manager',\n    description:\n      \"Detect the project's package manager(s). Returns the name and the install command for each. Call this before installing a dependency, then RUN the returned install command (with the posthog package) via bash — the SDK package must end up in the project manifest, or the app will not build.\",\n    promptSnippet:\n      'detect_package_manager() — find the PM + install command, then run it via bash to add the SDK',\n    parameters: Type.Object({}),\n    async execute() {\n      const result = await detectPackageManager(workingDirectory);\n      logToFile(\n        `[pi] detect_package_manager: ${result.detected.length} detected`,\n      );\n      return text(JSON.stringify(result, null, 2));\n    },\n  });\n\n  // Native mirror of the MCP `wizard_ask` tool: same name, schema, and\n  // askBridge, so the shared prompt is unchanged.\n  const wizardAsk = defineTool({\n    name: 'wizard_ask',\n    label: 'Ask the user',\n    description: WIZARD_ASK_TOOL_DESCRIPTION,\n    promptSnippet:\n      'wizard_ask(questions, subject) — ask the user structured questions and wait for answers; tag each call with the subject it collects for',\n    parameters: Type.Object({\n      questions: Type.Array(\n        Type.Object({\n          id: Type.String({\n            description: 'Stable key for the answer in the response map',\n          }),\n          prompt: Type.String({\n            description: 'Question text shown to the user',\n          }),\n          kind: Type.Optional(\n            Type.Union(\n              [\n                Type.Literal('single'),\n                Type.Literal('multi'),\n                Type.Literal('text'),\n              ],\n              { description: WIZARD_ASK_KIND_DESCRIPTION },\n            ),\n          ),\n          options: Type.Optional(\n            Type.Array(\n              Type.Object({\n                label: Type.String(),\n                value: Type.String(),\n                description: Type.Optional(Type.String()),\n              }),\n              {\n                description:\n                  'Required for kind=single|multi; ignored for kind=text',\n              },\n            ),\n          ),\n          required: Type.Optional(\n            Type.Boolean({ description: 'Defaults to true' }),\n          ),\n          sensitive: Type.Optional(\n            Type.Boolean({\n              description: WIZARD_ASK_SENSITIVE_DESCRIPTION,\n            }),\n          ),\n        }),\n        { minItems: 1, maxItems: 8 },\n      ),\n      subject: Type.Optional(\n        Type.String({ description: WIZARD_ASK_SUBJECT_DESCRIPTION }),\n      ),\n    }),\n    async execute(_id, args) {\n      if (!askBridge) {\n        return text(\n          'Error: wizard_ask is not available in this environment (CI / non-interactive). Proceed with sensible defaults or emit [ABORT] requirements-incomplete.',\n        );\n      }\n\n      const cap = askAccounting.evaluate(args.subject);\n      if (cap.kind === 'capped') {\n        const { callCount } = askAccounting.snapshot();\n        logToFile(\n          `[pi] wizard_ask capped: reason=${cap.reason} count=${callCount} subject=${cap.subject} run=${cap.subjectRunLength}`,\n        );\n        analytics.wizardCapture('wizard_ask capped', {\n          reason: cap.reason,\n          call_count: callCount,\n          max_questions: askMaxQuestions,\n          subject: cap.subject,\n          subject_run_length: cap.subjectRunLength,\n        });\n        return text(cap.message);\n      }\n\n      // A question with no kind takes the one its options imply, so the\n      // overlay always has an input to render. See resolveAskQuestionKinds.\n      const questions = resolveAskQuestionKinds(args.questions);\n\n      // The schema can't enforce per-kind requirements or unique ids.\n      const ids = new Set<string>();\n      for (const q of questions) {\n        if ((q.kind === 'single' || q.kind === 'multi') && !q.options?.length) {\n          return text(\n            `Error: question \"${q.id}\" has kind=\"${q.kind}\" but no options. Provide at least one { label, value }, or use kind=\"text\".`,\n          );\n        }\n        if (q.sensitive && q.kind !== 'text') {\n          return text(\n            `Error: question \"${q.id}\" sets sensitive=true but kind=\"${q.kind}\". Only kind=\"text\" answers can be sensitive.`,\n          );\n        }\n        if (ids.has(q.id)) {\n          return text(\n            `Error: duplicate question id \"${q.id}\". Each question needs a unique id.`,\n          );\n        }\n        ids.add(q.id);\n      }\n\n      // Optimistically take the slot; refund it on a cancellation or a bridge\n      // error so a declined/failed ask doesn't burn the budget for later ones.\n      askAccounting.record(args.subject);\n      // Block Write/Edit for as long as the overlay is open, so the agent can't\n      // mutate files while it's waiting on the user's answer.\n      onAskPendingChange?.(true);\n      try {\n        const { answers, timedOut } = await askBridge.request({\n          questions,\n          subject: normaliseAskSubject(args.subject),\n        });\n        if (isFullyCancelled(answers)) askAccounting.refund(args.subject);\n        // Sensitive answers go to the vault; the agent sees an opaque ref\n        // (same contract as the MCP wizard_ask).\n        const sanitised = vaultSensitiveAnswers(\n          questions,\n          answers,\n          secretVault,\n        );\n        // State an uncollected field as an outcome rather than leaving the\n        // agent to recognise a sentinel answer value (same as the MCP facade).\n        const cancelled = describeAskCancellation(sanitised, timedOut);\n        logToFile(\n          `[pi] wizard_ask: resolved ${\n            Object.keys(answers).length\n          } answer(s) for ${args.questions.length} question(s)${\n            cancelled ? `, cancelled: ${cancelled.reason}` : ''\n          }`,\n        );\n        return text(\n          JSON.stringify(\n            { answers: sanitised, ...(cancelled ? { cancelled } : {}) },\n            null,\n            2,\n          ),\n        );\n      } catch (err) {\n        askAccounting.refund(args.subject);\n        const message = err instanceof Error ? err.message : String(err);\n        logToFile(`[pi] wizard_ask: error: ${message}`);\n        return text(`Error: wizard_ask failed: ${message}`);\n      } finally {\n        onAskPendingChange?.(false);\n      }\n    },\n  });\n\n  // Native mirror of the MCP `publish_handoff` tool (shared description, so no drift).\n  const publishHandoffTool = defineTool({\n    name: PUBLISH_HANDOFF_TOOL_NAME,\n    label: 'Publish handoff',\n    description: PUBLISH_HANDOFF_DESCRIPTION,\n    promptSnippet:\n      'publish_handoff(content) — publish the full report markdown to the wizard session',\n    parameters: Type.Object({\n      content: Type.String({\n        description: PUBLISH_HANDOFF_CONTENT_DESCRIPTION,\n      }),\n    }),\n    execute(_id, args) {\n      const result = publishHandoff(args.content);\n      logToFile(`[pi] publish_handoff: ${result.message}`);\n      return Promise.resolve(text(result.message));\n    },\n  });\n\n  const tools = [\n    loadSkillMenu,\n    installSkill,\n    checkEnvKeys,\n    setEnvValues,\n    detectPm,\n    // Parallel: the mutex serializes the writes, so a subagent fan-out is safe.\n    withMode(auditSeedChecks, 'parallel'),\n    withMode(auditAddChecks, 'parallel'),\n    withMode(auditResolveChecks, 'parallel'),\n    // Sequential: it mutates the store's handoff state.\n    withMode(publishHandoffTool, 'sequential'),\n  ];\n  // Register wizard_ask only when the program allows it. posthog-integration\n  // disallows it (runs without structured user input); self-driving keeps it.\n  // Sequential: the ask bridge holds a single in-flight question slot, so a\n  // batched turn must never dispatch two asks (or an ask + a write) at once.\n  const askDisallowed =\n    ctx.disallowedTools?.includes(WIZARD_TOOL_NAMES.wizardAsk) ?? false;\n  if (!askDisallowed) tools.push(withMode(wizardAsk, 'sequential'));\n  return tools;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAyEA,SAAS,KAAK,GAGZ;AACA,QAAO;EAAE,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM;GAAG,CAAC;EAAE,SAAS,EAAE;EAAE;;AAoB9D,SAAgB,oBAAoB,KAAuC;CACzE,MAAM,EACJ,kBACA,eACA,WACA,oBACA,mBACE;CACJ,MAAM,uBACJ,IAAI,wBAAwB;CAC9B,MAAM,kBAAkB,IAAI,gBAAA;CAI5B,MAAM,gBAAgB,oBAAoB,gBAAgB;CAG1D,MAAM,cAAc,mBAAmB;CAIvC,IAAI;CACJ,MAAM,qBAAsB,gBAAgB,eAAe,cAAc;CAEzE,MAAM,gBAAgB,WAAW;EAC/B,MAAM;EACN,OAAO;EACP,aACE;EACF,eACE;EACF,YAAY,KAAK,OAAO,EACtB,UAAU,KAAK,OAAO,EACpB,aAAa,wCACd,CAAC,EACH,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;GACvB,MAAM,OAAO,MAAM,cAAc;AACjC,OAAI,CAAC,KAAM,QAAO,KAAK,wCAAwC;GAC/D,MAAM,SAAS,KAAK,WAAW,KAAK,aAAa,EAAE;AACnD,OAAI,OAAO,WAAW,EACpB,QAAO,KAAK,iCAAiC,KAAK,SAAS,IAAI;AAEjE,aAAU,yBAAyB,OAAO,OAAO,SAAS;AAC1D,UAAO,KAAK,OAAO,KAAK,MAAM,KAAK,EAAE,GAAG,IAAI,EAAE,OAAO,CAAC,KAAK,KAAK,CAAC;;EAEpE,CAAC;CAEF,MAAM,eAAe,WAAW;EAC9B,MAAM;EACN,OAAO;EACP,aACE;EACF,eACE;EACF,YAAY,KAAK,OAAO,EACtB,SAAS,KAAK,OAAO,EAAE,aAAa,iCAAiC,CAAC,EACvE,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;GACvB,MAAM,SAAS,MAAM,iBACnB,KAAK,SACL,kBACA,eACA,EAAE,QAAQ,gBAAgB,CAC3B;AACD,OAAI,OAAO,SAAS,MAAM;AACxB,cAAU,sBAAsB,KAAK,QAAQ,IAAI,OAAO,OAAO;AAC/D,WAAO,KACL,2BAA2B,KAAK,QAAQ,KAAK,OAAO,KAAK,yCAC1D;;AAEH,aAAU,sBAAsB,KAAK,QAAQ,MAAM,OAAO,OAAO;AACjE,UAAO,KACL,cAAc,KAAK,QAAQ,OAAO,OAAO,KAAK,SAAS,OAAO,KAAK,0BACpE;;EAEJ,CAAC;CAEF,MAAMA,iBAAe,WAAW;EAC9B,MAAM;EACN,OAAO;EACP,aAAa;EACb,eACE;EACF,YAAY,KAAK,OAAO;GACtB,UAAU,KAAK,SACb,KAAK,OAAO,EACV,aAAa,sCACd,CAAC,CACH;GACD,MAAM,KAAK,MAAM,KAAK,QAAQ,EAAE,EAC9B,aAAa,2CACd,CAAC;GACH,CAAC;EAQF,MAAM,QAAQ,KAAK,MAAM;GACvB,MAAM,UAAUC,aACd,kBACA,KAAK,MACL,KAAK,SACN;AACD,UAAO,KAAK,KAAK,UAAU,SAAS,MAAM,EAAE,CAAC;;EAEhD,CAAC;CAEF,MAAM,eAAe,WAAW;EAC9B,MAAM;EACN,OAAO;EACP,aACE;EACF,eACE;EACF,YAAY,KAAK,OAAO;GACtB,UAAU,KAAK,OAAO,EACpB,aAAa,2BACd,CAAC;GACF,QAAQ,KAAK,OACX,KAAK,QAAQ,EACb,KAAK,MAAM,CAAC,KAAK,QAAQ,EAAE,KAAK,OAAO,EAAE,WAAW,KAAK,QAAQ,EAAE,CAAC,CAAC,CAAC,EACtE,EACE,aACE,wEACH,CACF;GACF,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;GACvB,MAAM,aAAa,qBACjB,kBACA,OAAO,KAAK,KAAK,OAAO,CACzB;AACD,OAAI,WAAY,QAAO,KAAK,WAAW;GAEvC,MAAM,aAAa,qBAAqB,KAAK,QAAQ,YAAY;AACjE,OAAI,CAAC,WAAW,GACd,QAAO,KACL,4BAA4B,WAAW,UAAU,aAAa,WAAW,IAAI,0GAC9E;GAEH,MAAM,WAAW,eAAe,kBAAkB,KAAK,SAAS;GAChE,MAAM,kBAAkB,wBAAwB,SAAS;AACzD,OAAI,iBAAiB;AACnB,cAAU,gDAAgD,WAAW;AACrE,cAAU,cAAc,0CAA0C,EAChE,WAAW,KAAK,SAAS,SAAS,EACnC,CAAC;AACF,WAAO,KAAK,gBAAgB;;GAK9B,MAAM,SAAS,eAHE,GAAG,WAAW,SAAS,GACpC,MAAM,GAAG,SAAS,SAAS,UAAU,OAAO,GAC5C,IACoC,WAAW,OAAO;GAC1D,MAAM,MAAM,KAAK,QAAQ,SAAS;AAClC,OAAI,CAAC,GAAG,WAAW,IAAI,CACrB,OAAM,GAAG,SAAS,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC;AACnD,SAAM,GAAG,SAAS,UAAU,UAAU,QAAQ,OAAO;AAGrD,2BAAwB,kBAAkB,KAAK,SAAS,SAAS,CAAC;AAClE,aACE,wBAAwB,SAAS,QAAQ,OAAO,KAAK,KAAK,OAAO,CAAC,KAChE,IACD,GACF;AACD,UAAO,KACL,SAAS,OAAO,KAAK,KAAK,OAAO,CAAC,OAAO,aAAa,KAAK,SAAS,GACrE;;EAEJ,CAAC;CAMF,MAAM,kBAAkB,KAAK,KAAK,kBAAkB,kBAAkB;CACtE,MAAM,aAAa,WAAW;CAC9B,MAAM,cAAc,KAAK,MACvB,eAAe,KAAK,MAAM,KAAK,QAAQ,EAAE,CAAC,EAC1C,EAAE,aAAa,iBAAiB,CACjC;CACD,MAAM,aAAa,KAAK,OAAO;EAC7B,IAAI,KAAK,OAAO,EAAE,aAAa,8BAA8B,CAAC;EAC9D,MAAM,KAAK,OAAO,EAAE,aAAa,uCAAuC,CAAC;EACzE,OAAO,KAAK,OAAO,EAAE,aAAa,kCAAkC,CAAC;EACrE,QAAQ;EACR,MAAM,KAAK,SAAS,KAAK,OAAO,EAAE,aAAa,sBAAsB,CAAC,CAAC;EACvE,SAAS,KAAK,SACZ,KAAK,OAAO,EAAE,aAAa,iCAAiC,CAAC,CAC9D;EACF,CAAC;CAEF,MAAM,kBAAkB,WAAW;EACjC,MAAM;EACN,OAAO;EACP,aAAa;EACb,eACE;EACF,YAAY,KAAK,OAAO,EACtB,QAAQ,KAAK,MAAM,YAAY,EAC7B,aAAa,qCACd,CAAC,EACH,CAAC;EACF,UAAU,KAAK,SACb,iBAAiB;GACf,MAAM,SAAS,gBACb,iBACA,KAAK,OACN;AACD,aAAU,2BAA2B,OAAO,UAAU;AACtD,UAAO,KAAK,OAAO,QAAQ;IAC3B;EACL,CAAC;CAEF,MAAM,iBAAiB,WAAW;EAChC,MAAM;EACN,OAAO;EACP,aAAa;EACb,eACE;EACF,YAAY,KAAK,OAAO,EACtB,QAAQ,KAAK,MAAM,YAAY;GAC7B,UAAU;GACV,aAAa;GACd,CAAC,EACH,CAAC;EACF,UAAU,KAAK,SACb,iBAAiB;GACf,MAAM,SAAS,eACb,iBACA,KAAK,OACN;AACD,aAAU,0BAA0B,OAAO,UAAU;AACrD,UAAO,KAAK,OAAO,QAAQ;IAC3B;EACL,CAAC;CAEF,MAAM,qBAAqB,WAAW;EACpC,MAAM;EACN,OAAO;EACP,aAAa;EACb,eACE;EACF,YAAY,KAAK,OAAO,EACtB,SAAS,KAAK,MACZ,KAAK,OAAO;GACV,IAAI,KAAK,OAAO,EAAE,aAAa,qBAAqB,CAAC;GACrD,QAAQ;GACR,MAAM,KAAK,SACT,KAAK,OAAO,EAAE,aAAa,sBAAsB,CAAC,CACnD;GACD,SAAS,KAAK,SACZ,KAAK,OAAO,EAAE,aAAa,iCAAiC,CAAC,CAC9D;GACF,CAAC,EACF;GAAE,UAAU;GAAG,aAAa;GAAwC,CACrE,EACF,CAAC;EACF,UAAU,KAAK,SACb,iBAAiB;GACf,MAAM,SAAS,mBACb,iBACA,KAAK,QAMN;AACD,aAAU,8BAA8B,OAAO,UAAU;AACzD,UAAO,KAAK,OAAO,QAAQ;IAC3B;EACL,CAAC;CAEF,MAAM,WAAW,WAAW;EAC1B,MAAM;EACN,OAAO;EACP,aACE;EACF,eACE;EACF,YAAY,KAAK,OAAO,EAAE,CAAC;EAC3B,MAAM,UAAU;GACd,MAAM,SAAS,MAAM,qBAAqB,iBAAiB;AAC3D,aACE,gCAAgC,OAAO,SAAS,OAAO,WACxD;AACD,UAAO,KAAK,KAAK,UAAU,QAAQ,MAAM,EAAE,CAAC;;EAE/C,CAAC;CAIF,MAAM,YAAY,WAAW;EAC3B,MAAM;EACN,OAAO;EACP,aAAa;EACb,eACE;EACF,YAAY,KAAK,OAAO;GACtB,WAAW,KAAK,MACd,KAAK,OAAO;IACV,IAAI,KAAK,OAAO,EACd,aAAa,iDACd,CAAC;IACF,QAAQ,KAAK,OAAO,EAClB,aAAa,mCACd,CAAC;IACF,MAAM,KAAK,SACT,KAAK,MACH;KACE,KAAK,QAAQ,SAAS;KACtB,KAAK,QAAQ,QAAQ;KACrB,KAAK,QAAQ,OAAO;KACrB,EACD,EAAE,aAAa,6BAA6B,CAC7C,CACF;IACD,SAAS,KAAK,SACZ,KAAK,MACH,KAAK,OAAO;KACV,OAAO,KAAK,QAAQ;KACpB,OAAO,KAAK,QAAQ;KACpB,aAAa,KAAK,SAAS,KAAK,QAAQ,CAAC;KAC1C,CAAC,EACF,EACE,aACE,yDACH,CACF,CACF;IACD,UAAU,KAAK,SACb,KAAK,QAAQ,EAAE,aAAa,oBAAoB,CAAC,CAClD;IACD,WAAW,KAAK,SACd,KAAK,QAAQ,EACX,aAAa,kCACd,CAAC,CACH;IACF,CAAC,EACF;IAAE,UAAU;IAAG,UAAU;IAAG,CAC7B;GACD,SAAS,KAAK,SACZ,KAAK,OAAO,EAAE,aAAa,gCAAgC,CAAC,CAC7D;GACF,CAAC;EACF,MAAM,QAAQ,KAAK,MAAM;AACvB,OAAI,CAAC,UACH,QAAO,KACL,yJACD;GAGH,MAAM,MAAM,cAAc,SAAS,KAAK,QAAQ;AAChD,OAAI,IAAI,SAAS,UAAU;IACzB,MAAM,EAAE,cAAc,cAAc,UAAU;AAC9C,cACE,kCAAkC,IAAI,OAAO,SAAS,UAAU,WAAW,IAAI,QAAQ,OAAO,IAAI,mBACnG;AACD,cAAU,cAAc,qBAAqB;KAC3C,QAAQ,IAAI;KACZ,YAAY;KACZ,eAAe;KACf,SAAS,IAAI;KACb,oBAAoB,IAAI;KACzB,CAAC;AACF,WAAO,KAAK,IAAI,QAAQ;;GAK1B,MAAM,YAAY,wBAAwB,KAAK,UAAU;GAGzD,MAAM,sBAAM,IAAI,KAAa;AAC7B,QAAK,MAAM,KAAK,WAAW;AACzB,SAAK,EAAE,SAAS,YAAY,EAAE,SAAS,YAAY,CAAC,EAAE,SAAS,OAC7D,QAAO,KACL,oBAAoB,EAAE,GAAG,cAAc,EAAE,KAAK,8EAC/C;AAEH,QAAI,EAAE,aAAa,EAAE,SAAS,OAC5B,QAAO,KACL,oBAAoB,EAAE,GAAG,kCAAkC,EAAE,KAAK,+CACnE;AAEH,QAAI,IAAI,IAAI,EAAE,GAAG,CACf,QAAO,KACL,iCAAiC,EAAE,GAAG,qCACvC;AAEH,QAAI,IAAI,EAAE,GAAG;;AAKf,iBAAc,OAAO,KAAK,QAAQ;AAGlC,wBAAqB,KAAK;AAC1B,OAAI;IACF,MAAM,EAAE,SAAS,aAAa,MAAM,UAAU,QAAQ;KACpD;KACA,SAAS,oBAAoB,KAAK,QAAQ;KAC3C,CAAC;AACF,QAAI,iBAAiB,QAAQ,CAAE,eAAc,OAAO,KAAK,QAAQ;IAGjE,MAAM,YAAY,sBAChB,WACA,SACA,YACD;IAGD,MAAM,YAAY,wBAAwB,WAAW,SAAS;AAC9D,cACE,6BACE,OAAO,KAAK,QAAQ,CAAC,OACtB,iBAAiB,KAAK,UAAU,OAAO,cACtC,YAAY,gBAAgB,UAAU,WAAW,KAEpD;AACD,WAAO,KACL,KAAK,UACH;KAAE,SAAS;KAAW,GAAI,YAAY,EAAE,WAAW,GAAG,EAAE;KAAG,EAC3D,MACA,EACD,CACF;YACM,KAAK;AACZ,kBAAc,OAAO,KAAK,QAAQ;IAClC,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAChE,cAAU,2BAA2B,UAAU;AAC/C,WAAO,KAAK,6BAA6B,UAAU;aAC3C;AACR,yBAAqB,MAAM;;;EAGhC,CAAC;CAGF,MAAM,qBAAqB,WAAW;EACpC,MAAM;EACN,OAAO;EACP,aAAa;EACb,eACE;EACF,YAAY,KAAK,OAAO,EACtB,SAAS,KAAK,OAAO,EACnB,aAAa,qCACd,CAAC,EACH,CAAC;EACF,QAAQ,KAAK,MAAM;GACjB,MAAM,SAAS,eAAe,KAAK,QAAQ;AAC3C,aAAU,yBAAyB,OAAO,UAAU;AACpD,UAAO,QAAQ,QAAQ,KAAK,OAAO,QAAQ,CAAC;;EAE/C,CAAC;CAEF,MAAM,QAAQ;EACZ;EACA;EACAD;EACA;EACA;EAEA,SAAS,iBAAiB,WAAW;EACrC,SAAS,gBAAgB,WAAW;EACpC,SAAS,oBAAoB,WAAW;EAExC,SAAS,oBAAoB,aAAa;EAC3C;AAOD,KAAI,EADF,IAAI,iBAAiB,SAAS,kBAAkB,UAAU,IAAI,OAC5C,OAAM,KAAK,SAAS,WAAW,aAAa,CAAC;AACjE,QAAO"}

package/dist/{wizard-abort-C9Jbm-m7.js → wizard-abort-D3YA1hXX.js}

@@ -1,2 +1,2 @@
-import { i as wizardAbort, t as WizardError } from "./wizard-abort-B0c5VDie.js";
+import { i as wizardAbort, t as WizardError } from "./wizard-abort-hqHF-9xD.js";
 export { WizardError, wizardAbort };

package/dist/{wizard-abort-B0c5VDie.js → wizard-abort-hqHF-9xD.js}

@@ -1,7 +1,7 @@
 import { n as sanitizeErrorDetail, u as emitWizardError } from "./errors--OqLxmWR.js";
-import { f as getUI, m as LoggingUI, s as logToFile } from "./debug-DUmMVUHn.js";
+import { h as LoggingUI, p as getUI, s as logToFile } from "./debug-DWYDVp0B.js";
 import "./wizard-session-FSJCkTcP.js";
-import { n as analytics } from "./analytics-DSK0GXg1.js";
+import { n as analytics } from "./analytics-DSVyjIVF.js";
 //#region src/utils/wizard-abort.ts
 /**
 * Single exit point for the wizard. Use instead of process.exit() directly.
@@ -68,4 +68,4 @@ async function wizardAbort(options) {
 //#endregion
 export { wizardAbort as i, registerCleanup as n, runCleanups as r, WizardError as t };
 
-//# sourceMappingURL=wizard-abort-B0c5VDie.js.map
+//# sourceMappingURL=wizard-abort-hqHF-9xD.js.map

package/dist/{wizard-abort-B0c5VDie.js.map → wizard-abort-hqHF-9xD.js.map}

@@ -1 +1 @@
-{"version":3,"file":"wizard-abort-B0c5VDie.js","names":[],"sources":["../src/utils/wizard-abort.ts"],"sourcesContent":["/**\n * Single exit point for the wizard. Use instead of process.exit() directly.\n *\n * Sequence: cleanup -> error capture (optional) -> analytics shutdown -> outro -> process.exit\n *\n * WizardError is a data carrier passed to wizardAbort() for analytics context, never thrown.\n * The legacy abort() in setup-utils.ts delegates here.\n */\nimport { analytics } from './analytics';\nimport { logToFile } from './debug';\nimport { getUI } from '@ui';\nimport { LoggingUI } from '@ui/logging-ui';\nimport { OutroKind, type OutroData } from '@lib/wizard-session';\nimport type { ErrorCode } from '@lib/errors';\nimport { emitWizardError, sanitizeErrorDetail } from '@lib/errors';\n\nexport class WizardError extends Error {\n  readonly code?: ErrorCode;\n\n  constructor(\n    message: string,\n    public readonly context?: Record<string, unknown>,\n    code?: ErrorCode,\n  ) {\n    super(message);\n    this.name = 'WizardError';\n    this.code = code;\n  }\n}\n\ninterface WizardAbortOptions {\n  message?: string;\n  /** Structured error data. Renders via `outroError` instead of `outro`. */\n  outroData?: OutroData;\n  error?: Error | WizardError;\n  exitCode?: number;\n  code?: ErrorCode;\n  detail?: Record<string, unknown>;\n}\n\nconst cleanupFns: Array<() => void> = [];\n\nexport function registerCleanup(fn: () => void): void {\n  cleanupFns.push(fn);\n}\n\nexport function clearCleanup(): void {\n  cleanupFns.length = 0;\n}\n\n/** Runs all registered cleanup functions and drains the array. */\nexport function runCleanups(): void {\n  const fns = cleanupFns.splice(0);\n  for (const fn of fns) {\n    try {\n      fn();\n    } catch {\n      /* cleanup should not prevent exit */\n    }\n  }\n}\n\nfunction resolveErrorCode(\n  options: WizardAbortOptions,\n  error: Error | WizardError | undefined,\n): ErrorCode | undefined {\n  if (options.code) return options.code;\n  if (error instanceof WizardError) return error.code;\n  return undefined;\n}\n\nexport async function wizardAbort(\n  options?: WizardAbortOptions,\n): Promise<never> {\n  const {\n    message = 'Wizard setup cancelled.',\n    outroData,\n    error,\n    exitCode = 1,\n  } = options ?? {};\n\n  const code = resolveErrorCode(options ?? {}, error);\n  const detail = options?.detail;\n\n  logToFile(\n    `[wizard-abort] exitCode=${exitCode}, code=${\n      code ?? 'none'\n    }, message: ${message}`,\n  );\n  if (error) {\n    logToFile('[wizard-abort] error:', error);\n  }\n\n  // 1. Run registered cleanup functions\n  runCleanups();\n\n  // 2. Capture error in analytics (if provided)\n  if (error) {\n    analytics.captureException(error, {\n      ...((error instanceof WizardError && error.context) || {}),\n      ...(code ? { error_code: code } : {}),\n    });\n  }\n\n  // 3. Shutdown analytics\n  await analytics.shutdown(error ? 'error' : 'cancelled');\n\n  // 4. Render the error outro. Synthesize OutroData from `message`\n  //    when the caller didn't provide structured data.\n  const ui = getUI();\n  const resolvedOutroData: OutroData = outroData ?? {\n    kind: OutroKind.Error,\n    message,\n  };\n  if (code && resolvedOutroData.kind === OutroKind.Error) {\n    resolvedOutroData.errorCode ??= code;\n    if (detail) resolvedOutroData.errorDetail ??= detail;\n  }\n  ui.outroError(resolvedOutroData);\n\n  // 5. Wait for the user to dismiss the outro screen. In a TUI this gives\n  //    them time to read the error; in non-TUI environments it resolves\n  //    immediately.\n  await ui.waitForOutroDismissed();\n\n  // 6. Emit the machine-readable error line for non-interactive hosts\n  //    (LoggingUI and its HeadlessUI subclass); the TUI never sees it.\n  if (code && ui instanceof LoggingUI) {\n    emitWizardError({\n      code,\n      message: resolvedOutroData.message ?? message,\n      detail: sanitizeErrorDetail(resolvedOutroData.errorDetail ?? detail),\n    });\n  }\n\n  // 7. Exit (fires 'exit' event so TUI cleanup runs)\n  return process.exit(exitCode);\n}\n"],"mappings":";;;;;;;;;;;;;AAgBA,IAAa,cAAb,cAAiC,MAAM;CACrC;CAEA,YACE,SACA,SACA,MACA;AACA,QAAM,QAAQ;AAHE,OAAA,UAAA;AAIhB,OAAK,OAAO;AACZ,OAAK,OAAO;;;AAchB,MAAM,aAAgC,EAAE;AAExC,SAAgB,gBAAgB,IAAsB;AACpD,YAAW,KAAK,GAAG;;;AAQrB,SAAgB,cAAoB;CAClC,MAAM,MAAM,WAAW,OAAO,EAAE;AAChC,MAAK,MAAM,MAAM,IACf,KAAI;AACF,MAAI;SACE;;AAMZ,SAAS,iBACP,SACA,OACuB;AACvB,KAAI,QAAQ,KAAM,QAAO,QAAQ;AACjC,KAAI,iBAAiB,YAAa,QAAO,MAAM;;AAIjD,eAAsB,YACpB,SACgB;CAChB,MAAM,EACJ,UAAU,2BACV,WACA,OACA,WAAW,MACT,WAAW,EAAE;CAEjB,MAAM,OAAO,iBAAiB,WAAW,EAAE,EAAE,MAAM;CACnD,MAAM,SAAS,SAAS;AAExB,WACE,2BAA2B,SAAS,SAClC,QAAQ,OACT,aAAa,UACf;AACD,KAAI,MACF,WAAU,yBAAyB,MAAM;AAI3C,cAAa;AAGb,KAAI,MACF,WAAU,iBAAiB,OAAO;EAChC,GAAK,iBAAiB,eAAe,MAAM,WAAY,EAAE;EACzD,GAAI,OAAO,EAAE,YAAY,MAAM,GAAG,EAAE;EACrC,CAAC;AAIJ,OAAM,UAAU,SAAS,QAAQ,UAAU,YAAY;CAIvD,MAAM,KAAK,OAAO;CAClB,MAAM,oBAA+B,aAAa;EAChD,MAAA;EACA;EACD;AACD,KAAI,QAAQ,kBAAkB,SAAA,SAA0B;AACtD,oBAAkB,cAAc;AAChC,MAAI,OAAQ,mBAAkB,gBAAgB;;AAEhD,IAAG,WAAW,kBAAkB;AAKhC,OAAM,GAAG,uBAAuB;AAIhC,KAAI,QAAQ,cAAc,UACxB,iBAAgB;EACd;EACA,SAAS,kBAAkB,WAAW;EACtC,QAAQ,oBAAoB,kBAAkB,eAAe,OAAO;EACrE,CAAC;AAIJ,QAAO,QAAQ,KAAK,SAAS"}
+{"version":3,"file":"wizard-abort-hqHF-9xD.js","names":[],"sources":["../src/utils/wizard-abort.ts"],"sourcesContent":["/**\n * Single exit point for the wizard. Use instead of process.exit() directly.\n *\n * Sequence: cleanup -> error capture (optional) -> analytics shutdown -> outro -> process.exit\n *\n * WizardError is a data carrier passed to wizardAbort() for analytics context, never thrown.\n * The legacy abort() in setup-utils.ts delegates here.\n */\nimport { analytics } from './analytics';\nimport { logToFile } from './debug';\nimport { getUI } from '@ui';\nimport { LoggingUI } from '@ui/logging-ui';\nimport { OutroKind, type OutroData } from '@lib/wizard-session';\nimport type { ErrorCode } from '@lib/errors';\nimport { emitWizardError, sanitizeErrorDetail } from '@lib/errors';\n\nexport class WizardError extends Error {\n  readonly code?: ErrorCode;\n\n  constructor(\n    message: string,\n    public readonly context?: Record<string, unknown>,\n    code?: ErrorCode,\n  ) {\n    super(message);\n    this.name = 'WizardError';\n    this.code = code;\n  }\n}\n\ninterface WizardAbortOptions {\n  message?: string;\n  /** Structured error data. Renders via `outroError` instead of `outro`. */\n  outroData?: OutroData;\n  error?: Error | WizardError;\n  exitCode?: number;\n  code?: ErrorCode;\n  detail?: Record<string, unknown>;\n}\n\nconst cleanupFns: Array<() => void> = [];\n\nexport function registerCleanup(fn: () => void): void {\n  cleanupFns.push(fn);\n}\n\nexport function clearCleanup(): void {\n  cleanupFns.length = 0;\n}\n\n/** Runs all registered cleanup functions and drains the array. */\nexport function runCleanups(): void {\n  const fns = cleanupFns.splice(0);\n  for (const fn of fns) {\n    try {\n      fn();\n    } catch {\n      /* cleanup should not prevent exit */\n    }\n  }\n}\n\nfunction resolveErrorCode(\n  options: WizardAbortOptions,\n  error: Error | WizardError | undefined,\n): ErrorCode | undefined {\n  if (options.code) return options.code;\n  if (error instanceof WizardError) return error.code;\n  return undefined;\n}\n\nexport async function wizardAbort(\n  options?: WizardAbortOptions,\n): Promise<never> {\n  const {\n    message = 'Wizard setup cancelled.',\n    outroData,\n    error,\n    exitCode = 1,\n  } = options ?? {};\n\n  const code = resolveErrorCode(options ?? {}, error);\n  const detail = options?.detail;\n\n  logToFile(\n    `[wizard-abort] exitCode=${exitCode}, code=${\n      code ?? 'none'\n    }, message: ${message}`,\n  );\n  if (error) {\n    logToFile('[wizard-abort] error:', error);\n  }\n\n  // 1. Run registered cleanup functions\n  runCleanups();\n\n  // 2. Capture error in analytics (if provided)\n  if (error) {\n    analytics.captureException(error, {\n      ...((error instanceof WizardError && error.context) || {}),\n      ...(code ? { error_code: code } : {}),\n    });\n  }\n\n  // 3. Shutdown analytics\n  await analytics.shutdown(error ? 'error' : 'cancelled');\n\n  // 4. Render the error outro. Synthesize OutroData from `message`\n  //    when the caller didn't provide structured data.\n  const ui = getUI();\n  const resolvedOutroData: OutroData = outroData ?? {\n    kind: OutroKind.Error,\n    message,\n  };\n  if (code && resolvedOutroData.kind === OutroKind.Error) {\n    resolvedOutroData.errorCode ??= code;\n    if (detail) resolvedOutroData.errorDetail ??= detail;\n  }\n  ui.outroError(resolvedOutroData);\n\n  // 5. Wait for the user to dismiss the outro screen. In a TUI this gives\n  //    them time to read the error; in non-TUI environments it resolves\n  //    immediately.\n  await ui.waitForOutroDismissed();\n\n  // 6. Emit the machine-readable error line for non-interactive hosts\n  //    (LoggingUI and its HeadlessUI subclass); the TUI never sees it.\n  if (code && ui instanceof LoggingUI) {\n    emitWizardError({\n      code,\n      message: resolvedOutroData.message ?? message,\n      detail: sanitizeErrorDetail(resolvedOutroData.errorDetail ?? detail),\n    });\n  }\n\n  // 7. Exit (fires 'exit' event so TUI cleanup runs)\n  return process.exit(exitCode);\n}\n"],"mappings":";;;;;;;;;;;;;AAgBA,IAAa,cAAb,cAAiC,MAAM;CACrC;CAEA,YACE,SACA,SACA,MACA;AACA,QAAM,QAAQ;AAHE,OAAA,UAAA;AAIhB,OAAK,OAAO;AACZ,OAAK,OAAO;;;AAchB,MAAM,aAAgC,EAAE;AAExC,SAAgB,gBAAgB,IAAsB;AACpD,YAAW,KAAK,GAAG;;;AAQrB,SAAgB,cAAoB;CAClC,MAAM,MAAM,WAAW,OAAO,EAAE;AAChC,MAAK,MAAM,MAAM,IACf,KAAI;AACF,MAAI;SACE;;AAMZ,SAAS,iBACP,SACA,OACuB;AACvB,KAAI,QAAQ,KAAM,QAAO,QAAQ;AACjC,KAAI,iBAAiB,YAAa,QAAO,MAAM;;AAIjD,eAAsB,YACpB,SACgB;CAChB,MAAM,EACJ,UAAU,2BACV,WACA,OACA,WAAW,MACT,WAAW,EAAE;CAEjB,MAAM,OAAO,iBAAiB,WAAW,EAAE,EAAE,MAAM;CACnD,MAAM,SAAS,SAAS;AAExB,WACE,2BAA2B,SAAS,SAClC,QAAQ,OACT,aAAa,UACf;AACD,KAAI,MACF,WAAU,yBAAyB,MAAM;AAI3C,cAAa;AAGb,KAAI,MACF,WAAU,iBAAiB,OAAO;EAChC,GAAK,iBAAiB,eAAe,MAAM,WAAY,EAAE;EACzD,GAAI,OAAO,EAAE,YAAY,MAAM,GAAG,EAAE;EACrC,CAAC;AAIJ,OAAM,UAAU,SAAS,QAAQ,UAAU,YAAY;CAIvD,MAAM,KAAK,OAAO;CAClB,MAAM,oBAA+B,aAAa;EAChD,MAAA;EACA;EACD;AACD,KAAI,QAAQ,kBAAkB,SAAA,SAA0B;AACtD,oBAAkB,cAAc;AAChC,MAAI,OAAQ,mBAAkB,gBAAgB;;AAEhD,IAAG,WAAW,kBAAkB;AAKhC,OAAM,GAAG,uBAAuB;AAIhC,KAAI,QAAQ,cAAc,UACxB,iBAAgB;EACd;EACA,SAAS,kBAAkB,WAAW;EACtC,QAAQ,oBAAoB,kBAAkB,eAAe,OAAO;EACrE,CAAC;AAIJ,QAAO,QAAQ,KAAK,SAAS"}

package/dist/{yara-hooks-uCiAIcqU.js → yara-hooks-BaPKsm-B.js}

@@ -1,6 +1,6 @@
-import { f as getUI, s as logToFile, u as WIZARD_YARA_REPORT_FILE } from "./debug-DUmMVUHn.js";
-import { n as analytics } from "./analytics-DSK0GXg1.js";
-import { r as readFileHead } from "./bounded-fs-D85Tk3nS.js";
+import { d as WIZARD_YARA_REPORT_FILE, p as getUI, s as logToFile } from "./debug-DWYDVp0B.js";
+import { n as analytics } from "./analytics-DSVyjIVF.js";
+import { r as readFileHead } from "./bounded-fs-FbZJ_vJ_.js";
 import fs from "fs";
 import path from "path";
 import fg from "fast-glob";
@@ -782,4 +782,4 @@ async function scanSkillFiles(cwd, skillDir, llmProvider) {
 //#endregion
 export { publishBlockingMatch as C, SETUP_REPORT_FILE as S, AUDIT_CHECKS_KEY as _, flushScanReport as a, coerceAuditChecks as b, isWizardDocumentationPath as c, repeatBlockReason as d, scanAndTriage as f, AUDIT_CHECKS_FILE as g, EVENT_PLAN_FILE as h, createRepeatBlockTracker as i, prewarmYaraScanner as l, writeScanReport as m, createPostToolUseYaraHooks as n, formatScanReport as o, scanInstalledSkill as p, createPreToolUseYaraHooks as r, formatYaraAbortMessage as s, captureScanReport as t, recordExternalScan as u, AUDIT_REPORT_FILE as v, scanVerdict as w, getAuditChecks as x, AUDIT_SEVERITY_STYLE as y };
 
-//# sourceMappingURL=yara-hooks-uCiAIcqU.js.map
+//# sourceMappingURL=yara-hooks-BaPKsm-B.js.map