@posthog/wizard 2.76.1 → 2.78.0

package/dist/run-agent-legacy-d7rWlzQR.js

@@ -0,0 +1,3739 @@
+import { t as __exportAll } from "./rolldown-runtime-B_-DWIq7.js";
+import { a as AgentSignals, d as ErrorCodes } from "./errors-CQ9kttJD.js";
+import { i as enableDebugLogs, o as initLogFile, s as logToFile } from "./debug-Ch4BDOtD.js";
+import { $ as getSkillsBaseUrl, G as WIZARD_ORCHESTRATOR_FLAG_KEY, W as WIZARD_OAUTH_SCOPES, Z as WIZARD_SELF_DRIVING_USE_PI_HARNESS_FLAG_KEY, b as HAIKU_MODEL, n as AGENTIC_DETECTION_RETRY_TIMEOUT_MS, t as AGENTIC_DETECTION_FIRST_ATTEMPT_TIMEOUT_MS, u as DETECTION_TIMEOUT_MS, w as Integration } from "./constants-jFI2SaE1.js";
+import { r as mayReportScanResults } from "./wizard-session-2w4Ru-Wz.js";
+import { n as analytics, r as groupsFromUser } from "./analytics-CHCZ_qUR.js";
+import { a as safeReadFile, i as readProjectFile, o as walkProjectFiles } from "./bounded-fs-Bx9zTe6m.js";
+import { c as refreshAccessToken, l as OAuthError, p as detectNodePackageManagers, s as missingOAuthScopes, t as getOrAskForProjectData } from "./setup-utils-CmTCTPkX.js";
+import { a as getBlockingServiceKeys, i as evaluateWizardReadiness, n as SERVICE_LABELS, r as SIGNUP_WIZARD_READINESS_CONFIG } from "./logging-ui-_TwoMNbG.js";
+import { t as getUI } from "./ui-BBVuTM1v.js";
+import { i as wizardAbort, t as registerCleanup } from "./wizard-abort-BBkiUxfS.js";
+import { n as isNonInteractiveEnvironment } from "./environment-B07Bmxae.js";
+import { i as oauthCredentials, t as configureOAuthSession } from "./oauth-session-DJ8h6GFa.js";
+import { at as MAX_ENV_KEY_SET, c as checkAllSettingsConflicts, ct as toPromptSafeRelativePath, d as restoreClaudeSettings, h as markGrantRevoked, i as runAgent, l as classifySettingsConflicts, n as buildRunTags, ot as isEnvFileName, r as initializeAgent, s as backupAndFixClaudeSettings, st as parseEnvKeyNames } from "./agent-interface-BAOIHuXS.js";
+import { n as runAgent$1, r as resolveBinding } from "./agent-bCZ3i3fh.js";
+import { _ as coerceAuditChecks, a as flushScanReport } from "./yara-hooks-DCeMDd1o.js";
+import { g as TASK_OUTCOMES_KEY } from "./queue-tools-9OOVx5TE.js";
+import { t as FRAMEWORK_REGISTRY } from "./registry-8YG-kuXk.js";
+import { t as startFileWatcher } from "./file-watcher-DWc_bTs6.js";
+import * as semver from "semver";
+import fs, { existsSync, statSync } from "fs";
+import path, { isAbsolute, join, relative, resolve, sep } from "path";
+//#region src/ui/agent-progress.ts
+/**
+* The inverse of the agent's former `getUI()` calls: one event, one
+* `WizardUI` method, synchronous, in emission order. Because each case maps
+* back to exactly the call the agent used to make, the frame and flow goldens
+* hold without regeneration.
+*/
+function createUiReducer(ui) {
+	let spinner;
+	return (event) => {
+		switch (event.kind) {
+			case "lifecycle":
+				if (event.phase === "started") ui.startRun();
+				else ui.outro(event.message);
+				break;
+			case "spinner":
+				(spinner ??= ui.spinner())[event.action](event.message);
+				break;
+			case "log":
+				ui.log[event.level](event.message);
+				break;
+			case "status":
+				ui.pushStatus(event.message);
+				break;
+			case "tasks":
+				ui.syncTodos(event.tasks);
+				break;
+			case "stage":
+				ui.setStage(event.stage);
+				break;
+			case "url":
+				if (event.which === "dashboard") ui.setDashboardUrl(event.url);
+				else ui.setNotebookUrl(event.url);
+				break;
+			case "usage":
+				ui.addTokenUsage(event.delta);
+				break;
+			case "finalCost":
+				ui.setFinalTokenCostUsd(event.usd);
+				break;
+			case "authError":
+				ui.showAuthError(event.detail);
+				break;
+			case "handoff":
+				ui.setHandoffText(event.text);
+				break;
+			case "completion":
+				ui.setOutroData(event.outro);
+				break;
+			default: throw new Error(`Unhandled agent progress: ${JSON.stringify(event)}`);
+		}
+	};
+}
+/** The agent's questions, answered wherever `getUI()` answers them today. */
+function uiInteraction(ui) {
+	return {
+		ask: (question, { signal }) => dismissOnAbort(ui.requestQuestion(question), signal, () => ui.cancelPendingQuestion()),
+		taskNotice: (notice, { signal }) => dismissOnAbort(ui.showTaskNotice(notice), signal, () => ui.cancelTaskNotice())
+	};
+}
+/**
+* Dismiss one open request on abort; a settled one leaves the UI alone. A
+* throw inside an abort listener reaches no caller: Node rethrows it as an
+* uncaught exception, so a broken overlay is logged here instead.
+*/
+function dismissOnAbort(open, signal, dismiss) {
+	const onAbort = () => {
+		try {
+			dismiss();
+		} catch (error) {
+			logToFile("[agent-progress] dismissing an aborted request failed", error);
+		}
+	};
+	if (signal.aborted) onAbort();
+	else signal.addEventListener("abort", onAbort, { once: true });
+	return open.finally(() => signal.removeEventListener("abort", onAbort));
+}
+//#endregion
+//#region src/lib/programs/program-step.ts
+/**
+* Project program steps into the narrower Screen shape the router consumes.
+*
+* Two things happen here:
+*   1. Headless steps (no `screenId`) are filtered out. The router walks
+*      visible screens; gate-only steps like `detect` are store concerns.
+*   2. The step is narrowed to just { id, show, isComplete } — the
+*      router has no business touching gate, onInit, or label.
+*
+* This intentional separation keeps the router focused on one question:
+* "Which screen should be rendered right now?"
+*/
+/**
+* The gated steps the agent runner awaits after `auth` and before `run`, in
+* step order. Empty when a program has no auth step or runs before it.
+*/
+function postAuthGateSteps(steps) {
+	const authIndex = steps.findIndex((s) => s.screenId === "auth");
+	const runIndex = steps.findIndex((s) => s.screenId === "run");
+	if (authIndex === -1 || runIndex <= authIndex) return [];
+	return steps.slice(authIndex + 1, runIndex).filter((s) => s.gate);
+}
+function createProgramSequence(steps) {
+	const entries = steps.filter((step) => step.screenId != null).map((step) => ({
+		id: step.screenId,
+		show: step.show,
+		isComplete: step.isComplete ?? step.gate
+	}));
+	entries.push({
+		id: "exit",
+		show: void 0,
+		isComplete: void 0
+	});
+	return entries;
+}
+//#endregion
+//#region src/lib/programs/authenticate.ts
+async function authenticate(session, programId) {
+	if (session.credentials) return;
+	logToFile("[agent-runner] starting OAuth");
+	const { projectApiKey, host, accessToken, refreshToken, expiresAt, oauthClientId, projectId, roleAtOrganization, user, project, missingScopes } = await getOrAskForProjectData({
+		signup: session.signup,
+		ci: session.ci,
+		apiKey: session.apiKey,
+		projectId: session.projectId,
+		email: session.email,
+		region: session.region,
+		baseUrl: session.baseUrl,
+		localMcp: session.localMcp,
+		programId
+	});
+	session.credentials = {
+		accessToken,
+		refreshToken,
+		expiresAt,
+		oauthClientId,
+		projectApiKey,
+		host,
+		projectId,
+		missingScopes
+	};
+	session.apiProject = project;
+	session.roleAtOrganization = roleAtOrganization;
+	session.apiUser = user;
+	getUI().setCredentials(session.credentials);
+	getUI().setRoleAtOrganization(roleAtOrganization);
+	getUI().setApiUser(user);
+	if (user) analytics.identifyUser(user);
+	analytics.setGroups(groupsFromUser(user, host.apiHost));
+}
+/**
+* Grants the token endpoint refuses permanently. A dead grant means the login
+* is gone, not that the network blipped, so only these mark the session.
+*/
+const DEAD_GRANT_CODES = new Set(["invalid_grant", "invalid_client"]);
+async function refreshAccessTokenIfNeeded(session) {
+	if (!session.credentials) return;
+	configureOAuthSession(session.credentials, {
+		rotate: (credentials) => rotateCredentials(credentials, session.baseUrl),
+		onRefreshed: (refreshed) => {
+			session.credentials = refreshed;
+			getUI().setAccessToken(refreshed);
+		}
+	});
+	await oauthCredentials();
+}
+async function rotateCredentials(credentials, baseUrl) {
+	if (!credentials.refreshToken) return credentials;
+	try {
+		const token = await refreshAccessToken(credentials.refreshToken, baseUrl, credentials.oauthClientId);
+		return {
+			...credentials,
+			accessToken: token.access_token,
+			missingScopes: missingOAuthScopes([...WIZARD_OAUTH_SCOPES, ...credentials.missingScopes ?? []], token.scope),
+			refreshToken: token.refresh_token ?? credentials.refreshToken,
+			expiresAt: Date.now() + token.expires_in * 1e3
+		};
+	} catch (error) {
+		if (error instanceof OAuthError && DEAD_GRANT_CODES.has(error.code)) {
+			markGrantRevoked();
+			analytics.wizardCapture("auth session expired", { reason: error.code });
+		}
+		logToFile("[oauth] token refresh failed, continuing with the existing token:", error instanceof Error ? error.message : error);
+		return credentials;
+	}
+}
+//#endregion
+//#region src/lib/detection/framework.ts
+/**
+* Framework detection — identify which PostHog-supported framework
+* is present in the project directory.
+*
+* Pure function: takes an install dir, returns the detected integration
+* (or undefined). No store mutations, no UI calls.
+*/
+/**
+* Loop through all registered frameworks and return the first one
+* whose `detect()` predicate matches the given directory.
+* Returns undefined if no framework is detected or detection times out.
+*/
+async function detectFramework(installDir) {
+	for (const integration of Object.values(Integration)) {
+		const config = FRAMEWORK_REGISTRY[integration];
+		try {
+			if (await Promise.race([config.detection.detect({ installDir }), new Promise((resolve) => setTimeout(() => resolve(false), 1e4))])) return integration;
+		} catch {}
+	}
+}
+//#endregion
+//#region src/lib/detection/features.ts
+/**
+* Feature discovery — scan project dependencies for known SDK patterns
+* that indicate additional PostHog programs are relevant.
+*
+* Pure function: takes an install dir, returns a set of discovered features.
+* No store mutations, no UI calls.
+*/
+const STRIPE_PACKAGES = new Set(["stripe", "@stripe/stripe-js"]);
+const LLM_PACKAGES = new Set([
+	"openai",
+	"@anthropic-ai/sdk",
+	"ai",
+	"@ai-sdk/openai",
+	"langchain",
+	"@langchain/openai",
+	"@langchain/langgraph",
+	"@google/generative-ai",
+	"@google/genai",
+	"@instructor-ai/instructor",
+	"@mastra/core",
+	"portkey-ai"
+]);
+const PYTHON_LLM_PACKAGES = new Set([
+	"openai",
+	"anthropic",
+	"langchain",
+	"langchain-openai",
+	"langchain-anthropic",
+	"langchain-google-genai",
+	"langgraph",
+	"litellm",
+	"llama-index",
+	"pydantic-ai",
+	"crewai",
+	"instructor",
+	"dspy-ai",
+	"mistralai",
+	"cohere",
+	"google-generativeai",
+	"google-genai",
+	"portkey-ai"
+]);
+function discoverFeatures(installDir) {
+	const features = [];
+	discoverNodeFeatures(installDir, features);
+	discoverPythonFeatures(installDir, features);
+	return features;
+}
+function discoverNodeFeatures(installDir, features) {
+	const packageJsonText = safeRead(installDir, "package.json");
+	if (!packageJsonText) return;
+	let packageJson;
+	try {
+		packageJson = JSON.parse(packageJsonText);
+	} catch {
+		return;
+	}
+	const depNames = Object.keys({
+		...packageJson.dependencies,
+		...packageJson.devDependencies
+	});
+	if (depNames.some((depName) => STRIPE_PACKAGES.has(depName))) features.push("stripe");
+	if (depNames.some((depName) => LLM_PACKAGES.has(depName))) features.push("llm");
+}
+function discoverPythonFeatures(installDir, features) {
+	if (features.includes("llm")) return;
+	const depNames = [];
+	const requirementsTxt = safeRead(installDir, "requirements.txt");
+	if (requirementsTxt) depNames.push(...parseRequirementsTxt(requirementsTxt));
+	const pyprojectToml = safeRead(installDir, "pyproject.toml");
+	if (pyprojectToml) depNames.push(...parsePyprojectToml(pyprojectToml));
+	const pipfile = safeRead(installDir, "Pipfile");
+	if (pipfile) depNames.push(...parsePipfile(pipfile));
+	if (depNames.some((depName) => PYTHON_LLM_PACKAGES.has(depName))) features.push("llm");
+}
+function safeRead(installDir, file) {
+	return readProjectFile(join(installDir, file));
+}
+function normalizePyName(name) {
+	return name.toLowerCase().replace(/_/g, "-");
+}
+function parseRequirementsTxt(content) {
+	return content.split("\n").map((line) => line.trim()).filter((line) => line && !line.startsWith("#") && !line.startsWith("-")).map((line) => line.replace(/\[[^\]]*\]/, "")).map((line) => line.split(/[<>=!~;\s]/)[0]).filter(Boolean).map(normalizePyName);
+}
+function parsePyprojectToml(content) {
+	const depNames = [];
+	for (const arrayMatch of content.matchAll(/dependencies\s*=\s*\[([^\]]*)\]/g)) {
+		const arrayBody = arrayMatch[1];
+		for (const quotedMatch of arrayBody.matchAll(/["']([^"']+)["']/g)) {
+			const name = quotedMatch[1].replace(/\[[^\]]*\]/, "").split(/[<>=!~;\s]/)[0];
+			if (name) depNames.push(normalizePyName(name));
+		}
+	}
+	for (const sectionMatch of content.matchAll(/\[tool\.poetry\.(?:dev-dependencies|dependencies|group\.[^.\]]+\.dependencies)\]([\s\S]*?)(?=\n\[|$)/g)) {
+		const sectionBody = sectionMatch[1];
+		depNames.push(...extractTomlSectionKeys(sectionBody, { skip: ["python"] }));
+	}
+	return depNames;
+}
+function parsePipfile(content) {
+	const depNames = [];
+	for (const sectionMatch of content.matchAll(/\[(packages|dev-packages)\]([\s\S]*?)(?=\n\[|$)/g)) {
+		const sectionBody = sectionMatch[2];
+		depNames.push(...extractTomlSectionKeys(sectionBody));
+	}
+	return depNames;
+}
+function extractTomlSectionKeys(sectionBody, opts = {}) {
+	const skipNames = new Set(opts.skip ?? []);
+	const depNames = [];
+	for (const line of sectionBody.split("\n")) {
+		const trimmed = line.trim();
+		if (!trimmed || trimmed.startsWith("#")) continue;
+		const equalsIndex = trimmed.indexOf("=");
+		if (equalsIndex <= 0) continue;
+		const name = trimmed.slice(0, equalsIndex).trim();
+		if (!/^[a-zA-Z0-9._-]+$/.test(name)) continue;
+		if (skipNames.has(name.toLowerCase())) continue;
+		depNames.push(normalizePyName(name));
+	}
+	return depNames;
+}
+//#endregion
+//#region src/lib/detection/context.ts
+/**
+* Framework context gathering — run gatherContext and version checks
+* for a detected framework.
+*
+* Pure functions: take a framework config and options, return results.
+* No store mutations, no UI calls.
+*/
+/**
+* Run a framework's `gatherContext()` to collect variant-specific
+* metadata (e.g., router type for Next.js, Expo vs bare for React Native).
+*
+* Returns the gathered context, or an empty object on failure/timeout.
+*/
+async function gatherFrameworkContext(config, options) {
+	if (!config.metadata.gatherContext) return {};
+	try {
+		return await Promise.race([config.metadata.gatherContext(options), new Promise((resolve) => setTimeout(() => resolve({}), DETECTION_TIMEOUT_MS))]);
+	} catch {
+		return {};
+	}
+}
+/**
+* Check whether the installed framework version meets the minimum requirement.
+*
+* Returns `{ supported: true }` if the version is fine (or no check is needed).
+* Returns the version details if unsupported.
+*/
+async function checkFrameworkVersion(config, options) {
+	if (!config.detection.minimumVersion || !config.detection.getInstalledVersion) return { supported: true };
+	const version = await config.detection.getInstalledVersion(options);
+	if (!version) return { supported: true };
+	const coerced = semver.coerce(version);
+	if (coerced && semver.lt(coerced, config.detection.minimumVersion)) return { supported: {
+		current: version,
+		minimum: config.detection.minimumVersion,
+		docsUrl: config.metadata.unsupportedVersionDocsUrl ?? config.metadata.docsUrl
+	} };
+	return { supported: true };
+}
+//#endregion
+//#region src/lib/detection/agentic.ts
+/**
+* Agentic project detection.
+*
+* A reusable detection tool that drives a Haiku agent over the repo: it finds
+* project roots, resolves monorepo/workspace markers, reads package manifests,
+* classifies each project against a caller-supplied set of targets, and reports
+* which projects already have a PostHog SDK installed.
+*
+* Product-knowledge-free by design — the caller passes the targets to classify
+* into (e.g. source-map skill variants) and maps the result back. Sits next to
+* the other detection tools (framework, features, package-manager) so it's
+* discoverable. Runs AFTER auth: it uses the same agent loop every program
+* uses, which needs credentials.
+*/
+var AgenticDetectionTimeoutError = class extends Error {
+	constructor(attempt, timeoutMs) {
+		super(`Project scan attempt ${attempt} timed out after ${timeoutMs / 1e3}s`);
+		this.name = "AgenticDetectionTimeoutError";
+	}
+};
+/**
+* Every project-manifest / workspace-marker filename the wizard's frameworks
+* are identified by. One brace-expansion Glob over all of these locates every
+* project root in the repo in a single call, regardless of language.
+*
+* Counterpart: POSTHOG_MANIFESTS in @lib/programs/self-driving/detect (SDK
+* grep); keep the two in sync.
+*/
+const PROJECT_MANIFESTS = [
+	"package.json",
+	"pnpm-workspace.yaml",
+	"turbo.json",
+	"nx.json",
+	"lerna.json",
+	"requirements.txt",
+	"pyproject.toml",
+	"setup.py",
+	"Pipfile",
+	"manage.py",
+	"Gemfile",
+	"composer.json",
+	"pom.xml",
+	"Cargo.toml",
+	"mix.exs",
+	"go.mod",
+	"*.csproj",
+	"Package.swift",
+	"Podfile",
+	"project.yml",
+	"project.pbxproj",
+	"pubspec.yaml",
+	"build.gradle",
+	"build.gradle.kts",
+	"settings.gradle",
+	"settings.gradle.kts",
+	"gradle/libs.versions.toml"
+];
+/** The single brace-expansion glob covering every supported manifest. */
+function manifestGlob() {
+	return `**/{${PROJECT_MANIFESTS.join(",")}}`;
+}
+function buildPrompt(cwd, targets, purpose, recommend) {
+	const targetList = targets.map((t) => `- ${t.id} → ${t.name}`).join("\n");
+	const projectShape = `{"path":string,"framework":string,"matchingTargets":string[],"targetId":string|null,"hasPostHog":boolean,"evidence":string${recommend ? ",\"recommended\":boolean" : ""}}`;
+	return [
+		`You are scanning a code repository to ${purpose}. Be fast and mechanical — do not over-explore. Keep any reasoning to one short sentence, then run the tool calls and output the JSON.`,
+		"",
+		`Working directory: ${cwd}`,
+		"",
+		"A \"project\" is a directory containing one or more of the manifest files below. Find projects by their manifests, NOT by walking directories — never report a directory that has no manifest.",
+		"",
+		"Do exactly this:",
+		`1. Run Glob ONCE with this pattern to find every project manifest in the repo in a single call: "${manifestGlob()}". Discard any result whose path contains node_modules/, dist/, build/, .next/, out/, coverage/, vendor/, .venv/, site-packages/, target/, Pods/, Carthage/, or DerivedData/. Group the remaining results by directory — each directory is one project. Three exceptions to "directory = project": a project.pbxproj lives inside a "<Name>.xcodeproj/" wrapper, so the project root is the PARENT of that .xcodeproj directory; a project.yml at a directory root is an XcodeGen-generated Xcode app rooted at that directory; a gradle/libs.versions.toml is a version catalog belonging to the gradle project rooted at the PARENT of that gradle/ directory (read it alongside the build.gradle when deciding hasPostHog), never its own project.`,
+		"2. Decide repoType: \"monorepo\" if the root package.json has a \"workspaces\" field OR a pnpm-workspace.yaml / turbo.json / nx.json / lerna.json was found at the root, else \"single\".",
+		`3. For EACH project directory, ONE AT A TIME: Read its manifest(s) ONCE, decide the fields below, then IMMEDIATELY — before reading any other project — write that project's verdict as one JSON line of shape ${projectShape}. Never write a verdict from memory of an earlier Read; the manifest you just read is the only source. Decide from its dependency lists:`,
+		"   - the human-readable framework name (e.g. \"Next.js\", \"Django\", \"Rails\"),",
+		"   - matchingTargets: EVERY target id from the list below whose technology appears in THIS manifest, in the priority order of the list. An id belongs here only if you can point at the dependency or setting in the manifest you just read — never carry one over from another project,",
+		"   - targetId: the FIRST entry of matchingTargets (the list is ordered by priority, most specific first). null when matchingTargets is empty,",
+		`   - hasPostHog: true if any dependency is a PostHog SDK. This includes: a name containing "posthog" in any ecosystem (e.g. posthog-js, posthog-node, @posthog/*, posthog for pip/gem/hex, a com.posthog:* gradle/maven coordinate, a PostHog NuGet PackageReference); an SPM package named "PostHog" or a repositoryURL of github.com/PostHog/posthog-ios (in Package.swift or a .pbxproj); or a "pod 'PostHog'" line in a Podfile. Else false.`,
+		"   - evidence: the manifest fact that decided targetId, with the file it came from (e.g. \"rollup in devDependencies of backend/package.json\"). When targetId is null, name the closest fact you saw. One short clause, quoted from the manifest you just read.",
+		"   Do NOT read any file other than these manifests.",
+		...recommend ? ["4. Pick exactly ONE project as recommended — the main user-facing client application. Prefer a frontend web app or a mobile app over backend servers/APIs, libraries, CLIs, tooling, and example/demo/docs apps. If several client apps exist, pick the primary production app; if no client app exists, pick the primary application project."] : [],
+		"",
+		"Target ids (id → name), in priority order — most specific first; if several match a project, keep the one listed earliest:",
+		targetList,
+		"",
+		"Output requirements:",
+		"- After the last verdict line, respond with ONLY a single JSON object assembling the verdict lines you wrote, copied VERBATIM — same path, framework, targetId and evidence per project. No prose, no markdown code fences.",
+		`- Shape: {"repoType":"monorepo"|"single","projects":[${projectShape}]}`,
+		"- \"path\" is the project directory relative to the working directory; use \".\" for the repo root.",
+		"- \"targetId\" MUST be exactly one of the target ids above when it matches; if several match, use the one listed earliest; otherwise null.",
+		"- Include projects whose stack matches no target too (targetId: null).",
+		...recommend ? ["- Exactly one project has \"recommended\": true; every other project has \"recommended\": false."] : [],
+		`- If there are no manifests at all, respond with exactly: ${AgentSignals.ABORT} detection failed`
+	].join("\n");
+}
+/**
+* Build the detection report from the agent's output, or null when it holds
+* no verdicts. Exported for testing.
+*
+* The verdict lines are far more reliable than the model's final assembly
+* (prose, pretty-printing, per-object fences), so every parseable line
+* contributes: objects with a `path` merge by path (last wins), and a
+* one-line assembly's `projects` merge the same way. `repoType` is
+* approximated from the count — it only feeds telemetry and display.
+*/
+function deriveReportJson(text) {
+	const byPath = /* @__PURE__ */ new Map();
+	for (const line of text.split("\n")) {
+		const start = line.indexOf("{");
+		const end = line.lastIndexOf("}");
+		if (start === -1 || end <= start) continue;
+		let parsed;
+		try {
+			parsed = JSON.parse(line.slice(start, end + 1));
+		} catch {
+			continue;
+		}
+		const obj = parsed ?? {};
+		const candidates = Array.isArray(obj.projects) ? obj.projects : [obj];
+		for (const candidate of candidates) {
+			const p = candidate ?? {};
+			if (typeof p.path === "string") byPath.set(p.path, p);
+		}
+	}
+	if (byPath.size === 0) return null;
+	const projects = [...byPath.values()];
+	return {
+		repoType: projects.length > 1 ? "monorepo" : "single",
+		projects
+	};
+}
+/**
+* Clamp an agent-reported project path to a safe repo-relative dir. The path
+* is LLM output: absolute paths or `..` segments could steer later phases
+* (e.g. integrate-run's targetDir) outside the repo, so they clamp to '.'.
+*/
+function coercePath(raw) {
+	if (typeof raw !== "string" || raw.length === 0) return ".";
+	if (isAbsolute(raw) || raw.split(/[\\/]/).includes("..")) return ".";
+	return raw;
+}
+/** Resolve an agent-reported path to an absolute dir clamped to the root — the caller-side counterpart of coercePath. */
+function resolveProjectDir(installDir, rel) {
+	if (typeof rel !== "string" || rel === ".") return installDir;
+	const root = resolve(installDir);
+	const dir = resolve(root, rel);
+	return dir === root || dir.startsWith(root + sep) ? dir : root;
+}
+/**
+* Validate the agent's raw JSON into a report, clamping each targetId to the
+* supplied set and each path to a repo-relative dir. Exported for testing.
+* `recommended` is stripped unless requested; at most one (the first) survives.
+*/
+function coerceAgenticReport(parsed, validTargetIds, options) {
+	const recommend = options?.recommend === true;
+	const rerankIds = options?.rerankIds ?? [];
+	const obj = parsed ?? {};
+	const repoType = obj.repoType === "monorepo" ? "monorepo" : "single";
+	const rawProjects = Array.isArray(obj.projects) ? obj.projects : [];
+	let recommendedSeen = false;
+	return {
+		repoType,
+		projects: rawProjects.map((raw) => {
+			const p = raw ?? {};
+			const pick = typeof p.targetId === "string" && validTargetIds.includes(p.targetId) ? p.targetId : null;
+			const enumerated = Array.isArray(p.matchingTargets) ? validTargetIds.find((id) => p.matchingTargets.includes(id)) ?? null : null;
+			const targetId = pick === null ? enumerated : enumerated !== null && rerankIds.includes(enumerated) && rerankIds.includes(pick) ? enumerated : pick;
+			const recommended = recommend && !recommendedSeen && p.recommended === true;
+			recommendedSeen ||= recommended;
+			return {
+				path: coercePath(p.path),
+				framework: typeof p.framework === "string" ? p.framework : "Unknown",
+				targetId,
+				hasPostHog: p.hasPostHog === true,
+				...recommend ? { recommended } : {}
+			};
+		})
+	};
+}
+function formatToolUse(block) {
+	const name = typeof block?.name === "string" ? block.name : "tool";
+	const input = block?.input ?? {};
+	const detail = input.file_path || input.pattern || input.path || "";
+	return detail ? `${name} ${detail}` : name;
+}
+function sessionToWizardOptions(session) {
+	return {
+		installDir: session.installDir,
+		ci: session.ci,
+		debug: session.debug,
+		benchmark: session.benchmark,
+		yaraReport: session.yaraReport,
+		signup: session.signup,
+		apiKey: session.apiKey,
+		projectId: session.projectId
+	};
+}
+const NOOP_SPINNER = {
+	start: () => void 0,
+	stop: () => void 0,
+	message: () => void 0
+};
+/**
+* Drive the wizard's agent loop on HAIKU_MODEL to scan the repo and return a
+* structured detection report. Reuses the same setup every program uses, so
+* MCP, tools, and credentials are wired identically.
+*/
+async function detectProjectsWithAgent(session, options) {
+	if (!session.credentials) throw new Error("Detection requires authenticated credentials.");
+	const { targets, programId, purpose = "set up a PostHog integration", recommend = false, rerankIds, onEvent } = options;
+	const { accessToken, host } = session.credentials;
+	const cwd = session.installDir;
+	const runOptions = sessionToWizardOptions(session);
+	const wizardMetadata = {
+		...buildRunTags({
+			programId,
+			integration: "agentic-detect",
+			runId: analytics.runId,
+			build: analytics.build
+		}),
+		call_type: "detection"
+	};
+	const prompt = buildPrompt(cwd, targets, purpose, recommend);
+	for (let attempt = 0; attempt < 2; attempt++) {
+		const timeoutMs = attempt === 0 ? AGENTIC_DETECTION_FIRST_ATTEMPT_TIMEOUT_MS : AGENTIC_DETECTION_RETRY_TIMEOUT_MS;
+		const agent = await initializeAgent({
+			emit: createUiReducer(getUI()),
+			workingDirectory: cwd,
+			posthogMcpUrl: host.mcpUrl,
+			posthogApiKey: accessToken,
+			host,
+			detectPackageManager: detectNodePackageManagers,
+			skillsBaseUrl: getSkillsBaseUrl(),
+			programId,
+			integrationLabel: "agentic-detect",
+			wizardMetadata,
+			allowedTools: [
+				"Read",
+				"Grep",
+				"Glob"
+			],
+			modelOverride: HAIKU_MODEL
+		}, runOptions);
+		const MAX_TRANSCRIPT_CHARS = 256 * 1024;
+		const collected = [];
+		let collectedChars = 0;
+		const collect = (text) => {
+			collected.push(text);
+			collectedChars += text.length;
+			while (collectedChars > MAX_TRANSCRIPT_CHARS && collected.length > 1) collectedChars -= collected.shift().length;
+		};
+		let resultText = "";
+		const result = await runAgent(agent, prompt, runOptions, NOOP_SPINNER, {
+			spinnerMessage: "Scanning the repo...",
+			successMessage: "Detection complete",
+			errorMessage: "Detection failed",
+			requestRemark: false,
+			timeoutMs
+		}, {
+			onMessage: (message) => {
+				if (message?.type === "assistant") {
+					for (const block of message.message?.content ?? []) if (block?.type === "text" && typeof block.text === "string") {
+						collect(block.text);
+						const line = block.text.trim();
+						if (line && onEvent) onEvent(line.length > 100 ? `${line.slice(0, 100)}…` : line);
+					} else if (block?.type === "tool_use") onEvent?.(formatToolUse(block));
+				} else if (message?.type === "result" && typeof message.result === "string") resultText = message.result;
+			},
+			finalize: (_resultMessage, _durationMs) => void 0
+		});
+		if (result.kind === "failure" && result.classification === "WIZARD_AGENTIC_DETECTION_TIMEOUT") {
+			if (attempt === 0) {
+				onEvent?.("Project scan timed out; retrying...");
+				continue;
+			}
+			throw new AgenticDetectionTimeoutError(attempt + 1, timeoutMs);
+		}
+		if (result.kind !== "success") {
+			if (result.kind === "decided_failure") throw result.failure.error ?? new Error(result.failure.message);
+			throw result.error ?? new Error(result.message || `Agent error: ${result.classification}`);
+		}
+		const output = `${collected.join("\n")}\n${resultText}`;
+		const derived = deriveReportJson(output);
+		if (derived !== null) return coerceAgenticReport(derived, targets.map((t) => t.id), {
+			recommend,
+			rerankIds
+		});
+		if (output.includes(AgentSignals.ABORT)) return {
+			repoType: "single",
+			projects: []
+		};
+		if (attempt === 0) onEvent?.("Retrying project scan...");
+	}
+	throw new Error("Agent did not return a JSON object after retry");
+}
+//#endregion
+//#region src/lib/warehouse-sources/registry.ts
+const CORE_SOURCE_DETECTORS = [
+	{
+		kind: "Postgres",
+		label: "PostgreSQL",
+		mode: "in-cli",
+		signals: {
+			npm: [
+				"pg",
+				"postgres",
+				"postgres.js",
+				"knex",
+				"sequelize"
+			],
+			python: [
+				"psycopg",
+				"psycopg2",
+				"psycopg2-binary",
+				"asyncpg"
+			],
+			ruby: ["pg"],
+			envKeys: [
+				/^DATABASE_URL$/,
+				/^POSTGRES_/,
+				/^PG(HOST|DATABASE|USER|PORT)$/
+			]
+		},
+		supersededBy: ["Neon", "Supabase"]
+	},
+	{
+		kind: "MySQL",
+		label: "MySQL",
+		mode: "in-cli",
+		signals: {
+			npm: ["mysql", "mysql2"],
+			python: [
+				"pymysql",
+				"mysqlclient",
+				"mysql-connector-python"
+			],
+			ruby: ["mysql2"],
+			envKeys: [/^MYSQL_/]
+		}
+	},
+	{
+		kind: "MongoDB",
+		label: "MongoDB",
+		mode: "in-cli",
+		signals: {
+			npm: ["mongodb", "mongoose"],
+			python: ["pymongo", "motor"],
+			ruby: ["mongo", "mongoid"],
+			envKeys: [/^MONGO(DB)?_/]
+		}
+	},
+	{
+		kind: "Snowflake",
+		label: "Snowflake",
+		mode: "in-cli",
+		signals: {
+			npm: ["snowflake-sdk"],
+			python: ["snowflake-connector-python", "snowflake-sqlalchemy"],
+			envKeys: [/^SNOWFLAKE_/]
+		}
+	},
+	{
+		kind: "BigQuery",
+		label: "BigQuery",
+		mode: "deep-link",
+		signals: {
+			npm: ["@google-cloud/bigquery"],
+			python: ["google-cloud-bigquery"],
+			envKeys: [/^BIGQUERY_/]
+		}
+	},
+	{
+		kind: "Redshift",
+		label: "Redshift",
+		mode: "in-cli",
+		signals: {
+			npm: ["node-redshift"],
+			python: ["redshift-connector"],
+			envKeys: [/^REDSHIFT_/]
+		}
+	},
+	{
+		kind: "MSSQL",
+		label: "SQL Server",
+		mode: "in-cli",
+		signals: {
+			npm: ["mssql", "tedious"],
+			python: ["pyodbc", "pymssql"],
+			envKeys: [/^MSSQL_/]
+		}
+	},
+	{
+		kind: "Supabase",
+		label: "Supabase",
+		mode: "in-cli",
+		signals: {
+			npm: ["@supabase/supabase-js"],
+			python: ["supabase"],
+			envKeys: [/^SUPABASE_/]
+		}
+	},
+	{
+		kind: "ClickHouse",
+		label: "ClickHouse",
+		mode: "in-cli",
+		signals: {
+			npm: ["@clickhouse/client"],
+			python: ["clickhouse-connect", "clickhouse-driver"],
+			envKeys: [/^CLICKHOUSE_/]
+		}
+	},
+	{
+		kind: "Convex",
+		label: "Convex",
+		mode: "in-cli",
+		signals: {
+			npm: ["convex"],
+			python: ["convex"],
+			envKeys: [/^CONVEX_/, /^NEXT_PUBLIC_CONVEX_URL$/]
+		}
+	},
+	{
+		kind: "Firebase",
+		label: "Firebase",
+		mode: "deep-link",
+		signals: {
+			npm: ["firebase-admin", "firebase"],
+			python: ["firebase-admin"],
+			envKeys: [/^FIREBASE_/, /^NEXT_PUBLIC_FIREBASE_/]
+		}
+	},
+	{
+		kind: "Neon",
+		label: "Neon",
+		mode: "in-cli",
+		signals: {
+			npm: ["@neondatabase/serverless"],
+			envKeys: [/^NEON_/]
+		}
+	},
+	{
+		kind: "PlanetScaleMySQL",
+		label: "PlanetScale MySQL",
+		mode: "in-cli",
+		signals: {
+			npm: ["@planetscale/database"],
+			envKeys: [/^PLANETSCALE_/]
+		}
+	},
+	{
+		kind: "DynamoDB",
+		label: "DynamoDB",
+		mode: "in-cli",
+		signals: {
+			npm: ["@aws-sdk/client-dynamodb", "@aws-sdk/lib-dynamodb"],
+			python: ["pynamodb"]
+		}
+	},
+	{
+		kind: "Motherduck",
+		label: "MotherDuck",
+		mode: "in-cli",
+		signals: {
+			npm: ["@motherduck/wasm-client"],
+			envKeys: [/^MOTHERDUCK_/]
+		}
+	},
+	{
+		kind: "Databricks",
+		label: "Databricks",
+		mode: "in-cli",
+		signals: {
+			npm: ["@databricks/sql"],
+			python: ["databricks-sql-connector", "databricks-sdk"],
+			envKeys: [/^DATABRICKS_/]
+		}
+	},
+	{
+		kind: "Singlestore",
+		label: "SingleStore",
+		mode: "in-cli",
+		signals: {
+			python: ["singlestoredb"],
+			envKeys: [/^SINGLESTORE_/]
+		}
+	},
+	{
+		kind: "Stripe",
+		label: "Stripe",
+		mode: "in-cli",
+		signals: {
+			npm: [
+				"stripe",
+				"@stripe/stripe-js",
+				"@stripe/react-stripe-js"
+			],
+			python: ["stripe"],
+			ruby: ["stripe"],
+			envKeys: [/^STRIPE_(SECRET|API)_KEY$/]
+		}
+	},
+	{
+		kind: "Clerk",
+		label: "Clerk",
+		mode: "in-cli",
+		signals: {
+			npm: [
+				"@clerk/nextjs",
+				"@clerk/clerk-react",
+				"@clerk/backend",
+				"@clerk/express",
+				"@clerk/fastify",
+				"@clerk/remix"
+			],
+			envKeys: [/^CLERK_SECRET_KEY$/, /^NEXT_PUBLIC_CLERK_/]
+		}
+	},
+	{
+		kind: "Resend",
+		label: "Resend",
+		mode: "in-cli",
+		signals: {
+			npm: ["resend"],
+			python: ["resend"],
+			envKeys: [/^RESEND_API_KEY$/]
+		}
+	},
+	{
+		kind: "Shopify",
+		label: "Shopify",
+		mode: "in-cli",
+		signals: {
+			npm: ["@shopify/shopify-api", "shopify-api-node"],
+			python: ["shopifyapi"],
+			envKeys: [/^SHOPIFY_/]
+		}
+	},
+	{
+		kind: "Klaviyo",
+		label: "Klaviyo",
+		mode: "in-cli",
+		signals: {
+			npm: ["klaviyo-api"],
+			python: ["klaviyo-api"],
+			envKeys: [/^KLAVIYO_/]
+		}
+	},
+	{
+		kind: "Chargebee",
+		label: "Chargebee",
+		mode: "in-cli",
+		signals: {
+			npm: ["chargebee"],
+			python: ["chargebee"],
+			envKeys: [/^CHARGEBEE_/]
+		}
+	},
+	{
+		kind: "Paddle",
+		label: "Paddle",
+		mode: "in-cli",
+		signals: {
+			npm: ["@paddle/paddle-node-sdk", "@paddle/paddle-js"],
+			envKeys: [/^PADDLE_/]
+		}
+	},
+	{
+		kind: "Polar",
+		label: "Polar",
+		mode: "in-cli",
+		signals: {
+			npm: ["@polar-sh/sdk", "@polar-sh/nextjs"],
+			envKeys: [/^POLAR_/]
+		}
+	},
+	{
+		kind: "Mailchimp",
+		label: "Mailchimp",
+		mode: "in-cli",
+		signals: {
+			npm: ["@mailchimp/mailchimp_marketing"],
+			python: ["mailchimp-marketing"],
+			envKeys: [/^MAILCHIMP_/]
+		}
+	},
+	{
+		kind: "CustomerIO",
+		label: "Customer.io",
+		mode: "in-cli",
+		signals: {
+			npm: ["customerio-node"],
+			python: ["customerio"],
+			envKeys: [/^CUSTOMER_?IO_/]
+		}
+	},
+	{
+		kind: "Typeform",
+		label: "Typeform",
+		mode: "in-cli",
+		signals: {
+			npm: ["@typeform/api-client"],
+			envKeys: [/^TYPEFORM_/]
+		}
+	},
+	{
+		kind: "Sentry",
+		label: "Sentry",
+		mode: "in-cli",
+		signals: {
+			npm: [
+				"@sentry/node",
+				"@sentry/browser",
+				"@sentry/react",
+				"@sentry/nextjs"
+			],
+			python: ["sentry-sdk"],
+			ruby: ["sentry-ruby"]
+		}
+	},
+	{
+		kind: "Plaid",
+		label: "Plaid",
+		mode: "in-cli",
+		signals: {
+			npm: ["plaid"],
+			python: ["plaid-python", "plaid"],
+			ruby: ["plaid"],
+			envKeys: [/^PLAID_/]
+		}
+	},
+	{
+		kind: "Braintree",
+		label: "Braintree",
+		mode: "in-cli",
+		signals: {
+			npm: ["braintree"],
+			python: ["braintree"],
+			ruby: ["braintree"],
+			envKeys: [/^BRAINTREE_/]
+		}
+	},
+	{
+		kind: "Square",
+		label: "Square",
+		mode: "in-cli",
+		signals: {
+			npm: ["square"],
+			python: ["squareup"],
+			ruby: ["square"],
+			envKeys: [/^SQUARE_/]
+		}
+	},
+	{
+		kind: "GoCardless",
+		label: "GoCardless",
+		mode: "in-cli",
+		signals: {
+			npm: ["gocardless-nodejs"],
+			python: ["gocardless-pro"],
+			ruby: ["gocardless_pro"],
+			envKeys: [/^GOCARDLESS_/]
+		}
+	},
+	{
+		kind: "Mollie",
+		label: "Mollie",
+		mode: "in-cli",
+		signals: {
+			npm: ["@mollie/api-client"],
+			python: ["mollie-api-python"],
+			envKeys: [/^MOLLIE_/]
+		}
+	},
+	{
+		kind: "CheckoutCom",
+		label: "Checkout.com",
+		mode: "in-cli",
+		signals: {
+			npm: ["checkout-sdk-node"],
+			python: ["checkout-sdk"],
+			envKeys: [/^CKO_/, /^CHECKOUT_COM_/]
+		}
+	},
+	{
+		kind: "Recurly",
+		label: "Recurly",
+		mode: "in-cli",
+		signals: {
+			npm: ["recurly"],
+			python: ["recurly"],
+			ruby: ["recurly"],
+			envKeys: [/^RECURLY_/]
+		}
+	},
+	{
+		kind: "RevenueCat",
+		label: "RevenueCat",
+		mode: "in-cli",
+		signals: {
+			npm: [
+				"@revenuecat/purchases-js",
+				"react-native-purchases",
+				"@revenuecat/purchases-capacitor"
+			],
+			envKeys: [/^REVENUE_?CAT_/]
+		}
+	},
+	{
+		kind: "Twilio",
+		label: "Twilio",
+		mode: "in-cli",
+		signals: {
+			npm: ["twilio"],
+			python: ["twilio"],
+			ruby: ["twilio-ruby"],
+			envKeys: [/^TWILIO_/]
+		}
+	},
+	{
+		kind: "SendGrid",
+		label: "SendGrid",
+		mode: "in-cli",
+		signals: {
+			npm: ["@sendgrid/mail", "@sendgrid/client"],
+			python: ["sendgrid"],
+			ruby: ["sendgrid-ruby"],
+			envKeys: [/^SENDGRID_/]
+		}
+	},
+	{
+		kind: "Mailgun",
+		label: "Mailgun",
+		mode: "in-cli",
+		signals: {
+			npm: ["mailgun.js", "mailgun-js"],
+			python: ["mailgun"],
+			ruby: ["mailgun-ruby"],
+			envKeys: [/^MAILGUN_/]
+		}
+	},
+	{
+		kind: "Postmark",
+		label: "Postmark",
+		mode: "in-cli",
+		signals: {
+			npm: ["postmark"],
+			python: ["postmarker"],
+			ruby: ["postmark"],
+			envKeys: [/^POSTMARK_/]
+		}
+	},
+	{
+		kind: "Brevo",
+		label: "Brevo",
+		mode: "in-cli",
+		signals: {
+			npm: ["@getbrevo/brevo", "sib-api-v3-sdk"],
+			python: ["sib-api-v3-sdk"],
+			envKeys: [/^BREVO_/]
+		}
+	},
+	{
+		kind: "MailerLite",
+		label: "MailerLite",
+		mode: "in-cli",
+		signals: {
+			npm: ["@mailerlite/mailerlite-nodejs"],
+			python: ["mailerlite"],
+			envKeys: [/^MAILERLITE_/]
+		}
+	},
+	{
+		kind: "Mailjet",
+		label: "Mailjet",
+		mode: "in-cli",
+		signals: {
+			npm: ["node-mailjet"],
+			python: ["mailjet-rest"],
+			envKeys: [/^MAILJET_/, /^MJ_APIKEY_/]
+		}
+	},
+	{
+		kind: "LaunchDarkly",
+		label: "LaunchDarkly",
+		mode: "in-cli",
+		signals: {
+			npm: [
+				"launchdarkly-node-server-sdk",
+				"@launchdarkly/node-server-sdk",
+				"launchdarkly-js-client-sdk",
+				"launchdarkly-react-client-sdk"
+			],
+			python: ["launchdarkly-server-sdk"],
+			ruby: ["launchdarkly-server-sdk"],
+			envKeys: [/^LAUNCHDARKLY_/, /^LD_SDK_KEY$/]
+		}
+	},
+	{
+		kind: "Optimizely",
+		label: "Optimizely",
+		mode: "in-cli",
+		signals: {
+			npm: ["@optimizely/optimizely-sdk"],
+			python: ["optimizely-sdk"],
+			envKeys: [/^OPTIMIZELY_/]
+		}
+	},
+	{
+		kind: "Braze",
+		label: "Braze",
+		mode: "in-cli",
+		signals: {
+			npm: ["@braze/web-sdk", "@braze/react-native-sdk"],
+			python: ["braze-client"],
+			envKeys: [/^BRAZE_/]
+		}
+	},
+	{
+		kind: "Rollbar",
+		label: "Rollbar",
+		mode: "in-cli",
+		signals: {
+			npm: ["rollbar"],
+			python: ["rollbar", "pyrollbar"],
+			ruby: ["rollbar"],
+			envKeys: [/^ROLLBAR_/]
+		}
+	},
+	{
+		kind: "Okta",
+		label: "Okta",
+		mode: "in-cli",
+		signals: {
+			npm: [
+				"@okta/okta-sdk-nodejs",
+				"@okta/okta-auth-js",
+				"@okta/okta-react"
+			],
+			python: ["okta"],
+			envKeys: [/^OKTA_/]
+		}
+	},
+	{
+		kind: "WorkOS",
+		label: "WorkOS",
+		mode: "in-cli",
+		signals: {
+			npm: ["@workos-inc/node"],
+			python: ["workos"],
+			envKeys: [/^WORKOS_/]
+		}
+	},
+	{
+		kind: "Notion",
+		label: "Notion",
+		mode: "in-cli",
+		signals: {
+			npm: ["@notionhq/client"],
+			python: ["notion-client"],
+			envKeys: [/^NOTION_/]
+		}
+	},
+	{
+		kind: "FullStory",
+		label: "FullStory",
+		mode: "in-cli",
+		signals: {
+			npm: ["@fullstory/browser", "@fullstory/react-native"],
+			envKeys: [/^FULLSTORY_/]
+		}
+	},
+	{
+		kind: "Amplitude",
+		label: "Amplitude",
+		mode: "in-cli",
+		signals: {
+			npm: [
+				"@amplitude/analytics-browser",
+				"@amplitude/analytics-node",
+				"@amplitude/analytics-react-native",
+				"amplitude-js"
+			],
+			python: ["amplitude-analytics"],
+			envKeys: [/^AMPLITUDE_/]
+		}
+	},
+	{
+		kind: "Mixpanel",
+		label: "Mixpanel",
+		mode: "in-cli",
+		signals: {
+			npm: ["mixpanel", "mixpanel-browser"],
+			python: ["mixpanel"],
+			ruby: ["mixpanel-ruby"],
+			envKeys: [/^MIXPANEL_/]
+		}
+	},
+	{
+		kind: "Pendo",
+		label: "Pendo",
+		mode: "in-cli",
+		signals: {
+			npm: ["@pendo/agent"],
+			envKeys: [/^PENDO_/]
+		}
+	},
+	{
+		kind: "Salesforce",
+		label: "Salesforce",
+		mode: "deep-link",
+		signals: {
+			npm: ["jsforce"],
+			python: ["simple-salesforce"],
+			envKeys: [/^SALESFORCE_/]
+		}
+	},
+	{
+		kind: "Hubspot",
+		label: "HubSpot",
+		mode: "deep-link",
+		signals: {
+			npm: ["@hubspot/api-client"],
+			python: ["hubspot-api-client"],
+			envKeys: [/^HUBSPOT_/]
+		}
+	},
+	{
+		kind: "Zendesk",
+		label: "Zendesk",
+		mode: "deep-link",
+		signals: {
+			npm: ["node-zendesk"],
+			python: ["zenpy"],
+			envKeys: [/^ZENDESK_/]
+		}
+	},
+	{
+		kind: "Intercom",
+		label: "Intercom",
+		mode: "deep-link",
+		signals: {
+			npm: ["intercom-client", "@intercom/messenger-js-sdk"],
+			python: ["python-intercom"],
+			envKeys: [/^INTERCOM_/]
+		}
+	},
+	{
+		kind: "Linear",
+		label: "Linear",
+		mode: "deep-link",
+		signals: {
+			npm: ["@linear/sdk"],
+			envKeys: [/^LINEAR_API_KEY$/]
+		}
+	},
+	{
+		kind: "Slack",
+		label: "Slack",
+		mode: "deep-link",
+		signals: {
+			npm: ["@slack/web-api", "@slack/bolt"],
+			python: ["slack-sdk", "slack-bolt"],
+			envKeys: [/^SLACK_(BOT|APP|SIGNING|CLIENT)_/]
+		}
+	},
+	{
+		kind: "Github",
+		label: "GitHub",
+		mode: "deep-link",
+		signals: {
+			npm: [
+				"@octokit/rest",
+				"@octokit/core",
+				"@octokit/graphql",
+				"octokit"
+			],
+			python: ["pygithub"],
+			ruby: ["octokit"]
+		}
+	}
+];
+const LLM_SOURCE_DETECTORS = [
+	{
+		kind: "OpenAI",
+		label: "OpenAI",
+		mode: "in-cli",
+		signals: {
+			npm: ["openai"],
+			python: ["openai"],
+			envKeys: [/^OPENAI_/]
+		}
+	},
+	{
+		kind: "Anthropic",
+		label: "Anthropic",
+		mode: "in-cli",
+		signals: {
+			npm: ["@anthropic-ai/sdk"],
+			python: ["anthropic"],
+			envKeys: [/^ANTHROPIC_/]
+		}
+	},
+	{
+		kind: "Cohere",
+		label: "Cohere",
+		mode: "in-cli",
+		signals: {
+			npm: ["cohere-ai"],
+			python: ["cohere"],
+			envKeys: [/^COHERE_/]
+		}
+	},
+	{
+		kind: "MistralAI",
+		label: "Mistral AI",
+		mode: "in-cli",
+		signals: {
+			npm: ["@mistralai/mistralai"],
+			python: ["mistralai"],
+			envKeys: [/^MISTRAL_/]
+		}
+	},
+	{
+		kind: "Groq",
+		label: "Groq",
+		mode: "in-cli",
+		signals: {
+			npm: ["groq-sdk"],
+			python: ["groq"],
+			envKeys: [/^GROQ_/]
+		}
+	},
+	{
+		kind: "TogetherAI",
+		label: "Together AI",
+		mode: "in-cli",
+		signals: {
+			npm: ["together-ai"],
+			python: ["together"],
+			envKeys: [/^TOGETHER_/]
+		}
+	},
+	{
+		kind: "FireworksAI",
+		label: "Fireworks AI",
+		mode: "in-cli",
+		signals: {
+			python: ["fireworks-ai"],
+			envKeys: [/^FIREWORKS_/]
+		}
+	},
+	{
+		kind: "Replicate",
+		label: "Replicate",
+		mode: "in-cli",
+		signals: {
+			npm: ["replicate"],
+			python: ["replicate"],
+			envKeys: [/^REPLICATE_/]
+		}
+	},
+	{
+		kind: "HuggingFace",
+		label: "Hugging Face",
+		mode: "in-cli",
+		signals: {
+			npm: ["@huggingface/inference"],
+			python: ["huggingface-hub"],
+			envKeys: [/^HUGGINGFACE_/, /^HF_TOKEN$/]
+		}
+	},
+	{
+		kind: "ElevenLabs",
+		label: "ElevenLabs",
+		mode: "in-cli",
+		signals: {
+			npm: ["@elevenlabs/elevenlabs-js", "elevenlabs"],
+			python: ["elevenlabs"],
+			envKeys: [/^ELEVENLABS_/, /^ELEVEN_LABS_/]
+		}
+	},
+	{
+		kind: "Deepgram",
+		label: "Deepgram",
+		mode: "in-cli",
+		signals: {
+			npm: ["@deepgram/sdk"],
+			python: ["deepgram-sdk"],
+			envKeys: [/^DEEPGRAM_/]
+		}
+	},
+	{
+		kind: "AssemblyAI",
+		label: "AssemblyAI",
+		mode: "in-cli",
+		signals: {
+			npm: ["assemblyai"],
+			python: ["assemblyai"],
+			envKeys: [/^ASSEMBLYAI_/]
+		}
+	},
+	{
+		kind: "Langfuse",
+		label: "Langfuse",
+		mode: "in-cli",
+		signals: {
+			npm: ["langfuse"],
+			python: ["langfuse"],
+			envKeys: [/^LANGFUSE_/]
+		}
+	},
+	{
+		kind: "LangSmith",
+		label: "LangSmith",
+		mode: "in-cli",
+		signals: {
+			npm: ["langsmith"],
+			python: ["langsmith"],
+			envKeys: [/^LANGSMITH_/, /^LANGCHAIN_API_KEY$/]
+		}
+	},
+	{
+		kind: "Firecrawl",
+		label: "Firecrawl",
+		mode: "in-cli",
+		signals: {
+			npm: ["@mendable/firecrawl-js"],
+			python: ["firecrawl-py"],
+			envKeys: [/^FIRECRAWL_/]
+		}
+	},
+	{
+		kind: "Mem0",
+		label: "Mem0",
+		mode: "in-cli",
+		signals: {
+			npm: ["mem0ai"],
+			python: ["mem0ai"],
+			envKeys: [/^MEM0_/]
+		}
+	},
+	{
+		kind: "Vellum",
+		label: "Vellum",
+		mode: "in-cli",
+		signals: {
+			npm: ["vellum-ai"],
+			python: ["vellum-ai"],
+			envKeys: [/^VELLUM_/]
+		}
+	},
+	{
+		kind: "Helicone",
+		label: "Helicone",
+		mode: "in-cli",
+		signals: {
+			npm: ["@helicone/helpers"],
+			envKeys: [/^HELICONE_/]
+		}
+	},
+	{
+		kind: "OpenRouter",
+		label: "OpenRouter",
+		mode: "in-cli",
+		signals: {
+			npm: ["@openrouter/ai-sdk-provider"],
+			envKeys: [/^OPENROUTER_/]
+		}
+	},
+	{
+		kind: "Browserbase",
+		label: "Browserbase",
+		mode: "in-cli",
+		signals: {
+			npm: ["@browserbasehq/sdk", "@browserbasehq/stagehand"],
+			python: ["browserbase"],
+			envKeys: [/^BROWSERBASE_/]
+		}
+	},
+	{
+		kind: "E2B",
+		label: "E2B",
+		mode: "in-cli",
+		signals: {
+			npm: ["e2b", "@e2b/code-interpreter"],
+			python: ["e2b", "e2b-code-interpreter"],
+			envKeys: [/^E2B_/]
+		}
+	},
+	{
+		kind: "WeightsAndBiases",
+		label: "Weights & Biases",
+		mode: "in-cli",
+		signals: {
+			python: ["wandb"],
+			envKeys: [/^WANDB_/]
+		}
+	},
+	{
+		kind: "LlamaCloud",
+		label: "LlamaCloud",
+		mode: "in-cli",
+		signals: {
+			npm: ["llama-cloud-services"],
+			python: ["llama-cloud-services"],
+			envKeys: [/^LLAMA_CLOUD_/]
+		}
+	},
+	{
+		kind: "Zep",
+		label: "Zep",
+		mode: "in-cli",
+		signals: {
+			npm: ["@getzep/zep-cloud"],
+			python: ["zep-cloud"],
+			envKeys: [/^ZEP_API_KEY$/]
+		}
+	}
+];
+const OTHER_SOURCE_DETECTORS = [
+	{
+		kind: "Paystack",
+		label: "Paystack",
+		mode: "in-cli",
+		signals: {
+			python: ["paystackapi"],
+			envKeys: [/^PAYSTACK_/]
+		}
+	},
+	{
+		kind: "Orb",
+		label: "Orb",
+		mode: "in-cli",
+		signals: {
+			npm: ["orb-billing"],
+			python: ["orb-billing"],
+			envKeys: [/^ORB_/]
+		}
+	},
+	{
+		kind: "Lago",
+		label: "Lago",
+		mode: "in-cli",
+		signals: {
+			npm: ["lago-javascript-client"],
+			python: ["lago-python-client"],
+			envKeys: [/^LAGO_/]
+		}
+	},
+	{
+		kind: "Zuora",
+		label: "Zuora",
+		mode: "in-cli",
+		signals: { envKeys: [/^ZUORA_/] }
+	},
+	{
+		kind: "Stigg",
+		label: "Stigg",
+		mode: "in-cli",
+		signals: {
+			npm: ["@stigg/node-server-sdk"],
+			envKeys: [/^STIGG_/]
+		}
+	},
+	{
+		kind: "Ramp",
+		label: "Ramp",
+		mode: "in-cli",
+		signals: { envKeys: [/^RAMP_/] }
+	},
+	{
+		kind: "Brex",
+		label: "Brex",
+		mode: "in-cli",
+		signals: { envKeys: [/^BREX_/] }
+	},
+	{
+		kind: "Tremendous",
+		label: "Tremendous",
+		mode: "in-cli",
+		signals: { envKeys: [/^TREMENDOUS_/] }
+	},
+	{
+		kind: "Maxio",
+		label: "Maxio",
+		mode: "in-cli",
+		signals: { envKeys: [/^MAXIO_/] }
+	},
+	{
+		kind: "Chargify",
+		label: "Chargify",
+		mode: "in-cli",
+		signals: { envKeys: [/^CHARGIFY_/] }
+	},
+	{
+		kind: "Invoiced",
+		label: "Invoiced",
+		mode: "in-cli",
+		signals: {
+			npm: ["invoiced"],
+			python: ["invoiced"],
+			envKeys: [/^INVOICED_/]
+		}
+	},
+	{
+		kind: "LemonSqueezy",
+		label: "Lemon Squeezy",
+		mode: "in-cli",
+		signals: {
+			npm: ["@lemonsqueezy/lemonsqueezy.js"],
+			envKeys: [/^LEMONSQUEEZY_/, /^LEMON_SQUEEZY_/]
+		}
+	},
+	{
+		kind: "Razorpay",
+		label: "Razorpay",
+		mode: "in-cli",
+		signals: {
+			npm: ["razorpay"],
+			python: ["razorpay"],
+			ruby: ["razorpay"],
+			envKeys: [/^RAZORPAY_/]
+		}
+	},
+	{
+		kind: "Adyen",
+		label: "Adyen",
+		mode: "in-cli",
+		signals: {
+			npm: ["@adyen/api-library"],
+			python: ["adyen"],
+			envKeys: [/^ADYEN_/]
+		}
+	},
+	{
+		kind: "ChartMogul",
+		label: "ChartMogul",
+		mode: "in-cli",
+		signals: {
+			npm: ["chartmogul-node"],
+			python: ["chartmogul"],
+			envKeys: [/^CHARTMOGUL_/]
+		}
+	},
+	{
+		kind: "Airwallex",
+		label: "Airwallex",
+		mode: "in-cli",
+		signals: {
+			npm: ["airwallex-payment-elements"],
+			envKeys: [/^AIRWALLEX_/]
+		}
+	},
+	{
+		kind: "Flutterwave",
+		label: "Flutterwave",
+		mode: "in-cli",
+		signals: {
+			npm: ["flutterwave-node-v3"],
+			python: ["flutterwave"],
+			envKeys: [/^FLUTTERWAVE_/, /^FLW_(PUBLIC|SECRET)_KEY$/]
+		}
+	},
+	{
+		kind: "DodoPayments",
+		label: "Dodo Payments",
+		mode: "in-cli",
+		signals: {
+			npm: ["dodopayments"],
+			python: ["dodopayments"],
+			envKeys: [/^DODO_PAYMENTS_/]
+		}
+	},
+	{
+		kind: "Whop",
+		label: "Whop",
+		mode: "in-cli",
+		signals: {
+			npm: ["@whop/api", "@whop-apps/sdk"],
+			envKeys: [/^WHOP_/]
+		}
+	},
+	{
+		kind: "SparkPost",
+		label: "SparkPost",
+		mode: "in-cli",
+		signals: {
+			npm: ["sparkpost"],
+			python: ["sparkpost"],
+			envKeys: [/^SPARKPOST_/]
+		}
+	},
+	{
+		kind: "MailerSend",
+		label: "MailerSend",
+		mode: "in-cli",
+		signals: {
+			npm: ["mailersend"],
+			python: ["mailersend"],
+			envKeys: [/^MAILERSEND_/]
+		}
+	},
+	{
+		kind: "Iterable",
+		label: "Iterable",
+		mode: "in-cli",
+		signals: { envKeys: [/^ITERABLE_/] }
+	},
+	{
+		kind: "ConvertKit",
+		label: "ConvertKit",
+		mode: "in-cli",
+		signals: { envKeys: [/^CONVERTKIT_/] }
+	},
+	{
+		kind: "Drip",
+		label: "Drip",
+		mode: "in-cli",
+		signals: {
+			npm: ["drip-nodejs"],
+			envKeys: [/^DRIP_/]
+		}
+	},
+	{
+		kind: "Omnisend",
+		label: "Omnisend",
+		mode: "in-cli",
+		signals: { envKeys: [/^OMNISEND_/] }
+	},
+	{
+		kind: "EmailOctopus",
+		label: "EmailOctopus",
+		mode: "in-cli",
+		signals: { envKeys: [/^EMAILOCTOPUS_/, /^EMAIL_OCTOPUS_/] }
+	},
+	{
+		kind: "Elasticemail",
+		label: "Elastic Email",
+		mode: "in-cli",
+		signals: { envKeys: [/^ELASTICEMAIL_/, /^ELASTIC_EMAIL_/] }
+	},
+	{
+		kind: "CampaignMonitor",
+		label: "Campaign Monitor",
+		mode: "in-cli",
+		signals: {
+			npm: ["createsend-node"],
+			envKeys: [/^CAMPAIGN_MONITOR_/, /^CREATESEND_/]
+		}
+	},
+	{
+		kind: "Lemlist",
+		label: "Lemlist",
+		mode: "in-cli",
+		signals: { envKeys: [/^LEMLIST_/] }
+	},
+	{
+		kind: "Loops",
+		label: "Loops",
+		mode: "in-cli",
+		signals: {
+			npm: ["loops"],
+			envKeys: [/^LOOPS_/]
+		}
+	},
+	{
+		kind: "Knock",
+		label: "Knock",
+		mode: "in-cli",
+		signals: {
+			npm: ["@knocklabs/node", "@knocklabs/client"],
+			python: ["knockapi"],
+			envKeys: [/^KNOCK_/]
+		}
+	},
+	{
+		kind: "AwsSes",
+		label: "Amazon SES",
+		mode: "in-cli",
+		signals: {
+			npm: ["@aws-sdk/client-ses", "@aws-sdk/client-sesv2"],
+			envKeys: [/^AWS_SES_/]
+		}
+	},
+	{
+		kind: "Beehiiv",
+		label: "beehiiv",
+		mode: "in-cli",
+		signals: { envKeys: [/^BEEHIIV_/] }
+	},
+	{
+		kind: "Mailtrap",
+		label: "Mailtrap",
+		mode: "in-cli",
+		signals: {
+			npm: ["mailtrap"],
+			python: ["mailtrap"],
+			envKeys: [/^MAILTRAP_/]
+		}
+	},
+	{
+		kind: "Plunk",
+		label: "Plunk",
+		mode: "in-cli",
+		signals: {
+			npm: ["@plunk/node"],
+			envKeys: [/^PLUNK_/]
+		}
+	},
+	{
+		kind: "Ortto",
+		label: "Ortto",
+		mode: "in-cli",
+		signals: { envKeys: [/^ORTTO_/] }
+	},
+	{
+		kind: "Postscript",
+		label: "Postscript",
+		mode: "in-cli",
+		signals: { envKeys: [/^POSTSCRIPT_/] }
+	},
+	{
+		kind: "Marketo",
+		label: "Marketo",
+		mode: "in-cli",
+		signals: {
+			python: ["marketorestpython"],
+			envKeys: [/^MARKETO_/]
+		}
+	},
+	{
+		kind: "Lob",
+		label: "Lob",
+		mode: "in-cli",
+		signals: {
+			npm: ["lob"],
+			python: ["lob"],
+			envKeys: [/^LOB_API_KEY$/]
+		}
+	},
+	{
+		kind: "Segment",
+		label: "Segment",
+		mode: "in-cli",
+		signals: {
+			npm: ["@segment/analytics-node", "analytics-node"],
+			python: ["segment-analytics-python", "analytics-python"],
+			envKeys: [/^SEGMENT_/]
+		}
+	},
+	{
+		kind: "Snowplow",
+		label: "Snowplow Analytics",
+		mode: "in-cli",
+		signals: {
+			npm: ["@snowplow/node-tracker"],
+			python: ["snowplow-tracker"],
+			envKeys: [/^SNOWPLOW_/]
+		}
+	},
+	{
+		kind: "Matomo",
+		label: "Matomo",
+		mode: "in-cli",
+		signals: {
+			npm: ["matomo-tracker"],
+			envKeys: [/^MATOMO_/]
+		}
+	},
+	{
+		kind: "Plausible",
+		label: "Plausible",
+		mode: "in-cli",
+		signals: {
+			npm: ["plausible-tracker"],
+			envKeys: [/^PLAUSIBLE_/]
+		}
+	},
+	{
+		kind: "ConfigCat",
+		label: "ConfigCat",
+		mode: "in-cli",
+		signals: {
+			npm: ["configcat-node", "configcat-js"],
+			python: ["configcat-client"],
+			envKeys: [/^CONFIGCAT_/]
+		}
+	},
+	{
+		kind: "Flagsmith",
+		label: "Flagsmith",
+		mode: "in-cli",
+		signals: {
+			npm: ["flagsmith-nodejs", "flagsmith"],
+			python: ["flagsmith"],
+			envKeys: [/^FLAGSMITH_/]
+		}
+	},
+	{
+		kind: "Unleash",
+		label: "Unleash",
+		mode: "in-cli",
+		signals: {
+			npm: ["unleash-client"],
+			python: ["unleashclient"],
+			envKeys: [/^UNLEASH_/]
+		}
+	},
+	{
+		kind: "SplitIo",
+		label: "Split.io",
+		mode: "in-cli",
+		signals: {
+			npm: ["@splitsoftware/splitio"],
+			python: ["splitio-client"],
+			envKeys: [/^SPLITIO_/, /^SPLIT_IO_/]
+		}
+	},
+	{
+		kind: "Stytch",
+		label: "Stytch",
+		mode: "in-cli",
+		signals: {
+			npm: ["stytch"],
+			python: ["stytch"],
+			envKeys: [/^STYTCH_/]
+		}
+	},
+	{
+		kind: "Doppler",
+		label: "Doppler",
+		mode: "in-cli",
+		signals: {
+			npm: ["@dopplerhq/node-sdk"],
+			envKeys: [/^DOPPLER_/]
+		}
+	},
+	{
+		kind: "Infisical",
+		label: "Infisical",
+		mode: "in-cli",
+		signals: {
+			npm: ["@infisical/sdk"],
+			python: ["infisicalsdk"],
+			envKeys: [/^INFISICAL_/]
+		}
+	},
+	{
+		kind: "OnePassword",
+		label: "1Password",
+		mode: "in-cli",
+		signals: {
+			npm: ["@1password/sdk"],
+			python: ["onepassword-sdk"],
+			envKeys: [/^ONEPASSWORD_/, /^OP_SERVICE_ACCOUNT_TOKEN$/]
+		}
+	},
+	{
+		kind: "Persona",
+		label: "Persona",
+		mode: "in-cli",
+		signals: { envKeys: [/^PERSONA_/] }
+	},
+	{
+		kind: "Svix",
+		label: "Svix",
+		mode: "in-cli",
+		signals: {
+			npm: ["svix"],
+			python: ["svix"],
+			envKeys: [/^SVIX_/]
+		}
+	},
+	{
+		kind: "Mux",
+		label: "Mux",
+		mode: "in-cli",
+		signals: {
+			npm: ["@mux/mux-node"],
+			python: ["mux-python"],
+			envKeys: [/^MUX_/]
+		}
+	},
+	{
+		kind: "Vapi",
+		label: "Vapi",
+		mode: "in-cli",
+		signals: {
+			npm: ["@vapi-ai/server-sdk"],
+			python: ["vapi-server-sdk"],
+			envKeys: [/^VAPI_/]
+		}
+	},
+	{
+		kind: "Aircall",
+		label: "Aircall",
+		mode: "in-cli",
+		signals: { envKeys: [/^AIRCALL_/] }
+	},
+	{
+		kind: "JustCall",
+		label: "JustCall",
+		mode: "in-cli",
+		signals: { envKeys: [/^JUSTCALL_/] }
+	},
+	{
+		kind: "Telnyx",
+		label: "Telnyx",
+		mode: "in-cli",
+		signals: {
+			npm: ["telnyx"],
+			python: ["telnyx"],
+			envKeys: [/^TELNYX_/]
+		}
+	},
+	{
+		kind: "Plivo",
+		label: "Plivo",
+		mode: "in-cli",
+		signals: {
+			npm: ["plivo"],
+			python: ["plivo"],
+			envKeys: [/^PLIVO_/]
+		}
+	},
+	{
+		kind: "Courier",
+		label: "Courier",
+		mode: "in-cli",
+		signals: {
+			npm: ["@trycourier/courier"],
+			python: ["trycourier"],
+			envKeys: [/^COURIER_AUTH_TOKEN$/]
+		}
+	},
+	{
+		kind: "WooCommerce",
+		label: "WooCommerce",
+		mode: "in-cli",
+		signals: {
+			npm: ["@woocommerce/woocommerce-rest-api"],
+			python: ["woocommerce"],
+			envKeys: [/^WOOCOMMERCE_/]
+		}
+	},
+	{
+		kind: "Recharge",
+		label: "Recharge",
+		mode: "in-cli",
+		signals: { envKeys: [/^RECHARGE_/] }
+	},
+	{
+		kind: "Commercetools",
+		label: "commercetools",
+		mode: "in-cli",
+		signals: {
+			npm: ["@commercetools/platform-sdk"],
+			python: ["commercetools"],
+			envKeys: [/^CTP_/, /^COMMERCETOOLS_/]
+		}
+	},
+	{
+		kind: "Webflow",
+		label: "Webflow",
+		mode: "in-cli",
+		signals: {
+			npm: ["webflow-api"],
+			envKeys: [/^WEBFLOW_/]
+		}
+	},
+	{
+		kind: "Easypost",
+		label: "EasyPost",
+		mode: "in-cli",
+		signals: {
+			npm: ["@easypost/api"],
+			python: ["easypost"],
+			envKeys: [/^EASYPOST_/]
+		}
+	},
+	{
+		kind: "Shippo",
+		label: "Shippo",
+		mode: "in-cli",
+		signals: {
+			npm: ["shippo"],
+			python: ["shippo"],
+			envKeys: [/^SHIPPO_/]
+		}
+	},
+	{
+		kind: "ShipStation",
+		label: "ShipStation",
+		mode: "in-cli",
+		signals: { envKeys: [/^SHIPSTATION_/] }
+	},
+	{
+		kind: "Squarespace",
+		label: "Squarespace",
+		mode: "in-cli",
+		signals: { envKeys: [/^SQUARESPACE_/] }
+	},
+	{
+		kind: "Printify",
+		label: "Printify",
+		mode: "in-cli",
+		signals: { envKeys: [/^PRINTIFY_/] }
+	},
+	{
+		kind: "BigCommerce",
+		label: "BigCommerce",
+		mode: "in-cli",
+		signals: {
+			npm: ["node-bigcommerce"],
+			envKeys: [/^BIGCOMMERCE_/]
+		}
+	},
+	{
+		kind: "Freshdesk",
+		label: "Freshdesk",
+		mode: "in-cli",
+		signals: {
+			python: ["python-freshdesk"],
+			envKeys: [/^FRESHDESK_/]
+		}
+	},
+	{
+		kind: "Front",
+		label: "Front",
+		mode: "in-cli",
+		signals: { envKeys: [/^FRONTAPP_/, /^FRONT_API_/] }
+	},
+	{
+		kind: "Gorgias",
+		label: "Gorgias",
+		mode: "in-cli",
+		signals: { envKeys: [/^GORGIAS_/] }
+	},
+	{
+		kind: "Chatwoot",
+		label: "Chatwoot",
+		mode: "in-cli",
+		signals: { envKeys: [/^CHATWOOT_/] }
+	},
+	{
+		kind: "Kustomer",
+		label: "Kustomer",
+		mode: "in-cli",
+		signals: { envKeys: [/^KUSTOMER_/] }
+	},
+	{
+		kind: "Plain",
+		label: "Plain",
+		mode: "in-cli",
+		signals: {
+			npm: ["@team-plain/typescript-sdk"],
+			envKeys: [/^PLAIN_/]
+		}
+	},
+	{
+		kind: "Canny",
+		label: "Canny",
+		mode: "in-cli",
+		signals: { envKeys: [/^CANNY_/] }
+	},
+	{
+		kind: "Pylon",
+		label: "Pylon",
+		mode: "in-cli",
+		signals: { envKeys: [/^PYLON_/] }
+	},
+	{
+		kind: "GitLab",
+		label: "GitLab",
+		mode: "in-cli",
+		signals: {
+			npm: ["@gitbeaker/rest"],
+			python: ["python-gitlab"],
+			ruby: ["gitlab"],
+			envKeys: [/^GITLAB_/]
+		}
+	},
+	{
+		kind: "Bitbucket",
+		label: "Atlassian Bitbucket Cloud",
+		mode: "in-cli",
+		signals: {
+			npm: ["bitbucket"],
+			envKeys: [/^BITBUCKET_/]
+		}
+	},
+	{
+		kind: "Gitea",
+		label: "Gitea",
+		mode: "in-cli",
+		signals: {
+			npm: ["gitea-js"],
+			envKeys: [/^GITEA_/]
+		}
+	},
+	{
+		kind: "Datadog",
+		label: "Datadog",
+		mode: "in-cli",
+		signals: {
+			npm: ["@datadog/datadog-api-client", "dd-trace"],
+			python: ["datadog", "datadog-api-client"],
+			ruby: ["dogapi"],
+			envKeys: [
+				/^DATADOG_/,
+				/^DD_API_KEY$/,
+				/^DD_APP_KEY$/
+			]
+		}
+	},
+	{
+		kind: "NewRelic",
+		label: "New Relic",
+		mode: "in-cli",
+		signals: {
+			npm: ["newrelic"],
+			python: ["newrelic"],
+			ruby: ["newrelic_rpm"],
+			envKeys: [/^NEW_RELIC_/, /^NEWRELIC_/]
+		}
+	},
+	{
+		kind: "Cloudflare",
+		label: "Cloudflare",
+		mode: "in-cli",
+		signals: {
+			npm: ["cloudflare"],
+			python: ["cloudflare"],
+			envKeys: [/^CLOUDFLARE_/, /^CF_API_TOKEN$/]
+		}
+	},
+	{
+		kind: "Elasticsearch",
+		label: "Elasticsearch",
+		mode: "in-cli",
+		signals: {
+			npm: ["@elastic/elasticsearch"],
+			python: ["elasticsearch"],
+			ruby: ["elasticsearch"],
+			envKeys: [/^ELASTICSEARCH_/]
+		}
+	},
+	{
+		kind: "Snyk",
+		label: "Snyk",
+		mode: "in-cli",
+		signals: {
+			npm: ["snyk"],
+			python: ["pysnyk"],
+			envKeys: [/^SNYK_/]
+		}
+	},
+	{
+		kind: "PagerDuty",
+		label: "PagerDuty",
+		mode: "in-cli",
+		signals: {
+			npm: ["@pagerduty/pdjs"],
+			python: ["pdpyras"],
+			envKeys: [/^PAGERDUTY_/, /^PD_API_KEY$/]
+		}
+	},
+	{
+		kind: "Opsgenie",
+		label: "Opsgenie",
+		mode: "in-cli",
+		signals: { envKeys: [/^OPSGENIE_/] }
+	},
+	{
+		kind: "IncidentIo",
+		label: "incident.io",
+		mode: "in-cli",
+		signals: { envKeys: [/^INCIDENT_IO_/, /^INCIDENTIO_/] }
+	},
+	{
+		kind: "Bugsnag",
+		label: "Bugsnag",
+		mode: "in-cli",
+		signals: {
+			npm: ["@bugsnag/js"],
+			python: ["bugsnag"],
+			ruby: ["bugsnag"],
+			envKeys: [/^BUGSNAG_/]
+		}
+	},
+	{
+		kind: "Honeybadger",
+		label: "Honeybadger",
+		mode: "in-cli",
+		signals: {
+			npm: ["@honeybadger-io/js"],
+			python: ["honeybadger"],
+			ruby: ["honeybadger"],
+			envKeys: [/^HONEYBADGER_/]
+		}
+	},
+	{
+		kind: "Raygun",
+		label: "Raygun",
+		mode: "in-cli",
+		signals: {
+			npm: ["raygun"],
+			python: ["raygun4py"],
+			ruby: ["raygun4ruby"],
+			envKeys: [/^RAYGUN_/]
+		}
+	},
+	{
+		kind: "CircleCI",
+		label: "CircleCI",
+		mode: "in-cli",
+		signals: { envKeys: [/^CIRCLECI_/, /^CIRCLE_TOKEN$/] }
+	},
+	{
+		kind: "Upstash",
+		label: "Upstash",
+		mode: "in-cli",
+		signals: {
+			npm: ["@upstash/redis"],
+			python: ["upstash-redis"],
+			envKeys: [/^UPSTASH_/]
+		}
+	},
+	{
+		kind: "Vercel",
+		label: "Vercel",
+		mode: "in-cli",
+		signals: {
+			npm: ["@vercel/sdk"],
+			envKeys: [/^VERCEL_API_TOKEN$/]
+		}
+	},
+	{
+		kind: "Algolia",
+		label: "Algolia",
+		mode: "in-cli",
+		signals: {
+			npm: ["algoliasearch"],
+			python: ["algoliasearch"],
+			ruby: ["algolia"],
+			envKeys: [/^ALGOLIA_/]
+		}
+	},
+	{
+		kind: "Inngest",
+		label: "Inngest",
+		mode: "in-cli",
+		signals: {
+			npm: ["inngest"],
+			python: ["inngest"],
+			envKeys: [/^INNGEST_/]
+		}
+	},
+	{
+		kind: "TriggerDev",
+		label: "Trigger.dev",
+		mode: "in-cli",
+		signals: {
+			npm: ["@trigger.dev/sdk"],
+			envKeys: [/^TRIGGER_(SECRET_KEY|API_KEY|PROJECT_ID)$/]
+		}
+	},
+	{
+		kind: "Ably",
+		label: "Ably",
+		mode: "in-cli",
+		signals: {
+			npm: ["ably"],
+			python: ["ably"],
+			envKeys: [/^ABLY_/]
+		}
+	},
+	{
+		kind: "Netlify",
+		label: "Netlify",
+		mode: "in-cli",
+		signals: {
+			npm: ["@netlify/functions"],
+			envKeys: [/^NETLIFY_/]
+		}
+	},
+	{
+		kind: "Railway",
+		label: "Railway",
+		mode: "in-cli",
+		signals: { envKeys: [/^RAILWAY_/] }
+	},
+	{
+		kind: "Render",
+		label: "Render",
+		mode: "in-cli",
+		signals: { envKeys: [/^RENDER_API_KEY$/] }
+	},
+	{
+		kind: "FlyIo",
+		label: "Fly.io",
+		mode: "in-cli",
+		signals: { envKeys: [/^FLY_API_TOKEN$/, /^FLY_APP_NAME$/] }
+	},
+	{
+		kind: "Heroku",
+		label: "Heroku",
+		mode: "in-cli",
+		signals: { envKeys: [/^HEROKU_/] }
+	},
+	{
+		kind: "DigitalOcean",
+		label: "DigitalOcean",
+		mode: "in-cli",
+		signals: { envKeys: [/^DIGITALOCEAN_/] }
+	},
+	{
+		kind: "Grafana",
+		label: "Grafana",
+		mode: "in-cli",
+		signals: {
+			python: ["grafana-client"],
+			envKeys: [/^GRAFANA_/]
+		}
+	},
+	{
+		kind: "BetterStack",
+		label: "Better Stack",
+		mode: "in-cli",
+		signals: {
+			npm: ["@logtail/node", "@logtail/js"],
+			envKeys: [
+				/^BETTERSTACK_/,
+				/^BETTER_STACK_/,
+				/^LOGTAIL_/
+			]
+		}
+	},
+	{
+		kind: "Honeycomb",
+		label: "Honeycomb",
+		mode: "in-cli",
+		signals: {
+			npm: ["@honeycombio/opentelemetry-node", "honeycomb-beeline"],
+			python: ["honeycomb-beeline", "libhoney"],
+			envKeys: [/^HONEYCOMB_/]
+		}
+	},
+	{
+		kind: "Descope",
+		label: "Descope",
+		mode: "in-cli",
+		signals: {
+			npm: [
+				"@descope/node-sdk",
+				"@descope/nextjs-sdk",
+				"@descope/react-sdk"
+			],
+			python: ["descope"],
+			envKeys: [/^DESCOPE_/]
+		}
+	},
+	{
+		kind: "FusionAuth",
+		label: "FusionAuth",
+		mode: "in-cli",
+		signals: {
+			npm: ["@fusionauth/typescript-client"],
+			python: ["fusionauth-client"],
+			envKeys: [/^FUSIONAUTH_/, /^FUSION_AUTH_/]
+		}
+	},
+	{
+		kind: "Hookdeck",
+		label: "Hookdeck",
+		mode: "in-cli",
+		signals: {
+			npm: ["@hookdeck/sdk"],
+			envKeys: [/^HOOKDECK_/]
+		}
+	},
+	{
+		kind: "N8n",
+		label: "n8n",
+		mode: "in-cli",
+		signals: {
+			npm: ["n8n"],
+			envKeys: [/^N8N_/]
+		}
+	},
+	{
+		kind: "Dbt",
+		label: "dbt",
+		mode: "in-cli",
+		signals: {
+			python: [
+				"dbt-core",
+				"dbt-snowflake",
+				"dbt-postgres",
+				"dbt-bigquery",
+				"dbt-redshift",
+				"dbt-databricks"
+			],
+			envKeys: [/^DBT_/]
+		}
+	},
+	{
+		kind: "Fastly",
+		label: "Fastly",
+		mode: "in-cli",
+		signals: {
+			npm: ["fastly"],
+			python: ["fastly"],
+			envKeys: [/^FASTLY_/]
+		}
+	},
+	{
+		kind: "Bunny",
+		label: "Bunny.net",
+		mode: "in-cli",
+		signals: { envKeys: [/^BUNNY_/] }
+	},
+	{
+		kind: "Codecov",
+		label: "Codecov",
+		mode: "in-cli",
+		signals: {
+			npm: ["codecov"],
+			envKeys: [/^CODECOV_/]
+		}
+	},
+	{
+		kind: "Sourcegraph",
+		label: "Sourcegraph",
+		mode: "in-cli",
+		signals: { envKeys: [/^SOURCEGRAPH_/, /^SRC_ACCESS_TOKEN$/] }
+	},
+	{
+		kind: "TemporalIO",
+		label: "Temporal.io",
+		mode: "in-cli",
+		signals: {
+			npm: ["@temporalio/client", "@temporalio/worker"],
+			python: ["temporalio"],
+			envKeys: [/^TEMPORAL_/]
+		}
+	},
+	{
+		kind: "Hatchet",
+		label: "Hatchet",
+		mode: "in-cli",
+		signals: {
+			npm: ["@hatchet-dev/typescript-sdk"],
+			python: ["hatchet-sdk"],
+			envKeys: [/^HATCHET_/]
+		}
+	},
+	{
+		kind: "Pipedrive",
+		label: "Pipedrive",
+		mode: "in-cli",
+		signals: {
+			npm: ["pipedrive"],
+			envKeys: [/^PIPEDRIVE_/]
+		}
+	},
+	{
+		kind: "Close",
+		label: "Close",
+		mode: "in-cli",
+		signals: {
+			python: ["closeio"],
+			envKeys: [/^CLOSE_API_KEY$/]
+		}
+	},
+	{
+		kind: "Copper",
+		label: "Copper",
+		mode: "in-cli",
+		signals: { envKeys: [/^COPPER_/] }
+	},
+	{
+		kind: "Insightly",
+		label: "Insightly",
+		mode: "in-cli",
+		signals: { envKeys: [/^INSIGHTLY_/] }
+	},
+	{
+		kind: "Salesflare",
+		label: "Salesflare",
+		mode: "in-cli",
+		signals: { envKeys: [/^SALESFLARE_/] }
+	},
+	{
+		kind: "SalesLoft",
+		label: "Salesloft",
+		mode: "in-cli",
+		signals: { envKeys: [/^SALESLOFT_/] }
+	},
+	{
+		kind: "Attio",
+		label: "Attio",
+		mode: "in-cli",
+		signals: {
+			npm: ["attio"],
+			envKeys: [/^ATTIO_/]
+		}
+	},
+	{
+		kind: "ActiveCampaign",
+		label: "ActiveCampaign",
+		mode: "in-cli",
+		signals: { envKeys: [/^ACTIVECAMPAIGN_/, /^ACTIVE_CAMPAIGN_/] }
+	},
+	{
+		kind: "Vitally",
+		label: "Vitally",
+		mode: "in-cli",
+		signals: { envKeys: [/^VITALLY_/] }
+	},
+	{
+		kind: "Docusign",
+		label: "DocuSign",
+		mode: "in-cli",
+		signals: {
+			npm: ["docusign-esign"],
+			python: ["docusign-esign"],
+			envKeys: [/^DOCUSIGN_/]
+		}
+	},
+	{
+		kind: "PandaDoc",
+		label: "PandaDoc",
+		mode: "in-cli",
+		signals: { envKeys: [/^PANDADOC_/] }
+	},
+	{
+		kind: "Gong",
+		label: "Gong",
+		mode: "in-cli",
+		signals: { envKeys: [/^GONG_/] }
+	},
+	{
+		kind: "Asana",
+		label: "Asana",
+		mode: "in-cli",
+		signals: {
+			npm: ["asana"],
+			python: ["asana"],
+			envKeys: [/^ASANA_/]
+		}
+	},
+	{
+		kind: "Trello",
+		label: "Trello",
+		mode: "in-cli",
+		signals: {
+			npm: ["trello"],
+			envKeys: [/^TRELLO_/]
+		}
+	},
+	{
+		kind: "Todoist",
+		label: "Todoist",
+		mode: "in-cli",
+		signals: {
+			npm: ["@doist/todoist-api-typescript"],
+			python: ["todoist-api-python"],
+			envKeys: [/^TODOIST_/]
+		}
+	},
+	{
+		kind: "Monday",
+		label: "monday.com",
+		mode: "in-cli",
+		signals: {
+			npm: ["@mondaydotcomorg/api"],
+			envKeys: [/^MONDAY_/]
+		}
+	},
+	{
+		kind: "ClickUp",
+		label: "ClickUp",
+		mode: "in-cli",
+		signals: { envKeys: [/^CLICKUP_/] }
+	},
+	{
+		kind: "Height",
+		label: "Height",
+		mode: "in-cli",
+		signals: { envKeys: [/^HEIGHT_API_KEY$/] }
+	},
+	{
+		kind: "Shortcut",
+		label: "Shortcut",
+		mode: "in-cli",
+		signals: {
+			npm: ["@shortcut/client"],
+			envKeys: [/^SHORTCUT_/]
+		}
+	},
+	{
+		kind: "Jira",
+		label: "Jira",
+		mode: "in-cli",
+		signals: {
+			npm: ["jira-client"],
+			python: ["jira", "atlassian-python-api"],
+			envKeys: [/^JIRA_/]
+		}
+	},
+	{
+		kind: "Confluence",
+		label: "Confluence",
+		mode: "in-cli",
+		signals: { envKeys: [/^CONFLUENCE_/] }
+	},
+	{
+		kind: "Airtable",
+		label: "Airtable",
+		mode: "in-cli",
+		signals: {
+			npm: ["airtable"],
+			python: ["pyairtable"],
+			envKeys: [/^AIRTABLE_/]
+		}
+	},
+	{
+		kind: "Smartsheet",
+		label: "Smartsheet",
+		mode: "in-cli",
+		signals: {
+			npm: ["smartsheet"],
+			python: ["smartsheet-python-sdk"],
+			envKeys: [/^SMARTSHEET_/]
+		}
+	},
+	{
+		kind: "Coda",
+		label: "Coda",
+		mode: "in-cli",
+		signals: { envKeys: [/^CODA_API_/] }
+	},
+	{
+		kind: "Productboard",
+		label: "Productboard",
+		mode: "in-cli",
+		signals: { envKeys: [/^PRODUCTBOARD_/] }
+	},
+	{
+		kind: "GoogleSheets",
+		label: "Google Sheets",
+		mode: "in-cli",
+		signals: {
+			npm: ["google-spreadsheet"],
+			python: ["gspread"],
+			envKeys: [/^GOOGLE_SHEETS_/]
+		}
+	},
+	{
+		kind: "Formbricks",
+		label: "Formbricks",
+		mode: "in-cli",
+		signals: {
+			npm: ["@formbricks/js"],
+			envKeys: [/^FORMBRICKS_/]
+		}
+	},
+	{
+		kind: "Tally",
+		label: "Tally",
+		mode: "in-cli",
+		signals: { envKeys: [/^TALLY_API_KEY$/] }
+	},
+	{
+		kind: "Jotform",
+		label: "Jotform",
+		mode: "in-cli",
+		signals: {
+			python: ["jotform"],
+			envKeys: [/^JOTFORM_/]
+		}
+	},
+	{
+		kind: "GitBook",
+		label: "GitBook",
+		mode: "in-cli",
+		signals: {
+			npm: ["@gitbook/api"],
+			envKeys: [/^GITBOOK_/]
+		}
+	},
+	{
+		kind: "Wordpress",
+		label: "WordPress",
+		mode: "in-cli",
+		signals: {
+			npm: ["wpapi"],
+			envKeys: [/^WORDPRESS_/]
+		}
+	},
+	{
+		kind: "Clockify",
+		label: "Clockify",
+		mode: "in-cli",
+		signals: { envKeys: [/^CLOCKIFY_/] }
+	},
+	{
+		kind: "Calendly",
+		label: "Calendly",
+		mode: "in-cli",
+		signals: { envKeys: [/^CALENDLY_/] }
+	},
+	{
+		kind: "CalCom",
+		label: "Cal.com",
+		mode: "in-cli",
+		signals: { envKeys: [/^CALCOM_/, /^CAL_API_KEY$/] }
+	},
+	{
+		kind: "Eventbrite",
+		label: "Eventbrite",
+		mode: "in-cli",
+		signals: {
+			python: ["eventbrite"],
+			envKeys: [/^EVENTBRITE_/]
+		}
+	},
+	{
+		kind: "BambooHR",
+		label: "BambooHR",
+		mode: "in-cli",
+		signals: {
+			python: ["pybamboohr"],
+			envKeys: [/^BAMBOOHR_/, /^BAMBOO_HR_/]
+		}
+	},
+	{
+		kind: "Personio",
+		label: "Personio",
+		mode: "in-cli",
+		signals: { envKeys: [/^PERSONIO_/] }
+	},
+	{
+		kind: "Rippling",
+		label: "Rippling",
+		mode: "in-cli",
+		signals: { envKeys: [/^RIPPLING_/] }
+	},
+	{
+		kind: "Greenhouse",
+		label: "Greenhouse",
+		mode: "in-cli",
+		signals: { envKeys: [/^GREENHOUSE_/] }
+	},
+	{
+		kind: "Ashby",
+		label: "Ashby",
+		mode: "in-cli",
+		signals: { envKeys: [/^ASHBY_/] }
+	},
+	{
+		kind: "Workable",
+		label: "Workable",
+		mode: "in-cli",
+		signals: { envKeys: [/^WORKABLE_/] }
+	},
+	{
+		kind: "GoogleAds",
+		label: "Google Ads",
+		mode: "deep-link",
+		signals: {
+			npm: ["google-ads-api"],
+			python: ["google-ads"],
+			envKeys: [/^GOOGLE_ADS_/]
+		}
+	},
+	{
+		kind: "MetaAds",
+		label: "Meta Ads",
+		mode: "deep-link",
+		signals: {
+			npm: ["facebook-nodejs-business-sdk"],
+			python: ["facebook-business"],
+			envKeys: [/^META_ADS_/, /^FACEBOOK_ADS_/]
+		}
+	},
+	{
+		kind: "LinkedinAds",
+		label: "LinkedIn Ads",
+		mode: "deep-link",
+		signals: { envKeys: [/^LINKEDIN_ADS_/] }
+	},
+	{
+		kind: "TikTokAds",
+		label: "TikTok Ads",
+		mode: "deep-link",
+		signals: { envKeys: [/^TIKTOK_ADS_/] }
+	},
+	{
+		kind: "RedditAds",
+		label: "Reddit Ads",
+		mode: "deep-link",
+		signals: { envKeys: [/^REDDIT_ADS_/] }
+	},
+	{
+		kind: "PinterestAds",
+		label: "Pinterest Ads",
+		mode: "deep-link",
+		signals: { envKeys: [/^PINTEREST_ADS_/] }
+	},
+	{
+		kind: "BingAds",
+		label: "Bing Ads",
+		mode: "deep-link",
+		signals: {
+			python: ["bingads"],
+			envKeys: [/^BING_ADS_/, /^MICROSOFT_ADS_/]
+		}
+	},
+	{
+		kind: "AmazonAds",
+		label: "Amazon Ads",
+		mode: "deep-link",
+		signals: { envKeys: [/^AMAZON_ADS_/] }
+	},
+	{
+		kind: "GoogleAnalytics",
+		label: "Google Analytics",
+		mode: "deep-link",
+		signals: {
+			npm: ["react-ga4"],
+			python: ["google-analytics-data"],
+			envKeys: [/^GOOGLE_ANALYTICS_/, /^GA4_/]
+		}
+	},
+	{
+		kind: "GoogleSearchConsole",
+		label: "Google Search Console",
+		mode: "deep-link",
+		signals: { envKeys: [/^SEARCH_CONSOLE_/, /^GSC_/] }
+	},
+	{
+		kind: "AppsFlyer",
+		label: "AppsFlyer",
+		mode: "in-cli",
+		signals: {
+			npm: ["react-native-appsflyer"],
+			envKeys: [/^APPSFLYER_/]
+		}
+	},
+	{
+		kind: "Dub",
+		label: "Dub",
+		mode: "in-cli",
+		signals: {
+			npm: ["dub"],
+			python: ["dub"],
+			envKeys: [/^DUB_API_KEY$/]
+		}
+	}
+];
+const SOURCE_DETECTORS = [
+	...CORE_SOURCE_DETECTORS,
+	...LLM_SOURCE_DETECTORS,
+	...OTHER_SOURCE_DETECTORS
+];
+/** Kinds from the LLM / AI section above — the only ones that may set `wizard_ai_sdk_detected`. */
+const AI_SOURCE_KINDS = new Set(LLM_SOURCE_DETECTORS.map((detector) => detector.kind));
+//#endregion
+//#region src/lib/warehouse-sources/detect.ts
+/**
+* Data warehouse source detection.
+*
+* Scans a project for codebase signals (npm/python/ruby deps, `.env` key
+* names) and matches them against the `SOURCE_DETECTORS` registry. Pure
+* function: no store mutations, no UI calls. Reads files locally — only the
+* wizard process does this; the agent never sees secret values.
+*
+* Note we only read `.env` KEY NAMES, never values.
+*/
+const MAX_DEPTH = 3;
+const MAX_SIGNAL_SET = MAX_ENV_KEY_SET;
+function addCapped(set, value) {
+	if (set.size < MAX_SIGNAL_SET) set.add(value);
+}
+/**
+* Detect which warehouse sources the project at `installDir` appears to use.
+* Returns one `DetectedSource` per matched registry entry (kinds are unique,
+* so the result is naturally deduped), minus the entries a more specific
+* match supersedes.
+*/
+function detectWarehouseSources(installDir) {
+	const signals = collectSignals(installDir);
+	const matched = [];
+	for (const detector of SOURCE_DETECTORS) {
+		const signal = matchDetector(detector, signals);
+		if (signal) matched.push({
+			detector,
+			signal
+		});
+	}
+	const kinds = new Set(matched.map((m) => m.detector.kind));
+	return matched.filter(({ detector }) => !isSuperseded(detector, kinds)).map(({ detector, signal }) => ({
+		kind: detector.kind,
+		label: detector.label,
+		mode: detector.mode,
+		matchedSignal: signal
+	}));
+}
+/**
+* Whether a more specific match covers this detector's data. Every consumer
+* treats a detected kind as a source to create, so a project whose Postgres
+* lives on Neon or Supabase would otherwise be offered both and end up with
+* the same tables imported twice.
+*/
+function isSuperseded(detector, detectedKinds) {
+	return (detector.supersededBy ?? []).some((kind) => detectedKinds.has(kind));
+}
+/** Returns a human-readable description of the first matching signal, or null. */
+function matchDetector(detector, signals) {
+	const { npm, python, ruby, envKeys } = detector.signals;
+	const npmHit = npm?.find((dep) => signals.npm.has(dep));
+	if (npmHit) return `found \`${npmHit}\` in package.json`;
+	const pyHit = python?.find((dep) => signals.python.has(dep));
+	if (pyHit) return `found \`${pyHit}\` in Python dependencies`;
+	const rubyHit = ruby?.find((gem) => signals.ruby.has(gem));
+	if (rubyHit) return `found \`${rubyHit}\` in Gemfile`;
+	if (envKeys) {
+		for (const [key, file] of signals.envKeys) if (envKeys.some((re) => re.test(key))) return `found \`${key}\` in \`${file}\``;
+	}
+	return null;
+}
+function collectSignals(installDir) {
+	const signals = {
+		npm: /* @__PURE__ */ new Set(),
+		python: /* @__PURE__ */ new Set(),
+		ruby: /* @__PURE__ */ new Set(),
+		envKeys: /* @__PURE__ */ new Map()
+	};
+	walkProjectFiles(installDir, (name, fullPath) => ingestFile(installDir, name, fullPath, signals), MAX_DEPTH);
+	return signals;
+}
+/**
+* Route a file to the right parser BY NAME, reading its contents only when the
+* name matches one of the ~6 manifests we care about. Checking the name first
+* avoids slurping every file in the tree (lockfiles, binaries, assets) into
+* memory just to discard it.
+*/
+function ingestFile(installDir, name, fullPath, signals) {
+	const ingest = ingestorFor(name);
+	if (!ingest) return;
+	const content = safeReadFile(fullPath);
+	if (content === null) return;
+	ingest(content, signals, toPromptSafeRelativePath(installDir, fullPath));
+}
+/** Pick the parser for a manifest filename, or null if it's not one we read. */
+function ingestorFor(name) {
+	if (name === "package.json") return addNpmDeps;
+	if (name === "requirements.txt") return (c, s) => parseRequirementsTxt(c).forEach((d) => addCapped(s.python, d));
+	if (name === "pyproject.toml") return (c, s) => parsePyprojectToml(c).forEach((d) => addCapped(s.python, d));
+	if (name === "Pipfile") return (c, s) => parsePipfile(c).forEach((d) => addCapped(s.python, d));
+	if (name === "Gemfile") return (c, s) => parseGemfile(c).forEach((g) => addCapped(s.ruby, g));
+	if (isEnvFileName(name)) return (c, s, relativePath) => addEnvKeys(c, s, relativePath);
+	return null;
+}
+/**
+* Record each key NAME against the file that defined it. The first file wins,
+* so the reported signal stays stable when several `.env*` files repeat a key.
+* Values are never read.
+*/
+function addEnvKeys(content, signals, relativePath) {
+	for (const key of parseEnvKeyNames(content)) {
+		if (signals.envKeys.has(key)) continue;
+		if (signals.envKeys.size >= MAX_SIGNAL_SET) return;
+		signals.envKeys.set(key, relativePath);
+	}
+}
+function addNpmDeps(content, signals) {
+	try {
+		const pkg = JSON.parse(content);
+		for (const dep of Object.keys({
+			...pkg.dependencies,
+			...pkg.devDependencies
+		})) addCapped(signals.npm, dep);
+	} catch (error) {
+		analytics.captureException(error instanceof Error ? error : new Error(String(error)), { step: "detectWarehouseSources.parsePackageJson" });
+	}
+}
+/** Extract gem names from `gem 'name'` declarations. */
+function parseGemfile(content) {
+	const gems = [];
+	for (const match of content.matchAll(/^\s*gem\s+['"]([^'"]+)['"]/gm)) gems.push(match[1]);
+	return gems;
+}
+//#endregion
+//#region src/lib/programs/warehouse-source/detect.ts
+/**
+* Warehouse-source program detection step.
+*
+* Thin adapter over `detectWarehouseSources` that writes results into
+* frameworkContext for the intro screen, plus the `[ABORT]` cases the
+* data-warehouse-source-setup skill can emit.
+*/
+/** frameworkContext key holding the detected sources (set on success). */
+const DETECTED_WAREHOUSE_SOURCES_KEY = "detectedWarehouseSources";
+/**
+* Read the detected sources out of frameworkContext. Single accessor shared by
+* the intro screen and the prompt builder so the key + cast live in one place.
+*/
+function getDetectedWarehouseSources(session) {
+	return session.frameworkContext["detectedWarehouseSources"] ?? [];
+}
+/** `[ABORT] <reason>` cases the skill can emit. */
+const WAREHOUSE_ABORT_CASES = [{
+	match: /^no data sources? detected\.?$/i,
+	message: "No data source detected",
+	body: "The agent could not confirm a data warehouse source to connect. Run this command from a project that uses a supported source (a database, Stripe, etc.).",
+	docsUrl: "https://posthog.com/docs/data-warehouse"
+}, {
+	match: /^source creation failed\.?$/i,
+	message: "Source creation failed",
+	body: "PostHog could not create the data warehouse source with the credentials provided. Double-check the connection details and try again, or set the source up directly in the PostHog app.",
+	docsUrl: "https://posthog.com/docs/data-warehouse"
+}];
+/**
+* Scan `session.installDir` for warehouse-source signals. Writes the detected
+* sources (or a `detectError`) into frameworkContext for the intro screen.
+*/
+function detectWarehousePrerequisites(session, setFrameworkContext) {
+	const fail = (error) => setFrameworkContext("detectError", error);
+	const installDir = session.installDir;
+	if (!existsSync(installDir)) {
+		fail({
+			kind: "bad-directory",
+			path: installDir,
+			reason: "missing"
+		});
+		return;
+	}
+	try {
+		if (!statSync(installDir).isDirectory()) {
+			fail({
+				kind: "bad-directory",
+				path: installDir,
+				reason: "not-dir"
+			});
+			return;
+		}
+	} catch (error) {
+		analytics.captureException(error instanceof Error ? error : new Error(String(error)), {
+			step: "detectWarehousePrerequisites.stat",
+			path: installDir
+		});
+		fail({
+			kind: "bad-directory",
+			path: installDir,
+			reason: "unreadable"
+		});
+		return;
+	}
+	const sources = detectWarehouseSources(installDir);
+	if (sources.length === 0) {
+		fail({ kind: "no-sources" });
+		return;
+	}
+	analytics.setTag("warehouse_source_kinds", sources.map((s) => s.kind).join(","));
+	analytics.setTag("warehouse_source_modes", sources.map((s) => `${s.kind}:${s.mode}`).join(","));
+	analytics.setTag("warehouse_source_count", sources.length);
+	setFrameworkContext(DETECTED_WAREHOUSE_SOURCES_KEY, sources);
+}
+//#endregion
+//#region src/lib/programs/shared/package-scanning.ts
+const POSTHOG_SDKS = new Set([
+	"posthog-js",
+	"posthog-node",
+	"posthog-react-native",
+	"posthog-android",
+	"posthog-ios"
+]);
+const STRIPE_SDKS = new Set([
+	"stripe",
+	"@stripe/stripe-js",
+	"@stripe/react-stripe-js"
+]);
+const MAX_PACKAGE_MATCHES = 500;
+/**
+* Find all package.json files under installDir via the shared bounded walk
+* (depth cap, ignored dirs, symlink-loop protection, per-dir entry cap).
+* Returns matches with detected SDKs.
+*/
+function findPackageJsons(installDir, maxDepth = 3) {
+	const matches = [];
+	walkProjectFiles(installDir, (name, fullPath) => {
+		if (name !== "package.json" || matches.length >= MAX_PACKAGE_MATCHES) return;
+		const content = safeReadFile(fullPath);
+		if (content === null) return;
+		try {
+			const pkg = JSON.parse(content);
+			const depNames = [...Object.keys(pkg.dependencies ?? {}), ...Object.keys(pkg.devDependencies ?? {})];
+			const posthogSdks = depNames.filter((d) => POSTHOG_SDKS.has(d));
+			const stripeSdks = depNames.filter((d) => STRIPE_SDKS.has(d));
+			matches.push({
+				path: relative(installDir, fullPath) || "package.json",
+				posthogSdks,
+				stripeSdks
+			});
+		} catch {}
+	}, maxDepth);
+	return matches;
+}
+//#endregion
+//#region src/lib/programs/posthog-integration/detect.ts
+async function detectPostHogIntegration(ctx) {
+	const session = ctx.session;
+	const installDir = session.installDir;
+	const detectedIntegration = await detectFramework(installDir);
+	if (detectedIntegration) {
+		const config = FRAMEWORK_REGISTRY[detectedIntegration];
+		const sessionOptions = {
+			installDir,
+			debug: session.debug,
+			signup: session.signup,
+			ci: session.ci,
+			benchmark: session.benchmark,
+			yaraReport: session.yaraReport
+		};
+		const context = await gatherFrameworkContext(config, sessionOptions);
+		for (const [key, value] of Object.entries(context)) if (!(key in session.frameworkContext)) ctx.setFrameworkContext(key, value);
+		ctx.setFrameworkConfig(detectedIntegration, config);
+		ctx.setSkillId(detectedIntegration);
+		if (!session.detectedFrameworkLabel) ctx.setDetectedFramework(config.metadata.name);
+		const versionResult = await checkFrameworkVersion(config, sessionOptions);
+		if (versionResult.supported !== true) ctx.setUnsupportedVersion(versionResult.supported);
+	}
+	for (const feature of discoverFeatures(installDir)) ctx.addDiscoveredFeature(feature);
+	detectWarehouseSourcesForSuggestion(ctx, installDir);
+	detectExistingPostHog(ctx, installDir);
+	ctx.setDetectionComplete();
+}
+/**
+* How the scan went, for the reporter to read later. Three states, and the
+* absent one carries the most weight:
+*
+*   absent   this program never scanned. Only `posthog-integration` runs the
+*            scan below, but every program's intro screen resolves consent
+*            through the same store method, so the reporter is reached on runs
+*            where no scan ever happened.
+*   'failed' the scan threw. A zero-count row would read as "scanned, found
+*            nothing", which is a different fact.
+*   'ok'     the scan ran. Zero sources is a real result and gets reported.
+*/
+const WAREHOUSE_SCAN_STATE_KEY = "warehouseScanState";
+/**
+* Scan for data warehouse source signals (Postgres, Stripe, Hubspot, …) and,
+* when found, stash them for a `wizard warehouse` suggestion on the outro.
+* Runs unconditionally during `detect`, before the intro screen has asked
+* about sharing. Reporting what this finds is a separate, later concern.
+* See `reportWarehouseSourcesDetected` below.
+*
+* Deliberately a suggestion, not an inline agent run: a second credential-
+* collecting agent run before the outro could `process.exit()` on any of its
+* failure paths and cost the user the success outro on a run where PostHog
+* installed fine.
+*
+* Calls `detectWarehouseSources` (a pure scan) rather than the warehouse
+* program's `detectWarehousePrerequisites`, which writes a `detectError` when
+* it finds nothing — that's right for `wizard warehouse` but here would show a
+* spurious error and trip the CI prerequisites abort. No sources is a no-op.
+*
+* Best-effort: never let a scan failure break the wizard flow.
+*/
+function detectWarehouseSourcesForSuggestion(ctx, installDir) {
+	try {
+		const sources = detectWarehouseSources(installDir);
+		ctx.setFrameworkContext(WAREHOUSE_SCAN_STATE_KEY, "ok");
+		if (sources.length === 0) return;
+		ctx.setFrameworkContext(DETECTED_WAREHOUSE_SOURCES_KEY, sources);
+	} catch (error) {
+		ctx.setFrameworkContext(WAREHOUSE_SCAN_STATE_KEY, "failed");
+		analytics.captureException(error instanceof Error ? error : new Error(String(error)), { step: "detectWarehouseSourcesForSuggestion" });
+	}
+}
+function hasAiSdkEvidence(session, sources) {
+	return sources.some((s) => AI_SOURCE_KINDS.has(s.kind)) || session.discoveredFeatures.includes("llm");
+}
+/**
+* Boolean only, on the org, never the list of kinds or any non-AI tool: a
+* decline must not leak even the shape of what local detection saw.
+*/
+function stampAiSdkDetected(session, sources) {
+	const organizationId = session.apiUser?.organization?.id;
+	if (!organizationId) return;
+	if (!hasAiSdkEvidence(session, sources)) return;
+	analytics.groupIdentify("organization", organizationId, { wizard_ai_sdk_detected: true });
+}
+/**
+* Fires the org stamp once per session, right after `authenticate()` succeeds
+* — never from the consent path, since consent on the intro screen resolves
+* before login and `session.apiUser` is unset there. Called right after
+* `authenticate()` from run-wizard.ts's auth step and from bootstrap.ts,
+* whichever completes it first for a given program; a no-op on every call
+* after that. In the `--ci` path, project-scope.ts authenticates first as a
+* prerequisite (no evidence gathered yet, so nothing would stamp there
+* anyway) and this only ever runs from the later, idempotent bootstrap.ts
+* call — still correctly finding no evidence, since CI skips the detect step.
+*/
+function maybeStampAiSdkDetected(session) {
+	if (session.aiSdkStampReported) return;
+	session.aiSdkStampReported = true;
+	if (!mayReportScanResults(session)) return;
+	stampAiSdkDetected(session, getDetectedWarehouseSources(session));
+}
+/**
+* The single place scan results become telemetry. Called from
+* `WizardStore.completeSetup()`, the point consent becomes final — the privacy
+* panel's choice is reversible until then, so nothing may report earlier.
+* The org stamp is a separate concern: see `maybeStampAiSdkDetected`, which
+* runs post-auth rather than at consent resolution.
+*
+* Returns true when consent has resolved and the caller should latch
+* `warehouseSourcesReported`, which is not the same as "this sent something":
+* a decline, a failed scan, and a program that never scanned all resolve
+* without sending.
+*/
+function reportWarehouseSourcesDetected(session) {
+	if (session.warehouseSourcesReported) return false;
+	if (session.scanConsent === "undecided") return false;
+	if (mayReportScanResults(session)) {
+		const sources = getDetectedWarehouseSources(session);
+		if (session.frameworkContext[WAREHOUSE_SCAN_STATE_KEY] !== "ok") return true;
+		analytics.wizardCapture("warehouse sources detected", {
+			warehouse_source_count: sources.length,
+			warehouse_source_kinds: sources.map((s) => s.kind),
+			warehouse_source_modes: sources.map((s) => s.mode)
+		});
+		if (sources.length > 0) {
+			analytics.setTag("warehouse_source_kinds", sources.map((s) => s.kind).join(","));
+			analytics.setTag("warehouse_source_count", sources.length);
+		}
+	}
+	return true;
+}
+/** Dependency-level signal, not a verified install. A failed scan reports false. */
+function detectExistingPostHog(ctx, installDir) {
+	try {
+		const pkgJsons = findPackageJsons(installDir);
+		ctx.setPosthogSdkDetected(pkgJsons.some((p) => p.posthogSdks.length > 0));
+	} catch (error) {
+		analytics.captureException(error instanceof Error ? error : new Error(String(error)), { step: "detectExistingPosthog" });
+		ctx.setPosthogSdkDetected(false);
+	}
+}
+//#endregion
+//#region src/lib/programs/audit/types.ts
+/** Single source of truth for status glyph + color across audit views. */
+const AUDIT_SEVERITY_STYLE = {
+	pending: {
+		glyph: "◌",
+		color: "gray"
+	},
+	pass: {
+		glyph: "✔",
+		color: "green"
+	},
+	error: {
+		glyph: "✘",
+		color: "red"
+	},
+	warning: {
+		glyph: "⚠",
+		color: "yellow"
+	},
+	suggestion: {
+		glyph: "•",
+		color: "cyan"
+	}
+};
+const AUDIT_CHECKS_KEY = "auditChecks";
+function getAuditChecks(session) {
+	const raw = session.frameworkContext[AUDIT_CHECKS_KEY];
+	return Array.isArray(raw) ? raw : [];
+}
+//#endregion
+//#region src/lib/programs/audit/ledger-watcher.ts
+/**
+* Mirrors the agent's `.posthog-audit-checks.json` into the session, so the TUI
+* screens and the task stream read one value. `runProgramAgent` owns the
+* lifecycle and removes the file at run end, so every path gets it — including
+* the e2e host, which builds no task stream.
+*/
+const MAX_LEDGER_FILE_BYTES = 256 * 1024;
+function startAuditLedgerWatcher(installDir, file, options = {}) {
+	const target = path.join(installDir, file);
+	logToFile(`[audit-ledger] watching ${target}`);
+	return startFileWatcher(target, (parsed) => getUI().setFrameworkContext(AUDIT_CHECKS_KEY, coerceAuditChecks(parsed)), {
+		ignoreInitialFile: true,
+		maxFileSizeBytes: MAX_LEDGER_FILE_BYTES,
+		...options
+	});
+}
+/** The program declared the ledger, so it removes it, agent `rm` step or not. */
+function removeAuditLedger(installDir, file) {
+	const target = path.join(installDir, file);
+	try {
+		fs.rmSync(target, { force: true });
+	} catch (error) {
+		logToFile(`[audit-ledger] could not remove ${target}: ${String(error)}`);
+	}
+}
+//#endregion
+//#region src/lib/programs/run-agent-legacy.ts
+var run_agent_legacy_exports = /* @__PURE__ */ __exportAll({ runProgramAgent: () => runProgramAgent });
+/**
+* Resolve a ProgramConfig's agent run definition and execute the pipeline.
+* Entry point for the runners and for composed run steps.
+*/
+async function runProgramAgent(programConfig, session, options = {}) {
+	if (!programConfig.run) throw new Error(`Program "${programConfig.id}" has no run configuration.`);
+	const ledgerFile = programConfig.auditLedgerFile;
+	const ledger = ledgerFile ? startAuditLedgerWatcher(session.installDir, ledgerFile) : null;
+	const releaseLedger = () => {
+		ledger?.refresh();
+		ledger?.stop();
+		if (ledgerFile) removeAuditLedger(session.installDir, ledgerFile);
+	};
+	if (ledger) registerCleanup(releaseLedger);
+	try {
+		await runProgram(session, typeof programConfig.run === "function" ? await programConfig.run(session) : programConfig.run, programConfig, options.composed ?? false);
+	} finally {
+		releaseLedger();
+	}
+}
+/**
+* Gates → authenticate → flags → binding → the functional run → apply result.
+* Every step happens in the order it did inside the agent's bootstrap.
+*/
+async function runProgram(session, run, programConfig, composed) {
+	initLogFile();
+	session.skillId = run.skillId ?? run.integrationLabel;
+	logToFile(`[agent-runner] START ${run.integrationLabel} build=${analytics.build}${session.ci ? " (non-interactive)" : ""}`);
+	if (session.debug) enableDebugLogs();
+	await runHealthGate(session, programConfig);
+	await runSettingsGate(session);
+	analytics.wizardCapture("agent started", {
+		integration: run.integrationLabel,
+		program_id: programConfig.id,
+		skill_id: run.skillId ?? null
+	});
+	await authenticate(session, programConfig.id);
+	maybeStampAiSdkDetected(session);
+	logToFile("[agent-runner] checking AI opt-in gate");
+	await getUI().waitForAiOptIn();
+	logToFile("[agent-runner] AI opt-in gate cleared");
+	for (const step of postAuthGateSteps(programConfig.steps)) {
+		logToFile(`[agent-runner] awaiting post-auth gate: ${step.id}`);
+		await getUI().waitForGate(step.id);
+		logToFile(`[agent-runner] post-auth gate cleared: ${step.id}`);
+	}
+	const wizardFlags = await analytics.getAllFlagsForWizard();
+	const wizardFlagPayloads = analytics.getWizardFlagPayloads();
+	const wizardMetadata = buildRunTags({
+		programId: programConfig.id,
+		integration: run.integrationLabel,
+		runId: analytics.runId,
+		build: analytics.build,
+		skillId: run.skillId
+	});
+	await refreshAccessTokenIfNeeded(session);
+	const credentials = session.credentials;
+	const switchboard = {
+		program: programConfig.id,
+		composed,
+		flags: wizardFlags,
+		flagPayloads: wizardFlagPayloads,
+		cliHarness: session.harness,
+		cliSequence: session.sequence,
+		cliModel: session.model
+	};
+	const binding = resolveBinding(switchboard);
+	analytics.setTag("sequence", binding.sequence);
+	analytics.setTag("harness", binding.harness);
+	wizardMetadata.SEQUENCE = binding.sequence;
+	wizardMetadata.HARNESS = binding.harness;
+	captureSwitchboardDecision(switchboard, binding);
+	const ui = getUI();
+	registerCleanup(() => {
+		const report = flushScanReport({ yaraReport: session.yaraReport });
+		if (report) ui.log.info(report);
+	});
+	if (binding.sequence === "linear") ui.onEnterScreen("outro", () => restoreClaudeSettings(session.installDir));
+	const framework = session.integration ?? session.skillId ?? void 0;
+	const result = await runAgent$1({
+		programId: programConfig.id,
+		run,
+		composed,
+		binding,
+		switchboard,
+		skillsBaseUrl: getSkillsBaseUrl(),
+		wizardFlags,
+		wizardFlagPayloads,
+		wizardMetadata,
+		allowedTools: programConfig.allowedTools,
+		disallowedTools: programConfig.disallowedTools,
+		agentFlow: programConfig.agentFlow,
+		excludedTaskTypes: programConfig.excludedTaskTypes,
+		seedTasks: programConfig.seedTasks ? () => programConfig.seedTasks(session) : void 0,
+		hooks: {
+			postRun: run.postRun ? (creds) => run.postRun(session, creds) : void 0,
+			buildOutroData: run.buildOutroData ? (creds) => run.buildOutroData(session, creds) ?? void 0 : void 0,
+			buildOutroNextSteps: run.buildOutroNextSteps ? (creds, completed) => run.buildOutroNextSteps(session, creds, completed) : void 0,
+			recordTaskOutcomes: (outcomes) => {
+				session.frameworkContext[TASK_OUTCOMES_KEY] = outcomes;
+			}
+		}
+	}, {
+		installDir: session.installDir,
+		credentials,
+		project: session.apiProject,
+		apiUser: session.apiUser,
+		skillId: session.skillId ?? void 0,
+		integration: session.integration,
+		frameworkDocsUrl: framework ? FRAMEWORK_REGISTRY[framework]?.metadata.docsUrl : void 0,
+		flags: {
+			ci: session.ci,
+			signup: session.signup,
+			debug: session.debug,
+			e2eAsk: session.e2eAsk,
+			localMcp: session.localMcp,
+			captureAio: session.captureAio,
+			benchmark: session.benchmark,
+			yaraReport: session.yaraReport
+		},
+		host: {
+			baseUrl: session.baseUrl,
+			region: session.region,
+			email: session.email,
+			projectId: session.projectId,
+			apiKey: session.apiKey
+		}
+	}, {
+		onProgress: createUiReducer(ui),
+		interaction: uiInteraction(ui)
+	});
+	if (result.outcome === "crashed") throw result.failure.error;
+	if (result.outcome !== "success") {
+		if (result.failure.authErrorDetail) ui.showAuthError(result.failure.authErrorDetail);
+		await wizardAbort({
+			...result.failure,
+			status: result.outcome === "aborted" ? "cancelled" : "error"
+		});
+	} else if (!composed) try {
+		await analytics.shutdown("success");
+	} catch (error) {
+		logToFile("[agent-runner] analytics shutdown failed:", error);
+	}
+}
+async function runHealthGate(session, programConfig) {
+	const hasHealthCheckScreen = programConfig.steps.some((s) => s.screenId === "health-check");
+	if (session.readinessResult) logToFile(`[agent-runner] readiness pre-computed by TUI: decision=${session.readinessResult.decision}${session.outageDismissed ? " (outage dismissed by user)" : ""} — skipping re-check`);
+	if (!hasHealthCheckScreen || session.readinessResult) return;
+	logToFile("[agent-runner] evaluating wizard readiness");
+	const readinessConfig = session.signup ? SIGNUP_WIZARD_READINESS_CONFIG : void 0;
+	const readiness = await evaluateWizardReadiness(readinessConfig);
+	logToFile(`[agent-runner] readiness=${readiness.decision}`);
+	if (readiness.decision === "no") {
+		const blockingLabels = getBlockingServiceKeys(readiness.health, readinessConfig).map((k) => `${SERVICE_LABELS[k]} (${readiness.health[k].status})`);
+		logToFile(`[agent-runner] blocked by: ${blockingLabels.join(", ")}`);
+		await getUI().showBlockingOutage(readiness);
+		if (!isNonInteractiveEnvironment()) await wizardAbort({
+			code: ErrorCodes.EnvServiceOutage,
+			message: "Cannot start — external services are down:\n" + blockingLabels.map((l) => `  - ${l}`).join("\n") + "\n\nPlease try again later."
+		});
+	} else if (readiness.decision === "yes_with_warnings") getUI().setReadinessWarnings(readiness);
+}
+async function runSettingsGate(session) {
+	const settingsConflicts = checkAllSettingsConflicts(session.installDir);
+	logToFile(`[agent-runner] settings conflicts: ${settingsConflicts.length > 0 ? settingsConflicts.map((c) => `${c.source}(${c.keys.join(",")})`).join("; ") : "none"}`);
+	if (settingsConflicts.length === 0) return;
+	for (const conflict of settingsConflicts) {
+		const level = conflict.source === "managed" ? "org" : conflict.source;
+		analytics.wizardCapture("settings conflict detected", {
+			level,
+			keys: conflict.keys
+		});
+	}
+	const { autoFix, failClosed, warnOnly } = classifySettingsConflicts(settingsConflicts);
+	for (const conflict of warnOnly) {
+		logToFile(`[agent-runner] settings conflict in ${conflict.source} (${conflict.path}) neutralized by settingSources:['project'] — not blocking`);
+		analytics.wizardCapture("settings conflict neutralized", {
+			level: conflict.source,
+			keys: conflict.keys
+		});
+	}
+	let unfixable = failClosed;
+	if (autoFix.length > 0) if (backupAndFixClaudeSettings(session.installDir)) {
+		logToFile("[agent-runner] auto-neutralized writable settings conflict");
+		analytics.wizardCapture("settings conflict auto-neutralized", { keys: autoFix.flatMap((c) => c.keys) });
+	} else {
+		logToFile("[agent-runner] could not back up writable settings conflict — failing closed");
+		unfixable = [...failClosed, ...autoFix];
+	}
+	if (unfixable.length > 0) {
+		if (isNonInteractiveEnvironment()) await wizardAbort({
+			code: ErrorCodes.SettingsUnfixableConflict,
+			message: "Cannot start — a Claude settings file redirects the agent away from the PostHog gateway and cannot be neutralized automatically:\n" + unfixable.map((c) => `  - ${c.source} (${c.path}): ${c.keys.join(", ")}`).join("\n") + "\n\nRemove the conflicting keys and re-run the wizard."
+		});
+		await getUI().showSettingsOverride(unfixable, () => backupAndFixClaudeSettings(session.installDir));
+		logToFile("[agent-runner] settings override resolved");
+	}
+}
+/**
+* One event + one log line per run: what entered the switchboard, which
+* precedence rung decided each axis, and the final pick.
+*/
+function captureSwitchboardDecision(ctx, binding) {
+	const trace = ctx.trace ?? {};
+	const perTaskModel = binding.sequence === "orchestrator" && trace.model === "binding";
+	const model = perTaskModel ? "chosen-per-task" : binding.model;
+	const modelSource = perTaskModel ? "agent-prompts" : trace.model;
+	analytics.wizardCapture("switchboard resolved", {
+		program: ctx.program,
+		flag_self_driving_use_pi_harness: ctx.flags[WIZARD_SELF_DRIVING_USE_PI_HARNESS_FLAG_KEY],
+		flag_self_driving_pi_payload: JSON.stringify(ctx.flagPayloads?.["wizard-self-driving-use-pi-harness"] ?? null),
+		flag_orchestrator: ctx.flags[WIZARD_ORCHESTRATOR_FLAG_KEY],
+		cli_harness: ctx.cliHarness,
+		cli_sequence: ctx.cliSequence,
+		cli_model: ctx.cliModel,
+		harness_source: trace.harness,
+		model_source: modelSource,
+		sequence_source: trace.sequence,
+		harness: binding.harness,
+		model,
+		thinking_level: binding.thinkingLevel,
+		sequence: binding.sequence
+	});
+	logToFile(`[switchboard] decision: program=${ctx.program} in(orchestrator=${ctx.flags["wizard-orchestrator"] ?? "-"}, cli=${ctx.cliHarness ?? "-"}/${ctx.cliSequence ?? "-"}/${ctx.cliModel ?? "-"}) → harness=${binding.harness} (${trace.harness ?? "?"}) model=${model} (${modelSource ?? "?"}) sequence=${binding.sequence} (${trace.sequence ?? "?"})`);
+}
+//#endregion
+export { createProgramSequence as S, detectProjectsWithAgent as _, getAuditChecks as a, detectFramework as b, reportWarehouseSourcesDetected as c, findPackageJsons as d, WAREHOUSE_ABORT_CASES as f, AgenticDetectionTimeoutError as g, detectWarehouseSources as h, AUDIT_SEVERITY_STYLE as i, POSTHOG_SDKS as l, getDetectedWarehouseSources as m, run_agent_legacy_exports as n, detectPostHogIntegration as o, detectWarehousePrerequisites as p, AUDIT_CHECKS_KEY as r, maybeStampAiSdkDetected as s, runProgramAgent as t, STRIPE_SDKS as u, resolveProjectDir as v, authenticate as x, gatherFrameworkContext as y };
+
+//# sourceMappingURL=run-agent-legacy-d7rWlzQR.js.map