@posthog/wizard 2.77.0 → 2.79.0

package/dist/{agent-interface-Avtr_5M5.js → agent-interface-BXvmAm4c.js}

@@ -1,13 +1,14 @@
 import { n as __require } from "./rolldown-runtime-B_-DWIq7.js";
-import { c as RESUME_INSTRUCTION, l as classifyAuthFailure, o as AgentSignals, s as REMARK_INSTRUCTION } from "./errors-BoJvrdw8.js";
-import { A as CONTEXT_MILL_URL, Ct as runtimeEnv, O as AWS_SKILLS_BASE_URL, _t as wizardUserAgentForProgram, a as getLogFilePath, o as initLogFile, p as getUI, pt as WIZARD_REMARK_EVENT_NAME, r as debug, s as logToFile } from "./debug-B4kzIZPi.js";
-import { n as ADDITIONAL_FEATURE_PROMPTS } from "./wizard-session-FSJCkTcP.js";
-import { n as analytics } from "./analytics-C67F2vee.js";
-import { a as safeReadFile, i as readProjectFile, o as walkProjectFiles } from "./bounded-fs-CWRYuLAn.js";
-import { i as wizardAbort, n as registerCleanup, t as WizardError } from "./wizard-abort-lE6umflt.js";
-import { o as gatewayAuth, r as buildWizardPropertiesBlob, s as isPastRefresh } from "./gateway-session-xPFv6p5c.js";
-import { b as coerceAuditChecks, g as AUDIT_CHECKS_FILE, l as prewarmYaraScanner, n as createPostToolUseYaraHooks, p as scanInstalledSkill, r as createPreToolUseYaraHooks } from "./yara-hooks-BTNJ6MGW.js";
-import { C as makeMutex, S as triageModelFor, b as modelCapabilities, l as buildOrchestratorTools, w as writeJsonAtomic } from "./queue-tools-C8y_xZJi.js";
+import { i as classifyAuthFailure } from "./errors-ddDE6MbA.js";
+import { a as getLogFilePath, o as initLogFile, r as debug, s as logToFile, v as runtimeEnv } from "./debug-Cj-8vfXY.js";
+import { Y as WIZARD_REMARK_EVENT_NAME, c as CONTEXT_MILL_URL, et as wizardUserAgentForProgram, o as AWS_SKILLS_BASE_URL } from "./constants-CuJfQEcC.js";
+import { n as analytics } from "./analytics-VRYdebXW.js";
+import { a as safeReadFile, i as readProjectFile, o as walkProjectFiles } from "./bounded-fs-Cpn129A4.js";
+import { t as registerCleanup } from "./wizard-abort-HDbP3YcS.js";
+import { c as REMARK_INSTRUCTION, f as gatewayAuth, i as gatewayApiFor, l as RESUME_INSTRUCTION, n as buildGatewayModel, p as isPastRefresh, s as AgentSignals, u as buildWizardPropertiesBlob } from "./gateway-CVU1G0H3.js";
+import { i as modelCapabilities, o as triageModelFor } from "./models-DnAY67Lg.js";
+import { _ as coerceAuditChecks, h as AUDIT_CHECKS_FILE, l as prewarmYaraScanner, n as createPostToolUseYaraHooks, p as scanInstalledSkill, r as createPreToolUseYaraHooks } from "./yara-hooks-DCfROpZt.js";
+import { l as buildOrchestratorTools, v as makeMutex, y as writeJsonAtomic } from "./queue-tools-B7_aCyd-.js";
 import { createRequire } from "node:module";
 import * as fs$1 from "fs";
 import fs from "fs";
@@ -15,37 +16,60 @@ import path from "path";
 import path$1 from "node:path";
 import { spawnSync } from "node:child_process";
 import { closeSync, constants, fchmodSync, lstatSync, openSync, renameSync, unlinkSync, writeSync } from "node:fs";
-import { randomBytes } from "node:crypto";
+import { randomBytes, randomUUID } from "node:crypto";
 import { z } from "zod";
+import { randomUUID as randomUUID$1 } from "crypto";
 import * as os from "os";
 import { unzipSync } from "fflate";
-import { randomUUID } from "crypto";
-//#region src/lib/auth-session-state.ts
-/**
-* Whether this run's OAuth grant is known to be dead.
-*
-* Process-global on purpose. A run has exactly one login, but the two sides of
-* this fact are far apart: the pre-run refresh learns it in `authenticate.ts`,
-* and the only consumer is the 401 handler inside the agent message loop, which
-* holds no session. Threading it would mean a field on `AgentConfig` set at four
-* `initializeAgent` call sites — and the session it would read from may be a
-* shallow copy (`prepareRunSession`), so the value could be written to one
-* object and read from another.
-*
-* A leaf module with no imports, so either side can depend on it without a cycle.
-*/
-let grantRevoked = false;
+//#region src/agent/triage-provider.ts
+const TRIAGE_MAX_TOKENS = 16384;
+const TRIAGE_TIMEOUT_MS = 2e4;
 /**
-* Record that the token endpoint permanently refused this grant. Not an abort:
-* the access token in hand may still have minutes of life, so the run continues
-* and this only decides what a later 401 gets blamed on.
+* Triage provider for a harness. Auth is always explicit: every caller already
+* holds the gateway url and the run's token, and reading them back out of
+* ANTHROPIC_* made an unauthed provider silent — it returned undefined, the
+* caller failed closed, and a clean first-party skill got deleted. A resolver
+* is re-read on every call, so a run that re-mints mid-way scans with the
+* current bearer rather than the one it started with.
 */
-function markGrantRevoked() {
-	grantRevoked = true;
-}
-/** True once a token refresh failed because the grant itself is gone. */
-function isGrantRevoked() {
-	return grantRevoked;
+function createTriageLLMProvider(auth, harness) {
+	const resolveAuth = typeof auth === "function" ? auth : () => Promise.resolve(auth);
+	const modelId = triageModelFor(harness);
+	const { reasoning, thinkingLevel } = modelCapabilities(modelId);
+	logToFile(`[YARA] triage provider ready (model: ${modelId}, api: ${gatewayApiFor(modelId)})`);
+	return async (prompt) => {
+		const { completeSimple } = await import("@earendil-works/pi-ai");
+		const current = await resolveAuth();
+		const authToken = current.authToken;
+		const model = buildGatewayModel({
+			gatewayUrl: current.baseURL,
+			accessToken: authToken,
+			teamId: current.teamId,
+			wizardMetadata: current.wizardMetadata ?? {},
+			wizardFlags: current.wizardFlags ?? {},
+			modelId
+		});
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), TRIAGE_TIMEOUT_MS);
+		try {
+			const message = await completeSimple(model, { messages: [{
+				role: "user",
+				content: prompt,
+				timestamp: Date.now()
+			}] }, {
+				apiKey: authToken,
+				temperature: model.api === "anthropic-messages" ? 0 : void 0,
+				maxTokens: TRIAGE_MAX_TOKENS,
+				reasoning: reasoning && thinkingLevel !== "off" ? thinkingLevel : void 0,
+				signal: controller.signal
+			});
+			const text = message.content.filter((c) => c.type === "text").map((c) => c.text).join("");
+			if (message.stopReason === "error") logToFile(`[YARA] triage call failed on ${model.id}: ${message.errorMessage ?? "unknown"} — every flagged match will be acted on`);
+			return text;
+		} finally {
+			clearTimeout(timer);
+		}
+	};
 }
 /** A scan retains at most this many distinct key names. */
 const MAX_ENV_KEY_SET = 5e3;
@@ -172,7 +196,7 @@ function collectProjectEnvKeys(rootDir) {
 	return locations;
 }
 //#endregion
-//#region src/utils/custom-headers.ts
+//#region src/shared/utils/custom-headers.ts
 /**
 * Builds a list of custom headers for ANTHROPIC_CUSTOM_HEADERS.
 */
@@ -192,7 +216,7 @@ function createCustomHeaders() {
 	};
 }
 //#endregion
-//#region src/lib/safe-tools.ts
+//#region src/agent/safe-tools.ts
 const LINTING_TOOLS = [
 	"codespell",
 	"cspell",
@@ -330,7 +354,7 @@ const LINTING_TOOLS = [
 	"yamllint"
 ];
 //#endregion
-//#region src/lib/agent/bash-fence.ts
+//#region src/agent/bash-fence.ts
 /**
 * Bash command fence: exact per-manager allowlists + shell-shape gates.
 *
@@ -688,7 +712,7 @@ function evaluateBashCommand(rawCommand) {
 	return commandDecision(normalized);
 }
 //#endregion
-//#region src/lib/wizard-ask-bridge.ts
+//#region src/agent/wizard-ask-bridge.ts
 /**
 * WizardAskBridge — host-side promise broker for the `wizard_ask` MCP tool.
 *
@@ -722,51 +746,78 @@ function isFullyCancelled(answers) {
 }
 function createWizardAskBridge(opts) {
 	const timeoutMs = opts.timeoutMs ?? 3e5;
-	return { async request({ questions, subject }) {
-		const pending = {
-			id: randomUUID(),
-			questions,
-			source: opts.getSource(),
-			richLinks: opts.richLinks ?? false,
-			askedAt: (/* @__PURE__ */ new Date()).toISOString()
-		};
-		const startedAt = Date.now();
-		let timer;
-		let timedOut = false;
-		const timeoutPromise = new Promise((resolve) => {
-			timer = setTimeout(() => {
-				timedOut = true;
-				opts.cancelQuestion?.();
-				resolve(buildCancelledAnswers(questions));
-			}, timeoutMs);
-		});
-		try {
-			const answers = await Promise.race([opts.showQuestion(pending), timeoutPromise]);
-			const durationMs = Date.now() - startedAt;
-			if (isFullyCancelled(answers)) analytics.wizardCapture("wizard_ask cancelled", {
-				source: pending.source,
-				subject,
-				question_count: questions.length,
-				duration_ms: durationMs,
-				timed_out: timedOut
+	const pendingQuestions = /* @__PURE__ */ new Map();
+	return {
+		getPendingQuestion: () => {
+			for (const pending of pendingQuestions.values()) return pending;
+			return null;
+		},
+		async request({ questions, subject }) {
+			if (opts.signal?.aborted) return {
+				answers: buildCancelledAnswers(questions),
+				timedOut: false
+			};
+			const pending = {
+				id: randomUUID$1(),
+				questions,
+				source: opts.getSource(),
+				richLinks: opts.richLinks ?? false,
+				askedAt: (/* @__PURE__ */ new Date()).toISOString()
+			};
+			pendingQuestions.set(pending.id, pending);
+			const startedAt = Date.now();
+			const controller = new AbortController();
+			let timer;
+			let timedOut = false;
+			let cancelForAbort;
+			const timeoutPromise = new Promise((resolve) => {
+				timer = setTimeout(() => {
+					timedOut = true;
+					resolve(buildCancelledAnswers(questions));
+					controller.abort();
+				}, timeoutMs);
 			});
-			else analytics.wizardCapture("wizard_ask answered", {
-				source: pending.source,
-				subject,
-				question_count: questions.length,
-				duration_ms: durationMs
+			const aborted = new Promise((resolve) => {
+				cancelForAbort = () => {
+					resolve(buildCancelledAnswers(questions));
+					controller.abort();
+				};
+				opts.signal?.addEventListener("abort", cancelForAbort, { once: true });
 			});
-			return {
-				answers,
-				timedOut
-			};
-		} finally {
-			if (timer) clearTimeout(timer);
+			try {
+				const answers = await Promise.race([
+					opts.showQuestion(pending, { signal: controller.signal }),
+					timeoutPromise,
+					aborted
+				]);
+				const durationMs = Date.now() - startedAt;
+				if (isFullyCancelled(answers)) analytics.wizardCapture("wizard_ask cancelled", {
+					source: pending.source,
+					subject,
+					question_count: questions.length,
+					duration_ms: durationMs,
+					timed_out: timedOut
+				});
+				else analytics.wizardCapture("wizard_ask answered", {
+					source: pending.source,
+					subject,
+					question_count: questions.length,
+					duration_ms: durationMs
+				});
+				return {
+					answers,
+					timedOut
+				};
+			} finally {
+				if (timer) clearTimeout(timer);
+				if (cancelForAbort) opts.signal?.removeEventListener("abort", cancelForAbort);
+				pendingQuestions.delete(pending.id);
+			}
 		}
-	} };
+	};
 }
 //#endregion
-//#region src/lib/fetch-retry.ts
+//#region src/shared/fetch-retry.ts
 /**
 * One retry + failover policy for every critical-path fetch. GitHub is primary,
 * AWS is the fallback. A status a retry can't heal (404, 403) spends no retry
@@ -879,13 +930,12 @@ async function fetchWithRetry(url, opts = {}) {
 	throw new Error(`fetch ${url} failed — ${failures.join(" | ")}`);
 }
 //#endregion
-//#region src/lib/wizard-tools/tools.ts
+//#region src/shared/skill-menu.ts
 /**
-* Shared wizard-tool behavior — skill discovery/install, env-file helpers,
-* the wizard_ask cap policy, secret-vault plumbing, and the audit ledger.
-* One implementation consumed by both protocol facades: the MCP server
-* (`./mcp`) and the pi-native tools (`harness/pi/tools.ts`) — tool behavior
-* cannot drift between harnesses.
+* The skill menu: what context-mill publishes as `skill-menu.json` and how the
+* wizard reads it. Skill-backed CLI commands, the family picker, the skill
+* source screen and the agent's install path all resolve skills through this
+* one fetch, so it lives in shared and depends on nothing in the agent.
 */
 /** Expand a bundle entry into one entry per variant, so the menu reads the same whether a group ships bundled or as zips. */
 function expandBundleEntry(entry) {
@@ -915,6 +965,15 @@ async function fetchSkillMenu(skillsBaseUrl, opts = {}) {
 		return null;
 	}
 }
+//#endregion
+//#region src/agent/tools/tools.ts
+/**
+* Shared wizard-tool behavior — skill discovery/install, env-file helpers,
+* the wizard_ask cap policy, secret-vault plumbing, and the audit ledger.
+* One implementation consumed by both protocol facades: the MCP server
+* (`./mcp`) and the pi-native tools (`harness/pi/tools.ts`) — tool behavior
+* cannot drift between harnesses.
+*/
 /** Extract a zip buffer, refusing entries that escape destDir (zip-slip). */
 function extractZipArchive(zip, destDir) {
 	const root = path.resolve(destDir);
@@ -1097,7 +1156,7 @@ const WIZARD_ASK_SUBJECT_DESCRIPTION = "Short, stable tag naming what this call
 * server in `./mcp` and the pi-native mirror in `harness/pi/tools.ts`) so the
 * batching and cancellation contract reads identically in both harnesses.
 */
-const WIZARD_ASK_TOOL_DESCRIPTION = "Ask the user one or more structured questions and wait for their answers. Use this whenever you would otherwise inline a question in your text output. Batch every question about one subject into a single call (up to 8) rather than asking one at a time, and tag the call with `subject`. Walking a list — one call per data-warehouse source, one call per integration step — is expected and is never blocked, because the batching guard counts consecutive calls per subject. A fully cancelled or timed-out response does NOT count against the per-run cap, so nothing is wasted. When a field is not collected the result carries a `cancelled` object naming those question ids, whether the user dismissed the prompt or it timed out, and what to do next: read that instead of inspecting the answer values, and fall back gracefully (e.g. hand over a deep link) rather than re-asking.";
+const WIZARD_ASK_TOOL_DESCRIPTION = `Ask the user one or more structured questions and wait for their answers. Use this whenever you would otherwise inline a question in your text output. Batch every question about one subject into a single call (up to 12) rather than asking one at a time, and tag the call with \`subject\`. A subject needing more fields than one call carries — a connection form wider than the limit — is collected over consecutive calls reusing the same \`subject\`: that is expected, and is never a reason to abandon it for a link the user has to follow themselves. Walking a list — one call per data-warehouse source, one call per integration step — is expected and is never blocked, because the batching guard counts consecutive calls per subject. A fully cancelled or timed-out response does NOT count against the per-run cap, so nothing is wasted. When a field is not collected the result carries a \`cancelled\` object naming those question ids, whether the user dismissed the prompt or it timed out, and what to do next: read that instead of inspecting the answer values, and fall back gracefully (e.g. hand over a deep link) rather than re-asking.`;
 /**
 * Guidance returned with a `wizard_ask` result when the user dismissed the
 * prompt. Shared by both harness facades, like the descriptions above.
@@ -1176,7 +1235,7 @@ function evaluateAskCap({ callCount, maxQuestions, subject, subjectRunLength, ad
 		reason: "adjacency",
 		subject,
 		subjectRunLength,
-		message: `Not an error — this ask was not sent (a one-time nudge). You have sent ${subjectRunLength} wizard_ask calls in a row about the same subject (${subject === "(unspecified)" ? "they all declared no `subject`, so they count as one subject" : `they all used subject "${subject}"`}). Batch every question you still need for that subject into one call (up to 8 questions) and send wizard_ask again now. If your next questions are about something else — another data-warehouse source, another integration step — set a different \`subject\` on the call. Adjacency is counted per subject, so one call per source is never blocked, and you must not try to squeeze several sources into one 8-question call. Either way the next call is sent. Do not abandon the task, and do not fall back to browser setup because of this message.`
+		message: `Not an error — this ask was not sent (a one-time nudge). You have sent ${subjectRunLength} wizard_ask calls in a row about the same subject (${subject === "(unspecified)" ? "they all declared no `subject`, so they count as one subject" : `they all used subject "${subject}"`}). Batch every question you still need for that subject into one call (up to 12 questions) and send wizard_ask again now. If your next questions are about something else — another data-warehouse source, another integration step — set a different \`subject\` on the call. Adjacency is counted per subject, so one call per source is never blocked, and you must not try to squeeze several sources into one 12-question call. Either way the next call is sent. Do not abandon the task, and do not fall back to browser setup because of this message.`
 	};
 	return { kind: "ok" };
 }
@@ -1567,11 +1626,7 @@ const WIZARD_TOOL_NAMES = {
 	readHandoffs: `mcp__${SERVER_NAME}__read_handoffs`
 };
 //#endregion
-//#region src/lib/wizard-tools/handoff.ts
-/**
-* publish_handoff — the agent publishes the run's handoff doc (the report
-* markdown) in one explicit call, replacing the report file + watcher path.
-*/
+//#region src/agent/tools/handoff.ts
 const MAX_HANDOFF_TEXT_CHARS = 64 * 1024;
 const PUBLISH_HANDOFF_TOOL_NAME = "publish_handoff";
 /** Shared between the MCP server and the pi facade so the contract can't drift. */
@@ -1637,7 +1692,7 @@ function writeHandoffFileAtomically(targetPath, text) {
 		};
 	}
 }
-function publishHandoff(content) {
+function publishHandoff(content, emit) {
 	if (content.trim() === "") {
 		analytics.wizardCapture("handoff published", {
 			handoff_ok: false,
@@ -1650,7 +1705,10 @@ function publishHandoff(content) {
 	}
 	const truncated = content.length > MAX_HANDOFF_TEXT_CHARS;
 	const text = truncated ? content.slice(0, MAX_HANDOFF_TEXT_CHARS) : content;
-	getUI().setHandoffText(text);
+	emit?.({
+		kind: "handoff",
+		text
+	});
 	const handoffOutputPath = runtimeEnv("POSTHOG_HANDOFF_OUTPUT_PATH");
 	let handoffOutputWritten;
 	let handoffOutputError;
@@ -1677,7 +1735,7 @@ function publishHandoff(content) {
 	};
 }
 //#endregion
-//#region src/lib/secret-vault.ts
+//#region src/shared/secret-vault.ts
 /**
 * Session-scoped secret vault.
 *
@@ -1697,7 +1755,7 @@ function createSecretVault() {
 	const store = /* @__PURE__ */ new Map();
 	return {
 		put(value, meta) {
-			const ref = `${REF_PREFIX}${randomUUID()}`;
+			const ref = `${REF_PREFIX}${randomUUID$1()}`;
 			store.set(ref, {
 				value,
 				meta: {
@@ -1724,7 +1782,7 @@ function createSecretVault() {
 	};
 }
 //#endregion
-//#region src/lib/wizard-tools/mcp.ts
+//#region src/agent/tools/mcp.ts
 /**
 * MCP facade over `./tools` — the unified in-process server the anthropic
 * harness mounts. Declarations (zod schemas, descriptions) and the MCP result
@@ -1759,7 +1817,7 @@ async function getSDKModule$1() {
 * Must be called asynchronously because the SDK is an ESM module loaded via dynamic import.
 */
 async function createWizardToolsServer(options) {
-	const { workingDirectory, detectPackageManager, skillsBaseUrl, askBridge, askMaxQuestions = 10, secretVault = createSecretVault(), orchestrator, triageProvider } = options;
+	const { workingDirectory, detectPackageManager, skillsBaseUrl, askBridge, askMaxQuestions = 10, secretVault = createSecretVault(), orchestrator, triageProvider, emit } = options;
 	const { tool, createSdkMcpServer } = await getSDKModule$1();
 	const askAccounting = createAskAccounting(askMaxQuestions);
 	let cachedSkillMenu = {};
@@ -1961,7 +2019,7 @@ async function createWizardToolsServer(options) {
 			auditAddChecks,
 			auditResolveChecks,
 			tool("wizard_ask", WIZARD_ASK_TOOL_DESCRIPTION, {
-				questions: z.array(askQuestionSchema).min(1).max(8),
+				questions: z.array(askQuestionSchema).min(1).max(12),
 				subject: z.string().optional().describe(WIZARD_ASK_SUBJECT_DESCRIPTION)
 			}, async (args) => {
 				if (!askBridge) return {
@@ -2046,7 +2104,7 @@ async function createWizardToolsServer(options) {
 				}
 			}),
 			tool(PUBLISH_HANDOFF_TOOL_NAME, PUBLISH_HANDOFF_DESCRIPTION, { content: z.string().describe(PUBLISH_HANDOFF_CONTENT_DESCRIPTION) }, (args) => {
-				const result = publishHandoff(args.content);
+				const result = publishHandoff(args.content, emit);
 				logToFile(`publish_handoff: ${result.message}`);
 				return {
 					content: [{
@@ -2061,197 +2119,7 @@ async function createWizardToolsServer(options) {
 	});
 }
 //#endregion
-//#region src/lib/agent/runner/harness/pi/gateway.ts
-/**
-* PostHog AI gateway provider spec for pi sessions, shared by the linear run
-* and the orchestrator's per-task runs so both speak to the gateway
-* identically: bearer auth, the wizard properties header, transport shape
-* inferred from the model id. The caller registers the spec on its own
-* (lazily imported, properly typed) pi ModelRegistry.
-*/
-/** Provider registered on the in-memory registry for this run. */
-const GATEWAY_PROVIDER = "posthog-gateway";
-/**
-* The gateway speaks two shapes on two endpoints: Anthropic models over
-* `anthropic-messages` (the SDK appends `/v1/messages`, so the base URL has no
-* `/v1`), and OpenAI-class models (`openai/gpt-5`, …) over an OpenAI shape at
-* `/v1/responses` or `/v1/chat/completions` (base URL keeps `/v1`). Infer the
-* shape from the model id so a pair's model selects the right transport.
-*
-* OpenAI models take the Responses API because OpenAI rejects function tools
-* combined with `reasoning_effort` on chat completions and every task sends both.
-*/
-function gatewayApiFor(modelId) {
-	return modelId.startsWith("openai/") ? "openai-responses" : "anthropic-messages";
-}
-/**
-* Gateway HTTP headers, mirroring `buildAgentEnv` on the anthropic path: one
-* `X-PostHog-Properties` JSON blob (Bedrock fallback is native, so no opt-in)
-* plus the 1M context beta, since pi otherwise runs at 200k and overflows on
-* larger projects (the post-run compaction failures).
-*/
-function buildGatewayHeaders(wizardMetadata, wizardFlags, teamId) {
-	return {
-		"anthropic-beta": "context-1m-2025-08-07",
-		"X-PostHog-Properties": buildWizardPropertiesBlob(wizardMetadata, wizardFlags, teamId)
-	};
-}
-/**
-* One gateway model spec — the single description of how to reach a model on
-* the gateway. The provider spec below wraps it for pi's registry; one-shot
-* callers (scan triage) hand it straight to `completeSimple`.
-*/
-function buildGatewayModel(inputs) {
-	const { gatewayUrl, wizardMetadata, wizardFlags, modelId, teamId } = inputs;
-	const api = gatewayApiFor(modelId);
-	return {
-		id: modelId,
-		name: `${modelId} (PostHog Gateway)`,
-		api,
-		provider: GATEWAY_PROVIDER,
-		baseUrl: api === "anthropic-messages" ? gatewayUrl : `${gatewayUrl}/v1`,
-		reasoning: modelCapabilities(modelId).reasoning,
-		input: ["text"],
-		cost: {
-			input: 0,
-			output: 0,
-			cacheRead: 0,
-			cacheWrite: 0
-		},
-		contextWindow: 1e6,
-		maxTokens: 64e3,
-		headers: buildGatewayHeaders(wizardMetadata, wizardFlags, teamId)
-	};
-}
-/**
-* The provider object for `registry.registerProvider(GATEWAY_PROVIDER, …)`,
-* plus the derived traits the session setup needs (`caps.thinkingLevel`).
-*/
-function buildGatewayProvider(inputs) {
-	const { gatewayUrl, accessToken, modelId, effort } = inputs;
-	const api = gatewayApiFor(modelId);
-	const tableCaps = modelCapabilities(modelId);
-	const caps = effort && effort !== "off" && tableCaps.reasoning ? modelCapabilities(modelId, effort) : effort === "off" && tableCaps.reasoning ? {
-		...tableCaps,
-		thinkingLevel: "off"
-	} : tableCaps;
-	const model = buildGatewayModel(inputs);
-	return {
-		provider: {
-			name: "PostHog Gateway",
-			baseUrl: model.baseUrl,
-			apiKey: accessToken,
-			authHeader: true,
-			api,
-			headers: model.headers,
-			models: [model]
-		},
-		api,
-		caps,
-		gatewayUrl,
-		baseUrl: model.baseUrl
-	};
-}
-/**
-* Whether a turn's error is the gateway rejecting the bearer. pi attaches the
-* SDK's own error to `diagnostics`, so its code decides when one is present.
-* The message match is the fallback for a turn that failed before pi built a
-* diagnostic, where the status survives only as prose.
-*/
-function isGatewayAuthRejection(turn) {
-	const { errorMessage, diagnostics } = typeof turn === "string" ? {
-		errorMessage: turn,
-		diagnostics: void 0
-	} : turn ?? {};
-	for (const diagnostic of diagnostics ?? []) {
-		const code = diagnostic.error?.code;
-		if (code === 401 || code === "401") return true;
-		if (/^authentication_?error$/i.test(diagnostic.error?.name ?? "")) return true;
-	}
-	return /\b401\b|authentication_error|unauthorized/i.test(errorMessage ?? "");
-}
-/**
-* Wraps a pi session's prompt(): when a turn ends on a 401 from a bearer past
-* its refresh instant, mint once, re-register the provider with the new
-* bearer (pi resolves the apiKey per request), and continue. A 401 on a fresh
-* bearer, or a second one, is left to the harness's normal failure path.
-*/
-function withGatewayRemint(opts) {
-	let auth = opts.auth;
-	let rejected = false;
-	let reminted = false;
-	return {
-		noteAssistantTurn(message) {
-			const turn = message;
-			rejected = turn?.stopReason === "error" && isGatewayAuthRejection(turn);
-		},
-		async prompt(text) {
-			rejected = false;
-			await opts.session.prompt(text);
-			if (!rejected || reminted || !isPastRefresh(auth)) return;
-			reminted = true;
-			auth = await opts.refreshAuth();
-			opts.registry.registerProvider(GATEWAY_PROVIDER, buildGatewayProvider(opts.providerInputs(auth)).provider);
-			opts.onRemint?.();
-			rejected = false;
-			const next = opts.continueText;
-			await opts.session.prompt(typeof next === "function" ? next() : next);
-		}
-	};
-}
-//#endregion
-//#region src/lib/agent/triage-provider.ts
-const TRIAGE_MAX_TOKENS = 16384;
-const TRIAGE_TIMEOUT_MS = 2e4;
-/**
-* Triage provider for a harness. Auth is always explicit: every caller already
-* holds the gateway url and the run's token, and reading them back out of
-* ANTHROPIC_* made an unauthed provider silent — it returned undefined, the
-* caller failed closed, and a clean first-party skill got deleted. A resolver
-* is re-read on every call, so a run that re-mints mid-way scans with the
-* current bearer rather than the one it started with.
-*/
-function createTriageLLMProvider(auth, harness) {
-	const resolveAuth = typeof auth === "function" ? auth : () => Promise.resolve(auth);
-	const modelId = triageModelFor(harness);
-	const { reasoning, thinkingLevel } = modelCapabilities(modelId);
-	logToFile(`[YARA] triage provider ready (model: ${modelId}, api: ${gatewayApiFor(modelId)})`);
-	return async (prompt) => {
-		const { completeSimple } = await import("@earendil-works/pi-ai");
-		const current = await resolveAuth();
-		const authToken = current.authToken;
-		const model = buildGatewayModel({
-			gatewayUrl: current.baseURL,
-			accessToken: authToken,
-			teamId: current.teamId,
-			wizardMetadata: current.wizardMetadata ?? {},
-			wizardFlags: current.wizardFlags ?? {},
-			modelId
-		});
-		const controller = new AbortController();
-		const timer = setTimeout(() => controller.abort(), TRIAGE_TIMEOUT_MS);
-		try {
-			const message = await completeSimple(model, { messages: [{
-				role: "user",
-				content: prompt,
-				timestamp: Date.now()
-			}] }, {
-				apiKey: authToken,
-				temperature: model.api === "anthropic-messages" ? 0 : void 0,
-				maxTokens: TRIAGE_MAX_TOKENS,
-				reasoning: reasoning && thinkingLevel !== "off" ? thinkingLevel : void 0,
-				signal: controller.signal
-			});
-			const text = message.content.filter((c) => c.type === "text").map((c) => c.text).join("");
-			if (message.stopReason === "error") logToFile(`[YARA] triage call failed on ${model.id}: ${message.errorMessage ?? "unknown"} — every flagged match will be acted on`);
-			return text;
-		} finally {
-			clearTimeout(timer);
-		}
-	};
-}
-//#endregion
-//#region src/lib/agent/commandments.ts
+//#region src/agent/commandments.ts
 /**
 * Commandments true for every run, whatever program, sequence, harness, or model
 * it resolves to. Anything narrower belongs to its axis in
@@ -2284,7 +2152,7 @@ const WIZARD_COMMANDMENTS = [
 	].join("\n")
 ];
 //#endregion
-//#region src/lib/agent/runner/harness/pi/runtime-notes.ts
+//#region src/agent/runner/harness/pi/runtime-notes.ts
 const HEADER = ["## This runtime", "Below are important guidance on the harness constraints you are bound to. Follow them as commandments."];
 const PARALLEL_CALLS = "- When you need several INDEPENDENT operations — reading or searching multiple files, creating several insights — issue them as multiple tool calls in a SINGLE turn. They run in parallel and save round-trips; doing them one-per-turn is much slower. Only sequence calls when one needs a previous call’s output.";
 const EXPLORE = "- Explore with the `ls`, `find`, and `grep` tools (list a directory, find files by name, search file contents). `read` is for FILES only — reading a directory errors. NEVER inspect files through `bash`; `ls`, `find`, `cat`, `sed`, `head`, `xxd`, `python -c` and the like are all blocked. To see the exact bytes of a file (e.g. whitespace before a precise `edit`), use `read`.";
@@ -2342,7 +2210,7 @@ function piRuntimeNotes(sequence, caps) {
 	return notes.join("\n");
 }
 //#endregion
-//#region src/lib/agent/runner/switchboard/commandments.ts
+//#region src/agent/runner/switchboard/commandments.ts
 /**
 * LINEAR only. One session drives the whole run and holds the Task tools; an
 * orchestrator task session holds none of them and reports through
@@ -2389,7 +2257,7 @@ function assembleCommandments(axes) {
 	].filter(Boolean).join("\n");
 }
 //#endregion
-//#region src/lib/agent/agent-phase.ts
+//#region src/shared/agent-phase.ts
 /** Maps a Claude SDK tool name to the phase that tool implies. Returns null
 *  when the tool doesn't drive the visualizer (Task*, TodoWrite, etc.). */
 function classifyToolToStage(toolName) {
@@ -2402,7 +2270,35 @@ function classifyToolToStage(toolName) {
 	return null;
 }
 //#endregion
-//#region src/lib/agent/output-signals.ts
+//#region src/shared/auth-session-state.ts
+/**
+* Whether this run's OAuth grant is known to be dead.
+*
+* Process-global on purpose. A run has exactly one login, but the two sides of
+* this fact are far apart: the pre-run refresh learns it in `authenticate.ts`,
+* and the only consumer is the 401 handler inside the agent message loop, which
+* holds no session. Threading it would mean a field on `AgentConfig` set at four
+* `initializeAgent` call sites — and the session it would read from may be a
+* shallow copy (`prepareRunSession`), so the value could be written to one
+* object and read from another.
+*
+* A leaf module with no imports, so either side can depend on it without a cycle.
+*/
+let grantRevoked = false;
+/**
+* Record that the token endpoint permanently refused this grant. Not an abort:
+* the access token in hand may still have minutes of life, so the run continues
+* and this only decides what a later 401 gets blamed on.
+*/
+function markGrantRevoked() {
+	grantRevoked = true;
+}
+/** True once a token refresh failed because the grant itself is gone. */
+function isGrantRevoked() {
+	return grantRevoked;
+}
+//#endregion
+//#region src/agent/output-signals.ts
 /**
 * Parses the signal-bearing lines out of agent output and discards the rest.
 *
@@ -2509,7 +2405,7 @@ var AgentOutputSignals = class {
 	}
 };
 //#endregion
-//#region src/lib/agent/agent-env-isolation.ts
+//#region src/shared/agent-env-isolation.ts
 /**
 * Credential isolation for the Claude Agent SDK subprocess.
 *
@@ -2573,6 +2469,7 @@ const BLOCKED_OFF_NAMESPACE_KEYS = new Set(["AWS_BEARER_TOKEN_BEDROCK"]);
 const HOST_ONLY_ENV_KEYS = new Set([
 	"POSTHOG_HANDOFF_OUTPUT_PATH",
 	"POSTHOG_TASK_RUN_ID",
+	"POSTHOG_WIZARD_RUN_ID",
 	"POSTHOG_TASK_ID"
 ]);
 /**
@@ -2658,7 +2555,7 @@ function sanitizeAgentSubprocessEnv(env = process.env) {
 	return sanitized;
 }
 //#endregion
-//#region src/lib/agent/claude-settings.ts
+//#region src/shared/claude-settings.ts
 /**
 * Claude Code settings handling: conflict detection, backup/restore, and
 * orphan recovery.
@@ -2889,7 +2786,7 @@ function recoverOrphanedSettingsBackups(workingDirectory) {
 	}
 }
 //#endregion
-//#region src/lib/agent/stored-login.ts
+//#region src/agent/stored-login.ts
 /**
 * Detect a pre-existing Claude Code login on the machine.
 *
@@ -2969,7 +2866,7 @@ function detectStoredClaudeLogin(homeDir = os.homedir(), platform = process.plat
 	};
 }
 //#endregion
-//#region src/lib/agent/agent-interface.ts
+//#region src/agent/agent-interface.ts
 /**
 * Shared agent interface for PostHog wizards
 * Uses Claude Agent SDK directly with PostHog LLM gateway
@@ -3018,37 +2915,23 @@ function buildAuthErrorContext(workingDirectory, gatewayUrl, homeDir = os.homedi
 	};
 }
 /**
-* Create a stop hook callback that drains the additional feature queue,
-* then collects a remark, then allows stop.
+* Create a stop hook callback that collects a remark, then allows stop.
 *
-* Three-phase logic using closure state:
-*   Phase 1 — drain queue: block with each feature prompt in order
-*   Phase 2 — collect remark (once): block with remark prompt
-*   Phase 3 — allow stop: return {}
+* Two-phase logic using closure state:
+*   Phase 1 — collect remark (once): block with remark prompt
+*   Phase 2 — allow stop: return {}
 */
-function createStopHook(featureQueue, signals, requestRemark = true) {
-	let featureIndex = 0;
+function createStopHook(signals, requestRemark = true) {
 	let remarkRequested = false;
 	return (input) => {
 		logToFile("Stop hook triggered", {
 			stop_hook_active: input.stop_hook_active,
-			featureIndex,
-			remarkRequested,
-			queueLength: featureQueue.length
+			remarkRequested
 		});
 		if (signals?.hasApiError()) {
 			logToFile("Stop hook: API error detected, allowing immediate stop");
 			return {};
 		}
-		if (featureIndex < featureQueue.length) {
-			const feature = featureQueue[featureIndex++];
-			const prompt = ADDITIONAL_FEATURE_PROMPTS[feature];
-			logToFile(`Stop hook: injecting feature prompt for ${feature}`);
-			return {
-				decision: "block",
-				reason: prompt
-			};
-		}
 		if (requestRemark && !remarkRequested) {
 			remarkRequested = true;
 			logToFile("Stop hook: requesting reflection");
@@ -3061,6 +2944,7 @@ function createStopHook(featureQueue, signals, requestRemark = true) {
 		return {};
 	};
 }
+const NO_PROGRESS = () => void 0;
 /**
 * Global identifiers attached to every LLM gateway trace for a run. They ride on
 * each `$ai_generation` the gateway emits (in the `X-PostHog-Properties` blob
@@ -3113,6 +2997,10 @@ function buildAgentEnv(wizardMetadata, wizardFlags, teamId) {
 * this guard is a belt-and-suspenders second line.
 */
 function wizardCanUseTool(toolName, input, context = {}) {
+	if (context.readOnly && !READ_ONLY_TOOLS.includes(toolName)) return {
+		behavior: "deny",
+		message: `Tool ${toolName} is disabled for read-only runs.`
+	};
 	if (context.disallowedTools?.includes(toolName)) {
 		logToFile(`Denying disallowed tool: ${toolName}`);
 		return {
@@ -3188,9 +3076,10 @@ async function initializeAgent(config, options) {
 	initLogFile();
 	logToFile("Agent initialization starting");
 	logToFile("Install directory:", options.installDir);
+	const emit = config.emit ?? NO_PROGRESS;
 	try {
 		process.env.CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS = "true";
-		const currentGatewayAuth = () => gatewayAuth(config.host, config.posthogApiKey, config.programId);
+		const currentGatewayAuth = async () => gatewayAuth(config.host, await config.currentPosthogApiKey?.() ?? config.posthogApiKey, config.programId);
 		const auth = await currentGatewayAuth();
 		const gatewayUrl = auth.gatewayUrl;
 		process.env.ANTHROPIC_BASE_URL = gatewayUrl;
@@ -3244,16 +3133,20 @@ async function initializeAgent(config, options) {
 			askBridge: config.askBridge,
 			askMaxQuestions: config.askMaxQuestions,
 			orchestrator: config.orchestrator,
-			triageProvider
+			triageProvider,
+			emit: config.emit
 		});
 		const model = config.modelOverride ?? "claude-sonnet-5";
 		const agentRunConfig = {
 			workingDirectory: config.workingDirectory,
 			mcpServers,
 			model,
+			outputFormat: config.outputFormat,
 			posthogApiKey: config.posthogApiKey,
+			currentPosthogApiKey: config.currentPosthogApiKey,
 			wizardFlags: config.wizardFlags,
 			wizardMetadata: config.wizardMetadata,
+			readOnly: config.readOnly,
 			allowedTools: config.allowedTools,
 			disallowedTools: config.disallowedTools,
 			getPendingQuestion: config.getPendingQuestion,
@@ -3263,7 +3156,8 @@ async function initializeAgent(config, options) {
 			gatewayAuth: auth,
 			refreshGatewayAuth: currentGatewayAuth,
 			program: config.integrationLabel,
-			sequence: config.orchestrator ? "orchestrator" : "linear"
+			sequence: config.orchestrator ? "orchestrator" : "linear",
+			emit
 		};
 		logToFile("Agent config:", {
 			workingDirectory: agentRunConfig.workingDirectory,
@@ -3280,7 +3174,11 @@ async function initializeAgent(config, options) {
 		prewarmYaraScanner();
 		return agentRunConfig;
 	} catch (error) {
-		getUI().log.error(`Failed to initialize agent: ${error.message}`);
+		emit({
+			kind: "log",
+			level: "error",
+			message: `Failed to initialize agent: ${error.message}`
+		});
 		logToFile("Agent initialization error:", error);
 		debug("Agent initialization error:", error);
 		throw error;
@@ -3292,7 +3190,40 @@ async function initializeAgent(config, options) {
 *
 * @returns An object containing any error detected in the agent's output
 */
+function sdkErrorStatus(value) {
+	if (typeof value === "number" && value >= 400 && value < 600) return value;
+	if (typeof value === "string") {
+		const match = value.match(/(?:^|\b)(4\d\d|5\d\d)(?:\b|$)/);
+		return match ? Number(match[1]) : void 0;
+	}
+	if (value && typeof value === "object") {
+		const record = value;
+		return sdkErrorStatus(record.status) ?? sdkErrorStatus(record.statusCode) ?? sdkErrorStatus(record.code) ?? sdkErrorStatus(record.error);
+	}
+}
+function sdkResultFailure(message) {
+	if (message.subtype === "success" && message.is_error !== true) return void 0;
+	const errors = Array.isArray(message.errors) ? message.errors : [];
+	const detail = errors.map((error) => typeof error === "string" ? error : JSON.stringify(error)).join("; ") || (typeof message.result === "string" ? message.result : String(message.subtype ?? "SDK result failed"));
+	const status = sdkErrorStatus(message.api_error_status) ?? sdkErrorStatus(message.status) ?? errors.map(sdkErrorStatus).find((code) => code !== void 0) ?? sdkErrorStatus(message.result);
+	if (message.subtype === "error_max_structured_output_retries") return {
+		kind: "failure",
+		classification: "WIZARD_INVALID_STRUCTURED_OUTPUT",
+		message: detail
+	};
+	return {
+		kind: "failure",
+		classification: status === 429 ? "WIZARD_RATE_LIMIT" : "WIZARD_API_ERROR",
+		message: detail
+	};
+}
 async function runAgent(agentConfig, prompt, options, spinner, config, middleware) {
+	if (agentConfig.signal?.aborted) return {
+		kind: "abort",
+		classification: "WIZARD_ABORT",
+		message: "Agent run cancelled"
+	};
+	const emit = agentConfig.emit ?? NO_PROGRESS;
 	const { spinnerMessage = "Customizing your PostHog setup...", successMessage = "PostHog integration complete", errorMessage = "Integration failed", abortCases = [], emitStepEvents = false, resolveStepKey } = config ?? {};
 	logToFile("Starting agent run");
 	const { query } = await getSDKModule();
@@ -3306,6 +3237,8 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 	let receivedSuccessResult = false;
 	let loggedInitialContext = false;
 	let lastResultMessage = null;
+	let terminalFailure;
+	let assistantErrorStatus;
 	const tasks = /* @__PURE__ */ new Map();
 	let signalDone = () => void 0;
 	const createPromptStream = (text) => {
@@ -3350,23 +3283,36 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 			...config?.analyticsProperties
 		});
 		const totalCostUsd = Number(lastResultMessage?.total_cost_usd ?? 0);
-		if (totalCostUsd > 0) getUI().setFinalTokenCostUsd(totalCostUsd);
+		if (totalCostUsd > 0) emit({
+			kind: "finalCost",
+			usd: totalCostUsd
+		});
 		try {
 			middleware?.finalize(lastResultMessage, durationMs);
 		} catch (e) {
 			logToFile(`${AgentSignals.BENCHMARK} Middleware finalize error:`, e);
 		}
 		spinner.stop(successMessage);
-		return {};
+		return {
+			kind: "success",
+			structuredOutput: lastResultMessage?.structured_output
+		};
 	};
 	let abortController = new AbortController();
+	const onExternalAbort = () => {
+		abortController.abort();
+		signalDone();
+	};
 	let timedOut = false;
 	let abortReason = null;
 	let yaraViolationReason = null;
 	let sessionId;
 	let reminted = false;
 	let remintRequested = false;
+	let authFailure;
 	const agentConfigDir = createIsolatedAgentConfigDir();
+	agentConfig.signal?.addEventListener("abort", onExternalAbort, { once: true });
+	if (agentConfig.signal?.aborted) onExternalAbort();
 	const timeoutMs = config?.timeoutMs;
 	const timeoutId = timeoutMs ? setTimeout(() => {
 		if (receivedSuccessResult) return;
@@ -3376,7 +3322,7 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 	}, timeoutMs) : void 0;
 	try {
 		const disallow = new Set(agentConfig.disallowedTools ?? []);
-		const allowedTools = [...BASE_ALLOWED_TOOLS, ...agentConfig.allowedTools ?? []].filter((t) => !disallow.has(t));
+		const allowedTools = (agentConfig.readOnly ? READ_ONLY_TOOLS : [...BASE_ALLOWED_TOOLS, ...agentConfig.allowedTools ?? []]).filter((t) => !disallow.has(t));
 		const inheritedMcpServerNames = Object.keys(agentConfig.mcpServers);
 		const triageProvider = agentConfig.triageProvider;
 		const onYaraTerminate = (reason) => {
@@ -3399,18 +3345,19 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 					abortController,
 					resume,
 					model: agentConfig.model,
+					outputFormat: agentConfig.outputFormat,
 					cwd: agentConfig.workingDirectory,
-					permissionMode: "acceptEdits",
+					permissionMode: agentConfig.readOnly ? "default" : "acceptEdits",
 					betas: ["context-1m-2025-08-07"],
-					mcpServers: agentConfig.mcpServers,
-					agents: { "general-purpose": {
+					mcpServers: agentConfig.readOnly ? {} : agentConfig.mcpServers,
+					agents: agentConfig.readOnly ? void 0 : { "general-purpose": {
 						description: "General-purpose subagent. Inherits the parent run's tools plus the PostHog and wizard-tools MCP servers, so it can call mcp__posthog-wizard__* directly instead of curling the REST API.",
 						prompt: "You are a general-purpose subagent for the PostHog wizard. Prefer the authenticated mcp__posthog-wizard__* MCP tools over raw HTTP — they are already authenticated for this project. Only fall back to other transports if no MCP tool covers the operation.",
 						mcpServers: inheritedMcpServerNames,
 						disallowedTools: agentConfig.disallowedTools ? [...agentConfig.disallowedTools] : void 0
 					} },
-					settingSources: ["project"],
-					skills: "all",
+					settingSources: agentConfig.readOnly ? [] : ["project"],
+					skills: agentConfig.readOnly ? [] : "all",
 					allowedTools,
 					sandbox: {
 						enabled: true,
@@ -3457,7 +3404,7 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 						CLAUDE_CODE_OAUTH_TOKEN: agentConfig.gatewayAuth.token,
 						CLAUDE_CONFIG_DIR: agentConfigDir,
 						CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS: "true",
-						POSTHOG_MCP_TOKEN: agentConfig.posthogApiKey,
+						POSTHOG_MCP_TOKEN: await agentConfig.currentPosthogApiKey?.() ?? agentConfig.posthogApiKey,
 						MCP_CONNECTION_NONBLOCKING: "0",
 						ANTHROPIC_CUSTOM_HEADERS: buildAgentEnv(agentConfig.wizardMetadata ?? {}, agentConfig.wizardFlags ?? {}, agentConfig.gatewayAuth.teamId)
 					},
@@ -3467,6 +3414,7 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 							input
 						});
 						const result = wizardCanUseTool(toolName, input, {
+							readOnly: agentConfig.readOnly,
 							wizardAskPending: agentConfig.getPendingQuestion?.() != null,
 							disallowedTools: agentConfig.disallowedTools
 						});
@@ -3482,7 +3430,7 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 							harness: "anthropic"
 						})
 					},
-					tools: {
+					tools: agentConfig.readOnly ? [...READ_ONLY_TOOLS] : {
 						type: "preset",
 						preset: "claude_code"
 					},
@@ -3494,7 +3442,7 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 						PreToolUse: warlockDisabled ? [] : createPreToolUseYaraHooks(triageProvider, onYaraTerminate),
 						PostToolUse: warlockDisabled ? [] : createPostToolUseYaraHooks(triageProvider, onYaraTerminate),
 						Stop: [{
-							hooks: [createStopHook(config?.additionalFeatureQueue ?? [], signals, config?.requestRemark ?? true)],
+							hooks: [createStopHook(signals, config?.requestRemark ?? true)],
 							timeout: 30
 						}]
 					}
@@ -3521,7 +3469,8 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 						loggedInitialContext = true;
 					}
 					agentConfig.capture?.captureFromAnthropicSDKMessage(message);
-					handleSDKMessage(message, options, spinner, signals, receivedSuccessResult, tasks, agentConfig.suppressTaskRender ?? false, emitStepEvents, resolveStepKey);
+					handleSDKMessage(message, options, spinner, signals, emit, receivedSuccessResult, tasks, agentConfig.suppressTaskRender ?? false, emitStepEvents, resolveStepKey);
+					if (message.type === "assistant") assistantErrorStatus = sdkErrorStatus(message.error) ?? assistantErrorStatus;
 					if (abortCases.length > 0 && !abortReason && message.type === "assistant") {
 						const content = message.message?.content;
 						if (Array.isArray(content)) {
@@ -3537,9 +3486,9 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 							}
 						}
 					}
-					if (message.type === "assistant" && signals.hasApiErrorStatus(401)) {
+					if (message.type === "assistant" && sdkErrorStatus(message.error) === 401 || message.type === "result" && (sdkErrorStatus(message.api_error_status) === 401 || sdkErrorStatus(message.status) === 401) || message.type === "result" && Array.isArray(message.errors) && message.errors.some((error) => sdkErrorStatus(error) === 401)) {
 						signalDone();
-						if (agentConfig.refreshGatewayAuth && !reminted && isPastRefresh(agentConfig.gatewayAuth)) {
+						if (agentConfig.refreshGatewayAuth && !reminted && isPastRefresh(agentConfig.gatewayAuth) && !agentConfig.signal?.aborted) {
 							logToFile("Agent error: 401 on an aged gateway bearer; re-minting");
 							remintRequested = true;
 							abortController.abort();
@@ -3560,27 +3509,33 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 							...authError,
 							sessionExpired
 						});
-						getUI().showAuthError({
-							hasSettingsConflict: authError.hasSettingsConflict,
-							conflicts: authError.conflicts,
-							usingManagedLogin: authError.usingManagedLogin,
-							credentialPlaces: authError.credentialPlaces,
-							sessionExpired,
-							logFilePath: getLogFilePath()
-						});
-						await wizardAbort({
+						authFailure = {
 							code: authCode,
 							message: "Authentication failed (401)",
-							error: new WizardError("Authentication failed", {
+							authErrorDetail: {
+								hasSettingsConflict: authError.hasSettingsConflict,
+								conflicts: authError.conflicts,
+								usingManagedLogin: authError.usingManagedLogin,
+								credentialPlaces: authError.credentialPlaces,
+								sessionExpired,
+								logFilePath: getLogFilePath()
+							},
+							detail: {
 								hasSettingsConflict: authError.hasSettingsConflict,
 								conflictSources: authError.conflictSources,
 								conflictKeys: authError.conflictKeys,
+								conflicts: authError.conflicts,
+								credentialPlaces: authError.credentialPlaces,
+								sessionExpired,
+								logFilePath: getLogFilePath(),
 								gatewayUrl: authError.gatewayUrl,
 								region: authError.region,
 								usingManagedLogin: authError.usingManagedLogin,
 								apiKeySource: authError.apiKeySource
-							}, authCode)
-						});
+							}
+						};
+						abortController.abort();
+						break;
 					}
 					try {
 						middleware?.onMessage(message);
@@ -3591,66 +3546,112 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 						if (message.subtype === "success" && !message.is_error) {
 							receivedSuccessResult = true;
 							lastResultMessage = message;
+						} else if (!receivedSuccessResult) {
+							terminalFailure = sdkResultFailure(message);
+							if (terminalFailure && assistantErrorStatus === 429) terminalFailure = {
+								...terminalFailure,
+								classification: "WIZARD_RATE_LIMIT"
+							};
 						}
 						signalDone();
 					}
 				}
 			} catch (error) {
 				if (remintRequested) return "remint";
+				if (authFailure) return "done";
 				throw error;
 			}
 			return remintRequested ? "remint" : "done";
 		};
 		const refreshGatewayAuth = agentConfig.refreshGatewayAuth;
-		if (await runQuery() === "remint" && refreshGatewayAuth) {
+		if (await runQuery() === "remint" && refreshGatewayAuth && !agentConfig.signal?.aborted) {
 			reminted = true;
 			remintRequested = false;
 			abortController = new AbortController();
+			if (agentConfig.signal?.aborted) abortController.abort();
 			signals.forgetApiErrors();
 			spinner.message("Renewing the gateway token...");
 			const stale = agentConfig.gatewayAuth;
 			agentConfig.gatewayAuth = await refreshGatewayAuth();
+			if (agentConfig.signal?.aborted) return {
+				kind: "abort",
+				classification: "WIZARD_ABORT",
+				message: "Agent run cancelled"
+			};
 			logToFile(`Gateway token renewed after a 401 (${Math.round((Date.now() - stale.refreshAtMs) / 1e3)}s past refresh); resuming session ${sessionId ?? "(none: fresh session)"}`);
 			analytics.wizardCapture("gateway token reminted", { resumed: sessionId !== void 0 });
 			spinner.message(spinnerMessage);
 			await runQuery(sessionId);
 		}
+		if (authFailure) return {
+			kind: "decided_failure",
+			failure: authFailure
+		};
+		if (agentConfig.signal?.aborted) return {
+			kind: "abort",
+			classification: "WIZARD_ABORT",
+			message: "Agent run cancelled"
+		};
 		if (yaraViolationReason) {
 			logToFile("Agent error: YARA_VIOLATION");
 			spinner.stop("Security check stopped the setup");
-			return { error: "WIZARD_YARA_VIOLATION" };
+			return {
+				kind: "failure",
+				classification: "WIZARD_YARA_VIOLATION"
+			};
 		}
 		if (abortReason) {
 			spinner.stop("Wizard aborted");
 			return {
-				error: "WIZARD_ABORT",
+				kind: "abort",
+				classification: "WIZARD_ABORT",
 				message: abortReason
 			};
 		}
+		if (agentConfig.signal?.aborted) {
+			spinner.stop("Wizard aborted");
+			return {
+				kind: "abort",
+				classification: "WIZARD_ABORT",
+				message: "Agent run cancelled"
+			};
+		}
 		if (timedOut) {
 			spinner.stop("Agent run timed out");
 			return {
-				error: "WIZARD_AGENTIC_DETECTION_TIMEOUT",
+				kind: "failure",
+				classification: "WIZARD_AGENTIC_DETECTION_TIMEOUT",
 				message: `Agent run timed out after ${timeoutMs / 1e3}s`
 			};
 		}
 		if (signals.has("MCP_MISSING")) {
 			logToFile("Agent error: MCP_MISSING");
 			spinner.stop("Agent could not access PostHog MCP");
-			return { error: "WIZARD_MCP_MISSING" };
+			return {
+				kind: "failure",
+				classification: "WIZARD_MCP_MISSING"
+			};
 		}
 		if (signals.has("RESOURCE_MISSING")) {
 			logToFile("Agent error: RESOURCE_MISSING");
 			spinner.stop("Agent could not access setup resource");
-			return { error: "WIZARD_RESOURCE_MISSING" };
+			return {
+				kind: "failure",
+				classification: "WIZARD_RESOURCE_MISSING"
+			};
 		}
 		if (receivedSuccessResult) return completeWithSuccess();
+		if (terminalFailure) {
+			spinner.stop(errorMessage);
+			return terminalFailure;
+		}
 		const apiErrorMessage = signals.apiErrorMessage() ?? "Unknown API error";
 		if (signals.hasApiErrorStatus(429)) {
 			logToFile("Agent error: RATE_LIMIT");
 			spinner.stop("Rate limit exceeded");
 			return {
-				error: "WIZARD_RATE_LIMIT",
+				kind: "failure",
+				classification: "WIZARD_RATE_LIMIT",
 				message: apiErrorMessage
 			};
 		}
@@ -3658,65 +3659,99 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 			logToFile("Agent error: API_ERROR");
 			spinner.stop("API error occurred");
 			return {
-				error: "WIZARD_API_ERROR",
+				kind: "failure",
+				classification: "WIZARD_API_ERROR",
 				message: apiErrorMessage
 			};
 		}
-		return completeWithSuccess();
+		spinner.stop(errorMessage);
+		return {
+			kind: "failure",
+			classification: "WIZARD_API_ERROR",
+			message: "SDK stream ended without a success result"
+		};
 	} catch (error) {
 		signalDone();
 		if (yaraViolationReason) {
 			logToFile("Agent error: YARA_VIOLATION");
 			spinner.stop("Security check stopped the setup");
-			return { error: "WIZARD_YARA_VIOLATION" };
+			return {
+				kind: "failure",
+				classification: "WIZARD_YARA_VIOLATION"
+			};
 		}
 		if (abortReason) {
 			spinner.stop("Wizard aborted");
 			return {
-				error: "WIZARD_ABORT",
+				kind: "abort",
+				classification: "WIZARD_ABORT",
 				message: abortReason
 			};
 		}
+		if (agentConfig.signal?.aborted) {
+			spinner.stop("Wizard aborted");
+			return {
+				kind: "abort",
+				classification: "WIZARD_ABORT",
+				message: "Agent run cancelled"
+			};
+		}
 		if (receivedSuccessResult) return completeWithSuccess(error);
 		if (timedOut) {
 			spinner.stop("Agent run timed out");
 			return {
-				error: "WIZARD_AGENTIC_DETECTION_TIMEOUT",
+				kind: "failure",
+				classification: "WIZARD_AGENTIC_DETECTION_TIMEOUT",
 				message: `Agent run timed out after ${timeoutMs / 1e3}s`
 			};
 		}
+		if (terminalFailure) {
+			spinner.stop(errorMessage);
+			return terminalFailure;
+		}
 		const apiErrorMessage = signals.apiErrorMessage() ?? "Unknown API error";
 		if (signals.hasApiErrorStatus(429)) {
 			logToFile("Agent error (caught): RATE_LIMIT");
 			spinner.stop("Rate limit exceeded");
 			return {
-				error: "WIZARD_RATE_LIMIT",
-				message: apiErrorMessage
+				kind: "failure",
+				classification: "WIZARD_RATE_LIMIT",
+				message: apiErrorMessage,
+				error: error instanceof Error ? error : void 0
 			};
 		}
 		if (signals.hasApiError()) {
 			logToFile("Agent error (caught): API_ERROR");
 			spinner.stop("API error occurred");
 			return {
-				error: "WIZARD_API_ERROR",
-				message: apiErrorMessage
+				kind: "failure",
+				classification: "WIZARD_API_ERROR",
+				message: apiErrorMessage,
+				error: error instanceof Error ? error : void 0
 			};
 		}
 		spinner.stop(errorMessage);
-		getUI().log.error(`Error: ${error.message}`);
+		emit({
+			kind: "log",
+			level: "error",
+			message: `Error: ${error.message}`
+		});
 		logToFile("Agent run failed:", error);
 		debug("Full error:", error);
 		throw error;
 	} finally {
+		agentConfig.signal?.removeEventListener("abort", onExternalAbort);
 		if (timeoutId) clearTimeout(timeoutId);
-		if (!receivedSuccessResult) {
+		if (!receivedSuccessResult && !authFailure) {
 			const durationMs = Date.now() - startTime;
-			analytics.wizardCapture("agent aborted", {
-				duration_ms: durationMs,
-				duration_seconds: Math.round(durationMs / 1e3),
-				model: agentConfig.model,
-				...config?.analyticsProperties
-			});
+			try {
+				analytics.wizardCapture("agent aborted", {
+					duration_ms: durationMs,
+					duration_seconds: Math.round(durationMs / 1e3),
+					model: agentConfig.model,
+					...config?.analyticsProperties
+				});
+			} catch {}
 		}
 	}
 }
@@ -3750,6 +3785,11 @@ let TaskTool = /* @__PURE__ */ function(TaskTool) {
 * init handler has to recognise this server in the SDK's status report.
 */
 const POSTHOG_MCP_SERVER_NAME = "posthog-wizard";
+const READ_ONLY_TOOLS = [
+	"Read",
+	"Glob",
+	"Grep"
+];
 const BASE_ALLOWED_TOOLS = [
 	"Read",
 	"Write",
@@ -3761,10 +3801,18 @@ const BASE_ALLOWED_TOOLS = [
 	"ListMcpResourcesTool",
 	...Object.values(WIZARD_TOOL_NAMES)
 ];
+const taskSources = /* @__PURE__ */ new WeakMap();
 function handleTaskCreate(block, store) {
 	const input = block.input;
 	if (!input?.subject) return;
+	let source = taskSources.get(store.tasks);
+	if (!source) {
+		source = randomUUID();
+		taskSources.set(store.tasks, source);
+	}
 	store.tasks.set(block.id, {
+		id: randomUUID(),
+		source,
 		content: input.subject,
 		status: "pending",
 		activeForm: input.activeForm
@@ -3790,6 +3838,8 @@ function handleTaskUpdate(block, store) {
 			});
 		}
 		store.tasks.set(input.taskId, {
+			id: existing.id,
+			source: existing.source,
 			content: input.subject ?? existing.content,
 			status: input.status ?? existing.status,
 			activeForm: input.activeForm ?? existing.activeForm
@@ -3899,7 +3949,7 @@ function reportMcpSetup(message) {
 		mcp_servers: servers.map((s) => `${s.name}:${s.status}`).join(",")
 	});
 }
-function handleSDKMessage(message, options, spinner, signals, receivedSuccessResult = false, tasks, suppressTaskRender = false, emitStepEvents = false, resolveStepKey) {
+function handleSDKMessage(message, options, spinner, signals, emit, receivedSuccessResult = false, tasks, suppressTaskRender = false, emitStepEvents = false, resolveStepKey) {
 	const STATUS_RANK = {
 		completed: 0,
 		in_progress: 1
@@ -3907,15 +3957,20 @@ function handleSDKMessage(message, options, spinner, signals, receivedSuccessRes
 	const rank = (status) => STATUS_RANK[status] ?? 2;
 	const syncTasks = () => {
 		if (!tasks || suppressTaskRender) return;
-		const sorted = Array.from(tasks.values()).sort((a, b) => rank(a.status) - rank(b.status));
-		getUI().syncTodos(sorted);
+		emit({
+			kind: "tasks",
+			tasks: Array.from(tasks.values()).sort((a, b) => rank(a.status) - rank(b.status)).map((t) => ({ ...t }))
+		});
 	};
 	logToFile(`SDK Message: ${message.type}`, JSON.stringify(message, null, 2));
 	if (options.debug) debug(`SDK Message type: ${message.type}`);
 	switch (message.type) {
 		case "assistant": {
 			const tokenUsageDelta = extractTokenUsageDelta(message);
-			if (tokenUsageDelta) getUI().addTokenUsage(tokenUsageDelta);
+			if (tokenUsageDelta) emit({
+				kind: "usage",
+				delta: tokenUsageDelta
+			});
 			const content = message.message?.content;
 			if (Array.isArray(content)) for (const block of content) {
 				if (block.type === "text" && typeof block.text === "string") {
@@ -3924,15 +3979,26 @@ function handleSDKMessage(message, options, spinner, signals, receivedSuccessRes
 					const statusMatch = block.text.match(statusRegex);
 					if (statusMatch) {
 						const statusText = statusMatch[1].trim();
-						getUI().pushStatus(statusText);
+						emit({
+							kind: "status",
+							message: statusText
+						});
 						spinner.message(statusText);
 					}
 					const dashboardRegex = new RegExp(`${AgentSignals.DASHBOARD_URL.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*(\\S+)`, "m");
 					const dashboardMatch = block.text.match(dashboardRegex);
-					if (dashboardMatch) getUI().setDashboardUrl(dashboardMatch[1].trim());
+					if (dashboardMatch) emit({
+						kind: "url",
+						which: "dashboard",
+						url: dashboardMatch[1].trim()
+					});
 					const notebookRegex = new RegExp(`${AgentSignals.NOTEBOOK_URL.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*(\\S+)`, "m");
 					const notebookMatch = block.text.match(notebookRegex);
-					if (notebookMatch) getUI().setNotebookUrl(notebookMatch[1].trim());
+					if (notebookMatch) emit({
+						kind: "url",
+						which: "notebook",
+						url: notebookMatch[1].trim()
+					});
 				}
 				if (block.type === "tool_use" && tasks && Object.values(TaskTool).includes(block.name)) dispatchTaskToolUse(block, {
 					tasks,
@@ -3942,7 +4008,10 @@ function handleSDKMessage(message, options, spinner, signals, receivedSuccessRes
 				});
 				if (block.type === "tool_use") {
 					const stage = classifyToolToStage(block.name);
-					if (stage) getUI().setStage(stage);
+					if (stage) emit({
+						kind: "stage",
+						stage
+					});
 				}
 			}
 			break;
@@ -3966,7 +4035,11 @@ function handleSDKMessage(message, options, spinner, signals, receivedSuccessRes
 				logToFile("Agent result with error:", message.result);
 				if (typeof message.result === "string") signals.push(message.result);
 				if (message.errors && !receivedSuccessResult) for (const err of message.errors) {
-					getUI().log.error(`Error: ${err}`);
+					emit({
+						kind: "log",
+						level: "error",
+						message: `Error: ${err}`
+					});
 					logToFile("ERROR:", err);
 				}
 			} else if (message.subtype === "success") {
@@ -3975,7 +4048,11 @@ function handleSDKMessage(message, options, spinner, signals, receivedSuccessRes
 			} else {
 				logToFile("Agent result with error:", message.result);
 				if (message.errors && !receivedSuccessResult) for (const err of message.errors) {
-					getUI().log.error(`Error: ${err}`);
+					emit({
+						kind: "log",
+						level: "error",
+						message: `Error: ${err}`
+					});
 					logToFile("ERROR:", err);
 				}
 			}
@@ -3998,6 +4075,6 @@ function handleSDKMessage(message, options, spinner, signals, receivedSuccessRes
 	}
 }
 //#endregion
-export { resolveEnvSecretRefs as $, AUDIT_STATUSES as A, checkEnvKeys as B, publishHandoff as C, AUDIT_RESOLVE_CHECKS_PARAM_DESCRIPTION as D, AUDIT_RESOLVE_CHECKS_DESCRIPTION as E, WIZARD_ASK_SENSITIVE_DESCRIPTION as F, fetchSkillMenu as G, describeAskCancellation as H, WIZARD_ASK_SUBJECT_DESCRIPTION as I, mergeEnvValues as J, installSkillById as K, WIZARD_ASK_TOOL_DESCRIPTION as L, CHECK_ENV_KEYS_FILE_PATH_DESCRIPTION as M, ENV_FILE_PATH_DESCRIPTION as N, AUDIT_SEED_CHECKS_DESCRIPTION as O, WIZARD_ASK_KIND_DESCRIPTION as P, resolveEnvPath as Q, WIZARD_TOOL_NAMES as R, PUBLISH_HANDOFF_TOOL_NAME as S, AUDIT_ADD_CHECKS_PARAM_DESCRIPTION as T, downloadSkill as U, createAskAccounting as V, ensureGitignoreCoverage as W, resolveAskQuestionKinds as X, normaliseAskSubject as Y, resolveAuditChecks as Z, buildGatewayProvider as _, wizardCanUseTool as a, createWizardAskBridge as at, PUBLISH_HANDOFF_CONTENT_DESCRIPTION as b, checkAllSettingsConflicts as c, isEnvFileName as ct, restoreClaudeSettings as d, markGrantRevoked as dt, seedAuditChecks as et, sanitizeAgentSubprocessEnv as f, GATEWAY_PROVIDER as g, createTriageLLMProvider as h, runAgent as i, LONGER_ASK_TIMEOUT_MS as it, CHECK_ENV_KEYS_DESCRIPTION as j, AUDIT_SEED_CHECKS_PARAM_DESCRIPTION as k, classifySettingsConflicts as l, parseEnvKeyNames as lt, assembleCommandments as m, buildRunTags as n, vaultSensitiveAnswers as nt, createIsolatedAgentConfigDir as o, isFullyCancelled as ot, AgentOutputSignals as p, legacyKeyNameRefusal as q, initializeAgent as r, fetchWithRetry as rt, backupAndFixClaudeSettings as s, MAX_ENV_KEY_SET as st, buildAgentEnv as t, templateEnvWriteRefusal as tt, recoverOrphanedSettingsBackups as u, toPromptSafeRelativePath as ut, withGatewayRemint as v, AUDIT_ADD_CHECKS_DESCRIPTION as w, PUBLISH_HANDOFF_DESCRIPTION as x, createSecretVault as y, addAuditChecks as z };
+export { vaultSensitiveAnswers as $, CHECK_ENV_KEYS_FILE_PATH_DESCRIPTION as A, describeAskCancellation as B, AUDIT_ADD_CHECKS_PARAM_DESCRIPTION as C, AUDIT_SEED_CHECKS_PARAM_DESCRIPTION as D, AUDIT_SEED_CHECKS_DESCRIPTION as E, WIZARD_ASK_TOOL_DESCRIPTION as F, mergeEnvValues as G, ensureGitignoreCoverage as H, WIZARD_TOOL_NAMES as I, resolveAuditChecks as J, normaliseAskSubject as K, addAuditChecks as L, WIZARD_ASK_KIND_DESCRIPTION as M, WIZARD_ASK_SENSITIVE_DESCRIPTION as N, AUDIT_STATUSES as O, WIZARD_ASK_SUBJECT_DESCRIPTION as P, templateEnvWriteRefusal as Q, checkEnvKeys as R, AUDIT_ADD_CHECKS_DESCRIPTION as S, AUDIT_RESOLVE_CHECKS_PARAM_DESCRIPTION as T, installSkillById as U, downloadSkill as V, legacyKeyNameRefusal as W, resolveEnvSecretRefs as X, resolveEnvPath as Y, seedAuditChecks as Z, createSecretVault as _, wizardCanUseTool as a, MAX_ENV_KEY_SET as at, PUBLISH_HANDOFF_TOOL_NAME as b, checkAllSettingsConflicts as c, toPromptSafeRelativePath as ct, restoreClaudeSettings as d, fetchSkillMenu as et, sanitizeAgentSubprocessEnv as f, assembleCommandments as g, markGrantRevoked as h, runAgent as i, isFullyCancelled as it, ENV_FILE_PATH_DESCRIPTION as j, CHECK_ENV_KEYS_DESCRIPTION as k, classifySettingsConflicts as l, createTriageLLMProvider as lt, isGrantRevoked as m, buildRunTags as n, LONGER_ASK_TIMEOUT_MS as nt, createIsolatedAgentConfigDir as o, isEnvFileName as ot, AgentOutputSignals as p, resolveAskQuestionKinds as q, initializeAgent as r, createWizardAskBridge as rt, backupAndFixClaudeSettings as s, parseEnvKeyNames as st, buildAgentEnv as t, fetchWithRetry as tt, recoverOrphanedSettingsBackups as u, PUBLISH_HANDOFF_CONTENT_DESCRIPTION as v, AUDIT_RESOLVE_CHECKS_DESCRIPTION as w, publishHandoff as x, PUBLISH_HANDOFF_DESCRIPTION as y, createAskAccounting as z };
 
-//# sourceMappingURL=agent-interface-Avtr_5M5.js.map
+//# sourceMappingURL=agent-interface-BXvmAm4c.js.map