@posthog/wizard 2.80.0 → 2.80.1

package/dist/{agent-interface-CzyCmp7q.js → agent-interface-CemBvTAA.js}

@@ -1,13 +1,11 @@
-import { a as getLogFilePath, o as initLogFile, r as debug, s as logToFile, v as runtimeEnv } from "./debug-DyARf5TF.js";
-import { Y as WIZARD_REMARK_EVENT_NAME, c as CONTEXT_MILL_URL, et as wizardUserAgentForProgram, o as AWS_SKILLS_BASE_URL } from "./constants-DO4X70po.js";
-import { n as analytics } from "./analytics-B6q5PN7a.js";
-import { i as classifyAuthFailure } from "./errors-C2domSkK.js";
-import { a as safeReadFile, i as readProjectFile, o as walkProjectFiles } from "./bounded-fs-CC_NDtoP.js";
-import { t as registerCleanup } from "./wizard-abort-DBKtfnBR.js";
-import { c as REMARK_INSTRUCTION, f as gatewayAuth, i as gatewayApiFor, l as RESUME_INSTRUCTION, n as buildGatewayModel, p as isPastRefresh, s as AgentSignals, u as buildWizardPropertiesBlob } from "./gateway-BmjYUSua.js";
-import { i as modelCapabilities, o as triageModelFor } from "./models-Dba8ITeo.js";
-import { _ as coerceAuditChecks, h as AUDIT_CHECKS_FILE, l as prewarmYaraScanner, n as createPostToolUseYaraHooks, p as scanInstalledSkill, r as createPreToolUseYaraHooks } from "./yara-hooks-C3L6lBij.js";
-import { l as buildOrchestratorTools, v as makeMutex, y as writeJsonAtomic } from "./queue-tools-knnPQP0e.js";
+import { a as initLogFile, i as getLogFilePath, o as logToFile, r as formatLogLine, v as runtimeEnv } from "./debug-BfQPD2Hg.js";
+import { $ as WIZARD_REMARK_EVENT_NAME, it as wizardUserAgentForProgram, l as AWS_SKILLS_BASE_URL, n as analytics } from "./analytics-D21z3E5l.js";
+import { i as classifyAuthFailure } from "./errors-CHrJzAZb.js";
+import { a as safeReadFile, i as readProjectFile, o as walkProjectFiles } from "./bounded-fs-CAsuF6al.js";
+import { c as REMARK_INSTRUCTION, d as gatewayAuth, f as isPastRefresh, i as gatewayApiFor, l as RESUME_INSTRUCTION, n as buildGatewayModel, s as AgentSignals, u as buildWizardPropertiesBlob } from "./gateway-D3gIlR6b.js";
+import { i as modelCapabilities, o as triageModelFor } from "./models-D1SnCzvl.js";
+import { _ as makeMutex, l as buildOrchestratorTools, v as writeJsonAtomic } from "./queue-tools-BIZSJyt6.js";
+import { C as coerceAuditChecks, _ as downloadSkill, l as prewarmYaraScanner, n as createPostToolUseYaraHooks, p as scanInstalledSkill, r as createPreToolUseYaraHooks, x as AUDIT_CHECKS_FILE, y as fetchSkillMenu } from "./yara-hooks-D8YDyX7o.js";
 import { createRequire } from "node:module";
 import * as fs$1 from "fs";
 import fs from "fs";
@@ -15,14 +13,10 @@ import path from "path";
 import path$1 from "node:path";
 import { spawnSync } from "node:child_process";
 import { closeSync, constants, fchmodSync, lstatSync, openSync, renameSync, unlinkSync, writeSync } from "node:fs";
-import { randomUUID } from "crypto";
-import { randomBytes, randomUUID as randomUUID$1 } from "node:crypto";
+import { randomBytes, randomUUID } from "node:crypto";
 import * as os from "os";
-import { unzipSync } from "fflate";
+import { randomUUID as randomUUID$1 } from "crypto";
 import { z } from "zod";
-//#region \0rolldown/runtime.js
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
-//#endregion
 //#region src/agent/triage-provider.ts
 const TRIAGE_MAX_TOKENS = 16384;
 const TRIAGE_TIMEOUT_MS = 2e4;
@@ -73,40 +67,19 @@ function createTriageLLMProvider(auth, harness) {
 		}
 	};
 }
-//#endregion
-//#region src/shared/ask-policy.ts
-/**
-* Decide whether the `wizard_ask` overlay should be wired for this run.
-* Disabled in non-interactive modes (CI, signup) — there's no human to
-* answer. Per-program disabling is done by adding WIZARD_ASK_TOOL_NAME to
-* the program's `disallowedTools` so the SDK rejects calls outright.
-* Extracted so the policy can be unit-tested directly.
-*
-* `e2eAsk` is the one escape hatch. The e2e harness runs a `ci`
-* session, but it does have an answerer — the driver loop answers each
-* `wizard_ask` batch from the program's e2e profile. Without the flag the
-* agent-in-the-loop layer (the ask bridge in both sequence arms, and the
-* orchestrator's seeded warehouse task) stays unreachable from a test.
-*
-* Only the e2e TUI host sets the flag, from the `E2E_ASK` env var. No CLI flag
-* populates it, so plain `--ci` and `--signup` runs behave exactly as before.
-*/
-function shouldDisableAsk(flags) {
-	return (flags.ci || flags.signup) && !flags.e2eAsk;
-}
-/**
-* The longer per-question timeout, for asks that send the user on an errand —
-* open a database console, mint a restricted API key. The default above is
-* sized for a question answerable from memory and expires long before an
-* errand is done.
-*/
-const LONGER_ASK_TIMEOUT_MS = 1200 * 1e3;
 /** A scan retains at most this many distinct key names. */
 const MAX_ENV_KEY_SET = 5e3;
 /** Files whose names start with `.env` carry env keys (`.env.local`, `.env.production`, …). */
 function isEnvFileName(name) {
 	return name.startsWith(".env");
 }
+/** Committed template names; see {@link isTemplateEnvFileName}. */
+const TEMPLATE_ENV_FILE_NAMES = [
+	".env.example",
+	".env.sample",
+	".env.template",
+	".env.dist"
+];
 /**
 * Committed template files: `.env.example` and its conventional siblings. They
 * document the keys a project expects and hold placeholders, not credentials,
@@ -120,7 +93,7 @@ function isEnvFileName(name) {
 * key, not a project that has it.
 */
 function isTemplateEnvFileName(name) {
-	return /^\.env\.(example|sample|template|dist)$/.test(name);
+	return TEMPLATE_ENV_FILE_NAMES.includes(name);
 }
 /**
 * Extract KEY NAMES from a dotenv file's content. Values are intentionally
@@ -742,18 +715,46 @@ function evaluateBashCommand(rawCommand) {
 	return commandDecision(normalized);
 }
 //#endregion
+//#region src/shared/ask-policy.ts
+/**
+* Decide whether the `wizard_ask` overlay should be wired for this run.
+* Disabled in non-interactive modes (CI, signup) — there's no human to
+* answer. Per-program disabling is done by adding WIZARD_ASK_TOOL_NAME to
+* the program's `disallowedTools` so the SDK rejects calls outright.
+* Extracted so the policy can be unit-tested directly.
+*
+* `e2eAsk` is the one escape hatch. The e2e harness runs a `ci`
+* session, but it does have an answerer — the driver loop answers each
+* `wizard_ask` batch from the program's e2e profile. Without the flag the
+* agent-in-the-loop layer (the ask bridge in both sequence arms, and the
+* orchestrator's seeded warehouse task) stays unreachable from a test.
+*
+* Only the e2e TUI host sets the flag, from the `E2E_ASK` env var. No CLI flag
+* populates it, so plain `--ci` and `--signup` runs behave exactly as before.
+*/
+function shouldDisableAsk(flags) {
+	return (flags.ci || flags.signup) && !flags.e2eAsk;
+}
+/**
+* The longer per-question timeout, for asks that send the user on an errand —
+* open a database console, mint a restricted API key. The default above is
+* sized for a question answerable from memory and expires long before an
+* errand is done.
+*/
+const LONGER_ASK_TIMEOUT_MS = 1200 * 1e3;
+//#endregion
 //#region src/agent/wizard-ask-bridge.ts
 /**
 * WizardAskBridge — host-side promise broker for the `wizard_ask` MCP tool.
 *
-* The `wizard_ask` tool needs to (a) read information from the wizard
-* session (the active skill id, used as the analytics `source`) and
-* (b) drive the TUI overlay. Wiring `wizard-tools.ts` directly to either
-* would couple our pure-data MCP server to the runtime UI layer.
+* The `wizard_ask` tool needs to (a) know the run's skill id, used as the
+* analytics `source`, and (b) put questions to whoever answers them. Wiring
+* the tools directly to either would couple our pure-data MCP server to its
+* host.
 *
-* The bridge is the seam: `wizard-tools.ts` depends on this interface,
-* and `agent-runner.ts` constructs an implementation that knows about
-* both the session and `getUI()`.
+* The bridge is the seam: the wizard tools depend on this interface, and
+* the runner builds an implementation over the caller's `AgentInteraction`
+* (see `runner/shared/ask.ts`).
 */
 /** Sentinel returned for unanswered fields on cancellation or timeout. */
 const CANCELLED_SENTINEL = "__cancelled__";
@@ -781,7 +782,7 @@ function createWizardAskBridge(opts) {
 				timedOut: false
 			};
 			const pending = {
-				id: randomUUID(),
+				id: randomUUID$1(),
 				questions,
 				source: opts.getSource(),
 				richLinks: opts.richLinks ?? false,
@@ -855,277 +856,6 @@ function createWizardAskBridge(opts) {
 		}
 	};
 }
-//#endregion
-//#region src/shared/fetch-retry.ts
-/**
-* One retry + failover policy for every critical-path fetch. GitHub is primary,
-* AWS is the fallback. A status a retry can't heal (404, 403) spends no retry
-* budget at the origin that returned it — but it still costs the other origin
-* one try, because the two are published separately and GitHub 403s expired
-* asset redirects and blocked regions where the asset is present.
-*/
-const DEFAULT_TIMEOUT_MS = 6e4;
-const DEFAULT_MAX_ATTEMPTS = 3;
-const DEFAULT_BACKOFF_MS = 500;
-const GITHUB_LATEST_PREFIX = `${CONTEXT_MILL_URL}/releases/latest/download/`;
-const GITHUB_PINNED_PREFIX = `${CONTEXT_MILL_URL}/releases/download/`;
-/** Version-pinned URLs name their own prefix, so they need the host alone. */
-const AWS_ORIGIN = new URL(AWS_SKILLS_BASE_URL).origin;
-function sleep(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
-}
-/**
-* Maps a context-mill release URL onto AWS; null when there is no second origin.
-*
-*   .../releases/latest/download/x.zip  ->  <aws>/latest/x.zip
-*   .../releases/download/v1.50.0/x.zip ->  <aws>/v1.50.0/x.zip
-*/
-function awsUrlFor(url) {
-	if (url.startsWith(GITHUB_LATEST_PREFIX)) return `${AWS_SKILLS_BASE_URL}/${url.slice(GITHUB_LATEST_PREFIX.length)}`;
-	if (url.startsWith(GITHUB_PINNED_PREFIX)) return `${AWS_ORIGIN}/${url.slice(GITHUB_PINNED_PREFIX.length)}`;
-	return null;
-}
-/** Sticky: without it every asset re-pays GitHub's retry budget during an outage. */
-let preferredOrigin = "github";
-/** A response status that retrying can't fix; propagates past the retry loop. */
-var NonRetryableFetchError = class extends Error {};
-/**
-* 5xx are transient; 408 (request timeout) and 429 (rate limit) explicitly ask
-* to retry. Every other 4xx is a client error a retry won't heal (404 missing
-* skill, 403 bad token) — retrying only burns the backoff before failing.
-*/
-function isRetryableStatus(status) {
-	return status >= 500 || status === 408 || status === 429;
-}
-function messageOf(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-/** Try one origin to exhaustion. */
-async function fetchOrigin(url, opts) {
-	const failures = [];
-	for (let attempt = 1; attempt <= opts.maxAttempts; attempt++) try {
-		const resp = await opts.fetchImpl(url, { signal: AbortSignal.timeout(opts.timeoutMs) });
-		if (resp.ok) return resp;
-		const msg = `HTTP ${resp.status} ${resp.statusText}`.trim();
-		if (!isRetryableStatus(resp.status)) throw new NonRetryableFetchError(msg);
-		throw new Error(msg);
-	} catch (err) {
-		if (err instanceof NonRetryableFetchError) throw err;
-		failures.push(`attempt ${attempt}: ${messageOf(err)}`);
-		if (attempt < opts.maxAttempts) await opts.sleepImpl(opts.backoffMs * 2 ** (attempt - 1));
-	}
-	throw new Error(failures.join("; "));
-}
-/**
-* Retry with backoff, then fail over. Throws once every origin is exhausted.
-*/
-async function fetchWithRetry(url, opts = {}) {
-	const { fetchImpl = fetch, sleepImpl = sleep, timeoutMs = DEFAULT_TIMEOUT_MS, maxAttempts = DEFAULT_MAX_ATTEMPTS, backoffMs = DEFAULT_BACKOFF_MS, failover = true, onEvent = (event, props) => analytics.wizardCapture(event, props) } = opts;
-	const originOpts = {
-		fetchImpl,
-		sleepImpl,
-		timeoutMs,
-		maxAttempts,
-		backoffMs
-	};
-	const awsUrl = failover ? awsUrlFor(url) : null;
-	if (!awsUrl) try {
-		return await fetchOrigin(url, originOpts);
-	} catch (err) {
-		throw new Error(`fetch ${url} failed — ${messageOf(err)}`);
-	}
-	const order = preferredOrigin === "aws" ? [{
-		origin: "aws",
-		target: awsUrl
-	}, {
-		origin: "github",
-		target: url
-	}] : [{
-		origin: "github",
-		target: url
-	}, {
-		origin: "aws",
-		target: awsUrl
-	}];
-	const failures = [];
-	for (const [index, candidate] of order.entries()) try {
-		const resp = await fetchOrigin(candidate.target, originOpts);
-		if (candidate.origin !== preferredOrigin) {
-			preferredOrigin = candidate.origin;
-			logToFile(`fetchWithRetry: failed over to ${candidate.origin}`);
-			onEvent("skills fetch failed over", {
-				origin: candidate.origin,
-				url: candidate.target
-			});
-		}
-		return resp;
-	} catch (err) {
-		failures.push(`${candidate.origin}: ${messageOf(err)}`);
-		if (index === order.length - 1) onEvent("skills fetch failed", {
-			url,
-			failures: failures.length
-		});
-	}
-	throw new Error(`fetch ${url} failed — ${failures.join(" | ")}`);
-}
-//#endregion
-//#region src/shared/skill-menu.ts
-/**
-* The skill menu: what context-mill publishes as `skill-menu.json` and how the
-* wizard reads it. Skill-backed CLI commands, the family picker, the skill
-* source screen and the agent's install path all resolve skills through this
-* one fetch, so it lives in shared and depends on nothing in the agent.
-*/
-/** Expand a bundle entry into one entry per variant, so the menu reads the same whether a group ships bundled or as zips. */
-function expandBundleEntry(entry) {
-	if (!entry.bundle || !entry.variants) return [entry];
-	return entry.variants.map((variant) => ({
-		...variant,
-		name: entry.name,
-		group: entry.group,
-		bundle: true,
-		downloadUrl: entry.downloadUrl
-	}));
-}
-/**
-* Fetch the skill menu from the skills server.
-* Returns parsed data on success, `null` on failure.
-*/
-async function fetchSkillMenu(skillsBaseUrl, opts = {}) {
-	const menuUrl = `${skillsBaseUrl}/skill-menu.json`;
-	try {
-		logToFile(`fetchSkillMenu: fetching from ${menuUrl}`);
-		const data = await (await fetchWithRetry(menuUrl, opts)).json();
-		for (const [category, entries] of Object.entries(data.categories)) data.categories[category] = entries.flatMap(expandBundleEntry);
-		logToFile(`fetchSkillMenu: loaded (${Object.keys(data.categories).length} categories)`);
-		return data;
-	} catch (err) {
-		logToFile(`fetchSkillMenu: error: ${err.message}`);
-		return null;
-	}
-}
-//#endregion
-//#region src/agent/tools/tools.ts
-/**
-* Shared wizard-tool behavior — skill discovery/install, env-file helpers,
-* the wizard_ask cap policy, secret-vault plumbing, and the audit ledger.
-* One implementation consumed by both protocol facades: the MCP server
-* (`./mcp`) and the pi-native tools (`harness/pi/tools.ts`) — tool behavior
-* cannot drift between harnesses.
-*/
-/** Extract a zip buffer, refusing entries that escape destDir (zip-slip). */
-function extractZipArchive(zip, destDir) {
-	const root = path.resolve(destDir);
-	let written = 0;
-	for (const [entryPath, data] of Object.entries(unzipSync(zip))) {
-		const target = path.resolve(root, entryPath);
-		if (target !== root && !target.startsWith(root + path.sep)) throw new Error(`zip entry escapes destination: ${entryPath}`);
-		if (entryPath.endsWith("/")) {
-			fs.mkdirSync(target, { recursive: true });
-			continue;
-		}
-		fs.mkdirSync(path.dirname(target), { recursive: true });
-		fs.writeFileSync(target, data);
-		written++;
-	}
-	return written;
-}
-/** Unpack the one variant this entry names out of a bundle; the rest is noise and never hits disk. */
-function extractBundle(bundle, destDir, entryId) {
-	if (typeof bundle?.id !== "string" || typeof bundle?.variants !== "object" || bundle.variants === null) throw new Error("malformed bundle: expected { id, variants }");
-	const files = bundle.variants[entryId.slice(bundle.id.length + 1)];
-	if (!files) throw new Error(`bundle ${bundle.id} has no variant "${entryId}"`);
-	const root = path.resolve(destDir);
-	let written = 0;
-	for (const [entryPath, contents] of Object.entries(files)) {
-		const target = path.resolve(root, entryPath);
-		if (target !== root && !target.startsWith(root + path.sep)) throw new Error(`bundle entry escapes destination: ${entryPath}`);
-		fs.mkdirSync(path.dirname(target), { recursive: true });
-		fs.writeFileSync(target, contents);
-		written++;
-	}
-	return written;
-}
-/** Download a URL to a buffer, retrying transient failures with backoff. */
-async function downloadWithRetry(url, opts = {}) {
-	const resp = await fetchWithRetry(url, opts);
-	return new Uint8Array(await resp.arrayBuffer());
-}
-/**
-* Download and extract a skill.
-* By default installs to `<installDir>/.claude/skills/<id>/`.
-*/
-async function downloadSkill(skillEntry, installDir, { skillsRoot, triage }) {
-	const skillDir = skillsRoot ? path.join(installDir, skillsRoot, skillEntry.id) : path.join(installDir, ".claude", "skills", skillEntry.id);
-	let step = "download";
-	try {
-		fs.mkdirSync(skillDir, { recursive: true });
-		const data = await downloadWithRetry(skillEntry.downloadUrl);
-		step = "extract";
-		const fileCount = skillEntry.bundle ? extractBundle(JSON.parse(Buffer.from(data).toString("utf8")), skillDir, skillEntry.id) : extractZipArchive(data, skillDir);
-		fs.writeFileSync(path.join(skillDir, ".posthog-wizard"), "");
-		step = "scan";
-		const poisonReason = await scanInstalledSkill(skillDir, triage);
-		if (poisonReason) {
-			fs.rmSync(skillDir, {
-				recursive: true,
-				force: true
-			});
-			logToFile(`downloadSkill: ${poisonReason}`);
-			analytics.wizardCapture("skill install failed", {
-				skill_id: skillEntry.id,
-				step: "scan",
-				platform: process.platform,
-				error: poisonReason.slice(0, 500)
-			});
-			return {
-				success: false,
-				error: poisonReason
-			};
-		}
-		logToFile(`downloadSkill: installed ${skillEntry.id} from ${skillEntry.downloadUrl} (${fileCount} files)`);
-		analytics.wizardCapture("skill installed", {
-			skill_id: skillEntry.id,
-			platform: process.platform
-		});
-		return { success: true };
-	} catch (err) {
-		logToFile(`downloadSkill: error: ${err.message}`);
-		analytics.wizardCapture("skill install failed", {
-			skill_id: skillEntry.id,
-			step,
-			platform: process.platform,
-			error: String(err.message).slice(0, 500)
-		});
-		return {
-			success: false,
-			error: err.message
-		};
-	}
-}
-/**
-* High-level "install a skill by ID" helper. Fetches the skill menu,
-* finds the skill, downloads and extracts it. Programs should use this
-* instead of composing fetchSkillMenu + downloadSkill themselves.
-*/
-async function installSkillById(skillId, installDir, skillsBaseUrl, options) {
-	const menu = await fetchSkillMenu(skillsBaseUrl);
-	if (!menu) return { kind: "menu-fetch-failed" };
-	const skill = Object.values(menu.categories).flat().find((s) => s.id === skillId);
-	if (!skill) return {
-		kind: "skill-not-found",
-		skillId
-	};
-	const result = await downloadSkill(skill, installDir, options);
-	if (!result.success) return {
-		kind: "download-failed",
-		message: result.error ?? "unknown"
-	};
-	return {
-		kind: "ok",
-		path: options.skillsRoot ? `${options.skillsRoot}/${skillId}` : `.claude/skills/${skillId}`
-	};
-}
 /** Subject recorded for a `wizard_ask` call that declares none. */
 const ASK_SUBJECT_UNSPECIFIED = "(unspecified)";
 /** Longest subject we keep; anything longer is truncated, never rejected. */
@@ -1804,7 +1534,7 @@ function createSecretVault() {
 	const store = /* @__PURE__ */ new Map();
 	return {
 		put(value, meta) {
-			const ref = `${REF_PREFIX}${randomUUID()}`;
+			const ref = `${REF_PREFIX}${randomUUID$1()}`;
 			store.set(ref, {
 				value,
 				meta: {
@@ -1980,7 +1710,7 @@ async function createWizardToolsServer(options) {
 			}],
 			isError: true
 		};
-		const result = await downloadSkill(skill, workingDirectory, { triage: triageProvider });
+		const result = await downloadSkill(skill, workingDirectory, { scan: (dir) => scanInstalledSkill(dir, triageProvider) });
 		if (result.success) return { content: [{
 			type: "text",
 			text: `Skill installed to .claude/skills/${args.skillId}/`
@@ -2197,7 +1927,8 @@ const WIZARD_COMMANDMENTS = [
 		"  - For `single` and `multi`, extract the alternatives from the prose into `options` as `{ label, value }` pairs. Use the human phrase as `label` and a lowercase-hyphenated form as `value` (e.g., `label: \"Vanilla JS\"`, `value: \"vanilla-js\"`).",
 		"  - Use a kebab-case slug of the question label as `id` (e.g., \"Tech stack\" → `tech-stack`, \"Show frequency\" → `show-frequency`).",
 		"  - Do not invent fields the schema does not define (no `source`, `category`, `priority`, etc.) — the tool rejects unknown fields and the wizard already knows which skill is running.",
-		"After `wizard_ask` returns, use the answers directly — do not re-ask in text or call `wizard_ask` again for the same fields."
+		"After `wizard_ask` returns, use the answers directly — do not re-ask in text, and do not call `wizard_ask` again to confirm a field the user already answered.",
+		"Correcting a rejected value is the one exception, and it is expected: when whatever you handed an answer to rejects it — a connection that fails, a host or key the API calls invalid, a permission error — ask again for only the fields that were wrong, reuse the same `subject`, and say what was rejected and what a valid value looks like. A value the user could fix in one keystroke is never a reason to abandon the step for a link they have to follow themselves. Stop after a couple of attempts on one subject. A dismissed or timed-out ask is not this case — the result names the fields it did not collect and why, and that is a decline, so fall back instead of re-asking."
 	].join("\n")
 ];
 //#endregion
@@ -2454,6 +2185,25 @@ var AgentOutputSignals = class {
 	}
 };
 //#endregion
+//#region src/shared/utils/cleanup.ts
+/** Synchronous work to run before the process exits, such as removing a temp file. */
+const cleanupFns = [];
+/** Register `fn` to run on exit; returns a function that unregisters it. */
+function registerCleanup(fn) {
+	cleanupFns.push(fn);
+	return () => {
+		const index = cleanupFns.indexOf(fn);
+		if (index !== -1) cleanupFns.splice(index, 1);
+	};
+}
+/** Runs all registered cleanup functions and drains the array. */
+function runCleanups() {
+	const fns = cleanupFns.splice(0);
+	for (const fn of fns) try {
+		fn();
+	} catch {}
+}
+//#endregion
 //#region src/shared/agent-env-isolation.ts
 /**
 * Credential isolation for the Claude Agent SDK subprocess.
@@ -2609,7 +2359,7 @@ function sanitizeAgentSubprocessEnv(env = process.env) {
 * Claude Code settings handling: conflict detection, backup/restore, and
 * orphan recovery.
 *
-* Lives apart from agent-interface so bin.ts can run orphan recovery at
+* Lives apart from agent-interface so main.ts can run orphan recovery at
 * process start without dragging in the agent stack (wizard-tools, yara
 * hooks, the SDK loader).
 */
@@ -2817,7 +2567,7 @@ function restoreClaudeSettings(workingDirectory) {
 * skips restore, so the user's settings stay silently gone. Detect that exact
 * state (backup present, original absent) and put the original back.
 *
-* Runs once per process, from bin.ts, before anything reads Claude settings —
+* Runs once per process, from main.ts, before anything reads Claude settings —
 * conflict detection must see the user's real settings file, and a recovery
 * any later would resurface the conflicting overrides after the backup step
 * already moved them aside.
@@ -2930,7 +2680,7 @@ async function getSDKModule() {
 * This ensures we use the SDK's bundled version rather than the user's installed Claude Code.
 */
 function getClaudeCodeExecutablePath() {
-	const sdkPackagePath = (typeof __require !== "undefined" ? __require : createRequire(process.argv[1] ?? `${process.cwd()}/`)).resolve("@anthropic-ai/claude-agent-sdk");
+	const sdkPackagePath = createRequire(import.meta.url).resolve("@anthropic-ai/claude-agent-sdk");
 	return path.join(path.dirname(sdkPackagePath), "cli.js");
 }
 /** Region implied by the resolved gateway URL, for telemetry and display. */
@@ -3034,6 +2784,15 @@ function buildAgentEnv(wizardMetadata, wizardFlags, teamId) {
 	logToFile("ANTHROPIC_CUSTOM_HEADERS", encoded);
 	return encoded;
 }
+/** A debug run's diagnostic line, as info log progress; a run without `debug` emits nothing. */
+function debugLine(emit, options, ...args) {
+	if (!options.debug) return;
+	emit({
+		kind: "log",
+		level: "info",
+		message: formatLogLine(...args)
+	});
+}
 /**
 * Permission hook that allows only safe commands. Bash commands are gated by
 * the exact per-manager fence in bash-fence.ts (install/build/typecheck/lint
@@ -3101,14 +2860,14 @@ function wizardCanUseTool(toolName, input, context = {}) {
 	const decision = evaluateBashCommand(command);
 	if (decision.allowed) {
 		logToFile(`Allowing bash command: ${command}`);
-		debug(`Allowing bash command: ${command}`);
+		context.onDebug?.(`Allowing bash command: ${command}`);
 		return {
 			behavior: "allow",
 			updatedInput: input
 		};
 	}
 	logToFile(`Denying bash command (${decision.analyticsReason}): ${command}`);
-	debug(`Denying bash command (${decision.analyticsReason}): ${command}`);
+	context.onDebug?.(`Denying bash command (${decision.analyticsReason}): ${command}`);
 	analytics.wizardCapture("bash denied", {
 		reason: decision.analyticsReason,
 		command
@@ -3214,7 +2973,7 @@ async function initializeAgent(config, options) {
 			gatewayUrl,
 			apiKeyPresent: !!config.posthogApiKey
 		});
-		if (options.debug) debug("Agent config:", {
+		debugLine(emit, options, "Agent config:", {
 			workingDirectory: agentRunConfig.workingDirectory,
 			posthogMcpUrl: config.posthogMcpUrl,
 			gatewayUrl,
@@ -3229,7 +2988,7 @@ async function initializeAgent(config, options) {
 			message: `Failed to initialize agent: ${error.message}`
 		});
 		logToFile("Agent initialization error:", error);
-		debug("Agent initialization error:", error);
+		debugLine(emit, options, "Agent initialization error:", error);
 		throw error;
 	}
 }
@@ -3371,7 +3130,7 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 	}, timeoutMs) : void 0;
 	try {
 		const disallow = new Set(agentConfig.disallowedTools ?? []);
-		const allowedTools = (agentConfig.readOnly ? READ_ONLY_TOOLS : [...BASE_ALLOWED_TOOLS, ...agentConfig.allowedTools ?? []]).filter((t) => !disallow.has(t));
+		const allowedTools = (agentConfig.readOnly ? READ_ONLY_TOOLS : [...BASE_ALLOWED_TOOLS, ...agentConfig.allowedTools ?? []]).filter((t) => !disallow.has(t) && !CAN_USE_TOOL_FILE_TOOLS.has(t));
 		const inheritedMcpServerNames = Object.keys(agentConfig.mcpServers);
 		const triageProvider = agentConfig.triageProvider;
 		const onYaraTerminate = (reason) => {
@@ -3406,6 +3165,10 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 						disallowedTools: agentConfig.disallowedTools ? [...agentConfig.disallowedTools] : void 0
 					} },
 					settingSources: agentConfig.readOnly ? [] : ["project"],
+					settings: {
+						disableAllHooks: true,
+						permissions: { deny: [...ENV_FILE_DENY_RULES] }
+					},
 					skills: agentConfig.readOnly ? [] : "all",
 					allowedTools,
 					sandbox: {
@@ -3465,7 +3228,8 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 						const result = wizardCanUseTool(toolName, input, {
 							readOnly: agentConfig.readOnly,
 							wizardAskPending: agentConfig.getPendingQuestion?.() != null,
-							disallowedTools: agentConfig.disallowedTools
+							disallowedTools: agentConfig.disallowedTools,
+							onDebug: (line) => debugLine(emit, options, line)
 						});
 						logToFile("canUseTool result:", result);
 						return Promise.resolve(result);
@@ -3485,7 +3249,7 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 					},
 					stderr: (data) => {
 						logToFile("CLI stderr:", data);
-						if (options.debug) debug("CLI stderr:", data);
+						debugLine(emit, options, "CLI stderr:", data);
 					},
 					hooks: {
 						PreToolUse: warlockDisabled ? [] : createPreToolUseYaraHooks(triageProvider, onYaraTerminate),
@@ -3786,7 +3550,7 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 			message: `Error: ${error.message}`
 		});
 		logToFile("Agent run failed:", error);
-		debug("Full error:", error);
+		debugLine(emit, options, "Full error:", error);
 		throw error;
 	} finally {
 		agentConfig.signal?.removeEventListener("abort", onExternalAbort);
@@ -3839,12 +3603,17 @@ const READ_ONLY_TOOLS = [
 	"Glob",
 	"Grep"
 ];
-const BASE_ALLOWED_TOOLS = [
+/** wizardCanUseTool's env-file rule as SDK deny rules for the project; outside it, canUseTool sees the file tools. */
+const ENV_FILE_DENY_RULES = ["Read", "Edit"].flatMap((tool) => [`${tool}(.env*)`, ...TEMPLATE_ENV_FILE_NAMES.map((name) => `${tool}(!${name})`)]);
+/** The SDK approves these itself inside the project; allowing them would hide calls outside it from canUseTool. */
+const CAN_USE_TOOL_FILE_TOOLS = new Set([
 	"Read",
 	"Write",
 	"Edit",
+	"Grep"
+]);
+const BASE_ALLOWED_TOOLS = [
 	"Glob",
-	"Grep",
 	"Bash",
 	...Object.values(TaskTool),
 	"ListMcpResourcesTool",
@@ -3856,11 +3625,11 @@ function handleTaskCreate(block, store) {
 	if (!input?.subject) return;
 	let source = taskSources.get(store.tasks);
 	if (!source) {
-		source = randomUUID$1();
+		source = randomUUID();
 		taskSources.set(store.tasks, source);
 	}
 	store.tasks.set(block.id, {
-		id: randomUUID$1(),
+		id: randomUUID(),
 		source,
 		content: input.subject,
 		status: "pending",
@@ -4012,7 +3781,7 @@ function handleSDKMessage(message, options, spinner, signals, emit, receivedSucc
 		});
 	};
 	logToFile(`SDK Message: ${message.type}`, JSON.stringify(message, null, 2));
-	if (options.debug) debug(`SDK Message type: ${message.type}`);
+	debugLine(emit, options, `SDK Message type: ${message.type}`);
 	switch (message.type) {
 		case "assistant": {
 			const tokenUsageDelta = extractTokenUsageDelta(message);
@@ -4119,11 +3888,11 @@ function handleSDKMessage(message, options, spinner, signals, emit, receivedSucc
 			}
 			break;
 		default:
-			if (options.debug) debug(`Unhandled message type: ${message.type}`);
+			debugLine(emit, options, `Unhandled message type: ${message.type}`);
 			break;
 	}
 }
 //#endregion
-export { vaultSensitiveAnswers as $, CHECK_ENV_KEYS_FILE_PATH_DESCRIPTION as A, describeAskCancellation as B, AUDIT_ADD_CHECKS_PARAM_DESCRIPTION as C, AUDIT_SEED_CHECKS_PARAM_DESCRIPTION as D, AUDIT_SEED_CHECKS_DESCRIPTION as E, WIZARD_ASK_TOOL_DESCRIPTION as F, mergeEnvValues as G, ensureGitignoreCoverage as H, WIZARD_TOOL_NAMES as I, resolveAuditChecks as J, normaliseAskSubject as K, addAuditChecks as L, WIZARD_ASK_KIND_DESCRIPTION as M, WIZARD_ASK_SENSITIVE_DESCRIPTION as N, AUDIT_STATUSES as O, WIZARD_ASK_SUBJECT_DESCRIPTION as P, templateEnvWriteRefusal as Q, checkEnvKeys as R, AUDIT_ADD_CHECKS_DESCRIPTION as S, AUDIT_RESOLVE_CHECKS_PARAM_DESCRIPTION as T, installSkillById as U, downloadSkill as V, legacyKeyNameRefusal as W, resolveEnvSecretRefs as X, resolveEnvPath as Y, seedAuditChecks as Z, createSecretVault as _, wizardCanUseTool as a, isEnvFileName as at, PUBLISH_HANDOFF_TOOL_NAME as b, checkAllSettingsConflicts as c, LONGER_ASK_TIMEOUT_MS as ct, restoreClaudeSettings as d, fetchSkillMenu as et, sanitizeAgentSubprocessEnv as f, assembleCommandments as g, markGrantRevoked as h, runAgent as i, MAX_ENV_KEY_SET as it, ENV_FILE_PATH_DESCRIPTION as j, CHECK_ENV_KEYS_DESCRIPTION as k, classifySettingsConflicts as l, shouldDisableAsk as lt, isGrantRevoked as m, buildRunTags as n, createWizardAskBridge as nt, createIsolatedAgentConfigDir as o, parseEnvKeyNames as ot, AgentOutputSignals as p, resolveAskQuestionKinds as q, initializeAgent as r, isFullyCancelled as rt, backupAndFixClaudeSettings as s, toPromptSafeRelativePath as st, buildAgentEnv as t, fetchWithRetry as tt, recoverOrphanedSettingsBackups as u, createTriageLLMProvider as ut, PUBLISH_HANDOFF_CONTENT_DESCRIPTION as v, AUDIT_RESOLVE_CHECKS_DESCRIPTION as w, publishHandoff as x, PUBLISH_HANDOFF_DESCRIPTION as y, createAskAccounting as z };
+export { vaultSensitiveAnswers as $, AUDIT_STATUSES as A, checkEnvKeys as B, publishHandoff as C, AUDIT_RESOLVE_CHECKS_PARAM_DESCRIPTION as D, AUDIT_RESOLVE_CHECKS_DESCRIPTION as E, WIZARD_ASK_SENSITIVE_DESCRIPTION as F, mergeEnvValues as G, describeAskCancellation as H, WIZARD_ASK_SUBJECT_DESCRIPTION as I, resolveAuditChecks as J, normaliseAskSubject as K, WIZARD_ASK_TOOL_DESCRIPTION as L, CHECK_ENV_KEYS_FILE_PATH_DESCRIPTION as M, ENV_FILE_PATH_DESCRIPTION as N, AUDIT_SEED_CHECKS_DESCRIPTION as O, WIZARD_ASK_KIND_DESCRIPTION as P, templateEnvWriteRefusal as Q, WIZARD_TOOL_NAMES as R, PUBLISH_HANDOFF_TOOL_NAME as S, AUDIT_ADD_CHECKS_PARAM_DESCRIPTION as T, ensureGitignoreCoverage as U, createAskAccounting as V, legacyKeyNameRefusal as W, resolveEnvSecretRefs as X, resolveEnvPath as Y, seedAuditChecks as Z, markGrantRevoked as _, wizardCanUseTool as a, isEnvFileName as at, PUBLISH_HANDOFF_CONTENT_DESCRIPTION as b, checkAllSettingsConflicts as c, createTriageLLMProvider as ct, restoreClaudeSettings as d, createWizardAskBridge as et, sanitizeAgentSubprocessEnv as f, isGrantRevoked as g, AgentOutputSignals as h, runAgent as i, MAX_ENV_KEY_SET as it, CHECK_ENV_KEYS_DESCRIPTION as j, AUDIT_SEED_CHECKS_PARAM_DESCRIPTION as k, classifySettingsConflicts as l, runCleanups as m, buildRunTags as n, LONGER_ASK_TIMEOUT_MS as nt, createIsolatedAgentConfigDir as o, parseEnvKeyNames as ot, registerCleanup as p, resolveAskQuestionKinds as q, initializeAgent as r, shouldDisableAsk as rt, backupAndFixClaudeSettings as s, toPromptSafeRelativePath as st, buildAgentEnv as t, isFullyCancelled as tt, recoverOrphanedSettingsBackups as u, assembleCommandments as v, AUDIT_ADD_CHECKS_DESCRIPTION as w, PUBLISH_HANDOFF_DESCRIPTION as x, createSecretVault as y, addAuditChecks as z };
 
-//# sourceMappingURL=agent-interface-CzyCmp7q.js.map
+//# sourceMappingURL=agent-interface-CemBvTAA.js.map