@posthog/wizard 2.80.0 → 2.81.0

package/dist/analytics-CGGE7OSa.js

@@ -0,0 +1,735 @@
+import { _ as TASK_RUN_ID, f as VERSION, g as TASK_ID, h as RUN_SURFACE, o as logToFile } from "./debug-sB20p-Ek.js";
+import { a as WizardError } from "./errors-DhFeR8Sp.js";
+import { PostHog } from "posthog-node";
+import { v4 } from "uuid";
+//#region src/shared/local-dev.ts
+/**
+* Local development targets: context-mill (skills), MCP, and PostHog. Each is
+* independently switchable — CI runs local skills against the *production* MCP
+* — with `--local-dev` as a shorthand for all three.
+*
+* `wizard mcp add --local` is unrelated: it writes a `posthog-local` entry into
+* the user's editor config rather than retargeting this run. Hence no
+* `--local` here.
+*/
+const CONTEXT_MILL_LOCAL_URL = process.env.CONTEXT_MILL_URL || "http://localhost:8765";
+const MCP_LOCAL_URL = "http://localhost:8787/mcp";
+/** Pins the API, app, OAuth, and the LLM gateway derived from them. */
+const POSTHOG_LOCAL_URL = "http://localhost:8010";
+/**
+* A specific flag beats `--local-dev` in both directions. `??` is load-bearing:
+* it falls through only on `undefined`, so giving the specific flags a yargs
+* `default: false` would silently break both the umbrella and `--no-local-mcp`.
+*/
+function resolveLocalDev(flags) {
+	const umbrella = flags.localDev ?? false;
+	return {
+		localMcp: flags.localMcp ?? umbrella,
+		localContextMill: flags.localContextMill ?? umbrella,
+		localPosthog: flags.localPosthog ?? umbrella
+	};
+}
+/** yargs populates both spellings, so read either. */
+function localDevFromArgv(argv) {
+	const read = (kebab, camel) => {
+		const value = argv[camel] ?? argv[kebab];
+		return typeof value === "boolean" ? value : void 0;
+	};
+	return resolveLocalDev({
+		localDev: read("local-dev", "localDev"),
+		localMcp: read("local-mcp", "localMcp"),
+		localContextMill: read("local-context-mill", "localContextMill"),
+		localPosthog: read("local-posthog", "localPosthog")
+	});
+}
+const PRODUCTION_TARGETS = {
+	localMcp: false,
+	localContextMill: false,
+	localPosthog: false
+};
+let resolved = null;
+/**
+* Resolve this process's targets. Called once from the yargs middleware, which
+* covers every command and the env-var spellings alike.
+*/
+function initLocalDev(argv) {
+	resolved = localDevFromArgv(argv);
+	return resolved;
+}
+/**
+* Where this run points. Resolved once because the flags are parsed at startup
+* and never change; threading them through state let call sites read whichever
+* field they happened to have, which is how the intro screens ended up asking
+* the MCP flag where to fetch skills.
+*
+* Uninitialized means no CLI parse ran (a direct-call test) — production.
+*/
+function getLocalDev() {
+	return resolved ?? PRODUCTION_TARGETS;
+}
+const LOCAL_SERVICES = [
+	{
+		key: "localContextMill",
+		label: "context-mill",
+		flag: "--local-context-mill",
+		url: `${CONTEXT_MILL_LOCAL_URL}/skill-menu.json`,
+		startHint: "npm run dev  (in the context-mill repo)"
+	},
+	{
+		key: "localMcp",
+		label: "MCP server",
+		flag: "--local-mcp",
+		url: MCP_LOCAL_URL,
+		startHint: "hogli start  (or pnpm dev:local-resources in posthog/services/mcp)"
+	},
+	{
+		key: "localPosthog",
+		label: "PostHog",
+		flag: "--local-posthog",
+		url: POSTHOG_LOCAL_URL,
+		startHint: "./bin/start  (in the posthog repo)"
+	}
+];
+const PROBE_TIMEOUT_MS = 2e3;
+const PROBE_ATTEMPTS = 3;
+const PROBE_BACKOFF_MS = 250;
+async function isReachable(url) {
+	for (let attempt = 1; attempt <= PROBE_ATTEMPTS; attempt++) try {
+		await fetch(url, { signal: AbortSignal.timeout(PROBE_TIMEOUT_MS) });
+		return true;
+	} catch {
+		if (attempt < PROBE_ATTEMPTS) await new Promise((r) => setTimeout(r, PROBE_BACKOFF_MS * 2 ** (attempt - 1)));
+	}
+	return false;
+}
+/**
+* Probe every service the flags asked to be local. Returns one message naming
+* each unreachable one, or undefined if all are up (or none were requested).
+*
+* Without this a dead local server surfaces late and badly: a missing
+* context-mill looks like a registry outage, a missing MCP fails mid-run after
+* the agent has already edited files.
+*/
+async function checkLocalServices(resolved) {
+	const requested = LOCAL_SERVICES.filter((s) => resolved[s.key]);
+	if (requested.length === 0) return void 0;
+	const reachable = await Promise.all(requested.map((s) => isReachable(s.url)));
+	const dead = requested.filter((_, i) => !reachable[i]);
+	if (dead.length === 0) return void 0;
+	return [
+		`Local ${dead.length === 1 ? "service is" : "services are"} not running:`,
+		"",
+		...dead.map((s) => `  ${s.label} — nothing listening at ${new URL(s.url).origin}\n    requested by ${s.flag}\n    start it with: ${s.startHint}`),
+		"",
+		"Start the missing services, or drop the flag to use production."
+	].join("\n");
+}
+/**
+* `--local-mcp` used to select local skills too; anyone still relying on that
+* would silently get production skills. Temporary — drop after a release or two.
+*/
+function localMcpSkillsNotice(flags) {
+	if (flags.localMcp !== true) return void 0;
+	if (flags.localContextMill !== void 0 || flags.localDev === true) return;
+	return "--local-mcp now points only at the local MCP server. For local skills, add --local-context-mill (or use --local-dev for both).";
+}
+//#endregion
+//#region src/shared/constants.ts
+/**
+* Shared constants for the PostHog wizard.
+*/
+/** Next sonnet generation (a `MODEL_FLAG_VARIANTS` key in the switchboard). */
+const SONNET_5_MODEL = "claude-sonnet-5";
+/**
+* Default model for agent runs. Bare model IDs (no `anthropic/` prefix) so the
+* LLM gateway's Bedrock fallback can match map_to_bedrock_model().
+*/
+const DEFAULT_AGENT_MODEL = SONNET_5_MODEL;
+/** Undated haiku, for scan triage. The alias tracks the current 4.5 release rather than pinning one. */
+const HAIKU_TRIAGE_MODEL = "claude-haiku-4-5";
+/**
+* Cheaper, faster model for mechanical agent work (e.g. repo classification
+* during source-map detection). Passed via AgentConfig.modelOverride.
+*/
+const HAIKU_MODEL = HAIKU_TRIAGE_MODEL;
+const GPT5_6_LUNA_MODEL = "openai/gpt-5.6-luna";
+const GPT5_6_TERRA_MODEL = "openai/gpt-5.6-terra";
+const GPT5_6_SOL_MODEL = "openai/gpt-5.6-sol";
+/**
+* The two agent runner routing axes: **harness** (which agent SDK drives the LLM)
+* and **sequence** (which pipeline shape orchestrates the work). Single source
+* of truth for yargs `choices`, session fields, the runner registry, and tests
+* — `Object.values(Harness)` gives an iterable of the values when an array is
+* needed. Adding a member is enough to pick it up everywhere.
+*
+* Naming matches the directory layout — see `src/agent/runner/harness/`
+* and `src/agent/runner/sequence/`.
+*/
+let Harness = /* @__PURE__ */ function(Harness) {
+	Harness["anthropic"] = "anthropic";
+	Harness["pi"] = "pi";
+	return Harness;
+}({});
+let Sequence = /* @__PURE__ */ function(Sequence) {
+	Sequence["linear"] = "linear";
+	Sequence["orchestrator"] = "orchestrator";
+	return Sequence;
+}({});
+/**
+* Detection order matters: put framework-specific integrations BEFORE basic language fallbacks.
+*/
+let Integration = /* @__PURE__ */ function(Integration) {
+	Integration["nextjs"] = "nextjs";
+	Integration["nuxt"] = "nuxt";
+	Integration["vue"] = "vue";
+	Integration["reactRouter"] = "react-router";
+	Integration["tanstackStart"] = "tanstack-start";
+	Integration["tanstackRouter"] = "tanstack-router";
+	Integration["reactNative"] = "react-native";
+	Integration["angular"] = "angular";
+	Integration["astro"] = "astro";
+	Integration["django"] = "django";
+	Integration["flask"] = "flask";
+	Integration["fastapi"] = "fastapi";
+	Integration["laravel"] = "laravel";
+	Integration["sveltekit"] = "sveltekit";
+	Integration["flutter"] = "flutter";
+	Integration["kmp"] = "kmp";
+	Integration["swift"] = "swift";
+	Integration["android"] = "android";
+	Integration["rails"] = "rails";
+	Integration["elixir"] = "elixir";
+	Integration["go"] = "go";
+	Integration["rust"] = "rust";
+	Integration["java"] = "java";
+	Integration["python"] = "python";
+	Integration["ruby"] = "ruby";
+	Integration["javascript_web"] = "javascript_web";
+	Integration["javascriptNode"] = "javascript_node";
+	return Integration;
+}({});
+/**
+* The platforms session replay can actually record on. Replay vision watches
+* recordings, so a platform with no recordings has nothing to set up — the
+* run must stop before any work, not after a pointless agent run.
+*
+* Web frameworks record through posthog-js (server-rendered frameworks
+* included — they serve pages), and the mobile SDKs with replay support are
+* React Native, Android, iOS, and Flutter. Excluded: pure backend targets
+* (`javascript_node`, `python`, `ruby`) and KMP, which has no replay support
+* yet.
+*/
+const REPLAY_VISION_SUPPORTED = new Set([
+	"nextjs",
+	"nuxt",
+	"vue",
+	"react-router",
+	"tanstack-start",
+	"tanstack-router",
+	"angular",
+	"astro",
+	"sveltekit",
+	"javascript_web",
+	"django",
+	"flask",
+	"fastapi",
+	"laravel",
+	"rails",
+	"react-native",
+	"android",
+	"swift",
+	"flutter"
+]);
+/** The events-audit report. */
+const EVENTS_AUDIT_REPORT_FILE = "posthog-events-audit-report.md";
+const EVENT_INVENTORY_FILE = ".posthog-events-inventory.json";
+/** Per-part filename pattern emitted by events-audit subagents (e.g. `.posthog-events-inventory.part-3.json`). */
+const EVENT_INVENTORY_PART_PATTERN = /^\.posthog-events-inventory\.part-\d+\.json$/;
+/** The integration program's event plan. */
+const EVENT_PLAN_FILE = ".posthog-events.json";
+/** The integration program's setup report; Self-driving reads it as a hint. */
+const SETUP_REPORT_FILE = "posthog-setup-report.md";
+/**
+* Region-agnostic PostHog app URL. Resolves to us.posthog.com or
+* eu.posthog.com server-side based on the signed-in user's profile.
+* Use this for share-with-user links (e.g. settings pages) so they
+* land on the right region without us needing to know it client-side.
+*/
+const POSTHOG_APP_URL = "https://app.posthog.com";
+const ISSUES_URL = "https://github.com/posthog/wizard/issues";
+/** Public status page, linked from transient-failure guidance (e.g. OAuth server_error). */
+const POSTHOG_STATUS_PAGE_URL = "https://www.posthogstatus.com";
+const CONTEXT_MILL_URL = "https://github.com/PostHog/context-mill";
+/**
+* Latest context-mill release page — the BYOAI download link shown in
+* the privacy panel. Deliberately the release PAGE, not a direct asset
+* URL: asset URLs are ~89 chars and hard-wrap inside the 64-col panel,
+* which corrupts terminal copy/paste with a mid-URL line break. This
+* stays under one line; the panel names the exact asset to grab.
+*/
+const CONTEXT_MILL_RELEASES_URL = "https://github.com/PostHog/context-mill/releases/latest";
+const POSTHOG_DOCS_URL = "https://posthog.com/docs";
+const POSTHOG_TERMS_URL = "https://posthog.com/terms";
+const POSTHOG_PRIVACY_URL = "https://posthog.com/privacy";
+const POSTHOG_ORG_AI_SETTINGS_URL = "https://app.posthog.com/settings/organization-details#setting=organization-ai-consent";
+const WIZARD_CONTACT_EMAIL = "wizard@posthog.com";
+/**
+* Two origins for the same release, same filenames. Interchangeable bases, so
+* making AWS primary is a `getSkillsBaseUrl` change, not a code change.
+*/
+const GITHUB_SKILLS_BASE_URL = "https://github.com/PostHog/context-mill/releases/latest/download";
+const AWS_SKILLS_BASE_URL = "https://context-mill.posthog.com/latest";
+/** Alias of `@shared/local-dev`'s constant, kept for existing importers. */
+const LOCAL_SKILLS_BASE_URL = CONTEXT_MILL_LOCAL_URL;
+/**
+* Driven by `--local-context-mill`, NOT `--local-mcp` (which used to select
+* both). Takes no argument on purpose: callers can't pass the wrong flag.
+*/
+function getSkillsBaseUrl() {
+	return getLocalDev().localContextMill ? LOCAL_SKILLS_BASE_URL : GITHUB_SKILLS_BASE_URL;
+}
+const ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY = "sTMFPsFhdP1Ssg";
+const ANALYTICS_HOST_URL = "https://internal-j.posthog.com";
+const ANALYTICS_TEAM_TAG = "docs-and-wizard";
+const OAUTH_PORTS = [
+	8239,
+	8238,
+	8240,
+	8237,
+	8236,
+	8235
+];
+const POSTHOG_US_CLIENT_ID = "c4Rdw8DIxgtQfA80IiSnGKlNX8QN00cFWF00QQhM";
+const POSTHOG_EU_CLIENT_ID = "bx2C5sZRN03TkdjraCcetvQFPGH6N2Y9vRLkcKEy";
+const POSTHOG_DEV_CLIENT_ID = "DC5uRLVbGI02YQ82grxgnK6Qn12SXWpCqdPb60oZ";
+const POSTHOG_PROXY_CLIENT_ID = POSTHOG_US_CLIENT_ID;
+const DUMMY_PROJECT_API_KEY = "_YOUR_POSTHOG_PROJECT_TOKEN_";
+/**
+* Scopes the wizard requests during the agentic provisioning signup flow.
+*
+* Each entry is justified by what the wizard's agent step does after signup:
+* - user:read         identify the user for analytics + agent context
+* - project:read      look up the freshly-provisioned project
+* - llm_gateway:read  authenticate to gateway.{us,eu}.posthog.com/wizard
+*                     (the agent's LLM calls — without this scope, every
+*                     agent message returns 401)
+* - query:read        run HogQL queries when the agent needs data
+* - dashboard:write   create the onboarding dashboard during setup
+* - insight:write     create the onboarding insights during setup
+* - notebook:write    upload the events-audit report as a PostHog notebook
+*                     in step 6 of the events-audit skill (notebooks-create
+*                     MCP tool requires this scope)
+* - event_definition:write
+*                     create event definitions from the completed wizard
+*                     session's event plan
+*
+* Must be a subset of `ALLOWED_PROVISIONING_SCOPES` in
+* `ee/api/agentic_provisioning/views.py` on the backend.
+*/
+const WIZARD_PROVISIONING_SCOPES = [
+	"user:read",
+	"project:read",
+	"llm_gateway:read",
+	"dashboard:write",
+	"insight:write",
+	"query:read",
+	"notebook:write",
+	"event_definition:write"
+];
+/**
+* Scopes the wizard requests during the OAuth login flow. Superset of
+* `WIZARD_PROVISIONING_SCOPES` with scopes that only apply to the login
+* path and are not in the provisioning allowlist:
+* - health_issue:read     used by `wizard doctor`
+* - wizard_session:read   list / retrieve / stream sessions
+* - wizard_session:write  stream run state to /api/projects/{id}/wizard/sessions/
+* - event_definition:write
+*                          create event definitions when a session completes
+* - organization:read     read `organization.is_ai_data_processing_approved`
+*                         from /api/users/@me/ for the AI opt-in gate
+*
+* NOTE: every scope here must be within the wizard OAuth application's
+* server-side scope ceiling (`OAuthApplication.scopes` in posthog, set
+* via Django admin on BOTH prod regions). A scope outside the ceiling
+* does NOT fail the authorize request — the server silently clamps the
+* request to the ceiling (`clamp_scopes_to_ceiling` in posthog) and the
+* token comes back without it. Separately, the consent screen lets the
+* user deselect any scope the app doesn't mark required. Both paths
+* yield a granted `scope` narrower than requested, with no error, so
+* never assume the token carries this list — the token response's
+* `scope` field is the truth, and `missingOAuthScopes` (utils/oauth.ts)
+* diffs it at login. Ceiling procedure: the "scope-ceiling-invalid-scope"
+* runbook in PostHog/runbooks. Keep its worked example in sync when this
+* list changes.
+*/
+const WIZARD_OAUTH_SCOPES = [
+	...WIZARD_PROVISIONING_SCOPES,
+	"health_issue:read",
+	"wizard_session:read",
+	"wizard_session:write",
+	"wizard_run:write",
+	"organization:read"
+];
+const WIZARD_INTERACTION_EVENT_NAME = "wizard interaction";
+const WIZARD_REMARK_EVENT_NAME = "wizard remark";
+/** Multivariate flag: `wizard-run` publishes to WizardRun, anything else to WizardSession. */
+const WIZARD_RUN_SYNC_FLAG_KEY = "wizard-run-sync";
+/** Boolean feature flag that routes a run to the experimental orchestrator runner. */
+const WIZARD_ORCHESTRATOR_FLAG_KEY = "wizard-orchestrator";
+/** Multivariate flag: per-stage orchestrator overrides ride each variant's JSON payload (`{stage: {model?, effort?}}`). */
+const WIZARD_ORCHESTRATOR_OVERRIDE_FLAG_KEY = "wizard-orchestrator-override";
+/** Boolean flag: on → pi for self-driving. Payload carries `{model, effort?, harness?, sequence?}` (model = a `MODEL_FLAG_VARIANTS` key); missing/invalid payload keeps the non-flagged default. */
+const WIZARD_SELF_DRIVING_USE_PI_HARNESS_FLAG_KEY = "wizard-self-driving-use-pi-harness";
+/** Boolean flag: agentic project scoping for non-interactive basic-integration runs. */
+const WIZARD_BASIC_INTEGRATION_AGENTIC_DETECTION_FLAG_KEY = "wizard-basic-integration-agentic-detection";
+/** Boolean flag: the orchestrator queues the program's runner-seeded tasks (the warehouse step). Off, no task is queued and the run is byte-identical to a no-sources project. */
+const WIZARD_ORCHESTRATOR_SEEDED_TASKS_FLAG_KEY = "wizard-orchestrator-seeded-tasks";
+/** Kill switch over a shipped default: ONLY an explicit 'false' excludes the AI Observability and Logs tasks from default integration runs — absent or fetch-failed means include, so the default never vanishes on a network hiccup. */
+const WIZARD_DEFAULT_AIO_LOGS_FLAG_KEY = "wizard-default-aio-logs";
+const WIZARD_FLAG_KEYS = [
+	WIZARD_RUN_SYNC_FLAG_KEY,
+	WIZARD_ORCHESTRATOR_FLAG_KEY,
+	WIZARD_ORCHESTRATOR_OVERRIDE_FLAG_KEY,
+	WIZARD_ORCHESTRATOR_SEEDED_TASKS_FLAG_KEY,
+	WIZARD_SELF_DRIVING_USE_PI_HARNESS_FLAG_KEY,
+	WIZARD_BASIC_INTEGRATION_AGENTIC_DETECTION_FLAG_KEY,
+	WIZARD_DEFAULT_AIO_LOGS_FLAG_KEY
+];
+/** User-Agent for wizard HTTP requests and MCP server identification. */
+const WIZARD_USER_AGENT = `posthog/wizard; version: ${VERSION}`;
+/**
+* User-Agent for a specific program's MCP calls, tagged with `program: <id>` so the
+* backend can attribute work per program (e.g. the `self-driving` program's warehouse
+* sources are recorded as `created_via=self_driving` rather than plain `wizard`). The
+* base `posthog/wizard` token is preserved, so anything keying only on that still matches.
+*/
+function wizardUserAgentForProgram(programId) {
+	return programId ? `${WIZARD_USER_AGENT}; program: ${programId}` : WIZARD_USER_AGENT;
+}
+/** Timeout for framework / project detection probes (ms). */
+const DETECTION_TIMEOUT_MS = 1e4;
+/** Timeout for the agentic project scan (ms); past it the run falls back to root detection. */
+const AGENTIC_DETECTION_FIRST_ATTEMPT_TIMEOUT_MS = 6e4;
+const AGENTIC_DETECTION_RETRY_TIMEOUT_MS = 9e4;
+/**
+* Timeout for the OAuth authorization flow (ms).
+*
+* How long the user has to complete the browser login. The authorization
+* code is minted at approval and exchanged immediately on callback, so the
+* server-side code expiry (`AUTHORIZATION_CODE_EXPIRE_SECONDS`, 5 minutes)
+* bounds only the approval→exchange gap — manual-paste users have 5 minutes
+* from approval to submit the code — not how long this window may stay open.
+*/
+const OAUTH_TIMEOUT_MS = 18e5;
+//#endregion
+//#region src/shared/run-state.ts
+/** One place to ask, so a new consent state does not need three edits. */
+function mayReportScanResults(session) {
+	return session.scanConsent === "granted";
+}
+/** Lives here so analytics infrastructure never learns what consent means. */
+function reportableDiscoveredFeatures(session) {
+	return mayReportScanResults(session) ? session.discoveredFeatures : void 0;
+}
+/** Also a scan result, so it travels under the same consent as the rest. */
+function reportablePosthogSdkDetected(session) {
+	return mayReportScanResults(session) ? session.posthogSdkDetected : void 0;
+}
+//#endregion
+//#region src/shared/utils/ci-flag-overrides.ts
+function applyCiFlagOverrides(flags, payloads = {}) {
+	return {
+		flags,
+		payloads
+	};
+}
+/**
+* Task types excluded from this run. The exclusion env var (see the allowlist
+* in `env.ts`) is a comma-separated list (e.g. `dashboard`), set by the CI
+* harness that owns the policy — the wizard and the served content stay
+* run-mode agnostic. CI-build only, same as the flag overrides: published
+* builds strip this path.
+*/
+function ciExcludedTaskTypes() {
+	return [];
+}
+//#endregion
+//#region src/shared/utils/analytics.ts
+/**
+* The invocation, reduced to flag-safe strings: the command word (first
+* positional, 'default' for the bare flow) and the sorted option NAMES.
+* Option values never leave the machine — they carry paths, emails, keys.
+*/
+function invocationProperties() {
+	const args = process.argv.slice(2);
+	return {
+		command: args.find((a) => !a.startsWith("-")) ?? "default",
+		cli_flags: [...new Set(args.filter((a) => a.startsWith("--")).map((a) => a.slice(2).split("=")[0]))].sort().join(",")
+	};
+}
+/**
+* Extract a standard property bag from the current session.
+* Used by store-level analytics and available for ad-hoc captures.
+*/
+function sessionProperties(session) {
+	const discoveredFeatures = reportableDiscoveredFeatures(session);
+	const posthogSdkDetected = reportablePosthogSdkDetected(session);
+	return {
+		integration: session.integration,
+		skill_id: session.skillId,
+		detected_framework: session.detectedFrameworkLabel,
+		typescript: session.typescript,
+		project_id: session.credentials?.projectId,
+		...discoveredFeatures !== void 0 ? { discovered_features: discoveredFeatures } : {},
+		scan_consent: session.scanConsent,
+		run_phase: session.runPhase,
+		...posthogSdkDetected !== void 0 ? { posthog_sdk_detected: posthogSdkDetected } : {}
+	};
+}
+function groupsFromUser(user, host) {
+	const groups = { instance: host };
+	if (!user) return groups;
+	const organizationId = user.organization?.id;
+	if (organizationId) groups.organization = organizationId;
+	const customerId = user.organization?.customer_id;
+	if (customerId) groups.customer = customerId;
+	const projectUuid = user.team?.uuid;
+	if (projectUuid) groups.project = projectUuid;
+	return groups;
+}
+const WIZARD_FLAGS = new Set(WIZARD_FLAG_KEYS);
+function flagResponseValue(value) {
+	if (value === "true") return true;
+	if (value === "false") return false;
+	return value;
+}
+var Analytics = class {
+	client;
+	tags = {};
+	distinctId;
+	anonymousId;
+	_runId;
+	sessionId = null;
+	appName = "wizard";
+	activeFlags = null;
+	activeFlagPayloads = {};
+	groups = {};
+	personProperties = {};
+	terminalEventSent = false;
+	constructor() {
+		this.client = new PostHog(ANALYTICS_POSTHOG_PUBLIC_PROJECT_WRITE_KEY, {
+			host: ANALYTICS_HOST_URL,
+			flushAt: 1,
+			flushInterval: 0,
+			enableExceptionAutocapture: true,
+			before_send: (event) => {
+				if (!event) return event;
+				if (Object.keys(this.groups).length > 0) event.groups = {
+					...this.groups,
+					...event.groups
+				};
+				if (event.event === "$exception") {
+					event.distinctId = this.distinctId ?? this.anonymousId;
+					const { $process_person_profile, ...properties } = event.properties ?? {};
+					event.properties = {
+						...this.tags,
+						...properties
+					};
+				}
+				if (event.event === "$feature_flag_called") event.properties = {
+					...this.tags,
+					...event.properties ?? {}
+				};
+				return event;
+			}
+		});
+		this.tags = { $app_name: this.appName };
+		this.tags.build = "prod";
+		this.tags.run_surface = RUN_SURFACE;
+		this.tags.version = VERSION;
+		if (TASK_RUN_ID) this.tags.task_run_id = TASK_RUN_ID;
+		if (TASK_ID) this.tags.task_id = TASK_ID;
+		this.anonymousId = v4();
+		this._runId = v4();
+		this.tags.run_id = this._runId;
+		this.distinctId = void 0;
+	}
+	/** Per-process run id, tagged on every event and gateway trace. */
+	get runId() {
+		return this._runId;
+	}
+	/** Build type for this run ('prod' | 'dev' | 'ci' | 'headless') — the same value tagged on every analytics event. */
+	get build() {
+		return String(this.tags.build ?? "dev");
+	}
+	/**
+	* Associate the run with the logged-in user, once per id. Identifies them
+	* (email, name) and records those person properties so events carry them and
+	* feature flags can target the individual user — without the email here the
+	* wizard only sends `$app_name`, so email-targeted flags never match. Opens
+	* the analytics session on first login, then aliases the run's anonymous id
+	* onto the identified person so pre-login events merge in.
+	*/
+	identifyUser(user) {
+		const distinctId = user.distinct_id;
+		if (this.distinctId === distinctId || distinctId === this.anonymousId) return;
+		this.distinctId = distinctId;
+		if (!this.sessionId) {
+			this.sessionId = v4();
+			this.tags.$session_id = this.sessionId;
+		}
+		const props = {};
+		if (user.email) props.email = user.email;
+		const name = [user.first_name, user.last_name].filter(Boolean).join(" ").trim();
+		if (name) props.name = name;
+		this.personProperties = props;
+		this.client.identify({
+			distinctId,
+			properties: { $set: props }
+		});
+		this.client.alias({
+			distinctId,
+			alias: this.anonymousId
+		});
+		this.activeFlags = null;
+		this.activeFlagPayloads = {};
+	}
+	/** Person properties sent with flag evaluation: app name plus the user's. */
+	flagPersonProperties() {
+		return {
+			$app_name: this.appName,
+			version: VERSION,
+			run_surface: RUN_SURFACE,
+			build: String(this.tags.build ?? "dev"),
+			os: process.platform,
+			node_major: process.versions.node.split(".")[0],
+			...invocationProperties(),
+			...this.personProperties
+		};
+	}
+	setTag(key, value) {
+		this.tags[key] = value;
+	}
+	setGroups(groups) {
+		this.groups = groups;
+	}
+	captureException(error, properties = {}) {
+		const code = error instanceof WizardError && error.code || (typeof properties.error_code === "string" ? properties.error_code : "");
+		this.client.captureException(error, this.distinctId ?? this.anonymousId, {
+			team: ANALYTICS_TEAM_TAG,
+			...code ? { $exception_fingerprint: `wizard_${code}` } : {},
+			...this.tags,
+			...properties
+		});
+	}
+	capture(eventName, properties) {
+		this.client.capture({
+			distinctId: this.distinctId ?? this.anonymousId,
+			event: eventName,
+			properties: {
+				...this.tags,
+				...this.wizardFlagFeatureProperties(),
+				...properties
+			}
+		});
+	}
+	groupIdentify(groupType, groupKey, properties) {
+		this.client.groupIdentify({
+			groupType,
+			groupKey,
+			properties
+		});
+	}
+	wizardFlagFeatureProperties() {
+		if (this.activeFlags === null) return {};
+		const props = {};
+		const active = [];
+		for (const [key, value] of Object.entries(this.activeFlags)) {
+			if (!WIZARD_FLAGS.has(key)) continue;
+			const resolved = flagResponseValue(value);
+			props[`$feature/${key}`] = resolved;
+			if (resolved !== false) active.push(key);
+		}
+		if (active.length > 0) props.$active_feature_flags = active.sort();
+		return props;
+	}
+	/**
+	* Capture a wizard-specific event. Automatically prepends "wizard: " to the event name.
+	* All new wizard analytics should use this method instead of capture() directly.
+	*/
+	wizardCapture(eventName, properties) {
+		this.capture(`wizard: ${eventName}`, properties);
+	}
+	/**
+	* Flush pending events without firing the "setup wizard finished" terminal
+	* event. Use this from CLI error paths that exit before any wizard run
+	* starts — `shutdown()` would inflate the run count with a "finished" event
+	* for a parse error that never actually ran the wizard.
+	*/
+	async flush() {
+		await this.client.shutdown();
+	}
+	/**
+	* Evaluate all feature flags for the current user at the start of a run.
+	* Result is cached; subsequent calls in the same run return the same map.
+	* Returns flag key -> string value (booleans become 'true'/'false').
+	*/
+	async getAllFlagsForWizard() {
+		if (this.activeFlags !== null) return this.activeFlags;
+		const out = {};
+		const payloads = {};
+		try {
+			const distinctId = this.distinctId ?? this.anonymousId;
+			logToFile("[flags] evaluating as", {
+				distinctId,
+				identified: this.distinctId !== void 0,
+				personProperties: this.flagPersonProperties()
+			});
+			const evaluation = await this.client.evaluateFlags(distinctId, { personProperties: this.flagPersonProperties() });
+			for (const key of WIZARD_FLAG_KEYS) {
+				const value = evaluation.getFlag(key);
+				if (value === void 0) continue;
+				out[key] = String(value);
+				const payload = evaluation.getFlagPayload(key);
+				if (payload !== void 0) payloads[key] = payload;
+			}
+		} catch (error) {
+			logToFile("Failed to get all feature flags:", error);
+			this.captureException(error instanceof Error ? error : new Error(String(error)), { step: "get_all_flags" });
+		}
+		const merged = applyCiFlagOverrides(out, payloads);
+		this.activeFlags = merged.flags;
+		this.activeFlagPayloads = merged.payloads;
+		logToFile("[flags] evaluated", this.activeFlags);
+		return this.activeFlags;
+	}
+	getCachedWizardFlags() {
+		return this.activeFlags;
+	}
+	/** Flag payloads from the same snapshot; empty until the flags are fetched. */
+	getWizardFlagPayloads() {
+		return this.activeFlagPayloads;
+	}
+	async shutdown(status) {
+		if (Object.keys(this.tags).length === 0) return;
+		if (this.terminalEventSent) return;
+		this.terminalEventSent = true;
+		this.client.capture({
+			distinctId: this.distinctId ?? this.anonymousId,
+			event: "setup wizard finished",
+			properties: {
+				...this.tags,
+				run_id: this._runId,
+				...this.sessionId ? { $session_id: this.sessionId } : {},
+				status,
+				tags: this.tags
+			}
+		});
+		await this.client.shutdown();
+	}
+};
+const analytics = new Analytics();
+//#endregion
+export { WIZARD_REMARK_EVENT_NAME as $, POSTHOG_APP_URL as A, REPLAY_VISION_SUPPORTED as B, HAIKU_MODEL as C, Integration as D, ISSUES_URL as E, POSTHOG_PRIVACY_URL as F, WIZARD_CONTACT_EMAIL as G, SONNET_5_MODEL as H, POSTHOG_PROXY_CLIENT_ID as I, WIZARD_OAUTH_SCOPES as J, WIZARD_DEFAULT_AIO_LOGS_FLAG_KEY as K, POSTHOG_STATUS_PAGE_URL as L, POSTHOG_DOCS_URL as M, POSTHOG_EU_CLIENT_ID as N, OAUTH_PORTS as O, POSTHOG_ORG_AI_SETTINGS_URL as P, WIZARD_PROVISIONING_SCOPES as Q, POSTHOG_TERMS_URL as R, GPT5_6_TERRA_MODEL as S, Harness as T, Sequence as U, SETUP_REPORT_FILE as V, WIZARD_BASIC_INTEGRATION_AGENTIC_DETECTION_FLAG_KEY as W, WIZARD_ORCHESTRATOR_OVERRIDE_FLAG_KEY as X, WIZARD_ORCHESTRATOR_FLAG_KEY as Y, WIZARD_ORCHESTRATOR_SEEDED_TASKS_FLAG_KEY as Z, EVENT_INVENTORY_PART_PATTERN as _, ciExcludedTaskTypes as a, MCP_LOCAL_URL as at, GPT5_6_LUNA_MODEL as b, AGENTIC_DETECTION_RETRY_TIMEOUT_MS as c, getLocalDev as ct, CONTEXT_MILL_URL as d, resolveLocalDev as dt, WIZARD_RUN_SYNC_FLAG_KEY as et, DEFAULT_AGENT_MODEL as f, EVENT_INVENTORY_FILE as g, EVENTS_AUDIT_REPORT_FILE as h, sessionProperties as i, wizardUserAgentForProgram as it, POSTHOG_DEV_CLIENT_ID as j, OAUTH_TIMEOUT_MS as k, AWS_SKILLS_BASE_URL as l, initLocalDev as lt, DUMMY_PROJECT_API_KEY as m, analytics as n, WIZARD_USER_AGENT as nt, mayReportScanResults as o, POSTHOG_LOCAL_URL as ot, DETECTION_TIMEOUT_MS as p, WIZARD_INTERACTION_EVENT_NAME as q, groupsFromUser as r, getSkillsBaseUrl as rt, AGENTIC_DETECTION_FIRST_ATTEMPT_TIMEOUT_MS as s, checkLocalServices as st, Analytics as t, WIZARD_SELF_DRIVING_USE_PI_HARNESS_FLAG_KEY as tt, CONTEXT_MILL_RELEASES_URL as u, localMcpSkillsNotice as ut, EVENT_PLAN_FILE as v, HAIKU_TRIAGE_MODEL as w, GPT5_6_SOL_MODEL as x, GITHUB_SKILLS_BASE_URL as y, POSTHOG_US_CLIENT_ID as z };
+
+//# sourceMappingURL=analytics-CGGE7OSa.js.map