@posthog/wizard 2.80.0 → 2.81.0

package/dist/{debug-DyARf5TF.js → debug-sB20p-Ek.js}

@@ -3,37 +3,6 @@ import path from "path";
 import { inspect } from "node:util";
 import { tmpdir } from "node:os";
 import { join as join$1, sep as sep$1 } from "node:path";
-//#region src/shared/headless-mode.ts
-/**
-* The on-CLI flag name. Intentionally ugly + undocumented; do not surface it in
-* `--help`, the README, or user-facing error messages.
-*/
-const HEADLESS_FLAG = "headless-DONOTUSE-EXPERIMENTAL";
-/**
-* The yargs option declaration for the headless flag. Commands opt in so that
-* unsupported commands reject headless execution instead of starting it.
-*/
-const headlessOption = { [HEADLESS_FLAG]: {
-	default: false,
-	describe: "EXPERIMENTAL — do not use. Unstable, subject to breaking changes.",
-	type: "boolean",
-	hidden: true
-} };
-/**
-* Read the headless signal off a parsed argv / options bag. yargs always sets
-* the value under the declared key (`HEADLESS_FLAG`), so reading that key is
-* reliable regardless of camel-case expansion.
-*/
-function isHeadless(options) {
-	return options[HEADLESS_FLAG] === true;
-}
-const regionOption = { region: {
-	describe: "PostHog cloud region\nenv: POSTHOG_WIZARD_REGION",
-	choices: ["us", "eu"],
-	type: "string",
-	hidden: true
-} };
-//#endregion
 //#region src/env.ts
 /**
 * Central environment variable access for the PostHog wizard.
@@ -51,6 +20,11 @@ const regionOption = { region: {
 * vendored code. Production source outside those cases should use
 * this module instead.
 */
+/**
+* The on-CLI flag name. Intentionally ugly + undocumented; do not surface it in
+* `--help`, the README, or user-facing error messages.
+*/
+const HEADLESS_FLAG = "headless-DONOTUSE-EXPERIMENTAL";
 const NODE_ENV = "production";
 /** 'cloud' when launched with the experimental headless flag, else 'local' — resolved once from argv at launch. */
 const RUN_SURFACE = process.argv.some((a) => a === `--headless-DONOTUSE-EXPERIMENTAL` || a.startsWith(`--headless-DONOTUSE-EXPERIMENTAL=`)) ? "cloud" : "local";
@@ -66,6 +40,9 @@ function runtimeEnv(key) {
 const TASK_RUN_ID = runtimeEnv("POSTHOG_TASK_RUN_ID") || void 0;
 const TASK_ID = runtimeEnv("POSTHOG_TASK_ID") || void 0;
 //#endregion
+//#region src/shared/version.ts
+const VERSION = "2.81.0";
+//#endregion
 //#region src/shared/utils/paths.ts
 const TMP = process.platform === "win32" ? tmpdir() : "/tmp";
 const WIZARD_LOG_FILE = join$1(TMP, "posthog-wizard.log");
@@ -87,7 +64,7 @@ function relativeToInstallDir(file, installDir) {
 //#region src/shared/utils/debug.ts
 let logFilePath = WIZARD_LOG_FILE;
 let fileLoggingEnabled = true;
-let consoleLoggingEnabled = false;
+let logFilePinned = false;
 function stringify(value) {
 	if (typeof value === "string") return value;
 	if (value instanceof Error) return value.stack ?? String(value);
@@ -97,17 +74,20 @@ function stringify(value) {
 		return inspect(value, { depth: 3 });
 	}
 }
-function renderLine(args) {
+/** One log line from `logToFile`-style arguments: strings as they are, errors as their stack, the rest as JSON. */
+function formatLogLine(...args) {
 	return args.map(stringify).join(" ");
 }
 function getLogFilePath() {
 	return logFilePath;
 }
 function configureLogFile(opts) {
-	if (opts.path !== void 0) {
+	if (opts.pin === false) logFilePinned = false;
+	if (opts.path !== void 0 && !logFilePinned) {
 		logFilePath = opts.path;
 		ensuredLogDir = false;
 	}
+	if (opts.pin === true) logFilePinned = true;
 	if (opts.enabled !== void 0) fileLoggingEnabled = opts.enabled;
 }
 let ensuredLogDir = false;
@@ -115,7 +95,7 @@ let reportedLogFailure = false;
 function reportLogFailureOnce(err) {
 	if (reportedLogFailure) return;
 	reportedLogFailure = true;
-	import("./analytics-BXtfK9o7.js").then(({ analytics }) => analytics.captureException(err instanceof Error ? err : new Error(String(err)), {
+	import("./analytics-D6NAIJxP.js").then(({ analytics }) => analytics.captureException(err instanceof Error ? err : new Error(String(err)), {
 		source: "log-file-write",
 		log_path: logFilePath,
 		platform: process.platform
@@ -149,23 +129,9 @@ function initLogFile() {
 }
 function logToFile(...args) {
 	if (!fileLoggingEnabled) return;
-	appendLine(`[${(/* @__PURE__ */ new Date()).toISOString()}] ${renderLine(args)}\n`);
-}
-let debugSink = (line) => process.stdout.write(`${line}\n`);
-/** Replace the console sink; returns the previous one so callers can restore it. */
-function setDebugSink(sink) {
-	const previous = debugSink;
-	debugSink = sink;
-	return previous;
-}
-function debug(...args) {
-	if (!consoleLoggingEnabled) return;
-	debugSink(renderLine(args));
-}
-function enableDebugLogs() {
-	consoleLoggingEnabled = true;
+	appendLine(`[${(/* @__PURE__ */ new Date()).toISOString()}] ${formatLogLine(...args)}\n`);
 }
 //#endregion
-export { TASK_RUN_ID as _, getLogFilePath as a, isHeadless as b, setDebugSink as c, WIZARD_TASK_STREAM_FILE as d, WIZARD_YARA_REPORT_FILE as f, TASK_ID as g, RUN_SURFACE as h, enableDebugLogs as i, WIZARD_BENCHMARK_FILE as l, NODE_ENV as m, configureLogFileFromEnvironment as n, initLogFile as o, relativeToInstallDir as p, debug as r, logToFile as s, configureLogFile as t, WIZARD_LOG_FILE as u, runtimeEnv as v, regionOption as x, headlessOption as y };
+export { TASK_RUN_ID as _, initLogFile as a, WIZARD_LOG_FILE as c, relativeToInstallDir as d, VERSION as f, TASK_ID as g, RUN_SURFACE as h, getLogFilePath as i, WIZARD_TASK_STREAM_FILE as l, NODE_ENV as m, configureLogFileFromEnvironment as n, logToFile as o, HEADLESS_FLAG as p, formatLogLine as r, WIZARD_BENCHMARK_FILE as s, configureLogFile as t, WIZARD_YARA_REPORT_FILE as u, runtimeEnv as v };
 
-//# sourceMappingURL=debug-DyARf5TF.js.map
+//# sourceMappingURL=debug-sB20p-Ek.js.map

package/dist/debug-sB20p-Ek.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug-sB20p-Ek.js","names":["join","sep"],"sources":["../src/env.ts","../src/shared/version.ts","../src/shared/utils/paths.ts","../src/shared/utils/debug.ts"],"sourcesContent":["/**\n * Central environment variable access for the PostHog wizard.\n *\n * ── Build-time constants ────────────────────────────────────────────\n * Inlined by tsdown's `env` option at compile time. After build, the\n * runtime value of these env vars has zero effect on the wizard.\n *\n * ── Runtime variables ───────────────────────────────────────────────\n * Read through `runtimeEnv()` with a typed allowlist. This makes every\n * runtime dependency on the environment explicit and grep-able.\n *\n * ── Direct process.env access ───────────────────────────────────────\n * Reserved for subprocess environment configuration (writes) and\n * vendored code. Production source outside those cases should use\n * this module instead.\n */\n\n/**\n * The on-CLI flag name. Intentionally ugly + undocumented; do not surface it in\n * `--help`, the README, or user-facing error messages.\n */\nexport const HEADLESS_FLAG = 'headless-DONOTUSE-EXPERIMENTAL';\n\n// ── Build-time constants ─────────────────────────────────────────────\n// tsdown replaces `process.env.NODE_ENV` with a string literal.\n// After build these are just `\"production\"`, `false`, etc.\n\nexport const NODE_ENV = process.env.NODE_ENV as string;\nexport const IS_DEV =\n  process.env.NODE_ENV === 'development' || process.env.NODE_ENV === 'test';\n\n/**\n * True only in published/production builds. tsdown inlines\n * `process.env.NODE_ENV` as the literal `\"production\"` at build time, so this\n * collapses to `true` in `dist/` and stays `false` for `tsx`/dev/test runs\n * (where NODE_ENV is unset, `development`, or `test`). Used to gate features\n * that aren't supported in the shipped package — e.g. `--ci` mode.\n */\nexport const IS_PRODUCTION_BUILD = process.env.NODE_ENV === 'production';\n\n/** 'cloud' when launched with the experimental headless flag, else 'local' — resolved once from argv at launch. */\nexport const RUN_SURFACE: 'cloud' | 'local' = process.argv.some(\n  (a) => a === `--${HEADLESS_FLAG}` || a.startsWith(`--${HEADLESS_FLAG}=`),\n)\n  ? 'cloud'\n  : 'local';\n\n// ── Runtime environment ──────────────────────────────────────────────\n\n/**\n * Exhaustive allowlist of env vars the wizard reads at runtime.\n * Add new keys here when a new runtime dependency is needed.\n */\ntype RuntimeEnvKey =\n  // CI-build-only flag overrides (see utils/ci-flag-overrides.ts).\n  // Deliberately NOT POSTHOG_WIZARD_-prefixed: yargs .env('POSTHOG_WIZARD')\n  // would claim it as an unknown CLI option and strict-reject the run.\n  | 'WIZARD_CI_FLAG_OVERRIDES'\n  | 'WIZARD_CI_EXCLUDE_TASKS'\n  | 'WIZARD_CI_GATEWAY_TOKEN_FILE'\n  | 'WIZARD_CI_GATEWAY_URL'\n  // Wizard CLI configuration (yargs POSTHOG_WIZARD_ prefix)\n  | 'POSTHOG_WIZARD_BENCHMARK_CONFIG'\n  | 'POSTHOG_WIZARD_BENCHMARK_FILE'\n  | 'POSTHOG_WIZARD_LOG_DIR'\n  | 'POSTHOG_WIZARD_DEBUG'\n  // Identity of the PostHog task run whose sandbox launched this wizard. Set by\n  // the sandbox for every run it starts, agent or wizard. Deliberately NOT\n  // POSTHOG_WIZARD_-prefixed, for the same reason as the two keys above:\n  // yargs .env('POSTHOG_WIZARD') would claim them as CLI options and\n  // .strictOptions() would reject the run unless the wizard also declared them,\n  // which would tie every sandbox deploy to an npm release of this package.\n  | 'POSTHOG_WIZARD_RUN_ID'\n  | 'POSTHOG_TASK_RUN_ID'\n  | 'POSTHOG_TASK_ID'\n  | 'POSTHOG_HANDOFF_OUTPUT_PATH'\n  // Local/CI escape hatch to disable Warlock scanning without the PostHog flag.\n  | 'POSTHOG_WIZARD_WARLOCK_DISABLED'\n  | 'DEBUG'\n  // Agent / MCP\n  | 'MCP_URL'\n  | 'POSTHOG_API_KEY'\n  // Platform: terminal detection\n  | 'TERM'\n  | 'TERM_PROGRAM'\n  | 'TERMINAL_EMULATOR'\n  | 'CI'\n  | 'WT_SESSION'\n  | 'TERMINUS_SUBLIME'\n  | 'ConEmuTask'\n  // Platform: paths\n  | 'APPDATA'\n  | 'OPENCODE_CONFIG_DIR'\n  | 'XDG_CONFIG_HOME';\n\n/** Read a runtime environment variable. Only allowlisted keys compile. */\nexport function runtimeEnv(key: RuntimeEnvKey): string | undefined {\n  return process.env[key];\n}\n\n/**\n * The PostHog task run that launched this wizard, when one did. A cloud run's\n * sandbox exports both ids into the wizard's environment; every local run\n * leaves them undefined. Resolved once at launch, like RUN_SURFACE above.\n */\nexport const TASK_RUN_ID: string | undefined =\n  runtimeEnv('POSTHOG_TASK_RUN_ID') || undefined;\nexport const TASK_ID: string | undefined =\n  runtimeEnv('POSTHOG_TASK_ID') || undefined;\n","// Auto-generated by scripts/generate-version.js — do not edit\nexport const VERSION = '2.81.0';\n","import { tmpdir } from 'node:os';\nimport { join, sep } from 'node:path';\n\n// /tmp is stable and discoverable on macOS/Linux; Windows needs os.tmpdir()\nconst TMP = process.platform === 'win32' ? tmpdir() : '/tmp';\n\nexport const WIZARD_LOG_FILE = join(TMP, 'posthog-wizard.log');\nexport const WIZARD_BENCHMARK_FILE = join(TMP, 'posthog-wizard-benchmark.json');\n/** Default target of `--task-stream-log`. Dev builds only. */\nexport const WIZARD_TASK_STREAM_FILE = join(\n  TMP,\n  'posthog-wizard-task-stream.jsonl',\n);\nexport const WIZARD_YARA_REPORT_FILE = join(\n  TMP,\n  'posthog-wizard-yara-report.json',\n);\n/**\n * Strip an absolute installDir prefix off a project file path so the UI\n * renders `index.js:12` instead of `/Users/.../index.js:12`. Defends\n * against false matches like `/Users/foo` ⊂ `/Users/foobar/x.js` by\n * normalizing to a trailing path separator before the prefix check.\n */\nexport function relativeToInstallDir(file: string, installDir: string): string {\n  const prefix = installDir.endsWith(sep) ? installDir : installDir + sep;\n  return file.startsWith(prefix) ? file.slice(prefix.length) : file;\n}\n","import { appendFileSync, mkdirSync } from 'fs';\nimport path from 'path';\nimport { inspect } from 'node:util';\nimport { IS_DEV, runtimeEnv } from '@env';\nimport { WIZARD_LOG_FILE } from './paths';\n\n// Dev builds may redirect the log so concurrent runs don't interleave one file.\nlet logFilePath =\n  (IS_DEV && process.env.POSTHOG_WIZARD_LOG_FILE) || WIZARD_LOG_FILE;\nlet fileLoggingEnabled = true;\n// An explicit --log-file wins over every later path change while pinned.\nlet logFilePinned = false;\n\nfunction stringify(value: unknown): string {\n  if (typeof value === 'string') return value;\n  if (value instanceof Error) return value.stack ?? String(value);\n  try {\n    // JSON.stringify throws on cycles and skips some values — fall back to\n    // inspect so a crash log line is never dropped.\n    return JSON.stringify(value, null, 2) ?? inspect(value, { depth: 3 });\n  } catch {\n    return inspect(value, { depth: 3 });\n  }\n}\n\n/** One log line from `logToFile`-style arguments: strings as they are, errors as their stack, the rest as JSON. */\nexport function formatLogLine(...args: readonly unknown[]): string {\n  return args.map(stringify).join(' ');\n}\n\nexport function getLogFilePath(): string {\n  return logFilePath;\n}\n\nexport function configureLogFile(opts: {\n  path?: string;\n  enabled?: boolean;\n  pin?: boolean;\n}): void {\n  if (opts.pin === false) logFilePinned = false;\n  if (opts.path !== undefined && !logFilePinned) {\n    logFilePath = opts.path;\n    ensuredLogDir = false;\n  }\n  if (opts.pin === true) logFilePinned = true;\n  if (opts.enabled !== undefined) fileLoggingEnabled = opts.enabled;\n}\n\nlet ensuredLogDir = false;\nlet reportedLogFailure = false;\n\n// Failed log writes go to error tracking, once per process. Dynamic import:\n// analytics logs through this module, so a static import would be a cycle.\nfunction reportLogFailureOnce(err: unknown): void {\n  if (reportedLogFailure) return;\n  reportedLogFailure = true;\n  void import('./analytics')\n    .then(({ analytics }) =>\n      analytics.captureException(\n        err instanceof Error ? err : new Error(String(err)),\n        {\n          source: 'log-file-write',\n          log_path: logFilePath,\n          platform: process.platform,\n        },\n      ),\n    )\n    .catch(() => {\n      // Reporting must never crash the wizard either.\n    });\n}\n\n// The log's directory isn't guaranteed to exist (Windows %TEMP%,\n// POSTHOG_WIZARD_LOG_DIR) — create it on first failure.\nfunction appendLine(text: string): void {\n  try {\n    appendFileSync(logFilePath, text);\n  } catch (err) {\n    if (ensuredLogDir) {\n      reportLogFailureOnce(err);\n      return;\n    }\n    ensuredLogDir = true;\n    try {\n      mkdirSync(path.dirname(logFilePath), { recursive: true });\n      appendFileSync(logFilePath, text);\n    } catch (retryErr) {\n      reportLogFailureOnce(retryErr);\n    }\n  }\n}\n\nexport function configureLogFileFromEnvironment(): void {\n  const dir = runtimeEnv('POSTHOG_WIZARD_LOG_DIR');\n  if (dir) {\n    configureLogFile({ path: path.join(dir, 'posthog-wizard.log') });\n  }\n}\n\nexport function initLogFile(): void {\n  if (!fileLoggingEnabled) return;\n  const divider = '='.repeat(60);\n  appendLine(\n    `\\n${divider}\\nPostHog Wizard Run: ${new Date().toISOString()}\\n${divider}\\n`,\n  );\n}\n\nexport function logToFile(...args: unknown[]): void {\n  if (!fileLoggingEnabled) return;\n  const ts = new Date().toISOString();\n  appendLine(`[${ts}] ${formatLogLine(...args)}\\n`);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,gBAAgB;AAM7B,MAAa,WAAA;;AAcb,MAAa,cAAiC,QAAQ,KAAK,MACxD,MAAM,MAAM,sCAAwB,EAAE,WAAW,oCAAsB,CACzE,GACG,UACA;;AAmDJ,SAAgB,WAAW,KAAwC;AACjE,QAAO,QAAQ,IAAI;;;;;;;AAQrB,MAAa,cACX,WAAW,sBAAsB,IAAI,KAAA;AACvC,MAAa,UACX,WAAW,kBAAkB,IAAI,KAAA;;;AC3GnC,MAAa,UAAU;;;ACGvB,MAAM,MAAM,QAAQ,aAAa,UAAU,QAAQ,GAAG;AAEtD,MAAa,kBAAkBA,OAAK,KAAK,qBAAqB;AAC9D,MAAa,wBAAwBA,OAAK,KAAK,gCAAgC;;AAE/E,MAAa,0BAA0BA,OACrC,KACA,mCACD;AACD,MAAa,0BAA0BA,OACrC,KACA,kCACD;;;;;;;AAOD,SAAgB,qBAAqB,MAAc,YAA4B;CAC7E,MAAM,SAAS,WAAW,SAASC,MAAI,GAAG,aAAa,aAAaA;AACpE,QAAO,KAAK,WAAW,OAAO,GAAG,KAAK,MAAM,OAAO,OAAO,GAAG;;;;AClB/D,IAAI,cACiD;AACrD,IAAI,qBAAqB;AAEzB,IAAI,gBAAgB;AAEpB,SAAS,UAAU,OAAwB;AACzC,KAAI,OAAO,UAAU,SAAU,QAAO;AACtC,KAAI,iBAAiB,MAAO,QAAO,MAAM,SAAS,OAAO,MAAM;AAC/D,KAAI;AAGF,SAAO,KAAK,UAAU,OAAO,MAAM,EAAE,IAAI,QAAQ,OAAO,EAAE,OAAO,GAAG,CAAC;SAC/D;AACN,SAAO,QAAQ,OAAO,EAAE,OAAO,GAAG,CAAC;;;;AAKvC,SAAgB,cAAc,GAAG,MAAkC;AACjE,QAAO,KAAK,IAAI,UAAU,CAAC,KAAK,IAAI;;AAGtC,SAAgB,iBAAyB;AACvC,QAAO;;AAGT,SAAgB,iBAAiB,MAIxB;AACP,KAAI,KAAK,QAAQ,MAAO,iBAAgB;AACxC,KAAI,KAAK,SAAS,KAAA,KAAa,CAAC,eAAe;AAC7C,gBAAc,KAAK;AACnB,kBAAgB;;AAElB,KAAI,KAAK,QAAQ,KAAM,iBAAgB;AACvC,KAAI,KAAK,YAAY,KAAA,EAAW,sBAAqB,KAAK;;AAG5D,IAAI,gBAAgB;AACpB,IAAI,qBAAqB;AAIzB,SAAS,qBAAqB,KAAoB;AAChD,KAAI,mBAAoB;AACxB,sBAAqB;AAChB,QAAO,2BACT,MAAM,EAAE,gBACP,UAAU,iBACR,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,IAAI,CAAC,EACnD;EACE,QAAQ;EACR,UAAU;EACV,UAAU,QAAQ;EACnB,CACF,CACF,CACA,YAAY,GAEX;;AAKN,SAAS,WAAW,MAAoB;AACtC,KAAI;AACF,iBAAe,aAAa,KAAK;UAC1B,KAAK;AACZ,MAAI,eAAe;AACjB,wBAAqB,IAAI;AACzB;;AAEF,kBAAgB;AAChB,MAAI;AACF,aAAU,KAAK,QAAQ,YAAY,EAAE,EAAE,WAAW,MAAM,CAAC;AACzD,kBAAe,aAAa,KAAK;WAC1B,UAAU;AACjB,wBAAqB,SAAS;;;;AAKpC,SAAgB,kCAAwC;CACtD,MAAM,MAAM,WAAW,yBAAyB;AAChD,KAAI,IACF,kBAAiB,EAAE,MAAM,KAAK,KAAK,KAAK,qBAAqB,EAAE,CAAC;;AAIpE,SAAgB,cAAoB;AAClC,KAAI,CAAC,mBAAoB;CACzB,MAAM,UAAU,IAAI,OAAO,GAAG;AAC9B,YACE,KAAK,QAAQ,yCAAwB,IAAI,MAAM,EAAC,aAAa,CAAC,IAAI,QAAQ,IAC3E;;AAGH,SAAgB,UAAU,GAAG,MAAuB;AAClD,KAAI,CAAC,mBAAoB;AAEzB,YAAW,qBADA,IAAI,MAAM,EAAC,aAAa,CACjB,IAAI,cAAc,GAAG,KAAK,CAAC,IAAI"}

package/dist/{defaults-DpfMnH2q.js → defaults-DDVl3tKN.js}

@@ -1,53 +1,4 @@
 import z$1 from "zod";
-//#region src/shared/mcp-clients/results.ts
-/**
-* Failure text comes from CLIs we invoke with the user's personal API key on the
-* command line (`--header "Authorization: Bearer phx_..."`), so it can carry the
-* key into the log file, the TUI and exception reports. Mask it first.
-*
-* The plugin stages clone git repositories and read the user's own config, so
-* the text reaching here is no longer only ours: a failing clone echoes the
-* remote URL with any credentials embedded in it, and a config error can quote
-* a foreign provider's key. Each pattern below is a shape we have seen a CLI
-* print, not a guess at every possible secret.
-*/
-const redactSecrets = (raw) => raw.replace(/Bearer\s+\S+/gi, "Bearer [redacted]").replace(/ph[xspc]_[A-Za-z0-9_-]+/g, "[redacted]").replace(/(\bhttps?:\/\/)[^/\s:@]+:[^/\s@]+@/gi, "$1[redacted]@").replace(/\bgh[pousr]_[A-Za-z0-9]{16,}/g, "[redacted]").replace(/\bgithub_pat_[A-Za-z0-9_]{20,}/g, "[redacted]").replace(/\bsk-[A-Za-z0-9_-]{16,}/g, "[redacted]").replace(/\bAIza[A-Za-z0-9_-]{16,}/g, "[redacted]").replace(/\b([A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIALS?)[A-Za-z0-9_]*)(\s*[=:]\s*)["']?[A-Za-z0-9_\-./+]{8,}["']?/gi, "$1$2[redacted]");
-/**
-* Replace the user's home directory with `~`. Error tracking fingerprints on
-* the message, so a path that differs per user splits one root cause into one
-* issue per user — and the username itself never needs to leave the machine.
-*/
-const scrubHomePaths = (raw) => raw.replace(/\/(?:Users|home)\/[^/\s'"]+/g, "~").replace(/[A-Za-z]:\\Users\\[^\\\s'"]+/gi, "~");
-/**
-* The first matching hint, or undefined when the failure is worth reporting.
-*
-* `stage` is the caller's name for what it was doing. Passing it lets an entry
-* narrow itself; omitting it only considers entries that claim every stage,
-* because an unscoped call cannot honour a scoped entry.
-*/
-const expectedFailureHint = (text, table, stage) => {
-	if (!text.trim()) return void 0;
-	return table.find((f) => (f.stages === void 0 || stage !== void 0 && f.stages.includes(stage)) && f.match.test(text) && !f.unless?.test(text))?.hint;
-};
-/** First non-empty line of an error, trimmed to something a TUI line can hold. */
-const summarizeFailure = (raw) => {
-	const line = redactSecrets(raw ?? "").split("\n").map((l) => l.trim()).find((l) => l.length > 0);
-	if (!line) return void 0;
-	return line.length > 120 ? `${line.slice(0, 117)}...` : line;
-};
-const toClientResult = (name, result) => {
-	if (!result?.success) return {
-		name,
-		status: "failed",
-		detail: summarizeFailure(result?.reason)
-	};
-	return {
-		name,
-		status: result.alreadyInstalled ? "unchanged" : "changed"
-	};
-};
-const isOk = (r) => r.status !== "failed";
-const namesWithStatus = (results, status) => results.filter((r) => r.status === status).map((r) => r.name);
 z$1.object({ mcpServers: z$1.record(z$1.string(), z$1.union([z$1.object({
 	command: z$1.string().optional(),
 	args: z$1.array(z$1.string()).optional(),
@@ -304,6 +255,6 @@ const getDefaultServerConfig = (apiKey, selectedFeatures, local) => {
 	};
 };
 //#endregion
-export { getNativeHTTPServerConfig as a, isOk as c, scrubHomePaths as d, summarizeFailure as f, getDefaultServerConfig as i, namesWithStatus as l, AVAILABLE_FEATURES as n, isAllFeaturesSelected as o, toClientResult as p, buildMCPUrl as r, expectedFailureHint as s, ALL_FEATURE_VALUES as t, redactSecrets as u };
+export { getNativeHTTPServerConfig as a, getDefaultServerConfig as i, AVAILABLE_FEATURES as n, isAllFeaturesSelected as o, buildMCPUrl as r, ALL_FEATURE_VALUES as t };
 
-//# sourceMappingURL=defaults-DpfMnH2q.js.map
+//# sourceMappingURL=defaults-DDVl3tKN.js.map

package/dist/defaults-DDVl3tKN.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults-DDVl3tKN.js","names":["z"],"sources":["../src/shared/mcp-clients/defaults.ts"],"sourcesContent":["import z from 'zod';\n\nexport const DefaultMCPClientConfig = z\n  .object({\n    mcpServers: z.record(\n      z.string(),\n      z.union([\n        z.object({\n          command: z.string().optional(),\n          args: z.array(z.string()).optional(),\n          env: z.record(z.string(), z.string()).optional(),\n        }),\n        z.object({\n          url: z.string(),\n          headers: z.record(z.string(), z.string()).optional(),\n        }),\n      ]),\n    ),\n  })\n  .passthrough();\n\nexport const AVAILABLE_FEATURES = {\n  'Data & Analytics': [\n    {\n      value: 'dashboards',\n      label: 'Dashboards',\n      hint: 'Dashboard creation and management',\n    },\n    {\n      value: 'insights',\n      label: 'Insights',\n      hint: 'Analytics insights',\n    },\n    {\n      value: 'product_analytics',\n      label: 'Product Analytics',\n      hint: 'Insight CRUD management',\n    },\n    {\n      value: 'experiments',\n      label: 'Experiments',\n      hint: 'A/B testing experiments',\n    },\n    {\n      value: 'surveys',\n      label: 'Surveys',\n      hint: 'Survey management',\n    },\n    {\n      value: 'annotations',\n      label: 'Annotations',\n      hint: 'Annotation management',\n    },\n    {\n      value: 'replay',\n      label: 'Session Replay',\n      hint: 'Session recording management',\n    },\n    {\n      value: 'sql',\n      label: 'SQL',\n      hint: 'SQL query execution',\n    },\n    {\n      value: 'web_analytics',\n      label: 'Web Analytics',\n      hint: 'Web analytics queries and digests',\n    },\n    {\n      value: 'customer_analytics',\n      label: 'Usage metrics',\n      hint: 'Customer usage metric tracking',\n    },\n    {\n      value: 'signals',\n      label: 'Signals',\n      hint: 'Signal reports and source configs',\n    },\n  ],\n  'AI Engineering': [\n    {\n      value: 'llm_analytics',\n      label: 'AI Observability',\n      hint: 'LLM usage and cost tracking',\n    },\n  ],\n  'Development Tools': [\n    {\n      value: 'error_tracking',\n      label: 'Error Tracking',\n      hint: 'Error monitoring and debugging',\n    },\n    {\n      value: 'logs',\n      label: 'Logs',\n      hint: 'Log querying',\n    },\n    {\n      value: 'flags',\n      label: 'Feature Flags',\n      hint: 'Feature flag management',\n    },\n    {\n      value: 'early_access_features',\n      label: 'Early Access Features',\n      hint: 'Early access feature management',\n    },\n    {\n      value: 'cohorts',\n      label: 'Cohorts',\n      hint: 'Cohort management',\n    },\n    {\n      value: 'sdk_doctor',\n      label: 'SDK Doctor',\n      hint: 'SDK health diagnostics',\n    },\n    {\n      value: 'tracing',\n      label: 'APM Tracing',\n      hint: 'Distributed trace and span queries',\n    },\n  ],\n  'Data Management': [\n    {\n      value: 'events',\n      label: 'Events',\n      hint: 'Event and property definitions',\n    },\n    {\n      value: 'persons',\n      label: 'Persons',\n      hint: 'Person and group management',\n    },\n    {\n      value: 'actions',\n      label: 'Actions',\n      hint: 'Action definitions',\n    },\n    {\n      value: 'data_warehouse',\n      label: 'Data Warehouse',\n      hint: 'Data warehouse management',\n    },\n    {\n      value: 'endpoints',\n      label: 'Endpoints',\n      hint: 'Data warehouse endpoint management',\n    },\n    {\n      value: 'data_schema',\n      label: 'Data Schema',\n      hint: 'Data schema exploration',\n    },\n    {\n      value: 'batch_exports',\n      label: 'Batch Exports',\n      hint: 'Scheduled data exports',\n    },\n  ],\n  'CDP & Automation': [\n    {\n      value: 'hog_functions',\n      label: 'Hog Functions',\n      hint: 'CDP function management',\n    },\n    {\n      value: 'hog_function_templates',\n      label: 'Hog Function Templates',\n      hint: 'CDP function template browsing',\n    },\n    {\n      value: 'workflows',\n      label: 'Workflows',\n      hint: 'Workflow management',\n    },\n  ],\n  'Platform & Management': [\n    {\n      value: 'workspace',\n      label: 'Workspace',\n      hint: 'Organization and project management',\n    },\n    {\n      value: 'docs',\n      label: 'Documentation',\n      hint: 'PostHog documentation search',\n    },\n    {\n      value: 'notebooks',\n      label: 'Notebooks',\n      hint: 'Notebook management',\n    },\n    {\n      value: 'alerts',\n      label: 'Alerts',\n      hint: 'Alert management',\n    },\n    {\n      value: 'platform_features',\n      label: 'Platform Features',\n      hint: 'Activity logs, approvals, comments, and roles',\n    },\n    {\n      value: 'integrations',\n      label: 'Integrations',\n      hint: 'Connected integration management',\n    },\n    {\n      value: 'conversations',\n      label: 'Conversations',\n      hint: 'Support ticket management',\n    },\n    {\n      value: 'core',\n      label: 'Subscriptions',\n      hint: 'Scheduled insight and dashboard deliveries',\n    },\n    {\n      value: 'search',\n      label: 'Search',\n      hint: 'Entity search across the project',\n    },\n    {\n      value: 'reverse_proxy',\n      label: 'Reverse Proxy',\n      hint: 'Reverse proxy record management',\n    },\n    {\n      value: 'debug',\n      label: 'Debug',\n      hint: 'Debug and diagnostic tools',\n    },\n  ],\n};\n\nexport const ALL_FEATURE_VALUES = Object.values(AVAILABLE_FEATURES)\n  .flat()\n  .map((feature) => feature.value);\n\nexport const isAllFeaturesSelected = (features: string[]): boolean =>\n  features.length === ALL_FEATURE_VALUES.length &&\n  ALL_FEATURE_VALUES.every((feature) => features.includes(feature));\n\nexport const buildMCPUrl = (selectedFeatures?: string[], local?: boolean) => {\n  const host = local ? 'http://localhost:8787' : 'https://mcp.posthog.com';\n  const baseUrl = `${host}/mcp`;\n\n  const params: string[] = [];\n\n  // Add features param if not all features selected\n  if (\n    selectedFeatures &&\n    selectedFeatures.length > 0 &&\n    !isAllFeaturesSelected(selectedFeatures)\n  ) {\n    params.push(`features=${selectedFeatures.join(',')}`);\n  }\n\n  return params.length > 0 ? `${baseUrl}?${params.join('&')}` : baseUrl;\n};\n\nexport const getNativeHTTPServerConfig = (\n  apiKey: string | undefined,\n  selectedFeatures?: string[],\n  local?: boolean,\n) => {\n  const config: Record<string, unknown> = {\n    url: buildMCPUrl(selectedFeatures, local),\n  };\n\n  // Only add auth header if API key is provided (not OAuth mode)\n  if (apiKey) {\n    config.headers = {\n      Authorization: `Bearer ${apiKey}`,\n    };\n  }\n\n  return config;\n};\n\nexport const getDefaultServerConfig = (\n  apiKey: string | undefined,\n  selectedFeatures?: string[],\n  local?: boolean,\n) => {\n  const urlWithFeatures = buildMCPUrl(selectedFeatures, local);\n\n  // OAuth mode: no auth header, let MCP handle OAuth\n  if (!apiKey) {\n    return {\n      command: 'npx',\n      args: ['-y', 'mcp-remote@latest', urlWithFeatures],\n    };\n  }\n\n  // API key mode: include auth header\n  return {\n    command: 'npx',\n    args: [\n      '-y',\n      'mcp-remote@latest',\n      urlWithFeatures,\n      '--header',\n      `Authorization:\\${POSTHOG_AUTH_HEADER}`,\n    ],\n    env: {\n      POSTHOG_AUTH_HEADER: `Bearer ${apiKey}`,\n    },\n  };\n};\n"],"mappings":";AAEsCA,IACnC,OAAO,EACN,YAAYA,IAAE,OACZA,IAAE,QAAQ,EACVA,IAAE,MAAM,CACNA,IAAE,OAAO;CACP,SAASA,IAAE,QAAQ,CAAC,UAAU;CAC9B,MAAMA,IAAE,MAAMA,IAAE,QAAQ,CAAC,CAAC,UAAU;CACpC,KAAKA,IAAE,OAAOA,IAAE,QAAQ,EAAEA,IAAE,QAAQ,CAAC,CAAC,UAAU;CACjD,CAAC,EACFA,IAAE,OAAO;CACP,KAAKA,IAAE,QAAQ;CACf,SAASA,IAAE,OAAOA,IAAE,QAAQ,EAAEA,IAAE,QAAQ,CAAC,CAAC,UAAU;CACrD,CAAC,CACH,CAAC,CACH,EACF,CAAC,CACD,aAAa;AAEhB,MAAa,qBAAqB;CAChC,oBAAoB;EAClB;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACF;CACD,kBAAkB,CAChB;EACE,OAAO;EACP,OAAO;EACP,MAAM;EACP,CACF;CACD,qBAAqB;EACnB;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACF;CACD,mBAAmB;EACjB;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACF;CACD,oBAAoB;EAClB;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACF;CACD,yBAAyB;EACvB;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACD;GACE,OAAO;GACP,OAAO;GACP,MAAM;GACP;EACF;CACF;AAED,MAAa,qBAAqB,OAAO,OAAO,mBAAmB,CAChE,MAAM,CACN,KAAK,YAAY,QAAQ,MAAM;AAElC,MAAa,yBAAyB,aACpC,SAAS,WAAW,mBAAmB,UACvC,mBAAmB,OAAO,YAAY,SAAS,SAAS,QAAQ,CAAC;AAEnE,MAAa,eAAe,kBAA6B,UAAoB;CAE3E,MAAM,UAAU,GADH,QAAQ,0BAA0B,0BACvB;CAExB,MAAM,SAAmB,EAAE;AAG3B,KACE,oBACA,iBAAiB,SAAS,KAC1B,CAAC,sBAAsB,iBAAiB,CAExC,QAAO,KAAK,YAAY,iBAAiB,KAAK,IAAI,GAAG;AAGvD,QAAO,OAAO,SAAS,IAAI,GAAG,QAAQ,GAAG,OAAO,KAAK,IAAI,KAAK;;AAGhE,MAAa,6BACX,QACA,kBACA,UACG;CACH,MAAM,SAAkC,EACtC,KAAK,YAAY,kBAAkB,MAAM,EAC1C;AAGD,KAAI,OACF,QAAO,UAAU,EACf,eAAe,UAAU,UAC1B;AAGH,QAAO;;AAGT,MAAa,0BACX,QACA,kBACA,UACG;CACH,MAAM,kBAAkB,YAAY,kBAAkB,MAAM;AAG5D,KAAI,CAAC,OACH,QAAO;EACL,SAAS;EACT,MAAM;GAAC;GAAM;GAAqB;GAAgB;EACnD;AAIH,QAAO;EACL,SAAS;EACT,MAAM;GACJ;GACA;GACA;GACA;GACA;GACD;EACD,KAAK,EACH,qBAAqB,UAAU,UAChC;EACF"}

package/dist/{emit-BSetXzDV.js → emit-BqLCdV8Y.js}

@@ -44,6 +44,7 @@ const ErrorCodes = {
 	AgentIncompleteTasks: "PHW_AGENT_INCOMPLETE_TASKS",
 	AgentOrchestratorSkillVariantMissing: "PHW_AGENT_ORCHESTRATOR_SKILL_VARIANT_MISSING",
 	AgentOrchestratorTasksFailed: "PHW_AGENT_ORCHESTRATOR_TASKS_FAILED",
+	AgentOrchestratorTasksBlocked: "PHW_AGENT_ORCHESTRATOR_TASKS_BLOCKED",
 	AgentOrchestratorHollowRun: "PHW_AGENT_ORCHESTRATOR_HOLLOW_RUN",
 	AgentOrchestratorSinkInvariant: "PHW_AGENT_ORCHESTRATOR_SINK_INVARIANT",
 	GatewayMintRefused: "PHW_GATEWAY_MINT_REFUSED",
@@ -66,4 +67,4 @@ function emitWizardError(line) {
 //#endregion
 export { ErrorCodes as n, isErrorCode as r, emitWizardError as t };
 
-//# sourceMappingURL=emit-BSetXzDV.js.map
+//# sourceMappingURL=emit-BqLCdV8Y.js.map

package/dist/{emit-BSetXzDV.js.map → emit-BqLCdV8Y.js.map}

@@ -1 +1 @@
-{"version":3,"file":"emit-BSetXzDV.js","names":[],"sources":["../src/shared/errors/codes.ts","../src/shared/errors/emit.ts"],"sourcesContent":["export const ErrorCodes = {\n  CliNodeVersion: 'PHW_CLI_NODE_VERSION',\n  CliBadArgs: 'PHW_CLI_BAD_ARGS',\n  CliFlagUnavailable: 'PHW_CLI_FLAG_UNAVAILABLE',\n  CliInteractiveRequired: 'PHW_CLI_INTERACTIVE_REQUIRED',\n  ArgsMissingApiKey: 'PHW_ARGS_MISSING_API_KEY',\n  ArgsMissingInstallDir: 'PHW_ARGS_MISSING_INSTALL_DIR',\n  ArgsMissingEmail: 'PHW_ARGS_MISSING_EMAIL',\n  ArgsSignupProvisionFailed: 'PHW_ARGS_SIGNUP_PROVISION_FAILED',\n  AuthKeyType: 'PHW_AUTH_KEY_TYPE',\n  AuthMissingScope: 'PHW_AUTH_MISSING_SCOPE',\n  AuthRegionMismatch: 'PHW_AUTH_REGION_MISMATCH',\n  AuthInvalidOrExpired: 'PHW_AUTH_INVALID_OR_EXPIRED',\n  /** The OAuth grant itself is gone — distinct from a merely expired token. */\n  AuthSessionExpired: 'PHW_AUTH_SESSION_EXPIRED',\n  AuthSettingsConflict: 'PHW_AUTH_SETTINGS_CONFLICT',\n  AuthStoredLoginConflict: 'PHW_AUTH_STORED_LOGIN_CONFLICT',\n  AuthProjectFetchFailed: 'PHW_AUTH_PROJECT_FETCH_FAILED',\n  EnvLocalServicesDown: 'PHW_ENV_LOCAL_SERVICES_DOWN',\n  EnvServiceOutage: 'PHW_ENV_SERVICE_OUTAGE',\n  DetectBadDirectory: 'PHW_DETECT_BAD_DIRECTORY',\n  DetectNoFramework: 'PHW_DETECT_NO_FRAMEWORK',\n  DetectUnsupportedVersion: 'PHW_DETECT_UNSUPPORTED_VERSION',\n  DetectUnsupportedPlatform: 'PHW_DETECT_UNSUPPORTED_PLATFORM',\n  DetectNoPosthogSdk: 'PHW_DETECT_NO_POSTHOG_SDK',\n  DetectNoProjectFiles: 'PHW_DETECT_NO_PROJECT_FILES',\n  DetectNoSources: 'PHW_DETECT_NO_SOURCES',\n  DetectNoPackageJson: 'PHW_DETECT_NO_PACKAGE_JSON',\n  DetectNoSdks: 'PHW_DETECT_NO_SDKS',\n  DetectMissingStripe: 'PHW_DETECT_MISSING_STRIPE',\n  DetectUnclassified: 'PHW_DETECT_UNCLASSIFIED',\n  SkillMenuFetchFailed: 'PHW_SKILL_MENU_FETCH_FAILED',\n  SkillNotFound: 'PHW_SKILL_NOT_FOUND',\n  SkillDownloadFailed: 'PHW_SKILL_DOWNLOAD_FAILED',\n  AgentAbort: 'PHW_AGENT_ABORT',\n  AgenticDetectionTimeout: 'PHW_AGENTIC_DETECTION_TIMEOUT',\n  AgentMcpMissing: 'PHW_AGENT_MCP_MISSING',\n  AgentResourceMissing: 'PHW_AGENT_RESOURCE_MISSING',\n  AgentRateLimit: 'PHW_AGENT_RATE_LIMIT',\n  AgentApiError: 'PHW_AGENT_API_ERROR',\n  AgentYaraViolation: 'PHW_AGENT_YARA_VIOLATION',\n  AgentNoProgress: 'PHW_AGENT_NO_PROGRESS',\n  AgentInvalidStructuredOutput: 'PHW_AGENT_INVALID_STRUCTURED_OUTPUT',\n  AgentIncompleteTasks: 'PHW_AGENT_INCOMPLETE_TASKS',\n  AgentOrchestratorSkillVariantMissing:\n    'PHW_AGENT_ORCHESTRATOR_SKILL_VARIANT_MISSING',\n  AgentOrchestratorTasksFailed: 'PHW_AGENT_ORCHESTRATOR_TASKS_FAILED',\n  AgentOrchestratorHollowRun: 'PHW_AGENT_ORCHESTRATOR_HOLLOW_RUN',\n  AgentOrchestratorSinkInvariant: 'PHW_AGENT_ORCHESTRATOR_SINK_INVARIANT',\n  /** The backend answered the mint with a deliberate refusal. */\n  GatewayMintRefused: 'PHW_GATEWAY_MINT_REFUSED',\n  /** The mint was unreachable, errored, or returned an unusable token. */\n  GatewayMintFailed: 'PHW_GATEWAY_MINT_FAILED',\n  SettingsUnfixableConflict: 'PHW_SETTINGS_UNFIXABLE_CONFLICT',\n  InternalUnhandled: 'PHW_INTERNAL_UNHANDLED',\n} as const;\n\nexport type ErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];\n\nexport const ERROR_CODE_PATTERN = /^PHW_[A-Z][A-Z0-9_]*$/;\n\nexport function isErrorCode(value: string): value is ErrorCode {\n  return (Object.values(ErrorCodes) as string[]).includes(value);\n}\n","import type { ErrorCode } from './codes';\n\nexport const PHW_ERROR_PREFIX = 'phw-error:';\n\nexport interface WizardErrorLine {\n  code: ErrorCode;\n  message: string;\n  detail?: Record<string, unknown>;\n}\n\nexport function formatWizardErrorLine(line: WizardErrorLine): string {\n  return `${PHW_ERROR_PREFIX} ${JSON.stringify(line)}`;\n}\n\nexport function emitWizardError(line: WizardErrorLine): void {\n  process.stderr.write(`${formatWizardErrorLine(line)}\\n`);\n}\n"],"mappings":";AAAA,MAAa,aAAa;CACxB,gBAAgB;CAChB,YAAY;CACZ,oBAAoB;CACpB,wBAAwB;CACxB,mBAAmB;CACnB,uBAAuB;CACvB,kBAAkB;CAClB,2BAA2B;CAC3B,aAAa;CACb,kBAAkB;CAClB,oBAAoB;CACpB,sBAAsB;CAEtB,oBAAoB;CACpB,sBAAsB;CACtB,yBAAyB;CACzB,wBAAwB;CACxB,sBAAsB;CACtB,kBAAkB;CAClB,oBAAoB;CACpB,mBAAmB;CACnB,0BAA0B;CAC1B,2BAA2B;CAC3B,oBAAoB;CACpB,sBAAsB;CACtB,iBAAiB;CACjB,qBAAqB;CACrB,cAAc;CACd,qBAAqB;CACrB,oBAAoB;CACpB,sBAAsB;CACtB,eAAe;CACf,qBAAqB;CACrB,YAAY;CACZ,yBAAyB;CACzB,iBAAiB;CACjB,sBAAsB;CACtB,gBAAgB;CAChB,eAAe;CACf,oBAAoB;CACpB,iBAAiB;CACjB,8BAA8B;CAC9B,sBAAsB;CACtB,sCACE;CACF,8BAA8B;CAC9B,4BAA4B;CAC5B,gCAAgC;CAEhC,oBAAoB;CAEpB,mBAAmB;CACnB,2BAA2B;CAC3B,mBAAmB;CACpB;AAMD,SAAgB,YAAY,OAAmC;AAC7D,QAAQ,OAAO,OAAO,WAAW,CAAc,SAAS,MAAM;;;;AC5DhE,MAAa,mBAAmB;AAQhC,SAAgB,sBAAsB,MAA+B;AACnE,QAAO,GAAG,iBAAiB,GAAG,KAAK,UAAU,KAAK;;AAGpD,SAAgB,gBAAgB,MAA6B;AAC3D,SAAQ,OAAO,MAAM,GAAG,sBAAsB,KAAK,CAAC,IAAI"}
+{"version":3,"file":"emit-BqLCdV8Y.js","names":[],"sources":["../src/shared/errors/codes.ts","../src/shared/errors/emit.ts"],"sourcesContent":["export const ErrorCodes = {\n  CliNodeVersion: 'PHW_CLI_NODE_VERSION',\n  CliBadArgs: 'PHW_CLI_BAD_ARGS',\n  CliFlagUnavailable: 'PHW_CLI_FLAG_UNAVAILABLE',\n  CliInteractiveRequired: 'PHW_CLI_INTERACTIVE_REQUIRED',\n  ArgsMissingApiKey: 'PHW_ARGS_MISSING_API_KEY',\n  ArgsMissingInstallDir: 'PHW_ARGS_MISSING_INSTALL_DIR',\n  ArgsMissingEmail: 'PHW_ARGS_MISSING_EMAIL',\n  ArgsSignupProvisionFailed: 'PHW_ARGS_SIGNUP_PROVISION_FAILED',\n  AuthKeyType: 'PHW_AUTH_KEY_TYPE',\n  AuthMissingScope: 'PHW_AUTH_MISSING_SCOPE',\n  AuthRegionMismatch: 'PHW_AUTH_REGION_MISMATCH',\n  AuthInvalidOrExpired: 'PHW_AUTH_INVALID_OR_EXPIRED',\n  /** The OAuth grant itself is gone — distinct from a merely expired token. */\n  AuthSessionExpired: 'PHW_AUTH_SESSION_EXPIRED',\n  AuthSettingsConflict: 'PHW_AUTH_SETTINGS_CONFLICT',\n  AuthStoredLoginConflict: 'PHW_AUTH_STORED_LOGIN_CONFLICT',\n  AuthProjectFetchFailed: 'PHW_AUTH_PROJECT_FETCH_FAILED',\n  EnvLocalServicesDown: 'PHW_ENV_LOCAL_SERVICES_DOWN',\n  EnvServiceOutage: 'PHW_ENV_SERVICE_OUTAGE',\n  DetectBadDirectory: 'PHW_DETECT_BAD_DIRECTORY',\n  DetectNoFramework: 'PHW_DETECT_NO_FRAMEWORK',\n  DetectUnsupportedVersion: 'PHW_DETECT_UNSUPPORTED_VERSION',\n  DetectUnsupportedPlatform: 'PHW_DETECT_UNSUPPORTED_PLATFORM',\n  DetectNoPosthogSdk: 'PHW_DETECT_NO_POSTHOG_SDK',\n  DetectNoProjectFiles: 'PHW_DETECT_NO_PROJECT_FILES',\n  DetectNoSources: 'PHW_DETECT_NO_SOURCES',\n  DetectNoPackageJson: 'PHW_DETECT_NO_PACKAGE_JSON',\n  DetectNoSdks: 'PHW_DETECT_NO_SDKS',\n  DetectMissingStripe: 'PHW_DETECT_MISSING_STRIPE',\n  DetectUnclassified: 'PHW_DETECT_UNCLASSIFIED',\n  SkillMenuFetchFailed: 'PHW_SKILL_MENU_FETCH_FAILED',\n  SkillNotFound: 'PHW_SKILL_NOT_FOUND',\n  SkillDownloadFailed: 'PHW_SKILL_DOWNLOAD_FAILED',\n  AgentAbort: 'PHW_AGENT_ABORT',\n  AgenticDetectionTimeout: 'PHW_AGENTIC_DETECTION_TIMEOUT',\n  AgentMcpMissing: 'PHW_AGENT_MCP_MISSING',\n  AgentResourceMissing: 'PHW_AGENT_RESOURCE_MISSING',\n  AgentRateLimit: 'PHW_AGENT_RATE_LIMIT',\n  AgentApiError: 'PHW_AGENT_API_ERROR',\n  AgentYaraViolation: 'PHW_AGENT_YARA_VIOLATION',\n  AgentNoProgress: 'PHW_AGENT_NO_PROGRESS',\n  AgentInvalidStructuredOutput: 'PHW_AGENT_INVALID_STRUCTURED_OUTPUT',\n  AgentIncompleteTasks: 'PHW_AGENT_INCOMPLETE_TASKS',\n  AgentOrchestratorSkillVariantMissing:\n    'PHW_AGENT_ORCHESTRATOR_SKILL_VARIANT_MISSING',\n  AgentOrchestratorTasksFailed: 'PHW_AGENT_ORCHESTRATOR_TASKS_FAILED',\n  AgentOrchestratorTasksBlocked: 'PHW_AGENT_ORCHESTRATOR_TASKS_BLOCKED',\n  AgentOrchestratorHollowRun: 'PHW_AGENT_ORCHESTRATOR_HOLLOW_RUN',\n  AgentOrchestratorSinkInvariant: 'PHW_AGENT_ORCHESTRATOR_SINK_INVARIANT',\n  /** The backend answered the mint with a deliberate refusal. */\n  GatewayMintRefused: 'PHW_GATEWAY_MINT_REFUSED',\n  /** The mint was unreachable, errored, or returned an unusable token. */\n  GatewayMintFailed: 'PHW_GATEWAY_MINT_FAILED',\n  SettingsUnfixableConflict: 'PHW_SETTINGS_UNFIXABLE_CONFLICT',\n  InternalUnhandled: 'PHW_INTERNAL_UNHANDLED',\n} as const;\n\nexport type ErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];\n\nexport const ERROR_CODE_PATTERN = /^PHW_[A-Z][A-Z0-9_]*$/;\n\nexport function isErrorCode(value: string): value is ErrorCode {\n  return (Object.values(ErrorCodes) as string[]).includes(value);\n}\n","import type { ErrorCode } from './codes';\n\nexport const PHW_ERROR_PREFIX = 'phw-error:';\n\nexport interface WizardErrorLine {\n  code: ErrorCode;\n  message: string;\n  detail?: Record<string, unknown>;\n}\n\nexport function formatWizardErrorLine(line: WizardErrorLine): string {\n  return `${PHW_ERROR_PREFIX} ${JSON.stringify(line)}`;\n}\n\nexport function emitWizardError(line: WizardErrorLine): void {\n  process.stderr.write(`${formatWizardErrorLine(line)}\\n`);\n}\n"],"mappings":";AAAA,MAAa,aAAa;CACxB,gBAAgB;CAChB,YAAY;CACZ,oBAAoB;CACpB,wBAAwB;CACxB,mBAAmB;CACnB,uBAAuB;CACvB,kBAAkB;CAClB,2BAA2B;CAC3B,aAAa;CACb,kBAAkB;CAClB,oBAAoB;CACpB,sBAAsB;CAEtB,oBAAoB;CACpB,sBAAsB;CACtB,yBAAyB;CACzB,wBAAwB;CACxB,sBAAsB;CACtB,kBAAkB;CAClB,oBAAoB;CACpB,mBAAmB;CACnB,0BAA0B;CAC1B,2BAA2B;CAC3B,oBAAoB;CACpB,sBAAsB;CACtB,iBAAiB;CACjB,qBAAqB;CACrB,cAAc;CACd,qBAAqB;CACrB,oBAAoB;CACpB,sBAAsB;CACtB,eAAe;CACf,qBAAqB;CACrB,YAAY;CACZ,yBAAyB;CACzB,iBAAiB;CACjB,sBAAsB;CACtB,gBAAgB;CAChB,eAAe;CACf,oBAAoB;CACpB,iBAAiB;CACjB,8BAA8B;CAC9B,sBAAsB;CACtB,sCACE;CACF,8BAA8B;CAC9B,+BAA+B;CAC/B,4BAA4B;CAC5B,gCAAgC;CAEhC,oBAAoB;CAEpB,mBAAmB;CACnB,2BAA2B;CAC3B,mBAAmB;CACpB;AAMD,SAAgB,YAAY,OAAmC;AAC7D,QAAQ,OAAO,OAAO,WAAW,CAAc,SAAS,MAAM;;;;AC7DhE,MAAa,mBAAmB;AAQhC,SAAgB,sBAAsB,MAA+B;AACnE,QAAO,GAAG,iBAAiB,GAAG,KAAK,UAAU,KAAK;;AAGpD,SAAgB,gBAAgB,MAA6B;AAC3D,SAAQ,OAAO,MAAM,GAAG,sBAAsB,KAAK,CAAC,IAAI"}

package/dist/{errors-C2domSkK.js → errors-DhFeR8Sp.js}

@@ -1,12 +1,12 @@
-import { n as ErrorCodes, r as isErrorCode } from "./emit-BSetXzDV.js";
-ErrorCodes.CliNodeVersion, ErrorCodes.CliBadArgs, ErrorCodes.CliFlagUnavailable, ErrorCodes.CliInteractiveRequired, ErrorCodes.ArgsMissingApiKey, ErrorCodes.ArgsMissingInstallDir, ErrorCodes.ArgsMissingEmail, ErrorCodes.ArgsSignupProvisionFailed, ErrorCodes.AuthKeyType, ErrorCodes.AuthInvalidOrExpired, ErrorCodes.AuthSessionExpired, ErrorCodes.AuthMissingScope, ErrorCodes.AuthRegionMismatch, ErrorCodes.AuthSettingsConflict, ErrorCodes.AuthStoredLoginConflict, ErrorCodes.AuthProjectFetchFailed, ErrorCodes.EnvLocalServicesDown, ErrorCodes.EnvServiceOutage, ErrorCodes.DetectBadDirectory, ErrorCodes.DetectNoFramework, ErrorCodes.DetectUnsupportedVersion, ErrorCodes.DetectUnsupportedPlatform, ErrorCodes.DetectNoPosthogSdk, ErrorCodes.DetectNoProjectFiles, ErrorCodes.DetectNoSources, ErrorCodes.DetectNoPackageJson, ErrorCodes.DetectNoSdks, ErrorCodes.DetectMissingStripe, ErrorCodes.DetectUnclassified, ErrorCodes.SkillMenuFetchFailed, ErrorCodes.SkillNotFound, ErrorCodes.SkillDownloadFailed, ErrorCodes.AgentAbort, ErrorCodes.AgenticDetectionTimeout, ErrorCodes.AgentMcpMissing, ErrorCodes.AgentResourceMissing, ErrorCodes.AgentRateLimit, ErrorCodes.AgentApiError, ErrorCodes.AgentYaraViolation, ErrorCodes.AgentNoProgress, ErrorCodes.AgentInvalidStructuredOutput, ErrorCodes.AgentIncompleteTasks, ErrorCodes.AgentOrchestratorSkillVariantMissing, ErrorCodes.AgentOrchestratorTasksFailed, ErrorCodes.AgentOrchestratorHollowRun, ErrorCodes.AgentOrchestratorSinkInvariant, ErrorCodes.GatewayMintRefused, ErrorCodes.GatewayMintFailed, ErrorCodes.SettingsUnfixableConflict, ErrorCodes.InternalUnhandled;
+import { n as ErrorCodes, r as isErrorCode } from "./emit-BqLCdV8Y.js";
+ErrorCodes.CliNodeVersion, ErrorCodes.CliBadArgs, ErrorCodes.CliFlagUnavailable, ErrorCodes.CliInteractiveRequired, ErrorCodes.ArgsMissingApiKey, ErrorCodes.ArgsMissingInstallDir, ErrorCodes.ArgsMissingEmail, ErrorCodes.ArgsSignupProvisionFailed, ErrorCodes.AuthKeyType, ErrorCodes.AuthInvalidOrExpired, ErrorCodes.AuthSessionExpired, ErrorCodes.AuthMissingScope, ErrorCodes.AuthRegionMismatch, ErrorCodes.AuthSettingsConflict, ErrorCodes.AuthStoredLoginConflict, ErrorCodes.AuthProjectFetchFailed, ErrorCodes.EnvLocalServicesDown, ErrorCodes.EnvServiceOutage, ErrorCodes.DetectBadDirectory, ErrorCodes.DetectNoFramework, ErrorCodes.DetectUnsupportedVersion, ErrorCodes.DetectUnsupportedPlatform, ErrorCodes.DetectNoPosthogSdk, ErrorCodes.DetectNoProjectFiles, ErrorCodes.DetectNoSources, ErrorCodes.DetectNoPackageJson, ErrorCodes.DetectNoSdks, ErrorCodes.DetectMissingStripe, ErrorCodes.DetectUnclassified, ErrorCodes.SkillMenuFetchFailed, ErrorCodes.SkillNotFound, ErrorCodes.SkillDownloadFailed, ErrorCodes.AgentAbort, ErrorCodes.AgenticDetectionTimeout, ErrorCodes.AgentMcpMissing, ErrorCodes.AgentResourceMissing, ErrorCodes.AgentRateLimit, ErrorCodes.AgentApiError, ErrorCodes.AgentYaraViolation, ErrorCodes.AgentNoProgress, ErrorCodes.AgentInvalidStructuredOutput, ErrorCodes.AgentIncompleteTasks, ErrorCodes.AgentOrchestratorSkillVariantMissing, ErrorCodes.AgentOrchestratorTasksFailed, ErrorCodes.AgentOrchestratorTasksBlocked, ErrorCodes.AgentOrchestratorHollowRun, ErrorCodes.AgentOrchestratorSinkInvariant, ErrorCodes.GatewayMintRefused, ErrorCodes.GatewayMintFailed, ErrorCodes.SettingsUnfixableConflict, ErrorCodes.InternalUnhandled;
 //#endregion
 //#region src/shared/errors/wizard-error.ts
 /**
 * Structured error data for analytics and the machine-readable error line.
 *
-* A data carrier: the agent returns it inside a failure and the legacy adapter
-* hands it to `wizardAbort()`, which captures it. Never thrown by the wizard.
+* A data carrier: the agent returns it inside a failure and a host hands it
+* to `wizardAbort()`, which captures it. Never thrown by the wizard.
 */
 var WizardError = class extends Error {
 	code;
@@ -76,4 +76,4 @@ function classifyRunFailure(err) {
 //#endregion
 export { WizardError as a, classifyAuthFailure as i, sanitizeErrorDetail as n, skillErrorCode as r, classifyRunFailure as t };
 
-//# sourceMappingURL=errors-C2domSkK.js.map
+//# sourceMappingURL=errors-DhFeR8Sp.js.map

package/dist/{errors-C2domSkK.js.map → errors-DhFeR8Sp.js.map}

@@ -1 +1 @@
-{"version":3,"file":"errors-C2domSkK.js","names":[],"sources":["../src/shared/errors/catalog.ts","../src/shared/errors/wizard-error.ts","../src/shared/errors/auth.ts","../src/shared/errors/skill-map.ts","../src/shared/errors/sanitize.ts","../src/shared/errors/run-failure.ts"],"sourcesContent":["import { ErrorCodes, type ErrorCode } from './codes';\nimport type { ErrorCatalogEntry } from './types';\n\nexport const ERROR_CATALOG: Record<ErrorCode, ErrorCatalogEntry> = {\n  [ErrorCodes.CliNodeVersion]: {\n    group: 'cli',\n    retry: 'no',\n    description: 'Node.js runtime is older than the required range.',\n  },\n  [ErrorCodes.CliBadArgs]: {\n    group: 'cli',\n    retry: 'no',\n    description: 'Unrecognized command or option.',\n  },\n  [ErrorCodes.CliFlagUnavailable]: {\n    group: 'cli',\n    retry: 'no',\n    description: 'A dev-only flag or env var was passed to a published build.',\n  },\n  [ErrorCodes.CliInteractiveRequired]: {\n    group: 'cli',\n    retry: 'no',\n    description:\n      'The command requires an interactive terminal and has no non-interactive fallback.',\n  },\n  [ErrorCodes.ArgsMissingApiKey]: {\n    group: 'args',\n    retry: 'no',\n    description: 'Non-interactive run without --api-key.',\n  },\n  [ErrorCodes.ArgsMissingInstallDir]: {\n    group: 'args',\n    retry: 'no',\n    description: 'Non-interactive run without --install-dir.',\n  },\n  [ErrorCodes.ArgsMissingEmail]: {\n    group: 'args',\n    retry: 'no',\n    description: 'Signup run without --email.',\n  },\n  [ErrorCodes.ArgsSignupProvisionFailed]: {\n    group: 'args',\n    retry: 'yes',\n    description: 'Account provisioning for --signup failed.',\n  },\n  [ErrorCodes.AuthKeyType]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'The API key has the wrong type or prefix for this mode.',\n  },\n  [ErrorCodes.AuthInvalidOrExpired]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'The credential was rejected by the LLM gateway or API.',\n  },\n  [ErrorCodes.AuthSessionExpired]: {\n    group: 'auth',\n    // Retryable, unlike its neighbours: a new run means a new login.\n    retry: 'yes',\n    description: 'The OAuth grant expired or was revoked mid-run.',\n  },\n  [ErrorCodes.AuthMissingScope]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'The personal API key lacks a scope the run requires.',\n  },\n  [ErrorCodes.AuthRegionMismatch]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'The resolved region does not match the credential.',\n  },\n  [ErrorCodes.AuthSettingsConflict]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'A Claude settings file overrides the gateway credential.',\n  },\n  [ErrorCodes.AuthStoredLoginConflict]: {\n    group: 'auth',\n    retry: 'no',\n    description:\n      'The agent SDK used a stored Claude login instead of the gateway token.',\n  },\n  [ErrorCodes.AuthProjectFetchFailed]: {\n    group: 'auth',\n    retry: 'yes',\n    description: 'Fetching user or project data from the PostHog API failed.',\n  },\n  [ErrorCodes.EnvLocalServicesDown]: {\n    group: 'env',\n    retry: 'yes',\n    description: 'A local dev target service is not running.',\n  },\n  [ErrorCodes.EnvServiceOutage]: {\n    group: 'env',\n    retry: 'yes',\n    description: 'Blocking external services are down.',\n  },\n  [ErrorCodes.DetectBadDirectory]: {\n    group: 'detect',\n    retry: 'no',\n    description:\n      'The install directory is missing, not a directory, or unreadable.',\n  },\n  [ErrorCodes.DetectNoFramework]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'Framework auto-detection found no supported framework.',\n  },\n  [ErrorCodes.DetectUnsupportedVersion]: {\n    group: 'detect',\n    retry: 'no',\n    description:\n      'The detected framework version is below the supported minimum.',\n  },\n  [ErrorCodes.DetectUnsupportedPlatform]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'The project platform has no matching skill variant.',\n  },\n  [ErrorCodes.DetectNoPosthogSdk]: {\n    group: 'detect',\n    retry: 'no',\n    description:\n      'The program requires an installed PostHog SDK and none was found.',\n  },\n  [ErrorCodes.DetectNoProjectFiles]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'The project has no files for the program to work on.',\n  },\n  [ErrorCodes.DetectNoSources]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'No data warehouse sources were found.',\n  },\n  [ErrorCodes.DetectNoPackageJson]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'The project has no package.json for the program to scan.',\n  },\n  [ErrorCodes.DetectNoSdks]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'None of the SDKs the program needs are installed.',\n  },\n  [ErrorCodes.DetectMissingStripe]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'Revenue analytics requires a Stripe SDK and none was found.',\n  },\n  [ErrorCodes.DetectUnclassified]: {\n    group: 'detect',\n    // A detect step reported a precondition failure we have no code for yet.\n    // Every known cause is a property of the user's project, so retrying can\n    // only burn budget — fail closed rather than inheriting `internal`'s 'yes'.\n    retry: 'no',\n    description: 'A detect step failed with a kind absent from the catalog.',\n  },\n  [ErrorCodes.SkillMenuFetchFailed]: {\n    group: 'skill',\n    retry: 'yes',\n    description: 'The context-mill skill menu could not be fetched.',\n  },\n  [ErrorCodes.SkillNotFound]: {\n    group: 'skill',\n    retry: 'no',\n    description: 'The skill id is absent from the context-mill menu.',\n  },\n  [ErrorCodes.SkillDownloadFailed]: {\n    group: 'skill',\n    retry: 'yes',\n    description: 'The skill download or extraction failed.',\n  },\n  [ErrorCodes.AgentAbort]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description: 'The agent emitted an [ABORT] signal with a reason.',\n  },\n  [ErrorCodes.AgenticDetectionTimeout]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The agent run exceeded its configured time limit.',\n  },\n  [ErrorCodes.AgentMcpMissing]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The agent could not reach the PostHog MCP server.',\n  },\n  [ErrorCodes.AgentResourceMissing]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The agent could not access a setup resource.',\n  },\n  [ErrorCodes.AgentRateLimit]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The LLM gateway rate-limited the run.',\n  },\n  [ErrorCodes.AgentApiError]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The agent hit an API error other than a rate limit.',\n  },\n  [ErrorCodes.AgentYaraViolation]: {\n    group: 'agent',\n    retry: 'no',\n    description: 'The security scanner terminated the run.',\n  },\n  [ErrorCodes.AgentNoProgress]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description: 'The agent ended without a single tool call.',\n  },\n  [ErrorCodes.AgentInvalidStructuredOutput]: {\n    group: 'agent',\n    retry: 'yes',\n    description:\n      'The agent ended a schema-bound run without output matching the schema.',\n  },\n  [ErrorCodes.AgentIncompleteTasks]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description: 'The agent stopped with planned tasks still open.',\n  },\n  [ErrorCodes.AgentOrchestratorSkillVariantMissing]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The orchestrator could not download a needed skill variant.',\n  },\n  [ErrorCodes.AgentOrchestratorTasksFailed]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description: 'The orchestrator queue drained with failed or blocked tasks.',\n  },\n  [ErrorCodes.AgentOrchestratorHollowRun]: {\n    group: 'agent',\n    retry: 'yes',\n    description:\n      'The orchestrator drained with zero tasks — the seed step got no usable model output.',\n  },\n  [ErrorCodes.AgentOrchestratorSinkInvariant]: {\n    group: 'agent',\n    retry: 'no',\n    description: 'The orchestrator plan failed the sink coverage invariant.',\n  },\n  [ErrorCodes.GatewayMintRefused]: {\n    group: 'gateway',\n    // 429 clears with the daily window, 401 with a fresh login, 403 never.\n    retry: 'case-by-case',\n    description:\n      'The PostHog backend refused to mint a gateway token for this run.',\n  },\n  [ErrorCodes.GatewayMintFailed]: {\n    group: 'gateway',\n    retry: 'yes',\n    description:\n      'The PostHog backend could not mint a gateway token: unreachable, a 5xx, or an unusable response.',\n  },\n  [ErrorCodes.SettingsUnfixableConflict]: {\n    group: 'settings',\n    retry: 'no',\n    description:\n      'A Claude settings conflict cannot be neutralized automatically.',\n  },\n  [ErrorCodes.InternalUnhandled]: {\n    group: 'internal',\n    retry: 'yes',\n    description: 'An unexpected error escaped the pipeline.',\n  },\n};\n","import type { ErrorCode } from './codes';\n\n/**\n * Structured error data for analytics and the machine-readable error line.\n *\n * A data carrier: the agent returns it inside a failure and the legacy adapter\n * hands it to `wizardAbort()`, which captures it. Never thrown by the wizard.\n */\nexport class WizardError extends Error {\n  readonly code?: ErrorCode;\n\n  constructor(\n    message: string,\n    public readonly context?: Record<string, unknown>,\n    code?: ErrorCode,\n  ) {\n    super(message);\n    this.name = 'WizardError';\n    this.code = code;\n  }\n}\n","import { ErrorCodes, type ErrorCode } from './codes';\n\nexport interface AuthFailureInput {\n  hasSettingsConflict?: boolean;\n  usingManagedLogin?: boolean;\n  /** A pre-run token refresh already failed on a dead grant this run. */\n  sessionExpired?: boolean;\n  apiKey?: string;\n  missingScopes?: readonly string[];\n  gatewayRegion?: 'us' | 'eu' | 'local';\n  sessionRegion?: 'us' | 'eu';\n}\n\nexport function classifyAuthFailure(input: AuthFailureInput): ErrorCode {\n  // First: the only branch backed by a server verdict rather than inference.\n  // The token endpoint already told us the grant is dead, so every heuristic\n  // below would be guessing at a cause we know.\n  if (input.sessionExpired) return ErrorCodes.AuthSessionExpired;\n  if (input.usingManagedLogin) return ErrorCodes.AuthStoredLoginConflict;\n  if (input.hasSettingsConflict) return ErrorCodes.AuthSettingsConflict;\n  if (\n    input.apiKey &&\n    !input.apiKey.startsWith('phx_') &&\n    !input.apiKey.startsWith('pha_')\n  ) {\n    return ErrorCodes.AuthKeyType;\n  }\n  if (input.missingScopes && input.missingScopes.length > 0) {\n    return ErrorCodes.AuthMissingScope;\n  }\n  if (\n    input.gatewayRegion &&\n    input.sessionRegion &&\n    input.gatewayRegion !== 'local' &&\n    input.gatewayRegion !== input.sessionRegion\n  ) {\n    return ErrorCodes.AuthRegionMismatch;\n  }\n  return ErrorCodes.AuthInvalidOrExpired;\n}\n","import { ErrorCodes, type ErrorCode } from './codes';\nimport type { InstallSkillResult } from '@agent/types';\n\nconst SKILL_CODES: Record<\n  Exclude<InstallSkillResult['kind'], 'ok'>,\n  ErrorCode\n> = {\n  'menu-fetch-failed': ErrorCodes.SkillMenuFetchFailed,\n  'skill-not-found': ErrorCodes.SkillNotFound,\n  'download-failed': ErrorCodes.SkillDownloadFailed,\n};\n\nexport function skillErrorCode(result: InstallSkillResult): ErrorCode | null {\n  if (result.kind === 'ok') return null;\n  return SKILL_CODES[result.kind];\n}\n","const DETAIL_ALLOWLIST = ['reason', 'detected', 'platform'] as const;\n\nexport function sanitizeErrorDetail(\n  detail: Record<string, unknown> | undefined,\n): Record<string, unknown> | undefined {\n  if (!detail) return undefined;\n  const safe: Record<string, unknown> = {};\n  for (const key of DETAIL_ALLOWLIST) {\n    if (detail[key] !== undefined) safe[key] = detail[key];\n  }\n  return Object.keys(safe).length > 0 ? safe : undefined;\n}\n","import { ErrorCodes, isErrorCode, type ErrorCode } from './codes';\n\nexport interface RunFailure {\n  code: ErrorCode;\n  message: string;\n  /** True when the error carried its own code: a decision, not a crash. */\n  coded: boolean;\n}\n\n/**\n * How a run's terminal error is reported. A coded WizardError (a mint refusal,\n * say) keeps its own message and code; anything else is unhandled and gets the\n * generic framing. Duck-typed on `code` so callers need not load wizard-abort.\n */\nexport function classifyRunFailure(err: unknown): RunFailure {\n  const message = err instanceof Error ? err.message : String(err);\n  const code =\n    err instanceof Error ? (err as { code?: unknown }).code : undefined;\n  if (typeof code === 'string' && isErrorCode(code)) {\n    return { code, message, coded: true };\n  }\n  return { code: ErrorCodes.InternalUnhandled, message, coded: false };\n}\n"],"mappings":";AAIG,WAAW,gBAKX,WAAW,YAKX,WAAW,oBAKX,WAAW,wBAMX,WAAW,mBAKX,WAAW,uBAKX,WAAW,kBAKX,WAAW,2BAKX,WAAW,aAKX,WAAW,sBAKX,WAAW,oBAMX,WAAW,kBAKX,WAAW,oBAKX,WAAW,sBAKX,WAAW,yBAMX,WAAW,wBAKX,WAAW,sBAKX,WAAW,kBAKX,WAAW,oBAMX,WAAW,mBAKX,WAAW,0BAMX,WAAW,2BAKX,WAAW,oBAMX,WAAW,sBAKX,WAAW,iBAKX,WAAW,qBAKX,WAAW,cAKX,WAAW,qBAKX,WAAW,oBAQX,WAAW,sBAKX,WAAW,eAKX,WAAW,qBAKX,WAAW,YAKX,WAAW,yBAKX,WAAW,iBAKX,WAAW,sBAKX,WAAW,gBAKX,WAAW,eAKX,WAAW,oBAKX,WAAW,iBAKX,WAAW,8BAMX,WAAW,sBAKX,WAAW,sCAKX,WAAW,8BAKX,WAAW,4BAMX,WAAW,gCAKX,WAAW,oBAOX,WAAW,mBAMX,WAAW,2BAMX,WAAW;;;;;;;;;AChQd,IAAa,cAAb,cAAiC,MAAM;CACrC;CAEA,YACE,SACA,SACA,MACA;AACA,QAAM,QAAQ;AAHE,OAAA,UAAA;AAIhB,OAAK,OAAO;AACZ,OAAK,OAAO;;;;;ACLhB,SAAgB,oBAAoB,OAAoC;AAItE,KAAI,MAAM,eAAgB,QAAO,WAAW;AAC5C,KAAI,MAAM,kBAAmB,QAAO,WAAW;AAC/C,KAAI,MAAM,oBAAqB,QAAO,WAAW;AACjD,KACE,MAAM,UACN,CAAC,MAAM,OAAO,WAAW,OAAO,IAChC,CAAC,MAAM,OAAO,WAAW,OAAO,CAEhC,QAAO,WAAW;AAEpB,KAAI,MAAM,iBAAiB,MAAM,cAAc,SAAS,EACtD,QAAO,WAAW;AAEpB,KACE,MAAM,iBACN,MAAM,iBACN,MAAM,kBAAkB,WACxB,MAAM,kBAAkB,MAAM,cAE9B,QAAO,WAAW;AAEpB,QAAO,WAAW;;;;ACnCpB,MAAM,cAGF;CACF,qBAAqB,WAAW;CAChC,mBAAmB,WAAW;CAC9B,mBAAmB,WAAW;CAC/B;AAED,SAAgB,eAAe,QAA8C;AAC3E,KAAI,OAAO,SAAS,KAAM,QAAO;AACjC,QAAO,YAAY,OAAO;;;;ACd5B,MAAM,mBAAmB;CAAC;CAAU;CAAY;CAAW;AAE3D,SAAgB,oBACd,QACqC;AACrC,KAAI,CAAC,OAAQ,QAAO,KAAA;CACpB,MAAM,OAAgC,EAAE;AACxC,MAAK,MAAM,OAAO,iBAChB,KAAI,OAAO,SAAS,KAAA,EAAW,MAAK,OAAO,OAAO;AAEpD,QAAO,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO,KAAA;;;;;;;;;ACI/C,SAAgB,mBAAmB,KAA0B;CAC3D,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;CAChE,MAAM,OACJ,eAAe,QAAS,IAA2B,OAAO,KAAA;AAC5D,KAAI,OAAO,SAAS,YAAY,YAAY,KAAK,CAC/C,QAAO;EAAE;EAAM;EAAS,OAAO;EAAM;AAEvC,QAAO;EAAE,MAAM,WAAW;EAAmB;EAAS,OAAO;EAAO"}
+{"version":3,"file":"errors-DhFeR8Sp.js","names":[],"sources":["../src/shared/errors/catalog.ts","../src/shared/errors/wizard-error.ts","../src/shared/errors/auth.ts","../src/shared/errors/skill-map.ts","../src/shared/errors/sanitize.ts","../src/shared/errors/run-failure.ts"],"sourcesContent":["import { ErrorCodes, type ErrorCode } from './codes';\nimport type { ErrorCatalogEntry } from './types';\n\nexport const ERROR_CATALOG: Record<ErrorCode, ErrorCatalogEntry> = {\n  [ErrorCodes.CliNodeVersion]: {\n    group: 'cli',\n    retry: 'no',\n    description: 'Node.js runtime is older than the required range.',\n  },\n  [ErrorCodes.CliBadArgs]: {\n    group: 'cli',\n    retry: 'no',\n    description: 'Unrecognized command or option.',\n  },\n  [ErrorCodes.CliFlagUnavailable]: {\n    group: 'cli',\n    retry: 'no',\n    description: 'A dev-only flag or env var was passed to a published build.',\n  },\n  [ErrorCodes.CliInteractiveRequired]: {\n    group: 'cli',\n    retry: 'no',\n    description:\n      'The command requires an interactive terminal and has no non-interactive fallback.',\n  },\n  [ErrorCodes.ArgsMissingApiKey]: {\n    group: 'args',\n    retry: 'no',\n    description: 'Non-interactive run without --api-key.',\n  },\n  [ErrorCodes.ArgsMissingInstallDir]: {\n    group: 'args',\n    retry: 'no',\n    description: 'Non-interactive run without --install-dir.',\n  },\n  [ErrorCodes.ArgsMissingEmail]: {\n    group: 'args',\n    retry: 'no',\n    description: 'Signup run without --email.',\n  },\n  [ErrorCodes.ArgsSignupProvisionFailed]: {\n    group: 'args',\n    retry: 'yes',\n    description: 'Account provisioning for --signup failed.',\n  },\n  [ErrorCodes.AuthKeyType]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'The API key has the wrong type or prefix for this mode.',\n  },\n  [ErrorCodes.AuthInvalidOrExpired]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'The credential was rejected by the LLM gateway or API.',\n  },\n  [ErrorCodes.AuthSessionExpired]: {\n    group: 'auth',\n    // Retryable, unlike its neighbours: a new run means a new login.\n    retry: 'yes',\n    description: 'The OAuth grant expired or was revoked mid-run.',\n  },\n  [ErrorCodes.AuthMissingScope]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'The personal API key lacks a scope the run requires.',\n  },\n  [ErrorCodes.AuthRegionMismatch]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'The resolved region does not match the credential.',\n  },\n  [ErrorCodes.AuthSettingsConflict]: {\n    group: 'auth',\n    retry: 'no',\n    description: 'A Claude settings file overrides the gateway credential.',\n  },\n  [ErrorCodes.AuthStoredLoginConflict]: {\n    group: 'auth',\n    retry: 'no',\n    description:\n      'The agent SDK used a stored Claude login instead of the gateway token.',\n  },\n  [ErrorCodes.AuthProjectFetchFailed]: {\n    group: 'auth',\n    retry: 'yes',\n    description: 'Fetching user or project data from the PostHog API failed.',\n  },\n  [ErrorCodes.EnvLocalServicesDown]: {\n    group: 'env',\n    retry: 'yes',\n    description: 'A local dev target service is not running.',\n  },\n  [ErrorCodes.EnvServiceOutage]: {\n    group: 'env',\n    retry: 'yes',\n    description: 'Blocking external services are down.',\n  },\n  [ErrorCodes.DetectBadDirectory]: {\n    group: 'detect',\n    retry: 'no',\n    description:\n      'The install directory is missing, not a directory, or unreadable.',\n  },\n  [ErrorCodes.DetectNoFramework]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'Framework auto-detection found no supported framework.',\n  },\n  [ErrorCodes.DetectUnsupportedVersion]: {\n    group: 'detect',\n    retry: 'no',\n    description:\n      'The detected framework version is below the supported minimum.',\n  },\n  [ErrorCodes.DetectUnsupportedPlatform]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'The project platform has no matching skill variant.',\n  },\n  [ErrorCodes.DetectNoPosthogSdk]: {\n    group: 'detect',\n    retry: 'no',\n    description:\n      'The program requires an installed PostHog SDK and none was found.',\n  },\n  [ErrorCodes.DetectNoProjectFiles]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'The project has no files for the program to work on.',\n  },\n  [ErrorCodes.DetectNoSources]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'No data warehouse sources were found.',\n  },\n  [ErrorCodes.DetectNoPackageJson]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'The project has no package.json for the program to scan.',\n  },\n  [ErrorCodes.DetectNoSdks]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'None of the SDKs the program needs are installed.',\n  },\n  [ErrorCodes.DetectMissingStripe]: {\n    group: 'detect',\n    retry: 'no',\n    description: 'Revenue analytics requires a Stripe SDK and none was found.',\n  },\n  [ErrorCodes.DetectUnclassified]: {\n    group: 'detect',\n    // A detect step reported a precondition failure we have no code for yet.\n    // Every known cause is a property of the user's project, so retrying can\n    // only burn budget — fail closed rather than inheriting `internal`'s 'yes'.\n    retry: 'no',\n    description: 'A detect step failed with a kind absent from the catalog.',\n  },\n  [ErrorCodes.SkillMenuFetchFailed]: {\n    group: 'skill',\n    retry: 'yes',\n    description: 'The context-mill skill menu could not be fetched.',\n  },\n  [ErrorCodes.SkillNotFound]: {\n    group: 'skill',\n    retry: 'no',\n    description: 'The skill id is absent from the context-mill menu.',\n  },\n  [ErrorCodes.SkillDownloadFailed]: {\n    group: 'skill',\n    retry: 'yes',\n    description: 'The skill download or extraction failed.',\n  },\n  [ErrorCodes.AgentAbort]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description: 'The agent emitted an [ABORT] signal with a reason.',\n  },\n  [ErrorCodes.AgenticDetectionTimeout]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The agent run exceeded its configured time limit.',\n  },\n  [ErrorCodes.AgentMcpMissing]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The agent could not reach the PostHog MCP server.',\n  },\n  [ErrorCodes.AgentResourceMissing]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The agent could not access a setup resource.',\n  },\n  [ErrorCodes.AgentRateLimit]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The LLM gateway rate-limited the run.',\n  },\n  [ErrorCodes.AgentApiError]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The agent hit an API error other than a rate limit.',\n  },\n  [ErrorCodes.AgentYaraViolation]: {\n    group: 'agent',\n    retry: 'no',\n    description: 'The security scanner terminated the run.',\n  },\n  [ErrorCodes.AgentNoProgress]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description: 'The agent ended without a single tool call.',\n  },\n  [ErrorCodes.AgentInvalidStructuredOutput]: {\n    group: 'agent',\n    retry: 'yes',\n    description:\n      'The agent ended a schema-bound run without output matching the schema.',\n  },\n  [ErrorCodes.AgentIncompleteTasks]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description: 'The agent stopped with planned tasks still open.',\n  },\n  [ErrorCodes.AgentOrchestratorSkillVariantMissing]: {\n    group: 'agent',\n    retry: 'yes',\n    description: 'The orchestrator could not download a needed skill variant.',\n  },\n  [ErrorCodes.AgentOrchestratorTasksFailed]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description: 'The orchestrator queue drained with failed required tasks.',\n  },\n  [ErrorCodes.AgentOrchestratorTasksBlocked]: {\n    group: 'agent',\n    retry: 'case-by-case',\n    description:\n      'The orchestrator queue drained with no failed task but blocked ones that never ran.',\n  },\n  [ErrorCodes.AgentOrchestratorHollowRun]: {\n    group: 'agent',\n    retry: 'yes',\n    description:\n      'The orchestrator drained with zero tasks — the seed step got no usable model output.',\n  },\n  [ErrorCodes.AgentOrchestratorSinkInvariant]: {\n    group: 'agent',\n    retry: 'no',\n    description: 'The orchestrator plan failed the sink coverage invariant.',\n  },\n  [ErrorCodes.GatewayMintRefused]: {\n    group: 'gateway',\n    // 429 clears with the daily window, 401 with a fresh login, 403 never.\n    retry: 'case-by-case',\n    description:\n      'The PostHog backend refused to mint a gateway token for this run.',\n  },\n  [ErrorCodes.GatewayMintFailed]: {\n    group: 'gateway',\n    retry: 'yes',\n    description:\n      'The PostHog backend could not mint a gateway token: unreachable, a 5xx, or an unusable response.',\n  },\n  [ErrorCodes.SettingsUnfixableConflict]: {\n    group: 'settings',\n    retry: 'no',\n    description:\n      'A Claude settings conflict cannot be neutralized automatically.',\n  },\n  [ErrorCodes.InternalUnhandled]: {\n    group: 'internal',\n    retry: 'yes',\n    description: 'An unexpected error escaped the pipeline.',\n  },\n};\n","import type { ErrorCode } from './codes';\n\n/**\n * Structured error data for analytics and the machine-readable error line.\n *\n * A data carrier: the agent returns it inside a failure and a host hands it\n * to `wizardAbort()`, which captures it. Never thrown by the wizard.\n */\nexport class WizardError extends Error {\n  readonly code?: ErrorCode;\n\n  constructor(\n    message: string,\n    public readonly context?: Record<string, unknown>,\n    code?: ErrorCode,\n  ) {\n    super(message);\n    this.name = 'WizardError';\n    this.code = code;\n  }\n}\n","import { ErrorCodes, type ErrorCode } from './codes';\n\nexport interface AuthFailureInput {\n  hasSettingsConflict?: boolean;\n  usingManagedLogin?: boolean;\n  /** A pre-run token refresh already failed on a dead grant this run. */\n  sessionExpired?: boolean;\n  apiKey?: string;\n  missingScopes?: readonly string[];\n  gatewayRegion?: 'us' | 'eu' | 'local';\n  sessionRegion?: 'us' | 'eu';\n}\n\nexport function classifyAuthFailure(input: AuthFailureInput): ErrorCode {\n  // First: the only branch backed by a server verdict rather than inference.\n  // The token endpoint already told us the grant is dead, so every heuristic\n  // below would be guessing at a cause we know.\n  if (input.sessionExpired) return ErrorCodes.AuthSessionExpired;\n  if (input.usingManagedLogin) return ErrorCodes.AuthStoredLoginConflict;\n  if (input.hasSettingsConflict) return ErrorCodes.AuthSettingsConflict;\n  if (\n    input.apiKey &&\n    !input.apiKey.startsWith('phx_') &&\n    !input.apiKey.startsWith('pha_')\n  ) {\n    return ErrorCodes.AuthKeyType;\n  }\n  if (input.missingScopes && input.missingScopes.length > 0) {\n    return ErrorCodes.AuthMissingScope;\n  }\n  if (\n    input.gatewayRegion &&\n    input.sessionRegion &&\n    input.gatewayRegion !== 'local' &&\n    input.gatewayRegion !== input.sessionRegion\n  ) {\n    return ErrorCodes.AuthRegionMismatch;\n  }\n  return ErrorCodes.AuthInvalidOrExpired;\n}\n","import { ErrorCodes, type ErrorCode } from './codes';\nimport type { InstallSkillResult } from '@shared/skill-install';\n\nconst SKILL_CODES: Record<\n  Exclude<InstallSkillResult['kind'], 'ok'>,\n  ErrorCode\n> = {\n  'menu-fetch-failed': ErrorCodes.SkillMenuFetchFailed,\n  'skill-not-found': ErrorCodes.SkillNotFound,\n  'download-failed': ErrorCodes.SkillDownloadFailed,\n};\n\nexport function skillErrorCode(result: InstallSkillResult): ErrorCode | null {\n  if (result.kind === 'ok') return null;\n  return SKILL_CODES[result.kind];\n}\n","const DETAIL_ALLOWLIST = ['reason', 'detected', 'platform'] as const;\n\nexport function sanitizeErrorDetail(\n  detail: Record<string, unknown> | undefined,\n): Record<string, unknown> | undefined {\n  if (!detail) return undefined;\n  const safe: Record<string, unknown> = {};\n  for (const key of DETAIL_ALLOWLIST) {\n    if (detail[key] !== undefined) safe[key] = detail[key];\n  }\n  return Object.keys(safe).length > 0 ? safe : undefined;\n}\n","import { ErrorCodes, isErrorCode, type ErrorCode } from './codes';\n\nexport interface RunFailure {\n  code: ErrorCode;\n  message: string;\n  /** True when the error carried its own code: a decision, not a crash. */\n  coded: boolean;\n}\n\n/**\n * How a run's terminal error is reported. A coded WizardError (a mint refusal,\n * say) keeps its own message and code; anything else is unhandled and gets the\n * generic framing. Duck-typed on `code` so callers need not load wizard-abort.\n */\nexport function classifyRunFailure(err: unknown): RunFailure {\n  const message = err instanceof Error ? err.message : String(err);\n  const code =\n    err instanceof Error ? (err as { code?: unknown }).code : undefined;\n  if (typeof code === 'string' && isErrorCode(code)) {\n    return { code, message, coded: true };\n  }\n  return { code: ErrorCodes.InternalUnhandled, message, coded: false };\n}\n"],"mappings":";AAIG,WAAW,gBAKX,WAAW,YAKX,WAAW,oBAKX,WAAW,wBAMX,WAAW,mBAKX,WAAW,uBAKX,WAAW,kBAKX,WAAW,2BAKX,WAAW,aAKX,WAAW,sBAKX,WAAW,oBAMX,WAAW,kBAKX,WAAW,oBAKX,WAAW,sBAKX,WAAW,yBAMX,WAAW,wBAKX,WAAW,sBAKX,WAAW,kBAKX,WAAW,oBAMX,WAAW,mBAKX,WAAW,0BAMX,WAAW,2BAKX,WAAW,oBAMX,WAAW,sBAKX,WAAW,iBAKX,WAAW,qBAKX,WAAW,cAKX,WAAW,qBAKX,WAAW,oBAQX,WAAW,sBAKX,WAAW,eAKX,WAAW,qBAKX,WAAW,YAKX,WAAW,yBAKX,WAAW,iBAKX,WAAW,sBAKX,WAAW,gBAKX,WAAW,eAKX,WAAW,oBAKX,WAAW,iBAKX,WAAW,8BAMX,WAAW,sBAKX,WAAW,sCAKX,WAAW,8BAKX,WAAW,+BAMX,WAAW,4BAMX,WAAW,gCAKX,WAAW,oBAOX,WAAW,mBAMX,WAAW,2BAMX,WAAW;;;;;;;;;ACtQd,IAAa,cAAb,cAAiC,MAAM;CACrC;CAEA,YACE,SACA,SACA,MACA;AACA,QAAM,QAAQ;AAHE,OAAA,UAAA;AAIhB,OAAK,OAAO;AACZ,OAAK,OAAO;;;;;ACLhB,SAAgB,oBAAoB,OAAoC;AAItE,KAAI,MAAM,eAAgB,QAAO,WAAW;AAC5C,KAAI,MAAM,kBAAmB,QAAO,WAAW;AAC/C,KAAI,MAAM,oBAAqB,QAAO,WAAW;AACjD,KACE,MAAM,UACN,CAAC,MAAM,OAAO,WAAW,OAAO,IAChC,CAAC,MAAM,OAAO,WAAW,OAAO,CAEhC,QAAO,WAAW;AAEpB,KAAI,MAAM,iBAAiB,MAAM,cAAc,SAAS,EACtD,QAAO,WAAW;AAEpB,KACE,MAAM,iBACN,MAAM,iBACN,MAAM,kBAAkB,WACxB,MAAM,kBAAkB,MAAM,cAE9B,QAAO,WAAW;AAEpB,QAAO,WAAW;;;;ACnCpB,MAAM,cAGF;CACF,qBAAqB,WAAW;CAChC,mBAAmB,WAAW;CAC9B,mBAAmB,WAAW;CAC/B;AAED,SAAgB,eAAe,QAA8C;AAC3E,KAAI,OAAO,SAAS,KAAM,QAAO;AACjC,QAAO,YAAY,OAAO;;;;ACd5B,MAAM,mBAAmB;CAAC;CAAU;CAAY;CAAW;AAE3D,SAAgB,oBACd,QACqC;AACrC,KAAI,CAAC,OAAQ,QAAO,KAAA;CACpB,MAAM,OAAgC,EAAE;AACxC,MAAK,MAAM,OAAO,iBAChB,KAAI,OAAO,SAAS,KAAA,EAAW,MAAK,OAAO,OAAO;AAEpD,QAAO,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO,KAAA;;;;;;;;;ACI/C,SAAgB,mBAAmB,KAA0B;CAC3D,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;CAChE,MAAM,OACJ,eAAe,QAAS,IAA2B,OAAO,KAAA;AAC5D,KAAI,OAAO,SAAS,YAAY,YAAY,KAAK,CAC/C,QAAO;EAAE;EAAM;EAAS,OAAO;EAAM;AAEvC,QAAO;EAAE,MAAM,WAAW;EAAmB;EAAS,OAAO;EAAO"}

package/dist/family-picker-BKs-tTyu.js

@@ -0,0 +1,46 @@
+import { m as Colors, t as PickerMenu } from "./PickerMenu-BGGeYqd-.js";
+import { Box, Text, render } from "ink";
+import { createElement } from "react";
+//#region src/tui/family-picker.tsx
+/**
+* An Ink picker over a family's subcommands: one headline, one option per
+* child, the first option focused. Resolves with the picked value once the
+* user selects; which children to show and what to run are the CLI's.
+*/
+function FamilyPickerApp(props) {
+	return createElement(Box, {
+		flexDirection: "column",
+		paddingX: 1,
+		paddingY: 1
+	}, createElement(Text, {
+		bold: true,
+		color: Colors.accent
+	}, props.parentLabel), createElement(Box, { height: 1 }), createElement(PickerMenu, {
+		message: "Pick a subcommand",
+		options: props.options,
+		optionMarginBottom: 1,
+		onSelect: (value) => {
+			const picked = Array.isArray(value) ? value[0] : value;
+			if (picked) props.onSelect(picked);
+		}
+	}));
+}
+/** Render the picker and resolve with the selected option's value. */
+function renderFamilyPicker(parentLabel, options) {
+	return new Promise((resolve) => {
+		let app = null;
+		const handleSelect = (value) => {
+			app?.unmount();
+			resolve(value);
+		};
+		app = render(createElement(FamilyPickerApp, {
+			parentLabel,
+			options,
+			onSelect: handleSelect
+		}));
+	});
+}
+//#endregion
+export { renderFamilyPicker };
+
+//# sourceMappingURL=family-picker-BKs-tTyu.js.map

package/dist/family-picker-BKs-tTyu.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"family-picker-BKs-tTyu.js","names":[],"sources":["../src/tui/family-picker.tsx"],"sourcesContent":["/**\n * An Ink picker over a family's subcommands: one headline, one option per\n * child, the first option focused. Resolves with the picked value once the\n * user selects; which children to show and what to run are the CLI's.\n */\n\nimport { Box, Text, render } from 'ink';\nimport { createElement } from 'react';\n\nimport { Colors } from '@tui/styles';\nimport { PickerMenu } from '@tui/primitives/PickerMenu';\n\nexport interface FamilyPickerOption<T> {\n  label: string;\n  value: T;\n  hint?: string;\n}\n\ninterface FamilyPickerAppProps<T> {\n  parentLabel: string;\n  options: FamilyPickerOption<T>[];\n  onSelect: (value: T) => void;\n}\n\nfunction FamilyPickerApp<T>(props: FamilyPickerAppProps<T>) {\n  return createElement(\n    Box,\n    { flexDirection: 'column', paddingX: 1, paddingY: 1 },\n    createElement(\n      Text,\n      { bold: true, color: Colors.accent },\n      props.parentLabel,\n    ),\n    createElement(Box, { height: 1 }),\n    createElement(PickerMenu<T>, {\n      message: 'Pick a subcommand',\n      options: props.options,\n      optionMarginBottom: 1,\n      onSelect: (value) => {\n        // PickerMenu in single mode returns one value; only the multi-mode\n        // signature is the array variant. Narrow defensively.\n        const picked = Array.isArray(value) ? value[0] : value;\n        if (picked) props.onSelect(picked);\n      },\n    }),\n  );\n}\n\n/** Render the picker and resolve with the selected option's value. */\nexport function renderFamilyPicker<T>(\n  parentLabel: string,\n  options: FamilyPickerOption<T>[],\n): Promise<T> {\n  return new Promise((resolve) => {\n    let app: ReturnType<typeof render> | null = null;\n    const handleSelect = (value: T): void => {\n      app?.unmount();\n      resolve(value);\n    };\n    app = render(\n      createElement(FamilyPickerApp<T>, {\n        parentLabel,\n        options,\n        onSelect: handleSelect,\n      }),\n    );\n  });\n}\n"],"mappings":";;;;;;;;;AAwBA,SAAS,gBAAmB,OAAgC;AAC1D,QAAO,cACL,KACA;EAAE,eAAe;EAAU,UAAU;EAAG,UAAU;EAAG,EACrD,cACE,MACA;EAAE,MAAM;EAAM,OAAO,OAAO;EAAQ,EACpC,MAAM,YACP,EACD,cAAc,KAAK,EAAE,QAAQ,GAAG,CAAC,EACjC,cAAc,YAAe;EAC3B,SAAS;EACT,SAAS,MAAM;EACf,oBAAoB;EACpB,WAAW,UAAU;GAGnB,MAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,MAAM,KAAK;AACjD,OAAI,OAAQ,OAAM,SAAS,OAAO;;EAErC,CAAC,CACH;;;AAIH,SAAgB,mBACd,aACA,SACY;AACZ,QAAO,IAAI,SAAS,YAAY;EAC9B,IAAI,MAAwC;EAC5C,MAAM,gBAAgB,UAAmB;AACvC,QAAK,SAAS;AACd,WAAQ,MAAM;;AAEhB,QAAM,OACJ,cAAc,iBAAoB;GAChC;GACA;GACA,UAAU;GACX,CAAC,CACH;GACD"}

package/dist/{gateway-BmjYUSua.js → gateway-Dg4Fm-nC.js}

@@ -1,11 +1,112 @@
-import { n as ErrorCodes } from "./emit-BSetXzDV.js";
-import { s as logToFile } from "./debug-DyARf5TF.js";
-import { n as analytics } from "./analytics-B6q5PN7a.js";
-import { a as WizardError } from "./errors-C2domSkK.js";
-import { t as checkLlmGatewayHealth } from "./endpoints-D-4KxZiB.js";
-import { a as oauthLoginKey } from "./oauth-session-D-RfcVmr.js";
-import { i as modelCapabilities } from "./models-Dba8ITeo.js";
-import "node:fs";
+import { n as ErrorCodes } from "./emit-BqLCdV8Y.js";
+import { o as logToFile } from "./debug-sB20p-Ek.js";
+import { l as AWS_SKILLS_BASE_URL, n as analytics, y as GITHUB_SKILLS_BASE_URL } from "./analytics-CGGE7OSa.js";
+import { a as WizardError } from "./errors-DhFeR8Sp.js";
+import { i as oauthLoginKey } from "./oauth-session-C2fVSGfr.js";
+import { i as modelCapabilities } from "./models-G1j-wgwe.js";
+//#region src/shared/health-checks/endpoints.ts
+function noConnectionResult(error, attempts) {
+	return {
+		status: "no-connection",
+		error,
+		rawIndicator: attempts > 1 ? `attempts=${attempts}` : void 0
+	};
+}
+function downResult(error) {
+	return {
+		status: "down",
+		error
+	};
+}
+const RETRY_BACKOFFS_MS = [500, 2e3];
+async function attemptFetch(url, timeoutMs, redirect) {
+	const controller = new AbortController();
+	const tid = setTimeout(() => controller.abort(), timeoutMs);
+	try {
+		const res = await fetch(url, {
+			signal: controller.signal,
+			redirect
+		});
+		clearTimeout(tid);
+		return {
+			kind: "response",
+			res
+		};
+	} catch (e) {
+		clearTimeout(tid);
+		const err = e instanceof Error ? e : /* @__PURE__ */ new Error("Unknown error");
+		return {
+			kind: "error",
+			error: err,
+			timedOut: err.name === "AbortError"
+		};
+	}
+}
+async function fetchEndpointHealth(url, timeoutMs = 5e3, isExpectedStatus = (s) => s === 200, redirect = "follow") {
+	let lastHttpStatus = null;
+	let lastError = "Unknown error";
+	let attempts = 0;
+	for (let i = 0; i <= RETRY_BACKOFFS_MS.length; i++) {
+		if (i > 0) {
+			const wait = RETRY_BACKOFFS_MS[i - 1];
+			logToFile(`[health-checks] retry ${i}/${RETRY_BACKOFFS_MS.length} for ${url} in ${wait}ms (last: ${lastError})`);
+			await new Promise((r) => setTimeout(r, wait));
+		}
+		attempts++;
+		const outcome = await attemptFetch(url, timeoutMs, redirect);
+		if (outcome.kind === "response") {
+			const res = outcome.res;
+			if (isExpectedStatus(res.status)) {
+				const result = {
+					status: "healthy",
+					rawIndicator: attempts > 1 ? `HTTP ${res.status} (attempts=${attempts})` : `HTTP ${res.status}`
+				};
+				logToFile(`[health-checks] GET ${url} -> ${result.status} (${result.rawIndicator})`);
+				return result;
+			}
+			lastHttpStatus = res.status;
+			lastError = `HTTP ${res.status}`;
+			continue;
+		}
+		lastError = outcome.timedOut ? `Request timed out after ${timeoutMs}ms` : outcome.error.message;
+	}
+	const result = lastHttpStatus !== null ? downResult(`HTTP ${lastHttpStatus} (attempts=${attempts})`) : noConnectionResult(lastError, attempts);
+	logToFile(`[health-checks] GET ${url} -> ${result.status} (attempts=${attempts}, ${result.error})`);
+	return result;
+}
+const checkLlmGatewayHealth = (gatewayUrl) => fetchEndpointHealth(new URL("/readyz", gatewayUrl).href);
+/**
+* Skills are published to two origins under the same filenames and
+* `fetchWithRetry` fails over between them, so the run is only blocked when
+* neither answers. Probed in parallel — sequential probes would double the
+* worst case past `READINESS_TIMEOUT_MS`.
+*/
+const checkSkillsOriginHealth = async () => {
+	const [github, aws] = await Promise.all([fetchEndpointHealth(`${GITHUB_SKILLS_BASE_URL}/skill-menu.json`), fetchEndpointHealth(`${AWS_SKILLS_BASE_URL}/skill-menu.json`)]);
+	return combineOriginHealth(github, aws);
+};
+/**
+* Mirrors `fetchWithRetry`: a download tries GitHub, then AWS, so the run is
+* only blocked when neither origin answers. Whichever failure the probes saw,
+* one origin serving means skills are reachable.
+*/
+function combineOriginHealth(github, aws) {
+	if (github.status === "healthy") return aws.status === "healthy" ? github : withIndicatorSuffix(github, "aws unavailable");
+	if (aws.status === "healthy") return withIndicatorSuffix(aws, "via aws, github unavailable");
+	const error = `github: ${github.error ?? "unknown"} | aws: ${aws.error ?? "unknown"}`;
+	return {
+		status: github.status === "down" || aws.status === "down" ? "down" : "no-connection",
+		error,
+		rawIndicator: github.rawIndicator ?? aws.rawIndicator
+	};
+}
+function withIndicatorSuffix(result, suffix) {
+	return {
+		...result,
+		rawIndicator: result.rawIndicator ? `${result.rawIndicator} (${suffix})` : suffix
+	};
+}
+//#endregion
 //#region src/agent/gateway-session.ts
 /**
 * Gateway auth for a wizard run: a `phe_` scoped token the backend mints, with
@@ -20,9 +121,18 @@ let cached = null;
 * task at once, and each would otherwise take its own token and its own cap.
 */
 let inFlight = null;
-function configureGatewayFromCIEnvironment(projectId, region) {
+let ciAuth = null;
+function configureGatewayCredentialsForCI(token, projectId, gatewayUrl) {
 	throw new Error("CI gateway auth requires a non-production build");
 }
+/** Use this run's pre-issued gateway token, or mint when it has none; the keyed mint cache stays. */
+function useRunGatewayCredential(gateway, projectId) {
+	if (gateway) {
+		configureGatewayCredentialsForCI(gateway.token, projectId, gateway.url);
+		return;
+	}
+	ciAuth = null;
+}
 /**
 * Adoption floor. The anthropic subprocess holds its credential until a 401
 * forces a re-mint, so a token below this would churn mints.
@@ -37,6 +147,7 @@ const MAX_REFUSAL_DETAIL_LENGTH = 500;
 const MAX_REFUSAL_OUTCOME_LENGTH = 64;
 /** Resolve this run's gateway auth, minting and re-minting near expiry. */
 async function gatewayAuth(host, accessToken, program) {
+	if (ciAuth) return ciAuth;
 	const key = `${host.apiHost}\n${oauthLoginKey(accessToken)}\n${program ?? ""}`;
 	if (cached && cached.key === key && Date.now() < cached.staleAtMs) return cached.auth;
 	if (inFlight && inFlight.key === key) return inFlight.promise;
@@ -452,6 +563,6 @@ function withGatewayRemint(opts) {
 	};
 }
 //#endregion
-export { gatewayTerminalFailure as a, REMARK_INSTRUCTION as c, configureGatewayFromCIEnvironment as d, gatewayAuth as f, gatewayApiFor as i, RESUME_INSTRUCTION as l, buildGatewayModel as n, withGatewayRemint as o, isPastRefresh as p, buildGatewayProvider as r, AgentSignals as s, GATEWAY_PROVIDER as t, buildWizardPropertiesBlob as u };
+export { gatewayTerminalFailure as a, REMARK_INSTRUCTION as c, gatewayAuth as d, isPastRefresh as f, gatewayApiFor as i, RESUME_INSTRUCTION as l, checkSkillsOriginHealth as m, buildGatewayModel as n, withGatewayRemint as o, useRunGatewayCredential as p, buildGatewayProvider as r, AgentSignals as s, GATEWAY_PROVIDER as t, buildWizardPropertiesBlob as u };
 
-//# sourceMappingURL=gateway-BmjYUSua.js.map
+//# sourceMappingURL=gateway-Dg4Fm-nC.js.map