@posthog/wizard 2.82.0 → 2.84.0

package/dist/{programs-Bq9Ju9xk.js → programs-mxhRXwP-.js}

@@ -1,18 +1,18 @@
 import { n as ErrorCodes } from "./emit-BqLCdV8Y.js";
-import { f as VERSION, l as WIZARD_TASK_STREAM_FILE, o as logToFile, p as HEADLESS_FLAG } from "./debug-BvEbemym.js";
-import { B as REPLAY_VISION_SUPPORTED, E as ISSUES_URL, G as WIZARD_CONTACT_EMAIL, I as POSTHOG_PROXY_CLIENT_ID, J as WIZARD_OAUTH_SCOPES, L as POSTHOG_STATUS_PAGE_URL, M as POSTHOG_DOCS_URL, Q as WIZARD_PROVISIONING_SCOPES, S as GPT5_6_TERRA_MODEL, dt as resolveLocalDev, f as DEFAULT_AGENT_MODEL, h as EVENTS_AUDIT_REPORT_FILE, j as POSTHOG_DEV_CLIENT_ID, n as analytics, nt as WIZARD_USER_AGENT, o as mayReportScanResults, r as groupsFromUser, rt as getSkillsBaseUrl } from "./analytics-B_xFshPY.js";
-import { a as WizardError, n as sanitizeErrorDetail, t as classifyRunFailure } from "./errors-DhFeR8Sp.js";
-import { i as readProjectFile, t as IGNORED_DIRS } from "./bounded-fs-iRaQcKYL.js";
-import { n as isUsingTypeScript } from "./setup-utils-C7kaDP5X.js";
-import { l as markGrantRevoked, r as currentCredentials, s as rotateAfterUnauthorized, t as configureOAuthSession } from "./oauth-session-Bi1MLRCC.js";
-import { m as checkSkillsOriginHealth, s as AgentSignals } from "./gateway-CWoYlPz7.js";
-import { R as WIZARD_TOOL_NAMES, c as checkAllSettingsConflicts, d as restoreClaudeSettings, l as classifySettingsConflicts, nt as LONGER_ASK_TIMEOUT_MS, p as registerCleanup, s as backupAndFixClaudeSettings } from "./agent-interface-3YfIWZmY.js";
-import { a as getOAuthUrl, s as resolveBaseUrl } from "./urls-B82v7gfO.js";
-import { C as FRAMEWORK_REGISTRY, D as runAgent, O as DEFAULT_BINDING, S as detectFramework, _ as detectProjectsWithAgent, a as detectPostHogIntegration, b as noteDetectedFramework, d as DETECTED_WAREHOUSE_SOURCES_KEY, f as detectWarehouseSources, g as toIntegrationCandidates, h as scopeInstallDirToProject, i as ProgramAbort, m as detectIntegrationProjects, n as WAREHOUSE_SOURCE_SCOPE_ADDITIONS, o as reportWarehouseSourcesDetected, p as getDetectedWarehouseSources, r as abortNoFrameworkDetected, s as stampAiSdkDetected, t as config$13, u as findPackageJsons, v as resolveProjectDir, w as SPINNER_MESSAGE, x as gatherFrameworkContext } from "./posthog-integration-CpinLWNO.js";
-import { m as appendStatus } from "./pi-DTj1hsJe.js";
-import { v as writeJsonAtomic } from "./queue-tools-BoIITT7w.js";
-import { C as coerceAuditChecks, S as AUDIT_REPORT_FILE, x as AUDIT_CHECKS_FILE } from "./yara-hooks-BS0n3ekf.js";
-import { t as resolveApiKeyProject } from "./api-key-login-oUJQDmOV.js";
+import { f as VERSION, l as WIZARD_TASK_STREAM_FILE, o as logToFile, p as HEADLESS_FLAG } from "./debug-BfO_Txo8.js";
+import { C as GPT5_6_TERRA_MODEL, H as REPLAY_VISION_SUPPORTED, N as POSTHOG_DEV_CLIENT_ID, O as ISSUES_URL, P as POSTHOG_DOCS_URL, R as POSTHOG_PROXY_CLIENT_ID, X as WIZARD_OAUTH_SCOPES, at as getSkillsBaseUrl, et as WIZARD_PROVISIONING_SCOPES, g as EVENTS_AUDIT_REPORT_FILE, it as WIZARD_USER_AGENT, n as analytics, o as mayReportScanResults, p as DEFAULT_AGENT_MODEL, pt as resolveLocalDev, q as WIZARD_CONTACT_EMAIL, r as groupsFromUser, w as GPT6_SOL_MODEL, z as POSTHOG_STATUS_PAGE_URL } from "./analytics-Drox5LSW.js";
+import { a as WizardError, n as sanitizeErrorDetail, t as classifyRunFailure } from "./errors-BXlWujEw.js";
+import { i as readProjectFile, t as IGNORED_DIRS } from "./bounded-fs-TRL6IsoU.js";
+import { n as isUsingTypeScript } from "./setup-utils-CQY8PHjR.js";
+import { l as markGrantRevoked, r as currentCredentials, s as rotateAfterUnauthorized, t as configureOAuthSession } from "./oauth-session-9EU3ky0v.js";
+import { c as AgentSignals, g as checkSkillsOriginHealth } from "./gateway-CLQQb96F.js";
+import { R as WIZARD_TOOL_NAMES, c as checkAllSettingsConflicts, d as restoreClaudeSettings, l as classifySettingsConflicts, nt as LONGER_ASK_TIMEOUT_MS, p as registerCleanup, s as backupAndFixClaudeSettings } from "./agent-interface-BNssNetq.js";
+import { a as getOAuthUrl, s as resolveBaseUrl } from "./urls-WeqfBLP4.js";
+import { D as FRAMEWORK_REGISTRY, E as detectFramework, M as DEFAULT_BINDING, O as SPINNER_MESSAGE, S as tagScanResults, T as gatherFrameworkContext, _ as scopeInstallDirToProject, a as detectPostHogIntegration, b as resolveProjectDir, d as scanCodebaseFor, f as scannedWarehouseSources, g as detectIntegrationProjects, h as workspaceFingerprint, i as ProgramAbort, j as runAgent, l as findPackageJsons, m as getDetectedWarehouseSources, n as WAREHOUSE_SOURCE_SCOPE_ADDITIONS, o as reportWarehouseSourcesDetected, p as DETECTED_WAREHOUSE_SOURCES_KEY, r as abortNoFrameworkDetected, t as config$14, u as getCodebaseScan, v as toIntegrationCandidates, w as noteDetectedFramework, x as applyScanTags, y as detectProjectsWithAgent } from "./posthog-integration-mIQGBc1f.js";
+import { m as appendStatus } from "./pi-BSnSk6rv.js";
+import { y as writeJsonAtomic } from "./queue-tools-PFG6H93Q.js";
+import { C as AUDIT_REPORT_FILE, S as AUDIT_CHECKS_FILE, w as coerceAuditChecks } from "./yara-hooks-aDbdsitJ.js";
+import { t as resolveApiKeyProject } from "./api-key-login-BgwfAXfv.js";
 import { valid } from "semver";
 import * as fs$1 from "fs";
 import fs, { existsSync, readFileSync, readdirSync, statSync } from "fs";
@@ -248,20 +248,23 @@ const MCP_ANALYTICS_ABORT_CASES = [
 * 'mcp-analytics'` from context-mill — a deliberate breaking change, done then,
 * not pre-emptively.
 */
-const config$12 = createSkillProgram({
-	skillId: "mcp-analytics",
-	command: "mcp-analytics",
-	id: "mcp-analytics",
-	description: "Add PostHog MCP Analytics to your MCP server",
-	integrationLabel: "mcp-analytics",
-	customPrompt: `Instrument this project's MCP server with PostHog MCP analytics. Run the \`mcp-analytics\` skill end-to-end: detect the language and server style, install the PostHog MCP SDK for that language (\`@posthog/mcp\` for TypeScript, \`posthog\` for Python, \`posthogmcpsdk\` for Go, \`posthog-ruby\` for Ruby), wrap the server (or use the custom-dispatcher client where the skill says so), wire the project API key and host, and verify. Make only additive changes — do not alter tool behavior. For a Ruby server, the report must open by saying the Ruby SDK is experimental and not officially supported. The final report is written to ./${MCP_ANALYTICS_REPORT_FILE}.`,
-	successMessage: `MCP analytics configured! View the report at ./${MCP_ANALYTICS_REPORT_FILE}`,
-	reportFile: MCP_ANALYTICS_REPORT_FILE,
-	docsUrl: "https://posthog.com/docs/mcp-analytics",
-	spinnerMessage: "Setting up MCP analytics...",
-	estimatedDurationMinutes: 5,
-	abortCases: MCP_ANALYTICS_ABORT_CASES
-});
+const config$13 = {
+	decisions: ["is_mcp_server"],
+	...createSkillProgram({
+		skillId: "mcp-analytics",
+		command: "mcp-analytics",
+		id: "mcp-analytics",
+		description: "Add PostHog MCP Analytics to your MCP server",
+		integrationLabel: "mcp-analytics",
+		customPrompt: `Instrument this project's MCP server with PostHog MCP analytics. Run the \`mcp-analytics\` skill end-to-end: detect the language and server style, install the PostHog MCP SDK for that language (\`@posthog/mcp\` for TypeScript, \`posthog\` for Python, \`posthogmcpsdk\` for Go, \`posthog-ruby\` for Ruby), wrap the server (or use the custom-dispatcher client where the skill says so), wire the project API key and host, and verify. Make only additive changes — do not alter tool behavior. For a Ruby server, the report must open by saying the Ruby SDK is experimental and not officially supported. The final report is written to ./${MCP_ANALYTICS_REPORT_FILE}.`,
+		successMessage: `MCP analytics configured! View the report at ./${MCP_ANALYTICS_REPORT_FILE}`,
+		reportFile: MCP_ANALYTICS_REPORT_FILE,
+		docsUrl: "https://posthog.com/docs/mcp-analytics",
+		spinnerMessage: "Setting up MCP analytics...",
+		estimatedDurationMinutes: 5,
+		abortCases: MCP_ANALYTICS_ABORT_CASES
+	})
+};
 //#endregion
 //#region src/programs/replay-vision/scopes.ts
 /**
@@ -295,7 +298,7 @@ const REPLAY_VISION_SCOPE_ADDITIONS = [
 //#endregion
 //#region src/programs/replay-vision/index.ts
 const REPLAY_VISION_REPORT_FILE = "posthog-replay-vision-report.md";
-function abortUnsupportedPlatform$1(integration) {
+function abortUnsupportedPlatform$2(integration) {
 	const name = FRAMEWORK_REGISTRY[integration]?.metadata.name ?? integration;
 	analytics.wizardCapture("replay-vision unsupported platform", { integration });
 	throw new ProgramAbort({
@@ -333,7 +336,7 @@ const REPLAY_VISION_ABORT_CASES = [{
 async function detectReplayVisionProject(ctx) {
 	const integration = await detectFramework(ctx.session.installDir);
 	if (!integration) abortNoFrameworkDetected(NO_FRAMEWORK_GUIDANCE);
-	if (!REPLAY_VISION_SUPPORTED.has(integration)) abortUnsupportedPlatform$1(integration);
+	if (!REPLAY_VISION_SUPPORTED.has(integration)) abortUnsupportedPlatform$2(integration);
 	await detectPostHogIntegration(ctx);
 }
 /**
@@ -356,7 +359,12 @@ async function detectReplayVisionProject(ctx) {
 *   to the right project (monorepos), then detect the framework — the
 *   headless equivalent of `onReady`.
 */
-const config$11 = {
+const config$12 = {
+	decisions: [
+		"framework",
+		"web_frontend",
+		"primary_user_flow"
+	],
 	...createSkillProgram({
 		skillId: "replay-vision-setup",
 		command: "replay-vision",
@@ -373,8 +381,8 @@ const config$11 = {
 	}),
 	binding: {
 		sequence: "orchestrator",
-		harness: "anthropic",
-		model: DEFAULT_AGENT_MODEL
+		harness: "pi",
+		model: GPT6_SOL_MODEL
 	},
 	agentFlow: "replay-vision",
 	onReady: detectReplayVisionProject,
@@ -383,7 +391,7 @@ const config$11 = {
 		await scopeInstallDirToProject(session, runner);
 		const integration = await detectFramework(session.installDir);
 		if (!integration) abortNoFrameworkDetected(NO_FRAMEWORK_GUIDANCE);
-		if (!REPLAY_VISION_SUPPORTED.has(integration)) abortUnsupportedPlatform$1(integration);
+		if (!REPLAY_VISION_SUPPORTED.has(integration)) abortUnsupportedPlatform$2(integration);
 		session.integration = integration;
 		analytics.setTag("integration", integration);
 		const frameworkConfig = FRAMEWORK_REGISTRY[integration];
@@ -414,7 +422,8 @@ const AI_OBSERVABILITY_REPORT_FILE = "posthog-ai-observability-report.md";
 * the right variant itself (see `customPrompt`). Stays flat while a single
 * "add AIO to a project" flow is the only action.
 */
-const config$10 = {
+const config$11 = {
+	decisions: ["calls_llm_api"],
 	binding: {
 		sequence: "linear",
 		harness: "pi",
@@ -473,7 +482,7 @@ const METRICS_REPORT_FILE = "posthog-metrics-report.md";
 * `customPrompt` both pick from the menu and install it. Stays flat while a
 * single "add metrics to a project" flow is the only action.
 */
-const config$9 = {
+const config$10 = {
 	command: "metrics",
 	description: "Add PostHog application metrics to your project",
 	id: "metrics",
@@ -783,7 +792,7 @@ const DOCS_URL$3 = "https://posthog.com/docs/product-analytics/best-practices";
 * skill (whose id AuditRunScreen keys its slides on), not to this config.
 * Registered so its id stays resolvable; nothing dispatches to it today.
 */
-const config$8 = {
+const config$9 = {
 	description: "Audit PostHog event tracking in this project",
 	id: "events-audit",
 	skillId: "events-audit",
@@ -1036,7 +1045,7 @@ const configs = [{
 		...headlessOption,
 		...regionOption
 	}
-}, config$8];
+}, config$9];
 //#endregion
 //#region src/shared/oauth-scopes.ts
 /**
@@ -1122,7 +1131,7 @@ function detectWebAnalyticsPrerequisites(session, setFrameworkContext) {
 	}
 	setFrameworkContext("detectedPosthogSdks", sdks);
 }
-const config$7 = {
+const config$8 = {
 	...createSkillProgram({
 		skillId: "web-analytics-doctor",
 		command: "web-analytics",
@@ -1150,7 +1159,7 @@ const MIGRATION_ABORT_CASES = [{
 	body: "The migration needs an existing third-party SDK to migrate from. No calls to the source SDK appear anywhere in this project. If you haven't installed PostHog yet, you don't need this command — run `npx @posthog/wizard@latest` to add PostHog from scratch."
 }];
 const DEFAULT_MIGRATE_SKILL_ID = "migrate-statsig";
-const config$6 = {
+const config$7 = {
 	command: "migrate",
 	description: "Migrate to PostHog from another analytics provider",
 	id: "migration",
@@ -1266,7 +1275,8 @@ function detectRevenuePrerequisites(session, setFrameworkContext) {
 }
 //#endregion
 //#region src/programs/revenue-analytics/index.ts
-const config$5 = {
+const config$6 = {
+	decisions: ["billing_code"],
 	command: "revenue-analytics",
 	description: "Set up PostHog for Revenue Analytics",
 	id: "revenue-analytics-setup",
@@ -1292,7 +1302,7 @@ const config$5 = {
 /**
 * Warehouse-source program detection step.
 *
-* Thin adapter over `detectWarehouseSources` that writes results into
+* Reads the run's codebase scan and writes a `detectError` into
 * frameworkContext for the intro screen, plus the `[ABORT]` cases the
 * data-warehouse-source-setup skill can emit.
 */
@@ -1309,10 +1319,10 @@ const WAREHOUSE_ABORT_CASES = [{
 	docsUrl: "https://posthog.com/docs/data-warehouse"
 }];
 /**
-* Scan `session.installDir` for warehouse-source signals. Writes the detected
-* sources (or a `detectError`) into frameworkContext for the intro screen.
+* Check the run's codebase scan for warehouse sources. Writes a `detectError`
+* into frameworkContext for the intro screen when there is nothing to set up.
 */
-function detectWarehousePrerequisites(session, setFrameworkContext) {
+async function detectWarehousePrerequisites(session, setFrameworkContext) {
 	const fail = (error) => setFrameworkContext("detectError", error);
 	const installDir = session.installDir;
 	if (!existsSync(installDir)) {
@@ -1344,14 +1354,16 @@ function detectWarehousePrerequisites(session, setFrameworkContext) {
 		});
 		return;
 	}
-	const sources = detectWarehouseSources(installDir);
+	const sources = await scannedWarehouseSources(session);
 	if (sources.length === 0) {
 		fail({ kind: "no-sources" });
 		return;
 	}
-	analytics.setTag("warehouse_source_kinds", sources.map((s) => s.kind).join(","));
-	analytics.setTag("warehouse_source_modes", sources.map((s) => `${s.kind}:${s.mode}`).join(","));
-	analytics.setTag("warehouse_source_count", sources.length);
+	tagScanResults(session, setFrameworkContext, {
+		warehouse_source_kinds: sources.map((s) => s.kind).join(","),
+		warehouse_source_modes: sources.map((s) => `${s.kind}:${s.mode}`).join(","),
+		warehouse_source_count: sources.length
+	});
 	setFrameworkContext(DETECTED_WAREHOUSE_SOURCES_KEY, sources);
 }
 //#endregion
@@ -1374,11 +1386,13 @@ function buildPrompt(session) {
 		"Use the `kind` string exactly as printed above for `source_type` — PostHog rejects the display label."
 	].join("\n");
 }
-const config$4 = {
+const config$5 = {
+	decisions: ["owns_database"],
 	command: "warehouse",
 	description: "Detect and connect Data Warehouse sources",
 	id: "warehouse-source",
 	skillId: "data-warehouse-source-setup",
+	scansCodebase: true,
 	onReady: (ctx) => detectWarehousePrerequisites(ctx.session, ctx.setFrameworkContext),
 	oauthScopeAdditions: WAREHOUSE_SOURCE_SCOPE_ADDITIONS,
 	healthCheck: false,
@@ -1585,6 +1599,11 @@ const SELF_DRIVING_ABORT_CASES = [
 		message: "Interactive terminal required",
 		body: "Self-driving setup asks questions along the way (GitHub and issue trackers), so it needs an interactive terminal. Run the wizard outside CI / non-interactive mode."
 	},
+	{
+		match: /^wrong-project$/i,
+		message: "This repo uses a different PostHog project",
+		body: "Nothing was changed. Run the wizard again with --project-id set to the project this repo sends events to. The id is the number after /project/ in that project's PostHog URL."
+	},
 	{
 		match: /^requirements-incomplete$/i,
 		message: "Setup needs your input",
@@ -1596,7 +1615,7 @@ const SELF_DRIVING_ABORT_CASES = [
 * `SelfDrivingDetectError` to frameworkContext on failure — the intro
 * screen renders it and blocks.
 */
-function detectSelfDrivingPrerequisites(session, setFrameworkContext) {
+async function detectSelfDrivingPrerequisites(session, setFrameworkContext) {
 	const fail = (error) => setFrameworkContext("detectError", error);
 	const installDir = session.installDir;
 	if (!existsSync(installDir)) {
@@ -1625,9 +1644,9 @@ function detectSelfDrivingPrerequisites(session, setFrameworkContext) {
 		return;
 	}
 	setFrameworkContext(POSTHOG_PRESENT_KEY, detectPostHogPresent(installDir));
-	detectConnectedTools(installDir, setFrameworkContext);
+	await detectConnectedTools(session, setFrameworkContext);
 }
-/** Step 5's ask options intersected with `SOURCE_DETECTORS` — reconcile when the skill's catalog grows. */
+/** Step 5's ask options intersected with the tool catalog's kinds. Reconcile when the skill's catalog grows. */
 const SELF_DRIVING_TOOL_KINDS = new Set([
 	"Github",
 	"GitLab",
@@ -1651,18 +1670,21 @@ const SELF_DRIVING_TOOL_KINDS = new Set([
 	"Productboard",
 	"GoogleSearchConsole"
 ]);
-/** Scan for inbox-connectable tools so STEP 5 can surface them first. Best-effort — never blocks detection. */
-function detectConnectedTools(installDir, setFrameworkContext) {
-	try {
-		const tools = detectWarehouseSources(installDir).filter((s) => SELF_DRIVING_TOOL_KINDS.has(s.kind));
-		analytics.setTag("connected_tools_detected_count", tools.length);
-		if (tools.length === 0) return;
-		analytics.setTag("connected_tools_detected", tools.map((s) => s.kind).join(","));
-		setFrameworkContext(SELF_DRIVING_DETECTED_TOOLS_KEY, tools);
-	} catch (error) {
-		analytics.setTag("connected_tools_detected_count", -1);
-		analytics.captureException(error instanceof Error ? error : new Error(String(error)), { step: "detectConnectedTools" });
+/** Pick the inbox-connectable tools out of the run's codebase scan so STEP 5 can surface them first. */
+async function detectConnectedTools(session, setFrameworkContext) {
+	const scan = getCodebaseScan(session);
+	if (!scan) return;
+	if (scan.failed) {
+		tagScanResults(session, setFrameworkContext, { connected_tools_detected_count: -1 });
+		return;
 	}
+	const tools = (await scannedWarehouseSources(session)).filter((s) => SELF_DRIVING_TOOL_KINDS.has(s.kind));
+	tagScanResults(session, setFrameworkContext, {
+		connected_tools_detected_count: tools.length,
+		...tools.length > 0 && { connected_tools_detected: tools.map((s) => s.kind).join(",") }
+	});
+	if (tools.length === 0) return;
+	setFrameworkContext(SELF_DRIVING_DETECTED_TOOLS_KEY, tools);
 }
 //#endregion
 //#region src/programs/self-driving/prompt.ts
@@ -1776,6 +1798,19 @@ STEP 1 — Check Self-driving access. (skill: "Check access")
    and halt.
 
 STEP 2 — Read project and current Signals state. (skill: "Read context")
+   First confirm that this repo sends events to project ${ctx.projectId}.
+   The user picked that project on the PostHog login screen, and that
+   screen preselects the last project they opened in the browser, so it
+   can be the wrong one. Find the project token in this repo's PostHog
+   client setup (the init call, its env var, and that env var's value in
+   any .env file). This project's token is ${ctx.projectApiKey}. If the
+   repo's token is a different phc_ token, STOP before any write and ask
+   ONE wizard_ask: continue with project ${ctx.projectId}, or stop so they
+   can run the wizard again for the repo's project. Say which token the
+   repo uses and where. If they stop, emit
+   ${AgentSignals.ABORT} wrong-project
+   and halt. If the tokens match, or the repo has no literal token, go on.
+
    If ./posthog-setup-report.md exists, read it as a strong hint for what
    THIS repo instruments — but it is often absent (users frequently don't
    commit it), so do NOT depend on it. Combine whatever you find with the
@@ -2136,7 +2171,8 @@ const buildRun = (session) => Promise.resolve({
 		};
 	}
 });
-const config$3 = {
+const config$4 = {
+	decisions: ["primary_user_flow", "user_login"],
 	...createSkillProgram({
 		skillId: SELF_DRIVING_SKILL_ID,
 		command: "self-driving",
@@ -2151,6 +2187,7 @@ const config$3 = {
 		requires: ["posthog-integration"],
 		abortCases: SELF_DRIVING_ABORT_CASES
 	}),
+	scansCodebase: true,
 	onReady: (ctx) => detectSelfDrivingPrerequisites(ctx.session, ctx.setFrameworkContext),
 	oauthScopeAdditions: SELF_DRIVING_SCOPE_ADDITIONS,
 	runSteps: { "integrate-run": {
@@ -2719,7 +2756,12 @@ const DOCS_URL = "https://posthog.com/docs/error-tracking/upload-source-maps";
 function ensurePostHogCli(variant, log) {
 	preinstallPostHogCliOnce("source maps posthog-cli preinstall failed", { variant }, log);
 }
-const config$2 = {
+const config$3 = {
+	decisions: [
+		"ships_minified_js",
+		"build_tool",
+		"deploy_platform"
+	],
 	command: "upload-source-maps",
 	description: "Upload source maps to PostHog Error Tracking",
 	id: "error-tracking-upload-source-maps",
@@ -2845,7 +2887,7 @@ const SYMBOL_UPLOAD_CLI_FRAMEWORKS = new Set([
 	"go",
 	"rust"
 ]);
-function abortUnsupportedPlatform(integration) {
+function abortUnsupportedPlatform$1(integration) {
 	const name = FRAMEWORK_REGISTRY[integration]?.metadata.name ?? integration;
 	analytics.wizardCapture("error tracking unsupported platform", { integration });
 	throw new ProgramAbort({
@@ -2931,7 +2973,8 @@ const ERROR_TRACKING_RUN = {
 *   project (monorepos), then detect the framework — the headless equivalent
 *   of the project picker.
 */
-const config$1 = {
+const config$2 = {
+	decisions: ["web_frontend", "server_runtime"],
 	binding: {
 		sequence: "orchestrator",
 		harness: "pi",
@@ -2951,7 +2994,7 @@ const config$1 = {
 		await scopeInstallDirToProject(session, runner);
 		const integration = await detectFramework(session.installDir);
 		if (!integration) abortNoFrameworkDetected();
-		if (ERROR_TRACKING_UNSUPPORTED.has(integration)) abortUnsupportedPlatform(integration);
+		if (ERROR_TRACKING_UNSUPPORTED.has(integration)) abortUnsupportedPlatform$1(integration);
 		session.integration = integration;
 		analytics.setTag("integration", integration);
 		session.frameworkConfig = FRAMEWORK_REGISTRY[integration];
@@ -2960,6 +3003,79 @@ const config$1 = {
 	}
 };
 //#endregion
+//#region src/programs/feature-flags/scopes.ts
+const FEATURE_FLAGS_SCOPE_ADDITIONS = ["feature_flag:read", "feature_flag:write"];
+//#endregion
+//#region src/programs/feature-flags/index.ts
+const FEATURE_FLAGS_REPORT_FILE = "posthog-feature-flags-report.md";
+const FEATURE_FLAGS_DOCS_URL = "https://posthog.com/docs/feature-flags";
+const FEATURE_FLAGS_STEP_SKILL_ID = "integration-v2-feature-flags-step";
+/** KMP skill variants carry no `framework` tag, so orchestrator preflight aborts every KMP run. */
+const FEATURE_FLAGS_UNSUPPORTED = new Set(["kmp"]);
+function abortUnsupportedPlatform(integration) {
+	const name = FRAMEWORK_REGISTRY[integration]?.metadata.name ?? integration;
+	analytics.wizardCapture("feature flags unsupported platform", { integration });
+	throw new ProgramAbort({
+		code: ErrorCodes.DetectUnsupportedPlatform,
+		message: `The wizard cannot set up feature flags for ${name} projects yet.\n\nSet them up manually:\n  ${FEATURE_FLAGS_DOCS_URL}`
+	});
+}
+const config$1 = {
+	command: "feature-flags",
+	description: "Set up example PostHog feature flags",
+	id: "feature-flags",
+	binding: {
+		sequence: "orchestrator",
+		harness: "pi",
+		model: DEFAULT_AGENT_MODEL
+	},
+	agentFlow: "feature-flags",
+	handoffNotebook: true,
+	onReady: (ctx) => detectPostHogIntegration(ctx),
+	oauthScopeAdditions: FEATURE_FLAGS_SCOPE_ADDITIONS,
+	cliOptions: {
+		...headlessOption,
+		...regionOption
+	},
+	run: {
+		integrationLabel: "feature-flags",
+		successMessage: "Feature flags wired in!",
+		reportFile: FEATURE_FLAGS_REPORT_FILE,
+		docsUrl: FEATURE_FLAGS_DOCS_URL,
+		spinnerMessage: "Setting up your first feature flags...",
+		estimatedDurationMinutes: 5,
+		buildOutroNextSteps: () => ({
+			heading: "Next steps",
+			items: [
+				"Open your app and load the page or endpoint that evaluates each flag",
+				"Find the evaluation on each flag's page in PostHog (it can take a few minutes to show up)",
+				"Turn the flags on when you're ready"
+			]
+		})
+	},
+	ciPreRun: async (session, runner) => {
+		await scopeInstallDirToProject(session, runner);
+		const integration = await detectFramework(session.installDir);
+		if (!integration) abortNoFrameworkDetected();
+		if (FEATURE_FLAGS_UNSUPPORTED.has(integration)) abortUnsupportedPlatform(integration);
+		session.integration = integration;
+		analytics.setTag("integration", integration);
+		const frameworkConfig = FRAMEWORK_REGISTRY[integration];
+		session.frameworkConfig = frameworkConfig;
+		session.skillId = integration;
+		const context = await gatherFrameworkContext(frameworkConfig, {
+			installDir: session.installDir,
+			debug: session.debug,
+			signup: session.signup,
+			ci: true,
+			benchmark: session.benchmark,
+			yaraReport: session.yaraReport
+		});
+		for (const [key, value] of Object.entries(context)) if (!(key in session.frameworkContext)) session.frameworkContext[key] = value;
+		noteDetectedFramework(session, frameworkConfig, context, runner.log);
+	}
+};
+//#endregion
 //#region src/programs/agent-skill/index.ts
 const config = {
 	id: "agent-skill",
@@ -2989,20 +3105,21 @@ const config = {
 const [audit, eventsAudit] = configs;
 /** Every program entry, one line each. */
 const PROGRAM_REGISTRY = [
-	config$13,
+	config$14,
+	config$6,
 	config$5,
-	config$4,
+	config$3,
 	config$2,
 	config$1,
 	...configs,
+	config$8,
 	config$7,
-	config$6,
-	config$3,
+	config$4,
 	config,
+	config$13,
 	config$12,
 	config$11,
-	config$10,
-	config$9
+	config$10
 ];
 /**
 * Typed program names. Values come from each config's `id`, so there's
@@ -3010,21 +3127,22 @@ const PROGRAM_REGISTRY = [
 * just exposing that config's `id` under a friendly name for call sites.
 */
 const Program = {
-	PostHogIntegration: config$13.id,
-	RevenueAnalyticsSetup: config$5.id,
-	WarehouseSource: config$4.id,
-	ErrorTrackingUploadSourceMaps: config$2.id,
-	ErrorTracking: config$1.id,
-	Migration: config$6.id,
+	PostHogIntegration: config$14.id,
+	RevenueAnalyticsSetup: config$6.id,
+	WarehouseSource: config$5.id,
+	ErrorTrackingUploadSourceMaps: config$3.id,
+	ErrorTracking: config$2.id,
+	FeatureFlags: config$1.id,
+	Migration: config$7.id,
 	Audit: audit.id,
 	EventsAudit: eventsAudit.id,
-	WebAnalyticsDoctor: config$7.id,
-	SelfDriving: config$3.id,
+	WebAnalyticsDoctor: config$8.id,
+	SelfDriving: config$4.id,
 	AgentSkill: config.id,
-	McpAnalytics: config$12.id,
-	ReplayVision: config$11.id,
-	AiObservability: config$10.id,
-	Metrics: config$9.id
+	McpAnalytics: config$13.id,
+	ReplayVision: config$12.id,
+	AiObservability: config$11.id,
+	Metrics: config$10.id
 };
 /**
 * Look up a program config by its id. Callers pass ids from `Program` or
@@ -3043,7 +3161,6 @@ function getSubcommandPrograms() {
 function getCommandPath(config) {
 	return config.parentCommand ? `${config.parentCommand} ${config.command}` : config.command;
 }
-/** The program with this id, or undefined for a tool's id or none. */
 function findProgramConfig(programId) {
 	return programId ? PROGRAM_REGISTRY.find((c) => c.id === programId) : void 0;
 }
@@ -3064,6 +3181,45 @@ function getProvisioningScopesForProgram(programId) {
 	return withScopeAdditions(WIZARD_PROVISIONING_SCOPES, findProgramConfig(programId)?.oauthScopeAdditions);
 }
 //#endregion
+//#region src/programs/codebase-scan/report.ts
+/**
+* The one place a codebase scan is cleared to leave the machine. Runs only
+* when the user granted sharing (CI and headless runs grant it) and telemetry
+* is on.
+*
+* Called when consent resolves (the intro's Continue) and again after login,
+* because either can happen first. Each part latches, so a run reports once:
+*   - the `warehouse sources detected` event, which needs no login
+*   - the scan, which needs the login for its fingerprint. This hands it to
+*     the task stream, which attaches it to the run's wizard session.
+*/
+function buildScanReport(scan, projectId) {
+	return {
+		program: scan.program,
+		wizard_version: VERSION,
+		workspace_fingerprint: workspaceFingerprint(projectId, scan.scannedDir),
+		scanned_at: scan.scannedAt,
+		complete: scan.complete,
+		tools: scan.tools.map((tool) => ({
+			kind: tool.kind,
+			signals: tool.signals
+		}))
+	};
+}
+function reportCodebaseScan(store) {
+	const { session } = store;
+	if (session.noTelemetry) return;
+	applyScanTags(session);
+	store.markWarehouseSourcesReportedIfNeeded();
+	if (!mayReportScanResults(session)) return;
+	const { credentials } = session;
+	if (!credentials) return;
+	if (session.codebaseScanReport) return;
+	const scan = getCodebaseScan(session);
+	if (!scan || scan.failed) return;
+	store.shareCodebaseScan(buildScanReport(scan, credentials.projectId));
+}
+//#endregion
 //#region src/programs/detect-map.ts
 const DETECT_CODES = {
 	"bad-directory": ErrorCodes.DetectBadDirectory,
@@ -3094,6 +3250,7 @@ function detectErrorCode(kind) {
 * when it has one, anything else its `onReady`. Marks detection complete.
 */
 async function detectProgram(config, store, runner) {
+	await scanCodebaseFor(config, store.readyContext());
 	const ciPreRun = config.ciPreRun;
 	if (store.session.ci && ciPreRun) await store.edit((draft) => ciPreRun(draft, {
 		...runner,
@@ -3660,9 +3817,10 @@ var SessionStore = class {
 	markWarehouseSourcesReportedIfNeeded() {
 		if (reportWarehouseSourcesDetected(this.session)) this.set("warehouseSourcesReported", true);
 	}
-	setAiSdkStampReported() {
-		if (this.session.aiSdkStampReported) return;
-		this.set("aiSdkStampReported", true);
+	/** Hand the scan to the task stream. First one wins: a run shares one scan. */
+	shareCodebaseScan(report) {
+		if (this.session.codebaseScanReport) return;
+		this.set("codebaseScanReport", report);
 	}
 	setReadinessResult(result) {
 		this.$session.setKey("readinessResult", result);
@@ -4033,15 +4191,7 @@ async function invokeProgram(programId, callerInput, options) {
 				plainSettings = settings;
 			}
 			credentials = await login();
-			if (!store.session.aiSdkStampReported) {
-				store.setAiSdkStampReported();
-				stampAiSdkDetected({
-					apiUser: credentials.apiUser,
-					discoveredFeatures: store.session.discoveredFeatures,
-					warehouseSources: getDetectedWarehouseSources(store.session),
-					mayReportScanResults: mayReportScanResults(store.session)
-				});
-			}
+			reportCodebaseScan(store);
 			if (needsAiApproval(store.session, credentials)) {
 				if (!options.workflow) return fail("AI processing approval is required before this program can run.");
 				if (!await park(options.workflow.confirmStep({
@@ -4114,6 +4264,7 @@ async function invokeProgram(programId, callerInput, options) {
 					agentFlow: planned.config.agentFlow,
 					excludedTaskTypes: planned.config.excludedTaskTypes,
 					seedTasks: planned.config.seedTasks ? () => planned.config.seedTasks(session()) : void 0,
+					projectFacts: void 0,
 					hooks: sessionHooks(agentRun, session, (outcomes) => {
 						if (scoped) scoped.frameworkContext[TASK_OUTCOMES_KEY] = outcomes;
 						else store.setFrameworkContext(TASK_OUTCOMES_KEY, outcomes);
@@ -4529,7 +4680,7 @@ function buildSession(args) {
 		model: args.model,
 		scanConsent: args.ci ? "granted" : "undecided",
 		warehouseSourcesReported: false,
-		aiSdkStampReported: false,
+		codebaseScanReport: null,
 		integration: args.integration ?? null,
 		frameworkContext: {},
 		typescript: false,
@@ -4679,11 +4830,22 @@ var PostHogDestination = class {
 		if (this.disabled) return;
 		const creds = this.getCredentials();
 		if (!creds) return;
-		await this.postWithRetry(creds, toWirePayload(payload));
+		if (await this.postSession(creds, toWirePayload(payload)) === "auth_rejected") this.disabled = true;
+	}
+	async sendScan(payload) {
+		const creds = this.getCredentials();
+		if (!creds) return;
+		await this.postScan(creds, payload);
+	}
+	postSession(creds, body) {
+		return this.postWithRetry(creds, "wizard/sessions", body);
 	}
-	buildRequest(creds, body) {
+	postScan(creds, body) {
+		return this.postWithRetry(creds, "wizard/scans", body);
+	}
+	buildRequest(creds, path, body) {
 		return {
-			url: `${creds.host.apiHost.replace(/\/$/, "")}/api/projects/${creds.projectId}/wizard/sessions/`,
+			url: `${creds.host.apiHost.replace(/\/$/, "")}/api/projects/${creds.projectId}/${path}/`,
 			init: {
 				method: "POST",
 				headers: {
@@ -4694,8 +4856,9 @@ var PostHogDestination = class {
 			}
 		};
 	}
-	async postWithRetry(creds, body) {
-		const { url, init } = this.buildRequest(creds, body);
+	/** POST with the retry policy above. Never throws. */
+	async postWithRetry(creds, path, body) {
+		const { url, init } = this.buildRequest(creds, path, body);
 		let attempt = 0;
 		let backoff = BASE_BACKOFF_MS;
 		let retriedAfter429 = false;
@@ -4707,26 +4870,25 @@ var PostHogDestination = class {
 			} catch (err) {
 				if (attempt >= MAX_ATTEMPTS) {
 					this.onError(err instanceof Error ? err : new Error(String(err)));
-					return;
+					return "gave_up";
 				}
 				await this.sleep(backoff);
 				backoff = Math.min(backoff * 2, MAX_BACKOFF_MS);
 				continue;
 			}
 			if (response.ok) {
-				logToFile(`[task-stream] wizard/sessions push ok: ${response.status}`);
-				return;
+				logToFile(`[task-stream] ${path} push ok: ${response.status}`);
+				return "sent";
 			}
 			const status = response.status;
 			if (status === 401 || status === 403) {
-				this.disabled = true;
-				this.onError(/* @__PURE__ */ new Error(`wizard/sessions auth failed: ${status}`));
-				return;
+				this.onError(/* @__PURE__ */ new Error(`${path} auth failed: ${status}`));
+				return "auth_rejected";
 			}
 			if (status === 429) {
 				if (retriedAfter429) {
-					this.onError(/* @__PURE__ */ new Error("wizard/sessions rate limited"));
-					return;
+					this.onError(/* @__PURE__ */ new Error(`${path} rate limited`));
+					return "gave_up";
 				}
 				retriedAfter429 = true;
 				const wait = parseRetryAfter(response.headers.get("Retry-After"));
@@ -4736,8 +4898,8 @@ var PostHogDestination = class {
 			}
 			if (status >= 500) {
 				if (attempt >= MAX_ATTEMPTS) {
-					this.onError(/* @__PURE__ */ new Error(`wizard/sessions server error: ${status}`));
-					return;
+					this.onError(/* @__PURE__ */ new Error(`${path} server error: ${status}`));
+					return "gave_up";
 				}
 				await this.sleep(backoff);
 				backoff = Math.min(backoff * 2, MAX_BACKOFF_MS);
@@ -4748,12 +4910,13 @@ var PostHogDestination = class {
 				try {
 					detail = await response.text();
 				} catch {}
-				this.onError(/* @__PURE__ */ new Error(`wizard/sessions bad request (400): ${detail}`));
-				return;
+				this.onError(/* @__PURE__ */ new Error(`${path} bad request (400): ${detail}`));
+				return "gave_up";
 			}
-			this.onError(/* @__PURE__ */ new Error(`wizard/sessions unexpected status: ${status}`));
-			return;
+			this.onError(/* @__PURE__ */ new Error(`${path} unexpected status: ${status}`));
+			return "gave_up";
 		}
+		return "gave_up";
 	}
 };
 //#endregion
@@ -4877,7 +5040,7 @@ var WizardRunSync = class {
 				type: "local_folder",
 				project_name: projectName
 			},
-			...valid("2.82.0") ? { wizard_version: VERSION } : {},
+			...valid("2.84.0") ? { wizard_version: VERSION } : {},
 			idempotency_key: randomUUID()
 		});
 		const result = await this.request("POST", "", body, this.tasksAbort.signal);
@@ -5202,6 +5365,8 @@ var TaskStreamPush = class {
 	unsubscribe = null;
 	debounceTimer = null;
 	inFlight = null;
+	/** The scan send, once the user agreed to share. Shutdown waits for it. */
+	scanInFlight = null;
 	needsAnotherPush = false;
 	shuttingDown = false;
 	constructor(opts) {
@@ -5230,6 +5395,7 @@ var TaskStreamPush = class {
 		if (this.unsubscribe) return;
 		const target = store ?? this.store;
 		this.unsubscribe = target.subscribe(() => this.onStoreChange());
+		this.sendScanIfShared();
 	}
 	/** Stop subscribing. Does not flush. */
 	detach() {
@@ -5260,8 +5426,8 @@ var TaskStreamPush = class {
 		this.detach();
 		if (!this.enabled) return;
 		const phase = this.store.session.runPhase;
-		if (!(phase === "completed" || phase === "error")) return;
-		const flush = this.flush();
+		const isTerminal = phase === "completed" || phase === "error";
+		const flush = Promise.all([isTerminal ? this.flush() : void 0, this.scanInFlight]);
 		if (timeoutMs <= 0) return;
 		let timer;
 		try {
@@ -5281,6 +5447,7 @@ var TaskStreamPush = class {
 	}
 	onStoreChange() {
 		if (!this.enabled || this.shuttingDown) return;
+		this.sendScanIfShared();
 		const phase = this.store.session.runPhase;
 		if (phase === "idle") return;
 		this.selectRemoteSync();
@@ -5366,6 +5533,20 @@ var TaskStreamPush = class {
 		this.lastPushedQuestionId = payload.pending_input?.id ?? null;
 		await Promise.all(this.destinations.filter((d) => d.name !== "posthog" || this.remoteSync === "wizard-session").map((d) => d.send(event, payload).catch(() => {})));
 	}
+	/**
+	* Attach the shared scan to this session, once. It carries the stream's
+	* `session_id`, so PostHog can join the scan to the session row.
+	*/
+	sendScanIfShared() {
+		if (this.scanInFlight) return;
+		const report = this.store.session.codebaseScanReport;
+		if (!report) return;
+		const payload = {
+			...report,
+			session_id: this.sessionId
+		};
+		this.scanInFlight = Promise.all(this.destinations.map((d) => d.sendScan?.(payload).catch(() => {}))).then(() => void 0);
+	}
 	selectRemoteSync() {
 		if (this.remoteSync || !this.store.session.credentials) return;
 		if (this.store.session.runPhase === "idle") return;
@@ -5402,6 +5583,6 @@ function apiKeyCredentials(apiKey, options = {}) {
 	}) };
 }
 //#endregion
-export { config$7 as $, getProvisioningScopesForProgram as A, SOURCE_MAPS_CONTEXT_KEYS as B, oauthErrorFromTokenBody as C, getCommandPath as D, findProgramConfig as E, detectErrorTrackingProjects as F, detectSelfDrivingIntegrationProjects as G, NO_DEFAULT_LIMIT as H, config$2 as I, POSTHOG_PRESENT_KEY as J, GITHUB_REQUIRED_BODY as K, detectSourceMapsProjects as L, config as M, config$1 as N, getOAuthScopesForProgram as O, ERROR_TRACKING_PROJECT_PATH_KEY as P, config$6 as Q, DISPLAY_NAME as R, oauthErrorFromCallbackParams as S, Program as T, PRICING_LONG as U, config$3 as V, PRICING_SHORT as W, config$4 as X, SELF_DRIVING_INTEGRATE_PATH_KEY as Y, config$5 as Z, missingOAuthScopes as _, headlessOption as _t, PostHogDestination as a, evaluateWizardReadiness as at, buildCallbackErrorHtml as b, buildSession as c, config$10 as ct, SessionStore as d, createSkillProgram as dt, CONNECT_SLACK_SCOPE_ADDITIONS as et, applyAgentProgress as f, CLI_STEERING_TARGETS as ft, getOAuthClientId as g, installSteeringSnippet as gt, OAuthTokenResponseSchema as h, installOrUpdatePostHogCli as ht, createWizardRunSync as i, SIGNUP_WIZARD_READINESS_CONFIG as it, getSubcommandPrograms as j, getProgramConfig as k, TASK_OUTCOMES_KEY as l, config$11 as lt, logIn as m, findTarget as mt, resolveApiKeyLogin as n, getAuditChecks as nt, createFileDestination as o, getBlockingServiceKeys as ot, TaskStatus as p, detectTargets as pt, GITHUB_REQUIRED_MESSAGE as q, TaskStreamPush as r, SERVICE_LABELS as rt, storeInteraction as s, config$9 as st, apiKeyCredentials as t, withScopeAdditions as tt, runProgram as u, config$12 as ut, parseOAuthScopes as v, isHeadless as vt, PROGRAM_REGISTRY as w, buildOAuthFailureMessage as x, OAuthError as y, regionOption as yt, MANUAL_SDK_VARIANTS as z };
+export { SELF_DRIVING_INTEGRATE_PATH_KEY as $, getProgramConfig as A, config$3 as B, oauthErrorFromTokenBody as C, regionOption as Ct, findProgramConfig as D, Program as E, FEATURE_FLAGS_UNSUPPORTED as F, config$4 as G, DISPLAY_NAME as H, config$1 as I, PRICING_SHORT as J, NO_DEFAULT_LIMIT as K, config$2 as L, getSubcommandPrograms as M, config as N, getCommandPath as O, FEATURE_FLAGS_STEP_SKILL_ID as P, POSTHOG_PRESENT_KEY as Q, ERROR_TRACKING_PROJECT_PATH_KEY as R, oauthErrorFromCallbackParams as S, isHeadless as St, PROGRAM_REGISTRY as T, MANUAL_SDK_VARIANTS as U, detectSourceMapsProjects as V, SOURCE_MAPS_CONTEXT_KEYS as W, GITHUB_REQUIRED_BODY as X, detectSelfDrivingIntegrationProjects as Y, GITHUB_REQUIRED_MESSAGE as Z, missingOAuthScopes as _, detectTargets as _t, PostHogDestination as a, withScopeAdditions as at, buildCallbackErrorHtml as b, installSteeringSnippet as bt, buildSession as c, SIGNUP_WIZARD_READINESS_CONFIG as ct, SessionStore as d, config$10 as dt, config$5 as et, applyAgentProgress as f, config$11 as ft, getOAuthClientId as g, CLI_STEERING_TARGETS as gt, OAuthTokenResponseSchema as h, createSkillProgram as ht, createWizardRunSync as i, CONNECT_SLACK_SCOPE_ADDITIONS as it, getProvisioningScopesForProgram as j, getOAuthScopesForProgram as k, TASK_OUTCOMES_KEY as l, evaluateWizardReadiness as lt, logIn as m, config$13 as mt, resolveApiKeyLogin as n, config$7 as nt, createFileDestination as o, getAuditChecks as ot, TaskStatus as p, config$12 as pt, PRICING_LONG as q, TaskStreamPush as r, config$8 as rt, storeInteraction as s, SERVICE_LABELS as st, apiKeyCredentials as t, config$6 as tt, runProgram as u, getBlockingServiceKeys as ut, parseOAuthScopes as v, findTarget as vt, reportCodebaseScan as w, buildOAuthFailureMessage as x, headlessOption as xt, OAuthError as y, installOrUpdatePostHogCli as yt, detectErrorTrackingProjects as z };
 
-//# sourceMappingURL=programs-Bq9Ju9xk.js.map
+//# sourceMappingURL=programs-mxhRXwP-.js.map