@posthog/wizard 2.82.0 → 2.84.0

package/dist/models-B0huHItG.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"models-B0huHItG.js","names":[],"sources":["../src/agent/runner/switchboard/models.ts"],"sourcesContent":["// Local capabilities inform transport parameters; gateway policy independently admits models and efforts.\nimport {\n  SONNET_5_MODEL,\n  HAIKU_MODEL,\n  GPT5_6_LUNA_MODEL,\n  GPT5_6_SOL_MODEL,\n  GPT5_6_TERRA_MODEL,\n  GPT6_SOL_MODEL,\n  HAIKU_TRIAGE_MODEL,\n  Harness,\n} from '@shared/constants';\n\n/** Reasoning effort, mapped by each harness to its provider transport. */\nconst THINKING_LEVELS = [\n  'off',\n  'minimal',\n  'low',\n  'medium',\n  'high',\n  'xhigh',\n] as const;\nexport type ThinkingLevel = (typeof THINKING_LEVELS)[number];\n\n/** Whether a value (e.g. remote prompt frontmatter) names a valid effort. */\nexport function isThinkingLevel(value: unknown): value is ThinkingLevel {\n  return (THINKING_LEVELS as readonly unknown[]).includes(value);\n}\n\n/**\n * An effort *override* is always a positive level — `'off'` is a model trait\n * (`reasoning: false`), not something a flag may force onto a reasoning model.\n */\nexport type EffortLevel = Exclude<ThinkingLevel, 'off'>;\n\nexport interface ModelCapabilities {\n  /** Model supports reasoning; safe to request reasoning effort. */\n  reasoning: boolean;\n  /** Effort to request when reasoning. Omit for the harness/provider default. */\n  thinkingLevel?: ThinkingLevel;\n}\n\n/**\n * Explicit per-model traits. Anything absent falls back to `defaultCaps`.\n *\n * A reasoning model without a `thinkingLevel` leaves the effort to the harness,\n * and the mint pins effort per model (posthog `WIZARD_MODEL_ALLOWLIST`), so an\n * unpinned reasoning model is refused with no tool calls. Every level below is\n * one the mint allows for that model.\n */\nexport const MODEL_CAPABILITIES: Record<string, ModelCapabilities> = {\n  // The mint takes sonnet 5 at `none` or `high`; high is the only level it\n  // serves once reasoning is on.\n  [SONNET_5_MODEL]: { reasoning: true, thinkingLevel: 'high' },\n  // The mint takes haiku with no effort parameter at all, which is `off`.\n  [HAIKU_MODEL]: { reasoning: true, thinkingLevel: 'off' },\n  // The openai 5.6 line; all reasoning models, so they must opt in past the\n  // openai-completions default (reasoning off). Luna stays low for cheap,\n  // short-context mechanical work; terra runs medium as the sonnet-tier parallel\n  // — enough reasoning depth for the judgment tasks without high's latency blowup.\n  [GPT5_6_LUNA_MODEL]: { reasoning: true, thinkingLevel: 'low' },\n  [GPT5_6_TERRA_MODEL]: { reasoning: true, thinkingLevel: 'medium' },\n  [GPT5_6_SOL_MODEL]: { reasoning: true, thinkingLevel: 'medium' },\n  [GPT6_SOL_MODEL]: { reasoning: true, thinkingLevel: 'medium' },\n};\n\n/**\n * The mint's per-model effort pin, mirrored from posthog\n * `WIZARD_MODEL_ALLOWLIST`. `'off'` is the CLI's spelling of the mint's\n * `\"none\"` — a call carrying no effort parameter.\n */\nexport const MINT_ALLOWED_EFFORTS: Record<string, readonly ThinkingLevel[]> = {\n  [SONNET_5_MODEL]: ['off', 'high'],\n  [HAIKU_MODEL]: ['off'],\n  [GPT5_6_LUNA_MODEL]: ['low'],\n  [GPT5_6_SOL_MODEL]: ['medium'],\n  [GPT5_6_TERRA_MODEL]: ['low', 'medium', 'high'],\n  [GPT6_SOL_MODEL]: ['low', 'medium', 'high'],\n};\n\n// Local model choices; gateway admission also requires allowed models, efforts, and prompt compatibility.\nexport const VALID_MODELS: ReadonlySet<string> = new Set(\n  Object.keys(MODEL_CAPABILITIES),\n);\n\n/** Whether the value is an allow-listed model. */\nexport function isValidModel(model: unknown): model is string {\n  return typeof model === 'string' && VALID_MODELS.has(model);\n}\n\n/** First allow-listed candidate, else throw so a bad id fails loud. */\nexport function requireKnownModel(\n  ...candidates: (string | undefined)[]\n): string {\n  for (const c of candidates) if (isValidModel(c)) return c;\n  throw new Error(\n    `No valid model to dispatch on (tried ${JSON.stringify(candidates)}). ` +\n      `Allowed: ${[...VALID_MODELS].join(', ')}.`,\n  );\n}\n\n// Unknown Anthropic models default to reasoning; OpenAI models must opt in through the local table.\nfunction defaultCaps(modelId: string): ModelCapabilities {\n  return { reasoning: !modelId.startsWith('openai/') };\n}\n\n// Triage requests must satisfy gateway safety policy and preserve Warlock’s classifier format.\nexport const TRIAGE_MODELS: Record<Harness, string> = {\n  [Harness.anthropic]: HAIKU_TRIAGE_MODEL,\n  [Harness.pi]: GPT5_6_LUNA_MODEL,\n};\n\nexport function triageModelFor(harness: Harness): string {\n  return TRIAGE_MODELS[harness];\n}\n\n/**\n * Capabilities for a gateway model id, table override then transport default.\n * `effortOverride` is a switchboard-resolved effort (e.g. from a pi effort\n * flag); it applies only when the model reasons at all — a non-reasoning model\n * rejects reasoning effort, so the override is dropped.\n */\nexport function modelCapabilities(\n  modelId: string,\n  effortOverride?: EffortLevel,\n): ModelCapabilities {\n  const caps = MODEL_CAPABILITIES[modelId] ?? defaultCaps(modelId);\n  if (caps.reasoning && effortOverride) {\n    return { ...caps, thinkingLevel: effortOverride };\n  }\n  return caps;\n}\n"],"mappings":";;;AAaA,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;CACD;;AAID,SAAgB,gBAAgB,OAAwC;AACtE,QAAQ,gBAAuC,SAAS,MAAM;;;;;;;;;;AAwBhE,MAAa,qBAAwD;EAGlE,iBAAiB;EAAE,WAAW;EAAM,eAAe;EAAQ;EAE3D,cAAc;EAAE,WAAW;EAAM,eAAe;EAAO;EAKvD,oBAAoB;EAAE,WAAW;EAAM,eAAe;EAAO;EAC7D,qBAAqB;EAAE,WAAW;EAAM,eAAe;EAAU;EACjE,mBAAmB;EAAE,WAAW;EAAM,eAAe;EAAU;EAC/D,iBAAiB;EAAE,WAAW;EAAM,eAAe;EAAU;CAC/D;AAiBD,MAAa,eAAoC,IAAI,IACnD,OAAO,KAAK,mBAAmB,CAChC;;AAGD,SAAgB,aAAa,OAAiC;AAC5D,QAAO,OAAO,UAAU,YAAY,aAAa,IAAI,MAAM;;;AAI7D,SAAgB,kBACd,GAAG,YACK;AACR,MAAK,MAAM,KAAK,WAAY,KAAI,aAAa,EAAE,CAAE,QAAO;AACxD,OAAM,IAAI,MACR,wCAAwC,KAAK,UAAU,WAAW,CAAC,cACrD,CAAC,GAAG,aAAa,CAAC,KAAK,KAAK,CAAC,GAC5C;;AAIH,SAAS,YAAY,SAAoC;AACvD,QAAO,EAAE,WAAW,CAAC,QAAQ,WAAW,UAAU,EAAE;;AAItD,MAAa,gBAAyC;gBAC/B;SACP;CACf;AAED,SAAgB,eAAe,SAA0B;AACvD,QAAO,cAAc;;;;;;;;AASvB,SAAgB,kBACd,SACA,gBACmB;CACnB,MAAM,OAAO,mBAAmB,YAAY,YAAY,QAAQ;AAChE,KAAI,KAAK,aAAa,eACpB,QAAO;EAAE,GAAG;EAAM,eAAe;EAAgB;AAEnD,QAAO"}

package/dist/{non-interactive-DkldwWDM.js → non-interactive-DiEu4_6l.js}

@@ -1,6 +1,6 @@
 import { n as ErrorCodes, t as emitWizardError } from "./emit-BqLCdV8Y.js";
-import "./errors-DhFeR8Sp.js";
-import { t as consoleLog } from "./console-log-DJiTqYT2.js";
+import "./errors-BXlWujEw.js";
+import { t as consoleLog } from "./console-log-BMhBoX-o.js";
 //#region src/cli/commands/basic-integration/non-interactive.ts
 /** Print the "needs a TTY" error and exit. Used when no `--ci` flag and no TTY. */
 function failNonInteractive() {
@@ -15,4 +15,4 @@ function failNonInteractive() {
 //#endregion
 export { failNonInteractive };
 
-//# sourceMappingURL=non-interactive-DkldwWDM.js.map
+//# sourceMappingURL=non-interactive-DiEu4_6l.js.map

package/dist/{non-interactive-DkldwWDM.js.map → non-interactive-DiEu4_6l.js.map}

@@ -1 +1 @@
-{"version":3,"file":"non-interactive-DkldwWDM.js","names":[],"sources":["../src/cli/commands/basic-integration/non-interactive.ts"],"sourcesContent":["import { consoleLog } from '@shared/console-log';\nimport { ErrorCodes } from '@shared/errors';\nimport { emitWizardError } from '@shared/errors';\n\n/** Print the \"needs a TTY\" error and exit. Used when no `--ci` flag and no TTY. */\nexport function failNonInteractive(): void {\n  consoleLog.intro('PostHog Wizard');\n  consoleLog.log.error(\n    'This installer requires an interactive terminal (TTY) to run.\\n' +\n      'It appears you are running in a non-interactive environment.\\n' +\n      'Please run the wizard in an interactive terminal.\\n\\n' +\n      'For CI/CD environments, use --ci mode:\\n' +\n      '  npx @posthog/wizard --ci --region us --api-key phx_xxx',\n  );\n  emitWizardError({\n    code: ErrorCodes.CliInteractiveRequired,\n    message: 'This installer requires an interactive terminal (TTY) to run.',\n  });\n  process.exit(1);\n}\n"],"mappings":";;;;;AAKA,SAAgB,qBAA2B;AACzC,YAAW,MAAM,iBAAiB;AAClC,YAAW,IAAI,MACb,qRAKD;AACD,iBAAgB;EACd,MAAM,WAAW;EACjB,SAAS;EACV,CAAC;AACF,SAAQ,KAAK,EAAE"}
+{"version":3,"file":"non-interactive-DiEu4_6l.js","names":[],"sources":["../src/cli/commands/basic-integration/non-interactive.ts"],"sourcesContent":["import { consoleLog } from '@shared/console-log';\nimport { ErrorCodes } from '@shared/errors';\nimport { emitWizardError } from '@shared/errors';\n\n/** Print the \"needs a TTY\" error and exit. Used when no `--ci` flag and no TTY. */\nexport function failNonInteractive(): void {\n  consoleLog.intro('PostHog Wizard');\n  consoleLog.log.error(\n    'This installer requires an interactive terminal (TTY) to run.\\n' +\n      'It appears you are running in a non-interactive environment.\\n' +\n      'Please run the wizard in an interactive terminal.\\n\\n' +\n      'For CI/CD environments, use --ci mode:\\n' +\n      '  npx @posthog/wizard --ci --region us --api-key phx_xxx',\n  );\n  emitWizardError({\n    code: ErrorCodes.CliInteractiveRequired,\n    message: 'This installer requires an interactive terminal (TTY) to run.',\n  });\n  process.exit(1);\n}\n"],"mappings":";;;;;AAKA,SAAgB,qBAA2B;AACzC,YAAW,MAAM,iBAAiB;AAClC,YAAW,IAAI,MACb,qRAKD;AACD,iBAAgB;EACd,MAAM,WAAW;EACjB,SAAS;EACV,CAAC;AACF,SAAQ,KAAK,EAAE"}

package/dist/{oauth-session-Bi1MLRCC.js → oauth-session-9EU3ky0v.js}

@@ -1,4 +1,4 @@
-import { o as logToFile } from "./debug-BvEbemym.js";
+import { o as logToFile } from "./debug-BfO_Txo8.js";
 //#region src/shared/auth-session-state.ts
 /**
 * Whether this run's OAuth grant is known to be dead.
@@ -113,4 +113,4 @@ async function refresh(rotateWith, credentials) {
 //#endregion
 export { oauthLoginKey as a, isGrantRevoked as c, oauthCredentials as i, markGrantRevoked as l, currentAccessToken as n, onAccessTokenRotated as o, currentCredentials as r, rotateAfterUnauthorized as s, configureOAuthSession as t };
 
-//# sourceMappingURL=oauth-session-Bi1MLRCC.js.map
+//# sourceMappingURL=oauth-session-9EU3ky0v.js.map

package/dist/{oauth-session-Bi1MLRCC.js.map → oauth-session-9EU3ky0v.js.map}

@@ -1 +1 @@
-{"version":3,"file":"oauth-session-Bi1MLRCC.js","names":[],"sources":["../src/shared/auth-session-state.ts","../src/shared/oauth-session.ts"],"sourcesContent":["/**\n * Whether this run's OAuth grant is known to be dead.\n *\n * Process-global on purpose. A run has exactly one login, but the two sides of\n * this fact are far apart: the pre-run refresh learns it in `authenticate.ts`,\n * and the only consumer is the 401 handler inside the agent message loop, which\n * holds no session. Threading it would mean a field on `AgentConfig` set at four\n * `initializeAgent` call sites — and the session it would read from may be a\n * shallow copy (`prepareRunSession`), so the value could be written to one\n * object and read from another.\n *\n * A leaf module with no imports, so either side can depend on it without a cycle.\n */\n\nlet grantRevoked = false;\n\n/**\n * Record that the token endpoint permanently refused this grant. Not an abort:\n * the access token in hand may still have minutes of life, so the run continues\n * and this only decides what a later 401 gets blamed on.\n */\nexport function markGrantRevoked(): void {\n  grantRevoked = true;\n}\n\n/** True once a token refresh failed because the grant itself is gone. */\nexport function isGrantRevoked(): boolean {\n  return grantRevoked;\n}\n\n/** Test hook, mirroring `resetGatewaySession`. */\nexport function resetAuthSessionState(): void {\n  grantRevoked = false;\n}\n","// The run's one OAuth token, shaped like gateway-session. The host supplies the rotation.\n\nimport type { Credentials } from '@shared/api';\nimport { isGrantRevoked } from '@shared/auth-session-state';\nimport { logToFile } from '@utils/debug';\n\n// Below this remaining lifetime a run risks outliving its token; just-minted and 7-day tokens skip.\nconst REFRESH_WHEN_REMAINING_MS = 50 * 60 * 1000;\n\n/** Returns the rotated credentials, or the same object when the rotation failed. Never throws. */\nexport type RotateCredentials = (\n  credentials: Credentials,\n) => Promise<Credentials>;\n\nlet current: Credentials | null = null;\nlet rotate: RotateCredentials | undefined;\nlet onRefreshed: ((credentials: Credentials) => void) | undefined;\n// Shared so concurrent callers rotate once: a second rotation would spend the refresh token the first replaced.\nlet inFlight: Promise<Credentials> | null = null;\nconst listeners = new Set<(accessToken: string) => void>();\n// Every access token this login has held; the first one names the login.\nlet lineage = new Set<string>();\nlet lineageRoot: string | undefined;\n\n/** Adopt the run's credentials; a stale copy of the held login gets the newer one back through `onRefreshed`. */\nexport function configureOAuthSession(\n  credentials: Credentials,\n  options: {\n    rotate: RotateCredentials;\n    onRefreshed?: (credentials: Credentials) => void;\n  },\n): void {\n  rotate = options.rotate;\n  onRefreshed = options.onRefreshed;\n  if (\n    current &&\n    sameLogin(current, credentials) &&\n    (current.expiresAt ?? 0) > (credentials.expiresAt ?? 0)\n  ) {\n    onRefreshed?.(current);\n    return;\n  }\n  if (!current || !sameLogin(current, credentials)) {\n    lineage = new Set();\n    lineageRoot = credentials.accessToken;\n  }\n  lineage.add(credentials.accessToken);\n  current = credentials;\n}\n\n/** What a caller does after a 401: retry with `credentials`, or stop for the stated reason. */\nexport type UnauthorizedRecovery =\n  | { kind: 'rotated'; credentials: Credentials }\n  | { kind: 'refused' }\n  | { kind: 'unchanged' };\n\n/**\n * Rotate the token after a 401 so the caller can retry once. `refused`: the\n * grant is revoked, or `requireRefreshToken` is set and none is held, so no\n * rotation was tried. `unchanged`: the rotation failed and the token is the\n * same, so a retry would 401 again.\n */\nexport async function rotateAfterUnauthorized(\n  credentials: Credentials,\n  options: { requireRefreshToken: boolean },\n): Promise<UnauthorizedRecovery> {\n  if (\n    (options.requireRefreshToken && !credentials.refreshToken) ||\n    isGrantRevoked()\n  ) {\n    return { kind: 'refused' };\n  }\n  const rotated = await currentCredentials(credentials, true);\n  return rotated.accessToken === credentials.accessToken\n    ? { kind: 'unchanged' }\n    : { kind: 'rotated', credentials: rotated };\n}\n\n/** A key that stays the same across this login's rotations, so caches keyed on it survive one. */\nexport function oauthLoginKey(accessToken: string): string {\n  return lineageRoot && lineage.has(accessToken) ? lineageRoot : accessToken;\n}\n\n/** The current credentials, refreshed first when near expiry or when `force` is set. */\nexport async function oauthCredentials(\n  force = false,\n): Promise<Credentials | null> {\n  if (!current) return null;\n  if (!rotate || !current.refreshToken || (!force && !nearExpiry(current)))\n    return current;\n  inFlight ??= refresh(rotate, current).finally(() => {\n    inFlight = null;\n  });\n  return inFlight;\n}\n\n/** The credentials to use now for this login, or the fallback when another login is held. */\nexport async function currentCredentials(\n  fallback: Credentials,\n  force = false,\n): Promise<Credentials> {\n  if (!current || !sameLogin(current, fallback)) return fallback;\n  return (await oauthCredentials(force)) ?? fallback;\n}\n\n/** The access token to use now for this login. */\nexport async function currentAccessToken(\n  fallback: Credentials,\n): Promise<string> {\n  return (await currentCredentials(fallback)).accessToken;\n}\n\n/** Called with each new access token after a rotation. Returns the unsubscribe. */\nexport function onAccessTokenRotated(\n  listener: (accessToken: string) => void,\n): () => void {\n  listeners.add(listener);\n  return () => {\n    listeners.delete(listener);\n  };\n}\n\n/** Test hook: drop the held credentials so the next run configures afresh. */\nexport function resetOAuthSession(): void {\n  current = null;\n  rotate = undefined;\n  onRefreshed = undefined;\n  inFlight = null;\n  listeners.clear();\n  lineage = new Set();\n  lineageRoot = undefined;\n}\n\nfunction sameLogin(a: Credentials, b: Credentials): boolean {\n  return a.host.apiHost === b.host.apiHost && a.projectId === b.projectId;\n}\n\nfunction nearExpiry(credentials: Credentials): boolean {\n  // No expiry means we cannot tell how much life is left, so leave it alone.\n  return (\n    credentials.expiresAt !== undefined &&\n    credentials.expiresAt - Date.now() < REFRESH_WHEN_REMAINING_MS\n  );\n}\n\nasync function refresh(\n  rotateWith: RotateCredentials,\n  credentials: Credentials,\n): Promise<Credentials> {\n  const refreshed = await rotateWith(credentials);\n  if (refreshed === credentials) return credentials;\n  logToFile('[oauth-session] token rotated');\n  lineage.add(refreshed.accessToken);\n  current = refreshed;\n  onRefreshed?.(refreshed);\n  for (const listener of listeners) listener(refreshed.accessToken);\n  return refreshed;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAcA,IAAI,eAAe;;;;;;AAOnB,SAAgB,mBAAyB;AACvC,gBAAe;;;AAIjB,SAAgB,iBAA0B;AACxC,QAAO;;;;ACpBT,MAAM,4BAA4B,MAAU;AAO5C,IAAI,UAA8B;AAClC,IAAI;AACJ,IAAI;AAEJ,IAAI,WAAwC;AAC5C,MAAM,4BAAY,IAAI,KAAoC;AAE1D,IAAI,0BAAU,IAAI,KAAa;AAC/B,IAAI;;AAGJ,SAAgB,sBACd,aACA,SAIM;AACN,UAAS,QAAQ;AACjB,eAAc,QAAQ;AACtB,KACE,WACA,UAAU,SAAS,YAAY,KAC9B,QAAQ,aAAa,MAAM,YAAY,aAAa,IACrD;AACA,gBAAc,QAAQ;AACtB;;AAEF,KAAI,CAAC,WAAW,CAAC,UAAU,SAAS,YAAY,EAAE;AAChD,4BAAU,IAAI,KAAK;AACnB,gBAAc,YAAY;;AAE5B,SAAQ,IAAI,YAAY,YAAY;AACpC,WAAU;;;;;;;;AAeZ,eAAsB,wBACpB,aACA,SAC+B;AAC/B,KACG,QAAQ,uBAAuB,CAAC,YAAY,gBAC7C,gBAAgB,CAEhB,QAAO,EAAE,MAAM,WAAW;CAE5B,MAAM,UAAU,MAAM,mBAAmB,aAAa,KAAK;AAC3D,QAAO,QAAQ,gBAAgB,YAAY,cACvC,EAAE,MAAM,aAAa,GACrB;EAAE,MAAM;EAAW,aAAa;EAAS;;;AAI/C,SAAgB,cAAc,aAA6B;AACzD,QAAO,eAAe,QAAQ,IAAI,YAAY,GAAG,cAAc;;;AAIjE,eAAsB,iBACpB,QAAQ,OACqB;AAC7B,KAAI,CAAC,QAAS,QAAO;AACrB,KAAI,CAAC,UAAU,CAAC,QAAQ,gBAAiB,CAAC,SAAS,CAAC,WAAW,QAAQ,CACrE,QAAO;AACT,cAAa,QAAQ,QAAQ,QAAQ,CAAC,cAAc;AAClD,aAAW;GACX;AACF,QAAO;;;AAIT,eAAsB,mBACpB,UACA,QAAQ,OACc;AACtB,KAAI,CAAC,WAAW,CAAC,UAAU,SAAS,SAAS,CAAE,QAAO;AACtD,QAAQ,MAAM,iBAAiB,MAAM,IAAK;;;AAI5C,eAAsB,mBACpB,UACiB;AACjB,SAAQ,MAAM,mBAAmB,SAAS,EAAE;;;AAI9C,SAAgB,qBACd,UACY;AACZ,WAAU,IAAI,SAAS;AACvB,cAAa;AACX,YAAU,OAAO,SAAS;;;AAe9B,SAAS,UAAU,GAAgB,GAAyB;AAC1D,QAAO,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,cAAc,EAAE;;AAGhE,SAAS,WAAW,aAAmC;AAErD,QACE,YAAY,cAAc,KAAA,KAC1B,YAAY,YAAY,KAAK,KAAK,GAAG;;AAIzC,eAAe,QACb,YACA,aACsB;CACtB,MAAM,YAAY,MAAM,WAAW,YAAY;AAC/C,KAAI,cAAc,YAAa,QAAO;AACtC,WAAU,gCAAgC;AAC1C,SAAQ,IAAI,UAAU,YAAY;AAClC,WAAU;AACV,eAAc,UAAU;AACxB,MAAK,MAAM,YAAY,UAAW,UAAS,UAAU,YAAY;AACjE,QAAO"}
+{"version":3,"file":"oauth-session-9EU3ky0v.js","names":[],"sources":["../src/shared/auth-session-state.ts","../src/shared/oauth-session.ts"],"sourcesContent":["/**\n * Whether this run's OAuth grant is known to be dead.\n *\n * Process-global on purpose. A run has exactly one login, but the two sides of\n * this fact are far apart: the pre-run refresh learns it in `authenticate.ts`,\n * and the only consumer is the 401 handler inside the agent message loop, which\n * holds no session. Threading it would mean a field on `AgentConfig` set at four\n * `initializeAgent` call sites — and the session it would read from may be a\n * shallow copy (`prepareRunSession`), so the value could be written to one\n * object and read from another.\n *\n * A leaf module with no imports, so either side can depend on it without a cycle.\n */\n\nlet grantRevoked = false;\n\n/**\n * Record that the token endpoint permanently refused this grant. Not an abort:\n * the access token in hand may still have minutes of life, so the run continues\n * and this only decides what a later 401 gets blamed on.\n */\nexport function markGrantRevoked(): void {\n  grantRevoked = true;\n}\n\n/** True once a token refresh failed because the grant itself is gone. */\nexport function isGrantRevoked(): boolean {\n  return grantRevoked;\n}\n\n/** Test hook, mirroring `resetGatewaySession`. */\nexport function resetAuthSessionState(): void {\n  grantRevoked = false;\n}\n","// The run's one OAuth token, shaped like gateway-session. The host supplies the rotation.\n\nimport type { Credentials } from '@shared/api';\nimport { isGrantRevoked } from '@shared/auth-session-state';\nimport { logToFile } from '@utils/debug';\n\n// Below this remaining lifetime a run risks outliving its token; just-minted and 7-day tokens skip.\nconst REFRESH_WHEN_REMAINING_MS = 50 * 60 * 1000;\n\n/** Returns the rotated credentials, or the same object when the rotation failed. Never throws. */\nexport type RotateCredentials = (\n  credentials: Credentials,\n) => Promise<Credentials>;\n\nlet current: Credentials | null = null;\nlet rotate: RotateCredentials | undefined;\nlet onRefreshed: ((credentials: Credentials) => void) | undefined;\n// Shared so concurrent callers rotate once: a second rotation would spend the refresh token the first replaced.\nlet inFlight: Promise<Credentials> | null = null;\nconst listeners = new Set<(accessToken: string) => void>();\n// Every access token this login has held; the first one names the login.\nlet lineage = new Set<string>();\nlet lineageRoot: string | undefined;\n\n/** Adopt the run's credentials; a stale copy of the held login gets the newer one back through `onRefreshed`. */\nexport function configureOAuthSession(\n  credentials: Credentials,\n  options: {\n    rotate: RotateCredentials;\n    onRefreshed?: (credentials: Credentials) => void;\n  },\n): void {\n  rotate = options.rotate;\n  onRefreshed = options.onRefreshed;\n  if (\n    current &&\n    sameLogin(current, credentials) &&\n    (current.expiresAt ?? 0) > (credentials.expiresAt ?? 0)\n  ) {\n    onRefreshed?.(current);\n    return;\n  }\n  if (!current || !sameLogin(current, credentials)) {\n    lineage = new Set();\n    lineageRoot = credentials.accessToken;\n  }\n  lineage.add(credentials.accessToken);\n  current = credentials;\n}\n\n/** What a caller does after a 401: retry with `credentials`, or stop for the stated reason. */\nexport type UnauthorizedRecovery =\n  | { kind: 'rotated'; credentials: Credentials }\n  | { kind: 'refused' }\n  | { kind: 'unchanged' };\n\n/**\n * Rotate the token after a 401 so the caller can retry once. `refused`: the\n * grant is revoked, or `requireRefreshToken` is set and none is held, so no\n * rotation was tried. `unchanged`: the rotation failed and the token is the\n * same, so a retry would 401 again.\n */\nexport async function rotateAfterUnauthorized(\n  credentials: Credentials,\n  options: { requireRefreshToken: boolean },\n): Promise<UnauthorizedRecovery> {\n  if (\n    (options.requireRefreshToken && !credentials.refreshToken) ||\n    isGrantRevoked()\n  ) {\n    return { kind: 'refused' };\n  }\n  const rotated = await currentCredentials(credentials, true);\n  return rotated.accessToken === credentials.accessToken\n    ? { kind: 'unchanged' }\n    : { kind: 'rotated', credentials: rotated };\n}\n\n/** A key that stays the same across this login's rotations, so caches keyed on it survive one. */\nexport function oauthLoginKey(accessToken: string): string {\n  return lineageRoot && lineage.has(accessToken) ? lineageRoot : accessToken;\n}\n\n/** The current credentials, refreshed first when near expiry or when `force` is set. */\nexport async function oauthCredentials(\n  force = false,\n): Promise<Credentials | null> {\n  if (!current) return null;\n  if (!rotate || !current.refreshToken || (!force && !nearExpiry(current)))\n    return current;\n  inFlight ??= refresh(rotate, current).finally(() => {\n    inFlight = null;\n  });\n  return inFlight;\n}\n\n/** The credentials to use now for this login, or the fallback when another login is held. */\nexport async function currentCredentials(\n  fallback: Credentials,\n  force = false,\n): Promise<Credentials> {\n  if (!current || !sameLogin(current, fallback)) return fallback;\n  return (await oauthCredentials(force)) ?? fallback;\n}\n\n/** The access token to use now for this login. */\nexport async function currentAccessToken(\n  fallback: Credentials,\n): Promise<string> {\n  return (await currentCredentials(fallback)).accessToken;\n}\n\n/** Called with each new access token after a rotation. Returns the unsubscribe. */\nexport function onAccessTokenRotated(\n  listener: (accessToken: string) => void,\n): () => void {\n  listeners.add(listener);\n  return () => {\n    listeners.delete(listener);\n  };\n}\n\n/** Test hook: drop the held credentials so the next run configures afresh. */\nexport function resetOAuthSession(): void {\n  current = null;\n  rotate = undefined;\n  onRefreshed = undefined;\n  inFlight = null;\n  listeners.clear();\n  lineage = new Set();\n  lineageRoot = undefined;\n}\n\nfunction sameLogin(a: Credentials, b: Credentials): boolean {\n  return a.host.apiHost === b.host.apiHost && a.projectId === b.projectId;\n}\n\nfunction nearExpiry(credentials: Credentials): boolean {\n  // No expiry means we cannot tell how much life is left, so leave it alone.\n  return (\n    credentials.expiresAt !== undefined &&\n    credentials.expiresAt - Date.now() < REFRESH_WHEN_REMAINING_MS\n  );\n}\n\nasync function refresh(\n  rotateWith: RotateCredentials,\n  credentials: Credentials,\n): Promise<Credentials> {\n  const refreshed = await rotateWith(credentials);\n  if (refreshed === credentials) return credentials;\n  logToFile('[oauth-session] token rotated');\n  lineage.add(refreshed.accessToken);\n  current = refreshed;\n  onRefreshed?.(refreshed);\n  for (const listener of listeners) listener(refreshed.accessToken);\n  return refreshed;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAcA,IAAI,eAAe;;;;;;AAOnB,SAAgB,mBAAyB;AACvC,gBAAe;;;AAIjB,SAAgB,iBAA0B;AACxC,QAAO;;;;ACpBT,MAAM,4BAA4B,MAAU;AAO5C,IAAI,UAA8B;AAClC,IAAI;AACJ,IAAI;AAEJ,IAAI,WAAwC;AAC5C,MAAM,4BAAY,IAAI,KAAoC;AAE1D,IAAI,0BAAU,IAAI,KAAa;AAC/B,IAAI;;AAGJ,SAAgB,sBACd,aACA,SAIM;AACN,UAAS,QAAQ;AACjB,eAAc,QAAQ;AACtB,KACE,WACA,UAAU,SAAS,YAAY,KAC9B,QAAQ,aAAa,MAAM,YAAY,aAAa,IACrD;AACA,gBAAc,QAAQ;AACtB;;AAEF,KAAI,CAAC,WAAW,CAAC,UAAU,SAAS,YAAY,EAAE;AAChD,4BAAU,IAAI,KAAK;AACnB,gBAAc,YAAY;;AAE5B,SAAQ,IAAI,YAAY,YAAY;AACpC,WAAU;;;;;;;;AAeZ,eAAsB,wBACpB,aACA,SAC+B;AAC/B,KACG,QAAQ,uBAAuB,CAAC,YAAY,gBAC7C,gBAAgB,CAEhB,QAAO,EAAE,MAAM,WAAW;CAE5B,MAAM,UAAU,MAAM,mBAAmB,aAAa,KAAK;AAC3D,QAAO,QAAQ,gBAAgB,YAAY,cACvC,EAAE,MAAM,aAAa,GACrB;EAAE,MAAM;EAAW,aAAa;EAAS;;;AAI/C,SAAgB,cAAc,aAA6B;AACzD,QAAO,eAAe,QAAQ,IAAI,YAAY,GAAG,cAAc;;;AAIjE,eAAsB,iBACpB,QAAQ,OACqB;AAC7B,KAAI,CAAC,QAAS,QAAO;AACrB,KAAI,CAAC,UAAU,CAAC,QAAQ,gBAAiB,CAAC,SAAS,CAAC,WAAW,QAAQ,CACrE,QAAO;AACT,cAAa,QAAQ,QAAQ,QAAQ,CAAC,cAAc;AAClD,aAAW;GACX;AACF,QAAO;;;AAIT,eAAsB,mBACpB,UACA,QAAQ,OACc;AACtB,KAAI,CAAC,WAAW,CAAC,UAAU,SAAS,SAAS,CAAE,QAAO;AACtD,QAAQ,MAAM,iBAAiB,MAAM,IAAK;;;AAI5C,eAAsB,mBACpB,UACiB;AACjB,SAAQ,MAAM,mBAAmB,SAAS,EAAE;;;AAI9C,SAAgB,qBACd,UACY;AACZ,WAAU,IAAI,SAAS;AACvB,cAAa;AACX,YAAU,OAAO,SAAS;;;AAe9B,SAAS,UAAU,GAAgB,GAAyB;AAC1D,QAAO,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,cAAc,EAAE;;AAGhE,SAAS,WAAW,aAAmC;AAErD,QACE,YAAY,cAAc,KAAA,KAC1B,YAAY,YAAY,KAAK,KAAK,GAAG;;AAIzC,eAAe,QACb,YACA,aACsB;CACtB,MAAM,YAAY,MAAM,WAAW,YAAY;AAC/C,KAAI,cAAc,YAAa,QAAO;AACtC,WAAU,gCAAgC;AAC1C,SAAQ,IAAI,UAAU,YAAY;AAClC,WAAU;AACV,eAAc,UAAU;AACxB,MAAK,MAAM,YAAY,UAAW,UAAS,UAAU,YAAY;AACjE,QAAO"}

package/dist/{orchestrator-tools-DyKws92o.js → orchestrator-tools-QWyDLu_7.js}

@@ -1,5 +1,5 @@
-import { n as analytics } from "./analytics-B_xFshPY.js";
-import { a as REMARK_ASK, c as applyReadHandoffs, f as NotNeededReason, i as NOT_NEEDED_REASON_ASK, n as ENQUEUE_MODEL_DESCRIPTION, o as applyComplete, r as HANDOFF_FIELDS, s as applyEnqueue, t as COMPLETE_TASK_DESCRIPTION } from "./queue-tools-BoIITT7w.js";
+import { n as analytics } from "./analytics-Drox5LSW.js";
+import { a as REMARK_ASK, c as applyReadHandoffs, i as NOT_NEEDED_REASON_ASK, n as ENQUEUE_MODEL_DESCRIPTION, o as applyComplete, p as NotNeededReason, r as HANDOFF_FIELDS, s as applyEnqueue, t as COMPLETE_TASK_DESCRIPTION } from "./queue-tools-PFG6H93Q.js";
 import { Type } from "typebox";
 import { defineTool } from "@earendil-works/pi-coding-agent";
 //#region src/agent/runner/harness/pi/orchestrator-tools.ts
@@ -110,4 +110,4 @@ function createPiOrchestratorTools(ctx) {
 //#endregion
 export { createPiOrchestratorTools };
 
-//# sourceMappingURL=orchestrator-tools-DyKws92o.js.map
+//# sourceMappingURL=orchestrator-tools-QWyDLu_7.js.map

package/dist/{orchestrator-tools-DyKws92o.js.map → orchestrator-tools-QWyDLu_7.js.map}

@@ -1 +1 @@
-{"version":3,"file":"orchestrator-tools-DyKws92o.js","names":[],"sources":["../src/agent/runner/harness/pi/orchestrator-tools.ts"],"sourcesContent":["/**\n * Orchestrator queue tools as pi custom tools. The queue lives in-process, and\n * `applyEnqueue` / `applyComplete` / `applyReadHandoffs` are plain exported\n * functions — so pi needs no MCP transport, just `defineTool` wrappers around\n * the same guards and apply logic the anthropic path mounts through the\n * wizard-tools MCP server. Tool names match the MCP short names so the shared\n * agent prompts are unchanged.\n *\n * Lazily imported (typebox is ESM and must stay out of the static module graph\n * so CommonJS unit tests can load the backend seam without parsing it).\n */\n\nimport { Type } from 'typebox';\nimport { defineTool } from '@earendil-works/pi-coding-agent';\nimport type { ToolDefinition } from '@earendil-works/pi-coding-agent';\nimport { analytics } from '@utils/analytics';\nimport {\n  applyComplete,\n  applyEnqueue,\n  applyReadHandoffs,\n  COMPLETE_TASK_DESCRIPTION,\n  ENQUEUE_MODEL_DESCRIPTION,\n  HANDOFF_FIELDS,\n  NOT_NEEDED_REASON_ASK,\n  REMARK_ASK,\n  type CompleteArgs,\n  type EnqueueArgs,\n  type OrchestratorToolsContext,\n} from '../../sequence/orchestrator/queue-tools';\nimport { NotNeededReason } from '../../sequence/orchestrator/queue';\n\nfunction text(s: string): {\n  content: [{ type: 'text'; text: string }];\n  details: unknown;\n} {\n  return { content: [{ type: 'text', text: s }], details: {} };\n}\n\n/** Mirrors the zod `HANDOFF_SHAPE`; both read their text from HANDOFF_FIELDS. */\nconst HANDOFF_PARAMS = Type.Object({\n  goals: Type.String({ description: HANDOFF_FIELDS.goals }),\n  did: Type.String({ description: HANDOFF_FIELDS.did }),\n  forNextAgent: Type.String({ description: HANDOFF_FIELDS.forNextAgent }),\n  filesTouched: Type.Optional(\n    Type.Array(Type.String(), { description: HANDOFF_FIELDS.filesTouched }),\n  ),\n  evidence: Type.Optional(\n    Type.String({ description: HANDOFF_FIELDS.evidence }),\n  ),\n  assumptions: Type.Optional(\n    Type.String({ description: HANDOFF_FIELDS.assumptions }),\n  ),\n  conflict: Type.Optional(\n    Type.String({ description: HANDOFF_FIELDS.conflict }),\n  ),\n  reportSection: Type.Optional(\n    Type.String({ description: HANDOFF_FIELDS.reportSection }),\n  ),\n});\n\n/** Exported so the parity test can compare both harnesses' field sets. */\nexport const PI_HANDOFF_PARAM_KEYS: readonly string[] = Object.keys(\n  HANDOFF_PARAMS.properties,\n);\n\n/** Mirrors the zod `COMPLETE_SHAPE`; ctx-independent, so it lives out here. */\nconst COMPLETE_PARAMS = Type.Object({\n  status: Type.Union([\n    Type.Literal('done'),\n    Type.Literal('failed'),\n    Type.Literal('not needed'),\n  ]),\n  handoff: HANDOFF_PARAMS,\n  remark: Type.Optional(Type.String({ description: REMARK_ASK })),\n  notNeededReason: Type.Optional(\n    Type.Union(\n      [\n        Type.Literal(NotNeededReason.NotApplicable),\n        Type.Literal(NotNeededReason.UserDeclined),\n        Type.Literal(NotNeededReason.Blocked),\n      ],\n      { description: NOT_NEEDED_REASON_ASK },\n    ),\n  ),\n});\n\n/** Exported so the parity test can compare both harnesses' field sets. */\nexport const PI_COMPLETE_PARAM_KEYS: readonly string[] = Object.keys(\n  COMPLETE_PARAMS.properties,\n);\n\n/** The three queue tools bound to one agent's orchestrator context. */\nexport function createPiOrchestratorTools(\n  ctx: OrchestratorToolsContext,\n): ToolDefinition[] {\n  const enqueueTask = defineTool({\n    name: 'enqueue_task',\n    label: 'Enqueue task',\n    description:\n      'Add a task to the orchestrator queue. Use it to seed work and to enqueue follow-up work you discover. Keep tasks small and discrete.',\n    promptSnippet:\n      'enqueue_task({type, label, dependsOn, reason}) — add a task to the queue; the task type goes in the \"type\" field, and it returns the task id',\n    parameters: Type.Object({\n      type: Type.String({\n        description: `The task type. One of: ${ctx.validTypes.join(', ')}.`,\n      }),\n      label: Type.Optional(\n        Type.String({\n          description:\n            'A short label for the UI — the action in a few words (e.g. \"Add the PostHog SDK\", \"Initialize PostHog\"). Leave out file names, class names, and other specifics.',\n        }),\n      ),\n      inputs: Type.Optional(Type.Record(Type.String(), Type.Unknown())),\n      dependsOn: Type.Optional(\n        Type.Array(Type.String(), {\n          description: 'Task ids that must be done before this task runs.',\n        }),\n      ),\n      model: Type.Optional(\n        Type.String({ description: ENQUEUE_MODEL_DESCRIPTION }),\n      ),\n      reason: Type.String({\n        description: 'One line on why this task is needed.',\n      }),\n    }),\n    execute(_id, args) {\n      const res = applyEnqueue(ctx, args as EnqueueArgs);\n      if (!res.ok) {\n        analytics.wizardCapture('orchestrator guard tripped', {\n          guard: res.guard,\n          type: (args as EnqueueArgs).type,\n        });\n        return Promise.resolve(text(`Error: ${res.message}`));\n      }\n      return Promise.resolve(text(JSON.stringify({ id: res.task.id })));\n    },\n  });\n\n  const completeTask = defineTool({\n    name: 'complete_task',\n    label: 'Complete task',\n    description: COMPLETE_TASK_DESCRIPTION,\n    promptSnippet:\n      'complete_task(status, handoff) — report your outcome exactly once when done, with goals/did/forNextAgent nested inside handoff',\n    parameters: COMPLETE_PARAMS,\n    execute(_id, args) {\n      const res = applyComplete(ctx, args as CompleteArgs);\n      if (!res.ok) return Promise.resolve(text(`Error: ${res.message}`));\n      return Promise.resolve(text('ok'));\n    },\n  });\n\n  const readHandoffs = defineTool({\n    name: 'read_handoffs',\n    label: 'Read handoffs',\n    description:\n      'Read structured handoffs from earlier tasks. With no argument, returns the handoffs of your dependencies.',\n    promptSnippet:\n      'read_handoffs() — read what earlier tasks handed off (defaults to your dependencies)',\n    parameters: Type.Object({\n      type: Type.Optional(Type.String()),\n      taskId: Type.Optional(Type.String()),\n    }),\n    execute(_id, args) {\n      const handoffs = applyReadHandoffs(\n        ctx,\n        args as { type?: string; taskId?: string },\n      );\n      return Promise.resolve(text(JSON.stringify(handoffs, null, 2)));\n    },\n  });\n\n  return [enqueueTask, completeTask, readHandoffs];\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA+BA,SAAS,KAAK,GAGZ;AACA,QAAO;EAAE,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM;GAAG,CAAC;EAAE,SAAS,EAAE;EAAE;;;AAI9D,MAAM,iBAAiB,KAAK,OAAO;CACjC,OAAO,KAAK,OAAO,EAAE,aAAa,eAAe,OAAO,CAAC;CACzD,KAAK,KAAK,OAAO,EAAE,aAAa,eAAe,KAAK,CAAC;CACrD,cAAc,KAAK,OAAO,EAAE,aAAa,eAAe,cAAc,CAAC;CACvE,cAAc,KAAK,SACjB,KAAK,MAAM,KAAK,QAAQ,EAAE,EAAE,aAAa,eAAe,cAAc,CAAC,CACxE;CACD,UAAU,KAAK,SACb,KAAK,OAAO,EAAE,aAAa,eAAe,UAAU,CAAC,CACtD;CACD,aAAa,KAAK,SAChB,KAAK,OAAO,EAAE,aAAa,eAAe,aAAa,CAAC,CACzD;CACD,UAAU,KAAK,SACb,KAAK,OAAO,EAAE,aAAa,eAAe,UAAU,CAAC,CACtD;CACD,eAAe,KAAK,SAClB,KAAK,OAAO,EAAE,aAAa,eAAe,eAAe,CAAC,CAC3D;CACF,CAAC;AAGsD,OAAO,KAC7D,eAAe,WAChB;;AAGD,MAAM,kBAAkB,KAAK,OAAO;CAClC,QAAQ,KAAK,MAAM;EACjB,KAAK,QAAQ,OAAO;EACpB,KAAK,QAAQ,SAAS;EACtB,KAAK,QAAQ,aAAa;EAC3B,CAAC;CACF,SAAS;CACT,QAAQ,KAAK,SAAS,KAAK,OAAO,EAAE,aAAa,YAAY,CAAC,CAAC;CAC/D,iBAAiB,KAAK,SACpB,KAAK,MACH;EACE,KAAK,QAAQ,gBAAgB,cAAc;EAC3C,KAAK,QAAQ,gBAAgB,aAAa;EAC1C,KAAK,QAAQ,gBAAgB,QAAQ;EACtC,EACD,EAAE,aAAa,uBAAuB,CACvC,CACF;CACF,CAAC;AAGuD,OAAO,KAC9D,gBAAgB,WACjB;;AAGD,SAAgB,0BACd,KACkB;AA8ElB,QAAO;EA7Ea,WAAW;GAC7B,MAAM;GACN,OAAO;GACP,aACE;GACF,eACE;GACF,YAAY,KAAK,OAAO;IACtB,MAAM,KAAK,OAAO,EAChB,aAAa,0BAA0B,IAAI,WAAW,KAAK,KAAK,CAAC,IAClE,CAAC;IACF,OAAO,KAAK,SACV,KAAK,OAAO,EACV,aACE,wKACH,CAAC,CACH;IACD,QAAQ,KAAK,SAAS,KAAK,OAAO,KAAK,QAAQ,EAAE,KAAK,SAAS,CAAC,CAAC;IACjE,WAAW,KAAK,SACd,KAAK,MAAM,KAAK,QAAQ,EAAE,EACxB,aAAa,qDACd,CAAC,CACH;IACD,OAAO,KAAK,SACV,KAAK,OAAO,EAAE,aAAa,2BAA2B,CAAC,CACxD;IACD,QAAQ,KAAK,OAAO,EAClB,aAAa,wCACd,CAAC;IACH,CAAC;GACF,QAAQ,KAAK,MAAM;IACjB,MAAM,MAAM,aAAa,KAAK,KAAoB;AAClD,QAAI,CAAC,IAAI,IAAI;AACX,eAAU,cAAc,8BAA8B;MACpD,OAAO,IAAI;MACX,MAAO,KAAqB;MAC7B,CAAC;AACF,YAAO,QAAQ,QAAQ,KAAK,UAAU,IAAI,UAAU,CAAC;;AAEvD,WAAO,QAAQ,QAAQ,KAAK,KAAK,UAAU,EAAE,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC;;GAEpE,CAAC;EAEmB,WAAW;GAC9B,MAAM;GACN,OAAO;GACP,aAAa;GACb,eACE;GACF,YAAY;GACZ,QAAQ,KAAK,MAAM;IACjB,MAAM,MAAM,cAAc,KAAK,KAAqB;AACpD,QAAI,CAAC,IAAI,GAAI,QAAO,QAAQ,QAAQ,KAAK,UAAU,IAAI,UAAU,CAAC;AAClE,WAAO,QAAQ,QAAQ,KAAK,KAAK,CAAC;;GAErC,CAAC;EAEmB,WAAW;GAC9B,MAAM;GACN,OAAO;GACP,aACE;GACF,eACE;GACF,YAAY,KAAK,OAAO;IACtB,MAAM,KAAK,SAAS,KAAK,QAAQ,CAAC;IAClC,QAAQ,KAAK,SAAS,KAAK,QAAQ,CAAC;IACrC,CAAC;GACF,QAAQ,KAAK,MAAM;IACjB,MAAM,WAAW,kBACf,KACA,KACD;AACD,WAAO,QAAQ,QAAQ,KAAK,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC,CAAC;;GAElE,CAAC;EAE8C"}
+{"version":3,"file":"orchestrator-tools-QWyDLu_7.js","names":[],"sources":["../src/agent/runner/harness/pi/orchestrator-tools.ts"],"sourcesContent":["/**\n * Orchestrator queue tools as pi custom tools. The queue lives in-process, and\n * `applyEnqueue` / `applyComplete` / `applyReadHandoffs` are plain exported\n * functions — so pi needs no MCP transport, just `defineTool` wrappers around\n * the same guards and apply logic the anthropic path mounts through the\n * wizard-tools MCP server. Tool names match the MCP short names so the shared\n * agent prompts are unchanged.\n *\n * Lazily imported (typebox is ESM and must stay out of the static module graph\n * so CommonJS unit tests can load the backend seam without parsing it).\n */\n\nimport { Type } from 'typebox';\nimport { defineTool } from '@earendil-works/pi-coding-agent';\nimport type { ToolDefinition } from '@earendil-works/pi-coding-agent';\nimport { analytics } from '@utils/analytics';\nimport {\n  applyComplete,\n  applyEnqueue,\n  applyReadHandoffs,\n  COMPLETE_TASK_DESCRIPTION,\n  ENQUEUE_MODEL_DESCRIPTION,\n  HANDOFF_FIELDS,\n  NOT_NEEDED_REASON_ASK,\n  REMARK_ASK,\n  type CompleteArgs,\n  type EnqueueArgs,\n  type OrchestratorToolsContext,\n} from '../../sequence/orchestrator/queue-tools';\nimport { NotNeededReason } from '../../sequence/orchestrator/queue';\n\nfunction text(s: string): {\n  content: [{ type: 'text'; text: string }];\n  details: unknown;\n} {\n  return { content: [{ type: 'text', text: s }], details: {} };\n}\n\n/** Mirrors the zod `HANDOFF_SHAPE`; both read their text from HANDOFF_FIELDS. */\nconst HANDOFF_PARAMS = Type.Object({\n  goals: Type.String({ description: HANDOFF_FIELDS.goals }),\n  did: Type.String({ description: HANDOFF_FIELDS.did }),\n  forNextAgent: Type.String({ description: HANDOFF_FIELDS.forNextAgent }),\n  filesTouched: Type.Optional(\n    Type.Array(Type.String(), { description: HANDOFF_FIELDS.filesTouched }),\n  ),\n  evidence: Type.Optional(\n    Type.String({ description: HANDOFF_FIELDS.evidence }),\n  ),\n  assumptions: Type.Optional(\n    Type.String({ description: HANDOFF_FIELDS.assumptions }),\n  ),\n  conflict: Type.Optional(\n    Type.String({ description: HANDOFF_FIELDS.conflict }),\n  ),\n  reportSection: Type.Optional(\n    Type.String({ description: HANDOFF_FIELDS.reportSection }),\n  ),\n});\n\n/** Exported so the parity test can compare both harnesses' field sets. */\nexport const PI_HANDOFF_PARAM_KEYS: readonly string[] = Object.keys(\n  HANDOFF_PARAMS.properties,\n);\n\n/** Mirrors the zod `COMPLETE_SHAPE`; ctx-independent, so it lives out here. */\nconst COMPLETE_PARAMS = Type.Object({\n  status: Type.Union([\n    Type.Literal('done'),\n    Type.Literal('failed'),\n    Type.Literal('not needed'),\n  ]),\n  handoff: HANDOFF_PARAMS,\n  remark: Type.Optional(Type.String({ description: REMARK_ASK })),\n  notNeededReason: Type.Optional(\n    Type.Union(\n      [\n        Type.Literal(NotNeededReason.NotApplicable),\n        Type.Literal(NotNeededReason.UserDeclined),\n        Type.Literal(NotNeededReason.Blocked),\n      ],\n      { description: NOT_NEEDED_REASON_ASK },\n    ),\n  ),\n});\n\n/** Exported so the parity test can compare both harnesses' field sets. */\nexport const PI_COMPLETE_PARAM_KEYS: readonly string[] = Object.keys(\n  COMPLETE_PARAMS.properties,\n);\n\n/** The three queue tools bound to one agent's orchestrator context. */\nexport function createPiOrchestratorTools(\n  ctx: OrchestratorToolsContext,\n): ToolDefinition[] {\n  const enqueueTask = defineTool({\n    name: 'enqueue_task',\n    label: 'Enqueue task',\n    description:\n      'Add a task to the orchestrator queue. Use it to seed work and to enqueue follow-up work you discover. Keep tasks small and discrete.',\n    promptSnippet:\n      'enqueue_task({type, label, dependsOn, reason}) — add a task to the queue; the task type goes in the \"type\" field, and it returns the task id',\n    parameters: Type.Object({\n      type: Type.String({\n        description: `The task type. One of: ${ctx.validTypes.join(', ')}.`,\n      }),\n      label: Type.Optional(\n        Type.String({\n          description:\n            'A short label for the UI — the action in a few words (e.g. \"Add the PostHog SDK\", \"Initialize PostHog\"). Leave out file names, class names, and other specifics.',\n        }),\n      ),\n      inputs: Type.Optional(Type.Record(Type.String(), Type.Unknown())),\n      dependsOn: Type.Optional(\n        Type.Array(Type.String(), {\n          description: 'Task ids that must be done before this task runs.',\n        }),\n      ),\n      model: Type.Optional(\n        Type.String({ description: ENQUEUE_MODEL_DESCRIPTION }),\n      ),\n      reason: Type.String({\n        description: 'One line on why this task is needed.',\n      }),\n    }),\n    execute(_id, args) {\n      const res = applyEnqueue(ctx, args as EnqueueArgs);\n      if (!res.ok) {\n        analytics.wizardCapture('orchestrator guard tripped', {\n          guard: res.guard,\n          type: (args as EnqueueArgs).type,\n        });\n        return Promise.resolve(text(`Error: ${res.message}`));\n      }\n      return Promise.resolve(text(JSON.stringify({ id: res.task.id })));\n    },\n  });\n\n  const completeTask = defineTool({\n    name: 'complete_task',\n    label: 'Complete task',\n    description: COMPLETE_TASK_DESCRIPTION,\n    promptSnippet:\n      'complete_task(status, handoff) — report your outcome exactly once when done, with goals/did/forNextAgent nested inside handoff',\n    parameters: COMPLETE_PARAMS,\n    execute(_id, args) {\n      const res = applyComplete(ctx, args as CompleteArgs);\n      if (!res.ok) return Promise.resolve(text(`Error: ${res.message}`));\n      return Promise.resolve(text('ok'));\n    },\n  });\n\n  const readHandoffs = defineTool({\n    name: 'read_handoffs',\n    label: 'Read handoffs',\n    description:\n      'Read structured handoffs from earlier tasks. With no argument, returns the handoffs of your dependencies.',\n    promptSnippet:\n      'read_handoffs() — read what earlier tasks handed off (defaults to your dependencies)',\n    parameters: Type.Object({\n      type: Type.Optional(Type.String()),\n      taskId: Type.Optional(Type.String()),\n    }),\n    execute(_id, args) {\n      const handoffs = applyReadHandoffs(\n        ctx,\n        args as { type?: string; taskId?: string },\n      );\n      return Promise.resolve(text(JSON.stringify(handoffs, null, 2)));\n    },\n  });\n\n  return [enqueueTask, completeTask, readHandoffs];\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA+BA,SAAS,KAAK,GAGZ;AACA,QAAO;EAAE,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM;GAAG,CAAC;EAAE,SAAS,EAAE;EAAE;;;AAI9D,MAAM,iBAAiB,KAAK,OAAO;CACjC,OAAO,KAAK,OAAO,EAAE,aAAa,eAAe,OAAO,CAAC;CACzD,KAAK,KAAK,OAAO,EAAE,aAAa,eAAe,KAAK,CAAC;CACrD,cAAc,KAAK,OAAO,EAAE,aAAa,eAAe,cAAc,CAAC;CACvE,cAAc,KAAK,SACjB,KAAK,MAAM,KAAK,QAAQ,EAAE,EAAE,aAAa,eAAe,cAAc,CAAC,CACxE;CACD,UAAU,KAAK,SACb,KAAK,OAAO,EAAE,aAAa,eAAe,UAAU,CAAC,CACtD;CACD,aAAa,KAAK,SAChB,KAAK,OAAO,EAAE,aAAa,eAAe,aAAa,CAAC,CACzD;CACD,UAAU,KAAK,SACb,KAAK,OAAO,EAAE,aAAa,eAAe,UAAU,CAAC,CACtD;CACD,eAAe,KAAK,SAClB,KAAK,OAAO,EAAE,aAAa,eAAe,eAAe,CAAC,CAC3D;CACF,CAAC;AAGsD,OAAO,KAC7D,eAAe,WAChB;;AAGD,MAAM,kBAAkB,KAAK,OAAO;CAClC,QAAQ,KAAK,MAAM;EACjB,KAAK,QAAQ,OAAO;EACpB,KAAK,QAAQ,SAAS;EACtB,KAAK,QAAQ,aAAa;EAC3B,CAAC;CACF,SAAS;CACT,QAAQ,KAAK,SAAS,KAAK,OAAO,EAAE,aAAa,YAAY,CAAC,CAAC;CAC/D,iBAAiB,KAAK,SACpB,KAAK,MACH;EACE,KAAK,QAAQ,gBAAgB,cAAc;EAC3C,KAAK,QAAQ,gBAAgB,aAAa;EAC1C,KAAK,QAAQ,gBAAgB,QAAQ;EACtC,EACD,EAAE,aAAa,uBAAuB,CACvC,CACF;CACF,CAAC;AAGuD,OAAO,KAC9D,gBAAgB,WACjB;;AAGD,SAAgB,0BACd,KACkB;AA8ElB,QAAO;EA7Ea,WAAW;GAC7B,MAAM;GACN,OAAO;GACP,aACE;GACF,eACE;GACF,YAAY,KAAK,OAAO;IACtB,MAAM,KAAK,OAAO,EAChB,aAAa,0BAA0B,IAAI,WAAW,KAAK,KAAK,CAAC,IAClE,CAAC;IACF,OAAO,KAAK,SACV,KAAK,OAAO,EACV,aACE,wKACH,CAAC,CACH;IACD,QAAQ,KAAK,SAAS,KAAK,OAAO,KAAK,QAAQ,EAAE,KAAK,SAAS,CAAC,CAAC;IACjE,WAAW,KAAK,SACd,KAAK,MAAM,KAAK,QAAQ,EAAE,EACxB,aAAa,qDACd,CAAC,CACH;IACD,OAAO,KAAK,SACV,KAAK,OAAO,EAAE,aAAa,2BAA2B,CAAC,CACxD;IACD,QAAQ,KAAK,OAAO,EAClB,aAAa,wCACd,CAAC;IACH,CAAC;GACF,QAAQ,KAAK,MAAM;IACjB,MAAM,MAAM,aAAa,KAAK,KAAoB;AAClD,QAAI,CAAC,IAAI,IAAI;AACX,eAAU,cAAc,8BAA8B;MACpD,OAAO,IAAI;MACX,MAAO,KAAqB;MAC7B,CAAC;AACF,YAAO,QAAQ,QAAQ,KAAK,UAAU,IAAI,UAAU,CAAC;;AAEvD,WAAO,QAAQ,QAAQ,KAAK,KAAK,UAAU,EAAE,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC;;GAEpE,CAAC;EAEmB,WAAW;GAC9B,MAAM;GACN,OAAO;GACP,aAAa;GACb,eACE;GACF,YAAY;GACZ,QAAQ,KAAK,MAAM;IACjB,MAAM,MAAM,cAAc,KAAK,KAAqB;AACpD,QAAI,CAAC,IAAI,GAAI,QAAO,QAAQ,QAAQ,KAAK,UAAU,IAAI,UAAU,CAAC;AAClE,WAAO,QAAQ,QAAQ,KAAK,KAAK,CAAC;;GAErC,CAAC;EAEmB,WAAW;GAC9B,MAAM;GACN,OAAO;GACP,aACE;GACF,eACE;GACF,YAAY,KAAK,OAAO;IACtB,MAAM,KAAK,SAAS,KAAK,QAAQ,CAAC;IAClC,QAAQ,KAAK,SAAS,KAAK,QAAQ,CAAC;IACrC,CAAC;GACF,QAAQ,KAAK,MAAM;IACjB,MAAM,WAAW,kBACf,KACA,KACD;AACD,WAAO,QAAQ,QAAQ,KAAK,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC,CAAC;;GAElE,CAAC;EAE8C"}

package/dist/package-json-BAtJRHSq.js

@@ -0,0 +1,2 @@
+import { r as hasDeclaredDependency } from "./package-json-z1agAYXs.js";
+export { hasDeclaredDependency };

package/dist/{package-json-2UrhE6kP.js → package-json-z1agAYXs.js}

@@ -32,4 +32,4 @@ function getInstalledPackageVersion(packageName, installDir) {
 //#endregion
 export { getInstalledPackageVersion as n, hasDeclaredDependency as r, getDeclaredVersion as t };
 
-//# sourceMappingURL=package-json-2UrhE6kP.js.map
+//# sourceMappingURL=package-json-z1agAYXs.js.map

package/dist/{package-json-2UrhE6kP.js.map → package-json-z1agAYXs.js.map}

@@ -1 +1 @@
-{"version":3,"file":"package-json-2UrhE6kP.js","names":[],"sources":["../src/shared/utils/package-json.ts"],"sourcesContent":["import { readFileSync } from 'fs';\nimport path from 'path';\n\nexport type PackageJson = {\n  dependencies?: Record<string, string>;\n  devDependencies?: Record<string, string>;\n  scripts?: Record<string, string | undefined>;\n  version?: string;\n  overrides?: Record<string, string>;\n  resolutions?: Record<string, string>;\n  pnpm?: {\n    overrides?: Record<string, string>;\n  };\n};\n\ntype InstalledPackage = {\n  name: string;\n  version: string;\n};\n\n/**\n * Returns the raw version spec for `packageName` as written in\n * `package.json` (range, pinned version, workspace ref, URL, etc.).\n * `dependencies` wins over `devDependencies`. An empty-string value in\n * either slot falls through, matching the previous behaviour.\n */\nexport function getDeclaredVersion(\n  packageName: string,\n  packageJson: PackageJson,\n): string | undefined {\n  const fromDeps = packageJson?.dependencies?.[packageName];\n  if (fromDeps) return fromDeps;\n  const fromDevDeps = packageJson?.devDependencies?.[packageName];\n  if (fromDevDeps) return fromDevDeps;\n  return undefined;\n}\n\nexport function hasDeclaredDependency(\n  packageName: string,\n  packageJson: PackageJson,\n): boolean {\n  return getDeclaredVersion(packageName, packageJson) !== undefined;\n}\n\nexport function findDeclaredPackage(\n  packageNamesList: string[],\n  packageJson: PackageJson,\n): InstalledPackage | undefined {\n  for (const name of packageNamesList) {\n    const version = getDeclaredVersion(name, packageJson);\n    if (version) {\n      return { name, version };\n    }\n  }\n  return undefined;\n}\n\n/**\n * Returns the resolved version from `node_modules/<pkg>/package.json`,\n * not the range declared in the project's `package.json`. Use this when\n * you need to know what npm actually installed.\n */\nexport function getInstalledPackageVersion(\n  packageName: string,\n  installDir: string,\n): string | undefined {\n  try {\n    const manifestPath = path.join(\n      installDir,\n      'node_modules',\n      packageName,\n      'package.json',\n    );\n    const manifest = JSON.parse(readFileSync(manifestPath, 'utf-8')) as {\n      version?: string;\n    };\n    return manifest.version;\n  } catch {\n    return undefined;\n  }\n}\n"],"mappings":";;;;;;;;;AA0BA,SAAgB,mBACd,aACA,aACoB;CACpB,MAAM,WAAW,aAAa,eAAe;AAC7C,KAAI,SAAU,QAAO;CACrB,MAAM,cAAc,aAAa,kBAAkB;AACnD,KAAI,YAAa,QAAO;;AAI1B,SAAgB,sBACd,aACA,aACS;AACT,QAAO,mBAAmB,aAAa,YAAY,KAAK,KAAA;;;;;;;AAqB1D,SAAgB,2BACd,aACA,YACoB;AACpB,KAAI;EACF,MAAM,eAAe,KAAK,KACxB,YACA,gBACA,aACA,eACD;AAID,SAHiB,KAAK,MAAM,aAAa,cAAc,QAAQ,CAAC,CAGhD;SACV;AACN"}
+{"version":3,"file":"package-json-z1agAYXs.js","names":[],"sources":["../src/shared/utils/package-json.ts"],"sourcesContent":["import { readFileSync } from 'fs';\nimport path from 'path';\n\nexport type PackageJson = {\n  dependencies?: Record<string, string>;\n  devDependencies?: Record<string, string>;\n  scripts?: Record<string, string | undefined>;\n  version?: string;\n  overrides?: Record<string, string>;\n  resolutions?: Record<string, string>;\n  pnpm?: {\n    overrides?: Record<string, string>;\n  };\n};\n\ntype InstalledPackage = {\n  name: string;\n  version: string;\n};\n\n/**\n * Returns the raw version spec for `packageName` as written in\n * `package.json` (range, pinned version, workspace ref, URL, etc.).\n * `dependencies` wins over `devDependencies`. An empty-string value in\n * either slot falls through, matching the previous behaviour.\n */\nexport function getDeclaredVersion(\n  packageName: string,\n  packageJson: PackageJson,\n): string | undefined {\n  const fromDeps = packageJson?.dependencies?.[packageName];\n  if (fromDeps) return fromDeps;\n  const fromDevDeps = packageJson?.devDependencies?.[packageName];\n  if (fromDevDeps) return fromDevDeps;\n  return undefined;\n}\n\nexport function hasDeclaredDependency(\n  packageName: string,\n  packageJson: PackageJson,\n): boolean {\n  return getDeclaredVersion(packageName, packageJson) !== undefined;\n}\n\nexport function findDeclaredPackage(\n  packageNamesList: string[],\n  packageJson: PackageJson,\n): InstalledPackage | undefined {\n  for (const name of packageNamesList) {\n    const version = getDeclaredVersion(name, packageJson);\n    if (version) {\n      return { name, version };\n    }\n  }\n  return undefined;\n}\n\n/**\n * Returns the resolved version from `node_modules/<pkg>/package.json`,\n * not the range declared in the project's `package.json`. Use this when\n * you need to know what npm actually installed.\n */\nexport function getInstalledPackageVersion(\n  packageName: string,\n  installDir: string,\n): string | undefined {\n  try {\n    const manifestPath = path.join(\n      installDir,\n      'node_modules',\n      packageName,\n      'package.json',\n    );\n    const manifest = JSON.parse(readFileSync(manifestPath, 'utf-8')) as {\n      version?: string;\n    };\n    return manifest.version;\n  } catch {\n    return undefined;\n  }\n}\n"],"mappings":";;;;;;;;;AA0BA,SAAgB,mBACd,aACA,aACoB;CACpB,MAAM,WAAW,aAAa,eAAe;AAC7C,KAAI,SAAU,QAAO;CACrB,MAAM,cAAc,aAAa,kBAAkB;AACnD,KAAI,YAAa,QAAO;;AAI1B,SAAgB,sBACd,aACA,aACS;AACT,QAAO,mBAAmB,aAAa,YAAY,KAAK,KAAA;;;;;;;AAqB1D,SAAgB,2BACd,aACA,YACoB;AACpB,KAAI;EACF,MAAM,eAAe,KAAK,KACxB,YACA,gBACA,aACA,eACD;AAID,SAHiB,KAAK,MAAM,aAAa,cAAc,QAAQ,CAAC,CAGhD;SACV;AACN"}

package/dist/{package-manager-DpCdmMmB.js → package-manager-B-9I_fAT.js}

@@ -1,6 +1,6 @@
-import { n as analytics } from "./analytics-B_xFshPY.js";
-import { r as readFileHead } from "./bounded-fs-iRaQcKYL.js";
-import { t as withProgress } from "./telemetry-DKM7VGuJ.js";
+import { n as analytics } from "./analytics-Drox5LSW.js";
+import { r as readFileHead } from "./bounded-fs-TRL6IsoU.js";
+import { t as withProgress } from "./telemetry-BPBzqsb_.js";
 import * as fs$1 from "fs";
 import * as path$1 from "path";
 //#region src/shared/utils/package-manager.ts
@@ -102,4 +102,4 @@ function detectNodePackageManagers(installDir) {
 //#endregion
 export { detectNodePackageManagers as n, detectAllPackageManagers as t };
 
-//# sourceMappingURL=package-manager-DpCdmMmB.js.map
+//# sourceMappingURL=package-manager-B-9I_fAT.js.map

package/dist/{package-manager-DpCdmMmB.js.map → package-manager-B-9I_fAT.js.map}

@@ -1 +1 @@
-{"version":3,"file":"package-manager-DpCdmMmB.js","names":["fs","path"],"sources":["../src/shared/utils/package-manager.ts"],"sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\nimport { readFileHead } from './bounded-fs';\nimport { withProgress } from './telemetry';\nimport { analytics } from './analytics';\nimport type { WizardRunOptions } from './types';\n\ntype InstallDirOpt = Pick<WizardRunOptions, 'installDir'>;\n\nexport interface PackageManager {\n  name: string;\n  label: string;\n  installCommand: string;\n  buildCommand: string;\n  /** Command the manager uses to execute a `package.json` script. */\n  runScriptCommand: string;\n  flags: string;\n  detect: (opts: InstallDirOpt) => boolean;\n}\n\nfunction hasLockfile(installDir: string, file: string): boolean {\n  return fs.existsSync(path.join(installDir, file));\n}\n\nfunction lockfileHeaderContains(\n  installDir: string,\n  file: string,\n  needle: string,\n): boolean {\n  // Reads only the first 500 bytes of the lockfile.\n  return (\n    readFileHead(path.join(installDir, file), 500)?.includes(needle) ?? false\n  );\n}\n\nexport const BUN: PackageManager = {\n  name: 'bun',\n  label: 'Bun',\n  installCommand: 'bun add',\n  buildCommand: 'bun run build',\n  runScriptCommand: 'bun run',\n  flags: '',\n  detect: ({ installDir }) =>\n    hasLockfile(installDir, 'bun.lockb') || hasLockfile(installDir, 'bun.lock'),\n};\n\nexport const YARN_V1: PackageManager = {\n  name: 'yarn',\n  label: 'Yarn V1',\n  installCommand: 'yarn add',\n  buildCommand: 'yarn build',\n  runScriptCommand: 'yarn',\n  flags: '--ignore-workspace-root-check',\n  detect: ({ installDir }) =>\n    lockfileHeaderContains(installDir, 'yarn.lock', 'yarn lockfile v1'),\n};\n\n/** YARN V2/3/4 */\nexport const YARN_V2: PackageManager = {\n  name: 'yarn',\n  label: 'Yarn V2/3/4',\n  installCommand: 'yarn add',\n  buildCommand: 'yarn build',\n  runScriptCommand: 'yarn',\n  flags: '',\n  detect: ({ installDir }) =>\n    lockfileHeaderContains(installDir, 'yarn.lock', '__metadata'),\n};\n\nexport const PNPM: PackageManager = {\n  name: 'pnpm',\n  label: 'pnpm',\n  installCommand: 'pnpm add',\n  buildCommand: 'pnpm build',\n  runScriptCommand: 'pnpm',\n  flags: '--ignore-workspace-root-check',\n  detect: ({ installDir }) => hasLockfile(installDir, 'pnpm-lock.yaml'),\n};\n\nexport const NPM: PackageManager = {\n  name: 'npm',\n  label: 'npm',\n  installCommand: 'npm add',\n  buildCommand: 'npm run build',\n  runScriptCommand: 'npm run',\n  flags: '',\n  detect: ({ installDir }) => hasLockfile(installDir, 'package-lock.json'),\n};\n\n// Expo is selected by upstream config (app.json / app.config.*) rather than\n// a lockfile, so its detect always returns false here.\nexport const EXPO: PackageManager = {\n  name: 'expo',\n  label: 'Expo',\n  installCommand: 'npx expo install',\n  buildCommand: 'npx expo build',\n  runScriptCommand: 'npx expo run',\n  flags: '',\n  detect: () => false,\n};\n\nexport const packageManagers: PackageManager[] = [\n  BUN,\n  YARN_V1,\n  YARN_V2,\n  PNPM,\n  NPM,\n  EXPO,\n];\n\nexport function detectAllPackageManagers({\n  installDir,\n}: InstallDirOpt): PackageManager[] {\n  return withProgress('detect-package-manager', () => {\n    const matches = packageManagers.filter((pm) => pm.detect({ installDir }));\n    if (matches.length === 0) {\n      analytics.setTag('package-manager', 'not-detected');\n    }\n    return matches;\n  });\n}\n\n// ---------------------------------------------------------------------------\n// The detector contract the agent's `detect_package_manager` tool calls\n// ---------------------------------------------------------------------------\n\n/** Structured package manager info the agent can act on */\nexport interface DetectedPackageManager {\n  name: string;\n  label: string;\n  installCommand: string;\n  runCommand?: string;\n}\n\n/** Result returned by every detector */\nexport interface PackageManagerInfo {\n  detected: DetectedPackageManager[];\n  primary: DetectedPackageManager | null;\n  recommendation: string;\n}\n\n/** Signature each framework implements */\nexport type PackageManagerDetector = (\n  installDir: string,\n) => Promise<PackageManagerInfo>;\n\n// ---------------------------------------------------------------------------\n// Node.js helper\n// ---------------------------------------------------------------------------\n\nfunction serializeNodePM(pm: PackageManager): DetectedPackageManager {\n  return {\n    name: pm.name,\n    label: pm.label,\n    installCommand: pm.installCommand,\n    runCommand: pm.runScriptCommand,\n  };\n}\n\n/**\n * Detect Node.js package managers via lockfiles.\n * Wraps detectAllPackageManagers() above.\n */\nexport function detectNodePackageManagers(\n  installDir: string,\n): Promise<PackageManagerInfo> {\n  const detected = detectAllPackageManagers({ installDir }).map(\n    serializeNodePM,\n  );\n\n  if (detected.length === 0) {\n    return Promise.resolve({\n      detected: [],\n      primary: null,\n      recommendation: 'No lockfile found. Default to npm (npm add, npm run).',\n    });\n  }\n\n  const primary = detected[0];\n  return Promise.resolve({\n    detected,\n    primary,\n    recommendation:\n      detected.length === 1\n        ? `Use ${primary.label} (${primary.installCommand}).`\n        : `Multiple package managers detected. Prefer ${primary.label} (${primary.installCommand}).`,\n  });\n}\n"],"mappings":";;;;;;AAoBA,SAAS,YAAY,YAAoB,MAAuB;AAC9D,QAAOA,KAAG,WAAWC,OAAK,KAAK,YAAY,KAAK,CAAC;;AAGnD,SAAS,uBACP,YACA,MACA,QACS;AAET,QACE,aAAaA,OAAK,KAAK,YAAY,KAAK,EAAE,IAAI,EAAE,SAAS,OAAO,IAAI;;AAsExE,MAAa,kBAAoC;CAlEd;EACjC,MAAM;EACN,OAAO;EACP,gBAAgB;EAChB,cAAc;EACd,kBAAkB;EAClB,OAAO;EACP,SAAS,EAAE,iBACT,YAAY,YAAY,YAAY,IAAI,YAAY,YAAY,WAAW;EAC9E;CAEsC;EACrC,MAAM;EACN,OAAO;EACP,gBAAgB;EAChB,cAAc;EACd,kBAAkB;EAClB,OAAO;EACP,SAAS,EAAE,iBACT,uBAAuB,YAAY,aAAa,mBAAmB;EACtE;CAGsC;EACrC,MAAM;EACN,OAAO;EACP,gBAAgB;EAChB,cAAc;EACd,kBAAkB;EAClB,OAAO;EACP,SAAS,EAAE,iBACT,uBAAuB,YAAY,aAAa,aAAa;EAChE;CAEmC;EAClC,MAAM;EACN,OAAO;EACP,gBAAgB;EAChB,cAAc;EACd,kBAAkB;EAClB,OAAO;EACP,SAAS,EAAE,iBAAiB,YAAY,YAAY,iBAAiB;EACtE;CAEkC;EACjC,MAAM;EACN,OAAO;EACP,gBAAgB;EAChB,cAAc;EACd,kBAAkB;EAClB,OAAO;EACP,SAAS,EAAE,iBAAiB,YAAY,YAAY,oBAAoB;EACzE;CAImC;EAClC,MAAM;EACN,OAAO;EACP,gBAAgB;EAChB,cAAc;EACd,kBAAkB;EAClB,OAAO;EACP,cAAc;EACf;CASA;AAED,SAAgB,yBAAyB,EACvC,cACkC;AAClC,QAAO,aAAa,gCAAgC;EAClD,MAAM,UAAU,gBAAgB,QAAQ,OAAO,GAAG,OAAO,EAAE,YAAY,CAAC,CAAC;AACzE,MAAI,QAAQ,WAAW,EACrB,WAAU,OAAO,mBAAmB,eAAe;AAErD,SAAO;GACP;;AA+BJ,SAAS,gBAAgB,IAA4C;AACnE,QAAO;EACL,MAAM,GAAG;EACT,OAAO,GAAG;EACV,gBAAgB,GAAG;EACnB,YAAY,GAAG;EAChB;;;;;;AAOH,SAAgB,0BACd,YAC6B;CAC7B,MAAM,WAAW,yBAAyB,EAAE,YAAY,CAAC,CAAC,IACxD,gBACD;AAED,KAAI,SAAS,WAAW,EACtB,QAAO,QAAQ,QAAQ;EACrB,UAAU,EAAE;EACZ,SAAS;EACT,gBAAgB;EACjB,CAAC;CAGJ,MAAM,UAAU,SAAS;AACzB,QAAO,QAAQ,QAAQ;EACrB;EACA;EACA,gBACE,SAAS,WAAW,IAChB,OAAO,QAAQ,MAAM,IAAI,QAAQ,eAAe,MAChD,8CAA8C,QAAQ,MAAM,IAAI,QAAQ,eAAe;EAC9F,CAAC"}
+{"version":3,"file":"package-manager-B-9I_fAT.js","names":["fs","path"],"sources":["../src/shared/utils/package-manager.ts"],"sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\nimport { readFileHead } from './bounded-fs';\nimport { withProgress } from './telemetry';\nimport { analytics } from './analytics';\nimport type { WizardRunOptions } from './types';\n\ntype InstallDirOpt = Pick<WizardRunOptions, 'installDir'>;\n\nexport interface PackageManager {\n  name: string;\n  label: string;\n  installCommand: string;\n  buildCommand: string;\n  /** Command the manager uses to execute a `package.json` script. */\n  runScriptCommand: string;\n  flags: string;\n  detect: (opts: InstallDirOpt) => boolean;\n}\n\nfunction hasLockfile(installDir: string, file: string): boolean {\n  return fs.existsSync(path.join(installDir, file));\n}\n\nfunction lockfileHeaderContains(\n  installDir: string,\n  file: string,\n  needle: string,\n): boolean {\n  // Reads only the first 500 bytes of the lockfile.\n  return (\n    readFileHead(path.join(installDir, file), 500)?.includes(needle) ?? false\n  );\n}\n\nexport const BUN: PackageManager = {\n  name: 'bun',\n  label: 'Bun',\n  installCommand: 'bun add',\n  buildCommand: 'bun run build',\n  runScriptCommand: 'bun run',\n  flags: '',\n  detect: ({ installDir }) =>\n    hasLockfile(installDir, 'bun.lockb') || hasLockfile(installDir, 'bun.lock'),\n};\n\nexport const YARN_V1: PackageManager = {\n  name: 'yarn',\n  label: 'Yarn V1',\n  installCommand: 'yarn add',\n  buildCommand: 'yarn build',\n  runScriptCommand: 'yarn',\n  flags: '--ignore-workspace-root-check',\n  detect: ({ installDir }) =>\n    lockfileHeaderContains(installDir, 'yarn.lock', 'yarn lockfile v1'),\n};\n\n/** YARN V2/3/4 */\nexport const YARN_V2: PackageManager = {\n  name: 'yarn',\n  label: 'Yarn V2/3/4',\n  installCommand: 'yarn add',\n  buildCommand: 'yarn build',\n  runScriptCommand: 'yarn',\n  flags: '',\n  detect: ({ installDir }) =>\n    lockfileHeaderContains(installDir, 'yarn.lock', '__metadata'),\n};\n\nexport const PNPM: PackageManager = {\n  name: 'pnpm',\n  label: 'pnpm',\n  installCommand: 'pnpm add',\n  buildCommand: 'pnpm build',\n  runScriptCommand: 'pnpm',\n  flags: '--ignore-workspace-root-check',\n  detect: ({ installDir }) => hasLockfile(installDir, 'pnpm-lock.yaml'),\n};\n\nexport const NPM: PackageManager = {\n  name: 'npm',\n  label: 'npm',\n  installCommand: 'npm add',\n  buildCommand: 'npm run build',\n  runScriptCommand: 'npm run',\n  flags: '',\n  detect: ({ installDir }) => hasLockfile(installDir, 'package-lock.json'),\n};\n\n// Expo is selected by upstream config (app.json / app.config.*) rather than\n// a lockfile, so its detect always returns false here.\nexport const EXPO: PackageManager = {\n  name: 'expo',\n  label: 'Expo',\n  installCommand: 'npx expo install',\n  buildCommand: 'npx expo build',\n  runScriptCommand: 'npx expo run',\n  flags: '',\n  detect: () => false,\n};\n\nexport const packageManagers: PackageManager[] = [\n  BUN,\n  YARN_V1,\n  YARN_V2,\n  PNPM,\n  NPM,\n  EXPO,\n];\n\nexport function detectAllPackageManagers({\n  installDir,\n}: InstallDirOpt): PackageManager[] {\n  return withProgress('detect-package-manager', () => {\n    const matches = packageManagers.filter((pm) => pm.detect({ installDir }));\n    if (matches.length === 0) {\n      analytics.setTag('package-manager', 'not-detected');\n    }\n    return matches;\n  });\n}\n\n// ---------------------------------------------------------------------------\n// The detector contract the agent's `detect_package_manager` tool calls\n// ---------------------------------------------------------------------------\n\n/** Structured package manager info the agent can act on */\nexport interface DetectedPackageManager {\n  name: string;\n  label: string;\n  installCommand: string;\n  runCommand?: string;\n}\n\n/** Result returned by every detector */\nexport interface PackageManagerInfo {\n  detected: DetectedPackageManager[];\n  primary: DetectedPackageManager | null;\n  recommendation: string;\n}\n\n/** Signature each framework implements */\nexport type PackageManagerDetector = (\n  installDir: string,\n) => Promise<PackageManagerInfo>;\n\n// ---------------------------------------------------------------------------\n// Node.js helper\n// ---------------------------------------------------------------------------\n\nfunction serializeNodePM(pm: PackageManager): DetectedPackageManager {\n  return {\n    name: pm.name,\n    label: pm.label,\n    installCommand: pm.installCommand,\n    runCommand: pm.runScriptCommand,\n  };\n}\n\n/**\n * Detect Node.js package managers via lockfiles.\n * Wraps detectAllPackageManagers() above.\n */\nexport function detectNodePackageManagers(\n  installDir: string,\n): Promise<PackageManagerInfo> {\n  const detected = detectAllPackageManagers({ installDir }).map(\n    serializeNodePM,\n  );\n\n  if (detected.length === 0) {\n    return Promise.resolve({\n      detected: [],\n      primary: null,\n      recommendation: 'No lockfile found. Default to npm (npm add, npm run).',\n    });\n  }\n\n  const primary = detected[0];\n  return Promise.resolve({\n    detected,\n    primary,\n    recommendation:\n      detected.length === 1\n        ? `Use ${primary.label} (${primary.installCommand}).`\n        : `Multiple package managers detected. Prefer ${primary.label} (${primary.installCommand}).`,\n  });\n}\n"],"mappings":";;;;;;AAoBA,SAAS,YAAY,YAAoB,MAAuB;AAC9D,QAAOA,KAAG,WAAWC,OAAK,KAAK,YAAY,KAAK,CAAC;;AAGnD,SAAS,uBACP,YACA,MACA,QACS;AAET,QACE,aAAaA,OAAK,KAAK,YAAY,KAAK,EAAE,IAAI,EAAE,SAAS,OAAO,IAAI;;AAsExE,MAAa,kBAAoC;CAlEd;EACjC,MAAM;EACN,OAAO;EACP,gBAAgB;EAChB,cAAc;EACd,kBAAkB;EAClB,OAAO;EACP,SAAS,EAAE,iBACT,YAAY,YAAY,YAAY,IAAI,YAAY,YAAY,WAAW;EAC9E;CAEsC;EACrC,MAAM;EACN,OAAO;EACP,gBAAgB;EAChB,cAAc;EACd,kBAAkB;EAClB,OAAO;EACP,SAAS,EAAE,iBACT,uBAAuB,YAAY,aAAa,mBAAmB;EACtE;CAGsC;EACrC,MAAM;EACN,OAAO;EACP,gBAAgB;EAChB,cAAc;EACd,kBAAkB;EAClB,OAAO;EACP,SAAS,EAAE,iBACT,uBAAuB,YAAY,aAAa,aAAa;EAChE;CAEmC;EAClC,MAAM;EACN,OAAO;EACP,gBAAgB;EAChB,cAAc;EACd,kBAAkB;EAClB,OAAO;EACP,SAAS,EAAE,iBAAiB,YAAY,YAAY,iBAAiB;EACtE;CAEkC;EACjC,MAAM;EACN,OAAO;EACP,gBAAgB;EAChB,cAAc;EACd,kBAAkB;EAClB,OAAO;EACP,SAAS,EAAE,iBAAiB,YAAY,YAAY,oBAAoB;EACzE;CAImC;EAClC,MAAM;EACN,OAAO;EACP,gBAAgB;EAChB,cAAc;EACd,kBAAkB;EAClB,OAAO;EACP,cAAc;EACf;CASA;AAED,SAAgB,yBAAyB,EACvC,cACkC;AAClC,QAAO,aAAa,gCAAgC;EAClD,MAAM,UAAU,gBAAgB,QAAQ,OAAO,GAAG,OAAO,EAAE,YAAY,CAAC,CAAC;AACzE,MAAI,QAAQ,WAAW,EACrB,WAAU,OAAO,mBAAmB,eAAe;AAErD,SAAO;GACP;;AA+BJ,SAAS,gBAAgB,IAA4C;AACnE,QAAO;EACL,MAAM,GAAG;EACT,OAAO,GAAG;EACV,gBAAgB,GAAG;EACnB,YAAY,GAAG;EAChB;;;;;;AAOH,SAAgB,0BACd,YAC6B;CAC7B,MAAM,WAAW,yBAAyB,EAAE,YAAY,CAAC,CAAC,IACxD,gBACD;AAED,KAAI,SAAS,WAAW,EACtB,QAAO,QAAQ,QAAQ;EACrB,UAAU,EAAE;EACZ,SAAS;EACT,gBAAgB;EACjB,CAAC;CAGJ,MAAM,UAAU,SAAS;AACzB,QAAO,QAAQ,QAAQ;EACrB;EACA;EACA,gBACE,SAAS,WAAW,IAChB,OAAO,QAAQ,MAAM,IAAI,QAAQ,eAAe,MAChD,8CAA8C,QAAQ,MAAM,IAAI,QAAQ,eAAe;EAC9F,CAAC"}

package/dist/{pi-DTj1hsJe.js → pi-BSnSk6rv.js}

@@ -1,10 +1,10 @@
 import { n as ErrorCodes } from "./emit-BqLCdV8Y.js";
-import { f as VERSION, i as getLogFilePath, o as logToFile } from "./debug-BvEbemym.js";
-import { $ as WIZARD_REMARK_EVENT_NAME, it as wizardUserAgentForProgram, n as analytics } from "./analytics-B_xFshPY.js";
-import { t as classifyRunFailure } from "./errors-DhFeR8Sp.js";
-import { n as currentAccessToken } from "./oauth-session-Bi1MLRCC.js";
-import { c as REMARK_INSTRUCTION, d as gatewayAuth, o as withGatewayRemint, r as buildGatewayProvider, s as AgentSignals, t as GATEWAY_PROVIDER } from "./gateway-CWoYlPz7.js";
-import { g as assembleCommandments, h as AgentOutputSignals } from "./agent-interface-3YfIWZmY.js";
+import { f as VERSION, i as getLogFilePath, o as logToFile } from "./debug-BfO_Txo8.js";
+import { n as analytics, ot as wizardUserAgentForProgram, tt as WIZARD_REMARK_EVENT_NAME } from "./analytics-Drox5LSW.js";
+import { t as classifyRunFailure } from "./errors-BXlWujEw.js";
+import { n as currentAccessToken } from "./oauth-session-9EU3ky0v.js";
+import { c as AgentSignals, d as policyAbortReason, i as createGatewayRuntime, l as REMARK_INSTRUCTION, p as gatewayAuth, r as buildGatewayProvider, s as withGatewayRemint, t as GATEWAY_PROVIDER } from "./gateway-CLQQb96F.js";
+import { g as assembleCommandments, h as AgentOutputSignals } from "./agent-interface-BNssNetq.js";
 import fs from "fs";
 import path from "path";
 function appendStatus(messages, message) {
@@ -376,10 +376,13 @@ function bindPiCancellation(signal, session, onAbortError) {
 	};
 	signal?.addEventListener("abort", onAbort, { once: true });
 	if (signal?.aborted) onAbort();
-	return { async settle() {
-		signal?.removeEventListener("abort", onAbort);
-		await abortPromise;
-	} };
+	return {
+		abort: onAbort,
+		async settle() {
+			signal?.removeEventListener("abort", onAbort);
+			await abortPromise;
+		}
+	};
 }
 //#endregion
 //#region src/agent/runner/harness/pi/structured-output.ts
@@ -597,8 +600,9 @@ const piBackend = {
 				duration_seconds: Math.round(durationMs / 1e3)
 			};
 		};
-		const captureAborted = (failureMode) => analytics.wizardCapture("agent aborted", {
+		const captureAborted = (failureMode, source) => analytics.wizardCapture("agent aborted", {
 			failure_mode: failureMode,
+			...source && { source },
 			...runDurations(),
 			model: modelId
 		});
@@ -616,6 +620,13 @@ const piBackend = {
 		let cancellation;
 		let timedOut = false;
 		let timeoutAbort;
+		let abortReason;
+		let remarkTurn = false;
+		const policyAbort = (reply) => {
+			if (remarkTurn) return;
+			abortReason ??= policyAbortReason(reply);
+			if (abortReason) cancellation?.abort();
+		};
 		let securityState;
 		const yaraViolationResult = () => {
 			spinner.stop("Security violation detected");
@@ -627,7 +638,7 @@ const piBackend = {
 			};
 		};
 		try {
-			const { createAgentSession, DefaultResourceLoader, SessionManager, AuthStorage, ModelRegistry, getAgentDir, createLsToolDefinition, createFindToolDefinition, createGrepToolDefinition, createBashToolDefinition, createReadToolDefinition, createEditToolDefinition, createWriteToolDefinition } = await import("@earendil-works/pi-coding-agent");
+			const { createAgentSession, DefaultResourceLoader, SessionManager, getAgentDir, createLsToolDefinition, createFindToolDefinition, createGrepToolDefinition, createBashToolDefinition, createReadToolDefinition, createEditToolDefinition, createWriteToolDefinition } = await import("@earendil-works/pi-coding-agent");
 			const refreshAuth = async () => gatewayAuth(boot.credentials.host, await currentAccessToken(boot.credentials), boot.programId);
 			const auth = await refreshAuth();
 			const providerInputs = (current) => ({
@@ -640,16 +651,15 @@ const piBackend = {
 				effort: inputs.thinkingLevel
 			});
 			const { provider, caps, api } = buildGatewayProvider(providerInputs(auth));
-			const registry = ModelRegistry.inMemory(AuthStorage.create());
-			registry.registerProvider(GATEWAY_PROVIDER, provider);
-			const model = registry.find(GATEWAY_PROVIDER, modelId);
+			const registry = await createGatewayRuntime(provider);
+			const model = registry.getModel(GATEWAY_PROVIDER, modelId);
 			if (!model) return {
 				kind: "failure",
 				classification: "WIZARD_API_ERROR",
 				message: "pi: gateway model could not be resolved"
 			};
 			const askState = { pending: false };
-			const { createSecurityExtension, READ_ONLY_PI_TOOLS } = await import("./security-Cz3a-d7r.js");
+			const { createSecurityExtension, READ_ONLY_PI_TOOLS } = await import("./security-pApVawYb.js");
 			const security = createSecurityExtension({
 				readOnly: config.readOnly,
 				disallowedTools: runConfig.disallowedTools,
@@ -658,13 +668,13 @@ const piBackend = {
 				workingDirectory: input.installDir
 			});
 			securityState = security.state;
-			const { prewarmYaraScanner } = await import("./yara-hooks-CxksH-GZ.js");
+			const { prewarmYaraScanner } = await import("./yara-hooks-MDtFbuoM.js");
 			prewarmYaraScanner();
 			const extensionFactories = [security.factory];
 			let mcpInstructions;
 			let posthogMcp = false;
 			if (!config.readOnly) try {
-				const { setupPostHogMcp, fetchInstructions } = await import("./mcp-Buf9sfFm.js");
+				const { setupPostHogMcp, fetchInstructions } = await import("./mcp-KVV6Z_bq.js");
 				const mcpToken = await currentAccessToken(boot.credentials);
 				const mcpUserAgent = wizardUserAgentForProgram(config.integrationLabel);
 				const instructionsPromise = fetchInstructions(boot.credentials.host.mcpUrl, mcpToken, mcpUserAgent);
@@ -710,9 +720,9 @@ const piBackend = {
 				extensionFactories
 			});
 			await resourceLoader.reload();
-			const { createWizardPiTools } = await import("./tools-Bm0FDT6f.js");
-			const { createWizardPiTaskTools } = await import("./tasks-BfJhVky2.js");
-			const { createDispatchAgentTool } = await import("./subagent-BBfETG17.js");
+			const { createWizardPiTools } = await import("./tools-DyzRi_dQ.js");
+			const { createWizardPiTaskTools } = await import("./tasks-C03QbXTx.js");
+			const { createDispatchAgentTool } = await import("./subagent-YLGSvgoZ.js");
 			const wizardTaskTools = createWizardPiTaskTools((tasks) => emit({
 				kind: "tasks",
 				tasks
@@ -747,7 +757,7 @@ const piBackend = {
 				...wizardTaskTools.tools,
 				createDispatchAgentTool({
 					model,
-					modelRegistry: registry,
+					modelRuntime: registry,
 					cwd: input.installDir,
 					agentDir: getAgentDir(),
 					securityFactory: security.subagentFactory,
@@ -761,7 +771,7 @@ const piBackend = {
 			].filter((tool) => !config.readOnly || READ_ONLY_PI_TOOLS.has(tool.name));
 			const { session: agentSession } = await createAgentSession({
 				model,
-				modelRegistry: registry,
+				modelRuntime: registry,
 				thinkingLevel: caps.thinkingLevel,
 				cwd: input.installDir,
 				sessionManager: SessionManager.inMemory(input.installDir),
@@ -795,6 +805,7 @@ const piBackend = {
 						turns.noteAssistantTurn(event.message);
 						const blocks = textBlocks(event.message);
 						const assistant = blocks.join("").trim();
+						policyAbort(assistant);
 						lastAssistantText = (blocks.at(-1) ?? "").trim();
 						if (structured) inputs.middleware?.onMessage({
 							type: "assistant",
@@ -834,6 +845,7 @@ const piBackend = {
 					}
 					case "tool_execution_end":
 						logToFile(`[pi] ${event.isError ? "✗" : "←"} ${event.toolName}: ${typeof event.result === "string" ? event.result : JSON.stringify(event.result ?? "")}`);
+						if (event.toolName === "dispatch_agent") policyAbort(extractText(event.result));
 						break;
 					case "agent_end":
 						logToFile(`[pi] agent_end (willRetry=${String(event.willRetry)})`);
@@ -858,16 +870,19 @@ const piBackend = {
 				await turns.prompt(prompt);
 				terminal = turns.terminalFailure();
 				let continueNudges = 0;
-				while (!structured && continueNudges < MAX_CONTINUE_NUDGES && !security.state.criticalViolation && !inputs.signal?.aborted && !terminal && !setupSignalFailure(signals) && hasOpenTasks(wizardTaskTools.store)) {
+				while (!structured && continueNudges < MAX_CONTINUE_NUDGES && !security.state.criticalViolation && !inputs.signal?.aborted && !terminal && !abortReason && !setupSignalFailure(signals) && hasOpenTasks(wizardTaskTools.store)) {
 					continueNudges += 1;
 					logToFile(`[pi] completion guard: tasks still open, nudge ${continueNudges}/${MAX_CONTINUE_NUDGES}`);
 					await turns.prompt(CONTINUE_INSTRUCTION);
 					terminal = turns.terminalFailure();
 				}
-				if (!structured && !security.state.criticalViolation && !terminal && !setupSignalFailure(signals) && !inputs.signal?.aborted) try {
-					await agentSession.prompt(REMARK_INSTRUCTION);
-				} catch (err) {
-					logToFile(`[pi] remark request failed: ${String(err)}`);
+				if (!structured && !security.state.criticalViolation && !terminal && !abortReason && !setupSignalFailure(signals) && !inputs.signal?.aborted) {
+					remarkTurn = true;
+					try {
+						await agentSession.prompt(REMARK_INSTRUCTION);
+					} catch (err) {
+						logToFile(`[pi] remark request failed: ${String(err)}`);
+					}
 				}
 			} finally {
 				if (timeout) clearTimeout(timeout);
@@ -881,9 +896,13 @@ const piBackend = {
 				message: "Agent run cancelled"
 			};
 			if (timedOut && structured && !security.state.criticalViolation) return timedOutResult(structured.timeoutMs);
+			if (abortReason) terminal = {
+				classification: "WIZARD_ABORT",
+				message: abortReason
+			};
 			if (terminal && !security.state.criticalViolation) {
 				spinner.stop(config.errorMessage ?? `${config.integrationLabel} failed`);
-				captureAborted(terminal.classification);
+				captureAborted(terminal.classification, abortReason ? "gateway_policy" : void 0);
 				if (terminal.status === 401) return {
 					kind: "decided_failure",
 					failure: {
@@ -1014,11 +1033,11 @@ const piBackend = {
 		}
 	},
 	async runTask(inputs) {
-		const { runPiTask } = await import("./task-CmNe3xeg.js");
+		const { runPiTask } = await import("./task-3hRSovmK.js");
 		return runPiTask(inputs);
 	}
 };
 //#endregion
 export { piBackend as a, runErrorType as c, createEmitLog as d, createEmitSpinner as f, lastStatusLine as i, setupSignalFailure as l, appendStatus as m, buildScrubbedEnv as n, withMode as o, createProgressCollector as p, extractText as r, bindPiCancellation as s, applyOutroMarkers as t, createAioCapture as u };
 
-//# sourceMappingURL=pi-DTj1hsJe.js.map
+//# sourceMappingURL=pi-BSnSk6rv.js.map