@posthog/wizard 2.83.0 → 2.84.0

package/dist/programs-Bv0_YHzE.js

@@ -0,0 +1,3 @@
+import "./programs-mxhRXwP-.js";
+import { D as FRAMEWORK_REGISTRY } from "./posthog-integration-mIQGBc1f.js";
+export { FRAMEWORK_REGISTRY };

package/dist/{programs-eTv2T2rs.js → programs-mxhRXwP-.js}

@@ -1,18 +1,18 @@
 import { n as ErrorCodes } from "./emit-BqLCdV8Y.js";
-import { f as VERSION, l as WIZARD_TASK_STREAM_FILE, o as logToFile, p as HEADLESS_FLAG } from "./debug-BTUMatFI.js";
-import { $ as WIZARD_PROVISIONING_SCOPES, C as GPT6_SOL_MODEL, D as ISSUES_URL, K as WIZARD_CONTACT_EMAIL, L as POSTHOG_PROXY_CLIENT_ID, M as POSTHOG_DEV_CLIENT_ID, N as POSTHOG_DOCS_URL, R as POSTHOG_STATUS_PAGE_URL, S as GPT5_6_TERRA_MODEL, V as REPLAY_VISION_SUPPORTED, Y as WIZARD_OAUTH_SCOPES, f as DEFAULT_AGENT_MODEL, ft as resolveLocalDev, h as EVENTS_AUDIT_REPORT_FILE, it as getSkillsBaseUrl, n as analytics, o as mayReportScanResults, r as groupsFromUser, rt as WIZARD_USER_AGENT } from "./analytics-GQv--mQm.js";
-import { a as WizardError, n as sanitizeErrorDetail, t as classifyRunFailure } from "./errors-DhFeR8Sp.js";
-import { i as readProjectFile, t as IGNORED_DIRS } from "./bounded-fs-B31zq2ir.js";
-import { n as isUsingTypeScript } from "./setup-utils-B5E1rXLa.js";
-import { l as markGrantRevoked, r as currentCredentials, s as rotateAfterUnauthorized, t as configureOAuthSession } from "./oauth-session-CfkZ339p.js";
-import { h as checkSkillsOriginHealth, s as AgentSignals } from "./gateway-CJ8Jqbll.js";
-import { R as WIZARD_TOOL_NAMES, c as checkAllSettingsConflicts, d as restoreClaudeSettings, l as classifySettingsConflicts, nt as LONGER_ASK_TIMEOUT_MS, p as registerCleanup, s as backupAndFixClaudeSettings } from "./agent-interface-fcDXqb-_.js";
-import { a as getOAuthUrl, s as resolveBaseUrl } from "./urls-BTZhm5eA.js";
-import { C as FRAMEWORK_REGISTRY, D as runAgent, O as DEFAULT_BINDING, S as detectFramework, _ as detectProjectsWithAgent, a as detectPostHogIntegration, b as noteDetectedFramework, d as DETECTED_WAREHOUSE_SOURCES_KEY, f as detectWarehouseSources, g as toIntegrationCandidates, h as scopeInstallDirToProject, i as ProgramAbort, m as detectIntegrationProjects, n as WAREHOUSE_SOURCE_SCOPE_ADDITIONS, o as reportWarehouseSourcesDetected, p as getDetectedWarehouseSources, r as abortNoFrameworkDetected, s as stampAiSdkDetected, t as config$14, u as findPackageJsons, v as resolveProjectDir, w as SPINNER_MESSAGE, x as gatherFrameworkContext } from "./posthog-integration-DxRkw5DI.js";
-import { m as appendStatus } from "./pi-2pYz2OY3.js";
-import { y as writeJsonAtomic } from "./queue-tools-10w8lhEs.js";
-import { C as coerceAuditChecks, S as AUDIT_REPORT_FILE, x as AUDIT_CHECKS_FILE } from "./yara-hooks-BPYhN9WM.js";
-import { t as resolveApiKeyProject } from "./api-key-login-tysMeZnR.js";
+import { f as VERSION, l as WIZARD_TASK_STREAM_FILE, o as logToFile, p as HEADLESS_FLAG } from "./debug-BfO_Txo8.js";
+import { C as GPT5_6_TERRA_MODEL, H as REPLAY_VISION_SUPPORTED, N as POSTHOG_DEV_CLIENT_ID, O as ISSUES_URL, P as POSTHOG_DOCS_URL, R as POSTHOG_PROXY_CLIENT_ID, X as WIZARD_OAUTH_SCOPES, at as getSkillsBaseUrl, et as WIZARD_PROVISIONING_SCOPES, g as EVENTS_AUDIT_REPORT_FILE, it as WIZARD_USER_AGENT, n as analytics, o as mayReportScanResults, p as DEFAULT_AGENT_MODEL, pt as resolveLocalDev, q as WIZARD_CONTACT_EMAIL, r as groupsFromUser, w as GPT6_SOL_MODEL, z as POSTHOG_STATUS_PAGE_URL } from "./analytics-Drox5LSW.js";
+import { a as WizardError, n as sanitizeErrorDetail, t as classifyRunFailure } from "./errors-BXlWujEw.js";
+import { i as readProjectFile, t as IGNORED_DIRS } from "./bounded-fs-TRL6IsoU.js";
+import { n as isUsingTypeScript } from "./setup-utils-CQY8PHjR.js";
+import { l as markGrantRevoked, r as currentCredentials, s as rotateAfterUnauthorized, t as configureOAuthSession } from "./oauth-session-9EU3ky0v.js";
+import { c as AgentSignals, g as checkSkillsOriginHealth } from "./gateway-CLQQb96F.js";
+import { R as WIZARD_TOOL_NAMES, c as checkAllSettingsConflicts, d as restoreClaudeSettings, l as classifySettingsConflicts, nt as LONGER_ASK_TIMEOUT_MS, p as registerCleanup, s as backupAndFixClaudeSettings } from "./agent-interface-BNssNetq.js";
+import { a as getOAuthUrl, s as resolveBaseUrl } from "./urls-WeqfBLP4.js";
+import { D as FRAMEWORK_REGISTRY, E as detectFramework, M as DEFAULT_BINDING, O as SPINNER_MESSAGE, S as tagScanResults, T as gatherFrameworkContext, _ as scopeInstallDirToProject, a as detectPostHogIntegration, b as resolveProjectDir, d as scanCodebaseFor, f as scannedWarehouseSources, g as detectIntegrationProjects, h as workspaceFingerprint, i as ProgramAbort, j as runAgent, l as findPackageJsons, m as getDetectedWarehouseSources, n as WAREHOUSE_SOURCE_SCOPE_ADDITIONS, o as reportWarehouseSourcesDetected, p as DETECTED_WAREHOUSE_SOURCES_KEY, r as abortNoFrameworkDetected, t as config$14, u as getCodebaseScan, v as toIntegrationCandidates, w as noteDetectedFramework, x as applyScanTags, y as detectProjectsWithAgent } from "./posthog-integration-mIQGBc1f.js";
+import { m as appendStatus } from "./pi-BSnSk6rv.js";
+import { y as writeJsonAtomic } from "./queue-tools-PFG6H93Q.js";
+import { C as AUDIT_REPORT_FILE, S as AUDIT_CHECKS_FILE, w as coerceAuditChecks } from "./yara-hooks-aDbdsitJ.js";
+import { t as resolveApiKeyProject } from "./api-key-login-BgwfAXfv.js";
 import { valid } from "semver";
 import * as fs$1 from "fs";
 import fs, { existsSync, readFileSync, readdirSync, statSync } from "fs";
@@ -248,20 +248,23 @@ const MCP_ANALYTICS_ABORT_CASES = [
 * 'mcp-analytics'` from context-mill — a deliberate breaking change, done then,
 * not pre-emptively.
 */
-const config$13 = createSkillProgram({
-	skillId: "mcp-analytics",
-	command: "mcp-analytics",
-	id: "mcp-analytics",
-	description: "Add PostHog MCP Analytics to your MCP server",
-	integrationLabel: "mcp-analytics",
-	customPrompt: `Instrument this project's MCP server with PostHog MCP analytics. Run the \`mcp-analytics\` skill end-to-end: detect the language and server style, install the PostHog MCP SDK for that language (\`@posthog/mcp\` for TypeScript, \`posthog\` for Python, \`posthogmcpsdk\` for Go, \`posthog-ruby\` for Ruby), wrap the server (or use the custom-dispatcher client where the skill says so), wire the project API key and host, and verify. Make only additive changes — do not alter tool behavior. For a Ruby server, the report must open by saying the Ruby SDK is experimental and not officially supported. The final report is written to ./${MCP_ANALYTICS_REPORT_FILE}.`,
-	successMessage: `MCP analytics configured! View the report at ./${MCP_ANALYTICS_REPORT_FILE}`,
-	reportFile: MCP_ANALYTICS_REPORT_FILE,
-	docsUrl: "https://posthog.com/docs/mcp-analytics",
-	spinnerMessage: "Setting up MCP analytics...",
-	estimatedDurationMinutes: 5,
-	abortCases: MCP_ANALYTICS_ABORT_CASES
-});
+const config$13 = {
+	decisions: ["is_mcp_server"],
+	...createSkillProgram({
+		skillId: "mcp-analytics",
+		command: "mcp-analytics",
+		id: "mcp-analytics",
+		description: "Add PostHog MCP Analytics to your MCP server",
+		integrationLabel: "mcp-analytics",
+		customPrompt: `Instrument this project's MCP server with PostHog MCP analytics. Run the \`mcp-analytics\` skill end-to-end: detect the language and server style, install the PostHog MCP SDK for that language (\`@posthog/mcp\` for TypeScript, \`posthog\` for Python, \`posthogmcpsdk\` for Go, \`posthog-ruby\` for Ruby), wrap the server (or use the custom-dispatcher client where the skill says so), wire the project API key and host, and verify. Make only additive changes — do not alter tool behavior. For a Ruby server, the report must open by saying the Ruby SDK is experimental and not officially supported. The final report is written to ./${MCP_ANALYTICS_REPORT_FILE}.`,
+		successMessage: `MCP analytics configured! View the report at ./${MCP_ANALYTICS_REPORT_FILE}`,
+		reportFile: MCP_ANALYTICS_REPORT_FILE,
+		docsUrl: "https://posthog.com/docs/mcp-analytics",
+		spinnerMessage: "Setting up MCP analytics...",
+		estimatedDurationMinutes: 5,
+		abortCases: MCP_ANALYTICS_ABORT_CASES
+	})
+};
 //#endregion
 //#region src/programs/replay-vision/scopes.ts
 /**
@@ -357,6 +360,11 @@ async function detectReplayVisionProject(ctx) {
 *   headless equivalent of `onReady`.
 */
 const config$12 = {
+	decisions: [
+		"framework",
+		"web_frontend",
+		"primary_user_flow"
+	],
 	...createSkillProgram({
 		skillId: "replay-vision-setup",
 		command: "replay-vision",
@@ -415,6 +423,7 @@ const AI_OBSERVABILITY_REPORT_FILE = "posthog-ai-observability-report.md";
 * "add AIO to a project" flow is the only action.
 */
 const config$11 = {
+	decisions: ["calls_llm_api"],
 	binding: {
 		sequence: "linear",
 		harness: "pi",
@@ -1267,6 +1276,7 @@ function detectRevenuePrerequisites(session, setFrameworkContext) {
 //#endregion
 //#region src/programs/revenue-analytics/index.ts
 const config$6 = {
+	decisions: ["billing_code"],
 	command: "revenue-analytics",
 	description: "Set up PostHog for Revenue Analytics",
 	id: "revenue-analytics-setup",
@@ -1292,7 +1302,7 @@ const config$6 = {
 /**
 * Warehouse-source program detection step.
 *
-* Thin adapter over `detectWarehouseSources` that writes results into
+* Reads the run's codebase scan and writes a `detectError` into
 * frameworkContext for the intro screen, plus the `[ABORT]` cases the
 * data-warehouse-source-setup skill can emit.
 */
@@ -1309,10 +1319,10 @@ const WAREHOUSE_ABORT_CASES = [{
 	docsUrl: "https://posthog.com/docs/data-warehouse"
 }];
 /**
-* Scan `session.installDir` for warehouse-source signals. Writes the detected
-* sources (or a `detectError`) into frameworkContext for the intro screen.
+* Check the run's codebase scan for warehouse sources. Writes a `detectError`
+* into frameworkContext for the intro screen when there is nothing to set up.
 */
-function detectWarehousePrerequisites(session, setFrameworkContext) {
+async function detectWarehousePrerequisites(session, setFrameworkContext) {
 	const fail = (error) => setFrameworkContext("detectError", error);
 	const installDir = session.installDir;
 	if (!existsSync(installDir)) {
@@ -1344,14 +1354,16 @@ function detectWarehousePrerequisites(session, setFrameworkContext) {
 		});
 		return;
 	}
-	const sources = detectWarehouseSources(installDir);
+	const sources = await scannedWarehouseSources(session);
 	if (sources.length === 0) {
 		fail({ kind: "no-sources" });
 		return;
 	}
-	analytics.setTag("warehouse_source_kinds", sources.map((s) => s.kind).join(","));
-	analytics.setTag("warehouse_source_modes", sources.map((s) => `${s.kind}:${s.mode}`).join(","));
-	analytics.setTag("warehouse_source_count", sources.length);
+	tagScanResults(session, setFrameworkContext, {
+		warehouse_source_kinds: sources.map((s) => s.kind).join(","),
+		warehouse_source_modes: sources.map((s) => `${s.kind}:${s.mode}`).join(","),
+		warehouse_source_count: sources.length
+	});
 	setFrameworkContext(DETECTED_WAREHOUSE_SOURCES_KEY, sources);
 }
 //#endregion
@@ -1375,10 +1387,12 @@ function buildPrompt(session) {
 	].join("\n");
 }
 const config$5 = {
+	decisions: ["owns_database"],
 	command: "warehouse",
 	description: "Detect and connect Data Warehouse sources",
 	id: "warehouse-source",
 	skillId: "data-warehouse-source-setup",
+	scansCodebase: true,
 	onReady: (ctx) => detectWarehousePrerequisites(ctx.session, ctx.setFrameworkContext),
 	oauthScopeAdditions: WAREHOUSE_SOURCE_SCOPE_ADDITIONS,
 	healthCheck: false,
@@ -1585,6 +1599,11 @@ const SELF_DRIVING_ABORT_CASES = [
 		message: "Interactive terminal required",
 		body: "Self-driving setup asks questions along the way (GitHub and issue trackers), so it needs an interactive terminal. Run the wizard outside CI / non-interactive mode."
 	},
+	{
+		match: /^wrong-project$/i,
+		message: "This repo uses a different PostHog project",
+		body: "Nothing was changed. Run the wizard again with --project-id set to the project this repo sends events to. The id is the number after /project/ in that project's PostHog URL."
+	},
 	{
 		match: /^requirements-incomplete$/i,
 		message: "Setup needs your input",
@@ -1596,7 +1615,7 @@ const SELF_DRIVING_ABORT_CASES = [
 * `SelfDrivingDetectError` to frameworkContext on failure — the intro
 * screen renders it and blocks.
 */
-function detectSelfDrivingPrerequisites(session, setFrameworkContext) {
+async function detectSelfDrivingPrerequisites(session, setFrameworkContext) {
 	const fail = (error) => setFrameworkContext("detectError", error);
 	const installDir = session.installDir;
 	if (!existsSync(installDir)) {
@@ -1625,9 +1644,9 @@ function detectSelfDrivingPrerequisites(session, setFrameworkContext) {
 		return;
 	}
 	setFrameworkContext(POSTHOG_PRESENT_KEY, detectPostHogPresent(installDir));
-	detectConnectedTools(installDir, setFrameworkContext);
+	await detectConnectedTools(session, setFrameworkContext);
 }
-/** Step 5's ask options intersected with `SOURCE_DETECTORS` — reconcile when the skill's catalog grows. */
+/** Step 5's ask options intersected with the tool catalog's kinds. Reconcile when the skill's catalog grows. */
 const SELF_DRIVING_TOOL_KINDS = new Set([
 	"Github",
 	"GitLab",
@@ -1651,18 +1670,21 @@ const SELF_DRIVING_TOOL_KINDS = new Set([
 	"Productboard",
 	"GoogleSearchConsole"
 ]);
-/** Scan for inbox-connectable tools so STEP 5 can surface them first. Best-effort — never blocks detection. */
-function detectConnectedTools(installDir, setFrameworkContext) {
-	try {
-		const tools = detectWarehouseSources(installDir).filter((s) => SELF_DRIVING_TOOL_KINDS.has(s.kind));
-		analytics.setTag("connected_tools_detected_count", tools.length);
-		if (tools.length === 0) return;
-		analytics.setTag("connected_tools_detected", tools.map((s) => s.kind).join(","));
-		setFrameworkContext(SELF_DRIVING_DETECTED_TOOLS_KEY, tools);
-	} catch (error) {
-		analytics.setTag("connected_tools_detected_count", -1);
-		analytics.captureException(error instanceof Error ? error : new Error(String(error)), { step: "detectConnectedTools" });
+/** Pick the inbox-connectable tools out of the run's codebase scan so STEP 5 can surface them first. */
+async function detectConnectedTools(session, setFrameworkContext) {
+	const scan = getCodebaseScan(session);
+	if (!scan) return;
+	if (scan.failed) {
+		tagScanResults(session, setFrameworkContext, { connected_tools_detected_count: -1 });
+		return;
 	}
+	const tools = (await scannedWarehouseSources(session)).filter((s) => SELF_DRIVING_TOOL_KINDS.has(s.kind));
+	tagScanResults(session, setFrameworkContext, {
+		connected_tools_detected_count: tools.length,
+		...tools.length > 0 && { connected_tools_detected: tools.map((s) => s.kind).join(",") }
+	});
+	if (tools.length === 0) return;
+	setFrameworkContext(SELF_DRIVING_DETECTED_TOOLS_KEY, tools);
 }
 //#endregion
 //#region src/programs/self-driving/prompt.ts
@@ -1776,6 +1798,19 @@ STEP 1 — Check Self-driving access. (skill: "Check access")
    and halt.
 
 STEP 2 — Read project and current Signals state. (skill: "Read context")
+   First confirm that this repo sends events to project ${ctx.projectId}.
+   The user picked that project on the PostHog login screen, and that
+   screen preselects the last project they opened in the browser, so it
+   can be the wrong one. Find the project token in this repo's PostHog
+   client setup (the init call, its env var, and that env var's value in
+   any .env file). This project's token is ${ctx.projectApiKey}. If the
+   repo's token is a different phc_ token, STOP before any write and ask
+   ONE wizard_ask: continue with project ${ctx.projectId}, or stop so they
+   can run the wizard again for the repo's project. Say which token the
+   repo uses and where. If they stop, emit
+   ${AgentSignals.ABORT} wrong-project
+   and halt. If the tokens match, or the repo has no literal token, go on.
+
    If ./posthog-setup-report.md exists, read it as a strong hint for what
    THIS repo instruments — but it is often absent (users frequently don't
    commit it), so do NOT depend on it. Combine whatever you find with the
@@ -2137,6 +2172,7 @@ const buildRun = (session) => Promise.resolve({
 	}
 });
 const config$4 = {
+	decisions: ["primary_user_flow", "user_login"],
 	...createSkillProgram({
 		skillId: SELF_DRIVING_SKILL_ID,
 		command: "self-driving",
@@ -2151,6 +2187,7 @@ const config$4 = {
 		requires: ["posthog-integration"],
 		abortCases: SELF_DRIVING_ABORT_CASES
 	}),
+	scansCodebase: true,
 	onReady: (ctx) => detectSelfDrivingPrerequisites(ctx.session, ctx.setFrameworkContext),
 	oauthScopeAdditions: SELF_DRIVING_SCOPE_ADDITIONS,
 	runSteps: { "integrate-run": {
@@ -2720,6 +2757,11 @@ function ensurePostHogCli(variant, log) {
 	preinstallPostHogCliOnce("source maps posthog-cli preinstall failed", { variant }, log);
 }
 const config$3 = {
+	decisions: [
+		"ships_minified_js",
+		"build_tool",
+		"deploy_platform"
+	],
 	command: "upload-source-maps",
 	description: "Upload source maps to PostHog Error Tracking",
 	id: "error-tracking-upload-source-maps",
@@ -2932,6 +2974,7 @@ const ERROR_TRACKING_RUN = {
 *   of the project picker.
 */
 const config$2 = {
+	decisions: ["web_frontend", "server_runtime"],
 	binding: {
 		sequence: "orchestrator",
 		harness: "pi",
@@ -3118,7 +3161,6 @@ function getSubcommandPrograms() {
 function getCommandPath(config) {
 	return config.parentCommand ? `${config.parentCommand} ${config.command}` : config.command;
 }
-/** The program with this id, or undefined for a tool's id or none. */
 function findProgramConfig(programId) {
 	return programId ? PROGRAM_REGISTRY.find((c) => c.id === programId) : void 0;
 }
@@ -3139,6 +3181,45 @@ function getProvisioningScopesForProgram(programId) {
 	return withScopeAdditions(WIZARD_PROVISIONING_SCOPES, findProgramConfig(programId)?.oauthScopeAdditions);
 }
 //#endregion
+//#region src/programs/codebase-scan/report.ts
+/**
+* The one place a codebase scan is cleared to leave the machine. Runs only
+* when the user granted sharing (CI and headless runs grant it) and telemetry
+* is on.
+*
+* Called when consent resolves (the intro's Continue) and again after login,
+* because either can happen first. Each part latches, so a run reports once:
+*   - the `warehouse sources detected` event, which needs no login
+*   - the scan, which needs the login for its fingerprint. This hands it to
+*     the task stream, which attaches it to the run's wizard session.
+*/
+function buildScanReport(scan, projectId) {
+	return {
+		program: scan.program,
+		wizard_version: VERSION,
+		workspace_fingerprint: workspaceFingerprint(projectId, scan.scannedDir),
+		scanned_at: scan.scannedAt,
+		complete: scan.complete,
+		tools: scan.tools.map((tool) => ({
+			kind: tool.kind,
+			signals: tool.signals
+		}))
+	};
+}
+function reportCodebaseScan(store) {
+	const { session } = store;
+	if (session.noTelemetry) return;
+	applyScanTags(session);
+	store.markWarehouseSourcesReportedIfNeeded();
+	if (!mayReportScanResults(session)) return;
+	const { credentials } = session;
+	if (!credentials) return;
+	if (session.codebaseScanReport) return;
+	const scan = getCodebaseScan(session);
+	if (!scan || scan.failed) return;
+	store.shareCodebaseScan(buildScanReport(scan, credentials.projectId));
+}
+//#endregion
 //#region src/programs/detect-map.ts
 const DETECT_CODES = {
 	"bad-directory": ErrorCodes.DetectBadDirectory,
@@ -3169,6 +3250,7 @@ function detectErrorCode(kind) {
 * when it has one, anything else its `onReady`. Marks detection complete.
 */
 async function detectProgram(config, store, runner) {
+	await scanCodebaseFor(config, store.readyContext());
 	const ciPreRun = config.ciPreRun;
 	if (store.session.ci && ciPreRun) await store.edit((draft) => ciPreRun(draft, {
 		...runner,
@@ -3735,9 +3817,10 @@ var SessionStore = class {
 	markWarehouseSourcesReportedIfNeeded() {
 		if (reportWarehouseSourcesDetected(this.session)) this.set("warehouseSourcesReported", true);
 	}
-	setAiSdkStampReported() {
-		if (this.session.aiSdkStampReported) return;
-		this.set("aiSdkStampReported", true);
+	/** Hand the scan to the task stream. First one wins: a run shares one scan. */
+	shareCodebaseScan(report) {
+		if (this.session.codebaseScanReport) return;
+		this.set("codebaseScanReport", report);
 	}
 	setReadinessResult(result) {
 		this.$session.setKey("readinessResult", result);
@@ -4108,15 +4191,7 @@ async function invokeProgram(programId, callerInput, options) {
 				plainSettings = settings;
 			}
 			credentials = await login();
-			if (!store.session.aiSdkStampReported) {
-				store.setAiSdkStampReported();
-				stampAiSdkDetected({
-					apiUser: credentials.apiUser,
-					discoveredFeatures: store.session.discoveredFeatures,
-					warehouseSources: getDetectedWarehouseSources(store.session),
-					mayReportScanResults: mayReportScanResults(store.session)
-				});
-			}
+			reportCodebaseScan(store);
 			if (needsAiApproval(store.session, credentials)) {
 				if (!options.workflow) return fail("AI processing approval is required before this program can run.");
 				if (!await park(options.workflow.confirmStep({
@@ -4189,6 +4264,7 @@ async function invokeProgram(programId, callerInput, options) {
 					agentFlow: planned.config.agentFlow,
 					excludedTaskTypes: planned.config.excludedTaskTypes,
 					seedTasks: planned.config.seedTasks ? () => planned.config.seedTasks(session()) : void 0,
+					projectFacts: void 0,
 					hooks: sessionHooks(agentRun, session, (outcomes) => {
 						if (scoped) scoped.frameworkContext[TASK_OUTCOMES_KEY] = outcomes;
 						else store.setFrameworkContext(TASK_OUTCOMES_KEY, outcomes);
@@ -4604,7 +4680,7 @@ function buildSession(args) {
 		model: args.model,
 		scanConsent: args.ci ? "granted" : "undecided",
 		warehouseSourcesReported: false,
-		aiSdkStampReported: false,
+		codebaseScanReport: null,
 		integration: args.integration ?? null,
 		frameworkContext: {},
 		typescript: false,
@@ -4754,11 +4830,22 @@ var PostHogDestination = class {
 		if (this.disabled) return;
 		const creds = this.getCredentials();
 		if (!creds) return;
-		await this.postWithRetry(creds, toWirePayload(payload));
+		if (await this.postSession(creds, toWirePayload(payload)) === "auth_rejected") this.disabled = true;
 	}
-	buildRequest(creds, body) {
+	async sendScan(payload) {
+		const creds = this.getCredentials();
+		if (!creds) return;
+		await this.postScan(creds, payload);
+	}
+	postSession(creds, body) {
+		return this.postWithRetry(creds, "wizard/sessions", body);
+	}
+	postScan(creds, body) {
+		return this.postWithRetry(creds, "wizard/scans", body);
+	}
+	buildRequest(creds, path, body) {
 		return {
-			url: `${creds.host.apiHost.replace(/\/$/, "")}/api/projects/${creds.projectId}/wizard/sessions/`,
+			url: `${creds.host.apiHost.replace(/\/$/, "")}/api/projects/${creds.projectId}/${path}/`,
 			init: {
 				method: "POST",
 				headers: {
@@ -4769,8 +4856,9 @@ var PostHogDestination = class {
 			}
 		};
 	}
-	async postWithRetry(creds, body) {
-		const { url, init } = this.buildRequest(creds, body);
+	/** POST with the retry policy above. Never throws. */
+	async postWithRetry(creds, path, body) {
+		const { url, init } = this.buildRequest(creds, path, body);
 		let attempt = 0;
 		let backoff = BASE_BACKOFF_MS;
 		let retriedAfter429 = false;
@@ -4782,26 +4870,25 @@ var PostHogDestination = class {
 			} catch (err) {
 				if (attempt >= MAX_ATTEMPTS) {
 					this.onError(err instanceof Error ? err : new Error(String(err)));
-					return;
+					return "gave_up";
 				}
 				await this.sleep(backoff);
 				backoff = Math.min(backoff * 2, MAX_BACKOFF_MS);
 				continue;
 			}
 			if (response.ok) {
-				logToFile(`[task-stream] wizard/sessions push ok: ${response.status}`);
-				return;
+				logToFile(`[task-stream] ${path} push ok: ${response.status}`);
+				return "sent";
 			}
 			const status = response.status;
 			if (status === 401 || status === 403) {
-				this.disabled = true;
-				this.onError(/* @__PURE__ */ new Error(`wizard/sessions auth failed: ${status}`));
-				return;
+				this.onError(/* @__PURE__ */ new Error(`${path} auth failed: ${status}`));
+				return "auth_rejected";
 			}
 			if (status === 429) {
 				if (retriedAfter429) {
-					this.onError(/* @__PURE__ */ new Error("wizard/sessions rate limited"));
-					return;
+					this.onError(/* @__PURE__ */ new Error(`${path} rate limited`));
+					return "gave_up";
 				}
 				retriedAfter429 = true;
 				const wait = parseRetryAfter(response.headers.get("Retry-After"));
@@ -4811,8 +4898,8 @@ var PostHogDestination = class {
 			}
 			if (status >= 500) {
 				if (attempt >= MAX_ATTEMPTS) {
-					this.onError(/* @__PURE__ */ new Error(`wizard/sessions server error: ${status}`));
-					return;
+					this.onError(/* @__PURE__ */ new Error(`${path} server error: ${status}`));
+					return "gave_up";
 				}
 				await this.sleep(backoff);
 				backoff = Math.min(backoff * 2, MAX_BACKOFF_MS);
@@ -4823,12 +4910,13 @@ var PostHogDestination = class {
 				try {
 					detail = await response.text();
 				} catch {}
-				this.onError(/* @__PURE__ */ new Error(`wizard/sessions bad request (400): ${detail}`));
-				return;
+				this.onError(/* @__PURE__ */ new Error(`${path} bad request (400): ${detail}`));
+				return "gave_up";
 			}
-			this.onError(/* @__PURE__ */ new Error(`wizard/sessions unexpected status: ${status}`));
-			return;
+			this.onError(/* @__PURE__ */ new Error(`${path} unexpected status: ${status}`));
+			return "gave_up";
 		}
+		return "gave_up";
 	}
 };
 //#endregion
@@ -4952,7 +5040,7 @@ var WizardRunSync = class {
 				type: "local_folder",
 				project_name: projectName
 			},
-			...valid("2.83.0") ? { wizard_version: VERSION } : {},
+			...valid("2.84.0") ? { wizard_version: VERSION } : {},
 			idempotency_key: randomUUID()
 		});
 		const result = await this.request("POST", "", body, this.tasksAbort.signal);
@@ -5277,6 +5365,8 @@ var TaskStreamPush = class {
 	unsubscribe = null;
 	debounceTimer = null;
 	inFlight = null;
+	/** The scan send, once the user agreed to share. Shutdown waits for it. */
+	scanInFlight = null;
 	needsAnotherPush = false;
 	shuttingDown = false;
 	constructor(opts) {
@@ -5305,6 +5395,7 @@ var TaskStreamPush = class {
 		if (this.unsubscribe) return;
 		const target = store ?? this.store;
 		this.unsubscribe = target.subscribe(() => this.onStoreChange());
+		this.sendScanIfShared();
 	}
 	/** Stop subscribing. Does not flush. */
 	detach() {
@@ -5335,8 +5426,8 @@ var TaskStreamPush = class {
 		this.detach();
 		if (!this.enabled) return;
 		const phase = this.store.session.runPhase;
-		if (!(phase === "completed" || phase === "error")) return;
-		const flush = this.flush();
+		const isTerminal = phase === "completed" || phase === "error";
+		const flush = Promise.all([isTerminal ? this.flush() : void 0, this.scanInFlight]);
 		if (timeoutMs <= 0) return;
 		let timer;
 		try {
@@ -5356,6 +5447,7 @@ var TaskStreamPush = class {
 	}
 	onStoreChange() {
 		if (!this.enabled || this.shuttingDown) return;
+		this.sendScanIfShared();
 		const phase = this.store.session.runPhase;
 		if (phase === "idle") return;
 		this.selectRemoteSync();
@@ -5441,6 +5533,20 @@ var TaskStreamPush = class {
 		this.lastPushedQuestionId = payload.pending_input?.id ?? null;
 		await Promise.all(this.destinations.filter((d) => d.name !== "posthog" || this.remoteSync === "wizard-session").map((d) => d.send(event, payload).catch(() => {})));
 	}
+	/**
+	* Attach the shared scan to this session, once. It carries the stream's
+	* `session_id`, so PostHog can join the scan to the session row.
+	*/
+	sendScanIfShared() {
+		if (this.scanInFlight) return;
+		const report = this.store.session.codebaseScanReport;
+		if (!report) return;
+		const payload = {
+			...report,
+			session_id: this.sessionId
+		};
+		this.scanInFlight = Promise.all(this.destinations.map((d) => d.sendScan?.(payload).catch(() => {}))).then(() => void 0);
+	}
 	selectRemoteSync() {
 		if (this.remoteSync || !this.store.session.credentials) return;
 		if (this.store.session.runPhase === "idle") return;
@@ -5477,6 +5583,6 @@ function apiKeyCredentials(apiKey, options = {}) {
 	}) };
 }
 //#endregion
-export { config$5 as $, getProvisioningScopesForProgram as A, detectSourceMapsProjects as B, oauthErrorFromTokenBody as C, getCommandPath as D, findProgramConfig as E, config$1 as F, NO_DEFAULT_LIMIT as G, MANUAL_SDK_VARIANTS as H, config$2 as I, detectSelfDrivingIntegrationProjects as J, PRICING_LONG as K, ERROR_TRACKING_PROJECT_PATH_KEY as L, config as M, FEATURE_FLAGS_STEP_SKILL_ID as N, getOAuthScopesForProgram as O, FEATURE_FLAGS_UNSUPPORTED as P, SELF_DRIVING_INTEGRATE_PATH_KEY as Q, detectErrorTrackingProjects as R, oauthErrorFromCallbackParams as S, regionOption as St, Program as T, SOURCE_MAPS_CONTEXT_KEYS as U, DISPLAY_NAME as V, config$4 as W, GITHUB_REQUIRED_MESSAGE as X, GITHUB_REQUIRED_BODY as Y, POSTHOG_PRESENT_KEY as Z, missingOAuthScopes as _, findTarget as _t, PostHogDestination as a, getAuditChecks as at, buildCallbackErrorHtml as b, headlessOption as bt, buildSession as c, evaluateWizardReadiness as ct, SessionStore as d, config$11 as dt, config$6 as et, applyAgentProgress as f, config$12 as ft, getOAuthClientId as g, detectTargets as gt, OAuthTokenResponseSchema as h, CLI_STEERING_TARGETS as ht, createWizardRunSync as i, withScopeAdditions as it, getSubcommandPrograms as j, getProgramConfig as k, TASK_OUTCOMES_KEY as l, getBlockingServiceKeys as lt, logIn as m, createSkillProgram as mt, resolveApiKeyLogin as n, config$8 as nt, createFileDestination as o, SERVICE_LABELS as ot, TaskStatus as p, config$13 as pt, PRICING_SHORT as q, TaskStreamPush as r, CONNECT_SLACK_SCOPE_ADDITIONS as rt, storeInteraction as s, SIGNUP_WIZARD_READINESS_CONFIG as st, apiKeyCredentials as t, config$7 as tt, runProgram as u, config$10 as ut, parseOAuthScopes as v, installOrUpdatePostHogCli as vt, PROGRAM_REGISTRY as w, buildOAuthFailureMessage as x, isHeadless as xt, OAuthError as y, installSteeringSnippet as yt, config$3 as z };
+export { SELF_DRIVING_INTEGRATE_PATH_KEY as $, getProgramConfig as A, config$3 as B, oauthErrorFromTokenBody as C, regionOption as Ct, findProgramConfig as D, Program as E, FEATURE_FLAGS_UNSUPPORTED as F, config$4 as G, DISPLAY_NAME as H, config$1 as I, PRICING_SHORT as J, NO_DEFAULT_LIMIT as K, config$2 as L, getSubcommandPrograms as M, config as N, getCommandPath as O, FEATURE_FLAGS_STEP_SKILL_ID as P, POSTHOG_PRESENT_KEY as Q, ERROR_TRACKING_PROJECT_PATH_KEY as R, oauthErrorFromCallbackParams as S, isHeadless as St, PROGRAM_REGISTRY as T, MANUAL_SDK_VARIANTS as U, detectSourceMapsProjects as V, SOURCE_MAPS_CONTEXT_KEYS as W, GITHUB_REQUIRED_BODY as X, detectSelfDrivingIntegrationProjects as Y, GITHUB_REQUIRED_MESSAGE as Z, missingOAuthScopes as _, detectTargets as _t, PostHogDestination as a, withScopeAdditions as at, buildCallbackErrorHtml as b, installSteeringSnippet as bt, buildSession as c, SIGNUP_WIZARD_READINESS_CONFIG as ct, SessionStore as d, config$10 as dt, config$5 as et, applyAgentProgress as f, config$11 as ft, getOAuthClientId as g, CLI_STEERING_TARGETS as gt, OAuthTokenResponseSchema as h, createSkillProgram as ht, createWizardRunSync as i, CONNECT_SLACK_SCOPE_ADDITIONS as it, getProvisioningScopesForProgram as j, getOAuthScopesForProgram as k, TASK_OUTCOMES_KEY as l, evaluateWizardReadiness as lt, logIn as m, config$13 as mt, resolveApiKeyLogin as n, config$7 as nt, createFileDestination as o, getAuditChecks as ot, TaskStatus as p, config$12 as pt, PRICING_LONG as q, TaskStreamPush as r, config$8 as rt, storeInteraction as s, SERVICE_LABELS as st, apiKeyCredentials as t, config$6 as tt, runProgram as u, getBlockingServiceKeys as ut, parseOAuthScopes as v, findTarget as vt, reportCodebaseScan as w, buildOAuthFailureMessage as x, headlessOption as xt, OAuthError as y, installOrUpdatePostHogCli as yt, detectErrorTrackingProjects as z };
 
-//# sourceMappingURL=programs-eTv2T2rs.js.map
+//# sourceMappingURL=programs-mxhRXwP-.js.map