fix: ff scopes for agent skill program (#604)

Author: edwinyjlim

src/lib/agent/agent-runner.ts

@@ -271,6 +271,7 @@ export async function runProgram(
     projectId: session.projectId,
     email: session.email,
     region: session.region,
+    programId: programConfig.id,
   });
 
   session.credentials = { accessToken, projectApiKey, host, projectId };

src/lib/oauth/program-scopes.ts

@@ -100,6 +100,22 @@ export const MCP_TUTORIAL_SCOPE_ADDITIONS = [
   'subscription:read',
 ] as const;
 
+/**
+ * Extra scopes the agent-skill program needs on top of `WIZARD_OAUTH_SCOPES`.
+ *
+ * Skills under this program (e.g. `creating-product-tours`) create feature
+ * flags during the install flow. PostHog's consent grants exactly the scope
+ * strings requested — `:write` does not imply `:read` — so listing existing
+ * flags to avoid key collisions needs `feature_flag:read` explicitly.
+ * `property_definition:read` lets the agent discover person properties when
+ * building flag rollout filters instead of having to ask the user verbatim.
+ */
+export const AGENT_SKILL_SCOPE_ADDITIONS = [
+  'feature_flag:read',
+  'feature_flag:write',
+  'property_definition:read',
+] as const;
+
 /**
  * Per-program scope additions, layered on top of `WIZARD_OAUTH_SCOPES`.
  *
@@ -117,6 +133,7 @@ const PROGRAM_SCOPE_ADDITIONS: Partial<Record<ProgramId, readonly string[]>> = {
   // key constraint catches renames at compile time — if `mcpTutorialConfig.id`
   // ever changes, this line will fail to type-check.
   'mcp-tutorial': MCP_TUTORIAL_SCOPE_ADDITIONS,
+  'agent-skill': AGENT_SKILL_SCOPE_ADDITIONS,
 };
 
 /**

src/lib/runners/run-wizard.ts

@@ -110,6 +110,7 @@ export function runWizard(
             ci: session.ci,
             apiKey: session.apiKey,
             projectId: session.projectId,
+            programId: config.id,
           });
         activeTui.store.setCredentials({
           accessToken,