Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@cli/src/commands/demo/command.ts`:
- Around line 467-468: The code awaits waitForKeyPress({ Enter: retryFn }, ...)
but then executes break, which discards the retry's return value and lets
handleStep1 resolve undefined; replace the break with a return (or return the
awaited call) so the recursive retry result from waitForKeyPress / retryFn is
propagated back to handleStep1 (look for waitForKeyPress and handleStep1 to
apply this change).
- Around line 308-323: The deleteRouterToken and createRouterToken calls
currently only inspect returned { error } objects and will crash on
transport-level ConnectError exceptions; wrap both
deleteRouterToken(tokenParams) and createRouterToken(tokenParams) calls in
try/catch blocks, catch transport errors (e.g., ConnectError), build the same
errorText and call captureOnboardingEvent with the same properties, log the
error, and call await waitForKeyPress({ r: retryFn, R: retryFn }, 'Hit [r] to
retry. CTRL+C to quit.') before returning; ensure you still handle the existing
deleteResult.error/createResult.error path inside the try and only rethrow
unexpected non-ConnectError exceptions if necessary.

In `@cli/src/commands/demo/util.ts`:
- Around line 198-207: The telemetry payload is leaking local filesystem details
by including cosmoDir and raw per-file error strings in error_message; update
the captureOnboardingEvent call in util.ts to omit cosmoDir and to sanitize
entries from failed (use safe identifiers like path.basename(f.path) or just the
filename and/or an error code/category instead of full error text) so
error_message contains only non-sensitive summary info (e.g., "Failed to fetch N
support files" plus a sanitized list like "  filename.ext: NETWORK_ERROR").
Ensure you update the variables failText/errorText and the error_message
property accordingly and keep captureOnboardingEvent usage intact.

In `@studio/src/components/onboarding/step-1.tsx`:
- Around line 51-53: The current assignment to referrer uses document.referrer
during render which breaks SSR; update the derivation so document is only
accessed on the client (e.g., compute the source using router.query.referrer ||
(typeof window !== 'undefined' ? document.referrer : '') or move the logic into
a useEffect/useMemo that runs client-side) and then pass that value into
normalizeReferrer; locate the referrer variable assignment and the
normalizeReferrer call in step-1.tsx to apply the guard.

In `@studio/src/components/onboarding/step-3.tsx`:
- Around line 201-215: The effect currently only fires when both timeouts are
true and mislabels the category; change the guard to run when either timeout is
true (use || instead of &&) and compute error_category/error_message from the
individual flags so that if polling.routerTimedOut is true it sets category to
'router' (and message to 'Router not detected within 5 minutes'), otherwise if
polling.metricsTimedOut is true it sets category to 'metrics' (and message to
'Metrics not detected within 5 minutes'); adjust the effect surrounding
captureOnboardingEvent(posthog, ...) and its dependency array if needed to
ensure it fires correctly for single-timeout cases.

In `@studio/src/hooks/use-onboarding-navigation.ts`:
- Around line 62-67: The code constructs pathWithParams by concatenating
?referrer=${referrer}, which can break on reserved characters; update the logic
in use-onboarding-navigation (where params, referrer, path, pathWithParams and
Router.replace are used) to URL-encode the referrer before appending (e.g., use
encodeURIComponent(referrer) or build the query via URLSearchParams) so
Router.replace receives a safe, correctly encoded URL.

---

Outside diff comments:
In `@cli/src/commands/demo/util.ts`:
- Around line 136-168: Wrap the GitHub tree fetch and JSON parse in a try/catch
around the await fetch(...) and await treeResponse.json() +
GitHubTreeSchema.safeParse logic so network failures and JSON parse errors are
caught; in the catch block call spinner.fail with an explanatory message, build
an errorText from the caught error (e.g. error.message), call
captureOnboardingEvent with the same properties used for other failures
(step_name: 'init', entry_source: 'wgc', error_category: 'support_files',
error_message: errorText), and finally call program.error(errorText); keep the
existing branches for non-ok responses and safeParse failures but ensure any
thrown exceptions are handled by this new try/catch around the treeResponse
fetch/parse.

In `@studio/src/components/onboarding/onboarding-provider.tsx`:
- Around line 43-49: Persisted currentStep may exceed the new max
(ONBOARDING_V1_LAST_STEP), so add a normalization guard: after reading
currentStep (the useSessionStorage value) and in any place that updates it
(e.g., where setCurrentStep or setStep is called, including the effect handling
onboarding/featureFlag changes around the existing logic at lines ~73-85), check
if currentStep !== undefined and currentStep > ONBOARDING_V1_LAST_STEP and if so
call setCurrentStep(ONBOARDING_V1_LAST_STEP) (or set to undefined if that fits
UX) to clamp the stored value; apply the same clamp any time you restore or
initialize the step so an old value like 4 is normalized to the valid max.

---

Nitpick comments:
In `@cli/test/demo/command.test.ts`:
- Around line 271-477: Add a new test that asserts the onboarding_step_completed
event for run_router_send_metrics is emitted on the first successful sample
query: call runDemo (via runDemo), simulate the user choosing the router flow
(keys.enter(); keys.press('r')), and mock demoUtil.runRouterContainer (and if
needed createFederatedGraphToken/deleteRouterToken) so the first sample query
returns success while subsequent queries may also succeed; then assert
demoUtil.captureOnboardingEvent was calledWith { name:
'onboarding_step_completed', properties: { step_name: 'run_router_send_metrics',
entry_source: 'wgc' } } and that this completion event for
run_router_send_metrics is only emitted once (e.g., toHaveBeenCalledTimes /
filter calls by step_name). Ensure you reference runDemo,
demoUtil.runRouterContainer, demoUtil.captureOnboardingEvent,
createFederatedGraphToken, and deleteRouterToken when locating test scaffolding.

In `@studio/src/components/onboarding/step-1.tsx`:
- Around line 120-123: The useEffect that calls setStep(1) currently lists
posthog and referrer in its dependency array even though the effect body only
references setStep; remove posthog and referrer from the dependency array so the
effect becomes dependent only on setStep (i.e., update the effect that contains
useEffect(() => { setStep(1); }, [setStep, posthog, referrer]) to only include
setStep) to prevent unnecessary re-runs.

In `@studio/src/lib/track.ts`:
- Around line 6-10: Remove the stale Koala tracking typing by deleting the
window.ko entry from the global Window interface declaration in track.ts and any
direct references to window.ko; update the declaration so it only exposes Reo
(i.e., remove "ko: any" from the interface) and search for and eliminate any
usages of window.ko or ko in functions like the tracking exporters to avoid
unused/undefined references, then run type checks to ensure no remaining
references break compilation.