@moda-ai/cli 1.12.2 → 1.12.3

package/dist/harness.js

@@ -2481,14 +2481,19 @@ function environmentFromAnnotation(annotation) {
     };
 }
 function applyHeuristics(graph, files) {
+    const isApplicationCode = applicationCodePredicate(files);
     for (const file of files) {
         maybeAddPromptArtifact(graph, file);
         maybeAddSkillArtifact(graph, file);
+        if (isApplicationCode(file.path))
+            maybeAddToolArtifact(graph, file);
         maybeAddEvalArtifact(graph, file);
         maybeAddDeployment(graph, file);
     }
     if (graph.runtimeAgents.length === 0) {
         for (const file of files) {
+            if (!isApplicationCode(file.path))
+                continue;
             const agent = inferRuntimeAgent(file, graph);
             if (agent)
                 upsertRuntimeAgent(graph, agent);
@@ -2587,7 +2592,10 @@ function inferRuntimeAgent(file, graph) {
     const loweredText = file.text.toLowerCase();
     const pathLooksLikeAgent = /(^|\/)(agent|agents|agent_harness)\//.test(loweredPath) ||
         /(^|\/)(agent|main|index)\.(ts|tsx|js|mjs|py)$/.test(loweredPath);
-    const codeLooksLikeAgent = /\b(run_agent|runagent|createagent|buildprompt|system prompt|openai|anthropic|model)\b/i.test(file.text);
+    // Require evidence that the file actually constructs or runs an agent, not
+    // merely that it mentions a model provider. Loose signals like "openai" or
+    // "model" match library internals and utilities that are not runtime agents.
+    const codeLooksLikeAgent = AGENT_RUNTIME_SIGNAL.test(file.text);
     if (!pathLooksLikeAgent || !codeLooksLikeAgent)
         return null;
     const channelIds = inferChannels(file);
@@ -2673,16 +2681,136 @@ function inferChannels(file) {
         .filter(([needle]) => text.includes(needle))
         .map(([, id]) => id);
 }
+// Trailing module names an import statement references, normalized to their last
+// path segment without extension. Covers ES/TS `from '...'` / `import(...)` /
+// `require(...)` and Python `from a.b.c import ...` / `import a.b.c`. Used to link
+// split-file tools whose module is imported by extensionless or dotted name
+// (e.g. `from tools import get_weather`, `import { getWeather } from './tools'`).
+function importedModuleNames(text) {
+    const names = new Set();
+    for (const match of text.matchAll(/(?:from|import|require)\s*\(?\s*["']([^"']+)["']/g)) {
+        const segment = match[1].split('/').pop();
+        if (segment)
+            names.add(segment.replace(/\.(ts|tsx|js|mjs|py)$/i, ''));
+    }
+    for (const match of text.matchAll(/^\s*(?:from|import)\s+([.\w]+)/gm)) {
+        const segment = match[1].replace(/^\.+/, '').split('.').pop();
+        if (segment)
+            names.add(segment);
+    }
+    return names;
+}
 function inferArtifactsForFile(file, graph) {
     const text = file.text ?? '';
+    const imported = importedModuleNames(text);
     const referenced = graph.artifacts.filter((artifact) => {
         if (!artifact.sourcePath)
             return false;
+        if (artifact.sourcePath === file.path)
+            return true;
         const base = basename(artifact.sourcePath);
-        return text.includes(base) || text.includes(artifact.sourcePath);
+        if (text.includes(base) || text.includes(artifact.sourcePath))
+            return true;
+        // Split-file tools: the agent imports the tool module by its extensionless or
+        // dotted name, which contains neither the basename-with-extension nor the full
+        // source path (e.g. `from tools import get_weather`, `from './tools'`).
+        if (artifact.type === 'tool') {
+            const moduleName = base.replace(/\.(ts|tsx|js|mjs|py)$/i, '');
+            if (moduleName && imported.has(moduleName))
+                return true;
+        }
+        return false;
     });
     return referenced.map((artifact) => artifact.id);
 }
+// Signals that a file constructs or runs an agent (as opposed to merely
+// importing a model SDK). Kept deliberately construction/run oriented so
+// library internals that only reference a provider are not misread as agents.
+// Covers the LangChain factory/executor shapes (create_tool_calling_agent,
+// create_openai_functions_agent, AgentExecutor, ...) and the `return`/`yield
+// Agent(...)` factory forms in addition to the direct construction/run signals.
+const AGENT_RUNTIME_SIGNAL = /(run_agent|runAgent|create_[a-z_]*agent\b|createAgent|initialize_agent|AgentExecutor\s*\(|new\s+Agent\s*\(|\bSwarm\s*\(|\bCrew\s*\(|\bRunner\s*\(|Runner\.run|\.run_sync\s*\(|\.run_streamed\s*\(|[=([,]\s*Agent\s*\(|(?:return|yield)\s+Agent\s*\(|^\s*Agent\s*\()/im;
+// Hosted/first-party tool classes that count as tool definitions when called.
+const HOSTED_TOOL_CLASSES = [
+    'WebSearchTool',
+    'FileSearchTool',
+    'ComputerTool',
+    'CodeInterpreterTool',
+    'HostedMCPTool',
+    'ImageGenerationTool',
+    'LocalShellTool',
+    'ShellTool',
+    'ApplyPatchTool',
+    'FunctionTool',
+];
+function repoOwnPackageNames(files) {
+    const packageJson = files.find((file) => file.path === 'package.json')?.text;
+    const pyproject = files.find((file) => file.path === 'pyproject.toml')?.text;
+    const names = [
+        packageJson ? safePackageName(packageJson) : undefined,
+        pyproject ? safeTomlName(pyproject) : undefined,
+    ];
+    return names.filter((name) => Boolean(name)).map((name) => name.toLowerCase());
+}
+function repoIsAgentFrameworkSource(files) {
+    const own = new Set(repoOwnPackageNames(files));
+    if (own.size === 0)
+        return false;
+    return FRAMEWORK_CATALOG.some((framework) => framework.packageNames.some((name) => own.has(name.toLowerCase())));
+}
+function isApplicationLikePath(path) {
+    return /(^|\/)(examples?|apps?|demos?|samples?|cookbook|tutorials?|quickstart|playground)\//i.test(path);
+}
+// When the repository IS an agent framework/SDK (its own package name matches a
+// framework catalog entry), its library source is the framework implementation,
+// not customer application code: runtime agents and tools should only be
+// inferred from application-like directories (examples, apps, demos, ...).
+function applicationCodePredicate(files) {
+    return repoIsAgentFrameworkSource(files) ? isApplicationLikePath : () => true;
+}
+const HOSTED_TOOL_CALL = new RegExp(`\\b(${HOSTED_TOOL_CLASSES.join('|')})\\s*\\(`, 'g');
+function detectToolDefinitions(file) {
+    const text = file.text;
+    if (!text)
+        return [];
+    const found = new Map();
+    const pyDecorated = /@function_tool[^\n]*\n(?:[ \t]*@[^\n]*\n)*[ \t]*(?:async[ \t]+)?def[ \t]+([A-Za-z_]\w*)/g;
+    for (const match of text.matchAll(pyDecorated))
+        found.set(match[1], '@function_tool-decorated function');
+    const tsFactory = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:[\w.]*\.)?(?:tool|functionTool|createTool|dynamicTool)\s*\(/g;
+    for (const match of text.matchAll(tsFactory))
+        found.set(match[1], 'tool factory assignment');
+    const tsNewTool = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*new\s+(?:Dynamic|Structured)?Tool\b/g;
+    for (const match of text.matchAll(tsNewTool))
+        found.set(match[1], 'tool constructor assignment');
+    for (const match of text.matchAll(HOSTED_TOOL_CALL))
+        found.set(match[1], `hosted tool ${match[1]}`);
+    return [...found.entries()].map(([name, reason]) => ({ name, reason }));
+}
+function maybeAddToolArtifact(graph, file) {
+    if (!/\.(ts|tsx|js|mjs|py)$/i.test(file.path))
+        return;
+    // Skip test/eval fixtures — those tool definitions are fixtures, not a
+    // customer's runtime tools. (Framework library internals are already
+    // excluded by applyHeuristics's application-code predicate.)
+    if (isEvalLikePath(file.path))
+        return;
+    const tools = detectToolDefinitions(file);
+    if (tools.length === 0)
+        return;
+    for (const tool of tools) {
+        upsertArtifact(graph, {
+            id: stableId('tool', `${file.path}:${tool.name}`),
+            type: 'tool',
+            name: titleFromId(tool.name),
+            scope: 'agent',
+            sourcePath: file.path,
+            usedByAgentIds: [],
+            confidence: 0.6,
+            evidence: [{ path: file.path, reason: `Tool definition detected (${tool.reason}).` }],
+        });
+    }
+}
 function detectDeveloperAgentAdapters(files) {
     const adapters = [];
     if (files.some((file) => file.path.startsWith('.claude/'))) {
@@ -2745,7 +2873,7 @@ const FRAMEWORK_CATALOG = [
         name: 'LangChain',
         kind: 'agent_framework',
         packageNames: ['langchain', '@langchain/core', '@langchain/langgraph', 'langgraph'],
-        patterns: [/langchain/i, /langgraph/i],
+        patterns: [/\blangchain\b/i, /\blanggraph\b/i],
     },
     {
         id: 'framework_vercel_ai_sdk',
@@ -2759,7 +2887,7 @@ const FRAMEWORK_CATALOG = [
         name: 'Mastra',
         kind: 'agent_framework',
         packageNames: ['mastra', '@mastra/core'],
-        patterns: [/mastra/i],
+        patterns: [/\bmastra\b/i],
     },
     {
         id: 'framework_openai_agents',
@@ -2773,7 +2901,7 @@ const FRAMEWORK_CATALOG = [
         name: 'CrewAI',
         kind: 'agent_framework',
         packageNames: ['crewai'],
-        patterns: [/crewai/i],
+        patterns: [/\bcrewai\b/i],
     },
     {
         id: 'framework_pydantic_ai',
@@ -2798,7 +2926,7 @@ const PROVIDER_CATALOG = [
         kind: 'model_provider',
         packageNames: ['@anthropic-ai/sdk', '@ai-sdk/anthropic', 'anthropic'],
         envVars: ['ANTHROPIC_API_KEY'],
-        patterns: [/anthropic/i, /\bclaude-[\w.-]+/i, /ANTHROPIC_API_KEY/],
+        patterns: [/\banthropic\b/i, /\bclaude-[\w.-]+/i, /ANTHROPIC_API_KEY/],
     },
     {
         id: 'provider_google',
@@ -2806,7 +2934,7 @@ const PROVIDER_CATALOG = [
         kind: 'model_provider',
         packageNames: ['@google/generative-ai', '@ai-sdk/google', 'google-generativeai'],
         envVars: ['GOOGLE_GENERATIVE_AI_API_KEY', 'GEMINI_API_KEY'],
-        patterns: [/gemini/i, /google.generativeai/i],
+        patterns: [/\bgemini\b/i, /google\.generativeai/i],
     },
     {
         id: 'provider_cohere',
@@ -2814,7 +2942,7 @@ const PROVIDER_CATALOG = [
         kind: 'model_provider',
         packageNames: ['cohere-ai', 'cohere'],
         envVars: ['COHERE_API_KEY'],
-        patterns: [/cohere/i],
+        patterns: [/\bcohere\b/i],
     },
     {
         id: 'provider_mistral',
@@ -2822,7 +2950,7 @@ const PROVIDER_CATALOG = [
         kind: 'model_provider',
         packageNames: ['@mistralai/mistralai', 'mistralai'],
         envVars: ['MISTRAL_API_KEY'],
-        patterns: [/mistral/i],
+        patterns: [/\bmistral\b/i],
     },
     {
         id: 'provider_ollama',
@@ -2830,7 +2958,7 @@ const PROVIDER_CATALOG = [
         kind: 'model_provider',
         packageNames: ['ollama'],
         envVars: ['OLLAMA_HOST'],
-        patterns: [/ollama/i],
+        patterns: [/\bollama\b/i],
     },
 ];
 function detectAgentFrameworks(files) {
@@ -2883,9 +3011,9 @@ function detectionEvidence(files, packageNames, patterns) {
             }
         }
         if (file.path === 'pyproject.toml' && file.text) {
-            const lowered = file.text.toLowerCase();
+            const deps = pyprojectDependencyNames(file.text);
             for (const name of packageNames) {
-                if (lowered.includes(name.toLowerCase())) {
+                if (deps.has(name.toLowerCase())) {
                     evidence.push({ path: file.path, reason: `Python dependency ${name} detected.` });
                 }
             }
@@ -2915,6 +3043,53 @@ function packageDependencyNames(text) {
         return new Set();
     }
 }
+function pyprojectDependencyNames(text) {
+    // Only extract names from actual dependency contexts, never every quoted string
+    // in the file: that would re-open the "ai"-inside-`keywords = ["ai"]` /
+    // `name = "openai-agents"` false positives this parser exists to avoid. Two
+    // dependency shapes are covered, and membership is tested by exact name:
+    //   - PEP 621 / PEP 518 requirement arrays (`dependencies`/`requires = [...]`,
+    //     `[project.optional-dependencies]`, `[dependency-groups]`): leading
+    //     distribution token of each quoted PEP 508 string (e.g. "openai>=2" -> openai).
+    //   - Poetry tables (`[tool.poetry.dependencies]`, `dev-dependencies`,
+    //     `group.<name>.dependencies`): the bare TOML key (e.g. `openai = "^1.0"`).
+    const names = new Set();
+    const addLeadingToken = (spec) => {
+        const match = spec.match(/^\s*([A-Za-z0-9][A-Za-z0-9._-]*)/);
+        if (match)
+            names.add(match[1].toLowerCase());
+    };
+    const isPoetryDepTable = (section) => /^tool\.poetry\.(dependencies|dev-dependencies|group\.[^.]+\.dependencies)$/.test(section);
+    const isRequirementArrayTable = (section) => section === 'project.optional-dependencies' || section === 'dependency-groups';
+    let section = '';
+    let inDependencyArray = false;
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.split('#')[0];
+        const header = line.match(/^\s*\[\[?\s*([^\]]+?)\s*\]\]?\s*$/);
+        if (header) {
+            section = header[1].trim().toLowerCase();
+            inDependencyArray = false;
+            continue;
+        }
+        if (/^\s*(?:dependencies|requires)\s*=\s*\[/.test(line) ||
+            (isRequirementArrayTable(section) && /=\s*\[/.test(line))) {
+            inDependencyArray = true;
+        }
+        if (inDependencyArray) {
+            for (const match of line.matchAll(/["']([^"']+)["']/g))
+                addLeadingToken(match[1]);
+            if (line.includes(']'))
+                inDependencyArray = false;
+            continue;
+        }
+        if (isPoetryDepTable(section)) {
+            const key = line.match(/^\s*([A-Za-z0-9][A-Za-z0-9._-]*)\s*=/);
+            if (key && key[1].toLowerCase() !== 'python')
+                names.add(key[1].toLowerCase());
+        }
+    }
+    return names;
+}
 function modelHintsForProvider(providerId, files) {
     const hints = new Set();
     const pattern = providerId === 'provider_anthropic'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.12.2",
+  "version": "1.12.3",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-07-06T03:50:30.586Z",
-  "cli_version": "1.12.2",
+  "bundled_at": "2026-07-06T05:27:59.799Z",
+  "cli_version": "1.12.3",
   "skills": [
     {
       "id": "integration-node-anthropic",