@moda-ai/cli 1.12.2 → 1.12.6

package/dist/harness-report.js

@@ -622,7 +622,8 @@ function graphEvidenceById(graph) {
             const evidence = item.evidence
                 .filter((entry) => (isRecord(entry) &&
                 typeof entry.path === 'string' &&
-                typeof entry.reason === 'string'));
+                typeof entry.reason === 'string'))
+                .map((entry) => normalizeEvidenceEntry(entry));
             if (evidence.length > 0)
                 byId.set(item.id, evidence);
         }
@@ -637,10 +638,15 @@ function dedupeEvidence(evidence) {
         if (seen.has(key))
             continue;
         seen.add(key);
-        deduped.push({ path: item.path, reason: item.reason });
+        deduped.push(normalizeEvidenceEntry(item));
     }
     return deduped;
 }
+/** Keep the `{ path, reason }` shape, preserving a valid structured `line`. */
+function normalizeEvidenceEntry(item) {
+    const line = evidenceLine(item);
+    return line ? { path: item.path, reason: item.reason, line } : { path: item.path, reason: item.reason };
+}
 function normalizeHarnessClaim(claim, graph) {
     if (!isRecord(claim))
         return claim;
@@ -792,11 +798,52 @@ function validateGraphCollection(graph, errors, field, shape) {
             for (const [evidenceIndex, evidence] of item.evidence.entries()) {
                 if (!isRecord(evidence) || typeof evidence.path !== 'string' || typeof evidence.reason !== 'string') {
                     errors.push(`Graph ${label} evidence ${evidenceIndex + 1} must include path and reason.`);
+                    continue;
+                }
+                if (evidence.line !== undefined && (typeof evidence.line !== 'number' || !Number.isFinite(evidence.line) || evidence.line <= 0)) {
+                    errors.push(`Graph ${label} evidence ${evidenceIndex + 1} line must be a positive number.`);
                 }
             }
         }
+        if (field === 'artifacts' && requiresArtifactEvidenceLine(item.type) && !artifactHasRetrievableLocation(item)) {
+            errors.push(`Graph ${label} is a ${String(item.type)} artifact and must include a numeric evidence line (or a dedicated whole-file source) so its exact text can be retrieved.`);
+        }
     }
 }
+/** prompt/tool artifacts must pin an exact source location for downstream retrieval. */
+function requiresArtifactEvidenceLine(type) {
+    return type === 'prompt' || type === 'tool';
+}
+/**
+ * A prompt/tool artifact's text is retrievable when either (a) at least one
+ * evidence entry carries a resolvable line, or (b) the artifact is a whole
+ * dedicated file — its evidence points at the same file named in `sourcePath`,
+ * so the entire file IS the artifact and no line is needed.
+ */
+function artifactHasRetrievableLocation(item) {
+    if (hasEvidenceLine(item.evidence))
+        return true;
+    return isWholeFileArtifact(item);
+}
+function isWholeFileArtifact(item) {
+    if (typeof item.sourcePath !== 'string' || item.sourcePath.length === 0)
+        return false;
+    if (!Array.isArray(item.evidence))
+        return false;
+    return item.evidence.some((entry) => isRecord(entry) && entry.path === item.sourcePath);
+}
+function hasEvidenceLine(evidence) {
+    if (!Array.isArray(evidence))
+        return false;
+    return evidence.some((entry) => (isRecord(entry) &&
+        typeof entry.path === 'string' &&
+        typeof entry.reason === 'string' &&
+        evidenceLine({
+            path: entry.path,
+            reason: entry.reason,
+            line: typeof entry.line === 'number' ? entry.line : undefined,
+        }) !== undefined));
+}
 function normalizeGraphItemFieldAliases(collection, item) {
     if (!isRecord(item))
         return;
@@ -1155,7 +1202,7 @@ function upsertCitation(citations, citationIndex, evidence, rootDir) {
         return undefined;
     if (evidence.path === '.')
         return undefined;
-    const line = lineFromReason(evidence.reason);
+    const line = evidenceLine(evidence);
     const key = `${evidence.path}:${line ?? ''}:${evidence.reason}`;
     const existing = citationIndex.get(key);
     if (existing)
@@ -1389,6 +1436,16 @@ function lineFromReason(reason) {
     const value = Number(match[1]);
     return Number.isFinite(value) && value > 0 ? value : undefined;
 }
+/**
+ * Resolve the 1-based source line for an evidence entry, preferring the
+ * structured `line` field and falling back to a "line N" mention in the reason.
+ */
+function evidenceLine(evidence) {
+    if (typeof evidence.line === 'number' && Number.isFinite(evidence.line) && evidence.line > 0) {
+        return Math.trunc(evidence.line);
+    }
+    return lineFromReason(evidence.reason);
+}
 function inferenceFromConfidence(confidence) {
     if (confidence >= 0.85)
         return 'direct';

package/dist/harness.d.ts

@@ -4,6 +4,12 @@ declare const SCHEMA_VERSION = "harness.v0.1";
 export interface HarnessEvidence {
     path: string;
     reason: string;
+    /**
+     * 1-based line where the cited item is defined. Optional in general, but
+     * required for `prompt` and `tool` artifacts so downstream prompt/tool
+     * optimization can retrieve the exact source text of every enumerated item.
+     */
+    line?: number;
 }
 export interface HarnessDetection {
     confidence: number;

package/dist/harness.js

@@ -1343,11 +1343,12 @@ function renderExternalHarnessAnalystPrompt(options) {
         '',
         'Your task:',
         renderExternalAnalystProtocol(),
-        '1. Identify the actual runtime agent harnesses, agent families, prompts, tools, channel adapters, identity mappings, evals, model providers, frameworks, deployments, and open questions.',
-        '2. Cite every claim with local file paths, exact line numbers, and excerpts. File citations without line numbers are invalid for agent-authored reports.',
-        `3. After completing investigation, print the report JSON between ${REPORT_JSON_BEGIN} and ${REPORT_JSON_END}. Moda CLI will validate it and write the local artifacts.`,
+        '1. Identify the runtime agent harnesses, agent families, channel adapters, identity mappings, model providers, frameworks, deployments, and open questions.',
+        '2. Exhaustively enumerate EVERY prompt, tool, guardrail, and eval as its own graph artifact — the complete inventory, not a sample. This report feeds prompt optimization and tool optimization, so a missing tool or prompt is a real defect. Runtime agents may be modeled representatively on framework/example repos, but prompts and tools must be complete.',
+        '3. Cite every narrative claim with local file paths, exact line numbers, and excerpts. File citations without line numbers are invalid for agent-authored reports. Enumerated artifacts only need evidence:[{path, reason}], so completeness of the artifact inventory is not limited by the citation cap.',
+        `4. After completing investigation, print the report JSON between ${REPORT_JSON_BEGIN} and ${REPORT_JSON_END}. Moda CLI will validate it and write the local artifacts.`,
         'Your final response must contain the sentinel-wrapped JSON report. Do not end with commentary about being read-only, do not summarize without JSON, and do not omit the sentinel markers.',
-        'If the repository is too large to fully enumerate, stop broad exploration and produce the best conservative cited report with unknowns instead of continuing indefinitely.',
+        'If the repository is very large, keep enumerating prompts/tools/guardrails/evals as artifacts (uncapped) and only summarize runtime AGENTS representatively — do not drop tools or prompts to save space.',
         '',
         'Final output format:',
         REPORT_JSON_BEGIN,
@@ -1372,7 +1373,8 @@ function renderExternalHarnessAnalystPrompt(options) {
         'Use exact field names and numeric confidence values from 0 to 1. Do not write string confidence values like "high". Do not use confidence >= 0.90 unless the claim is direct evidence from the cited line(s).',
         'Each graph item with evidence must use evidence: [{ path, reason }], not citationIds/citations.',
         'Runtime agents must include id, name, kind:"runtime_agent", root, entrypointIds, channelAdapterIds, artifactIds, identityNamespaceIds, deploymentIds, frameworkIds, modelProviderIds, confidence, evidence.',
-        'Artifacts must include id, type, name, scope, usedByAgentIds, confidence, evidence, and optional sourcePath/contentHash/ownedByAgentId.',
+        'Artifacts must include id, type, name, scope, usedByAgentIds, confidence, evidence, and optional sourcePath/contentHash/ownedByAgentId. Emit one artifact PER tool, PER prompt (including each inline system prompt), PER guardrail, and PER eval — enumerate them all; artifact types are entrypoint, prompt, tool, skill, eval, retrieval_index, memory, guardrail, model_config, unknown.',
+        'For every `prompt` and `tool` artifact, at least one evidence entry MUST pin an exact source location so downstream optimization can retrieve the item text: carry a numeric `line` (the definition line, or the first line of the range) — evidence: [{ path, line, reason }]. The only exception is an artifact whose entire dedicated file is the text (e.g. a standalone prompt file); set its sourcePath and cite that same file and no line is required. When a single file holds multiple inline prompts or tool definitions, give each its own distinct line — a bare { path, reason } is a defect there.',
         'Agent families must include id, name, runtimeAgentIds, sharedArtifactIds, confidence, evidence.',
         'Frameworks/providers must include packageNames and runtimeAgentIds arrays; providers also include envVars and modelHints arrays.',
         'Unknowns in graph must include id, question, candidateIds, evidence. Report-level unknowns must include id, question, citationIds.',
@@ -1393,11 +1395,15 @@ function renderExternalAnalystProtocol() {
     return [
         'Focused investigation protocol:',
         '- First build a quick repo map with read-only commands such as pwd, git ls-files, rg, and targeted manifest/doc reads.',
-        '- Prioritize runtime entrypoints, prompt/tool definitions, framework/provider calls, channel adapters, evals, and deploy config over exhaustive file enumeration.',
-        '- If the repository is a framework, SDK, or examples collection, do not enumerate every example as a production runtime agent. Model representative harnesses, reusable frameworks, and unknowns conservatively with citations.',
-        '- For every claimed runtime agent, read and cite at least one concrete entrypoint or orchestration line. Add prompt/tool/config citations when available.',
-        '- Stop exploring once the cited graph is sufficiently supported. Use unknowns for unresolved questions instead of continuing broad exploration.',
-        '- Prefer a compact report: target 8-16 high-signal claims and 12-40 citations unless the repo clearly needs more.',
+        '- EXHAUSTIVELY enumerate every prompt, tool, guardrail, eval, memory/retrieval store, and model config in the repository — one graph artifact each. This inventory feeds downstream prompt optimization and tool optimization, so completeness matters more than brevity: do NOT stop at representative examples and do NOT sample.',
+        '- Tools: emit a `tool` artifact for EVERY tool definition — each `@function_tool` / `function_tool(...)`-decorated function, every hosted/first-party tool class (e.g. WebSearchTool, FileSearchTool, ComputerTool, CodeInterpreterTool, HostedMCPTool, ImageGenerationTool, LocalShellTool), and every `tool({...})` / `createTool(...)` / `new *Tool(...)` factory. Name each artifact after the tool/function and cite its definition line.',
+        '- Prompts: emit a `prompt` artifact for EVERY distinct prompt — dedicated prompt files AND inline system prompts (`instructions=`, `system=`, `SYSTEM_PROMPT`, prompt-template strings), one per agent/definition, each with its exact file+line location so the prompt text can be retrieved and optimized later.',
+        '- Also emit artifacts for guardrails (type "guardrail"), evals/tests-of-agents (type "eval"), memory/session stores (type "memory"), retrieval indexes (type "retrieval_index"), and model configuration (type "model_config").',
+        '- Only runtime AGENTS may be modeled representatively: if the repo is a framework/SDK/examples collection, you need not treat every example as a distinct production agent — but you MUST still enumerate every distinct tool, prompt, guardrail, and eval as its own artifact.',
+        '- Each enumerated artifact needs evidence: [{ path, reason }] (file path + short reason); a full line+excerpt citation is required only for the narrative `claims`, NOT for every artifact — so listing hundreds of tools/prompts is cheap and expected.',
+        '- EXCEPTION — `prompt` and `tool` artifacts MUST pin an exact location: put a numeric `line` on at least one evidence entry (evidence: [{ path, line, reason }]) at the definition line. That structured location is what lets downstream optimization retrieve the exact prompt/tool text; when one file has several inline prompts or tools, each artifact gets its own line. The only case that needs no line is a whole dedicated file whose entire content is the artifact (set sourcePath to that file and cite it). Still no excerpt required — just the line.',
+        '- For every runtime agent, read and cite at least one concrete entrypoint or orchestration line, and link its prompts/tools via artifactIds.',
+        '- Keep going until every prompt, tool, guardrail, and eval in scope is represented as an artifact. Use unknowns only for genuinely ambiguous items — never to skip enumeration. Respect the hard caps (<=250 claims, <=400 citations): artifacts are uncapped, so when there are many items keep enumerating them as artifacts and reserve claims/citations for the most important ones.',
     ].join('\n');
 }
 function renderAnalystPreflightSection(rootDir) {
@@ -2481,14 +2487,19 @@ function environmentFromAnnotation(annotation) {
     };
 }
 function applyHeuristics(graph, files) {
+    const isApplicationCode = applicationCodePredicate(files);
     for (const file of files) {
         maybeAddPromptArtifact(graph, file);
         maybeAddSkillArtifact(graph, file);
+        if (isApplicationCode(file.path))
+            maybeAddToolArtifact(graph, file);
         maybeAddEvalArtifact(graph, file);
         maybeAddDeployment(graph, file);
     }
     if (graph.runtimeAgents.length === 0) {
         for (const file of files) {
+            if (!isApplicationCode(file.path))
+                continue;
             const agent = inferRuntimeAgent(file, graph);
             if (agent)
                 upsertRuntimeAgent(graph, agent);
@@ -2587,7 +2598,10 @@ function inferRuntimeAgent(file, graph) {
     const loweredText = file.text.toLowerCase();
     const pathLooksLikeAgent = /(^|\/)(agent|agents|agent_harness)\//.test(loweredPath) ||
         /(^|\/)(agent|main|index)\.(ts|tsx|js|mjs|py)$/.test(loweredPath);
-    const codeLooksLikeAgent = /\b(run_agent|runagent|createagent|buildprompt|system prompt|openai|anthropic|model)\b/i.test(file.text);
+    // Require evidence that the file actually constructs or runs an agent, not
+    // merely that it mentions a model provider. Loose signals like "openai" or
+    // "model" match library internals and utilities that are not runtime agents.
+    const codeLooksLikeAgent = AGENT_RUNTIME_SIGNAL.test(file.text);
     if (!pathLooksLikeAgent || !codeLooksLikeAgent)
         return null;
     const channelIds = inferChannels(file);
@@ -2673,16 +2687,136 @@ function inferChannels(file) {
         .filter(([needle]) => text.includes(needle))
         .map(([, id]) => id);
 }
+// Trailing module names an import statement references, normalized to their last
+// path segment without extension. Covers ES/TS `from '...'` / `import(...)` /
+// `require(...)` and Python `from a.b.c import ...` / `import a.b.c`. Used to link
+// split-file tools whose module is imported by extensionless or dotted name
+// (e.g. `from tools import get_weather`, `import { getWeather } from './tools'`).
+function importedModuleNames(text) {
+    const names = new Set();
+    for (const match of text.matchAll(/(?:from|import|require)\s*\(?\s*["']([^"']+)["']/g)) {
+        const segment = match[1].split('/').pop();
+        if (segment)
+            names.add(segment.replace(/\.(ts|tsx|js|mjs|py)$/i, ''));
+    }
+    for (const match of text.matchAll(/^\s*(?:from|import)\s+([.\w]+)/gm)) {
+        const segment = match[1].replace(/^\.+/, '').split('.').pop();
+        if (segment)
+            names.add(segment);
+    }
+    return names;
+}
 function inferArtifactsForFile(file, graph) {
     const text = file.text ?? '';
+    const imported = importedModuleNames(text);
     const referenced = graph.artifacts.filter((artifact) => {
         if (!artifact.sourcePath)
             return false;
+        if (artifact.sourcePath === file.path)
+            return true;
         const base = basename(artifact.sourcePath);
-        return text.includes(base) || text.includes(artifact.sourcePath);
+        if (text.includes(base) || text.includes(artifact.sourcePath))
+            return true;
+        // Split-file tools: the agent imports the tool module by its extensionless or
+        // dotted name, which contains neither the basename-with-extension nor the full
+        // source path (e.g. `from tools import get_weather`, `from './tools'`).
+        if (artifact.type === 'tool') {
+            const moduleName = base.replace(/\.(ts|tsx|js|mjs|py)$/i, '');
+            if (moduleName && imported.has(moduleName))
+                return true;
+        }
+        return false;
     });
     return referenced.map((artifact) => artifact.id);
 }
+// Signals that a file constructs or runs an agent (as opposed to merely
+// importing a model SDK). Kept deliberately construction/run oriented so
+// library internals that only reference a provider are not misread as agents.
+// Covers the LangChain factory/executor shapes (create_tool_calling_agent,
+// create_openai_functions_agent, AgentExecutor, ...) and the `return`/`yield
+// Agent(...)` factory forms in addition to the direct construction/run signals.
+const AGENT_RUNTIME_SIGNAL = /(run_agent|runAgent|create_[a-z_]*agent\b|createAgent|initialize_agent|AgentExecutor\s*\(|new\s+Agent\s*\(|\bSwarm\s*\(|\bCrew\s*\(|\bRunner\s*\(|Runner\.run|\.run_sync\s*\(|\.run_streamed\s*\(|[=([,]\s*Agent\s*\(|(?:return|yield)\s+Agent\s*\(|^\s*Agent\s*\()/im;
+// Hosted/first-party tool classes that count as tool definitions when called.
+const HOSTED_TOOL_CLASSES = [
+    'WebSearchTool',
+    'FileSearchTool',
+    'ComputerTool',
+    'CodeInterpreterTool',
+    'HostedMCPTool',
+    'ImageGenerationTool',
+    'LocalShellTool',
+    'ShellTool',
+    'ApplyPatchTool',
+    'FunctionTool',
+];
+function repoOwnPackageNames(files) {
+    const packageJson = files.find((file) => file.path === 'package.json')?.text;
+    const pyproject = files.find((file) => file.path === 'pyproject.toml')?.text;
+    const names = [
+        packageJson ? safePackageName(packageJson) : undefined,
+        pyproject ? safeTomlName(pyproject) : undefined,
+    ];
+    return names.filter((name) => Boolean(name)).map((name) => name.toLowerCase());
+}
+function repoIsAgentFrameworkSource(files) {
+    const own = new Set(repoOwnPackageNames(files));
+    if (own.size === 0)
+        return false;
+    return FRAMEWORK_CATALOG.some((framework) => framework.packageNames.some((name) => own.has(name.toLowerCase())));
+}
+function isApplicationLikePath(path) {
+    return /(^|\/)(examples?|apps?|demos?|samples?|cookbook|tutorials?|quickstart|playground)\//i.test(path);
+}
+// When the repository IS an agent framework/SDK (its own package name matches a
+// framework catalog entry), its library source is the framework implementation,
+// not customer application code: runtime agents and tools should only be
+// inferred from application-like directories (examples, apps, demos, ...).
+function applicationCodePredicate(files) {
+    return repoIsAgentFrameworkSource(files) ? isApplicationLikePath : () => true;
+}
+const HOSTED_TOOL_CALL = new RegExp(`\\b(${HOSTED_TOOL_CLASSES.join('|')})\\s*\\(`, 'g');
+function detectToolDefinitions(file) {
+    const text = file.text;
+    if (!text)
+        return [];
+    const found = new Map();
+    const pyDecorated = /@function_tool[^\n]*\n(?:[ \t]*@[^\n]*\n)*[ \t]*(?:async[ \t]+)?def[ \t]+([A-Za-z_]\w*)/g;
+    for (const match of text.matchAll(pyDecorated))
+        found.set(match[1], '@function_tool-decorated function');
+    const tsFactory = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:[\w.]*\.)?(?:tool|functionTool|createTool|dynamicTool)\s*\(/g;
+    for (const match of text.matchAll(tsFactory))
+        found.set(match[1], 'tool factory assignment');
+    const tsNewTool = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*new\s+(?:Dynamic|Structured)?Tool\b/g;
+    for (const match of text.matchAll(tsNewTool))
+        found.set(match[1], 'tool constructor assignment');
+    for (const match of text.matchAll(HOSTED_TOOL_CALL))
+        found.set(match[1], `hosted tool ${match[1]}`);
+    return [...found.entries()].map(([name, reason]) => ({ name, reason }));
+}
+function maybeAddToolArtifact(graph, file) {
+    if (!/\.(ts|tsx|js|mjs|py)$/i.test(file.path))
+        return;
+    // Skip test/eval fixtures — those tool definitions are fixtures, not a
+    // customer's runtime tools. (Framework library internals are already
+    // excluded by applyHeuristics's application-code predicate.)
+    if (isEvalLikePath(file.path))
+        return;
+    const tools = detectToolDefinitions(file);
+    if (tools.length === 0)
+        return;
+    for (const tool of tools) {
+        upsertArtifact(graph, {
+            id: stableId('tool', `${file.path}:${tool.name}`),
+            type: 'tool',
+            name: titleFromId(tool.name),
+            scope: 'agent',
+            sourcePath: file.path,
+            usedByAgentIds: [],
+            confidence: 0.6,
+            evidence: [{ path: file.path, reason: `Tool definition detected (${tool.reason}).` }],
+        });
+    }
+}
 function detectDeveloperAgentAdapters(files) {
     const adapters = [];
     if (files.some((file) => file.path.startsWith('.claude/'))) {
@@ -2745,7 +2879,7 @@ const FRAMEWORK_CATALOG = [
         name: 'LangChain',
         kind: 'agent_framework',
         packageNames: ['langchain', '@langchain/core', '@langchain/langgraph', 'langgraph'],
-        patterns: [/langchain/i, /langgraph/i],
+        patterns: [/\blangchain\b/i, /\blanggraph\b/i],
     },
     {
         id: 'framework_vercel_ai_sdk',
@@ -2759,7 +2893,7 @@ const FRAMEWORK_CATALOG = [
         name: 'Mastra',
         kind: 'agent_framework',
         packageNames: ['mastra', '@mastra/core'],
-        patterns: [/mastra/i],
+        patterns: [/\bmastra\b/i],
     },
     {
         id: 'framework_openai_agents',
@@ -2773,7 +2907,7 @@ const FRAMEWORK_CATALOG = [
         name: 'CrewAI',
         kind: 'agent_framework',
         packageNames: ['crewai'],
-        patterns: [/crewai/i],
+        patterns: [/\bcrewai\b/i],
     },
     {
         id: 'framework_pydantic_ai',
@@ -2798,7 +2932,7 @@ const PROVIDER_CATALOG = [
         kind: 'model_provider',
         packageNames: ['@anthropic-ai/sdk', '@ai-sdk/anthropic', 'anthropic'],
         envVars: ['ANTHROPIC_API_KEY'],
-        patterns: [/anthropic/i, /\bclaude-[\w.-]+/i, /ANTHROPIC_API_KEY/],
+        patterns: [/\banthropic\b/i, /\bclaude-[\w.-]+/i, /ANTHROPIC_API_KEY/],
     },
     {
         id: 'provider_google',
@@ -2806,7 +2940,7 @@ const PROVIDER_CATALOG = [
         kind: 'model_provider',
         packageNames: ['@google/generative-ai', '@ai-sdk/google', 'google-generativeai'],
         envVars: ['GOOGLE_GENERATIVE_AI_API_KEY', 'GEMINI_API_KEY'],
-        patterns: [/gemini/i, /google.generativeai/i],
+        patterns: [/\bgemini\b/i, /google\.generativeai/i],
     },
     {
         id: 'provider_cohere',
@@ -2814,7 +2948,7 @@ const PROVIDER_CATALOG = [
         kind: 'model_provider',
         packageNames: ['cohere-ai', 'cohere'],
         envVars: ['COHERE_API_KEY'],
-        patterns: [/cohere/i],
+        patterns: [/\bcohere\b/i],
     },
     {
         id: 'provider_mistral',
@@ -2822,7 +2956,7 @@ const PROVIDER_CATALOG = [
         kind: 'model_provider',
         packageNames: ['@mistralai/mistralai', 'mistralai'],
         envVars: ['MISTRAL_API_KEY'],
-        patterns: [/mistral/i],
+        patterns: [/\bmistral\b/i],
     },
     {
         id: 'provider_ollama',
@@ -2830,7 +2964,7 @@ const PROVIDER_CATALOG = [
         kind: 'model_provider',
         packageNames: ['ollama'],
         envVars: ['OLLAMA_HOST'],
-        patterns: [/ollama/i],
+        patterns: [/\bollama\b/i],
     },
 ];
 function detectAgentFrameworks(files) {
@@ -2883,9 +3017,9 @@ function detectionEvidence(files, packageNames, patterns) {
             }
         }
         if (file.path === 'pyproject.toml' && file.text) {
-            const lowered = file.text.toLowerCase();
+            const deps = pyprojectDependencyNames(file.text);
             for (const name of packageNames) {
-                if (lowered.includes(name.toLowerCase())) {
+                if (deps.has(name.toLowerCase())) {
                     evidence.push({ path: file.path, reason: `Python dependency ${name} detected.` });
                 }
             }
@@ -2915,6 +3049,53 @@ function packageDependencyNames(text) {
         return new Set();
     }
 }
+function pyprojectDependencyNames(text) {
+    // Only extract names from actual dependency contexts, never every quoted string
+    // in the file: that would re-open the "ai"-inside-`keywords = ["ai"]` /
+    // `name = "openai-agents"` false positives this parser exists to avoid. Two
+    // dependency shapes are covered, and membership is tested by exact name:
+    //   - PEP 621 / PEP 518 requirement arrays (`dependencies`/`requires = [...]`,
+    //     `[project.optional-dependencies]`, `[dependency-groups]`): leading
+    //     distribution token of each quoted PEP 508 string (e.g. "openai>=2" -> openai).
+    //   - Poetry tables (`[tool.poetry.dependencies]`, `dev-dependencies`,
+    //     `group.<name>.dependencies`): the bare TOML key (e.g. `openai = "^1.0"`).
+    const names = new Set();
+    const addLeadingToken = (spec) => {
+        const match = spec.match(/^\s*([A-Za-z0-9][A-Za-z0-9._-]*)/);
+        if (match)
+            names.add(match[1].toLowerCase());
+    };
+    const isPoetryDepTable = (section) => /^tool\.poetry\.(dependencies|dev-dependencies|group\.[^.]+\.dependencies)$/.test(section);
+    const isRequirementArrayTable = (section) => section === 'project.optional-dependencies' || section === 'dependency-groups';
+    let section = '';
+    let inDependencyArray = false;
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.split('#')[0];
+        const header = line.match(/^\s*\[\[?\s*([^\]]+?)\s*\]\]?\s*$/);
+        if (header) {
+            section = header[1].trim().toLowerCase();
+            inDependencyArray = false;
+            continue;
+        }
+        if (/^\s*(?:dependencies|requires)\s*=\s*\[/.test(line) ||
+            (isRequirementArrayTable(section) && /=\s*\[/.test(line))) {
+            inDependencyArray = true;
+        }
+        if (inDependencyArray) {
+            for (const match of line.matchAll(/["']([^"']+)["']/g))
+                addLeadingToken(match[1]);
+            if (line.includes(']'))
+                inDependencyArray = false;
+            continue;
+        }
+        if (isPoetryDepTable(section)) {
+            const key = line.match(/^\s*([A-Za-z0-9][A-Za-z0-9._-]*)\s*=/);
+            if (key && key[1].toLowerCase() !== 'python')
+                names.add(key[1].toLowerCase());
+        }
+    }
+    return names;
+}
 function modelHintsForProvider(providerId, files) {
     const hints = new Set();
     const pattern = providerId === 'provider_anthropic'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.12.2",
+  "version": "1.12.6",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-07-06T03:50:30.586Z",
-  "cli_version": "1.12.2",
+  "bundled_at": "2026-07-06T09:38:49.718Z",
+  "cli_version": "1.12.6",
   "skills": [
     {
       "id": "integration-node-anthropic",