@moda-ai/cli 1.12.3 → 1.12.6

package/dist/harness-report.js

@@ -622,7 +622,8 @@ function graphEvidenceById(graph) {
             const evidence = item.evidence
                 .filter((entry) => (isRecord(entry) &&
                 typeof entry.path === 'string' &&
-                typeof entry.reason === 'string'));
+                typeof entry.reason === 'string'))
+                .map((entry) => normalizeEvidenceEntry(entry));
             if (evidence.length > 0)
                 byId.set(item.id, evidence);
         }
@@ -637,10 +638,15 @@ function dedupeEvidence(evidence) {
         if (seen.has(key))
             continue;
         seen.add(key);
-        deduped.push({ path: item.path, reason: item.reason });
+        deduped.push(normalizeEvidenceEntry(item));
     }
     return deduped;
 }
+/** Keep the `{ path, reason }` shape, preserving a valid structured `line`. */
+function normalizeEvidenceEntry(item) {
+    const line = evidenceLine(item);
+    return line ? { path: item.path, reason: item.reason, line } : { path: item.path, reason: item.reason };
+}
 function normalizeHarnessClaim(claim, graph) {
     if (!isRecord(claim))
         return claim;
@@ -792,11 +798,52 @@ function validateGraphCollection(graph, errors, field, shape) {
             for (const [evidenceIndex, evidence] of item.evidence.entries()) {
                 if (!isRecord(evidence) || typeof evidence.path !== 'string' || typeof evidence.reason !== 'string') {
                     errors.push(`Graph ${label} evidence ${evidenceIndex + 1} must include path and reason.`);
+                    continue;
+                }
+                if (evidence.line !== undefined && (typeof evidence.line !== 'number' || !Number.isFinite(evidence.line) || evidence.line <= 0)) {
+                    errors.push(`Graph ${label} evidence ${evidenceIndex + 1} line must be a positive number.`);
                 }
             }
         }
+        if (field === 'artifacts' && requiresArtifactEvidenceLine(item.type) && !artifactHasRetrievableLocation(item)) {
+            errors.push(`Graph ${label} is a ${String(item.type)} artifact and must include a numeric evidence line (or a dedicated whole-file source) so its exact text can be retrieved.`);
+        }
     }
 }
+/** prompt/tool artifacts must pin an exact source location for downstream retrieval. */
+function requiresArtifactEvidenceLine(type) {
+    return type === 'prompt' || type === 'tool';
+}
+/**
+ * A prompt/tool artifact's text is retrievable when either (a) at least one
+ * evidence entry carries a resolvable line, or (b) the artifact is a whole
+ * dedicated file — its evidence points at the same file named in `sourcePath`,
+ * so the entire file IS the artifact and no line is needed.
+ */
+function artifactHasRetrievableLocation(item) {
+    if (hasEvidenceLine(item.evidence))
+        return true;
+    return isWholeFileArtifact(item);
+}
+function isWholeFileArtifact(item) {
+    if (typeof item.sourcePath !== 'string' || item.sourcePath.length === 0)
+        return false;
+    if (!Array.isArray(item.evidence))
+        return false;
+    return item.evidence.some((entry) => isRecord(entry) && entry.path === item.sourcePath);
+}
+function hasEvidenceLine(evidence) {
+    if (!Array.isArray(evidence))
+        return false;
+    return evidence.some((entry) => (isRecord(entry) &&
+        typeof entry.path === 'string' &&
+        typeof entry.reason === 'string' &&
+        evidenceLine({
+            path: entry.path,
+            reason: entry.reason,
+            line: typeof entry.line === 'number' ? entry.line : undefined,
+        }) !== undefined));
+}
 function normalizeGraphItemFieldAliases(collection, item) {
     if (!isRecord(item))
         return;
@@ -1155,7 +1202,7 @@ function upsertCitation(citations, citationIndex, evidence, rootDir) {
         return undefined;
     if (evidence.path === '.')
         return undefined;
-    const line = lineFromReason(evidence.reason);
+    const line = evidenceLine(evidence);
     const key = `${evidence.path}:${line ?? ''}:${evidence.reason}`;
     const existing = citationIndex.get(key);
     if (existing)
@@ -1389,6 +1436,16 @@ function lineFromReason(reason) {
     const value = Number(match[1]);
     return Number.isFinite(value) && value > 0 ? value : undefined;
 }
+/**
+ * Resolve the 1-based source line for an evidence entry, preferring the
+ * structured `line` field and falling back to a "line N" mention in the reason.
+ */
+function evidenceLine(evidence) {
+    if (typeof evidence.line === 'number' && Number.isFinite(evidence.line) && evidence.line > 0) {
+        return Math.trunc(evidence.line);
+    }
+    return lineFromReason(evidence.reason);
+}
 function inferenceFromConfidence(confidence) {
     if (confidence >= 0.85)
         return 'direct';

package/dist/harness.d.ts

@@ -4,6 +4,12 @@ declare const SCHEMA_VERSION = "harness.v0.1";
 export interface HarnessEvidence {
     path: string;
     reason: string;
+    /**
+     * 1-based line where the cited item is defined. Optional in general, but
+     * required for `prompt` and `tool` artifacts so downstream prompt/tool
+     * optimization can retrieve the exact source text of every enumerated item.
+     */
+    line?: number;
 }
 export interface HarnessDetection {
     confidence: number;

package/dist/harness.js

@@ -1343,11 +1343,12 @@ function renderExternalHarnessAnalystPrompt(options) {
         '',
         'Your task:',
         renderExternalAnalystProtocol(),
-        '1. Identify the actual runtime agent harnesses, agent families, prompts, tools, channel adapters, identity mappings, evals, model providers, frameworks, deployments, and open questions.',
-        '2. Cite every claim with local file paths, exact line numbers, and excerpts. File citations without line numbers are invalid for agent-authored reports.',
-        `3. After completing investigation, print the report JSON between ${REPORT_JSON_BEGIN} and ${REPORT_JSON_END}. Moda CLI will validate it and write the local artifacts.`,
+        '1. Identify the runtime agent harnesses, agent families, channel adapters, identity mappings, model providers, frameworks, deployments, and open questions.',
+        '2. Exhaustively enumerate EVERY prompt, tool, guardrail, and eval as its own graph artifact — the complete inventory, not a sample. This report feeds prompt optimization and tool optimization, so a missing tool or prompt is a real defect. Runtime agents may be modeled representatively on framework/example repos, but prompts and tools must be complete.',
+        '3. Cite every narrative claim with local file paths, exact line numbers, and excerpts. File citations without line numbers are invalid for agent-authored reports. Enumerated artifacts only need evidence:[{path, reason}], so completeness of the artifact inventory is not limited by the citation cap.',
+        `4. After completing investigation, print the report JSON between ${REPORT_JSON_BEGIN} and ${REPORT_JSON_END}. Moda CLI will validate it and write the local artifacts.`,
         'Your final response must contain the sentinel-wrapped JSON report. Do not end with commentary about being read-only, do not summarize without JSON, and do not omit the sentinel markers.',
-        'If the repository is too large to fully enumerate, stop broad exploration and produce the best conservative cited report with unknowns instead of continuing indefinitely.',
+        'If the repository is very large, keep enumerating prompts/tools/guardrails/evals as artifacts (uncapped) and only summarize runtime AGENTS representatively — do not drop tools or prompts to save space.',
         '',
         'Final output format:',
         REPORT_JSON_BEGIN,
@@ -1372,7 +1373,8 @@ function renderExternalHarnessAnalystPrompt(options) {
         'Use exact field names and numeric confidence values from 0 to 1. Do not write string confidence values like "high". Do not use confidence >= 0.90 unless the claim is direct evidence from the cited line(s).',
         'Each graph item with evidence must use evidence: [{ path, reason }], not citationIds/citations.',
         'Runtime agents must include id, name, kind:"runtime_agent", root, entrypointIds, channelAdapterIds, artifactIds, identityNamespaceIds, deploymentIds, frameworkIds, modelProviderIds, confidence, evidence.',
-        'Artifacts must include id, type, name, scope, usedByAgentIds, confidence, evidence, and optional sourcePath/contentHash/ownedByAgentId.',
+        'Artifacts must include id, type, name, scope, usedByAgentIds, confidence, evidence, and optional sourcePath/contentHash/ownedByAgentId. Emit one artifact PER tool, PER prompt (including each inline system prompt), PER guardrail, and PER eval — enumerate them all; artifact types are entrypoint, prompt, tool, skill, eval, retrieval_index, memory, guardrail, model_config, unknown.',
+        'For every `prompt` and `tool` artifact, at least one evidence entry MUST pin an exact source location so downstream optimization can retrieve the item text: carry a numeric `line` (the definition line, or the first line of the range) — evidence: [{ path, line, reason }]. The only exception is an artifact whose entire dedicated file is the text (e.g. a standalone prompt file); set its sourcePath and cite that same file and no line is required. When a single file holds multiple inline prompts or tool definitions, give each its own distinct line — a bare { path, reason } is a defect there.',
         'Agent families must include id, name, runtimeAgentIds, sharedArtifactIds, confidence, evidence.',
         'Frameworks/providers must include packageNames and runtimeAgentIds arrays; providers also include envVars and modelHints arrays.',
         'Unknowns in graph must include id, question, candidateIds, evidence. Report-level unknowns must include id, question, citationIds.',
@@ -1393,11 +1395,15 @@ function renderExternalAnalystProtocol() {
     return [
         'Focused investigation protocol:',
         '- First build a quick repo map with read-only commands such as pwd, git ls-files, rg, and targeted manifest/doc reads.',
-        '- Prioritize runtime entrypoints, prompt/tool definitions, framework/provider calls, channel adapters, evals, and deploy config over exhaustive file enumeration.',
-        '- If the repository is a framework, SDK, or examples collection, do not enumerate every example as a production runtime agent. Model representative harnesses, reusable frameworks, and unknowns conservatively with citations.',
-        '- For every claimed runtime agent, read and cite at least one concrete entrypoint or orchestration line. Add prompt/tool/config citations when available.',
-        '- Stop exploring once the cited graph is sufficiently supported. Use unknowns for unresolved questions instead of continuing broad exploration.',
-        '- Prefer a compact report: target 8-16 high-signal claims and 12-40 citations unless the repo clearly needs more.',
+        '- EXHAUSTIVELY enumerate every prompt, tool, guardrail, eval, memory/retrieval store, and model config in the repository — one graph artifact each. This inventory feeds downstream prompt optimization and tool optimization, so completeness matters more than brevity: do NOT stop at representative examples and do NOT sample.',
+        '- Tools: emit a `tool` artifact for EVERY tool definition — each `@function_tool` / `function_tool(...)`-decorated function, every hosted/first-party tool class (e.g. WebSearchTool, FileSearchTool, ComputerTool, CodeInterpreterTool, HostedMCPTool, ImageGenerationTool, LocalShellTool), and every `tool({...})` / `createTool(...)` / `new *Tool(...)` factory. Name each artifact after the tool/function and cite its definition line.',
+        '- Prompts: emit a `prompt` artifact for EVERY distinct prompt — dedicated prompt files AND inline system prompts (`instructions=`, `system=`, `SYSTEM_PROMPT`, prompt-template strings), one per agent/definition, each with its exact file+line location so the prompt text can be retrieved and optimized later.',
+        '- Also emit artifacts for guardrails (type "guardrail"), evals/tests-of-agents (type "eval"), memory/session stores (type "memory"), retrieval indexes (type "retrieval_index"), and model configuration (type "model_config").',
+        '- Only runtime AGENTS may be modeled representatively: if the repo is a framework/SDK/examples collection, you need not treat every example as a distinct production agent — but you MUST still enumerate every distinct tool, prompt, guardrail, and eval as its own artifact.',
+        '- Each enumerated artifact needs evidence: [{ path, reason }] (file path + short reason); a full line+excerpt citation is required only for the narrative `claims`, NOT for every artifact — so listing hundreds of tools/prompts is cheap and expected.',
+        '- EXCEPTION — `prompt` and `tool` artifacts MUST pin an exact location: put a numeric `line` on at least one evidence entry (evidence: [{ path, line, reason }]) at the definition line. That structured location is what lets downstream optimization retrieve the exact prompt/tool text; when one file has several inline prompts or tools, each artifact gets its own line. The only case that needs no line is a whole dedicated file whose entire content is the artifact (set sourcePath to that file and cite it). Still no excerpt required — just the line.',
+        '- For every runtime agent, read and cite at least one concrete entrypoint or orchestration line, and link its prompts/tools via artifactIds.',
+        '- Keep going until every prompt, tool, guardrail, and eval in scope is represented as an artifact. Use unknowns only for genuinely ambiguous items — never to skip enumeration. Respect the hard caps (<=250 claims, <=400 citations): artifacts are uncapped, so when there are many items keep enumerating them as artifacts and reserve claims/citations for the most important ones.',
     ].join('\n');
 }
 function renderAnalystPreflightSection(rootDir) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.12.3",
+  "version": "1.12.6",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-07-06T05:27:59.799Z",
-  "cli_version": "1.12.3",
+  "bundled_at": "2026-07-06T09:38:49.718Z",
+  "cli_version": "1.12.6",
   "skills": [
     {
       "id": "integration-node-anthropic",