@moda-ai/cli 1.13.2 → 1.13.4

package/dist/cli.js

@@ -238,9 +238,11 @@ Init flags:
   --yes                            Accept all defaults (non-interactive)
   --analyst=auto|claude|codex|cursor|local-scan
                                    Choose harness analyst adapter
-  --remote                         Run harness analysis server-side (Moda-hosted):
-                                   upload a safe source snapshot; no local agent
-                                   (also MODA_HARNESS_REMOTE=1)
+  --remote                         Run harness analysis server-side (Moda-hosted,
+                                   the default): upload a safe source snapshot; no
+                                   local coding agent required
+  --local                          Run harness analysis with a LOCAL coding agent
+                                   instead of server-side (opt out of remote)
   --tui                            Show full-screen analyst dashboard in human TTYs
   --no-tui                         Show raw external analyst output
   --sdk-integrate                  Run your coding agent to install the Moda SDK and instrument LLM calls

package/dist/harness-remote.js

@@ -27,7 +27,18 @@ export function isRemoteHarnessAnalyze(context) {
     // The CLI normalizes numeric flag values to numbers, so `--remote=1` arrives
     // as the number 1 rather than the string '1'; accept every truthy spelling.
     const flag = context.flags.remote;
-    if (flag === true || flag === 1 || flag === 'true' || flag === '1' || flag === 'yes')
+    // An explicit local opt-out (`--local` / `--no-remote` / `--remote=false|0`)
+    // wins over the `MODA_HARNESS_REMOTE` env, so callers that force local — the
+    // `moda init` local path and its remote-failure fallback — stay local even
+    // when the env is set. `no-remote` may arrive kebab- or snake-cased depending
+    // on the caller (real CLI parsing snake-cases; internal callers do not).
+    const noRemote = context.flags['no-remote'] ?? context.flags.no_remote;
+    const local = context.flags.local;
+    const isTruthy = (v) => v === true || v === 1 || v === 'true' || v === '1' || v === 'yes';
+    const isFalsy = (v) => v === false || v === 0 || v === 'false' || v === '0' || v === 'no';
+    if (isFalsy(flag) || isTruthy(noRemote) || isTruthy(local))
+        return false;
+    if (isTruthy(flag))
         return true;
     const env = (context.env.MODA_HARNESS_REMOTE ?? '').trim().toLowerCase();
     return env !== '' && env !== '0' && env !== 'false';

package/dist/harness-report.js

@@ -44,7 +44,10 @@ const HARNESS_REPORT_CITATION_TYPES = new Set([
     'command_output',
     'production_evidence',
 ]);
-const MAX_HARNESS_REPORT_BYTES = 1_500_000;
+// Raised from 1.5 MB to 12 MB so artifacts can carry their full usable content
+// (prompt bodies, tool signatures/docstrings, guardrail rules) for downstream
+// prompt/tool optimization — not just location metadata.
+const MAX_HARNESS_REPORT_BYTES = 12_000_000;
 const MAX_HARNESS_REPORT_CLAIMS = 250;
 const MAX_HARNESS_REPORT_CITATIONS = 400;
 const MAX_HARNESS_REPORT_SUMMARY_LENGTH = 1_200;

package/dist/harness.d.ts

@@ -90,6 +90,14 @@ export interface HarnessArtifact extends HarnessDetection {
     contentHash?: string;
     ownedByAgentId?: string;
     usedByAgentIds: string[];
+    /**
+     * The actual usable content of the artifact, captured so downstream
+     * consumers (prompt optimization, tool optimization) can use it without
+     * re-reading the repo: the full prompt text for `prompt`, the signature +
+     * docstring/description for `tool`, the rule for `guardrail`, the assertion
+     * for `eval`, the config values for `model_config`, etc.
+     */
+    body?: string;
 }
 export interface HarnessIdentityNamespace extends HarnessDetection {
     id: string;

package/dist/harness.js

@@ -1374,6 +1374,7 @@ function renderExternalHarnessAnalystPrompt(options) {
         'Each graph item with evidence must use evidence: [{ path, reason }], not citationIds/citations.',
         'Runtime agents must include id, name, kind:"runtime_agent", root, entrypointIds, channelAdapterIds, artifactIds, identityNamespaceIds, deploymentIds, frameworkIds, modelProviderIds, confidence, evidence.',
         'Artifacts must include id, type, name, scope, usedByAgentIds, confidence, evidence, and optional sourcePath/contentHash/ownedByAgentId. Emit one artifact PER tool, PER prompt (including each inline system prompt), PER guardrail, and PER eval — enumerate them all; artifact types are entrypoint, prompt, tool, skill, eval, retrieval_index, memory, guardrail, model_config, unknown.',
+        'Also set `body` on each artifact to its actual usable content so it can be consumed downstream WITHOUT re-reading the repo: for `prompt` the COMPLETE prompt text verbatim (full inline `instructions=`/system-prompt string or full prompt file); for `tool` the signature (name + parameters + types) and its docstring/description; for `guardrail` the rule/condition; for `eval` what it asserts; for `model_config` the configuration values. Copy the text in full — do not summarize or truncate `body` (it is the artifact we optimize). Redact any secret literals.',
         'For every `prompt` and `tool` artifact, at least one evidence entry MUST pin an exact source location so downstream optimization can retrieve the item text: carry a numeric `line` (the definition line, or the first line of the range) — evidence: [{ path, line, reason }]. The only exception is an artifact whose entire dedicated file is the text (e.g. a standalone prompt file); set its sourcePath and cite that same file and no line is required. When a single file holds multiple inline prompts or tool definitions, give each its own distinct line — a bare { path, reason } is a defect there.',
         'Agent families must include id, name, runtimeAgentIds, sharedArtifactIds, confidence, evidence.',
         'Frameworks/providers must include packageNames and runtimeAgentIds arrays; providers also include envVars and modelHints arrays.',
@@ -1401,6 +1402,7 @@ function renderExternalAnalystProtocol() {
         '- Also emit artifacts for guardrails (type "guardrail"), evals/tests-of-agents (type "eval"), memory/session stores (type "memory"), retrieval indexes (type "retrieval_index"), and model configuration (type "model_config").',
         '- Only runtime AGENTS may be modeled representatively: if the repo is a framework/SDK/examples collection, you need not treat every example as a distinct production agent — but you MUST still enumerate every distinct tool, prompt, guardrail, and eval as its own artifact.',
         '- Each enumerated artifact needs evidence: [{ path, reason }] (file path + short reason); a full line+excerpt citation is required only for the narrative `claims`, NOT for every artifact — so listing hundreds of tools/prompts is cheap and expected.',
+        '- Capture the actual usable content in each artifact\'s `body`: full prompt text for prompts, signature+docstring for tools, the rule for guardrails, the assertion for evals, config values for model configs. This inventory is consumed directly for optimization, so `body` must be the complete text (verbatim, not summarized), with secret literals redacted.',
         '- EXCEPTION — `prompt` and `tool` artifacts MUST pin an exact location: put a numeric `line` on at least one evidence entry (evidence: [{ path, line, reason }]) at the definition line. That structured location is what lets downstream optimization retrieve the exact prompt/tool text; when one file has several inline prompts or tools, each artifact gets its own line. The only case that needs no line is a whole dedicated file whose entire content is the artifact (set sourcePath to that file and cite it). Still no excerpt required — just the line.',
         '- For every runtime agent, read and cite at least one concrete entrypoint or orchestration line, and link its prompts/tools via artifactIds.',
         '- Keep going until every prompt, tool, guardrail, and eval in scope is represented as an artifact. Use unknowns only for genuinely ambiguous items — never to skip enumeration. Respect the hard caps (<=250 claims, <=400 citations): artifacts are uncapped, so when there are many items keep enumerating them as artifacts and reserve claims/citations for the most important ones.',
@@ -2529,13 +2531,17 @@ function maybeAddPromptArtifact(graph, file) {
     if (!isPrompt)
         return;
     const id = stableId('prompt', file.path);
+    const text = file.text ?? readFileSync(file.absPath, 'utf8');
     upsertArtifact(graph, {
         id,
         type: 'prompt',
         name: promptNameFromPath(file.path),
         scope: 'agent',
         sourcePath: file.path,
-        contentHash: hashText(file.text ?? readFileSync(file.absPath, 'utf8')),
+        contentHash: hashText(text),
+        // Capture the full prompt text so downstream prompt optimization can use it
+        // directly without re-reading the repo.
+        body: text,
         usedByAgentIds: [],
         confidence: 0.72,
         evidence: [{ path: file.path, reason: 'Prompt-like file found under prompts directory.' }],

package/dist/init/index.d.ts

@@ -28,4 +28,10 @@ export interface InitRunOptions {
     onEvent?: (event: InitProgressEvent) => void;
 }
 export declare function runInit(flags: Record<string, unknown>, options?: InitRunOptions): Promise<InitResult>;
+/**
+ * Onboarding runs harness discovery SERVER-SIDE by default so the customer
+ * needs no local coding agent. Opt out with `--local`, `--no-remote`, or
+ * `--remote=false` to use a local coding-agent analyst instead.
+ */
+export declare function resolveHarnessRemote(flags: Record<string, unknown>): boolean;
 //# sourceMappingURL=index.d.ts.map

package/dist/init/index.js

@@ -97,17 +97,14 @@ export async function runInit(flags, options = {}) {
     log(renderInitNote(`Active workspace: ${tenantName}`));
     emit('workspace', `Active workspace: ${tenantName}`, 'completed');
     phases.push({ id: 'workspace', title: 'Workspace & Profile', status: 'completed', details: tenantName });
-    // Step 4: Harness analyst report. When the user passes `--remote`, Moda runs
-    // the analyst server-side (uploading a safe source snapshot) so no local
-    // coding agent is required; otherwise the local analyst runs as before.
-    const remote = isTruthyFlag(flagValue(flags, 'remote'));
-    log(renderInitStep(4, 7, 'Harness Discovery', remote
-        ? 'Moda runs the harness analyst server-side and writes cited local artifacts.'
-        : 'Moda Analyst investigates the harness and writes cited local artifacts.'));
-    emit('harness', remote
-        ? 'Running Moda-hosted harness discovery.'
-        : 'Running Moda Analyst harness discovery.');
-    const harnessResult = await runHarnessCommand(createCommandContext({
+    // Step 4: Harness analyst report. Onboarding runs the analyst SERVER-SIDE by
+    // default (Moda uploads a safe source snapshot and runs the agent on its own
+    // infra) so the customer needs no local coding agent. Opt out with `--local`
+    // (or `--remote=false`) to run a local coding-agent analyst instead. If the
+    // remote run fails (service/network), we fall back to the local analyst so
+    // onboarding never hard-fails.
+    const remote = resolveHarnessRemote(flags);
+    const runAnalyze = (useRemote) => runHarnessCommand(createCommandContext({
         command: 'harness',
         positional: 'analyze',
         positionals: ['analyze'],
@@ -122,14 +119,44 @@ export async function runInit(flags, options = {}) {
             json: json || agent,
             agent,
             analyst: stringFlag(flags.analyst) ?? 'auto',
-            remote,
+            // Pass the remote/local decision EXPLICITLY. `commandFlags` drops
+            // `remote: false`, so a bare `remote: useRemote` would leave the child
+            // with no signal and it would re-derive remoteness from
+            // `MODA_HARNESS_REMOTE` — silently overriding `--local` and the
+            // remote-failure fallback below. `--no-remote` survives (it's `true`)
+            // and takes precedence over the env in `isRemoteHarnessAnalyze`.
+            remote: useRemote ? true : undefined,
+            'no-remote': useRemote ? undefined : true,
             quiet: true,
             progress: true,
             'no-telemetry': true,
         }),
     }));
+    log(renderInitStep(4, 7, 'Harness Discovery', remote
+        ? 'Moda runs the harness analyst server-side and writes cited local artifacts.'
+        : 'Moda Analyst investigates the harness and writes cited local artifacts.'));
+    emit('harness', remote
+        ? 'Running Moda-hosted harness discovery.'
+        : 'Running Moda Analyst harness discovery.');
+    let harnessResult;
+    try {
+        harnessResult = await runAnalyze(remote);
+    }
+    catch (error) {
+        // A remote failure (service down, upload error) must not sink onboarding —
+        // fall back to the local analyst path. If the caller pinned `--remote`
+        // explicitly, respect that and surface the failure.
+        if (remote && !isTruthyFlag(flagValue(flags, 'remote'))) {
+            warn(renderInitNote(`Server-side harness discovery unavailable (${error instanceof Error ? error.message : String(error)}); falling back to local analyst.`, 'warning'));
+            emit('harness', 'Server-side discovery failed; falling back to local analyst.', 'warning');
+            harnessResult = await runAnalyze(false);
+        }
+        else {
+            throw error;
+        }
+    }
     if (harnessResult.exitCode !== 0) {
-        throw new CliInputError('Moda Analyst produced a harness report that did not pass validation.', 'Review .moda/harness-report-validation.json, then rerun `moda init --analyst=claude|cursor|codex` or `moda harness analyze --analyst=local-scan --summary`.');
+        throw new CliInputError('Moda Analyst produced a harness report that did not pass validation.', 'Review .moda/harness-report-validation.json, then rerun `moda init --local --analyst=claude|cursor|codex` or `moda harness analyze --analyst=local-scan --summary`.');
     }
     log(renderInitNote('Wrote or verified .moda/harness-report.json, .moda/harness.json, and .moda/HARNESS.md'));
     if (human)
@@ -628,9 +655,12 @@ async function shouldIntegrateSdk(flags, yes) {
 function parseOptionalBoolean(value) {
     if (value === undefined)
         return undefined;
-    if (value === true || value === 'true' || value === '1' || value === 'yes')
+    // The CLI parser normalizes numeric-looking flag values to numbers, so
+    // `--remote=1` arrives as number 1 and `--remote=0` as number 0 (not the
+    // string spellings); accept both alongside the string/boolean forms.
+    if (value === true || value === 1 || value === 'true' || value === '1' || value === 'yes')
         return true;
-    if (value === false || value === 'false' || value === '0' || value === 'no')
+    if (value === false || value === 0 || value === 'false' || value === '0' || value === 'no')
         return false;
     return undefined;
 }
@@ -639,6 +669,21 @@ function isTruthyFlag(value) {
     // number 1), so accept the numeric `1` alongside the string spellings.
     return value === true || value === 1 || value === 'true' || value === '1' || value === 'yes';
 }
+/**
+ * Onboarding runs harness discovery SERVER-SIDE by default so the customer
+ * needs no local coding agent. Opt out with `--local`, `--no-remote`, or
+ * `--remote=false` to use a local coding-agent analyst instead.
+ */
+export function resolveHarnessRemote(flags) {
+    if (isTruthyFlag(flagValue(flags, 'local')))
+        return false;
+    if (isTruthyFlag(flagValue(flags, 'no-remote', 'no_remote')))
+        return false;
+    const remote = parseOptionalBoolean(flagValue(flags, 'remote'));
+    if (remote !== undefined)
+        return remote;
+    return true;
+}
 function flagValue(flags, ...keys) {
     for (const key of keys) {
         if (flags[key] !== undefined)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.13.2",
+  "version": "1.13.4",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-07-06T10:32:52.250Z",
-  "cli_version": "1.13.2",
+  "bundled_at": "2026-07-06T19:06:41.988Z",
+  "cli_version": "1.13.4",
   "skills": [
     {
       "id": "integration-node-anthropic",