@moda-ai/cli 1.13.5 → 1.13.6

package/dist/harness-artifact-bodies.d.ts

@@ -0,0 +1,21 @@
+import type { HarnessArtifactType, HarnessEvidence, HarnessGraph } from './harness.js';
+export interface ArtifactBodyAnnotation {
+    values: Record<string, string[]>;
+    evidence: HarnessEvidence;
+    sourceAbsPath: string;
+    rootDir: string;
+}
+export interface ArtifactBodyFileItem {
+    path: string;
+    rootDir: string;
+    text?: string;
+}
+export declare function extractToolBodyFromText(text: string, toolName: string): string | undefined;
+export declare function readPromptOrToolBody(type: HarnessArtifactType, sourcePath: string, annotation: ArtifactBodyAnnotation): string | undefined;
+export declare function extractToolBody(file: ArtifactBodyFileItem, tool: {
+    name: string;
+    reason: string;
+}): string | undefined;
+export declare function hydratePromptAndToolBodies(graph: HarnessGraph, rootDir: string): void;
+export declare function enrichScanCaptureMetadata(graph: HarnessGraph): void;
+//# sourceMappingURL=harness-artifact-bodies.d.ts.map

package/dist/harness-artifact-bodies.js

@@ -0,0 +1,201 @@
+import { existsSync, lstatSync, readFileSync, realpathSync } from 'node:fs';
+import { basename, dirname, isAbsolute, relative, resolve } from 'node:path';
+import { artifactHasBody, firstEvidencePath, requiresArtifactBody, } from './harness-report.js';
+const MAX_SCANNED_FILE_BYTES = 512 * 1024;
+const SNAPSHOT_BUDGET_SKIP_REASONS = new Set([
+    'file too large for harness scan',
+    'scan text budget exceeded',
+]);
+function first(values) {
+    return values?.[0];
+}
+function normalizePath(path) {
+    return path.replace(/\\/g, '/');
+}
+function isTextFile(path) {
+    return /\.(ts|tsx|js|jsx|mjs|cjs|py|md|json|ya?ml|toml|txt|sh|rb|go|rs|swift|kt|java|cs|php|sql|graphql|gql|proto|css|scss|less|html|vue|svelte)$/i.test(path);
+}
+function isSecretishPath(path) {
+    const normalized = normalizePath(path).toLowerCase();
+    return normalized.includes('.env') ||
+        normalized.endsWith('.pem') ||
+        normalized.endsWith('.key') ||
+        normalized.includes('/secrets/') ||
+        normalized.includes('/credentials/');
+}
+function isOutsideRoot(rel) {
+    return rel === '' || rel === '..' || rel.startsWith('../') || isAbsolute(rel);
+}
+function readBoundedRepoText(absPath, rootDir) {
+    if (!existsSync(absPath))
+        return undefined;
+    const rel = normalizePath(relative(rootDir, absPath));
+    // Containment: never read files that resolve outside the scan root. Guards against
+    // `..` traversal or absolute paths (e.g. via a crafted `path=` annotation / sourcePath /
+    // evidence path) being hydrated into synced artifact bodies.
+    if (isOutsideRoot(rel))
+        return undefined;
+    if (isSecretishPath(rel))
+        return undefined;
+    let stat;
+    try {
+        stat = lstatSync(absPath);
+    }
+    catch {
+        return undefined;
+    }
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_SCANNED_FILE_BYTES) {
+        return undefined;
+    }
+    if (!isTextFile(rel))
+        return undefined;
+    // Realpath containment: the lexical `rel` check is purely textual and `lstatSync` only
+    // inspects the final component, so an intermediate directory symlink (e.g.
+    // `tools/outside -> /tmp/public`) could still let `readFileSync` follow the link out of
+    // the repo. Canonicalize both sides and re-check before reading.
+    try {
+        if (isOutsideRoot(normalizePath(relative(realpathSync(rootDir), realpathSync(absPath))))) {
+            return undefined;
+        }
+    }
+    catch {
+        return undefined;
+    }
+    try {
+        return readFileSync(absPath, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+}
+function readRepoRelativeText(rootDir, relPath) {
+    return readBoundedRepoText(resolve(rootDir, relPath), rootDir);
+}
+function isDedicatedToolFilePath(path) {
+    return /(^|\/)tools?\//i.test(path) && /\.(ts|tsx|js|mjs|py)$/i.test(path);
+}
+function firstEvidenceLineNumber(evidence) {
+    if (!Array.isArray(evidence))
+        return undefined;
+    for (const entry of evidence) {
+        if (typeof entry.line === 'number' && Number.isFinite(entry.line) && entry.line > 0) {
+            return Math.floor(entry.line);
+        }
+    }
+    return undefined;
+}
+function extractSnippetAroundLine(text, line, radius) {
+    const lines = text.split(/\r?\n/);
+    const start = Math.max(0, line - 1 - radius);
+    // `line` is 1-indexed and slice's end is exclusive, so include through
+    // (line-1)+radius: end = line + radius. Using line-1+radius dropped the tail line.
+    const end = Math.min(lines.length, line + radius);
+    return lines.slice(start, end).join('\n');
+}
+export function extractToolBodyFromText(text, toolName) {
+    const lines = text.split(/\r?\n/);
+    const normalizedName = toolName.replace(/\s+/g, '').toLowerCase();
+    for (let index = 0; index < lines.length; index += 1) {
+        const line = lines[index];
+        const compact = line.replace(/\s+/g, '').toLowerCase();
+        const mentionsTool = compact.includes(normalizedName) || compact.includes(`def${normalizedName}`);
+        if (!mentionsTool)
+            continue;
+        if (line.includes('function_tool') ||
+            line.includes('tool(') ||
+            line.includes('createTool') ||
+            line.includes('functionTool') ||
+            line.includes('dynamicTool') ||
+            line.includes('new Tool') ||
+            line.includes('def ')) {
+            return extractSnippetAroundLine(text, index + 1, 30);
+        }
+    }
+    return undefined;
+}
+function readAnnotatedSourceText(sourcePath, annotation) {
+    const explicitSourcePath = normalizePath(sourcePath) !== normalizePath(annotation.evidence.path);
+    const candidates = explicitSourcePath ? [
+        resolve(annotation.rootDir, sourcePath),
+        resolve(dirname(annotation.sourceAbsPath), sourcePath),
+    ] : [
+        resolve(annotation.rootDir, sourcePath),
+        resolve(dirname(annotation.sourceAbsPath), sourcePath),
+        annotation.sourceAbsPath,
+    ];
+    const seen = new Set();
+    for (const candidate of candidates) {
+        if (seen.has(candidate))
+            continue;
+        seen.add(candidate);
+        const text = readBoundedRepoText(candidate, annotation.rootDir);
+        if (text !== undefined)
+            return text;
+    }
+    return undefined;
+}
+export function readPromptOrToolBody(type, sourcePath, annotation) {
+    if (!requiresArtifactBody(type))
+        return undefined;
+    const text = readAnnotatedSourceText(sourcePath, annotation);
+    if (text === undefined)
+        return undefined;
+    if (type === 'prompt' || isDedicatedToolFilePath(sourcePath))
+        return text;
+    return extractToolBodyFromText(text, first(annotation.values.name) ?? basename(sourcePath)) ?? text;
+}
+export function extractToolBody(file, tool) {
+    const text = file.text ?? readRepoRelativeText(file.rootDir, file.path);
+    if (!text)
+        return undefined;
+    if (isDedicatedToolFilePath(file.path))
+        return text;
+    return extractToolBodyFromText(text, tool.name);
+}
+function hydrateArtifactBody(artifact, rootDir) {
+    if (artifact.sourcePath) {
+        const wholeFile = readRepoRelativeText(rootDir, artifact.sourcePath);
+        if (wholeFile !== undefined) {
+            if (artifact.type === 'prompt' || isDedicatedToolFilePath(artifact.sourcePath)) {
+                return wholeFile;
+            }
+            if (artifact.type === 'tool') {
+                return extractToolBodyFromText(wholeFile, artifact.name) ?? wholeFile;
+            }
+        }
+    }
+    const evidenceLine = firstEvidenceLineNumber(artifact.evidence);
+    const evidencePath = firstEvidencePath(artifact);
+    if (evidencePath && evidenceLine !== undefined) {
+        const text = readRepoRelativeText(rootDir, evidencePath);
+        if (text !== undefined) {
+            return extractSnippetAroundLine(text, evidenceLine, artifact.type === 'tool' ? 30 : 80);
+        }
+    }
+    return undefined;
+}
+export function hydratePromptAndToolBodies(graph, rootDir) {
+    for (const artifact of graph.artifacts) {
+        if (!requiresArtifactBody(artifact.type) || artifactHasBody(artifact)) {
+            continue;
+        }
+        const hydrated = hydrateArtifactBody(artifact, rootDir);
+        if (hydrated)
+            artifact.body = hydrated;
+    }
+}
+function countIncompletePromptToolBodies(graph) {
+    return graph.artifacts.filter((artifact) => requiresArtifactBody(artifact.type) &&
+        !artifactHasBody(artifact)).length;
+}
+export function enrichScanCaptureMetadata(graph) {
+    const budgetSkips = graph.scan.skipped
+        .map((skip) => skip.reason)
+        .filter((reason) => SNAPSHOT_BUDGET_SKIP_REASONS.has(reason));
+    const truncationReasons = [...new Set(budgetSkips)];
+    graph.scan.truncated = truncationReasons.length > 0;
+    graph.scan.truncationReasons = truncationReasons.length > 0 ? truncationReasons : undefined;
+    const incomplete = countIncompletePromptToolBodies(graph);
+    graph.scan.incompleteArtifactCount = incomplete > 0 ? incomplete : undefined;
+}
+//# sourceMappingURL=harness-artifact-bodies.js.map

package/dist/harness-remote.js

@@ -9,7 +9,7 @@
  */
 import { resolveApiKey, resolveIngestUrl } from './config.js';
 import { CliInputError } from './errors.js';
-import { normalizeHarnessReport, validateHarnessReport, writeHarnessReportArtifacts, } from './harness-report.js';
+import { normalizeHarnessReport, stampRemoteSnapshotTruncation, validateHarnessReport, writeHarnessReportArtifacts, } from './harness-report.js';
 import { buildSourceSnapshot, emitWrittenArtifacts, numericEnv, numericEnvAllowZero, repairExternalAnalystReport, sleep, summarizeHarness, summarizeInvalidAnalystReport, truncateText, writeHarnessAnalyzeResult, writeHarnessArtifacts, writeHumanProgress, } from './harness.js';
 const DEFAULT_REMOTE_ANALYZE_TIMEOUT_MS = 900_000;
 const DEFAULT_REMOTE_POLL_INITIAL_MS = 3_000;
@@ -75,6 +75,15 @@ export async function runRemoteHarnessAnalyst(options) {
         elapsed_ms: Date.now() - context.startedAt,
     });
     writeHumanProgress(context, `Moda Analyst (remote): uploading ${snapshot.fileCount} file(s) for server-side analysis...`);
+    if (snapshot.truncated) {
+        context.output.writeEvent({
+            event: 'warning',
+            phase: 'remote_upload',
+            message: 'Source snapshot is truncated; server-side analysis may be incomplete.',
+            elapsed_ms: Date.now() - context.startedAt,
+        });
+        writeHumanProgress(context, 'Warning: source snapshot is truncated — analysis may be incomplete.');
+    }
     const accepted = await postRemoteAnalyze(ingestUrl, apiKey, {
         snapshot,
         options: buildRemoteAnalyzeOptions(context.flags),
@@ -98,7 +107,10 @@ export async function runRemoteHarnessAnalyst(options) {
             'Increase MODA_HARNESS_REMOTE_TIMEOUT_MS if large repos need longer.',
         ].join('\n'));
     }
-    const report = repairExternalAnalystReport(normalizeHarnessReport(final.report), rootDir);
+    let report = repairExternalAnalystReport(normalizeHarnessReport(final.report), rootDir);
+    if (snapshot.truncated) {
+        report = stampRemoteSnapshotTruncation(report);
+    }
     const validation = validateHarnessReport(report, rootDir);
     context.output.writeEvent({
         event: 'progress',

package/dist/harness-report.d.ts

@@ -123,6 +123,13 @@ export declare function loadHarnessReportForSync(rootDir: string, reportPath: st
 };
 export declare function readHarnessReport(reportPath: string): HarnessReport;
 export declare function normalizeHarnessReport(value: unknown): HarnessReport;
+/** prompt/tool artifacts must carry full usable content for downstream optimization. */
+export declare function requiresArtifactBody(type: unknown): boolean;
+export declare function artifactHasBody(item: Record<string, unknown>): boolean;
+/** Canonical evidence path for graph items: prefer explicit sourcePath, then evidence. */
+export declare function firstEvidencePath(item: Record<string, unknown>): string | undefined;
+/** Stamp remote snapshot truncation onto a validated report graph scan metadata. */
+export declare function stampRemoteSnapshotTruncation(report: HarnessReport): HarnessReport;
 export declare function resolveHarnessReportPath(rootDir: string, value?: string): string;
 export declare function writeHarnessReportArtifacts(options: {
     rootDir: string;

package/dist/harness-report.js

@@ -320,6 +320,7 @@ export function validateHarnessReport(report, rootDir) {
             check(`graph_${field}_array`, Array.isArray(report.graph[field]), `Graph field ${field} must be an array.`);
         }
         validateGraphItemShapes(report.graph, errors);
+        validateCaptureQuality(report.graph, warn);
     }
     if (report?.summary && typeof report.summary === 'object') {
         for (const field of HARNESS_REPORT_SUMMARY_FIELDS) {
@@ -811,8 +812,18 @@ function validateGraphCollection(graph, errors, field, shape) {
         if (field === 'artifacts' && requiresArtifactEvidenceLine(item.type) && !artifactHasRetrievableLocation(item)) {
             errors.push(`Graph ${label} is a ${String(item.type)} artifact and must include a numeric evidence line (or a dedicated whole-file source) so its exact text can be retrieved.`);
         }
+        if (field === 'artifacts' && requiresArtifactBody(item.type) && !artifactHasBody(item)) {
+            errors.push(`Graph ${label} is a ${String(item.type)} artifact and must include a non-empty string body with its usable content.`);
+        }
     }
 }
+/** prompt/tool artifacts must carry full usable content for downstream optimization. */
+export function requiresArtifactBody(type) {
+    return type === 'prompt' || type === 'tool';
+}
+export function artifactHasBody(item) {
+    return typeof item.body === 'string' && item.body.trim().length > 0;
+}
 /** prompt/tool artifacts must pin an exact source location for downstream retrieval. */
 function requiresArtifactEvidenceLine(type) {
     return type === 'prompt' || type === 'tool';
@@ -828,6 +839,20 @@ function artifactHasRetrievableLocation(item) {
         return true;
     return isWholeFileArtifact(item);
 }
+function validateCaptureQuality(graph, warn) {
+    const scan = graph.scan;
+    if (!isRecord(scan))
+        return;
+    if (scan.truncated === true) {
+        const reasons = Array.isArray(scan.truncationReasons) && scan.truncationReasons.length > 0
+            ? scan.truncationReasons.map((reason) => String(reason)).join(', ')
+            : 'scan budget or upload cap reached';
+        warn('scan_truncated', `Harness scan is partial (truncated): ${reasons}. Re-run with --path=<agent-dir> or review skipped files in the report.`);
+    }
+    if (typeof scan.incompleteArtifactCount === 'number' && scan.incompleteArtifactCount > 0) {
+        warn('artifacts_missing_body', `${scan.incompleteArtifactCount} prompt/tool artifact(s) are still missing captured body content after hydration.`);
+    }
+}
 function isWholeFileArtifact(item) {
     if (typeof item.sourcePath !== 'string' || item.sourcePath.length === 0)
         return false;
@@ -884,7 +909,10 @@ function normalizeGraphItemFieldAliases(collection, item) {
         }
     }
 }
-function firstEvidencePath(item) {
+/** Canonical evidence path for graph items: prefer explicit sourcePath, then evidence. */
+export function firstEvidencePath(item) {
+    if (typeof item.sourcePath === 'string' && item.sourcePath.length > 0)
+        return item.sourcePath;
     if (!Array.isArray(item.evidence))
         return undefined;
     for (const evidence of item.evidence) {
@@ -894,6 +922,27 @@ function firstEvidencePath(item) {
     }
     return undefined;
 }
+/** Stamp remote snapshot truncation onto a validated report graph scan metadata. */
+export function stampRemoteSnapshotTruncation(report) {
+    const scanRecord = isRecord(report.graph.scan) ? report.graph.scan : {};
+    const truncationReasons = Array.isArray(scanRecord.truncationReasons)
+        ? scanRecord.truncationReasons.map(String)
+        : [];
+    return {
+        ...report,
+        graph: {
+            ...report.graph,
+            scan: {
+                ...report.graph.scan,
+                truncated: true,
+                truncationReasons: [
+                    ...truncationReasons,
+                    'remote source snapshot truncated before upload',
+                ],
+            },
+        },
+    };
+}
 function requiresGraphItemConfidence(collection) {
     return collection !== 'relationships' && collection !== 'unknowns';
 }

package/dist/harness-sync-limits.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Maximum serialized harness graph size accepted by the backend sync endpoint.
+ * Must match `MAX_HARNESS_SYNC_GRAPH_BYTES` in
+ * `apps/moda-backend/src/harnesses/harness-sync-limits.ts`.
+ */
+export declare const MAX_HARNESS_SYNC_GRAPH_BYTES = 2000000;
+export declare function assertHarnessGraphSyncSize(graph: unknown): void;
+//# sourceMappingURL=harness-sync-limits.d.ts.map

package/dist/harness-sync-limits.js

@@ -0,0 +1,21 @@
+import { CliInputError } from './errors.js';
+/**
+ * Maximum serialized harness graph size accepted by the backend sync endpoint.
+ * Must match `MAX_HARNESS_SYNC_GRAPH_BYTES` in
+ * `apps/moda-backend/src/harnesses/harness-sync-limits.ts`.
+ */
+export const MAX_HARNESS_SYNC_GRAPH_BYTES = 2_000_000;
+export function assertHarnessGraphSyncSize(graph) {
+    if (!graph || typeof graph !== 'object' || Array.isArray(graph)) {
+        throw new CliInputError('Harness graph must be an object before sync.');
+    }
+    const graphBytes = Buffer.byteLength(JSON.stringify(graph), 'utf8');
+    if (graphBytes > MAX_HARNESS_SYNC_GRAPH_BYTES) {
+        throw new CliInputError(`Harness graph is too large to sync (${graphBytes.toLocaleString()} bytes; limit ${MAX_HARNESS_SYNC_GRAPH_BYTES.toLocaleString()}).`, [
+            'Run `moda harness analyze --path=<agent-dir>` to narrow the harness root.',
+            'Reduce captured prompt/tool bodies if the graph grew too large.',
+            'Split multiple agent roots into separate harness syncs per tenant.',
+        ].join('\n'));
+    }
+}
+//# sourceMappingURL=harness-sync-limits.js.map

package/dist/harness.d.ts

@@ -32,6 +32,12 @@ export interface HarnessScanMetadata {
         path: string;
         reason: string;
     }>;
+    /** True when the scan dropped files due to size/budget caps or snapshot limits. */
+    truncated?: boolean;
+    /** Human-readable reasons the scan is partial (budget skips, upload cap, etc.). */
+    truncationReasons?: string[];
+    /** Prompt/tool artifacts still missing a captured body after hydration. */
+    incompleteArtifactCount?: number;
 }
 export interface HarnessScanReadPlan {
     scope: 'broad' | 'narrow';

package/dist/harness.js

@@ -10,7 +10,9 @@ import { resolveApiKey, resolveTenantId } from './config.js';
 import { CliInputError, CliInputRequiredError } from './errors.js';
 import { isRemoteHarnessAnalyze, runRemoteHarnessAnalyst } from './harness-remote.js';
 import { getActiveProfile } from './profiles.js';
+import { enrichScanCaptureMetadata, extractToolBody, hydratePromptAndToolBodies, readPromptOrToolBody, } from './harness-artifact-bodies.js';
 import { approveHarnessReport, createHarnessReport, graphForReport, hashHarnessReport, hashStableJson as hashHarnessReportStableJson, HARNESS_REPORT_PATH, loadHarnessReportForSync, normalizeHarnessReport, readHarnessReport, resolveHarnessReportPath, validateHarnessReport, writeHarnessReportArtifacts, } from './harness-report.js';
+import { assertHarnessGraphSyncSize } from './harness-sync-limits.js';
 import { renderHarnessAnalystChoice, renderHarnessAnalystLaunch, renderHarnessAnalystPreflight, renderHarnessAnalyzeHumanResult, renderHarnessProgress, } from './tui.js';
 const MODA_DIR = '.moda';
 const HARNESS_PATH = join(MODA_DIR, 'harness.json');
@@ -1607,6 +1609,8 @@ export function scanHarness(options = {}) {
     applyHeuristics(graph, files);
     linkFrameworksAndProviders(graph);
     finalizeGraph(graph);
+    hydratePromptAndToolBodies(graph, rootDir);
+    enrichScanCaptureMetadata(graph);
     return graph;
 }
 export function summarizeHarness(graph) {
@@ -1864,6 +1868,7 @@ function plannedDryRunRemote(plan) {
     };
 }
 async function syncHarnessWithRemote(context, body) {
+    assertHarnessGraphSyncSize(body.graph);
     const profileOptions = { profile: context.profile, env: context.env };
     const hasApiKey = Boolean(resolveApiKey(profileOptions));
     if (context.dryRun && !hasApiKey)
@@ -2436,6 +2441,7 @@ function artifactFromAnnotation(annotation) {
     const type = artifactType(first(values.kind) ?? first(values.type));
     const sourcePath = first(values.path) ?? annotation.evidence.path;
     const id = first(values.id) ?? stableId(type, first(values.name) ?? sourcePath);
+    const body = readPromptOrToolBody(type, sourcePath, annotation);
     return {
         id,
         type,
@@ -2443,6 +2449,7 @@ function artifactFromAnnotation(annotation) {
         scope: scopeValue(first(values.scope)),
         sourcePath,
         contentHash: contentHashForAnnotatedSource(sourcePath, annotation),
+        body,
         ownedByAgentId: first(values.owner),
         usedByAgentIds: values.agent ?? [],
         confidence: numberValue(first(values.confidence), 0.85),
@@ -2811,12 +2818,14 @@ function maybeAddToolArtifact(graph, file) {
     if (tools.length === 0)
         return;
     for (const tool of tools) {
+        const body = extractToolBody(file, tool);
         upsertArtifact(graph, {
             id: stableId('tool', `${file.path}:${tool.name}`),
             type: 'tool',
             name: titleFromId(tool.name),
             scope: 'agent',
             sourcePath: file.path,
+            body,
             usedByAgentIds: [],
             confidence: 0.6,
             evidence: [{ path: file.path, reason: `Tool definition detected (${tool.reason}).` }],
@@ -3216,6 +3225,7 @@ function finalizeGraph(graph) {
                     type: artifactTypeFromId(artifactId),
                     name: titleFromId(artifactId),
                     scope: 'agent',
+                    sourcePath: agent.evidence[0]?.path,
                     usedByAgentIds: [agent.id],
                     confidence: 0.45,
                     evidence: agent.evidence,
@@ -3375,6 +3385,8 @@ function upsertArtifact(graph, next) {
     existing.ownedByAgentId = existing.ownedByAgentId ?? next.ownedByAgentId;
     existing.contentHash = existing.contentHash ?? next.contentHash;
     existing.sourcePath = existing.sourcePath ?? next.sourcePath;
+    if (!existing.body && next.body)
+        existing.body = next.body;
     if (existing.scope !== 'shared')
         existing.scope = next.scope;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.13.5",
+  "version": "1.13.6",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-07-06T22:15:52.641Z",
-  "cli_version": "1.13.5",
+  "bundled_at": "2026-07-07T22:20:09.380Z",
+  "cli_version": "1.13.6",
   "skills": [
     {
       "id": "integration-node-anthropic",