@moda-ai/cli 1.13.6 → 1.13.8

package/dist/auth.d.ts

@@ -2,6 +2,17 @@ import { type ProfileIOOptions } from './profiles.js';
 import { type AuthSessionOptions } from './auth-storage.js';
 export { clearAuthSession, isAuthSessionValid, loadAuthSession, loadToken, saveAuthSession, type AuthSessionOptions, type StoredAuth, type StoredAuthTokenKind, } from './auth-storage.js';
 export { revokeCliSessionToken } from './cli-session.js';
+/** Default wait for browser Auth0/consent during `moda auth login` / init. */
+export declare const DEFAULT_AUTH_TIMEOUT_MS = 600000;
+/**
+ * Resolve the browser-auth wait. Explicit LoginOptions.timeoutMs wins;
+ * otherwise MODA_AUTH_TIMEOUT_MS (clamped); otherwise a 10-minute default that
+ * covers real Auth0 + MFA + slow consent without abandoning mid-login.
+ */
+export declare function resolveAuthTimeoutMs(options?: {
+    timeoutMs?: number;
+    env?: NodeJS.ProcessEnv;
+}): number;
 /** base64url(sha256(verifier)) — the S256 code challenge for a verifier. */
 export declare function computePkceChallenge(codeVerifier: string): string;
 export interface CliLoginContext {
@@ -20,6 +31,11 @@ export declare function getCachedLoginContext(options?: ProfileIOOptions): CliLo
 export interface LoginOptions extends ProfileIOOptions {
     /** Use this exact port for the localhost callback (no fallback ladder). */
     callbackPort?: number;
+    /**
+     * Explicit browser-auth wait in ms. Unlike `MODA_AUTH_TIMEOUT_MS` (clamped
+     * 30s–30m), an explicit value bypasses that clamp (only floored at 1ms) so
+     * programmatic/test callers can set very short or very long waits.
+     */
     timeoutMs?: number;
     openUrl?: (url: string) => Promise<void>;
     /**

package/dist/auth.js

@@ -20,10 +20,33 @@ const CALLBACK_PORT = 8432;
 // callback redirect is port-parameterized, so any of these works as long as
 // the auth URL carries the port that actually got bound.
 const CALLBACK_PORT_LADDER = [CALLBACK_PORT, 8433, 8434, 8435];
-const AUTH_TIMEOUT_MS = 120_000;
+/** Default wait for browser Auth0/consent during `moda auth login` / init. */
+export const DEFAULT_AUTH_TIMEOUT_MS = 600_000;
+/** Floor / ceiling for MODA_AUTH_TIMEOUT_MS (30s .. 30m). */
+const AUTH_TIMEOUT_MIN_MS = 30_000;
+const AUTH_TIMEOUT_MAX_MS = 30 * 60_000;
 const DEFAULT_EXPIRES_IN_SECONDS = 86_400;
 // PKCE code exchange against {base}/api/cli/auth/exchange.
 const EXCHANGE_TIMEOUT_MS = 10_000;
+/**
+ * Resolve the browser-auth wait. Explicit LoginOptions.timeoutMs wins;
+ * otherwise MODA_AUTH_TIMEOUT_MS (clamped); otherwise a 10-minute default that
+ * covers real Auth0 + MFA + slow consent without abandoning mid-login.
+ */
+export function resolveAuthTimeoutMs(options = {}) {
+    if (typeof options.timeoutMs === 'number' && Number.isFinite(options.timeoutMs)) {
+        return Math.max(1, Math.floor(options.timeoutMs));
+    }
+    const env = options.env ?? process.env;
+    const raw = env.MODA_AUTH_TIMEOUT_MS?.trim();
+    if (raw) {
+        const parsed = Number.parseInt(raw, 10);
+        if (Number.isFinite(parsed) && parsed > 0) {
+            return Math.min(AUTH_TIMEOUT_MAX_MS, Math.max(AUTH_TIMEOUT_MIN_MS, parsed));
+        }
+    }
+    return DEFAULT_AUTH_TIMEOUT_MS;
+}
 function escapeHtml(value) {
     return value
         .replace(/&/g, '&')
@@ -209,7 +232,7 @@ export async function login(screen = 'login', options = {}) {
                             // flips. The flag only needs to clear on failure, where a
                             // retry paste is still legitimate.
                             res.writeHead(302, {
-                                Location: `${resolveModaBaseUrl()}/auth/cli/done?status=success`,
+                                Location: `${resolveModaBaseUrl(storageOptions)}/auth/cli/done?status=success`,
                                 Connection: 'close',
                             });
                             res.end(() => {
@@ -220,7 +243,7 @@ export async function login(screen = 'login', options = {}) {
                             exchangeInFlight = false;
                             const error = err instanceof Error ? err : new Error(String(err));
                             res.writeHead(302, {
-                                Location: `${resolveModaBaseUrl()}/auth/cli/done` +
+                                Location: `${resolveModaBaseUrl(storageOptions)}/auth/cli/done` +
                                     `?status=error&reason=${exchangeFailureReason(err)}`,
                                 Connection: 'close',
                             });
@@ -538,7 +561,7 @@ export async function login(screen = 'login', options = {}) {
         }
         timeout = setTimeout(() => {
             fail(new Error('Authentication timed out. Please try again.'));
-        }, options.timeoutMs ?? AUTH_TIMEOUT_MS);
+        }, resolveAuthTimeoutMs({ timeoutMs: options.timeoutMs, env: options.env }));
         server.on('error', (err) => {
             if (settled)
                 return;

package/dist/cli.js

@@ -181,9 +181,11 @@ Commands:
   prompts sync                     Upload changed prompt versions
   prompts sync --watch             Upload again when prompt files change
   prompts promote <key>            Move a dev/staging/prod label
+  prompts ab                       Run a judged prompt A/B replay experiment
 
   Skills:
   skills gen                       Kick off tenant-wide skill generation
+  skills status [run-id]           Show a generation run's status, outcome, and recent events (default: latest run)
   skills pull                      Pull tenant-generated skills into .claude/skills (and .cursor/rules)
   skills pull --status=proposed    Include not-yet-promoted skills (default: approved)
   skills sync                      Push local .claude/skills/**/SKILL.md up to Moda
@@ -309,6 +311,7 @@ Examples:
   moda prompts status
   moda prompts sync
   moda prompts promote support.triage --label=prod --version=pver_abc123
+  moda prompts ab --baseline=prompts/agent.prompt.md --candidate=prompts/agent-v2.prompt.md --conversations=conv_1,conv_2
   moda skills pull`);
 }
 // --- Command Handlers ---
@@ -1056,7 +1059,7 @@ export const commandRegistry = createCommandRegistry([
     legacyCommand({
         name: 'prompts',
         description: 'Manage prompt versions and labels',
-        examples: ['moda prompts status', 'moda prompts sync'],
+        examples: ['moda prompts status', 'moda prompts sync', 'moda prompts ab --baseline=old.md --candidate=new.md'],
         auth: 'api-key',
         outputModes: ['human', 'json', 'agent'],
         mutability: 'write',
@@ -1121,7 +1124,7 @@ export const commandRegistry = createCommandRegistry([
     {
         name: 'skills',
         description: 'Generate, pull, and sync Moda skills',
-        examples: ['moda skills gen', 'moda skills pull', 'moda skills sync'],
+        examples: ['moda skills gen', 'moda skills status', 'moda skills pull', 'moda skills sync'],
         auth: 'none',
         outputModes: ['human', 'json', 'agent'],
         mutability: 'write',

package/dist/doctor.js

@@ -7,7 +7,7 @@ import { isAuthSessionValid, loadAuthSession } from './auth.js';
 import { resolveApiKey, resolveIngestUrl, resolveModaBaseUrl, resolveTenantId } from './config.js';
 import { readHarnessSyncState, scanHarness } from './harness.js';
 import { HARNESS_REPORT_APPROVAL_PATH, HARNESS_REPORT_APPROVAL_SCHEMA_VERSION, HARNESS_REPORT_PATH, hashHarnessReport, readHarnessReport, validateHarnessReport, } from './harness-report.js';
-import { ensureSecretFilePermissions, getActiveProfile, getModaPaths, loadProfileConfig, resolveSecretReference, secretFilePathFromRef, } from './profiles.js';
+import { ensureSecretFilePermissions, getActiveProfile, getModaPaths, isLoopbackBaseUrl, loadProfileConfig, resolveSecretReference, secretFilePathFromRef, } from './profiles.js';
 import { renderDoctorHuman, renderStatusHuman } from './tui.js';
 export async function runDoctorCommand(context) {
     const report = await buildDoctorReport(context, {
@@ -132,6 +132,7 @@ export async function buildDoctorReport(context, options) {
     }
     checks.push(urlCheck('base_url_valid', 'config', 'Base URL is valid', baseUrl));
     checks.push(urlCheck('ingest_url_valid', 'config', 'Ingest URL is valid', ingestUrl));
+    checks.push(localBaseUrlCheck(activeProfile.environment, baseUrl));
     const manifestPath = join(context.cwd, '.moda', 'harness.json');
     const manifestExists = existsSync(manifestPath);
     checks.push({
@@ -287,6 +288,82 @@ function urlCheck(id, group, title, value) {
         nextCommand: valid ? undefined : 'moda profiles create',
     };
 }
+/**
+ * Local stacks mount `/auth/cli` and `/api/*` CLI/control proxies on the
+ * frontend (`:3000` by default). Pointing `base_url` at the backend (`:3001`)
+ * breaks browser login even though some Nest routes still answer there.
+ */
+function localBaseUrlCheck(environment, baseUrl) {
+    // Only the `local` profile targets a loopback worktree stack. `dev` defaults to
+    // remote `https://moda.dev`, so including it here warns valid remote configs.
+    if (environment !== 'local') {
+        return {
+            id: 'local_base_url_frontend',
+            group: 'config',
+            title: 'Local base URL targets the frontend',
+            status: 'skipped',
+            severity: 'info',
+            evidence: [{ label: 'environment', value: environment }],
+        };
+    }
+    let port = null;
+    let loopback = false;
+    try {
+        const parsed = new URL(baseUrl);
+        loopback = isLoopbackBaseUrl(baseUrl);
+        port = parsed.port || (parsed.protocol === 'https:' ? '443' : '80');
+    }
+    catch {
+        return {
+            id: 'local_base_url_frontend',
+            group: 'config',
+            title: 'Local base URL targets the frontend',
+            status: 'fail',
+            severity: 'critical',
+            evidence: [{ label: 'base_url', value: baseUrl }],
+            remediation: 'Set the local profile base URL to the frontend origin (http://localhost:3000).',
+            nextCommand: 'moda profiles create local --environment local --base-url http://localhost:3000',
+        };
+    }
+    const looksLikeBackend = loopback && (port === '3001' || port === '3002');
+    if (looksLikeBackend) {
+        return {
+            id: 'local_base_url_frontend',
+            group: 'config',
+            title: 'Local base URL targets the frontend',
+            status: 'warning',
+            severity: 'warning',
+            evidence: [
+                { label: 'base_url', value: baseUrl },
+                { label: 'port', value: port ?? 'unknown' },
+            ],
+            remediation: 'Local CLI auth and control APIs are served by the frontend. ' +
+                'Use http://localhost:3000 (or your worktree frontend port), not the backend :3001.',
+            nextCommand: 'moda profiles create local --environment local --base-url http://localhost:3000 --use',
+        };
+    }
+    if (!loopback) {
+        return {
+            id: 'local_base_url_frontend',
+            group: 'config',
+            title: 'Local base URL targets the frontend',
+            status: 'warning',
+            severity: 'warning',
+            evidence: [{ label: 'base_url', value: baseUrl }],
+            remediation: 'Local profile should use a loopback frontend URL (http://localhost:3000). ' +
+                'Activate with `moda profiles use local` or set MODA_PROFILE=local.',
+            nextCommand: 'moda profiles use local',
+        };
+    }
+    return {
+        id: 'local_base_url_frontend',
+        group: 'config',
+        title: 'Local base URL targets the frontend',
+        status: 'pass',
+        severity: 'info',
+        evidence: [{ label: 'base_url', value: baseUrl }],
+    };
+}
 function harnessCurrentCheck(cwd, manifestPath, manifestExists, tenantId) {
     if (!manifestExists) {
         return {

package/dist/harness-artifact-bodies.d.ts

@@ -11,6 +11,13 @@ export interface ArtifactBodyFileItem {
     text?: string;
 }
 export declare function extractToolBodyFromText(text: string, toolName: string): string | undefined;
+export declare function annotatedSourceCandidates(sourcePath: string, annotation: ArtifactBodyAnnotation): string[];
+/**
+ * Resolve an annotated artifact `path=` to a repo-relative sourcePath.
+ * Prefer the nested annotation-relative file when present so later whole-file
+ * hydration and content hashing look in the right place.
+ */
+export declare function resolveAnnotatedSourcePath(sourcePath: string, annotation: ArtifactBodyAnnotation): string;
 export declare function readPromptOrToolBody(type: HarnessArtifactType, sourcePath: string, annotation: ArtifactBodyAnnotation): string | undefined;
 export declare function extractToolBody(file: ArtifactBodyFileItem, tool: {
     name: string;

package/dist/harness-artifact-bodies.js

@@ -26,6 +26,21 @@ function isSecretishPath(path) {
 function isOutsideRoot(rel) {
     return rel === '' || rel === '..' || rel.startsWith('../') || isAbsolute(rel);
 }
+/** Walk from `fromAbs` up to `rootAbs` (inclusive), bounded by `maxDepth`. */
+function walkAncestorDirs(fromAbs, rootAbs, maxDepth = 8) {
+    const dirs = [];
+    let cursor = fromAbs;
+    for (let depth = 0; depth < maxDepth; depth += 1) {
+        dirs.push(cursor);
+        if (normalizePath(cursor) === normalizePath(rootAbs))
+            break;
+        const parent = dirname(cursor);
+        if (parent === cursor)
+            break;
+        cursor = parent;
+    }
+    return dirs;
+}
 function readBoundedRepoText(absPath, rootDir) {
     if (!existsSync(absPath))
         return undefined;
@@ -113,18 +128,31 @@ export function extractToolBodyFromText(text, toolName) {
     }
     return undefined;
 }
-function readAnnotatedSourceText(sourcePath, annotation) {
+export function annotatedSourceCandidates(sourcePath, annotation) {
     const explicitSourcePath = normalizePath(sourcePath) !== normalizePath(annotation.evidence.path);
-    const candidates = explicitSourcePath ? [
-        resolve(annotation.rootDir, sourcePath),
-        resolve(dirname(annotation.sourceAbsPath), sourcePath),
-    ] : [
-        resolve(annotation.rootDir, sourcePath),
-        resolve(dirname(annotation.sourceAbsPath), sourcePath),
-        annotation.sourceAbsPath,
-    ];
+    // Relative `path=` annotations in nested packages usually mean "relative to the
+    // package/harness root that owns the annotated file", not the file's own directory.
+    // Example: harnesses/boardy-ops/src/ops.ts with path=prompts/ops-system.prompt.md
+    // resolves to harnesses/boardy-ops/prompts/ops-system.prompt.md (one level up from
+    // src/), not harnesses/boardy-ops/src/prompts/... Walk parents between the
+    // annotated file and the scan root, then fall back to the scan-root candidate
+    // for flat repos that annotate from the repository root.
+    if (!explicitSourcePath) {
+        return [
+            resolve(annotation.rootDir, sourcePath),
+            resolve(dirname(annotation.sourceAbsPath), sourcePath),
+            annotation.sourceAbsPath,
+        ];
+    }
+    const rootAbs = resolve(annotation.rootDir);
+    const candidates = walkAncestorDirs(dirname(annotation.sourceAbsPath), rootAbs)
+        .map((dir) => resolve(dir, sourcePath));
+    candidates.push(resolve(annotation.rootDir, sourcePath));
+    return candidates;
+}
+function readAnnotatedSourceText(sourcePath, annotation) {
     const seen = new Set();
-    for (const candidate of candidates) {
+    for (const candidate of annotatedSourceCandidates(sourcePath, annotation)) {
         if (seen.has(candidate))
             continue;
         seen.add(candidate);
@@ -134,6 +162,25 @@ function readAnnotatedSourceText(sourcePath, annotation) {
     }
     return undefined;
 }
+/**
+ * Resolve an annotated artifact `path=` to a repo-relative sourcePath.
+ * Prefer the nested annotation-relative file when present so later whole-file
+ * hydration and content hashing look in the right place.
+ */
+export function resolveAnnotatedSourcePath(sourcePath, annotation) {
+    const seen = new Set();
+    for (const candidate of annotatedSourceCandidates(sourcePath, annotation)) {
+        if (seen.has(candidate))
+            continue;
+        seen.add(candidate);
+        if (readBoundedRepoText(candidate, annotation.rootDir) === undefined)
+            continue;
+        const rel = normalizePath(relative(annotation.rootDir, candidate));
+        if (!isOutsideRoot(rel))
+            return rel;
+    }
+    return sourcePath;
+}
 export function readPromptOrToolBody(type, sourcePath, annotation) {
     if (!requiresArtifactBody(type))
         return undefined;
@@ -154,7 +201,8 @@ export function extractToolBody(file, tool) {
 }
 function hydrateArtifactBody(artifact, rootDir) {
     if (artifact.sourcePath) {
-        const wholeFile = readRepoRelativeText(rootDir, artifact.sourcePath);
+        const wholeFile = readRepoRelativeText(rootDir, artifact.sourcePath)
+            ?? readSourcePathRelativeToEvidence(artifact, rootDir);
         if (wholeFile !== undefined) {
             if (artifact.type === 'prompt' || isDedicatedToolFilePath(artifact.sourcePath)) {
                 return wholeFile;
@@ -174,6 +222,25 @@ function hydrateArtifactBody(artifact, rootDir) {
     }
     return undefined;
 }
+/**
+ * Fallback for nested relative `sourcePath` values that were recorded before the
+ * annotation-relative resolver existed: walk parent dirs beside the evidence file
+ * looking for the package-local prompt/tool path.
+ */
+function readSourcePathRelativeToEvidence(artifact, rootDir) {
+    if (!artifact.sourcePath)
+        return undefined;
+    const evidencePath = firstEvidencePath(artifact);
+    if (!evidencePath)
+        return undefined;
+    const rootAbs = resolve(rootDir);
+    for (const dir of walkAncestorDirs(dirname(resolve(rootDir, evidencePath)), rootAbs)) {
+        const text = readBoundedRepoText(resolve(dir, artifact.sourcePath), rootDir);
+        if (text !== undefined)
+            return text;
+    }
+    return undefined;
+}
 export function hydratePromptAndToolBodies(graph, rootDir) {
     for (const artifact of graph.artifacts) {
         if (!requiresArtifactBody(artifact.type) || artifactHasBody(artifact)) {

package/dist/harness.d.ts

@@ -273,6 +273,12 @@ export declare function emitWrittenArtifacts(context: CommandContext, written: s
 export declare function repairExternalAnalystReport(report: HarnessReport, rootDir: string): HarnessReport;
 export declare function sleep(ms: number): Promise<void>;
 export declare function summarizeInvalidAnalystReport(report: unknown): Record<string, unknown>;
+/**
+ * The analyst spellings that select the deterministic local scanner (no LLM,
+ * no remote analyze). Shared by `normalizeAnalystAdapter` and `moda init`'s
+ * `resolveHarnessRemote` so the set cannot drift between the two.
+ */
+export declare function isDeterministicLocalAnalyst(raw: string | undefined): boolean;
 export type CodingAgentAdapter = ExternalHarnessAnalystAdapter;
 export interface CodingAgentRun {
     adapter: CodingAgentAdapter;

package/dist/harness.js

@@ -10,7 +10,7 @@ import { resolveApiKey, resolveTenantId } from './config.js';
 import { CliInputError, CliInputRequiredError } from './errors.js';
 import { isRemoteHarnessAnalyze, runRemoteHarnessAnalyst } from './harness-remote.js';
 import { getActiveProfile } from './profiles.js';
-import { enrichScanCaptureMetadata, extractToolBody, hydratePromptAndToolBodies, readPromptOrToolBody, } from './harness-artifact-bodies.js';
+import { enrichScanCaptureMetadata, annotatedSourceCandidates, extractToolBody, hydratePromptAndToolBodies, readPromptOrToolBody, resolveAnnotatedSourcePath, } from './harness-artifact-bodies.js';
 import { approveHarnessReport, createHarnessReport, graphForReport, hashHarnessReport, hashStableJson as hashHarnessReportStableJson, HARNESS_REPORT_PATH, loadHarnessReportForSync, normalizeHarnessReport, readHarnessReport, resolveHarnessReportPath, validateHarnessReport, writeHarnessReportArtifacts, } from './harness-report.js';
 import { assertHarnessGraphSyncSize } from './harness-sync-limits.js';
 import { renderHarnessAnalystChoice, renderHarnessAnalystLaunch, renderHarnessAnalystPreflight, renderHarnessAnalyzeHumanResult, renderHarnessProgress, } from './tui.js';
@@ -1201,6 +1201,15 @@ function shouldPromptForHarnessAnalyst(context) {
         !context.flags['analyst-command'] &&
         !process.env.MODA_HARNESS_ANALYST_COMMAND;
 }
+/**
+ * The analyst spellings that select the deterministic local scanner (no LLM,
+ * no remote analyze). Shared by `normalizeAnalystAdapter` and `moda init`'s
+ * `resolveHarnessRemote` so the set cannot drift between the two.
+ */
+export function isDeterministicLocalAnalyst(raw) {
+    const value = raw?.trim().toLowerCase();
+    return value === 'local-scan' || value === 'local' || value === 'scripted' || value === 'moda';
+}
 function normalizeAnalystAdapter(raw) {
     const value = (raw && raw !== 'true' ? raw : 'auto').trim().toLowerCase();
     if (value === 'auto')
@@ -1211,7 +1220,7 @@ function normalizeAnalystAdapter(raw) {
         return 'codex';
     if (value === 'cursor' || value === 'cursor-cli' || value === 'cursor_cli')
         return 'cursor';
-    if (value === 'local-scan' || value === 'local' || value === 'scripted' || value === 'moda')
+    if (isDeterministicLocalAnalyst(value))
         return 'local-scan';
     throw new CliInputError(`Unknown harness analyst '${raw}'.`, 'Use `--analyst=claude|codex|cursor|local-scan`.');
 }
@@ -2439,9 +2448,17 @@ function channelFromAnnotation(annotation) {
 function artifactFromAnnotation(annotation) {
     const values = annotation.values;
     const type = artifactType(first(values.kind) ?? first(values.type));
-    const sourcePath = first(values.path) ?? annotation.evidence.path;
+    const annotatedPath = first(values.path) ?? annotation.evidence.path;
+    // Canonicalize nested relative path= annotations to a repo-relative location
+    // so later whole-file body hydration and hashing find the real prompt/tool file.
+    const sourcePath = resolveAnnotatedSourcePath(annotatedPath, annotation);
     const id = first(values.id) ?? stableId(type, first(values.name) ?? sourcePath);
-    const body = readPromptOrToolBody(type, sourcePath, annotation);
+    // Body reads from the RAW annotated path on purpose: readPromptOrToolBody walks
+    // the annotation's ancestor dirs itself to locate nested-package files, so it
+    // must not be handed the already-canonicalized sourcePath. sourcePath and
+    // contentHash use the canonical path so downstream whole-file hydration and
+    // hashing resolve the same file the body came from.
+    const body = readPromptOrToolBody(type, annotatedPath, annotation);
     return {
         id,
         type,
@@ -3420,14 +3437,13 @@ function upsertDeployment(graph, next) {
     existing.environmentId = existing.environmentId ?? next.environmentId;
 }
 function contentHashForAnnotatedSource(sourcePath, annotation) {
-    const explicitSourcePath = normalizePath(sourcePath) !== normalizePath(annotation.evidence.path);
-    const candidates = explicitSourcePath ? [
-        resolve(annotation.rootDir, sourcePath),
-        resolve(dirname(annotation.sourceAbsPath), sourcePath),
-    ] : [
-        resolve(annotation.rootDir, sourcePath),
-        resolve(dirname(annotation.sourceAbsPath), sourcePath),
-        annotation.sourceAbsPath,
+    // Reuse the annotation-relative candidate resolver; prefer the canonicalized
+    // repo-relative path first so hashing matches hydrated artifact bodies.
+    const bodyAnnotation = annotation;
+    const rootCandidate = resolve(annotation.rootDir, sourcePath);
+    const candidates = [
+        rootCandidate,
+        ...annotatedSourceCandidates(sourcePath, bodyAnnotation).filter((c) => c !== rootCandidate),
     ];
     const seen = new Set();
     for (const candidate of candidates) {

package/dist/init/index.d.ts

@@ -30,8 +30,9 @@ export interface InitRunOptions {
 export declare function runInit(flags: Record<string, unknown>, options?: InitRunOptions): Promise<InitResult>;
 /**
  * Onboarding runs harness discovery SERVER-SIDE by default so the customer
- * needs no local coding agent. Opt out with `--local`, `--no-remote`, or
- * `--remote=false` to use a local coding-agent analyst instead.
+ * needs no local coding agent. Opt out with `--local`, `--no-remote`,
+ * `--remote=false`, or an explicit deterministic local analyst
+ * (`--analyst=local-scan|local|scripted|moda`).
  */
 export declare function resolveHarnessRemote(flags: Record<string, unknown>): boolean;
 //# sourceMappingURL=index.d.ts.map

package/dist/init/index.js

@@ -15,7 +15,7 @@ import { runSdkIntegration } from './sdk-integration.js';
 import { createCommandContext } from '../command-context.js';
 import { VERSION } from '../config.js';
 import { CliAuthError, CliInputError } from '../errors.js';
-import { runHarnessCommand } from '../harness.js';
+import { isDeterministicLocalAnalyst, runHarnessCommand } from '../harness.js';
 import { buildDoctorReport } from '../doctor.js';
 import { renderInitBanner, renderInitComplete, renderInitNote, renderInitSetupPlan, renderInitStep, } from '../tui.js';
 export async function runInit(flags, options = {}) {
@@ -676,8 +676,9 @@ function isTruthyFlag(value) {
 }
 /**
  * Onboarding runs harness discovery SERVER-SIDE by default so the customer
- * needs no local coding agent. Opt out with `--local`, `--no-remote`, or
- * `--remote=false` to use a local coding-agent analyst instead.
+ * needs no local coding agent. Opt out with `--local`, `--no-remote`,
+ * `--remote=false`, or an explicit deterministic local analyst
+ * (`--analyst=local-scan|local|scripted|moda`).
  */
 export function resolveHarnessRemote(flags) {
     if (isTruthyFlag(flagValue(flags, 'local')))
@@ -687,6 +688,13 @@ export function resolveHarnessRemote(flags) {
     const remote = parseOptionalBoolean(flagValue(flags, 'remote'));
     if (remote !== undefined)
         return remote;
+    // Scenarios and users that pin `--analyst=local-scan` mean "run the local
+    // deterministic scanner", not "upload to hosted analyze and poll". Treat that
+    // as an implicit local opt-out so moda-test live/onboarding suites and
+    // developer workflows do not hang waiting on remote analyze.
+    if (isDeterministicLocalAnalyst(stringFlag(flagValue(flags, 'analyst')))) {
+        return false;
+    }
     return true;
 }
 function flagValue(flags, ...keys) {

package/dist/init/tenant.js

@@ -360,7 +360,8 @@ export async function selectTenantAndCreateKey(options = {}) {
                     'This organization has reached its CLI API key limit.', {
                     // Command-agnostic: this path is shared by `moda init` and
                     // `moda provision`.
-                    guidance: 'Revoke old CLI keys in the dashboard (Settings -> API Keys), then retry.',
+                    guidance: 'Revoke unused "CLI - ..." keys in the dashboard (Settings → API Keys), ' +
+                        'or reuse the existing key already saved in ~/.moda/config.json from a previous moda init / moda provision --save, then retry.',
                 });
             }
             throw new Error(`Failed to create API key (409): ${body}`);

package/dist/manifest.js

@@ -27,6 +27,7 @@ export function buildManifest(commands) {
             'MODA_TENANT_ID',
             'MODA_PROFILE',
             'MODA_BASE_URL',
+            'MODA_AUTH_TIMEOUT_MS',
             'MODA_HEARTBEAT_MS',
             'MODA_AGENT_MAX_OUTPUT_BYTES',
             'MODA_CLI_TELEMETRY',

package/dist/prompts-ab.d.ts

@@ -0,0 +1,18 @@
+import type { CommandContext } from './command-context.js';
+import type { ProfileIOOptions } from './profiles.js';
+export interface PromptArmPayload {
+    content: string;
+    prompt_version_id?: string;
+    prompt_id?: string;
+    prompt_label?: string;
+}
+export interface PromptAbResult {
+    replaySetId: string;
+    runId: string;
+    status: string;
+    verdict: string;
+    run: Record<string, unknown> | null;
+    cases: Array<Record<string, unknown>>;
+}
+export declare function runPromptAb(flags: Record<string, string>, profileOptions: ProfileIOOptions, context: CommandContext): Promise<void>;
+//# sourceMappingURL=prompts-ab.d.ts.map

package/dist/prompts-ab.js

@@ -0,0 +1,243 @@
+import { existsSync } from 'node:fs';
+import { isAbsolute, resolve } from 'node:path';
+import { callControlAPI, callDataAPI } from './api-client.js';
+import { resolveTenantId, validateConfig } from './config.js';
+import { discoverPrompts, parsePromptFileForAb, readPromptLock, runPromptSync, } from './prompts.js';
+const DEFAULT_SEEDS_PER_CASE = 3;
+const DEFAULT_POLL_INTERVAL_MS = 15_000;
+const DEFAULT_WAIT_TIMEOUT_MS = 2 * 60 * 60 * 1000;
+const TERMINAL_RUN_STATUSES = new Set(['completed', 'skipped', 'error']);
+export async function runPromptAb(flags, profileOptions, context) {
+    validateConfig();
+    const tenantId = flags['tenant-id'] || resolveTenantId(profileOptions);
+    if (!tenantId) {
+        throw new Error('Missing tenant id. Run `moda init` or pass --tenant-id=<id>.');
+    }
+    const baselineSource = flags.baseline || flags['baseline-file'] || flags['baseline-key'];
+    const candidateSource = flags.candidate || flags['candidate-file'] || flags['candidate-key'];
+    if (!baselineSource || !candidateSource) {
+        throw new Error('Usage: moda prompts ab --baseline=<file|key> --candidate=<file|key> [--auto-generate|--set-id=ID|--conversations=id1,id2]');
+    }
+    if (flags.sync === 'true') {
+        await runPromptSync({ ...flags, watch: 'false' }, profileOptions);
+    }
+    const promptArms = {
+        prod: resolvePromptArmSpec(baselineSource, 'baseline'),
+        proposed: resolvePromptArmSpec(candidateSource, 'candidate'),
+    };
+    const replaySetId = await ensureReplaySet(flags, tenantId, profileOptions);
+    const seedsPerCase = parsePositiveInt(flags.seeds ?? flags['seeds-per-case'], DEFAULT_SEEDS_PER_CASE, 10);
+    const assistantModel = (flags.model ?? flags['assistant-model'] ?? '').trim();
+    const enqueue = await callControlAPI(`/tenants/${encodeURIComponent(tenantId)}/replay-sets/${encodeURIComponent(replaySetId)}/run`, {
+        method: 'POST',
+        body: JSON.stringify({
+            promptArms,
+            seedsPerCase,
+            assistantModel: assistantModel || undefined,
+            promotePrimary: flags['no-promote'] !== 'true',
+        }),
+    }, profileOptions, { timeoutMs: 120_000, retries: 1 });
+    const noWait = flags.wait === 'false' || flags['no-wait'] === 'true';
+    if (noWait) {
+        context.output.writeData({
+            replaySetId,
+            runId: enqueue.runId,
+            status: enqueue.status,
+            message: enqueue.message ?? 'Replay comparison queued',
+        });
+        return;
+    }
+    const timeoutMs = parsePositiveInt(flags.timeout, DEFAULT_WAIT_TIMEOUT_MS, 24 * 60 * 60 * 1000);
+    const pollIntervalMs = parsePositiveInt(flags['poll-interval'], DEFAULT_POLL_INTERVAL_MS, 120_000);
+    const deadline = Date.now() + timeoutMs;
+    let latest = null;
+    while (Date.now() < deadline) {
+        latest = await fetchLatestRun(tenantId, replaySetId, enqueue.runId, profileOptions);
+        const status = latest.run?.status ?? '';
+        const runId = latest.run?.runId ?? '';
+        if (TERMINAL_RUN_STATUSES.has(status) && runId === enqueue.runId) {
+            break;
+        }
+        if (context.outputMode === 'human') {
+            process.stderr.write(`Waiting for replay run (${status || 'pending'})...\n`);
+        }
+        await sleep(pollIntervalMs);
+    }
+    if (!latest?.run
+        || latest.run.runId !== enqueue.runId
+        || !TERMINAL_RUN_STATUSES.has(latest.run.status)) {
+        throw new Error(`Timed out after ${timeoutMs}ms waiting for replay run ${enqueue.runId} to finish`);
+    }
+    const result = {
+        replaySetId,
+        runId: latest.run.runId,
+        status: latest.run.status,
+        verdict: formatVerdict(latest),
+        run: { ...latest.run },
+        cases: latest.cases.map((row) => ({ ...row })),
+    };
+    if (context.outputMode === 'human') {
+        printHumanVerdict(result);
+    }
+    context.output.writeData(result);
+}
+function resolvePromptArmSpec(source, label) {
+    const trimmed = source.trim();
+    if (!trimmed) {
+        throw new Error(`Empty prompt source for ${label}`);
+    }
+    const absPath = isAbsolute(trimmed) ? trimmed : resolve(process.cwd(), trimmed);
+    let key;
+    let content;
+    if (existsSync(absPath)) {
+        const parsed = parsePromptFileForAb(absPath);
+        key = parsed.key;
+        content = parsed.content;
+    }
+    else {
+        const discovered = discoverPrompts();
+        const match = discovered.find((prompt) => prompt.key === trimmed)
+            ?? discovered.find((prompt) => prompt.sourcePath === trimmed);
+        if (!match) {
+            throw new Error(`Could not resolve prompt '${trimmed}' — pass a .prompt.md path or a discovered prompt key`);
+        }
+        key = match.key;
+        content = match.content;
+    }
+    const locked = readPromptLock()?.prompts[key];
+    return {
+        content,
+        prompt_version_id: locked?.versionId ?? '',
+        prompt_id: locked?.promptId ?? '',
+        prompt_label: label,
+    };
+}
+async function ensureReplaySet(flags, tenantId, profileOptions) {
+    const existingSetId = (flags['set-id'] || flags['replay-set-id'] || '').trim();
+    if (existingSetId) {
+        return existingSetId;
+    }
+    const conversations = parseCsv(flags.conversations ?? flags['conversation-ids']);
+    if (conversations.length) {
+        return createSetFromConversations(conversations, flags, tenantId, profileOptions);
+    }
+    if (flags['auto-generate'] === 'false' && !existingSetId) {
+        throw new Error('Provide --set-id=, --conversations=, or allow --auto-generate (default)');
+    }
+    const caseCount = parsePositiveInt(flags.cases ?? flags['case-count'], 5, 25);
+    const lookbackDays = parsePositiveInt(flags['lookback-days'], 30, 365);
+    const name = (flags.name ?? flags['set-name'] ?? `Prompt A/B ${new Date().toISOString().slice(0, 10)}`).trim();
+    const generated = await callControlAPI(`/tenants/${encodeURIComponent(tenantId)}/replay-sets/auto-generate`, {
+        method: 'POST',
+        body: JSON.stringify({ name, caseCount, lookbackDays }),
+    }, profileOptions, { timeoutMs: 300_000, retries: 0 });
+    if (!generated?.id) {
+        throw new Error('Auto-generate did not return a replay set id');
+    }
+    return generated.id;
+}
+async function createSetFromConversations(conversationIds, flags, tenantId, profileOptions) {
+    const name = (flags.name ?? flags['set-name'] ?? `Prompt A/B ${conversationIds.length} conv`).trim();
+    const created = await callControlAPI(`/tenants/${encodeURIComponent(tenantId)}/replay-sets`, {
+        method: 'POST',
+        body: JSON.stringify({ name, description: 'Created by moda prompts ab' }),
+    }, profileOptions);
+    let position = 0;
+    for (const conversationId of conversationIds) {
+        const scenario = await loadScenarioFromConversation(conversationId);
+        await callControlAPI(`/tenants/${encodeURIComponent(tenantId)}/replay-sets/${encodeURIComponent(created.id)}/cases`, {
+            method: 'POST',
+            body: JSON.stringify({
+                title: conversationId,
+                scenario,
+                sourceConversationId: conversationId,
+                successCriteria: [
+                    'The agent understands the user request',
+                    'The agent uses tools appropriately when needed',
+                    'The agent provides a helpful final answer',
+                ],
+                position: position++,
+            }),
+        }, profileOptions);
+    }
+    return created.id;
+}
+async function loadScenarioFromConversation(conversationId) {
+    try {
+        const data = await callDataAPI(`/conversations/${encodeURIComponent(conversationId)}/context?msg_index=0&window=0`);
+        const firstUser = (data.messages ?? []).find((message) => message.role === 'user' && String(message.content ?? '').trim());
+        const opening = String(firstUser?.content ?? '').trim();
+        if (opening) {
+            return `The user says: "${opening}"\n\nReplay the conversation faithfully and help them accomplish their goal.`;
+        }
+    }
+    catch {
+        // Fall through to generic scenario.
+    }
+    return `Replay conversation ${conversationId}: help the user accomplish their original goal using the available tools.`;
+}
+async function fetchLatestRun(tenantId, replaySetId, runId, profileOptions) {
+    // Pin the poll to OUR run id — otherwise a concurrent comparison on the same
+    // set would make `/runs/latest` return the newer run forever and this command
+    // would stall until timeout even after its own run finished.
+    return callControlAPI(`/tenants/${encodeURIComponent(tenantId)}/replay-sets/${encodeURIComponent(replaySetId)}/runs/latest?runId=${encodeURIComponent(runId)}`, { method: 'GET' }, profileOptions, { timeoutMs: 60_000, retries: 2 });
+}
+function formatVerdict(payload) {
+    const run = payload.run;
+    if (!run)
+        return 'no run';
+    if (run.status === 'skipped')
+        return `skipped: ${run.notes || 'no reason'}`;
+    if (run.status === 'error')
+        return `error: ${run.notes || 'unknown error'}`;
+    if (run.status !== 'completed')
+        return `status=${run.status}`;
+    const delta = run.proposedPassCount - run.prodPassCount;
+    const winner = delta > 0 ? 'candidate wins' : delta < 0 ? 'baseline wins' : 'tie on case passes';
+    const rates = `baseline ${run.prodPassCount}/${run.caseCount} (${pct(run.prodPassRate)}), candidate ${run.proposedPassCount}/${run.caseCount} (${pct(run.proposedPassRate)})`;
+    const notes = run.notes?.trim();
+    return `${winner}; ${rates}${notes ? `; ${notes}` : ''}`;
+}
+function printHumanVerdict(result) {
+    process.stderr.write('\nPrompt A/B replay verdict\n');
+    process.stderr.write('-------------------------\n');
+    process.stderr.write(`Replay set: ${result.replaySetId}\n`);
+    process.stderr.write(`Run id:     ${result.runId}\n`);
+    process.stderr.write(`Status:     ${result.status}\n`);
+    process.stderr.write(`Verdict:    ${result.verdict}\n`);
+    if (result.cases.length) {
+        process.stderr.write('\nPer-case:\n');
+        for (const row of result.cases) {
+            const caseId = String(row.caseId ?? '');
+            const prod = formatPass(row.prodPass);
+            const proposed = formatPass(row.proposedPass);
+            process.stderr.write(`  ${caseId}: baseline=${prod} candidate=${proposed}\n`);
+        }
+    }
+    process.stderr.write('\n');
+}
+function formatPass(value) {
+    if (value === null || value === undefined)
+        return 'abstained';
+    return value ? 'pass' : 'fail';
+}
+function pct(rate) {
+    return `${Math.round(Math.max(0, Math.min(1, rate)) * 100)}%`;
+}
+function parsePositiveInt(raw, fallback, max) {
+    if (!raw)
+        return fallback;
+    const parsed = Number.parseInt(raw, 10);
+    if (!Number.isFinite(parsed) || parsed < 1)
+        return fallback;
+    return Math.min(parsed, max);
+}
+function parseCsv(raw) {
+    if (!raw?.trim())
+        return [];
+    return raw.split(',').map((part) => part.trim()).filter(Boolean);
+}
+function sleep(ms) {
+    return new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
+}
+//# sourceMappingURL=prompts-ab.js.map

package/dist/prompts.d.ts

@@ -1,5 +1,32 @@
 import { type CommandContext } from './command-context.js';
 import type { ProfileIOOptions } from './profiles.js';
+interface PromptFile {
+    key: string;
+    name: string;
+    description?: string;
+    category?: string;
+    sourcePath: string;
+    content: string;
+    systemPrompt?: string;
+    messages?: unknown[];
+    variables?: unknown[];
+    variablesSchema?: Record<string, unknown>;
+    modelConfig?: Record<string, unknown>;
+    toolRefs?: unknown[];
+    responseSchema?: Record<string, unknown>;
+    contentHash: string;
+}
+interface PromptLock {
+    version: 1;
+    generatedAt: string;
+    prompts: Record<string, {
+        key: string;
+        sourcePath: string;
+        contentHash: string;
+        versionId?: string;
+        promptId?: string;
+    }>;
+}
 export declare function runPromptsCommand(input: CommandContext | string[], legacyFlags?: Record<string, string>, legacyProfileOptions?: ProfileIOOptions): Promise<void>;
 export declare function initPrompts(options?: {
     silent?: boolean;
@@ -20,4 +47,12 @@ export interface PromptSyncResult {
  * control their own output. `moda prompts sync` wraps this with JSON output.
  */
 export declare function runPromptSync(flags: Record<string, string>, profileOptions: ProfileIOOptions): Promise<PromptSyncResult>;
+export declare function discoverPrompts(): PromptFile[];
+export declare function readPromptLock(): PromptLock | null;
+/** Parse a prompt file for A/B runs (body text + registry key). */
+export declare function parsePromptFileForAb(absPath: string): {
+    key: string;
+    content: string;
+};
+export {};
 //# sourceMappingURL=prompts.d.ts.map

package/dist/prompts.js

@@ -4,6 +4,7 @@ import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, writeFileS
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { callControlAPI } from './api-client.js';
 import { createCommandContext } from './command-context.js';
+import { runPromptAb } from './prompts-ab.js';
 const MODA_DIR = '.moda';
 const MANIFEST_PATH = join(MODA_DIR, 'prompts.yml');
 const LOCK_PATH = join(MODA_DIR, 'prompts.lock.json');
@@ -51,8 +52,11 @@ export async function runPromptsCommand(input, legacyFlags, legacyProfileOptions
         case 'promote':
             await promotePrompt(positionals, flags, profileOptions, context);
             break;
+        case 'ab':
+            await runPromptAb(flags, profileOptions, context);
+            break;
         default:
-            throw new Error(`Unknown prompts command '${subcommand}'. Use init, status, diff, sync, or promote.`);
+            throw new Error(`Unknown prompts command '${subcommand}'. Use init, status, diff, sync, promote, or ab.`);
     }
 }
 export async function initPrompts(options = {}) {
@@ -195,7 +199,7 @@ async function getPromptStatus() {
         prompts: rows,
     };
 }
-function discoverPrompts() {
+export function discoverPrompts() {
     const manifest = readManifest();
     // A pattern like `src/prompts/**/*.prompt.md` should *only* match files under
     // src/prompts. Extract both the base directory (everything up to the first
@@ -290,6 +294,14 @@ function readManifest() {
         .filter((path) => path.includes('.prompt.'));
     return { promptPaths: promptPaths.length ? promptPaths : DEFAULT_PROMPT_PATHS };
 }
+export function readPromptLock() {
+    return readLock();
+}
+/** Parse a prompt file for A/B runs (body text + registry key). */
+export function parsePromptFileForAb(absPath) {
+    const parsed = parsePromptFile(absPath);
+    return { key: parsed.key, content: parsed.content };
+}
 function readLock() {
     if (!existsSync(LOCK_PATH))
         return null;

package/dist/skills.js

@@ -74,6 +74,108 @@ async function fetchSkills(status) {
         status,
     };
 }
+/**
+ * Authenticated GET against the ingest worker's `/v1/skills/runs` surface.
+ * Returns `{ status, body }` so callers can treat 404 (no such run) as data;
+ * every other non-2xx throws.
+ */
+async function skillRunsRequest(url) {
+    const apiKey = resolveApiKey();
+    if (!apiKey) {
+        throw new CliInputError('No Moda API key found. Run `moda init` first (or set MODA_API_KEY).');
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), SKILLS_REQUEST_TIMEOUT_MS);
+    let response;
+    try {
+        response = await fetch(url, {
+            headers: { Authorization: `Bearer ${apiKey}` },
+            signal: controller.signal,
+        });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Network error: failed to reach ${url} (${message})`);
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+    const text = await response.text().catch(() => '');
+    if (!response.ok && response.status !== 404) {
+        throw new Error(`Failed to fetch run status (HTTP ${response.status}): ${text.slice(0, 200)}`);
+    }
+    let body = {};
+    try {
+        body = text ? JSON.parse(text) : {};
+    }
+    catch {
+        body = {};
+    }
+    return { status: response.status, body };
+}
+/**
+ * Resolve a run's status + recent events. Without a run id, the tenant's
+ * latest run (`GET /v1/skills/runs?limit=1`) is used; the detail form
+ * (`GET /v1/skills/runs/:id`) always supplies the event breadcrumbs.
+ */
+async function fetchSkillRunStatus(runId) {
+    const ingestUrl = resolveIngestUrl().replace(/\/$/, '');
+    let resolvedRunId = runId;
+    if (!resolvedRunId) {
+        const list = await skillRunsRequest(`${ingestUrl}/v1/skills/runs?limit=1`);
+        const listBody = list.body;
+        const latest = Array.isArray(listBody.runs) ? listBody.runs[0] : undefined;
+        if (!latest)
+            return { run: null, events: [] };
+        resolvedRunId = latest.generation_run_id;
+        // Defensive: a row without an id can still be shown, just without events.
+        if (!resolvedRunId)
+            return { run: latest, events: [] };
+    }
+    const detail = await skillRunsRequest(`${ingestUrl}/v1/skills/runs/${encodeURIComponent(resolvedRunId)}`);
+    if (detail.status === 404) {
+        if (runId) {
+            throw new CliInputError(`No skill generation run found with id '${runId}'`);
+        }
+        return { run: null, events: [] };
+    }
+    const detailBody = detail.body;
+    return {
+        run: detailBody.run ?? null,
+        events: Array.isArray(detailBody.events) ? detailBody.events : [],
+    };
+}
+const STATUS_HUMAN_EVENT_LIMIT = 10;
+/** Human rendering for `moda skills status` (key: value lines, gen-style). */
+function formatRunStatusHuman(run, events) {
+    const counters = run.counters ?? {};
+    const lines = [
+        run.generation_run_id && `run: ${run.generation_run_id}`,
+        `status: ${run.status || 'unknown'}`,
+        run.current_stage && `stage: ${run.current_stage}`,
+        run.outcome && `outcome: ${run.outcome}`,
+        `processed: ${Number(counters.sessions_processed ?? 0)}`,
+        `failed: ${Number(counters.sessions_failed ?? 0)}`,
+        Number(counters.distilled_skills_generated ?? 0) > 0
+            && `distilled: ${Number(counters.distilled_skills_generated ?? 0)}`,
+        Number(counters.skills_indexed ?? 0) > 0
+            && `indexed: ${Number(counters.skills_indexed ?? 0)}`,
+        (run.generated_skill_ids?.length ?? 0) > 0
+            && `skills: ${(run.generated_skill_ids ?? []).join(', ')}`,
+        run.error && `error: ${run.error}`,
+        run.started_at && `started: ${run.started_at}`,
+        run.updated_at && `updated: ${run.updated_at}`,
+    ].filter(Boolean);
+    if (events.length > 0) {
+        lines.push('recent events (newest first):');
+        for (const event of events.slice(0, STATUS_HUMAN_EVENT_LIMIT)) {
+            lines.push(`  ${[event.created_at, event.level, event.stage, event.message]
+                .filter(Boolean)
+                .join('  ')}`);
+        }
+    }
+    return lines.join('\n');
+}
 /**
  * Write `content` to `filePath`, creating parent dirs. Returns whether the
  * file was created, updated (content differed), or left unchanged.
@@ -463,6 +565,8 @@ export async function runSkillsCommand(input) {
                 'accepted: true',
                 result.generation_run_id && `generation_run_id: ${result.generation_run_id}`,
                 result.message && `message: ${result.message}`,
+                result.generation_run_id
+                    && `follow progress: moda skills status ${result.generation_run_id}`,
             ].filter(Boolean).join('\n'));
         }
         else {
@@ -473,10 +577,26 @@ export async function runSkillsCommand(input) {
                 `pending_found: ${result.pending_sessions_found ?? 0}`,
                 `distilled: ${Number(result.cluster_result?.distilled_skills_generated ?? 0)}`,
                 `indexed: ${Number(result.cluster_result?.skills_indexed ?? 0)}`,
-            ].join('\n'));
+                result.distillation_skipped
+                    && `distillation skipped: ${result.distillation_skip_reason || 'unknown'}`,
+            ].filter(Boolean).join('\n'));
         }
         return Number(result.sessions_failed ?? 0) > 0 ? 1 : 0;
     }
+    if (sub === 'status') {
+        const runId = positionals[1] || flags['run-id'] || undefined;
+        const { run, events } = await fetchSkillRunStatus(runId);
+        if (context.outputMode !== 'human') {
+            context.output.writeData({ run, events }, { status: run?.status === 'failed' ? 'error' : 'success' });
+        }
+        else if (!run) {
+            console.log('No skill generation runs found yet. Start one with `moda skills gen`.');
+        }
+        else {
+            console.log(formatRunStatusHuman(run, events));
+        }
+        return run?.status === 'failed' ? 1 : 0;
+    }
     if (sub === 'proposals' && positionals[1] === 'list') {
         const proposals = await fetchSkillProposals(flags, { profile: context.profile });
         if (flags.json === 'true') {
@@ -533,7 +653,7 @@ export async function runSkillsCommand(input) {
         return 0;
     }
     if (sub !== 'pull') {
-        throw new CliInputError(sub ? `Unknown skills subcommand '${sub}'` : 'A skills subcommand is required', 'Usage: moda skills gen [--source=all|sdk|coding-agent] [--max-sessions=N] [--start-at=ISO] [--end-at=ISO] [--replay] [--replay-set-id=ID] [--reprocess-segments] [--force-reprocess] [--wait] | moda skills proposals list [--status=ready_for_pr] | moda skills proposal apply <proposal-id> | moda skills pull [--status=approved|proposed|all] | moda skills sync [--dry-run]');
+        throw new CliInputError(sub ? `Unknown skills subcommand '${sub}'` : 'A skills subcommand is required', 'Usage: moda skills gen [--source=all|sdk|coding-agent] [--max-sessions=N] [--start-at=ISO] [--end-at=ISO] [--replay] [--replay-set-id=ID] [--reprocess-segments] [--force-reprocess] [--wait] | moda skills status [run-id] | moda skills proposals list [--status=ready_for_pr] | moda skills proposal apply <proposal-id> | moda skills pull [--status=approved|proposed|all] | moda skills sync [--dry-run]');
     }
     const status = (flags.status ?? 'approved').toLowerCase();
     if (!VALID_STATUSES.has(status)) {
@@ -580,7 +700,7 @@ async function generateSkills(flags) {
         replay_set_id: flags['replay-set-id'] || flags['eval-set-id'] || undefined,
         run_clustering: flags['no-clustering'] !== 'true',
         source: normalizeSkillSource(flags.source),
-        clustering_timeout_seconds: parsePositiveInt(flags['clustering-timeout-seconds'], 0),
+        clustering_timeout_seconds: parsePositiveInt(flags['clustering-timeout-seconds'], 7200),
         clustering_poll_seconds: parsePositiveInt(flags['clustering-poll-seconds'], 15),
         max_cluster_pct: parseOptionalFloat(flags['max-cluster-pct']),
         reprocess_segments: flags['reprocess-segments'] === 'true' || forceReprocess,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.13.6",
+  "version": "1.13.8",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-07-07T22:20:09.380Z",
-  "cli_version": "1.13.6",
+  "bundled_at": "2026-07-08T03:25:26.235Z",
+  "cli_version": "1.13.8",
   "skills": [
     {
       "id": "integration-node-anthropic",