@moda-ai/cli 1.13.9 → 1.13.10

package/dist/harness-artifact-bodies.js

@@ -214,10 +214,18 @@ function hydrateArtifactBody(artifact, rootDir) {
     }
     const evidenceLine = firstEvidenceLineNumber(artifact.evidence);
     const evidencePath = firstEvidencePath(artifact);
-    if (evidencePath && evidenceLine !== undefined) {
+    if (evidencePath) {
         const text = readRepoRelativeText(rootDir, evidencePath);
         if (text !== undefined) {
-            return extractSnippetAroundLine(text, evidenceLine, artifact.type === 'tool' ? 30 : 80);
+            if (evidenceLine !== undefined) {
+                return extractSnippetAroundLine(text, evidenceLine, artifact.type === 'tool' ? 30 : 80);
+            }
+            // No line number (common for agent/hosted analyst citations): fall back to
+            // the whole evidence file so the body is still captured in full.
+            if (artifact.type === 'prompt' || isDedicatedToolFilePath(evidencePath))
+                return text;
+            if (artifact.type === 'tool')
+                return extractToolBodyFromText(text, artifact.name) ?? text;
         }
     }
     return undefined;

package/dist/harness-remote.js

@@ -97,15 +97,34 @@ export async function runRemoteHarnessAnalyst(options) {
     });
     writeHumanProgress(context, `Moda Analyst (remote): analysis run ${runId} accepted; waiting for results...`);
     const final = await pollRemoteAnalyze({ ingestUrl, apiKey, runId, context });
-    if (final.status !== 'completed' || !final.report) {
-        const detail = final.status === 'failed'
-            ? `Remote harness analysis failed: ${final.error ?? 'unknown error'}.`
-            : `Remote harness analysis did not finish before the timeout (last status: ${final.status}).`;
-        throw new CliInputError(detail, [
-            `Retry \`moda harness analyze --remote\`${runId ? ` (run ${runId})` : ''}.`,
-            'Or run `moda harness analyze --analyst=local-scan` to analyze locally.',
-            'Increase MODA_HARNESS_REMOTE_TIMEOUT_MS if large repos need longer.',
-        ].join('\n'));
+    // A run that returned no report at all is a hard failure (timeout, or the
+    // hosted agent crashed before producing anything) — nothing to recover.
+    if (!final.report) {
+        throw remoteAnalyzeHardFailure(final, runId);
+    }
+    // A `failed` run only qualifies for client-side recovery when the server tells
+    // us the failure was its own REPORT VALIDATION (it produced a report but the
+    // report-contract check failed). That is the one class the client can recover:
+    // the uploaded snapshot is truncated/sampled, so the hosted analyst commonly
+    // leaves prompt/tool `body` (or citation lines) empty, and the client — which
+    // has the full local repo — can backfill those source-dependent gaps and
+    // re-validate. Any other `failed` run (a crashed/aborted agent, which carries
+    // an `error` string and no structured validation verdict) stays a hard failure
+    // even if a partial report leaked through, so we never write or sync a report
+    // from a hosted run the server aborted for a reason the client cannot repair.
+    if (final.status === 'failed' && !serverFailedReportValidation(final)) {
+        throw remoteAnalyzeHardFailure(final, runId);
+    }
+    // The hosted analyst returned a report that failed SERVER-side validation —
+    // most often because it enumerated prompt/tool artifacts but left their `body`
+    // empty, or because the uploaded snapshot was truncated so the server never
+    // saw the source. The client has the full local repo, so `repairExternalAnalystReport`
+    // backfills those bodies from disk here and we re-validate locally before
+    // deciding the outcome (a report that stays invalid after repair still exits 1
+    // and is never synced). This lets `--remote` succeed even when the server
+    // could not complete the report.
+    if (final.status === 'failed') {
+        writeHumanProgress(context, 'Moda Analyst (remote): server validation incomplete; completing artifact bodies from local source...');
     }
     let report = repairExternalAnalystReport(normalizeHarnessReport(final.report), rootDir);
     if (snapshot.truncated) {
@@ -145,6 +164,33 @@ export async function runRemoteHarnessAnalyst(options) {
     });
     return { exitCode: validation.status === 'pass' ? 0 : 1 };
 }
+/** Build the terminal error for a remote run that cannot be recovered client-side. */
+function remoteAnalyzeHardFailure(final, runId) {
+    const detail = final.status === 'failed'
+        ? `Remote harness analysis failed: ${final.error ?? 'unknown error'}.`
+        : `Remote harness analysis did not finish before the timeout (last status: ${final.status}).`;
+    return new CliInputError(detail, [
+        `Retry \`moda harness analyze --remote\`${runId ? ` (run ${runId})` : ''}.`,
+        'Or run `moda harness analyze --analyst=local-scan` to analyze locally.',
+        'Increase MODA_HARNESS_REMOTE_TIMEOUT_MS if large repos need longer.',
+    ].join('\n'));
+}
+/**
+ * True when a `failed` hosted run failed specifically because its own report
+ * validation failed — the only server failure the client can recover. The hosted
+ * service attaches a structured validation verdict (`{ status: 'fail', ... }`)
+ * only when it produced a report that failed the report-contract check
+ * (`apps/moda-harness-analyze` server.ts); an operational failure (crashed agent)
+ * reports an `error` string with no validation object. Gating recovery on this
+ * verdict keeps crashed/aborted runs as hard failures, and the mandatory
+ * client-side re-validation still rejects any report that stays invalid after
+ * body/citation repair.
+ */
+function serverFailedReportValidation(final) {
+    const { validation } = final;
+    return typeof validation === 'object' && validation !== null && !Array.isArray(validation)
+        && validation.status === 'fail';
+}
 /** Map CLI flags to the optional server-side analyze options in the wire contract. */
 function buildRemoteAnalyzeOptions(flags) {
     const options = {};

package/dist/harness.js

@@ -730,6 +730,10 @@ function parseHarnessReportCandidate(candidate) {
 export function repairExternalAnalystReport(report, rootDir) {
     const normalized = normalizeHarnessReport(report);
     repairCitationLines(normalized, rootDir);
+    // Agent/hosted analysts reliably enumerate prompt/tool artifacts but often omit
+    // the verbatim `body`. Backfill it from source the same way local-scan does so
+    // external reports satisfy the prompt/tool body requirement.
+    hydratePromptAndToolBodies(normalized.graph, rootDir);
     repairReportSummaryCounts(normalized);
     return normalized;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.13.9",
+  "version": "1.13.10",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-07-08T05:27:07.614Z",
-  "cli_version": "1.13.9",
+  "bundled_at": "2026-07-08T06:08:46.984Z",
+  "cli_version": "1.13.10",
   "skills": [
     {
       "id": "integration-node-anthropic",