@moda-ai/cli 1.18.0 → 1.19.0

package/dist/cli.js

@@ -177,6 +177,7 @@ Commands:
   prompts sync --watch             Upload again when prompt files change
   prompts promote <key>            Move a dev/staging/prod label
   prompts ab                       Run a judged prompt A/B replay experiment
+  prompts propose                  Revise a prompt from a run's failures (--gate to auto-A/B, --promote-on-win)
 
   Skills:
   skills gen                       Kick off tenant-wide skill generation
@@ -249,6 +250,10 @@ Init flags:
   --no-ci-cd                       Skip CI/CD workflow creation
   --autosync                       Create GitHub Actions workflow to sync prompts + skills to Moda on push to main
   --no-autosync                    Skip autosync workflow creation
+  --harness-rescan                 Create GitHub Actions workflow to re-scan the harness and sync it to Moda on push to main
+  --no-harness-rescan              Skip harness rescan workflow creation
+  --harness-rescan-paths=GLOBS     Comma-separated path globs that scope which pushes trigger the
+                                   harness rescan workflow (implies --harness-rescan)
   --offline                        Run final validation offline (skip the online telemetry check)
 
 Provision flags (headless; requires an existing "moda auth login" session):
@@ -291,6 +296,7 @@ Examples:
   moda harness explain --agent=agent_support
   moda init --ci-cd
   moda init --autosync
+  moda init --harness-rescan --harness-rescan-paths='src/agents/**'
   moda overview --days-back=30
   moda clusters --time-range=7d
   moda conversations --search="error" --limit=5
@@ -706,7 +712,7 @@ export const commandRegistry = createCommandRegistry([
     {
         name: 'init',
         description: 'Set up Moda in your project',
-        examples: ['moda init', 'moda init --sdk-integrate', 'moda init --ci-cd', 'moda init --autosync'],
+        examples: ['moda init', 'moda init --sdk-integrate', 'moda init --ci-cd', 'moda init --autosync', 'moda init --harness-rescan'],
         auth: 'none',
         outputModes: ['human', 'json', 'agent'],
         mutability: 'write',

package/dist/config.d.ts

@@ -28,6 +28,18 @@ export declare function saveCliConfig(update: CliConfig, options?: ProfileIOOpti
  * long-lived process (or a test) sees the current value.
  */
 export declare function resolveApiKey(options?: ProfileIOOptions): string | undefined;
+/**
+ * Signed CLI keys embed their tenant: the format is
+ * moda_sk_<base64url("v1:keyId:tenantId:timestamp:signature")> — see
+ * createApiKey/parseAndVerifySignedKey in
+ * apps/moda-backend/src/api-keys/api-keys.service.ts. The server derives the
+ * upload destination tenant from the key alone, so this is the only
+ * client-side tenant source that matches where data actually lands
+ * (config / MODA_TENANT_ID can disagree with a shadowing env key). The HMAC
+ * signature can only be verified server-side; treat the result as
+ * informational.
+ */
+export declare function embeddedTenantIdFromApiKey(key: string): string | undefined;
 /**
  * Resolve the ingest worker base URL used by `moda workspace snapshot`.
  * Env override -> active profile -> legacy config -> production default.

package/dist/config.js

@@ -40,6 +40,34 @@ export function resolveApiKey(options = {}) {
         loadCliConfig(options).api_key ||
         undefined);
 }
+const SIGNED_API_KEY_PREFIX = 'moda_sk_';
+const SIGNED_API_KEY_VERSION = 'v1';
+/**
+ * Signed CLI keys embed their tenant: the format is
+ * moda_sk_<base64url("v1:keyId:tenantId:timestamp:signature")> — see
+ * createApiKey/parseAndVerifySignedKey in
+ * apps/moda-backend/src/api-keys/api-keys.service.ts. The server derives the
+ * upload destination tenant from the key alone, so this is the only
+ * client-side tenant source that matches where data actually lands
+ * (config / MODA_TENANT_ID can disagree with a shadowing env key). The HMAC
+ * signature can only be verified server-side; treat the result as
+ * informational.
+ */
+export function embeddedTenantIdFromApiKey(key) {
+    if (!key.startsWith(SIGNED_API_KEY_PREFIX))
+        return undefined;
+    try {
+        const decoded = Buffer.from(key.slice(SIGNED_API_KEY_PREFIX.length), 'base64url').toString('utf8');
+        // Expected format: version:keyId:tenantId:timestamp:signature
+        const parts = decoded.split(':');
+        if (parts.length !== 5 || parts[0] !== SIGNED_API_KEY_VERSION)
+            return undefined;
+        return parts[2] || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Resolve the ingest worker base URL used by `moda workspace snapshot`.
  * Env override -> active profile -> legacy config -> production default.

package/dist/harness.d.ts

@@ -390,6 +390,51 @@ declare function buildCommandScanPlan(context: CommandContext, rootDir: string):
 };
 export declare function writeHumanProgress(context: CommandContext, message: string): void;
 export declare function readHarnessSyncState(rootDir: string): HarnessSyncState | undefined;
+/**
+ * The identity a sync-style upload will actually authenticate as, resolved
+ * with the same precedence as the API call itself (MODA_API_KEY env wins over
+ * the active profile / legacy config). Used for the pre-upload
+ * "Syncing as <credential> → tenant <id>" banner so a shadowed or stale key
+ * is visible BEFORE data lands in the wrong tenant.
+ *
+ * The destination tenant is derived from the WINNING KEY itself (signed CLI
+ * keys embed their tenant, and the server resolves the destination from the
+ * key alone) — never from flag/env/profile config, which is exactly what a
+ * shadowing stale key disagrees with. When the key does not embed a tenant,
+ * the config-resolved id is returned with `tenantSource: 'config'` so
+ * callers must label it unverified. Best-effort: never throws (a broken
+ * MODA_PROFILE must not abort onboarding).
+ */
+export declare function describeSyncIdentity(options?: {
+    profile?: string;
+    env?: NodeJS.ProcessEnv;
+}): {
+    credential: string;
+    tenantId?: string;
+    /** 'api-key' = decoded from the winning key (authoritative); 'config' = flag/env/profile fallback (unverified). */
+    tenantSource?: 'api-key' | 'config';
+} | undefined;
+/**
+ * Human tenant label for the identity banner: key-derived ids are printed
+ * bare; config-derived ids are explicitly marked unverified so the banner
+ * never asserts a destination the server might not use.
+ */
+export declare function describeSyncTenantLabel(identity: {
+    tenantId?: string;
+    tenantSource?: 'api-key' | 'config';
+}): string;
+/**
+ * Reports in subdirectories that are FRESHER than the root's
+ * `.moda/harness-report.json` (a missing root report counts as infinitely
+ * old). Catches the `--path` trap: `harness analyze --path=<subdir>` writes
+ * `<subdir>/.moda/harness-report.json`, and a later root-level
+ * `harness approve`/`sync` silently targets the stale (or absent) root report.
+ * Newest first.
+ */
+export declare function findFresherHarnessReports(rootDir: string): Array<{
+    path: string;
+    mtimeMs: number;
+}>;
 export declare function writeHarnessArtifacts(graph: HarnessGraph, rootDir: string, options?: {
     summary?: boolean;
 }): string[];

package/dist/harness.js

@@ -6,7 +6,7 @@ import { basename, delimiter, dirname, extname, join, relative, resolve, sep } f
 import { confirm, select } from '@inquirer/prompts';
 import { callControlAPI } from './api-client.js';
 import { AnalystTui, shouldUseAnalystTui } from './analyst-tui.js';
-import { resolveApiKey, resolveTenantId } from './config.js';
+import { embeddedTenantIdFromApiKey, resolveApiKey, resolveTenantId } from './config.js';
 import { CliInputError, CliInputRequiredError } from './errors.js';
 import { HARNESS_REMOTE_RUN_STATE_PATH, isRemoteHarnessAnalyze, readRemoteRunState, runHarnessPull, runRemoteHarnessAnalyst, } from './harness-remote.js';
 import { getActiveProfile } from './profiles.js';
@@ -101,6 +101,24 @@ export async function runHarnessCommand(context) {
             if (!resolveApiKey({ profile: context.profile, env: context.env }) && !context.dryRun) {
                 throw new CliInputError('No Moda API key found for harness sync.', 'Run `moda init` first, set MODA_API_KEY, or select a profile with an API key.');
             }
+            warnFresherSubdirHarnessReports(context, rootDir, context.flags['from-report'] ?? context.flags.report);
+            if (!context.dryRun) {
+                const identity = describeSyncIdentity({ profile: context.profile, env: context.env });
+                if (identity) {
+                    // The banner's tenant comes from the winning key when it embeds
+                    // one. Otherwise fall back to the flag/env/profile-resolved tenant
+                    // but label it unverified — that source is precisely what a
+                    // shadowing stale key disagrees with, so it must never be asserted
+                    // as the destination.
+                    const label = identity.tenantSource === 'api-key'
+                        ? describeSyncTenantLabel(identity)
+                        : describeSyncTenantLabel({
+                            tenantId: tenant?.tenantId ?? identity.tenantId,
+                            tenantSource: 'config',
+                        });
+                    writeHumanProgress(context, `Syncing as ${identity.credential} → tenant ${label}`);
+                }
+            }
             if (context.flags['from-report'] || context.flags.report) {
                 const reportPath = resolveHarnessReportPath(rootDir, context.flags['from-report'] ?? context.flags.report);
                 const { report, validation, approval, approved } = loadHarnessReportForSync(rootDir, reportPath);
@@ -344,6 +362,7 @@ export async function runHarnessCommand(context) {
             return { exitCode: validation.status === 'pass' ? 0 : 1 };
         }
         case 'approve': {
+            warnFresherSubdirHarnessReports(context, rootDir, context.positionals[1] ?? context.flags.report);
             const reportPath = resolveHarnessReportPath(rootDir, context.positionals[1] ?? context.flags.report);
             const approval = await approveHarnessReport({
                 rootDir,
@@ -363,7 +382,7 @@ export async function runHarnessCommand(context) {
             return { exitCode: 0 };
         }
         case 'agents': {
-            const graph = loadOrScanHarness(rootDir, tenant);
+            const graph = loadOrScanHarness(rootDir, tenant, context);
             context.output.writeData({
                 summary: summarizeHarness(graph),
                 agentFamilies: graph.agentFamilies,
@@ -373,12 +392,12 @@ export async function runHarnessCommand(context) {
             return { exitCode: 0 };
         }
         case 'graph': {
-            const graph = loadOrScanHarness(rootDir, tenant);
+            const graph = loadOrScanHarness(rootDir, tenant, context);
             context.output.writeData(graph);
             return { exitCode: 0 };
         }
         case 'explain': {
-            const graph = loadOrScanHarness(rootDir, tenant);
+            const graph = loadOrScanHarness(rootDir, tenant, context);
             if (selectedAgentId) {
                 const agent = graph.runtimeAgents.find((candidate) => candidate.id === selectedAgentId);
                 if (!agent) {
@@ -2040,15 +2059,187 @@ function selectedRuntimeAgentId(flags) {
         return flags.agent;
     return undefined;
 }
-function loadOrScanHarness(rootDir, tenant) {
+function loadOrScanHarness(rootDir, tenant, context) {
     const manifestPath = join(rootDir, HARNESS_PATH);
-    return existsSync(manifestPath)
-        ? readHarnessGraph(manifestPath)
-        : scanHarness({
-            rootDir,
-            tenantId: tenant?.tenantId,
-            tenantSource: tenant?.source,
-        });
+    if (existsSync(manifestPath))
+        return readHarnessGraph(manifestPath);
+    // Provenance banner: without a persisted manifest this command output comes
+    // from a live scan of the current directory, which is easy to mistake for
+    // synced/account data (especially right after switching repos or profiles).
+    if (context) {
+        writeHarnessNotice(context, `No ${HARNESS_PATH} found; showing a live scan of ${rootDir}. ` +
+            'This is local scan output, NOT synced or account data. ' +
+            'Run `moda harness scan` to persist it and `moda harness sync` to upload it.');
+    }
+    return scanHarness({
+        rootDir,
+        tenantId: tenant?.tenantId,
+        tenantSource: tenant?.source,
+    });
+}
+/**
+ * Warning line that must be visible in every output mode: styled progress on
+ * stderr for humans, a plain `Warning:` stderr line for machine modes (stdout
+ * stays machine-readable JSON either way). Quiet suppresses it like the rest
+ * of the harness progress surface.
+ */
+function writeHarnessNotice(context, message) {
+    if (context.quiet && context.flags.progress !== 'true')
+        return;
+    if (context.outputMode === 'human') {
+        console.error(renderHarnessProgress(message, 'warning'));
+        return;
+    }
+    console.error(`Warning: ${message}`);
+}
+/**
+ * The identity a sync-style upload will actually authenticate as, resolved
+ * with the same precedence as the API call itself (MODA_API_KEY env wins over
+ * the active profile / legacy config). Used for the pre-upload
+ * "Syncing as <credential> → tenant <id>" banner so a shadowed or stale key
+ * is visible BEFORE data lands in the wrong tenant.
+ *
+ * The destination tenant is derived from the WINNING KEY itself (signed CLI
+ * keys embed their tenant, and the server resolves the destination from the
+ * key alone) — never from flag/env/profile config, which is exactly what a
+ * shadowing stale key disagrees with. When the key does not embed a tenant,
+ * the config-resolved id is returned with `tenantSource: 'config'` so
+ * callers must label it unverified. Best-effort: never throws (a broken
+ * MODA_PROFILE must not abort onboarding).
+ */
+export function describeSyncIdentity(options = {}) {
+    const apiKey = resolveApiKey(options);
+    if (!apiKey)
+        return undefined;
+    const redacted = apiKey.length > 12
+        ? `${apiKey.slice(0, 8)}…${apiKey.slice(-4)}`
+        : `…${apiKey.slice(-4)}`;
+    const env = options.env ?? process.env;
+    // getActiveProfile throws when the named profile is missing (e.g. a stale
+    // MODA_PROFILE) even though the key already resolved via legacy config —
+    // the banner is advisory and must never abort the command around it.
+    let profileName;
+    try {
+        profileName = getActiveProfile(options).name;
+    }
+    catch {
+        profileName = undefined;
+    }
+    const credential = env.MODA_API_KEY === apiKey
+        ? `MODA_API_KEY env key (${redacted})`
+        : profileName
+            ? `profile '${profileName}' key (${redacted})`
+            : `stored key (${redacted})`;
+    const keyTenantId = embeddedTenantIdFromApiKey(apiKey);
+    if (keyTenantId) {
+        return { credential, tenantId: keyTenantId, tenantSource: 'api-key' };
+    }
+    const configTenantId = resolveTenantId(options);
+    return {
+        credential,
+        tenantId: configTenantId,
+        tenantSource: configTenantId ? 'config' : undefined,
+    };
+}
+/**
+ * Human tenant label for the identity banner: key-derived ids are printed
+ * bare; config-derived ids are explicitly marked unverified so the banner
+ * never asserts a destination the server might not use.
+ */
+export function describeSyncTenantLabel(identity) {
+    if (!identity.tenantId)
+        return 'unresolved';
+    if (identity.tenantSource === 'api-key')
+        return identity.tenantId;
+    return `${identity.tenantId} (unverified — from local config, not the API key; the server derives the destination tenant from the key)`;
+}
+/** Bounded walk looking for `<subdir>/.moda/harness-report.json` files. */
+const FRESHER_REPORT_MAX_DEPTH = 4;
+const FRESHER_REPORT_MAX_DIRS = 4_000;
+/**
+ * Reports in subdirectories that are FRESHER than the root's
+ * `.moda/harness-report.json` (a missing root report counts as infinitely
+ * old). Catches the `--path` trap: `harness analyze --path=<subdir>` writes
+ * `<subdir>/.moda/harness-report.json`, and a later root-level
+ * `harness approve`/`sync` silently targets the stale (or absent) root report.
+ * Newest first.
+ */
+export function findFresherHarnessReports(rootDir) {
+    let rootMtimeMs = 0;
+    try {
+        rootMtimeMs = lstatSync(join(rootDir, HARNESS_REPORT_PATH)).mtimeMs;
+    }
+    catch {
+        rootMtimeMs = 0;
+    }
+    const fresher = [];
+    let visited = 0;
+    const walk = (dir, depth) => {
+        if (depth > FRESHER_REPORT_MAX_DEPTH || visited >= FRESHER_REPORT_MAX_DIRS)
+            return;
+        visited += 1;
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            // Dot-dirs (including each dir's own `.moda`, checked explicitly below)
+            // and scan-skipped dirs never host a user project subtree.
+            if (!entry.isDirectory() || entry.name.startsWith('.') || SKIPPED_DIRS.has(entry.name))
+                continue;
+            const child = join(dir, entry.name);
+            try {
+                const candidate = lstatSync(join(child, HARNESS_REPORT_PATH));
+                if (candidate.isFile() && candidate.mtimeMs > rootMtimeMs) {
+                    fresher.push({
+                        path: normalizePath(relative(rootDir, join(child, HARNESS_REPORT_PATH))),
+                        mtimeMs: candidate.mtimeMs,
+                    });
+                }
+            }
+            catch {
+                // No report in this subdir; keep walking.
+            }
+            walk(child, depth + 1);
+        }
+    };
+    walk(rootDir, 1);
+    return fresher.sort((a, b) => b.mtimeMs - a.mtimeMs);
+}
+/**
+ * `--path` trap guard for `harness approve` / `harness sync`: when the
+ * report the command is about to use is older than a fresher
+ * `<subdir>/.moda/harness-report.json`, point at the fresher one. Skipped
+ * when the user explicitly named a report file (they already chose).
+ */
+function warnFresherSubdirHarnessReports(context, rootDir, explicitReport) {
+    // Only treat an explicit report as an opt-out when it points somewhere other
+    // than the default root report. `--from-report=.moda/harness-report.json`
+    // still targets the default report, so the fresher-subdir warning must fire.
+    const explicitReportPath = explicitReport && explicitReport !== 'true'
+        ? normalizePath(relative(rootDir, resolve(rootDir, explicitReport)))
+        : undefined;
+    if (explicitReportPath && explicitReportPath !== normalizePath(HARNESS_REPORT_PATH))
+        return;
+    let fresher;
+    try {
+        fresher = findFresherHarnessReports(rootDir);
+    }
+    catch {
+        return;
+    }
+    if (fresher.length === 0)
+        return;
+    const newest = fresher[0];
+    const subdir = normalizePath(dirname(dirname(newest.path)));
+    const rootState = existsSync(join(rootDir, HARNESS_REPORT_PATH))
+        ? `older ${HARNESS_REPORT_PATH}`
+        : `no ${HARNESS_REPORT_PATH}`;
+    writeHarnessNotice(context, `A fresher harness report exists at ${newest.path} (this directory has ${rootState}). ` +
+        `If you meant that report, re-run with --path=${subdir}.`);
 }
 function readHarnessGraph(manifestPath) {
     return JSON.parse(readFileSync(manifestPath, 'utf8'));

package/dist/init/index.d.ts

@@ -11,7 +11,7 @@ export interface InitPhaseResult {
     details?: string;
 }
 export interface InitSetupAction {
-    category: 'sdk' | 'harness' | 'hooks' | 'prompts' | 'skills' | 'ci-cd' | 'autosync' | 'validation';
+    category: 'sdk' | 'harness' | 'hooks' | 'prompts' | 'skills' | 'ci-cd' | 'autosync' | 'harness-rescan' | 'validation';
     title: string;
     status: 'planned' | 'applied' | 'skipped' | 'manual';
     approved: boolean;
@@ -28,6 +28,44 @@ export interface InitRunOptions {
     onEvent?: (event: InitProgressEvent) => void;
 }
 export declare function runInit(flags: Record<string, unknown>, options?: InitRunOptions): Promise<InitResult>;
+export declare function writeCiCdWorkflow(cwd?: string): string;
+export declare function writeAutosyncWorkflow(cwd?: string): string;
+export declare function writeHarnessRescanWorkflow(cwd?: string, paths?: string[]): string;
+/**
+ * Signals from the discovered graph used by the init 0-agent quality gate:
+ * runtime agent count plus the LLM framework/provider names detected in the
+ * repo.
+ */
+export interface HarnessQualitySignals {
+    runtimeAgents: number;
+    frameworks: string[];
+    providers: string[];
+}
+/**
+ * Read the gate signals from the SAME graph the auto-sync uploads: the cited
+ * report (`.moda/harness-report.json`, consumed by `harness sync --from-report`)
+ * is authoritative, so read its `graph` first. Only fall back to the standalone
+ * manifest (`.moda/harness.json`) when no report exists, otherwise a stale or
+ * missing manifest could let an empty report slip past the gate and overwrite
+ * the tenant's harness. Returns undefined when neither is readable.
+ */
+export declare function readHarnessQualitySignals(cwd?: string): HarnessQualitySignals | undefined;
+/**
+ * True when discovery found no runtime agents even though the repo carries
+ * LLM framework/provider signals — the signature of a failed discovery run,
+ * not an agent-free repo.
+ */
+export declare function harnessLooksIncomplete(signals: HarnessQualitySignals): boolean;
+/**
+ * Deterministic repo-side LLM signals: well-known LLM package names found in
+ * dependency manifests. Independent of the discovery output, so a fully
+ * failed discovery (empty graph) cannot bypass the 0-agent gate.
+ */
+export declare function detectRepoLlmSignals(cwd?: string): {
+    frameworks: string[];
+    providers: string[];
+};
+export declare function resumeFlagsForInit(flags: Record<string, unknown>): string[];
 /**
  * Onboarding runs harness discovery SERVER-SIDE by default so the customer
  * needs no local coding agent. Opt out with `--local`, `--no-remote`,