@moda-ai/cli 1.18.0 → 1.19.0

package/dist/init/index.js

@@ -5,7 +5,7 @@
 // harness analysis first and overlapping it with the fast local tasks and the
 // SDK integration agent while a live progress board (progress-board.ts)
 // renders each lane.
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { checkbox, confirm, select } from '@inquirer/prompts';
 import { login, loadToken } from '../auth.js';
@@ -20,7 +20,7 @@ import { InitProgressBoard } from './progress-board.js';
 import { createCommandContext } from '../command-context.js';
 import { resolveModaBaseUrl, VERSION } from '../config.js';
 import { CliAuthError, CliInputError } from '../errors.js';
-import { detectAvailableCodingAgents, isDeterministicLocalAnalyst, runHarnessCommand, } from '../harness.js';
+import { describeSyncIdentity, describeSyncTenantLabel, detectAvailableCodingAgents, isDeterministicLocalAnalyst, runHarnessCommand, } from '../harness.js';
 import { pollRemoteAnalyzeUntilDone, startRemoteAnalyze, } from '../harness-remote.js';
 import { buildDoctorReport } from '../doctor.js';
 import { renderInitBanner, renderInitComplete, renderInitNote, renderInitSetupPlan, renderInitStep, } from '../tui.js';
@@ -113,7 +113,7 @@ export async function runInit(flags, options = {}) {
     // selection; otherwise the exact-id match below fails with
     // "No organization with id ''" instead of auto-selecting a sole org.
     const tenantIdEnv = stringFlag(process.env.MODA_TENANT_ID);
-    const { apiKey, tenantName } = await selectTenantAndCreateKey({
+    const { apiKey, tenantId: selectedTenantId, tenantName } = await selectTenantAndCreateKey({
         tenantId: tenantIdFlag ?? tenantIdEnv,
         tenantIdSource: tenantIdFlag ? 'flag' : tenantIdEnv ? 'env' : undefined,
         nonInteractive: json || agent,
@@ -134,6 +134,11 @@ export async function runInit(flags, options = {}) {
     const sdkFlag = resolveSdkIntegrateFlag(flags);
     const ciCdFlag = resolveCiCdFlag(flags);
     const autosyncFlag = resolveAutosyncFlag(flags);
+    const harnessRescanFlag = resolveHarnessRescanFlag(flags);
+    const harnessRescanPaths = parseHarnessRescanPaths(flagValue(flags, 'harness-rescan-paths', 'harness_rescan_paths'));
+    // Passing --harness-rescan-paths alone is an explicit opt-in: scoping the
+    // rescan only makes sense when the workflow is being written.
+    const harnessRescanChoice = harnessRescanFlag ?? (harnessRescanPaths !== undefined ? true : undefined);
     // SDK integration installs packages and edits source via a coding agent, so
     // it defaults ON only when an agent CLI is installed to do the work; it
     // never runs unattended without an explicit --sdk-integrate.
@@ -141,6 +146,7 @@ export async function runInit(flags, options = {}) {
     let integrateSdk = sdkFlag !== undefined ? sdkFlag : yes ? false : codingAgentAvailable;
     let configureCiCd = ciCdFlag ?? false;
     let configureAutosync = autosyncFlag ?? false;
+    let configureHarnessRescan = harnessRescanChoice ?? false;
     let setupPlan = [];
     const renderPlan = () => {
         setupPlan = buildSetupPlan({
@@ -148,6 +154,7 @@ export async function runInit(flags, options = {}) {
             integrateSdk,
             configureCiCd,
             configureAutosync,
+            configureHarnessRescan,
             remote,
         });
         log(renderInitSetupPlan(setupPlan, { snapshotConsent: remote }));
@@ -185,6 +192,13 @@ export async function runInit(flags, options = {}) {
                     checked: configureAutosync,
                 });
             }
+            if (harnessRescanChoice === undefined) {
+                choices.push({
+                    name: 'Re-scan the harness on push to main (.github/workflows/moda-harness-rescan.yml)',
+                    value: 'harness-rescan',
+                    checked: configureHarnessRescan,
+                });
+            }
             if (choices.length > 0) {
                 const selected = await checkbox({
                     message: 'Choose what runs (space toggles, enter confirms)',
@@ -198,13 +212,16 @@ export async function runInit(flags, options = {}) {
                     configureCiCd = selected.includes('ci-cd');
                 if (autosyncFlag === undefined)
                     configureAutosync = selected.includes('autosync');
+                if (harnessRescanChoice === undefined)
+                    configureHarnessRescan = selected.includes('harness-rescan');
                 renderPlan();
             }
         }
     }
     if (json || agent) {
         const skipped = setupPlan
-            .filter((action) => (action.category === 'sdk' || action.category === 'ci-cd' || action.category === 'autosync') &&
+            .filter((action) => (action.category === 'sdk' || action.category === 'ci-cd' || action.category === 'autosync' ||
+            action.category === 'harness-rescan') &&
             action.approved === false)
             .map((action) => `${action.category}: ${action.command ?? 'explicit flag required'}`);
         if (skipped.length > 0) {
@@ -267,6 +284,61 @@ export async function runInit(flags, options = {}) {
     // unapproved report, so approve it first. Best-effort: a network blip on
     // either call must not abort onboarding.
     const approveAndSyncHarness = async () => {
+        // Quality gate: a result with ZERO runtime agents on a repo that clearly
+        // uses LLM frameworks/providers almost always means discovery failed (bad
+        // snapshot, analyst error), not an agent-free repo. Auto-approving and
+        // syncing it would overwrite the tenant's harness with an empty graph, so
+        // withhold the upload and hand the user the retry commands instead.
+        // The framework/provider evidence is the union of what the discovered
+        // graph self-reports AND a deterministic repo-side dependency scan — a
+        // TOTAL discovery failure (0 agents, 0 frameworks, 0 providers) must not
+        // bypass the gate just because the artifact being judged is empty.
+        const graphSignals = readHarnessQualitySignals(rootDir);
+        const repoSignals = detectRepoLlmSignals(rootDir);
+        const signals = graphSignals
+            ? {
+                runtimeAgents: graphSignals.runtimeAgents,
+                frameworks: [...new Set([...graphSignals.frameworks, ...repoSignals.frameworks])],
+                providers: [...new Set([...graphSignals.providers, ...repoSignals.providers])],
+            }
+            : undefined;
+        if (signals && harnessLooksIncomplete(signals)) {
+            const names = [...signals.frameworks, ...signals.providers].join(', ');
+            const retryCommand = remote
+                ? 'moda harness analyze --remote --summary'
+                : 'moda harness analyze --analyst=claude|cursor|codex --summary';
+            warn(renderInitNote(`Harness discovery found 0 runtime agents, but this repo has LLM framework signals (${names}). ` +
+                'Discovery likely failed, so the result was NOT approved or synced.', 'warning'));
+            warn(`  Retry with \`${retryCommand}\`, then \`moda harness approve --yes && moda harness sync --from-report\`.`);
+            emit('harness', 'Harness discovery found 0 agents despite LLM framework signals; sync withheld.', 'warning');
+            harnessPhase = {
+                id: 'harness',
+                title: 'Harness discovery',
+                status: 'warning',
+                details: '0 agents detected; sync withheld',
+            };
+            return;
+        }
+        // Identity banner: the credential is resolved with the same precedence
+        // the upload uses (MODA_API_KEY env wins) and the tenant comes from the
+        // WINNING KEY itself (or is marked unverified), so a shadowed/stale key
+        // is visible — and never mislabeled — BEFORE the graph lands in the
+        // wrong tenant. Best-effort: must not abort onboarding.
+        try {
+            const identity = describeSyncIdentity({ profile, env: process.env });
+            if (identity) {
+                // The friendly workspace name only decorates the id when the winning
+                // key's embedded tenant IS the tenant init just selected — otherwise
+                // the raw (possibly surprising) destination id stands alone.
+                const tenantLabel = identity.tenantSource === 'api-key' && identity.tenantId
+                    ? `${identity.tenantId}${identity.tenantId === selectedTenantId ? ` (${tenantName})` : ''}`
+                    : describeSyncTenantLabel(identity);
+                log(renderInitNote(`Syncing as ${identity.credential} → tenant ${tenantLabel}`, 'info'));
+            }
+        }
+        catch {
+            // Advisory banner only.
+        }
         try {
             await runHarnessCommand(createCommandContext({
                 command: 'harness',
@@ -437,6 +509,12 @@ export async function runInit(flags, options = {}) {
         laneBoard?.complete('autosync', `wrote ${workflowPath}`);
         markApplied(setupPlan, 'autosync');
     }
+    if (setupPlan.find((action) => action.category === 'harness-rescan')?.approved === true) {
+        const workflowPath = writeHarnessRescanWorkflow(process.cwd(), harnessRescanPaths);
+        laneBoard?.startLane('harness-rescan', 'Harness rescan workflow');
+        laneBoard?.complete('harness-rescan', `wrote ${workflowPath}`);
+        markApplied(setupPlan, 'harness-rescan');
+    }
     const sdkAction = setupPlan.find((action) => action.category === 'sdk');
     if (sdkAction?.approved === true) {
         laneBoard?.startLane('sdk', 'SDK integration', {
@@ -667,6 +745,17 @@ function buildSetupPlan(options) {
             command: 'moda prompts sync && moda skills sync',
             reason: options.configureAutosync ? undefined : 'No autosync workflow is written until it is explicitly approved (--autosync).',
         },
+        {
+            category: 'harness-rescan',
+            title: 'Re-scan the harness on push to main so the synced graph never drifts from the code',
+            status: options.configureHarnessRescan ? 'planned' : 'manual',
+            approved: options.configureHarnessRescan,
+            files: ['.github/workflows/moda-harness-rescan.yml'],
+            command: 'moda harness analyze --remote --yes && moda harness approve --yes && moda harness sync --from-report',
+            reason: options.configureHarnessRescan
+                ? undefined
+                : 'No harness rescan workflow is written until it is explicitly approved (--harness-rescan).',
+        },
         {
             category: 'validation',
             title: 'Run Moda doctor online to confirm telemetry is reaching Moda',
@@ -701,7 +790,14 @@ function changedFiles(setupPlan) {
 // the Moda registry. The pin tracks the CLI that generated the file, so each
 // `moda init` upgrade is an explicit, reviewable bump of the workflow.
 const GENERATED_WORKFLOW_CLI = `@moda-ai/cli@${VERSION}`;
-function writeCiCdWorkflow(cwd = process.cwd()) {
+// npx dispatch shape matters: `npx -y @moda-ai/cli@X moda harness ...` resolves
+// the package's default bin and passes the literal `moda` token through as the
+// CLI's first argument, so every step would exit 1 with "Unknown command
+// 'moda'". `--package=<pkg> moda` pins the package AND names the `moda` bin
+// explicitly, so the CLI receives the real subcommand first.
+const GENERATED_WORKFLOW_NPX = `npx -y --package=${GENERATED_WORKFLOW_CLI} moda`;
+// Exported for tests (generated-workflows.test.ts validates npx dispatch shape).
+export function writeCiCdWorkflow(cwd = process.cwd()) {
     const relativePath = '.github/workflows/moda-validation.yml';
     const path = join(cwd, relativePath);
     mkdirSync(dirname(path), { recursive: true });
@@ -730,7 +826,7 @@ function writeCiCdWorkflow(cwd = process.cwd()) {
         '        with:',
         '          node-version: 22',
         '      - name: Validate Moda setup',
-        `        run: npx -y ${GENERATED_WORKFLOW_CLI} moda doctor --online --json`,
+        `        run: ${GENERATED_WORKFLOW_NPX} doctor --online --json`,
         '',
     ].join('\n')}`);
     return relativePath;
@@ -739,7 +835,7 @@ function writeCiCdWorkflow(cwd = process.cwd()) {
 // sync with the repo: it pushes prompt and skill changes after they merge. It
 // only runs on `main` (never on pull_request) so unmerged versions are never
 // published. Keep its env in step with writeCiCdWorkflow().
-function writeAutosyncWorkflow(cwd = process.cwd()) {
+export function writeAutosyncWorkflow(cwd = process.cwd()) {
     const relativePath = '.github/workflows/moda-autosync.yml';
     const path = join(cwd, relativePath);
     mkdirSync(dirname(path), { recursive: true });
@@ -772,9 +868,72 @@ function writeAutosyncWorkflow(cwd = process.cwd()) {
         '        with:',
         '          node-version: 22',
         `      - name: Sync prompts to Moda`,
-        `        run: npx -y ${GENERATED_WORKFLOW_CLI} moda prompts sync`,
+        `        run: ${GENERATED_WORKFLOW_NPX} prompts sync`,
         `      - name: Sync skills to Moda`,
-        `        run: npx -y ${GENERATED_WORKFLOW_CLI} moda skills sync`,
+        `        run: ${GENERATED_WORKFLOW_NPX} skills sync`,
+        '',
+    ].join('\n')}`);
+    return relativePath;
+}
+// Generates the "living harness" rescan workflow: after every merge to main
+// the hosted analyst re-analyzes the repo, the refreshed report is approved
+// non-interactively, and the cited graph is synced to Moda — so the harness
+// Moda serves never drifts from the code. It runs only on push to `main`
+// (plus manual workflow_dispatch), never on pull_request, so unmerged agent
+// changes are never synced. An optional path scope limits pushes that trigger
+// a rescan. Keep its env in step with writeCiCdWorkflow().
+export function writeHarnessRescanWorkflow(cwd = process.cwd(), paths) {
+    const relativePath = '.github/workflows/moda-harness-rescan.yml';
+    const path = join(cwd, relativePath);
+    mkdirSync(dirname(path), { recursive: true });
+    const pathScope = paths !== undefined && paths.length > 0
+        ? [
+            '    # Only pushes touching these paths trigger a rescan.',
+            '    paths:',
+            ...paths.map((glob) => `      - '${glob.replace(/'/g, "''")}'`),
+        ]
+        : [
+            '    # Optional: scope rescans to agent-relevant paths, e.g.',
+            '    # paths:',
+            "    #   - 'src/agents/**'",
+        ];
+    writeFileSync(path, `${[
+        'name: Moda Harness Rescan',
+        '',
+        'on:',
+        '  push:',
+        '    branches: [main]',
+        ...pathScope,
+        '  workflow_dispatch:',
+        '',
+        '# Least privilege: this job reads the checked-out repo, uploads a safe',
+        '# source snapshot to Moda over the API key, and syncs the refreshed harness',
+        '# graph; it never writes back to the repository.',
+        'permissions:',
+        '  contents: read',
+        '',
+        '# One in-flight rescan at a time; newer pushes supersede older runs.',
+        'concurrency:',
+        '  group: moda-harness-rescan',
+        '  cancel-in-progress: true',
+        '',
+        'jobs:',
+        '  moda-harness-rescan:',
+        '    runs-on: ubuntu-latest',
+        '    env:',
+        '      MODA_API_KEY: ${{ secrets.MODA_API_KEY }}',
+        '      MODA_TENANT_ID: ${{ secrets.MODA_TENANT_ID }}',
+        '    steps:',
+        '      - uses: actions/checkout@v4',
+        '      - uses: actions/setup-node@v4',
+        '        with:',
+        '          node-version: 22',
+        '      - name: Re-analyze the harness on Moda',
+        `        run: ${GENERATED_WORKFLOW_NPX} harness analyze --remote --yes`,
+        '      - name: Approve the refreshed harness report',
+        `        run: ${GENERATED_WORKFLOW_NPX} harness approve --yes`,
+        '      - name: Sync the harness graph to Moda',
+        `        run: ${GENERATED_WORKFLOW_NPX} harness sync --from-report`,
         '',
     ].join('\n')}`);
     return relativePath;
@@ -802,6 +961,225 @@ function printHarnessDetectionSummary(cwd = process.cwd()) {
         console.log('  Detected harness summary is available in .moda/HARNESS.md');
     }
 }
+function signalsFromGraph(graph) {
+    const names = (items) => (items ?? [])
+        .map((item) => (typeof item.name === 'string' ? item.name : undefined))
+        .filter((name) => Boolean(name));
+    return {
+        runtimeAgents: Array.isArray(graph.runtimeAgents) ? graph.runtimeAgents.length : 0,
+        frameworks: names(graph.agentFrameworks),
+        providers: names(graph.modelProviders),
+    };
+}
+/**
+ * Read the gate signals from the SAME graph the auto-sync uploads: the cited
+ * report (`.moda/harness-report.json`, consumed by `harness sync --from-report`)
+ * is authoritative, so read its `graph` first. Only fall back to the standalone
+ * manifest (`.moda/harness.json`) when no report exists, otherwise a stale or
+ * missing manifest could let an empty report slip past the gate and overwrite
+ * the tenant's harness. Returns undefined when neither is readable.
+ */
+export function readHarnessQualitySignals(cwd = process.cwd()) {
+    const reportPath = join(cwd, '.moda', 'harness-report.json');
+    if (existsSync(reportPath)) {
+        try {
+            const report = JSON.parse(readFileSync(reportPath, 'utf8'));
+            if (report.graph && typeof report.graph === 'object') {
+                return signalsFromGraph(report.graph);
+            }
+        }
+        catch {
+            // Fall through to the manifest below.
+        }
+    }
+    const manifestPath = join(cwd, '.moda', 'harness.json');
+    if (!existsSync(manifestPath))
+        return undefined;
+    try {
+        return signalsFromGraph(JSON.parse(readFileSync(manifestPath, 'utf8')));
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * True when discovery found no runtime agents even though the repo carries
+ * LLM framework/provider signals — the signature of a failed discovery run,
+ * not an agent-free repo.
+ */
+export function harnessLooksIncomplete(signals) {
+    return signals.runtimeAgents === 0 &&
+        (signals.frameworks.length > 0 || signals.providers.length > 0);
+}
+// --- Repo-side LLM dependency scan (0-agent gate evidence) -----------------
+//
+// The gate must not read its "repo has LLM signals" evidence solely from the
+// artifact it is gating: a TOTAL discovery failure emits a graph with 0
+// agents AND 0 frameworks/providers, which would sail past a graph-only
+// check and overwrite the tenant's harness with an empty graph. This scan is
+// deterministic and independent of the analyst: it looks for well-known LLM
+// packages in dependency manifests (package.json, requirements.txt,
+// pyproject.toml) via a bounded walk.
+const REPO_SIGNAL_MAX_DEPTH = 3;
+const REPO_SIGNAL_MAX_DIRS = 500;
+const REPO_SIGNAL_SKIPPED_DIRS = new Set([
+    'node_modules', 'dist', 'build', 'out', 'coverage', 'vendor', 'target',
+    'venv', 'env', '__pycache__', 'site-packages',
+]);
+/** Exact npm package name → signal. */
+const JS_LLM_DEPENDENCIES = {
+    openai: { name: 'OpenAI', kind: 'provider' },
+    '@anthropic-ai/sdk': { name: 'Anthropic', kind: 'provider' },
+    '@google/generative-ai': { name: 'Google Gemini', kind: 'provider' },
+    '@google/genai': { name: 'Google Gemini', kind: 'provider' },
+    'cohere-ai': { name: 'Cohere', kind: 'provider' },
+    'groq-sdk': { name: 'Groq', kind: 'provider' },
+    '@mistralai/mistralai': { name: 'Mistral', kind: 'provider' },
+    ollama: { name: 'Ollama', kind: 'provider' },
+    'together-ai': { name: 'Together', kind: 'provider' },
+    '@aws-sdk/client-bedrock-runtime': { name: 'AWS Bedrock', kind: 'provider' },
+    ai: { name: 'Vercel AI SDK', kind: 'framework' },
+    langchain: { name: 'LangChain', kind: 'framework' },
+    llamaindex: { name: 'LlamaIndex', kind: 'framework' },
+    '@anthropic-ai/claude-agent-sdk': { name: 'Claude Agent SDK', kind: 'framework' },
+    '@openai/agents': { name: 'OpenAI Agents', kind: 'framework' },
+    '@mastra/core': { name: 'Mastra', kind: 'framework' },
+};
+/** npm scope/prefix → signal (monorepo-style split packages). */
+const JS_LLM_DEPENDENCY_PREFIXES = [
+    ['@langchain/', { name: 'LangChain', kind: 'framework' }],
+    ['@ai-sdk/', { name: 'Vercel AI SDK', kind: 'framework' }],
+    ['@llamaindex/', { name: 'LlamaIndex', kind: 'framework' }],
+];
+/** Normalized (lowercase, `_`→`-`) Python distribution name → signal. */
+const PY_LLM_DEPENDENCIES = {
+    openai: { name: 'OpenAI', kind: 'provider' },
+    anthropic: { name: 'Anthropic', kind: 'provider' },
+    'google-generativeai': { name: 'Google Gemini', kind: 'provider' },
+    'google-genai': { name: 'Google Gemini', kind: 'provider' },
+    cohere: { name: 'Cohere', kind: 'provider' },
+    groq: { name: 'Groq', kind: 'provider' },
+    mistralai: { name: 'Mistral', kind: 'provider' },
+    ollama: { name: 'Ollama', kind: 'provider' },
+    langgraph: { name: 'LangGraph', kind: 'framework' },
+    litellm: { name: 'LiteLLM', kind: 'framework' },
+    crewai: { name: 'CrewAI', kind: 'framework' },
+    autogen: { name: 'AutoGen', kind: 'framework' },
+    pyautogen: { name: 'AutoGen', kind: 'framework' },
+    ag2: { name: 'AutoGen', kind: 'framework' },
+    'pydantic-ai': { name: 'Pydantic AI', kind: 'framework' },
+    'openai-agents': { name: 'OpenAI Agents', kind: 'framework' },
+    'semantic-kernel': { name: 'Semantic Kernel', kind: 'framework' },
+    dspy: { name: 'DSPy', kind: 'framework' },
+    'haystack-ai': { name: 'Haystack', kind: 'framework' },
+};
+/** Python prefix matches (langchain, langchain-openai, llama-index-core, ...). */
+const PY_LLM_DEPENDENCY_PREFIXES = [
+    ['langchain', { name: 'LangChain', kind: 'framework' }],
+    ['llama-index', { name: 'LlamaIndex', kind: 'framework' }],
+];
+function jsDependencySignal(dep) {
+    const exact = JS_LLM_DEPENDENCIES[dep];
+    if (exact)
+        return exact;
+    for (const [prefix, signal] of JS_LLM_DEPENDENCY_PREFIXES) {
+        if (dep.startsWith(prefix))
+            return signal;
+    }
+    return undefined;
+}
+function pyDependencySignal(dep) {
+    const normalized = dep.toLowerCase().replace(/_/g, '-');
+    const exact = PY_LLM_DEPENDENCIES[normalized];
+    if (exact)
+        return exact;
+    for (const [prefix, signal] of PY_LLM_DEPENDENCY_PREFIXES) {
+        if (normalized === prefix || normalized.startsWith(`${prefix}-`))
+            return signal;
+    }
+    return undefined;
+}
+/** Requirement names from requirements.txt lines / pyproject.toml specifiers. */
+function pythonRequirementNames(text, file) {
+    const names = [];
+    if (file === 'requirements.txt') {
+        for (const line of text.split('\n')) {
+            const match = /^\s*([A-Za-z0-9][A-Za-z0-9._-]*)/.exec(line);
+            if (match)
+                names.push(match[1]);
+        }
+        return names;
+    }
+    // pyproject.toml: dependency specifiers are quoted strings whose leading
+    // token is the distribution name ("openai>=1.0", "langchain-openai", ...).
+    for (const match of text.matchAll(/["']([A-Za-z0-9][A-Za-z0-9._-]*)[^"']*["']/g)) {
+        names.push(match[1]);
+    }
+    return names;
+}
+/**
+ * Deterministic repo-side LLM signals: well-known LLM package names found in
+ * dependency manifests. Independent of the discovery output, so a fully
+ * failed discovery (empty graph) cannot bypass the 0-agent gate.
+ */
+export function detectRepoLlmSignals(cwd = process.cwd()) {
+    const frameworks = new Set();
+    const providers = new Set();
+    const record = (signal) => {
+        if (!signal)
+            return;
+        (signal.kind === 'framework' ? frameworks : providers).add(signal.name);
+    };
+    const scanDir = (dir) => {
+        try {
+            const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
+            for (const dep of [
+                ...Object.keys(pkg.dependencies ?? {}),
+                ...Object.keys(pkg.devDependencies ?? {}),
+                ...Object.keys(pkg.peerDependencies ?? {}),
+            ]) {
+                record(jsDependencySignal(dep));
+            }
+        }
+        catch {
+            // No/invalid package.json here.
+        }
+        for (const file of ['requirements.txt', 'pyproject.toml']) {
+            try {
+                const text = readFileSync(join(dir, file), 'utf8');
+                for (const name of pythonRequirementNames(text, file)) {
+                    record(pyDependencySignal(name));
+                }
+            }
+            catch {
+                // No such manifest here.
+            }
+        }
+    };
+    let visited = 0;
+    const walk = (dir, depth) => {
+        if (depth > REPO_SIGNAL_MAX_DEPTH || visited >= REPO_SIGNAL_MAX_DIRS)
+            return;
+        visited += 1;
+        scanDir(dir);
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (!entry.isDirectory() || entry.name.startsWith('.'))
+                continue;
+            if (REPO_SIGNAL_SKIPPED_DIRS.has(entry.name))
+                continue;
+            walk(join(dir, entry.name), depth + 1);
+        }
+    };
+    walk(cwd, 0);
+    return { frameworks: [...frameworks].sort(), providers: [...providers].sort() };
+}
 /** Agent/artifact counts for the completion screen's harness payoff line. */
 function readHarnessGraphCounts(cwd = process.cwd()) {
     const manifestPath = join(cwd, '.moda', 'harness.json');
@@ -826,7 +1204,7 @@ function commandFlags(flags) {
 function stringFlag(value) {
     return typeof value === 'string' && value.trim().length > 0 ? value : undefined;
 }
-function resumeFlagsForInit(flags) {
+export function resumeFlagsForInit(flags) {
     const passthrough = [
         'profile',
         'tenant-id',
@@ -835,9 +1213,12 @@ function resumeFlagsForInit(flags) {
         'sdk-integrate',
         'ci-cd',
         'autosync',
+        'harness-rescan',
+        'harness-rescan-paths',
         'no-sdk-integrate',
         'no-ci-cd',
         'no-autosync',
+        'no-harness-rescan',
         'yes',
         'agent',
         'json',
@@ -854,6 +1235,14 @@ function resumeFlagsForInit(flags) {
         else
             out.push(flag, String(value));
     }
+    // The rescan choice is derived as `flag ?? (paths ? true : ...)`, so a bare
+    // `--harness-rescan-paths` re-implies opt-in. If the original run explicitly
+    // disabled rescan (via `--harness-rescan=false`, whose false value the loop
+    // above drops), carry the negative through so a resume can't silently write
+    // the workflow the user declined.
+    if (resolveHarnessRescanFlag(flags) === false && !out.includes('--no-harness-rescan')) {
+        out.push('--no-harness-rescan');
+    }
     return out;
 }
 /**
@@ -877,6 +1266,29 @@ function resolveAutosyncFlag(flags) {
         return false;
     return undefined;
 }
+/** Explicit harness-rescan decision from flags, or undefined when the Plan beat decides. */
+function resolveHarnessRescanFlag(flags) {
+    const explicit = parseOptionalBoolean(flagValue(flags, 'harness-rescan', 'harness_rescan'));
+    if (explicit !== undefined)
+        return explicit;
+    if (isTruthyFlag(flagValue(flags, 'no-harness-rescan', 'no_harness_rescan')))
+        return false;
+    return undefined;
+}
+/**
+ * Comma-separated path globs for the rescan workflow's `on.push.paths` scope.
+ * `undefined` when the flag is absent (or carries no usable globs), so a bare
+ * `--harness-rescan` still writes an unscoped rescan-on-every-push workflow.
+ */
+function parseHarnessRescanPaths(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const globs = value
+        .split(',')
+        .map((glob) => glob.trim())
+        .filter((glob) => glob.length > 0 && glob !== 'true');
+    return globs.length > 0 ? globs : undefined;
+}
 /**
  * Explicit SDK-integration decision from flags, or undefined when the Plan
  * beat decides (interactive default: on when a coding-agent CLI is installed;

package/dist/init/tenant.js

@@ -5,7 +5,7 @@ import { hostname } from 'node:os';
 import { join } from 'node:path';
 import { select } from '@inquirer/prompts';
 import { authFetch, getCachedLoginContext } from '../auth.js';
-import { loadCliConfig, resolveIngestUrl, resolveModaBaseUrl, saveCliConfig, } from '../config.js';
+import { embeddedTenantIdFromApiKey, loadCliConfig, resolveIngestUrl, resolveModaBaseUrl, saveCliConfig, } from '../config.js';
 import { getModaDir, resolveApiKeyFromActiveProfile, resolveTenantIdFromActiveProfile, writeSecretJsonFile, } from '../profiles.js';
 import { CliAccessError, CliInputError, CliInputRequiredError } from '../errors.js';
 /**
@@ -42,8 +42,6 @@ export function formatControlPlaneFetchError(action, status, body) {
 // Mirrors the backend's checkAdminAccess: only the viewer role is denied.
 const ADMIN_ACCESS_MESSAGE = 'You need admin or owner access to create API keys.';
 const ADMIN_ACCESS_GUIDANCE = 'Ask your organization owner to upgrade your role.';
-const API_KEY_PREFIX = 'moda_sk_';
-const SIGNED_KEY_VERSION = 'v1';
 // Bound the pre-bootstrap liveness probe tightly: a slow or unreachable
 // endpoint must never block init — we just mint a fresh key instead.
 const VALIDATE_TIMEOUT_MS = 3_000;
@@ -160,29 +158,13 @@ function bootstrapLabel(custom) {
     }
 }
 /**
- * Signed CLI keys embed their tenant: the format is
- * moda_sk_<base64url("v1:keyId:tenantId:timestamp:signature")> — see
- * createApiKey/parseAndVerifySignedKey in
- * apps/moda-backend/src/api-keys/api-keys.service.ts. Decoding locally lets
- * dedup reject a cross-tenant or malformed key structurally, with no network
- * call. The HMAC signature can only be verified server-side; liveness (not
- * revoked) is probed separately by isStoredKeyLive().
+ * Signed CLI keys embed their tenant (moda_sk_<base64url("v1:keyId:tenantId:
+ * timestamp:signature")>). Decoding locally lets dedup reject a cross-tenant
+ * or malformed key structurally, with no network call. Shared with the
+ * pre-upload identity banner via `embeddedTenantIdFromApiKey` in config.ts;
+ * liveness (not revoked) is probed separately by isStoredKeyLive().
  */
-function embeddedTenantId(key) {
-    if (!key.startsWith(API_KEY_PREFIX))
-        return undefined;
-    try {
-        const decoded = Buffer.from(key.slice(API_KEY_PREFIX.length), 'base64url').toString('utf8');
-        // Expected format: version:keyId:tenantId:timestamp:signature
-        const parts = decoded.split(':');
-        if (parts.length !== 5 || parts[0] !== SIGNED_KEY_VERSION)
-            return undefined;
-        return parts[2] || undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
+const embeddedTenantId = embeddedTenantIdFromApiKey;
 /**
  * Liveness probe for a stored key. Deliberately NOT the backend's public
  * POST /api/api-keys/validate: the CLI's resolved base URL is the FRONTEND