@moda-ai/cli 1.18.1 → 1.19.0

package/dist/cli.js

@@ -250,6 +250,10 @@ Init flags:
   --no-ci-cd                       Skip CI/CD workflow creation
   --autosync                       Create GitHub Actions workflow to sync prompts + skills to Moda on push to main
   --no-autosync                    Skip autosync workflow creation
+  --harness-rescan                 Create GitHub Actions workflow to re-scan the harness and sync it to Moda on push to main
+  --no-harness-rescan              Skip harness rescan workflow creation
+  --harness-rescan-paths=GLOBS     Comma-separated path globs that scope which pushes trigger the
+                                   harness rescan workflow (implies --harness-rescan)
   --offline                        Run final validation offline (skip the online telemetry check)
 
 Provision flags (headless; requires an existing "moda auth login" session):
@@ -292,6 +296,7 @@ Examples:
   moda harness explain --agent=agent_support
   moda init --ci-cd
   moda init --autosync
+  moda init --harness-rescan --harness-rescan-paths='src/agents/**'
   moda overview --days-back=30
   moda clusters --time-range=7d
   moda conversations --search="error" --limit=5
@@ -707,7 +712,7 @@ export const commandRegistry = createCommandRegistry([
     {
         name: 'init',
         description: 'Set up Moda in your project',
-        examples: ['moda init', 'moda init --sdk-integrate', 'moda init --ci-cd', 'moda init --autosync'],
+        examples: ['moda init', 'moda init --sdk-integrate', 'moda init --ci-cd', 'moda init --autosync', 'moda init --harness-rescan'],
         auth: 'none',
         outputModes: ['human', 'json', 'agent'],
         mutability: 'write',

package/dist/config.d.ts

@@ -28,6 +28,18 @@ export declare function saveCliConfig(update: CliConfig, options?: ProfileIOOpti
  * long-lived process (or a test) sees the current value.
  */
 export declare function resolveApiKey(options?: ProfileIOOptions): string | undefined;
+/**
+ * Signed CLI keys embed their tenant: the format is
+ * moda_sk_<base64url("v1:keyId:tenantId:timestamp:signature")> — see
+ * createApiKey/parseAndVerifySignedKey in
+ * apps/moda-backend/src/api-keys/api-keys.service.ts. The server derives the
+ * upload destination tenant from the key alone, so this is the only
+ * client-side tenant source that matches where data actually lands
+ * (config / MODA_TENANT_ID can disagree with a shadowing env key). The HMAC
+ * signature can only be verified server-side; treat the result as
+ * informational.
+ */
+export declare function embeddedTenantIdFromApiKey(key: string): string | undefined;
 /**
  * Resolve the ingest worker base URL used by `moda workspace snapshot`.
  * Env override -> active profile -> legacy config -> production default.

package/dist/config.js

@@ -40,6 +40,34 @@ export function resolveApiKey(options = {}) {
         loadCliConfig(options).api_key ||
         undefined);
 }
+const SIGNED_API_KEY_PREFIX = 'moda_sk_';
+const SIGNED_API_KEY_VERSION = 'v1';
+/**
+ * Signed CLI keys embed their tenant: the format is
+ * moda_sk_<base64url("v1:keyId:tenantId:timestamp:signature")> — see
+ * createApiKey/parseAndVerifySignedKey in
+ * apps/moda-backend/src/api-keys/api-keys.service.ts. The server derives the
+ * upload destination tenant from the key alone, so this is the only
+ * client-side tenant source that matches where data actually lands
+ * (config / MODA_TENANT_ID can disagree with a shadowing env key). The HMAC
+ * signature can only be verified server-side; treat the result as
+ * informational.
+ */
+export function embeddedTenantIdFromApiKey(key) {
+    if (!key.startsWith(SIGNED_API_KEY_PREFIX))
+        return undefined;
+    try {
+        const decoded = Buffer.from(key.slice(SIGNED_API_KEY_PREFIX.length), 'base64url').toString('utf8');
+        // Expected format: version:keyId:tenantId:timestamp:signature
+        const parts = decoded.split(':');
+        if (parts.length !== 5 || parts[0] !== SIGNED_API_KEY_VERSION)
+            return undefined;
+        return parts[2] || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Resolve the ingest worker base URL used by `moda workspace snapshot`.
  * Env override -> active profile -> legacy config -> production default.

package/dist/harness.d.ts

@@ -390,6 +390,51 @@ declare function buildCommandScanPlan(context: CommandContext, rootDir: string):
 };
 export declare function writeHumanProgress(context: CommandContext, message: string): void;
 export declare function readHarnessSyncState(rootDir: string): HarnessSyncState | undefined;
+/**
+ * The identity a sync-style upload will actually authenticate as, resolved
+ * with the same precedence as the API call itself (MODA_API_KEY env wins over
+ * the active profile / legacy config). Used for the pre-upload
+ * "Syncing as <credential> → tenant <id>" banner so a shadowed or stale key
+ * is visible BEFORE data lands in the wrong tenant.
+ *
+ * The destination tenant is derived from the WINNING KEY itself (signed CLI
+ * keys embed their tenant, and the server resolves the destination from the
+ * key alone) — never from flag/env/profile config, which is exactly what a
+ * shadowing stale key disagrees with. When the key does not embed a tenant,
+ * the config-resolved id is returned with `tenantSource: 'config'` so
+ * callers must label it unverified. Best-effort: never throws (a broken
+ * MODA_PROFILE must not abort onboarding).
+ */
+export declare function describeSyncIdentity(options?: {
+    profile?: string;
+    env?: NodeJS.ProcessEnv;
+}): {
+    credential: string;
+    tenantId?: string;
+    /** 'api-key' = decoded from the winning key (authoritative); 'config' = flag/env/profile fallback (unverified). */
+    tenantSource?: 'api-key' | 'config';
+} | undefined;
+/**
+ * Human tenant label for the identity banner: key-derived ids are printed
+ * bare; config-derived ids are explicitly marked unverified so the banner
+ * never asserts a destination the server might not use.
+ */
+export declare function describeSyncTenantLabel(identity: {
+    tenantId?: string;
+    tenantSource?: 'api-key' | 'config';
+}): string;
+/**
+ * Reports in subdirectories that are FRESHER than the root's
+ * `.moda/harness-report.json` (a missing root report counts as infinitely
+ * old). Catches the `--path` trap: `harness analyze --path=<subdir>` writes
+ * `<subdir>/.moda/harness-report.json`, and a later root-level
+ * `harness approve`/`sync` silently targets the stale (or absent) root report.
+ * Newest first.
+ */
+export declare function findFresherHarnessReports(rootDir: string): Array<{
+    path: string;
+    mtimeMs: number;
+}>;
 export declare function writeHarnessArtifacts(graph: HarnessGraph, rootDir: string, options?: {
     summary?: boolean;
 }): string[];

package/dist/harness.js

@@ -6,7 +6,7 @@ import { basename, delimiter, dirname, extname, join, relative, resolve, sep } f
 import { confirm, select } from '@inquirer/prompts';
 import { callControlAPI } from './api-client.js';
 import { AnalystTui, shouldUseAnalystTui } from './analyst-tui.js';
-import { resolveApiKey, resolveTenantId } from './config.js';
+import { embeddedTenantIdFromApiKey, resolveApiKey, resolveTenantId } from './config.js';
 import { CliInputError, CliInputRequiredError } from './errors.js';
 import { HARNESS_REMOTE_RUN_STATE_PATH, isRemoteHarnessAnalyze, readRemoteRunState, runHarnessPull, runRemoteHarnessAnalyst, } from './harness-remote.js';
 import { getActiveProfile } from './profiles.js';
@@ -101,6 +101,24 @@ export async function runHarnessCommand(context) {
             if (!resolveApiKey({ profile: context.profile, env: context.env }) && !context.dryRun) {
                 throw new CliInputError('No Moda API key found for harness sync.', 'Run `moda init` first, set MODA_API_KEY, or select a profile with an API key.');
             }
+            warnFresherSubdirHarnessReports(context, rootDir, context.flags['from-report'] ?? context.flags.report);
+            if (!context.dryRun) {
+                const identity = describeSyncIdentity({ profile: context.profile, env: context.env });
+                if (identity) {
+                    // The banner's tenant comes from the winning key when it embeds
+                    // one. Otherwise fall back to the flag/env/profile-resolved tenant
+                    // but label it unverified — that source is precisely what a
+                    // shadowing stale key disagrees with, so it must never be asserted
+                    // as the destination.
+                    const label = identity.tenantSource === 'api-key'
+                        ? describeSyncTenantLabel(identity)
+                        : describeSyncTenantLabel({
+                            tenantId: tenant?.tenantId ?? identity.tenantId,
+                            tenantSource: 'config',
+                        });
+                    writeHumanProgress(context, `Syncing as ${identity.credential} → tenant ${label}`);
+                }
+            }
             if (context.flags['from-report'] || context.flags.report) {
                 const reportPath = resolveHarnessReportPath(rootDir, context.flags['from-report'] ?? context.flags.report);
                 const { report, validation, approval, approved } = loadHarnessReportForSync(rootDir, reportPath);
@@ -344,6 +362,7 @@ export async function runHarnessCommand(context) {
             return { exitCode: validation.status === 'pass' ? 0 : 1 };
         }
         case 'approve': {
+            warnFresherSubdirHarnessReports(context, rootDir, context.positionals[1] ?? context.flags.report);
             const reportPath = resolveHarnessReportPath(rootDir, context.positionals[1] ?? context.flags.report);
             const approval = await approveHarnessReport({
                 rootDir,
@@ -363,7 +382,7 @@ export async function runHarnessCommand(context) {
             return { exitCode: 0 };
         }
         case 'agents': {
-            const graph = loadOrScanHarness(rootDir, tenant);
+            const graph = loadOrScanHarness(rootDir, tenant, context);
             context.output.writeData({
                 summary: summarizeHarness(graph),
                 agentFamilies: graph.agentFamilies,
@@ -373,12 +392,12 @@ export async function runHarnessCommand(context) {
             return { exitCode: 0 };
         }
         case 'graph': {
-            const graph = loadOrScanHarness(rootDir, tenant);
+            const graph = loadOrScanHarness(rootDir, tenant, context);
             context.output.writeData(graph);
             return { exitCode: 0 };
         }
         case 'explain': {
-            const graph = loadOrScanHarness(rootDir, tenant);
+            const graph = loadOrScanHarness(rootDir, tenant, context);
             if (selectedAgentId) {
                 const agent = graph.runtimeAgents.find((candidate) => candidate.id === selectedAgentId);
                 if (!agent) {
@@ -2040,15 +2059,187 @@ function selectedRuntimeAgentId(flags) {
         return flags.agent;
     return undefined;
 }
-function loadOrScanHarness(rootDir, tenant) {
+function loadOrScanHarness(rootDir, tenant, context) {
     const manifestPath = join(rootDir, HARNESS_PATH);
-    return existsSync(manifestPath)
-        ? readHarnessGraph(manifestPath)
-        : scanHarness({
-            rootDir,
-            tenantId: tenant?.tenantId,
-            tenantSource: tenant?.source,
-        });
+    if (existsSync(manifestPath))
+        return readHarnessGraph(manifestPath);
+    // Provenance banner: without a persisted manifest this command output comes
+    // from a live scan of the current directory, which is easy to mistake for
+    // synced/account data (especially right after switching repos or profiles).
+    if (context) {
+        writeHarnessNotice(context, `No ${HARNESS_PATH} found; showing a live scan of ${rootDir}. ` +
+            'This is local scan output, NOT synced or account data. ' +
+            'Run `moda harness scan` to persist it and `moda harness sync` to upload it.');
+    }
+    return scanHarness({
+        rootDir,
+        tenantId: tenant?.tenantId,
+        tenantSource: tenant?.source,
+    });
+}
+/**
+ * Warning line that must be visible in every output mode: styled progress on
+ * stderr for humans, a plain `Warning:` stderr line for machine modes (stdout
+ * stays machine-readable JSON either way). Quiet suppresses it like the rest
+ * of the harness progress surface.
+ */
+function writeHarnessNotice(context, message) {
+    if (context.quiet && context.flags.progress !== 'true')
+        return;
+    if (context.outputMode === 'human') {
+        console.error(renderHarnessProgress(message, 'warning'));
+        return;
+    }
+    console.error(`Warning: ${message}`);
+}
+/**
+ * The identity a sync-style upload will actually authenticate as, resolved
+ * with the same precedence as the API call itself (MODA_API_KEY env wins over
+ * the active profile / legacy config). Used for the pre-upload
+ * "Syncing as <credential> → tenant <id>" banner so a shadowed or stale key
+ * is visible BEFORE data lands in the wrong tenant.
+ *
+ * The destination tenant is derived from the WINNING KEY itself (signed CLI
+ * keys embed their tenant, and the server resolves the destination from the
+ * key alone) — never from flag/env/profile config, which is exactly what a
+ * shadowing stale key disagrees with. When the key does not embed a tenant,
+ * the config-resolved id is returned with `tenantSource: 'config'` so
+ * callers must label it unverified. Best-effort: never throws (a broken
+ * MODA_PROFILE must not abort onboarding).
+ */
+export function describeSyncIdentity(options = {}) {
+    const apiKey = resolveApiKey(options);
+    if (!apiKey)
+        return undefined;
+    const redacted = apiKey.length > 12
+        ? `${apiKey.slice(0, 8)}…${apiKey.slice(-4)}`
+        : `…${apiKey.slice(-4)}`;
+    const env = options.env ?? process.env;
+    // getActiveProfile throws when the named profile is missing (e.g. a stale
+    // MODA_PROFILE) even though the key already resolved via legacy config —
+    // the banner is advisory and must never abort the command around it.
+    let profileName;
+    try {
+        profileName = getActiveProfile(options).name;
+    }
+    catch {
+        profileName = undefined;
+    }
+    const credential = env.MODA_API_KEY === apiKey
+        ? `MODA_API_KEY env key (${redacted})`
+        : profileName
+            ? `profile '${profileName}' key (${redacted})`
+            : `stored key (${redacted})`;
+    const keyTenantId = embeddedTenantIdFromApiKey(apiKey);
+    if (keyTenantId) {
+        return { credential, tenantId: keyTenantId, tenantSource: 'api-key' };
+    }
+    const configTenantId = resolveTenantId(options);
+    return {
+        credential,
+        tenantId: configTenantId,
+        tenantSource: configTenantId ? 'config' : undefined,
+    };
+}
+/**
+ * Human tenant label for the identity banner: key-derived ids are printed
+ * bare; config-derived ids are explicitly marked unverified so the banner
+ * never asserts a destination the server might not use.
+ */
+export function describeSyncTenantLabel(identity) {
+    if (!identity.tenantId)
+        return 'unresolved';
+    if (identity.tenantSource === 'api-key')
+        return identity.tenantId;
+    return `${identity.tenantId} (unverified — from local config, not the API key; the server derives the destination tenant from the key)`;
+}
+/** Bounded walk looking for `<subdir>/.moda/harness-report.json` files. */
+const FRESHER_REPORT_MAX_DEPTH = 4;
+const FRESHER_REPORT_MAX_DIRS = 4_000;
+/**
+ * Reports in subdirectories that are FRESHER than the root's
+ * `.moda/harness-report.json` (a missing root report counts as infinitely
+ * old). Catches the `--path` trap: `harness analyze --path=<subdir>` writes
+ * `<subdir>/.moda/harness-report.json`, and a later root-level
+ * `harness approve`/`sync` silently targets the stale (or absent) root report.
+ * Newest first.
+ */
+export function findFresherHarnessReports(rootDir) {
+    let rootMtimeMs = 0;
+    try {
+        rootMtimeMs = lstatSync(join(rootDir, HARNESS_REPORT_PATH)).mtimeMs;
+    }
+    catch {
+        rootMtimeMs = 0;
+    }
+    const fresher = [];
+    let visited = 0;
+    const walk = (dir, depth) => {
+        if (depth > FRESHER_REPORT_MAX_DEPTH || visited >= FRESHER_REPORT_MAX_DIRS)
+            return;
+        visited += 1;
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            // Dot-dirs (including each dir's own `.moda`, checked explicitly below)
+            // and scan-skipped dirs never host a user project subtree.
+            if (!entry.isDirectory() || entry.name.startsWith('.') || SKIPPED_DIRS.has(entry.name))
+                continue;
+            const child = join(dir, entry.name);
+            try {
+                const candidate = lstatSync(join(child, HARNESS_REPORT_PATH));
+                if (candidate.isFile() && candidate.mtimeMs > rootMtimeMs) {
+                    fresher.push({
+                        path: normalizePath(relative(rootDir, join(child, HARNESS_REPORT_PATH))),
+                        mtimeMs: candidate.mtimeMs,
+                    });
+                }
+            }
+            catch {
+                // No report in this subdir; keep walking.
+            }
+            walk(child, depth + 1);
+        }
+    };
+    walk(rootDir, 1);
+    return fresher.sort((a, b) => b.mtimeMs - a.mtimeMs);
+}
+/**
+ * `--path` trap guard for `harness approve` / `harness sync`: when the
+ * report the command is about to use is older than a fresher
+ * `<subdir>/.moda/harness-report.json`, point at the fresher one. Skipped
+ * when the user explicitly named a report file (they already chose).
+ */
+function warnFresherSubdirHarnessReports(context, rootDir, explicitReport) {
+    // Only treat an explicit report as an opt-out when it points somewhere other
+    // than the default root report. `--from-report=.moda/harness-report.json`
+    // still targets the default report, so the fresher-subdir warning must fire.
+    const explicitReportPath = explicitReport && explicitReport !== 'true'
+        ? normalizePath(relative(rootDir, resolve(rootDir, explicitReport)))
+        : undefined;
+    if (explicitReportPath && explicitReportPath !== normalizePath(HARNESS_REPORT_PATH))
+        return;
+    let fresher;
+    try {
+        fresher = findFresherHarnessReports(rootDir);
+    }
+    catch {
+        return;
+    }
+    if (fresher.length === 0)
+        return;
+    const newest = fresher[0];
+    const subdir = normalizePath(dirname(dirname(newest.path)));
+    const rootState = existsSync(join(rootDir, HARNESS_REPORT_PATH))
+        ? `older ${HARNESS_REPORT_PATH}`
+        : `no ${HARNESS_REPORT_PATH}`;
+    writeHarnessNotice(context, `A fresher harness report exists at ${newest.path} (this directory has ${rootState}). ` +
+        `If you meant that report, re-run with --path=${subdir}.`);
 }
 function readHarnessGraph(manifestPath) {
     return JSON.parse(readFileSync(manifestPath, 'utf8'));

package/dist/init/index.d.ts

@@ -11,7 +11,7 @@ export interface InitPhaseResult {
     details?: string;
 }
 export interface InitSetupAction {
-    category: 'sdk' | 'harness' | 'hooks' | 'prompts' | 'skills' | 'ci-cd' | 'autosync' | 'validation';
+    category: 'sdk' | 'harness' | 'hooks' | 'prompts' | 'skills' | 'ci-cd' | 'autosync' | 'harness-rescan' | 'validation';
     title: string;
     status: 'planned' | 'applied' | 'skipped' | 'manual';
     approved: boolean;
@@ -28,6 +28,44 @@ export interface InitRunOptions {
     onEvent?: (event: InitProgressEvent) => void;
 }
 export declare function runInit(flags: Record<string, unknown>, options?: InitRunOptions): Promise<InitResult>;
+export declare function writeCiCdWorkflow(cwd?: string): string;
+export declare function writeAutosyncWorkflow(cwd?: string): string;
+export declare function writeHarnessRescanWorkflow(cwd?: string, paths?: string[]): string;
+/**
+ * Signals from the discovered graph used by the init 0-agent quality gate:
+ * runtime agent count plus the LLM framework/provider names detected in the
+ * repo.
+ */
+export interface HarnessQualitySignals {
+    runtimeAgents: number;
+    frameworks: string[];
+    providers: string[];
+}
+/**
+ * Read the gate signals from the SAME graph the auto-sync uploads: the cited
+ * report (`.moda/harness-report.json`, consumed by `harness sync --from-report`)
+ * is authoritative, so read its `graph` first. Only fall back to the standalone
+ * manifest (`.moda/harness.json`) when no report exists, otherwise a stale or
+ * missing manifest could let an empty report slip past the gate and overwrite
+ * the tenant's harness. Returns undefined when neither is readable.
+ */
+export declare function readHarnessQualitySignals(cwd?: string): HarnessQualitySignals | undefined;
+/**
+ * True when discovery found no runtime agents even though the repo carries
+ * LLM framework/provider signals — the signature of a failed discovery run,
+ * not an agent-free repo.
+ */
+export declare function harnessLooksIncomplete(signals: HarnessQualitySignals): boolean;
+/**
+ * Deterministic repo-side LLM signals: well-known LLM package names found in
+ * dependency manifests. Independent of the discovery output, so a fully
+ * failed discovery (empty graph) cannot bypass the 0-agent gate.
+ */
+export declare function detectRepoLlmSignals(cwd?: string): {
+    frameworks: string[];
+    providers: string[];
+};
+export declare function resumeFlagsForInit(flags: Record<string, unknown>): string[];
 /**
  * Onboarding runs harness discovery SERVER-SIDE by default so the customer
  * needs no local coding agent. Opt out with `--local`, `--no-remote`,

package/dist/init/index.js

@@ -5,7 +5,7 @@
 // harness analysis first and overlapping it with the fast local tasks and the
 // SDK integration agent while a live progress board (progress-board.ts)
 // renders each lane.
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { checkbox, confirm, select } from '@inquirer/prompts';
 import { login, loadToken } from '../auth.js';
@@ -20,7 +20,7 @@ import { InitProgressBoard } from './progress-board.js';
 import { createCommandContext } from '../command-context.js';
 import { resolveModaBaseUrl, VERSION } from '../config.js';
 import { CliAuthError, CliInputError } from '../errors.js';
-import { detectAvailableCodingAgents, isDeterministicLocalAnalyst, runHarnessCommand, } from '../harness.js';
+import { describeSyncIdentity, describeSyncTenantLabel, detectAvailableCodingAgents, isDeterministicLocalAnalyst, runHarnessCommand, } from '../harness.js';
 import { pollRemoteAnalyzeUntilDone, startRemoteAnalyze, } from '../harness-remote.js';
 import { buildDoctorReport } from '../doctor.js';
 import { renderInitBanner, renderInitComplete, renderInitNote, renderInitSetupPlan, renderInitStep, } from '../tui.js';
@@ -113,7 +113,7 @@ export async function runInit(flags, options = {}) {
     // selection; otherwise the exact-id match below fails with
     // "No organization with id ''" instead of auto-selecting a sole org.
     const tenantIdEnv = stringFlag(process.env.MODA_TENANT_ID);
-    const { apiKey, tenantName } = await selectTenantAndCreateKey({
+    const { apiKey, tenantId: selectedTenantId, tenantName } = await selectTenantAndCreateKey({
         tenantId: tenantIdFlag ?? tenantIdEnv,
         tenantIdSource: tenantIdFlag ? 'flag' : tenantIdEnv ? 'env' : undefined,
         nonInteractive: json || agent,
@@ -134,6 +134,11 @@ export async function runInit(flags, options = {}) {
     const sdkFlag = resolveSdkIntegrateFlag(flags);
     const ciCdFlag = resolveCiCdFlag(flags);
     const autosyncFlag = resolveAutosyncFlag(flags);
+    const harnessRescanFlag = resolveHarnessRescanFlag(flags);
+    const harnessRescanPaths = parseHarnessRescanPaths(flagValue(flags, 'harness-rescan-paths', 'harness_rescan_paths'));
+    // Passing --harness-rescan-paths alone is an explicit opt-in: scoping the
+    // rescan only makes sense when the workflow is being written.
+    const harnessRescanChoice = harnessRescanFlag ?? (harnessRescanPaths !== undefined ? true : undefined);
     // SDK integration installs packages and edits source via a coding agent, so
     // it defaults ON only when an agent CLI is installed to do the work; it
     // never runs unattended without an explicit --sdk-integrate.
@@ -141,6 +146,7 @@ export async function runInit(flags, options = {}) {
     let integrateSdk = sdkFlag !== undefined ? sdkFlag : yes ? false : codingAgentAvailable;
     let configureCiCd = ciCdFlag ?? false;
     let configureAutosync = autosyncFlag ?? false;
+    let configureHarnessRescan = harnessRescanChoice ?? false;
     let setupPlan = [];
     const renderPlan = () => {
         setupPlan = buildSetupPlan({
@@ -148,6 +154,7 @@ export async function runInit(flags, options = {}) {
             integrateSdk,
             configureCiCd,
             configureAutosync,
+            configureHarnessRescan,
             remote,
         });
         log(renderInitSetupPlan(setupPlan, { snapshotConsent: remote }));
@@ -185,6 +192,13 @@ export async function runInit(flags, options = {}) {
                     checked: configureAutosync,
                 });
             }
+            if (harnessRescanChoice === undefined) {
+                choices.push({
+                    name: 'Re-scan the harness on push to main (.github/workflows/moda-harness-rescan.yml)',
+                    value: 'harness-rescan',
+                    checked: configureHarnessRescan,
+                });
+            }
             if (choices.length > 0) {
                 const selected = await checkbox({
                     message: 'Choose what runs (space toggles, enter confirms)',
@@ -198,13 +212,16 @@ export async function runInit(flags, options = {}) {
                     configureCiCd = selected.includes('ci-cd');
                 if (autosyncFlag === undefined)
                     configureAutosync = selected.includes('autosync');
+                if (harnessRescanChoice === undefined)
+                    configureHarnessRescan = selected.includes('harness-rescan');
                 renderPlan();
             }
         }
     }
     if (json || agent) {
         const skipped = setupPlan
-            .filter((action) => (action.category === 'sdk' || action.category === 'ci-cd' || action.category === 'autosync') &&
+            .filter((action) => (action.category === 'sdk' || action.category === 'ci-cd' || action.category === 'autosync' ||
+            action.category === 'harness-rescan') &&
             action.approved === false)
             .map((action) => `${action.category}: ${action.command ?? 'explicit flag required'}`);
         if (skipped.length > 0) {
@@ -267,6 +284,61 @@ export async function runInit(flags, options = {}) {
     // unapproved report, so approve it first. Best-effort: a network blip on
     // either call must not abort onboarding.
     const approveAndSyncHarness = async () => {
+        // Quality gate: a result with ZERO runtime agents on a repo that clearly
+        // uses LLM frameworks/providers almost always means discovery failed (bad
+        // snapshot, analyst error), not an agent-free repo. Auto-approving and
+        // syncing it would overwrite the tenant's harness with an empty graph, so
+        // withhold the upload and hand the user the retry commands instead.
+        // The framework/provider evidence is the union of what the discovered
+        // graph self-reports AND a deterministic repo-side dependency scan — a
+        // TOTAL discovery failure (0 agents, 0 frameworks, 0 providers) must not
+        // bypass the gate just because the artifact being judged is empty.
+        const graphSignals = readHarnessQualitySignals(rootDir);
+        const repoSignals = detectRepoLlmSignals(rootDir);
+        const signals = graphSignals
+            ? {
+                runtimeAgents: graphSignals.runtimeAgents,
+                frameworks: [...new Set([...graphSignals.frameworks, ...repoSignals.frameworks])],
+                providers: [...new Set([...graphSignals.providers, ...repoSignals.providers])],
+            }
+            : undefined;
+        if (signals && harnessLooksIncomplete(signals)) {
+            const names = [...signals.frameworks, ...signals.providers].join(', ');
+            const retryCommand = remote
+                ? 'moda harness analyze --remote --summary'
+                : 'moda harness analyze --analyst=claude|cursor|codex --summary';
+            warn(renderInitNote(`Harness discovery found 0 runtime agents, but this repo has LLM framework signals (${names}). ` +
+                'Discovery likely failed, so the result was NOT approved or synced.', 'warning'));
+            warn(`  Retry with \`${retryCommand}\`, then \`moda harness approve --yes && moda harness sync --from-report\`.`);
+            emit('harness', 'Harness discovery found 0 agents despite LLM framework signals; sync withheld.', 'warning');
+            harnessPhase = {
+                id: 'harness',
+                title: 'Harness discovery',
+                status: 'warning',
+                details: '0 agents detected; sync withheld',
+            };
+            return;
+        }
+        // Identity banner: the credential is resolved with the same precedence
+        // the upload uses (MODA_API_KEY env wins) and the tenant comes from the
+        // WINNING KEY itself (or is marked unverified), so a shadowed/stale key
+        // is visible — and never mislabeled — BEFORE the graph lands in the
+        // wrong tenant. Best-effort: must not abort onboarding.
+        try {
+            const identity = describeSyncIdentity({ profile, env: process.env });
+            if (identity) {
+                // The friendly workspace name only decorates the id when the winning
+                // key's embedded tenant IS the tenant init just selected — otherwise
+                // the raw (possibly surprising) destination id stands alone.
+                const tenantLabel = identity.tenantSource === 'api-key' && identity.tenantId
+                    ? `${identity.tenantId}${identity.tenantId === selectedTenantId ? ` (${tenantName})` : ''}`
+                    : describeSyncTenantLabel(identity);
+                log(renderInitNote(`Syncing as ${identity.credential} → tenant ${tenantLabel}`, 'info'));
+            }
+        }
+        catch {
+            // Advisory banner only.
+        }
         try {
             await runHarnessCommand(createCommandContext({
                 command: 'harness',
@@ -437,6 +509,12 @@ export async function runInit(flags, options = {}) {
         laneBoard?.complete('autosync', `wrote ${workflowPath}`);
         markApplied(setupPlan, 'autosync');
     }
+    if (setupPlan.find((action) => action.category === 'harness-rescan')?.approved === true) {
+        const workflowPath = writeHarnessRescanWorkflow(process.cwd(), harnessRescanPaths);
+        laneBoard?.startLane('harness-rescan', 'Harness rescan workflow');
+        laneBoard?.complete('harness-rescan', `wrote ${workflowPath}`);
+        markApplied(setupPlan, 'harness-rescan');
+    }
     const sdkAction = setupPlan.find((action) => action.category === 'sdk');
     if (sdkAction?.approved === true) {
         laneBoard?.startLane('sdk', 'SDK integration', {
@@ -667,6 +745,17 @@ function buildSetupPlan(options) {
             command: 'moda prompts sync && moda skills sync',
             reason: options.configureAutosync ? undefined : 'No autosync workflow is written until it is explicitly approved (--autosync).',
         },
+        {
+            category: 'harness-rescan',
+            title: 'Re-scan the harness on push to main so the synced graph never drifts from the code',
+            status: options.configureHarnessRescan ? 'planned' : 'manual',
+            approved: options.configureHarnessRescan,
+            files: ['.github/workflows/moda-harness-rescan.yml'],
+            command: 'moda harness analyze --remote --yes && moda harness approve --yes && moda harness sync --from-report',
+            reason: options.configureHarnessRescan
+                ? undefined
+                : 'No harness rescan workflow is written until it is explicitly approved (--harness-rescan).',
+        },
         {
             category: 'validation',
             title: 'Run Moda doctor online to confirm telemetry is reaching Moda',
@@ -701,7 +790,14 @@ function changedFiles(setupPlan) {
 // the Moda registry. The pin tracks the CLI that generated the file, so each
 // `moda init` upgrade is an explicit, reviewable bump of the workflow.
 const GENERATED_WORKFLOW_CLI = `@moda-ai/cli@${VERSION}`;
-function writeCiCdWorkflow(cwd = process.cwd()) {
+// npx dispatch shape matters: `npx -y @moda-ai/cli@X moda harness ...` resolves
+// the package's default bin and passes the literal `moda` token through as the
+// CLI's first argument, so every step would exit 1 with "Unknown command
+// 'moda'". `--package=<pkg> moda` pins the package AND names the `moda` bin
+// explicitly, so the CLI receives the real subcommand first.
+const GENERATED_WORKFLOW_NPX = `npx -y --package=${GENERATED_WORKFLOW_CLI} moda`;
+// Exported for tests (generated-workflows.test.ts validates npx dispatch shape).
+export function writeCiCdWorkflow(cwd = process.cwd()) {
     const relativePath = '.github/workflows/moda-validation.yml';
     const path = join(cwd, relativePath);
     mkdirSync(dirname(path), { recursive: true });
@@ -730,7 +826,7 @@ function writeCiCdWorkflow(cwd = process.cwd()) {
         '        with:',
         '          node-version: 22',
         '      - name: Validate Moda setup',
-        `        run: npx -y ${GENERATED_WORKFLOW_CLI} moda doctor --online --json`,
+        `        run: ${GENERATED_WORKFLOW_NPX} doctor --online --json`,
         '',
     ].join('\n')}`);
     return relativePath;
@@ -739,7 +835,7 @@ function writeCiCdWorkflow(cwd = process.cwd()) {
 // sync with the repo: it pushes prompt and skill changes after they merge. It
 // only runs on `main` (never on pull_request) so unmerged versions are never
 // published. Keep its env in step with writeCiCdWorkflow().
-function writeAutosyncWorkflow(cwd = process.cwd()) {
+export function writeAutosyncWorkflow(cwd = process.cwd()) {
     const relativePath = '.github/workflows/moda-autosync.yml';
     const path = join(cwd, relativePath);
     mkdirSync(dirname(path), { recursive: true });
@@ -772,9 +868,72 @@ function writeAutosyncWorkflow(cwd = process.cwd()) {
         '        with:',
         '          node-version: 22',
         `      - name: Sync prompts to Moda`,
-        `        run: npx -y ${GENERATED_WORKFLOW_CLI} moda prompts sync`,
+        `        run: ${GENERATED_WORKFLOW_NPX} prompts sync`,
         `      - name: Sync skills to Moda`,
-        `        run: npx -y ${GENERATED_WORKFLOW_CLI} moda skills sync`,
+        `        run: ${GENERATED_WORKFLOW_NPX} skills sync`,
+        '',
+    ].join('\n')}`);
+    return relativePath;
+}
+// Generates the "living harness" rescan workflow: after every merge to main
+// the hosted analyst re-analyzes the repo, the refreshed report is approved
+// non-interactively, and the cited graph is synced to Moda — so the harness
+// Moda serves never drifts from the code. It runs only on push to `main`
+// (plus manual workflow_dispatch), never on pull_request, so unmerged agent
+// changes are never synced. An optional path scope limits pushes that trigger
+// a rescan. Keep its env in step with writeCiCdWorkflow().
+export function writeHarnessRescanWorkflow(cwd = process.cwd(), paths) {
+    const relativePath = '.github/workflows/moda-harness-rescan.yml';
+    const path = join(cwd, relativePath);
+    mkdirSync(dirname(path), { recursive: true });
+    const pathScope = paths !== undefined && paths.length > 0
+        ? [
+            '    # Only pushes touching these paths trigger a rescan.',
+            '    paths:',
+            ...paths.map((glob) => `      - '${glob.replace(/'/g, "''")}'`),
+        ]
+        : [
+            '    # Optional: scope rescans to agent-relevant paths, e.g.',
+            '    # paths:',
+            "    #   - 'src/agents/**'",
+        ];
+    writeFileSync(path, `${[
+        'name: Moda Harness Rescan',
+        '',
+        'on:',
+        '  push:',
+        '    branches: [main]',
+        ...pathScope,
+        '  workflow_dispatch:',
+        '',
+        '# Least privilege: this job reads the checked-out repo, uploads a safe',
+        '# source snapshot to Moda over the API key, and syncs the refreshed harness',
+        '# graph; it never writes back to the repository.',
+        'permissions:',
+        '  contents: read',
+        '',
+        '# One in-flight rescan at a time; newer pushes supersede older runs.',
+        'concurrency:',
+        '  group: moda-harness-rescan',
+        '  cancel-in-progress: true',
+        '',
+        'jobs:',
+        '  moda-harness-rescan:',
+        '    runs-on: ubuntu-latest',
+        '    env:',
+        '      MODA_API_KEY: ${{ secrets.MODA_API_KEY }}',
+        '      MODA_TENANT_ID: ${{ secrets.MODA_TENANT_ID }}',
+        '    steps:',
+        '      - uses: actions/checkout@v4',
+        '      - uses: actions/setup-node@v4',
+        '        with:',
+        '          node-version: 22',
+        '      - name: Re-analyze the harness on Moda',
+        `        run: ${GENERATED_WORKFLOW_NPX} harness analyze --remote --yes`,
+        '      - name: Approve the refreshed harness report',
+        `        run: ${GENERATED_WORKFLOW_NPX} harness approve --yes`,
+        '      - name: Sync the harness graph to Moda',
+        `        run: ${GENERATED_WORKFLOW_NPX} harness sync --from-report`,
         '',
     ].join('\n')}`);
     return relativePath;
@@ -802,6 +961,225 @@ function printHarnessDetectionSummary(cwd = process.cwd()) {
         console.log('  Detected harness summary is available in .moda/HARNESS.md');
     }
 }
+function signalsFromGraph(graph) {
+    const names = (items) => (items ?? [])
+        .map((item) => (typeof item.name === 'string' ? item.name : undefined))
+        .filter((name) => Boolean(name));
+    return {
+        runtimeAgents: Array.isArray(graph.runtimeAgents) ? graph.runtimeAgents.length : 0,
+        frameworks: names(graph.agentFrameworks),
+        providers: names(graph.modelProviders),
+    };
+}
+/**
+ * Read the gate signals from the SAME graph the auto-sync uploads: the cited
+ * report (`.moda/harness-report.json`, consumed by `harness sync --from-report`)
+ * is authoritative, so read its `graph` first. Only fall back to the standalone
+ * manifest (`.moda/harness.json`) when no report exists, otherwise a stale or
+ * missing manifest could let an empty report slip past the gate and overwrite
+ * the tenant's harness. Returns undefined when neither is readable.
+ */
+export function readHarnessQualitySignals(cwd = process.cwd()) {
+    const reportPath = join(cwd, '.moda', 'harness-report.json');
+    if (existsSync(reportPath)) {
+        try {
+            const report = JSON.parse(readFileSync(reportPath, 'utf8'));
+            if (report.graph && typeof report.graph === 'object') {
+                return signalsFromGraph(report.graph);
+            }
+        }
+        catch {
+            // Fall through to the manifest below.
+        }
+    }
+    const manifestPath = join(cwd, '.moda', 'harness.json');
+    if (!existsSync(manifestPath))
+        return undefined;
+    try {
+        return signalsFromGraph(JSON.parse(readFileSync(manifestPath, 'utf8')));
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * True when discovery found no runtime agents even though the repo carries
+ * LLM framework/provider signals — the signature of a failed discovery run,
+ * not an agent-free repo.
+ */
+export function harnessLooksIncomplete(signals) {
+    return signals.runtimeAgents === 0 &&
+        (signals.frameworks.length > 0 || signals.providers.length > 0);
+}
+// --- Repo-side LLM dependency scan (0-agent gate evidence) -----------------
+//
+// The gate must not read its "repo has LLM signals" evidence solely from the
+// artifact it is gating: a TOTAL discovery failure emits a graph with 0
+// agents AND 0 frameworks/providers, which would sail past a graph-only
+// check and overwrite the tenant's harness with an empty graph. This scan is
+// deterministic and independent of the analyst: it looks for well-known LLM
+// packages in dependency manifests (package.json, requirements.txt,
+// pyproject.toml) via a bounded walk.
+const REPO_SIGNAL_MAX_DEPTH = 3;
+const REPO_SIGNAL_MAX_DIRS = 500;
+const REPO_SIGNAL_SKIPPED_DIRS = new Set([
+    'node_modules', 'dist', 'build', 'out', 'coverage', 'vendor', 'target',
+    'venv', 'env', '__pycache__', 'site-packages',
+]);
+/** Exact npm package name → signal. */
+const JS_LLM_DEPENDENCIES = {
+    openai: { name: 'OpenAI', kind: 'provider' },
+    '@anthropic-ai/sdk': { name: 'Anthropic', kind: 'provider' },
+    '@google/generative-ai': { name: 'Google Gemini', kind: 'provider' },
+    '@google/genai': { name: 'Google Gemini', kind: 'provider' },
+    'cohere-ai': { name: 'Cohere', kind: 'provider' },
+    'groq-sdk': { name: 'Groq', kind: 'provider' },
+    '@mistralai/mistralai': { name: 'Mistral', kind: 'provider' },
+    ollama: { name: 'Ollama', kind: 'provider' },
+    'together-ai': { name: 'Together', kind: 'provider' },
+    '@aws-sdk/client-bedrock-runtime': { name: 'AWS Bedrock', kind: 'provider' },
+    ai: { name: 'Vercel AI SDK', kind: 'framework' },
+    langchain: { name: 'LangChain', kind: 'framework' },
+    llamaindex: { name: 'LlamaIndex', kind: 'framework' },
+    '@anthropic-ai/claude-agent-sdk': { name: 'Claude Agent SDK', kind: 'framework' },
+    '@openai/agents': { name: 'OpenAI Agents', kind: 'framework' },
+    '@mastra/core': { name: 'Mastra', kind: 'framework' },
+};
+/** npm scope/prefix → signal (monorepo-style split packages). */
+const JS_LLM_DEPENDENCY_PREFIXES = [
+    ['@langchain/', { name: 'LangChain', kind: 'framework' }],
+    ['@ai-sdk/', { name: 'Vercel AI SDK', kind: 'framework' }],
+    ['@llamaindex/', { name: 'LlamaIndex', kind: 'framework' }],
+];
+/** Normalized (lowercase, `_`→`-`) Python distribution name → signal. */
+const PY_LLM_DEPENDENCIES = {
+    openai: { name: 'OpenAI', kind: 'provider' },
+    anthropic: { name: 'Anthropic', kind: 'provider' },
+    'google-generativeai': { name: 'Google Gemini', kind: 'provider' },
+    'google-genai': { name: 'Google Gemini', kind: 'provider' },
+    cohere: { name: 'Cohere', kind: 'provider' },
+    groq: { name: 'Groq', kind: 'provider' },
+    mistralai: { name: 'Mistral', kind: 'provider' },
+    ollama: { name: 'Ollama', kind: 'provider' },
+    langgraph: { name: 'LangGraph', kind: 'framework' },
+    litellm: { name: 'LiteLLM', kind: 'framework' },
+    crewai: { name: 'CrewAI', kind: 'framework' },
+    autogen: { name: 'AutoGen', kind: 'framework' },
+    pyautogen: { name: 'AutoGen', kind: 'framework' },
+    ag2: { name: 'AutoGen', kind: 'framework' },
+    'pydantic-ai': { name: 'Pydantic AI', kind: 'framework' },
+    'openai-agents': { name: 'OpenAI Agents', kind: 'framework' },
+    'semantic-kernel': { name: 'Semantic Kernel', kind: 'framework' },
+    dspy: { name: 'DSPy', kind: 'framework' },
+    'haystack-ai': { name: 'Haystack', kind: 'framework' },
+};
+/** Python prefix matches (langchain, langchain-openai, llama-index-core, ...). */
+const PY_LLM_DEPENDENCY_PREFIXES = [
+    ['langchain', { name: 'LangChain', kind: 'framework' }],
+    ['llama-index', { name: 'LlamaIndex', kind: 'framework' }],
+];
+function jsDependencySignal(dep) {
+    const exact = JS_LLM_DEPENDENCIES[dep];
+    if (exact)
+        return exact;
+    for (const [prefix, signal] of JS_LLM_DEPENDENCY_PREFIXES) {
+        if (dep.startsWith(prefix))
+            return signal;
+    }
+    return undefined;
+}
+function pyDependencySignal(dep) {
+    const normalized = dep.toLowerCase().replace(/_/g, '-');
+    const exact = PY_LLM_DEPENDENCIES[normalized];
+    if (exact)
+        return exact;
+    for (const [prefix, signal] of PY_LLM_DEPENDENCY_PREFIXES) {
+        if (normalized === prefix || normalized.startsWith(`${prefix}-`))
+            return signal;
+    }
+    return undefined;
+}
+/** Requirement names from requirements.txt lines / pyproject.toml specifiers. */
+function pythonRequirementNames(text, file) {
+    const names = [];
+    if (file === 'requirements.txt') {
+        for (const line of text.split('\n')) {
+            const match = /^\s*([A-Za-z0-9][A-Za-z0-9._-]*)/.exec(line);
+            if (match)
+                names.push(match[1]);
+        }
+        return names;
+    }
+    // pyproject.toml: dependency specifiers are quoted strings whose leading
+    // token is the distribution name ("openai>=1.0", "langchain-openai", ...).
+    for (const match of text.matchAll(/["']([A-Za-z0-9][A-Za-z0-9._-]*)[^"']*["']/g)) {
+        names.push(match[1]);
+    }
+    return names;
+}
+/**
+ * Deterministic repo-side LLM signals: well-known LLM package names found in
+ * dependency manifests. Independent of the discovery output, so a fully
+ * failed discovery (empty graph) cannot bypass the 0-agent gate.
+ */
+export function detectRepoLlmSignals(cwd = process.cwd()) {
+    const frameworks = new Set();
+    const providers = new Set();
+    const record = (signal) => {
+        if (!signal)
+            return;
+        (signal.kind === 'framework' ? frameworks : providers).add(signal.name);
+    };
+    const scanDir = (dir) => {
+        try {
+            const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
+            for (const dep of [
+                ...Object.keys(pkg.dependencies ?? {}),
+                ...Object.keys(pkg.devDependencies ?? {}),
+                ...Object.keys(pkg.peerDependencies ?? {}),
+            ]) {
+                record(jsDependencySignal(dep));
+            }
+        }
+        catch {
+            // No/invalid package.json here.
+        }
+        for (const file of ['requirements.txt', 'pyproject.toml']) {
+            try {
+                const text = readFileSync(join(dir, file), 'utf8');
+                for (const name of pythonRequirementNames(text, file)) {
+                    record(pyDependencySignal(name));
+                }
+            }
+            catch {
+                // No such manifest here.
+            }
+        }
+    };
+    let visited = 0;
+    const walk = (dir, depth) => {
+        if (depth > REPO_SIGNAL_MAX_DEPTH || visited >= REPO_SIGNAL_MAX_DIRS)
+            return;
+        visited += 1;
+        scanDir(dir);
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (!entry.isDirectory() || entry.name.startsWith('.'))
+                continue;
+            if (REPO_SIGNAL_SKIPPED_DIRS.has(entry.name))
+                continue;
+            walk(join(dir, entry.name), depth + 1);
+        }
+    };
+    walk(cwd, 0);
+    return { frameworks: [...frameworks].sort(), providers: [...providers].sort() };
+}
 /** Agent/artifact counts for the completion screen's harness payoff line. */
 function readHarnessGraphCounts(cwd = process.cwd()) {
     const manifestPath = join(cwd, '.moda', 'harness.json');
@@ -826,7 +1204,7 @@ function commandFlags(flags) {
 function stringFlag(value) {
     return typeof value === 'string' && value.trim().length > 0 ? value : undefined;
 }
-function resumeFlagsForInit(flags) {
+export function resumeFlagsForInit(flags) {
     const passthrough = [
         'profile',
         'tenant-id',
@@ -835,9 +1213,12 @@ function resumeFlagsForInit(flags) {
         'sdk-integrate',
         'ci-cd',
         'autosync',
+        'harness-rescan',
+        'harness-rescan-paths',
         'no-sdk-integrate',
         'no-ci-cd',
         'no-autosync',
+        'no-harness-rescan',
         'yes',
         'agent',
         'json',
@@ -854,6 +1235,14 @@ function resumeFlagsForInit(flags) {
         else
             out.push(flag, String(value));
     }
+    // The rescan choice is derived as `flag ?? (paths ? true : ...)`, so a bare
+    // `--harness-rescan-paths` re-implies opt-in. If the original run explicitly
+    // disabled rescan (via `--harness-rescan=false`, whose false value the loop
+    // above drops), carry the negative through so a resume can't silently write
+    // the workflow the user declined.
+    if (resolveHarnessRescanFlag(flags) === false && !out.includes('--no-harness-rescan')) {
+        out.push('--no-harness-rescan');
+    }
     return out;
 }
 /**
@@ -877,6 +1266,29 @@ function resolveAutosyncFlag(flags) {
         return false;
     return undefined;
 }
+/** Explicit harness-rescan decision from flags, or undefined when the Plan beat decides. */
+function resolveHarnessRescanFlag(flags) {
+    const explicit = parseOptionalBoolean(flagValue(flags, 'harness-rescan', 'harness_rescan'));
+    if (explicit !== undefined)
+        return explicit;
+    if (isTruthyFlag(flagValue(flags, 'no-harness-rescan', 'no_harness_rescan')))
+        return false;
+    return undefined;
+}
+/**
+ * Comma-separated path globs for the rescan workflow's `on.push.paths` scope.
+ * `undefined` when the flag is absent (or carries no usable globs), so a bare
+ * `--harness-rescan` still writes an unscoped rescan-on-every-push workflow.
+ */
+function parseHarnessRescanPaths(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const globs = value
+        .split(',')
+        .map((glob) => glob.trim())
+        .filter((glob) => glob.length > 0 && glob !== 'true');
+    return globs.length > 0 ? globs : undefined;
+}
 /**
  * Explicit SDK-integration decision from flags, or undefined when the Plan
  * beat decides (interactive default: on when a coding-agent CLI is installed;

package/dist/init/tenant.js

@@ -5,7 +5,7 @@ import { hostname } from 'node:os';
 import { join } from 'node:path';
 import { select } from '@inquirer/prompts';
 import { authFetch, getCachedLoginContext } from '../auth.js';
-import { loadCliConfig, resolveIngestUrl, resolveModaBaseUrl, saveCliConfig, } from '../config.js';
+import { embeddedTenantIdFromApiKey, loadCliConfig, resolveIngestUrl, resolveModaBaseUrl, saveCliConfig, } from '../config.js';
 import { getModaDir, resolveApiKeyFromActiveProfile, resolveTenantIdFromActiveProfile, writeSecretJsonFile, } from '../profiles.js';
 import { CliAccessError, CliInputError, CliInputRequiredError } from '../errors.js';
 /**
@@ -42,8 +42,6 @@ export function formatControlPlaneFetchError(action, status, body) {
 // Mirrors the backend's checkAdminAccess: only the viewer role is denied.
 const ADMIN_ACCESS_MESSAGE = 'You need admin or owner access to create API keys.';
 const ADMIN_ACCESS_GUIDANCE = 'Ask your organization owner to upgrade your role.';
-const API_KEY_PREFIX = 'moda_sk_';
-const SIGNED_KEY_VERSION = 'v1';
 // Bound the pre-bootstrap liveness probe tightly: a slow or unreachable
 // endpoint must never block init — we just mint a fresh key instead.
 const VALIDATE_TIMEOUT_MS = 3_000;
@@ -160,29 +158,13 @@ function bootstrapLabel(custom) {
     }
 }
 /**
- * Signed CLI keys embed their tenant: the format is
- * moda_sk_<base64url("v1:keyId:tenantId:timestamp:signature")> — see
- * createApiKey/parseAndVerifySignedKey in
- * apps/moda-backend/src/api-keys/api-keys.service.ts. Decoding locally lets
- * dedup reject a cross-tenant or malformed key structurally, with no network
- * call. The HMAC signature can only be verified server-side; liveness (not
- * revoked) is probed separately by isStoredKeyLive().
+ * Signed CLI keys embed their tenant (moda_sk_<base64url("v1:keyId:tenantId:
+ * timestamp:signature")>). Decoding locally lets dedup reject a cross-tenant
+ * or malformed key structurally, with no network call. Shared with the
+ * pre-upload identity banner via `embeddedTenantIdFromApiKey` in config.ts;
+ * liveness (not revoked) is probed separately by isStoredKeyLive().
  */
-function embeddedTenantId(key) {
-    if (!key.startsWith(API_KEY_PREFIX))
-        return undefined;
-    try {
-        const decoded = Buffer.from(key.slice(API_KEY_PREFIX.length), 'base64url').toString('utf8');
-        // Expected format: version:keyId:tenantId:timestamp:signature
-        const parts = decoded.split(':');
-        if (parts.length !== 5 || parts[0] !== SIGNED_KEY_VERSION)
-            return undefined;
-        return parts[2] || undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
+const embeddedTenantId = embeddedTenantIdFromApiKey;
 /**
  * Liveness probe for a stored key. Deliberately NOT the backend's public
  * POST /api/api-keys/validate: the CLI's resolved base URL is the FRONTEND

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.18.1",
+  "version": "1.19.0",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-07-10T23:46:28.191Z",
-  "cli_version": "1.18.1",
+  "bundled_at": "2026-07-11T00:30:28.897Z",
+  "cli_version": "1.19.0",
   "skills": [
     {
       "id": "integration-node-anthropic",