@moda-ai/cli 1.18.1 → 1.19.1

package/dist/harness.d.ts

@@ -173,6 +173,12 @@ export interface HarnessGraph {
     relationships: HarnessRelationship[];
     unknowns: HarnessUnknown[];
 }
+export interface FileInventoryItem {
+    path: string;
+    absPath: string;
+    rootDir: string;
+    text?: string;
+}
 interface ScanOptions {
     rootDir?: string;
     dryRun?: boolean;
@@ -390,10 +396,67 @@ declare function buildCommandScanPlan(context: CommandContext, rootDir: string):
 };
 export declare function writeHumanProgress(context: CommandContext, message: string): void;
 export declare function readHarnessSyncState(rootDir: string): HarnessSyncState | undefined;
+/**
+ * The identity a sync-style upload will actually authenticate as, resolved
+ * with the same precedence as the API call itself (MODA_API_KEY env wins over
+ * the active profile / legacy config). Used for the pre-upload
+ * "Syncing as <credential> → tenant <id>" banner so a shadowed or stale key
+ * is visible BEFORE data lands in the wrong tenant.
+ *
+ * The destination tenant is derived from the WINNING KEY itself (signed CLI
+ * keys embed their tenant, and the server resolves the destination from the
+ * key alone) — never from flag/env/profile config, which is exactly what a
+ * shadowing stale key disagrees with. When the key does not embed a tenant,
+ * the config-resolved id is returned with `tenantSource: 'config'` so
+ * callers must label it unverified. Best-effort: never throws (a broken
+ * MODA_PROFILE must not abort onboarding).
+ */
+export declare function describeSyncIdentity(options?: {
+    profile?: string;
+    env?: NodeJS.ProcessEnv;
+}): {
+    credential: string;
+    tenantId?: string;
+    /** 'api-key' = decoded from the winning key (authoritative); 'config' = flag/env/profile fallback (unverified). */
+    tenantSource?: 'api-key' | 'config';
+} | undefined;
+/**
+ * Human tenant label for the identity banner: key-derived ids are printed
+ * bare; config-derived ids are explicitly marked unverified so the banner
+ * never asserts a destination the server might not use.
+ */
+export declare function describeSyncTenantLabel(identity: {
+    tenantId?: string;
+    tenantSource?: 'api-key' | 'config';
+}): string;
+/**
+ * Reports in subdirectories that are FRESHER than the root's
+ * `.moda/harness-report.json` (a missing root report counts as infinitely
+ * old). Catches the `--path` trap: `harness analyze --path=<subdir>` writes
+ * `<subdir>/.moda/harness-report.json`, and a later root-level
+ * `harness approve`/`sync` silently targets the stale (or absent) root report.
+ * Newest first.
+ */
+export declare function findFresherHarnessReports(rootDir: string): Array<{
+    path: string;
+    mtimeMs: number;
+}>;
 export declare function writeHarnessArtifacts(graph: HarnessGraph, rootDir: string, options?: {
     summary?: boolean;
 }): string[];
 export declare function graphForSync(graph: HarnessGraph): HarnessGraph;
+/**
+ * Bounded repo walk shared by `harness scan`, snapshot upload, and the static
+ * candidates pre-pass: skips ignored/secret-bearing paths and symlinks,
+ * enforces the file-count and text-byte budgets, and reads text for known
+ * text extensions plus any file admitted by `options.includeFile`.
+ * `options.includeFile` widens (ORs with) the default inventory predicate and
+ * also opts its files into text reading — it can never re-admit secret-bearing
+ * or oversized files, which are rejected before the predicate runs.
+ */
+export declare function inventoryFiles(rootDir: string, skipped: HarnessScanMetadata['skipped'], options?: {
+    includeFile?: (relPath: string) => boolean;
+}): FileInventoryItem[];
 export declare function numericEnv(name: string, fallback: number): number;
 export declare function numericEnvAllowZero(name: string, fallback: number): number;
 export {};

package/dist/harness.js

@@ -6,12 +6,13 @@ import { basename, delimiter, dirname, extname, join, relative, resolve, sep } f
 import { confirm, select } from '@inquirer/prompts';
 import { callControlAPI } from './api-client.js';
 import { AnalystTui, shouldUseAnalystTui } from './analyst-tui.js';
-import { resolveApiKey, resolveTenantId } from './config.js';
+import { embeddedTenantIdFromApiKey, resolveApiKey, resolveTenantId } from './config.js';
 import { CliInputError, CliInputRequiredError } from './errors.js';
 import { HARNESS_REMOTE_RUN_STATE_PATH, isRemoteHarnessAnalyze, readRemoteRunState, runHarnessPull, runRemoteHarnessAnalyst, } from './harness-remote.js';
 import { getActiveProfile } from './profiles.js';
 import { enrichScanCaptureMetadata, annotatedSourceCandidates, extractToolBody, hydratePromptAndToolBodies, readPromptOrToolBody, resolveAnnotatedSourcePath, } from './harness-artifact-bodies.js';
 import { approveHarnessReport, createHarnessReport, graphForReport, hashHarnessReport, hashStableJson as hashHarnessReportStableJson, HARNESS_REPORT_PATH, loadHarnessReportForSync, normalizeHarnessReport, readHarnessReport, resolveHarnessReportPath, validateHarnessReport, writeHarnessReportArtifacts, } from './harness-report.js';
+import { detectHarnessCandidates, writeHarnessCandidatesReport } from './harness-candidates.js';
 import { assertHarnessGraphSyncSize } from './harness-sync-limits.js';
 import { renderHarnessAnalystChoice, renderHarnessAnalystLaunch, renderHarnessAnalystPreflight, renderHarnessAnalyzeHumanResult, renderHarnessProgress, } from './tui.js';
 const MODA_DIR = '.moda';
@@ -101,6 +102,24 @@ export async function runHarnessCommand(context) {
             if (!resolveApiKey({ profile: context.profile, env: context.env }) && !context.dryRun) {
                 throw new CliInputError('No Moda API key found for harness sync.', 'Run `moda init` first, set MODA_API_KEY, or select a profile with an API key.');
             }
+            warnFresherSubdirHarnessReports(context, rootDir, context.flags['from-report'] ?? context.flags.report);
+            if (!context.dryRun) {
+                const identity = describeSyncIdentity({ profile: context.profile, env: context.env });
+                if (identity) {
+                    // The banner's tenant comes from the winning key when it embeds
+                    // one. Otherwise fall back to the flag/env/profile-resolved tenant
+                    // but label it unverified — that source is precisely what a
+                    // shadowing stale key disagrees with, so it must never be asserted
+                    // as the destination.
+                    const label = identity.tenantSource === 'api-key'
+                        ? describeSyncTenantLabel(identity)
+                        : describeSyncTenantLabel({
+                            tenantId: tenant?.tenantId ?? identity.tenantId,
+                            tenantSource: 'config',
+                        });
+                    writeHumanProgress(context, `Syncing as ${identity.credential} → tenant ${label}`);
+                }
+            }
             if (context.flags['from-report'] || context.flags.report) {
                 const reportPath = resolveHarnessReportPath(rootDir, context.flags['from-report'] ?? context.flags.report);
                 const { report, validation, approval, approved } = loadHarnessReportForSync(rootDir, reportPath);
@@ -344,6 +363,7 @@ export async function runHarnessCommand(context) {
             return { exitCode: validation.status === 'pass' ? 0 : 1 };
         }
         case 'approve': {
+            warnFresherSubdirHarnessReports(context, rootDir, context.positionals[1] ?? context.flags.report);
             const reportPath = resolveHarnessReportPath(rootDir, context.positionals[1] ?? context.flags.report);
             const approval = await approveHarnessReport({
                 rootDir,
@@ -362,8 +382,31 @@ export async function runHarnessCommand(context) {
             });
             return { exitCode: 0 };
         }
+        case 'candidates': {
+            await approveScanIfNeeded(scanPlan, {
+                context,
+                message: 'Scan this project for static harness candidates?',
+            });
+            writeHumanProgress(context, 'Harness candidates: static pre-pass (no LLM, no network)...');
+            const report = detectHarnessCandidates(rootDir);
+            const written = [];
+            const outFlag = context.flags.out;
+            // A value-less `--out` is parsed as the sentinel string 'true'; reject it
+            // rather than silently writing the report to `<cwd>/true`.
+            if (outFlag === 'true') {
+                throw new CliInputError('Missing output path for --out.', 'Usage: moda harness candidates --out=<file>');
+            }
+            if (outFlag && !context.dryRun) {
+                written.push(writeHarnessCandidatesReport(report, resolve(context.cwd, outFlag)));
+            }
+            writeHumanProgress(context, `Harness candidates: ${report.stats.candidateCount} candidates across ` +
+                `${report.stats.filesWithCandidates} files (${report.stats.filesScanned} scanned, ` +
+                `${report.stats.filesPerSecond.toLocaleString()} files/sec).`);
+            context.output.writeData({ scanPlan, ...report, written, dryRun: context.dryRun });
+            return { exitCode: 0 };
+        }
         case 'agents': {
-            const graph = loadOrScanHarness(rootDir, tenant);
+            const graph = loadOrScanHarness(rootDir, tenant, context);
             context.output.writeData({
                 summary: summarizeHarness(graph),
                 agentFamilies: graph.agentFamilies,
@@ -373,12 +416,12 @@ export async function runHarnessCommand(context) {
             return { exitCode: 0 };
         }
         case 'graph': {
-            const graph = loadOrScanHarness(rootDir, tenant);
+            const graph = loadOrScanHarness(rootDir, tenant, context);
             context.output.writeData(graph);
             return { exitCode: 0 };
         }
         case 'explain': {
-            const graph = loadOrScanHarness(rootDir, tenant);
+            const graph = loadOrScanHarness(rootDir, tenant, context);
             if (selectedAgentId) {
                 const agent = graph.runtimeAgents.find((candidate) => candidate.id === selectedAgentId);
                 if (!agent) {
@@ -451,7 +494,7 @@ export async function runHarnessCommand(context) {
             return { exitCode: 0 };
         }
         default:
-            throw new CliInputError(`Unknown harness command '${subcommand}'.`, 'Usage: moda harness analyze|pull|validate-report|approve|scan|sync|agents|graph|explain|write-summary|status');
+            throw new CliInputError(`Unknown harness command '${subcommand}'.`, 'Usage: moda harness analyze|pull|validate-report|approve|scan|candidates|sync|agents|graph|explain|write-summary|status');
     }
 }
 export function writeHarnessAnalyzeResult(context, payload) {
@@ -2040,15 +2083,187 @@ function selectedRuntimeAgentId(flags) {
         return flags.agent;
     return undefined;
 }
-function loadOrScanHarness(rootDir, tenant) {
+function loadOrScanHarness(rootDir, tenant, context) {
     const manifestPath = join(rootDir, HARNESS_PATH);
-    return existsSync(manifestPath)
-        ? readHarnessGraph(manifestPath)
-        : scanHarness({
-            rootDir,
-            tenantId: tenant?.tenantId,
-            tenantSource: tenant?.source,
-        });
+    if (existsSync(manifestPath))
+        return readHarnessGraph(manifestPath);
+    // Provenance banner: without a persisted manifest this command output comes
+    // from a live scan of the current directory, which is easy to mistake for
+    // synced/account data (especially right after switching repos or profiles).
+    if (context) {
+        writeHarnessNotice(context, `No ${HARNESS_PATH} found; showing a live scan of ${rootDir}. ` +
+            'This is local scan output, NOT synced or account data. ' +
+            'Run `moda harness scan` to persist it and `moda harness sync` to upload it.');
+    }
+    return scanHarness({
+        rootDir,
+        tenantId: tenant?.tenantId,
+        tenantSource: tenant?.source,
+    });
+}
+/**
+ * Warning line that must be visible in every output mode: styled progress on
+ * stderr for humans, a plain `Warning:` stderr line for machine modes (stdout
+ * stays machine-readable JSON either way). Quiet suppresses it like the rest
+ * of the harness progress surface.
+ */
+function writeHarnessNotice(context, message) {
+    if (context.quiet && context.flags.progress !== 'true')
+        return;
+    if (context.outputMode === 'human') {
+        console.error(renderHarnessProgress(message, 'warning'));
+        return;
+    }
+    console.error(`Warning: ${message}`);
+}
+/**
+ * The identity a sync-style upload will actually authenticate as, resolved
+ * with the same precedence as the API call itself (MODA_API_KEY env wins over
+ * the active profile / legacy config). Used for the pre-upload
+ * "Syncing as <credential> → tenant <id>" banner so a shadowed or stale key
+ * is visible BEFORE data lands in the wrong tenant.
+ *
+ * The destination tenant is derived from the WINNING KEY itself (signed CLI
+ * keys embed their tenant, and the server resolves the destination from the
+ * key alone) — never from flag/env/profile config, which is exactly what a
+ * shadowing stale key disagrees with. When the key does not embed a tenant,
+ * the config-resolved id is returned with `tenantSource: 'config'` so
+ * callers must label it unverified. Best-effort: never throws (a broken
+ * MODA_PROFILE must not abort onboarding).
+ */
+export function describeSyncIdentity(options = {}) {
+    const apiKey = resolveApiKey(options);
+    if (!apiKey)
+        return undefined;
+    const redacted = apiKey.length > 12
+        ? `${apiKey.slice(0, 8)}…${apiKey.slice(-4)}`
+        : `…${apiKey.slice(-4)}`;
+    const env = options.env ?? process.env;
+    // getActiveProfile throws when the named profile is missing (e.g. a stale
+    // MODA_PROFILE) even though the key already resolved via legacy config —
+    // the banner is advisory and must never abort the command around it.
+    let profileName;
+    try {
+        profileName = getActiveProfile(options).name;
+    }
+    catch {
+        profileName = undefined;
+    }
+    const credential = env.MODA_API_KEY === apiKey
+        ? `MODA_API_KEY env key (${redacted})`
+        : profileName
+            ? `profile '${profileName}' key (${redacted})`
+            : `stored key (${redacted})`;
+    const keyTenantId = embeddedTenantIdFromApiKey(apiKey);
+    if (keyTenantId) {
+        return { credential, tenantId: keyTenantId, tenantSource: 'api-key' };
+    }
+    const configTenantId = resolveTenantId(options);
+    return {
+        credential,
+        tenantId: configTenantId,
+        tenantSource: configTenantId ? 'config' : undefined,
+    };
+}
+/**
+ * Human tenant label for the identity banner: key-derived ids are printed
+ * bare; config-derived ids are explicitly marked unverified so the banner
+ * never asserts a destination the server might not use.
+ */
+export function describeSyncTenantLabel(identity) {
+    if (!identity.tenantId)
+        return 'unresolved';
+    if (identity.tenantSource === 'api-key')
+        return identity.tenantId;
+    return `${identity.tenantId} (unverified — from local config, not the API key; the server derives the destination tenant from the key)`;
+}
+/** Bounded walk looking for `<subdir>/.moda/harness-report.json` files. */
+const FRESHER_REPORT_MAX_DEPTH = 4;
+const FRESHER_REPORT_MAX_DIRS = 4_000;
+/**
+ * Reports in subdirectories that are FRESHER than the root's
+ * `.moda/harness-report.json` (a missing root report counts as infinitely
+ * old). Catches the `--path` trap: `harness analyze --path=<subdir>` writes
+ * `<subdir>/.moda/harness-report.json`, and a later root-level
+ * `harness approve`/`sync` silently targets the stale (or absent) root report.
+ * Newest first.
+ */
+export function findFresherHarnessReports(rootDir) {
+    let rootMtimeMs = 0;
+    try {
+        rootMtimeMs = lstatSync(join(rootDir, HARNESS_REPORT_PATH)).mtimeMs;
+    }
+    catch {
+        rootMtimeMs = 0;
+    }
+    const fresher = [];
+    let visited = 0;
+    const walk = (dir, depth) => {
+        if (depth > FRESHER_REPORT_MAX_DEPTH || visited >= FRESHER_REPORT_MAX_DIRS)
+            return;
+        visited += 1;
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            // Dot-dirs (including each dir's own `.moda`, checked explicitly below)
+            // and scan-skipped dirs never host a user project subtree.
+            if (!entry.isDirectory() || entry.name.startsWith('.') || SKIPPED_DIRS.has(entry.name))
+                continue;
+            const child = join(dir, entry.name);
+            try {
+                const candidate = lstatSync(join(child, HARNESS_REPORT_PATH));
+                if (candidate.isFile() && candidate.mtimeMs > rootMtimeMs) {
+                    fresher.push({
+                        path: normalizePath(relative(rootDir, join(child, HARNESS_REPORT_PATH))),
+                        mtimeMs: candidate.mtimeMs,
+                    });
+                }
+            }
+            catch {
+                // No report in this subdir; keep walking.
+            }
+            walk(child, depth + 1);
+        }
+    };
+    walk(rootDir, 1);
+    return fresher.sort((a, b) => b.mtimeMs - a.mtimeMs);
+}
+/**
+ * `--path` trap guard for `harness approve` / `harness sync`: when the
+ * report the command is about to use is older than a fresher
+ * `<subdir>/.moda/harness-report.json`, point at the fresher one. Skipped
+ * when the user explicitly named a report file (they already chose).
+ */
+function warnFresherSubdirHarnessReports(context, rootDir, explicitReport) {
+    // Only treat an explicit report as an opt-out when it points somewhere other
+    // than the default root report. `--from-report=.moda/harness-report.json`
+    // still targets the default report, so the fresher-subdir warning must fire.
+    const explicitReportPath = explicitReport && explicitReport !== 'true'
+        ? normalizePath(relative(rootDir, resolve(rootDir, explicitReport)))
+        : undefined;
+    if (explicitReportPath && explicitReportPath !== normalizePath(HARNESS_REPORT_PATH))
+        return;
+    let fresher;
+    try {
+        fresher = findFresherHarnessReports(rootDir);
+    }
+    catch {
+        return;
+    }
+    if (fresher.length === 0)
+        return;
+    const newest = fresher[0];
+    const subdir = normalizePath(dirname(dirname(newest.path)));
+    const rootState = existsSync(join(rootDir, HARNESS_REPORT_PATH))
+        ? `older ${HARNESS_REPORT_PATH}`
+        : `no ${HARNESS_REPORT_PATH}`;
+    writeHarnessNotice(context, `A fresher harness report exists at ${newest.path} (this directory has ${rootState}). ` +
+        `If you meant that report, re-run with --path=${subdir}.`);
 }
 function readHarnessGraph(manifestPath) {
     return JSON.parse(readFileSync(manifestPath, 'utf8'));
@@ -2215,7 +2430,16 @@ function explainAgent(graph, agent) {
         relationships: graph.relationships.filter((relationship) => relationship.from === agent.id || relationship.to === agent.id),
     };
 }
-function inventoryFiles(rootDir, skipped) {
+/**
+ * Bounded repo walk shared by `harness scan`, snapshot upload, and the static
+ * candidates pre-pass: skips ignored/secret-bearing paths and symlinks,
+ * enforces the file-count and text-byte budgets, and reads text for known
+ * text extensions plus any file admitted by `options.includeFile`.
+ * `options.includeFile` widens (ORs with) the default inventory predicate and
+ * also opts its files into text reading — it can never re-admit secret-bearing
+ * or oversized files, which are rejected before the predicate runs.
+ */
+export function inventoryFiles(rootDir, skipped, options = {}) {
     const files = [];
     const rootReal = resolve(rootDir);
     const maxFiles = numericEnv('MODA_HARNESS_MAX_FILES', DEFAULT_MAX_INVENTORY_FILES);
@@ -2255,7 +2479,7 @@ function inventoryFiles(rootDir, skipped) {
             recordSkipped(skipped, { path: rel, reason: 'secret-bearing file skipped' });
             return;
         }
-        if (!shouldInventoryFile(rel))
+        if (!shouldInventoryFile(rel) && !(options.includeFile?.(rel) ?? false))
             return;
         if (files.length >= maxFiles) {
             throwHarnessScanTooBroad(rootReal, {
@@ -2267,7 +2491,12 @@ function inventoryFiles(rootDir, skipped) {
             });
         }
         const item = { path: rel, absPath: current, rootDir: rootReal };
-        if (isTextFile(rel)) {
+        // Read text for known text extensions, but also for any file the caller
+        // widened in via `includeFile` (e.g. the candidates pass admits template
+        // prompt files like `.jinja`/`.hbs`/`.tpl`/`.prompt` whose extensions are
+        // not in `isTextFile`) — otherwise a widened-in file is counted as scanned
+        // but never gets its text read, so downstream detectors silently skip it.
+        if (isTextFile(rel) || (options.includeFile?.(rel) ?? false)) {
             if (textBytes + stat.size > maxTextBytes) {
                 recordSkipped(skipped, { path: rel, reason: 'scan text budget exceeded' });
             }

package/dist/init/index.d.ts

@@ -11,7 +11,7 @@ export interface InitPhaseResult {
     details?: string;
 }
 export interface InitSetupAction {
-    category: 'sdk' | 'harness' | 'hooks' | 'prompts' | 'skills' | 'ci-cd' | 'autosync' | 'validation';
+    category: 'sdk' | 'harness' | 'hooks' | 'prompts' | 'skills' | 'ci-cd' | 'autosync' | 'harness-rescan' | 'validation';
     title: string;
     status: 'planned' | 'applied' | 'skipped' | 'manual';
     approved: boolean;
@@ -28,6 +28,44 @@ export interface InitRunOptions {
     onEvent?: (event: InitProgressEvent) => void;
 }
 export declare function runInit(flags: Record<string, unknown>, options?: InitRunOptions): Promise<InitResult>;
+export declare function writeCiCdWorkflow(cwd?: string): string;
+export declare function writeAutosyncWorkflow(cwd?: string): string;
+export declare function writeHarnessRescanWorkflow(cwd?: string, paths?: string[]): string;
+/**
+ * Signals from the discovered graph used by the init 0-agent quality gate:
+ * runtime agent count plus the LLM framework/provider names detected in the
+ * repo.
+ */
+export interface HarnessQualitySignals {
+    runtimeAgents: number;
+    frameworks: string[];
+    providers: string[];
+}
+/**
+ * Read the gate signals from the SAME graph the auto-sync uploads: the cited
+ * report (`.moda/harness-report.json`, consumed by `harness sync --from-report`)
+ * is authoritative, so read its `graph` first. Only fall back to the standalone
+ * manifest (`.moda/harness.json`) when no report exists, otherwise a stale or
+ * missing manifest could let an empty report slip past the gate and overwrite
+ * the tenant's harness. Returns undefined when neither is readable.
+ */
+export declare function readHarnessQualitySignals(cwd?: string): HarnessQualitySignals | undefined;
+/**
+ * True when discovery found no runtime agents even though the repo carries
+ * LLM framework/provider signals — the signature of a failed discovery run,
+ * not an agent-free repo.
+ */
+export declare function harnessLooksIncomplete(signals: HarnessQualitySignals): boolean;
+/**
+ * Deterministic repo-side LLM signals: well-known LLM package names found in
+ * dependency manifests. Independent of the discovery output, so a fully
+ * failed discovery (empty graph) cannot bypass the 0-agent gate.
+ */
+export declare function detectRepoLlmSignals(cwd?: string): {
+    frameworks: string[];
+    providers: string[];
+};
+export declare function resumeFlagsForInit(flags: Record<string, unknown>): string[];
 /**
  * Onboarding runs harness discovery SERVER-SIDE by default so the customer
  * needs no local coding agent. Opt out with `--local`, `--no-remote`,