@moda-ai/cli 1.20.0 → 1.21.0

package/dist/init/index.d.ts

@@ -1,8 +1,10 @@
+import { type SdkIntegrationOutcome } from './sdk-integration.js';
 export interface InitResult {
     apiKey: string;
     tenantName: string;
     phases: InitPhaseResult[];
     setupPlan: InitSetupAction[];
+    sdk_integration?: SdkIntegrationOutcome;
 }
 export interface InitPhaseResult {
     id: 'welcome' | 'auth' | 'workspace' | 'harness' | 'plan' | 'apply' | 'validate';

package/dist/init/index.js

@@ -16,9 +16,10 @@ import { initPrompts, runPromptSync } from '../prompts.js';
 import { runSkillSync } from '../skills.js';
 import { SDK_GUIDE_PATH, writeSdkIntegrationGuide } from './sdk-guide.js';
 import { runSdkIntegration } from './sdk-integration.js';
+import { fetchAuditWithApiKey } from './sdk-verification.js';
 import { InitProgressBoard } from './progress-board.js';
 import { createCommandContext } from '../command-context.js';
-import { resolveModaBaseUrl, VERSION } from '../config.js';
+import { resolveModaBaseUrl, resolveIngestUrl, VERSION } from '../config.js';
 import { CliAuthError, CliInputError } from '../errors.js';
 import { describeSyncIdentity, describeSyncTenantLabel, detectAvailableCodingAgents, isDeterministicLocalAnalyst, runHarnessCommand, } from '../harness.js';
 import { pollRemoteAnalyzeUntilDone, startRemoteAnalyze, } from '../harness-remote.js';
@@ -516,38 +517,35 @@ export async function runInit(flags, options = {}) {
         markApplied(setupPlan, 'harness-rescan');
     }
     const sdkAction = setupPlan.find((action) => action.category === 'sdk');
+    let sdkIntegration;
     if (sdkAction?.approved === true) {
         laneBoard?.startLane('sdk', 'SDK integration', {
             detail: 'launching your coding agent',
             expectation: 'usually 3-10 min',
         });
         emit('apply', 'Running your coding agent to integrate the Moda SDK.');
-        const result = await runSdkIntegration({
+        const verificationBaseUrl = resolveModaBaseUrl({ profile });
+        sdkIntegration = await runSdkIntegration({
+            apiKey,
+            ingestUrl: resolveIngestUrl({ profile }),
+            fetchAudit: (id) => fetchAuditWithApiKey(id, apiKey, verificationBaseUrl),
             onProgress: (message) => {
                 laneBoard?.update('sdk', message);
                 emitLaneProgress('apply', 'sdk', message);
             },
+            onPhase: (phase, message) => {
+                laneBoard?.update('sdk', message);
+                emitLaneProgress('apply', 'sdk', message);
+            },
             // Presence of onEvent selects the streaming agent invocation so tool
             // cards arrive incrementally; onProgress above receives the rendered
             // cards (describeCodingAgentEvent), which is all the lane needs.
             onEvent: () => { },
         });
-        if (result.status === 'integrated') {
-            laneBoard?.complete('sdk', `integrated with ${result.adapter}; review the diff before committing`);
-            markApplied(setupPlan, 'sdk');
-        }
-        else if (result.status === 'no-agent') {
-            const guidePath = writeSdkIntegrationGuide();
-            sdkAction.files = [guidePath];
-            laneBoard?.warn('sdk', `no coding agent CLI found; wrote ${guidePath} to integrate by hand`);
-            markApplied(setupPlan, 'sdk');
-        }
-        else {
-            const guidePath = writeSdkIntegrationGuide();
-            sdkAction.files = [guidePath];
-            laneBoard?.warn('sdk', `${result.adapter} did not complete; wrote ${guidePath} to finish manually`);
-            markApplied(setupPlan, 'sdk');
-        }
+        applySdkIntegrationOutcome(setupPlan, sdkIntegration, {
+            laneBoard,
+            writeGuide: () => writeSdkIntegrationGuide(rootDir),
+        });
     }
     else {
         markApplied(setupPlan, 'sdk', 'User skipped SDK integration.');
@@ -627,7 +625,7 @@ export async function runInit(flags, options = {}) {
     const offlineValidation = isTruthyFlag(flagValue(flags, 'offline'));
     log(renderInitStep(5, 5, 'Verify', offlineValidation
         ? 'Running local doctor checks so the setup leaves a clear state.'
-        : 'Running Moda doctor online to confirm setup and that telemetry is reaching Moda.'));
+        : 'Running Moda doctor online as a tenant health check (not proof of SDK integration).'));
     emit('validate', `Running Moda doctor diagnostics (${offlineValidation ? 'offline' : 'online'}).`);
     const doctorReport = await buildDoctorReport(createCommandContext({
         command: 'doctor',
@@ -665,7 +663,7 @@ export async function runInit(flags, options = {}) {
         skipped: setupPlan.filter((item) => item.status === 'skipped' || item.status === 'manual'),
         telemetrySeen,
     }));
-    return { apiKey, tenantName, phases, setupPlan };
+    return { apiKey, tenantName, phases, setupPlan, ...(sdkIntegration ? { sdk_integration: sdkIntegration } : {}) };
 }
 function buildSetupPlan(options) {
     return [
@@ -716,15 +714,13 @@ function buildSetupPlan(options) {
         },
         {
             category: 'sdk',
-            title: 'Run a coding agent to integrate the Moda SDK',
+            title: 'Launch your coding agent to integrate the Moda SDK',
             status: options.integrateSdk ? 'planned' : 'manual',
             approved: options.integrateSdk,
-            // Files are repo-specific and unknown ahead of the agent run; the fallback
-            // path rewrites this to the guide path when no agent CLI is available.
             files: [],
-            command: 'moda init',
+            command: 'moda init --sdk-integrate',
             reason: options.integrateSdk
-                ? 'Installs the SDK package and edits source via your coding agent; review the diff before committing.'
+                ? 'Your agent investigates the repo, applies matching integration skill(s), installs packages, runs repo checks, sends one verification request, and Moda verifies the exact trace. Your Moda API key is provided to the agent\'s environment for the verification run.'
                 : `SDK integration stays manual; see ${SDK_GUIDE_PATH} if you generate the guide.`,
         },
         {
@@ -758,7 +754,7 @@ function buildSetupPlan(options) {
         },
         {
             category: 'validation',
-            title: 'Run Moda doctor online to confirm telemetry is reaching Moda',
+            title: 'Run Moda doctor online as a tenant health check',
             status: 'planned',
             approved: true,
             files: [],
@@ -778,6 +774,85 @@ function markApplied(setupPlan, category, skipReason) {
     if (action.approved)
         action.status = 'applied';
 }
+function markManual(setupPlan, category, reason) {
+    const action = setupPlan.find((item) => item.category === category);
+    if (!action)
+        return;
+    action.status = 'manual';
+    action.reason = reason;
+}
+function applySdkIntegrationOutcome(setupPlan, outcome, deps) {
+    const sdkAction = setupPlan.find((action) => action.category === 'sdk');
+    if (!sdkAction)
+        return;
+    const { laneBoard, writeGuide } = deps;
+    const verificationId = outcome.verification_id ?? 'unknown';
+    const firstRemaining = outcome.agent_result?.remaining_actions?.[0];
+    switch (outcome.status) {
+        case 'integrated_verified': {
+            const llmSpans = outcome.verification?.llm_spans ?? 0;
+            laneBoard?.complete('sdk', `verified — trace reached Moda (${llmSpans} llm span(s), conversation ${verificationId})`);
+            markApplied(setupPlan, 'sdk');
+            if (outcome.agent_result?.files_changed?.length) {
+                sdkAction.files = [...new Set(outcome.agent_result.files_changed)].slice(0, 20);
+            }
+            break;
+        }
+        case 'telemetry_not_observed':
+            laneBoard?.warn('sdk', `integration applied but the verification trace was not observed; check MODA_API_KEY at runtime, then moda audit ${verificationId}`);
+            markManual(setupPlan, 'sdk', outcome.detail ?? 'Verification trace was not observed.');
+            break;
+        case 'needs_human_input': {
+            const securityLead = outcome.security_findings?.length
+                ? `Security: possible API key leak in ${outcome.security_findings.join(', ')} — remove the key, rotate it, and keep secrets in the environment. `
+                : '';
+            const note = firstRemaining ?? outcome.detail ?? 'Additional human input required.';
+            laneBoard?.warn('sdk', `${securityLead}${note}`);
+            markManual(setupPlan, 'sdk', `${securityLead}${note}`.trim());
+            break;
+        }
+        case 'nothing_to_integrate': {
+            if (outcome.verification?.observed === true) {
+                laneBoard?.complete('sdk', outcome.detail ?? 'existing integration verified — trace reached Moda');
+                markApplied(setupPlan, 'sdk');
+                sdkAction.reason = outcome.detail ?? 'Existing Moda integration verified.';
+                break;
+            }
+            // With a smoke attempt the verification id is real and auditable (the
+            // trace may land late); without one the user must pick their own id.
+            const reason = outcome.verification
+                ? 'agent reports Moda is already integrated but the verification trace was not observed; ' +
+                    `check MODA_API_KEY at runtime, then \`moda audit ${verificationId}\``
+                : 'agent reports Moda is already integrated — not independently verified; ' +
+                    'send a real request through your app with a conversation id you choose, then run `moda audit` with that id';
+            laneBoard?.warn('sdk', reason);
+            markManual(setupPlan, 'sdk', reason);
+            break;
+        }
+        case 'agent_unavailable': {
+            const guidePath = writeGuide();
+            sdkAction.files = [guidePath];
+            laneBoard?.warn('sdk', `no coding agent CLI found; wrote ${guidePath} to integrate by hand`);
+            markManual(setupPlan, 'sdk', `No coding agent CLI found; wrote ${guidePath}.`);
+            break;
+        }
+        case 'cancelled':
+            laneBoard?.fail('sdk', outcome.detail ?? 'SDK integration cancelled');
+            markManual(setupPlan, 'sdk', outcome.detail ?? 'SDK integration cancelled.');
+            break;
+        case 'repository_checks_failed':
+        case 'smoke_execution_failed':
+        case 'agent_failed':
+        default: {
+            const guidePath = writeGuide();
+            sdkAction.files = [guidePath];
+            const detail = outcome.detail ?? 'SDK integration did not complete.';
+            laneBoard?.warn('sdk', `${detail}; wrote ${guidePath} to finish manually`);
+            markManual(setupPlan, 'sdk', `${detail}; wrote ${guidePath}.`);
+            break;
+        }
+    }
+}
 function changedFiles(setupPlan) {
     return [...new Set(setupPlan
             .filter((action) => action.status === 'applied')

package/dist/init/sdk-catalog.d.ts

@@ -0,0 +1,10 @@
+import { type BundledSkillIndex } from '../skills-bundled.js';
+export interface MaterializedSdkCatalog {
+    dir: string;
+    relativeDir: string;
+    index: BundledSkillIndex;
+}
+export declare function materializeSdkCatalog(cwd: string, runId: string): MaterializedSdkCatalog;
+export declare function cleanupSdkCatalog(dir: string): void;
+export declare function renderCatalogListing(index: BundledSkillIndex): string;
+//# sourceMappingURL=sdk-catalog.d.ts.map

package/dist/init/sdk-catalog.js

@@ -0,0 +1,80 @@
+// src/init/sdk-catalog.ts — Ephemeral, run-scoped materialization of the
+// complete bundled SDK integration-skill catalog for a coding agent to browse.
+import { copyFileSync, existsSync, mkdirSync, readdirSync, rmSync, statSync, } from 'node:fs';
+import { join, relative, resolve } from 'node:path';
+import { bundledSkillsDir, readBundledIndex, } from '../skills-bundled.js';
+export function materializeSdkCatalog(cwd, runId) {
+    if (!/^[a-z0-9-]+$/.test(runId)) {
+        throw new Error(`Invalid SDK catalog run id: ${JSON.stringify(runId).slice(0, 80)}`);
+    }
+    const sourceDir = bundledSkillsDir();
+    const indexPath = join(sourceDir, 'index.json');
+    if (!existsSync(sourceDir) || !existsSync(indexPath)) {
+        throw missingBundleError(sourceDir);
+    }
+    const index = readBundledIndex();
+    if (!index) {
+        throw missingBundleError(sourceDir);
+    }
+    const dir = join(cwd, '.moda', 'tmp', `sdk-catalog-${runId}`);
+    cleanupSdkCatalog(dir);
+    copyDirectoryRecursive(sourceDir, dir);
+    return {
+        dir,
+        relativeDir: relative(cwd, dir).replace(/\\/g, '/'),
+        index,
+    };
+}
+export function cleanupSdkCatalog(dir) {
+    const normalized = resolve(dir).replace(/\\/g, '/');
+    if (!normalized.includes('.moda/tmp/sdk-catalog-'))
+        return;
+    try {
+        rmSync(dir, { recursive: true, force: true });
+    }
+    catch {
+        // Catalog cleanup is best-effort and must never mask the integration result.
+    }
+}
+export function renderCatalogListing(index) {
+    return index.skills.map((skill) => {
+        const targets = [`language: ${skill.targets.language}`];
+        if (skill.targets.frameworks.length > 0) {
+            targets.push(`frameworks: ${skill.targets.frameworks.join(',')}`);
+        }
+        if (skill.targets.providers.length > 0) {
+            targets.push(`providers: ${skill.targets.providers.join(',')}`);
+        }
+        return `- ${skill.id} — ${skill.summary} [${targets.join('; ')}]`;
+    }).join('\n');
+}
+function copyDirectoryRecursive(sourceDir, targetDir) {
+    mkdirSync(targetDir, { recursive: true });
+    for (const entry of readdirSync(sourceDir, { withFileTypes: true })) {
+        const source = join(sourceDir, entry.name);
+        const target = join(targetDir, entry.name);
+        if (entry.isDirectory()) {
+            copyDirectoryRecursive(source, target);
+        }
+        else if (entry.isFile()) {
+            copyFileSync(source, target);
+        }
+    }
+}
+function missingBundleError(sourceDir) {
+    let detail = 'is absent';
+    try {
+        if (existsSync(sourceDir) && !statSync(sourceDir).isDirectory()) {
+            detail = 'is not a directory';
+        }
+        else if (existsSync(sourceDir)) {
+            detail = 'has no readable index.json';
+        }
+    }
+    catch {
+        detail = 'is not readable';
+    }
+    return new Error(`Bundled SDK skill catalog ${detail} at ${sourceDir}. ` +
+        'Set MODA_BUNDLED_SKILLS_DIR to a built bundle, or run the integration-skill bundle build in a dev tree.');
+}
+//# sourceMappingURL=sdk-catalog.js.map

package/dist/init/sdk-guide.d.ts

@@ -6,43 +6,14 @@ type RuntimeSummary = {
     providers: string[];
     runtimeAgentNames: string[];
 };
-export type SdkGuideContext = {
-    languages: string[];
-    installCommands: string[];
-    providerHints: string[];
-    frameworkHints: string[];
-    packageManagers: string[];
-    runtimeSummary: RuntimeSummary;
-};
 /**
  * Write the human/agent-readable fallback guide (.moda/SDK_INTEGRATION.md).
- *
- * When a bundled integration skill matches the detected stack, the guide is
- * rendered from that skill's content plus the detection block (one shared
- * renderer with the agent-prompt path). When no skill resolves (no language
- * detected) the slim generic guide is used; when a skill resolved but its
- * content could not be loaded (missing/unreadable bundle) the generic guide is
- * flagged as a degraded fallback and pinned to the detected stack.
+ * Used when automatic SDK integration did not complete successfully.
  */
 export declare function writeSdkIntegrationGuide(cwd?: string): string;
-/** Shared renderer: detection block + the resolved skill's full content. */
-export declare function renderSkillBasedGuide(skillId: string, skillMd: string, context: SdkGuideContext): string;
-/** The "What Moda Detected" section, shared by prompts and guides. */
-export declare function renderDetectionBlock(context: SdkGuideContext): string;
-/** Drop a SKILL.md's YAML frontmatter so only the prose body is rendered. */
-export declare function stripSkillFrontmatter(markdown: string): string;
-export declare function detectSdkGuideContext(cwd: string): SdkGuideContext;
-/**
- * Slim last-resort guide, used when no bundled skill resolves (no language
- * detected) or when a skill resolved but its content could not be loaded (the
- * bundle is missing/unreadable). Detected stacks with readable content get the
- * far richer skill-based guide via renderSkillBasedGuide().
- *
- * When `resolvedSkillId` is set the intro flags the degradation and pins the
- * reader to the detection block instead of claiming no stack was detected —
- * mirrors the degraded fallback in the agent-prompt path so a successful
- * detection never reads as stack-less.
- */
-export declare function renderSdkIntegrationGuide(context: SdkGuideContext, resolvedSkillId?: string): string;
+export declare function renderSdkIntegrationGuideContent(): string;
+/** Read optional harness discovery context from `.moda/harness.json`. */
+export declare function readRuntimeSummary(cwd: string): RuntimeSummary;
+export declare function renderRuntimeSummaryBlock(summary: RuntimeSummary): string;
 export {};
 //# sourceMappingURL=sdk-guide.d.ts.map