@moda-ai/cli 1.22.0 → 1.22.2

package/dist/harness.js

@@ -1,4009 +0,0 @@
-import { createHash } from 'node:crypto';
-import { execFileSync, spawn } from 'node:child_process';
-import { homedir } from 'node:os';
-import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, writeFileSync, } from 'node:fs';
-import { basename, delimiter, dirname, extname, join, relative, resolve, sep } from 'node:path';
-import { confirm, select } from '@inquirer/prompts';
-import { callControlAPI } from './api-client.js';
-import { AnalystTui, shouldUseAnalystTui } from './analyst-tui.js';
-import { embeddedTenantIdFromApiKey, resolveApiKey, resolveTenantId } from './config.js';
-import { CliInputError, CliInputRequiredError } from './errors.js';
-import { HARNESS_REMOTE_RUN_STATE_PATH, isRemoteHarnessAnalyze, readRemoteRunState, runHarnessPull, runRemoteHarnessAnalyst, } from './harness-remote.js';
-import { getActiveProfile } from './profiles.js';
-import { enrichScanCaptureMetadata, annotatedSourceCandidates, extractToolBody, hydratePromptAndToolBodies, readPromptOrToolBody, resolveAnnotatedSourcePath, } from './harness-artifact-bodies.js';
-import { approveHarnessReport, createHarnessReport, graphForReport, hashHarnessReport, hashStableJson as hashHarnessReportStableJson, HARNESS_REPORT_PATH, loadHarnessReportForSync, normalizeHarnessReport, readHarnessReport, resolveHarnessReportPath, validateHarnessReport, writeHarnessReportArtifacts, } from './harness-report.js';
-import { detectHarnessCandidates, writeHarnessCandidatesReport } from './harness-candidates.js';
-import { assertHarnessGraphSyncSize } from './harness-sync-limits.js';
-import { renderHarnessAnalystChoice, renderHarnessAnalystLaunch, renderHarnessAnalystPreflight, renderHarnessAnalyzeHumanResult, renderHarnessProgress, } from './tui.js';
-const MODA_DIR = '.moda';
-const HARNESS_PATH = join(MODA_DIR, 'harness.json');
-const HARNESS_SUMMARY_PATH = join(MODA_DIR, 'HARNESS.md');
-const SYNC_STATE_PATH = join(MODA_DIR, 'sync-state.json');
-const SCHEMA_VERSION = 'harness.v0.1';
-const MAX_SCANNED_FILE_BYTES = 512 * 1024;
-const DEFAULT_MAX_INVENTORY_FILES = 12_000;
-const DEFAULT_MAX_INVENTORY_TEXT_BYTES = 48 * 1024 * 1024;
-const MAX_RECORDED_SKIPS = 1_000;
-const REPORT_JSON_BEGIN = 'MODA_HARNESS_REPORT_JSON_BEGIN';
-const REPORT_JSON_END = 'MODA_HARNESS_REPORT_JSON_END';
-const SKIPPED_DIRS = new Set([
-    '.angular',
-    '.cache',
-    '.expo',
-    '.git',
-    '.hg',
-    '.idea',
-    '.svn',
-    '.next',
-    '.nuxt',
-    '.output',
-    '.parcel-cache',
-    '.pytest_cache',
-    '.ruff_cache',
-    '.serverless',
-    '.sst',
-    '.turbo',
-    '.wrangler',
-    '.wrangler-shared',
-    '.moda',
-    '.moda-test',
-    '.moda-test-home',
-    '.moda-cli-workspaces',
-    '.moda-cli-benchmarks',
-    'node_modules',
-    'dist',
-    'build',
-    'coverage',
-    'out',
-    'target',
-    'logs',
-    'tmp',
-    'temp',
-    '__pycache__',
-    '.venv',
-    'venv',
-]);
-const SKIPPED_PATH_PREFIXES = [
-    '.claude/worktrees',
-    '.codex/environments',
-];
-const EXTERNAL_ANALYST_ADAPTERS = ['claude', 'codex', 'cursor'];
-export async function runHarnessCommand(context) {
-    const subcommand = context.positionals[0] ?? 'scan';
-    const rootDir = resolve(context.cwd, context.flags.path ?? '.');
-    const selectedAgentId = selectedRuntimeAgentId(context.flags);
-    const tenant = resolveHarnessTenant(context.flags, context);
-    const scanPlan = buildCommandScanPlan(context, rootDir);
-    switch (subcommand) {
-        case 'scan': {
-            await approveScanIfNeeded(scanPlan, { context });
-            writeHumanProgress(context, 'Harness scan: inventorying local files...');
-            const graph = scanHarness({
-                rootDir,
-                dryRun: context.dryRun,
-                tenantId: tenant?.tenantId,
-                tenantSource: tenant?.source,
-                pathWasExplicit: context.flags.path !== undefined,
-            });
-            const written = context.dryRun ? [] : writeHarnessArtifacts(graph, rootDir, {
-                summary: context.flags.summary === 'true',
-            });
-            writeHumanProgress(context, 'Harness scan: complete.');
-            context.output.writeData({
-                scanPlan,
-                summary: summarizeHarness(graph),
-                graph,
-                written,
-                dryRun: context.dryRun,
-            });
-            return { exitCode: 0 };
-        }
-        case 'sync': {
-            if (!resolveApiKey({ profile: context.profile, env: context.env }) && !context.dryRun) {
-                throw new CliInputError('No Moda API key found for harness sync.', 'Run `moda init` first, set MODA_API_KEY, or select a profile with an API key.');
-            }
-            warnFresherSubdirHarnessReports(context, rootDir, context.flags['from-report'] ?? context.flags.report);
-            if (!context.dryRun) {
-                const identity = describeSyncIdentity({ profile: context.profile, env: context.env });
-                if (identity) {
-                    // The banner's tenant comes from the winning key when it embeds
-                    // one. Otherwise fall back to the flag/env/profile-resolved tenant
-                    // but label it unverified — that source is precisely what a
-                    // shadowing stale key disagrees with, so it must never be asserted
-                    // as the destination.
-                    const label = identity.tenantSource === 'api-key'
-                        ? describeSyncTenantLabel(identity)
-                        : describeSyncTenantLabel({
-                            tenantId: tenant?.tenantId ?? identity.tenantId,
-                            tenantSource: 'config',
-                        });
-                    writeHumanProgress(context, `Syncing as ${identity.credential} → tenant ${label}`);
-                }
-            }
-            if (context.flags['from-report'] || context.flags.report) {
-                const reportPath = resolveHarnessReportPath(rootDir, context.flags['from-report'] ?? context.flags.report);
-                const { report, validation, approval, approved } = loadHarnessReportForSync(rootDir, reportPath);
-                const reportHash = hashHarnessReport(report);
-                if (!approved && !context.dryRun) {
-                    throw new CliInputError('Harness report is not approved; refusing to sync.', 'Run `moda harness validate-report`, review the report, then run `moda harness approve --yes` before syncing.');
-                }
-                const syncGraph = graphForReport(report.graph);
-                const sourceCommit = report.source.sourceCommit ?? getGitCommit(rootDir);
-                const localGraphHash = hashHarnessReportStableJson(syncGraph);
-                const plan = createHarnessSyncPlan({
-                    context,
-                    rootDir,
-                    graph: report.graph,
-                    source: 'approved_report',
-                    sourceCommit,
-                    localGraphHash,
-                    localWrites: plannedHarnessArtifactWrites(context),
-                });
-                const written = context.dryRun ? [] : writeHarnessArtifacts(report.graph, rootDir, {
-                    summary: context.flags.summary === 'true',
-                });
-                const syncBody = {
-                    graph: syncGraph,
-                    graphHash: localGraphHash,
-                    sourceCommit,
-                    report,
-                    reportHash,
-                    reportValidationStatus: validation.status,
-                    reportApproval: approval ? {
-                        approved: approval.approved,
-                        approvedAt: approval.approvedAt,
-                        approvedBy: approval.approvedBy,
-                        reportHash: approval.reportHash,
-                    } : undefined,
-                };
-                const response = await syncHarnessWithRemote(context, syncBody);
-                const statePath = response && !context.dryRun
-                    ? writeHarnessSyncState(rootDir, {
-                        schemaVersion: 'sync_state.v0.1',
-                        updatedAt: new Date().toISOString(),
-                        resource: 'harness',
-                        source: 'approved_report',
-                        profile: plan.profile,
-                        tenantId: response.tenantId ?? plan.tenantId,
-                        rootPath: plan.rootPath,
-                        sourceCommit,
-                        harnessId: report.graph.harnessId,
-                        localGraphHash,
-                        report: {
-                            reportId: report.reportId,
-                            reportHash,
-                            validationStatus: validation.status,
-                        },
-                        remote: response,
-                        summary: summarizeHarness(report.graph),
-                        uploads: plan.uploads,
-                        privacy: plan.privacy,
-                        written,
-                    })
-                    : undefined;
-                context.output.writeData({
-                    plan,
-                    report: {
-                        reportId: report.reportId,
-                        reportHash,
-                        path: normalizePath(relative(rootDir, reportPath)) || '.moda/harness-report.json',
-                    },
-                    validation,
-                    approval: {
-                        approved,
-                        approvedAt: approval?.approvedAt,
-                        approvedBy: approval?.approvedBy,
-                    },
-                    summary: summarizeHarness(report.graph),
-                    remote: response ?? plannedDryRunRemote(plan),
-                    written,
-                    syncState: statePath ? { path: statePath } : undefined,
-                    dryRun: context.dryRun,
-                });
-                return { exitCode: 0 };
-            }
-            const graph = scanHarness({
-                rootDir,
-                dryRun: context.dryRun,
-                tenantId: tenant?.tenantId,
-                tenantSource: tenant?.source,
-                pathWasExplicit: context.flags.path !== undefined,
-            });
-            const syncGraph = graphForSync(graph);
-            const sourceCommit = getGitCommit(rootDir);
-            const localGraphHash = hashStableJson(syncGraph);
-            const plan = createHarnessSyncPlan({
-                context,
-                rootDir,
-                graph,
-                source: 'local_scan',
-                sourceCommit,
-                localGraphHash,
-                localWrites: plannedHarnessArtifactWrites(context),
-            });
-            const written = context.dryRun ? [] : writeHarnessArtifacts(graph, rootDir, {
-                summary: context.flags.summary === 'true',
-            });
-            const response = await syncHarnessWithRemote(context, {
-                graph: syncGraph,
-                graphHash: localGraphHash,
-                sourceCommit,
-            });
-            const statePath = response && !context.dryRun
-                ? writeHarnessSyncState(rootDir, {
-                    schemaVersion: 'sync_state.v0.1',
-                    updatedAt: new Date().toISOString(),
-                    resource: 'harness',
-                    source: 'local_scan',
-                    profile: plan.profile,
-                    tenantId: response.tenantId ?? plan.tenantId,
-                    rootPath: plan.rootPath,
-                    sourceCommit,
-                    harnessId: graph.harnessId,
-                    localGraphHash,
-                    remote: response,
-                    summary: summarizeHarness(graph),
-                    uploads: plan.uploads,
-                    privacy: plan.privacy,
-                    written,
-                })
-                : undefined;
-            context.output.writeData({
-                scanPlan,
-                plan,
-                summary: summarizeHarness(graph),
-                remote: response ?? plannedDryRunRemote(plan),
-                written,
-                syncState: statePath ? { path: statePath } : undefined,
-                dryRun: context.dryRun,
-            });
-            return { exitCode: 0 };
-        }
-        case 'delete': {
-            const idOrKey = context.positionals[1]
-                ?? (context.flags.harness && context.flags.harness !== 'true' ? context.flags.harness : undefined);
-            if (!idOrKey) {
-                throw new CliInputError('Missing harness id or key to delete.', 'Usage: moda harness delete <harness-id-or-key> [--yes]');
-            }
-            const profileOptions = { profile: context.profile, env: context.env };
-            if (!resolveApiKey(profileOptions) && !context.dryRun) {
-                throw new CliInputError('No Moda API key found for harness delete.', 'Run `moda init` first, set MODA_API_KEY, or select a profile with an API key.');
-            }
-            // Identity banner (same pattern as sync): deletion is destructive and
-            // tenant-scoped, so the resolved credential and destination tenant must
-            // be visible BEFORE the user confirms — a shadowed or stale key would
-            // otherwise delete from the wrong tenant silently.
-            const identity = describeSyncIdentity(profileOptions);
-            if (identity) {
-                const label = identity.tenantSource === 'api-key'
-                    ? describeSyncTenantLabel(identity)
-                    : describeSyncTenantLabel({
-                        tenantId: tenant?.tenantId ?? identity.tenantId,
-                        tenantSource: 'config',
-                    });
-                writeHumanProgress(context, `Deleting as ${identity.credential} → tenant ${label}`);
-            }
-            if (context.dryRun) {
-                context.output.writeData({
-                    endpoint: `/api/harnesses/${idOrKey}`,
-                    harnessKey: idOrKey,
-                    deleted: false,
-                    dryRun: true,
-                });
-                return { exitCode: 0 };
-            }
-            await confirmHarnessDelete(context, idOrKey);
-            const response = await callControlAPI(`/harnesses/${encodeURIComponent(idOrKey)}`, { method: 'DELETE' }, profileOptions);
-            writeHumanProgress(context, `Deleted harness ${response.harnessKey ?? idOrKey} from tenant ${response.tenantId ?? 'unknown'} ` +
-                `(${response.deleted?.versions ?? 0} versions, ${response.deleted?.agents ?? 0} agents, ` +
-                `${response.deleted?.artifacts ?? 0} artifacts, ${response.deleted?.relationships ?? 0} relationships).`);
-            context.output.writeData({ ...response, dryRun: false });
-            return { exitCode: 0 };
-        }
-        case 'analyze': {
-            await approveScanIfNeeded(scanPlan, {
-                context,
-                message: 'Run Moda Analyst to investigate this project and produce a cited harness report?',
-                declinedMessage: 'Harness analysis was not approved.',
-                declinedHint: 'Run `moda harness analyze --path=<dir>` for a narrower investigation, or rerun with `--yes` after reviewing the read plan.',
-            });
-            context.output.writeEvent({
-                event: 'started',
-                phase: 'harness_analyze',
-                message: 'Starting Moda Analyst harness analysis.',
-                elapsed_ms: Date.now() - context.startedAt,
-            });
-            if (isRemoteHarnessAnalyze(context)) {
-                return runRemoteHarnessAnalyst({ context, rootDir, scanPlan, tenant });
-            }
-            const analyst = await resolveHarnessAnalystAdapter(context);
-            if (analyst !== 'local-scan') {
-                return runExternalHarnessAnalyst({
-                    context,
-                    rootDir,
-                    scanPlan,
-                    tenant,
-                    adapter: analyst,
-                });
-            }
-            context.output.writeEvent({
-                event: 'progress',
-                phase: 'inventory',
-                message: 'Inventorying local harness files.',
-                elapsed_ms: Date.now() - context.startedAt,
-            });
-            writeHumanProgress(context, 'Moda Analyst: inventorying local harness files...');
-            const graph = scanHarness({
-                rootDir,
-                dryRun: context.dryRun,
-                tenantId: tenant?.tenantId,
-                tenantSource: tenant?.source,
-                pathWasExplicit: context.flags.path !== undefined,
-            });
-            context.output.writeEvent({
-                event: 'progress',
-                phase: 'report',
-                message: 'Producing cited structured harness report.',
-                elapsed_ms: Date.now() - context.startedAt,
-            });
-            writeHumanProgress(context, 'Moda Analyst: producing cited structured harness report...');
-            const report = createHarnessReport({
-                graph,
-                rootDir,
-                sourceCommit: getGitCommit(rootDir),
-                analystAdapter: 'local-scan',
-            });
-            const validation = validateHarnessReport(report, rootDir);
-            context.output.writeEvent({
-                event: 'progress',
-                phase: 'validation',
-                message: `Harness report validation ${validation.status}.`,
-                elapsed_ms: Date.now() - context.startedAt,
-            });
-            writeHumanProgress(context, `Moda Analyst: validation ${validation.status}.`);
-            const written = context.dryRun
-                ? []
-                : [
-                    ...writeHarnessReportArtifacts({
-                        rootDir,
-                        report,
-                        validation,
-                        markdown: context.flags.summary === 'true' || context.outputMode === 'human',
-                    }),
-                    ...writeHarnessArtifacts(report.graph, rootDir, {
-                        summary: context.flags.summary === 'true',
-                    }),
-                ];
-            emitWrittenArtifacts(context, written, 'Written by Moda Analyst.');
-            writeHarnessAnalyzeResult(context, {
-                scanPlan,
-                summary: summarizeHarness(graph),
-                report,
-                validation,
-                written,
-                dryRun: context.dryRun,
-            });
-            return { exitCode: validation.status === 'pass' ? 0 : 1 };
-        }
-        case 'pull': {
-            return runHarnessPull({ context, rootDir, scanPlan });
-        }
-        case 'validate-report': {
-            const reportPath = resolveHarnessReportPath(rootDir, context.positionals[1] ?? context.flags.report);
-            const report = readHarnessReport(reportPath);
-            const validation = validateHarnessReport(report, rootDir);
-            if (!context.dryRun) {
-                writeHarnessReportArtifacts({
-                    rootDir,
-                    report,
-                    validation,
-                    markdown: context.flags.summary === 'true',
-                });
-            }
-            context.output.writeData(validation, { status: validation.status === 'pass' ? 'success' : 'error' });
-            return { exitCode: validation.status === 'pass' ? 0 : 1 };
-        }
-        case 'approve': {
-            warnFresherSubdirHarnessReports(context, rootDir, context.positionals[1] ?? context.flags.report);
-            const reportPath = resolveHarnessReportPath(rootDir, context.positionals[1] ?? context.flags.report);
-            const approval = await approveHarnessReport({
-                rootDir,
-                reportPath,
-                yes: context.yes,
-                interactive: context.interactive,
-            });
-            context.output.writeData({
-                report: {
-                    reportId: approval.report.reportId,
-                    reportHash: hashHarnessReport(approval.report),
-                    path: normalizePath(relative(rootDir, reportPath)) || '.moda/harness-report.json',
-                },
-                validation: approval.validation,
-                approval: approval.approval,
-            });
-            return { exitCode: 0 };
-        }
-        case 'candidates': {
-            await approveScanIfNeeded(scanPlan, {
-                context,
-                message: 'Scan this project for static harness candidates?',
-            });
-            writeHumanProgress(context, 'Harness candidates: static pre-pass (no LLM, no network)...');
-            const report = detectHarnessCandidates(rootDir);
-            const written = [];
-            const outFlag = context.flags.out;
-            // A value-less `--out` is parsed as the sentinel string 'true'; reject it
-            // rather than silently writing the report to `<cwd>/true`.
-            if (outFlag === 'true') {
-                throw new CliInputError('Missing output path for --out.', 'Usage: moda harness candidates --out=<file>');
-            }
-            if (outFlag && !context.dryRun) {
-                written.push(writeHarnessCandidatesReport(report, resolve(context.cwd, outFlag)));
-            }
-            writeHumanProgress(context, `Harness candidates: ${report.stats.candidateCount} candidates across ` +
-                `${report.stats.filesWithCandidates} files (${report.stats.filesScanned} scanned, ` +
-                `${report.stats.filesPerSecond.toLocaleString()} files/sec).`);
-            context.output.writeData({ scanPlan, ...report, written, dryRun: context.dryRun });
-            return { exitCode: 0 };
-        }
-        case 'agents': {
-            const graph = loadOrScanHarness(rootDir, tenant, context);
-            context.output.writeData({
-                summary: summarizeHarness(graph),
-                agentFamilies: graph.agentFamilies,
-                runtimeAgents: graph.runtimeAgents,
-                unknowns: graph.unknowns,
-            });
-            return { exitCode: 0 };
-        }
-        case 'graph': {
-            const graph = loadOrScanHarness(rootDir, tenant, context);
-            context.output.writeData(graph);
-            return { exitCode: 0 };
-        }
-        case 'explain': {
-            const graph = loadOrScanHarness(rootDir, tenant, context);
-            if (selectedAgentId) {
-                const agent = graph.runtimeAgents.find((candidate) => candidate.id === selectedAgentId);
-                if (!agent) {
-                    throw new CliInputError(`Runtime agent '${selectedAgentId}' was not found in the harness graph.`, 'Run `moda harness agents` to inspect detected runtime agents.');
-                }
-                context.output.writeData(explainAgent(graph, agent));
-                return { exitCode: 0 };
-            }
-            context.output.writeData({
-                summary: summarizeHarness(graph),
-                markdown: renderHarnessMarkdown(graph),
-                unknowns: graph.unknowns,
-            });
-            return { exitCode: 0 };
-        }
-        case 'write-summary': {
-            const graph = loadOrScanHarness(rootDir, tenant);
-            const summaryPath = writeHarnessSummary(graph, rootDir);
-            context.output.writeData({
-                summary: summarizeHarness(graph),
-                written: [summaryPath],
-            });
-            return { exitCode: 0 };
-        }
-        case 'status': {
-            const manifestPath = join(rootDir, HARNESS_PATH);
-            const graph = existsSync(manifestPath)
-                ? readHarnessGraph(manifestPath)
-                : scanHarness({
-                    rootDir,
-                    tenantId: tenant?.tenantId,
-                    tenantSource: tenant?.source,
-                });
-            const currentGraphHash = hashStableJson(graphForSync(graph));
-            const syncState = readHarnessSyncState(rootDir);
-            const remoteRun = readRemoteRunState(rootDir);
-            context.output.writeData({
-                manifest: HARNESS_PATH,
-                exists: existsSync(manifestPath),
-                summary: summarizeHarness(graph),
-                graphHash: currentGraphHash,
-                remoteRun: remoteRun
-                    ? {
-                        statePath: HARNESS_REMOTE_RUN_STATE_PATH,
-                        runId: remoteRun.run_id,
-                        status: remoteRun.status,
-                        startedAt: remoteRun.started_at_iso || undefined,
-                    }
-                    : undefined,
-                sync: syncState
-                    ? {
-                        statePath: SYNC_STATE_PATH,
-                        lastSyncedAt: syncState.updatedAt,
-                        profile: syncState.profile,
-                        tenantId: syncState.tenantId,
-                        harnessId: syncState.harnessId,
-                        remoteHarnessId: syncState.remote.harnessId,
-                        remoteVersionId: syncState.remote.versionId,
-                        remoteGraphHash: syncState.remote.graphHash,
-                        localGraphHash: syncState.localGraphHash,
-                        stale: syncState.localGraphHash !== currentGraphHash,
-                    }
-                    : {
-                        statePath: SYNC_STATE_PATH,
-                        lastSyncedAt: null,
-                        stale: true,
-                    },
-                stale: syncState ? syncState.localGraphHash !== currentGraphHash : true,
-            });
-            return { exitCode: 0 };
-        }
-        default:
-            throw new CliInputError(`Unknown harness command '${subcommand}'.`, 'Usage: moda harness analyze|pull|validate-report|approve|scan|candidates|sync|delete|agents|graph|explain|write-summary|status');
-    }
-}
-export function writeHarnessAnalyzeResult(context, payload) {
-    if (context.outputMode === 'human') {
-        if (!context.quiet)
-            console.log(renderHarnessAnalyzeHumanResult(payload));
-        return;
-    }
-    const validationPassed = payload.validation.status === 'pass';
-    context.output.writeData(payload, {
-        status: validationPassed ? 'success' : 'error',
-        summary: validationPassed
-            ? 'Moda Analyst produced and validated a cited harness report.'
-            : 'Moda Analyst produced a harness report, but validation failed.',
-        findings: [
-            {
-                id: 'harness_analyze:validation',
-                title: 'Harness report validation',
-                status: payload.validation.status,
-                severity: validationPassed ? 'info' : 'error',
-                description: validationPassed
-                    ? 'The report is ready for human review and approval.'
-                    : 'Review validation errors before syncing the harness graph.',
-            },
-        ],
-        artifacts: payload.written.map((file) => ({
-            kind: file.includes('harness-report') || file.includes('HARNESS_REPORT')
-                ? 'harness_report_artifact'
-                : 'harness_graph_artifact',
-            path: file,
-            description: 'Written by Moda Analyst.',
-        })),
-        nextCommands: validationPassed
-            ? [
-                {
-                    command: 'moda harness approve --yes',
-                    purpose: 'Approve the cited report after human review.',
-                    mutability: 'write',
-                    requires_approval: true,
-                },
-                {
-                    command: 'moda harness sync --from-report .moda/harness-report.json --summary',
-                    purpose: 'Sync the approved harness graph to Moda Cloud.',
-                    mutability: 'sync',
-                    requires_approval: true,
-                },
-            ]
-            : [
-                {
-                    command: 'moda harness validate-report --summary',
-                    purpose: 'Re-run citation and schema validation after fixing the report.',
-                    mutability: 'read',
-                    requires_approval: false,
-                },
-            ],
-    });
-}
-/**
- * Emit one `artifact` lifecycle event per written file, classifying report vs
- * graph artifacts. Shared by the local-scan, external-analyst, and remote
- * analyze paths.
- */
-export function emitWrittenArtifacts(context, written, description) {
-    for (const file of written) {
-        context.output.writeEvent({
-            event: 'artifact',
-            phase: 'write',
-            artifact: {
-                kind: file.includes('harness-report') || file.includes('HARNESS_REPORT')
-                    ? 'harness_report_artifact'
-                    : 'harness_graph_artifact',
-                path: file,
-                description,
-            },
-            elapsed_ms: Date.now() - context.startedAt,
-        });
-    }
-}
-async function runExternalHarnessAnalyst(options) {
-    if (options.context.dryRun) {
-        throw new CliInputError('External harness analysis cannot run in dry-run mode yet.', 'Use `moda harness analyze --analyst=local-scan --dry-run` for deterministic fallback inspection.');
-    }
-    const prompt = renderExternalHarnessAnalystPrompt({
-        adapter: options.adapter,
-        rootDir: options.rootDir,
-        tenantId: options.tenant?.tenantId,
-    });
-    // Agent-stream mode also runs the analyst child in stream-json mode so its
-    // tool activity can be forwarded as NDJSON `progress` events (consumed by
-    // the hosted analyze runner for live run-state progress). Report extraction
-    // is unaffected: the report is read from .moda/harness-report.json.
-    const streamAnalystProgress = options.context.outputMode === 'agent-stream';
-    const invocation = resolveExternalHarnessAnalystInvocation({
-        adapter: options.adapter,
-        flags: options.context.flags,
-        prompt,
-        rootDir: options.rootDir,
-        stream: options.context.outputMode === 'human' || streamAnalystProgress,
-    });
-    options.context.output.writeEvent({
-        event: 'progress',
-        phase: 'analyst_launch',
-        message: `Launching ${analystDisplayName(options.adapter)} in read-only analyst mode.`,
-        elapsed_ms: Date.now() - options.context.startedAt,
-    });
-    const inheritedOutput = options.context.outputMode === 'human';
-    const analystTui = shouldUseAnalystTui(options.context.flags, options.context.outputMode) && invocation.streamEvents && !options.context.quiet
-        ? new AnalystTui({
-            adapterName: analystDisplayName(options.adapter),
-            command: invocation.command,
-            root: options.rootDir,
-            reportPath: HARNESS_REPORT_PATH,
-            startedAt: options.context.startedAt,
-        })
-        : undefined;
-    if (analystTui) {
-        analystTui.start();
-    }
-    else {
-        writeHumanBlock(options.context, renderHarnessAnalystLaunch({
-            adapterName: analystDisplayName(options.adapter),
-            command: invocation.command,
-            root: options.rootDir,
-            reportPath: HARNESS_REPORT_PATH,
-        }));
-    }
-    const timeoutMs = numericEnv('MODA_HARNESS_ANALYST_TIMEOUT_MS', 20 * 60 * 1000);
-    try {
-        const result = await runExternalAnalystWithRetries(invocation, {
-            cwd: options.rootDir,
-            env: buildExternalAnalystEnv(options.context.env),
-            inheritedOutput,
-            timeoutMs,
-            maxBuffer: 20 * 1024 * 1024,
-            progress: (inheritedOutput && !options.context.quiet) || options.context.outputMode === 'agent-stream',
-            progressToStderr: inheritedOutput && !options.context.quiet && !analystTui,
-            streamEvents: invocation.streamEvents,
-            adapter: invocation.adapter,
-            tui: analystTui,
-            maxAttempts: externalAnalystMaxAttempts(options.adapter),
-            backoffMs: numericEnvAllowZero('MODA_HARNESS_ANALYST_RETRY_BACKOFF_MS', 6_000),
-            onProgress: (message, phase = 'analyst') => {
-                options.context.output.writeEvent({
-                    event: 'progress',
-                    phase,
-                    message,
-                    elapsed_ms: Date.now() - options.context.startedAt,
-                });
-            },
-            // Forward the analyst's parsed tool/text events as progress events so
-            // agent-stream consumers see live activity ("reading src/agent.ts"),
-            // not just the periodic still-investigating ticker.
-            onAgentEvent: streamAnalystProgress
-                ? (event) => {
-                    const progress = analystEventProgress(event);
-                    if (!progress)
-                        return;
-                    options.context.output.writeEvent({
-                        event: 'progress',
-                        phase: progress.phase,
-                        message: progress.message,
-                        elapsed_ms: Date.now() - options.context.startedAt,
-                    });
-                }
-                : undefined,
-        });
-        if (result.error) {
-            throw new CliInputError(`Harness analyst ${options.adapter} failed to run: ${result.error.message}`, 'Check that the selected coding agent CLI is installed and authenticated, or run `moda harness analyze --analyst=local-scan` for the deterministic fallback.');
-        }
-        if (result.timedOut) {
-            throw new CliInputError(`Harness analyst ${options.adapter} timed out after ${Math.round(timeoutMs / 1000)}s.`, 'Run from a narrower agent project root, pass --path=<agent-dir>, or retry after the analyst CLI is responsive.');
-        }
-        if (result.maxBufferExceeded) {
-            throw new CliInputError(`Harness analyst ${options.adapter} produced more than 20MiB of output.`, 'Retry with a narrower --path or ask the analyst to write the report directly instead of printing large logs.');
-        }
-        if (result.status !== 0) {
-            const output = inheritedOutput
-                ? ''
-                : truncateText(`${result.stdout}\n${result.stderr}`, 1200);
-            throw new CliInputError(`Harness analyst ${options.adapter} exited with status ${result.status ?? 'unknown'}.`, output || 'Rerun with the selected coding agent CLI fixed, or choose another analyst with `--analyst=claude|codex|cursor`.');
-        }
-        const report = readExternalAnalystReport(options.rootDir, result, options.adapter);
-        analystTui?.setSummary({
-            runtimeAgentCount: report.graph.runtimeAgents.length,
-            agentFamilyCount: report.graph.agentFamilies.length,
-            artifactCount: report.graph.artifacts.length,
-            modelProviderCount: report.graph.modelProviders.length,
-            unknownCount: report.graph.unknowns.length,
-            claimCount: report.claims.length,
-            citationCount: report.citations.length,
-            relationshipCount: report.graph.relationships.length,
-        });
-        options.context.output.writeEvent({
-            event: 'progress',
-            phase: 'validation',
-            message: `Validating ${HARNESS_REPORT_PATH}.`,
-            elapsed_ms: Date.now() - options.context.startedAt,
-        });
-        analystTui?.setValidation('running');
-        const validation = validateHarnessReport(report, options.rootDir);
-        analystTui?.setValidation(validation.status === 'pass' ? 'pass' : 'fail');
-        if (!analystTui)
-            writeHumanProgress(options.context, `Moda Analyst: validation ${validation.status}.`);
-        const written = [
-            ...writeHarnessReportArtifacts({
-                rootDir: options.rootDir,
-                report,
-                validation,
-                markdown: options.context.flags.summary === 'true' || options.context.outputMode === 'human',
-            }),
-        ];
-        if (validation.status === 'pass') {
-            written.push(...writeHarnessArtifacts(report.graph, options.rootDir, {
-                summary: options.context.flags.summary === 'true',
-            }));
-        }
-        analystTui?.setArtifacts(written);
-        emitWrittenArtifacts(options.context, written, 'Written by Moda Analyst.');
-        analystTui?.complete(validation.status === 'pass' ? 'pass' : 'fail');
-        analystTui?.stop();
-        writeHarnessAnalyzeResult(options.context, {
-            scanPlan: options.scanPlan,
-            summary: validation.status === 'pass'
-                ? summarizeHarness(report.graph)
-                : summarizeInvalidAnalystReport(report),
-            report,
-            validation,
-            written,
-            dryRun: false,
-        });
-        return { exitCode: validation.status === 'pass' ? 0 : 1 };
-    }
-    catch (error) {
-        analystTui?.complete('fail');
-        analystTui?.stop();
-        throw error;
-    }
-}
-function buildExternalAnalystEnv(env) {
-    const next = {
-        ...env,
-        MODA_CLI_TELEMETRY: '0',
-        DO_NOT_TRACK: '1',
-    };
-    const analystHome = env.MODA_HARNESS_ANALYST_HOME;
-    if (analystHome && analystHome !== 'true') {
-        next.HOME = analystHome === '~' ? homedir() : analystHome;
-        next.USERPROFILE = next.HOME;
-    }
-    return next;
-}
-function readExternalAnalystReport(rootDir, result, adapter) {
-    const reportPath = resolve(rootDir, HARNESS_REPORT_PATH);
-    if (existsSync(reportPath))
-        return repairExternalAnalystReport(readHarnessReport(reportPath), rootDir);
-    const output = [
-        result.stdout,
-        result.stderr,
-        extractAgentTextFromOutput(result.stdout),
-        extractAgentTextFromOutput(result.stderr),
-    ].filter(Boolean).join('\n');
-    const parsed = extractHarnessReportFromText(output, rootDir);
-    if (parsed)
-        return parsed;
-    throw new CliInputError(`Harness analyst ${adapter} did not return a harness report.`, [
-        `Expected ${HARNESS_REPORT_PATH} or final JSON between ${REPORT_JSON_BEGIN} and ${REPORT_JSON_END}.`,
-        'Retry with the selected coding agent CLI fixed, choose another analyst, or run `moda harness analyze --analyst=local-scan --summary` for deterministic fallback.',
-    ].join('\n'));
-}
-function extractHarnessReportFromText(output, rootDir) {
-    for (const candidate of reportJsonCandidates(output)) {
-        const parsed = parseHarnessReportCandidate(candidate);
-        if (parsed)
-            return repairExternalAnalystReport(parsed, rootDir);
-    }
-    return undefined;
-}
-function reportJsonCandidates(output) {
-    const candidates = [];
-    const markerPattern = new RegExp(`${escapeRegExp(REPORT_JSON_BEGIN)}\\s*([\\s\\S]*?)\\s*${escapeRegExp(REPORT_JSON_END)}`, 'g');
-    for (const match of output.matchAll(markerPattern)) {
-        if (match[1])
-            candidates.push(match[1]);
-    }
-    const fencePattern = /```(?:json)?\s*([\s\S]*?)```/gi;
-    for (const match of output.matchAll(fencePattern)) {
-        if (match[1]?.includes('harness_report.v0.1'))
-            candidates.push(match[1]);
-    }
-    const firstBrace = output.indexOf('{');
-    const lastBrace = output.lastIndexOf('}');
-    if (firstBrace !== -1 && lastBrace > firstBrace) {
-        candidates.push(output.slice(firstBrace, lastBrace + 1));
-    }
-    return candidates;
-}
-function parseHarnessReportCandidate(candidate) {
-    try {
-        const parsed = JSON.parse(candidate.trim());
-        if (isRecord(parsed) && parsed.schemaVersion === 'harness_report.v0.1') {
-            return parsed;
-        }
-    }
-    catch {
-        return undefined;
-    }
-    return undefined;
-}
-export function repairExternalAnalystReport(report, rootDir) {
-    const normalized = normalizeHarnessReport(report);
-    repairCitationLines(normalized, rootDir);
-    // Agent/hosted analysts reliably enumerate prompt/tool artifacts but often omit
-    // the verbatim `body`. Backfill it from source the same way local-scan does so
-    // external reports satisfy the prompt/tool body requirement.
-    hydratePromptAndToolBodies(normalized.graph, rootDir);
-    repairReportSummaryCounts(normalized);
-    return normalized;
-}
-function repairReportSummaryCounts(report) {
-    const graph = report.graph;
-    report.summary = {
-        ...report.summary,
-        runtimeAgentCount: graph.runtimeAgents.length,
-        agentFamilyCount: graph.agentFamilies.length,
-        artifactCount: graph.artifacts.length,
-        sharedArtifactCount: graph.artifacts.filter((artifact) => artifact.scope === 'shared').length,
-        channelAdapterCount: graph.channelAdapters.length,
-        identityNamespaceCount: graph.identityNamespaces.length,
-        environmentCount: graph.environments.length,
-        agentFrameworkCount: graph.agentFrameworks.length,
-        modelProviderCount: graph.modelProviders.length,
-        deploymentCount: graph.deployments.length,
-        relationshipCount: graph.relationships.length,
-        unknownCount: graph.unknowns.length,
-    };
-}
-function repairCitationLines(report, rootDir) {
-    for (const citation of report.citations) {
-        if ((citation.type !== 'file' && citation.type !== 'generated_doc') || !citation.path || !citation.excerpt)
-            continue;
-        const excerpt = citation.excerpt;
-        const candidatePath = resolve(rootDir, citation.path);
-        if (!existsSync(candidatePath))
-            continue;
-        let text;
-        try {
-            text = readFileSync(candidatePath, 'utf8');
-        }
-        catch {
-            continue;
-        }
-        const lines = text.split(/\r?\n/);
-        const currentLine = typeof citation.line === 'number' ? lines[citation.line - 1] : undefined;
-        if (currentLine && citationLineMatches(currentLine, excerpt))
-            continue;
-        const matchedIndex = lines.findIndex((line) => citationLineMatches(line, excerpt));
-        if (matchedIndex >= 0)
-            citation.line = matchedIndex + 1;
-    }
-}
-function citationLineMatches(line, excerpt) {
-    return normalizeComparableLine(line).includes(normalizeComparableLine(excerpt));
-}
-function normalizeComparableLine(value) {
-    return value.replace(/\s+/g, ' ').trim();
-}
-function extractAgentTextFromOutput(output) {
-    const lines = [];
-    for (const line of output.split(/\r?\n/)) {
-        const trimmed = line.trim();
-        if (!trimmed)
-            continue;
-        try {
-            const event = JSON.parse(trimmed);
-            const text = extractTextFromAgentEvent(event);
-            if (text)
-                lines.push(text);
-        }
-        catch {
-            lines.push(trimmed);
-        }
-    }
-    return lines.join('\n');
-}
-function extractTextFromAgentEvent(event) {
-    if (!isRecord(event))
-        return undefined;
-    const directText = stringValue(event.text) ??
-        stringValue(event.message) ??
-        stringValue(event.delta) ??
-        stringValue(event.result);
-    if (directText)
-        return directText;
-    const message = isRecord(event.message) ? event.message : undefined;
-    const messageText = message
-        ? stringValue(message.text) ?? stringValue(message.content)
-        : undefined;
-    if (messageText)
-        return messageText;
-    const content = Array.isArray(message?.content)
-        ? message.content
-        : Array.isArray(event.content)
-            ? event.content
-            : [];
-    const textParts = content
-        .map((part) => {
-        if (!isRecord(part))
-            return undefined;
-        return stringValue(part.text) ?? stringValue(part.content);
-    })
-        .filter((part) => Boolean(part));
-    return textParts.length > 0 ? textParts.join('\n') : undefined;
-}
-function escapeRegExp(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-/**
- * Tool cards must stay one line (same convention as ask-stream's oneLine):
- * collapse whitespace and truncate so multi-line agent prose never spills
- * into a progress line.
- */
-const EVENT_CARD_MAX = 100;
-function eventCardLine(text) {
-    const collapsed = text.replace(/\s+/g, ' ').trim();
-    return collapsed.length > EVENT_CARD_MAX
-        ? `${collapsed.slice(0, EVENT_CARD_MAX - 1)}…`
-        : collapsed;
-}
-/**
- * Translate a parsed coding-agent stream event into a one-line progress card
- * ("editing src/llm/client.ts", "running bun add moda-ai", trimmed agent text).
- * Returns undefined for low-signal events (system noise) so they never reach
- * the user. Shared by the init progress board (via sdk-integration) and the
- * agent-stream analyst progress events below.
- */
-export function describeCodingAgentEvent(event) {
-    if (event.kind === 'tool') {
-        const name = event.toolName ?? 'tool';
-        const detail = event.detail;
-        if (/edit|write|patch|create|notebook/i.test(name)) {
-            return eventCardLine(detail ? `editing ${detail}` : `editing files (${name})`);
-        }
-        if (/bash|shell|exec|command|terminal|run/i.test(name)) {
-            return eventCardLine(detail ? `running ${detail}` : `running a command (${name})`);
-        }
-        if (/read|grep|glob|search|ls|find|cat/i.test(name)) {
-            return eventCardLine(detail ? `reading ${detail}` : `reading files (${name})`);
-        }
-        return eventCardLine(detail ? `using ${name}: ${detail}` : `using ${name}`);
-    }
-    if (event.kind === 'command') {
-        const command = event.detail ?? event.message.replace(/^command\s+/, '');
-        return eventCardLine(`running ${command}`);
-    }
-    if (event.kind === 'agent_text') {
-        const text = eventCardLine(event.message);
-        return text.length > 0 ? text : undefined;
-    }
-    if (event.kind === 'rate_limit')
-        return 'waiting on a provider rate limit';
-    return undefined;
-}
-/**
- * Map a parsed analyst stream event to the `progress` agent event the CLI
- * writes in agent-stream mode. Tool/command events get a `tool_use` phase so
- * downstream consumers (the hosted analyze runner's progress parser counts
- * phases starting with "tool") can track tool-call activity; agent text gets
- * the generic `analyst` phase. Low-signal events map to undefined.
- */
-export function analystEventProgress(event) {
-    const card = describeCodingAgentEvent(event);
-    if (!card)
-        return undefined;
-    return {
-        phase: event.kind === 'tool' || event.kind === 'command' ? 'tool_use' : 'analyst',
-        message: card,
-    };
-}
-function runExternalAnalystProcess(invocation, options) {
-    return new Promise((resolveProcess) => {
-        const child = spawn(invocation.command, invocation.args, {
-            cwd: options.cwd,
-            env: options.env,
-            stdio: ['ignore', 'pipe', 'pipe'],
-        });
-        const startedAt = Date.now();
-        let lastOutputAt = startedAt;
-        let sawOutput = false;
-        let stdout = '';
-        let stderr = '';
-        let timedOut = false;
-        let maxBufferExceeded = false;
-        let settled = false;
-        let eventLineBuffer = '';
-        const progressMs = numericEnv('MODA_HARNESS_ANALYST_PROGRESS_MS', 8_000);
-        const progressTimer = options.progress
-            ? setInterval(() => {
-                const elapsed = Math.max(1, Math.round((Date.now() - startedAt) / 1000));
-                const quietFor = Math.max(0, Math.round((Date.now() - lastOutputAt) / 1000));
-                const status = sawOutput
-                    ? `${quietFor}s since analyst output`
-                    : 'waiting for first analyst output';
-                const message = `Moda Analyst: still investigating (${elapsed}s elapsed, ${status})...`;
-                options.onProgress?.(message, 'analyst_wait');
-                options.tui?.heartbeat({ elapsedSeconds: elapsed, quietForSeconds: quietFor, sawOutput });
-                if (options.progressToStderr) {
-                    process.stderr.write(`${renderHarnessProgress(message)}\n`);
-                }
-            }, progressMs)
-            : undefined;
-        const timeoutTimer = setTimeout(() => {
-            timedOut = true;
-            child.kill('SIGTERM');
-            setTimeout(() => {
-                if (!settled)
-                    child.kill('SIGKILL');
-            }, 5_000).unref();
-        }, options.timeoutMs);
-        const flushEventLines = () => {
-            if (!eventLineBuffer)
-                return;
-            recordExternalAgentEventLine(eventLineBuffer, options);
-            eventLineBuffer = '';
-        };
-        const appendOutput = (stream, chunk) => {
-            sawOutput = true;
-            lastOutputAt = Date.now();
-            const text = chunk.toString('utf8');
-            if (stream === 'stdout')
-                stdout += text;
-            else
-                stderr += text;
-            const wantsEventLines = options.streamEvents && stream === 'stdout' &&
-                (options.inheritedOutput || Boolean(options.onAgentEvent));
-            if (options.inheritedOutput && options.tui && stream === 'stderr') {
-                recordExternalAgentTextChunk(text, options.tui);
-            }
-            else if (wantsEventLines) {
-                eventLineBuffer += text;
-                const lines = eventLineBuffer.split(/\r?\n/);
-                eventLineBuffer = lines.pop() ?? '';
-                for (const line of lines) {
-                    recordExternalAgentEventLine(line, options);
-                }
-            }
-            else if (options.inheritedOutput) {
-                process.stderr.write(chunk);
-            }
-            if (stdout.length + stderr.length > options.maxBuffer && !maxBufferExceeded) {
-                maxBufferExceeded = true;
-                child.kill('SIGTERM');
-            }
-        };
-        child.stdout.on('data', (chunk) => appendOutput('stdout', chunk));
-        child.stderr.on('data', (chunk) => appendOutput('stderr', chunk));
-        child.on('error', (error) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timeoutTimer);
-            if (progressTimer)
-                clearInterval(progressTimer);
-            flushEventLines();
-            resolveProcess({
-                status: null,
-                signal: null,
-                stdout,
-                stderr,
-                error,
-                timedOut,
-                maxBufferExceeded,
-            });
-        });
-        child.on('close', (status, signal) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timeoutTimer);
-            if (progressTimer)
-                clearInterval(progressTimer);
-            flushEventLines();
-            resolveProcess({
-                status,
-                signal,
-                stdout,
-                stderr,
-                timedOut,
-                maxBufferExceeded,
-            });
-        });
-    });
-}
-async function runExternalAnalystWithRetries(invocation, options) {
-    let lastResult;
-    for (let attempt = 1; attempt <= options.maxAttempts; attempt += 1) {
-        if (attempt > 1) {
-            const message = `Moda Analyst: retrying ${analystDisplayName(options.adapter)} after transient provider failure (${attempt}/${options.maxAttempts}).`;
-            options.onProgress?.(message, 'analyst_retry');
-            options.tui?.recordEvent({ kind: 'system', message });
-            if (options.progressToStderr)
-                process.stderr.write(`${renderHarnessProgress(message)}\n`);
-            if (options.backoffMs > 0)
-                await sleep(options.backoffMs);
-        }
-        lastResult = await runExternalAnalystProcess(invocation, options);
-        if (!isRetryableExternalAnalystFailure(lastResult))
-            return lastResult;
-    }
-    return lastResult;
-}
-function isRetryableExternalAnalystFailure(result) {
-    if (result.error || result.timedOut || result.maxBufferExceeded)
-        return false;
-    if (result.status === 0)
-        return false;
-    const output = `${result.stdout}\n${result.stderr}`;
-    return /\b529\b|overloaded|server-side issue|temporar(?:y|ily)|try again|rate limit|too many requests|\b429\b|service unavailable/i.test(output);
-}
-function externalAnalystMaxAttempts(adapter) {
-    const defaultRetries = adapter === 'claude' ? 2 : 1;
-    return 1 + numericEnvAllowZero('MODA_HARNESS_ANALYST_RETRIES', defaultRetries);
-}
-export function sleep(ms) {
-    return new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
-}
-function recordExternalAgentTextChunk(text, tui) {
-    for (const line of text.split(/\r?\n/)) {
-        const message = line.trim();
-        if (!message)
-            continue;
-        tui.recordEvent({ kind: 'system', message: truncateText(message, 500) });
-    }
-}
-function recordExternalAgentEventLine(line, options) {
-    const event = parseExternalAgentEventLine(line);
-    if (!event)
-        return;
-    options.onAgentEvent?.(event);
-    if (!options.inheritedOutput)
-        return;
-    options.tui?.recordEvent(event);
-    if (options.tui)
-        return;
-    const formatted = formatExternalAgentDisplayEvent(event, options.adapter);
-    if (formatted)
-        process.stderr.write(formatted);
-}
-function formatExternalAgentEventLine(line, adapter) {
-    const event = parseExternalAgentEventLine(line);
-    return event ? formatExternalAgentDisplayEvent(event, adapter) : undefined;
-}
-function parseExternalAgentEventLine(line) {
-    const trimmed = line.trim();
-    if (!trimmed)
-        return undefined;
-    try {
-        const event = JSON.parse(trimmed);
-        return parseExternalAgentEvent(event);
-    }
-    catch {
-        return { kind: 'agent_text', message: truncateText(trimmed, 500) };
-    }
-}
-function formatExternalAgentDisplayEvent(event, adapter) {
-    if (event.kind === 'tool')
-        return undefined;
-    return `  ${analystDisplayName(adapter)}: ${event.message}\n`;
-}
-function parseExternalAgentEvent(event) {
-    if (!isRecord(event))
-        return { kind: 'agent_text', message: truncateText(String(event), 500) };
-    const msg = isRecord(event.msg) ? event.msg : undefined;
-    const call = isRecord(event.call) ? event.call : undefined;
-    const type = stringValue(event.type) ?? stringValue(event.event) ?? stringValue(msg?.type);
-    const subtype = stringValue(event.subtype);
-    if (type === 'rate_limit_event')
-        return { kind: 'rate_limit', message: 'rate limit wait' };
-    const toolName = stringValue(event.name) ??
-        stringValue(event.tool_name) ??
-        stringValue(event.toolName) ??
-        stringValue(call?.name);
-    if (toolName && /tool|call|exec|command|bash/i.test(`${type ?? ''} ${subtype ?? ''}`)) {
-        const detail = toolInputDetail(event.input ?? event.arguments ?? call?.input ?? call?.arguments);
-        return { kind: 'tool', toolName, message: `tool ${toolName}`, ...(detail ? { detail } : {}) };
-    }
-    const directText = stringValue(event.text) ??
-        stringValue(event.message) ??
-        stringValue(event.delta) ??
-        stringValue(event.result);
-    if (directText && !isLowSignalEventType(type)) {
-        return { kind: 'agent_text', message: truncateText(firstMeaningfulLine(directText), 500) };
-    }
-    const message = isRecord(event.message) ? event.message : undefined;
-    const messageText = message
-        ? stringValue(message.text) ?? stringValue(message.content)
-        : undefined;
-    if (messageText && !isLowSignalEventType(type)) {
-        return { kind: 'agent_text', message: truncateText(firstMeaningfulLine(messageText), 500) };
-    }
-    const content = Array.isArray(message?.content)
-        ? message.content
-        : Array.isArray(event.content)
-            ? event.content
-            : [];
-    for (const part of content) {
-        const parsed = parseAgentContentPart(part);
-        if (parsed)
-            return parsed;
-    }
-    const command = stringValue(event.command) ?? stringValue(event.cmd);
-    if (command) {
-        return { kind: 'command', message: `command ${truncateText(command, 300)}`, detail: truncateText(command, 300) };
-    }
-    if (type && !isLowSignalEventType(type)) {
-        return { kind: 'system', message: subtype ? `${type}:${subtype}` : type };
-    }
-    return undefined;
-}
-function parseAgentContentPart(part) {
-    if (!isRecord(part))
-        return undefined;
-    const partType = stringValue(part.type);
-    if (partType === 'tool_use' || partType === 'tool_call') {
-        const name = stringValue(part.name) ?? stringValue(part.tool_name);
-        if (!name)
-            return undefined;
-        const detail = toolInputDetail(part.input ?? part.arguments);
-        return { kind: 'tool', toolName: name, message: `tool ${name}`, ...(detail ? { detail } : {}) };
-    }
-    if (partType === 'tool_result' || partType === 'tool_output')
-        return undefined;
-    if (partType === 'text' || partType === 'output_text') {
-        const text = stringValue(part.text) ?? stringValue(part.content);
-        return text ? { kind: 'agent_text', message: truncateText(firstMeaningfulLine(text), 500) } : undefined;
-    }
-    const name = stringValue(part.name) ?? stringValue(part.tool_name);
-    if (name)
-        return { kind: 'tool', toolName: name, message: `tool ${name}` };
-    return undefined;
-}
-/** Pull the most useful one-line detail (file path or command) out of a tool input payload. */
-function toolInputDetail(input) {
-    if (!isRecord(input))
-        return undefined;
-    const value = stringValue(input.file_path) ??
-        stringValue(input.filePath) ??
-        stringValue(input.path) ??
-        stringValue(input.notebook_path) ??
-        stringValue(input.command) ??
-        stringValue(input.cmd) ??
-        stringValue(input.pattern) ??
-        stringValue(input.query);
-    return value ? truncateText(firstMeaningfulLine(value), 300) : undefined;
-}
-function firstMeaningfulLine(value) {
-    return value.split(/\r?\n/).map((line) => line.trim()).find(Boolean) ?? value.trim();
-}
-function isLowSignalEventType(type) {
-    return !type ||
-        type === 'assistant' ||
-        type === 'user' ||
-        type === 'system' ||
-        type === 'session' ||
-        type === 'turn_start' ||
-        type === 'turn_end' ||
-        type === 'tool_use' ||
-        type === 'tool_result' ||
-        type === 'tool_call' ||
-        type === 'tool_output' ||
-        type === 'token_count' ||
-        type === 'usage' ||
-        type.endsWith('_delta');
-}
-function analystDisplayName(adapter) {
-    if (adapter === 'claude')
-        return 'Claude Code';
-    if (adapter === 'cursor')
-        return 'Cursor';
-    return 'Codex';
-}
-function isRecord(value) {
-    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
-}
-function stringValue(value) {
-    return typeof value === 'string' && value.length > 0 ? value : undefined;
-}
-export function summarizeInvalidAnalystReport(report) {
-    if (!report || typeof report !== 'object')
-        return { status: 'invalid_report' };
-    const reportRecord = report;
-    const graph = reportRecord.graph && typeof reportRecord.graph === 'object'
-        ? reportRecord.graph
-        : {};
-    return {
-        status: 'validation_failed',
-        schemaVersion: typeof graph.schemaVersion === 'string' ? graph.schemaVersion : undefined,
-        harnessId: typeof reportRecord.harnessId === 'string'
-            ? reportRecord.harnessId
-            : typeof graph.harnessId === 'string'
-                ? graph.harnessId
-                : undefined,
-        runtimeAgentCount: countArray(graph.runtimeAgents),
-        agentFamilyCount: countArray(graph.agentFamilies),
-        artifactCount: countArray(graph.artifacts),
-        channelAdapterCount: countArray(graph.channelAdapters),
-        identityNamespaceCount: countArray(graph.identityNamespaces),
-        agentFrameworkCount: countArray(graph.agentFrameworks),
-        modelProviderCount: countArray(graph.modelProviders),
-        deploymentCount: countArray(graph.deployments),
-        unknownCount: countArray(graph.unknowns),
-    };
-}
-function countArray(value) {
-    return Array.isArray(value) ? value.length : undefined;
-}
-async function resolveHarnessAnalystAdapter(context) {
-    const requested = normalizeAnalystAdapter(context.flags.analyst);
-    if (requested !== 'auto')
-        return requested;
-    const available = rankHarnessAnalysts(detectAvailableHarnessAnalysts());
-    if (available.length > 0) {
-        writeHumanBlock(context, renderHarnessAnalystChoice({
-            detected: available.map((item) => `${analystDisplayName(item.adapter)} (${item.command})`),
-        }));
-    }
-    if (available.length === 1) {
-        writeHumanProgress(context, `Using ${analystDisplayName(available[0].adapter)} for read-only harness investigation.`);
-        return available[0].adapter;
-    }
-    if (available.length > 1 && shouldPromptForHarnessAnalyst(context)) {
-        return select({
-            message: 'Choose which coding agent should investigate this harness',
-            choices: available.map((item) => ({
-                name: `${analystDisplayName(item.adapter)} (${item.command})`,
-                value: item.adapter,
-            })),
-        });
-    }
-    if (available.length > 1) {
-        writeHumanProgress(context, `Using ${analystDisplayName(available[0].adapter)} for read-only harness investigation. Pass --analyst=claude|codex|cursor to choose explicitly.`);
-        return available[0].adapter;
-    }
-    throw new CliInputError('No external harness analyst CLI was found.', [
-        'Install/sign into Claude Code, Codex, or Cursor, then rerun `moda harness analyze`.',
-        'Set MODA_HARNESS_ANALYST_COMMAND to an explicit analyst command.',
-        'For deterministic debugging only, run `moda harness analyze --analyst=local-scan`.',
-    ].join('\n'));
-}
-function detectAvailableHarnessAnalysts() {
-    return EXTERNAL_ANALYST_ADAPTERS
-        .map((adapter) => ({ adapter, command: resolveAnalystCommand(adapter) }))
-        .filter((item) => Boolean(item.command));
-}
-function rankHarnessAnalysts(analysts) {
-    return [...analysts].sort((a, b) => analystQualityScore(b.adapter) - analystQualityScore(a.adapter));
-}
-function analystQualityScore(adapter) {
-    if (adapter === 'claude')
-        return 3;
-    if (adapter === 'codex')
-        return 2;
-    return 1;
-}
-function shouldPromptForHarnessAnalyst(context) {
-    return context.outputMode === 'human' &&
-        !context.yes &&
-        process.stdin.isTTY === true &&
-        !context.flags['analyst-command'] &&
-        !process.env.MODA_HARNESS_ANALYST_COMMAND;
-}
-/**
- * The analyst spellings that select the deterministic local scanner (no LLM,
- * no remote analyze). Shared by `normalizeAnalystAdapter` and `moda init`'s
- * `resolveHarnessRemote` so the set cannot drift between the two.
- */
-export function isDeterministicLocalAnalyst(raw) {
-    const value = raw?.trim().toLowerCase();
-    return value === 'local-scan' || value === 'local' || value === 'scripted' || value === 'moda';
-}
-function normalizeAnalystAdapter(raw) {
-    const value = (raw && raw !== 'true' ? raw : 'auto').trim().toLowerCase();
-    if (value === 'auto')
-        return 'auto';
-    if (value === 'claude' || value === 'claude-code' || value === 'claude_code')
-        return 'claude';
-    if (value === 'codex' || value === 'codex-cli' || value === 'codex_cli')
-        return 'codex';
-    if (value === 'cursor' || value === 'cursor-cli' || value === 'cursor_cli')
-        return 'cursor';
-    if (isDeterministicLocalAnalyst(value))
-        return 'local-scan';
-    throw new CliInputError(`Unknown harness analyst '${raw}'.`, 'Use `--analyst=claude|codex|cursor|local-scan`.');
-}
-function resolveExternalHarnessAnalystInvocation(options) {
-    const mode = options.mode ?? 'read-only';
-    const override = options.flags['analyst-command'] || process.env.MODA_HARNESS_ANALYST_COMMAND;
-    if (override) {
-        const [command, ...args] = splitCommandLine(override);
-        if (!command) {
-            throw new CliInputError('Analyst command override is empty.');
-        }
-        return { adapter: options.adapter, command, args: [...args, options.prompt], streamEvents: false };
-    }
-    const command = resolveAnalystCommand(options.adapter);
-    if (!command) {
-        throw new CliInputError(`${titleFromId(options.adapter)} analyst CLI was not found.`, `Install/sign into ${titleFromId(options.adapter)}, set MODA_HARNESS_ANALYST_COMMAND, or choose another analyst with --analyst=claude|codex|cursor.`);
-    }
-    if (options.adapter === 'claude') {
-        const extraArgs = externalAnalystExtraArgs(options.adapter);
-        // Write mode auto-accepts edits and unblocks the tools an integration needs
-        // (Edit/Write/Bash for package installs); read-only stays in plan mode with a
-        // safe-Bash allowlist so the harness analyst can never mutate the tree.
-        const permission = mode === 'write'
-            ? ['--permission-mode', 'acceptEdits', '--allowedTools', 'Read,Grep,Glob,Edit,Write,Bash']
-            : ['--permission-mode', 'plan', '--allowedTools', 'Read,Grep,Glob,Bash(pwd),Bash(ls *),Bash(find *),Bash(rg *),Bash(grep *),Bash(cat *),Bash(git status *),Bash(git ls-files *),Bash(git grep *)'];
-        return {
-            adapter: options.adapter,
-            command,
-            args: [
-                '--print',
-                ...extraArgs,
-                ...permission,
-                ...(options.stream ? ['--verbose'] : []),
-                '--output-format',
-                options.stream ? 'stream-json' : 'text',
-                '--no-session-persistence',
-                options.prompt,
-            ],
-            streamEvents: options.stream,
-        };
-    }
-    if (options.adapter === 'codex') {
-        return {
-            adapter: options.adapter,
-            command,
-            args: [
-                'exec',
-                '--skip-git-repo-check',
-                '--sandbox',
-                mode === 'write' ? 'workspace-write' : 'read-only',
-                ...(options.stream ? ['--json'] : []),
-                '-C',
-                options.rootDir,
-                options.prompt,
-            ],
-            streamEvents: options.stream,
-        };
-    }
-    return {
-        adapter: options.adapter,
-        command,
-        args: cursorSubcommandArgs(command, [
-            '--print',
-            '--trust',
-            ...(mode === 'write' ? ['--force'] : ['--mode', 'plan', '--sandbox', 'enabled']),
-            '--workspace',
-            options.rootDir,
-            '--output-format',
-            options.stream ? 'stream-json' : 'text',
-            options.prompt,
-        ]),
-        streamEvents: options.stream,
-    };
-}
-/** Coding-agent CLIs found on PATH, ranked best-first (claude > codex > cursor). */
-export function detectAvailableCodingAgents() {
-    return rankHarnessAnalysts(detectAvailableHarnessAnalysts());
-}
-export function codingAgentDisplayName(adapter) {
-    return analystDisplayName(adapter);
-}
-/** Spawn an installed coding-agent CLI with a prompt; capture its output. */
-export async function runCodingAgent(options) {
-    const stream = options.stream ?? Boolean(options.onAgentEvent);
-    const invocation = resolveExternalHarnessAnalystInvocation({
-        adapter: options.adapter,
-        flags: {},
-        prompt: options.prompt,
-        rootDir: options.rootDir,
-        stream,
-        mode: options.mode,
-    });
-    const timeoutMs = options.timeoutMs ?? numericEnv('MODA_HARNESS_ANALYST_TIMEOUT_MS', 20 * 60 * 1000);
-    const result = await runExternalAnalystWithRetries(invocation, {
-        cwd: options.rootDir,
-        env: buildExternalAnalystEnv(options.env ?? process.env),
-        inheritedOutput: false,
-        timeoutMs,
-        maxBuffer: 20 * 1024 * 1024,
-        progress: Boolean(options.onProgress) || Boolean(options.progressToStderr),
-        progressToStderr: options.progressToStderr ?? false,
-        streamEvents: stream,
-        adapter: invocation.adapter,
-        maxAttempts: externalAnalystMaxAttempts(options.adapter),
-        backoffMs: numericEnvAllowZero('MODA_HARNESS_ANALYST_RETRY_BACKOFF_MS', 6_000),
-        onProgress: options.onProgress,
-        onAgentEvent: options.onAgentEvent,
-    });
-    return {
-        adapter: invocation.adapter,
-        command: invocation.command,
-        status: result.status,
-        stdout: result.stdout,
-        stderr: result.stderr,
-        timedOut: result.timedOut,
-        failedToStart: Boolean(result.error),
-    };
-}
-function externalAnalystExtraArgs(adapter) {
-    return splitCommandLine(process.env[`MODA_HARNESS_ANALYST_${adapter.toUpperCase()}_ARGS`] ?? '');
-}
-function renderExternalHarnessAnalystPrompt(options) {
-    return [
-        'You are Moda Analyst, investigating an agent harness for Moda CLI onboarding.',
-        '',
-        'Do real repository investigation. Do not call `moda harness scan`, `moda harness analyze`, or rely on deterministic Moda scanner output.',
-        'Only inspect the Repository root named below and files/directories under it. Do not inspect parent directories, sibling projects, the Moda CLI implementation, or this monorepo unless the Repository root itself is that directory.',
-        'Inspect package manifests, source files, prompt files, tool definitions, skills/rules, evals, deployment config, and README/AGENTS docs as needed.',
-        'Do not read secret-looking files such as .env files, private keys, credential files, or token stores.',
-        'You are running as a read-only analyst. Do not edit source files, configuration files, git state, dependency files, or project metadata.',
-        'Prefer printing the final report JSON for Moda CLI to validate and write. If your runtime unexpectedly allows file writes, only `.moda/harness-report.json` is permitted.',
-        '',
-        'Your task:',
-        renderExternalAnalystProtocol(),
-        '1. Identify the runtime agent harnesses, agent families, channel adapters, identity mappings, model providers, frameworks, deployments, and open questions.',
-        '2. Exhaustively enumerate EVERY prompt, tool, guardrail, and eval as its own graph artifact — the complete inventory, not a sample. This report feeds prompt optimization and tool optimization, so a missing tool or prompt is a real defect. Runtime agents may be modeled representatively on framework/example repos, but prompts and tools must be complete.',
-        '3. Cite every narrative claim with local file paths, exact line numbers, and excerpts. File citations without line numbers are invalid for agent-authored reports. Enumerated artifacts only need evidence:[{path, reason}], so completeness of the artifact inventory is not limited by the citation cap.',
-        `4. After completing investigation, print the report JSON between ${REPORT_JSON_BEGIN} and ${REPORT_JSON_END}. Moda CLI will validate it and write the local artifacts.`,
-        'Your final response must contain the sentinel-wrapped JSON report. Do not end with commentary about being read-only, do not summarize without JSON, and do not omit the sentinel markers.',
-        'If the repository is very large, keep enumerating prompts/tools/guardrails/evals as artifacts (uncapped) and only summarize runtime AGENTS representatively — do not drop tools or prompts to save space.',
-        '',
-        'Final output format:',
-        REPORT_JSON_BEGIN,
-        '{',
-        '  "...": "valid harness_report.v0.1 JSON"',
-        '}',
-        REPORT_JSON_END,
-        '',
-        'The report must be JSON with this top-level contract:',
-        '- schemaVersion: "harness_report.v0.1"',
-        '- reportId, harnessId, createdAt',
-        `- analyst: { "id": "moda-${options.adapter}-analyst", "adapter": "${options.adapter}", "mode": "agent", "version": "cli" }`,
-        '- repo: { root: ".", name, packageManagers, languages }',
-        '- source: { graphSchemaVersion: "harness.v0.1", graphHash: "", readPlan, deterministicInventory: false }',
-        '- summary: numeric fields named runtimeAgentCount, agentFamilyCount, artifactCount, sharedArtifactCount, channelAdapterCount, identityNamespaceCount, environmentCount, agentFrameworkCount, modelProviderCount, deploymentCount, relationshipCount, unknownCount',
-        '- graph: an exact sanitized harness.v0.1 graph with arrays for agentFamilies, runtimeAgents, developerAgentAdapters, channelAdapters, artifacts, identityNamespaces, environments, agentFrameworks, modelProviders, deployments, relationships, unknowns',
-        '- claims: cited claims about graph items. Each claim must include kind, subjectId, title, summary, confidence, inference, and citationIds; kind should be one of runtime_agent, agent_family, developer_agent_adapter, artifact, channel_adapter, identity_namespace, environment, agent_framework, model_provider, deployment, relationship, unknown. subjectId should be the id of the runtime agent, agent family, developer adapter, artifact, provider, adapter, deployment, relationship, or unknown being claimed.',
-        '- citations: evidence records with id, type, reason, and excerpt. For type:"file" or type:"generated_doc", include path, line, reason, and excerpt matching that exact line. You may also use type:"command_output" or type:"production_evidence" with excerpt when evidence came from a command or production source.',
-        `- syncPlan: { command: "moda harness sync --from-report ${HARNESS_REPORT_PATH}", dryRunCommand: "moda harness sync --from-report ${HARNESS_REPORT_PATH} --dry-run", uploads: string[], privacy: string[] }`,
-        '- unknowns: report-level open questions with id, question, and citationIds',
-        '',
-        'Use exact field names and numeric confidence values from 0 to 1. Do not write string confidence values like "high". Do not use confidence >= 0.90 unless the claim is direct evidence from the cited line(s).',
-        'Each graph item with evidence must use evidence: [{ path, reason }], not citationIds/citations.',
-        'Runtime agents must include id, name, kind:"runtime_agent", root, entrypointIds, channelAdapterIds, artifactIds, identityNamespaceIds, deploymentIds, frameworkIds, modelProviderIds, confidence, evidence.',
-        'Artifacts must include id, type, name, scope, usedByAgentIds, confidence, evidence, and optional sourcePath/contentHash/ownedByAgentId. Emit one artifact PER tool, PER prompt (including each inline system prompt), PER guardrail, and PER eval — enumerate them all; artifact types are entrypoint, prompt, tool, skill, eval, retrieval_index, memory, guardrail, model_config, unknown.',
-        'Also set `body` on each artifact to its actual usable content so it can be consumed downstream WITHOUT re-reading the repo: for `prompt` the COMPLETE prompt text verbatim (full inline `instructions=`/system-prompt string or full prompt file); for `tool` the signature (name + parameters + types) and its docstring/description; for `guardrail` the rule/condition; for `eval` what it asserts; for `model_config` the configuration values. Copy the text in full — do not summarize or truncate `body` (it is the artifact we optimize). Redact any secret literals.',
-        'For every `prompt` and `tool` artifact, at least one evidence entry MUST pin an exact source location so downstream optimization can retrieve the item text: carry a numeric `line` (the definition line, or the first line of the range) — evidence: [{ path, line, reason }]. The only exception is an artifact whose entire dedicated file is the text (e.g. a standalone prompt file); set its sourcePath and cite that same file and no line is required. When a single file holds multiple inline prompts or tool definitions, give each its own distinct line — a bare { path, reason } is a defect there.',
-        'Agent families must include id, name, runtimeAgentIds, sharedArtifactIds, confidence, evidence.',
-        'Frameworks/providers must include packageNames and runtimeAgentIds arrays; providers also include envVars and modelHints arrays.',
-        'Unknowns in graph must include id, question, candidateIds, evidence. Report-level unknowns must include id, question, citationIds.',
-        'Do not make every claim about the repo or harness id. Claims should name the specific graph item they support.',
-        '',
-        'Set source.graphHash to an empty string if you cannot compute Moda stable graph hashing; Moda CLI will still validate citations and schema.',
-        options.tenantId ? `Tenant ID to include in graph.tenant: ${options.tenantId}` : 'No tenant ID was provided for this analysis.',
-        `Repository root: ${options.rootDir}`,
-        renderAnalystPreflightSection(options.rootDir),
-        '',
-        'Be conservative. If something is unclear, put it in unknowns instead of inventing an agent.',
-    ].filter(Boolean).join('\n');
-}
-function renderExternalAnalystProtocol() {
-    const protocol = process.env.MODA_HARNESS_ANALYST_PROTOCOL?.trim().toLowerCase();
-    if (protocol === 'classic' || protocol === 'none' || protocol === '0')
-        return '';
-    return [
-        'Focused investigation protocol:',
-        '- First build a quick repo map with read-only commands such as pwd, git ls-files, rg, and targeted manifest/doc reads.',
-        '- EXHAUSTIVELY enumerate every prompt, tool, guardrail, eval, memory/retrieval store, and model config in the repository — one graph artifact each. This inventory feeds downstream prompt optimization and tool optimization, so completeness matters more than brevity: do NOT stop at representative examples and do NOT sample.',
-        '- Tools: emit a `tool` artifact for EVERY tool definition — each `@function_tool` / `function_tool(...)`-decorated function, every hosted/first-party tool class (e.g. WebSearchTool, FileSearchTool, ComputerTool, CodeInterpreterTool, HostedMCPTool, ImageGenerationTool, LocalShellTool), and every `tool({...})` / `createTool(...)` / `new *Tool(...)` factory. Name each artifact after the tool/function and cite its definition line.',
-        '- Prompts: emit a `prompt` artifact for EVERY distinct prompt — dedicated prompt files AND inline system prompts (`instructions=`, `system=`, `SYSTEM_PROMPT`, prompt-template strings), one per agent/definition, each with its exact file+line location so the prompt text can be retrieved and optimized later.',
-        '- Also emit artifacts for guardrails (type "guardrail"), evals/tests-of-agents (type "eval"), memory/session stores (type "memory"), retrieval indexes (type "retrieval_index"), and model configuration (type "model_config").',
-        '- Only runtime AGENTS may be modeled representatively: if the repo is a framework/SDK/examples collection, you need not treat every example as a distinct production agent — but you MUST still enumerate every distinct tool, prompt, guardrail, and eval as its own artifact.',
-        '- Each enumerated artifact needs evidence: [{ path, reason }] (file path + short reason); a full line+excerpt citation is required only for the narrative `claims`, NOT for every artifact — so listing hundreds of tools/prompts is cheap and expected.',
-        '- Capture the actual usable content in each artifact\'s `body`: full prompt text for prompts, signature+docstring for tools, the rule for guardrails, the assertion for evals, config values for model configs. This inventory is consumed directly for optimization, so `body` must be the complete text (verbatim, not summarized), with secret literals redacted.',
-        '- EXCEPTION — `prompt` and `tool` artifacts MUST pin an exact location: put a numeric `line` on at least one evidence entry (evidence: [{ path, line, reason }]) at the definition line. That structured location is what lets downstream optimization retrieve the exact prompt/tool text; when one file has several inline prompts or tools, each artifact gets its own line. The only case that needs no line is a whole dedicated file whose entire content is the artifact (set sourcePath to that file and cite it). Still no excerpt required — just the line.',
-        '- For every runtime agent, read and cite at least one concrete entrypoint or orchestration line, and link its prompts/tools via artifactIds.',
-        '- Keep going until every prompt, tool, guardrail, and eval in scope is represented as an artifact. Use unknowns only for genuinely ambiguous items — never to skip enumeration. Respect the hard caps (<=250 claims, <=400 citations): artifacts are uncapped, so when there are many items keep enumerating them as artifacts and reserve claims/citations for the most important ones.',
-    ].join('\n');
-}
-function renderAnalystPreflightSection(rootDir) {
-    if (process.env.MODA_HARNESS_ANALYST_PREFLIGHT !== '1')
-        return '';
-    const paths = listAnalystPreflightPaths(rootDir);
-    if (paths.length === 0)
-        return '';
-    const groups = {
-        manifests: paths.filter((path) => isManifestLikePath(path)).slice(0, 60),
-        docs: paths.filter((path) => isDocLikePath(path)).slice(0, 40),
-        source: paths.filter((path) => isAgentNavigationPath(path)).slice(0, 160),
-        deploy: paths.filter((path) => isPreflightDeployLikePath(path)).slice(0, 50),
-        evals: paths.filter((path) => isPreflightEvalLikePath(path)).slice(0, 50),
-    };
-    const lines = [
-        '',
-        'Navigation aid (not evidence):',
-        'Moda generated this path-only map to help you navigate faster. Do not cite it and do not trust it for claims. Read the real files and cite exact lines before asserting anything.',
-        ...renderPreflightGroup('Manifests/config', groups.manifests),
-        ...renderPreflightGroup('Docs/rules', groups.docs),
-        ...renderPreflightGroup('Likely source/prompt/tool paths', groups.source),
-        ...renderPreflightGroup('Deploy/CI', groups.deploy),
-        ...renderPreflightGroup('Evals/tests', groups.evals),
-    ];
-    return lines.join('\n');
-}
-function renderPreflightGroup(label, paths) {
-    if (paths.length === 0)
-        return [];
-    return [`${label}:`, ...paths.map((path) => `- ${path}`)];
-}
-function listAnalystPreflightPaths(rootDir) {
-    const gitPaths = readGitTrackedPaths(rootDir);
-    const paths = gitPaths.length > 0 ? gitPaths : readDirectoryPreflightPaths(rootDir);
-    return [...new Set(paths.map(normalizePath))]
-        .filter((path) => path && !shouldSkipPreflightPath(path))
-        .sort();
-}
-function readGitTrackedPaths(rootDir) {
-    try {
-        return execFileSync('git', ['ls-files', '-co', '--exclude-standard'], {
-            cwd: rootDir,
-            encoding: 'utf8',
-            maxBuffer: 4 * 1024 * 1024,
-        }).split(/\r?\n/).filter(Boolean);
-    }
-    catch {
-        return [];
-    }
-}
-function readDirectoryPreflightPaths(rootDir) {
-    const paths = [];
-    const stack = ['.'];
-    while (stack.length > 0 && paths.length < 2_000) {
-        const current = stack.pop() ?? '.';
-        const absolute = current === '.' ? rootDir : join(rootDir, current);
-        let entries;
-        try {
-            entries = readdirSync(absolute);
-        }
-        catch {
-            continue;
-        }
-        for (const entry of entries) {
-            const child = current === '.' ? entry : `${current}/${entry}`;
-            if (shouldSkipPreflightPath(child))
-                continue;
-            const childAbsolute = join(rootDir, child);
-            let stat;
-            try {
-                stat = lstatSync(childAbsolute);
-            }
-            catch {
-                continue;
-            }
-            if (stat.isSymbolicLink())
-                continue;
-            if (stat.isDirectory()) {
-                stack.push(child);
-            }
-            else {
-                paths.push(child);
-            }
-        }
-    }
-    return paths;
-}
-function shouldSkipPreflightPath(path) {
-    const normalized = normalizePath(path);
-    if (!normalized || normalized.startsWith('.moda/'))
-        return true;
-    const parts = normalized.split('/');
-    if (parts.some((part) => SKIPPED_DIRS.has(part)))
-        return true;
-    return isSecretishPath(normalized);
-}
-function isManifestLikePath(path) {
-    const name = basename(path).toLowerCase();
-    return /^(package\.json|pyproject\.toml|requirements.*\.txt|uv\.lock|poetry\.lock|pnpm-lock\.yaml|bun\.lockb?|yarn\.lock|cargo\.toml|go\.mod|deno\.json|turbo\.json|langgraph\.json|agents\.json|config\.(ts|js|json|yaml|yml|toml))$/.test(name);
-}
-function isDocLikePath(path) {
-    const lower = path.toLowerCase();
-    return /(^|\/)(readme|agents|claude|cursor|codex|rules|skills?)(\.[\w-]+)?$/.test(lower) ||
-        lower.includes('/skills/') ||
-        lower.includes('/rules/');
-}
-function isAgentNavigationPath(path) {
-    const lower = path.toLowerCase();
-    return /\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs|cs|java|kt|rb|php|md|yaml|yml|toml|json)$/.test(lower) &&
-        /(agent|assistant|harness|prompt|tool|workflow|graph|model|provider|llm|chat|completion|planner|research|memory|eval|guardrail|router|orchestr|crew|swarm|bot)/.test(lower);
-}
-function isPreflightDeployLikePath(path) {
-    const lower = path.toLowerCase();
-    return lower.startsWith('.github/workflows/') ||
-        lower.includes('/deploy') ||
-        lower.includes('/docker') ||
-        /(dockerfile|compose\.ya?ml|vercel\.json|netlify\.toml|wrangler\.toml|modal\.py|fly\.toml|render\.ya?ml)$/.test(lower);
-}
-function isPreflightEvalLikePath(path) {
-    const lower = path.toLowerCase();
-    return /(^|\/)(test|tests|eval|evals|bench|benchmarks|fixtures)(\/|$)/.test(lower) ||
-        lower.includes('eval') ||
-        lower.includes('benchmark');
-}
-function resolveAnalystCommand(adapter) {
-    const envSpecific = process.env[`MODA_HARNESS_ANALYST_${adapter.toUpperCase()}_COMMAND`];
-    if (envSpecific)
-        return splitCommandLine(envSpecific)[0];
-    if (adapter === 'claude')
-        return findOnPath('claude');
-    if (adapter === 'codex')
-        return findOnPath('codex') || findOnPath('/Applications/Codex.app/Contents/Resources/codex');
-    return findOnPath('cursor-agent') ||
-        findOnPath('cursor-cli') ||
-        findOnPath('cursor') ||
-        findOnPath('/Applications/Cursor.app/Contents/Resources/app/bin/cursor');
-}
-function cursorSubcommandArgs(command, args) {
-    const name = basename(command);
-    return name === 'cursor' || name === 'cursor-cli' ? ['agent', ...args] : args;
-}
-function findOnPath(command) {
-    if (command.includes('/') && existsSync(command))
-        return command;
-    for (const dir of (process.env.PATH ?? '').split(delimiter).filter(Boolean)) {
-        const candidate = join(dir, command);
-        if (existsSync(candidate))
-            return candidate;
-    }
-    return undefined;
-}
-function splitCommandLine(commandLine) {
-    return commandLine.trim().split(/\s+/).filter(Boolean);
-}
-export function truncateText(value, maxLength) {
-    const compact = value.replace(/\s+/g, ' ').trim();
-    return compact.length > maxLength ? `${compact.slice(0, maxLength - 1)}...` : compact;
-}
-export function scanHarness(options = {}) {
-    const rootDir = resolve(options.rootDir ?? process.cwd());
-    const skipped = [];
-    const files = inventoryFiles(rootDir, skipped);
-    const annotations = files.flatMap((file) => parseAnnotations(file));
-    const repo = detectRepo(rootDir, files);
-    const readPlan = buildHarnessReadPlan(rootDir, options.pathWasExplicit === true);
-    const graph = {
-        schemaVersion: SCHEMA_VERSION,
-        harnessId: stableId('harness', repo.name || basename(rootDir) || 'repo'),
-        tenant: options.tenantId
-            ? {
-                tenantId: options.tenantId,
-                source: options.tenantSource ?? 'scan_option',
-            }
-            : undefined,
-        repo,
-        scan: {
-            createdAt: new Date().toISOString(),
-            scannerVersion: options.scannerVersion ?? 'moda-cli',
-            mode: options.dryRun ? 'dry-run' : 'permissioned',
-            rootPaths: ['.'],
-            readPlan,
-            skipped,
-        },
-        agentFamilies: [],
-        runtimeAgents: [],
-        developerAgentAdapters: detectDeveloperAgentAdapters(files),
-        channelAdapters: [],
-        artifacts: [],
-        identityNamespaces: [],
-        environments: detectEnvironments(files),
-        agentFrameworks: detectAgentFrameworks(files),
-        modelProviders: detectModelProviders(files),
-        deployments: [],
-        relationships: [],
-        unknowns: [],
-    };
-    applyAnnotations(graph, annotations);
-    applyHeuristics(graph, files);
-    linkFrameworksAndProviders(graph);
-    finalizeGraph(graph);
-    hydratePromptAndToolBodies(graph, rootDir);
-    enrichScanCaptureMetadata(graph);
-    return graph;
-}
-export function summarizeHarness(graph) {
-    return {
-        schemaVersion: graph.schemaVersion,
-        harnessId: graph.harnessId,
-        tenantId: graph.tenant?.tenantId,
-        runtimeAgentCount: graph.runtimeAgents.length,
-        agentFamilyCount: graph.agentFamilies.length,
-        sharedArtifactCount: graph.artifacts.filter((artifact) => artifact.scope === 'shared').length,
-        channelAdapterCount: graph.channelAdapters.length,
-        identityNamespaceCount: graph.identityNamespaces.length,
-        agentFrameworkCount: graph.agentFrameworks.length,
-        modelProviderCount: graph.modelProviders.length,
-        deploymentCount: graph.deployments.length,
-        unknownCount: graph.unknowns.length,
-    };
-}
-/** Skip reasons that mean a file was dropped for exceeding a size/budget cap. */
-function isSnapshotBudgetSkip(reason) {
-    return reason === 'file too large for harness scan' ||
-        reason === 'scan text budget exceeded';
-}
-/**
- * Serialized-file budget for a {@link SourceSnapshot}, kept under the ingest
- * proxy's 5MB request-body cap (`MAX_ANALYZE_BODY_BYTES` in
- * apps/moda-ingest-worker) with ~500KB of headroom for the JSON envelope. The
- * raw inventory text budget (48MB) is far larger, so this is the binding limit.
- */
-const MAX_SNAPSHOT_BODY_BYTES = 4_500_000;
-/**
- * Build a safe source snapshot of `rootDir` by reusing the permissioned
- * `inventoryFiles` walk (secret-skip, symlink-skip, 512KB/file, 12k-file/48MB
- * caps) plus `detectRepo`/`getGitCommit`. Only files with text content are
- * included; `truncated` is set when the scan dropped any file for a size/budget
- * cap so the server knows the snapshot is incomplete.
- */
-export function buildSourceSnapshot(rootDir) {
-    const root = resolve(rootDir);
-    const skipped = [];
-    const files = inventoryFiles(root, skipped);
-    const repo = detectRepo(root, files);
-    const includedFiles = [];
-    let byteCount = 0;
-    let serializedBytes = 0;
-    let truncatedBySize = false;
-    for (const item of files) {
-        if (item.text === undefined)
-            continue;
-        const file = { path: item.path, text: item.text };
-        // Bound the SERIALIZED upload, not just the raw inventory text: the ingest
-        // proxy caps the request body at MAX_ANALYZE_BODY_BYTES (5MB) while the
-        // inventory text budget (48MB) is far larger. Account for JSON encoding
-        // (keys, quotes, escaping, and the array comma) so a large repo produces a
-        // `truncated` snapshot that still uploads instead of failing with HTTP 413.
-        const cost = Buffer.byteLength(JSON.stringify(file), 'utf8') + 1;
-        if (serializedBytes + cost > MAX_SNAPSHOT_BODY_BYTES) {
-            truncatedBySize = true;
-            break;
-        }
-        includedFiles.push(file);
-        serializedBytes += cost;
-        byteCount += Buffer.byteLength(item.text, 'utf8');
-    }
-    const gitCommit = getGitCommit(root);
-    return {
-        repo: { name: repo.name, root: '.' },
-        files: includedFiles,
-        truncated: truncatedBySize || skipped.some((skip) => isSnapshotBudgetSkip(skip.reason)),
-        fileCount: includedFiles.length,
-        byteCount,
-        ...(gitCommit ? { gitCommit } : {}),
-    };
-}
-function buildCommandScanPlan(context, rootDir) {
-    const explicitPath = context.flags.path !== undefined;
-    const rel = normalizePath(relative(context.cwd, rootDir)) || '.';
-    const scope = explicitPath && rel !== '.' ? 'narrow' : 'broad';
-    const machineReadable = context.outputMode !== 'human';
-    const approvalRequired = context.positional === 'analyze' && scope === 'broad' && !context.yes;
-    return {
-        scope,
-        root: rel,
-        approval: {
-            required: approvalRequired,
-            granted: !approvalRequired,
-            reason: approvalRequired
-                ? 'broad scan requires confirmation'
-                : context.yes
-                    ? '--yes'
-                    : machineReadable
-                        ? 'machine-readable output'
-                        : scope === 'narrow'
-                            ? 'narrow path'
-                            : 'non-interactive terminal',
-        },
-        readPlan: buildHarnessReadPlan(rootDir, explicitPath),
-    };
-}
-async function approveScanIfNeeded(scanPlan, options = {}) {
-    if (!scanPlan.approval.required)
-        return;
-    if (options.context && (options.context.outputMode !== 'human' || process.stdin.isTTY !== true)) {
-        throw new CliInputRequiredError(options.message ?? 'Scan this project to build a Moda harness manifest?', {
-            id: 'harness_scan_approval',
-            question: options.message ?? 'Scan this project to build a Moda harness manifest?',
-            kind: 'confirm',
-            choices: [
-                { value: 'yes', label: 'Approve broad scan', resume_flags: ['--yes'] },
-                { value: 'no', label: 'Decline broad scan', resume_flags: ['--path', scanPlan.root === '.' ? './src' : scanPlan.root] },
-            ],
-            resume_command: ['moda', 'harness', 'analyze', '--yes'],
-        }, 'Re-run with `--yes` to approve the broad local read plan, or pass --path=<dir> for a narrower scan.');
-    }
-    if (options.context?.outputMode === 'human') {
-        writeHumanBlock(options.context, renderHarnessAnalystPreflight({
-            root: scanPlan.root,
-            willRead: scanPlan.readPlan.willRead,
-            willSkip: scanPlan.readPlan.willSkip,
-        }));
-    }
-    const approved = await confirm({
-        message: options.message ?? 'Scan this project to build a Moda harness manifest?',
-        default: true,
-    });
-    scanPlan.approval.granted = approved;
-    scanPlan.approval.reason = approved ? 'confirmed by user' : 'declined by user';
-    if (!approved) {
-        throw new CliInputError(options.declinedMessage ?? 'Harness scan was not approved.', options.declinedHint ?? 'Run `moda harness scan --path=<dir>` for a narrower scan, or rerun with `--yes` after reviewing the read plan.');
-    }
-}
-/**
- * Interactive confirmation gate for `harness delete`. `--yes` skips it; in
- * machine-readable modes or without a TTY the command refuses with a
- * resumable input-required error instead of prompting (same posture as the
- * broad-scan approval above) so agents/CI never hang on stdin.
- */
-async function confirmHarnessDelete(context, idOrKey) {
-    if (context.yes)
-        return;
-    const message = `Permanently delete harness '${idOrKey}' and all of its synced versions from Moda Cloud?`;
-    if (context.outputMode !== 'human' || process.stdin.isTTY !== true) {
-        throw new CliInputRequiredError(message, {
-            id: 'harness_delete_approval',
-            question: message,
-            kind: 'confirm',
-            choices: [
-                { value: 'yes', label: 'Delete harness', resume_flags: ['--yes'] },
-                { value: 'no', label: 'Keep harness', resume_flags: [] },
-            ],
-            resume_command: ['moda', 'harness', 'delete', idOrKey, '--yes'],
-        }, 'Re-run with `--yes` to confirm the deletion.');
-    }
-    const approved = await confirm({ message, default: false });
-    if (!approved) {
-        throw new CliInputError('Harness delete was not approved.', 'Re-run with `--yes` to skip the prompt, or leave the harness in place.');
-    }
-}
-export function writeHumanProgress(context, message) {
-    if (context.outputMode !== 'human')
-        return;
-    if (context.quiet && context.flags.progress !== 'true')
-        return;
-    console.error(renderHarnessProgress(message));
-}
-function writeHumanBlock(context, message) {
-    if (context.outputMode !== 'human')
-        return;
-    if (context.quiet && context.flags.progress !== 'true')
-        return;
-    console.error(message);
-}
-function buildHarnessReadPlan(rootDir, pathWasExplicit) {
-    return {
-        scope: pathWasExplicit ? 'narrow' : 'broad',
-        rootPaths: [normalizePath(relative(rootDir, rootDir)) || '.'],
-        willRead: [
-            'package manifests',
-            'source files under the selected path',
-            'prompt files',
-            'tool definitions',
-            'skill/rule files',
-            'eval/test files',
-            'deployment and CI config',
-        ],
-        willSkip: [
-            'secret-looking files',
-            'symlinks',
-            'node_modules and build output',
-            '.moda runtime files',
-            'large files over 512KB',
-        ],
-        skipsSecretFiles: true,
-        followsSymlinks: false,
-        uploadsSourceByDefault: false,
-    };
-}
-function resolveHarnessTenant(flags, context) {
-    const flagTenant = flags['tenant-id'] || flags.tenant;
-    if (flagTenant && flagTenant !== 'true') {
-        return {
-            tenantId: flagTenant,
-            source: 'flag',
-        };
-    }
-    const tenantId = resolveTenantId({ profile: context?.profile, env: context?.env });
-    if (!tenantId)
-        return undefined;
-    return {
-        tenantId,
-        source: 'env_or_config',
-    };
-}
-function createHarnessSyncPlan(options) {
-    const profile = getActiveProfile({
-        profile: options.context.profile,
-        env: options.context.env,
-    });
-    const tenantId = options.graph.tenant?.tenantId ??
-        resolveTenantId({ profile: options.context.profile, env: options.context.env });
-    return {
-        endpoint: '/api/harnesses/sync',
-        resource: 'harness',
-        source: options.source,
-        profile: profile.name,
-        tenantId,
-        rootPath: options.rootDir,
-        sourceCommit: options.sourceCommit,
-        harnessId: options.graph.harnessId,
-        localGraphHash: options.localGraphHash,
-        counts: syncCounts(options.graph),
-        uploads: options.source === 'approved_report'
-            ? [
-                'approved harness graph metadata',
-                'runtime agents, families, artifacts, relationships, citations-derived graph shape',
-                'graph hash and source commit',
-            ]
-            : [
-                'harness graph metadata',
-                'runtime agents, families, artifacts, relationships',
-                'graph hash and source commit',
-            ],
-        localWrites: options.localWrites,
-        privacy: [
-            'No secret-looking files are read by the harness scanner.',
-            'Source file contents are not uploaded by harness sync by default.',
-            'Prompt/tool/skill artifacts sync as metadata, ids, paths, hashes, and relationships unless a separate resource command uploads content.',
-        ],
-    };
-}
-function plannedHarnessArtifactWrites(context) {
-    return context.flags.summary === 'true'
-        ? [HARNESS_PATH, HARNESS_SUMMARY_PATH, SYNC_STATE_PATH]
-        : [HARNESS_PATH, SYNC_STATE_PATH];
-}
-function syncCounts(graph) {
-    return {
-        runtimeAgents: graph.runtimeAgents.length,
-        agentFamilies: graph.agentFamilies.length,
-        developerAgentAdapters: graph.developerAgentAdapters.length,
-        channelAdapters: graph.channelAdapters.length,
-        artifacts: graph.artifacts.length,
-        identityNamespaces: graph.identityNamespaces.length,
-        environments: graph.environments.length,
-        agentFrameworks: graph.agentFrameworks.length,
-        modelProviders: graph.modelProviders.length,
-        deployments: graph.deployments.length,
-        relationships: graph.relationships.length,
-        unknowns: graph.unknowns.length,
-    };
-}
-function plannedDryRunRemote(plan) {
-    return {
-        tenantId: plan.tenantId ?? 'unresolved',
-        harnessId: plan.harnessId,
-        harnessKey: plan.harnessId,
-        versionId: '',
-        graphHash: plan.localGraphHash,
-        changed: false,
-        dryRun: true,
-        counts: plan.counts,
-    };
-}
-async function syncHarnessWithRemote(context, body) {
-    assertHarnessGraphSyncSize(body.graph);
-    const profileOptions = { profile: context.profile, env: context.env };
-    const hasApiKey = Boolean(resolveApiKey(profileOptions));
-    if (context.dryRun && !hasApiKey)
-        return undefined;
-    return await callControlAPI('/harnesses/sync', {
-        method: 'POST',
-        body: JSON.stringify({
-            ...body,
-            dryRun: context.dryRun,
-        }),
-    }, profileOptions);
-}
-export function readHarnessSyncState(rootDir) {
-    const path = join(rootDir, SYNC_STATE_PATH);
-    if (!existsSync(path))
-        return undefined;
-    try {
-        const parsed = JSON.parse(readFileSync(path, 'utf8'));
-        if (!isRecord(parsed) || parsed.schemaVersion !== 'sync_state.v0.1') {
-            return undefined;
-        }
-        return parsed;
-    }
-    catch {
-        return undefined;
-    }
-}
-function writeHarnessSyncState(rootDir, state) {
-    const path = join(rootDir, SYNC_STATE_PATH);
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, `${JSON.stringify(state, null, 2)}\n`);
-    return SYNC_STATE_PATH;
-}
-function selectedRuntimeAgentId(flags) {
-    if (flags['agent-id'])
-        return flags['agent-id'];
-    if (flags.agent && flags.agent !== 'true')
-        return flags.agent;
-    return undefined;
-}
-function loadOrScanHarness(rootDir, tenant, context) {
-    const manifestPath = join(rootDir, HARNESS_PATH);
-    if (existsSync(manifestPath))
-        return readHarnessGraph(manifestPath);
-    // Provenance banner: without a persisted manifest this command output comes
-    // from a live scan of the current directory, which is easy to mistake for
-    // synced/account data (especially right after switching repos or profiles).
-    if (context) {
-        writeHarnessNotice(context, `No ${HARNESS_PATH} found; showing a live scan of ${rootDir}. ` +
-            'This is local scan output, NOT synced or account data. ' +
-            'Run `moda harness scan` to persist it and `moda harness sync` to upload it.');
-    }
-    return scanHarness({
-        rootDir,
-        tenantId: tenant?.tenantId,
-        tenantSource: tenant?.source,
-    });
-}
-/**
- * Warning line that must be visible in every output mode: styled progress on
- * stderr for humans, a plain `Warning:` stderr line for machine modes (stdout
- * stays machine-readable JSON either way). Quiet suppresses it like the rest
- * of the harness progress surface.
- */
-function writeHarnessNotice(context, message) {
-    if (context.quiet && context.flags.progress !== 'true')
-        return;
-    if (context.outputMode === 'human') {
-        console.error(renderHarnessProgress(message, 'warning'));
-        return;
-    }
-    console.error(`Warning: ${message}`);
-}
-/**
- * The identity a sync-style upload will actually authenticate as, resolved
- * with the same precedence as the API call itself (MODA_API_KEY env wins over
- * the active profile / legacy config). Used for the pre-upload
- * "Syncing as <credential> → tenant <id>" banner so a shadowed or stale key
- * is visible BEFORE data lands in the wrong tenant.
- *
- * The destination tenant is derived from the WINNING KEY itself (signed CLI
- * keys embed their tenant, and the server resolves the destination from the
- * key alone) — never from flag/env/profile config, which is exactly what a
- * shadowing stale key disagrees with. When the key does not embed a tenant,
- * the config-resolved id is returned with `tenantSource: 'config'` so
- * callers must label it unverified. Best-effort: never throws (a broken
- * MODA_PROFILE must not abort onboarding).
- */
-export function describeSyncIdentity(options = {}) {
-    const apiKey = resolveApiKey(options);
-    if (!apiKey)
-        return undefined;
-    const redacted = apiKey.length > 12
-        ? `${apiKey.slice(0, 8)}…${apiKey.slice(-4)}`
-        : `…${apiKey.slice(-4)}`;
-    const env = options.env ?? process.env;
-    // getActiveProfile throws when the named profile is missing (e.g. a stale
-    // MODA_PROFILE) even though the key already resolved via legacy config —
-    // the banner is advisory and must never abort the command around it.
-    let profileName;
-    try {
-        profileName = getActiveProfile(options).name;
-    }
-    catch {
-        profileName = undefined;
-    }
-    const credential = env.MODA_API_KEY === apiKey
-        ? `MODA_API_KEY env key (${redacted})`
-        : profileName
-            ? `profile '${profileName}' key (${redacted})`
-            : `stored key (${redacted})`;
-    const keyTenantId = embeddedTenantIdFromApiKey(apiKey);
-    if (keyTenantId) {
-        return { credential, tenantId: keyTenantId, tenantSource: 'api-key' };
-    }
-    const configTenantId = resolveTenantId(options);
-    return {
-        credential,
-        tenantId: configTenantId,
-        tenantSource: configTenantId ? 'config' : undefined,
-    };
-}
-/**
- * Human tenant label for the identity banner: key-derived ids are printed
- * bare; config-derived ids are explicitly marked unverified so the banner
- * never asserts a destination the server might not use.
- */
-export function describeSyncTenantLabel(identity) {
-    if (!identity.tenantId)
-        return 'unresolved';
-    if (identity.tenantSource === 'api-key')
-        return identity.tenantId;
-    return `${identity.tenantId} (unverified — from local config, not the API key; the server derives the destination tenant from the key)`;
-}
-/** Bounded walk looking for `<subdir>/.moda/harness-report.json` files. */
-const FRESHER_REPORT_MAX_DEPTH = 4;
-const FRESHER_REPORT_MAX_DIRS = 4_000;
-/**
- * Reports in subdirectories that are FRESHER than the root's
- * `.moda/harness-report.json` (a missing root report counts as infinitely
- * old). Catches the `--path` trap: `harness analyze --path=<subdir>` writes
- * `<subdir>/.moda/harness-report.json`, and a later root-level
- * `harness approve`/`sync` silently targets the stale (or absent) root report.
- * Newest first.
- */
-export function findFresherHarnessReports(rootDir) {
-    let rootMtimeMs = 0;
-    try {
-        rootMtimeMs = lstatSync(join(rootDir, HARNESS_REPORT_PATH)).mtimeMs;
-    }
-    catch {
-        rootMtimeMs = 0;
-    }
-    const fresher = [];
-    let visited = 0;
-    const walk = (dir, depth) => {
-        if (depth > FRESHER_REPORT_MAX_DEPTH || visited >= FRESHER_REPORT_MAX_DIRS)
-            return;
-        visited += 1;
-        let entries;
-        try {
-            entries = readdirSync(dir, { withFileTypes: true });
-        }
-        catch {
-            return;
-        }
-        for (const entry of entries) {
-            // Dot-dirs (including each dir's own `.moda`, checked explicitly below)
-            // and scan-skipped dirs never host a user project subtree.
-            if (!entry.isDirectory() || entry.name.startsWith('.') || SKIPPED_DIRS.has(entry.name))
-                continue;
-            const child = join(dir, entry.name);
-            try {
-                const candidate = lstatSync(join(child, HARNESS_REPORT_PATH));
-                if (candidate.isFile() && candidate.mtimeMs > rootMtimeMs) {
-                    fresher.push({
-                        path: normalizePath(relative(rootDir, join(child, HARNESS_REPORT_PATH))),
-                        mtimeMs: candidate.mtimeMs,
-                    });
-                }
-            }
-            catch {
-                // No report in this subdir; keep walking.
-            }
-            walk(child, depth + 1);
-        }
-    };
-    walk(rootDir, 1);
-    return fresher.sort((a, b) => b.mtimeMs - a.mtimeMs);
-}
-/**
- * `--path` trap guard for `harness approve` / `harness sync`: when the
- * report the command is about to use is older than a fresher
- * `<subdir>/.moda/harness-report.json`, point at the fresher one. Skipped
- * when the user explicitly named a report file (they already chose).
- */
-function warnFresherSubdirHarnessReports(context, rootDir, explicitReport) {
-    // Only treat an explicit report as an opt-out when it points somewhere other
-    // than the default root report. `--from-report=.moda/harness-report.json`
-    // still targets the default report, so the fresher-subdir warning must fire.
-    const explicitReportPath = explicitReport && explicitReport !== 'true'
-        ? normalizePath(relative(rootDir, resolve(rootDir, explicitReport)))
-        : undefined;
-    if (explicitReportPath && explicitReportPath !== normalizePath(HARNESS_REPORT_PATH))
-        return;
-    let fresher;
-    try {
-        fresher = findFresherHarnessReports(rootDir);
-    }
-    catch {
-        return;
-    }
-    if (fresher.length === 0)
-        return;
-    const newest = fresher[0];
-    const subdir = normalizePath(dirname(dirname(newest.path)));
-    const rootState = existsSync(join(rootDir, HARNESS_REPORT_PATH))
-        ? `older ${HARNESS_REPORT_PATH}`
-        : `no ${HARNESS_REPORT_PATH}`;
-    writeHarnessNotice(context, `A fresher harness report exists at ${newest.path} (this directory has ${rootState}). ` +
-        `If you meant that report, re-run with --path=${subdir}.`);
-}
-function readHarnessGraph(manifestPath) {
-    return JSON.parse(readFileSync(manifestPath, 'utf8'));
-}
-export function writeHarnessArtifacts(graph, rootDir, options = {}) {
-    const modaDir = join(rootDir, MODA_DIR);
-    mkdirSync(modaDir, { recursive: true });
-    const manifestPath = join(rootDir, HARNESS_PATH);
-    writeFileSync(manifestPath, `${JSON.stringify(graph, null, 2)}\n`);
-    const written = [HARNESS_PATH];
-    if (options.summary) {
-        written.push(writeHarnessSummary(graph, rootDir));
-    }
-    return written;
-}
-function writeHarnessSummary(graph, rootDir) {
-    const summaryPath = join(rootDir, HARNESS_SUMMARY_PATH);
-    mkdirSync(dirname(summaryPath), { recursive: true });
-    writeFileSync(summaryPath, renderHarnessMarkdown(graph));
-    return HARNESS_SUMMARY_PATH;
-}
-function renderHarnessMarkdown(graph) {
-    const summary = summarizeHarness(graph);
-    const lines = [
-        '# Moda Harness',
-        '',
-        `Harness ID: ${graph.harnessId}`,
-        `Tenant ID: ${graph.tenant?.tenantId ?? 'none'}`,
-        `Runtime agents: ${summary.runtimeAgentCount}`,
-        `Agent families: ${summary.agentFamilyCount}`,
-        `Shared artifacts: ${summary.sharedArtifactCount}`,
-        `Channel adapters: ${summary.channelAdapterCount}`,
-        `Identity namespaces: ${summary.identityNamespaceCount}`,
-        `Agent frameworks: ${summary.agentFrameworkCount}`,
-        `Model providers: ${summary.modelProviderCount}`,
-        '',
-        '## What This Harness Does',
-        '',
-        ...renderHarnessPurposeLines(graph),
-        '',
-        '## Frameworks And Models',
-        '',
-        ...renderFrameworkAndProviderLines(graph),
-        '',
-        '## Moda Data Flow',
-        '',
-        '- `moda harness scan` reads local harness structure and writes `.moda/harness.json`.',
-        '- `moda harness sync` uploads the graph metadata, hashes, and relationships to Moda Cloud.',
-        '- Prompt, skill, eval, deployment, framework, and provider detections become the local context Moda uses for future recommendations.',
-        '- Source content and secret-bearing files are not uploaded by default during scan.',
-        '',
-        '## Runtime Agents',
-        '',
-    ];
-    for (const agent of graph.runtimeAgents) {
-        const artifacts = graph.artifacts.filter((artifact) => agent.artifactIds.includes(artifact.id));
-        lines.push(`### ${agent.name}`, '', `- ID: ${agent.id}`, `- Root: ${agent.root}`, `- Purpose: ${agent.purpose ?? 'unknown'}`, `- Family: ${agent.familyId ?? 'none'}`, `- Channels: ${agent.channelAdapterIds.join(', ') || 'none'}`, `- Frameworks: ${(agent.frameworkIds ?? []).join(', ') || 'unknown'}`, `- Model providers: ${(agent.modelProviderIds ?? []).join(', ') || 'unknown'}`, `- Artifacts: ${artifacts.map((artifact) => artifact.name).join(', ') || 'none'}`, `- Confidence: ${agent.confidence.toFixed(2)}`, '');
-    }
-    if (graph.agentFamilies.length > 0) {
-        lines.push('## Agent Families', '');
-        for (const family of graph.agentFamilies) {
-            lines.push(`### ${family.name}`, '', `- ID: ${family.id}`, `- Agents: ${family.runtimeAgentIds.join(', ') || 'none'}`, `- Shared artifacts: ${family.sharedArtifactIds.join(', ') || 'none'}`, '');
-        }
-    }
-    if (graph.unknowns.length > 0) {
-        lines.push('## Open Questions', '');
-        for (const unknown of graph.unknowns) {
-            lines.push(`- ${unknown.question}`);
-        }
-        lines.push('');
-    }
-    return `${lines.join('\n')}\n`;
-}
-function renderHarnessPurposeLines(graph) {
-    if (graph.runtimeAgents.length === 0) {
-        return ['- No runtime agents were confidently detected yet.'];
-    }
-    return graph.runtimeAgents.map((agent) => {
-        const channels = agent.channelAdapterIds
-            .map((id) => graph.channelAdapters.find((channel) => channel.id === id)?.name ?? titleFromId(id))
-            .join(', ');
-        const purpose = agent.purpose ?? inferPurposeFromAgentShape(graph, agent);
-        return `- ${agent.name}: ${purpose}${channels ? ` (${channels})` : ''}.`;
-    });
-}
-function inferPurposeFromAgentShape(graph, agent) {
-    const prompts = graph.artifacts
-        .filter((artifact) => agent.artifactIds.includes(artifact.id) && artifact.type === 'prompt')
-        .map((artifact) => artifact.name);
-    if (prompts.length > 0)
-        return `Uses ${prompts.join(', ')}`;
-    if (agent.channelAdapterIds.length > 0) {
-        return `Handles ${agent.channelAdapterIds.map((id) => titleFromId(id)).join(', ')} traffic`;
-    }
-    return 'Runtime agent detected from local code';
-}
-function renderFrameworkAndProviderLines(graph) {
-    const lines = [];
-    if (graph.agentFrameworks.length > 0) {
-        lines.push(`- Frameworks: ${graph.agentFrameworks.map((framework) => framework.name).join(', ')}`);
-    }
-    else {
-        lines.push('- Frameworks: unknown');
-    }
-    if (graph.modelProviders.length > 0) {
-        lines.push(`- Model providers: ${graph.modelProviders.map((provider) => provider.name).join(', ')}`);
-        for (const provider of graph.modelProviders) {
-            if (provider.modelHints.length > 0) {
-                lines.push(`- ${provider.name} model hints: ${provider.modelHints.join(', ')}`);
-            }
-        }
-    }
-    else {
-        lines.push('- Model providers: unknown');
-    }
-    return lines;
-}
-export function graphForSync(graph) {
-    return sortJson({
-        ...graph,
-        scan: {
-            ...graph.scan,
-            createdAt: undefined,
-            scannerVersion: undefined,
-            skipped: undefined,
-        },
-    });
-}
-function hashStableJson(value) {
-    return hashText(JSON.stringify(sortJson(value)));
-}
-function sortJson(value) {
-    if (Array.isArray(value))
-        return value.map((item) => sortJson(item));
-    if (value && typeof value === 'object') {
-        return Object.fromEntries(Object.entries(value)
-            .sort(([a], [b]) => a.localeCompare(b))
-            .map(([key, item]) => [key, sortJson(item)]));
-    }
-    return value;
-}
-function getGitCommit(rootDir) {
-    try {
-        return execFileSync('git', ['rev-parse', 'HEAD'], {
-            cwd: rootDir,
-            encoding: 'utf8',
-            stdio: ['ignore', 'pipe', 'ignore'],
-        }).trim() || undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-function explainAgent(graph, agent) {
-    return {
-        agent,
-        family: agent.familyId
-            ? graph.agentFamilies.find((family) => family.id === agent.familyId) ?? null
-            : null,
-        channels: graph.channelAdapters.filter((channel) => agent.channelAdapterIds.includes(channel.id)),
-        artifacts: graph.artifacts.filter((artifact) => agent.artifactIds.includes(artifact.id)),
-        identities: graph.identityNamespaces.filter((identity) => agent.identityNamespaceIds.includes(identity.id)),
-        deployments: graph.deployments.filter((deployment) => agent.deploymentIds.includes(deployment.id)),
-        relationships: graph.relationships.filter((relationship) => relationship.from === agent.id || relationship.to === agent.id),
-    };
-}
-/**
- * Bounded repo walk shared by `harness scan`, snapshot upload, and the static
- * candidates pre-pass: skips ignored/secret-bearing paths and symlinks,
- * enforces the file-count and text-byte budgets, and reads text for known
- * text extensions plus any file admitted by `options.includeFile`.
- * `options.includeFile` widens (ORs with) the default inventory predicate and
- * also opts its files into text reading — it can never re-admit secret-bearing
- * or oversized files, which are rejected before the predicate runs.
- */
-export function inventoryFiles(rootDir, skipped, options = {}) {
-    const files = [];
-    const rootReal = resolve(rootDir);
-    const maxFiles = numericEnv('MODA_HARNESS_MAX_FILES', DEFAULT_MAX_INVENTORY_FILES);
-    const maxTextBytes = numericEnv('MODA_HARNESS_MAX_TEXT_BYTES', DEFAULT_MAX_INVENTORY_TEXT_BYTES);
-    let textBytes = 0;
-    function walk(current) {
-        const rel = normalizePath(relative(rootReal, current)) || '.';
-        let stat;
-        try {
-            stat = lstatSync(current);
-        }
-        catch {
-            recordSkipped(skipped, { path: rel, reason: 'stat failed' });
-            return;
-        }
-        if (stat.isSymbolicLink()) {
-            recordSkipped(skipped, { path: rel, reason: 'symlink skipped for safety' });
-            return;
-        }
-        if (stat.isDirectory()) {
-            if (rel !== '.' && shouldSkipDirectory(rel, current)) {
-                recordSkipped(skipped, { path: rel, reason: 'ignored directory' });
-                return;
-            }
-            for (const entry of readdirSync(current).sort()) {
-                walk(join(current, entry));
-            }
-            return;
-        }
-        if (!stat.isFile())
-            return;
-        if (stat.size > MAX_SCANNED_FILE_BYTES) {
-            recordSkipped(skipped, { path: rel, reason: 'file too large for harness scan' });
-            return;
-        }
-        if (isSecretishPath(rel)) {
-            recordSkipped(skipped, { path: rel, reason: 'secret-bearing file skipped' });
-            return;
-        }
-        if (!shouldInventoryFile(rel) && !(options.includeFile?.(rel) ?? false))
-            return;
-        if (files.length >= maxFiles) {
-            throwHarnessScanTooBroad(rootReal, {
-                files: files.length,
-                textBytes,
-                lastPath: rel,
-                maxFiles,
-                maxTextBytes,
-            });
-        }
-        const item = { path: rel, absPath: current, rootDir: rootReal };
-        // Read text for known text extensions, but also for any file the caller
-        // widened in via `includeFile` (e.g. the candidates pass admits template
-        // prompt files like `.jinja`/`.hbs`/`.tpl`/`.prompt` whose extensions are
-        // not in `isTextFile`) — otherwise a widened-in file is counted as scanned
-        // but never gets its text read, so downstream detectors silently skip it.
-        if (isTextFile(rel) || (options.includeFile?.(rel) ?? false)) {
-            if (textBytes + stat.size > maxTextBytes) {
-                recordSkipped(skipped, { path: rel, reason: 'scan text budget exceeded' });
-            }
-            else {
-                try {
-                    item.text = readFileSync(current, 'utf8');
-                    textBytes += Buffer.byteLength(item.text, 'utf8');
-                }
-                catch {
-                    recordSkipped(skipped, { path: rel, reason: 'text read failed' });
-                }
-            }
-        }
-        files.push(item);
-    }
-    walk(rootReal);
-    return files;
-}
-function shouldSkipDirectory(rel, absPath) {
-    if (SKIPPED_DIRS.has(basename(absPath)))
-        return true;
-    return SKIPPED_PATH_PREFIXES.some((prefix) => rel === prefix || rel.startsWith(`${prefix}/`));
-}
-function shouldInventoryFile(path) {
-    const normalized = normalizePath(path);
-    const base = basename(normalized);
-    const ext = extname(normalized).toLowerCase();
-    if (isSourceFile(normalized))
-        return true;
-    if (isPackageOrLockfile(normalized))
-        return true;
-    if (isPromptLikePath(normalized))
-        return true;
-    if (isSkillLikePath(normalized))
-        return true;
-    if (isEvalLikePath(normalized))
-        return true;
-    if (isDeploymentLikePath(normalized))
-        return true;
-    if (isDeveloperAgentConfigPath(normalized))
-        return true;
-    if (base === 'README.md' || base === 'AGENTS.md')
-        return true;
-    return ext === '.toml' && (base === 'pyproject.toml' || base === 'wrangler.toml');
-}
-function isSourceFile(path) {
-    return /\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(path);
-}
-function isPackageOrLockfile(path) {
-    return path === 'package.json' ||
-        path === 'pyproject.toml' ||
-        path === 'bun.lock' ||
-        path === 'bun.lockb' ||
-        path === 'pnpm-lock.yaml' ||
-        path === 'yarn.lock';
-}
-function isPromptLikePath(path) {
-    return /(^|\/)prompts?\//i.test(path) &&
-        /\.(prompt\.)?(md|json|ya?ml)$/i.test(path);
-}
-function isSkillLikePath(path) {
-    return /(^|\/)(\.claude\/skills|\.cursor\/rules|skills?)\//i.test(path) &&
-        /\.(md|mdc)$/i.test(path);
-}
-function isEvalLikePath(path) {
-    return /(^|\/)(evals?|tests?|__tests__)\//i.test(path) &&
-        /\.(ts|tsx|js|mjs|py|json|ya?ml)$/i.test(path);
-}
-function isDeploymentLikePath(path) {
-    return /(^|\/)(wrangler\.toml|vercel\.json|render\.ya?ml|railway\.json|Dockerfile|docker-compose\.ya?ml)$/i.test(path) ||
-        /^\.github\/workflows\/[^/]+\.ya?ml$/i.test(path);
-}
-function isDeveloperAgentConfigPath(path) {
-    return path === '.claude/settings.json' ||
-        path === '.codex/hooks.json' ||
-        path === '.cursor/hooks.json';
-}
-function recordSkipped(skipped, item) {
-    if (skipped.length < MAX_RECORDED_SKIPS) {
-        skipped.push(item);
-        return;
-    }
-    if (skipped.length === MAX_RECORDED_SKIPS) {
-        skipped.push({
-            path: '...',
-            reason: 'additional skipped entries omitted',
-        });
-    }
-}
-function throwHarnessScanTooBroad(rootDir, details) {
-    const mib = (details.textBytes / 1024 / 1024).toFixed(1);
-    const maxMib = (details.maxTextBytes / 1024 / 1024).toFixed(0);
-    throw new CliInputError('Harness scan is too broad for safe local analysis.', [
-        `Moda reached ${details.files.toLocaleString()} files while scanning ${rootDir}.`,
-        `Text read budget: ${mib}MiB of ${maxMib}MiB. Last path: ${details.lastPath}.`,
-        'Run `moda init` from the actual agent project root, not a parent folder like ~/Projects.',
-        'For harness-only analysis, use `moda harness analyze --path=<agent-dir> --summary`.',
-    ].join('\n'));
-}
-export function numericEnv(name, fallback) {
-    const raw = process.env[name];
-    if (!raw)
-        return fallback;
-    const parsed = Number(raw);
-    return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : fallback;
-}
-export function numericEnvAllowZero(name, fallback) {
-    const raw = process.env[name];
-    if (!raw)
-        return fallback;
-    const parsed = Number(raw);
-    return Number.isFinite(parsed) && parsed >= 0 ? Math.floor(parsed) : fallback;
-}
-function isTextFile(path) {
-    const ext = extname(path).toLowerCase();
-    return [
-        '',
-        '.cjs',
-        '.js',
-        '.json',
-        '.jsx',
-        '.md',
-        '.mdc',
-        '.mjs',
-        '.py',
-        '.toml',
-        '.ts',
-        '.tsx',
-        '.txt',
-        '.yaml',
-        '.yml',
-    ].includes(ext);
-}
-function isSecretishPath(path) {
-    const name = basename(path).toLowerCase();
-    return name === '.env' ||
-        name.startsWith('.env.') ||
-        name.includes('secret') ||
-        name.includes('private-key') ||
-        name.endsWith('.pem');
-}
-function detectRepo(rootDir, files) {
-    const packageJson = files.find((file) => file.path === 'package.json');
-    const pyproject = files.find((file) => file.path === 'pyproject.toml');
-    const name = packageJson?.text
-        ? safePackageName(packageJson.text) ?? basename(rootDir)
-        : pyproject?.text
-            ? safeTomlName(pyproject.text) ?? basename(rootDir)
-            : basename(rootDir);
-    const packageManagers = [
-        files.some((file) => file.path === 'bun.lock' || file.path === 'bun.lockb') ? 'bun' : null,
-        files.some((file) => file.path === 'pnpm-lock.yaml') ? 'pnpm' : null,
-        files.some((file) => file.path === 'yarn.lock') ? 'yarn' : null,
-        packageJson ? 'npm' : null,
-        pyproject ? 'python' : null,
-    ].filter((value) => Boolean(value));
-    const languages = [
-        files.some((file) => file.path.endsWith('.ts') || file.path.endsWith('.tsx')) ? 'typescript' : null,
-        files.some((file) => file.path.endsWith('.js') || file.path.endsWith('.jsx') || file.path.endsWith('.mjs')) ? 'javascript' : null,
-        files.some((file) => file.path.endsWith('.py')) ? 'python' : null,
-    ].filter((value) => Boolean(value));
-    return {
-        root: '.',
-        name,
-        packageManagers: [...new Set(packageManagers)],
-        languages: [...new Set(languages)],
-    };
-}
-function safePackageName(text) {
-    try {
-        const parsed = JSON.parse(text);
-        return typeof parsed.name === 'string' ? parsed.name : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-function safeTomlName(text) {
-    const match = text.match(/^\s*name\s*=\s*["']([^"']+)["']/m);
-    return match?.[1];
-}
-function parseAnnotations(file) {
-    if (!file.text?.includes('moda:'))
-        return [];
-    const annotations = [];
-    const lines = file.text.split(/\r?\n/);
-    lines.forEach((line, index) => {
-        const match = line.match(/\bmoda:\s*([a-z-]+)\s*(.*)$/i);
-        if (!match)
-            return;
-        annotations.push({
-            type: match[1],
-            values: parseAnnotationValues(match[2] ?? ''),
-            evidence: {
-                path: file.path,
-                reason: `Explicit moda ${match[1]} annotation on line ${index + 1}.`,
-            },
-            sourceAbsPath: file.absPath,
-            rootDir: file.rootDir,
-        });
-    });
-    return annotations;
-}
-function parseAnnotationValues(raw) {
-    const values = {};
-    const regex = /([A-Za-z0-9_-]+)=("([^"]*)"|'([^']*)'|[^\s]+)/g;
-    let match;
-    while ((match = regex.exec(raw))) {
-        const key = match[1].replace(/-/g, '_');
-        const value = match[3] ?? match[4] ?? match[2];
-        if (!values[key])
-            values[key] = [];
-        values[key].push(value);
-    }
-    return values;
-}
-function applyAnnotations(graph, annotations) {
-    for (const annotation of annotations) {
-        switch (annotation.type) {
-            case 'runtime-agent':
-            case 'agent':
-                upsertRuntimeAgent(graph, runtimeAgentFromAnnotation(annotation));
-                break;
-            case 'agent-family':
-            case 'family':
-                upsertAgentFamily(graph, agentFamilyFromAnnotation(annotation));
-                break;
-            case 'channel':
-                upsertChannel(graph, channelFromAnnotation(annotation));
-                break;
-            case 'artifact':
-                upsertArtifact(graph, artifactFromAnnotation(annotation));
-                break;
-            case 'identity':
-                upsertIdentity(graph, identityFromAnnotation(annotation));
-                break;
-            case 'deployment':
-                upsertDeployment(graph, deploymentFromAnnotation(annotation));
-                break;
-            case 'environment':
-                upsertEnvironment(graph, environmentFromAnnotation(annotation));
-                break;
-            default:
-                graph.unknowns.push({
-                    id: stableId('unknown', `${annotation.type}-${annotation.evidence.path}`),
-                    question: `Unknown moda annotation type '${annotation.type}' in ${annotation.evidence.path}.`,
-                    candidateIds: [],
-                    evidence: [annotation.evidence],
-                });
-        }
-    }
-}
-function runtimeAgentFromAnnotation(annotation) {
-    const values = annotation.values;
-    const id = first(values.id) ?? stableId('agent', first(values.name) ?? annotation.evidence.path);
-    return {
-        id,
-        name: first(values.name) ?? titleFromId(id),
-        kind: 'runtime_agent',
-        purpose: first(values.purpose) ?? first(values.description),
-        familyId: first(values.family),
-        root: normalizePath(first(values.root) ?? dirname(annotation.evidence.path)),
-        entrypointIds: values.entrypoint ?? [stableId('entry', annotation.evidence.path)],
-        channelAdapterIds: values.channel ?? [],
-        artifactIds: [...(values.artifact ?? []), ...(values.prompt ?? []), ...(values.tool ?? [])],
-        identityNamespaceIds: values.identity ?? [],
-        deploymentIds: values.deployment ?? [],
-        frameworkIds: values.framework ?? [],
-        modelProviderIds: [...(values.provider ?? []), ...(values.model_provider ?? [])],
-        confidence: numberValue(first(values.confidence), 0.9),
-        evidence: [annotation.evidence],
-    };
-}
-function agentFamilyFromAnnotation(annotation) {
-    const values = annotation.values;
-    const id = first(values.id) ?? stableId('family', first(values.name) ?? annotation.evidence.path);
-    return {
-        id,
-        name: first(values.name) ?? titleFromId(id),
-        description: first(values.description),
-        runtimeAgentIds: values.agent ?? [],
-        sharedArtifactIds: [...(values.artifact ?? []), ...(values.prompt ?? []), ...(values.tool ?? [])],
-        confidence: numberValue(first(values.confidence), 0.86),
-        evidence: [annotation.evidence],
-    };
-}
-function channelFromAnnotation(annotation) {
-    const values = annotation.values;
-    const kind = first(values.kind) ?? first(values.type) ?? 'channel';
-    const id = first(values.id) ?? stableId('channel', first(values.name) ?? kind);
-    return {
-        id,
-        name: first(values.name) ?? titleFromId(id),
-        kind,
-        sourcePath: annotation.evidence.path,
-        confidence: numberValue(first(values.confidence), 0.85),
-        evidence: [annotation.evidence],
-    };
-}
-function artifactFromAnnotation(annotation) {
-    const values = annotation.values;
-    const type = artifactType(first(values.kind) ?? first(values.type));
-    const annotatedPath = first(values.path) ?? annotation.evidence.path;
-    // Canonicalize nested relative path= annotations to a repo-relative location
-    // so later whole-file body hydration and hashing find the real prompt/tool file.
-    const sourcePath = resolveAnnotatedSourcePath(annotatedPath, annotation);
-    const id = first(values.id) ?? stableId(type, first(values.name) ?? sourcePath);
-    // Body reads from the RAW annotated path on purpose: readPromptOrToolBody walks
-    // the annotation's ancestor dirs itself to locate nested-package files, so it
-    // must not be handed the already-canonicalized sourcePath. sourcePath and
-    // contentHash use the canonical path so downstream whole-file hydration and
-    // hashing resolve the same file the body came from.
-    const body = readPromptOrToolBody(type, annotatedPath, annotation);
-    return {
-        id,
-        type,
-        name: first(values.name) ?? titleFromId(id),
-        scope: scopeValue(first(values.scope)),
-        sourcePath,
-        contentHash: contentHashForAnnotatedSource(sourcePath, annotation),
-        body,
-        ownedByAgentId: first(values.owner),
-        usedByAgentIds: values.agent ?? [],
-        confidence: numberValue(first(values.confidence), 0.85),
-        evidence: [annotation.evidence],
-    };
-}
-function identityFromAnnotation(annotation) {
-    const values = annotation.values;
-    const kind = first(values.kind) ?? first(values.type) ?? 'identity';
-    const id = first(values.id) ?? stableId('identity', first(values.name) ?? kind);
-    return {
-        id,
-        name: first(values.name) ?? titleFromId(id),
-        kind,
-        canonicalId: first(values.canonical),
-        sourcePath: annotation.evidence.path,
-        confidence: numberValue(first(values.confidence), 0.8),
-        evidence: [annotation.evidence],
-    };
-}
-function deploymentFromAnnotation(annotation) {
-    const values = annotation.values;
-    const id = first(values.id) ?? stableId('deploy', first(values.name) ?? annotation.evidence.path);
-    return {
-        id,
-        name: first(values.name) ?? titleFromId(id),
-        environmentId: first(values.environment),
-        sourcePath: first(values.path) ?? annotation.evidence.path,
-        confidence: numberValue(first(values.confidence), 0.78),
-        evidence: [annotation.evidence],
-    };
-}
-function environmentFromAnnotation(annotation) {
-    const values = annotation.values;
-    const kind = first(values.kind) ?? first(values.type) ?? 'runtime';
-    const id = first(values.id) ?? stableId('env', first(values.name) ?? kind);
-    return {
-        id,
-        name: first(values.name) ?? titleFromId(id),
-        kind,
-        sourcePath: annotation.evidence.path,
-        confidence: numberValue(first(values.confidence), 0.75),
-        evidence: [annotation.evidence],
-    };
-}
-function applyHeuristics(graph, files) {
-    const isApplicationCode = applicationCodePredicate(files);
-    for (const file of files) {
-        maybeAddPromptArtifact(graph, file);
-        maybeAddSkillArtifact(graph, file);
-        if (isApplicationCode(file.path))
-            maybeAddToolArtifact(graph, file);
-        maybeAddEvalArtifact(graph, file);
-        maybeAddDeployment(graph, file);
-    }
-    if (graph.runtimeAgents.length === 0) {
-        for (const file of files) {
-            if (!isApplicationCode(file.path))
-                continue;
-            const agent = inferRuntimeAgent(file, graph);
-            if (agent)
-                upsertRuntimeAgent(graph, agent);
-        }
-    }
-    for (const agent of graph.runtimeAgents) {
-        if (agent.entrypointIds.length === 0) {
-            const entryId = stableId('entry', agent.root);
-            agent.entrypointIds.push(entryId);
-            upsertArtifact(graph, {
-                id: entryId,
-                type: 'entrypoint',
-                name: `${agent.name} Entrypoint`,
-                scope: 'agent',
-                sourcePath: agent.root,
-                ownedByAgentId: agent.id,
-                usedByAgentIds: [agent.id],
-                confidence: 0.7,
-                evidence: agent.evidence,
-            });
-        }
-    }
-}
-function maybeAddPromptArtifact(graph, file) {
-    const isPrompt = /(^|\/)prompts?\//i.test(file.path) &&
-        /\.(prompt\.)?(md|json|ya?ml)$/i.test(file.path);
-    if (!isPrompt)
-        return;
-    const id = stableId('prompt', file.path);
-    const text = file.text ?? readFileSync(file.absPath, 'utf8');
-    upsertArtifact(graph, {
-        id,
-        type: 'prompt',
-        name: promptNameFromPath(file.path),
-        scope: 'agent',
-        sourcePath: file.path,
-        contentHash: hashText(text),
-        // Capture the full prompt text so downstream prompt optimization can use it
-        // directly without re-reading the repo.
-        body: text,
-        usedByAgentIds: [],
-        confidence: 0.72,
-        evidence: [{ path: file.path, reason: 'Prompt-like file found under prompts directory.' }],
-    });
-}
-function maybeAddSkillArtifact(graph, file) {
-    if (!/(^|\/)(\.claude\/skills|\.cursor\/rules|skills?)\//i.test(file.path))
-        return;
-    if (!/\.(md|mdc)$/i.test(file.path))
-        return;
-    upsertArtifact(graph, {
-        id: stableId('skill', file.path),
-        type: 'skill',
-        name: titleFromId(basename(file.path).replace(/\.(md|mdc)$/i, '')),
-        scope: 'global',
-        sourcePath: file.path,
-        contentHash: hashText(file.text ?? ''),
-        usedByAgentIds: [],
-        confidence: 0.7,
-        evidence: [{ path: file.path, reason: 'Skill or rule file detected.' }],
-    });
-}
-function maybeAddEvalArtifact(graph, file) {
-    if (!/(eval|test|spec)/i.test(file.path))
-        return;
-    if (!/\.(ts|tsx|js|mjs|py|json|ya?ml)$/i.test(file.path))
-        return;
-    upsertArtifact(graph, {
-        id: stableId('eval', file.path),
-        type: 'eval',
-        name: titleFromId(file.path),
-        scope: 'global',
-        sourcePath: file.path,
-        contentHash: file.text ? hashText(file.text) : undefined,
-        usedByAgentIds: [],
-        confidence: 0.52,
-        evidence: [{ path: file.path, reason: 'Eval/test-like file detected.' }],
-    });
-}
-function maybeAddDeployment(graph, file) {
-    if (!/(wrangler\.toml|vercel\.json|render\.yaml|railway\.json|Dockerfile|docker-compose\.ya?ml|\.github\/workflows\/)/i.test(file.path)) {
-        return;
-    }
-    upsertDeployment(graph, {
-        id: stableId('deploy', file.path),
-        name: titleFromId(file.path),
-        sourcePath: file.path,
-        confidence: 0.6,
-        evidence: [{ path: file.path, reason: 'Deployment or CI configuration detected.' }],
-    });
-}
-function inferRuntimeAgent(file, graph) {
-    if (!file.text)
-        return null;
-    if (!/\.(ts|tsx|js|mjs|py)$/i.test(file.path))
-        return null;
-    if (basename(file.path) === '__init__.py')
-        return null;
-    const loweredPath = file.path.toLowerCase();
-    const loweredText = file.text.toLowerCase();
-    const pathLooksLikeAgent = /(^|\/)(agent|agents|agent_harness)\//.test(loweredPath) ||
-        /(^|\/)(agent|main|index)\.(ts|tsx|js|mjs|py)$/.test(loweredPath);
-    // Require evidence that the file actually constructs or runs an agent, not
-    // merely that it mentions a model provider. Loose signals like "openai" or
-    // "model" match library internals and utilities that are not runtime agents.
-    const codeLooksLikeAgent = AGENT_RUNTIME_SIGNAL.test(file.text);
-    if (!pathLooksLikeAgent || !codeLooksLikeAgent)
-        return null;
-    const channelIds = inferChannels(file);
-    const artifactIds = inferArtifactsForFile(file, graph);
-    const frameworkIds = frameworkIdsForFile(file);
-    const modelProviderIds = providerIdsForFile(file);
-    const agentId = stableId('agent', file.path.replace(/\.(ts|tsx|js|mjs|py)$/i, ''));
-    const entryId = stableId('entry', file.path);
-    upsertArtifact(graph, {
-        id: entryId,
-        type: 'entrypoint',
-        name: `${titleFromId(agentId)} Entrypoint`,
-        scope: 'agent',
-        sourcePath: file.path,
-        contentHash: hashText(file.text),
-        ownedByAgentId: agentId,
-        usedByAgentIds: [agentId],
-        confidence: 0.7,
-        evidence: [{ path: file.path, reason: 'Agent-like entrypoint detected from path and code.' }],
-    });
-    return {
-        id: agentId,
-        name: titleFromId(file.path.replace(/\.(ts|tsx|js|mjs|py)$/i, '')),
-        kind: 'runtime_agent',
-        purpose: inferAgentPurpose(file),
-        root: normalizePath(dirname(file.path)),
-        entrypointIds: [entryId],
-        channelAdapterIds: channelIds,
-        artifactIds,
-        identityNamespaceIds: [],
-        deploymentIds: [],
-        frameworkIds,
-        modelProviderIds,
-        confidence: loweredText.includes('run_agent') || loweredText.includes('runagent') ? 0.68 : 0.56,
-        evidence: [{ path: file.path, reason: 'Agent-like entrypoint detected from path and code.' }],
-    };
-}
-function inferAgentPurpose(file) {
-    const text = file.text ?? '';
-    const promptMatch = text.match(/(?:systemPrompt|system_prompt|SYSTEM_PROMPT)\s*[:=]\s*["'`]([^"'`]{12,180})/);
-    const quoted = promptMatch?.[1];
-    if (quoted)
-        return titleCaseSentence(quoted.split(/[.!?]/)[0]);
-    const commentMatch = text.match(/(?:purpose|description)\s*[:=]\s*["'`]([^"'`]{12,180})/i);
-    if (commentMatch?.[1])
-        return titleCaseSentence(commentMatch[1].split(/[.!?]/)[0]);
-    const path = file.path.toLowerCase();
-    if (path.includes('support'))
-        return 'Support Agent';
-    if (path.includes('triage'))
-        return 'Triage Agent';
-    if (path.includes('coding'))
-        return 'Coding Agent';
-    return undefined;
-}
-function titleCaseSentence(value) {
-    return value
-        .replace(/\s+/g, ' ')
-        .trim()
-        .split(' ')
-        .map((word) => {
-        if (!word)
-            return word;
-        if (/^[A-Z0-9_]+$/.test(word))
-            return word;
-        return word.charAt(0).toUpperCase() + word.slice(1);
-    })
-        .join(' ');
-}
-function inferChannels(file) {
-    const text = `${file.path}\n${file.text ?? ''}`.toLowerCase();
-    const channels = [
-        ['whatsapp', 'channel_whatsapp'],
-        ['sms', 'channel_sms'],
-        ['voice', 'channel_voice'],
-        ['slack', 'channel_slack'],
-        ['email', 'channel_email'],
-        ['web', 'channel_web'],
-        ['cron', 'channel_cron'],
-        ['api', 'channel_api'],
-    ];
-    return channels
-        .filter(([needle]) => text.includes(needle))
-        .map(([, id]) => id);
-}
-// Trailing module names an import statement references, normalized to their last
-// path segment without extension. Covers ES/TS `from '...'` / `import(...)` /
-// `require(...)` and Python `from a.b.c import ...` / `import a.b.c`. Used to link
-// split-file tools whose module is imported by extensionless or dotted name
-// (e.g. `from tools import get_weather`, `import { getWeather } from './tools'`).
-function importedModuleNames(text) {
-    const names = new Set();
-    for (const match of text.matchAll(/(?:from|import|require)\s*\(?\s*["']([^"']+)["']/g)) {
-        const segment = match[1].split('/').pop();
-        if (segment)
-            names.add(segment.replace(/\.(ts|tsx|js|mjs|py)$/i, ''));
-    }
-    for (const match of text.matchAll(/^\s*(?:from|import)\s+([.\w]+)/gm)) {
-        const segment = match[1].replace(/^\.+/, '').split('.').pop();
-        if (segment)
-            names.add(segment);
-    }
-    return names;
-}
-function inferArtifactsForFile(file, graph) {
-    const text = file.text ?? '';
-    const imported = importedModuleNames(text);
-    const referenced = graph.artifacts.filter((artifact) => {
-        if (!artifact.sourcePath)
-            return false;
-        if (artifact.sourcePath === file.path)
-            return true;
-        const base = basename(artifact.sourcePath);
-        if (text.includes(base) || text.includes(artifact.sourcePath))
-            return true;
-        // Split-file tools: the agent imports the tool module by its extensionless or
-        // dotted name, which contains neither the basename-with-extension nor the full
-        // source path (e.g. `from tools import get_weather`, `from './tools'`).
-        if (artifact.type === 'tool') {
-            const moduleName = base.replace(/\.(ts|tsx|js|mjs|py)$/i, '');
-            if (moduleName && imported.has(moduleName))
-                return true;
-        }
-        return false;
-    });
-    return referenced.map((artifact) => artifact.id);
-}
-// Signals that a file constructs or runs an agent (as opposed to merely
-// importing a model SDK). Kept deliberately construction/run oriented so
-// library internals that only reference a provider are not misread as agents.
-// Covers the LangChain factory/executor shapes (create_tool_calling_agent,
-// create_openai_functions_agent, AgentExecutor, ...) and the `return`/`yield
-// Agent(...)` factory forms in addition to the direct construction/run signals.
-const AGENT_RUNTIME_SIGNAL = /(run_agent|runAgent|create_[a-z_]*agent\b|createAgent|initialize_agent|AgentExecutor\s*\(|new\s+Agent\s*\(|\bSwarm\s*\(|\bCrew\s*\(|\bRunner\s*\(|Runner\.run|\.run_sync\s*\(|\.run_streamed\s*\(|[=([,]\s*Agent\s*\(|(?:return|yield)\s+Agent\s*\(|^\s*Agent\s*\()/im;
-// Hosted/first-party tool classes that count as tool definitions when called.
-const HOSTED_TOOL_CLASSES = [
-    'WebSearchTool',
-    'FileSearchTool',
-    'ComputerTool',
-    'CodeInterpreterTool',
-    'HostedMCPTool',
-    'ImageGenerationTool',
-    'LocalShellTool',
-    'ShellTool',
-    'ApplyPatchTool',
-    'FunctionTool',
-];
-function repoOwnPackageNames(files) {
-    const packageJson = files.find((file) => file.path === 'package.json')?.text;
-    const pyproject = files.find((file) => file.path === 'pyproject.toml')?.text;
-    const names = [
-        packageJson ? safePackageName(packageJson) : undefined,
-        pyproject ? safeTomlName(pyproject) : undefined,
-    ];
-    return names.filter((name) => Boolean(name)).map((name) => name.toLowerCase());
-}
-function repoIsAgentFrameworkSource(files) {
-    const own = new Set(repoOwnPackageNames(files));
-    if (own.size === 0)
-        return false;
-    return FRAMEWORK_CATALOG.some((framework) => framework.packageNames.some((name) => own.has(name.toLowerCase())));
-}
-function isApplicationLikePath(path) {
-    return /(^|\/)(examples?|apps?|demos?|samples?|cookbook|tutorials?|quickstart|playground)\//i.test(path);
-}
-// When the repository IS an agent framework/SDK (its own package name matches a
-// framework catalog entry), its library source is the framework implementation,
-// not customer application code: runtime agents and tools should only be
-// inferred from application-like directories (examples, apps, demos, ...).
-function applicationCodePredicate(files) {
-    return repoIsAgentFrameworkSource(files) ? isApplicationLikePath : () => true;
-}
-const HOSTED_TOOL_CALL = new RegExp(`\\b(${HOSTED_TOOL_CLASSES.join('|')})\\s*\\(`, 'g');
-function detectToolDefinitions(file) {
-    const text = file.text;
-    if (!text)
-        return [];
-    const found = new Map();
-    const pyDecorated = /@function_tool[^\n]*\n(?:[ \t]*@[^\n]*\n)*[ \t]*(?:async[ \t]+)?def[ \t]+([A-Za-z_]\w*)/g;
-    for (const match of text.matchAll(pyDecorated))
-        found.set(match[1], '@function_tool-decorated function');
-    const tsFactory = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:[\w.]*\.)?(?:tool|functionTool|createTool|dynamicTool)\s*\(/g;
-    for (const match of text.matchAll(tsFactory))
-        found.set(match[1], 'tool factory assignment');
-    const tsNewTool = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*new\s+(?:Dynamic|Structured)?Tool\b/g;
-    for (const match of text.matchAll(tsNewTool))
-        found.set(match[1], 'tool constructor assignment');
-    for (const match of text.matchAll(HOSTED_TOOL_CALL))
-        found.set(match[1], `hosted tool ${match[1]}`);
-    return [...found.entries()].map(([name, reason]) => ({ name, reason }));
-}
-function maybeAddToolArtifact(graph, file) {
-    if (!/\.(ts|tsx|js|mjs|py)$/i.test(file.path))
-        return;
-    // Skip test/eval fixtures — those tool definitions are fixtures, not a
-    // customer's runtime tools. (Framework library internals are already
-    // excluded by applyHeuristics's application-code predicate.)
-    if (isEvalLikePath(file.path))
-        return;
-    const tools = detectToolDefinitions(file);
-    if (tools.length === 0)
-        return;
-    for (const tool of tools) {
-        const body = extractToolBody(file, tool);
-        upsertArtifact(graph, {
-            id: stableId('tool', `${file.path}:${tool.name}`),
-            type: 'tool',
-            name: titleFromId(tool.name),
-            scope: 'agent',
-            sourcePath: file.path,
-            body,
-            usedByAgentIds: [],
-            confidence: 0.6,
-            evidence: [{ path: file.path, reason: `Tool definition detected (${tool.reason}).` }],
-        });
-    }
-}
-function detectDeveloperAgentAdapters(files) {
-    const adapters = [];
-    if (files.some((file) => file.path.startsWith('.claude/'))) {
-        adapters.push({
-            id: 'developer_adapter_claude_code',
-            name: 'Claude Code',
-            kind: 'developer_agent_adapter',
-            sourcePath: '.claude',
-            confidence: 0.9,
-            evidence: [{ path: '.claude', reason: 'Claude Code project markers detected.' }],
-        });
-    }
-    if (files.some((file) => file.path.startsWith('.cursor/'))) {
-        adapters.push({
-            id: 'developer_adapter_cursor',
-            name: 'Cursor',
-            kind: 'developer_agent_adapter',
-            sourcePath: '.cursor',
-            confidence: 0.9,
-            evidence: [{ path: '.cursor', reason: 'Cursor project markers detected.' }],
-        });
-    }
-    if (files.some((file) => file.path.startsWith('.codex/'))) {
-        adapters.push({
-            id: 'developer_adapter_codex',
-            name: 'Codex',
-            kind: 'developer_agent_adapter',
-            sourcePath: '.codex',
-            confidence: 0.9,
-            evidence: [{ path: '.codex', reason: 'Codex project markers detected.' }],
-        });
-    }
-    return adapters;
-}
-function detectEnvironments(files) {
-    const envs = [];
-    for (const id of ['local', 'staging', 'prod']) {
-        const pathMatch = files.find((file) => file.path.includes(`.${id}.`) ||
-            file.path.includes(`-${id}.`) ||
-            file.path.includes(`/${id}/`));
-        if (pathMatch || id === 'local') {
-            envs.push({
-                id: `env_${id}`,
-                name: titleFromId(id),
-                kind: id,
-                sourcePath: pathMatch?.path,
-                confidence: pathMatch ? 0.65 : 0.45,
-                evidence: [{
-                        path: pathMatch?.path ?? '.',
-                        reason: pathMatch ? `Environment marker for ${id} detected.` : 'Default local environment assumed.',
-                    }],
-            });
-        }
-    }
-    return envs;
-}
-const FRAMEWORK_CATALOG = [
-    {
-        id: 'framework_langchain',
-        name: 'LangChain',
-        kind: 'agent_framework',
-        packageNames: ['langchain', '@langchain/core', '@langchain/langgraph', 'langgraph'],
-        patterns: [/\blangchain\b/i, /\blanggraph\b/i],
-    },
-    {
-        id: 'framework_vercel_ai_sdk',
-        name: 'Vercel AI SDK',
-        kind: 'agent_framework',
-        packageNames: ['ai', '@ai-sdk/openai', '@ai-sdk/anthropic'],
-        patterns: [/\bfrom\s+['"]ai['"]/, /\bgenerateText\s*\(/, /\bstreamText\s*\(/],
-    },
-    {
-        id: 'framework_mastra',
-        name: 'Mastra',
-        kind: 'agent_framework',
-        packageNames: ['mastra', '@mastra/core'],
-        patterns: [/\bmastra\b/i],
-    },
-    {
-        id: 'framework_openai_agents',
-        name: 'OpenAI Agents SDK',
-        kind: 'agent_framework',
-        packageNames: ['@openai/agents', 'openai-agents', 'openai-agents-python'],
-        patterns: [/openai_agents/i, /@openai\/agents/i, /\bAgent\s*\(/],
-    },
-    {
-        id: 'framework_crewai',
-        name: 'CrewAI',
-        kind: 'agent_framework',
-        packageNames: ['crewai'],
-        patterns: [/\bcrewai\b/i],
-    },
-    {
-        id: 'framework_pydantic_ai',
-        name: 'Pydantic AI',
-        kind: 'agent_framework',
-        packageNames: ['pydantic-ai', 'pydantic_ai'],
-        patterns: [/pydantic_ai/i],
-    },
-];
-const PROVIDER_CATALOG = [
-    {
-        id: 'provider_openai',
-        name: 'OpenAI',
-        kind: 'model_provider',
-        packageNames: ['openai', '@ai-sdk/openai'],
-        envVars: ['OPENAI_API_KEY'],
-        patterns: [/from\s+['"]openai['"]/, /\bnew\s+OpenAI\b/, /\bgpt-[\w.-]+/i, /OPENAI_API_KEY/],
-    },
-    {
-        id: 'provider_anthropic',
-        name: 'Anthropic',
-        kind: 'model_provider',
-        packageNames: ['@anthropic-ai/sdk', '@ai-sdk/anthropic', 'anthropic'],
-        envVars: ['ANTHROPIC_API_KEY'],
-        patterns: [/\banthropic\b/i, /\bclaude-[\w.-]+/i, /ANTHROPIC_API_KEY/],
-    },
-    {
-        id: 'provider_google',
-        name: 'Google Gemini',
-        kind: 'model_provider',
-        packageNames: ['@google/generative-ai', '@ai-sdk/google', 'google-generativeai'],
-        envVars: ['GOOGLE_GENERATIVE_AI_API_KEY', 'GEMINI_API_KEY'],
-        patterns: [/\bgemini\b/i, /google\.generativeai/i],
-    },
-    {
-        id: 'provider_cohere',
-        name: 'Cohere',
-        kind: 'model_provider',
-        packageNames: ['cohere-ai', 'cohere'],
-        envVars: ['COHERE_API_KEY'],
-        patterns: [/\bcohere\b/i],
-    },
-    {
-        id: 'provider_mistral',
-        name: 'Mistral',
-        kind: 'model_provider',
-        packageNames: ['@mistralai/mistralai', 'mistralai'],
-        envVars: ['MISTRAL_API_KEY'],
-        patterns: [/\bmistral\b/i],
-    },
-    {
-        id: 'provider_ollama',
-        name: 'Ollama',
-        kind: 'model_provider',
-        packageNames: ['ollama'],
-        envVars: ['OLLAMA_HOST'],
-        patterns: [/\bollama\b/i],
-    },
-];
-function detectAgentFrameworks(files) {
-    const frameworks = [];
-    for (const candidate of FRAMEWORK_CATALOG) {
-        const evidence = detectionEvidence(files, candidate.packageNames, candidate.patterns);
-        if (evidence.length === 0)
-            continue;
-        frameworks.push({
-            id: candidate.id,
-            name: candidate.name,
-            kind: candidate.kind,
-            packageNames: [...candidate.packageNames],
-            runtimeAgentIds: [],
-            confidence: evidence.some((item) => item.path === 'package.json' || item.path === 'pyproject.toml') ? 0.82 : 0.66,
-            evidence,
-        });
-    }
-    return frameworks.sort((a, b) => a.id.localeCompare(b.id));
-}
-function detectModelProviders(files) {
-    const providers = [];
-    for (const candidate of PROVIDER_CATALOG) {
-        const evidence = detectionEvidence(files, candidate.packageNames, candidate.patterns);
-        if (evidence.length === 0)
-            continue;
-        const modelHints = modelHintsForProvider(candidate.id, files);
-        providers.push({
-            id: candidate.id,
-            name: candidate.name,
-            kind: candidate.kind,
-            packageNames: [...candidate.packageNames],
-            runtimeAgentIds: [],
-            envVars: [...candidate.envVars],
-            modelHints,
-            confidence: evidence.some((item) => item.path === 'package.json' || item.path === 'pyproject.toml') ? 0.82 : 0.62,
-            evidence,
-        });
-    }
-    return providers.sort((a, b) => a.id.localeCompare(b.id));
-}
-function detectionEvidence(files, packageNames, patterns) {
-    const evidence = [];
-    for (const file of files) {
-        if (file.path === 'package.json' && file.text) {
-            const deps = packageDependencyNames(file.text);
-            const matched = packageNames.filter((name) => deps.has(name));
-            for (const name of matched) {
-                evidence.push({ path: file.path, reason: `Dependency ${name} detected.` });
-            }
-        }
-        if (file.path === 'pyproject.toml' && file.text) {
-            const deps = pyprojectDependencyNames(file.text);
-            for (const name of packageNames) {
-                if (deps.has(name.toLowerCase())) {
-                    evidence.push({ path: file.path, reason: `Python dependency ${name} detected.` });
-                }
-            }
-        }
-        if (!file.text || !/\.(ts|tsx|js|mjs|py|json|toml)$/i.test(file.path))
-            continue;
-        for (const pattern of patterns) {
-            if (pattern.test(file.text)) {
-                evidence.push({ path: file.path, reason: `Source references ${pattern.source}.` });
-                break;
-            }
-        }
-    }
-    return mergeEvidence([], evidence).slice(0, 12);
-}
-function packageDependencyNames(text) {
-    try {
-        const parsed = JSON.parse(text);
-        return new Set([
-            ...Object.keys(parsed.dependencies ?? {}),
-            ...Object.keys(parsed.devDependencies ?? {}),
-            ...Object.keys(parsed.optionalDependencies ?? {}),
-            ...Object.keys(parsed.peerDependencies ?? {}),
-        ]);
-    }
-    catch {
-        return new Set();
-    }
-}
-function pyprojectDependencyNames(text) {
-    // Only extract names from actual dependency contexts, never every quoted string
-    // in the file: that would re-open the "ai"-inside-`keywords = ["ai"]` /
-    // `name = "openai-agents"` false positives this parser exists to avoid. Two
-    // dependency shapes are covered, and membership is tested by exact name:
-    //   - PEP 621 / PEP 518 requirement arrays (`dependencies`/`requires = [...]`,
-    //     `[project.optional-dependencies]`, `[dependency-groups]`): leading
-    //     distribution token of each quoted PEP 508 string (e.g. "openai>=2" -> openai).
-    //   - Poetry tables (`[tool.poetry.dependencies]`, `dev-dependencies`,
-    //     `group.<name>.dependencies`): the bare TOML key (e.g. `openai = "^1.0"`).
-    const names = new Set();
-    const addLeadingToken = (spec) => {
-        const match = spec.match(/^\s*([A-Za-z0-9][A-Za-z0-9._-]*)/);
-        if (match)
-            names.add(match[1].toLowerCase());
-    };
-    const isPoetryDepTable = (section) => /^tool\.poetry\.(dependencies|dev-dependencies|group\.[^.]+\.dependencies)$/.test(section);
-    const isRequirementArrayTable = (section) => section === 'project.optional-dependencies' || section === 'dependency-groups';
-    let section = '';
-    let inDependencyArray = false;
-    for (const raw of text.split(/\r?\n/)) {
-        const line = raw.split('#')[0];
-        const header = line.match(/^\s*\[\[?\s*([^\]]+?)\s*\]\]?\s*$/);
-        if (header) {
-            section = header[1].trim().toLowerCase();
-            inDependencyArray = false;
-            continue;
-        }
-        if (/^\s*(?:dependencies|requires)\s*=\s*\[/.test(line) ||
-            (isRequirementArrayTable(section) && /=\s*\[/.test(line))) {
-            inDependencyArray = true;
-        }
-        if (inDependencyArray) {
-            for (const match of line.matchAll(/["']([^"']+)["']/g))
-                addLeadingToken(match[1]);
-            if (line.includes(']'))
-                inDependencyArray = false;
-            continue;
-        }
-        if (isPoetryDepTable(section)) {
-            const key = line.match(/^\s*([A-Za-z0-9][A-Za-z0-9._-]*)\s*=/);
-            if (key && key[1].toLowerCase() !== 'python')
-                names.add(key[1].toLowerCase());
-        }
-    }
-    return names;
-}
-function modelHintsForProvider(providerId, files) {
-    const hints = new Set();
-    const pattern = providerId === 'provider_anthropic'
-        ? /\bclaude-[A-Za-z0-9_.-]+/g
-        : providerId === 'provider_openai'
-            ? /\bgpt-[A-Za-z0-9_.-]+/g
-            : providerId === 'provider_google'
-                ? /\bgemini-[A-Za-z0-9_.-]+/g
-                : null;
-    if (!pattern)
-        return [];
-    for (const file of files) {
-        if (!file.text)
-            continue;
-        for (const match of file.text.matchAll(pattern)) {
-            hints.add(match[0]);
-        }
-    }
-    return [...hints].sort();
-}
-function frameworkIdsForFile(file) {
-    return FRAMEWORK_CATALOG
-        .filter((candidate) => file.text && candidate.patterns.some((pattern) => pattern.test(file.text ?? '')))
-        .map((candidate) => candidate.id);
-}
-function providerIdsForFile(file) {
-    return PROVIDER_CATALOG
-        .filter((candidate) => file.text && candidate.patterns.some((pattern) => pattern.test(file.text ?? '')))
-        .map((candidate) => candidate.id);
-}
-function linkFrameworksAndProviders(graph) {
-    for (const agent of graph.runtimeAgents) {
-        const agentPaths = new Set([
-            agent.root,
-            ...agent.evidence.map((item) => item.path),
-            ...graph.artifacts
-                .filter((artifact) => agent.entrypointIds.includes(artifact.id) && artifact.sourcePath)
-                .map((artifact) => artifact.sourcePath),
-        ]);
-        for (const framework of graph.agentFrameworks) {
-            if (detectionAppliesToAgent(framework.evidence, agent, agentPaths)) {
-                agent.frameworkIds = unique([...agent.frameworkIds, framework.id]).sort();
-                framework.runtimeAgentIds = unique([...framework.runtimeAgentIds, agent.id]).sort();
-            }
-        }
-        for (const provider of graph.modelProviders) {
-            if (detectionAppliesToAgent(provider.evidence, agent, agentPaths)) {
-                agent.modelProviderIds = unique([...agent.modelProviderIds, provider.id]).sort();
-                provider.runtimeAgentIds = unique([...provider.runtimeAgentIds, agent.id]).sort();
-            }
-        }
-    }
-}
-function detectionAppliesToAgent(evidence, agent, agentPaths) {
-    return evidence.some((item) => item.path === 'package.json' ||
-        item.path === 'pyproject.toml' ||
-        agentPaths.has(item.path) ||
-        item.path.startsWith(`${agent.root}/`));
-}
-function finalizeGraph(graph) {
-    const artifactMap = new Map(graph.artifacts.map((artifact) => [artifact.id, artifact]));
-    const channelMap = new Map(graph.channelAdapters.map((channel) => [channel.id, channel]));
-    const identityMap = new Map(graph.identityNamespaces.map((identity) => [identity.id, identity]));
-    const deploymentMap = new Map(graph.deployments.map((deployment) => [deployment.id, deployment]));
-    for (const agent of graph.runtimeAgents) {
-        for (const entrypointId of agent.entrypointIds) {
-            if (!artifactMap.has(entrypointId)) {
-                const sourcePath = agent.evidence[0]?.path ?? agent.root;
-                const entrypoint = {
-                    id: entrypointId,
-                    type: 'entrypoint',
-                    name: `${agent.name} Entrypoint`,
-                    scope: 'agent',
-                    sourcePath,
-                    ownedByAgentId: agent.id,
-                    usedByAgentIds: [agent.id],
-                    confidence: Math.min(0.82, agent.confidence),
-                    evidence: agent.evidence,
-                };
-                upsertArtifact(graph, entrypoint);
-                artifactMap.set(entrypointId, entrypoint);
-            }
-            graph.relationships.push({
-                type: 'owns_artifact',
-                from: agent.id,
-                to: entrypointId,
-                artifactId: entrypointId,
-                evidence: agent.evidence,
-            });
-        }
-        for (const channelId of agent.channelAdapterIds) {
-            if (!channelMap.has(channelId)) {
-                upsertChannel(graph, {
-                    id: channelId,
-                    name: titleFromId(channelId),
-                    kind: channelId.replace(/^channel_/, ''),
-                    confidence: 0.55,
-                    evidence: agent.evidence,
-                });
-            }
-            graph.relationships.push({
-                type: 'invoked_by_channel',
-                from: agent.id,
-                to: channelId,
-                evidence: agent.evidence,
-            });
-        }
-        for (const artifactId of agent.artifactIds) {
-            if (!artifactMap.has(artifactId)) {
-                const artifact = {
-                    id: artifactId,
-                    type: artifactTypeFromId(artifactId),
-                    name: titleFromId(artifactId),
-                    scope: 'agent',
-                    sourcePath: agent.evidence[0]?.path,
-                    usedByAgentIds: [agent.id],
-                    confidence: 0.45,
-                    evidence: agent.evidence,
-                };
-                upsertArtifact(graph, artifact);
-                artifactMap.set(artifactId, artifact);
-            }
-            const artifact = artifactMap.get(artifactId);
-            if (artifact && !artifact.usedByAgentIds.includes(agent.id)) {
-                artifact.usedByAgentIds.push(agent.id);
-            }
-            graph.relationships.push({
-                type: 'uses_artifact',
-                from: agent.id,
-                to: artifactId,
-                artifactId,
-                evidence: artifact?.evidence ?? agent.evidence,
-            });
-        }
-        for (const identityId of agent.identityNamespaceIds) {
-            if (!identityMap.has(identityId)) {
-                upsertIdentity(graph, {
-                    id: identityId,
-                    name: titleFromId(identityId),
-                    kind: identityId.replace(/^identity_/, ''),
-                    confidence: 0.5,
-                    evidence: agent.evidence,
-                });
-            }
-        }
-        for (const deploymentId of agent.deploymentIds) {
-            if (!deploymentMap.has(deploymentId)) {
-                upsertDeployment(graph, {
-                    id: deploymentId,
-                    name: titleFromId(deploymentId),
-                    confidence: 0.5,
-                    evidence: agent.evidence,
-                });
-            }
-            graph.relationships.push({
-                type: 'deployed_as',
-                from: agent.id,
-                to: deploymentId,
-                evidence: agent.evidence,
-            });
-        }
-    }
-    const familyMap = new Map(graph.agentFamilies.map((family) => [family.id, family]));
-    for (const agent of graph.runtimeAgents) {
-        if (!agent.familyId)
-            continue;
-        const family = familyMap.get(agent.familyId);
-        if (family && !family.runtimeAgentIds.includes(agent.id)) {
-            family.runtimeAgentIds.push(agent.id);
-        }
-    }
-    for (const family of graph.agentFamilies) {
-        const shared = graph.artifacts
-            .filter((artifact) => artifact.usedByAgentIds.filter((agentId) => family.runtimeAgentIds.includes(agentId)).length > 1)
-            .map((artifact) => artifact.id);
-        family.sharedArtifactIds = unique([...family.sharedArtifactIds, ...shared]);
-    }
-    for (const artifact of graph.artifacts) {
-        artifact.usedByAgentIds = unique(artifact.usedByAgentIds).sort();
-        if (artifact.usedByAgentIds.length > 1) {
-            artifact.scope = 'shared';
-            for (const from of artifact.usedByAgentIds) {
-                for (const to of artifact.usedByAgentIds) {
-                    if (from === to)
-                        continue;
-                    graph.relationships.push({
-                        type: 'shares_artifact_with',
-                        from,
-                        to,
-                        artifactId: artifact.id,
-                        evidence: artifact.evidence,
-                    });
-                }
-            }
-        }
-    }
-    for (const identity of graph.identityNamespaces) {
-        if (identity.canonicalId && identity.canonicalId !== identity.id) {
-            graph.relationships.push({
-                type: 'resolves_identity_to',
-                from: identity.id,
-                to: identity.canonicalId,
-                evidence: identity.evidence,
-            });
-        }
-    }
-    if (graph.runtimeAgents.length > 1 && graph.agentFamilies.length === 0) {
-        graph.unknowns.push({
-            id: 'unknown_agent_grouping',
-            question: 'Multiple runtime agents were detected. Confirm whether any should be grouped into an agent family.',
-            candidateIds: graph.runtimeAgents.map((agent) => agent.id),
-            evidence: graph.runtimeAgents.flatMap((agent) => agent.evidence).slice(0, 5),
-        });
-    }
-    graph.agentFamilies.sort((a, b) => a.id.localeCompare(b.id));
-    graph.runtimeAgents.sort((a, b) => a.id.localeCompare(b.id));
-    graph.channelAdapters.sort((a, b) => a.id.localeCompare(b.id));
-    graph.artifacts.sort((a, b) => a.id.localeCompare(b.id));
-    graph.identityNamespaces.sort((a, b) => a.id.localeCompare(b.id));
-    graph.agentFrameworks.sort((a, b) => a.id.localeCompare(b.id));
-    graph.modelProviders.sort((a, b) => a.id.localeCompare(b.id));
-    graph.deployments.sort((a, b) => a.id.localeCompare(b.id));
-    graph.relationships = dedupeRelationships(graph.relationships);
-}
-function upsertRuntimeAgent(graph, next) {
-    const existing = graph.runtimeAgents.find((agent) => agent.id === next.id);
-    if (!existing) {
-        graph.runtimeAgents.push(next);
-        return;
-    }
-    existing.evidence = mergeEvidence(existing.evidence, next.evidence);
-    existing.confidence = Math.max(existing.confidence, next.confidence);
-    existing.entrypointIds = unique([...existing.entrypointIds, ...next.entrypointIds]);
-    existing.channelAdapterIds = unique([...existing.channelAdapterIds, ...next.channelAdapterIds]);
-    existing.artifactIds = unique([...existing.artifactIds, ...next.artifactIds]);
-    existing.identityNamespaceIds = unique([...existing.identityNamespaceIds, ...next.identityNamespaceIds]);
-    existing.deploymentIds = unique([...existing.deploymentIds, ...next.deploymentIds]);
-    existing.frameworkIds = unique([...existing.frameworkIds, ...next.frameworkIds]);
-    existing.modelProviderIds = unique([...existing.modelProviderIds, ...next.modelProviderIds]);
-    existing.familyId = existing.familyId ?? next.familyId;
-    existing.purpose = existing.purpose ?? next.purpose;
-}
-function upsertAgentFamily(graph, next) {
-    const existing = graph.agentFamilies.find((family) => family.id === next.id);
-    if (!existing) {
-        graph.agentFamilies.push(next);
-        return;
-    }
-    existing.evidence = mergeEvidence(existing.evidence, next.evidence);
-    existing.confidence = Math.max(existing.confidence, next.confidence);
-    existing.runtimeAgentIds = unique([...existing.runtimeAgentIds, ...next.runtimeAgentIds]);
-    existing.sharedArtifactIds = unique([...existing.sharedArtifactIds, ...next.sharedArtifactIds]);
-}
-function upsertChannel(graph, next) {
-    const existing = graph.channelAdapters.find((channel) => channel.id === next.id);
-    if (!existing) {
-        graph.channelAdapters.push(next);
-        return;
-    }
-    existing.evidence = mergeEvidence(existing.evidence, next.evidence);
-    existing.confidence = Math.max(existing.confidence, next.confidence);
-}
-function upsertArtifact(graph, next) {
-    const existing = graph.artifacts.find((artifact) => artifact.id === next.id);
-    if (!existing) {
-        graph.artifacts.push(next);
-        return;
-    }
-    existing.evidence = mergeEvidence(existing.evidence, next.evidence);
-    existing.confidence = Math.max(existing.confidence, next.confidence);
-    existing.usedByAgentIds = unique([...existing.usedByAgentIds, ...next.usedByAgentIds]);
-    existing.ownedByAgentId = existing.ownedByAgentId ?? next.ownedByAgentId;
-    existing.contentHash = existing.contentHash ?? next.contentHash;
-    existing.sourcePath = existing.sourcePath ?? next.sourcePath;
-    if (!existing.body && next.body)
-        existing.body = next.body;
-    if (existing.scope !== 'shared')
-        existing.scope = next.scope;
-}
-function upsertIdentity(graph, next) {
-    const existing = graph.identityNamespaces.find((identity) => identity.id === next.id);
-    if (!existing) {
-        graph.identityNamespaces.push(next);
-        return;
-    }
-    existing.evidence = mergeEvidence(existing.evidence, next.evidence);
-    existing.confidence = Math.max(existing.confidence, next.confidence);
-    existing.canonicalId = existing.canonicalId ?? next.canonicalId;
-}
-function upsertEnvironment(graph, next) {
-    const existing = graph.environments.find((env) => env.id === next.id);
-    if (!existing) {
-        graph.environments.push(next);
-        return;
-    }
-    existing.evidence = mergeEvidence(existing.evidence, next.evidence);
-    existing.confidence = Math.max(existing.confidence, next.confidence);
-}
-function upsertDeployment(graph, next) {
-    const existing = graph.deployments.find((deployment) => deployment.id === next.id);
-    if (!existing) {
-        graph.deployments.push(next);
-        return;
-    }
-    existing.evidence = mergeEvidence(existing.evidence, next.evidence);
-    existing.confidence = Math.max(existing.confidence, next.confidence);
-    existing.environmentId = existing.environmentId ?? next.environmentId;
-}
-function contentHashForAnnotatedSource(sourcePath, annotation) {
-    // Reuse the annotation-relative candidate resolver; prefer the canonicalized
-    // repo-relative path first so hashing matches hydrated artifact bodies.
-    const bodyAnnotation = annotation;
-    const rootCandidate = resolve(annotation.rootDir, sourcePath);
-    const candidates = [
-        rootCandidate,
-        ...annotatedSourceCandidates(sourcePath, bodyAnnotation).filter((c) => c !== rootCandidate),
-    ];
-    const seen = new Set();
-    for (const candidate of candidates) {
-        if (seen.has(candidate))
-            continue;
-        seen.add(candidate);
-        const text = readSmallTextFileForHash(candidate, annotation.rootDir);
-        if (text !== undefined)
-            return hashText(text);
-    }
-    return undefined;
-}
-function readSmallTextFileForHash(absPath, rootDir) {
-    if (!existsSync(absPath))
-        return undefined;
-    const rel = normalizePath(relative(rootDir, absPath));
-    if (isSecretishPath(rel))
-        return undefined;
-    let stat;
-    try {
-        stat = lstatSync(absPath);
-    }
-    catch {
-        return undefined;
-    }
-    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_SCANNED_FILE_BYTES) {
-        return undefined;
-    }
-    if (!isTextFile(rel))
-        return undefined;
-    try {
-        return readFileSync(absPath, 'utf8');
-    }
-    catch {
-        return undefined;
-    }
-}
-function dedupeRelationships(relationships) {
-    const seen = new Set();
-    const result = [];
-    for (const relationship of relationships) {
-        const key = [
-            relationship.type,
-            relationship.from,
-            relationship.to,
-            relationship.artifactId ?? '',
-        ].join('\0');
-        if (seen.has(key))
-            continue;
-        seen.add(key);
-        result.push(relationship);
-    }
-    return result.sort((a, b) => `${a.type}:${a.from}:${a.to}:${a.artifactId ?? ''}`.localeCompare(`${b.type}:${b.from}:${b.to}:${b.artifactId ?? ''}`));
-}
-function mergeEvidence(left, right) {
-    const seen = new Set();
-    const result = [];
-    for (const item of [...left, ...right]) {
-        const key = `${item.path}\0${item.reason}`;
-        if (seen.has(key))
-            continue;
-        seen.add(key);
-        result.push(item);
-    }
-    return result;
-}
-function artifactType(value) {
-    if (value === 'entrypoint' ||
-        value === 'prompt' ||
-        value === 'tool' ||
-        value === 'skill' ||
-        value === 'eval' ||
-        value === 'retrieval_index' ||
-        value === 'memory' ||
-        value === 'guardrail' ||
-        value === 'model_config') {
-        return value;
-    }
-    return 'unknown';
-}
-function artifactTypeFromId(id) {
-    if (id.startsWith('prompt_'))
-        return 'prompt';
-    if (id.startsWith('tool_'))
-        return 'tool';
-    if (id.startsWith('skill_'))
-        return 'skill';
-    if (id.startsWith('eval_'))
-        return 'eval';
-    if (id.startsWith('entry_'))
-        return 'entrypoint';
-    if (id.startsWith('memory_'))
-        return 'memory';
-    if (id.startsWith('guardrail_'))
-        return 'guardrail';
-    if (id.startsWith('model_config_'))
-        return 'model_config';
-    return 'unknown';
-}
-function scopeValue(value) {
-    if (value === 'shared' || value === 'global' || value === 'agent')
-        return value;
-    return 'agent';
-}
-function numberValue(value, fallback) {
-    if (!value)
-        return fallback;
-    const parsed = Number(value);
-    return Number.isFinite(parsed) ? Math.max(0, Math.min(1, parsed)) : fallback;
-}
-function first(values) {
-    return values?.[0];
-}
-function unique(values) {
-    return [...new Set(values.filter(Boolean))];
-}
-function stableId(prefix, raw) {
-    const slug = raw
-        .toLowerCase()
-        .replace(/\.[^.]+$/g, '')
-        .replace(/[^a-z0-9]+/g, '_')
-        .replace(/^_+|_+$/g, '')
-        .replace(/_+/g, '_')
-        .slice(0, 72);
-    return `${prefix}_${slug || hashText(raw).slice(0, 10)}`;
-}
-function titleFromId(id) {
-    return id
-        .replace(/^(agent|family|channel|prompt|tool|skill|eval|identity|deploy|entry|env)_/, '')
-        .split(/[_/.-]+/)
-        .filter(Boolean)
-        .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
-        .join(' ') || id;
-}
-function promptNameFromPath(path) {
-    return titleFromId(basename(path).replace(/\.(prompt\.)?(md|json|ya?ml)$/i, ''));
-}
-function normalizePath(path) {
-    return path.split(sep).join('/');
-}
-function hashText(text) {
-    return createHash('sha256').update(text).digest('hex');
-}
-//# sourceMappingURL=harness.js.map