@moda-ai/cli 1.22.0 → 1.22.2

package/dist/index-6h0nc1r5.js

@@ -0,0 +1,2765 @@
+import {
+  SKILL_SOURCE_INTEGRATION_BUNDLED,
+  buildDoctorReport,
+  claudeSkillToCursorRule,
+  codingAgentDisplayName,
+  describeCodingAgentEvent,
+  describeSyncIdentity,
+  describeSyncTenantLabel,
+  detectAgents,
+  detectAvailableCodingAgents,
+  initPrompts,
+  installRules,
+  isDeterministicLocalAnalyst,
+  pollRemoteAnalyzeUntilDone,
+  readSkillsManifest,
+  renderInitBanner,
+  renderInitComplete,
+  renderInitNote,
+  renderInitSetupPlan,
+  renderInitStep,
+  runCodingAgent,
+  runHarnessCommand,
+  runPromptSync,
+  runSkillSync,
+  startRemoteAnalyze,
+  stripAnsi,
+  upsertSkillManifestRecord
+} from "./cli-g8qs2tj9.js";
+import {
+  selectTenantAndCreateKey
+} from "./cli-qszcpda3.js";
+import {
+  CliAuthError,
+  CliInputError,
+  VERSION,
+  createCommandContext,
+  loadToken,
+  login,
+  resolveIngestUrl,
+  resolveModaBaseUrl
+} from "./cli-pwbvtes8.js";
+
+// src/init/index.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readdirSync as readdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname4, join as join6 } from "node:path";
+import { checkbox, confirm, select } from "@inquirer/prompts";
+
+// src/init/sdk-guide.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, join as join3 } from "node:path";
+
+// src/skills-bundled.ts
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+var PACKAGE_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
+var BUNDLED_SKILLS_DIR = join(PACKAGE_ROOT, "skills", "integration");
+function bundledSkillsDir() {
+  return process.env.MODA_BUNDLED_SKILLS_DIR || BUNDLED_SKILLS_DIR;
+}
+function readBundledIndex() {
+  const indexPath = join(bundledSkillsDir(), "index.json");
+  if (!existsSync(indexPath))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync(indexPath, "utf8"));
+    if (!Array.isArray(parsed.skills))
+      return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function installIntegrationSkill(skillId, cwd = process.cwd()) {
+  if (!/^[a-z0-9-]+$/.test(skillId)) {
+    throw new Error(`Invalid integration skill id: ${JSON.stringify(skillId).slice(0, 80)}`);
+  }
+  const sourceDir = join(bundledSkillsDir(), skillId);
+  if (!existsSync(join(sourceDir, "SKILL.md"))) {
+    const bundled = readBundledIndex()?.skills.map((skill) => skill.id) ?? [];
+    throw new Error(`Integration skill '${skillId}' is not bundled with this CLI.${bundled.length > 0 ? ` Bundled skills: ${bundled.join(", ")}` : ""}`);
+  }
+  const files = listFilesRecursive(sourceDir).sort();
+  const plannedWrites = [];
+  for (const file of files) {
+    const relPath = relative(sourceDir, file).replace(/\\/g, "/");
+    plannedWrites.push({
+      targetRelPath: `.claude/skills/${skillId}/${relPath}`,
+      targetPath: join(cwd, ".claude", "skills", skillId, relPath),
+      content: readFileSync(file, "utf8")
+    });
+  }
+  const writeCursor = detectAgents().includes("Cursor") || existsSync(join(cwd, ".cursor"));
+  if (writeCursor) {
+    const skillMd = readFileSync(join(sourceDir, "SKILL.md"), "utf8");
+    plannedWrites.push({
+      targetRelPath: `.cursor/rules/${skillId}.mdc`,
+      targetPath: join(cwd, ".cursor", "rules", `${skillId}.mdc`),
+      content: claudeSkillToCursorRule(skillMd)
+    });
+  }
+  const ownedPaths = new Set((readSkillsManifest(cwd)?.records ?? []).flatMap((record) => record.paths));
+  const collisions = plannedWrites.filter((write) => existsSync(write.targetPath) && !ownedPaths.has(write.targetRelPath));
+  if (collisions.length > 0) {
+    throw new Error(`Refusing to overwrite ${collisions.length} existing file(s) not managed by Moda: ` + `${collisions.map((write) => write.targetRelPath).join(", ")}. ` + "Move or remove them, then re-run to install the bundled integration skill.");
+  }
+  const paths = [];
+  let wroteAny = false;
+  for (const write of plannedWrites) {
+    if (writeIfChanged(write.targetPath, write.content))
+      wroteAny = true;
+    paths.push(write.targetRelPath);
+  }
+  upsertSkillManifestRecord(cwd, {
+    skillId,
+    contentHash: hashSkillDir(sourceDir, files),
+    source: SKILL_SOURCE_INTEGRATION_BUNDLED,
+    paths
+  });
+  return { skillId, status: wroteAny ? "installed" : "unchanged", paths };
+}
+function writeIfChanged(path, content) {
+  if (existsSync(path)) {
+    try {
+      if (readFileSync(path, "utf8") === content)
+        return false;
+    } catch {}
+  }
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, content);
+  return true;
+}
+function listFilesRecursive(dir) {
+  const files = [];
+  const stack = [dir];
+  while (stack.length > 0) {
+    const current = stack.pop();
+    if (!current)
+      continue;
+    for (const entry of readdirSync(current, { withFileTypes: true })) {
+      const path = join(current, entry.name);
+      if (entry.isDirectory())
+        stack.push(path);
+      else if (entry.isFile())
+        files.push(path);
+    }
+  }
+  return files;
+}
+function hashSkillDir(sourceDir, files) {
+  const hash = createHash("sha256");
+  for (const file of files) {
+    hash.update(relative(sourceDir, file).replace(/\\/g, "/"));
+    hash.update("\x00");
+    hash.update(readFileSync(file));
+    hash.update("\x00");
+  }
+  return hash.digest("hex");
+}
+
+// src/init/sdk-catalog.ts
+import {
+  copyFileSync,
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  readdirSync as readdirSync2,
+  rmSync,
+  statSync
+} from "node:fs";
+import { join as join2, relative as relative2, resolve } from "node:path";
+function materializeSdkCatalog(cwd, runId) {
+  if (!/^[a-z0-9-]+$/.test(runId)) {
+    throw new Error(`Invalid SDK catalog run id: ${JSON.stringify(runId).slice(0, 80)}`);
+  }
+  const sourceDir = bundledSkillsDir();
+  const indexPath = join2(sourceDir, "index.json");
+  if (!existsSync2(sourceDir) || !existsSync2(indexPath)) {
+    throw missingBundleError(sourceDir);
+  }
+  const index = readBundledIndex();
+  if (!index) {
+    throw missingBundleError(sourceDir);
+  }
+  const dir = join2(cwd, ".moda", "tmp", `sdk-catalog-${runId}`);
+  cleanupSdkCatalog(dir);
+  copyDirectoryRecursive(sourceDir, dir);
+  return {
+    dir,
+    relativeDir: relative2(cwd, dir).replace(/\\/g, "/"),
+    index
+  };
+}
+function cleanupSdkCatalog(dir) {
+  const normalized = resolve(dir).replace(/\\/g, "/");
+  if (!normalized.includes(".moda/tmp/sdk-catalog-"))
+    return;
+  try {
+    rmSync(dir, { recursive: true, force: true });
+  } catch {}
+}
+function renderCatalogListing(index) {
+  return index.skills.map((skill) => {
+    const targets = [`language: ${skill.targets.language}`];
+    if (skill.targets.frameworks.length > 0) {
+      targets.push(`frameworks: ${skill.targets.frameworks.join(",")}`);
+    }
+    if (skill.targets.providers.length > 0) {
+      targets.push(`providers: ${skill.targets.providers.join(",")}`);
+    }
+    return `- ${skill.id} — ${skill.summary} [${targets.join("; ")}]`;
+  }).join(`
+`);
+}
+function copyDirectoryRecursive(sourceDir, targetDir) {
+  mkdirSync2(targetDir, { recursive: true });
+  for (const entry of readdirSync2(sourceDir, { withFileTypes: true })) {
+    const source = join2(sourceDir, entry.name);
+    const target = join2(targetDir, entry.name);
+    if (entry.isDirectory()) {
+      copyDirectoryRecursive(source, target);
+    } else if (entry.isFile()) {
+      copyFileSync(source, target);
+    }
+  }
+}
+function missingBundleError(sourceDir) {
+  let detail = "is absent";
+  try {
+    if (existsSync2(sourceDir) && !statSync(sourceDir).isDirectory()) {
+      detail = "is not a directory";
+    } else if (existsSync2(sourceDir)) {
+      detail = "has no readable index.json";
+    }
+  } catch {
+    detail = "is not readable";
+  }
+  return new Error(`Bundled SDK skill catalog ${detail} at ${sourceDir}. ` + "Set MODA_BUNDLED_SKILLS_DIR to a built bundle, or run the integration-skill bundle build in a dev tree.");
+}
+
+// src/init/sdk-guide.ts
+var SDK_GUIDE_PATH = ".moda/SDK_INTEGRATION.md";
+function writeSdkIntegrationGuide(cwd = process.cwd()) {
+  const relativePath = SDK_GUIDE_PATH;
+  const absolutePath = join3(cwd, relativePath);
+  const content = renderSdkIntegrationGuideContent();
+  mkdirSync3(dirname2(absolutePath), { recursive: true });
+  writeFileSync2(absolutePath, content);
+  return relativePath;
+}
+function renderSdkIntegrationGuideContent() {
+  const index = readBundledIndex();
+  const catalogSection = index ? [
+    "## Available integration skills",
+    "",
+    renderCatalogListing(index),
+    "",
+    "During `moda init`, Moda materializes these skills into a temporary catalog for your",
+    "coding agent. To integrate by hand, read the matching skill inside the installed CLI",
+    "package (`.../@moda-ai/cli/skills/integration/<id>/SKILL.md`), re-run `moda init` with",
+    "a coding agent CLI installed, or follow https://docs.moda.dev/ingestion.",
+    ""
+  ] : [
+    "## Available integration skills",
+    "",
+    "_The bundled skill index is unavailable in this install; use the generic steps below",
+    "and https://docs.moda.dev/ingestion for stack-specific guidance._",
+    ""
+  ];
+  return [
+    "# Moda SDK Integration Guide",
+    "",
+    "Generated by `moda init`. **The SDK integration was not applied automatically.**",
+    "This checklist gets you there by hand or with your coding agent.",
+    "",
+    ...catalogSection,
+    "## 1. Install the SDK",
+    "",
+    "Install the Moda SDK for your stack with **your** package manager. If a catalog skill",
+    "above matches your repo, use its exact package name and install command.",
+    "",
+    "Examples (adapt to your stack):",
+    "",
+    "Node.js / TypeScript:",
+    "",
+    "```bash",
+    "npm install moda-ai   # or: bun add / pnpm add / yarn add",
+    "```",
+    "",
+    "Python:",
+    "",
+    "```bash",
+    "pip install moda-ai   # or: uv add / poetry add",
+    "```",
+    "",
+    "Do not paste `MODA_API_KEY` into source or `.env` files. Keep it in your deployment",
+    "environment, secret manager, or local shell.",
+    "",
+    "## 2. Initialize Moda before LLM clients",
+    "",
+    "Initialize before any LLM client is created.",
+    "",
+    "Node.js / TypeScript (example):",
+    "",
+    "```ts",
+    "import { Moda } from 'moda-ai';",
+    "",
+    "await Moda.init(process.env.MODA_API_KEY!);",
+    "```",
+    "",
+    "Python (example):",
+    "",
+    "```python",
+    "import os",
+    "",
+    "import moda",
+    "",
+    'moda.init(os.environ["MODA_API_KEY"])',
+    "```",
+    "",
+    "## 3. Set conversation and user context",
+    "",
+    "Set a stable conversation id before each LLM call, and a user id when one user can be",
+    "identified. For concurrent request handlers, use scoped context helpers from the SDK",
+    "instead of setting global context across overlapping requests.",
+    "",
+    "Node.js / TypeScript (example):",
+    "",
+    "```ts",
+    "Moda.conversationId = sessionId;",
+    "Moda.userId = userId;",
+    "```",
+    "",
+    "Python (example):",
+    "",
+    "```python",
+    "moda.conversation_id = session_id",
+    "moda.user_id = user_id",
+    "```",
+    "",
+    "## 4. Flush before exit",
+    "",
+    "Node.js / TypeScript: `await Moda.flush();` — Python: `moda.flush()`.",
+    "",
+    "## 5. Validate",
+    "",
+    "Tenant health (does not prove this integration by itself):",
+    "",
+    "```bash",
+    "moda doctor --online --json",
+    "```",
+    "",
+    "Exact-trace confirmation: send one request through your app with a known conversation id,",
+    "then run `moda audit <that-id>` — you should see your llm span(s).",
+    ""
+  ].join(`
+`);
+}
+function readRuntimeSummary(cwd) {
+  const empty = {
+    runtimeAgents: 0,
+    agentFamilies: 0,
+    frameworks: [],
+    providers: [],
+    runtimeAgentNames: []
+  };
+  const path = join3(cwd, ".moda", "harness.json");
+  if (!existsSync3(path))
+    return empty;
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    if (!isRecord(parsed))
+      return empty;
+    const runtimeAgents = Array.isArray(parsed.runtimeAgents) ? parsed.runtimeAgents : [];
+    const agentFamilies = Array.isArray(parsed.agentFamilies) ? parsed.agentFamilies : [];
+    const frameworks = Array.isArray(parsed.agentFrameworks) ? parsed.agentFrameworks : [];
+    const providers = Array.isArray(parsed.modelProviders) ? parsed.modelProviders : [];
+    return {
+      runtimeAgents: runtimeAgents.length,
+      agentFamilies: agentFamilies.length,
+      runtimeAgentNames: runtimeAgents.map((agent) => isRecord(agent) && typeof agent.name === "string" ? agent.name : undefined).filter((name) => Boolean(name)),
+      frameworks: frameworks.map((framework) => isRecord(framework) && typeof framework.name === "string" ? framework.name : undefined).filter((name) => Boolean(name)),
+      providers: providers.map((provider) => isRecord(provider) && typeof provider.name === "string" ? provider.name : undefined).filter((name) => Boolean(name))
+    };
+  } catch {
+    return empty;
+  }
+}
+function renderRuntimeSummaryBlock(summary) {
+  const runtimeNames = summary.runtimeAgentNames.slice(0, 8);
+  const lines = [
+    `- Runtime agents: ${summary.runtimeAgents}`,
+    `- Agent families: ${summary.agentFamilies}`
+  ];
+  if (summary.frameworks.length > 0) {
+    lines.push(`- Frameworks: ${summary.frameworks.join(", ")}`);
+  }
+  if (summary.providers.length > 0) {
+    lines.push(`- Providers: ${summary.providers.join(", ")}`);
+  }
+  if (runtimeNames.length > 0) {
+    lines.push(`- Runtime agent names: ${runtimeNames.join(", ")}`);
+  }
+  return lines.join(`
+`);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/init/sdk-integration.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import {
+  closeSync,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync4,
+  openSync,
+  readFileSync as readFileSync4,
+  readSync,
+  readdirSync as readdirSync3,
+  rmSync as rmSync2,
+  statSync as statSync2,
+  writeFileSync as writeFileSync3
+} from "node:fs";
+import { dirname as dirname3, join as join5, relative as relative3, resolve as resolve2 } from "node:path";
+import { spawnSync } from "node:child_process";
+
+// src/init/sdk-protocol.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "node:fs";
+import { join as join4 } from "node:path";
+import { z } from "zod";
+var SDK_RESULT_SCHEMA_VERSION = "moda.sdk_integration_result.v1";
+var SDK_RESULT_JSON_BEGIN = "MODA_SDK_RESULT_JSON_BEGIN";
+var SDK_RESULT_JSON_END = "MODA_SDK_RESULT_JSON_END";
+var SDK_RESULT_FILE = ".moda/sdk-integration-result.json";
+var nonemptyString = z.preprocess((value) => {
+  if (typeof value === "string")
+    return value.trim();
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
+  }
+  return value;
+}, z.string().min(1));
+var optionalString = z.preprocess((value) => {
+  if (value === undefined)
+    return;
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    return trimmed || undefined;
+  }
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
+  }
+  return;
+}, z.string().min(1).optional());
+function tolerantArray(itemSchema) {
+  return z.preprocess((value) => {
+    if (!Array.isArray(value))
+      return [];
+    const accepted = [];
+    for (const item of value) {
+      const parsed = itemSchema.safeParse(item);
+      if (parsed.success)
+        accepted.push(parsed.data);
+    }
+    return accepted;
+  }, z.array(itemSchema)).default([]);
+}
+var callSiteSchema = z.union([
+  nonemptyString.transform((file) => ({ file })),
+  z.object({
+    file: nonemptyString,
+    detail: optionalString
+  })
+]);
+var exitCodeSchema = z.preprocess((value) => {
+  if (value === null)
+    return null;
+  if (typeof value === "string" && value.trim() !== "") {
+    const numeric = Number(value);
+    return Number.isFinite(numeric) ? numeric : value;
+  }
+  return value;
+}, z.union([z.number().finite(), z.null()]));
+var commandSchema = z.object({
+  command: nonemptyString,
+  exit_code: exitCodeSchema,
+  kind: optionalString
+});
+var smokeSchema = z.object({
+  method: nonemptyString,
+  command: optionalString,
+  verification_id: nonemptyString
+});
+var failureSchema = z.object({
+  class: nonemptyString,
+  detail: nonemptyString
+});
+var SdkAgentResultSchema = z.object({
+  schema_version: z.string().trim().pipe(z.literal(SDK_RESULT_SCHEMA_VERSION)),
+  status: z.preprocess((value) => typeof value === "string" ? value.trim() : value, z.enum([
+    "integrated",
+    "needs_human_input",
+    "repository_checks_failed",
+    "smoke_execution_failed",
+    "nothing_to_integrate",
+    "failed"
+  ])),
+  summary: nonemptyString,
+  skills_consulted: tolerantArray(nonemptyString),
+  skills_used: tolerantArray(nonemptyString),
+  packages_installed: tolerantArray(nonemptyString),
+  files_changed: tolerantArray(nonemptyString),
+  call_sites_instrumented: tolerantArray(callSiteSchema),
+  commands_run: tolerantArray(commandSchema),
+  smoke: z.preprocess((value) => value ?? null, smokeSchema.nullable()).default(null),
+  remaining_actions: tolerantArray(nonemptyString),
+  failure: z.preprocess((value) => value ?? null, failureSchema.nullable()).default(null)
+});
+function extractSdkAgentResult(opts) {
+  const diagnostics = [];
+  const resultPath = join4(opts.cwd, SDK_RESULT_FILE);
+  if (existsSync4(resultPath)) {
+    try {
+      const parsed = parseCandidate(readFileSync3(resultPath, "utf8"));
+      if (parsed.result)
+        return { result: parsed.result, source: "file" };
+      diagnostics.push(`result file: ${parsed.detail}`);
+    } catch (error) {
+      diagnostics.push(`result file: ${errorMessage(error)}`);
+    }
+  }
+  const output = [opts.stdout, opts.stderr].filter(Boolean).join(`
+`);
+  const candidates = markerCandidates(output);
+  for (const [index, candidate] of candidates.entries()) {
+    const parsed = parseCandidate(candidate);
+    if (parsed.result)
+      return { result: parsed.result, source: "markers" };
+    diagnostics.push(`marker block ${index + 1}: ${parsed.detail}`);
+  }
+  if (candidates.length === 0) {
+    diagnostics.push(`no ${SDK_RESULT_JSON_BEGIN}/${SDK_RESULT_JSON_END} marker block found`);
+  }
+  return {
+    error: "SDK integration result protocol violation.",
+    detail: diagnostics.join("; ")
+  };
+}
+function markerCandidates(output) {
+  const pattern = new RegExp(`${SDK_RESULT_JSON_BEGIN}\\s*([\\s\\S]*?)\\s*${SDK_RESULT_JSON_END}`, "g");
+  const candidates = [];
+  for (const match of output.matchAll(pattern)) {
+    if (match[1])
+      candidates.push(match[1]);
+  }
+  return candidates;
+}
+function parseCandidate(candidate) {
+  let value;
+  try {
+    value = JSON.parse(candidate.trim());
+  } catch (error) {
+    return { detail: `invalid JSON (${errorMessage(error)})` };
+  }
+  const parsed = SdkAgentResultSchema.safeParse(value);
+  if (parsed.success)
+    return { result: parsed.data };
+  const detail = parsed.error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`).join(", ");
+  return { detail: `validation failed (${detail})` };
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/init/sdk-verification.ts
+import { randomBytes } from "node:crypto";
+var DEFAULT_TIMEOUT_MS = 90000;
+var DEFAULT_POLL_INTERVAL_MS = 3000;
+var MIN_TIMEOUT_MS = 1e4;
+var MAX_TIMEOUT_MS = 600000;
+function generateVerificationId() {
+  return `moda-verify-${randomBytes(16).toString("hex")}`;
+}
+async function verifyExactTrace(opts) {
+  const now = opts.now ?? Date.now;
+  const sleep = opts.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
+  const fetchAudit = opts.fetchAudit;
+  const timeoutMs = opts.timeoutMs === undefined || !Number.isFinite(opts.timeoutMs) ? resolveTimeoutFromEnv() : Math.max(0, opts.timeoutMs);
+  const requestedPollInterval = opts.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const pollIntervalMs = Number.isFinite(requestedPollInterval) ? Math.max(1, requestedPollInterval) : DEFAULT_POLL_INTERVAL_MS;
+  const startedAt = now();
+  const deadline = startedAt + Math.max(0, timeoutMs);
+  let polls = 0;
+  let lastError;
+  let counts = {
+    total_spans: 0,
+    llm_spans: 0,
+    tool_spans: 0,
+    trace_ids: [],
+    orphan_count: 0,
+    duplicate_count: 0,
+    ingest_rows: 0
+  };
+  if (!fetchAudit) {
+    lastError = "verification requires an explicit audit fetcher bound to the provisioned API key";
+    return buildEvidence(false);
+  }
+  while (true) {
+    polls++;
+    try {
+      const response = await fetchAudit(opts.verificationId);
+      const parsed = readAuditCounts(response);
+      if (parsed) {
+        counts = parsed;
+        if (counts.total_spans >= 1 && counts.llm_spans >= 1) {
+          return buildEvidence(true);
+        }
+      }
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : String(error);
+    }
+    const currentTime = now();
+    if (currentTime >= deadline)
+      return buildEvidence(false);
+    await sleep(Math.min(pollIntervalMs, deadline - currentTime));
+  }
+  function buildEvidence(observed) {
+    return {
+      observed,
+      verification_id: opts.verificationId,
+      ...counts,
+      elapsed_ms: Math.max(0, now() - startedAt),
+      polls,
+      ...lastError ? { last_error: lastError } : {}
+    };
+  }
+}
+function resolveTimeoutFromEnv() {
+  const raw = process.env.MODA_SDK_VERIFY_TIMEOUT_MS;
+  if (!raw)
+    return DEFAULT_TIMEOUT_MS;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed))
+    return DEFAULT_TIMEOUT_MS;
+  return Math.min(MAX_TIMEOUT_MS, Math.max(MIN_TIMEOUT_MS, Math.trunc(parsed)));
+}
+function readAuditCounts(value) {
+  if (!isRecord2(value) || !isRecord2(value.summary))
+    return;
+  const summary = value.summary;
+  if (!isNonNegativeNumber(summary.total_spans) || !isRecord2(summary.by_type))
+    return;
+  return {
+    total_spans: summary.total_spans,
+    llm_spans: isNonNegativeNumber(summary.by_type.llm) ? summary.by_type.llm : 0,
+    tool_spans: isNonNegativeNumber(summary.by_type.tool) ? summary.by_type.tool : 0,
+    trace_ids: Array.isArray(summary.trace_ids) ? summary.trace_ids.filter((item) => typeof item === "string") : [],
+    orphan_count: isNonNegativeNumber(summary.orphan_count) ? summary.orphan_count : 0,
+    duplicate_count: isNonNegativeNumber(summary.duplicate_count) ? summary.duplicate_count : 0,
+    ingest_rows: isNonNegativeNumber(summary.ingest_rows) ? summary.ingest_rows : 0
+  };
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNonNegativeNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0;
+}
+async function fetchAuditWithApiKey(id, apiKey, baseUrl) {
+  const url = `${baseUrl}/api/v1/data/audit/${encodeURIComponent(id)}?kind=conversation`;
+  const response = await fetch(url, {
+    method: "GET",
+    headers: { "x-api-key": apiKey },
+    signal: AbortSignal.timeout(1e4)
+  });
+  const body = await response.text();
+  if (!response.ok) {
+    throw new Error(`Audit fetch failed (${response.status}): ${body.slice(0, 200)}`);
+  }
+  return JSON.parse(body);
+}
+
+// src/init/sdk-integration.ts
+var OUTCOME_SCHEMA_VERSION = "moda.sdk_integration_outcome.v1";
+var MAX_SCAN_FILE_BYTES = 1048576;
+var MAX_SCANNED_FILES = 2000;
+var MAX_SCAN_DIRECTORIES = 2000;
+var SECRET_KEY_PATTERN = /moda_sk_[A-Za-z0-9]{8,}/g;
+var DEGRADED_GUARDS_NOTE = "changed-file guards degraded: not a git repository";
+async function runSdkIntegration(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const available = detectAvailableCodingAgents();
+  if (available.length === 0) {
+    return { status: "agent_unavailable", repair_attempts: 0 };
+  }
+  const adapter = options.adapter && available.some((item) => item.adapter === options.adapter) ? options.adapter : available[0].adapter;
+  const human = options.human ?? false;
+  const emit = (message) => {
+    const redacted = redactSecretText(message, options.apiKey);
+    options.onProgress?.(redacted);
+    if (human)
+      process.stderr.write(`  ${codingAgentDisplayName(adapter)}: ${redacted}
+`);
+  };
+  const runAgent = options.runAgent ?? runCodingAgent;
+  const verify = options.verify ?? verifyExactTrace;
+  const maxRepairAttempts = resolveMaxRepairAttempts(options.maxRepairAttempts);
+  const runId = randomBytes2(4).toString("hex");
+  const verificationId = generateVerificationId();
+  let catalog;
+  let gitBaseline = null;
+  let runStartedAt = Date.now();
+  let guardsDegraded = false;
+  let degradedGuardsEmitted = false;
+  const markGuardsDegraded = () => {
+    guardsDegraded = true;
+    if (degradedGuardsEmitted)
+      return;
+    degradedGuardsEmitted = true;
+    emit(DEGRADED_GUARDS_NOTE);
+  };
+  try {
+    catalog = materializeSdkCatalog(cwd, runId);
+    gitBaseline = snapshotGitStatus(cwd);
+    runStartedAt = Date.now();
+    if (gitBaseline === null)
+      markGuardsDegraded();
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return {
+      status: "agent_failed",
+      adapter,
+      verification_id: verificationId,
+      repair_attempts: 0,
+      detail: redactSecretText(`Could not materialize the SDK skill catalog: ${detail}`, options.apiKey)
+    };
+  }
+  const attemptCtx = {
+    cwd,
+    adapter,
+    verificationId,
+    catalog,
+    gitBaseline,
+    apiKey: options.apiKey,
+    ingestUrl: options.ingestUrl,
+    human,
+    emit,
+    onEvent: options.onEvent,
+    onPhase: options.onPhase,
+    runAgent,
+    verify,
+    fetchAudit: options.fetchAudit,
+    verifyTimeoutMs: options.verifyTimeoutMs
+  };
+  let repairAttemptsUsed = 0;
+  let lastAgentResult;
+  let lastVerification;
+  let lastSecurityFindings;
+  let lastOutcome = { status: "agent_failed", detail: "No agent attempt completed." };
+  let installedSkillIds;
+  let protocolRetryUsed = false;
+  try {
+    options.onPhase?.("investigating", "Investigating repository and integrating the Moda SDK…");
+    emit("Starting SDK integration…");
+    while (true) {
+      const isRepair = repairAttemptsUsed > 0;
+      const prompt = isRepair ? renderSdkRepairPrompt({
+        catalogDir: catalog.relativeDir,
+        catalogListing: renderCatalogListing(catalog.index),
+        verificationId,
+        attempt: repairAttemptsUsed,
+        maxAttempts: maxRepairAttempts,
+        classification: lastOutcome.repairable ?? "telemetry_not_observed",
+        previousResult: lastAgentResult,
+        verification: lastVerification,
+        securityFindings: lastSecurityFindings,
+        harnessSummary: readRuntimeSummary(cwd)
+      }) : renderSdkIntegrationPrompt({
+        catalogDir: catalog.relativeDir,
+        catalogListing: renderCatalogListing(catalog.index),
+        verificationId,
+        harnessSummary: readRuntimeSummary(cwd)
+      });
+      const run = await invokeAgent(attemptCtx, prompt);
+      const extraction = await extractResultWithProtocolRetry(attemptCtx, run, protocolRetryUsed, () => {
+        protocolRetryUsed = true;
+      });
+      if ("agentFailed" in extraction) {
+        lastOutcome = extraction.agentFailed;
+        break;
+      }
+      lastAgentResult = sanitizeAgentResult(extraction.result, options.apiKey);
+      removeAgentResultFile(cwd);
+      const guards = applyDeterministicGuards(cwd, gitBaseline, lastAgentResult, runStartedAt, options.apiKey);
+      if (guards.guardsDegraded)
+        markGuardsDegraded();
+      lastSecurityFindings = guards.securityFindings.length > 0 ? guards.securityFindings : undefined;
+      if (guards.securityFindings.length > 0) {
+        lastOutcome = {
+          status: "needs_human_input",
+          detail: "remove the leaked key, rotate it, and keep secrets in the environment"
+        };
+        break;
+      }
+      if (guards.dishonestIntegrated) {
+        lastOutcome = {
+          status: "agent_failed",
+          detail: "agent reported integration but no files changed"
+        };
+        break;
+      }
+      lastOutcome = await mapAgentResultToOutcome(attemptCtx, lastAgentResult);
+      if (lastOutcome.verification) {
+        lastVerification = lastOutcome.verification;
+      }
+      if (!lastOutcome.repairable || repairAttemptsUsed >= maxRepairAttempts) {
+        break;
+      }
+      repairAttemptsUsed += 1;
+      options.onPhase?.("repairing", `Repairing SDK integration (attempt ${repairAttemptsUsed} of ${maxRepairAttempts})…`);
+      emit(`Repair attempt ${repairAttemptsUsed} of ${maxRepairAttempts}…`);
+    }
+    if (lastOutcome.status === "integrated_verified" && lastAgentResult) {
+      installedSkillIds = installUsedSkills(lastAgentResult, catalog, cwd, emit);
+    }
+    const finalStatus = lastOutcome.status;
+    const finalDetail = composeFinalDetail(finalStatus, lastOutcome.detail, lastVerification, options.apiKey, guardsDegraded);
+    writeFinalOutcomeArtifact(cwd, {
+      status: finalStatus,
+      verification_id: verificationId,
+      verification: lastVerification,
+      agent_result: lastAgentResult,
+      repair_attempts: repairAttemptsUsed,
+      security_findings: lastSecurityFindings
+    });
+    return {
+      status: finalStatus,
+      adapter,
+      verification_id: verificationId,
+      verification: lastVerification,
+      agent_result: lastAgentResult,
+      repair_attempts: repairAttemptsUsed,
+      ...lastSecurityFindings ? { security_findings: lastSecurityFindings } : {},
+      ...installedSkillIds ? { installed_skill_ids: installedSkillIds } : {},
+      ...finalDetail ? { detail: finalDetail } : {}
+    };
+  } finally {
+    cleanupSdkCatalog(catalog.dir);
+  }
+}
+function renderSdkIntegrationPrompt(opts) {
+  const summary = opts.harnessSummary;
+  const hasHarnessSignals = Boolean(summary && (summary.runtimeAgents > 0 || summary.frameworks.length > 0 || summary.providers.length > 0));
+  const harnessBlock = summary && hasHarnessSignals ? [
+    "Context from Moda's earlier harness discovery (may be incomplete):",
+    renderRuntimeSummaryBlock(summary),
+    ""
+  ] : [];
+  return [
+    "You are running inside `moda init` as a one-shot SDK integration task. The user has",
+    "approved letting you install packages and edit source files in THIS repository to add",
+    "Moda LLM observability. Do the integration now — do not just describe it.",
+    "",
+    ...SAFETY_RULES,
+    "",
+    "Investigation:",
+    "- Inspect this repository yourself: workspace/monorepo layout, package manifests and",
+    "  lockfiles, scripts, app entry points, LLM clients/wrappers, existing telemetry or",
+    "  existing Moda setup, tests/build/typecheck/lint commands, and runtime requirements.",
+    "- If Moda is already integrated, do not duplicate it. You MUST still run the smoke",
+    "  through the EXISTING integration with the provided verification id, then report",
+    "  `nothing_to_integrate` with an honest summary and the `smoke` field set.",
+    "",
+    ...harnessBlock,
+    "Skill catalog (read relevant skills; multiple may apply):",
+    opts.catalogListing,
+    "",
+    `Read \`${opts.catalogDir}/<id>/SKILL.md\` for every skill relevant to this repo`,
+    "(EXAMPLE.md beside it shows the finished integration). Multiple skills may apply",
+    "(e.g. a monorepo with a Node service and a Python service, or two providers) —",
+    "apply each relevant one. The catalog is guidance, not a constraint: if the repo's",
+    "stack has no matching skill, use the closest skill plus the docs pattern, and say",
+    "so in the result.",
+    "",
+    "Repository checks:",
+    "- Discover and run this repo's own build/typecheck/lint/test commands relevant to",
+    "  your changes; record each in commands_run with exit codes.",
+    "- If they fail and you cannot fix within the integration scope → status",
+    "  repository_checks_failed.",
+    "",
+    "Smoke + verification id:",
+    `- Run one real request through an instrumented application path that makes an actual`,
+    "  LLM call, with the Moda conversation id set to EXACTLY",
+    `  \`${opts.verificationId}\` (each skill documents the conversation-id API, e.g.`,
+    "  Moda.conversationId / moda.conversation_id).",
+    "- Prefer a minimal temporary script under .moda/tmp/ (delete it after) or an existing",
+    "  safe entry point — never a destructive path (no prod mutations, no long-running",
+    "  servers left up). Flush before exit.",
+    "- MODA_API_KEY and MODA_INGEST_URL are already exported in your environment for the",
+    "  smoke run — reference them, never print or copy their values.",
+    "- If the smoke cannot run (missing provider key, needs a running service you cannot",
+    "  start safely) → status smoke_execution_failed or needs_human_input with",
+    "  remaining_actions.",
+    "",
+    renderResultProtocolSection()
+  ].join(`
+`);
+}
+function renderSdkRepairPrompt(opts) {
+  const evidence = {
+    previous_agent_result: opts.previousResult ?? null,
+    verification: opts.verification ?? null,
+    security_findings: opts.securityFindings ?? []
+  };
+  return [
+    `Repair attempt ${opts.attempt} of ${opts.maxAttempts} failed: ${opts.classification}`,
+    "",
+    "Structured evidence from the previous attempt:",
+    JSON.stringify(evidence, null, 2),
+    "",
+    ...SAFETY_RULES,
+    "",
+    `Skill catalog directory: ${opts.catalogDir}`,
+    opts.catalogListing,
+    "",
+    `Use the SAME verification id for the smoke run: \`${opts.verificationId}\`.`,
+    "Re-run only what is needed; report honestly via the result protocol.",
+    "",
+    renderResultProtocolSection()
+  ].join(`
+`);
+}
+var SAFETY_RULES = [
+  "Scope and safety rules:",
+  "- Only touch this repository (the working directory you were launched in).",
+  "- Install the Moda SDK with the package manager this repo already uses.",
+  "- Instrument the real LLM call sites; do not invent files or frameworks that are not here.",
+  "- NEVER write MODA_API_KEY or any secret into source files, and never create or edit",
+  "  .env files. The key is already exported in your environment as MODA_API_KEY for the",
+  "  smoke run — reference it, never print or copy its value.",
+  "- Make the smallest correct change. Match the existing code style and imports.",
+  "- Do not modify anything under the ephemeral skill catalog directory.",
+  "- Do not run `git commit`.",
+  "- Do not edit `.moda/` state files except `.moda/sdk-integration-result.json`.",
+  "- If the repo has no LLM calls or something is ambiguous, stop and report honestly",
+  "  via the result protocol."
+];
+function renderResultProtocolSection() {
+  return [
+    "Result protocol (REQUIRED — write file AND print markers as your last output):",
+    `- Write \`${SDK_RESULT_FILE}\` with schema_version \`${SDK_RESULT_SCHEMA_VERSION}\`.`,
+    `- Print the same JSON between ${SDK_RESULT_JSON_BEGIN} and ${SDK_RESULT_JSON_END}.`,
+    "Fields:",
+    "- schema_version (required): must be moda.sdk_integration_result.v1",
+    "- status (required): integrated | needs_human_input | repository_checks_failed |",
+    "  smoke_execution_failed | nothing_to_integrate | failed",
+    "- summary (required): one-line human summary",
+    "- skills_consulted: string[] of catalog skill ids you read",
+    "- skills_used: string[] of catalog skill ids you applied",
+    "- packages_installed: string[]",
+    "- files_changed: string[] of repo-relative paths",
+    "- call_sites_instrumented: { file, detail? }[] (plain strings accepted as {file})",
+    "- commands_run: { command, exit_code, kind? }[]",
+    `- smoke: { method, command?, verification_id } | null — verification_id must be exactly`,
+    "  the id provided above when smoke ran",
+    "- remaining_actions: string[] for the human when blocked",
+    "- failure: { class, detail } | null",
+    "",
+    "Report honestly: `integrated` means you completed integration, checks passed, and the",
+    "smoke ran — Moda will independently verify the trace; false claims are detected."
+  ].join(`
+`);
+}
+function resolveMaxRepairAttempts(override) {
+  if (override !== undefined && Number.isFinite(override)) {
+    return Math.min(3, Math.max(0, Math.trunc(override)));
+  }
+  const raw = process.env.MODA_SDK_REPAIR_ATTEMPTS;
+  if (!raw)
+    return 1;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed))
+    return 1;
+  return Math.min(3, Math.max(0, Math.trunc(parsed)));
+}
+function snapshotGitStatus(cwd) {
+  const result = spawnSync("git", ["-c", "core.quotePath=off", "status", "--porcelain"], {
+    cwd,
+    encoding: "utf8"
+  });
+  if (result.status !== 0)
+    return null;
+  return result.stdout ?? "";
+}
+function gitDelta(baseline, cwd) {
+  const after = snapshotGitStatus(cwd);
+  if (baseline === null || after === null)
+    return { lines: [], degraded: true };
+  const beforeLines = new Set(baseline.split(`
+`).filter(Boolean));
+  return {
+    lines: after.split(`
+`).filter((line) => line && !beforeLines.has(line)),
+    degraded: false
+  };
+}
+function parseGitDeltaPaths(deltaLines) {
+  const paths = [];
+  for (const line of deltaLines) {
+    if (!line.trim())
+      continue;
+    const body = line.slice(3).trim();
+    if (!body)
+      continue;
+    const renameAt = body.lastIndexOf(" -> ");
+    const rawPath = renameAt >= 0 ? body.slice(renameAt + 4) : body;
+    paths.push(unquoteGitPath(rawPath));
+  }
+  return paths;
+}
+var GIT_QUOTE_ESCAPES = {
+  '"': 34,
+  "\\": 92,
+  a: 7,
+  b: 8,
+  f: 12,
+  n: 10,
+  r: 13,
+  t: 9,
+  v: 11
+};
+function unquoteGitPath(path) {
+  const trimmed = path.trim();
+  if (trimmed.length < 2 || trimmed[0] !== '"' || trimmed.at(-1) !== '"')
+    return trimmed;
+  const inner = trimmed.slice(1, -1);
+  const bytes = [];
+  for (let i = 0;i < inner.length; i++) {
+    const ch = inner[i];
+    if (ch !== "\\") {
+      for (const byte of Buffer.from(ch, "utf8"))
+        bytes.push(byte);
+      continue;
+    }
+    const octal = inner.slice(i + 1, i + 4);
+    if (/^[0-7]{3}$/.test(octal)) {
+      bytes.push(parseInt(octal, 8));
+      i += 3;
+      continue;
+    }
+    const next = inner[i + 1];
+    if (next !== undefined && GIT_QUOTE_ESCAPES[next] !== undefined) {
+      bytes.push(GIT_QUOTE_ESCAPES[next]);
+      i += 1;
+      continue;
+    }
+    bytes.push(92);
+  }
+  return Buffer.from(bytes).toString("utf8");
+}
+var MTIME_SLACK_MS = 2000;
+function filesTouchedSince(cwd, paths, sinceMs) {
+  const resolvedCwd = resolve2(cwd);
+  return paths.some((relPath) => {
+    const absPath = resolve2(cwd, relPath.replace(/\\/g, "/"));
+    if (!absPath.startsWith(resolvedCwd + "/") && absPath !== resolvedCwd)
+      return false;
+    try {
+      return statSync2(absPath).mtimeMs >= sinceMs - MTIME_SLACK_MS;
+    } catch {
+      return false;
+    }
+  });
+}
+function applyDeterministicGuards(cwd, gitBaseline, result, runStartedAt, apiKey) {
+  const delta = gitDelta(gitBaseline, cwd);
+  const deltaPaths = parseGitDeltaPaths(delta.lines);
+  const candidatePaths = uniquePaths([...deltaPaths, ...result.files_changed]);
+  const securityFindings = scanForSecrets(cwd, candidatePaths, apiKey);
+  const claimCorroborated = deltaPaths.length > 0 || filesTouchedSince(cwd, result.files_changed, runStartedAt);
+  const dishonestIntegrated = result.status === "integrated" && (delta.degraded ? result.files_changed.length === 0 : !claimCorroborated);
+  return { securityFindings, dishonestIntegrated, guardsDegraded: delta.degraded };
+}
+function uniquePaths(paths) {
+  return [...new Set(paths.map((p) => p.replace(/\\/g, "/")).filter(Boolean))];
+}
+function scanForSecrets(cwd, paths, apiKey) {
+  const findings = [];
+  const resolvedCwd = resolve2(cwd);
+  const scanPaths = collectSecretScanFiles(cwd, paths);
+  for (const relPath of scanPaths) {
+    const absPath = resolve2(cwd, relPath);
+    if (!absPath.startsWith(resolvedCwd + "/") && absPath !== resolvedCwd)
+      continue;
+    if (!existsSync5(absPath))
+      continue;
+    let stat;
+    try {
+      stat = statSync2(absPath);
+    } catch {
+      continue;
+    }
+    if (!stat.isFile())
+      continue;
+    let content;
+    try {
+      content = stat.size > MAX_SCAN_FILE_BYTES ? readFilePrefix(absPath, MAX_SCAN_FILE_BYTES) : readFileSync4(absPath, "utf8");
+    } catch {
+      continue;
+    }
+    if (content.includes("\x00"))
+      continue;
+    let leaked = false;
+    if (apiKey && content.includes(apiKey))
+      leaked = true;
+    SECRET_KEY_PATTERN.lastIndex = 0;
+    if (SECRET_KEY_PATTERN.test(content))
+      leaked = true;
+    if (leaked)
+      findings.push(relPath.replace(/\\/g, "/"));
+  }
+  return findings;
+}
+function readFilePrefix(absPath, maxBytes) {
+  const fd = openSync(absPath, "r");
+  try {
+    const buffer = Buffer.allocUnsafe(maxBytes);
+    const bytesRead = readSync(fd, buffer, 0, maxBytes, 0);
+    return buffer.toString("utf8", 0, bytesRead);
+  } finally {
+    closeSync(fd);
+  }
+}
+function collectSecretScanFiles(cwd, paths) {
+  const resolvedCwd = resolve2(cwd);
+  const files = [];
+  const seenFiles = new Set;
+  let visitedDirectories = 0;
+  const isInsideRepo = (path) => path === resolvedCwd || path.startsWith(`${resolvedCwd}/`);
+  const addFile = (path) => {
+    if (files.length >= MAX_SCANNED_FILES || !isInsideRepo(path))
+      return;
+    const relPath = relative3(resolvedCwd, path).replace(/\\/g, "/");
+    if (!relPath || seenFiles.has(relPath))
+      return;
+    seenFiles.add(relPath);
+    files.push(relPath);
+  };
+  const addEnvFiles = (dir) => {
+    if (files.length >= MAX_SCANNED_FILES || !isInsideRepo(dir))
+      return;
+    let entries;
+    try {
+      entries = readdirSync3(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.isFile() && (entry.name === ".env" || entry.name.startsWith(".env."))) {
+        addFile(join5(dir, entry.name));
+      }
+    }
+  };
+  const addDirectoryFiles = (rootDir) => {
+    const stack = [rootDir];
+    while (stack.length > 0 && files.length < MAX_SCANNED_FILES && visitedDirectories < MAX_SCAN_DIRECTORIES) {
+      const dir = stack.pop();
+      if (!dir || !isInsideRepo(dir))
+        continue;
+      visitedDirectories += 1;
+      let entries;
+      try {
+        entries = readdirSync3(dir, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      for (const entry of entries) {
+        if (files.length >= MAX_SCANNED_FILES)
+          break;
+        const path = join5(dir, entry.name);
+        if (entry.isDirectory())
+          stack.push(path);
+        else if (entry.isFile())
+          addFile(path);
+      }
+    }
+  };
+  addEnvFiles(resolvedCwd);
+  const candidates = uniquePaths(paths).slice(0, MAX_SCANNED_FILES);
+  for (const relPath of candidates) {
+    if (files.length >= MAX_SCANNED_FILES)
+      break;
+    const absPath = resolve2(cwd, relPath);
+    if (!isInsideRepo(absPath))
+      continue;
+    addEnvFiles(dirname3(absPath));
+    if (!existsSync5(absPath))
+      continue;
+    let stat;
+    try {
+      stat = statSync2(absPath);
+    } catch {
+      continue;
+    }
+    if (stat.isFile())
+      addFile(absPath);
+    else if (stat.isDirectory() && relPath.replace(/\\/g, "/").endsWith("/")) {
+      addDirectoryFiles(absPath);
+    }
+  }
+  return files;
+}
+async function invokeAgent(ctx, prompt) {
+  const env = { ...process.env };
+  if (ctx.apiKey)
+    env.MODA_API_KEY = ctx.apiKey;
+  if (ctx.ingestUrl)
+    env.MODA_INGEST_URL = ctx.ingestUrl;
+  return ctx.runAgent({
+    adapter: ctx.adapter,
+    prompt,
+    rootDir: ctx.cwd,
+    mode: "write",
+    env,
+    stream: ctx.human || Boolean(ctx.onEvent),
+    progressToStderr: false,
+    onProgress: (message) => ctx.emit(message),
+    onAgentEvent: (event) => {
+      ctx.onEvent?.(event);
+      const card = describeCodingAgentEvent(event);
+      if (card)
+        ctx.emit(card);
+    }
+  });
+}
+async function extractResultWithProtocolRetry(ctx, run, protocolRetryUsed, onProtocolRetry) {
+  if (run.failedToStart) {
+    return { agentFailed: { status: "agent_failed", detail: "CLI failed to start" } };
+  }
+  if (run.timedOut) {
+    return { agentFailed: { status: "agent_failed", detail: "timed out" } };
+  }
+  let extraction = extractSdkAgentResult({ cwd: ctx.cwd, stdout: run.stdout, stderr: run.stderr });
+  if ("error" in extraction && !protocolRetryUsed) {
+    onProtocolRetry();
+    ctx.emit("Agent did not emit a valid result; requesting protocol retry…");
+    const retryRun = await invokeAgent(ctx, renderProtocolRetryPrompt(ctx.catalog.relativeDir));
+    if (retryRun.failedToStart) {
+      return { agentFailed: { status: "agent_failed", detail: "CLI failed to start" } };
+    }
+    if (retryRun.timedOut) {
+      return { agentFailed: { status: "agent_failed", detail: "timed out" } };
+    }
+    extraction = extractSdkAgentResult({
+      cwd: ctx.cwd,
+      stdout: retryRun.stdout,
+      stderr: retryRun.stderr
+    });
+  }
+  if ("error" in extraction) {
+    const tail = redactOutputTail(`${run.stdout}
+${run.stderr}`, ctx.apiKey);
+    const exitNote = run.status !== 0 ? ` exited with status ${run.status ?? "unknown"}.` : ".";
+    return {
+      agentFailed: {
+        status: "agent_failed",
+        detail: `SDK integration result protocol violation${exitNote}${tail ? `
+${tail}` : ""}`
+      }
+    };
+  }
+  return { result: extraction.result };
+}
+function renderProtocolRetryPrompt(catalogDir) {
+  return [
+    "Your previous run did not emit a valid SDK integration result.",
+    "Write `.moda/sdk-integration-result.json` AND print the same JSON between",
+    `${SDK_RESULT_JSON_BEGIN} and ${SDK_RESULT_JSON_END} as your last output.`,
+    `Do not modify anything under ${catalogDir}.`,
+    "",
+    renderResultProtocolSection()
+  ].join(`
+`);
+}
+function removeAgentResultFile(cwd) {
+  const path = join5(cwd, SDK_RESULT_FILE);
+  try {
+    if (existsSync5(path))
+      rmSync2(path);
+  } catch {}
+}
+async function mapAgentResultToOutcome(ctx, result) {
+  const agentDetail = (detail) => redactSecretText(detail, ctx.apiKey);
+  switch (result.status) {
+    case "needs_human_input":
+      return {
+        status: "needs_human_input",
+        detail: agentDetail(result.failure?.detail ?? result.summary)
+      };
+    case "nothing_to_integrate": {
+      if (!result.smoke) {
+        return {
+          status: "nothing_to_integrate",
+          detail: "agent reports Moda is already integrated — not independently verified"
+        };
+      }
+      const verification = await verifyAgentSmoke(ctx);
+      if (verification.observed) {
+        return {
+          status: "nothing_to_integrate",
+          detail: `existing integration verified — trace reached Moda (${verification.llm_spans} llm span(s))`,
+          verification
+        };
+      }
+      return {
+        status: "nothing_to_integrate",
+        detail: "agent reports Moda is already integrated — verification trace was not observed",
+        verification
+      };
+    }
+    case "repository_checks_failed":
+      return {
+        status: "repository_checks_failed",
+        detail: agentDetail(result.failure?.detail ?? result.summary),
+        repairable: "repository_checks_failed"
+      };
+    case "smoke_execution_failed":
+      return {
+        status: "smoke_execution_failed",
+        detail: agentDetail(result.failure?.detail ?? result.summary),
+        repairable: "smoke_execution_failed"
+      };
+    case "failed":
+      return {
+        status: "agent_failed",
+        detail: agentDetail(result.failure?.detail ?? result.summary),
+        repairable: "failed"
+      };
+    case "integrated": {
+      const verification = await verifyAgentSmoke(ctx);
+      if (verification.observed) {
+        let detail = `trace reached Moda (${verification.llm_spans} llm span(s))`;
+        if (verification.duplicate_count > 0) {
+          detail += `; warning: duplicate_count=${verification.duplicate_count}`;
+        }
+        return {
+          status: "integrated_verified",
+          detail,
+          verification
+        };
+      }
+      return {
+        status: "telemetry_not_observed",
+        detail: "integration applied but the verification trace was not observed",
+        verification,
+        repairable: "telemetry_not_observed"
+      };
+    }
+    default:
+      return { status: "agent_failed", detail: agentDetail(result.summary) };
+  }
+}
+async function verifyAgentSmoke(ctx) {
+  ctx.onPhase?.("verifying", "Verifying trace in Moda…");
+  ctx.emit("Verifying trace in Moda…");
+  const evidence = await ctx.verify({
+    verificationId: ctx.verificationId,
+    timeoutMs: ctx.verifyTimeoutMs,
+    fetchAudit: ctx.fetchAudit
+  });
+  return evidence.last_error !== undefined ? { ...evidence, last_error: redactSecretText(evidence.last_error, ctx.apiKey) } : evidence;
+}
+function installUsedSkills(result, catalog, cwd, emit) {
+  const validIds = new Set(catalog.index.skills.map((skill) => skill.id));
+  const installed = [];
+  const warnings = [];
+  for (const skillId of result.skills_used) {
+    if (!validIds.has(skillId)) {
+      warnings.push(`unknown skill id ${skillId}`);
+      continue;
+    }
+    try {
+      installIntegrationSkill(skillId, cwd);
+      installed.push(skillId);
+      emit(`Installed integration skill ${skillId} to .claude/skills/${skillId}/`);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      warnings.push(`could not install ${skillId}: ${message}`);
+    }
+  }
+  if (warnings.length > 0) {
+    emit(warnings.join("; "));
+  }
+  return installed;
+}
+function composeFinalDetail(status, detail, verification, apiKey, guardsDegraded) {
+  const baseDetail = detail ?? (status === "integrated_verified" && verification ? `verified — trace reached Moda (${verification.llm_spans} llm span(s))` : undefined);
+  const combined = guardsDegraded ? [baseDetail, DEGRADED_GUARDS_NOTE].filter(Boolean).join("; ") : baseDetail;
+  return combined ? redactSecretText(combined, apiKey) : undefined;
+}
+function writeFinalOutcomeArtifact(cwd, payload) {
+  const path = join5(cwd, SDK_RESULT_FILE);
+  mkdirSync4(dirname3(path), { recursive: true });
+  writeFileSync3(path, `${JSON.stringify({
+    schema_version: OUTCOME_SCHEMA_VERSION,
+    status: payload.status,
+    verification_id: payload.verification_id,
+    verification: payload.verification,
+    agent_result: payload.agent_result,
+    repair_attempts: payload.repair_attempts,
+    ...payload.security_findings ? { security_findings: payload.security_findings } : {},
+    finished_at: new Date().toISOString()
+  }, null, 2)}
+`);
+}
+function redactSecretText(text, apiKey) {
+  let redacted = text;
+  for (const secret of [apiKey, process.env.MODA_API_KEY]) {
+    if (secret)
+      redacted = redacted.split(secret).join("[REDACTED]");
+  }
+  SECRET_KEY_PATTERN.lastIndex = 0;
+  return redacted.replace(SECRET_KEY_PATTERN, "[REDACTED]");
+}
+function sanitizeAgentResult(result, apiKey) {
+  return JSON.parse(redactSecretText(JSON.stringify(result), apiKey));
+}
+function redactOutputTail(output, apiKey) {
+  return redactSecretText(output, apiKey).trim().slice(-800);
+}
+
+// src/init/progress-board.ts
+var SPINNER_FRAMES = ["◐", "◓", "◑", "◒"];
+var GLYPHS = {
+  done: "✓",
+  warning: "!",
+  failed: "✗"
+};
+var GLYPH_COLORS = {
+  done: 32,
+  warning: 33,
+  failed: 31
+};
+var DETAIL_MAX = 100;
+var RENDER_INTERVAL_MS = 150;
+var NON_TTY_LANE_INTERVAL_MS = 1e4;
+function renderProgressBoardFrame(lanes, options = {}) {
+  const now = options.now ?? Date.now();
+  const color = options.color ?? false;
+  const width = Math.max(48, Math.min(options.width ?? 120, 200));
+  const paint = (code, text) => color ? `\x1B[${code}m${text}\x1B[0m` : text;
+  const titleWidth = Math.min(32, lanes.reduce((max, lane) => Math.max(max, lane.title.length), 0));
+  return lanes.map((lane) => {
+    const title = lane.title.padEnd(titleWidth);
+    if (lane.status === "running") {
+      const elapsed = formatDuration(Math.max(0, Math.round((now - lane.startedAt) / 1000)));
+      const detail = lane.detail ? `   ${oneLine(lane.detail)}` : "";
+      const expectation = lane.expectation ? ` ${paint(90, `(${lane.expectation})`)}` : "";
+      const glyph2 = paint(36, options.spinnerFrame ?? SPINNER_FRAMES[0]);
+      return truncateVisible(`  ${glyph2} ${title}  ${paint(90, elapsed.padStart(6))}${detail}${expectation}`, width);
+    }
+    const glyph = paint(GLYPH_COLORS[lane.status], GLYPHS[lane.status]);
+    const note = lane.detail ? oneLine(lane.detail) : formatDuration(Math.max(0, Math.round(((lane.finishedAt ?? now) - lane.startedAt) / 1000)));
+    return truncateVisible(`  ${glyph} ${title}  ${note}`, width);
+  });
+}
+
+class InitProgressBoard {
+  stream;
+  tty;
+  color;
+  now;
+  renderIntervalMs;
+  fallbackIntervalMs;
+  laneList = [];
+  lanesById = new Map;
+  lastFallbackPrint = new Map;
+  timer;
+  renderedLines = 0;
+  spinnerIndex = 0;
+  stopped = false;
+  constructor(options = {}) {
+    this.stream = options.stream ?? process.stderr;
+    const dumbTerm = process.env.TERM === "dumb";
+    this.tty = options.isTTY ?? (this.stream.isTTY === true && !dumbTerm);
+    this.color = options.color ?? (this.tty && process.env.NO_COLOR === undefined);
+    this.now = options.now ?? Date.now;
+    this.renderIntervalMs = options.renderIntervalMs ?? RENDER_INTERVAL_MS;
+    this.fallbackIntervalMs = options.fallbackIntervalMs ?? NON_TTY_LANE_INTERVAL_MS;
+  }
+  get lanes() {
+    return this.laneList;
+  }
+  startLane(id, title, options = {}) {
+    if (this.stopped || this.lanesById.has(id))
+      return;
+    const lane = {
+      id,
+      title,
+      status: "running",
+      detail: options.detail,
+      expectation: options.expectation,
+      startedAt: this.now()
+    };
+    this.laneList.push(lane);
+    this.lanesById.set(id, lane);
+    if (this.tty) {
+      this.ensureTimer();
+      this.render();
+    } else {
+      this.lastFallbackPrint.set(id, this.now());
+      this.writeLine(`  ${title}: ${lane.detail ? oneLine(lane.detail) : "started"}${lane.expectation ? ` (${lane.expectation})` : ""}`);
+    }
+  }
+  update(id, detail) {
+    const lane = this.lanesById.get(id);
+    if (!lane || this.stopped || lane.status !== "running")
+      return;
+    lane.detail = detail;
+    if (this.tty)
+      return;
+    const last = this.lastFallbackPrint.get(id) ?? 0;
+    if (this.now() - last < this.fallbackIntervalMs)
+      return;
+    this.lastFallbackPrint.set(id, this.now());
+    const elapsed = formatDuration(Math.max(0, Math.round((this.now() - lane.startedAt) / 1000)));
+    this.writeLine(`  ${lane.title}: ${oneLine(detail)} (${elapsed} elapsed)`);
+  }
+  complete(id, note) {
+    this.finish(id, "done", note);
+  }
+  warn(id, note) {
+    this.finish(id, "warning", note);
+  }
+  fail(id, note) {
+    this.finish(id, "failed", note);
+  }
+  stop() {
+    if (this.stopped)
+      return;
+    this.stopped = true;
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = undefined;
+    }
+    if (this.tty && this.laneList.length > 0)
+      this.render();
+  }
+  finish(id, status, note) {
+    const lane = this.lanesById.get(id);
+    if (!lane || this.stopped)
+      return;
+    if (lane.status !== "running" && lane.status === status && lane.detail === note)
+      return;
+    lane.status = status;
+    lane.detail = note;
+    lane.finishedAt ??= this.now();
+    if (this.tty) {
+      this.render();
+      return;
+    }
+    const label = status === "done" ? "done" : status === "warning" ? "warning" : "failed";
+    this.writeLine(`  ${lane.title}: ${label}${note ? ` (${oneLine(note)})` : ""}`);
+  }
+  ensureTimer() {
+    if (this.timer || !this.tty)
+      return;
+    this.timer = setInterval(() => this.render(), this.renderIntervalMs);
+    this.timer.unref?.();
+  }
+  render() {
+    if (!this.tty || this.laneList.length === 0)
+      return;
+    const lines = renderProgressBoardFrame(this.laneList, {
+      now: this.now(),
+      spinnerFrame: SPINNER_FRAMES[this.spinnerIndex++ % SPINNER_FRAMES.length],
+      color: this.color,
+      width: this.stream.columns ?? 120
+    });
+    const up = this.renderedLines > 0 ? `\x1B[${this.renderedLines}A` : "";
+    this.stream.write(`${up}${lines.map((line) => `\x1B[2K${line}`).join(`
+`)}
+`);
+    this.renderedLines = lines.length;
+  }
+  writeLine(line) {
+    this.stream.write(`${line}
+`);
+  }
+}
+function oneLine(text) {
+  const collapsed = stripAnsi(text).replace(/[\u0000-\u001f\u007f]+/g, " ").replace(/\s+/g, " ").trim();
+  return collapsed.length > DETAIL_MAX ? `${collapsed.slice(0, DETAIL_MAX - 1)}…` : collapsed;
+}
+function formatDuration(seconds) {
+  if (seconds < 60)
+    return `${seconds}s`;
+  const minutes = Math.floor(seconds / 60);
+  const remaining = seconds % 60;
+  return `${minutes}m ${remaining}s`;
+}
+function truncateVisible(value, width) {
+  if (visibleLength(value) <= width)
+    return value;
+  const stripped = stripAnsi(value);
+  return `${stripped.slice(0, Math.max(0, width - 3))}...`;
+}
+function visibleLength(value) {
+  return stripAnsi(value).length;
+}
+
+// src/init/index.ts
+var HARNESS_PULL_RECOVERY = "moda harness pull --sync";
+var LANE_EVENT_THROTTLE_MS = 2000;
+async function runInit(flags, options = {}) {
+  const explicitYes = flags.yes === true || flags.yes === "true" || flags.y === true || flags.y === "true";
+  const json = flags.json === true || flags.json === "true";
+  const agent = flags.agent === true || flags.agent === "true";
+  const human = !json && !agent;
+  const yes = explicitYes || json || agent;
+  const phases = [];
+  const log = (message) => {
+    if (human)
+      console.log(message);
+  };
+  const warn = (message) => {
+    if (human)
+      console.error(message);
+  };
+  const emit = (phase, message, status) => {
+    options.onEvent?.({ phase, message, status });
+  };
+  const laneEventAt = new Map;
+  const emitLaneProgress = (phase, laneId, message) => {
+    if (!options.onEvent || human)
+      return;
+    const now = Date.now();
+    if (now - (laneEventAt.get(laneId) ?? 0) < LANE_EVENT_THROTTLE_MS)
+      return;
+    laneEventAt.set(laneId, now);
+    emit(phase, message);
+  };
+  log(renderInitBanner());
+  emit("welcome", "Onboarding this project as a Moda agent harness.", "completed");
+  phases.push({ id: "welcome", title: "Welcome", status: "completed" });
+  const profile = stringFlag(flags.profile);
+  log(renderInitStep(1, 5, "Sign in", "No environment variable files are written. File changes are listed before completion."));
+  let token = loadToken({ profile });
+  if (!token) {
+    if (json || agent) {
+      throw new CliAuthError("Browser authentication is required before non-interactive init can continue.", {
+        reason: "no_stored_credentials",
+        login_command: ["moda", "auth", "login"],
+        resume_command: ["moda", "init", ...resumeFlagsForInit(flags)]
+      }, "Run `moda auth login`, then re-run `moda init`.");
+    }
+    let action = "login";
+    if (!yes) {
+      action = await select({
+        message: "Get started",
+        choices: [
+          { name: "Sign up", value: "signup" },
+          { name: "Login", value: "login" }
+        ]
+      });
+    }
+    log(renderInitNote(`Opening browser to ${action === "signup" ? "sign up" : "log in"}...`, "warning"));
+    emit("auth", `Opening browser to ${action}.`);
+    token = await login(action, { profile });
+    log(renderInitNote("Authentication successful"));
+  } else {
+    log(renderInitNote("Already authenticated (cached token)"));
+  }
+  emit("auth", "Authentication complete.", "completed");
+  phases.push({ id: "auth", title: "Sign in", status: "completed" });
+  log(renderInitStep(2, 5, "Workspace"));
+  emit("workspace", "Selecting workspace and creating API key.");
+  const tenantIdFlag = stringFlag(flagValue(flags, "tenant-id", "tenant_id"));
+  const tenantIdEnv = stringFlag(process.env.MODA_TENANT_ID);
+  const { apiKey, tenantId: selectedTenantId, tenantName } = await selectTenantAndCreateKey({
+    tenantId: tenantIdFlag ?? tenantIdEnv,
+    tenantIdSource: tenantIdFlag ? "flag" : tenantIdEnv ? "env" : undefined,
+    nonInteractive: json || agent,
+    silent: !human,
+    resumeCommand: ["moda", "init", ...resumeFlagsForInit(flags)],
+    profile
+  });
+  log(renderInitNote(`Active workspace: ${tenantName}`));
+  emit("workspace", `Active workspace: ${tenantName}`, "completed");
+  phases.push({ id: "workspace", title: "Workspace", status: "completed", details: tenantName });
+  log(renderInitStep(3, 5, "Plan", "One confirmation covers everything below; setup then runs unattended."));
+  let remote = resolveHarnessRemote(flags);
+  const remotePinned = hasExplicitRemoteChoice(flags);
+  const sdkFlag = resolveSdkIntegrateFlag(flags);
+  const ciCdFlag = resolveCiCdFlag(flags);
+  const autosyncFlag = resolveAutosyncFlag(flags);
+  const harnessRescanFlag = resolveHarnessRescanFlag(flags);
+  const harnessRescanPaths = parseHarnessRescanPaths(flagValue(flags, "harness-rescan-paths", "harness_rescan_paths"));
+  const harnessRescanChoice = harnessRescanFlag ?? (harnessRescanPaths !== undefined ? true : undefined);
+  const codingAgentAvailable = detectAvailableCodingAgents().length > 0;
+  let integrateSdk = sdkFlag !== undefined ? sdkFlag : yes ? false : codingAgentAvailable;
+  let configureCiCd = ciCdFlag ?? false;
+  let configureAutosync = autosyncFlag ?? false;
+  let configureHarnessRescan = harnessRescanChoice ?? false;
+  let setupPlan = [];
+  const renderPlan = () => {
+    setupPlan = buildSetupPlan({
+      installHooks: false,
+      integrateSdk,
+      configureCiCd,
+      configureAutosync,
+      configureHarnessRescan,
+      remote
+    });
+    log(renderInitSetupPlan(setupPlan, { snapshotConsent: remote }));
+  };
+  renderPlan();
+  if (!yes) {
+    const proceed = await confirm({ message: "Proceed with this plan?", default: true });
+    if (!proceed) {
+      const choices = [];
+      if (sdkFlag === undefined) {
+        choices.push({
+          name: "SDK integration via your coding agent (installs packages, edits source)",
+          value: "sdk",
+          checked: integrateSdk
+        });
+      }
+      if (!remotePinned) {
+        choices.push({
+          name: "Harness analysis on Moda's servers (uncheck to run a local coding agent analyst)",
+          value: "remote",
+          checked: remote
+        });
+      }
+      if (ciCdFlag === undefined) {
+        choices.push({
+          name: "CI/CD validation workflow (.github/workflows/moda-validation.yml)",
+          value: "ci-cd",
+          checked: configureCiCd
+        });
+      }
+      if (autosyncFlag === undefined) {
+        choices.push({
+          name: "Autosync prompts and skills on push to main (.github/workflows/moda-autosync.yml)",
+          value: "autosync",
+          checked: configureAutosync
+        });
+      }
+      if (harnessRescanChoice === undefined) {
+        choices.push({
+          name: "Re-scan the harness on push to main (.github/workflows/moda-harness-rescan.yml)",
+          value: "harness-rescan",
+          checked: configureHarnessRescan
+        });
+      }
+      if (choices.length > 0) {
+        const selected = await checkbox({
+          message: "Choose what runs (space toggles, enter confirms)",
+          choices
+        });
+        if (sdkFlag === undefined)
+          integrateSdk = selected.includes("sdk");
+        if (!remotePinned)
+          remote = selected.includes("remote");
+        if (ciCdFlag === undefined)
+          configureCiCd = selected.includes("ci-cd");
+        if (autosyncFlag === undefined)
+          configureAutosync = selected.includes("autosync");
+        if (harnessRescanChoice === undefined)
+          configureHarnessRescan = selected.includes("harness-rescan");
+        renderPlan();
+      }
+    }
+  }
+  if (json || agent) {
+    const skipped = setupPlan.filter((action) => (action.category === "sdk" || action.category === "ci-cd" || action.category === "autosync" || action.category === "harness-rescan") && action.approved === false).map((action) => `${action.category}: ${action.command ?? "explicit flag required"}`);
+    if (skipped.length > 0) {
+      emit("plan", `Non-interactive init skipped optional actions (${skipped.join("; ")}).`, "warning");
+    }
+  }
+  emit("plan", "Setup plan ready.", "completed");
+  phases.push({ id: "plan", title: "Plan", status: "completed" });
+  log(renderInitStep(4, 5, "Set up", remote ? "Harness analysis runs on Moda while local setup continues. No further input is needed." : "Runs unattended. No further input is needed."));
+  const rootDir = process.cwd();
+  const allowLocalFallback = !isTruthyFlag(flagValue(flags, "remote"));
+  const nestedHarnessFlags = (extra) => commandFlags({
+    summary: true,
+    yes: true,
+    json: json || agent,
+    agent,
+    quiet: true,
+    "no-telemetry": true,
+    profile,
+    ...extra
+  });
+  const runAnalyze = (useRemote) => runHarnessCommand(createCommandContext({
+    command: "harness",
+    positional: "analyze",
+    positionals: ["analyze"],
+    flags: nestedHarnessFlags({
+      analyst: stringFlag(flags.analyst) ?? "auto",
+      remote: useRemote ? true : undefined,
+      "no-remote": useRemote ? undefined : true,
+      progress: true
+    })
+  }));
+  let board;
+  const startBoard = () => {
+    if (!human)
+      return;
+    board ??= new InitProgressBoard;
+    return board;
+  };
+  const validationFailure = () => new CliInputError("Moda Analyst produced a harness report that did not pass validation.", "Review .moda/harness-report-validation.json, then rerun `moda init --local --analyst=claude|cursor|codex` or `moda harness analyze --analyst=local-scan --summary`.");
+  let harnessPhase = { id: "harness", title: "Harness discovery", status: "completed" };
+  let harnessDeferred = false;
+  const approveAndSyncHarness = async () => {
+    const graphSignals = readHarnessQualitySignals(rootDir);
+    const repoSignals = detectRepoLlmSignals(rootDir);
+    const signals = graphSignals ? {
+      runtimeAgents: graphSignals.runtimeAgents,
+      frameworks: [...new Set([...graphSignals.frameworks, ...repoSignals.frameworks])],
+      providers: [...new Set([...graphSignals.providers, ...repoSignals.providers])]
+    } : undefined;
+    if (signals && harnessLooksIncomplete(signals)) {
+      const names = [...signals.frameworks, ...signals.providers].join(", ");
+      const retryCommand = remote ? "moda harness analyze --remote --summary" : "moda harness analyze --analyst=claude|cursor|codex --summary";
+      warn(renderInitNote(`Harness discovery found 0 runtime agents, but this repo has LLM framework signals (${names}). ` + "Discovery likely failed, so the result was NOT approved or synced.", "warning"));
+      warn(`  Retry with \`${retryCommand}\`, then \`moda harness approve --yes && moda harness sync --from-report\`.`);
+      emit("harness", "Harness discovery found 0 agents despite LLM framework signals; sync withheld.", "warning");
+      harnessPhase = {
+        id: "harness",
+        title: "Harness discovery",
+        status: "warning",
+        details: "0 agents detected; sync withheld"
+      };
+      return;
+    }
+    try {
+      const identity = describeSyncIdentity({ profile, env: process.env });
+      if (identity) {
+        const tenantLabel = identity.tenantSource === "api-key" && identity.tenantId ? `${identity.tenantId}${identity.tenantId === selectedTenantId ? ` (${tenantName})` : ""}` : describeSyncTenantLabel(identity);
+        log(renderInitNote(`Syncing as ${identity.credential} → tenant ${tenantLabel}`, "info"));
+      }
+    } catch {}
+    try {
+      await runHarnessCommand(createCommandContext({
+        command: "harness",
+        positional: "approve",
+        positionals: ["approve"],
+        flags: nestedHarnessFlags({})
+      }));
+      await runHarnessCommand(createCommandContext({
+        command: "harness",
+        positional: "sync",
+        positionals: ["sync"],
+        flags: nestedHarnessFlags({ "from-report": true })
+      }));
+      log(renderInitNote("Synced harness graph to Moda"));
+      emit("harness", "Harness graph synced to Moda.", "completed");
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      warn(renderInitNote(`Harness sync skipped: ${message}`, "warning"));
+      warn("  Run `moda harness approve --yes && moda harness sync --from-report` later to upload.");
+      emit("harness", "Harness sync skipped.", "warning");
+      harnessPhase = { id: "harness", title: "Harness discovery", status: "warning", details: "sync skipped" };
+    }
+  };
+  const finishLocalAnalyze = async () => {
+    emit("harness", "Running Moda Analyst harness discovery.");
+    const result = await runAnalyze(false);
+    if (result.exitCode !== 0)
+      throw validationFailure();
+    log(renderInitNote("Wrote or verified .moda/harness-report.json, .moda/harness.json, and .moda/HARNESS.md"));
+    if (human)
+      printHarnessDetectionSummary();
+    emit("harness", "Harness discovery complete.", "completed");
+    await approveAndSyncHarness();
+  };
+  let pollPromise;
+  let pollError;
+  let remoteRunId;
+  const onRemoteSigint = () => {
+    board?.stop();
+    process.stderr.write(`
+Harness analysis keeps running on Moda. Resume anytime with \`${HARNESS_PULL_RECOVERY}\`.
+`);
+    process.exit(130);
+  };
+  if (remote) {
+    emit("harness", "Running Moda-hosted harness discovery.");
+    try {
+      const harnessContext = createCommandContext({
+        command: "harness",
+        positional: "analyze",
+        positionals: ["analyze"],
+        flags: nestedHarnessFlags({
+          analyst: stringFlag(flags.analyst) ?? "auto",
+          remote: true
+        })
+      });
+      const started = await startRemoteAnalyze({ context: harnessContext, rootDir });
+      remoteRunId = started.runId;
+      process.once("SIGINT", onRemoteSigint);
+      emit("harness", `Moda accepted harness analysis run ${started.runId}.`);
+      startBoard()?.startLane("harness", "Harness analysis on Moda", {
+        detail: "waiting for the hosted analyst",
+        expectation: "usually 2-4 min"
+      });
+      pollPromise = pollRemoteAnalyzeUntilDone({
+        context: harnessContext,
+        runId: started.runId,
+        onProgress: ({ status, progress }) => {
+          if (status === "completed" || status === "failed") {
+            if (status === "completed") {
+              board?.complete("harness", "analysis finished on Moda; finalizing after setup");
+            } else {
+              board?.warn("harness", "hosted run finished with issues; finalizing after setup");
+            }
+            emitLaneProgress("harness", "harness", `Hosted analysis ${status}; finalizing after setup.`);
+            return;
+          }
+          const message = progress?.message ?? (typeof progress?.tool_calls === "number" ? `${progress.tool_calls} tool call(s) so far` : `analysis ${status}`);
+          board?.update("harness", message);
+          emitLaneProgress("harness", "harness", message);
+        }
+      }).catch((error) => {
+        pollError = error;
+        return;
+      });
+    } catch (error) {
+      if (!allowLocalFallback)
+        throw error;
+      warn(renderInitNote(`Server-side harness discovery unavailable (${error instanceof Error ? error.message : String(error)}); falling back to local analyst.`, "warning"));
+      emit("harness", "Server-side discovery failed; falling back to local analyst.", "warning");
+      remote = false;
+    }
+  }
+  if (!remote) {
+    await finishLocalAnalyze();
+  }
+  emit("apply", "Applying approved setup changes.");
+  const laneBoard = startBoard();
+  const ingestCodingAgentTraces = false;
+  const agents = detectAgents();
+  laneBoard?.startLane("agent-skills", "Agent skills");
+  if (agents.length > 0) {
+    await installRules(agents, { yes: true, silent: true });
+    laneBoard?.complete("agent-skills", `moda-cli skill installed for ${agents.join(", ")}`);
+  } else {
+    laneBoard?.complete("agent-skills", "no coding agents detected");
+  }
+  await initPrompts({ silent: true });
+  laneBoard?.startLane("prompts", "Prompts", { detail: "Created or verified .moda/prompts.yml" });
+  try {
+    const promptSync = await runPromptSync({}, { profile });
+    laneBoard?.complete("prompts", promptSync.synced.length > 0 ? `${promptSync.synced.length} prompt(s) synced` : "manifest ready (no prompt files to sync yet)");
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    laneBoard?.warn("prompts", `sync skipped: ${message}`);
+  }
+  laneBoard?.startLane("skills", "Skills");
+  try {
+    const skillSync = await runSkillSync({}, { profile });
+    laneBoard?.complete("skills", skillSync.synced.length > 0 ? `${skillSync.synced.length} skill(s) synced` : "no local skills to sync yet");
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    laneBoard?.warn("skills", `sync skipped: ${message}`);
+  }
+  if (setupPlan.find((action) => action.category === "ci-cd")?.approved === true) {
+    const workflowPath = writeCiCdWorkflow();
+    laneBoard?.startLane("ci-cd", "CI/CD workflow");
+    laneBoard?.complete("ci-cd", `wrote ${workflowPath}`);
+    markApplied(setupPlan, "ci-cd");
+  }
+  if (setupPlan.find((action) => action.category === "autosync")?.approved === true) {
+    const workflowPath = writeAutosyncWorkflow();
+    laneBoard?.startLane("autosync", "Autosync workflow");
+    laneBoard?.complete("autosync", `wrote ${workflowPath}`);
+    markApplied(setupPlan, "autosync");
+  }
+  if (setupPlan.find((action) => action.category === "harness-rescan")?.approved === true) {
+    const workflowPath = writeHarnessRescanWorkflow(process.cwd(), harnessRescanPaths);
+    laneBoard?.startLane("harness-rescan", "Harness rescan workflow");
+    laneBoard?.complete("harness-rescan", `wrote ${workflowPath}`);
+    markApplied(setupPlan, "harness-rescan");
+  }
+  const sdkAction = setupPlan.find((action) => action.category === "sdk");
+  let sdkIntegration;
+  if (sdkAction?.approved === true) {
+    laneBoard?.startLane("sdk", "SDK integration", {
+      detail: "launching your coding agent",
+      expectation: "usually 3-10 min"
+    });
+    emit("apply", "Running your coding agent to integrate the Moda SDK.");
+    const verificationBaseUrl = resolveModaBaseUrl({ profile });
+    sdkIntegration = await runSdkIntegration({
+      apiKey,
+      ingestUrl: resolveIngestUrl({ profile }),
+      fetchAudit: (id) => fetchAuditWithApiKey(id, apiKey, verificationBaseUrl),
+      onProgress: (message) => {
+        laneBoard?.update("sdk", message);
+        emitLaneProgress("apply", "sdk", message);
+      },
+      onPhase: (phase, message) => {
+        laneBoard?.update("sdk", message);
+        emitLaneProgress("apply", "sdk", message);
+      },
+      onEvent: () => {}
+    });
+    applySdkIntegrationOutcome(setupPlan, sdkIntegration, {
+      laneBoard,
+      writeGuide: () => writeSdkIntegrationGuide(rootDir)
+    });
+  } else {
+    markApplied(setupPlan, "sdk", "User skipped SDK integration.");
+  }
+  markApplied(setupPlan, "hooks", ingestCodingAgentTraces ? undefined : "Coding-agent trace capture is temporarily unavailable.");
+  markApplied(setupPlan, "prompts");
+  markApplied(setupPlan, "skills");
+  if (remote && pollPromise && remoteRunId) {
+    const final = await pollPromise;
+    process.removeListener("SIGINT", onRemoteSigint);
+    const fallBackToLocal = async (error) => {
+      board?.fail("harness", "hosted analysis failed");
+      board?.stop();
+      if (!allowLocalFallback)
+        throw error;
+      warn(renderInitNote(`Server-side harness discovery failed (${error instanceof Error ? error.message : String(error)}); falling back to local analyst.`, "warning"));
+      emit("harness", "Server-side discovery failed; falling back to local analyst.", "warning");
+      await finishLocalAnalyze();
+    };
+    if (pollError !== undefined) {
+      await fallBackToLocal(pollError);
+    } else if (!final || final.status !== "completed" && final.status !== "failed") {
+      harnessDeferred = true;
+      harnessPhase = { id: "harness", title: "Harness discovery", status: "warning", details: "still running on Moda" };
+      markApplied(setupPlan, "harness", `Analysis still running on Moda; run \`${HARNESS_PULL_RECOVERY}\` to fetch and sync it.`);
+      board?.warn("harness", `still running on Moda; run \`${HARNESS_PULL_RECOVERY}\` in a few minutes`);
+      board?.stop();
+      log(renderInitNote(`Harness analysis is still running on Moda. Run \`${HARNESS_PULL_RECOVERY}\` in a few minutes to fetch and sync the result.`, "info"));
+      emit("harness", `Harness analysis still running on Moda; resume with \`${HARNESS_PULL_RECOVERY}\`.`, "warning");
+    } else {
+      board?.update("harness", "writing local artifacts");
+      let pullResult;
+      try {
+        pullResult = await runHarnessCommand(createCommandContext({
+          command: "harness",
+          positional: "pull",
+          positionals: ["pull"],
+          flags: nestedHarnessFlags({ "run-id": remoteRunId })
+        }));
+      } catch (error) {
+        await fallBackToLocal(error);
+      }
+      if (pullResult) {
+        if (pullResult.exitCode !== 0) {
+          board?.fail("harness", "report validation failed");
+          board?.stop();
+          throw validationFailure();
+        }
+        board?.complete("harness", "report written to .moda/");
+        board?.stop();
+        log(renderInitNote("Wrote or verified .moda/harness-report.json, .moda/harness.json, and .moda/HARNESS.md"));
+        if (human)
+          printHarnessDetectionSummary();
+        emit("harness", "Harness discovery complete.", "completed");
+        await approveAndSyncHarness();
+      }
+    }
+  }
+  board?.stop();
+  if (!harnessDeferred)
+    markApplied(setupPlan, "harness");
+  phases.push(harnessPhase);
+  emit("apply", "Approved changes applied.", "completed");
+  phases.push({ id: "apply", title: "Set up", status: "completed" });
+  const offlineValidation = isTruthyFlag(flagValue(flags, "offline"));
+  log(renderInitStep(5, 5, "Verify", offlineValidation ? "Running local doctor checks so the setup leaves a clear state." : "Running Moda doctor online as a tenant health check (not proof of SDK integration)."));
+  emit("validate", `Running Moda doctor diagnostics (${offlineValidation ? "offline" : "online"}).`);
+  const doctorReport = await buildDoctorReport(createCommandContext({
+    command: "doctor",
+    positional: undefined,
+    positionals: [],
+    flags: commandFlags({ json: true, quiet: true, "no-telemetry": true })
+  }), { offline: offlineValidation });
+  markApplied(setupPlan, "validation");
+  log(renderInitNote(`Validation checks completed: ${doctorReport.summary.pass} passing, ${doctorReport.summary.warning} warning, ${doctorReport.summary.fail} failing`));
+  let telemetrySeen;
+  if (!offlineValidation) {
+    const cloud = doctorReport.checks.find((check) => check.id === "cloud_data_flow");
+    if (cloud) {
+      telemetrySeen = cloud.status === "pass";
+      if (telemetrySeen) {
+        log(renderInitNote("Moda Cloud telemetry: flowing"));
+      } else {
+        log(renderInitNote("No telemetry yet. Expected until your app runs with the SDK; see next steps.", "info"));
+      }
+    }
+  }
+  emit("validate", "Validation checks complete.", doctorReport.summary.fail > 0 ? "warning" : "completed");
+  phases.push({ id: "validate", title: "Verify", status: "completed" });
+  log(renderInitComplete({
+    tenantName,
+    dashboardUrl: `${resolveModaBaseUrl({ profile })}/dashboard`,
+    harness: harnessDeferred ? { state: "pending" } : { state: "mapped", ...readHarnessGraphCounts() },
+    filesChanged: changedFiles(setupPlan),
+    skipped: setupPlan.filter((item) => item.status === "skipped" || item.status === "manual"),
+    telemetrySeen
+  }));
+  return { apiKey, tenantName, phases, setupPlan, ...sdkIntegration ? { sdk_integration: sdkIntegration } : {} };
+}
+function buildSetupPlan(options) {
+  return [
+    {
+      category: "harness",
+      title: options.remote ? "Analyze the harness on Moda's servers, write the cited report, and sync the graph to Moda" : "Analyze the harness locally, write the cited report, and sync the graph to Moda",
+      status: "planned",
+      approved: true,
+      files: [
+        ".moda/harness-report.json",
+        ".moda/harness-report-validation.json",
+        ".moda/HARNESS_REPORT.md",
+        ".moda/harness.json",
+        ".moda/HARNESS.md"
+      ],
+      command: options.remote ? "moda harness analyze --remote --summary && moda harness approve --yes && moda harness sync --from-report" : "moda harness analyze --analyst=auto --summary && moda harness approve --yes && moda harness sync --from-report"
+    },
+    {
+      category: "hooks",
+      title: "Install coding-agent trace hooks",
+      status: options.installHooks ? "planned" : "skipped",
+      approved: options.installHooks,
+      files: ["~/.claude/settings.json", "~/.codex/hooks.json", "~/.cursor/hooks.json"],
+      command: "moda hooks install --agent=all",
+      reason: options.installHooks ? undefined : "Coding-agent trace capture is temporarily unavailable."
+    },
+    {
+      category: "prompts",
+      title: "Initialize the prompt registry manifest and sync prompts to Moda",
+      status: "planned",
+      approved: true,
+      files: [".moda/prompts.yml"],
+      command: "moda prompts init && moda prompts sync"
+    },
+    {
+      category: "skills",
+      title: "Install the moda-cli skill into detected coding agents and sync local skills to Moda",
+      status: "planned",
+      approved: true,
+      files: [".claude/skills", ".cursor/rules"],
+      command: "moda skills sync"
+    },
+    {
+      category: "sdk",
+      title: "Launch your coding agent to integrate the Moda SDK",
+      status: options.integrateSdk ? "planned" : "manual",
+      approved: options.integrateSdk,
+      files: [],
+      command: "moda init --sdk-integrate",
+      reason: options.integrateSdk ? "Your agent investigates the repo, applies matching integration skill(s), installs packages, runs repo checks, sends one verification request, and Moda verifies the exact trace. Your Moda API key is provided to the agent's environment for the verification run." : `SDK integration stays manual; see ${SDK_GUIDE_PATH} if you generate the guide.`
+    },
+    {
+      category: "ci-cd",
+      title: "CI/CD validation workflow",
+      status: options.configureCiCd ? "planned" : "manual",
+      approved: options.configureCiCd,
+      files: [".github/workflows/moda-validation.yml"],
+      command: "moda doctor --online --json",
+      reason: options.configureCiCd ? undefined : "No CI/CD files are changed until a project-specific plan is approved."
+    },
+    {
+      category: "autosync",
+      title: "Autosync prompts and skills to Moda on push to main",
+      status: options.configureAutosync ? "planned" : "manual",
+      approved: options.configureAutosync,
+      files: [".github/workflows/moda-autosync.yml"],
+      command: "moda prompts sync && moda skills sync",
+      reason: options.configureAutosync ? undefined : "No autosync workflow is written until it is explicitly approved (--autosync)."
+    },
+    {
+      category: "harness-rescan",
+      title: "Re-scan the harness on push to main so the synced graph never drifts from the code",
+      status: options.configureHarnessRescan ? "planned" : "manual",
+      approved: options.configureHarnessRescan,
+      files: [".github/workflows/moda-harness-rescan.yml"],
+      command: "moda harness analyze --remote --yes && moda harness approve --yes && moda harness sync --from-report",
+      reason: options.configureHarnessRescan ? undefined : "No harness rescan workflow is written until it is explicitly approved (--harness-rescan)."
+    },
+    {
+      category: "validation",
+      title: "Run Moda doctor online as a tenant health check",
+      status: "planned",
+      approved: true,
+      files: [],
+      command: "moda doctor --online"
+    }
+  ];
+}
+function markApplied(setupPlan, category, skipReason) {
+  const action = setupPlan.find((item) => item.category === category);
+  if (!action)
+    return;
+  if (skipReason) {
+    action.status = "skipped";
+    action.reason = skipReason;
+    return;
+  }
+  if (action.approved)
+    action.status = "applied";
+}
+function markManual(setupPlan, category, reason) {
+  const action = setupPlan.find((item) => item.category === category);
+  if (!action)
+    return;
+  action.status = "manual";
+  action.reason = reason;
+}
+function applySdkIntegrationOutcome(setupPlan, outcome, deps) {
+  const sdkAction = setupPlan.find((action) => action.category === "sdk");
+  if (!sdkAction)
+    return;
+  const { laneBoard, writeGuide } = deps;
+  const verificationId = outcome.verification_id ?? "unknown";
+  const firstRemaining = outcome.agent_result?.remaining_actions?.[0];
+  switch (outcome.status) {
+    case "integrated_verified": {
+      const llmSpans = outcome.verification?.llm_spans ?? 0;
+      laneBoard?.complete("sdk", `verified — trace reached Moda (${llmSpans} llm span(s), conversation ${verificationId})`);
+      markApplied(setupPlan, "sdk");
+      if (outcome.agent_result?.files_changed?.length) {
+        sdkAction.files = [...new Set(outcome.agent_result.files_changed)].slice(0, 20);
+      }
+      break;
+    }
+    case "telemetry_not_observed":
+      laneBoard?.warn("sdk", `integration applied but the verification trace was not observed; check MODA_API_KEY at runtime, then moda audit ${verificationId}`);
+      markManual(setupPlan, "sdk", outcome.detail ?? "Verification trace was not observed.");
+      break;
+    case "needs_human_input": {
+      const securityLead = outcome.security_findings?.length ? `Security: possible API key leak in ${outcome.security_findings.join(", ")} — remove the key, rotate it, and keep secrets in the environment. ` : "";
+      const note = firstRemaining ?? outcome.detail ?? "Additional human input required.";
+      laneBoard?.warn("sdk", `${securityLead}${note}`);
+      markManual(setupPlan, "sdk", `${securityLead}${note}`.trim());
+      break;
+    }
+    case "nothing_to_integrate": {
+      if (outcome.verification?.observed === true) {
+        laneBoard?.complete("sdk", outcome.detail ?? "existing integration verified — trace reached Moda");
+        markApplied(setupPlan, "sdk");
+        sdkAction.reason = outcome.detail ?? "Existing Moda integration verified.";
+        break;
+      }
+      const reason = outcome.verification ? "agent reports Moda is already integrated but the verification trace was not observed; " + `check MODA_API_KEY at runtime, then \`moda audit ${verificationId}\`` : "agent reports Moda is already integrated — not independently verified; " + "send a real request through your app with a conversation id you choose, then run `moda audit` with that id";
+      laneBoard?.warn("sdk", reason);
+      markManual(setupPlan, "sdk", reason);
+      break;
+    }
+    case "agent_unavailable": {
+      const guidePath = writeGuide();
+      sdkAction.files = [guidePath];
+      laneBoard?.warn("sdk", `no coding agent CLI found; wrote ${guidePath} to integrate by hand`);
+      markManual(setupPlan, "sdk", `No coding agent CLI found; wrote ${guidePath}.`);
+      break;
+    }
+    case "cancelled":
+      laneBoard?.fail("sdk", outcome.detail ?? "SDK integration cancelled");
+      markManual(setupPlan, "sdk", outcome.detail ?? "SDK integration cancelled.");
+      break;
+    case "repository_checks_failed":
+    case "smoke_execution_failed":
+    case "agent_failed":
+    default: {
+      const guidePath = writeGuide();
+      sdkAction.files = [guidePath];
+      const detail = outcome.detail ?? "SDK integration did not complete.";
+      laneBoard?.warn("sdk", `${detail}; wrote ${guidePath} to finish manually`);
+      markManual(setupPlan, "sdk", `${detail}; wrote ${guidePath}.`);
+      break;
+    }
+  }
+}
+function changedFiles(setupPlan) {
+  return [...new Set(setupPlan.filter((action) => action.status === "applied").flatMap((action) => action.files))].filter((file) => !file.includes(".env"));
+}
+var GENERATED_WORKFLOW_CLI = `@moda-ai/cli@${VERSION}`;
+var GENERATED_WORKFLOW_NPX = `npx -y --package=${GENERATED_WORKFLOW_CLI} moda`;
+function writeCiCdWorkflow(cwd = process.cwd()) {
+  const relativePath = ".github/workflows/moda-validation.yml";
+  const path = join6(cwd, relativePath);
+  mkdirSync5(dirname4(path), { recursive: true });
+  writeFileSync4(path, `${[
+    "name: Moda Validation",
+    "",
+    "on:",
+    "  pull_request:",
+    "  push:",
+    "    branches: [main]",
+    "",
+    "# Least privilege: these jobs only read the checked-out repo and talk to",
+    "# Moda over the API key; they never write back to the repository.",
+    "permissions:",
+    "  contents: read",
+    "",
+    "jobs:",
+    "  moda-doctor:",
+    "    runs-on: ubuntu-latest",
+    "    env:",
+    "      MODA_API_KEY: ${{ secrets.MODA_API_KEY }}",
+    "      MODA_TENANT_ID: ${{ secrets.MODA_TENANT_ID }}",
+    "    steps:",
+    "      - uses: actions/checkout@v4",
+    "      - uses: actions/setup-node@v4",
+    "        with:",
+    "          node-version: 22",
+    "      - name: Validate Moda setup",
+    `        run: ${GENERATED_WORKFLOW_NPX} doctor --online --json`,
+    ""
+  ].join(`
+`)}`);
+  return relativePath;
+}
+function writeAutosyncWorkflow(cwd = process.cwd()) {
+  const relativePath = ".github/workflows/moda-autosync.yml";
+  const path = join6(cwd, relativePath);
+  mkdirSync5(dirname4(path), { recursive: true });
+  writeFileSync4(path, `${[
+    "name: Moda Autosync",
+    "",
+    "on:",
+    "  push:",
+    "    branches: [main]",
+    "",
+    "# Least privilege: this job only reads the checked-out repo and writes to",
+    "# Moda over the API key; it never writes back to the repository.",
+    "permissions:",
+    "  contents: read",
+    "",
+    "# A single in-flight sync at a time; newer pushes supersede older runs.",
+    "concurrency:",
+    "  group: moda-autosync",
+    "  cancel-in-progress: true",
+    "",
+    "jobs:",
+    "  moda-sync:",
+    "    runs-on: ubuntu-latest",
+    "    env:",
+    "      MODA_API_KEY: ${{ secrets.MODA_API_KEY }}",
+    "      MODA_TENANT_ID: ${{ secrets.MODA_TENANT_ID }}",
+    "    steps:",
+    "      - uses: actions/checkout@v4",
+    "      - uses: actions/setup-node@v4",
+    "        with:",
+    "          node-version: 22",
+    `      - name: Sync prompts to Moda`,
+    `        run: ${GENERATED_WORKFLOW_NPX} prompts sync`,
+    `      - name: Sync skills to Moda`,
+    `        run: ${GENERATED_WORKFLOW_NPX} skills sync`,
+    ""
+  ].join(`
+`)}`);
+  return relativePath;
+}
+function writeHarnessRescanWorkflow(cwd = process.cwd(), paths) {
+  const relativePath = ".github/workflows/moda-harness-rescan.yml";
+  const path = join6(cwd, relativePath);
+  mkdirSync5(dirname4(path), { recursive: true });
+  const pathScope = paths !== undefined && paths.length > 0 ? [
+    "    # Only pushes touching these paths trigger a rescan.",
+    "    paths:",
+    ...paths.map((glob) => `      - '${glob.replace(/'/g, "''")}'`)
+  ] : [
+    "    # Optional: scope rescans to agent-relevant paths, e.g.",
+    "    # paths:",
+    "    #   - 'src/agents/**'"
+  ];
+  writeFileSync4(path, `${[
+    "name: Moda Harness Rescan",
+    "",
+    "on:",
+    "  push:",
+    "    branches: [main]",
+    ...pathScope,
+    "  workflow_dispatch:",
+    "",
+    "# Least privilege: this job reads the checked-out repo, uploads a safe",
+    "# source snapshot to Moda over the API key, and syncs the refreshed harness",
+    "# graph; it never writes back to the repository.",
+    "permissions:",
+    "  contents: read",
+    "",
+    "# One in-flight rescan at a time; newer pushes supersede older runs.",
+    "concurrency:",
+    "  group: moda-harness-rescan",
+    "  cancel-in-progress: true",
+    "",
+    "jobs:",
+    "  moda-harness-rescan:",
+    "    runs-on: ubuntu-latest",
+    "    env:",
+    "      MODA_API_KEY: ${{ secrets.MODA_API_KEY }}",
+    "      MODA_TENANT_ID: ${{ secrets.MODA_TENANT_ID }}",
+    "    steps:",
+    "      - uses: actions/checkout@v4",
+    "      - uses: actions/setup-node@v4",
+    "        with:",
+    "          node-version: 22",
+    "      - name: Re-analyze the harness on Moda",
+    `        run: ${GENERATED_WORKFLOW_NPX} harness analyze --remote --yes`,
+    "      - name: Approve the refreshed harness report",
+    `        run: ${GENERATED_WORKFLOW_NPX} harness approve --yes`,
+    "      - name: Sync the harness graph to Moda",
+    `        run: ${GENERATED_WORKFLOW_NPX} harness sync --from-report`,
+    ""
+  ].join(`
+`)}`);
+  return relativePath;
+}
+function printHarnessDetectionSummary(cwd = process.cwd()) {
+  const manifestPath = join6(cwd, ".moda", "harness.json");
+  if (!existsSync6(manifestPath))
+    return;
+  try {
+    const graph = JSON.parse(readFileSync5(manifestPath, "utf8"));
+    const frameworkNames = (graph.agentFrameworks ?? []).map((framework) => typeof framework.name === "string" ? framework.name : undefined).filter((name) => Boolean(name));
+    const providerNames = (graph.modelProviders ?? []).map((provider) => typeof provider.name === "string" ? provider.name : undefined).filter((name) => Boolean(name));
+    console.log(`  Detected harness: ${(graph.runtimeAgents ?? []).length} runtime agent(s), ` + `${(graph.artifacts ?? []).length} artifact(s), ${(graph.relationships ?? []).length} relationship(s)`);
+    if (frameworkNames.length > 0)
+      console.log(`  Frameworks: ${frameworkNames.join(", ")}`);
+    if (providerNames.length > 0)
+      console.log(`  Model providers: ${providerNames.join(", ")}`);
+  } catch {
+    console.log("  Detected harness summary is available in .moda/HARNESS.md");
+  }
+}
+function signalsFromGraph(graph) {
+  const names = (items) => (items ?? []).map((item) => typeof item.name === "string" ? item.name : undefined).filter((name) => Boolean(name));
+  return {
+    runtimeAgents: Array.isArray(graph.runtimeAgents) ? graph.runtimeAgents.length : 0,
+    frameworks: names(graph.agentFrameworks),
+    providers: names(graph.modelProviders)
+  };
+}
+function readHarnessQualitySignals(cwd = process.cwd()) {
+  const reportPath = join6(cwd, ".moda", "harness-report.json");
+  if (existsSync6(reportPath)) {
+    try {
+      const report = JSON.parse(readFileSync5(reportPath, "utf8"));
+      if (report.graph && typeof report.graph === "object") {
+        return signalsFromGraph(report.graph);
+      }
+    } catch {}
+  }
+  const manifestPath = join6(cwd, ".moda", "harness.json");
+  if (!existsSync6(manifestPath))
+    return;
+  try {
+    return signalsFromGraph(JSON.parse(readFileSync5(manifestPath, "utf8")));
+  } catch {
+    return;
+  }
+}
+function harnessLooksIncomplete(signals) {
+  return signals.runtimeAgents === 0 && (signals.frameworks.length > 0 || signals.providers.length > 0);
+}
+var REPO_SIGNAL_MAX_DEPTH = 3;
+var REPO_SIGNAL_MAX_DIRS = 500;
+var REPO_SIGNAL_SKIPPED_DIRS = new Set([
+  "node_modules",
+  "dist",
+  "build",
+  "out",
+  "coverage",
+  "vendor",
+  "target",
+  "venv",
+  "env",
+  "__pycache__",
+  "site-packages"
+]);
+var JS_LLM_DEPENDENCIES = {
+  openai: { name: "OpenAI", kind: "provider" },
+  "@anthropic-ai/sdk": { name: "Anthropic", kind: "provider" },
+  "@google/generative-ai": { name: "Google Gemini", kind: "provider" },
+  "@google/genai": { name: "Google Gemini", kind: "provider" },
+  "cohere-ai": { name: "Cohere", kind: "provider" },
+  "groq-sdk": { name: "Groq", kind: "provider" },
+  "@mistralai/mistralai": { name: "Mistral", kind: "provider" },
+  ollama: { name: "Ollama", kind: "provider" },
+  "together-ai": { name: "Together", kind: "provider" },
+  "@aws-sdk/client-bedrock-runtime": { name: "AWS Bedrock", kind: "provider" },
+  ai: { name: "Vercel AI SDK", kind: "framework" },
+  langchain: { name: "LangChain", kind: "framework" },
+  llamaindex: { name: "LlamaIndex", kind: "framework" },
+  "@anthropic-ai/claude-agent-sdk": { name: "Claude Agent SDK", kind: "framework" },
+  "@openai/agents": { name: "OpenAI Agents", kind: "framework" },
+  "@mastra/core": { name: "Mastra", kind: "framework" }
+};
+var JS_LLM_DEPENDENCY_PREFIXES = [
+  ["@langchain/", { name: "LangChain", kind: "framework" }],
+  ["@ai-sdk/", { name: "Vercel AI SDK", kind: "framework" }],
+  ["@llamaindex/", { name: "LlamaIndex", kind: "framework" }]
+];
+var PY_LLM_DEPENDENCIES = {
+  openai: { name: "OpenAI", kind: "provider" },
+  anthropic: { name: "Anthropic", kind: "provider" },
+  "google-generativeai": { name: "Google Gemini", kind: "provider" },
+  "google-genai": { name: "Google Gemini", kind: "provider" },
+  cohere: { name: "Cohere", kind: "provider" },
+  groq: { name: "Groq", kind: "provider" },
+  mistralai: { name: "Mistral", kind: "provider" },
+  ollama: { name: "Ollama", kind: "provider" },
+  langgraph: { name: "LangGraph", kind: "framework" },
+  litellm: { name: "LiteLLM", kind: "framework" },
+  crewai: { name: "CrewAI", kind: "framework" },
+  autogen: { name: "AutoGen", kind: "framework" },
+  pyautogen: { name: "AutoGen", kind: "framework" },
+  ag2: { name: "AutoGen", kind: "framework" },
+  "pydantic-ai": { name: "Pydantic AI", kind: "framework" },
+  "openai-agents": { name: "OpenAI Agents", kind: "framework" },
+  "semantic-kernel": { name: "Semantic Kernel", kind: "framework" },
+  dspy: { name: "DSPy", kind: "framework" },
+  "haystack-ai": { name: "Haystack", kind: "framework" }
+};
+var PY_LLM_DEPENDENCY_PREFIXES = [
+  ["langchain", { name: "LangChain", kind: "framework" }],
+  ["llama-index", { name: "LlamaIndex", kind: "framework" }]
+];
+function jsDependencySignal(dep) {
+  const exact = JS_LLM_DEPENDENCIES[dep];
+  if (exact)
+    return exact;
+  for (const [prefix, signal] of JS_LLM_DEPENDENCY_PREFIXES) {
+    if (dep.startsWith(prefix))
+      return signal;
+  }
+  return;
+}
+function pyDependencySignal(dep) {
+  const normalized = dep.toLowerCase().replace(/_/g, "-");
+  const exact = PY_LLM_DEPENDENCIES[normalized];
+  if (exact)
+    return exact;
+  for (const [prefix, signal] of PY_LLM_DEPENDENCY_PREFIXES) {
+    if (normalized === prefix || normalized.startsWith(`${prefix}-`))
+      return signal;
+  }
+  return;
+}
+function pythonRequirementNames(text, file) {
+  const names = [];
+  if (file === "requirements.txt") {
+    for (const line of text.split(`
+`)) {
+      const match = /^\s*([A-Za-z0-9][A-Za-z0-9._-]*)/.exec(line);
+      if (match)
+        names.push(match[1]);
+    }
+    return names;
+  }
+  for (const match of text.matchAll(/["']([A-Za-z0-9][A-Za-z0-9._-]*)[^"']*["']/g)) {
+    names.push(match[1]);
+  }
+  return names;
+}
+function detectRepoLlmSignals(cwd = process.cwd()) {
+  const frameworks = new Set;
+  const providers = new Set;
+  const record = (signal) => {
+    if (!signal)
+      return;
+    (signal.kind === "framework" ? frameworks : providers).add(signal.name);
+  };
+  const scanDir = (dir) => {
+    try {
+      const pkg = JSON.parse(readFileSync5(join6(dir, "package.json"), "utf8"));
+      for (const dep of [
+        ...Object.keys(pkg.dependencies ?? {}),
+        ...Object.keys(pkg.devDependencies ?? {}),
+        ...Object.keys(pkg.peerDependencies ?? {})
+      ]) {
+        record(jsDependencySignal(dep));
+      }
+    } catch {}
+    for (const file of ["requirements.txt", "pyproject.toml"]) {
+      try {
+        const text = readFileSync5(join6(dir, file), "utf8");
+        for (const name of pythonRequirementNames(text, file)) {
+          record(pyDependencySignal(name));
+        }
+      } catch {}
+    }
+  };
+  let visited = 0;
+  const walk = (dir, depth) => {
+    if (depth > REPO_SIGNAL_MAX_DEPTH || visited >= REPO_SIGNAL_MAX_DIRS)
+      return;
+    visited += 1;
+    scanDir(dir);
+    let entries;
+    try {
+      entries = readdirSync4(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory() || entry.name.startsWith("."))
+        continue;
+      if (REPO_SIGNAL_SKIPPED_DIRS.has(entry.name))
+        continue;
+      walk(join6(dir, entry.name), depth + 1);
+    }
+  };
+  walk(cwd, 0);
+  return { frameworks: [...frameworks].sort(), providers: [...providers].sort() };
+}
+function readHarnessGraphCounts(cwd = process.cwd()) {
+  const manifestPath = join6(cwd, ".moda", "harness.json");
+  if (!existsSync6(manifestPath))
+    return {};
+  try {
+    const graph = JSON.parse(readFileSync5(manifestPath, "utf8"));
+    return {
+      agents: Array.isArray(graph.runtimeAgents) ? graph.runtimeAgents.length : 0,
+      artifacts: Array.isArray(graph.artifacts) ? graph.artifacts.length : 0
+    };
+  } catch {
+    return {};
+  }
+}
+function commandFlags(flags) {
+  return Object.fromEntries(Object.entries(flags).filter(([, value]) => value !== undefined && value !== false).map(([key, value]) => [key, value === true ? "true" : String(value)]));
+}
+function stringFlag(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value : undefined;
+}
+function resumeFlagsForInit(flags) {
+  const passthrough = [
+    "profile",
+    "tenant-id",
+    "offline",
+    "analyst",
+    "sdk-integrate",
+    "ci-cd",
+    "autosync",
+    "harness-rescan",
+    "harness-rescan-paths",
+    "no-sdk-integrate",
+    "no-ci-cd",
+    "no-autosync",
+    "no-harness-rescan",
+    "yes",
+    "agent",
+    "json",
+    "stream"
+  ];
+  const out = [];
+  for (const key of passthrough) {
+    const value = flagValue(flags, key, key.replace(/-/g, "_"));
+    if (value === undefined || value === false || value === "false")
+      continue;
+    const flag = `--${key}`;
+    if (value === true || value === "true")
+      out.push(flag);
+    else
+      out.push(flag, String(value));
+  }
+  if (resolveHarnessRescanFlag(flags) === false && !out.includes("--no-harness-rescan")) {
+    out.push("--no-harness-rescan");
+  }
+  return out;
+}
+function resolveCiCdFlag(flags) {
+  const explicit = parseOptionalBoolean(flagValue(flags, "ci-cd", "ci_cd", "ci"));
+  if (explicit !== undefined)
+    return explicit;
+  if (isTruthyFlag(flagValue(flags, "no-ci-cd", "no_ci_cd")))
+    return false;
+  return;
+}
+function resolveAutosyncFlag(flags) {
+  const explicit = parseOptionalBoolean(flagValue(flags, "autosync", "auto-sync", "auto_sync"));
+  if (explicit !== undefined)
+    return explicit;
+  if (isTruthyFlag(flagValue(flags, "no-autosync", "no_autosync", "no-auto-sync", "no_auto_sync")))
+    return false;
+  return;
+}
+function resolveHarnessRescanFlag(flags) {
+  const explicit = parseOptionalBoolean(flagValue(flags, "harness-rescan", "harness_rescan"));
+  if (explicit !== undefined)
+    return explicit;
+  if (isTruthyFlag(flagValue(flags, "no-harness-rescan", "no_harness_rescan")))
+    return false;
+  return;
+}
+function parseHarnessRescanPaths(value) {
+  if (typeof value !== "string")
+    return;
+  const globs = value.split(",").map((glob) => glob.trim()).filter((glob) => glob.length > 0 && glob !== "true");
+  return globs.length > 0 ? globs : undefined;
+}
+function resolveSdkIntegrateFlag(flags) {
+  const explicit = parseOptionalBoolean(flagValue(flags, "sdk-integrate", "sdk_integrate", "sdk-guide", "sdk_guide", "sdk"));
+  if (explicit !== undefined)
+    return explicit;
+  if (isTruthyFlag(flagValue(flags, "no-sdk-integrate", "no_sdk_integrate", "no-sdk-guide", "no_sdk_guide", "no-sdk", "no_sdk"))) {
+    return false;
+  }
+  return;
+}
+function parseOptionalBoolean(value) {
+  if (value === undefined)
+    return;
+  if (value === true || value === 1 || value === "true" || value === "1" || value === "yes")
+    return true;
+  if (value === false || value === 0 || value === "false" || value === "0" || value === "no")
+    return false;
+  return;
+}
+function isTruthyFlag(value) {
+  return value === true || value === 1 || value === "true" || value === "1" || value === "yes";
+}
+function resolveHarnessRemote(flags) {
+  if (isTruthyFlag(flagValue(flags, "local")))
+    return false;
+  if (isTruthyFlag(flagValue(flags, "no-remote", "no_remote")))
+    return false;
+  const remote = parseOptionalBoolean(flagValue(flags, "remote"));
+  if (remote !== undefined)
+    return remote;
+  if (isDeterministicLocalAnalyst(stringFlag(flagValue(flags, "analyst")))) {
+    return false;
+  }
+  return true;
+}
+function hasExplicitRemoteChoice(flags) {
+  if (isTruthyFlag(flagValue(flags, "local")))
+    return true;
+  if (isTruthyFlag(flagValue(flags, "no-remote", "no_remote")))
+    return true;
+  if (parseOptionalBoolean(flagValue(flags, "remote")) !== undefined)
+    return true;
+  return isDeterministicLocalAnalyst(stringFlag(flagValue(flags, "analyst")));
+}
+function flagValue(flags, ...keys) {
+  for (const key of keys) {
+    if (flags[key] !== undefined)
+      return flags[key];
+  }
+  return;
+}
+export {
+  writeHarnessRescanWorkflow,
+  writeCiCdWorkflow,
+  writeAutosyncWorkflow,
+  runInit,
+  resumeFlagsForInit,
+  resolveHarnessRemote,
+  readHarnessQualitySignals,
+  harnessLooksIncomplete,
+  detectRepoLlmSignals
+};