@moda-ai/cli 1.22.1 → 1.23.0

package/dist/errors.d.ts

@@ -1,50 +0,0 @@
-export declare class CliInputError extends Error {
-    readonly usage?: string | undefined;
-    constructor(message: string, usage?: string | undefined);
-}
-/**
- * The authenticated user cannot perform the requested action with their
- * current access (no organizations, or insufficient role). This is an access
- * problem, not missing auth — the dispatcher maps it to EXIT_ERROR (1),
- * never EXIT_AUTH_REQUIRED.
- */
-export declare class CliAccessError extends Error {
-    /** Optional follow-up line telling the user how to obtain access. */
-    readonly guidance?: string;
-    constructor(message: string, options?: {
-        guidance?: string;
-    });
-}
-export interface AgentInputChoice {
-    value: string;
-    label: string;
-    resume_flags: string[];
-}
-export interface AgentInputRequest {
-    id: string;
-    question: string;
-    kind: 'select' | 'confirm' | 'text';
-    choices?: AgentInputChoice[];
-    resume_command?: string[];
-}
-export interface AgentAuthRequest {
-    reason: 'no_stored_credentials' | 'token_expired' | 'token_revoked' | 'renew_failed';
-    login_command: string[];
-    resume_command?: string[];
-}
-export declare class CliInputRequiredError extends Error {
-    readonly input_request: AgentInputRequest;
-    constructor(message: string, input_request: AgentInputRequest, usage?: string);
-    readonly usage?: string;
-}
-export declare class CliAuthError extends Error {
-    readonly auth: AgentAuthRequest;
-    constructor(message: string, auth: AgentAuthRequest, usage?: string);
-    readonly usage?: string;
-}
-export declare class CliCancellationError extends Error {
-    constructor(message: string);
-}
-export declare function isNetworkLikeError(error: unknown): boolean;
-export declare function isApiLikeError(error: unknown): boolean;
-//# sourceMappingURL=errors.d.ts.map

package/dist/errors.js

@@ -1,64 +0,0 @@
-export class CliInputError extends Error {
-    usage;
-    constructor(message, usage) {
-        super(message);
-        this.usage = usage;
-        this.name = 'CliInputError';
-    }
-}
-/**
- * The authenticated user cannot perform the requested action with their
- * current access (no organizations, or insufficient role). This is an access
- * problem, not missing auth — the dispatcher maps it to EXIT_ERROR (1),
- * never EXIT_AUTH_REQUIRED.
- */
-export class CliAccessError extends Error {
-    /** Optional follow-up line telling the user how to obtain access. */
-    guidance;
-    constructor(message, options = {}) {
-        super(message);
-        this.name = 'CliAccessError';
-        this.guidance = options.guidance;
-    }
-}
-export class CliInputRequiredError extends Error {
-    input_request;
-    constructor(message, input_request, usage) {
-        super(message);
-        this.input_request = input_request;
-        this.name = 'CliInputRequiredError';
-        if (usage)
-            this.usage = usage;
-    }
-    usage;
-}
-export class CliAuthError extends Error {
-    auth;
-    constructor(message, auth, usage) {
-        super(message);
-        this.auth = auth;
-        this.name = 'CliAuthError';
-        if (usage)
-            this.usage = usage;
-    }
-    usage;
-}
-export class CliCancellationError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'CliCancellationError';
-    }
-}
-export function isNetworkLikeError(error) {
-    return error instanceof Error &&
-        (error.message.startsWith('Network error:') ||
-            error.message.startsWith('Request timed out') ||
-            error.name === 'AbortError' ||
-            /(?:ECONNRESET|ECONNREFUSED|ETIMEDOUT|ENOTFOUND|socket hang up)/i.test(error.message));
-}
-export function isApiLikeError(error) {
-    return error instanceof Error &&
-        (error.name === 'ApiError' ||
-            ('statusCode' in error && typeof error.statusCode === 'number'));
-}
-//# sourceMappingURL=errors.js.map

package/dist/exit-funnel.d.ts

@@ -1,14 +0,0 @@
-import type { CommandContext } from './command-context.js';
-export type RunOutcome = {
-    kind: 'completed';
-    exitCode?: number;
-} | {
-    kind: 'error';
-    error: unknown;
-} | {
-    kind: 'cancelled';
-    reason?: string;
-};
-export declare function finishRun(context: CommandContext, outcome: RunOutcome): Promise<number>;
-export declare function exitCodeForError(error: unknown): number;
-//# sourceMappingURL=exit-funnel.d.ts.map

package/dist/exit-funnel.js

@@ -1,53 +0,0 @@
-import { CliAccessError, CliAuthError, CliCancellationError, CliInputRequiredError, } from './errors.js';
-import { EXIT_AUTH_REQUIRED, EXIT_CANCELLED, EXIT_ERROR, EXIT_INPUT_REQUIRED, EXIT_OK, wasOutputCancelled, } from './output.js';
-const finishedContexts = new WeakSet();
-export async function finishRun(context, outcome) {
-    if (finishedContexts.has(context)) {
-        return exitCodeForOutcome(outcome);
-    }
-    finishedContexts.add(context);
-    if (outcome.kind === 'completed') {
-        // Guarantee the stream contract structurally: exactly one terminal event
-        // ends every stream. A handler that returned without writing one gets a
-        // synthetic `completed` (a no-op in non-stream modes and when a terminal
-        // event was already emitted).
-        if (!context.output.hasTerminalOutput()) {
-            context.output.writeEvent({ event: 'completed', status: 'ok' });
-        }
-        context.output.close();
-        if (wasOutputCancelled())
-            return EXIT_CANCELLED;
-        return outcome.exitCode ?? EXIT_OK;
-    }
-    if (outcome.kind === 'cancelled') {
-        context.output.writeCancelled(outcome.reason ?? 'Command cancelled.');
-        context.output.close();
-        return EXIT_CANCELLED;
-    }
-    context.output.writeError(outcome.error);
-    context.output.close();
-    if (wasOutputCancelled())
-        return EXIT_CANCELLED;
-    return exitCodeForError(outcome.error);
-}
-export function exitCodeForError(error) {
-    if (error instanceof CliAuthError)
-        return EXIT_AUTH_REQUIRED;
-    if (error instanceof CliInputRequiredError)
-        return EXIT_INPUT_REQUIRED;
-    if (error instanceof CliCancellationError)
-        return EXIT_CANCELLED;
-    // An access problem (missing org / insufficient role) is a hard failure,
-    // never auth-required — it stays EXIT_ERROR (the default), made explicit here.
-    if (error instanceof CliAccessError)
-        return EXIT_ERROR;
-    return EXIT_ERROR;
-}
-function exitCodeForOutcome(outcome) {
-    if (outcome.kind === 'completed')
-        return outcome.exitCode ?? EXIT_OK;
-    if (outcome.kind === 'cancelled')
-        return EXIT_CANCELLED;
-    return exitCodeForError(outcome.error);
-}
-//# sourceMappingURL=exit-funnel.js.map

package/dist/harness-artifact-bodies.d.ts

@@ -1,28 +0,0 @@
-import type { HarnessArtifactType, HarnessEvidence, HarnessGraph } from './harness.js';
-export interface ArtifactBodyAnnotation {
-    values: Record<string, string[]>;
-    evidence: HarnessEvidence;
-    sourceAbsPath: string;
-    rootDir: string;
-}
-export interface ArtifactBodyFileItem {
-    path: string;
-    rootDir: string;
-    text?: string;
-}
-export declare function extractToolBodyFromText(text: string, toolName: string): string | undefined;
-export declare function annotatedSourceCandidates(sourcePath: string, annotation: ArtifactBodyAnnotation): string[];
-/**
- * Resolve an annotated artifact `path=` to a repo-relative sourcePath.
- * Prefer the nested annotation-relative file when present so later whole-file
- * hydration and content hashing look in the right place.
- */
-export declare function resolveAnnotatedSourcePath(sourcePath: string, annotation: ArtifactBodyAnnotation): string;
-export declare function readPromptOrToolBody(type: HarnessArtifactType, sourcePath: string, annotation: ArtifactBodyAnnotation): string | undefined;
-export declare function extractToolBody(file: ArtifactBodyFileItem, tool: {
-    name: string;
-    reason: string;
-}): string | undefined;
-export declare function hydratePromptAndToolBodies(graph: HarnessGraph, rootDir: string): void;
-export declare function enrichScanCaptureMetadata(graph: HarnessGraph): void;
-//# sourceMappingURL=harness-artifact-bodies.d.ts.map

package/dist/harness-artifact-bodies.js

@@ -1,276 +0,0 @@
-import { existsSync, lstatSync, readFileSync, realpathSync } from 'node:fs';
-import { basename, dirname, isAbsolute, relative, resolve } from 'node:path';
-import { artifactHasBody, firstEvidencePath, requiresArtifactBody, } from './harness-report.js';
-const MAX_SCANNED_FILE_BYTES = 512 * 1024;
-const SNAPSHOT_BUDGET_SKIP_REASONS = new Set([
-    'file too large for harness scan',
-    'scan text budget exceeded',
-]);
-function first(values) {
-    return values?.[0];
-}
-function normalizePath(path) {
-    return path.replace(/\\/g, '/');
-}
-function isTextFile(path) {
-    return /\.(ts|tsx|js|jsx|mjs|cjs|py|md|json|ya?ml|toml|txt|sh|rb|go|rs|swift|kt|java|cs|php|sql|graphql|gql|proto|css|scss|less|html|vue|svelte)$/i.test(path);
-}
-function isSecretishPath(path) {
-    const normalized = normalizePath(path).toLowerCase();
-    return normalized.includes('.env') ||
-        normalized.endsWith('.pem') ||
-        normalized.endsWith('.key') ||
-        normalized.includes('/secrets/') ||
-        normalized.includes('/credentials/');
-}
-function isOutsideRoot(rel) {
-    return rel === '' || rel === '..' || rel.startsWith('../') || isAbsolute(rel);
-}
-/** Walk from `fromAbs` up to `rootAbs` (inclusive), bounded by `maxDepth`. */
-function walkAncestorDirs(fromAbs, rootAbs, maxDepth = 8) {
-    const dirs = [];
-    let cursor = fromAbs;
-    for (let depth = 0; depth < maxDepth; depth += 1) {
-        dirs.push(cursor);
-        if (normalizePath(cursor) === normalizePath(rootAbs))
-            break;
-        const parent = dirname(cursor);
-        if (parent === cursor)
-            break;
-        cursor = parent;
-    }
-    return dirs;
-}
-function readBoundedRepoText(absPath, rootDir) {
-    if (!existsSync(absPath))
-        return undefined;
-    const rel = normalizePath(relative(rootDir, absPath));
-    // Containment: never read files that resolve outside the scan root. Guards against
-    // `..` traversal or absolute paths (e.g. via a crafted `path=` annotation / sourcePath /
-    // evidence path) being hydrated into synced artifact bodies.
-    if (isOutsideRoot(rel))
-        return undefined;
-    if (isSecretishPath(rel))
-        return undefined;
-    let stat;
-    try {
-        stat = lstatSync(absPath);
-    }
-    catch {
-        return undefined;
-    }
-    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_SCANNED_FILE_BYTES) {
-        return undefined;
-    }
-    if (!isTextFile(rel))
-        return undefined;
-    // Realpath containment: the lexical `rel` check is purely textual and `lstatSync` only
-    // inspects the final component, so an intermediate directory symlink (e.g.
-    // `tools/outside -> /tmp/public`) could still let `readFileSync` follow the link out of
-    // the repo. Canonicalize both sides and re-check before reading.
-    try {
-        if (isOutsideRoot(normalizePath(relative(realpathSync(rootDir), realpathSync(absPath))))) {
-            return undefined;
-        }
-    }
-    catch {
-        return undefined;
-    }
-    try {
-        return readFileSync(absPath, 'utf8');
-    }
-    catch {
-        return undefined;
-    }
-}
-function readRepoRelativeText(rootDir, relPath) {
-    return readBoundedRepoText(resolve(rootDir, relPath), rootDir);
-}
-function isDedicatedToolFilePath(path) {
-    return /(^|\/)tools?\//i.test(path) && /\.(ts|tsx|js|mjs|py)$/i.test(path);
-}
-function firstEvidenceLineNumber(evidence) {
-    if (!Array.isArray(evidence))
-        return undefined;
-    for (const entry of evidence) {
-        if (typeof entry.line === 'number' && Number.isFinite(entry.line) && entry.line > 0) {
-            return Math.floor(entry.line);
-        }
-    }
-    return undefined;
-}
-function extractSnippetAroundLine(text, line, radius) {
-    const lines = text.split(/\r?\n/);
-    const start = Math.max(0, line - 1 - radius);
-    // `line` is 1-indexed and slice's end is exclusive, so include through
-    // (line-1)+radius: end = line + radius. Using line-1+radius dropped the tail line.
-    const end = Math.min(lines.length, line + radius);
-    return lines.slice(start, end).join('\n');
-}
-export function extractToolBodyFromText(text, toolName) {
-    const lines = text.split(/\r?\n/);
-    const normalizedName = toolName.replace(/\s+/g, '').toLowerCase();
-    for (let index = 0; index < lines.length; index += 1) {
-        const line = lines[index];
-        const compact = line.replace(/\s+/g, '').toLowerCase();
-        const mentionsTool = compact.includes(normalizedName) || compact.includes(`def${normalizedName}`);
-        if (!mentionsTool)
-            continue;
-        if (line.includes('function_tool') ||
-            line.includes('tool(') ||
-            line.includes('createTool') ||
-            line.includes('functionTool') ||
-            line.includes('dynamicTool') ||
-            line.includes('new Tool') ||
-            line.includes('def ')) {
-            return extractSnippetAroundLine(text, index + 1, 30);
-        }
-    }
-    return undefined;
-}
-export function annotatedSourceCandidates(sourcePath, annotation) {
-    const explicitSourcePath = normalizePath(sourcePath) !== normalizePath(annotation.evidence.path);
-    // Relative `path=` annotations in nested packages usually mean "relative to the
-    // package/harness root that owns the annotated file", not the file's own directory.
-    // Example: harnesses/boardy-ops/src/ops.ts with path=prompts/ops-system.prompt.md
-    // resolves to harnesses/boardy-ops/prompts/ops-system.prompt.md (one level up from
-    // src/), not harnesses/boardy-ops/src/prompts/... Walk parents between the
-    // annotated file and the scan root, then fall back to the scan-root candidate
-    // for flat repos that annotate from the repository root.
-    if (!explicitSourcePath) {
-        return [
-            resolve(annotation.rootDir, sourcePath),
-            resolve(dirname(annotation.sourceAbsPath), sourcePath),
-            annotation.sourceAbsPath,
-        ];
-    }
-    const rootAbs = resolve(annotation.rootDir);
-    const candidates = walkAncestorDirs(dirname(annotation.sourceAbsPath), rootAbs)
-        .map((dir) => resolve(dir, sourcePath));
-    candidates.push(resolve(annotation.rootDir, sourcePath));
-    return candidates;
-}
-function readAnnotatedSourceText(sourcePath, annotation) {
-    const seen = new Set();
-    for (const candidate of annotatedSourceCandidates(sourcePath, annotation)) {
-        if (seen.has(candidate))
-            continue;
-        seen.add(candidate);
-        const text = readBoundedRepoText(candidate, annotation.rootDir);
-        if (text !== undefined)
-            return text;
-    }
-    return undefined;
-}
-/**
- * Resolve an annotated artifact `path=` to a repo-relative sourcePath.
- * Prefer the nested annotation-relative file when present so later whole-file
- * hydration and content hashing look in the right place.
- */
-export function resolveAnnotatedSourcePath(sourcePath, annotation) {
-    const seen = new Set();
-    for (const candidate of annotatedSourceCandidates(sourcePath, annotation)) {
-        if (seen.has(candidate))
-            continue;
-        seen.add(candidate);
-        if (readBoundedRepoText(candidate, annotation.rootDir) === undefined)
-            continue;
-        const rel = normalizePath(relative(annotation.rootDir, candidate));
-        if (!isOutsideRoot(rel))
-            return rel;
-    }
-    return sourcePath;
-}
-export function readPromptOrToolBody(type, sourcePath, annotation) {
-    if (!requiresArtifactBody(type))
-        return undefined;
-    const text = readAnnotatedSourceText(sourcePath, annotation);
-    if (text === undefined)
-        return undefined;
-    if (type === 'prompt' || isDedicatedToolFilePath(sourcePath))
-        return text;
-    return extractToolBodyFromText(text, first(annotation.values.name) ?? basename(sourcePath)) ?? text;
-}
-export function extractToolBody(file, tool) {
-    const text = file.text ?? readRepoRelativeText(file.rootDir, file.path);
-    if (!text)
-        return undefined;
-    if (isDedicatedToolFilePath(file.path))
-        return text;
-    return extractToolBodyFromText(text, tool.name);
-}
-function hydrateArtifactBody(artifact, rootDir) {
-    if (artifact.sourcePath) {
-        const wholeFile = readRepoRelativeText(rootDir, artifact.sourcePath)
-            ?? readSourcePathRelativeToEvidence(artifact, rootDir);
-        if (wholeFile !== undefined) {
-            if (artifact.type === 'prompt' || isDedicatedToolFilePath(artifact.sourcePath)) {
-                return wholeFile;
-            }
-            if (artifact.type === 'tool') {
-                return extractToolBodyFromText(wholeFile, artifact.name) ?? wholeFile;
-            }
-        }
-    }
-    const evidenceLine = firstEvidenceLineNumber(artifact.evidence);
-    const evidencePath = firstEvidencePath(artifact);
-    if (evidencePath) {
-        const text = readRepoRelativeText(rootDir, evidencePath);
-        if (text !== undefined) {
-            if (evidenceLine !== undefined) {
-                return extractSnippetAroundLine(text, evidenceLine, artifact.type === 'tool' ? 30 : 80);
-            }
-            // No line number (common for agent/hosted analyst citations): fall back to
-            // the whole evidence file so the body is still captured in full.
-            if (artifact.type === 'prompt' || isDedicatedToolFilePath(evidencePath))
-                return text;
-            if (artifact.type === 'tool')
-                return extractToolBodyFromText(text, artifact.name) ?? text;
-        }
-    }
-    return undefined;
-}
-/**
- * Fallback for nested relative `sourcePath` values that were recorded before the
- * annotation-relative resolver existed: walk parent dirs beside the evidence file
- * looking for the package-local prompt/tool path.
- */
-function readSourcePathRelativeToEvidence(artifact, rootDir) {
-    if (!artifact.sourcePath)
-        return undefined;
-    const evidencePath = firstEvidencePath(artifact);
-    if (!evidencePath)
-        return undefined;
-    const rootAbs = resolve(rootDir);
-    for (const dir of walkAncestorDirs(dirname(resolve(rootDir, evidencePath)), rootAbs)) {
-        const text = readBoundedRepoText(resolve(dir, artifact.sourcePath), rootDir);
-        if (text !== undefined)
-            return text;
-    }
-    return undefined;
-}
-export function hydratePromptAndToolBodies(graph, rootDir) {
-    for (const artifact of graph.artifacts) {
-        if (!requiresArtifactBody(artifact.type) || artifactHasBody(artifact)) {
-            continue;
-        }
-        const hydrated = hydrateArtifactBody(artifact, rootDir);
-        if (hydrated)
-            artifact.body = hydrated;
-    }
-}
-function countIncompletePromptToolBodies(graph) {
-    return graph.artifacts.filter((artifact) => requiresArtifactBody(artifact.type) &&
-        !artifactHasBody(artifact)).length;
-}
-export function enrichScanCaptureMetadata(graph) {
-    const budgetSkips = graph.scan.skipped
-        .map((skip) => skip.reason)
-        .filter((reason) => SNAPSHOT_BUDGET_SKIP_REASONS.has(reason));
-    const truncationReasons = [...new Set(budgetSkips)];
-    graph.scan.truncated = truncationReasons.length > 0;
-    graph.scan.truncationReasons = truncationReasons.length > 0 ? truncationReasons : undefined;
-    const incomplete = countIncompletePromptToolBodies(graph);
-    graph.scan.incompleteArtifactCount = incomplete > 0 ? incomplete : undefined;
-}
-//# sourceMappingURL=harness-artifact-bodies.js.map

package/dist/harness-candidates.d.ts

@@ -1,77 +0,0 @@
-/**
- * Static harness-candidate pre-pass (Phase 2 prototype).
- *
- * A deterministic, LLM-free detector that walks a repo and extracts
- * *candidate* harness surfaces — LLM SDK call sites, agent-framework
- * constructs, tool definitions/schemas, prompt files and prompt-like string
- * literals, and model config assignments — each with a file:line citation,
- * a confidence heuristic, and a short excerpt.
- *
- * Purpose: today `harness analyze` (local or hosted) has a single agent read
- * everything, which caps out around ~450 files / ~20 minutes. This pre-pass is
- * pure regex/heuristics (no LLM calls, no network), runs in milliseconds per
- * thousand files, and produces a prioritized read plan so the LLM
- * classification stage only needs to open the files that plausibly matter.
- *
- * Output contract: `harness_candidates.v0.1` — see {@link HarnessCandidateReport}.
- * Candidates are recall-oriented: false positives are expected and cheap (the
- * LLM stage filters them); false negatives are the expensive failure mode.
- */
-import { type FileInventoryItem, type HarnessScanMetadata } from './harness.js';
-export type HarnessCandidateKind = 'llm_call_site' | 'framework_construct' | 'tool_definition' | 'tool_schema' | 'message_construction' | 'prompt_file' | 'prompt_literal' | 'model_config';
-export type HarnessCandidateConfidence = 'high' | 'medium' | 'low';
-export interface HarnessCandidate {
-    kind: HarnessCandidateKind;
-    /** Repo-relative, forward-slash path. */
-    path: string;
-    /** 1-based inclusive line range. */
-    startLine: number;
-    endLine: number;
-    confidence: HarnessCandidateConfidence;
-    /** Which detector fired, e.g. `openai.chat_completions_create`. */
-    signal: string;
-    /** Normalized single-line excerpt, capped at {@link EXCERPT_MAX_CHARS}. */
-    excerpt: string;
-}
-export interface HarnessCandidateFileSummary {
-    path: string;
-    /** Sum of per-candidate confidence weights; higher = read first. */
-    score: number;
-    kinds: HarnessCandidateKind[];
-    candidateCount: number;
-}
-export interface HarnessCandidateStats {
-    filesScanned: number;
-    filesWithCandidates: number;
-    candidateCount: number;
-    textBytesScanned: number;
-    durationMs: number;
-    filesPerSecond: number;
-}
-export interface HarnessCandidateReport {
-    schemaVersion: 'harness_candidates.v0.1';
-    generatedAt: string;
-    rootDir: string;
-    stats: HarnessCandidateStats;
-    candidates: HarnessCandidate[];
-    /** Per-file rollup sorted by descending score — the LLM-stage read plan. */
-    files: HarnessCandidateFileSummary[];
-    skipped: HarnessScanMetadata['skipped'];
-}
-/**
- * Pure detector core: run every heuristic over an already-materialized file
- * inventory. No filesystem access — unit tests and the walker wrapper both
- * call this.
- */
-export declare function detectHarnessCandidatesInFiles(files: Array<Pick<FileInventoryItem, 'path' | 'text'>>): {
-    candidates: HarnessCandidate[];
-    files: HarnessCandidateFileSummary[];
-};
-/**
- * Walk `rootDir` with the harness inventory walker (same skip/secret/symlink
- * budget rules as `harness scan`, widened to include all prompt-doc files)
- * and run the static detector over it.
- */
-export declare function detectHarnessCandidates(rootDir: string): HarnessCandidateReport;
-export declare function writeHarnessCandidatesReport(report: HarnessCandidateReport, outPath: string): string;
-//# sourceMappingURL=harness-candidates.d.ts.map