@moda-ai/cli 1.22.1 → 1.23.0

package/dist/cli-mnqa4rp6.js

@@ -0,0 +1,1563 @@
+import { createRequire } from "node:module";
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+// src/errors.ts
+class CliInputError extends Error {
+  usage;
+  constructor(message, usage) {
+    super(message);
+    this.usage = usage;
+    this.name = "CliInputError";
+  }
+}
+
+class CliAccessError extends Error {
+  guidance;
+  constructor(message, options = {}) {
+    super(message);
+    this.name = "CliAccessError";
+    this.guidance = options.guidance;
+  }
+}
+
+class CliInputRequiredError extends Error {
+  input_request;
+  constructor(message, input_request, usage) {
+    super(message);
+    this.input_request = input_request;
+    this.name = "CliInputRequiredError";
+    if (usage)
+      this.usage = usage;
+  }
+  usage;
+}
+
+class CliAuthError extends Error {
+  auth;
+  constructor(message, auth, usage) {
+    super(message);
+    this.auth = auth;
+    this.name = "CliAuthError";
+    if (usage)
+      this.usage = usage;
+  }
+  usage;
+}
+
+class CliCancellationError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CliCancellationError";
+  }
+}
+function isNetworkLikeError(error) {
+  return error instanceof Error && (error.message.startsWith("Network error:") || error.message.startsWith("Request timed out") || error.name === "AbortError" || /(?:ECONNRESET|ECONNREFUSED|ETIMEDOUT|ENOTFOUND|socket hang up)/i.test(error.message));
+}
+function isApiLikeError(error) {
+  return error instanceof Error && (error.name === "ApiError" || ("statusCode" in error) && typeof error.statusCode === "number");
+}
+
+// src/config.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+
+// src/profiles.ts
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, normalize, relative } from "node:path";
+var PROFILE_CONFIG_VERSION = 1;
+var PROD_BASE_URL = "https://moda.dev";
+var DEFAULT_INGEST_URL = "https://moda-ingest.modas.workers.dev";
+var DEFAULT_PROFILE_NAME = "prod";
+function getEnv(options = {}) {
+  return options.env ?? process.env;
+}
+function resolveModaHome(options = {}) {
+  const env = getEnv(options);
+  return options.home || env.HOME || env.USERPROFILE || homedir();
+}
+function getModaPaths(options = {}) {
+  const home = resolveModaHome(options);
+  const dir = join(home, ".moda");
+  return {
+    home,
+    dir,
+    legacyConfigPath: join(dir, "config.json"),
+    legacyAuthPath: join(dir, "auth.json"),
+    profileConfigPath: join(dir, "profiles.json"),
+    secretsDir: join(dir, "secrets")
+  };
+}
+function getModaDir(options = {}) {
+  return getModaPaths(options).dir;
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function optionalString(value) {
+  return typeof value === "string" && value.trim() ? value : undefined;
+}
+function readJsonFile(path) {
+  return JSON.parse(readFileSync(path, "utf8"));
+}
+function safeReadRecord(path) {
+  try {
+    if (!existsSync(path))
+      return;
+    const parsed = readJsonFile(path);
+    return isRecord(parsed) ? parsed : undefined;
+  } catch {
+    return;
+  }
+}
+function loadLegacyCliConfig(options = {}) {
+  const parsed = safeReadRecord(getModaPaths(options).legacyConfigPath);
+  if (!parsed)
+    return {};
+  return {
+    api_key: optionalString(parsed.api_key),
+    ingest_url: optionalString(parsed.ingest_url),
+    tenant_id: optionalString(parsed.tenant_id)
+  };
+}
+function writeLegacyCliConfig(update, options = {}) {
+  const paths = getModaPaths(options);
+  mkdirSync(paths.dir, { recursive: true });
+  const merged = { ...loadLegacyCliConfig(options), ...update };
+  writeSecretJsonFile(paths.legacyConfigPath, merged);
+  return merged;
+}
+function profileDefaults(name, environment, now) {
+  const local = environment === "local";
+  const staging = environment === "staging";
+  return {
+    name,
+    environment,
+    base_url: local ? "http://localhost:3000" : staging ? "https://staging.moda.dev" : PROD_BASE_URL,
+    ingest_url: local ? "http://localhost:8787" : DEFAULT_INGEST_URL,
+    metadata: {
+      created_at: now.toISOString(),
+      source: "default"
+    }
+  };
+}
+function createDefaultProfiles(options = {}) {
+  const now = options.now ?? new Date;
+  return {
+    local: profileDefaults("local", "local", now),
+    staging: profileDefaults("staging", "staging", now),
+    prod: profileDefaults("prod", "prod", now)
+  };
+}
+function isLoopbackHostname(hostname) {
+  const host = hostname.toLowerCase();
+  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+}
+function isLoopbackBaseUrl(url) {
+  try {
+    return isLoopbackHostname(new URL(url).hostname);
+  } catch {
+    return false;
+  }
+}
+function defaultIngestUrlForEnvironment(environment) {
+  if (environment === "local")
+    return "http://localhost:8787";
+  return DEFAULT_INGEST_URL;
+}
+function environmentAllowsLoopback(environment) {
+  return environment !== "prod";
+}
+function sanitizeProfileBaseUrl(url, environment) {
+  const normalized = normalizeModaBaseUrl(url);
+  if (environmentAllowsLoopback(environment) || !isLoopbackBaseUrl(normalized)) {
+    return normalized;
+  }
+  return PROD_BASE_URL;
+}
+function sanitizeProfileIngestUrl(url, environment) {
+  if (!url)
+    return url;
+  if (environmentAllowsLoopback(environment) || !isLoopbackBaseUrl(url)) {
+    return url;
+  }
+  return DEFAULT_INGEST_URL;
+}
+function enforceNonLoopbackBaseUrl(url, environment) {
+  return sanitizeProfileBaseUrl(url, environment);
+}
+function enforceNonLoopbackIngestUrl(url, environment) {
+  return sanitizeProfileIngestUrl(url, environment) ?? defaultIngestUrlForEnvironment(environment);
+}
+function activeProfileEnvironment(options) {
+  try {
+    return getActiveProfile(options).environment;
+  } catch {
+    return "prod";
+  }
+}
+function normalizeEnvironment(value) {
+  if (value === "local" || value === "dev" || value === "staging" || value === "prod") {
+    return value;
+  }
+  return "prod";
+}
+function isSecretReference(value) {
+  return value.startsWith("env:") || value.startsWith("file:") || value === "legacy:config.api_key" || value === "legacy:auth.access_token";
+}
+function normalizeSecretReference(value) {
+  if (typeof value !== "string")
+    return;
+  return isSecretReference(value) ? value : undefined;
+}
+function assertValidProfileName(name) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(name)) {
+    throw new Error(`Invalid profile name '${name}'. Use letters, numbers, dots, dashes, or underscores.`);
+  }
+}
+function normalizeProfile(fallbackName, value, options) {
+  if (!isRecord(value))
+    return;
+  const name = optionalString(value.name) ?? fallbackName;
+  try {
+    assertValidProfileName(name);
+  } catch {
+    return;
+  }
+  const defaults = profileDefaults(name, normalizeEnvironment(value.environment), options.now ?? new Date);
+  return {
+    ...defaults,
+    base_url: sanitizeProfileBaseUrl(optionalString(value.base_url) ?? defaults.base_url, normalizeEnvironment(value.environment)),
+    ingest_url: sanitizeProfileIngestUrl(optionalString(value.ingest_url) ?? defaults.ingest_url, normalizeEnvironment(value.environment)),
+    tenant_id: optionalString(value.tenant_id),
+    workspace_id: optionalString(value.workspace_id),
+    api_key_ref: normalizeSecretReference(value.api_key_ref),
+    auth_token_ref: normalizeSecretReference(value.auth_token_ref),
+    metadata: isRecord(value.metadata) ? value.metadata : defaults.metadata
+  };
+}
+function inspectLegacyAuth(path) {
+  const parsed = safeReadRecord(path);
+  const expiresAt = typeof parsed?.expires_at === "number" ? parsed.expires_at : undefined;
+  return {
+    path,
+    present: Boolean(parsed),
+    has_access_token: typeof parsed?.access_token === "string",
+    expires_at: expiresAt,
+    expired: expiresAt === undefined ? undefined : Date.now() / 1000 > expiresAt - 60
+  };
+}
+function inspectProfileMigrationState(options = {}) {
+  const paths = getModaPaths(options);
+  const legacyConfig = loadLegacyCliConfig(options);
+  return {
+    legacy_config: {
+      path: paths.legacyConfigPath,
+      present: existsSync(paths.legacyConfigPath),
+      has_api_key: Boolean(legacyConfig.api_key),
+      has_ingest_url: Boolean(legacyConfig.ingest_url),
+      has_tenant_id: Boolean(legacyConfig.tenant_id)
+    },
+    legacy_auth: inspectLegacyAuth(paths.legacyAuthPath)
+  };
+}
+function applyLegacyAwareness(config, options) {
+  const legacy = loadLegacyCliConfig(options);
+  const migration = inspectProfileMigrationState(options);
+  const prod = config.profiles.prod;
+  if (prod && (legacy.api_key || legacy.ingest_url || legacy.tenant_id)) {
+    const migratedIngestUrl = legacy.ingest_url && !isLoopbackBaseUrl(legacy.ingest_url) ? legacy.ingest_url : prod.ingest_url;
+    config.profiles.prod = {
+      ...prod,
+      ingest_url: migratedIngestUrl,
+      tenant_id: legacy.tenant_id ?? prod.tenant_id,
+      api_key_ref: legacy.api_key ? "legacy:config.api_key" : prod.api_key_ref,
+      auth_token_ref: migration.legacy_auth.has_access_token ? "legacy:auth.access_token" : prod.auth_token_ref,
+      metadata: {
+        ...prod.metadata,
+        source: "migration",
+        legacy_config_path: migration.legacy_config.path,
+        legacy_auth_path: migration.legacy_auth.path
+      }
+    };
+  }
+  return {
+    ...config,
+    migrations: migration
+  };
+}
+function normalizeProfileConfig(raw, options = {}) {
+  const profiles = createDefaultProfiles(options);
+  let activeProfile = DEFAULT_PROFILE_NAME;
+  if (isRecord(raw)) {
+    if (isRecord(raw.profiles)) {
+      for (const [name, profile] of Object.entries(raw.profiles)) {
+        const normalized = normalizeProfile(name, profile, options);
+        if (normalized)
+          profiles[normalized.name] = normalized;
+      }
+    }
+    const configuredActive = optionalString(raw.active_profile);
+    if (configuredActive && profiles[configuredActive]) {
+      activeProfile = configuredActive;
+    }
+  }
+  return applyLegacyAwareness({
+    version: PROFILE_CONFIG_VERSION,
+    active_profile: activeProfile,
+    profiles,
+    migrations: inspectProfileMigrationState(options)
+  }, options);
+}
+function loadProfileConfig(options = {}) {
+  const path = getModaPaths(options).profileConfigPath;
+  const parsed = safeReadRecord(path);
+  return normalizeProfileConfig(parsed, options);
+}
+function saveProfileConfig(config, options = {}) {
+  const active = config.active_profile || DEFAULT_PROFILE_NAME;
+  if (!config.profiles[active]) {
+    throw new Error(`Cannot activate missing profile '${active}'.`);
+  }
+  const path = getModaPaths(options).profileConfigPath;
+  writeSecretJsonFile(path, {
+    version: PROFILE_CONFIG_VERSION,
+    active_profile: active,
+    profiles: config.profiles,
+    migrations: inspectProfileMigrationState(options)
+  });
+}
+function getActiveProfile(options = {}) {
+  const config = loadProfileConfig(options);
+  const envProfile = optionalString(getEnv(options).MODA_PROFILE);
+  const requested = options.profile || envProfile || config.active_profile;
+  const profile = config.profiles[requested];
+  if (!profile) {
+    throw new Error(`Moda profile '${requested}' does not exist.`);
+  }
+  return profile;
+}
+function setActiveProfile(name, options = {}) {
+  assertValidProfileName(name);
+  const config = loadProfileConfig(options);
+  if (!config.profiles[name]) {
+    throw new Error(`Moda profile '${name}' does not exist.`);
+  }
+  const next = { ...config, active_profile: name };
+  saveProfileConfig(next, options);
+  return next;
+}
+function upsertProfile(profile, options = {}) {
+  assertValidProfileName(profile.name);
+  const config = loadProfileConfig(options);
+  const next = {
+    ...config,
+    profiles: {
+      ...config.profiles,
+      [profile.name]: {
+        ...profile,
+        metadata: {
+          ...profile.metadata,
+          updated_at: (options.now ?? new Date).toISOString()
+        }
+      }
+    }
+  };
+  saveProfileConfig(next, options);
+  return next;
+}
+function syncLegacyConfigToProfile(legacy, options = {}) {
+  const active = getActiveProfile(options);
+  return upsertProfile({
+    ...active,
+    ingest_url: legacy.ingest_url ?? active.ingest_url,
+    tenant_id: legacy.tenant_id ?? active.tenant_id,
+    api_key_ref: legacy.api_key ? "legacy:config.api_key" : active.api_key_ref,
+    metadata: {
+      ...active.metadata,
+      source: "migration",
+      legacy_config_path: getModaPaths(options).legacyConfigPath
+    }
+  }, options);
+}
+function clearStoredApiKeyCredentials(options = {}) {
+  let cleared = false;
+  const paths = getModaPaths(options);
+  const legacy = loadLegacyCliConfig(options);
+  if (legacy.api_key || legacy.tenant_id) {
+    writeSecretJsonFile(paths.legacyConfigPath, legacy.ingest_url ? { ingest_url: legacy.ingest_url } : {});
+    cleared = true;
+  }
+  const config = loadProfileConfig(options);
+  const profileName = options.profile || optionalString(getEnv(options).MODA_PROFILE) || config.active_profile;
+  const profile = config.profiles[profileName];
+  if (profile && (profile.api_key_ref || profile.tenant_id)) {
+    if (profile.api_key_ref?.startsWith("file:")) {
+      const secretPath = resolveFileSecretPath(profile.api_key_ref, options);
+      if (secretPath)
+        rmSync(secretPath, { force: true });
+    }
+    const { api_key_ref: _key, tenant_id: _tenant, ...rest } = profile;
+    saveProfileConfig({ ...config, profiles: { ...config.profiles, [profileName]: rest } }, options);
+    cleared = true;
+  }
+  return cleared;
+}
+function resolveFileSecretPath(reference, options) {
+  if (!reference.startsWith("file:"))
+    return;
+  const rawPath = reference.slice("file:".length);
+  if (!rawPath)
+    return;
+  const paths = getModaPaths(options);
+  const secretPath = isAbsolute(rawPath) ? normalize(rawPath) : normalize(join(paths.dir, rawPath));
+  const rel = relative(paths.dir, secretPath);
+  if (rel.startsWith("..") || isAbsolute(rel)) {
+    throw new Error(`Secret reference escapes the Moda directory: ${reference}`);
+  }
+  return secretPath;
+}
+function secretFilePathFromRef(reference, options = {}) {
+  return resolveFileSecretPath(reference, options);
+}
+function resolveSecretReference(reference, options = {}) {
+  if (!reference)
+    return;
+  const env = getEnv(options);
+  if (reference.startsWith("env:")) {
+    return env[reference.slice("env:".length)] || undefined;
+  }
+  if (reference === "legacy:config.api_key") {
+    return loadLegacyCliConfig(options).api_key;
+  }
+  if (reference === "legacy:auth.access_token") {
+    const parsed2 = safeReadRecord(getModaPaths(options).legacyAuthPath);
+    return optionalString(parsed2?.access_token);
+  }
+  const filePath = resolveFileSecretPath(reference, options);
+  if (!filePath)
+    return;
+  const parsed = safeReadRecord(filePath);
+  if (parsed) {
+    return optionalString(parsed.value) ?? optionalString(parsed.api_key) ?? optionalString(parsed.access_token);
+  }
+  try {
+    const raw = readFileSync(filePath, "utf8").trim();
+    return raw || undefined;
+  } catch {
+    return;
+  }
+}
+function resolveApiKeyFromActiveProfile(options = {}) {
+  try {
+    return resolveSecretReference(getActiveProfile(options).api_key_ref, options);
+  } catch {
+    return;
+  }
+}
+function normalizeModaBaseUrl(url) {
+  try {
+    const parsed = new URL(url);
+    if (parsed.hostname === "www.moda.dev") {
+      parsed.hostname = "moda.dev";
+      return parsed.toString().replace(/\/$/, "");
+    }
+  } catch {}
+  return url.replace(/\/$/, "");
+}
+function resolveBaseUrl(options = {}) {
+  const environment = activeProfileEnvironment(options);
+  const envBase = optionalString(getEnv(options).MODA_BASE_URL);
+  if (envBase) {
+    return enforceNonLoopbackBaseUrl(normalizeModaBaseUrl(envBase), environment);
+  }
+  try {
+    return enforceNonLoopbackBaseUrl(normalizeModaBaseUrl(getActiveProfile(options).base_url || PROD_BASE_URL), environment);
+  } catch {
+    return PROD_BASE_URL;
+  }
+}
+function resolveIngestUrl(options = {}) {
+  const environment = activeProfileEnvironment(options);
+  const envIngest = optionalString(getEnv(options).MODA_INGEST_URL);
+  if (envIngest) {
+    return enforceNonLoopbackIngestUrl(envIngest, environment);
+  }
+  try {
+    const profileIngest = getActiveProfile(options).ingest_url;
+    if (profileIngest) {
+      return enforceNonLoopbackIngestUrl(profileIngest, environment);
+    }
+  } catch {}
+  const legacyIngest = optionalString(loadLegacyCliConfig(options).ingest_url);
+  if (legacyIngest) {
+    return enforceNonLoopbackIngestUrl(legacyIngest, environment);
+  }
+  return defaultIngestUrlForEnvironment(environment);
+}
+function resolveTenantIdFromActiveProfile(options = {}) {
+  try {
+    return getActiveProfile(options).tenant_id;
+  } catch {
+    return;
+  }
+}
+function modeString(mode) {
+  return `0${(mode & 511).toString(8).padStart(3, "0")}`;
+}
+function ensureSecretFilePermissions(path, repair = true) {
+  if (!existsSync(path)) {
+    return { path, exists: false, secure: false, repaired: false };
+  }
+  const before = statSync(path);
+  if (!before.isFile()) {
+    return {
+      path,
+      exists: true,
+      secure: false,
+      repaired: false,
+      mode: modeString(before.mode),
+      reason: "not_file"
+    };
+  }
+  if ((before.mode & 63) !== 0 && repair) {
+    try {
+      chmodSync(path, 384);
+      const after = statSync(path);
+      return {
+        path,
+        exists: true,
+        secure: (after.mode & 63) === 0,
+        repaired: true,
+        mode: modeString(after.mode)
+      };
+    } catch {
+      return {
+        path,
+        exists: true,
+        secure: false,
+        repaired: false,
+        mode: modeString(before.mode),
+        reason: "chmod_failed"
+      };
+    }
+  }
+  return {
+    path,
+    exists: true,
+    secure: (before.mode & 63) === 0,
+    repaired: false,
+    mode: modeString(before.mode)
+  };
+}
+function writeSecretJsonFile(path, value) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(value, null, 2)}
+`, { mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {}
+}
+
+// src/config.ts
+var pkg = JSON.parse(readFileSync2(new URL("../package.json", import.meta.url), "utf8"));
+var VERSION = pkg.version;
+var MODA_BASE_URL = resolveBaseUrl();
+function loadCliConfig(options = {}) {
+  return loadLegacyCliConfig(options);
+}
+function saveCliConfig(update, options = {}) {
+  const merged = writeLegacyCliConfig(update, options);
+  try {
+    syncLegacyConfigToProfile(merged, options);
+  } catch {}
+}
+function resolveApiKey(options = {}) {
+  const env = options.env ?? process.env;
+  return env.MODA_API_KEY || resolveApiKeyFromActiveProfile(options) || loadCliConfig(options).api_key || undefined;
+}
+var SIGNED_API_KEY_PREFIX = "moda_sk_";
+var SIGNED_API_KEY_VERSION = "v1";
+function embeddedTenantIdFromApiKey(key) {
+  if (!key.startsWith(SIGNED_API_KEY_PREFIX))
+    return;
+  try {
+    const decoded = Buffer.from(key.slice(SIGNED_API_KEY_PREFIX.length), "base64url").toString("utf8");
+    const parts = decoded.split(":");
+    if (parts.length !== 5 || parts[0] !== SIGNED_API_KEY_VERSION)
+      return;
+    return parts[2] || undefined;
+  } catch {
+    return;
+  }
+}
+function resolveIngestUrl2(options = {}) {
+  return resolveIngestUrl(options);
+}
+function resolveTenantId(options = {}) {
+  const env = options.env ?? process.env;
+  return env.MODA_TENANT_ID || resolveTenantIdFromActiveProfile(options) || loadCliConfig(options).tenant_id || undefined;
+}
+var MODA_API_KEY = process.env.MODA_API_KEY;
+var MODA_INGEST_URL = process.env.MODA_INGEST_URL || DEFAULT_INGEST_URL;
+function resolveModaBaseUrl(options = {}) {
+  return resolveBaseUrl(options) || PROD_BASE_URL;
+}
+function validateConfig() {
+  if (!resolveApiKey()) {
+    throw new CliAuthError('No Moda API key found. Set MODA_API_KEY or run "moda init".', {
+      reason: "no_stored_credentials",
+      login_command: ["moda", "init"]
+    }, "Get your API key from https://moda.dev/settings");
+  }
+}
+
+// src/output.ts
+import { randomUUID } from "node:crypto";
+
+// ../../packages/harness-snapshot/src/policy.ts
+var MAX_SCANNED_FILE_BYTES = 512 * 1024;
+var DEFAULT_MAX_INVENTORY_FILES = 12000;
+var DEFAULT_MAX_INVENTORY_TEXT_BYTES = 48 * 1024 * 1024;
+var MAX_SNAPSHOT_BODY_BYTES = 4500000;
+var MAX_RECORDED_SKIPS = 1000;
+var SKIPPED_DIRS = new Set([
+  ".angular",
+  ".cache",
+  ".expo",
+  ".git",
+  ".hg",
+  ".idea",
+  ".svn",
+  ".next",
+  ".nuxt",
+  ".output",
+  ".parcel-cache",
+  ".pytest_cache",
+  ".ruff_cache",
+  ".serverless",
+  ".sst",
+  ".turbo",
+  ".wrangler",
+  ".wrangler-shared",
+  ".moda",
+  ".moda-test",
+  ".moda-test-home",
+  ".moda-cli-workspaces",
+  ".moda-cli-benchmarks",
+  "node_modules",
+  "dist",
+  "build",
+  "coverage",
+  "out",
+  "target",
+  "logs",
+  "tmp",
+  "temp",
+  "__pycache__",
+  ".venv",
+  "venv"
+]);
+var SKIPPED_PATH_PREFIXES = [
+  ".claude/worktrees",
+  ".codex/environments"
+];
+function posixNormalize(path) {
+  const absolute = path.startsWith("/");
+  const parts = path.split("/").filter((part) => part !== "" && part !== ".");
+  const normalized = parts.join("/");
+  return absolute ? `/${normalized}` : normalized;
+}
+function basename(path) {
+  const normalized = posixNormalize(path);
+  const index = normalized.lastIndexOf("/");
+  return index === -1 ? normalized : normalized.slice(index + 1);
+}
+function extname(path) {
+  const name = basename(path);
+  const index = name.lastIndexOf(".");
+  return index <= 0 ? "" : name.slice(index);
+}
+function isSkippedDir(path) {
+  return SKIPPED_DIRS.has(basename(path));
+}
+function isSkippedPathPrefix(path) {
+  const normalized = posixNormalize(path);
+  return SKIPPED_PATH_PREFIXES.some((prefix) => normalized === prefix || normalized.startsWith(`${prefix}/`));
+}
+function isSourceFile(path) {
+  return /\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(path);
+}
+function isPackageOrLockfile(path) {
+  return path === "package.json" || path === "pyproject.toml" || path === "bun.lock" || path === "bun.lockb" || path === "pnpm-lock.yaml" || path === "yarn.lock";
+}
+function isPromptLikePath(path) {
+  return /(^|\/)prompts?\//i.test(path) && /\.(prompt\.)?(md|json|ya?ml)$/i.test(path);
+}
+function isSkillLikePath(path) {
+  return /(^|\/)(\.claude\/skills|\.cursor\/rules|skills?)\//i.test(path) && /\.(md|mdc)$/i.test(path);
+}
+function isEvalLikePath(path) {
+  return /(^|\/)(evals?|tests?|__tests__)\//i.test(path) && /\.(ts|tsx|js|mjs|py|json|ya?ml)$/i.test(path);
+}
+function isDeploymentLikePath(path) {
+  return /(^|\/)(wrangler\.toml|vercel\.json|render\.ya?ml|railway\.json|Dockerfile|docker-compose\.ya?ml)$/i.test(path) || /^\.github\/workflows\/[^/]+\.ya?ml$/i.test(path);
+}
+function isDeveloperAgentConfigPath(path) {
+  return path === ".claude/settings.json" || path === ".codex/hooks.json" || path === ".cursor/hooks.json";
+}
+function isReadmeOrAgents(path) {
+  const name = basename(path);
+  return name === "README.md" || name === "AGENTS.md";
+}
+function shouldInventoryFile(path) {
+  const normalized = posixNormalize(path);
+  const name = basename(normalized);
+  const extension = extname(normalized).toLowerCase();
+  if (isSourceFile(normalized))
+    return true;
+  if (isPackageOrLockfile(normalized))
+    return true;
+  if (isPromptLikePath(normalized))
+    return true;
+  if (isSkillLikePath(normalized))
+    return true;
+  if (isEvalLikePath(normalized))
+    return true;
+  if (isDeploymentLikePath(normalized))
+    return true;
+  if (isDeveloperAgentConfigPath(normalized))
+    return true;
+  if (isReadmeOrAgents(normalized))
+    return true;
+  return extension === ".toml" && (name === "pyproject.toml" || name === "wrangler.toml");
+}
+function isTextFile(path) {
+  const extension = extname(path).toLowerCase();
+  return [
+    "",
+    ".cjs",
+    ".js",
+    ".json",
+    ".jsx",
+    ".md",
+    ".mdc",
+    ".mjs",
+    ".py",
+    ".toml",
+    ".ts",
+    ".tsx",
+    ".txt",
+    ".yaml",
+    ".yml"
+  ].includes(extension);
+}
+function isSecretishPath(path) {
+  const name = basename(path).toLowerCase();
+  return name === ".env" || name.startsWith(".env.") || name.includes("secret") || name.includes("private-key") || name.endsWith(".pem");
+}
+
+// ../../packages/harness-snapshot/src/redact.ts
+var REDACTED = "[REDACTED]";
+var MAX_DEPTH = 256;
+var SECRET_KEYS = new Set([
+  "api_key",
+  "apikey",
+  "token",
+  "access_token",
+  "authorization",
+  "secret",
+  "password",
+  "cli_token"
+]);
+var SECRET_PATTERNS = [
+  { pattern: /\bmoda_sk_[A-Za-z0-9_-]+\b/g, prefixLength: 8 },
+  { pattern: /\bmoda_ct_[A-Za-z0-9_-]+\b/g, prefixLength: 8 },
+  { pattern: /\bBearer\s+([A-Za-z0-9._~+/-]+=*)\b/gi, prefixLength: 8 },
+  { pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, prefixLength: 8 },
+  { pattern: /\bsk-ant-api\d{2}-[A-Za-z0-9_-]{20,}\b/g, prefixLength: 12 },
+  { pattern: /\bsk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{20,}\b/g, prefixLength: 8 },
+  { pattern: /\bAKIA[A-Z0-9]{16}\b/g, prefixLength: 8 },
+  { pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g, prefixLength: 8 },
+  { pattern: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g, prefixLength: 8 },
+  { pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, prefixLength: 8 }
+];
+function redactDeep(value) {
+  return redactValue(value, 0, new WeakSet);
+}
+function redactValue(value, depth, seen) {
+  if (typeof value === "string")
+    return redactString(value);
+  if (value === null || typeof value !== "object")
+    return value;
+  if (depth >= MAX_DEPTH)
+    return "[MaxDepth]";
+  if (seen.has(value))
+    return "[Circular]";
+  seen.add(value);
+  if (Array.isArray(value)) {
+    try {
+      return value.map((item) => redactValue(item, depth + 1, seen));
+    } finally {
+      seen.delete(value);
+    }
+  }
+  const out = {};
+  try {
+    for (const [key, item] of Object.entries(value)) {
+      out[key] = shouldRedactKey(key) ? redactSecretValue(item) : redactValue(item, depth + 1, seen);
+    }
+  } finally {
+    seen.delete(value);
+  }
+  return out;
+}
+function shouldRedactKey(key) {
+  return SECRET_KEYS.has(key.replace(/[-\s]/g, "_").toLowerCase());
+}
+function redactSecretValue(value) {
+  if (typeof value !== "string")
+    return REDACTED;
+  const redacted = redactString(value);
+  if (redacted !== value)
+    return redacted;
+  if (/^(configured|missing|not_configured|none|present|absent)$/i.test(value))
+    return value;
+  return REDACTED;
+}
+function redactStringWithCount(input) {
+  let text = input;
+  let redactionCount = 0;
+  for (const { pattern, prefixLength } of SECRET_PATTERNS) {
+    text = text.replace(pattern, (match) => {
+      redactionCount += 1;
+      if (/^Bearer\s+/i.test(match)) {
+        const token = match.replace(/^Bearer\s+/i, "");
+        return `Bearer ${token.slice(0, prefixLength)}...[REDACTED]`;
+      }
+      return `${match.slice(0, prefixLength)}...[REDACTED]`;
+    });
+  }
+  return { text, redactionCount };
+}
+function redactString(input) {
+  return redactStringWithCount(input).text;
+}
+function redactSnapshotText(text) {
+  const parts = text.split(/(\r\n|\r|\n)/);
+  let redactionCount = 0;
+  for (let index = 0;index < parts.length; index += 2) {
+    const redacted = redactStringWithCount(parts[index] ?? "");
+    parts[index] = redacted.text;
+    redactionCount += redacted.redactionCount;
+  }
+  return { text: parts.join(""), redactionCount };
+}
+
+// ../../packages/harness-snapshot/src/pack.ts
+function utf8ByteLength(value) {
+  let bytes = 0;
+  for (let index = 0;index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code <= 127) {
+      bytes += 1;
+    } else if (code <= 2047) {
+      bytes += 2;
+    } else if (code >= 55296 && code <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (next >= 56320 && next <= 57343) {
+        bytes += 4;
+        index += 1;
+      } else {
+        bytes += 3;
+      }
+    } else {
+      bytes += 3;
+    }
+  }
+  return bytes;
+}
+function isValidRelativePath(path) {
+  if (path.length === 0 || path.startsWith("/") || path.includes("\\"))
+    return false;
+  return !path.split("/").some((part) => part === "..");
+}
+function packSnapshot(inputs, opts) {
+  const maxFiles = opts.maxFiles ?? DEFAULT_MAX_INVENTORY_FILES;
+  const maxTextBytes = opts.maxTextBytes ?? DEFAULT_MAX_INVENTORY_TEXT_BYTES;
+  const maxSnapshotBytes = opts.maxSnapshotBytes ?? MAX_SNAPSHOT_BODY_BYTES;
+  const files = [];
+  const skips = [];
+  let inventoryTextBytes = 0;
+  let serializedBytes = 0;
+  let byteCount = 0;
+  let truncated = false;
+  const recordSkip = (path, reason) => {
+    if (skips.length < MAX_RECORDED_SKIPS)
+      skips.push({ path, reason });
+  };
+  const sorted = [...inputs].sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0);
+  for (const input of sorted) {
+    if (!isValidRelativePath(input.path)) {
+      recordSkip(input.path, "invalid relative path");
+      continue;
+    }
+    const path = posixNormalize(input.path);
+    if (input.isSymlink) {
+      recordSkip(path, "symlink skipped for safety");
+      continue;
+    }
+    if (isSecretishPath(path)) {
+      recordSkip(path, "secret-bearing path");
+      continue;
+    }
+    if (!shouldInventoryFile(path)) {
+      recordSkip(path, "not an inventory file");
+      continue;
+    }
+    if (!isTextFile(path)) {
+      recordSkip(path, "non-text file");
+      continue;
+    }
+    if (input.byteSize > MAX_SCANNED_FILE_BYTES) {
+      recordSkip(path, "file too large");
+      truncated = true;
+      continue;
+    }
+    if (files.length >= maxFiles || inventoryTextBytes + input.byteSize > maxTextBytes) {
+      recordSkip(path, "inventory budget");
+      truncated = true;
+      continue;
+    }
+    const text = opts.redact === false ? input.text : redactSnapshotText(input.text).text;
+    const file = { path, text };
+    const serializedCost = utf8ByteLength(JSON.stringify(file)) + 1;
+    if (serializedBytes + serializedCost > maxSnapshotBytes) {
+      recordSkip(path, "snapshot budget");
+      truncated = true;
+      break;
+    }
+    files.push(file);
+    inventoryTextBytes += input.byteSize;
+    serializedBytes += serializedCost;
+    byteCount += utf8ByteLength(text);
+  }
+  return {
+    snapshot: {
+      repo: { name: opts.repoName, root: "." },
+      files,
+      truncated,
+      fileCount: files.length,
+      byteCount,
+      ...opts.gitCommit ? { gitCommit: opts.gitCommit } : {}
+    },
+    skips
+  };
+}
+// src/output.ts
+var AGENT_SCHEMA_VERSION = "moda.agent.v1";
+var AGENT_EVENT_SCHEMA_VERSION = "moda.agent_event.v1";
+var FEEDBACK_TIP = 'Help us improve! If a result in this response looks wrong or is missing data, flag it: moda feedback "<describe what looked wrong>" [--category=...] [--conversation-id=... | --cluster-id=... | --tool-name=...]. Only submit genuine observations.';
+var EXIT_OK = 0;
+var EXIT_ERROR = 1;
+var EXIT_DEGRADED = 3;
+var EXIT_AUTH_REQUIRED = 4;
+var EXIT_INPUT_REQUIRED = 5;
+var EXIT_CANCELLED = 130;
+var AGENT_ERROR_CODES = [
+  "input_error",
+  "api_error",
+  "network_error",
+  "auth_required",
+  "input_required",
+  "cancelled",
+  "command_error",
+  "access_denied",
+  "unknown_error",
+  "cloud_unavailable"
+];
+var FALLBACK_RUN_ID = randomUUID();
+var fallbackSeq = 0;
+var stdoutClosed = false;
+var stderrClosed = false;
+process.stdout.on("error", (error) => {
+  if (error.code === "EPIPE") {
+    stdoutClosed = true;
+    process.exitCode = EXIT_CANCELLED;
+    return;
+  }
+  throw error;
+});
+process.stderr.on("error", (error) => {
+  if (error.code === "EPIPE") {
+    stderrClosed = true;
+    process.exitCode = EXIT_CANCELLED;
+    return;
+  }
+  throw error;
+});
+function wasOutputCancelled() {
+  return stdoutClosed || stderrClosed;
+}
+function safeWriteStdout(text) {
+  if (stdoutClosed)
+    return false;
+  try {
+    if (false) {} else {
+      process.stdout.write(text);
+    }
+    return true;
+  } catch (error) {
+    if (error.code === "EPIPE") {
+      stdoutClosed = true;
+      process.exitCode = EXIT_CANCELLED;
+      return false;
+    }
+    throw error;
+  }
+}
+function safeWriteStderr(text) {
+  if (stderrClosed)
+    return false;
+  try {
+    if (false) {} else {
+      process.stderr.write(text);
+    }
+    return true;
+  } catch (error) {
+    if (error.code === "EPIPE") {
+      stderrClosed = true;
+      process.exitCode = EXIT_CANCELLED;
+      return false;
+    }
+    throw error;
+  }
+}
+function explicitModeFromFlags(flags) {
+  if (flags.agent === "true" && (flags.stream === "true" || flags.format === "ndjson"))
+    return "agent-stream";
+  if (flags.agent === "true")
+    return "agent";
+  if (flags.json === "true")
+    return "json";
+  if (flags.human === "true" || flags.prose === "true")
+    return "human";
+  return;
+}
+function outputModeFromFlags(flags) {
+  return explicitModeFromFlags(flags) ?? "human";
+}
+function outputModeFromEnv(env) {
+  const fmt = (env.MODA_FORMAT ?? "").trim().toLowerCase();
+  if (fmt === "human" || fmt === "json" || fmt === "agent")
+    return fmt;
+  if (fmt === "agent-stream" || fmt === "ndjson")
+    return "agent-stream";
+  return;
+}
+function truthyEnv(value) {
+  return value != null && value !== "" && value !== "0" && value.toLowerCase() !== "false";
+}
+function isAgentEnvironment(env) {
+  return truthyEnv(env.CLAUDECODE) || truthyEnv(env.CURSOR) || truthyEnv(env.CI) || truthyEnv(env.MODA_AGENT);
+}
+function resolveOutputMode(flags, opts = {}) {
+  const explicit = explicitModeFromFlags(flags);
+  if (explicit)
+    return explicit;
+  const env = opts.env ?? process.env;
+  const fromEnv = outputModeFromEnv(env);
+  if (fromEnv)
+    return fromEnv;
+  if (isAgentEnvironment(env))
+    return "agent";
+  const isTTY = opts.isTTY ?? Boolean(process.stdout.isTTY);
+  if (!isTTY)
+    return "agent";
+  return "human";
+}
+function createCliOutput(options) {
+  const state = {
+    runId: options.runId ?? randomUUID(),
+    seq: 0,
+    started: false,
+    terminal: false,
+    startedAt: Date.now(),
+    lastEventAt: Date.now()
+  };
+  const emitEvent = (event) => {
+    if (options.quiet || options.mode !== "agent-stream")
+      return;
+    if (state.terminal)
+      return;
+    if (event.event === "started" && state.started)
+      return;
+    if (event.event === "started")
+      state.started = true;
+    if (isTerminalEvent(event.event)) {
+      state.terminal = true;
+      clearHeartbeat(state);
+    }
+    state.lastEventAt = Date.now();
+    safeWriteStdout(`${JSON.stringify(createAgentEvent(options.command, event, state))}
+`);
+  };
+  const ensureStarted = () => {
+    if (options.mode !== "agent-stream" || state.started || options.quiet)
+      return;
+    startHeartbeat(options.command, state);
+    emitEvent({
+      event: "started",
+      phase: options.command,
+      message: `Starting ${options.command}.`,
+      elapsed_ms: 0
+    });
+  };
+  const writeEnvelope = (data, writeOptions = {}) => {
+    return createAgentEnvelope({
+      command: options.command,
+      status: writeOptions.status === "error" ? "error" : writeOptions.status === "degraded" ? "degraded" : "ok",
+      data,
+      meta: {
+        ...writeOptions.meta ?? {},
+        run_id: state.runId,
+        ...options.command === "feedback" ? {} : { tip: FEEDBACK_TIP }
+      },
+      summary: writeOptions.summary,
+      findings: writeOptions.findings,
+      evidenceRefs: writeOptions.evidenceRefs,
+      recommendedActions: writeOptions.recommendedActions,
+      nextCommands: writeOptions.nextCommands,
+      artifacts: writeOptions.artifacts,
+      warnings: writeOptions.warnings,
+      errors: writeOptions.errors
+    });
+  };
+  const output = {
+    mode: options.mode,
+    quiet: options.quiet === true,
+    writeData(data, writeOptions = {}) {
+      if (options.quiet)
+        return;
+      if (options.mode === "agent" || options.mode === "agent-stream") {
+        if (state.terminal)
+          return;
+        const envelope = writeEnvelope(data, writeOptions);
+        if (options.mode === "agent-stream") {
+          ensureStarted();
+          emitEvent({
+            event: envelope.status === "error" ? "error" : "completed",
+            status: envelope.status,
+            result: envelope,
+            ...envelope.errors[0] ? { error: envelope.errors[0] } : {}
+          });
+        } else {
+          state.terminal = true;
+          safeWriteStdout(`${JSON.stringify(envelope)}
+`);
+        }
+        return;
+      }
+      safeWriteStdout(`${JSON.stringify(redactDeep(data), null, 2)}
+`);
+    },
+    writeEvent(event) {
+      if (options.quiet)
+        return;
+      if (options.mode !== "agent-stream")
+        return;
+      if (event.event === "started") {
+        startHeartbeat(options.command, state);
+        emitEvent(event);
+        return;
+      }
+      ensureStarted();
+      emitEvent(event);
+    },
+    writeError(error) {
+      if (options.quiet || state.terminal)
+        return;
+      const agentError = errorToAgentError(error);
+      const envelope = createAgentErrorEnvelope(options.command || "unknown", agentError, state.runId);
+      if (options.mode === "agent-stream") {
+        ensureStarted();
+        if (error instanceof CliInputRequiredError) {
+          emitEvent({
+            event: "needs_input",
+            status: "error",
+            message: error.message,
+            error: agentError,
+            input_request: error.input_request,
+            result: envelope
+          });
+          return;
+        }
+        if (error instanceof CliAuthError) {
+          emitEvent({
+            event: "auth_required",
+            status: "error",
+            message: error.message,
+            error: agentError,
+            auth: error.auth,
+            result: envelope
+          });
+          return;
+        }
+        if (error instanceof CliCancellationError) {
+          emitEvent({
+            event: "cancelled",
+            status: "error",
+            message: error.message,
+            error: agentError,
+            result: envelope
+          });
+          return;
+        }
+        emitEvent({
+          event: "error",
+          status: "error",
+          message: agentError.message,
+          error: agentError,
+          result: envelope
+        });
+        return;
+      }
+      if (options.mode === "agent" || options.mode === "json") {
+        state.terminal = true;
+        safeWriteStdout(`${JSON.stringify(envelope)}
+`);
+      }
+    },
+    writeCancelled(reason = "Command cancelled.") {
+      output.writeError(new CliCancellationError(reason));
+    },
+    hasTerminalOutput() {
+      return state.terminal;
+    },
+    close() {
+      clearHeartbeat(state);
+    }
+  };
+  return output;
+}
+function createAgentEnvelope(options) {
+  const safeData = redactDeep(options.data);
+  const bounded = boundForAgent(safeData);
+  const envelope = {
+    schema_version: AGENT_SCHEMA_VERSION,
+    command: options.command,
+    status: options.status,
+    generated_at: new Date().toISOString(),
+    ...options.profile ? { profile: options.profile } : {},
+    summary: normalizeSummary(options.summary, options.command, options.status, safeData),
+    findings: options.findings ?? [],
+    evidence_refs: options.evidenceRefs ?? [],
+    recommended_actions: options.recommendedActions ?? [],
+    next_commands: normalizeNextCommands(options.nextCommands ?? []),
+    artifacts: options.artifacts ?? [],
+    warnings: options.warnings ?? inferWarnings(safeData),
+    errors: options.errors ?? [],
+    data: bounded.data,
+    ...options.meta ? { meta: options.meta } : {},
+    ...bounded.truncation ? { truncation: bounded.truncation } : {}
+  };
+  return redactDeep(envelope);
+}
+function createAgentErrorEnvelope(command, error, runId) {
+  return createAgentEnvelope({
+    command,
+    status: "error",
+    data: null,
+    meta: runId ? { run_id: runId } : undefined,
+    summary: {
+      text: error.message,
+      confidence: "high"
+    },
+    errors: [error],
+    nextCommands: (error.suggested_commands ?? []).map((commandText) => ({
+      command: commandText,
+      purpose: "Suggested recovery command.",
+      mutability: commandText.includes(" sync") || commandText.startsWith("moda sync") ? "sync" : "read",
+      requires_approval: commandText.includes(" --yes") || commandText.includes(" sync")
+    }))
+  });
+}
+function createAgentEvent(command, event, state) {
+  const stamped = {
+    schema_version: AGENT_EVENT_SCHEMA_VERSION,
+    command,
+    generated_at: new Date().toISOString(),
+    run_id: state?.runId ?? FALLBACK_RUN_ID,
+    seq: state ? ++state.seq : ++fallbackSeq,
+    event_version: event.event_version ?? 1,
+    ...event
+  };
+  return redactDeep(stamped);
+}
+function errorToAgentError(error) {
+  if (error instanceof CliInputRequiredError) {
+    return {
+      code: "input_required",
+      message: error.message,
+      cause: error.usage,
+      suggested_commands: error.input_request.resume_command ? [error.input_request.resume_command.join(" ")] : undefined,
+      input_request: error.input_request,
+      blocking: true
+    };
+  }
+  if (error instanceof CliAuthError) {
+    const suggested = [error.auth.login_command.join(" ")];
+    if (error.auth.resume_command)
+      suggested.push(error.auth.resume_command.join(" "));
+    return {
+      code: "auth_required",
+      message: error.message,
+      cause: error.usage,
+      suggested_commands: suggested,
+      auth: error.auth,
+      blocking: true
+    };
+  }
+  if (error instanceof CliCancellationError) {
+    return {
+      code: "cancelled",
+      message: error.message,
+      blocking: true
+    };
+  }
+  if (error instanceof CliAccessError) {
+    return {
+      code: "access_denied",
+      message: error.message,
+      cause: error.guidance,
+      blocking: true
+    };
+  }
+  if (error instanceof Error) {
+    if (error instanceof CliInputError || error.name === "ZodError") {
+      return {
+        code: "input_error",
+        message: error.message,
+        cause: "usage" in error && typeof error.usage === "string" ? error.usage : undefined,
+        suggested_commands: "usage" in error && typeof error.usage === "string" ? extractSuggestedCommands(error.usage) : undefined,
+        blocking: true
+      };
+    }
+    if (isApiLikeError(error)) {
+      const statusCode = "statusCode" in error ? error.statusCode : undefined;
+      return {
+        code: "api_error",
+        message: error.message,
+        cause: typeof statusCode === "number" ? `HTTP ${statusCode}` : undefined,
+        blocking: true
+      };
+    }
+    if (isNetworkLikeError(error)) {
+      return {
+        code: "network_error",
+        message: error.message,
+        blocking: true
+      };
+    }
+    return {
+      code: "command_error",
+      message: error.message,
+      cause: "usage" in error && typeof error.usage === "string" ? error.usage : undefined,
+      suggested_commands: "usage" in error && typeof error.usage === "string" ? extractSuggestedCommands(error.usage) : undefined,
+      blocking: true
+    };
+  }
+  return {
+    code: "unknown_error",
+    message: String(error),
+    blocking: true
+  };
+}
+function isTerminalEvent(event) {
+  return event === "completed" || event === "error" || event === "cancelled" || event === "needs_input" || event === "auth_required";
+}
+function startHeartbeat(command, state) {
+  if (state.heartbeat)
+    return;
+  const intervalMs = Number(process.env.MODA_HEARTBEAT_MS ?? 1e4);
+  if (!Number.isFinite(intervalMs) || intervalMs <= 0)
+    return;
+  state.heartbeat = setInterval(() => {
+    if (state.terminal || stdoutClosed)
+      return;
+    const now = Date.now();
+    if (now - state.lastEventAt < intervalMs)
+      return;
+    state.lastEventAt = now;
+    safeWriteStdout(`${JSON.stringify(createAgentEvent(command, {
+      event: "heartbeat",
+      elapsed_ms: now - state.startedAt
+    }, state))}
+`);
+  }, intervalMs);
+  state.heartbeat.unref();
+}
+function clearHeartbeat(state) {
+  if (!state.heartbeat)
+    return;
+  clearInterval(state.heartbeat);
+  state.heartbeat = undefined;
+}
+function normalizeSummary(summary, command, status, data) {
+  if (typeof summary === "string") {
+    return { text: summary, confidence: "high" };
+  }
+  if (summary?.text) {
+    return {
+      text: summary.text,
+      confidence: summary.confidence ?? "high"
+    };
+  }
+  return inferSummary(command, status, data);
+}
+function inferSummary(command, status, data) {
+  const record = asRecord(data);
+  if (status === "error") {
+    return { text: `${command} failed.`, confidence: "high" };
+  }
+  const summary = asRecord(record?.summary);
+  if (summary) {
+    const statusValue = typeof summary.status === "string" ? summary.status : undefined;
+    const fail = typeof summary.fail === "number" ? summary.fail : undefined;
+    const warning = typeof summary.warning === "number" ? summary.warning : undefined;
+    if (statusValue && fail !== undefined && warning !== undefined) {
+      return {
+        text: `${command} completed with status ${statusValue}: ${fail} failing checks and ${warning} warnings.`,
+        confidence: "high"
+      };
+    }
+    const runtimeAgentCount = typeof summary.runtimeAgentCount === "number" ? summary.runtimeAgentCount : undefined;
+    if (runtimeAgentCount !== undefined) {
+      return {
+        text: `${command} completed. Harness summary includes ${runtimeAgentCount} runtime agent(s).`,
+        confidence: "high"
+      };
+    }
+  }
+  if (typeof record?.status === "string") {
+    return { text: `${command} completed with status ${record.status}.`, confidence: "high" };
+  }
+  return { text: `${command} completed.`, confidence: "medium" };
+}
+function normalizeNextCommands(commands) {
+  return commands.map((command) => {
+    if (typeof command !== "string")
+      return command;
+    return {
+      command,
+      purpose: "Suggested next Moda command.",
+      mutability: inferMutability(command),
+      requires_approval: command.includes(" --yes") || command.includes(" sync")
+    };
+  });
+}
+function inferMutability(command) {
+  if (/\b(sync|approve|init|install|pull|gen|remove|promote)\b/.test(command)) {
+    if (/\bsync\b/.test(command))
+      return "sync";
+    return "write";
+  }
+  return "read";
+}
+function inferWarnings(data) {
+  const record = asRecord(data);
+  const direct = record?.warnings;
+  if (Array.isArray(direct))
+    return direct.filter((item) => typeof item === "string");
+  const validation = asRecord(record?.validation);
+  if (Array.isArray(validation?.warnings)) {
+    return validation.warnings.filter((item) => typeof item === "string");
+  }
+  return [];
+}
+function boundForAgent(data) {
+  const maxBytes = Number(process.env.MODA_AGENT_MAX_OUTPUT_BYTES ?? 200000);
+  const serialized = JSON.stringify(data);
+  const bytes = Buffer.byteLength(serialized, "utf8");
+  if (bytes <= maxBytes)
+    return { data };
+  const preview = serialized.slice(0, Math.max(0, maxBytes - 256));
+  return {
+    data: {
+      truncated: true,
+      original_bytes: bytes,
+      max_bytes: maxBytes,
+      preview
+    },
+    truncation: {
+      data: {
+        original_bytes: bytes,
+        max_bytes: maxBytes,
+        reason: "agent_output_byte_limit"
+      }
+    }
+  };
+}
+function asRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function extractSuggestedCommands(text) {
+  const commands = [...text.matchAll(/`(moda [^`]+)`/g)].map((match) => match[1]);
+  return commands.length > 0 ? commands : undefined;
+}
+
+// src/command-context.ts
+function flagEnabled(flags, key) {
+  return flags[key] === "true";
+}
+function stringOption(value) {
+  if (value === undefined || value === null)
+    return;
+  const text = String(value).trim();
+  return text.length > 0 ? text : undefined;
+}
+function createCommandContext(input, options = {}) {
+  const flags = options.commandFlags ?? input.flags;
+  const rawFlags = options.rawFlags ?? input.flags;
+  const outputMode = options.outputMode ?? outputModeFromFlags(flags);
+  const quiet = flagEnabled(flags, "quiet");
+  const interactive = outputMode === "human" && !quiet && !flagEnabled(flags, "yes") && process.stdin.isTTY === true && process.stderr.isTTY === true;
+  const telemetryMeta = {};
+  return {
+    command: options.commandName ?? input.command,
+    positional: input.positional,
+    positionals: input.positionals,
+    flags,
+    rawFlags,
+    startedAt: options.startedAt ?? Date.now(),
+    cwd: options.cwd ?? process.cwd(),
+    env: options.env ?? process.env,
+    outputMode,
+    output: createCliOutput({
+      command: options.commandName ?? input.command,
+      mode: outputMode,
+      quiet
+    }),
+    profile: flags.profile,
+    dryRun: flagEnabled(flags, "dry-run"),
+    yes: flagEnabled(flags, "yes"),
+    quiet,
+    verbose: flagEnabled(flags, "verbose"),
+    interactive,
+    recordTelemetry(meta) {
+      Object.assign(telemetryMeta, meta);
+    },
+    getTelemetryMeta() {
+      return telemetryMeta;
+    }
+  };
+}
+
+export { __require, PROD_BASE_URL, DEFAULT_INGEST_URL, getModaPaths, getModaDir, isLoopbackBaseUrl, assertValidProfileName, loadProfileConfig, saveProfileConfig, getActiveProfile, setActiveProfile, upsertProfile, clearStoredApiKeyCredentials, secretFilePathFromRef, resolveSecretReference, resolveApiKeyFromActiveProfile, resolveTenantIdFromActiveProfile, ensureSecretFilePermissions, writeSecretJsonFile, CliInputError, CliAccessError, CliInputRequiredError, CliAuthError, CliCancellationError, isNetworkLikeError, isApiLikeError, VERSION, loadCliConfig, saveCliConfig, resolveApiKey, embeddedTenantIdFromApiKey, resolveIngestUrl2 as resolveIngestUrl, resolveTenantId, resolveModaBaseUrl, validateConfig, MAX_SCANNED_FILE_BYTES, DEFAULT_MAX_INVENTORY_FILES, DEFAULT_MAX_INVENTORY_TEXT_BYTES, MAX_RECORDED_SKIPS, SKIPPED_DIRS, isSkippedDir, isSkippedPathPrefix, isEvalLikePath, shouldInventoryFile, isTextFile, isSecretishPath, redactDeep, packSnapshot, EXIT_OK, EXIT_ERROR, EXIT_DEGRADED, EXIT_AUTH_REQUIRED, EXIT_INPUT_REQUIRED, EXIT_CANCELLED, AGENT_ERROR_CODES, wasOutputCancelled, safeWriteStdout, safeWriteStderr, resolveOutputMode, createCliOutput, stringOption, createCommandContext };