@moda-ai/cli 1.28.5 → 1.29.0

package/dist/{cli-g931ntph.js → cli-351a5yc4.js}

@@ -124,7 +124,7 @@ function resetApiRequestCount() {
 }
 
 // src/harness-remote.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
 import { join as join3 } from "node:path";
 
 // src/markdown-terminal.ts
@@ -542,7 +542,7 @@ function createHarnessReport(options) {
     unknowns: limitedUnknowns
   };
 }
-function validateHarnessReport(report, rootDir) {
+function validateHarnessReport(report, rootDir, options) {
   const checks = [];
   const errors = [];
   const warnings = [];
@@ -713,6 +713,7 @@ function validateHarnessReport(report, rootDir) {
       }
     }
   }
+  validateDeterministicFloor(report, options?.deterministicFloor, check, warn);
   return {
     schemaVersion: HARNESS_REPORT_VALIDATION_SCHEMA_VERSION,
     reportId: report?.reportId ?? "unknown",
@@ -724,6 +725,27 @@ function validateHarnessReport(report, rootDir) {
     warnings
   };
 }
+function validateDeterministicFloor(report, floor, check, warn) {
+  if (!floor)
+    return;
+  if (process.env.MODA_HARNESS_FLOOR_CHECK === "0")
+    return;
+  const graph = isRecord(report?.graph) ? report.graph : {};
+  const toolArtifactCount = Array.isArray(graph.artifacts) ? graph.artifacts.filter((artifact) => isRecord(artifact) && artifact.type === "tool").length : 0;
+  const providerCount = safeArrayLength(graph.modelProviders);
+  const runtimeAgentCount = safeArrayLength(graph.runtimeAgents);
+  if (typeof floor.toolCandidates === "number" && floor.toolCandidates >= 5) {
+    const minimumTools = Math.ceil(0.5 * floor.toolCandidates);
+    check("floor_tools", toolArtifactCount >= minimumTools, `Deterministic scan found ${floor.toolCandidates} high-confidence tool definition candidate(s); the report graph must include at least ${minimumTools} tool artifact(s) but has ${toolArtifactCount}.`);
+  }
+  const providerPackages = Array.isArray(floor.providerPackages) ? floor.providerPackages.filter((name) => typeof name === "string" && name.length > 0) : [];
+  if (providerPackages.length > 0) {
+    check("floor_providers", providerCount > 0, `Manifest dependencies include model-provider package(s) ${providerPackages.join(", ")}, but the report graph.modelProviders is empty.`);
+  }
+  if (typeof floor.llmCallSites === "number" && floor.llmCallSites > 0 && runtimeAgentCount === 0) {
+    warn("floor_agents", `Deterministic scan found ${floor.llmCallSites} LLM call site(s) but the report graph.runtimeAgents is empty; sync will be blocked by the zero-agent gate.`);
+  }
+}
 async function approveHarnessReport(options) {
   const report = readHarnessReport(options.reportPath);
   const validation = validateHarnessReport(report, options.rootDir);
@@ -760,9 +782,9 @@ async function approveHarnessReport(options) {
   writeJson(join(options.rootDir, HARNESS_REPORT_APPROVAL_PATH), approval);
   return { report, validation, approval };
 }
-function loadHarnessReportForSync(rootDir, reportPath) {
+function loadHarnessReportForSync(rootDir, reportPath, options) {
   const report = readHarnessReport(reportPath);
-  const validation = validateHarnessReport(report, rootDir);
+  const validation = validateHarnessReport(report, rootDir, options);
   if (validation.status !== "pass") {
     throw new CliInputError("Harness report validation failed; cannot sync.", validation.errors.slice(0, 5).join(`
 `));
@@ -1753,11 +1775,11 @@ import {
   existsSync as existsSync3,
   lstatSync as lstatSync3,
   mkdirSync as mkdirSync3,
-  readFileSync as readFileSync3,
+  readFileSync as readFileSync4,
   readdirSync,
   writeFileSync as writeFileSync3
 } from "node:fs";
-import { basename as basename4, delimiter, dirname as dirname4, join as join2, relative as relative3, resolve as resolve4, sep } from "node:path";
+import { basename as basename4, delimiter, dirname as dirname4, join as join2, relative as relative3, resolve as resolve5, sep } from "node:path";
 import { confirm as confirm2, select } from "@inquirer/prompts";
 
 // src/analyst-tui.ts
@@ -2400,7 +2422,7 @@ var LINE_PATTERNS = [
     kind: "tool_definition",
     signal: "python.tool_decorator",
     confidence: "high",
-    pattern: /^\s*@(tool|function_tool|mcp\.tool|app\.tool)\b/,
+    pattern: /^\s*@(tool|function_tool|register_as_tool|\w+\.tool)\b/,
     extensions: PY
   },
   {
@@ -2764,6 +2786,173 @@ function writeHarnessCandidatesReport(report, outPath) {
   return target;
 }
 
+// src/harness-candidate-promotion.ts
+import { readFileSync as readFileSync3 } from "node:fs";
+import { resolve as resolve4 } from "node:path";
+var PROMOTED_CONFIDENCE = {
+  high: 0.85,
+  medium: 0.6
+};
+var MAX_DECORATOR_LOOKAHEAD_LINES = 12;
+var PY_DEF_NAME = /^\s*(?:async\s+)?def\s+([A-Za-z_]\w*)\s*\(/;
+var PY_CLASS_NAME = /\bclass\s+([A-Za-z_]\w*)\s*\(/;
+var JS_ASSIGNMENT_NAME = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=/;
+var JS_PROPERTY_NAME = /^\s*(?:public\s+|readonly\s+)?([A-Za-z_$][\w$]*)\s*:\s*(?:new\s+)?(?:[\w.$]*\.)?(?:tool|functionTool|createTool|dynamicTool|DynamicStructuredTool)\s*\(/;
+var JS_TRAILING_ASSIGNMENT_NAME = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:new\s+)?$/;
+var REGISTRY_CALL_NAME = /\b(?:register_tool|registerTool|add_tool)\s*\(\s*["']?([A-Za-z_$][\w$]*)/;
+var PROMPT_ASSIGNMENT_NAME = /^\s*(?:export\s+)?(?:(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*[:=]/;
+var MODEL_STRING = /["'`]([\w.:/-]*(?:gpt-|o[134](?:-mini)?\b|claude|gemini|llama|mistral|mixtral|deepseek|qwen|grok|sonnet|opus|haiku|command-r|glm|gemma)[\w.:/-]*)["'`]/i;
+function candidateEvidence(candidate) {
+  return [{
+    path: candidate.path,
+    line: candidate.startLine,
+    reason: `deterministic detector ${candidate.signal}`
+  }];
+}
+function pathStem(path) {
+  return path.replace(/\.[^.]+$/, "");
+}
+function readFileLines(rootDir, path, cache) {
+  const cached = cache.get(path);
+  if (cached !== undefined)
+    return cached;
+  let lines;
+  try {
+    lines = readFileSync3(resolve4(rootDir, path), "utf8").split(/\r?\n/);
+  } catch {
+    lines = null;
+  }
+  cache.set(path, lines);
+  return lines;
+}
+function extractToolName(candidate, lines) {
+  const line = lines[candidate.startLine - 1] ?? "";
+  if (candidate.signal === "python.tool_decorator") {
+    const end = Math.min(lines.length, candidate.startLine + MAX_DECORATOR_LOOKAHEAD_LINES);
+    for (let i = candidate.startLine;i < end; i += 1) {
+      const match = PY_DEF_NAME.exec(lines[i]);
+      if (match)
+        return match[1];
+    }
+    return;
+  }
+  if (candidate.signal === "python.base_tool_subclass") {
+    return PY_CLASS_NAME.exec(line)?.[1];
+  }
+  if (candidate.signal === "tool_registry.registration") {
+    return REGISTRY_CALL_NAME.exec(line)?.[1];
+  }
+  return JS_ASSIGNMENT_NAME.exec(line)?.[1] ?? JS_PROPERTY_NAME.exec(line)?.[1] ?? (candidate.startLine >= 2 ? JS_TRAILING_ASSIGNMENT_NAME.exec(lines[candidate.startLine - 2])?.[1] : undefined);
+}
+function promoteToolCandidate(candidate, rootDir, confidence, fileCache) {
+  const lines = readFileLines(rootDir, candidate.path, fileCache);
+  if (!lines)
+    return;
+  const name = extractToolName(candidate, lines);
+  if (!name)
+    return;
+  return {
+    id: stableId2("tool", `${candidate.path.replace(/\.[^./]+$/, "")}:${name}`),
+    type: "tool",
+    name: titleFromId2(name),
+    scope: "shared",
+    sourcePath: candidate.path,
+    usedByAgentIds: [],
+    confidence,
+    evidence: candidateEvidence(candidate),
+    body: extractToolBody({ path: candidate.path, rootDir }, { name, reason: candidate.signal })
+  };
+}
+function promotePromptFileCandidate(candidate, confidence) {
+  return {
+    id: stableId2("prompt", candidate.path),
+    type: "prompt",
+    name: promptNameFromPath(candidate.path),
+    scope: "shared",
+    sourcePath: candidate.path,
+    usedByAgentIds: [],
+    confidence,
+    evidence: candidateEvidence(candidate)
+  };
+}
+function promotePromptLiteralCandidate(candidate, rootDir, confidence, fileCache) {
+  const lines = readFileLines(rootDir, candidate.path, fileCache);
+  const assignedName = lines ? PROMPT_ASSIGNMENT_NAME.exec(lines[candidate.startLine - 1] ?? "")?.[1] ?? (candidate.startLine >= 2 ? PROMPT_ASSIGNMENT_NAME.exec(lines[candidate.startLine - 2] ?? "")?.[1] : undefined) : undefined;
+  return {
+    id: stableId2("prompt", `${pathStem(candidate.path)}:L${candidate.startLine}`),
+    type: "prompt",
+    name: assignedName ? titleFromId2(assignedName) : `Inline Prompt (${candidate.path}:${candidate.startLine})`,
+    scope: "shared",
+    usedByAgentIds: [],
+    confidence,
+    evidence: candidateEvidence(candidate)
+  };
+}
+function promoteModelConfigCandidate(candidate, rootDir, confidence, fileCache) {
+  const lines = readFileLines(rootDir, candidate.path, fileCache);
+  const sourceLine = lines?.[candidate.startLine - 1] ?? "";
+  const model = MODEL_STRING.exec(sourceLine)?.[1] ?? MODEL_STRING.exec(candidate.excerpt)?.[1];
+  if (!model)
+    return;
+  return {
+    id: stableId2("model_config", `${pathStem(candidate.path)}:L${candidate.startLine}`),
+    type: "model_config",
+    name: model,
+    scope: "shared",
+    usedByAgentIds: [],
+    confidence,
+    evidence: candidateEvidence(candidate)
+  };
+}
+function mergePromotedDuplicate(existing, next) {
+  for (const entry of next.evidence) {
+    const already = existing.evidence.some((candidate) => candidate.path === entry.path && candidate.line === entry.line && candidate.reason === entry.reason);
+    if (!already)
+      existing.evidence.push(entry);
+  }
+  existing.confidence = Math.max(existing.confidence, next.confidence);
+  if (!existing.body && next.body)
+    existing.body = next.body;
+}
+function promoteHarnessCandidates(report, rootDir) {
+  const fileCache = new Map;
+  const byId = new Map;
+  for (const candidate of report.candidates) {
+    const confidence = PROMOTED_CONFIDENCE[candidate.confidence];
+    if (confidence === undefined)
+      continue;
+    let artifact;
+    switch (candidate.kind) {
+      case "tool_definition":
+        artifact = promoteToolCandidate(candidate, rootDir, confidence, fileCache);
+        break;
+      case "prompt_file":
+        artifact = promotePromptFileCandidate(candidate, confidence);
+        break;
+      case "prompt_literal":
+        if (candidate.confidence === "high") {
+          artifact = promotePromptLiteralCandidate(candidate, rootDir, confidence, fileCache);
+        }
+        break;
+      case "model_config":
+        if (candidate.confidence === "high") {
+          artifact = promoteModelConfigCandidate(candidate, rootDir, confidence, fileCache);
+        }
+        break;
+      default:
+        break;
+    }
+    if (!artifact)
+      continue;
+    const existing = byId.get(artifact.id);
+    if (existing)
+      mergePromotedDuplicate(existing, artifact);
+    else
+      byId.set(artifact.id, artifact);
+  }
+  return [...byId.values()];
+}
+
 // src/harness-sync-limits.ts
 var MAX_HARNESS_SYNC_GRAPH_BYTES = 2000000;
 function assertHarnessGraphSyncSize(graph) {
@@ -3103,7 +3292,7 @@ var REPORT_JSON_END = "MODA_HARNESS_REPORT_JSON_END";
 var EXTERNAL_ANALYST_ADAPTERS = ["claude", "codex", "cursor"];
 async function runHarnessCommand(context) {
   const subcommand = context.positionals[0] ?? "scan";
-  const rootDir = resolve4(context.cwd, context.flags.path ?? ".");
+  const rootDir = resolve5(context.cwd, context.flags.path ?? ".");
   const selectedAgentId = selectedRuntimeAgentId(context.flags);
   const tenant = resolveHarnessTenant(context.flags, context);
   const scanPlan = buildCommandScanPlan(context, rootDir);
@@ -3148,11 +3337,15 @@ async function runHarnessCommand(context) {
       }
       if (context.flags["from-report"] || context.flags.report) {
         const reportPath = resolveHarnessReportPath(rootDir, context.flags["from-report"] ?? context.flags.report);
-        const { report, validation, approval, approved } = loadHarnessReportForSync(rootDir, reportPath);
+        const { report, validation, approval, approved } = loadHarnessReportForSync(rootDir, reportPath, {
+          deterministicFloor: computeDeterministicFloor(rootDir)
+        });
         const reportHash = hashHarnessReport(report);
         if (!approved && !context.dryRun) {
           throw new CliInputError("Harness report is not approved; refusing to sync.", "Run `moda harness validate-report`, review the report, then run `moda harness approve --yes` before syncing.");
         }
+        if (!context.dryRun)
+          assertHarnessGraphSyncQuality(report.graph, context.flags);
         const syncGraph2 = graphForReport(report.graph);
         const sourceCommit2 = report.source.sourceCommit ?? getGitCommit(rootDir);
         const localGraphHash2 = hashStableJson(syncGraph2);
@@ -3233,6 +3426,8 @@ async function runHarnessCommand(context) {
         tenantSource: tenant?.source,
         pathWasExplicit: context.flags.path !== undefined
       });
+      if (!context.dryRun)
+        assertHarnessGraphSyncQuality(graph, context.flags);
       const syncGraph = graphForSync(graph);
       const sourceCommit = getGitCommit(rootDir);
       const localGraphHash = hashStableJson2(syncGraph);
@@ -3338,11 +3533,13 @@ async function runHarnessCommand(context) {
         elapsed_ms: Date.now() - context.startedAt
       });
       if (context.flags["github-actions"] === "true") {
-        const { runGithubActionsAnalyze } = await import("./harness-github-actions-ct8fwzdr.js");
+        const { runGithubActionsAnalyze } = await import("./harness-github-actions-p8xa3akx.js");
         const result = await runGithubActionsAnalyze(rootDir, {
           writeReport: (report2) => {
             const normalized = normalizeHarnessReport(report2);
-            const validation2 = validateHarnessReport(normalized, rootDir);
+            const validation2 = validateHarnessReport(normalized, rootDir, {
+              deterministicFloor: computeDeterministicFloor(rootDir)
+            });
             writeHarnessReportArtifacts({
               rootDir,
               report: normalized,
@@ -3430,7 +3627,9 @@ async function runHarnessCommand(context) {
     case "validate-report": {
       const reportPath = resolveHarnessReportPath(rootDir, context.positionals[1] ?? context.flags.report);
       const report = readHarnessReport(reportPath);
-      const validation = validateHarnessReport(report, rootDir);
+      const validation = validateHarnessReport(report, rootDir, {
+        deterministicFloor: computeDeterministicFloor(rootDir)
+      });
       if (!context.dryRun) {
         writeHarnessReportArtifacts({
           rootDir,
@@ -3475,7 +3674,7 @@ async function runHarnessCommand(context) {
         throw new CliInputError("Missing output path for --out.", "Usage: moda harness candidates --out=<file>");
       }
       if (outFlag && !context.dryRun) {
-        written.push(writeHarnessCandidatesReport(report, resolve4(context.cwd, outFlag)));
+        written.push(writeHarnessCandidatesReport(report, resolve5(context.cwd, outFlag)));
       }
       writeHumanProgress(context, `Harness candidates: ${report.stats.candidateCount} candidates across ${report.stats.filesWithCandidates} files (${report.stats.filesScanned} scanned, ${report.stats.filesPerSecond.toLocaleString()} files/sec).`);
       context.output.writeData({ scanPlan, ...report, written, dryRun: context.dryRun });
@@ -3669,7 +3868,7 @@ async function runExternalHarnessAnalyst(options) {
       reportPath: HARNESS_REPORT_PATH
     }));
   }
-  const timeoutMs = numericEnv("MODA_HARNESS_ANALYST_TIMEOUT_MS", 1200000);
+  const timeoutMs = numericEnv("MODA_HARNESS_ANALYST_TIMEOUT_MS", 1800000);
   try {
     const result = await runExternalAnalystWithRetries(invocation, {
       cwd: options.rootDir,
@@ -3736,7 +3935,9 @@ ${result.stderr}`, 1200);
       elapsed_ms: Date.now() - options.context.startedAt
     });
     analystTui?.setValidation("running");
-    const validation = validateHarnessReport(report, options.rootDir);
+    const validation = validateHarnessReport(report, options.rootDir, {
+      deterministicFloor: computeDeterministicFloor(options.rootDir)
+    });
     analystTui?.setValidation(validation.status === "pass" ? "pass" : "fail");
     if (!analystTui)
       writeHumanProgress(options.context, `Moda Analyst: validation ${validation.status}.`);
@@ -3786,7 +3987,7 @@ function buildExternalAnalystEnv(env) {
   return next;
 }
 function readExternalAnalystReport(rootDir, result, adapter) {
-  const reportPath = resolve4(rootDir, HARNESS_REPORT_PATH);
+  const reportPath = resolve5(rootDir, HARNESS_REPORT_PATH);
   if (existsSync3(reportPath))
     return repairExternalAnalystReport(readHarnessReport(reportPath), rootDir);
   const output = [
@@ -3799,10 +4000,25 @@ function readExternalAnalystReport(rootDir, result, adapter) {
   const parsed = extractHarnessReportFromText(output, rootDir);
   if (parsed)
     return parsed;
+  let debugHint = "";
+  try {
+    const debugPath = resolve5(rootDir, MODA_DIR, "analyst-debug.log");
+    mkdirSync3(dirname4(debugPath), { recursive: true });
+    writeFileSync3(debugPath, [
+      `# analyst=${adapter} status=${result.status} signal=${result.signal} timedOut=${result.timedOut} maxBufferExceeded=${result.maxBufferExceeded}`,
+      "# ----- stdout -----",
+      result.stdout,
+      "# ----- stderr -----",
+      result.stderr
+    ].join(`
+`));
+    debugHint = `Raw analyst output saved to ${join2(MODA_DIR, "analyst-debug.log")} for debugging.`;
+  } catch {}
   throw new CliInputError(`Harness analyst ${adapter} did not return a harness report.`, [
     `Expected ${HARNESS_REPORT_PATH} or final JSON between ${REPORT_JSON_BEGIN} and ${REPORT_JSON_END}.`,
+    debugHint,
     "Retry with the selected coding agent CLI fixed, choose another analyst, or run `moda harness analyze --analyst=local-scan --summary` for deterministic fallback."
-  ].join(`
+  ].filter(Boolean).join(`
 `));
 }
 function extractHarnessReportFromText(output, rootDir) {
@@ -3846,10 +4062,56 @@ function parseHarnessReportCandidate(candidate) {
 function repairExternalAnalystReport(report, rootDir) {
   const normalized = normalizeHarnessReport(report);
   repairCitationLines(normalized, rootDir);
+  mergeDeterministicArtifacts(normalized.graph, rootDir);
   hydratePromptAndToolBodies(normalized.graph, rootDir);
   repairReportSummaryCounts(normalized);
   return normalized;
 }
+function mergeDeterministicArtifacts(graph, rootDir) {
+  if (process.env.MODA_HARNESS_DETERMINISTIC_MERGE === "0")
+    return { added: 0 };
+  let promoted;
+  try {
+    promoted = promoteHarnessCandidates(detectHarnessCandidates(rootDir), rootDir);
+  } catch {
+    return { added: 0 };
+  }
+  let added = 0;
+  for (const artifact of promoted) {
+    if (graphCoversPromotedArtifact(graph, artifact))
+      continue;
+    graph.artifacts.push(artifact);
+    added += 1;
+  }
+  return { added };
+}
+function artifactSourceKey(artifact) {
+  if (artifact.sourcePath)
+    return normalizePath3(artifact.sourcePath);
+  const pinned = Array.isArray(artifact.evidence) ? artifact.evidence.find((entry) => typeof entry.path === "string" && entry.path.length > 0) : undefined;
+  return pinned ? normalizePath3(pinned.path) : undefined;
+}
+function graphCoversPromotedArtifact(graph, promoted) {
+  const promotedName = promoted.name.toLowerCase();
+  const promotedLines = promoted.evidence.filter((entry) => typeof entry.line === "number");
+  const promotedSource = artifactSourceKey(promoted);
+  const isWholeFilePrompt = promoted.type === "prompt" && Boolean(promoted.sourcePath);
+  return graph.artifacts.some((existing) => {
+    if (existing.id === promoted.id)
+      return true;
+    if (existing.type === promoted.type && existing.name?.toLowerCase() === promotedName) {
+      const existingSource = artifactSourceKey(existing);
+      if (!existingSource || !promotedSource || existingSource === promotedSource)
+        return true;
+    }
+    if (existing.type === promoted.type && Array.isArray(existing.evidence) && existing.evidence.some((entry) => typeof entry.line === "number" && promotedLines.some((line) => line.path === entry.path && line.line === entry.line))) {
+      return true;
+    }
+    if (isWholeFilePrompt && existing.sourcePath === promoted.sourcePath)
+      return true;
+    return false;
+  });
+}
 function repairReportSummaryCounts(report) {
   const graph = report.graph;
   report.summary = {
@@ -3873,12 +4135,12 @@ function repairCitationLines(report, rootDir) {
     if (citation.type !== "file" && citation.type !== "generated_doc" || !citation.path || !citation.excerpt)
       continue;
     const excerpt = citation.excerpt;
-    const candidatePath = resolve4(rootDir, citation.path);
+    const candidatePath = resolve5(rootDir, citation.path);
     if (!existsSync3(candidatePath))
       continue;
     let text;
     try {
-      text = readFileSync3(candidatePath, "utf8");
+      text = readFileSync4(candidatePath, "utf8");
     } catch {
       continue;
     }
@@ -4112,7 +4374,7 @@ function isRetryableExternalAnalystFailure(result) {
     return false;
   const output = `${result.stdout}
 ${result.stderr}`;
-  return /\b529\b|overloaded|server-side issue|temporar(?:y|ily)|try again|rate limit|too many requests|\b429\b|service unavailable/i.test(output);
+  return /\b529\b|\b429\b|\b5(?:00|02|03|04)\b|overloaded|server-side issue|temporar(?:y|ily)|try again|rate limit|too many requests|service unavailable|internal server error|connection (?:closed|reset|error)|mid-response|econnreset|econnrefused|etimedout|socket hang ?up|fetch failed|network error|stream (?:closed|disconnected|error)/i.test(output);
 }
 function externalAnalystMaxAttempts(adapter) {
   const defaultRetries = adapter === "claude" ? 2 : 1;
@@ -4352,12 +4614,14 @@ function resolveExternalHarnessAnalystInvocation(options) {
   }
   if (options.adapter === "claude") {
     const extraArgs = externalAnalystExtraArgs(options.adapter);
-    const permission = mode === "write" ? ["--permission-mode", "acceptEdits", "--allowedTools", "Read,Grep,Glob,Edit,Write,Bash"] : ["--permission-mode", "plan", "--allowedTools", "Read,Grep,Glob,Bash(pwd),Bash(ls *),Bash(find *),Bash(rg *),Bash(grep *),Bash(cat *),Bash(git status *),Bash(git ls-files *),Bash(git grep *)"];
+    const model = resolveAnalystModel(options.adapter, options.flags);
+    const permission = mode === "write" ? ["--permission-mode", "acceptEdits", "--allowedTools", "Read,Grep,Glob,Edit,Write,Bash"] : ["--allowedTools", `Read,Grep,Glob,Write(${HARNESS_REPORT_PATH}),Bash(pwd),Bash(ls *),Bash(find *),Bash(rg *),Bash(grep *),Bash(cat *),Bash(git status *),Bash(git ls-files *),Bash(git grep *)`];
     return {
       adapter: options.adapter,
       command,
       args: [
         "--print",
+        ...model ? ["--model", model] : [],
         ...extraArgs,
         ...permission,
         ...options.stream ? ["--verbose"] : [],
@@ -4418,7 +4682,7 @@ async function runCodingAgent(options) {
     stream,
     mode: options.mode
   });
-  const timeoutMs = options.timeoutMs ?? numericEnv("MODA_HARNESS_ANALYST_TIMEOUT_MS", 1200000);
+  const timeoutMs = options.timeoutMs ?? numericEnv("MODA_HARNESS_ANALYST_TIMEOUT_MS", 1800000);
   const result = await runExternalAnalystWithRetries(invocation, {
     cwd: options.rootDir,
     env: buildExternalAnalystEnv(options.env ?? process.env),
@@ -4447,24 +4711,34 @@ async function runCodingAgent(options) {
 function externalAnalystExtraArgs(adapter) {
   return splitCommandLine(process.env[`MODA_HARNESS_ANALYST_${adapter.toUpperCase()}_ARGS`] ?? "");
 }
+var DEFAULT_CLAUDE_ANALYST_MODEL = "sonnet";
+function resolveAnalystModel(adapter, flags) {
+  const flagValue = flags["analyst-model"] && flags["analyst-model"] !== "true" ? flags["analyst-model"] : undefined;
+  const raw = (flagValue ?? process.env.MODA_HARNESS_ANALYST_MODEL)?.trim();
+  if (raw?.toLowerCase() === "default")
+    return;
+  if (raw)
+    return raw;
+  return adapter === "claude" ? DEFAULT_CLAUDE_ANALYST_MODEL : undefined;
+}
 function renderExternalHarnessAnalystPrompt(options) {
   return [
     "You are Moda Analyst, investigating an agent harness for Moda CLI onboarding.",
     "",
-    "Do real repository investigation. Do not call `moda harness scan`, `moda harness analyze`, or rely on deterministic Moda scanner output.",
+    "Do real repository investigation. Do not call `moda harness scan` or `moda harness analyze` yourself. When Moda provides deterministic scanner seeds below, treat them as navigation candidates to verify against the real files — never as evidence or as a complete inventory.",
     "Only inspect the Repository root named below and files/directories under it. Do not inspect parent directories, sibling projects, the Moda CLI implementation, or this monorepo unless the Repository root itself is that directory.",
     "Inspect package manifests, source files, prompt files, tool definitions, skills/rules, evals, deployment config, and README/AGENTS docs as needed.",
     "Do not read secret-looking files such as .env files, private keys, credential files, or token stores.",
     "You are running as a read-only analyst. Do not edit source files, configuration files, git state, dependency files, or project metadata.",
-    "Prefer printing the final report JSON for Moda CLI to validate and write. If your runtime unexpectedly allows file writes, only `.moda/harness-report.json` is permitted.",
+    `The ONLY path you may write is ${HARNESS_REPORT_PATH}. Write the final report JSON there with the Write tool as soon as it is complete — the file is the durable deliverable and survives a dropped connection, unlike a long printed message. If (and only if) the write fails, print the report JSON between the sentinel markers instead.`,
     "",
     "Your task:",
     renderExternalAnalystProtocol(),
     "1. Identify the runtime agent harnesses, agent families, channel adapters, identity mappings, model providers, frameworks, deployments, and open questions.",
     "2. Exhaustively enumerate EVERY prompt, tool, guardrail, and eval as its own graph artifact — the complete inventory, not a sample. This report feeds prompt optimization and tool optimization, so a missing tool or prompt is a real defect. Runtime agents may be modeled representatively on framework/example repos, but prompts and tools must be complete.",
     "3. Cite every narrative claim with local file paths, exact line numbers, and excerpts. File citations without line numbers are invalid for agent-authored reports. Enumerated artifacts only need evidence:[{path, reason}], so completeness of the artifact inventory is not limited by the citation cap.",
-    `4. After completing investigation, print the report JSON between ${REPORT_JSON_BEGIN} and ${REPORT_JSON_END}. Moda CLI will validate it and write the local artifacts.`,
-    "Your final response must contain the sentinel-wrapped JSON report. Do not end with commentary about being read-only, do not summarize without JSON, and do not omit the sentinel markers.",
+    `4. After completing investigation, WRITE the report JSON to ${HARNESS_REPORT_PATH} with the Write tool, then print a one-line confirmation naming the file. Only if that write fails, print the report JSON between ${REPORT_JSON_BEGIN} and ${REPORT_JSON_END}. Moda CLI validates whichever it finds (the file wins).`,
+    "Do not end with commentary about being read-only and do not summarize without delivering the report: either the written file or the sentinel-wrapped JSON must exist before you finish.",
     "If the repository is very large, keep enumerating prompts/tools/guardrails/evals as artifacts (uncapped) and only summarize runtime AGENTS representatively — do not drop tools or prompts to save space.",
     "",
     "Final output format:",
@@ -4491,7 +4765,7 @@ function renderExternalHarnessAnalystPrompt(options) {
     "Each graph item with evidence must use evidence: [{ path, reason }], not citationIds/citations.",
     'Runtime agents must include id, name, kind:"runtime_agent", root, entrypointIds, channelAdapterIds, artifactIds, identityNamespaceIds, deploymentIds, frameworkIds, modelProviderIds, confidence, evidence.',
     "Artifacts must include id, type, name, scope, usedByAgentIds, confidence, evidence, and optional sourcePath/contentHash/ownedByAgentId. Emit one artifact PER tool, PER prompt (including each inline system prompt), PER guardrail, and PER eval — enumerate them all; artifact types are entrypoint, prompt, tool, skill, eval, retrieval_index, memory, guardrail, model_config, unknown.",
-    "Also set `body` on each artifact to its actual usable content so it can be consumed downstream WITHOUT re-reading the repo: for `prompt` the COMPLETE prompt text verbatim (full inline `instructions=`/system-prompt string or full prompt file); for `tool` the signature (name + parameters + types) and its docstring/description; for `guardrail` the rule/condition; for `eval` what it asserts; for `model_config` the configuration values. Copy the text in full — do not summarize or truncate `body` (it is the artifact we optimize). Redact any secret literals.",
+    "Do NOT transcribe prompt/tool text into `body` when it exists verbatim in the repo — pin its exact location instead (sourcePath for a dedicated file, or evidence [{ path, line, reason }] at the definition line) and Moda hydrates `body` locally from that location after validation. Set `body` inline ONLY for content that cannot be recovered from one pinned location: dynamically assembled prompts, fragments concatenated at runtime, or values you had to derive. Short bodies for `guardrail` (the rule), `eval` (what it asserts), and `model_config` (the config values) are still welcome. Redact any secret literals.",
     "For every `prompt` and `tool` artifact, at least one evidence entry MUST pin an exact source location so downstream optimization can retrieve the item text: carry a numeric `line` (the definition line, or the first line of the range) — evidence: [{ path, line, reason }]. The only exception is an artifact whose entire dedicated file is the text (e.g. a standalone prompt file); set its sourcePath and cite that same file and no line is required. When a single file holds multiple inline prompts or tool definitions, give each its own distinct line — a bare { path, reason } is a defect there.",
     "Agent families must include id, name, runtimeAgentIds, sharedArtifactIds, confidence, evidence.",
     "Frameworks/providers must include packageNames and runtimeAgentIds arrays; providers also include envVars and modelHints arrays.",
@@ -4502,6 +4776,7 @@ function renderExternalHarnessAnalystPrompt(options) {
     options.tenantId ? `Tenant ID to include in graph.tenant: ${options.tenantId}` : "No tenant ID was provided for this analysis.",
     `Repository root: ${options.rootDir}`,
     renderAnalystPreflightSection(options.rootDir),
+    renderAnalystSeedSection(options.rootDir),
     "",
     "Be conservative. If something is unclear, put it in unknowns instead of inventing an agent."
   ].filter(Boolean).join(`
@@ -4520,7 +4795,7 @@ function renderExternalAnalystProtocol() {
     '- Also emit artifacts for guardrails (type "guardrail"), evals/tests-of-agents (type "eval"), memory/session stores (type "memory"), retrieval indexes (type "retrieval_index"), and model configuration (type "model_config").',
     "- Only runtime AGENTS may be modeled representatively: if the repo is a framework/SDK/examples collection, you need not treat every example as a distinct production agent — but you MUST still enumerate every distinct tool, prompt, guardrail, and eval as its own artifact.",
     "- Each enumerated artifact needs evidence: [{ path, reason }] (file path + short reason); a full line+excerpt citation is required only for the narrative `claims`, NOT for every artifact — so listing hundreds of tools/prompts is cheap and expected.",
-    "- Capture the actual usable content in each artifact's `body`: full prompt text for prompts, signature+docstring for tools, the rule for guardrails, the assertion for evals, config values for model configs. This inventory is consumed directly for optimization, so `body` must be the complete text (verbatim, not summarized), with secret literals redacted.",
+    "- Bodies are hydrated locally by Moda from pinned locations — do not copy file text into `body`. Spend your output budget on coverage (every artifact, exact definition locations), not transcription. Inline `body` only for content not recoverable from a single location (e.g. prompts assembled from fragments at runtime), plus short bodies for guardrails/evals/model configs.",
     "- EXCEPTION — `prompt` and `tool` artifacts MUST pin an exact location: put a numeric `line` on at least one evidence entry (evidence: [{ path, line, reason }]) at the definition line. That structured location is what lets downstream optimization retrieve the exact prompt/tool text; when one file has several inline prompts or tools, each artifact gets its own line. The only case that needs no line is a whole dedicated file whose entire content is the artifact (set sourcePath to that file and cite it). Still no excerpt required — just the line.",
     "- For every runtime agent, read and cite at least one concrete entrypoint or orchestration line, and link its prompts/tools via artifactIds.",
     "- Keep going until every prompt, tool, guardrail, and eval in scope is represented as an artifact. Use unknowns only for genuinely ambiguous items — never to skip enumeration. Respect the hard caps (<=250 claims, <=400 citations): artifacts are uncapped, so when there are many items keep enumerating them as artifacts and reserve claims/citations for the most important ones."
@@ -4528,7 +4803,7 @@ function renderExternalAnalystProtocol() {
 `);
 }
 function renderAnalystPreflightSection(rootDir) {
-  if (process.env.MODA_HARNESS_ANALYST_PREFLIGHT !== "1")
+  if (process.env.MODA_HARNESS_ANALYST_PREFLIGHT === "0")
     return "";
   const paths = listAnalystPreflightPaths(rootDir);
   if (paths.length === 0)
@@ -4558,6 +4833,91 @@ function renderPreflightGroup(label, paths) {
     return [];
   return [`${label}:`, ...paths.map((path) => `- ${path}`)];
 }
+var MAX_SEED_ARTIFACT_LINES = 150;
+function renderAnalystSeedSection(rootDir) {
+  if (process.env.MODA_HARNESS_ANALYST_SEEDS === "0")
+    return "";
+  const sections = [];
+  try {
+    const lines = renderAnalystSeedLines(scanHarness({ rootDir, dryRun: true, pathWasExplicit: true }));
+    if (lines)
+      sections.push(lines);
+  } catch {}
+  try {
+    const lines = renderAnalystCandidateLines(detectHarnessCandidates(rootDir));
+    if (lines)
+      sections.push(lines);
+  } catch {}
+  return sections.join(`
+`);
+}
+var MAX_SEED_CANDIDATES_PER_KIND = 40;
+var MAX_SEED_READ_PLAN_FILES = 25;
+var SEED_CANDIDATE_KIND_LABELS = {
+  llm_call_site: "LLM call sites",
+  framework_construct: "Agent-framework constructs",
+  tool_definition: "Tool definitions",
+  tool_schema: "Tool schemas",
+  message_construction: "Message constructions",
+  prompt_file: "Prompt files",
+  prompt_literal: "Inline prompt literals",
+  model_config: "Model configuration"
+};
+function renderAnalystCandidateLines(report) {
+  if (report.candidates.length === 0)
+    return "";
+  const byKind = new Map;
+  for (const candidate of report.candidates) {
+    const bucket = byKind.get(candidate.kind);
+    if (bucket)
+      bucket.push(candidate);
+    else
+      byKind.set(candidate.kind, [candidate]);
+  }
+  const lines = [
+    "",
+    `Deterministic candidate inventory (${report.candidates.length} candidates across ${report.stats.filesWithCandidates} files, scanned in ${report.stats.durationMs}ms):`,
+    "Each entry is path:line [detector] excerpt. Candidates are pattern matches — verify each against the real file and drop false positives. Verified deterministic candidates are also auto-merged into the graph after your run, so prioritize (1) agents, topology, and relationships, (2) verifying or refuting these candidates (list refuted ones in unknowns), and (3) artifacts the patterns cannot see (runtime agents, prompts assembled at runtime, cross-file wiring) — rather than re-listing every candidate as an artifact. Do not cite this list as evidence; cite the files."
+  ];
+  for (const [kind, label] of Object.entries(SEED_CANDIDATE_KIND_LABELS)) {
+    const bucket = byKind.get(kind);
+    if (!bucket || bucket.length === 0)
+      continue;
+    const shown = bucket.slice(0, MAX_SEED_CANDIDATES_PER_KIND);
+    lines.push(`${label} (${bucket.length}${bucket.length > shown.length ? `, showing ${shown.length}` : ""}):`);
+    for (const candidate of shown) {
+      lines.push(`- ${candidate.path}:${candidate.startLine} [${candidate.signal}] ${candidate.excerpt}`);
+    }
+  }
+  const readPlan = report.files.slice(0, MAX_SEED_READ_PLAN_FILES);
+  if (readPlan.length > 0) {
+    lines.push(`Highest-signal files to read first (${readPlan.length} of ${report.files.length}):`, ...readPlan.map((file) => `- ${file.path} (score ${Math.round(file.score)}; ${file.kinds.join(", ")})`));
+  }
+  return lines.join(`
+`);
+}
+function renderAnalystSeedLines(graph) {
+  const providers = graph.modelProviders.map((provider) => `- ${provider.name}${provider.packageNames.length ? ` (packages: ${provider.packageNames.join(", ")})` : ""}`);
+  const frameworks = graph.agentFrameworks.map((framework) => `- ${framework.name}${framework.packageNames.length ? ` (packages: ${framework.packageNames.join(", ")})` : ""}`);
+  const artifacts = graph.artifacts.slice(0, MAX_SEED_ARTIFACT_LINES).map((artifact) => `- [${artifact.type}] ${artifact.sourcePath ?? artifact.name}`);
+  if (providers.length === 0 && frameworks.length === 0 && artifacts.length === 0)
+    return "";
+  const lines = [
+    "",
+    "Deterministic scanner seeds (candidates, not ground truth):",
+    "Moda's static scanner pre-detected the items below from package manifests and filename patterns. Verify each against the real files before including it, correct or drop mislabeled entries, and focus your investigation on what pattern matching cannot see: runtime agents, inline prompts, decorated/registered tool definitions, and the relationships between them. Do not cite this list as evidence."
+  ];
+  if (providers.length > 0)
+    lines.push("Detected model providers:", ...providers);
+  if (frameworks.length > 0) {
+    lines.push("Detected agent frameworks (package-name matches; may be false positives):", ...frameworks);
+  }
+  if (artifacts.length > 0) {
+    lines.push(`Detected artifact candidates (${graph.artifacts.length} total${graph.artifacts.length > MAX_SEED_ARTIFACT_LINES ? `, showing first ${MAX_SEED_ARTIFACT_LINES}` : ""}):`, ...artifacts);
+  }
+  return lines.join(`
+`);
+}
 function listAnalystPreflightPaths(rootDir) {
   const gitPaths = readGitTrackedPaths(rootDir);
   const paths = gitPaths.length > 0 ? gitPaths : readDirectoryPreflightPaths(rootDir);
@@ -4669,7 +5029,7 @@ function truncateText(value, maxLength) {
   return compact.length > maxLength ? `${compact.slice(0, maxLength - 1)}...` : compact;
 }
 function scanHarness(options = {}) {
-  const rootDir = resolve4(options.rootDir ?? process.cwd());
+  const rootDir = resolve5(options.rootDir ?? process.cwd());
   const skipped = [];
   const files = inventoryFiles(rootDir, skipped);
   const annotations = files.flatMap((file) => parseAnnotations(file));
@@ -4771,7 +5131,7 @@ function collectSnapshotInputs(rootDir, maxFiles, maxTextBytes) {
     let text = "";
     if (isTextFile(path)) {
       try {
-        text = readFileSync3(current, "utf8");
+        text = readFileSync4(current, "utf8");
         inventoryTextBytes += Buffer.byteLength(text, "utf8");
       } catch {
         return;
@@ -4784,7 +5144,7 @@ function collectSnapshotInputs(rootDir, maxFiles, maxTextBytes) {
   return inputs;
 }
 function buildSourceSnapshot(rootDir) {
-  const root = resolve4(rootDir);
+  const root = resolve5(rootDir);
   const maxFiles = numericEnv("MODA_HARNESS_MAX_FILES", DEFAULT_MAX_INVENTORY_FILES);
   const maxTextBytes = numericEnv("MODA_HARNESS_MAX_TEXT_BYTES", DEFAULT_MAX_INVENTORY_TEXT_BYTES);
   const inputs = collectSnapshotInputs(root, maxFiles, maxTextBytes);
@@ -5011,7 +5371,7 @@ function readHarnessSyncState(rootDir) {
   if (!existsSync3(path))
     return;
   try {
-    const parsed = JSON.parse(readFileSync3(path, "utf8"));
+    const parsed = JSON.parse(readFileSync4(path, "utf8"));
     if (!isRecord3(parsed) || parsed.schemaVersion !== "sync_state.v0.1") {
       return;
     }
@@ -5128,7 +5488,7 @@ function findFresherHarnessReports(rootDir) {
   return fresher.sort((a, b) => b.mtimeMs - a.mtimeMs);
 }
 function warnFresherSubdirHarnessReports(context, rootDir, explicitReport) {
-  const explicitReportPath = explicitReport && explicitReport !== "true" ? normalizePath3(relative3(rootDir, resolve4(rootDir, explicitReport))) : undefined;
+  const explicitReportPath = explicitReport && explicitReport !== "true" ? normalizePath3(relative3(rootDir, resolve5(rootDir, explicitReport))) : undefined;
   if (explicitReportPath && explicitReportPath !== normalizePath3(HARNESS_REPORT_PATH))
     return;
   let fresher;
@@ -5145,7 +5505,7 @@ function warnFresherSubdirHarnessReports(context, rootDir, explicitReport) {
   writeHarnessNotice(context, `A fresher harness report exists at ${newest.path} (this directory has ${rootState}). If you meant that report, re-run with --path=${subdir}.`);
 }
 function readHarnessGraph(manifestPath) {
-  return JSON.parse(readFileSync3(manifestPath, "utf8"));
+  return JSON.parse(readFileSync4(manifestPath, "utf8"));
 }
 function writeHarnessArtifacts(graph, rootDir, options = {}) {
   const modaDir = join2(rootDir, MODA_DIR);
@@ -5257,6 +5617,25 @@ function renderFrameworkAndProviderLines(graph) {
   }
   return lines;
 }
+function assertHarnessGraphSyncQuality(graph, flags) {
+  if (flags["allow-no-agents"] === "true")
+    return;
+  if (graph.runtimeAgents.length > 0)
+    return;
+  const evidence = [];
+  if (graph.modelProviders.length > 0) {
+    evidence.push(`model providers (${graph.modelProviders.map((provider) => provider.name).join(", ")})`);
+  }
+  if (graph.agentFrameworks.length > 0) {
+    evidence.push(`agent frameworks (${graph.agentFrameworks.map((framework) => framework.name).join(", ")})`);
+  }
+  const promptOrToolCount = graph.artifacts.filter((artifact) => artifact.type === "prompt" || artifact.type === "tool").length;
+  if (promptOrToolCount > 0)
+    evidence.push(`${promptOrToolCount} prompt/tool artifacts`);
+  if (evidence.length === 0)
+    return;
+  throw new CliInputError(`Refusing to sync: the harness graph has zero runtime agents but detected ${evidence.join(", ")}.`, "Agent detection likely under-ran (the deterministic scanner only finds agents via @moda annotations). Run `moda harness analyze --analyst=claude` for semantic detection, or pass --allow-no-agents to sync this graph anyway.");
+}
 function graphForSync(graph) {
   return sortJson2({
     ...graph,
@@ -5303,7 +5682,7 @@ function explainAgent(graph, agent) {
 }
 function inventoryFiles(rootDir, skipped, options = {}) {
   const files = [];
-  const rootReal = resolve4(rootDir);
+  const rootReal = resolve5(rootDir);
   const maxFiles = numericEnv("MODA_HARNESS_MAX_FILES", DEFAULT_MAX_INVENTORY_FILES);
   const maxTextBytes = numericEnv("MODA_HARNESS_MAX_TEXT_BYTES", DEFAULT_MAX_INVENTORY_TEXT_BYTES);
   let textBytes = 0;
@@ -5357,7 +5736,7 @@ function inventoryFiles(rootDir, skipped, options = {}) {
         recordSkipped(skipped, { path: rel, reason: "scan text budget exceeded" });
       } else {
         try {
-          item.text = readFileSync3(current, "utf8");
+          item.text = readFileSync4(current, "utf8");
           textBytes += Buffer.byteLength(item.text, "utf8");
         } catch {
           recordSkipped(skipped, { path: rel, reason: "text read failed" });
@@ -5664,7 +6043,7 @@ function maybeAddPromptArtifact(graph, file) {
   if (!isPrompt)
     return;
   const id = stableId2("prompt", file.path);
-  const text = file.text ?? readFileSync3(file.absPath, "utf8");
+  const text = file.text ?? readFileSync4(file.absPath, "utf8");
   upsertArtifact(graph, {
     id,
     type: "prompt",
@@ -5891,12 +6270,27 @@ function detectToolDefinitions(file) {
   const pyDecorated = /@function_tool[^\n]*\n(?:[ \t]*@[^\n]*\n)*[ \t]*(?:async[ \t]+)?def[ \t]+([A-Za-z_]\w*)/g;
   for (const match of text.matchAll(pyDecorated))
     found.set(match[1], "@function_tool-decorated function");
+  const pyToolDecorated = /@((?:[A-Za-z_]\w*\.)?tool|register_as_tool)\b[^\n]*\n(?:[ \t]*@[^\n]*\n)*[ \t]*(?:async[ \t]+)?def[ \t]+([A-Za-z_]\w*)/g;
+  for (const match of text.matchAll(pyToolDecorated))
+    found.set(match[2], `@${match[1]}-decorated function`);
+  const pyToolClass = /class[ \t]+([A-Za-z_]\w*)\s*\(\s*(?:[A-Za-z_]\w*\.)?(BaseTool|StructuredTool)\b/g;
+  for (const match of text.matchAll(pyToolClass))
+    found.set(match[1], `${match[2]} subclass`);
   const tsFactory = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:[\w.]*\.)?(?:tool|functionTool|createTool|dynamicTool)\s*\(/g;
   for (const match of text.matchAll(tsFactory))
     found.set(match[1], "tool factory assignment");
-  const tsNewTool = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*new\s+(?:Dynamic|Structured)?Tool\b/g;
+  const tsNewTool = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*new\s+(?:DynamicStructured|Dynamic|Structured)?Tool\b/g;
   for (const match of text.matchAll(tsNewTool))
     found.set(match[1], "tool constructor assignment");
+  const tsInlineToolCtor = /(?:^|[(,[]|return\s)\s*(?:new\s+)?(?:DynamicStructured|Dynamic|Structured)Tool\s*\(\s*\{[^{}]*?\bname\s*:\s*["'`]([\w .:-]+)["'`]/gm;
+  for (const match of text.matchAll(tsInlineToolCtor))
+    found.set(match[1], "tool constructor call");
+  const registryCall = /\b(register_tool|registerTool|add_tool|ToolRegistry)\s*\(\s*\[?\s*(?:name\s*=\s*)?(?:["']([\w .:-]+)["']|([A-Za-z_$][\w$]*))/g;
+  for (const match of text.matchAll(registryCall)) {
+    const name = match[2] ?? match[3];
+    if (name)
+      found.set(name, `${match[1]} registration`);
+  }
   for (const match of text.matchAll(HOSTED_TOOL_CALL))
     found.set(match[1], `hosted tool ${match[1]}`);
   return [...found.entries()].map(([name, reason]) => ({ name, reason }));
@@ -5912,7 +6306,7 @@ function maybeAddToolArtifact(graph, file) {
   for (const tool of tools) {
     const body = extractToolBody(file, tool);
     upsertArtifact(graph, {
-      id: stableId2("tool", `${file.path}:${tool.name}`),
+      id: stableId2("tool", `${file.path.replace(/\.[^./]+$/, "")}:${tool.name}`),
       type: "tool",
       name: titleFromId2(tool.name),
       scope: "agent",
@@ -6020,6 +6414,55 @@ var FRAMEWORK_CATALOG = [
     kind: "agent_framework",
     packageNames: ["pydantic-ai", "pydantic_ai"],
     patterns: [/pydantic_ai/i]
+  },
+  {
+    id: "framework_langgraph",
+    name: "LangGraph",
+    kind: "agent_framework",
+    packageNames: ["langgraph", "@langchain/langgraph"],
+    patterns: [/\blanggraph\b/i, /\bStateGraph\s*\(/]
+  },
+  {
+    id: "framework_autogen",
+    name: "AutoGen",
+    kind: "agent_framework",
+    packageNames: ["autogen", "pyautogen", "autogen-agentchat"],
+    patterns: [/\bautogen\b/i]
+  },
+  {
+    id: "framework_dspy",
+    name: "DSPy",
+    kind: "agent_framework",
+    packageNames: ["dspy", "dspy-ai"],
+    patterns: [/\bdspy\b/i]
+  },
+  {
+    id: "framework_semantic_kernel",
+    name: "Semantic Kernel",
+    kind: "agent_framework",
+    packageNames: ["semantic-kernel"],
+    patterns: [/semantic[-_]?kernel/i]
+  },
+  {
+    id: "framework_smolagents",
+    name: "Smolagents",
+    kind: "agent_framework",
+    packageNames: ["smolagents"],
+    patterns: [/\bsmolagents\b/i]
+  },
+  {
+    id: "framework_llama_index",
+    name: "LlamaIndex",
+    kind: "agent_framework",
+    packageNames: ["llama-index", "llamaindex"],
+    patterns: [/llama[-_]?index/i]
+  },
+  {
+    id: "framework_claude_agent_sdk",
+    name: "Claude Agent SDK",
+    kind: "agent_framework",
+    packageNames: ["@anthropic-ai/claude-agent-sdk", "claude-agent-sdk"],
+    patterns: [/claude[-_]agent[-_]sdk/i]
   }
 ];
 var PROVIDER_CATALOG = [
@@ -6070,6 +6513,46 @@ var PROVIDER_CATALOG = [
     packageNames: ["ollama"],
     envVars: ["OLLAMA_HOST"],
     patterns: [/\bollama\b/i]
+  },
+  {
+    id: "provider_litellm",
+    name: "LiteLLM",
+    kind: "model_provider",
+    packageNames: ["litellm"],
+    envVars: [],
+    patterns: [/\blitellm\b/i]
+  },
+  {
+    id: "provider_aws_bedrock",
+    name: "AWS Bedrock",
+    kind: "model_provider",
+    packageNames: ["@aws-sdk/client-bedrock-runtime"],
+    envVars: ["AWS_BEARER_TOKEN_BEDROCK"],
+    patterns: [/bedrock-runtime/i, /\bBedrockRuntimeClient\b/, /\bInvokeModelCommand\b/, /\binvoke_model\s*\(/]
+  },
+  {
+    id: "provider_openrouter",
+    name: "OpenRouter",
+    kind: "model_provider",
+    packageNames: ["openrouter", "@openrouter/ai-sdk-provider"],
+    envVars: ["OPENROUTER_API_KEY"],
+    patterns: [/openrouter\.ai/i, /\bopenrouter\b/i, /OPENROUTER_API_KEY/]
+  },
+  {
+    id: "provider_xai",
+    name: "xAI",
+    kind: "model_provider",
+    packageNames: ["xai-sdk"],
+    envVars: ["XAI_API_KEY"],
+    patterns: [/\bgrok-[\w.-]+/i, /api\.x\.ai/i, /XAI_API_KEY/]
+  },
+  {
+    id: "provider_groq",
+    name: "Groq",
+    kind: "model_provider",
+    packageNames: ["groq", "groq-sdk"],
+    envVars: ["GROQ_API_KEY"],
+    patterns: [/\bgroq\b/i]
   }
 ];
 function detectAgentFrameworks(files) {
@@ -6111,6 +6594,59 @@ function detectModelProviders(files) {
   }
   return providers.sort((a, b) => a.id.localeCompare(b.id));
 }
+function computeDeterministicFloor(rootDir) {
+  try {
+    const candidateReport = detectHarnessCandidates(rootDir);
+    let toolCandidates = 0;
+    let promptCandidates = 0;
+    let llmCallSites = 0;
+    for (const candidate of candidateReport.candidates) {
+      if (candidate.kind === "tool_definition" && candidate.confidence === "high") {
+        toolCandidates += 1;
+      } else if ((candidate.kind === "prompt_file" || candidate.kind === "prompt_literal") && candidate.confidence === "high") {
+        promptCandidates += 1;
+      } else if (candidate.kind === "llm_call_site") {
+        llmCallSites += 1;
+      }
+    }
+    return {
+      toolCandidates,
+      promptCandidates,
+      llmCallSites,
+      providerPackages: detectProviderPackagesInManifests(rootDir)
+    };
+  } catch {
+    return { toolCandidates: 0, promptCandidates: 0, llmCallSites: 0, providerPackages: [] };
+  }
+}
+function detectProviderPackagesInManifests(rootDir) {
+  const present = new Set;
+  const packageJsonPath = join2(rootDir, "package.json");
+  if (existsSync3(packageJsonPath)) {
+    try {
+      const deps = packageDependencyNames(readFileSync4(packageJsonPath, "utf8"));
+      for (const provider of PROVIDER_CATALOG) {
+        for (const name of provider.packageNames) {
+          if (deps.has(name))
+            present.add(name);
+        }
+      }
+    } catch {}
+  }
+  const pyprojectPath = join2(rootDir, "pyproject.toml");
+  if (existsSync3(pyprojectPath)) {
+    try {
+      const deps = pyprojectDependencyNames(readFileSync4(pyprojectPath, "utf8"));
+      for (const provider of PROVIDER_CATALOG) {
+        for (const name of provider.packageNames) {
+          if (deps.has(name.toLowerCase()))
+            present.add(name);
+        }
+      }
+    } catch {}
+  }
+  return [...present].sort();
+}
 function detectionEvidence(files, packageNames, patterns) {
   const evidence = [];
   for (const file of files) {
@@ -6192,7 +6728,7 @@ function pyprojectDependencyNames(text) {
 }
 function modelHintsForProvider(providerId, files) {
   const hints = new Set;
-  const pattern = providerId === "provider_anthropic" ? /\bclaude-[A-Za-z0-9_.-]+/g : providerId === "provider_openai" ? /\bgpt-[A-Za-z0-9_.-]+/g : providerId === "provider_google" ? /\bgemini-[A-Za-z0-9_.-]+/g : null;
+  const pattern = providerId === "provider_anthropic" ? /\bclaude-[A-Za-z0-9_.-]+/g : providerId === "provider_openai" ? /\bgpt-[A-Za-z0-9_.-]+/g : providerId === "provider_google" ? /\bgemini-[A-Za-z0-9_.-]+/g : providerId === "provider_xai" ? /\bgrok-[A-Za-z0-9_.-]+/g : null;
   if (!pattern)
     return [];
   for (const file of files) {
@@ -6483,7 +7019,7 @@ function upsertDeployment(graph, next) {
 }
 function contentHashForAnnotatedSource(sourcePath, annotation) {
   const bodyAnnotation = annotation;
-  const rootCandidate = resolve4(annotation.rootDir, sourcePath);
+  const rootCandidate = resolve5(annotation.rootDir, sourcePath);
   const candidates = [
     rootCandidate,
     ...annotatedSourceCandidates(sourcePath, bodyAnnotation).filter((c) => c !== rootCandidate)
@@ -6517,7 +7053,7 @@ function readSmallTextFileForHash(absPath, rootDir) {
   if (!isTextFile(rel))
     return;
   try {
-    return readFileSync3(absPath, "utf8");
+    return readFileSync4(absPath, "utf8");
   } catch {
     return;
   }
@@ -6637,7 +7173,7 @@ function readRemoteRunState(rootDir) {
   if (!existsSync4(path))
     return;
   try {
-    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    const parsed = JSON.parse(readFileSync5(path, "utf8"));
     if (!parsed || typeof parsed.run_id !== "string" || parsed.run_id.length === 0)
       return;
     return {
@@ -6792,7 +7328,9 @@ function finalizeRemoteAnalyzeResult(options) {
   if (options.snapshotTruncated) {
     report = stampRemoteSnapshotTruncation(report);
   }
-  const validation = validateHarnessReport(report, rootDir);
+  const validation = validateHarnessReport(report, rootDir, {
+    deterministicFloor: computeDeterministicFloor(rootDir)
+  });
   context.output.writeEvent({
     event: "progress",
     phase: "validation",

package/dist/{cli-x1a56ws9.js → cli-3w6hbpr3.js}

@@ -11,7 +11,7 @@ import {
   renderStatusHuman,
   scanHarness,
   validateHarnessReport
-} from "./cli-g931ntph.js";
+} from "./cli-351a5yc4.js";
 import {
   isAuthSessionValid,
   loadAuthSession

package/dist/cli.js

@@ -8,7 +8,7 @@ import {
   runPromptsCommand,
   runSkillsCommand,
   runStatusCommand
-} from "./cli-x1a56ws9.js";
+} from "./cli-3w6hbpr3.js";
 import {
   ApiError,
   HARNESS_REPORT_APPROVAL_PATH,
@@ -29,7 +29,7 @@ import {
   summarizeHarness,
   terminalStyles,
   validateHarnessReport
-} from "./cli-g931ntph.js";
+} from "./cli-351a5yc4.js";
 import {
   authFetch,
   clearAuthSession,
@@ -5499,6 +5499,11 @@ Init flags:
   --yes                            Accept all defaults (non-interactive)
   --analyst=auto|claude|codex|cursor|local-scan
                                    Choose harness analyst adapter
+  --analyst-model=MODEL            Model for the claude analyst (default: sonnet;
+                                   "default" = the claude CLI's own default;
+                                   env: MODA_HARNESS_ANALYST_MODEL)
+  --allow-no-agents                Allow harness sync to push a graph with zero
+                                   runtime agents despite detected LLM usage
   --remote                         Run harness analysis server-side (Moda-hosted,
                                    the default): upload a safe source snapshot; no
                                    local coding agent required
@@ -6491,7 +6496,7 @@ var commandRegistry = createCommandRegistry([
     resetApiRequestCountBeforeRun: true,
     telemetry: "result",
     handler: async (context) => {
-      const { runInit } = await import("./index-g3gt62rm.js");
+      const { runInit } = await import("./index-8ksqhqmr.js");
       if (context.outputMode === "agent-stream") {
         context.output.writeEvent({
           event: "started",

package/dist/{harness-github-actions-ct8fwzdr.js → harness-github-actions-p8xa3akx.js}

@@ -1,6 +1,6 @@
 import {
   buildSourceSnapshot
-} from "./cli-g931ntph.js";
+} from "./cli-351a5yc4.js";
 import"./cli-59yacef3.js";
 
 // src/harness-github-actions.ts

package/dist/{index-g3gt62rm.js → index-8ksqhqmr.js}

@@ -9,7 +9,7 @@ import {
   runPromptSync,
   runSkillSync,
   upsertSkillManifestRecord
-} from "./cli-x1a56ws9.js";
+} from "./cli-3w6hbpr3.js";
 import {
   codingAgentDisplayName,
   describeCodingAgentEvent,
@@ -27,7 +27,7 @@ import {
   runHarnessCommand,
   startRemoteAnalyze,
   stripAnsi
-} from "./cli-g931ntph.js";
+} from "./cli-351a5yc4.js";
 import {
   selectTenantAndCreateKey
 } from "./cli-pq6rte0w.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.28.5",
+  "version": "1.29.0",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-08-27T02:29:51.059Z",
-  "cli_version": "1.28.5",
+  "bundled_at": "2026-08-28T23:14:50.005Z",
+  "cli_version": "1.29.0",
   "skills": [
     {
       "id": "integration-node-anthropic",