@moda-ai/cli 1.28.6 → 1.29.1

package/dist/{cli-793dhrgb.js → cli-5e0rd8mf.js}

@@ -124,7 +124,7 @@ function resetApiRequestCount() {
 }
 
 // src/harness-remote.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
 import { join as join3 } from "node:path";
 
 // src/markdown-terminal.ts
@@ -542,7 +542,7 @@ function createHarnessReport(options) {
     unknowns: limitedUnknowns
   };
 }
-function validateHarnessReport(report, rootDir) {
+function validateHarnessReport(report, rootDir, options) {
   const checks = [];
   const errors = [];
   const warnings = [];
@@ -713,6 +713,7 @@ function validateHarnessReport(report, rootDir) {
       }
     }
   }
+  validateDeterministicFloor(report, options?.deterministicFloor, check, warn);
   return {
     schemaVersion: HARNESS_REPORT_VALIDATION_SCHEMA_VERSION,
     reportId: report?.reportId ?? "unknown",
@@ -724,6 +725,27 @@ function validateHarnessReport(report, rootDir) {
     warnings
   };
 }
+function validateDeterministicFloor(report, floor, check, warn) {
+  if (!floor)
+    return;
+  if (process.env.MODA_HARNESS_FLOOR_CHECK === "0")
+    return;
+  const graph = isRecord(report?.graph) ? report.graph : {};
+  const toolArtifactCount = Array.isArray(graph.artifacts) ? graph.artifacts.filter((artifact) => isRecord(artifact) && artifact.type === "tool").length : 0;
+  const providerCount = safeArrayLength(graph.modelProviders);
+  const runtimeAgentCount = safeArrayLength(graph.runtimeAgents);
+  if (typeof floor.toolCandidates === "number" && floor.toolCandidates >= 5) {
+    const minimumTools = Math.ceil(0.5 * floor.toolCandidates);
+    check("floor_tools", toolArtifactCount >= minimumTools, `Deterministic scan found ${floor.toolCandidates} high-confidence tool definition candidate(s); the report graph must include at least ${minimumTools} tool artifact(s) but has ${toolArtifactCount}.`);
+  }
+  const providerPackages = Array.isArray(floor.providerPackages) ? floor.providerPackages.filter((name) => typeof name === "string" && name.length > 0) : [];
+  if (providerPackages.length > 0) {
+    check("floor_providers", providerCount > 0, `Manifest dependencies include model-provider package(s) ${providerPackages.join(", ")}, but the report graph.modelProviders is empty.`);
+  }
+  if (typeof floor.llmCallSites === "number" && floor.llmCallSites > 0 && runtimeAgentCount === 0) {
+    warn("floor_agents", `Deterministic scan found ${floor.llmCallSites} LLM call site(s) but the report graph.runtimeAgents is empty; sync will be blocked by the zero-agent gate.`);
+  }
+}
 async function approveHarnessReport(options) {
   const report = readHarnessReport(options.reportPath);
   const validation = validateHarnessReport(report, options.rootDir);
@@ -760,9 +782,9 @@ async function approveHarnessReport(options) {
   writeJson(join(options.rootDir, HARNESS_REPORT_APPROVAL_PATH), approval);
   return { report, validation, approval };
 }
-function loadHarnessReportForSync(rootDir, reportPath) {
+function loadHarnessReportForSync(rootDir, reportPath, options) {
   const report = readHarnessReport(reportPath);
-  const validation = validateHarnessReport(report, rootDir);
+  const validation = validateHarnessReport(report, rootDir, options);
   if (validation.status !== "pass") {
     throw new CliInputError("Harness report validation failed; cannot sync.", validation.errors.slice(0, 5).join(`
 `));
@@ -1157,7 +1179,7 @@ function firstEvidencePath(item) {
 function stampRemoteSnapshotTruncation(report) {
   const scanRecord = isRecord(report.graph.scan) ? report.graph.scan : {};
   const truncationReasons = Array.isArray(scanRecord.truncationReasons) ? scanRecord.truncationReasons.map(String) : [];
-  return {
+  const stamped = {
     ...report,
     graph: {
       ...report.graph,
@@ -1171,6 +1193,10 @@ function stampRemoteSnapshotTruncation(report) {
       }
     }
   };
+  if (stamped.source?.graphHash) {
+    stamped.source = { ...stamped.source, graphHash: hashStableJson(graphForReport(stamped.graph)) };
+  }
+  return stamped;
 }
 function requiresGraphItemConfidence(collection) {
   return collection !== "relationships" && collection !== "unknowns";
@@ -1753,11 +1779,11 @@ import {
   existsSync as existsSync3,
   lstatSync as lstatSync3,
   mkdirSync as mkdirSync3,
-  readFileSync as readFileSync3,
+  readFileSync as readFileSync4,
   readdirSync,
   writeFileSync as writeFileSync3
 } from "node:fs";
-import { basename as basename4, delimiter, dirname as dirname4, join as join2, relative as relative3, resolve as resolve4, sep } from "node:path";
+import { basename as basename4, delimiter, dirname as dirname4, join as join2, relative as relative3, resolve as resolve5, sep } from "node:path";
 import { confirm as confirm2, select } from "@inquirer/prompts";
 
 // src/analyst-tui.ts
@@ -2400,7 +2426,7 @@ var LINE_PATTERNS = [
     kind: "tool_definition",
     signal: "python.tool_decorator",
     confidence: "high",
-    pattern: /^\s*@(tool|function_tool|mcp\.tool|app\.tool)\b/,
+    pattern: /^\s*@(tool|function_tool|register_as_tool|\w+\.tool)\b/,
     extensions: PY
   },
   {
@@ -2764,6 +2790,173 @@ function writeHarnessCandidatesReport(report, outPath) {
   return target;
 }
 
+// src/harness-candidate-promotion.ts
+import { readFileSync as readFileSync3 } from "node:fs";
+import { resolve as resolve4 } from "node:path";
+var PROMOTED_CONFIDENCE = {
+  high: 0.85,
+  medium: 0.6
+};
+var MAX_DECORATOR_LOOKAHEAD_LINES = 12;
+var PY_DEF_NAME = /^\s*(?:async\s+)?def\s+([A-Za-z_]\w*)\s*\(/;
+var PY_CLASS_NAME = /\bclass\s+([A-Za-z_]\w*)\s*\(/;
+var JS_ASSIGNMENT_NAME = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=/;
+var JS_PROPERTY_NAME = /^\s*(?:public\s+|readonly\s+)?([A-Za-z_$][\w$]*)\s*:\s*(?:new\s+)?(?:[\w.$]*\.)?(?:tool|functionTool|createTool|dynamicTool|DynamicStructuredTool)\s*\(/;
+var JS_TRAILING_ASSIGNMENT_NAME = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:new\s+)?$/;
+var REGISTRY_CALL_NAME = /\b(?:register_tool|registerTool|add_tool)\s*\(\s*["']?([A-Za-z_$][\w$]*)/;
+var PROMPT_ASSIGNMENT_NAME = /^\s*(?:export\s+)?(?:(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*[:=]/;
+var MODEL_STRING = /["'`]([\w.:/-]*(?:gpt-|o[134](?:-mini)?\b|claude|gemini|llama|mistral|mixtral|deepseek|qwen|grok|sonnet|opus|haiku|command-r|glm|gemma)[\w.:/-]*)["'`]/i;
+function candidateEvidence(candidate) {
+  return [{
+    path: candidate.path,
+    line: candidate.startLine,
+    reason: `deterministic detector ${candidate.signal}`
+  }];
+}
+function pathStem(path) {
+  return path.replace(/\.[^.]+$/, "");
+}
+function readFileLines(rootDir, path, cache) {
+  const cached = cache.get(path);
+  if (cached !== undefined)
+    return cached;
+  let lines;
+  try {
+    lines = readFileSync3(resolve4(rootDir, path), "utf8").split(/\r?\n/);
+  } catch {
+    lines = null;
+  }
+  cache.set(path, lines);
+  return lines;
+}
+function extractToolName(candidate, lines) {
+  const line = lines[candidate.startLine - 1] ?? "";
+  if (candidate.signal === "python.tool_decorator") {
+    const end = Math.min(lines.length, candidate.startLine + MAX_DECORATOR_LOOKAHEAD_LINES);
+    for (let i = candidate.startLine;i < end; i += 1) {
+      const match = PY_DEF_NAME.exec(lines[i]);
+      if (match)
+        return match[1];
+    }
+    return;
+  }
+  if (candidate.signal === "python.base_tool_subclass") {
+    return PY_CLASS_NAME.exec(line)?.[1];
+  }
+  if (candidate.signal === "tool_registry.registration") {
+    return REGISTRY_CALL_NAME.exec(line)?.[1];
+  }
+  return JS_ASSIGNMENT_NAME.exec(line)?.[1] ?? JS_PROPERTY_NAME.exec(line)?.[1] ?? (candidate.startLine >= 2 ? JS_TRAILING_ASSIGNMENT_NAME.exec(lines[candidate.startLine - 2])?.[1] : undefined);
+}
+function promoteToolCandidate(candidate, rootDir, confidence, fileCache) {
+  const lines = readFileLines(rootDir, candidate.path, fileCache);
+  if (!lines)
+    return;
+  const name = extractToolName(candidate, lines);
+  if (!name)
+    return;
+  return {
+    id: stableId2("tool", `${candidate.path.replace(/\.[^./]+$/, "")}:${name}`),
+    type: "tool",
+    name: titleFromId2(name),
+    scope: "shared",
+    sourcePath: candidate.path,
+    usedByAgentIds: [],
+    confidence,
+    evidence: candidateEvidence(candidate),
+    body: extractToolBody({ path: candidate.path, rootDir }, { name, reason: candidate.signal })
+  };
+}
+function promotePromptFileCandidate(candidate, confidence) {
+  return {
+    id: stableId2("prompt", candidate.path),
+    type: "prompt",
+    name: promptNameFromPath(candidate.path),
+    scope: "shared",
+    sourcePath: candidate.path,
+    usedByAgentIds: [],
+    confidence,
+    evidence: candidateEvidence(candidate)
+  };
+}
+function promotePromptLiteralCandidate(candidate, rootDir, confidence, fileCache) {
+  const lines = readFileLines(rootDir, candidate.path, fileCache);
+  const assignedName = lines ? PROMPT_ASSIGNMENT_NAME.exec(lines[candidate.startLine - 1] ?? "")?.[1] ?? (candidate.startLine >= 2 ? PROMPT_ASSIGNMENT_NAME.exec(lines[candidate.startLine - 2] ?? "")?.[1] : undefined) : undefined;
+  return {
+    id: stableId2("prompt", `${pathStem(candidate.path)}:L${candidate.startLine}`),
+    type: "prompt",
+    name: assignedName ? titleFromId2(assignedName) : `Inline Prompt (${candidate.path}:${candidate.startLine})`,
+    scope: "shared",
+    usedByAgentIds: [],
+    confidence,
+    evidence: candidateEvidence(candidate)
+  };
+}
+function promoteModelConfigCandidate(candidate, rootDir, confidence, fileCache) {
+  const lines = readFileLines(rootDir, candidate.path, fileCache);
+  const sourceLine = lines?.[candidate.startLine - 1] ?? "";
+  const model = MODEL_STRING.exec(sourceLine)?.[1] ?? MODEL_STRING.exec(candidate.excerpt)?.[1];
+  if (!model)
+    return;
+  return {
+    id: stableId2("model_config", `${pathStem(candidate.path)}:L${candidate.startLine}`),
+    type: "model_config",
+    name: model,
+    scope: "shared",
+    usedByAgentIds: [],
+    confidence,
+    evidence: candidateEvidence(candidate)
+  };
+}
+function mergePromotedDuplicate(existing, next) {
+  for (const entry of next.evidence) {
+    const already = existing.evidence.some((candidate) => candidate.path === entry.path && candidate.line === entry.line && candidate.reason === entry.reason);
+    if (!already)
+      existing.evidence.push(entry);
+  }
+  existing.confidence = Math.max(existing.confidence, next.confidence);
+  if (!existing.body && next.body)
+    existing.body = next.body;
+}
+function promoteHarnessCandidates(report, rootDir) {
+  const fileCache = new Map;
+  const byId = new Map;
+  for (const candidate of report.candidates) {
+    const confidence = PROMOTED_CONFIDENCE[candidate.confidence];
+    if (confidence === undefined)
+      continue;
+    let artifact;
+    switch (candidate.kind) {
+      case "tool_definition":
+        artifact = promoteToolCandidate(candidate, rootDir, confidence, fileCache);
+        break;
+      case "prompt_file":
+        artifact = promotePromptFileCandidate(candidate, confidence);
+        break;
+      case "prompt_literal":
+        if (candidate.confidence === "high") {
+          artifact = promotePromptLiteralCandidate(candidate, rootDir, confidence, fileCache);
+        }
+        break;
+      case "model_config":
+        if (candidate.confidence === "high") {
+          artifact = promoteModelConfigCandidate(candidate, rootDir, confidence, fileCache);
+        }
+        break;
+      default:
+        break;
+    }
+    if (!artifact)
+      continue;
+    const existing = byId.get(artifact.id);
+    if (existing)
+      mergePromotedDuplicate(existing, artifact);
+    else
+      byId.set(artifact.id, artifact);
+  }
+  return [...byId.values()];
+}
+
 // src/harness-sync-limits.ts
 var MAX_HARNESS_SYNC_GRAPH_BYTES = 2000000;
 function assertHarnessGraphSyncSize(graph) {
@@ -3103,7 +3296,7 @@ var REPORT_JSON_END = "MODA_HARNESS_REPORT_JSON_END";
 var EXTERNAL_ANALYST_ADAPTERS = ["claude", "codex", "cursor"];
 async function runHarnessCommand(context) {
   const subcommand = context.positionals[0] ?? "scan";
-  const rootDir = resolve4(context.cwd, context.flags.path ?? ".");
+  const rootDir = resolve5(context.cwd, context.flags.path ?? ".");
   const selectedAgentId = selectedRuntimeAgentId(context.flags);
   const tenant = resolveHarnessTenant(context.flags, context);
   const scanPlan = buildCommandScanPlan(context, rootDir);
@@ -3148,7 +3341,9 @@ async function runHarnessCommand(context) {
       }
       if (context.flags["from-report"] || context.flags.report) {
         const reportPath = resolveHarnessReportPath(rootDir, context.flags["from-report"] ?? context.flags.report);
-        const { report, validation, approval, approved } = loadHarnessReportForSync(rootDir, reportPath);
+        const { report, validation, approval, approved } = loadHarnessReportForSync(rootDir, reportPath, {
+          deterministicFloor: computeDeterministicFloor(rootDir)
+        });
         const reportHash = hashHarnessReport(report);
         if (!approved && !context.dryRun) {
           throw new CliInputError("Harness report is not approved; refusing to sync.", "Run `moda harness validate-report`, review the report, then run `moda harness approve --yes` before syncing.");
@@ -3342,11 +3537,13 @@ async function runHarnessCommand(context) {
         elapsed_ms: Date.now() - context.startedAt
       });
       if (context.flags["github-actions"] === "true") {
-        const { runGithubActionsAnalyze } = await import("./harness-github-actions-wd1ahhxz.js");
+        const { runGithubActionsAnalyze } = await import("./harness-github-actions-dmy8fz54.js");
         const result = await runGithubActionsAnalyze(rootDir, {
           writeReport: (report2) => {
             const normalized = normalizeHarnessReport(report2);
-            const validation2 = validateHarnessReport(normalized, rootDir);
+            const validation2 = validateHarnessReport(normalized, rootDir, {
+              deterministicFloor: computeDeterministicFloor(rootDir)
+            });
             writeHarnessReportArtifacts({
               rootDir,
               report: normalized,
@@ -3434,7 +3631,9 @@ async function runHarnessCommand(context) {
     case "validate-report": {
       const reportPath = resolveHarnessReportPath(rootDir, context.positionals[1] ?? context.flags.report);
       const report = readHarnessReport(reportPath);
-      const validation = validateHarnessReport(report, rootDir);
+      const validation = validateHarnessReport(report, rootDir, {
+        deterministicFloor: computeDeterministicFloor(rootDir)
+      });
       if (!context.dryRun) {
         writeHarnessReportArtifacts({
           rootDir,
@@ -3479,7 +3678,7 @@ async function runHarnessCommand(context) {
         throw new CliInputError("Missing output path for --out.", "Usage: moda harness candidates --out=<file>");
       }
       if (outFlag && !context.dryRun) {
-        written.push(writeHarnessCandidatesReport(report, resolve4(context.cwd, outFlag)));
+        written.push(writeHarnessCandidatesReport(report, resolve5(context.cwd, outFlag)));
       }
       writeHumanProgress(context, `Harness candidates: ${report.stats.candidateCount} candidates across ${report.stats.filesWithCandidates} files (${report.stats.filesScanned} scanned, ${report.stats.filesPerSecond.toLocaleString()} files/sec).`);
       context.output.writeData({ scanPlan, ...report, written, dryRun: context.dryRun });
@@ -3740,7 +3939,9 @@ ${result.stderr}`, 1200);
       elapsed_ms: Date.now() - options.context.startedAt
     });
     analystTui?.setValidation("running");
-    const validation = validateHarnessReport(report, options.rootDir);
+    const validation = validateHarnessReport(report, options.rootDir, {
+      deterministicFloor: computeDeterministicFloor(options.rootDir)
+    });
     analystTui?.setValidation(validation.status === "pass" ? "pass" : "fail");
     if (!analystTui)
       writeHumanProgress(options.context, `Moda Analyst: validation ${validation.status}.`);
@@ -3790,7 +3991,7 @@ function buildExternalAnalystEnv(env) {
   return next;
 }
 function readExternalAnalystReport(rootDir, result, adapter) {
-  const reportPath = resolve4(rootDir, HARNESS_REPORT_PATH);
+  const reportPath = resolve5(rootDir, HARNESS_REPORT_PATH);
   if (existsSync3(reportPath))
     return repairExternalAnalystReport(readHarnessReport(reportPath), rootDir);
   const output = [
@@ -3805,7 +4006,7 @@ function readExternalAnalystReport(rootDir, result, adapter) {
     return parsed;
   let debugHint = "";
   try {
-    const debugPath = resolve4(rootDir, MODA_DIR, "analyst-debug.log");
+    const debugPath = resolve5(rootDir, MODA_DIR, "analyst-debug.log");
     mkdirSync3(dirname4(debugPath), { recursive: true });
     writeFileSync3(debugPath, [
       `# analyst=${adapter} status=${result.status} signal=${result.signal} timedOut=${result.timedOut} maxBufferExceeded=${result.maxBufferExceeded}`,
@@ -3865,10 +4066,96 @@ function parseHarnessReportCandidate(candidate) {
 function repairExternalAnalystReport(report, rootDir) {
   const normalized = normalizeHarnessReport(report);
   repairCitationLines(normalized, rootDir);
+  mergeDeterministicArtifacts(normalized.graph, rootDir);
   hydratePromptAndToolBodies(normalized.graph, rootDir);
+  deriveRelationshipsFromGraph(normalized.graph);
   repairReportSummaryCounts(normalized);
+  if (normalized.source?.graphHash) {
+    normalized.source.graphHash = hashStableJson(graphForReport(normalized.graph));
+  }
   return normalized;
 }
+function deriveRelationshipsFromGraph(graph) {
+  if (process.env.MODA_HARNESS_DERIVE_RELATIONSHIPS === "0")
+    return { added: 0 };
+  const agentIds = new Set(graph.runtimeAgents.map((agent) => agent.id));
+  const artifactsById = new Map(graph.artifacts.map((artifact) => [artifact.id, artifact]));
+  const seen = new Set(graph.relationships.map((rel) => `${rel.type}|${rel.from}|${rel.to}`));
+  let added = 0;
+  const push = (type, from, to, evidence) => {
+    const key = `${type}|${from}|${to}`;
+    if (seen.has(key))
+      return;
+    seen.add(key);
+    graph.relationships.push({ type, from, to, evidence });
+    added += 1;
+  };
+  for (const artifact of graph.artifacts) {
+    const evidence = artifact.evidence?.length ? [artifact.evidence[0]] : [{ path: artifact.sourcePath ?? ".", reason: "derived from artifact linkage fields" }];
+    if (artifact.ownedByAgentId && agentIds.has(artifact.ownedByAgentId)) {
+      push("owns_artifact", artifact.ownedByAgentId, artifact.id, evidence);
+    }
+    for (const agentId of artifact.usedByAgentIds ?? []) {
+      if (agentIds.has(agentId))
+        push("uses_artifact", agentId, artifact.id, evidence);
+    }
+  }
+  for (const agent of graph.runtimeAgents) {
+    for (const artifactId of agent.artifactIds ?? []) {
+      const artifact = artifactsById.get(artifactId);
+      if (!artifact)
+        continue;
+      const evidence = agent.evidence?.length ? [agent.evidence[0]] : [{ path: agent.root ?? ".", reason: "derived from agent artifactIds" }];
+      push("uses_artifact", agent.id, artifact.id, evidence);
+    }
+  }
+  return { added };
+}
+function mergeDeterministicArtifacts(graph, rootDir) {
+  if (process.env.MODA_HARNESS_DETERMINISTIC_MERGE === "0")
+    return { added: 0 };
+  let promoted;
+  try {
+    promoted = promoteHarnessCandidates(detectHarnessCandidates(rootDir), rootDir);
+  } catch {
+    return { added: 0 };
+  }
+  let added = 0;
+  for (const artifact of promoted) {
+    if (graphCoversPromotedArtifact(graph, artifact))
+      continue;
+    graph.artifacts.push(artifact);
+    added += 1;
+  }
+  return { added };
+}
+function artifactSourceKey(artifact) {
+  if (artifact.sourcePath)
+    return normalizePath3(artifact.sourcePath);
+  const pinned = Array.isArray(artifact.evidence) ? artifact.evidence.find((entry) => typeof entry.path === "string" && entry.path.length > 0) : undefined;
+  return pinned ? normalizePath3(pinned.path) : undefined;
+}
+function graphCoversPromotedArtifact(graph, promoted) {
+  const promotedName = promoted.name.toLowerCase();
+  const promotedLines = promoted.evidence.filter((entry) => typeof entry.line === "number");
+  const promotedSource = artifactSourceKey(promoted);
+  const isWholeFilePrompt = promoted.type === "prompt" && Boolean(promoted.sourcePath);
+  return graph.artifacts.some((existing) => {
+    if (existing.id === promoted.id)
+      return true;
+    if (existing.type === promoted.type && existing.name?.toLowerCase() === promotedName) {
+      const existingSource = artifactSourceKey(existing);
+      if (!existingSource || !promotedSource || existingSource === promotedSource)
+        return true;
+    }
+    if (existing.type === promoted.type && Array.isArray(existing.evidence) && existing.evidence.some((entry) => typeof entry.line === "number" && promotedLines.some((line) => line.path === entry.path && line.line === entry.line))) {
+      return true;
+    }
+    if (isWholeFilePrompt && existing.sourcePath === promoted.sourcePath)
+      return true;
+    return false;
+  });
+}
 function repairReportSummaryCounts(report) {
   const graph = report.graph;
   report.summary = {
@@ -3892,12 +4179,12 @@ function repairCitationLines(report, rootDir) {
     if (citation.type !== "file" && citation.type !== "generated_doc" || !citation.path || !citation.excerpt)
       continue;
     const excerpt = citation.excerpt;
-    const candidatePath = resolve4(rootDir, citation.path);
+    const candidatePath = resolve5(rootDir, citation.path);
     if (!existsSync3(candidatePath))
       continue;
     let text;
     try {
-      text = readFileSync3(candidatePath, "utf8");
+      text = readFileSync4(candidatePath, "utf8");
     } catch {
       continue;
     }
@@ -4524,6 +4811,7 @@ function renderExternalHarnessAnalystPrompt(options) {
     "Artifacts must include id, type, name, scope, usedByAgentIds, confidence, evidence, and optional sourcePath/contentHash/ownedByAgentId. Emit one artifact PER tool, PER prompt (including each inline system prompt), PER guardrail, and PER eval — enumerate them all; artifact types are entrypoint, prompt, tool, skill, eval, retrieval_index, memory, guardrail, model_config, unknown.",
     "Do NOT transcribe prompt/tool text into `body` when it exists verbatim in the repo — pin its exact location instead (sourcePath for a dedicated file, or evidence [{ path, line, reason }] at the definition line) and Moda hydrates `body` locally from that location after validation. Set `body` inline ONLY for content that cannot be recovered from one pinned location: dynamically assembled prompts, fragments concatenated at runtime, or values you had to derive. Short bodies for `guardrail` (the rule), `eval` (what it asserts), and `model_config` (the config values) are still welcome. Redact any secret literals.",
     "For every `prompt` and `tool` artifact, at least one evidence entry MUST pin an exact source location so downstream optimization can retrieve the item text: carry a numeric `line` (the definition line, or the first line of the range) — evidence: [{ path, line, reason }]. The only exception is an artifact whose entire dedicated file is the text (e.g. a standalone prompt file); set its sourcePath and cite that same file and no line is required. When a single file holds multiple inline prompts or tool definitions, give each its own distinct line — a bare { path, reason } is a defect there.",
+    "LINKAGE IS MANDATORY, not optional metadata: every artifact you author must carry usedByAgentIds naming each runtime agent that uses it (and ownedByAgentId when a single agent owns it), and every runtime agent's artifactIds must list its prompts, tools, and evals. Moda derives uses_artifact/owns_artifact edges from these fields after your run, so empty linkage means a disconnected map. Reserve explicit `relationships` entries for what linkage fields cannot express: covered_by_eval, runs_in_environment, invoked_by_channel, deployed_as, shares_artifact_with, resolves_identity_to, emits_telemetry.",
     "Agent families must include id, name, runtimeAgentIds, sharedArtifactIds, confidence, evidence.",
     "Frameworks/providers must include packageNames and runtimeAgentIds arrays; providers also include envVars and modelHints arrays.",
     "Unknowns in graph must include id, question, candidateIds, evidence. Report-level unknowns must include id, question, citationIds.",
@@ -4634,7 +4922,7 @@ function renderAnalystCandidateLines(report) {
   const lines = [
     "",
     `Deterministic candidate inventory (${report.candidates.length} candidates across ${report.stats.filesWithCandidates} files, scanned in ${report.stats.durationMs}ms):`,
-    "Each entry is path:line [detector] excerpt. Verify each candidate against the real file, then represent every confirmed tool/prompt/eval/model-config as a graph artifact pinned to that location. Candidates are pattern matches — drop false positives, and investigate what patterns cannot see (agent topology, relationships, prompts assembled at runtime). Do not cite this list as evidence; cite the files."
+    "Each entry is path:line [detector] excerpt. Candidates are pattern matches — verify each against the real file and drop false positives. Verified deterministic candidates are also auto-merged into the graph after your run, so prioritize (1) agents, topology, and relationships, (2) verifying or refuting these candidates (list refuted ones in unknowns), and (3) artifacts the patterns cannot see (runtime agents, prompts assembled at runtime, cross-file wiring) — rather than re-listing every candidate as an artifact. Do not cite this list as evidence; cite the files."
   ];
   for (const [kind, label] of Object.entries(SEED_CANDIDATE_KIND_LABELS)) {
     const bucket = byKind.get(kind);
@@ -4786,7 +5074,7 @@ function truncateText(value, maxLength) {
   return compact.length > maxLength ? `${compact.slice(0, maxLength - 1)}...` : compact;
 }
 function scanHarness(options = {}) {
-  const rootDir = resolve4(options.rootDir ?? process.cwd());
+  const rootDir = resolve5(options.rootDir ?? process.cwd());
   const skipped = [];
   const files = inventoryFiles(rootDir, skipped);
   const annotations = files.flatMap((file) => parseAnnotations(file));
@@ -4888,7 +5176,7 @@ function collectSnapshotInputs(rootDir, maxFiles, maxTextBytes) {
     let text = "";
     if (isTextFile(path)) {
       try {
-        text = readFileSync3(current, "utf8");
+        text = readFileSync4(current, "utf8");
         inventoryTextBytes += Buffer.byteLength(text, "utf8");
       } catch {
         return;
@@ -4901,7 +5189,7 @@ function collectSnapshotInputs(rootDir, maxFiles, maxTextBytes) {
   return inputs;
 }
 function buildSourceSnapshot(rootDir) {
-  const root = resolve4(rootDir);
+  const root = resolve5(rootDir);
   const maxFiles = numericEnv("MODA_HARNESS_MAX_FILES", DEFAULT_MAX_INVENTORY_FILES);
   const maxTextBytes = numericEnv("MODA_HARNESS_MAX_TEXT_BYTES", DEFAULT_MAX_INVENTORY_TEXT_BYTES);
   const inputs = collectSnapshotInputs(root, maxFiles, maxTextBytes);
@@ -5128,7 +5416,7 @@ function readHarnessSyncState(rootDir) {
   if (!existsSync3(path))
     return;
   try {
-    const parsed = JSON.parse(readFileSync3(path, "utf8"));
+    const parsed = JSON.parse(readFileSync4(path, "utf8"));
     if (!isRecord3(parsed) || parsed.schemaVersion !== "sync_state.v0.1") {
       return;
     }
@@ -5245,7 +5533,7 @@ function findFresherHarnessReports(rootDir) {
   return fresher.sort((a, b) => b.mtimeMs - a.mtimeMs);
 }
 function warnFresherSubdirHarnessReports(context, rootDir, explicitReport) {
-  const explicitReportPath = explicitReport && explicitReport !== "true" ? normalizePath3(relative3(rootDir, resolve4(rootDir, explicitReport))) : undefined;
+  const explicitReportPath = explicitReport && explicitReport !== "true" ? normalizePath3(relative3(rootDir, resolve5(rootDir, explicitReport))) : undefined;
   if (explicitReportPath && explicitReportPath !== normalizePath3(HARNESS_REPORT_PATH))
     return;
   let fresher;
@@ -5262,7 +5550,7 @@ function warnFresherSubdirHarnessReports(context, rootDir, explicitReport) {
   writeHarnessNotice(context, `A fresher harness report exists at ${newest.path} (this directory has ${rootState}). If you meant that report, re-run with --path=${subdir}.`);
 }
 function readHarnessGraph(manifestPath) {
-  return JSON.parse(readFileSync3(manifestPath, "utf8"));
+  return JSON.parse(readFileSync4(manifestPath, "utf8"));
 }
 function writeHarnessArtifacts(graph, rootDir, options = {}) {
   const modaDir = join2(rootDir, MODA_DIR);
@@ -5439,7 +5727,7 @@ function explainAgent(graph, agent) {
 }
 function inventoryFiles(rootDir, skipped, options = {}) {
   const files = [];
-  const rootReal = resolve4(rootDir);
+  const rootReal = resolve5(rootDir);
   const maxFiles = numericEnv("MODA_HARNESS_MAX_FILES", DEFAULT_MAX_INVENTORY_FILES);
   const maxTextBytes = numericEnv("MODA_HARNESS_MAX_TEXT_BYTES", DEFAULT_MAX_INVENTORY_TEXT_BYTES);
   let textBytes = 0;
@@ -5493,7 +5781,7 @@ function inventoryFiles(rootDir, skipped, options = {}) {
         recordSkipped(skipped, { path: rel, reason: "scan text budget exceeded" });
       } else {
         try {
-          item.text = readFileSync3(current, "utf8");
+          item.text = readFileSync4(current, "utf8");
           textBytes += Buffer.byteLength(item.text, "utf8");
         } catch {
           recordSkipped(skipped, { path: rel, reason: "text read failed" });
@@ -5800,7 +6088,7 @@ function maybeAddPromptArtifact(graph, file) {
   if (!isPrompt)
     return;
   const id = stableId2("prompt", file.path);
-  const text = file.text ?? readFileSync3(file.absPath, "utf8");
+  const text = file.text ?? readFileSync4(file.absPath, "utf8");
   upsertArtifact(graph, {
     id,
     type: "prompt",
@@ -6027,12 +6315,27 @@ function detectToolDefinitions(file) {
   const pyDecorated = /@function_tool[^\n]*\n(?:[ \t]*@[^\n]*\n)*[ \t]*(?:async[ \t]+)?def[ \t]+([A-Za-z_]\w*)/g;
   for (const match of text.matchAll(pyDecorated))
     found.set(match[1], "@function_tool-decorated function");
+  const pyToolDecorated = /@((?:[A-Za-z_]\w*\.)?tool|register_as_tool)\b[^\n]*\n(?:[ \t]*@[^\n]*\n)*[ \t]*(?:async[ \t]+)?def[ \t]+([A-Za-z_]\w*)/g;
+  for (const match of text.matchAll(pyToolDecorated))
+    found.set(match[2], `@${match[1]}-decorated function`);
+  const pyToolClass = /class[ \t]+([A-Za-z_]\w*)\s*\(\s*(?:[A-Za-z_]\w*\.)?(BaseTool|StructuredTool)\b/g;
+  for (const match of text.matchAll(pyToolClass))
+    found.set(match[1], `${match[2]} subclass`);
   const tsFactory = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:[\w.]*\.)?(?:tool|functionTool|createTool|dynamicTool)\s*\(/g;
   for (const match of text.matchAll(tsFactory))
     found.set(match[1], "tool factory assignment");
-  const tsNewTool = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*new\s+(?:Dynamic|Structured)?Tool\b/g;
+  const tsNewTool = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*new\s+(?:DynamicStructured|Dynamic|Structured)?Tool\b/g;
   for (const match of text.matchAll(tsNewTool))
     found.set(match[1], "tool constructor assignment");
+  const tsInlineToolCtor = /(?:^|[(,[]|return\s)\s*(?:new\s+)?(?:DynamicStructured|Dynamic|Structured)Tool\s*\(\s*\{[^{}]*?\bname\s*:\s*["'`]([\w .:-]+)["'`]/gm;
+  for (const match of text.matchAll(tsInlineToolCtor))
+    found.set(match[1], "tool constructor call");
+  const registryCall = /\b(register_tool|registerTool|add_tool|ToolRegistry)\s*\(\s*\[?\s*(?:name\s*=\s*)?(?:["']([\w .:-]+)["']|([A-Za-z_$][\w$]*))/g;
+  for (const match of text.matchAll(registryCall)) {
+    const name = match[2] ?? match[3];
+    if (name)
+      found.set(name, `${match[1]} registration`);
+  }
   for (const match of text.matchAll(HOSTED_TOOL_CALL))
     found.set(match[1], `hosted tool ${match[1]}`);
   return [...found.entries()].map(([name, reason]) => ({ name, reason }));
@@ -6048,7 +6351,7 @@ function maybeAddToolArtifact(graph, file) {
   for (const tool of tools) {
     const body = extractToolBody(file, tool);
     upsertArtifact(graph, {
-      id: stableId2("tool", `${file.path}:${tool.name}`),
+      id: stableId2("tool", `${file.path.replace(/\.[^./]+$/, "")}:${tool.name}`),
       type: "tool",
       name: titleFromId2(tool.name),
       scope: "agent",
@@ -6156,6 +6459,55 @@ var FRAMEWORK_CATALOG = [
     kind: "agent_framework",
     packageNames: ["pydantic-ai", "pydantic_ai"],
     patterns: [/pydantic_ai/i]
+  },
+  {
+    id: "framework_langgraph",
+    name: "LangGraph",
+    kind: "agent_framework",
+    packageNames: ["langgraph", "@langchain/langgraph"],
+    patterns: [/\blanggraph\b/i, /\bStateGraph\s*\(/]
+  },
+  {
+    id: "framework_autogen",
+    name: "AutoGen",
+    kind: "agent_framework",
+    packageNames: ["autogen", "pyautogen", "autogen-agentchat"],
+    patterns: [/\bautogen\b/i]
+  },
+  {
+    id: "framework_dspy",
+    name: "DSPy",
+    kind: "agent_framework",
+    packageNames: ["dspy", "dspy-ai"],
+    patterns: [/\bdspy\b/i]
+  },
+  {
+    id: "framework_semantic_kernel",
+    name: "Semantic Kernel",
+    kind: "agent_framework",
+    packageNames: ["semantic-kernel"],
+    patterns: [/semantic[-_]?kernel/i]
+  },
+  {
+    id: "framework_smolagents",
+    name: "Smolagents",
+    kind: "agent_framework",
+    packageNames: ["smolagents"],
+    patterns: [/\bsmolagents\b/i]
+  },
+  {
+    id: "framework_llama_index",
+    name: "LlamaIndex",
+    kind: "agent_framework",
+    packageNames: ["llama-index", "llamaindex"],
+    patterns: [/llama[-_]?index/i]
+  },
+  {
+    id: "framework_claude_agent_sdk",
+    name: "Claude Agent SDK",
+    kind: "agent_framework",
+    packageNames: ["@anthropic-ai/claude-agent-sdk", "claude-agent-sdk"],
+    patterns: [/claude[-_]agent[-_]sdk/i]
   }
 ];
 var PROVIDER_CATALOG = [
@@ -6206,6 +6558,46 @@ var PROVIDER_CATALOG = [
     packageNames: ["ollama"],
     envVars: ["OLLAMA_HOST"],
     patterns: [/\bollama\b/i]
+  },
+  {
+    id: "provider_litellm",
+    name: "LiteLLM",
+    kind: "model_provider",
+    packageNames: ["litellm"],
+    envVars: [],
+    patterns: [/\blitellm\b/i]
+  },
+  {
+    id: "provider_aws_bedrock",
+    name: "AWS Bedrock",
+    kind: "model_provider",
+    packageNames: ["@aws-sdk/client-bedrock-runtime"],
+    envVars: ["AWS_BEARER_TOKEN_BEDROCK"],
+    patterns: [/bedrock-runtime/i, /\bBedrockRuntimeClient\b/, /\bInvokeModelCommand\b/, /\binvoke_model\s*\(/]
+  },
+  {
+    id: "provider_openrouter",
+    name: "OpenRouter",
+    kind: "model_provider",
+    packageNames: ["openrouter", "@openrouter/ai-sdk-provider"],
+    envVars: ["OPENROUTER_API_KEY"],
+    patterns: [/openrouter\.ai/i, /\bopenrouter\b/i, /OPENROUTER_API_KEY/]
+  },
+  {
+    id: "provider_xai",
+    name: "xAI",
+    kind: "model_provider",
+    packageNames: ["xai-sdk"],
+    envVars: ["XAI_API_KEY"],
+    patterns: [/\bgrok-[\w.-]+/i, /api\.x\.ai/i, /XAI_API_KEY/]
+  },
+  {
+    id: "provider_groq",
+    name: "Groq",
+    kind: "model_provider",
+    packageNames: ["groq", "groq-sdk"],
+    envVars: ["GROQ_API_KEY"],
+    patterns: [/\bgroq\b/i]
   }
 ];
 function detectAgentFrameworks(files) {
@@ -6247,6 +6639,59 @@ function detectModelProviders(files) {
   }
   return providers.sort((a, b) => a.id.localeCompare(b.id));
 }
+function computeDeterministicFloor(rootDir) {
+  try {
+    const candidateReport = detectHarnessCandidates(rootDir);
+    let toolCandidates = 0;
+    let promptCandidates = 0;
+    let llmCallSites = 0;
+    for (const candidate of candidateReport.candidates) {
+      if (candidate.kind === "tool_definition" && candidate.confidence === "high") {
+        toolCandidates += 1;
+      } else if ((candidate.kind === "prompt_file" || candidate.kind === "prompt_literal") && candidate.confidence === "high") {
+        promptCandidates += 1;
+      } else if (candidate.kind === "llm_call_site") {
+        llmCallSites += 1;
+      }
+    }
+    return {
+      toolCandidates,
+      promptCandidates,
+      llmCallSites,
+      providerPackages: detectProviderPackagesInManifests(rootDir)
+    };
+  } catch {
+    return { toolCandidates: 0, promptCandidates: 0, llmCallSites: 0, providerPackages: [] };
+  }
+}
+function detectProviderPackagesInManifests(rootDir) {
+  const present = new Set;
+  const packageJsonPath = join2(rootDir, "package.json");
+  if (existsSync3(packageJsonPath)) {
+    try {
+      const deps = packageDependencyNames(readFileSync4(packageJsonPath, "utf8"));
+      for (const provider of PROVIDER_CATALOG) {
+        for (const name of provider.packageNames) {
+          if (deps.has(name))
+            present.add(name);
+        }
+      }
+    } catch {}
+  }
+  const pyprojectPath = join2(rootDir, "pyproject.toml");
+  if (existsSync3(pyprojectPath)) {
+    try {
+      const deps = pyprojectDependencyNames(readFileSync4(pyprojectPath, "utf8"));
+      for (const provider of PROVIDER_CATALOG) {
+        for (const name of provider.packageNames) {
+          if (deps.has(name.toLowerCase()))
+            present.add(name);
+        }
+      }
+    } catch {}
+  }
+  return [...present].sort();
+}
 function detectionEvidence(files, packageNames, patterns) {
   const evidence = [];
   for (const file of files) {
@@ -6328,7 +6773,7 @@ function pyprojectDependencyNames(text) {
 }
 function modelHintsForProvider(providerId, files) {
   const hints = new Set;
-  const pattern = providerId === "provider_anthropic" ? /\bclaude-[A-Za-z0-9_.-]+/g : providerId === "provider_openai" ? /\bgpt-[A-Za-z0-9_.-]+/g : providerId === "provider_google" ? /\bgemini-[A-Za-z0-9_.-]+/g : null;
+  const pattern = providerId === "provider_anthropic" ? /\bclaude-[A-Za-z0-9_.-]+/g : providerId === "provider_openai" ? /\bgpt-[A-Za-z0-9_.-]+/g : providerId === "provider_google" ? /\bgemini-[A-Za-z0-9_.-]+/g : providerId === "provider_xai" ? /\bgrok-[A-Za-z0-9_.-]+/g : null;
   if (!pattern)
     return [];
   for (const file of files) {
@@ -6619,7 +7064,7 @@ function upsertDeployment(graph, next) {
 }
 function contentHashForAnnotatedSource(sourcePath, annotation) {
   const bodyAnnotation = annotation;
-  const rootCandidate = resolve4(annotation.rootDir, sourcePath);
+  const rootCandidate = resolve5(annotation.rootDir, sourcePath);
   const candidates = [
     rootCandidate,
     ...annotatedSourceCandidates(sourcePath, bodyAnnotation).filter((c) => c !== rootCandidate)
@@ -6653,7 +7098,7 @@ function readSmallTextFileForHash(absPath, rootDir) {
   if (!isTextFile(rel))
     return;
   try {
-    return readFileSync3(absPath, "utf8");
+    return readFileSync4(absPath, "utf8");
   } catch {
     return;
   }
@@ -6773,7 +7218,7 @@ function readRemoteRunState(rootDir) {
   if (!existsSync4(path))
     return;
   try {
-    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    const parsed = JSON.parse(readFileSync5(path, "utf8"));
     if (!parsed || typeof parsed.run_id !== "string" || parsed.run_id.length === 0)
       return;
     return {
@@ -6928,7 +7373,9 @@ function finalizeRemoteAnalyzeResult(options) {
   if (options.snapshotTruncated) {
     report = stampRemoteSnapshotTruncation(report);
   }
-  const validation = validateHarnessReport(report, rootDir);
+  const validation = validateHarnessReport(report, rootDir, {
+    deterministicFloor: computeDeterministicFloor(rootDir)
+  });
   context.output.writeEvent({
     event: "progress",
     phase: "validation",

package/dist/{cli-n5qz81m0.js → cli-b2ktsnmh.js}

@@ -11,7 +11,7 @@ import {
   renderStatusHuman,
   scanHarness,
   validateHarnessReport
-} from "./cli-793dhrgb.js";
+} from "./cli-5e0rd8mf.js";
 import {
   isAuthSessionValid,
   loadAuthSession

package/dist/cli.js

@@ -8,7 +8,7 @@ import {
   runPromptsCommand,
   runSkillsCommand,
   runStatusCommand
-} from "./cli-n5qz81m0.js";
+} from "./cli-b2ktsnmh.js";
 import {
   ApiError,
   HARNESS_REPORT_APPROVAL_PATH,
@@ -29,7 +29,7 @@ import {
   summarizeHarness,
   terminalStyles,
   validateHarnessReport
-} from "./cli-793dhrgb.js";
+} from "./cli-5e0rd8mf.js";
 import {
   authFetch,
   clearAuthSession,
@@ -6496,7 +6496,7 @@ var commandRegistry = createCommandRegistry([
     resetApiRequestCountBeforeRun: true,
     telemetry: "result",
     handler: async (context) => {
-      const { runInit } = await import("./index-djg29jhz.js");
+      const { runInit } = await import("./index-6twsawta.js");
       if (context.outputMode === "agent-stream") {
         context.output.writeEvent({
           event: "started",

package/dist/{harness-github-actions-wd1ahhxz.js → harness-github-actions-dmy8fz54.js}

@@ -1,6 +1,6 @@
 import {
   buildSourceSnapshot
-} from "./cli-793dhrgb.js";
+} from "./cli-5e0rd8mf.js";
 import"./cli-59yacef3.js";
 
 // src/harness-github-actions.ts

package/dist/{index-djg29jhz.js → index-6twsawta.js}

@@ -9,7 +9,7 @@ import {
   runPromptSync,
   runSkillSync,
   upsertSkillManifestRecord
-} from "./cli-n5qz81m0.js";
+} from "./cli-b2ktsnmh.js";
 import {
   codingAgentDisplayName,
   describeCodingAgentEvent,
@@ -27,7 +27,7 @@ import {
   runHarnessCommand,
   startRemoteAnalyze,
   stripAnsi
-} from "./cli-793dhrgb.js";
+} from "./cli-5e0rd8mf.js";
 import {
   selectTenantAndCreateKey
 } from "./cli-pq6rte0w.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.28.6",
+  "version": "1.29.1",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-08-28T19:57:51.453Z",
-  "cli_version": "1.28.6",
+  "bundled_at": "2026-08-29T04:58:53.183Z",
+  "cli_version": "1.29.1",
   "skills": [
     {
       "id": "integration-node-anthropic",