@moda-ai/cli 1.29.0 → 1.29.1

package/dist/{cli-351a5yc4.js → cli-5e0rd8mf.js}

@@ -1179,7 +1179,7 @@ function firstEvidencePath(item) {
 function stampRemoteSnapshotTruncation(report) {
   const scanRecord = isRecord(report.graph.scan) ? report.graph.scan : {};
   const truncationReasons = Array.isArray(scanRecord.truncationReasons) ? scanRecord.truncationReasons.map(String) : [];
-  return {
+  const stamped = {
     ...report,
     graph: {
       ...report.graph,
@@ -1193,6 +1193,10 @@ function stampRemoteSnapshotTruncation(report) {
       }
     }
   };
+  if (stamped.source?.graphHash) {
+    stamped.source = { ...stamped.source, graphHash: hashStableJson(graphForReport(stamped.graph)) };
+  }
+  return stamped;
 }
 function requiresGraphItemConfidence(collection) {
   return collection !== "relationships" && collection !== "unknowns";
@@ -3533,7 +3537,7 @@ async function runHarnessCommand(context) {
         elapsed_ms: Date.now() - context.startedAt
       });
       if (context.flags["github-actions"] === "true") {
-        const { runGithubActionsAnalyze } = await import("./harness-github-actions-p8xa3akx.js");
+        const { runGithubActionsAnalyze } = await import("./harness-github-actions-dmy8fz54.js");
         const result = await runGithubActionsAnalyze(rootDir, {
           writeReport: (report2) => {
             const normalized = normalizeHarnessReport(report2);
@@ -4064,9 +4068,49 @@ function repairExternalAnalystReport(report, rootDir) {
   repairCitationLines(normalized, rootDir);
   mergeDeterministicArtifacts(normalized.graph, rootDir);
   hydratePromptAndToolBodies(normalized.graph, rootDir);
+  deriveRelationshipsFromGraph(normalized.graph);
   repairReportSummaryCounts(normalized);
+  if (normalized.source?.graphHash) {
+    normalized.source.graphHash = hashStableJson(graphForReport(normalized.graph));
+  }
   return normalized;
 }
+function deriveRelationshipsFromGraph(graph) {
+  if (process.env.MODA_HARNESS_DERIVE_RELATIONSHIPS === "0")
+    return { added: 0 };
+  const agentIds = new Set(graph.runtimeAgents.map((agent) => agent.id));
+  const artifactsById = new Map(graph.artifacts.map((artifact) => [artifact.id, artifact]));
+  const seen = new Set(graph.relationships.map((rel) => `${rel.type}|${rel.from}|${rel.to}`));
+  let added = 0;
+  const push = (type, from, to, evidence) => {
+    const key = `${type}|${from}|${to}`;
+    if (seen.has(key))
+      return;
+    seen.add(key);
+    graph.relationships.push({ type, from, to, evidence });
+    added += 1;
+  };
+  for (const artifact of graph.artifacts) {
+    const evidence = artifact.evidence?.length ? [artifact.evidence[0]] : [{ path: artifact.sourcePath ?? ".", reason: "derived from artifact linkage fields" }];
+    if (artifact.ownedByAgentId && agentIds.has(artifact.ownedByAgentId)) {
+      push("owns_artifact", artifact.ownedByAgentId, artifact.id, evidence);
+    }
+    for (const agentId of artifact.usedByAgentIds ?? []) {
+      if (agentIds.has(agentId))
+        push("uses_artifact", agentId, artifact.id, evidence);
+    }
+  }
+  for (const agent of graph.runtimeAgents) {
+    for (const artifactId of agent.artifactIds ?? []) {
+      const artifact = artifactsById.get(artifactId);
+      if (!artifact)
+        continue;
+      const evidence = agent.evidence?.length ? [agent.evidence[0]] : [{ path: agent.root ?? ".", reason: "derived from agent artifactIds" }];
+      push("uses_artifact", agent.id, artifact.id, evidence);
+    }
+  }
+  return { added };
+}
 function mergeDeterministicArtifacts(graph, rootDir) {
   if (process.env.MODA_HARNESS_DETERMINISTIC_MERGE === "0")
     return { added: 0 };
@@ -4767,6 +4811,7 @@ function renderExternalHarnessAnalystPrompt(options) {
     "Artifacts must include id, type, name, scope, usedByAgentIds, confidence, evidence, and optional sourcePath/contentHash/ownedByAgentId. Emit one artifact PER tool, PER prompt (including each inline system prompt), PER guardrail, and PER eval — enumerate them all; artifact types are entrypoint, prompt, tool, skill, eval, retrieval_index, memory, guardrail, model_config, unknown.",
     "Do NOT transcribe prompt/tool text into `body` when it exists verbatim in the repo — pin its exact location instead (sourcePath for a dedicated file, or evidence [{ path, line, reason }] at the definition line) and Moda hydrates `body` locally from that location after validation. Set `body` inline ONLY for content that cannot be recovered from one pinned location: dynamically assembled prompts, fragments concatenated at runtime, or values you had to derive. Short bodies for `guardrail` (the rule), `eval` (what it asserts), and `model_config` (the config values) are still welcome. Redact any secret literals.",
     "For every `prompt` and `tool` artifact, at least one evidence entry MUST pin an exact source location so downstream optimization can retrieve the item text: carry a numeric `line` (the definition line, or the first line of the range) — evidence: [{ path, line, reason }]. The only exception is an artifact whose entire dedicated file is the text (e.g. a standalone prompt file); set its sourcePath and cite that same file and no line is required. When a single file holds multiple inline prompts or tool definitions, give each its own distinct line — a bare { path, reason } is a defect there.",
+    "LINKAGE IS MANDATORY, not optional metadata: every artifact you author must carry usedByAgentIds naming each runtime agent that uses it (and ownedByAgentId when a single agent owns it), and every runtime agent's artifactIds must list its prompts, tools, and evals. Moda derives uses_artifact/owns_artifact edges from these fields after your run, so empty linkage means a disconnected map. Reserve explicit `relationships` entries for what linkage fields cannot express: covered_by_eval, runs_in_environment, invoked_by_channel, deployed_as, shares_artifact_with, resolves_identity_to, emits_telemetry.",
     "Agent families must include id, name, runtimeAgentIds, sharedArtifactIds, confidence, evidence.",
     "Frameworks/providers must include packageNames and runtimeAgentIds arrays; providers also include envVars and modelHints arrays.",
     "Unknowns in graph must include id, question, candidateIds, evidence. Report-level unknowns must include id, question, citationIds.",

package/dist/{cli-3w6hbpr3.js → cli-b2ktsnmh.js}

@@ -11,7 +11,7 @@ import {
   renderStatusHuman,
   scanHarness,
   validateHarnessReport
-} from "./cli-351a5yc4.js";
+} from "./cli-5e0rd8mf.js";
 import {
   isAuthSessionValid,
   loadAuthSession

package/dist/cli.js

@@ -8,7 +8,7 @@ import {
   runPromptsCommand,
   runSkillsCommand,
   runStatusCommand
-} from "./cli-3w6hbpr3.js";
+} from "./cli-b2ktsnmh.js";
 import {
   ApiError,
   HARNESS_REPORT_APPROVAL_PATH,
@@ -29,7 +29,7 @@ import {
   summarizeHarness,
   terminalStyles,
   validateHarnessReport
-} from "./cli-351a5yc4.js";
+} from "./cli-5e0rd8mf.js";
 import {
   authFetch,
   clearAuthSession,
@@ -6496,7 +6496,7 @@ var commandRegistry = createCommandRegistry([
     resetApiRequestCountBeforeRun: true,
     telemetry: "result",
     handler: async (context) => {
-      const { runInit } = await import("./index-8ksqhqmr.js");
+      const { runInit } = await import("./index-6twsawta.js");
       if (context.outputMode === "agent-stream") {
         context.output.writeEvent({
           event: "started",

package/dist/{harness-github-actions-p8xa3akx.js → harness-github-actions-dmy8fz54.js}

@@ -1,6 +1,6 @@
 import {
   buildSourceSnapshot
-} from "./cli-351a5yc4.js";
+} from "./cli-5e0rd8mf.js";
 import"./cli-59yacef3.js";
 
 // src/harness-github-actions.ts

package/dist/{index-8ksqhqmr.js → index-6twsawta.js}

@@ -9,7 +9,7 @@ import {
   runPromptSync,
   runSkillSync,
   upsertSkillManifestRecord
-} from "./cli-3w6hbpr3.js";
+} from "./cli-b2ktsnmh.js";
 import {
   codingAgentDisplayName,
   describeCodingAgentEvent,
@@ -27,7 +27,7 @@ import {
   runHarnessCommand,
   startRemoteAnalyze,
   stripAnsi
-} from "./cli-351a5yc4.js";
+} from "./cli-5e0rd8mf.js";
 import {
   selectTenantAndCreateKey
 } from "./cli-pq6rte0w.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.29.0",
+  "version": "1.29.1",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-08-28T23:14:50.005Z",
-  "cli_version": "1.29.0",
+  "bundled_at": "2026-08-29T04:58:53.183Z",
+  "cli_version": "1.29.1",
   "skills": [
     {
       "id": "integration-node-anthropic",