@moda-ai/cli 1.30.1 → 1.31.1

package/dist/{cli-js4bmw21.js → cli-p3271yp2.js}

@@ -284,6 +284,7 @@ var HARNESS_REPORT_PATH = join(".moda", "harness-report.json");
 var HARNESS_REPORT_MARKDOWN_PATH = join(".moda", "HARNESS_REPORT.md");
 var HARNESS_REPORT_VALIDATION_PATH = join(".moda", "harness-report-validation.json");
 var HARNESS_REPORT_APPROVAL_PATH = join(".moda", "harness-report-approval.json");
+var HARNESS_ANALYZE_CONCERNS = ["topology", "tools", "prompts", "evals"];
 var HARNESS_GRAPH_ARRAY_FIELDS = [
   "agentFamilies",
   "runtimeAgents",
@@ -713,7 +714,7 @@ function validateHarnessReport(report, rootDir, options) {
       }
     }
   }
-  validateDeterministicFloor(report, options?.deterministicFloor, check, warn);
+  validateDeterministicFloor(report, options?.deterministicFloor, check, warn, options?.concern);
   return {
     schemaVersion: HARNESS_REPORT_VALIDATION_SCHEMA_VERSION,
     reportId: report?.reportId ?? "unknown",
@@ -725,24 +726,26 @@ function validateHarnessReport(report, rootDir, options) {
     warnings
   };
 }
-function validateDeterministicFloor(report, floor, check, warn) {
+function validateDeterministicFloor(report, floor, check, warn, concern) {
   if (!floor)
     return;
   if (process.env.MODA_HARNESS_FLOOR_CHECK === "0")
     return;
+  const applyToolFloor = concern === undefined || concern === "tools";
+  const applyTopologyFloors = concern === undefined || concern === "topology";
   const graph = isRecord(report?.graph) ? report.graph : {};
   const toolArtifactCount = Array.isArray(graph.artifacts) ? graph.artifacts.filter((artifact) => isRecord(artifact) && artifact.type === "tool").length : 0;
   const providerCount = safeArrayLength(graph.modelProviders);
   const runtimeAgentCount = safeArrayLength(graph.runtimeAgents);
-  if (typeof floor.toolCandidates === "number" && floor.toolCandidates >= 5) {
+  if (applyToolFloor && typeof floor.toolCandidates === "number" && floor.toolCandidates >= 5) {
     const minimumTools = Math.ceil(0.5 * floor.toolCandidates);
     check("floor_tools", toolArtifactCount >= minimumTools, `Deterministic scan found ${floor.toolCandidates} high-confidence tool definition candidate(s); the report graph must include at least ${minimumTools} tool artifact(s) but has ${toolArtifactCount}.`);
   }
   const providerPackages = Array.isArray(floor.providerPackages) ? floor.providerPackages.filter((name) => typeof name === "string" && name.length > 0) : [];
-  if (providerPackages.length > 0) {
+  if (applyTopologyFloors && providerPackages.length > 0) {
     check("floor_providers", providerCount > 0, `Manifest dependencies include model-provider package(s) ${providerPackages.join(", ")}, but the report graph.modelProviders is empty.`);
   }
-  if (typeof floor.llmCallSites === "number" && floor.llmCallSites > 0 && runtimeAgentCount === 0) {
+  if (applyTopologyFloors && typeof floor.llmCallSites === "number" && floor.llmCallSites > 0 && runtimeAgentCount === 0) {
     warn("floor_agents", `Deterministic scan found ${floor.llmCallSites} LLM call site(s) but the report graph.runtimeAgents is empty; sync will be blocked by the zero-agent gate.`);
   }
 }
@@ -1651,7 +1654,7 @@ function citationExcerptMatches(expected, actualLine) {
   return expectedNormalized.includes(actualNormalized) || actualNormalized.includes(expectedNormalized);
 }
 function normalizeComparableText(value) {
-  return value.replace(/\s+/g, " ").trim().slice(0, 240);
+  return value.replace(/\s+/g, " ").trim();
 }
 function validateCitation(citation, rootDir, errors, warnings, options) {
   if (citation.type === "command_output" || citation.type === "production_evidence") {
@@ -2973,7 +2976,6 @@ function assertHarnessGraphSyncSize(graph) {
 `));
   }
 }
-
 // src/tui.ts
 var STATUS_LABELS = {
   pass: "ok",
@@ -3524,6 +3526,13 @@ async function runHarnessCommand(context) {
         writeHumanProgress(context, "moda harness analyze is disabled: connect the Moda GitHub App (Settings → Integrations) for automatic analysis, or pass --experimental to run the CLI analyze.");
         return { exitCode: 1 };
       }
+      const concern = resolveHarnessAnalyzeConcern(context.flags, context.env);
+      if (concern) {
+        const unsupported = context.flags["github-actions"] === "true" ? "--github-actions" : isRemoteHarnessAnalyze(context) ? "hosted (--remote) analysis" : await resolveHarnessAnalystAdapter(context) === "local-scan" ? "--analyst=local-scan" : "";
+        if (unsupported) {
+          throw new CliInputError(`--concern=${concern} is not supported by ${unsupported}.`, "Concern scoping narrows the analyst prompt and gates deterministic seeds, promotion, and floors, which only the local coding-agent analyst does today. Drop --concern, or run with --analyst=claude|codex|cursor.");
+        }
+      }
       await approveScanIfNeeded(scanPlan, {
         context,
         message: "Run Moda Analyst to investigate this project and produce a cited harness report?",
@@ -3537,7 +3546,7 @@ async function runHarnessCommand(context) {
         elapsed_ms: Date.now() - context.startedAt
       });
       if (context.flags["github-actions"] === "true") {
-        const { runGithubActionsAnalyze } = await import("./harness-github-actions-v98snak8.js");
+        const { runGithubActionsAnalyze } = await import("./harness-github-actions-kbw4z7q4.js");
         const result = await runGithubActionsAnalyze(rootDir, {
           writeReport: (report2) => {
             const normalized = normalizeHarnessReport(report2);
@@ -3565,7 +3574,8 @@ async function runHarnessCommand(context) {
           rootDir,
           scanPlan,
           tenant,
-          adapter: analyst
+          adapter: analyst,
+          concern
         });
       }
       context.output.writeEvent({
@@ -3838,7 +3848,8 @@ async function runExternalHarnessAnalyst(options) {
   const prompt = renderExternalHarnessAnalystPrompt({
     adapter: options.adapter,
     rootDir: options.rootDir,
-    tenantId: options.tenant?.tenantId
+    tenantId: options.tenant?.tenantId,
+    concern: options.concern
   });
   const streamAnalystProgress = options.context.outputMode === "agent-stream";
   const invocation = resolveExternalHarnessAnalystInvocation({
@@ -3924,7 +3935,7 @@ async function runExternalHarnessAnalyst(options) {
 ${result.stderr}`, 1200);
       throw new CliInputError(`Harness analyst ${options.adapter} exited with status ${result.status ?? "unknown"}.`, output || "Rerun with the selected coding agent CLI fixed, or choose another analyst with `--analyst=claude|codex|cursor`.");
     }
-    const report = readExternalAnalystReport(options.rootDir, result, options.adapter);
+    const report = readExternalAnalystReport(options.rootDir, result, options.adapter, options.concern);
     analystTui?.setSummary({
       runtimeAgentCount: report.graph.runtimeAgents.length,
       agentFamilyCount: report.graph.agentFamilies.length,
@@ -3943,7 +3954,8 @@ ${result.stderr}`, 1200);
     });
     analystTui?.setValidation("running");
     const validation = validateHarnessReport(report, options.rootDir, {
-      deterministicFloor: computeDeterministicFloor(options.rootDir)
+      deterministicFloor: computeDeterministicFloor(options.rootDir),
+      concern: options.concern
     });
     analystTui?.setValidation(validation.status === "pass" ? "pass" : "fail");
     if (!analystTui)
@@ -3993,10 +4005,10 @@ function buildExternalAnalystEnv(env) {
   }
   return next;
 }
-function readExternalAnalystReport(rootDir, result, adapter) {
+function readExternalAnalystReport(rootDir, result, adapter, concern) {
   const reportPath = resolve5(rootDir, HARNESS_REPORT_PATH);
   if (existsSync3(reportPath))
-    return repairExternalAnalystReport(readHarnessReport(reportPath), rootDir);
+    return repairExternalAnalystReport(readHarnessReport(reportPath), rootDir, { concern });
   const output = [
     result.stdout,
     result.stderr,
@@ -4004,7 +4016,7 @@ function readExternalAnalystReport(rootDir, result, adapter) {
     extractAgentTextFromOutput(result.stderr)
   ].filter(Boolean).join(`
 `);
-  const parsed = extractHarnessReportFromText(output, rootDir);
+  const parsed = extractHarnessReportFromText(output, rootDir, concern);
   if (parsed)
     return parsed;
   let debugHint = "";
@@ -4028,11 +4040,11 @@ function readExternalAnalystReport(rootDir, result, adapter) {
   ].filter(Boolean).join(`
 `));
 }
-function extractHarnessReportFromText(output, rootDir) {
+function extractHarnessReportFromText(output, rootDir, concern) {
   for (const candidate of reportJsonCandidates(output)) {
     const parsed = parseHarnessReportCandidate(candidate);
     if (parsed)
-      return repairExternalAnalystReport(parsed, rootDir);
+      return repairExternalAnalystReport(parsed, rootDir, { concern });
   }
   return;
 }
@@ -4066,13 +4078,32 @@ function parseHarnessReportCandidate(candidate) {
   }
   return;
 }
-function repairExternalAnalystReport(report, rootDir) {
+function repairExternalAnalystReport(report, rootDir, options = {}) {
   const normalized = normalizeHarnessReport(report);
   repairCitationLines(normalized, rootDir);
-  mergeDeterministicArtifacts(normalized.graph, rootDir);
+  mergeDeterministicArtifacts(normalized.graph, rootDir, { concern: options.concern });
   hydratePromptAndToolBodies(normalized.graph, rootDir);
   deriveRelationshipsFromGraph(normalized.graph);
   repairReportSummaryCounts(normalized);
+  if (options.concern) {
+    normalized.source = {
+      ...normalized.source ?? {
+        graphSchemaVersion: normalized.graph?.schemaVersion ?? SCHEMA_VERSION,
+        graphHash: "",
+        readPlan: normalized.graph?.scan?.readPlan ?? {
+          scope: "broad",
+          rootPaths: ["."],
+          willRead: [],
+          willSkip: [],
+          skipsSecretFiles: true,
+          followsSymlinks: false,
+          uploadsSourceByDefault: false
+        },
+        deterministicInventory: false
+      },
+      concern: options.concern
+    };
+  }
   if (normalized.source?.graphHash) {
     normalized.source.graphHash = hashStableJson(graphForReport(normalized.graph));
   }
@@ -4114,9 +4145,18 @@ function deriveRelationshipsFromGraph(graph) {
   }
   return { added };
 }
-function mergeDeterministicArtifacts(graph, rootDir) {
+var CONCERN_PROMOTED_ARTIFACT_TYPES = {
+  topology: new Set,
+  tools: new Set(["tool"]),
+  prompts: new Set(["prompt"]),
+  evals: new Set(["model_config"])
+};
+function mergeDeterministicArtifacts(graph, rootDir, options = {}) {
   if (process.env.MODA_HARNESS_DETERMINISTIC_MERGE === "0")
     return { added: 0 };
+  if (options.concern === "topology")
+    return { added: 0 };
+  const allowedTypes = options.concern ? CONCERN_PROMOTED_ARTIFACT_TYPES[options.concern] : undefined;
   let promoted;
   try {
     promoted = promoteHarnessCandidates(detectHarnessCandidates(rootDir), rootDir);
@@ -4125,6 +4165,8 @@ function mergeDeterministicArtifacts(graph, rootDir) {
   }
   let added = 0;
   for (const artifact of promoted) {
+    if (allowedTypes && !allowedTypes.has(artifact.type))
+      continue;
     if (graphCoversPromotedArtifact(graph, artifact))
       continue;
     graph.artifacts.push(artifact);
@@ -4195,9 +4237,22 @@ function repairCitationLines(report, rootDir) {
     const currentLine = typeof citation.line === "number" ? lines[citation.line - 1] : undefined;
     if (currentLine && citationLineMatches(currentLine, excerpt))
       continue;
-    const matchedIndex = lines.findIndex((line) => citationLineMatches(line, excerpt));
-    if (matchedIndex >= 0)
-      citation.line = matchedIndex + 1;
+    const needle = normalizeComparableLine(excerpt);
+    if (!needle)
+      continue;
+    const sourceLines = lines.map((line, index) => ({ text: normalizeComparableLine(line), index })).filter((line) => line.text.length > 0);
+    const source = sourceLines.map((line) => line.text).join(" ");
+    const match = source.indexOf(needle);
+    if (match < 0 || source.indexOf(needle, match + 1) >= 0)
+      continue;
+    let offset = 0;
+    for (const line of sourceLines) {
+      if (match >= offset && match < offset + line.text.length) {
+        citation.line = line.index + 1;
+        break;
+      }
+      offset += line.text.length + 1;
+    }
   }
 }
 function citationLineMatches(line, excerpt) {
@@ -4661,6 +4716,17 @@ function isDeterministicLocalAnalyst(raw) {
   const value = raw?.trim().toLowerCase();
   return value === "local-scan" || value === "local" || value === "scripted" || value === "moda";
 }
+function resolveHarnessAnalyzeConcern(flags, env = process.env) {
+  const flagValue = flags.concern && flags.concern !== "true" ? flags.concern : undefined;
+  const raw = flagValue ?? env.MODA_HARNESS_CONCERN;
+  const value = raw?.trim().toLowerCase();
+  if (!value)
+    return;
+  if (HARNESS_ANALYZE_CONCERNS.includes(value)) {
+    return value;
+  }
+  throw new CliInputError(`Unknown harness analyze concern '${raw}'. Valid concerns: ${HARNESS_ANALYZE_CONCERNS.join("|")}.`, `Use --concern=${HARNESS_ANALYZE_CONCERNS.join("|")} (or MODA_HARNESS_CONCERN; the flag wins).`);
+}
 function normalizeAnalystAdapter(raw) {
   const value = (raw && raw !== "true" ? raw : "auto").trim().toLowerCase();
   if (value === "auto")
@@ -4692,7 +4758,7 @@ function resolveExternalHarnessAnalystInvocation(options) {
   if (options.adapter === "claude") {
     const extraArgs = externalAnalystExtraArgs(options.adapter);
     const model = resolveAnalystModel(options.adapter, options.flags);
-    const permission = mode === "write" ? ["--permission-mode", "acceptEdits", "--allowedTools", "Read,Grep,Glob,Edit,Write,Bash"] : ["--allowedTools", `Read,Grep,Glob,Write(${HARNESS_REPORT_PATH}),Bash(pwd),Bash(ls *),Bash(find *),Bash(rg *),Bash(grep *),Bash(cat *),Bash(git status *),Bash(git ls-files *),Bash(git grep *)`];
+    const permission = mode === "write" ? ["--permission-mode", "acceptEdits", "--allowedTools", "Read,Grep,Glob,Edit,Write,Bash"] : ["--allowedTools", `Read,Grep,Glob,Edit(${HARNESS_REPORT_PATH}),Bash(pwd),Bash(ls *),Bash(find *),Bash(rg *),Bash(grep *),Bash(cat *),Bash(git status *),Bash(git ls-files *),Bash(git grep *)`];
     return {
       adapter: options.adapter,
       command,
@@ -4798,9 +4864,100 @@ function resolveAnalystModel(adapter, flags) {
     return raw;
   return adapter === "claude" ? DEFAULT_CLAUDE_ANALYST_MODEL : undefined;
 }
+var CONCERN_AGENT_STUB_LINE = 'Runtime agents may be represented ONLY as bare low-confidence stubs when linkage needs a target: id, name, kind:"runtime_agent", root, confidence, evidence — nothing more. Do not investigate agent topology beyond that; the topology concern pass owns it.';
+var CONCERN_LOCATION_PIN_LINE = "Every artifact you author MUST pin an exact source location so downstream optimization can retrieve the item text: carry a numeric `line` on at least one evidence entry (evidence: [{ path, line, reason }]) at the definition line. The only exception is an artifact whose entire dedicated file is the text — set its sourcePath and cite that file, no line required. When a single file holds multiple inline definitions, give each artifact its own distinct line.";
+var CONCERN_NO_TRANSCRIPTION_LINE = "Do NOT transcribe prompt/tool text into `body` when it exists verbatim in the repo — pin its exact location instead and Moda hydrates `body` locally after validation. Set `body` inline ONLY for content that cannot be recovered from one pinned location (e.g. fragments assembled at runtime). Redact any secret literals.";
+var CONCERN_CAPS_LINE = "- Keep going until every in-concern item is represented as an artifact. Respect the hard caps (<=250 claims, <=400 citations): artifacts are uncapped, so keep enumerating them as artifacts and reserve claims/citations for the most important ones.";
+var CONCERN_PROMPT_SPECS = {
+  topology: {
+    mission: "Your single concern for this pass is TOPOLOGY: the agents and the infrastructure they run on. Other concern passes exhaustively enumerate tools, prompts, and evals — you must not.",
+    taskLines: [
+      "1. Map the harness topology: runtime agents, agent families, channel adapters, identity namespaces, environments, agent frameworks, model providers, deployments, the relationships among them, and open questions.",
+      "2. Do NOT exhaustively enumerate tools, prompts, guardrails, or evals as artifacts — separate concern passes produce those inventories. Keep graph.artifacts minimal: entrypoint artifacts only, plus agent artifactIds references you discover naturally along the way."
+    ],
+    protocolLines: [
+      "- Focus EXCLUSIVELY on topology: runtime agents, agent families, channel adapters, identity namespaces, environments, agent frameworks, model providers, deployments, and how they relate.",
+      "- Do NOT enumerate tools, prompts, guardrails, or evals as artifacts. Keep graph.artifacts minimal: entrypoints only.",
+      "- For every runtime agent, read and cite at least one concrete entrypoint or orchestration line, and populate every linkage field (entrypointIds, channelAdapterIds, identityNamespaceIds, deploymentIds, frameworkIds, modelProviderIds).",
+      "- Reserve explicit `relationships` entries for what linkage fields cannot express: covered_by_eval, runs_in_environment, invoked_by_channel, deployed_as, shares_artifact_with, resolves_identity_to, emits_telemetry."
+    ],
+    contractLines: [
+      'Runtime agents must include id, name, kind:"runtime_agent", root, entrypointIds, channelAdapterIds, artifactIds, identityNamespaceIds, deploymentIds, frameworkIds, modelProviderIds, confidence, evidence. Agent linkage fields are the product of this pass — empty linkage means a disconnected map.',
+      "Agent families must include id, name, runtimeAgentIds, sharedArtifactIds, confidence, evidence.",
+      "Frameworks/providers must include packageNames and runtimeAgentIds arrays; providers also include envVars and modelHints arrays.",
+      "Keep graph.artifacts minimal (entrypoints only); do not enumerate tools, prompts, guardrails, or evals."
+    ],
+    largeRepoLine: "If the repository is very large, model runtime agents representatively rather than exhaustively, but never drop channel adapters, providers, frameworks, or deployments you have evidence for."
+  },
+  tools: {
+    mission: "Your single concern for this pass is TOOLS: the exhaustive tool inventory. Other concern passes cover agents/topology, prompts, and evals — you must not enumerate those.",
+    taskLines: [
+      "1. Exhaustively enumerate EVERY tool as its own `tool` graph artifact — the complete inventory, not a sample. This report feeds tool optimization, so a missing tool is a real defect.",
+      "2. Do NOT enumerate prompts, guardrails, or evals, and do not map agent topology beyond bare stubs needed for tool linkage."
+    ],
+    protocolLines: [
+      "- Tools: emit a `tool` artifact for EVERY tool definition — each `@function_tool` / `function_tool(...)`-decorated function, every hosted/first-party tool class (e.g. WebSearchTool, FileSearchTool, ComputerTool, CodeInterpreterTool, HostedMCPTool, ImageGenerationTool, LocalShellTool), and every `tool({...})` / `createTool(...)` / `new *Tool(...)` factory. Name each artifact after the tool/function and cite its definition line.",
+      "- Populate usedByAgentIds on every tool artifact whenever the using agent is determinable (and ownedByAgentId when a single agent owns it).",
+      `- ${CONCERN_AGENT_STUB_LINE}`,
+      "- Do NOT emit prompt, guardrail, eval, memory, or retrieval_index artifacts — other concern passes own those.",
+      CONCERN_CAPS_LINE
+    ],
+    contractLines: [
+      'Artifacts must include id, type:"tool", name, scope, usedByAgentIds, confidence, evidence, and optional sourcePath/contentHash/ownedByAgentId. Emit one artifact PER tool — enumerate them all.',
+      CONCERN_NO_TRANSCRIPTION_LINE,
+      CONCERN_LOCATION_PIN_LINE,
+      CONCERN_AGENT_STUB_LINE
+    ],
+    largeRepoLine: "If the repository is very large, keep enumerating tools as artifacts (uncapped) — do not drop tools to save space."
+  },
+  prompts: {
+    mission: "Your single concern for this pass is PROMPTS: the exhaustive prompt inventory. Other concern passes cover agents/topology, tools, and evals — you must not enumerate those.",
+    taskLines: [
+      "1. Exhaustively enumerate EVERY distinct prompt as its own `prompt` graph artifact — dedicated prompt files AND inline system prompts, the complete inventory, not a sample. This report feeds prompt optimization, so a missing prompt is a real defect.",
+      "2. Do NOT enumerate tools, guardrails, or evals, and do not map agent topology beyond bare stubs needed for prompt linkage."
+    ],
+    protocolLines: [
+      "- Prompts: emit a `prompt` artifact for EVERY distinct prompt — dedicated prompt files AND inline system prompts (`instructions=`, `system=`, `SYSTEM_PROMPT`, prompt-template strings), one per agent/definition, each with its exact file+line location so the prompt text can be retrieved and optimized later.",
+      "- Populate usedByAgentIds on every prompt artifact whenever the using agent is determinable (and ownedByAgentId when a single agent owns it).",
+      `- ${CONCERN_AGENT_STUB_LINE}`,
+      "- Do NOT emit tool, guardrail, eval, memory, or retrieval_index artifacts — other concern passes own those.",
+      CONCERN_CAPS_LINE
+    ],
+    contractLines: [
+      'Artifacts must include id, type:"prompt", name, scope, usedByAgentIds, confidence, evidence, and optional sourcePath/contentHash/ownedByAgentId. Emit one artifact PER prompt (including each inline system prompt) — enumerate them all.',
+      CONCERN_NO_TRANSCRIPTION_LINE,
+      CONCERN_LOCATION_PIN_LINE,
+      CONCERN_AGENT_STUB_LINE
+    ],
+    largeRepoLine: "If the repository is very large, keep enumerating prompts as artifacts (uncapped) — do not drop prompts to save space."
+  },
+  evals: {
+    mission: "Your single concern for this pass is EVALS & SAFETY CONFIG: evals, guardrails, model configs, and memory/retrieval stores. Other concern passes cover agents/topology, tools, and prompts — you must not enumerate those.",
+    taskLines: [
+      '1. Exhaustively enumerate EVERY eval (type "eval"), guardrail (type "guardrail"), model configuration (type "model_config"), memory/session store (type "memory"), and retrieval index (type "retrieval_index") as its own graph artifact — the complete inventory, not a sample.',
+      "2. Do NOT enumerate tools or prompts, and do not map agent topology beyond bare stubs needed for linkage."
+    ],
+    protocolLines: [
+      '- Emit artifacts for evals/tests-of-agents (type "eval"), guardrails (type "guardrail"), model configuration (type "model_config"), memory/session stores (type "memory"), and retrieval indexes (type "retrieval_index").',
+      "- Short bodies are welcome here: `guardrail` (the rule), `eval` (what it asserts), `model_config` (the config values). Redact any secret literals.",
+      "- Populate usedByAgentIds on every artifact whenever the using agent is determinable.",
+      `- ${CONCERN_AGENT_STUB_LINE}`,
+      "- Do NOT emit tool or prompt artifacts — other concern passes own those.",
+      CONCERN_CAPS_LINE
+    ],
+    contractLines: [
+      "Artifacts must include id, type, name, scope, usedByAgentIds, confidence, evidence, and optional sourcePath/contentHash/ownedByAgentId; artifact types for this pass are eval, guardrail, model_config, memory, retrieval_index. Emit one artifact PER item — enumerate them all.",
+      "Short bodies are welcome: `guardrail` (the rule), `eval` (what it asserts), `model_config` (the config values). Redact any secret literals.",
+      CONCERN_AGENT_STUB_LINE
+    ],
+    largeRepoLine: "If the repository is very large, keep enumerating evals, guardrails, and model configs as artifacts (uncapped) — do not drop them to save space."
+  }
+};
 function renderExternalHarnessAnalystPrompt(options) {
+  const spec = options.concern ? CONCERN_PROMPT_SPECS[options.concern] : undefined;
   return [
     "You are Moda Analyst, investigating an agent harness for Moda CLI onboarding.",
+    spec?.mission ?? "",
     "",
     "Do real repository investigation. Do not call `moda harness scan` or `moda harness analyze` yourself. When Moda provides deterministic scanner seeds below, treat them as navigation candidates to verify against the real files — never as evidence or as a complete inventory.",
     "Only inspect the Repository root named below and files/directories under it. Do not inspect parent directories, sibling projects, the Moda CLI implementation, or this monorepo unless the Repository root itself is that directory.",
@@ -4810,13 +4967,15 @@ function renderExternalHarnessAnalystPrompt(options) {
     `The ONLY path you may write is ${HARNESS_REPORT_PATH}. Write the final report JSON there with the Write tool as soon as it is complete — the file is the durable deliverable and survives a dropped connection, unlike a long printed message. If (and only if) the write fails, print the report JSON between the sentinel markers instead.`,
     "",
     "Your task:",
-    renderExternalAnalystProtocol(),
-    "1. Identify the runtime agent harnesses, agent families, channel adapters, identity mappings, model providers, frameworks, deployments, and open questions.",
-    "2. Exhaustively enumerate EVERY prompt, tool, guardrail, and eval as its own graph artifact — the complete inventory, not a sample. This report feeds prompt optimization and tool optimization, so a missing tool or prompt is a real defect. Runtime agents may be modeled representatively on framework/example repos, but prompts and tools must be complete.",
+    renderExternalAnalystProtocol(options.concern),
+    ...spec ? spec.taskLines : [
+      "1. Identify the runtime agent harnesses, agent families, channel adapters, identity mappings, model providers, frameworks, deployments, and open questions.",
+      "2. Exhaustively enumerate EVERY prompt, tool, guardrail, and eval as its own graph artifact — the complete inventory, not a sample. This report feeds prompt optimization and tool optimization, so a missing tool or prompt is a real defect. Runtime agents may be modeled representatively on framework/example repos, but prompts and tools must be complete."
+    ],
     "3. Cite every narrative claim with local file paths, exact line numbers, and excerpts. File citations without line numbers are invalid for agent-authored reports. Enumerated artifacts only need evidence:[{path, reason}], so completeness of the artifact inventory is not limited by the citation cap.",
     `4. After completing investigation, WRITE the report JSON to ${HARNESS_REPORT_PATH} with the Write tool, then print a one-line confirmation naming the file. Only if that write fails, print the report JSON between ${REPORT_JSON_BEGIN} and ${REPORT_JSON_END}. Moda CLI validates whichever it finds (the file wins).`,
     "Do not end with commentary about being read-only and do not summarize without delivering the report: either the written file or the sentinel-wrapped JSON must exist before you finish.",
-    "If the repository is very large, keep enumerating prompts/tools/guardrails/evals as artifacts (uncapped) and only summarize runtime AGENTS representatively — do not drop tools or prompts to save space.",
+    spec?.largeRepoLine ?? "If the repository is very large, keep enumerating prompts/tools/guardrails/evals as artifacts (uncapped) and only summarize runtime AGENTS representatively — do not drop tools or prompts to save space.",
     "",
     "Final output format:",
     REPORT_JSON_BEGIN,
@@ -4830,7 +4989,7 @@ function renderExternalHarnessAnalystPrompt(options) {
     "- reportId, harnessId, createdAt",
     `- analyst: { "id": "moda-${options.adapter}-analyst", "adapter": "${options.adapter}", "mode": "agent", "version": "cli" }`,
     '- repo: { root: ".", name, packageManagers, languages }',
-    '- source: { graphSchemaVersion: "harness.v0.1", graphHash: "", readPlan, deterministicInventory: false }',
+    options.concern ? `- source: { graphSchemaVersion: "harness.v0.1", graphHash: "", readPlan, deterministicInventory: false, concern: "${options.concern}" }` : '- source: { graphSchemaVersion: "harness.v0.1", graphHash: "", readPlan, deterministicInventory: false }',
     "- summary: numeric fields named runtimeAgentCount, agentFamilyCount, artifactCount, sharedArtifactCount, channelAdapterCount, identityNamespaceCount, environmentCount, agentFrameworkCount, modelProviderCount, deploymentCount, relationshipCount, unknownCount",
     "- graph: an exact sanitized harness.v0.1 graph with arrays for agentFamilies, runtimeAgents, developerAgentAdapters, channelAdapters, artifacts, identityNamespaces, environments, agentFrameworks, modelProviders, deployments, relationships, unknowns",
     "- claims: cited claims about graph items. Each claim must include kind, subjectId, title, summary, confidence, inference, and citationIds; kind should be one of runtime_agent, agent_family, developer_agent_adapter, artifact, channel_adapter, identity_namespace, environment, agent_framework, model_provider, deployment, relationship, unknown. subjectId should be the id of the runtime agent, agent family, developer adapter, artifact, provider, adapter, deployment, relationship, or unknown being claimed.",
@@ -4840,13 +4999,15 @@ function renderExternalHarnessAnalystPrompt(options) {
     "",
     'Use exact field names and numeric confidence values from 0 to 1. Do not write string confidence values like "high". Do not use confidence >= 0.90 unless the claim is direct evidence from the cited line(s).',
     "Each graph item with evidence must use evidence: [{ path, reason }], not citationIds/citations.",
-    'Runtime agents must include id, name, kind:"runtime_agent", root, entrypointIds, channelAdapterIds, artifactIds, identityNamespaceIds, deploymentIds, frameworkIds, modelProviderIds, confidence, evidence.',
-    "Artifacts must include id, type, name, scope, usedByAgentIds, confidence, evidence, and optional sourcePath/contentHash/ownedByAgentId. Emit one artifact PER tool, PER prompt (including each inline system prompt), PER guardrail, and PER eval — enumerate them all; artifact types are entrypoint, prompt, tool, skill, eval, retrieval_index, memory, guardrail, model_config, unknown.",
-    "Do NOT transcribe prompt/tool text into `body` when it exists verbatim in the repo — pin its exact location instead (sourcePath for a dedicated file, or evidence [{ path, line, reason }] at the definition line) and Moda hydrates `body` locally from that location after validation. Set `body` inline ONLY for content that cannot be recovered from one pinned location: dynamically assembled prompts, fragments concatenated at runtime, or values you had to derive. Short bodies for `guardrail` (the rule), `eval` (what it asserts), and `model_config` (the config values) are still welcome. Redact any secret literals.",
-    "For every `prompt` and `tool` artifact, at least one evidence entry MUST pin an exact source location so downstream optimization can retrieve the item text: carry a numeric `line` (the definition line, or the first line of the range) — evidence: [{ path, line, reason }]. The only exception is an artifact whose entire dedicated file is the text (e.g. a standalone prompt file); set its sourcePath and cite that same file and no line is required. When a single file holds multiple inline prompts or tool definitions, give each its own distinct line — a bare { path, reason } is a defect there.",
-    "LINKAGE IS MANDATORY, not optional metadata: every artifact you author must carry usedByAgentIds naming each runtime agent that uses it (and ownedByAgentId when a single agent owns it), and every runtime agent's artifactIds must list its prompts, tools, and evals. Moda derives uses_artifact/owns_artifact edges from these fields after your run, so empty linkage means a disconnected map. Reserve explicit `relationships` entries for what linkage fields cannot express: covered_by_eval, runs_in_environment, invoked_by_channel, deployed_as, shares_artifact_with, resolves_identity_to, emits_telemetry.",
-    "Agent families must include id, name, runtimeAgentIds, sharedArtifactIds, confidence, evidence.",
-    "Frameworks/providers must include packageNames and runtimeAgentIds arrays; providers also include envVars and modelHints arrays.",
+    ...spec ? spec.contractLines : [
+      'Runtime agents must include id, name, kind:"runtime_agent", root, entrypointIds, channelAdapterIds, artifactIds, identityNamespaceIds, deploymentIds, frameworkIds, modelProviderIds, confidence, evidence.',
+      "Artifacts must include id, type, name, scope, usedByAgentIds, confidence, evidence, and optional sourcePath/contentHash/ownedByAgentId. Emit one artifact PER tool, PER prompt (including each inline system prompt), PER guardrail, and PER eval — enumerate them all; artifact types are entrypoint, prompt, tool, skill, eval, retrieval_index, memory, guardrail, model_config, unknown.",
+      "Do NOT transcribe prompt/tool text into `body` when it exists verbatim in the repo — pin its exact location instead (sourcePath for a dedicated file, or evidence [{ path, line, reason }] at the definition line) and Moda hydrates `body` locally from that location after validation. Set `body` inline ONLY for content that cannot be recovered from one pinned location: dynamically assembled prompts, fragments concatenated at runtime, or values you had to derive. Short bodies for `guardrail` (the rule), `eval` (what it asserts), and `model_config` (the config values) are still welcome. Redact any secret literals.",
+      "For every `prompt` and `tool` artifact, at least one evidence entry MUST pin an exact source location so downstream optimization can retrieve the item text: carry a numeric `line` (the definition line, or the first line of the range) — evidence: [{ path, line, reason }]. The only exception is an artifact whose entire dedicated file is the text (e.g. a standalone prompt file); set its sourcePath and cite that same file and no line is required. When a single file holds multiple inline prompts or tool definitions, give each its own distinct line — a bare { path, reason } is a defect there.",
+      "LINKAGE IS MANDATORY, not optional metadata: every artifact you author must carry usedByAgentIds naming each runtime agent that uses it (and ownedByAgentId when a single agent owns it), and every runtime agent's artifactIds must list its prompts, tools, and evals. Moda derives uses_artifact/owns_artifact edges from these fields after your run, so empty linkage means a disconnected map. Reserve explicit `relationships` entries for what linkage fields cannot express: covered_by_eval, runs_in_environment, invoked_by_channel, deployed_as, shares_artifact_with, resolves_identity_to, emits_telemetry.",
+      "Agent families must include id, name, runtimeAgentIds, sharedArtifactIds, confidence, evidence.",
+      "Frameworks/providers must include packageNames and runtimeAgentIds arrays; providers also include envVars and modelHints arrays."
+    ],
     "Unknowns in graph must include id, question, candidateIds, evidence. Report-level unknowns must include id, question, citationIds.",
     "Do not make every claim about the repo or harness id. Claims should name the specific graph item they support.",
     "",
@@ -4854,16 +5015,24 @@ function renderExternalHarnessAnalystPrompt(options) {
     options.tenantId ? `Tenant ID to include in graph.tenant: ${options.tenantId}` : "No tenant ID was provided for this analysis.",
     `Repository root: ${options.rootDir}`,
     renderAnalystPreflightSection(options.rootDir),
-    renderAnalystSeedSection(options.rootDir),
+    renderAnalystSeedSection(options.rootDir, options.concern),
     "",
     "Be conservative. If something is unclear, put it in unknowns instead of inventing an agent."
   ].filter(Boolean).join(`
 `);
 }
-function renderExternalAnalystProtocol() {
+function renderExternalAnalystProtocol(concern) {
   const protocol = process.env.MODA_HARNESS_ANALYST_PROTOCOL?.trim().toLowerCase();
   if (protocol === "classic" || protocol === "none" || protocol === "0")
     return "";
+  if (concern) {
+    return [
+      "Focused investigation protocol:",
+      "- First build a quick repo map with read-only commands such as pwd, git ls-files, rg, and targeted manifest/doc reads.",
+      ...CONCERN_PROMPT_SPECS[concern].protocolLines
+    ].join(`
+`);
+  }
   return [
     "Focused investigation protocol:",
     "- First build a quick repo map with read-only commands such as pwd, git ls-files, rg, and targeted manifest/doc reads.",
@@ -4912,23 +5081,31 @@ function renderPreflightGroup(label, paths) {
   return [`${label}:`, ...paths.map((path) => `- ${path}`)];
 }
 var MAX_SEED_ARTIFACT_LINES = 150;
-function renderAnalystSeedSection(rootDir) {
+function renderAnalystSeedSection(rootDir, concern) {
   if (process.env.MODA_HARNESS_ANALYST_SEEDS === "0")
     return "";
   const sections = [];
+  if (concern === undefined || concern === "topology") {
+    try {
+      const lines = renderAnalystSeedLines(scanHarness({ rootDir, dryRun: true, pathWasExplicit: true }));
+      if (lines)
+        sections.push(lines);
+    } catch {}
+  }
   try {
-    const lines = renderAnalystSeedLines(scanHarness({ rootDir, dryRun: true, pathWasExplicit: true }));
-    if (lines)
-      sections.push(lines);
-  } catch {}
-  try {
-    const lines = renderAnalystCandidateLines(detectHarnessCandidates(rootDir));
+    const lines = renderAnalystCandidateLines(detectHarnessCandidates(rootDir), concern);
     if (lines)
       sections.push(lines);
   } catch {}
   return sections.join(`
 `);
 }
+var CONCERN_CANDIDATE_KINDS = {
+  topology: ["llm_call_site", "framework_construct"],
+  tools: ["tool_definition", "tool_schema"],
+  prompts: ["prompt_file", "prompt_literal", "message_construction"],
+  evals: ["model_config"]
+};
 var MAX_SEED_CANDIDATES_PER_KIND = 40;
 var MAX_SEED_READ_PLAN_FILES = 25;
 var SEED_CANDIDATE_KIND_LABELS = {
@@ -4941,11 +5118,13 @@ var SEED_CANDIDATE_KIND_LABELS = {
   prompt_literal: "Inline prompt literals",
   model_config: "Model configuration"
 };
-function renderAnalystCandidateLines(report) {
-  if (report.candidates.length === 0)
+function renderAnalystCandidateLines(report, concern) {
+  const allowedKinds = concern ? new Set(CONCERN_CANDIDATE_KINDS[concern]) : undefined;
+  const candidates = allowedKinds ? report.candidates.filter((candidate) => allowedKinds.has(candidate.kind)) : report.candidates;
+  if (candidates.length === 0)
     return "";
   const byKind = new Map;
-  for (const candidate of report.candidates) {
+  for (const candidate of candidates) {
     const bucket = byKind.get(candidate.kind);
     if (bucket)
       bucket.push(candidate);
@@ -4954,9 +5133,12 @@ function renderAnalystCandidateLines(report) {
   }
   const lines = [
     "",
-    `Deterministic candidate inventory (${report.candidates.length} candidates across ${report.stats.filesWithCandidates} files, scanned in ${report.stats.durationMs}ms):`,
-    "Each entry is path:line [detector] excerpt. Candidates are pattern matches — verify each against the real file and drop false positives. Verified deterministic candidates are also auto-merged into the graph after your run, so prioritize (1) agents, topology, and relationships, (2) verifying or refuting these candidates (list refuted ones in unknowns), and (3) artifacts the patterns cannot see (runtime agents, prompts assembled at runtime, cross-file wiring) — rather than re-listing every candidate as an artifact. Do not cite this list as evidence; cite the files."
+    concern ? `Deterministic candidate inventory for the ${concern} concern (${candidates.length} candidates, scanned in ${report.stats.durationMs}ms):` : `Deterministic candidate inventory (${candidates.length} candidates across ${report.stats.filesWithCandidates} files, scanned in ${report.stats.durationMs}ms):`,
+    concern ? "Each entry is path:line [detector] excerpt. Candidates are pattern matches — verify each against the real file, drop false positives (list refuted ones in unknowns), and hunt for in-concern items the patterns cannot see. Do not cite this list as evidence; cite the files." : "Each entry is path:line [detector] excerpt. Candidates are pattern matches — verify each against the real file and drop false positives. Verified deterministic candidates are also auto-merged into the graph after your run, so prioritize (1) agents, topology, and relationships, (2) verifying or refuting these candidates (list refuted ones in unknowns), and (3) artifacts the patterns cannot see (runtime agents, prompts assembled at runtime, cross-file wiring) — rather than re-listing every candidate as an artifact. Do not cite this list as evidence; cite the files."
   ];
+  if (concern === "evals") {
+    lines.push("Note: evals, guardrails, and memory/retrieval stores have no deterministic detector — only model_config candidates are seeded. Discover the rest by investigation.");
+  }
   for (const [kind, label] of Object.entries(SEED_CANDIDATE_KIND_LABELS)) {
     const bucket = byKind.get(kind);
     if (!bucket || bucket.length === 0)