@moda-ai/cli 1.32.0 → 1.34.0

package/README.md

@@ -148,23 +148,52 @@ moda prompts sync --analyst=claude
 moda prompts sync --no-analyze
 ```
 
-Every sync reuses the prompt-specific harness analyzer. The default is a bounded,
-deterministic local scan with no agent calls. Successful sync saves newly verified
-mappings in `.moda/prompts.yml`; existing keys and legacy prompt-file metadata are
-preserved. Explicit negative `prompt_paths` patterns also exclude new discoveries.
-Analysis diagnostics and partial coverage are returned in the sync result. A dry
-run performs deterministic discovery without changing the manifest or lockfile.
-`--watch` starts with analysis and then watches mapped definitions; re-run sync to
-look for newly added sources that do not affect an existing mapping.
-
-For unresolved candidates, select `--analyst=claude`, `codex`, or `cursor` on sync.
-The CLI launches a bounded investigation through the installed coding-agent CLI.
-It accepts source selectors, then reads and validates the source itself; agent
-text never becomes registered prompt content. `--assist=none` disables assistance.
-You can still run `harness analyze --experimental --concern=prompts` separately
-and import its report with `prompts init --from-harness=<report>`.
-Discovery reports partial coverage explicitly; finding some prompts does not
-prove that every model call is covered.
+Every sync reuses the prompt-specific harness analyzer. It discovers candidates
+locally, then uses an installed Claude Code, Codex, or Cursor CLI to follow
+unresolved relationships and repair mappings. A separate agent session reviews
+new candidates. Source resolution reads the actual files; agent-written prompt
+text never becomes registry content. Uncertain candidates remain pending and
+are reported separately from sources eligible for sync.
+
+Use `--analyst=local-scan` or `--assist=none` to disable agent calls, or
+`--no-analyze` to sync only configured sources. Existing mappings remain
+authoritative. Successful sync saves new accepted mappings in
+`.moda/prompts.yml`, preserving existing keys, legacy metadata, and negative
+`prompt_paths` patterns. Builders are stored as source definitions, not as
+claims about their rendered runtime text.
+
+A plain `--dry-run` uses deterministic discovery. Add `--analyst=claude`,
+`--analyst=codex`, `--analyst=cursor`, or `--analyst=auto` to preview agent-assisted
+discovery without saving the manifest, lockfile, or registry versions. Agent
+investigations have no fixed wall-clock timeout and consume the installed
+agent's usage; interrupt the command to cancel. Sync prints scan and verification
+progress to stderr, including periodic analyst heartbeats while waiting. JSON
+results on stdout remain unchanged; `--quiet` suppresses progress and
+`--agent --stream` delivers progress as structured events.
+
+`--watch` starts with analysis and then watches mapped definitions; re-run sync
+to discover new sources that do not affect an existing mapping. You can also
+run `harness analyze --experimental --concern=prompts` and import its report
+with `prompts init --from-harness=<report>`. Discovery reports partial coverage:
+finding a prompt fragment does not prove that every composition or model call
+has been covered.
+
+Prompt discovery keeps semantic role separate from mechanical extraction kind.
+Independent review can classify a source as an authored definition, builder,
+prompt transport, runtime context, non-prompt, or uncertain even when the
+resolver stored it as text, messages, template, or builder. Usage is tracked
+separately as active, conditional, display-only, or unknown, with an endpoint
+verification flag; unknown usage does not reject an otherwise verified authored
+definition or builder. Helpers that forward prompt configuration or carry
+runtime context are retained as related discovery candidates and diagnostics,
+but are not synced as prompt sources. Builder provenance remains the source
+mapping and dependency evidence, so discovery does not claim complete
+whole-codebase classification.
+
+The reviewer receives the complete parser-selected definition and can inspect
+surrounding relationships. Its definition citations, source hash, and source
+stability are checked locally. Malformed review JSON gets one format-only repair
+attempt; a repair that changes an already stated role or decision stays pending.
 
 You can also configure `.moda/prompts.yml` directly:
 

package/dist/{cli-drabjmaj.js → cli-0h32yvwq.js}

@@ -648,7 +648,7 @@ function validateConfig() {
   }
 }
 
-// ../../packages/harness-snapshot/src/policy.ts
+// ../../../ModaObservability-prompt-sync/packages/harness-snapshot/src/policy.ts
 var MAX_SCANNED_FILE_BYTES = 512 * 1024;
 var DEFAULT_MAX_INVENTORY_FILES = 12000;
 var DEFAULT_MAX_INVENTORY_TEXT_BYTES = 48 * 1024 * 1024;
@@ -790,7 +790,7 @@ function isSecretishPath(path) {
   return name === ".env" || name.startsWith(".env.") || name.includes("secret") || name.includes("private-key") || name.endsWith(".pem");
 }
 
-// ../../packages/harness-snapshot/src/redact.ts
+// ../../../ModaObservability-prompt-sync/packages/harness-snapshot/src/redact.ts
 var REDACTED = "[REDACTED]";
 var MAX_DEPTH = 256;
 var SECRET_KEYS = new Set([
@@ -887,7 +887,7 @@ function redactSnapshotText(text) {
   return { text: parts.join(""), redactionCount };
 }
 
-// ../../packages/harness-snapshot/src/pack.ts
+// ../../../ModaObservability-prompt-sync/packages/harness-snapshot/src/pack.ts
 function utf8ByteLength(value) {
   let bytes = 0;
   for (let index = 0;index < value.length; index += 1) {

package/dist/{cli-scjxgaba.js → cli-4ycvzfdg.js}

@@ -1,7 +1,7 @@
 import {
   authFetch,
   getCachedLoginContext
-} from "./cli-yz99t7n8.js";
+} from "./cli-eggpzt87.js";
 import {
   CliAccessError,
   CliInputError,
@@ -15,7 +15,7 @@ import {
   resolveTenantIdFromActiveProfile,
   saveCliConfig,
   writeSecretJsonFile
-} from "./cli-drabjmaj.js";
+} from "./cli-0h32yvwq.js";
 
 // src/init/tenant.ts
 import { randomUUID } from "node:crypto";

package/dist/{cli-yz99t7n8.js → cli-eggpzt87.js}

@@ -8,7 +8,7 @@ import {
   saveProfileConfig,
   secretFilePathFromRef,
   writeSecretJsonFile
-} from "./cli-drabjmaj.js";
+} from "./cli-0h32yvwq.js";
 
 // src/auth-storage.ts
 import { existsSync, readFileSync, rmSync } from "node:fs";