@moda-ai/cli 1.34.0 → 1.34.1

package/README.md

@@ -183,8 +183,13 @@ Independent review can classify a source as an authored definition, builder,
 prompt transport, runtime context, non-prompt, or uncertain even when the
 resolver stored it as text, messages, template, or builder. Usage is tracked
 separately as active, conditional, display-only, or unknown, with an endpoint
-verification flag; unknown usage does not reject an otherwise verified authored
-definition or builder. Helpers that forward prompt configuration or carry
+verification flag. Automatic code/configuration registration requires an authored
+definition or builder with independently reviewed active or conditional model use
+and a local consumer citation. Custom framework hooks can qualify without a
+recognized SDK binding. Consumer relationships are semantic reviewer judgments,
+not deterministic dataflow proofs; locally valid citations alone do not establish
+model use. The separate `endpointVerified` flag reports SDK provenance. Display-only sources stay visible as related; sources
+with unknown use remain pending. Helpers that forward prompt configuration or carry
 runtime context are retained as related discovery candidates and diagnostics,
 but are not synced as prompt sources. Builder provenance remains the source
 mapping and dependency evidence, so discovery does not claim complete
@@ -195,6 +200,18 @@ surrounding relationships. Its definition citations, source hash, and source
 stability are checked locally. Malformed review JSON gets one format-only repair
 attempt; a repair that changes an already stated role or decision stays pending.
 
+Before uploading, sync checks statically resolvable JavaScript/TypeScript lookups
+into the repository's `.moda/prompts.lock.json`. A missing key stops the upload
+and reports its source location. Preserve a stable runtime key by assigning it
+to the intended source mapping, or update the lookup to the selected mapping key.
+Dynamic lookups and other languages are not exhaustively checked; attribution
+coverage remains partial. A real sync with candidates but no eligible sources
+exits nonzero after printing discovery diagnostics; dry runs remain previews.
+
+Configured mappings remain authoritative. To clean up sources previously
+registered in error, remove their entries from `.moda/prompts.yml` and sync with
+`--allow-untrack`. This removes local tracking, not historical registry versions.
+
 You can also configure `.moda/prompts.yml` directly:
 
 ```yaml

package/dist/{cli-xwqb83jb.js → cli-8q7jffnj.js}

@@ -183017,6 +183017,7 @@ function reviewEvidence(rootDir, source, evidence) {
   if (!evidence.length)
     return { valid: false, endpointVerified: false, reason: "Reviewer supplied no evidence" };
   try {
+    const endpoints = [];
     for (const item of evidence) {
       let text;
       try {
@@ -183032,20 +183033,21 @@ function reviewEvidence(rootDir, source, evidence) {
           continue;
         return { valid: false, endpointVerified: false, reason: `Invalid definition evidence line ${item.path}:${item.line}` };
       }
+      if (item.kind === "model_endpoint" && item.reason.trim())
+        endpoints.push(item);
     }
     const definition = evidence.some((item) => item.kind === "definition" && item.path === source.path && isSelectedDefinitionCitation(rootDir, source, item.line));
     if (!definition) {
       return { valid: false, endpointVerified: false, reason: "Reviewer evidence lacks a citation inside the selected definition" };
     }
-    const endpoint = evidence.filter((item) => item.kind === "model_endpoint");
-    const endpointVerified = endpoint.some((item) => {
+    const endpointVerified = endpoints.some((item) => {
       try {
         return proveSink(rootDir, { path: item.path, line: item.line, api: "" }) === "constructed";
       } catch {
         return false;
       }
     });
-    return { valid: true, endpointVerified };
+    return { valid: true, endpointVerified, reviewedConsumerCited: endpoints.length > 0 };
   } catch (error) {
     return { valid: false, endpointVerified: false, reason: error instanceof Error ? error.message : String(error) };
   }
@@ -183065,7 +183067,8 @@ function promptVerificationInstruction(source, sourceHash, definition) {
     "Classify helpers by the value they carry, not the storage mechanism: persisting/retrieving/forwarding instruction settings, prompt definitions, or tool descriptors is prompt_transport; retrieving/formatting runtime facts, memory, documents, tool results, or ordinary user data is runtime_context. Neither operation alone authors or composes instructions.",
     "For a builder verdict, identify an actual instruction-composition operation owned by the selection: combining instruction fragments, assembling instructional messages, or rendering an instruction template with inputs. Merely passing an already-built value as a call argument, storing/retrieving it, or returning an identifier is not composition. A wrapper forwarding a prompt/tool descriptor remains transport or runtime_context unless it performs its own instruction composition. State the concrete operation in the definition evidence reason.",
     "A selected definition citation is required for every positive role. An endpoint witness is optional for role evidence and independently determines usage. UI labels/layout copy, retrieval output, ordinary configuration, and response adapters are non_prompt. Prompt presets, display-only instruction copies, tool/schema descriptions, and instruction spans remain authored when the selected definition owns that text. For mixed functions, authored instruction operations take precedence over transport/context operations; inspect the whole selected body.",
-    "usage.status is active only when you explicitly establish active model use and provide a trusted endpoint witness. Otherwise use unknown. conditional and display_only are semantic usage statuses, but endpointVerified must remain false unless deterministic proof exists.",
+    "Instruction ownership alone does not qualify a source for automatic registration. Report usage.status active or conditional only after tracing this selected source to a concrete model input, including through imported builders, stored configuration, or a custom framework hook such as a returned system field. Cite that consumer as model_endpoint and explain the value flow from this source. A recognized SDK is not required for semantic usage; endpointVerified is computed separately by the local checker.",
+    "Display copies, preset chips that only prefill an editor, and forms that concatenate or save editor state are display_only unless you trace the resulting value to an actual model consumer. Possible future use or the ability to click a UI control is not conditional model use. If the code is inconclusive, use unknown. Keep these definitions visible with their true semantic role; do not invent a model-use path to make them eligible.",
     "For lifecycle hooks that return a system/instructions field, cite the returned field as an endpoint witness only. If the selected hook only delegates to a separate builder, classify it as transport; if its own body authors instruction spans, authored role takes precedence.",
     `Candidate: ${JSON.stringify(source)}`,
     `Expected source hash: ${sourceHash}`,
@@ -183076,6 +183079,7 @@ function promptVerificationInstruction(source, sourceHash, definition) {
     ...definition?.declarationKind === "class" ? ["This selected definition is a class container. Do not inherit roles from separately addressable member methods: map the owning method instead. Only class-owned instruction initializers justify an authored role on the class itself; otherwise classify the container as non_prompt or uncertain and explain which members own the behavior."] : [],
     "Return exactly one JSON object between MODA_PROMPT_VERIFY_BEGIN and MODA_PROMPT_VERIFY_END:",
     '{"verified":true,"role":"authored_definition","usage":{"status":"unknown","reason":"No trusted endpoint established","endpointVerified":false},"sourceHash":"...","evidence":[{"path":"src/agent.ts","line":1,"kind":"definition","reason":"..."}],"reason":"..."}',
+    "usage.status must be exactly one of: active, conditional, display_only, unknown. Use display_only (with an underscore) for editor-only or display-only instruction text. Do not emit inactive, none, or display-only. endpointVerified must be false in your response; only the local checker establishes that flag.",
     "Every response must include verified, role, sourceHash, evidence, and reason. role is authored_definition, builder, prompt_transport, runtime_context, non_prompt, or uncertain. Evidence kind is definition or model_endpoint and line is positive. Cite the endpoint expression START line when present."
   ].join(`
 `);
@@ -183170,7 +183174,7 @@ ${output}` : "";
     if (!reviewed.verified || reviewed.role === "uncertain")
       return pending(reviewed.reason, reviewed.evidence, reviewed.role, normalizeUsage(undefined, false));
     const evidence = reviewEvidence(rootDir, source, reviewed.evidence);
-    const usage = normalizeUsage(reviewed.usage, evidence.endpointVerified);
+    const usage = normalizeUsage(reviewed.usage, evidence.endpointVerified, evidence.reviewedConsumerCited);
     if (!evidence.valid)
       return pending(evidence.reason ?? "Reviewer evidence is invalid", reviewed.evidence, reviewed.role, usage);
     return { status: "verified", reason: reviewed.reason, evidence: reviewed.evidence, sourceHash: checked.sourceHash, role: reviewed.role, usage };
@@ -183199,11 +183203,11 @@ function extractJudgment(output) {
     return;
   }
 }
-function normalizeUsage(reviewed, endpointVerified) {
+function normalizeUsage(reviewed, endpointVerified, reviewedConsumerCited = false) {
   if (!reviewed)
     return { status: "unknown", reason: "Reviewer did not provide explicit usage status", endpointVerified };
-  if (reviewed.status === "active" && !endpointVerified)
-    return { status: "unknown", reason: "Active usage requires a deterministically trusted endpoint", endpointVerified: false };
+  if ((reviewed.status === "active" || reviewed.status === "conditional") && !reviewedConsumerCited)
+    return { status: "unknown", reason: "Model usage requires reviewer evidence at a valid model-input source location", endpointVerified: false };
   return { ...reviewed, endpointVerified };
 }
 
@@ -183445,9 +183449,18 @@ async function investigateHarnessPrompts(options) {
         candidate.role = decision.role;
       if (decision.usage)
         candidate.usage = decision.usage;
-      if (decision.status === "verified" && (decision.role === "authored_definition" || decision.role === "builder"))
-        candidate.status = "accepted";
-      else if (decision.status === "verified" && (decision.role === "prompt_transport" || decision.role === "runtime_context")) {
+      if (decision.status === "verified" && decision.usage?.status === "display_only") {
+        candidate.status = "related";
+        candidate.reason = `Display-only source is visible in discovery but is not eligible for automatic registration. ${decision.reason}`;
+        related.push(candidate);
+      } else if (decision.status === "verified" && (decision.role === "authored_definition" || decision.role === "builder")) {
+        if (decision.usage?.status === "active" || decision.usage?.status === "conditional")
+          candidate.status = "accepted";
+        else {
+          candidate.status = "pending";
+          candidate.reason = `Instruction ownership is verified, but model use is unresolved. ${decision.reason}`;
+        }
+      } else if (decision.status === "verified" && (decision.role === "prompt_transport" || decision.role === "runtime_context")) {
         candidate.status = "related";
         related.push(candidate);
       } else
@@ -184271,7 +184284,7 @@ async function runHarnessCommand(context) {
         throw new CliInputError("Focused remote prompt analysis is not supported yet.", "Use local --analyst=claude|codex|cursor|local-scan, or drop --concern for a full remote report.");
       }
       if (context.flags["github-actions"] === "true") {
-        const { runGithubActionsAnalyze } = await import("./harness-github-actions-43kt57xm.js");
+        const { runGithubActionsAnalyze } = await import("./harness-github-actions-xk7n788g.js");
         const result = await runGithubActionsAnalyze(rootDir, {
           writeReport: (report2) => {
             const normalized = normalizeHarnessReport(report2);
@@ -188281,4 +188294,4 @@ function hashText(text) {
   return createHash4("sha256").update(text).digest("hex");
 }
 
-export { ApiError, callDataAPI, callControlAPI, getApiRequestCount, resetApiRequestCount, $parseDocument, $stringify, inspectCodeSelectors, inspectPythonSelectors, resolvePromptSource, shouldColorTerminalOutput, terminalStyles, stripAnsi2 as stripAnsi, renderMarkdownForTerminal, HARNESS_REPORT_PATH, HARNESS_REPORT_APPROVAL_PATH, HARNESS_ANALYZE_CONCERNS, validateHarnessReport, readHarnessReport, hashHarnessReport, hashStableJson, startRemoteAnalyze, pollRemoteAnalyzeUntilDone, checkPromptMapping, safePromptEvidencePath, discoverHarnessPromptSources, renderDoctorHuman, renderStatusHuman, renderInitBanner, renderInitStep, renderInitNote, renderInitSetupPlan, renderInitComplete, runHarnessCommand, writeHarnessAnalyzeResult, emitWrittenArtifacts, analyzeHarnessPrompts, repairExternalAnalystReport, deriveRelationshipsFromGraph, mergeDeterministicArtifacts, describeCodingAgentEvent, analystEventProgress, isRetryableExternalAnalystFailure, sleep, summarizeInvalidAnalystReport, isDeterministicLocalAnalyst, resolveHarnessAnalyzeConcern, detectAvailableCodingAgents, codingAgentDisplayName, runCodingAgent, resolveAnalystModel, renderExternalHarnessAnalystPrompt, CONCERN_CANDIDATE_KINDS, SEED_CANDIDATE_KIND_LABELS, renderAnalystCandidateLines, renderAnalystSeedLines, truncateText, scanHarness, summarizeHarness, buildSourceSnapshot, writeHumanProgress, readHarnessSyncState, describeSyncIdentity, describeSyncTenantLabel, findFresherHarnessReports, writeHarnessArtifacts, assertHarnessGraphSyncQuality, graphForSync, inventoryFiles, numericEnv, numericEnvAllowZero, computeDeterministicFloor, stableId2 as stableId, titleFromId2 as titleFromId, promptNameFromPath };
+export { ApiError, callDataAPI, callControlAPI, getApiRequestCount, resetApiRequestCount, $parseDocument, $stringify, require_typescript, inspectCodeSelectors, inspectPythonSelectors, resolvePromptSource, shouldColorTerminalOutput, terminalStyles, stripAnsi2 as stripAnsi, renderMarkdownForTerminal, HARNESS_REPORT_PATH, HARNESS_REPORT_APPROVAL_PATH, HARNESS_ANALYZE_CONCERNS, validateHarnessReport, readHarnessReport, hashHarnessReport, hashStableJson, startRemoteAnalyze, pollRemoteAnalyzeUntilDone, checkPromptMapping, safePromptEvidencePath, discoverHarnessPromptSources, renderDoctorHuman, renderStatusHuman, renderInitBanner, renderInitStep, renderInitNote, renderInitSetupPlan, renderInitComplete, runHarnessCommand, writeHarnessAnalyzeResult, emitWrittenArtifacts, analyzeHarnessPrompts, repairExternalAnalystReport, deriveRelationshipsFromGraph, mergeDeterministicArtifacts, describeCodingAgentEvent, analystEventProgress, isRetryableExternalAnalystFailure, sleep, summarizeInvalidAnalystReport, isDeterministicLocalAnalyst, resolveHarnessAnalyzeConcern, detectAvailableCodingAgents, codingAgentDisplayName, runCodingAgent, resolveAnalystModel, renderExternalHarnessAnalystPrompt, CONCERN_CANDIDATE_KINDS, SEED_CANDIDATE_KIND_LABELS, renderAnalystCandidateLines, renderAnalystSeedLines, truncateText, scanHarness, summarizeHarness, buildSourceSnapshot, writeHumanProgress, readHarnessSyncState, describeSyncIdentity, describeSyncTenantLabel, findFresherHarnessReports, writeHarnessArtifacts, assertHarnessGraphSyncQuality, graphForSync, inventoryFiles, numericEnv, numericEnvAllowZero, computeDeterministicFloor, stableId2 as stableId, titleFromId2 as titleFromId, promptNameFromPath };

package/dist/{cli-q9t1tr1z.js → cli-cagbc7wz.js}

@@ -3,12 +3,15 @@ import {
   $stringify,
   callControlAPI,
   callDataAPI,
+  inventoryFiles,
   readHarnessSyncState,
   renderDoctorHuman,
   renderStatusHuman,
+  require_typescript,
   resolvePromptSource,
+  safePromptEvidencePath,
   scanHarness
-} from "./cli-xwqb83jb.js";
+} from "./cli-8q7jffnj.js";
 import {
   isAuthSessionValid,
   loadAuthSession
@@ -5547,7 +5550,7 @@ import {
   rmSync,
   writeFileSync as writeFileSync2
 } from "node:fs";
-import { dirname, isAbsolute as isAbsolute3, join, relative, resolve as resolve3 } from "node:path";
+import { dirname as dirname2, isAbsolute as isAbsolute3, join, relative, resolve as resolve4 } from "node:path";
 
 // src/prompts-ab.ts
 import { existsSync } from "node:fs";
@@ -6030,6 +6033,131 @@ function parsePositiveInt2(raw, fallback, max) {
   return Math.min(n, max);
 }
 
+// src/prompt-attribution.ts
+var import_typescript = __toESM(require_typescript(), 1);
+import { dirname, extname, resolve as resolve3 } from "node:path";
+function checkPromptAttribution(rootDir, keys) {
+  const result = { references: [], coverage: "partial", issues: [] };
+  const known = new Set(keys), lock = resolve3(rootDir, ".moda/prompts.lock.json");
+  let files;
+  try {
+    files = inventoryFiles(rootDir, []);
+  } catch (error) {
+    result.issues.push({ path: ".", reason: `Attribution scan incomplete: ${error instanceof Error ? error.message : String(error)}` });
+    return result;
+  }
+  for (const file of files) {
+    if (![".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"].includes(extname(file.path)) || !file.text?.includes("prompts.lock.json"))
+      continue;
+    if (/(^|\/)(?:tests?|__tests__|fixtures?)(\/|$)|\.(?:test|spec)\.[^.]+$/.test(file.path))
+      continue;
+    try {
+      const absolute = safePromptEvidencePath(rootDir, file.path);
+      const program = import_typescript.default.createProgram([absolute], { noResolve: true, noLib: true, types: [], allowJs: true });
+      const sf = program.getSourceFile(absolute);
+      if (!sf || program.getSyntacticDiagnostics(sf).length) {
+        result.issues.push({ path: file.path, reason: "Attribution source could not be parsed" });
+        continue;
+      }
+      const checker = program.getTypeChecker();
+      const declaration = (node) => {
+        const all = checker.getSymbolAtLocation(node)?.declarations;
+        return all?.length === 1 ? all[0] : undefined;
+      };
+      const imported = (node) => {
+        if (import_typescript.default.isImportSpecifier(node) && node.isTypeOnly)
+          return false;
+        let parent = node;
+        while (parent && !import_typescript.default.isImportDeclaration(parent))
+          parent = parent.parent;
+        return !!parent && import_typescript.default.isImportDeclaration(parent) && !parent.importClause?.isTypeOnly && import_typescript.default.isStringLiteral(parent.moduleSpecifier) && parent.moduleSpecifier.text.startsWith(".") && resolve3(dirname(absolute), parent.moduleSpecifier.text) === lock;
+      };
+      const initializer = (node) => {
+        const decl = declaration(node);
+        return decl && import_typescript.default.isVariableDeclaration(decl) && import_typescript.default.isVariableDeclarationList(decl.parent) && !!(decl.parent.flags & import_typescript.default.NodeFlags.Const) ? decl.initializer : undefined;
+      };
+      const unwrap = (node) => {
+        while (import_typescript.default.isParenthesizedExpression(node) || import_typescript.default.isAsExpression(node) || import_typescript.default.isTypeAssertionExpression(node) || import_typescript.default.isNonNullExpression(node))
+          node = node.expression;
+        return node;
+      };
+      const literal = (expression, seen = new Set) => {
+        const node = unwrap(expression);
+        if (seen.has(node))
+          return;
+        seen.add(node);
+        if (import_typescript.default.isStringLiteral(node) || import_typescript.default.isNoSubstitutionTemplateLiteral(node))
+          return node.text;
+        if (import_typescript.default.isIdentifier(node)) {
+          const init = initializer(node);
+          return init ? literal(init, seen) : undefined;
+        }
+        if (import_typescript.default.isBinaryExpression(node) && node.operatorToken.kind === import_typescript.default.SyntaxKind.PlusToken) {
+          const a = literal(node.left, new Set(seen)), b = literal(node.right, new Set(seen));
+          return a !== undefined && b !== undefined ? a + b : undefined;
+        }
+      };
+      const lockPath = (node) => import_typescript.default.isStringLiteral(node) && node.text.startsWith(".") && resolve3(dirname(absolute), node.text) === lock;
+      const isConstBinding = (node) => import_typescript.default.isVariableDeclarationList(node.parent) && !!(node.parent.flags & import_typescript.default.NodeFlags.Const);
+      const isLock = (expression, seen = new Set) => {
+        const node = unwrap(expression);
+        if (seen.has(node))
+          return false;
+        seen.add(node);
+        if (import_typescript.default.isCallExpression(node) && import_typescript.default.isIdentifier(node.expression) && node.expression.text === "require" && !declaration(node.expression) && node.arguments.length === 1)
+          return lockPath(node.arguments[0]);
+        if (!import_typescript.default.isIdentifier(node))
+          return false;
+        const decl = declaration(node);
+        if (decl && (import_typescript.default.isImportClause(decl) || import_typescript.default.isNamespaceImport(decl)))
+          return imported(decl);
+        const init = initializer(node);
+        return !!init && isLock(init, seen);
+      };
+      const isTable = (expression, seen = new Set) => {
+        const node = unwrap(expression);
+        if (seen.has(node))
+          return false;
+        seen.add(node);
+        if (import_typescript.default.isPropertyAccessExpression(node))
+          return node.name.text === "prompts" && isLock(node.expression);
+        if (import_typescript.default.isElementAccessExpression(node))
+          return literal(node.argumentExpression) === "prompts" && isLock(node.expression);
+        if (import_typescript.default.isIdentifier(node)) {
+          const decl = declaration(node);
+          if (decl && import_typescript.default.isBindingElement(decl) && import_typescript.default.isObjectBindingPattern(decl.parent) && import_typescript.default.isVariableDeclaration(decl.parent.parent)) {
+            const owner = decl.parent.parent;
+            const name = decl.propertyName ?? decl.name;
+            if (!decl.dotDotDotToken && !decl.initializer && (import_typescript.default.isIdentifier(name) || import_typescript.default.isStringLiteral(name)) && name.text === "prompts" && isConstBinding(owner) && owner.initializer)
+              return isLock(owner.initializer);
+          }
+          if (decl && import_typescript.default.isImportSpecifier(decl))
+            return (decl.propertyName?.text ?? decl.name.text) === "prompts" && imported(decl);
+          const init = initializer(node);
+          return !!init && isTable(init, seen);
+        }
+        return false;
+      };
+      const visit = (node) => {
+        if ((import_typescript.default.isElementAccessExpression(node) || import_typescript.default.isPropertyAccessExpression(node)) && isTable(node.expression)) {
+          const key = import_typescript.default.isElementAccessExpression(node) ? literal(node.argumentExpression) : node.name.text;
+          result.references.push({
+            path: file.path,
+            line: sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1,
+            key,
+            status: key === undefined ? "unresolved" : known.has(key) ? "mapped" : "missing"
+          });
+        }
+        import_typescript.default.forEachChild(node, visit);
+      };
+      visit(sf);
+    } catch (error) {
+      result.issues.push({ path: file.path, reason: error instanceof Error ? error.message : String(error) });
+    }
+  }
+  return result;
+}
+
 // src/prompts.ts
 var MODA_DIR = ".moda";
 var MANIFEST_PATH = join(MODA_DIR, "prompts.yml");
@@ -6101,8 +6229,8 @@ async function runPromptsCommand(input, legacyFlags, legacyProfileOptions) {
 }
 async function initPrompts(options = {}) {
   const cwd = process.cwd();
-  const manifestPath = resolve3(cwd, MANIFEST_PATH);
-  const lockPath = resolve3(cwd, LOCK_PATH);
+  const manifestPath = resolve4(cwd, MANIFEST_PATH);
+  const lockPath = resolve4(cwd, LOCK_PATH);
   if (existsSync2(MODA_DIR) && lstatSync(MODA_DIR).isSymbolicLink())
     throw new Error(".moda must not be a symlink.");
   mkdirSync(MODA_DIR, { recursive: true });
@@ -6151,8 +6279,8 @@ async function syncPrompts(flags, profileOptions, context) {
 async function runPromptSync(flags, profileOptions, options = {}) {
   if (flags["dry-run"] === "true")
     return runPromptSyncExclusive(flags, profileOptions, options);
-  mkdirSync(dirname(MANIFEST_PATH), { recursive: true });
-  const syncLock = resolve3(dirname(MANIFEST_PATH), "prompts.sync.lock");
+  mkdirSync(dirname2(MANIFEST_PATH), { recursive: true });
+  const syncLock = resolve4(dirname2(MANIFEST_PATH), "prompts.sync.lock");
   try {
     mkdirSync(syncLock);
   } catch (error) {
@@ -6181,7 +6309,7 @@ async function runPromptSyncExclusive(flags, profileOptions, options) {
   const analyzedDefinitions = new Map;
   if (flags["no-analyze"] !== "true") {
     options.onProgress?.("Analyzing prompt sources before sync.");
-    const { analyzeHarnessPrompts } = await import("./harness-g0jbmgsx.js");
+    const { analyzeHarnessPrompts } = await import("./harness-1xj4f0qp.js");
     const result = await analyzeHarnessPrompts({
       rootDir: process.cwd(),
       existing: established.flatMap((prompt) => prompt.sourceDefinition ? [prompt.sourceDefinition.source] : []),
@@ -6190,10 +6318,10 @@ async function runPromptSyncExclusive(flags, profileOptions, options) {
       dryRun: flags["dry-run"] === "true",
       onProgress: options.onProgress
     });
-    const legacyPaths = new Set(established.filter((prompt) => !prompt.sourceDefinition).map((prompt) => resolve3(prompt.sourcePath)));
+    const legacyPaths = new Set(established.filter((prompt) => !prompt.sourceDefinition).map((prompt) => resolve4(prompt.sourcePath)));
     const exclusions = manifest.promptPaths.filter((pattern) => pattern.startsWith("!")).map((pattern) => pattern.slice(1));
-    const excludedPaths = new Set(exclusions.length ? import_fast_glob.default.sync(exclusions, { cwd: process.cwd(), onlyFiles: true, dot: true, followSymbolicLinks: false }).map((path) => resolve3(path)) : []);
-    const found = result.sources.filter((source) => !legacyPaths.has(resolve3(source.path)) && !excludedPaths.has(resolve3(source.path)));
+    const excludedPaths = new Set(exclusions.length ? import_fast_glob.default.sync(exclusions, { cwd: process.cwd(), onlyFiles: true, dot: true, followSymbolicLinks: false }).map((path) => resolve4(path)) : []);
+    const found = result.sources.filter((source) => !legacyPaths.has(resolve4(source.path)) && !excludedPaths.has(resolve4(source.path)));
     for (const source of found) {
       const analyzed = result.resolved.find((item) => item.key === source.key);
       if (!analyzed)
@@ -6209,6 +6337,11 @@ async function runPromptSyncExclusive(flags, profileOptions, options) {
   const mergedSources = mergePromptSources(manifest.sources, extraSources);
   const manifestUpdate = stableJson(mergedSources) === stableJson(mergePromptSources(manifest.sources, [])) ? undefined : $stringify({ version: 2, prompt_paths: manifest.promptPaths, sources: mergedSources });
   const prompts = discoverPrompts(extraSources);
+  const attribution = checkPromptAttribution(process.cwd(), prompts.map((prompt) => prompt.key));
+  const brokenAttribution = attribution.references.filter((reference) => reference.status === "missing");
+  if (brokenAttribution.length) {
+    throw new Error(`Prompt attribution keys are absent from this sync: ${brokenAttribution.map((reference) => `'${reference.key}' at ${reference.path}:${reference.line}`).join(", ")}. Map the referenced key to its verified source in .moda/prompts.yml, or update the runtime lookup to the intended mapped key. No prompt versions were uploaded.`);
+  }
   for (const prompt of prompts) {
     const analyzed = analyzedDefinitions.get(prompt.key);
     if (analyzed && analyzed !== stableJson(prompt.sourceDefinition))
@@ -6226,7 +6359,7 @@ async function runPromptSyncExclusive(flags, profileOptions, options) {
   if (prompts.length === 0) {
     if (!dryRun && flags["allow-untrack"] === "true")
       writeLock([], []);
-    return { synced: [], dryRun, discovery };
+    return { synced: [], dryRun, discovery, attribution };
   }
   const signature = stableJson(prompts);
   const response = await callControlAPI("/prompts/sync", {
@@ -6258,7 +6391,7 @@ async function runPromptSyncExclusive(flags, profileOptions, options) {
       atomicWrite(MANIFEST_PATH, manifestUpdate);
     writeLock(prompts, synced);
   }
-  return { synced: response.synced ?? [], dryRun, discovery };
+  return { synced: response.synced ?? [], dryRun, discovery, attribution };
 }
 function writePromptSyncProgress(message, context, quiet = false) {
   if (quiet || context?.quiet)
@@ -6277,12 +6410,17 @@ async function syncPromptsOnce(flags, profileOptions, context) {
   const payload = {
     synced: result.synced,
     discovery: result.discovery,
+    attribution: result.attribution,
     lockfile: result.dryRun ? undefined : LOCK_PATH
   };
   if (context)
     context.output.writeData(payload);
   else
     printJson(payload);
+  if (!result.dryRun && result.synced.length === 0 && result.discovery?.candidates?.length) {
+    writePromptSyncProgress("No eligible prompt sources were synced. Review discovery.pending and discovery.related.", context, flags.quiet === "true");
+    process.exitCode = 1;
+  }
 }
 async function watchPromptSync(flags, profileOptions) {
   await syncPromptsOnce(flags, profileOptions);
@@ -6298,7 +6436,7 @@ async function watchPromptSync(flags, profileOptions) {
         await syncPromptsOnce({ ...flags, watch: "false", "no-analyze": "true" }, profileOptions);
       }
     }
-    await new Promise((resolve4) => setTimeout(resolve4, intervalMs));
+    await new Promise((resolve5) => setTimeout(resolve5, intervalMs));
   }
 }
 async function promotePrompt(positionals, flags, profileOptions, context) {
@@ -6362,7 +6500,7 @@ function discoverPrompts(extraSources = []) {
     const positive = pattern.startsWith("!") ? pattern.slice(1) : pattern;
     if (isAbsolute3(positive) || positive.split(/[\\/]/).includes(".."))
       throw new Error(`Prompt pattern must stay inside the repository: ${pattern}`);
-    if (!pattern.startsWith("!") && !import_fast_glob.default.isDynamicPattern(pattern) && !existsSync2(resolve3(root, pattern))) {
+    if (!pattern.startsWith("!") && !import_fast_glob.default.isDynamicPattern(pattern) && !existsSync2(resolve4(root, pattern))) {
       throw new Error(`Configured prompt file is missing: ${pattern}`);
     }
   }
@@ -6377,11 +6515,11 @@ function discoverPrompts(extraSources = []) {
   const sources = new Map(manifest.sources.map((source) => [source.key, source]));
   for (const source of extraSources)
     sources.set(source.key, source);
-  const selectedPaths = new Set([...sources.values()].map((source) => resolve3(root, source.path)));
-  const prompts = paths.filter((path) => !selectedPaths.has(resolve3(root, path))).map((path) => {
+  const selectedPaths = new Set([...sources.values()].map((source) => resolve4(root, source.path)));
+  const prompts = paths.filter((path) => !selectedPaths.has(resolve4(root, path))).map((path) => {
     assertContainedSource(root, path);
     if (/\.prompt\.(md|json)$/i.test(path))
-      return parsePromptFile(resolve3(root, path));
+      return parsePromptFile(resolve4(root, path));
     return normalizePrompt(resolvePromptSource(root, { key: keyFromPath(path), path }));
   });
   for (const source of sources.values())
@@ -6395,15 +6533,15 @@ function discoverPrompts(extraSources = []) {
   return prompts.sort((a, b) => a.key.localeCompare(b.key));
 }
 function assertContainedSource(root, path) {
-  const abs = resolve3(root, path);
+  const abs = resolve4(root, path);
   const rel = relative(realpathSync(root), realpathSync(abs));
   if (rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute3(rel))
     throw new Error(`Prompt source escapes repository: ${path}`);
   let cursor = abs;
-  while (cursor !== resolve3(root)) {
+  while (cursor !== resolve4(root)) {
     if (lstatSync(cursor).isSymbolicLink())
       throw new Error(`Prompt source uses a symlink: ${path}`);
-    const next = dirname(cursor);
+    const next = dirname2(cursor);
     if (next === cursor)
       throw new Error(`Prompt source escapes repository: ${path}`);
     cursor = next;
@@ -6520,7 +6658,7 @@ function readManifest() {
 function readHarnessSources(reportPath) {
   const selected = reportPath === "true" ? ".moda/harness-report.json" : reportPath;
   assertContainedSource(process.cwd(), selected);
-  const report = JSON.parse(readFileSync(resolve3(selected), "utf8"));
+  const report = JSON.parse(readFileSync(resolve4(selected), "utf8"));
   if (!Array.isArray(report?.graph?.artifacts))
     throw new Error("Expected a harness report with graph.artifacts.");
   const artifacts = report.graph.artifacts.filter((artifact) => artifact.type === "prompt");
@@ -6555,8 +6693,8 @@ function mergePromptSources(existingSources, sources) {
   return [...merged.values()].sort((a, b) => a.key.localeCompare(b.key));
 }
 function atomicWrite(path, content) {
-  mkdirSync(dirname(path), { recursive: true });
-  assertContainedSource(process.cwd(), dirname(path));
+  mkdirSync(dirname2(path), { recursive: true });
+  assertContainedSource(process.cwd(), dirname2(path));
   if (existsSync2(path) && lstatSync(path).isSymbolicLink())
     throw new Error(`Refusing to overwrite symlink: ${path}`);
   const temp = `${path}.${process.pid}.tmp`;
@@ -6597,7 +6735,7 @@ function writeLock(prompts, synced) {
       }];
     }))
   };
-  mkdirSync(dirname(LOCK_PATH), { recursive: true });
+  mkdirSync(dirname2(LOCK_PATH), { recursive: true });
   atomicWrite(LOCK_PATH, `${JSON.stringify(lock, null, 2)}
 `);
 }
@@ -6658,10 +6796,10 @@ import { join as join3 } from "node:path";
 import { confirm } from "@inquirer/prompts";
 
 // src/package-assets.ts
-import { dirname as dirname2, join as join2 } from "node:path";
+import { dirname as dirname3, join as join2 } from "node:path";
 import { fileURLToPath } from "node:url";
 function packageAssetPath(...parts) {
-  return join2(dirname2(fileURLToPath(import.meta.url)), "..", ...parts);
+  return join2(dirname3(fileURLToPath(import.meta.url)), "..", ...parts);
 }
 
 // src/init/rules.ts
@@ -6838,7 +6976,7 @@ import {
   readFileSync as readFileSync5,
   writeFileSync as writeFileSync6
 } from "node:fs";
-import { basename, dirname as dirname5, join as join7, relative as relative3 } from "node:path";
+import { basename, dirname as dirname6, join as join7, relative as relative3 } from "node:path";
 
 // src/skills-manifest.ts
 import {
@@ -6850,7 +6988,7 @@ import {
   unlinkSync,
   writeFileSync as writeFileSync4
 } from "node:fs";
-import { dirname as dirname3, isAbsolute as isAbsolute4, join as join5, normalize, relative as relative2, resolve as resolve4 } from "node:path";
+import { dirname as dirname4, isAbsolute as isAbsolute4, join as join5, normalize, relative as relative2, resolve as resolve5 } from "node:path";
 var SKILLS_MANIFEST_PATH = join5(".moda", "skills.yml");
 var SKILL_SOURCE_HARNESS = "moda";
 var SKILL_SOURCE_INTEGRATION_BUNDLED = "integration-bundled";
@@ -6910,7 +7048,7 @@ function writeSkillsManifest(cwd, header, records) {
     ]),
     ""
   ];
-  mkdirSync3(dirname3(manifestPath), { recursive: true });
+  mkdirSync3(dirname4(manifestPath), { recursive: true });
   writeFileSync4(manifestPath, lines.join(`
 `));
 }
@@ -6941,7 +7079,7 @@ function pruneManagedSkillPaths(cwd, managedPaths, log) {
 function pruneEmptyClaudeSkillDir(cwd, relativePath) {
   if (!relativePath.startsWith(".claude/skills/") || !relativePath.endsWith("/SKILL.md"))
     return;
-  const dir = dirname3(join5(cwd, relativePath));
+  const dir = dirname4(join5(cwd, relativePath));
   try {
     if (existsSync5(dir) && readdirSync(dir).length === 0) {
       rmdirSync(dir);
@@ -6949,8 +7087,8 @@ function pruneEmptyClaudeSkillDir(cwd, relativePath) {
   } catch {}
 }
 function absoluteManagedPath(cwd, relativePath) {
-  const abs = resolve4(cwd, relativePath);
-  const root = resolve4(cwd);
+  const abs = resolve5(cwd, relativePath);
+  const root = resolve5(cwd);
   const rel = relative2(root, abs);
   if (rel.startsWith("..") || isAbsolute4(rel))
     return null;
@@ -7061,7 +7199,7 @@ function yamlQuote(value) {
 
 // src/agents-md.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname4, join as join6 } from "node:path";
+import { dirname as dirname5, join as join6 } from "node:path";
 var AGENTS_MD_FILENAME = "AGENTS.md";
 var FIXES_BLOCK_BEGIN = "<!-- moda:fixes:begin -->";
 var FIXES_BLOCK_END = "<!-- moda:fixes:end -->";
@@ -7107,7 +7245,7 @@ function upsertManagedBlock(existing, block) {
 }
 function writeFileIfChanged(filePath, content) {
   try {
-    mkdirSync4(dirname4(filePath), { recursive: true });
+    mkdirSync4(dirname5(filePath), { recursive: true });
     if (existsSync6(filePath)) {
       const current = readFileSync4(filePath, "utf8");
       if (current === content)
@@ -7263,7 +7401,7 @@ function formatRunStatusHuman(run, events) {
 }
 function writeIfChanged(filePath, content) {
   try {
-    mkdirSync5(dirname5(filePath), { recursive: true });
+    mkdirSync5(dirname6(filePath), { recursive: true });
     if (existsSync7(filePath)) {
       const current = readFileSync5(filePath, "utf8");
       if (current === content)
@@ -7407,7 +7545,7 @@ function discoverLocalSkills(cwd) {
     const sourcePath = relative3(cwd, absPath).replace(/\\/g, "/");
     if (managed.has(sourcePath))
       continue;
-    const key = basename(dirname5(absPath));
+    const key = basename(dirname6(absPath));
     if (key === "moda-cli" || !/^[A-Za-z0-9_-]+$/.test(key))
       continue;
     let content;
@@ -7555,7 +7693,7 @@ function safeSkillId(skillId) {
 }
 function writeSkillProposalManifest(cwd, proposal, relativePath) {
   const manifestPath = join7(cwd, SKILL_PROPOSALS_MANIFEST_PATH);
-  mkdirSync5(dirname5(manifestPath), { recursive: true });
+  mkdirSync5(dirname6(manifestPath), { recursive: true });
   const existing = existsSync7(manifestPath) ? readFileSync5(manifestPath, "utf8") : `applied_proposals:
 `;
   const entry = [

package/dist/cli.js

@@ -8,7 +8,7 @@ import {
   runPromptsCommand,
   runSkillsCommand,
   runStatusCommand
-} from "./cli-q9t1tr1z.js";
+} from "./cli-cagbc7wz.js";
 import {
   ApiError,
   HARNESS_REPORT_APPROVAL_PATH,
@@ -29,7 +29,7 @@ import {
   summarizeHarness,
   terminalStyles,
   validateHarnessReport
-} from "./cli-xwqb83jb.js";
+} from "./cli-8q7jffnj.js";
 import {
   authFetch,
   clearAuthSession,
@@ -6580,7 +6580,7 @@ var commandRegistry = createCommandRegistry([
     resetApiRequestCountBeforeRun: true,
     telemetry: "result",
     handler: async (context) => {
-      const { runInit } = await import("./index-a0hvade2.js");
+      const { runInit } = await import("./index-h6gg66n5.js");
       if (context.outputMode === "agent-stream") {
         context.output.writeEvent({
           event: "started",

package/dist/{harness-g0jbmgsx.js → harness-1xj4f0qp.js}

@@ -42,7 +42,7 @@ import {
   writeHarnessAnalyzeResult,
   writeHarnessArtifacts,
   writeHumanProgress
-} from "./cli-xwqb83jb.js";
+} from "./cli-8q7jffnj.js";
 import"./cli-0h32yvwq.js";
 export {
   writeHumanProgress,

package/dist/{harness-github-actions-43kt57xm.js → harness-github-actions-xk7n788g.js}

@@ -1,6 +1,6 @@
 import {
   buildSourceSnapshot
-} from "./cli-xwqb83jb.js";
+} from "./cli-8q7jffnj.js";
 import"./cli-0h32yvwq.js";
 
 // src/harness-github-actions.ts

package/dist/{index-a0hvade2.js → index-h6gg66n5.js}

@@ -10,7 +10,7 @@ import {
   runPromptSync,
   runSkillSync,
   upsertSkillManifestRecord
-} from "./cli-q9t1tr1z.js";
+} from "./cli-cagbc7wz.js";
 import {
   codingAgentDisplayName,
   describeCodingAgentEvent,
@@ -28,7 +28,7 @@ import {
   runHarnessCommand,
   startRemoteAnalyze,
   stripAnsi
-} from "./cli-xwqb83jb.js";
+} from "./cli-8q7jffnj.js";
 import {
   selectTenantAndCreateKey
 } from "./cli-4ycvzfdg.js";

package/dist/prompt-source-mcp.js

@@ -5,7 +5,7 @@ import {
   inspectCodeSelectors,
   inspectPythonSelectors,
   safePromptEvidencePath
-} from "./cli-xwqb83jb.js";
+} from "./cli-8q7jffnj.js";
 import {
   __commonJS,
   __toESM

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.34.0",
+  "version": "1.34.1",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-09-21T22:32:21.368Z",
-  "cli_version": "1.34.0",
+  "bundled_at": "2026-09-22T23:28:01.590Z",
+  "cli_version": "1.34.1",
   "skills": [
     {
       "id": "integration-cloudflare-think",