@moda-ai/cli 1.36.0 → 1.38.0

package/dist/{index-pf2hvadv.js → index-hwfe7gs8.js}

@@ -1,16 +1,9 @@
 import {
-  SKILL_SOURCE_INTEGRATION_BUNDLED,
   buildDoctorReport,
-  claudeSkillToCursorRule,
-  detectAgents,
   initPrompts,
-  installRules,
-  packageAssetPath,
-  readSkillsManifest,
   runPromptSync,
-  runSkillSync,
-  upsertSkillManifestRecord
-} from "./cli-7qkhy41j.js";
+  runSkillSync
+} from "./cli-3kcy61fr.js";
 import {
   codingAgentDisplayName,
   describeCodingAgentEvent,
@@ -18,6 +11,7 @@ import {
   describeSyncTenantLabel,
   detectAvailableCodingAgents,
   isDeterministicLocalAnalyst,
+  isRecoverableRemoteRun,
   pollRemoteAnalyzeUntilDone,
   renderInitBanner,
   renderInitComplete,
@@ -28,14 +22,26 @@ import {
   runHarnessCommand,
   startRemoteAnalyze,
   stripAnsi
-} from "./cli-0p6n391h.js";
+} from "./cli-07tv75te.js";
+import {
+  bundledSkillsDir,
+  installIntegrationSkill,
+  readBundledIndex
+} from "./cli-c5c6f0yw.js";
+import {
+  detectAgents,
+  installRules
+} from "./cli-ssfq84k5.js";
 import {
   selectTenantAndCreateKey
-} from "./cli-scjxgaba.js";
+} from "./cli-k38j2fpq.js";
 import {
+  ConnectCodeError,
+  connectWithCode,
+  loadAuthSession,
   loadToken,
   login
-} from "./cli-yz99t7n8.js";
+} from "./cli-kegd748v.js";
 import {
   CliAuthError,
   CliInputError,
@@ -43,154 +49,47 @@ import {
   createCommandContext,
   resolveIngestUrl,
   resolveModaBaseUrl
-} from "./cli-drabjmaj.js";
+} from "./cli-q79sq80a.js";
+import"./cli-0v6na3yp.js";
 
 // src/init/index.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, readdirSync as readdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname4, join as join6 } from "node:path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readdirSync as readdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname3, join as join5 } from "node:path";
 import { checkbox, confirm, select } from "@inquirer/prompts";
 
 // src/init/sdk-guide.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2, join as join3 } from "node:path";
-
-// src/skills-bundled.ts
-import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join, relative } from "node:path";
-var BUNDLED_SKILLS_DIR = packageAssetPath("skills", "integration");
-function bundledSkillsDir() {
-  return process.env.MODA_BUNDLED_SKILLS_DIR || BUNDLED_SKILLS_DIR;
-}
-function readBundledIndex() {
-  const indexPath = join(bundledSkillsDir(), "index.json");
-  if (!existsSync(indexPath))
-    return null;
-  try {
-    const parsed = JSON.parse(readFileSync(indexPath, "utf8"));
-    if (!Array.isArray(parsed.skills))
-      return null;
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function installIntegrationSkill(skillId, cwd = process.cwd()) {
-  if (!/^[a-z0-9-]+$/.test(skillId)) {
-    throw new Error(`Invalid integration skill id: ${JSON.stringify(skillId).slice(0, 80)}`);
-  }
-  const sourceDir = join(bundledSkillsDir(), skillId);
-  if (!existsSync(join(sourceDir, "SKILL.md"))) {
-    const bundled = readBundledIndex()?.skills.map((skill) => skill.id) ?? [];
-    throw new Error(`Integration skill '${skillId}' is not bundled with this CLI.${bundled.length > 0 ? ` Bundled skills: ${bundled.join(", ")}` : ""}`);
-  }
-  const files = listFilesRecursive(sourceDir).sort();
-  const plannedWrites = [];
-  for (const file of files) {
-    const relPath = relative(sourceDir, file).replace(/\\/g, "/");
-    plannedWrites.push({
-      targetRelPath: `.claude/skills/${skillId}/${relPath}`,
-      targetPath: join(cwd, ".claude", "skills", skillId, relPath),
-      content: readFileSync(file, "utf8")
-    });
-  }
-  const writeCursor = detectAgents().includes("Cursor") || existsSync(join(cwd, ".cursor"));
-  if (writeCursor) {
-    const skillMd = readFileSync(join(sourceDir, "SKILL.md"), "utf8");
-    plannedWrites.push({
-      targetRelPath: `.cursor/rules/${skillId}.mdc`,
-      targetPath: join(cwd, ".cursor", "rules", `${skillId}.mdc`),
-      content: claudeSkillToCursorRule(skillMd)
-    });
-  }
-  const ownedPaths = new Set((readSkillsManifest(cwd)?.records ?? []).flatMap((record) => record.paths));
-  const collisions = plannedWrites.filter((write) => existsSync(write.targetPath) && !ownedPaths.has(write.targetRelPath));
-  if (collisions.length > 0) {
-    throw new Error(`Refusing to overwrite ${collisions.length} existing file(s) not managed by Moda: ` + `${collisions.map((write) => write.targetRelPath).join(", ")}. ` + "Move or remove them, then re-run to install the bundled integration skill.");
-  }
-  const paths = [];
-  let wroteAny = false;
-  for (const write of plannedWrites) {
-    if (writeIfChanged(write.targetPath, write.content))
-      wroteAny = true;
-    paths.push(write.targetRelPath);
-  }
-  upsertSkillManifestRecord(cwd, {
-    skillId,
-    contentHash: hashSkillDir(sourceDir, files),
-    source: SKILL_SOURCE_INTEGRATION_BUNDLED,
-    paths
-  });
-  return { skillId, status: wroteAny ? "installed" : "unchanged", paths };
-}
-function writeIfChanged(path, content) {
-  if (existsSync(path)) {
-    try {
-      if (readFileSync(path, "utf8") === content)
-        return false;
-    } catch {}
-  }
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, content);
-  return true;
-}
-function listFilesRecursive(dir) {
-  const files = [];
-  const stack = [dir];
-  while (stack.length > 0) {
-    const current = stack.pop();
-    if (!current)
-      continue;
-    for (const entry of readdirSync(current, { withFileTypes: true })) {
-      const path = join(current, entry.name);
-      if (entry.isDirectory())
-        stack.push(path);
-      else if (entry.isFile())
-        files.push(path);
-    }
-  }
-  return files;
-}
-function hashSkillDir(sourceDir, files) {
-  const hash = createHash("sha256");
-  for (const file of files) {
-    hash.update(relative(sourceDir, file).replace(/\\/g, "/"));
-    hash.update("\x00");
-    hash.update(readFileSync(file));
-    hash.update("\x00");
-  }
-  return hash.digest("hex");
-}
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join as join2 } from "node:path";
 
 // src/init/sdk-catalog.ts
 import {
   copyFileSync,
-  existsSync as existsSync2,
-  mkdirSync as mkdirSync2,
-  readdirSync as readdirSync2,
+  existsSync,
+  mkdirSync,
+  readdirSync,
   rmSync,
   statSync
 } from "node:fs";
-import { join as join2, relative as relative2, resolve } from "node:path";
+import { join, relative, resolve } from "node:path";
 function materializeSdkCatalog(cwd, runId) {
   if (!/^[a-z0-9-]+$/.test(runId)) {
     throw new Error(`Invalid SDK catalog run id: ${JSON.stringify(runId).slice(0, 80)}`);
   }
   const sourceDir = bundledSkillsDir();
-  const indexPath = join2(sourceDir, "index.json");
-  if (!existsSync2(sourceDir) || !existsSync2(indexPath)) {
+  const indexPath = join(sourceDir, "index.json");
+  if (!existsSync(sourceDir) || !existsSync(indexPath)) {
     throw missingBundleError(sourceDir);
   }
   const index = readBundledIndex();
   if (!index) {
     throw missingBundleError(sourceDir);
   }
-  const dir = join2(cwd, ".moda", "tmp", `sdk-catalog-${runId}`);
+  const dir = join(cwd, ".moda", "tmp", `sdk-catalog-${runId}`);
   cleanupSdkCatalog(dir);
   copyDirectoryRecursive(sourceDir, dir);
   return {
     dir,
-    relativeDir: relative2(cwd, dir).replace(/\\/g, "/"),
+    relativeDir: relative(cwd, dir).replace(/\\/g, "/"),
     index
   };
 }
@@ -216,10 +115,10 @@ function renderCatalogListing(index) {
 `);
 }
 function copyDirectoryRecursive(sourceDir, targetDir) {
-  mkdirSync2(targetDir, { recursive: true });
-  for (const entry of readdirSync2(sourceDir, { withFileTypes: true })) {
-    const source = join2(sourceDir, entry.name);
-    const target = join2(targetDir, entry.name);
+  mkdirSync(targetDir, { recursive: true });
+  for (const entry of readdirSync(sourceDir, { withFileTypes: true })) {
+    const source = join(sourceDir, entry.name);
+    const target = join(targetDir, entry.name);
     if (entry.isDirectory()) {
       copyDirectoryRecursive(source, target);
     } else if (entry.isFile()) {
@@ -230,9 +129,9 @@ function copyDirectoryRecursive(sourceDir, targetDir) {
 function missingBundleError(sourceDir) {
   let detail = "is absent";
   try {
-    if (existsSync2(sourceDir) && !statSync(sourceDir).isDirectory()) {
+    if (existsSync(sourceDir) && !statSync(sourceDir).isDirectory()) {
       detail = "is not a directory";
-    } else if (existsSync2(sourceDir)) {
+    } else if (existsSync(sourceDir)) {
       detail = "has no readable index.json";
     }
   } catch {
@@ -245,10 +144,10 @@ function missingBundleError(sourceDir) {
 var SDK_GUIDE_PATH = ".moda/SDK_INTEGRATION.md";
 function writeSdkIntegrationGuide(cwd = process.cwd()) {
   const relativePath = SDK_GUIDE_PATH;
-  const absolutePath = join3(cwd, relativePath);
+  const absolutePath = join2(cwd, relativePath);
   const content = renderSdkIntegrationGuideContent();
-  mkdirSync3(dirname2(absolutePath), { recursive: true });
-  writeFileSync2(absolutePath, content);
+  mkdirSync2(dirname(absolutePath), { recursive: true });
+  writeFileSync(absolutePath, content);
   return relativePath;
 }
 function renderSdkIntegrationGuideContent() {
@@ -367,11 +266,11 @@ function readRuntimeSummary(cwd) {
     providers: [],
     runtimeAgentNames: []
   };
-  const path = join3(cwd, ".moda", "harness.json");
-  if (!existsSync3(path))
+  const path = join2(cwd, ".moda", "harness.json");
+  if (!existsSync2(path))
     return empty;
   try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
     if (!isRecord(parsed))
       return empty;
     const runtimeAgents = Array.isArray(parsed.runtimeAgents) ? parsed.runtimeAgents : [];
@@ -415,22 +314,22 @@ function isRecord(value) {
 import { randomBytes as randomBytes2 } from "node:crypto";
 import {
   closeSync,
-  existsSync as existsSync5,
-  mkdirSync as mkdirSync4,
+  existsSync as existsSync4,
+  mkdirSync as mkdirSync3,
   openSync,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync3,
   readSync,
-  readdirSync as readdirSync3,
+  readdirSync as readdirSync2,
   rmSync as rmSync2,
   statSync as statSync2,
-  writeFileSync as writeFileSync3
+  writeFileSync as writeFileSync2
 } from "node:fs";
-import { dirname as dirname3, join as join5, relative as relative3, resolve as resolve2 } from "node:path";
+import { dirname as dirname2, join as join4, relative as relative2, resolve as resolve2 } from "node:path";
 import { spawnSync } from "node:child_process";
 
 // src/init/sdk-protocol.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "node:fs";
-import { join as join4 } from "node:path";
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "node:fs";
+import { join as join3 } from "node:path";
 import { z } from "zod";
 var SDK_RESULT_SCHEMA_VERSION = "moda.sdk_integration_result.v1";
 var SDK_RESULT_JSON_BEGIN = "MODA_SDK_RESULT_JSON_BEGIN";
@@ -522,10 +421,10 @@ var SdkAgentResultSchema = z.object({
 });
 function extractSdkAgentResult(opts) {
   const diagnostics = [];
-  const resultPath = join4(opts.cwd, SDK_RESULT_FILE);
-  if (existsSync4(resultPath)) {
+  const resultPath = join3(opts.cwd, SDK_RESULT_FILE);
+  if (existsSync3(resultPath)) {
     try {
-      const parsed = parseCandidate(readFileSync3(resultPath, "utf8"));
+      const parsed = parseCandidate(readFileSync2(resultPath, "utf8"));
       if (parsed.result)
         return { result: parsed.result, source: "file" };
       diagnostics.push(`result file: ${parsed.detail}`);
@@ -585,6 +484,12 @@ var MAX_TIMEOUT_MS = 600000;
 function generateVerificationId() {
   return `moda-verify-${randomBytes(16).toString("hex")}`;
 }
+function isModaVerificationId(value) {
+  return /^moda-verify-[0-9a-f]{32}$/.test(value);
+}
+function isAcceptedVerificationId(value) {
+  return isModaVerificationId(value) || /^onb_[A-Za-z0-9]{16}$/.test(value);
+}
 async function verifyExactTrace(opts) {
   const now = opts.now ?? Date.now;
   const sleep = opts.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
@@ -776,7 +681,7 @@ async function runSdkIntegration(options = {}) {
   const verify = options.verify ?? verifyExactTrace;
   const maxRepairAttempts = resolveMaxRepairAttempts(options.maxRepairAttempts);
   const runId = randomBytes2(4).toString("hex");
-  const verificationId = generateVerificationId();
+  const verificationId = options.verificationId ?? generateVerificationId();
   let catalog;
   let gitBaseline = null;
   let runStartedAt = Date.now();
@@ -1162,7 +1067,7 @@ function scanForSecrets(cwd, paths, apiKey) {
     const absPath = resolve2(cwd, relPath);
     if (!absPath.startsWith(resolvedCwd + "/") && absPath !== resolvedCwd)
       continue;
-    if (!existsSync5(absPath))
+    if (!existsSync4(absPath))
       continue;
     let stat;
     try {
@@ -1174,7 +1079,7 @@ function scanForSecrets(cwd, paths, apiKey) {
       continue;
     let content;
     try {
-      content = stat.size > MAX_SCAN_FILE_BYTES ? readFilePrefix(absPath, MAX_SCAN_FILE_BYTES) : readFileSync4(absPath, "utf8");
+      content = stat.size > MAX_SCAN_FILE_BYTES ? readFilePrefix(absPath, MAX_SCAN_FILE_BYTES) : readFileSync3(absPath, "utf8");
     } catch {
       continue;
     }
@@ -1210,7 +1115,7 @@ function collectSecretScanFiles(cwd, paths) {
   const addFile = (path) => {
     if (files.length >= MAX_SCANNED_FILES || !isInsideRepo(path))
       return;
-    const relPath = relative3(resolvedCwd, path).replace(/\\/g, "/");
+    const relPath = relative2(resolvedCwd, path).replace(/\\/g, "/");
     if (!relPath || seenFiles.has(relPath))
       return;
     seenFiles.add(relPath);
@@ -1221,13 +1126,13 @@ function collectSecretScanFiles(cwd, paths) {
       return;
     let entries;
     try {
-      entries = readdirSync3(dir, { withFileTypes: true });
+      entries = readdirSync2(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry.isFile() && (entry.name === ".env" || entry.name.startsWith(".env."))) {
-        addFile(join5(dir, entry.name));
+        addFile(join4(dir, entry.name));
       }
     }
   };
@@ -1240,14 +1145,14 @@ function collectSecretScanFiles(cwd, paths) {
       visitedDirectories += 1;
       let entries;
       try {
-        entries = readdirSync3(dir, { withFileTypes: true });
+        entries = readdirSync2(dir, { withFileTypes: true });
       } catch {
         continue;
       }
       for (const entry of entries) {
         if (files.length >= MAX_SCANNED_FILES)
           break;
-        const path = join5(dir, entry.name);
+        const path = join4(dir, entry.name);
         if (entry.isDirectory())
           stack.push(path);
         else if (entry.isFile())
@@ -1263,8 +1168,8 @@ function collectSecretScanFiles(cwd, paths) {
     const absPath = resolve2(cwd, relPath);
     if (!isInsideRepo(absPath))
       continue;
-    addEnvFiles(dirname3(absPath));
-    if (!existsSync5(absPath))
+    addEnvFiles(dirname2(absPath));
+    if (!existsSync4(absPath))
       continue;
     let stat;
     try {
@@ -1353,9 +1258,9 @@ function renderProtocolRetryPrompt(catalogDir) {
 `);
 }
 function removeAgentResultFile(cwd) {
-  const path = join5(cwd, SDK_RESULT_FILE);
+  const path = join4(cwd, SDK_RESULT_FILE);
   try {
-    if (existsSync5(path))
+    if (existsSync4(path))
       rmSync2(path);
   } catch {}
 }
@@ -1469,9 +1374,9 @@ function composeFinalDetail(status, detail, verification, apiKey, guardsDegraded
   return combined ? redactSecretText(combined, apiKey) : undefined;
 }
 function writeFinalOutcomeArtifact(cwd, payload) {
-  const path = join5(cwd, SDK_RESULT_FILE);
-  mkdirSync4(dirname3(path), { recursive: true });
-  writeFileSync3(path, `${JSON.stringify({
+  const path = join4(cwd, SDK_RESULT_FILE);
+  mkdirSync3(dirname2(path), { recursive: true });
+  writeFileSync2(path, `${JSON.stringify({
     schema_version: OUTCOME_SCHEMA_VERSION,
     status: payload.status,
     verification_id: payload.verification_id,
@@ -1681,13 +1586,38 @@ function visibleLength(value) {
 
 // src/init/index.ts
 var HARNESS_PULL_RECOVERY = "moda harness pull --sync";
+var HARNESS_SKIP_NEXT = {
+  unavailable: "retry",
+  lost: "pull",
+  unfetched: "pull",
+  failed: "retry"
+};
+var HARNESS_SKIP_DETAILS = {
+  unavailable: "hosted analysis unavailable",
+  lost: "lost track of the hosted run",
+  unfetched: "could not fetch the finished run",
+  failed: "hosted run failed"
+};
+var HARNESS_SKIP_PLAN = {
+  unavailable: "unavailable",
+  lost: "status unknown",
+  unfetched: "finished but not fetched",
+  failed: "failed"
+};
+var HARNESS_SKIP_EVENT = {
+  unavailable: "unavailable",
+  lost: "could not be followed",
+  unfetched: "finished but could not be fetched",
+  failed: "failed on Moda"
+};
 var LANE_EVENT_THROTTLE_MS = 2000;
 async function runInit(flags, options = {}) {
   const explicitYes = flags.yes === true || flags.yes === "true" || flags.y === true || flags.y === "true";
   const json = flags.json === true || flags.json === "true";
   const agent = flags.agent === true || flags.agent === "true";
   const human = !json && !agent;
-  const yes = explicitYes || json || agent;
+  const noPrompts = flags.non_interactive === true || flags.non_interactive === "true";
+  const yes = explicitYes || json || agent || noPrompts;
   const phases = [];
   const log = (message) => {
     if (human)
@@ -1716,8 +1646,34 @@ async function runInit(flags, options = {}) {
   const profile = stringFlag(flags.profile);
   log(renderInitStep(1, 5, "Sign in", "No environment variable files are written. File changes are listed before completion."));
   let token = loadToken({ profile });
+  const connectCode = stringFlag(flagValue(flags, "connect-code", "connect_code"));
+  let codeTenantId;
+  if (connectCode) {
+    const previousEmail = token ? loadAuthSession({ profile })?.user_email : undefined;
+    try {
+      const connected = await connectWithCode(connectCode, {
+        profile,
+        tenantId: stringFlag(flagValue(flags, "tenant-id", "tenant_id"))
+      });
+      token = loadToken({ profile });
+      codeTenantId = connected.tenantId;
+      const email = connected.user.email || "your Moda account";
+      const replaced = previousEmail && previousEmail !== connected.user.email ? ` (replacing the CLI session for ${previousEmail})` : "";
+      log(renderInitNote(`Signed in as ${email} with the one-time code${replaced}`));
+      emit("auth", `Signed in as ${email} with the one-time code${replaced}.`);
+    } catch (error) {
+      if (!(error instanceof ConnectCodeError))
+        throw error;
+      if (error.reason === "workspace_mismatch") {
+        throw new CliInputError(error.message, "Copy the command again from the Moda onboarding page, or drop --tenant-id.");
+      }
+      const next = token ? `Continuing with your existing CLI session${previousEmail ? ` (${previousEmail})` : ""}.` : "Signing in through the browser instead.";
+      warn(renderInitNote(`${error.message} ${next}`, "warning"));
+      emit("auth", `${error.message} ${next}`, "warning");
+    }
+  }
   if (!token) {
-    if (json || agent) {
+    if (json || agent || noPrompts) {
       throw new CliAuthError("Browser authentication is required before non-interactive init can continue.", {
         reason: "no_stored_credentials",
         login_command: ["moda", "auth", "login"],
@@ -1725,7 +1681,8 @@ async function runInit(flags, options = {}) {
       }, "Run `moda auth login`, then re-run `moda init`.");
     }
     let action = "login";
-    if (!yes) {
+    const fromDashboard = Boolean(connectCode || stringFlag(flagValue(flags, "tenant-id", "tenant_id")) || stringFlag(flagValue(flags, "verification-id", "verification_id")));
+    if (!yes && !fromDashboard) {
       action = await select({
         message: "Get started",
         choices: [
@@ -1746,11 +1703,18 @@ async function runInit(flags, options = {}) {
   log(renderInitStep(2, 5, "Workspace"));
   emit("workspace", "Selecting workspace and creating API key.");
   const tenantIdFlag = stringFlag(flagValue(flags, "tenant-id", "tenant_id"));
+  if (codeTenantId && tenantIdFlag && tenantIdFlag !== codeTenantId) {
+    throw new CliInputError("The sign-in code is for a different workspace than --tenant-id.", "Copy the command again from the Moda onboarding page, or drop --tenant-id.");
+  }
+  const verificationId = stringFlag(flagValue(flags, "verification-id", "verification_id"));
+  if (verificationId !== undefined && !isAcceptedVerificationId(verificationId)) {
+    throw new CliInputError(`Invalid --verification-id ${JSON.stringify(verificationId).slice(0, 80)}`, "Pass the onb_ id shown in the Moda onboarding page, or omit the flag.");
+  }
   const tenantIdEnv = stringFlag(process.env.MODA_TENANT_ID);
   const { apiKey, tenantId: selectedTenantId, tenantName } = await selectTenantAndCreateKey({
-    tenantId: tenantIdFlag ?? tenantIdEnv,
-    tenantIdSource: tenantIdFlag ? "flag" : tenantIdEnv ? "env" : undefined,
-    nonInteractive: json || agent,
+    tenantId: tenantIdFlag ?? codeTenantId ?? tenantIdEnv,
+    tenantIdSource: tenantIdFlag || codeTenantId ? "flag" : tenantIdEnv ? "env" : undefined,
+    nonInteractive: json || agent || noPrompts,
     silent: !human,
     resumeCommand: ["moda", "init", ...resumeFlagsForInit(flags)],
     profile
@@ -1854,6 +1818,8 @@ async function runInit(flags, options = {}) {
   log(renderInitStep(4, 5, "Set up", remote ? "Harness analysis runs on Moda while local setup continues. No further input is needed." : "Runs unattended. No further input is needed."));
   const rootDir = process.cwd();
   const allowLocalFallback = !isTruthyFlag(flagValue(flags, "remote"));
+  const launchLocalAnalyst = human && !noPrompts || stringFlag(flags.analyst) !== undefined;
+  const HARNESS_RETRY = "moda harness analyze --remote --summary --experimental";
   const nestedHarnessFlags = (extra) => commandFlags({
     summary: true,
     yes: true,
@@ -1886,6 +1852,23 @@ async function runInit(flags, options = {}) {
   const validationFailure = () => new CliInputError("Moda Analyst produced a harness report that did not pass validation.", "Review .moda/harness-report-validation.json, then rerun `moda init --local --analyst=claude|cursor|codex` or `moda harness analyze --analyst=local-scan --summary`.");
   let harnessPhase = { id: "harness", title: "Harness discovery", status: "completed" };
   let harnessDeferred = false;
+  let harnessSkipped = false;
+  let harnessSkip = "unavailable";
+  const skipHarness = (error, kind = "unavailable") => {
+    harnessSkipped = true;
+    harnessDeferred = true;
+    harnessSkip = kind;
+    const reason = error instanceof Error ? error.message : String(error);
+    const next = HARNESS_SKIP_NEXT[kind] === "pull" ? HARNESS_PULL_RECOVERY : HARNESS_RETRY;
+    harnessPhase = {
+      id: "harness",
+      title: "Harness discovery",
+      status: "warning",
+      details: `skipped: ${HARNESS_SKIP_DETAILS[kind]}`
+    };
+    markApplied(setupPlan, "harness", `Hosted analysis ${HARNESS_SKIP_PLAN[kind]}; run \`${next}\` later.`);
+    emit("harness", `Hosted harness discovery ${HARNESS_SKIP_EVENT[kind]} (${reason}); skipped. Continue with \`${next}\`.`, "warning");
+  };
   const approveAndSyncHarness = async () => {
     const graphSignals = readHarnessQualitySignals(rootDir);
     const repoSignals = detectRepoLlmSignals(rootDir);
@@ -1896,7 +1879,7 @@ async function runInit(flags, options = {}) {
     } : undefined;
     if (signals && harnessLooksIncomplete(signals)) {
       const names = [...signals.frameworks, ...signals.providers].join(", ");
-      const retryCommand = remote ? "moda harness analyze --remote --summary" : "moda harness analyze --analyst=claude|cursor|codex --summary";
+      const retryCommand = remote ? "moda harness analyze --remote --summary --experimental" : "moda harness analyze --analyst=claude|cursor|codex --summary";
       warn(renderInitNote(`Harness discovery found 0 runtime agents, but this repo has LLM framework signals (${names}). ` + "Discovery likely failed, so the result was NOT approved or synced.", "warning"));
       warn(`  Retry with \`${retryCommand}\`, then \`moda harness approve --yes && moda harness sync --from-report\`.`);
       emit("harness", "Harness discovery found 0 agents despite LLM framework signals; sync withheld.", "warning");
@@ -2003,12 +1986,16 @@ Harness analysis keeps running on Moda. Resume anytime with \`${HARNESS_PULL_REC
     } catch (error) {
       if (!allowLocalFallback)
         throw error;
-      warn(renderInitNote(`Server-side harness discovery unavailable (${error instanceof Error ? error.message : String(error)}); falling back to local analyst.`, "warning"));
-      emit("harness", "Server-side discovery failed; falling back to local analyst.", "warning");
       remote = false;
+      if (launchLocalAnalyst) {
+        warn(renderInitNote(`Server-side harness discovery unavailable (${error instanceof Error ? error.message : String(error)}); falling back to local analyst.`, "warning"));
+        emit("harness", "Server-side discovery failed; falling back to local analyst.", "warning");
+      } else {
+        skipHarness(error);
+      }
     }
   }
-  if (!remote) {
+  if (!remote && !harnessSkipped) {
     await finishLocalAnalyze();
   }
   emit("apply", "Applying approved setup changes.");
@@ -2068,6 +2055,7 @@ Harness analysis keeps running on Moda. Resume anytime with \`${HARNESS_PULL_REC
     const verificationBaseUrl = resolveModaBaseUrl({ profile });
     sdkIntegration = await runSdkIntegration({
       apiKey,
+      verificationId,
       ingestUrl: resolveIngestUrl({ profile }),
       fetchAudit: (id) => fetchAuditWithApiKey(id, apiKey, verificationBaseUrl),
       onProgress: (message) => {
@@ -2093,17 +2081,21 @@ Harness analysis keeps running on Moda. Resume anytime with \`${HARNESS_PULL_REC
   if (remote && pollPromise && remoteRunId) {
     const final = await pollPromise;
     process.removeListener("SIGINT", onRemoteSigint);
-    const fallBackToLocal = async (error) => {
+    const fallBackToLocal = async (error, kind) => {
       board?.fail("harness", "hosted analysis failed");
       board?.stop();
       if (!allowLocalFallback)
         throw error;
+      if (!launchLocalAnalyst) {
+        skipHarness(error, kind);
+        return;
+      }
       warn(renderInitNote(`Server-side harness discovery failed (${error instanceof Error ? error.message : String(error)}); falling back to local analyst.`, "warning"));
       emit("harness", "Server-side discovery failed; falling back to local analyst.", "warning");
       await finishLocalAnalyze();
     };
     if (pollError !== undefined) {
-      await fallBackToLocal(pollError);
+      await fallBackToLocal(pollError, "lost");
     } else if (!final || final.status !== "completed" && final.status !== "failed") {
       harnessDeferred = true;
       harnessPhase = { id: "harness", title: "Harness discovery", status: "warning", details: "still running on Moda" };
@@ -2123,7 +2115,7 @@ Harness analysis keeps running on Moda. Resume anytime with \`${HARNESS_PULL_REC
           flags: nestedHarnessFlags({ "run-id": remoteRunId })
         }));
       } catch (error) {
-        await fallBackToLocal(error);
+        await fallBackToLocal(error, isRecoverableRemoteRun(final) ? "unfetched" : "failed");
       }
       if (pullResult) {
         if (pullResult.exitCode !== 0) {
@@ -2175,7 +2167,7 @@ Harness analysis keeps running on Moda. Resume anytime with \`${HARNESS_PULL_REC
   log(renderInitComplete({
     tenantName,
     dashboardUrl: `${resolveModaBaseUrl({ profile })}/dashboard`,
-    harness: harnessDeferred ? { state: "pending" } : { state: "mapped", ...readHarnessGraphCounts() },
+    harness: harnessSkipped ? { state: "skipped", reason: harnessSkip, next: HARNESS_SKIP_NEXT[harnessSkip] === "pull" ? HARNESS_PULL_RECOVERY : HARNESS_RETRY } : harnessDeferred ? { state: "pending" } : { state: "mapped", ...readHarnessGraphCounts() },
     filesChanged: changedFiles(setupPlan),
     skipped: setupPlan.filter((item) => item.status === "skipped" || item.status === "manual"),
     telemetrySeen
@@ -2359,9 +2351,9 @@ var GENERATED_WORKFLOW_CLI = `@moda-ai/cli@${VERSION}`;
 var GENERATED_WORKFLOW_NPX = `npx -y --package=${GENERATED_WORKFLOW_CLI} moda`;
 function writeCiCdWorkflow(cwd = process.cwd()) {
   const relativePath = ".github/workflows/moda-validation.yml";
-  const path = join6(cwd, relativePath);
-  mkdirSync5(dirname4(path), { recursive: true });
-  writeFileSync4(path, `${[
+  const path = join5(cwd, relativePath);
+  mkdirSync4(dirname3(path), { recursive: true });
+  writeFileSync3(path, `${[
     "name: Moda Validation",
     "",
     "on:",
@@ -2394,9 +2386,9 @@ function writeCiCdWorkflow(cwd = process.cwd()) {
 }
 function writeAutosyncWorkflow(cwd = process.cwd()) {
   const relativePath = ".github/workflows/moda-autosync.yml";
-  const path = join6(cwd, relativePath);
-  mkdirSync5(dirname4(path), { recursive: true });
-  writeFileSync4(path, `${[
+  const path = join5(cwd, relativePath);
+  mkdirSync4(dirname3(path), { recursive: true });
+  writeFileSync3(path, `${[
     "name: Moda Autosync",
     "",
     "on:",
@@ -2435,8 +2427,8 @@ function writeAutosyncWorkflow(cwd = process.cwd()) {
 }
 function writeHarnessRescanWorkflow(cwd = process.cwd(), paths) {
   const relativePath = ".github/workflows/moda-harness-rescan.yml";
-  const path = join6(cwd, relativePath);
-  mkdirSync5(dirname4(path), { recursive: true });
+  const path = join5(cwd, relativePath);
+  mkdirSync4(dirname3(path), { recursive: true });
   const pathScope = paths !== undefined && paths.length > 0 ? [
     "    # Only pushes touching these paths trigger a rescan.",
     "    paths:",
@@ -2446,7 +2438,7 @@ function writeHarnessRescanWorkflow(cwd = process.cwd(), paths) {
     "    # paths:",
     "    #   - 'src/agents/**'"
   ];
-  writeFileSync4(path, `${[
+  writeFileSync3(path, `${[
     "name: Moda Harness Rescan",
     "",
     "on:",
@@ -2492,11 +2484,11 @@ function writeHarnessRescanWorkflow(cwd = process.cwd(), paths) {
   return relativePath;
 }
 function printHarnessDetectionSummary(cwd = process.cwd()) {
-  const manifestPath = join6(cwd, ".moda", "harness.json");
-  if (!existsSync6(manifestPath))
+  const manifestPath = join5(cwd, ".moda", "harness.json");
+  if (!existsSync5(manifestPath))
     return;
   try {
-    const graph = JSON.parse(readFileSync5(manifestPath, "utf8"));
+    const graph = JSON.parse(readFileSync4(manifestPath, "utf8"));
     const frameworkNames = (graph.agentFrameworks ?? []).map((framework) => typeof framework.name === "string" ? framework.name : undefined).filter((name) => Boolean(name));
     const providerNames = (graph.modelProviders ?? []).map((provider) => typeof provider.name === "string" ? provider.name : undefined).filter((name) => Boolean(name));
     console.log(`  Detected harness: ${(graph.runtimeAgents ?? []).length} runtime agent(s), ` + `${(graph.artifacts ?? []).length} artifact(s), ${(graph.relationships ?? []).length} relationship(s)`);
@@ -2517,20 +2509,20 @@ function signalsFromGraph(graph) {
   };
 }
 function readHarnessQualitySignals(cwd = process.cwd()) {
-  const reportPath = join6(cwd, ".moda", "harness-report.json");
-  if (existsSync6(reportPath)) {
+  const reportPath = join5(cwd, ".moda", "harness-report.json");
+  if (existsSync5(reportPath)) {
     try {
-      const report = JSON.parse(readFileSync5(reportPath, "utf8"));
+      const report = JSON.parse(readFileSync4(reportPath, "utf8"));
       if (report.graph && typeof report.graph === "object") {
         return signalsFromGraph(report.graph);
       }
     } catch {}
   }
-  const manifestPath = join6(cwd, ".moda", "harness.json");
-  if (!existsSync6(manifestPath))
+  const manifestPath = join5(cwd, ".moda", "harness.json");
+  if (!existsSync5(manifestPath))
     return;
   try {
-    return signalsFromGraph(JSON.parse(readFileSync5(manifestPath, "utf8")));
+    return signalsFromGraph(JSON.parse(readFileSync4(manifestPath, "utf8")));
   } catch {
     return;
   }
@@ -2648,7 +2640,7 @@ function detectRepoLlmSignals(cwd = process.cwd()) {
   };
   const scanDir = (dir) => {
     try {
-      const pkg = JSON.parse(readFileSync5(join6(dir, "package.json"), "utf8"));
+      const pkg = JSON.parse(readFileSync4(join5(dir, "package.json"), "utf8"));
       for (const dep of [
         ...Object.keys(pkg.dependencies ?? {}),
         ...Object.keys(pkg.devDependencies ?? {}),
@@ -2659,7 +2651,7 @@ function detectRepoLlmSignals(cwd = process.cwd()) {
     } catch {}
     for (const file of ["requirements.txt", "pyproject.toml"]) {
       try {
-        const text = readFileSync5(join6(dir, file), "utf8");
+        const text = readFileSync4(join5(dir, file), "utf8");
         for (const name of pythonRequirementNames(text, file)) {
           record(pyDependencySignal(name));
         }
@@ -2674,7 +2666,7 @@ function detectRepoLlmSignals(cwd = process.cwd()) {
     scanDir(dir);
     let entries;
     try {
-      entries = readdirSync4(dir, { withFileTypes: true });
+      entries = readdirSync3(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -2683,18 +2675,18 @@ function detectRepoLlmSignals(cwd = process.cwd()) {
         continue;
       if (REPO_SIGNAL_SKIPPED_DIRS.has(entry.name))
         continue;
-      walk(join6(dir, entry.name), depth + 1);
+      walk(join5(dir, entry.name), depth + 1);
     }
   };
   walk(cwd, 0);
   return { frameworks: [...frameworks].sort(), providers: [...providers].sort() };
 }
 function readHarnessGraphCounts(cwd = process.cwd()) {
-  const manifestPath = join6(cwd, ".moda", "harness.json");
-  if (!existsSync6(manifestPath))
+  const manifestPath = join5(cwd, ".moda", "harness.json");
+  if (!existsSync5(manifestPath))
     return {};
   try {
-    const graph = JSON.parse(readFileSync5(manifestPath, "utf8"));
+    const graph = JSON.parse(readFileSync4(manifestPath, "utf8"));
     return {
       agents: Array.isArray(graph.runtimeAgents) ? graph.runtimeAgents.length : 0,
       artifacts: Array.isArray(graph.artifacts) ? graph.artifacts.length : 0
@@ -2713,6 +2705,7 @@ function resumeFlagsForInit(flags) {
   const passthrough = [
     "profile",
     "tenant-id",
+    "verification-id",
     "offline",
     "analyst",
     "sdk-integrate",