@moda-ai/cli 1.38.0 → 1.39.0

package/dist/{cli-07tv75te.js → cli-xsmsjny3.js}

@@ -19,12 +19,13 @@ import {
   redactDeep,
   redactString,
   resolveApiKey,
+  resolveApiTenantId,
   resolveIngestUrl,
   resolveModaBaseUrl,
   resolveTenantId,
   shouldInventoryFile,
   stringOption
-} from "./cli-q79sq80a.js";
+} from "./cli-rp912ypf.js";
 import {
   __commonJS,
   __require,
@@ -9157,7 +9158,7 @@ var require_source_map_support = __commonJS((exports, module) => {
 
 // ../../node_modules/.bun/typescript@5.9.3/node_modules/typescript/lib/typescript.js
 var require_typescript = __commonJS((exports, module) => {
-  var __dirname = "/home/runner/work/ModaObservability/ModaObservability/node_modules/.bun/typescript@5.9.3/node_modules/typescript/lib", __filename = "/home/runner/work/ModaObservability/ModaObservability/node_modules/.bun/typescript@5.9.3/node_modules/typescript/lib/typescript.js";
+  var __dirname = "/home/runner/_work/ModaObservability/ModaObservability/node_modules/.bun/typescript@5.9.3/node_modules/typescript/lib", __filename = "/home/runner/_work/ModaObservability/ModaObservability/node_modules/.bun/typescript@5.9.3/node_modules/typescript/lib/typescript.js";
   /*! *****************************************************************************
   Copyright (c) Microsoft Corporation. All rights reserved.
   Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -9453,7 +9454,7 @@ var require_typescript = __commonJS((exports, module) => {
       commandLineOptionOfCustomType: () => commandLineOptionOfCustomType,
       commentPragmas: () => commentPragmas,
       commonOptionsWithBuild: () => commonOptionsWithBuild,
-      compact: () => compact,
+      compact: () => compact2,
       compareBooleans: () => compareBooleans,
       compareDataObjects: () => compareDataObjects,
       compareDiagnostics: () => compareDiagnostics,
@@ -11973,7 +11974,7 @@ var require_typescript = __commonJS((exports, module) => {
       }
       return true;
     }
-    function compact(array) {
+    function compact2(array) {
       let result;
       if (array !== undefined) {
         for (let i = 0;i < array.length; i++) {
@@ -93165,7 +93166,7 @@ ${lanes.join(`
             if (!links2.hasReportedStatementInAmbientContext) {
               return links2.hasReportedStatementInAmbientContext = grammarErrorOnFirstToken(node, Diagnostics.Statements_are_not_allowed_in_ambient_contexts);
             }
-          } else {}
+          }
         }
         return false;
       }
@@ -97630,7 +97631,7 @@ ${lanes.join(`
           const savedPendingExpressions = pendingExpressions;
           pendingExpressions = undefined;
           node = factory2.updateBinaryExpression(node, visitNode(node.left, assignmentTargetVisitor, isExpression), node.operatorToken, visitNode(node.right, visitor, isExpression));
-          const expr = some(pendingExpressions) ? factory2.inlineExpressions(compact([...pendingExpressions, node])) : node;
+          const expr = some(pendingExpressions) ? factory2.inlineExpressions(compact2([...pendingExpressions, node])) : node;
           pendingExpressions = savedPendingExpressions;
           return expr;
         }
@@ -102629,7 +102630,7 @@ ${lanes.join(`
               ], 2));
               setParentRecursive(requireStatement, false);
               statements = insertStatementAfterCustomPrologue(statements.slice(), requireStatement);
-            } else {}
+            }
           }
         }
         if (statements !== visited.statements) {
@@ -107434,14 +107435,14 @@ ${lanes.join(`
         }
       }
       function createImportCallExpressionAMD(arg, containsLexicalThis) {
-        const resolve4 = factory2.createUniqueName("resolve");
+        const resolve5 = factory2.createUniqueName("resolve");
         const reject = factory2.createUniqueName("reject");
         const parameters = [
-          factory2.createParameterDeclaration(undefined, undefined, resolve4),
+          factory2.createParameterDeclaration(undefined, undefined, resolve5),
           factory2.createParameterDeclaration(undefined, undefined, reject)
         ];
         const body = factory2.createBlock([
-          factory2.createExpressionStatement(factory2.createCallExpression(factory2.createIdentifier("require"), undefined, [factory2.createArrayLiteralExpression([arg || factory2.createOmittedExpression()]), resolve4, reject]))
+          factory2.createExpressionStatement(factory2.createCallExpression(factory2.createIdentifier("require"), undefined, [factory2.createArrayLiteralExpression([arg || factory2.createOmittedExpression()]), resolve5, reject]))
         ]);
         let func;
         if (languageVersion >= 2) {
@@ -110422,7 +110423,7 @@ ${lanes.join(`
             let parameterProperties;
             if (ctor) {
               const oldDiag2 = getSymbolAccessibilityDiagnostic;
-              parameterProperties = compact(flatMap(ctor.parameters, (param) => {
+              parameterProperties = compact2(flatMap(ctor.parameters, (param) => {
                 if (!hasSyntacticModifier(param, 31) || shouldStripInternal(param))
                   return;
                 getSymbolAccessibilityDiagnostic = createGetSymbolAccessibilityDiagnosticForNode(param);
@@ -141755,7 +141756,7 @@ ${newComment.split(`
         }
         const checker = context.program.getTypeChecker();
         const trackChanges = (cb) => ts_textChanges_exports.ChangeTracker.with(context, cb);
-        return compact([
+        return compact2([
           getDeclarationSiteFix(context, expression, errorCode, checker, trackChanges),
           getUseSiteFix(context, expression, errorCode, checker, trackChanges)
         ]);
@@ -160749,7 +160750,7 @@ ${content}
       const lastToken = last(children);
       const separateLastToken = separateTrailingSemicolon && lastToken.kind === 27;
       const rightChildren = children.slice(splitTokenIndex + 1, separateLastToken ? children.length - 1 : undefined);
-      const result = compact([
+      const result = compact2([
         leftChildren.length ? createSyntaxList2(leftChildren) : undefined,
         splitToken,
         rightChildren.length ? createSyntaxList2(rightChildren) : undefined
@@ -165453,7 +165454,7 @@ ${options.prefix}` : `
       commandLineOptionOfCustomType: () => commandLineOptionOfCustomType,
       commentPragmas: () => commentPragmas,
       commonOptionsWithBuild: () => commonOptionsWithBuild,
-      compact: () => compact,
+      compact: () => compact2,
       compareBooleans: () => compareBooleans,
       compareDataObjects: () => compareDataObjects,
       compareDiagnostics: () => compareDiagnostics,
@@ -177616,8 +177617,8 @@ Additional information: BADCLIENT: Bad error code, ${badCode} not found in range
       installPackage(options) {
         this.packageInstallId++;
         const request = { kind: "installPackage", ...options, id: this.packageInstallId };
-        const promise = new Promise((resolve4, reject) => {
-          (this.packageInstalledPromise ?? (this.packageInstalledPromise = /* @__PURE__ */ new Map)).set(this.packageInstallId, { resolve: resolve4, reject });
+        const promise = new Promise((resolve5, reject) => {
+          (this.packageInstalledPromise ?? (this.packageInstalledPromise = /* @__PURE__ */ new Map)).set(this.packageInstallId, { resolve: resolve5, reject });
         });
         this.installer.send(request);
         return promise;
@@ -177886,14 +177887,18 @@ import {
   lstatSync as lstatSync7,
   mkdtempSync,
   mkdirSync as mkdirSync4,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync13,
   readdirSync,
   writeFileSync as writeFileSync4,
   rmSync
 } from "node:fs";
-import { basename as basename4, delimiter, dirname as dirname5, join as join4, relative as relative6, resolve as resolve10, sep as sep2 } from "node:path";
+import { basename as basename4, delimiter, dirname as dirname5, join as join4, relative as relative6, resolve as resolve11, sep as sep2 } from "node:path";
 import { confirm as confirm2, select } from "@inquirer/prompts";
 
+// src/parity-commands.ts
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
 // src/api-client.ts
 var REQUEST_TIMEOUT_MS = 30000;
 var MAX_RETRIES = 3;
@@ -177918,6 +177923,12 @@ class NetworkError extends Error {
     this.name = "NetworkError";
   }
 }
+function networkErrorMessage(error, url) {
+  const message = error instanceof Error ? error.message : String(error);
+  const cause = error instanceof Error ? error.cause : undefined;
+  const code = typeof cause?.code === "string" ? `: ${cause.code}` : "";
+  return `Network error: ${message} (could not reach ${url.split("?")[0]}${code})`;
+}
 function isRetryable(status) {
   return status === 429 || status >= 500;
 }
@@ -177932,7 +177943,8 @@ async function callControlAPI(endpoint, options = {}, profileOptions = {}, reque
 }
 async function callModaAPI(url, options, profileOptions = {}, requestOptions = {}) {
   const timeoutMs = requestOptions.timeoutMs ?? REQUEST_TIMEOUT_MS;
-  const maxRetries = requestOptions.retries ?? MAX_RETRIES;
+  const method = (options.method ?? "GET").toUpperCase();
+  const maxRetries = requestOptions.retries ?? (method === "GET" || method === "HEAD" ? MAX_RETRIES : 0);
   const initialNetworkRetryBudget = requestOptions.retryOnceOnNetworkError ? 1 : 0;
   let networkRetryBudget = initialNetworkRetryBudget;
   let connectionClose = false;
@@ -177963,12 +177975,17 @@ async function callModaAPI(url, options, profileOptions = {}, requestOptions = {
         }
         throw error;
       }
-      return response.json();
+      if (response.status === 204)
+        return null;
+      if (typeof response.text !== "function")
+        return response.json();
+      const text = await response.text();
+      return text.trim() === "" ? null : JSON.parse(text);
     } catch (error) {
       if (error instanceof ApiError)
         throw error;
       const isAbort = error instanceof DOMException && error.name === "AbortError";
-      const wrapped = isAbort ? new Error(`Request timed out after ${timeoutMs}ms: ${url}`) : new NetworkError(`Network error: ${error instanceof Error ? error.message : String(error)}`);
+      const wrapped = isAbort ? new Error(`Request timed out after ${timeoutMs}ms: ${url}`) : new NetworkError(networkErrorMessage(error, url));
       if (attempt < maxRetries) {
         continue;
       }
@@ -177992,6 +178009,459 @@ function resetApiRequestCount() {
   apiRequestCount = 0;
 }
 
+// src/parity-commands.ts
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var WINDOWS = ["24h", "7d", "30d", "90d"];
+function profileOptions(context) {
+  return { profile: context.profile, env: context.env };
+}
+function requireKey(context) {
+  if (!resolveApiKey(profileOptions(context))) {
+    throw new CliInputError(`No Moda API key found for moda ${context.command}.`, "Set MODA_API_KEY, run `moda auth login --api-key`, or select a profile with an API key.");
+  }
+}
+function requireTenant(context) {
+  const key = resolveApiKey(profileOptions(context));
+  const keyTenant = key ? embeddedTenantIdFromApiKey(key) : undefined;
+  const flagTenant = context.flags["tenant-id"];
+  if (flagTenant && keyTenant && flagTenant !== keyTenant) {
+    throw new CliInputError(`--tenant-id=${flagTenant} does not match this API key's tenant (${keyTenant}), so nothing was sent.`, "Drop --tenant-id (the key names its tenant) or use a key for that tenant.");
+  }
+  const tenantId = flagTenant || resolveApiTenantId(profileOptions(context));
+  if (!tenantId) {
+    throw new CliInputError("Could not determine the tenant.", "Use a signed API key (it names its tenant), set MODA_TENANT_ID, or pass --tenant-id=<id>.");
+  }
+  return tenantId;
+}
+function assertFlags(command, flags, allowed) {
+  if (command.startsWith("signals "))
+    allowed = [...allowed, "tenant-id"];
+  const globals = [
+    "agent",
+    "json",
+    "human",
+    "prose",
+    "quiet",
+    "verbose",
+    "yes",
+    "profile",
+    "progress",
+    "format",
+    "no-telemetry",
+    "no-update-check",
+    "help",
+    "version",
+    "json-schemas",
+    "stream",
+    "no-stream",
+    "tui",
+    "no-tui"
+  ];
+  const known = new Set([...allowed, ...globals]);
+  const unknown = Object.keys(flags).filter((flag) => !known.has(flag));
+  if (unknown.includes("dry-run")) {
+    throw new CliInputError(`'moda ${command}' has no dry-run mode, so nothing was sent.`, "Remove --dry-run to run it for real.");
+  }
+  if (unknown.length > 0) {
+    throw new CliInputError(`Unknown flag${unknown.length > 1 ? "s" : ""} ${unknown.map((flag) => `--${flag}`).join(", ")} for 'moda ${command}'.`, `Valid flags: ${allowed.map((flag) => `--${flag}`).join(", ") || "(none)"}.`);
+  }
+}
+function assertPositionals(command, positionals, max, usage) {
+  if (positionals.length > max) {
+    throw new CliInputError(`Unexpected argument${positionals.length - max > 1 ? "s" : ""} '${positionals.slice(max).join(" ")}' for 'moda ${command}', so nothing was sent.`, `Usage: ${usage}`);
+  }
+}
+function oneOf(name, value, allowed) {
+  if (value === undefined)
+    return;
+  if (!allowed.includes(value)) {
+    throw new CliInputError(`--${name} must be one of ${allowed.join(", ")} (got '${value}').`);
+  }
+  return value;
+}
+function csv(value) {
+  if (value === undefined)
+    return;
+  const items = value.split(",").map((item) => item.trim()).filter(Boolean);
+  return items.length > 0 ? items : undefined;
+}
+function readBodyFile(flags, cwd) {
+  if (!flags.file)
+    return {};
+  if (flags.file === "true")
+    throw new CliInputError("Missing path for --file.");
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(resolve(cwd, flags.file), "utf8"));
+  } catch (error) {
+    throw new CliInputError(`Could not read --file ${flags.file}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new CliInputError("--file must contain a JSON object (the request body).");
+  }
+  return parsed;
+}
+function compact(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== undefined));
+}
+var LLM_WRITE_TIMEOUT_MS = 180000;
+async function send(context, plane, method, endpoint, body, options = {}) {
+  const init = { method, ...body !== undefined ? { body: JSON.stringify(body) } : {} };
+  if (method !== "GET" && context.dryRun) {
+    context.output.writeData({
+      dryRun: true,
+      planned: { method, endpoint: plane === "data" ? `/api/v1/data${endpoint}` : `/api${endpoint}`, ...body !== undefined ? { body } : {} }
+    }, { summary: { text: `Dry run: would ${method} ${endpoint}. Nothing was sent.`, confidence: "high" } });
+    return;
+  }
+  const requestOptions = method === "GET" ? {} : { retries: 0, ...options.slow ? { timeoutMs: LLM_WRITE_TIMEOUT_MS } : {} };
+  const data = plane === "data" ? await callDataAPI(endpoint, init, requestOptions) : await callControlAPI(endpoint, init, profileOptions(context), requestOptions);
+  context.output.writeData(data ?? { ok: true });
+}
+var USER_COHORTS = ["all", "power_users", "heavy_tool_users", "frustrated", "at_risk", "new_this_week", "silent_sufferers"];
+var USER_SORTS = ["last_seen", "health_score", "conversation_count", "frustration_max"];
+var HEALTH = ["healthy", "at_risk", "frustrated"];
+async function runUsersCommand(context) {
+  const flags = context.flags;
+  assertFlags("users", flags, [
+    "window",
+    "page",
+    "page-size",
+    "search",
+    "cohort",
+    "sort",
+    "order",
+    "health-status",
+    "min-health",
+    "max-health",
+    "min-conversations",
+    "min-tool-failures",
+    "tenant-id"
+  ]);
+  if (context.positionals.length > 0) {
+    throw new CliInputError(`'moda users' takes no arguments. For one user use 'moda user <user_id>'.`);
+  }
+  requireKey(context);
+  const tenantId = requireTenant(context);
+  const query = new URLSearchParams(compact({
+    window: oneOf("window", flags.window, WINDOWS),
+    page: flags.page,
+    pageSize: flags["page-size"],
+    search: flags.search,
+    cohort: oneOf("cohort", flags.cohort, USER_COHORTS),
+    sortBy: oneOf("sort", flags.sort, USER_SORTS),
+    sortOrder: oneOf("order", flags.order, ["asc", "desc"]),
+    healthStatus: csv(flags["health-status"])?.map((value) => oneOf("health-status", value, HEALTH)).join(","),
+    minHealthScore: flags["min-health"],
+    maxHealthScore: flags["max-health"],
+    minConversations: flags["min-conversations"],
+    minToolFailures: flags["min-tool-failures"]
+  }));
+  const suffix = query.toString() ? `?${query.toString()}` : "";
+  await send(context, "control", "GET", `/tenants/${encodeURIComponent(tenantId)}/users${suffix}`);
+  return { exitCode: 0 };
+}
+async function runUserCommand(context) {
+  const flags = context.flags;
+  assertFlags("user", flags, ["window", "activity-cursor", "tenant-id"]);
+  assertPositionals("user", context.positionals, 1, "moda user <user_id> [--window=24h|7d|30d|90d]");
+  const userId = context.positionals[0];
+  if (!userId)
+    throw new CliInputError("<user_id> is required.", "Usage: moda user <user_id> [--window=24h|7d|30d|90d]");
+  requireKey(context);
+  const tenantId = requireTenant(context);
+  const query = new URLSearchParams(compact({
+    window: oneOf("window", flags.window, WINDOWS),
+    activityCursor: flags["activity-cursor"]
+  }));
+  const suffix = query.toString() ? `?${query.toString()}` : "";
+  await send(context, "control", "GET", `/tenants/${encodeURIComponent(tenantId)}/users/${encodeURIComponent(userId)}${suffix}`);
+  return { exitCode: 0 };
+}
+async function runProblemReopenCommand(context) {
+  assertFlags("problem-reopen", context.flags, ["reason", "dry-run"]);
+  assertPositionals("problem-reopen", context.positionals, 1, "moda problem-reopen <problem_id> [--reason=TEXT]");
+  const problemId = context.positionals[0];
+  const usage = "Usage: moda problem-reopen <problem_id> [--reason=TEXT]";
+  if (!problemId || !UUID_RE.test(problemId))
+    throw new CliInputError("<problem_id> (UUID) is required.", usage);
+  const reason = context.flags.reason;
+  if (reason !== undefined && reason.length > 500)
+    throw new CliInputError("--reason must be 500 characters or fewer.");
+  requireKey(context);
+  await send(context, "data", "POST", `/problems/${problemId}/reopen`, compact({ reason }));
+  return { exitCode: 0 };
+}
+var SIGNAL_FIELD_FLAGS = [
+  "name",
+  "description",
+  "pass-criteria",
+  "fail-criteria",
+  "polarity",
+  "locus",
+  "tool-names",
+  "keyword-hints",
+  "use-case-id",
+  "message-types",
+  "note",
+  "file"
+];
+function signalBody(flags, cwd) {
+  const fromFile = readBodyFile(flags, cwd);
+  const scope = compact({
+    toolNames: csv(flags["tool-names"]),
+    keywordHints: csv(flags["keyword-hints"]),
+    useCaseId: flags["use-case-id"],
+    messageTypes: csv(flags["message-types"])
+  });
+  return {
+    ...fromFile,
+    ...compact({
+      name: flags.name,
+      description: flags.description,
+      passCriteria: flags["pass-criteria"],
+      failCriteria: flags["fail-criteria"],
+      polarity: oneOf("polarity", flags.polarity, ["violation", "expectation"]),
+      locus: oneOf("locus", flags.locus, ["agent", "tool_output", "user_input"]),
+      note: flags.note
+    }),
+    ...Object.keys(scope).length > 0 ? { scope: { ...fromFile.scope ?? {}, ...scope } } : {}
+  };
+}
+var SIGNAL_USAGE = [
+  "moda signals                                   list custom signals",
+  'moda signals draft --note="…"                  AI-draft criteria from a description',
+  "moda signals create --name --description --pass-criteria --fail-criteria [--polarity --locus --tool-names=a,b] [--file=body.json]",
+  "moda signals update <id> [same flags]           edit a signal",
+  "moda signals activate|pause|delete <id>          (delete: drafts only; archive is dashboard-only)",
+  "moda signals examples <id> add|update|remove --conversation-id=ID [--label=fits|does_not_fit --note --msg-index]",
+  'moda signals refine <id> --request="…"          propose a criteria edit',
+  "moda signals revise <id> --conversation-ids=a,b re-derive criteria from labelled traces",
+  "moda signals proposals <id> | accept <id> <proposal_id> | reject <id> <proposal_id>",
+  "moda signals search <id> [--mode=wizard|full] | search-status <id> <search_id> | search-stop <id> <search_id>",
+  "moda signals preview --file=detector.json [--conversation-ids=a,b --max-examples=N]",
+  "All write subcommands accept --dry-run (prints the request, sends nothing)."
+].join(`
+  `);
+async function runSignalsManagementCommand(sub, context) {
+  const flags = context.flags;
+  const args = context.positionals.slice(1);
+  const arity = {
+    draft: 0,
+    create: 0,
+    preview: 0,
+    update: 1,
+    activate: 1,
+    pause: 1,
+    delete: 1,
+    examples: 2,
+    refine: 1,
+    revise: 1,
+    proposals: 1,
+    accept: 2,
+    reject: 2,
+    search: 1,
+    "search-status": 2,
+    "search-stop": 2
+  };
+  if (sub in arity)
+    assertPositionals(`signals ${sub}`, args, arity[sub], SIGNAL_USAGE.split(`
+`)[0]);
+  const base = () => `/tenants/${encodeURIComponent(requireTenant(context))}/custom-signals`;
+  const id = (index = 0, what = "a signal id") => {
+    const value = args[index];
+    if (!value)
+      throw new CliInputError(`moda signals ${sub} needs ${what}.`, `Usage:
+  ${SIGNAL_USAGE}`);
+    return encodeURIComponent(value);
+  };
+  const start = () => requireKey(context);
+  switch (sub) {
+    case "draft": {
+      assertFlags("signals draft", flags, ["note", "file", "dry-run"]);
+      const body = { ...readBodyFile(flags, context.cwd), ...compact({ note: flags.note }) };
+      if (!body.note)
+        throw new CliInputError("--note is required (describe what the signal should catch).");
+      start();
+      await send(context, "control", "POST", `${base()}/draft`, body, { slow: true });
+      return { exitCode: 0 };
+    }
+    case "create": {
+      assertFlags("signals create", flags, [...SIGNAL_FIELD_FLAGS, "dry-run"]);
+      const body = signalBody(flags, context.cwd);
+      const missing = ["name", "description", "passCriteria", "failCriteria"].filter((field) => !body[field]);
+      if (missing.length > 0) {
+        throw new CliInputError(`Missing ${missing.join(", ")} for signals create.`, 'Pass --name --description --pass-criteria --fail-criteria, or a --file with those fields. Tip: `moda signals draft --note="…"` drafts them.');
+      }
+      start();
+      await send(context, "control", "POST", base(), body);
+      return { exitCode: 0 };
+    }
+    case "update": {
+      assertFlags("signals update", flags, [...SIGNAL_FIELD_FLAGS, "dry-run"]);
+      const signalId = id();
+      const body = signalBody(flags, context.cwd);
+      if (Object.keys(body).length === 0)
+        throw new CliInputError("Nothing to update: pass at least one field flag or --file.");
+      start();
+      await send(context, "control", "PATCH", `${base()}/${signalId}`, body);
+      return { exitCode: 0 };
+    }
+    case "activate":
+    case "pause": {
+      assertFlags(`signals ${sub}`, flags, ["dry-run"]);
+      const signalId = id();
+      start();
+      await send(context, "control", "POST", `${base()}/${signalId}/${sub}`);
+      return { exitCode: 0 };
+    }
+    case "delete": {
+      assertFlags("signals delete", flags, ["dry-run"]);
+      const signalId = id();
+      start();
+      await send(context, "control", "DELETE", `${base()}/${signalId}`);
+      return { exitCode: 0 };
+    }
+    case "examples": {
+      const signalId = id();
+      const action = args[1];
+      const conversationId = flags["conversation-id"];
+      if (!action || !["add", "update", "remove"].includes(action)) {
+        throw new CliInputError("Usage: moda signals examples <id> add|update|remove --conversation-id=ID …");
+      }
+      if (!conversationId)
+        throw new CliInputError("--conversation-id is required.");
+      if (action === "add") {
+        assertFlags("signals examples add", flags, ["conversation-id", "label", "note", "msg-index", "msg-dedup-token", "criteria", "verdict", "dry-run"]);
+        const label = oneOf("label", flags.label, ["fits", "does_not_fit"]);
+        if (!label)
+          throw new CliInputError("--label=fits|does_not_fit is required.");
+        start();
+        await send(context, "control", "POST", `${base()}/${signalId}/examples`, compact({
+          conversationId,
+          label,
+          source: "api",
+          note: flags.note,
+          msgIndex: flags["msg-index"] !== undefined ? Number(flags["msg-index"]) : undefined,
+          msgDedupToken: flags["msg-dedup-token"],
+          criteria: oneOf("criteria", flags.criteria, ["pass", "fail"]),
+          verdict: oneOf("verdict", flags.verdict, ["accept", "reject"])
+        }));
+      } else if (action === "update") {
+        assertFlags("signals examples update", flags, ["conversation-id", "label", "note", "blurb", "dry-run"]);
+        const body = compact({ label: oneOf("label", flags.label, ["fits", "does_not_fit"]), note: flags.note, blurb: flags.blurb });
+        if (Object.keys(body).length === 0)
+          throw new CliInputError("Nothing to update: pass --label, --note, or --blurb.");
+        start();
+        await send(context, "control", "PATCH", `${base()}/${signalId}/examples/${encodeURIComponent(conversationId)}`, body);
+      } else {
+        assertFlags("signals examples remove", flags, ["conversation-id", "dry-run"]);
+        start();
+        await send(context, "control", "DELETE", `${base()}/${signalId}/examples/${encodeURIComponent(conversationId)}`);
+      }
+      return { exitCode: 0 };
+    }
+    case "refine": {
+      assertFlags("signals refine", flags, ["request", "dry-run"]);
+      const signalId = id();
+      const request = flags.request;
+      if (!request || request.length > 2000)
+        throw new CliInputError("--request (1–2000 characters) is required.");
+      start();
+      await send(context, "control", "POST", `${base()}/${signalId}/refine`, { request }, { slow: true });
+      return { exitCode: 0 };
+    }
+    case "revise": {
+      assertFlags("signals revise", flags, ["conversation-ids", "dry-run"]);
+      const signalId = id();
+      const conversationIds = csv(flags["conversation-ids"]);
+      if (!conversationIds)
+        throw new CliInputError("--conversation-ids=a,b is required.");
+      start();
+      await send(context, "control", "POST", `${base()}/${signalId}/revise`, { conversationIds }, { slow: true });
+      return { exitCode: 0 };
+    }
+    case "proposals": {
+      assertFlags("signals proposals", flags, []);
+      const signalId = id();
+      start();
+      await send(context, "control", "GET", `${base()}/${signalId}/proposals`);
+      return { exitCode: 0 };
+    }
+    case "accept":
+    case "reject": {
+      assertFlags(`signals ${sub}`, flags, ["dry-run"]);
+      const signalId = id();
+      const proposalId = id(1, "a proposal id (see `moda signals proposals <id>`)");
+      start();
+      await send(context, "control", "POST", `${base()}/${signalId}/proposals/${proposalId}/${sub}`);
+      return { exitCode: 0 };
+    }
+    case "search": {
+      assertFlags("signals search", flags, ["mode", "exclude-conversation-ids", "dry-run"]);
+      const signalId = id();
+      start();
+      await send(context, "control", "POST", `${base()}/${signalId}/search`, compact({
+        mode: oneOf("mode", flags.mode, ["wizard", "full"]),
+        excludeConversationIds: csv(flags["exclude-conversation-ids"])
+      }), { slow: true });
+      return { exitCode: 0 };
+    }
+    case "search-status":
+    case "search-stop": {
+      assertFlags(`signals ${sub}`, flags, sub === "search-stop" ? ["dry-run"] : []);
+      const signalId = id();
+      const searchId = id(1, "a search id (returned by `moda signals search <id>`)");
+      start();
+      await send(context, "control", sub === "search-stop" ? "POST" : "GET", `${base()}/${signalId}/searches/${searchId}${sub === "search-stop" ? "/stop" : ""}`);
+      return { exitCode: 0 };
+    }
+    case "preview": {
+      assertFlags("signals preview", flags, ["file", "conversation-ids", "max-examples"]);
+      const body = readBodyFile(flags, context.cwd);
+      if (!body.detector)
+        throw new CliInputError('--file must contain {"detector": {...}} (optionally scope).');
+      start();
+      await send(context, "control", "POST", `${base()}/detector-preview`, {
+        ...body,
+        ...compact({
+          conversationIds: csv(flags["conversation-ids"]),
+          maxExamples: flags["max-examples"] !== undefined ? Number(flags["max-examples"]) : undefined
+        })
+      });
+      return { exitCode: 0 };
+    }
+    default:
+      throw unknownSignalsSubcommandError(sub, args);
+  }
+}
+var SIGNALS_MANAGEMENT_SUBCOMMANDS = new Set([
+  "draft",
+  "create",
+  "update",
+  "activate",
+  "pause",
+  "delete",
+  "examples",
+  "refine",
+  "revise",
+  "proposals",
+  "accept",
+  "reject",
+  "search",
+  "search-status",
+  "search-stop",
+  "preview"
+]);
+function unknownSignalsSubcommandError(sub, args = []) {
+  if (sub === "archive") {
+    const id = args[0] ?? "<signal_id>";
+    return new CliInputError(`Unknown signals subcommand 'archive': archiving a signal is dashboard-only, so nothing was sent.`, `To stop a signal from running, pause it: moda signals pause ${id}. Drafts can be deleted with moda signals delete ${id}.`);
+  }
+  return new CliInputError(`Unknown signals subcommand '${sub}', so nothing was sent. Valid subcommands: ${[...SIGNALS_MANAGEMENT_SUBCOMMANDS].join(", ")}.`, `Bare 'moda signals' lists custom signals; 'moda signal <signal_id>' opens one. Usage:
+  ${SIGNAL_USAGE}`);
+}
+
 // src/analyst-tui.ts
 class AnalystTui {
   state;
@@ -178096,16 +178566,16 @@ class AnalystTui {
     this.active = false;
   }
   pushTimeline(label, message) {
-    const compact = compactWhitespace(message);
-    if (!compact)
+    const compact2 = compactWhitespace(message);
+    if (!compact2)
       return;
     const last = this.state.timeline.at(-1);
-    if (last?.label === label && last.message === compact)
+    if (last?.label === label && last.message === compact2)
       return;
     this.state.timeline.push({
       time: timeOfDay(new Date),
       label,
-      message: compact
+      message: compact2
     });
     if (this.state.timeline.length > 80)
       this.state.timeline.splice(0, this.state.timeline.length - 80);
@@ -178281,7 +178751,7 @@ function stripAnsi(value) {
 }
 
 // src/harness-remote.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { join as join2 } from "node:path";
 
 // src/markdown-terminal.ts
@@ -178429,10 +178899,10 @@ import {
   existsSync,
   lstatSync,
   mkdirSync,
-  readFileSync,
+  readFileSync as readFileSync2,
   writeFileSync
 } from "node:fs";
-import { basename, dirname, join, relative, resolve } from "node:path";
+import { basename, dirname, join, relative, resolve as resolve2 } from "node:path";
 import { confirm } from "@inquirer/prompts";
 var HARNESS_REPORT_SCHEMA_VERSION = "harness_report.v0.1";
 var HARNESS_REPORT_VALIDATION_SCHEMA_VERSION = "harness_report_validation.v0.1";
@@ -178950,12 +179420,12 @@ function loadHarnessReportForSync(rootDir, reportPath, options) {
 `));
   }
   const approvalPath = join(rootDir, HARNESS_REPORT_APPROVAL_PATH);
-  const approval = existsSync(approvalPath) ? JSON.parse(readFileSync(approvalPath, "utf8")) : null;
+  const approval = existsSync(approvalPath) ? JSON.parse(readFileSync2(approvalPath, "utf8")) : null;
   const approved = approval?.schemaVersion === HARNESS_REPORT_APPROVAL_SCHEMA_VERSION && approval.reportId === report.reportId && approval.reportHash === hashHarnessReport(report) && approval.approved === true;
   return { report, validation, approval, approved };
 }
 function readHarnessReport(reportPath) {
-  return normalizeHarnessReport(JSON.parse(readFileSync(reportPath, "utf8")));
+  return normalizeHarnessReport(JSON.parse(readFileSync2(reportPath, "utf8")));
 }
 function normalizeHarnessReport(value) {
   const report = cloneJson(value);
@@ -179546,7 +180016,7 @@ function limitReportEvidence(claims, citations) {
   };
 }
 function resolveHarnessReportPath(rootDir, value) {
-  return resolve(rootDir, value && value !== "true" ? value : HARNESS_REPORT_PATH);
+  return resolve2(rootDir, value && value !== "true" ? value : HARNESS_REPORT_PATH);
 }
 function writeHarnessReportArtifacts(options) {
   const written = [];
@@ -179683,14 +180153,14 @@ function upsertCitation(citations, citationIndex, evidence, rootDir) {
 function citationExcerpt(rootDir, path, line) {
   if (isUnsafeCitationPath(path))
     return {};
-  const absPath = resolve(rootDir, path);
+  const absPath = resolve2(rootDir, path);
   if (!isInside(rootDir, absPath) || !existsSync(absPath))
     return {};
   try {
     const stat = lstatSync(absPath);
     if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 128 * 1024)
       return {};
-    const lines = readFileSync(absPath, "utf8").split(/\r?\n/);
+    const lines = readFileSync2(absPath, "utf8").split(/\r?\n/);
     const selected = line ? lines[line - 1] : lines.find((candidate) => candidate.trim().length > 0);
     if (!selected)
       return {};
@@ -179828,7 +180298,7 @@ function validateCitation(citation, rootDir, errors, warnings, options) {
     errors.push(`Citation ${citation.id} points to an unsafe path.`);
     return;
   }
-  const absPath = resolve(rootDir, citation.path);
+  const absPath = resolve2(rootDir, citation.path);
   if (!isInside(rootDir, absPath)) {
     errors.push(`Citation ${citation.id} points outside the harness root.`);
     return;
@@ -179847,7 +180317,7 @@ function validateCitation(citation, rootDir, errors, warnings, options) {
     }
     if (!stat.isFile())
       errors.push(`Citation ${citation.id} does not point to a file.`);
-    const lines = readFileSync(absPath, "utf8").split(/\r?\n/);
+    const lines = readFileSync2(absPath, "utf8").split(/\r?\n/);
     if (citation.line !== undefined) {
       const lineCount = lines.length;
       if (citation.line < 1 || citation.line > lineCount) {
@@ -179898,7 +180368,7 @@ function isSecretishPath2(path) {
   return name === ".env" || name.startsWith(".env.") || name.includes("secret") || name.includes("private-key") || name.endsWith(".pem");
 }
 function isInside(rootDir, absPath) {
-  const rel = relative(resolve(rootDir), resolve(absPath));
+  const rel = relative(resolve2(rootDir), resolve2(absPath));
   return rel === "" || !rel.startsWith("..") && !rel.startsWith("/");
 }
 function writeJson(path, value) {
@@ -179958,7 +180428,7 @@ function readRemoteRunState(rootDir) {
   if (!existsSync2(path))
     return;
   try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    const parsed = JSON.parse(readFileSync3(path, "utf8"));
     if (!parsed || typeof parsed.run_id !== "string" || parsed.run_id.length === 0)
       return;
     return {
@@ -180317,8 +180787,8 @@ async function remoteAnalyzeFetch(url, apiKey, init, timeoutMs) {
 }
 
 // src/harness-artifact-bodies.ts
-import { existsSync as existsSync3, lstatSync as lstatSync2, readFileSync as readFileSync3, realpathSync } from "node:fs";
-import { basename as basename2, dirname as dirname2, isAbsolute, relative as relative2, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync3, lstatSync as lstatSync2, readFileSync as readFileSync4, realpathSync } from "node:fs";
+import { basename as basename2, dirname as dirname2, isAbsolute, relative as relative2, resolve as resolve3 } from "node:path";
 var MAX_SCANNED_FILE_BYTES2 = 512 * 1024;
 var SNAPSHOT_BUDGET_SKIP_REASONS = new Set([
   "file too large for harness scan",
@@ -180381,13 +180851,13 @@ function readBoundedRepoText(absPath, rootDir) {
     return;
   }
   try {
-    return readFileSync3(absPath, "utf8");
+    return readFileSync4(absPath, "utf8");
   } catch {
     return;
   }
 }
 function readRepoRelativeText(rootDir, relPath) {
-  return readBoundedRepoText(resolve2(rootDir, relPath), rootDir);
+  return readBoundedRepoText(resolve3(rootDir, relPath), rootDir);
 }
 function isDedicatedToolFilePath(path) {
   return /(^|\/)tools?\//i.test(path) && /\.(ts|tsx|js|mjs|py)$/i.test(path);
@@ -180414,8 +180884,8 @@ function extractToolBodyFromText(text, toolName) {
   const normalizedName = toolName.replace(/\s+/g, "").toLowerCase();
   for (let index = 0;index < lines.length; index += 1) {
     const line = lines[index];
-    const compact = line.replace(/\s+/g, "").toLowerCase();
-    const mentionsTool = compact.includes(normalizedName) || compact.includes(`def${normalizedName}`);
+    const compact2 = line.replace(/\s+/g, "").toLowerCase();
+    const mentionsTool = compact2.includes(normalizedName) || compact2.includes(`def${normalizedName}`);
     if (!mentionsTool)
       continue;
     if (line.includes("function_tool") || line.includes("tool(") || line.includes("createTool") || line.includes("functionTool") || line.includes("dynamicTool") || line.includes("new Tool") || line.includes("def ")) {
@@ -180428,14 +180898,14 @@ function annotatedSourceCandidates(sourcePath, annotation) {
   const explicitSourcePath = normalizePath2(sourcePath) !== normalizePath2(annotation.evidence.path);
   if (!explicitSourcePath) {
     return [
-      resolve2(annotation.rootDir, sourcePath),
-      resolve2(dirname2(annotation.sourceAbsPath), sourcePath),
+      resolve3(annotation.rootDir, sourcePath),
+      resolve3(dirname2(annotation.sourceAbsPath), sourcePath),
       annotation.sourceAbsPath
     ];
   }
-  const rootAbs = resolve2(annotation.rootDir);
-  const candidates = walkAncestorDirs(dirname2(annotation.sourceAbsPath), rootAbs).map((dir) => resolve2(dir, sourcePath));
-  candidates.push(resolve2(annotation.rootDir, sourcePath));
+  const rootAbs = resolve3(annotation.rootDir);
+  const candidates = walkAncestorDirs(dirname2(annotation.sourceAbsPath), rootAbs).map((dir) => resolve3(dir, sourcePath));
+  candidates.push(resolve3(annotation.rootDir, sourcePath));
   return candidates;
 }
 function readAnnotatedSourceText(sourcePath, annotation) {
@@ -180516,9 +180986,9 @@ function readSourcePathRelativeToEvidence(artifact, rootDir) {
   const evidencePath = firstEvidencePath(artifact);
   if (!evidencePath)
     return;
-  const rootAbs = resolve2(rootDir);
-  for (const dir of walkAncestorDirs(dirname2(resolve2(rootDir, evidencePath)), rootAbs)) {
-    const text = readBoundedRepoText(resolve2(dir, artifact.sourcePath), rootDir);
+  const rootAbs = resolve3(rootDir);
+  for (const dir of walkAncestorDirs(dirname2(resolve3(rootDir, evidencePath)), rootAbs)) {
+    const text = readBoundedRepoText(resolve3(dir, artifact.sourcePath), rootDir);
     if (text !== undefined)
       return text;
   }
@@ -180548,7 +181018,7 @@ function enrichScanCaptureMetadata(graph) {
 
 // src/harness-candidates.ts
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "node:fs";
-import { basename as basename3, dirname as dirname3, extname, resolve as resolve3 } from "node:path";
+import { basename as basename3, dirname as dirname3, extname, resolve as resolve4 } from "node:path";
 var EXCERPT_MAX_CHARS = 240;
 var MAX_CANDIDATES_PER_FILE_PER_SIGNAL = 20;
 var MIN_PROMPT_LITERAL_CHARS = 160;
@@ -181076,7 +181546,7 @@ function detectHarnessCandidatesInFiles(files) {
 function detectHarnessCandidates(rootDir) {
   const startedAt = Date.now();
   const skipped = [];
-  const root = resolve3(rootDir);
+  const root = resolve4(rootDir);
   const inventory = inventoryFiles(root, skipped, {
     includeFile: (path) => PROMPT_DOC_EXTENSIONS.has(extname(path).toLowerCase()) || [".json", ".yaml", ".yml"].includes(extname(path).toLowerCase()) || extname(path).toLowerCase() === ".rs" && RUST_PROMPT_PATH_HINT.test(path)
   });
@@ -181102,7 +181572,7 @@ function detectHarnessCandidates(rootDir) {
   return redactDeep(report);
 }
 function writeHarnessCandidatesReport(report, outPath) {
-  const target = resolve3(outPath);
+  const target = resolve4(outPath);
   mkdirSync3(dirname3(target), { recursive: true });
   writeFileSync3(target, `${JSON.stringify(report, null, 2)}
 `, "utf8");
@@ -181162,8 +181632,8 @@ import { extname as extname8 } from "node:path";
 // src/prompt-sources.ts
 var import_typescript2 = __toESM(require_typescript(), 1);
 import { createHash as createHash2 } from "node:crypto";
-import { lstatSync as lstatSync4, readFileSync as readFileSync6, realpathSync as realpathSync4 } from "node:fs";
-import { extname as extname3, isAbsolute as isAbsolute2, relative as relative3, resolve as resolve6 } from "node:path";
+import { lstatSync as lstatSync4, readFileSync as readFileSync7, realpathSync as realpathSync4 } from "node:fs";
+import { extname as extname3, isAbsolute as isAbsolute2, relative as relative3, resolve as resolve7 } from "node:path";
 
 // src/prompt-frameworks.ts
 var PYTHON_AGENT_MODULES = [
@@ -181184,15 +181654,15 @@ var TYPESCRIPT_AGENT_MODULES = [
 
 // src/prompt-source-code.ts
 var import_typescript = __toESM(require_typescript(), 1);
-import { existsSync as existsSync4, lstatSync as lstatSync3, readFileSync as readFileSync4, realpathSync as realpathSync2 } from "node:fs";
-import { dirname as dirname4, extname as extname2, join as join3, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync4, lstatSync as lstatSync3, readFileSync as readFileSync5, realpathSync as realpathSync2 } from "node:fs";
+import { dirname as dirname4, extname as extname2, join as join3, resolve as resolve5 } from "node:path";
 var EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
 var MAX_BYTES = 2 * 1024 * 1024;
 var MAX_DEPTH = 32;
 var MAX_FILES = 256;
 var MAX_GRAPH_BYTES = 16 * 1024 * 1024;
 function extractCodeSource(rootDir, sourcePath, symbol, forceDependencyGraph = false) {
-  const state = { root: resolve4(rootDir), files: [], unresolved: [], visiting: new Set, importsVisited: new Set, parsed: new Map, assignments: new Map, bytesRead: 0 };
+  const state = { root: resolve5(rootDir), files: [], unresolved: [], visiting: new Set, importsVisited: new Set, parsed: new Map, assignments: new Map, bytesRead: 0 };
   const file = safeFile(state.root, state.root, sourcePath);
   const parsed = parseFile(file, state);
   const target = symbol ? findSymbol(parsed, symbol) : findInstructionCandidate(parsed);
@@ -181225,7 +181695,7 @@ function parseFile(filePath, state) {
   const cached = state.parsed.get(path);
   if (cached)
     return cached;
-  const text = readFileSync4(path, "utf8");
+  const text = readFileSync5(path, "utf8");
   state.bytesRead += Buffer.byteLength(text);
   state.files.push(path);
   const scriptKind = extname2(path) === ".json" ? import_typescript.default.ScriptKind.JSON : /\.tsx?$/.test(extname2(path)) ? import_typescript.default.ScriptKind.TSX : import_typescript.default.ScriptKind.JSX;
@@ -181240,7 +181710,7 @@ function parseFile(filePath, state) {
 function safeFile(root, base, requested) {
   if (requested.includes("\x00"))
     throw new Error(`Prompt source path contains NUL: ${requested}`);
-  const candidate = resolve4(base, requested);
+  const candidate = resolve5(base, requested);
   let cursor = candidate;
   while (cursor !== root) {
     let stat2;
@@ -181256,7 +181726,7 @@ function safeFile(root, base, requested) {
       break;
     cursor = next;
   }
-  const rootReal = resolve4(root);
+  const rootReal = resolve5(root);
   let real;
   try {
     real = requireRealpath(candidate);
@@ -181593,7 +182063,7 @@ function isBindingMutated(file, name) {
 function moduleSpecifier(from, specifier) {
   if (!specifier.startsWith("."))
     return;
-  const base = resolve4(dirname4(from), specifier);
+  const base = resolve5(dirname4(from), specifier);
   const stripped = /\.(?:js|jsx|mjs|cjs)$/.test(base) ? base.slice(0, base.lastIndexOf(".")) : base;
   for (const candidate of [base, stripped, ...EXTENSIONS.map((ext) => `${base}${ext}`), ...EXTENSIONS.map((ext) => `${stripped}${ext}`), ...EXTENSIONS.map((ext) => join3(base, `index${ext}`)), ...EXTENSIONS.map((ext) => join3(stripped, `index${ext}`))])
     if (existsSync4(candidate) && lstatSync3(candidate).isFile())
@@ -181613,7 +182083,7 @@ function nodeRange(file, node) {
   };
 }
 function inspectCodeSelectors(rootDir, sourcePath, symbol) {
-  const state = { root: resolve4(rootDir), files: [], unresolved: [], visiting: new Set, importsVisited: new Set, parsed: new Map, assignments: new Map, bytesRead: 0 };
+  const state = { root: resolve5(rootDir), files: [], unresolved: [], visiting: new Set, importsVisited: new Set, parsed: new Map, assignments: new Map, bytesRead: 0 };
   const parsed = parseFile(safeFile(state.root, state.root, sourcePath), state);
   if (symbol) {
     const node = findSymbol(parsed, symbol);
@@ -181663,8 +182133,8 @@ function referenceNames(node) {
 
 // src/prompt-source-python.ts
 import { spawnSync } from "node:child_process";
-import { readFileSync as readFileSync5, realpathSync as realpathSync3 } from "node:fs";
-import { resolve as resolve5 } from "node:path";
+import { readFileSync as readFileSync6, realpathSync as realpathSync3 } from "node:fs";
+import { resolve as resolve6 } from "node:path";
 var PYTHON_AGENT_MODULES_LITERAL = JSON.stringify(PYTHON_AGENT_MODULES);
 var SELECTOR_HELPER = String.raw`import ast,json,os,sys
 request=json.loads(sys.stdin.read()); root=os.path.realpath(request['root']); path=os.path.abspath(request['path']); wanted=request.get('symbol')
@@ -181725,7 +182195,7 @@ else:
   print(json.dumps({'candidates':found},ensure_ascii=False))`;
 function inspectPythonSelectors(rootDir, sourcePath, symbol) {
   const root = realpathSync3(rootDir);
-  const absolute = resolve5(root, sourcePath);
+  const absolute = resolve6(root, sourcePath);
   const result = spawnSync("python3", ["-I", "-c", SELECTOR_HELPER], {
     input: JSON.stringify({ root, path: absolute, ...symbol ? { symbol } : {} }),
     encoding: "utf8",
@@ -181870,7 +182340,7 @@ except SystemExit: pass
 except Exception as error: print(json.dumps({'candidates':[],'error':str(error)}))`;
 function discoverPythonPromptSources(rootDir, sourcePath) {
   const result = spawnSync("python3", ["-I", "-c", DISCOVERY_HELPER], {
-    input: JSON.stringify({ root: rootDir, path: resolve5(rootDir, sourcePath) }),
+    input: JSON.stringify({ root: rootDir, path: resolve6(rootDir, sourcePath) }),
     encoding: "utf8",
     maxBuffer: 4 * 1024 * 1024,
     timeout: 1e4
@@ -182130,7 +182600,7 @@ except Exception as e:
 function extractPythonSource(rootDir, sourcePath, symbol, _forceDependencyGraph = false) {
   let raw = "";
   try {
-    raw = readFileSync5(sourcePath, "utf8");
+    raw = readFileSync6(sourcePath, "utf8");
   } catch {}
   const result = spawnSync("python3", ["-I", "-c", HELPER], {
     input: JSON.stringify({ root: rootDir, path: sourcePath, symbol, force: _forceDependencyGraph }),
@@ -182224,7 +182694,7 @@ function resolvePromptSource(rootDir, source) {
   } else if (source.selector?.symbol) {
     throw new Error(`${sourcePath}: symbol selectors require a JavaScript, TypeScript, or Python source file`);
   } else if (ext === ".json" || ext === ".yaml" || ext === ".yml" || hasPointer || source.kind === "messages") {
-    const parsed = parseStructured(readFileSync6(sourceAbs, "utf8"), sourcePath, ext);
+    const parsed = parseStructured(readFileSync7(sourceAbs, "utf8"), sourcePath, ext);
     const selected = hasPointer ? jsonPointer(parsed, source.selector.pointer, sourcePath) : parsed;
     const selectedField = source.selector?.pointer?.split("/").at(-1)?.replaceAll("~1", "/").replaceAll("~0", "~");
     const inferredKind = !source.kind && selectedField && /^(?:template|system_template|instance_template)$/.test(selectedField) ? "template" : source.kind;
@@ -182234,7 +182704,7 @@ function resolvePromptSource(rootDir, source) {
     messages = structured.messages;
     kind = structured.kind;
   } else {
-    const raw = readFileSync6(sourceAbs, "utf8");
+    const raw = readFileSync7(sourceAbs, "utf8");
     if (ext === ".md" && /\.prompt\.md$/i.test(sourcePath)) {
       const legacy = parseLegacyMarkdown(raw);
       content = legacy.content;
@@ -182257,7 +182727,7 @@ function resolvePromptSource(rootDir, source) {
       const depAbs = safePath(root, dependency.path);
       files.add(depAbs);
       if (typeof dependency.selector?.pointer === "string") {
-        const parsed = parseStructured(readFileSync6(depAbs, "utf8"), dependency.path, extname3(depAbs).toLowerCase());
+        const parsed = parseStructured(readFileSync7(depAbs, "utf8"), dependency.path, extname3(depAbs).toLowerCase());
         jsonPointer(parsed, dependency.selector.pointer, dependency.path);
       } else if (dependency.selector?.symbol && CODE_EXTENSIONS2.has(extname3(depAbs).toLowerCase())) {
         const dep = extname3(depAbs).toLowerCase() === ".py" ? extractPythonSource(root, depAbs, dependency.selector.symbol) : extractCodeSource(root, depAbs, dependency.selector.symbol);
@@ -182280,7 +182750,7 @@ function resolvePromptSource(rootDir, source) {
     assertSafeMaterializedContent(content, sourcePath);
   else
     assertSafeMaterializedContent(materialized, sourcePath);
-  const dependencies = [...files].sort().map((path) => ({ path: relative3(root, path).replaceAll("\\", "/"), contentHash: sha256(readFileSync6(path)) }));
+  const dependencies = [...files].sort().map((path) => ({ path: relative3(root, path).replaceAll("\\", "/"), contentHash: sha256(readFileSync7(path)) }));
   const sourceHash = sha256(JSON.stringify({ kind, content, systemPrompt: systemPrompt ?? null, messages: messages ?? null }));
   const sourceDefinition = {
     schemaVersion: 1,
@@ -182350,7 +182820,7 @@ function discoverStructuredPromptSources(rootDir, sourcePath) {
   const ext = extname3(file).toLowerCase();
   if (![".json", ".yaml", ".yml"].includes(ext))
     return [];
-  const value = parseStructured(readFileSync6(file, "utf8"), sourcePath, ext);
+  const value = parseStructured(readFileSync7(file, "utf8"), sourcePath, ext);
   const sources = [];
   const base = sourcePath.replace(/\.[^.]+$/, "").replace(/[^A-Za-z0-9_.-]+/g, ".");
   const dedicatedPath = /(^|\/)prompts?(?:\/|\.[^/]+$)|\.prompt\.[^.]+$/i.test(sourcePath);
@@ -182413,14 +182883,14 @@ function discoverCodePromptCandidates(rootDir, sourcePath) {
       addName(candidate.symbol, candidate.knownBuilder === true);
       modelInputs.add(candidate.symbol);
     }
-    for (const match of readFileSync6(file, "utf8").matchAll(/^(?:(?:async\s+)?def\s+([A-Za-z_]\w*)|([A-Za-z_]\w*)\s*=\s*([^\n#]+))/gm)) {
+    for (const match of readFileSync7(file, "utf8").matchAll(/^(?:(?:async\s+)?def\s+([A-Za-z_]\w*)|([A-Za-z_]\w*)\s*=\s*([^\n#]+))/gm)) {
       const name = match[1] ?? match[2];
       const rhs = match[3] ?? "";
       if (name && isPromptName2(name) && (match[1] || /['"`\[({+]/.test(rhs) || /^[A-Za-z_]\w*\s*$/.test(rhs)))
         addName(name, Boolean(match[1]));
     }
   } else {
-    const sf = import_typescript2.default.createSourceFile(file, readFileSync6(file, "utf8"), import_typescript2.default.ScriptTarget.Latest, true, import_typescript2.default.ScriptKind.TSX);
+    const sf = import_typescript2.default.createSourceFile(file, readFileSync7(file, "utf8"), import_typescript2.default.ScriptTarget.Latest, true, import_typescript2.default.ScriptKind.TSX);
     const agentConstructors = new Set;
     for (const statement of sf.statements) {
       if (!import_typescript2.default.isImportDeclaration(statement) || !import_typescript2.default.isStringLiteral(statement.moduleSpecifier) || !TYPESCRIPT_AGENT_MODULES.includes(statement.moduleSpecifier.text))
@@ -182602,13 +183072,13 @@ function jsonPointer(value, pointer, path) {
   return current;
 }
 function safeRoot(dir) {
-  const root = realpathSync4(resolve6(dir));
+  const root = realpathSync4(resolve7(dir));
   if (!lstatSync4(root).isDirectory())
     throw new Error(`Prompt source root is not a directory: ${dir}`);
   return root;
 }
 function safePath(root, requested) {
-  const candidate = resolve6(root, requested);
+  const candidate = resolve7(root, requested);
   rejectSymlinkPath(root, candidate, requested);
   const real = realpathSync4(candidate);
   if (!(real === root || real.startsWith(`${root}/`)))
@@ -182654,12 +183124,12 @@ function sha256(input) {
 }
 
 // src/prompt-source-verification/index.ts
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 import { z } from "zod";
 
 // src/prompt-source-validation.ts
 import { existsSync as existsSync5, lstatSync as lstatSync5 } from "node:fs";
-import { extname as extname4, relative as relative4, resolve as resolve7 } from "node:path";
+import { extname as extname4, relative as relative4, resolve as resolve8 } from "node:path";
 function checkPromptMapping(rootDir, unknownMapping) {
   const repairs = [];
   const unresolved = [];
@@ -182675,10 +183145,10 @@ function checkPromptMapping(rootDir, unknownMapping) {
     if (JSON.stringify(normalized) !== JSON.stringify(sourceValue))
       repairs.push("Omitted empty selector/dependency containers");
     const source = validatePromptSource(normalized);
-    const absolute = resolve7(rootDir, source.path);
+    const absolute = resolve8(rootDir, source.path);
     if (!existsSync5(absolute) || !lstatSync5(absolute).isFile())
       throw new Error(`${source.path}: source path is unavailable`);
-    const rel = relative4(resolve7(rootDir), absolute).replaceAll("\\", "/");
+    const rel = relative4(resolve8(rootDir), absolute).replaceAll("\\", "/");
     if (rel !== source.path)
       repairs.push(`normalized path to ${rel}`);
     let selected = { ...source, path: rel };
@@ -182743,23 +183213,23 @@ function isPromptDefinitionPath(path) {
 }
 
 // src/prompt-source-verification/evidence.ts
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 import { extname as extname7 } from "node:path";
 
 // src/prompt-source-verification/paths.ts
 import { lstatSync as lstatSync6, realpathSync as realpathSync5 } from "node:fs";
-import { isAbsolute as isAbsolute3, relative as relative5, resolve as resolve8, sep } from "node:path";
+import { isAbsolute as isAbsolute3, relative as relative5, resolve as resolve9, sep } from "node:path";
 function safePromptEvidencePath(rootDir, path) {
   const root = realpathSync5(rootDir);
   if (!path || isAbsolute3(path))
     throw new Error("Evidence path must be repository-relative");
-  const absolute = resolve8(root, path);
+  const absolute = resolve9(root, path);
   const rel = relative5(root, absolute);
   if (!rel || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute3(rel))
     throw new Error("Evidence escapes repository");
   let current = root;
   for (const part of rel.split(sep)) {
-    current = resolve8(current, part);
+    current = resolve9(current, part);
     if (lstatSync6(current).isSymbolicLink())
       throw new Error("Evidence path is symlinked");
   }
@@ -182773,14 +183243,14 @@ function safePromptEvidencePath(rootDir, path) {
 var import_typescript3 = __toESM(require_typescript(), 1);
 import { execFileSync } from "node:child_process";
 import { extname as extname5 } from "node:path";
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync8 } from "node:fs";
 function proveSink(root, sink) {
   const file = safePromptEvidencePath(root, sink.path);
   const cache = new Map;
   if (!cache.has(file)) {
     if (extname5(file) === ".py") {
       try {
-        const rows = JSON.parse(execFileSync("python3", ["-I", "-c", PYTHON_PROOF], { input: readFileSync7(file, "utf8"), encoding: "utf8", timeout: 1e4, maxBuffer: 2 * 1024 * 1024 }));
+        const rows = JSON.parse(execFileSync("python3", ["-I", "-c", PYTHON_PROOF], { input: readFileSync8(file, "utf8"), encoding: "utf8", timeout: 1e4, maxBuffer: 2 * 1024 * 1024 }));
         cache.set(file, new Map(Object.entries(rows).map(([line, proof]) => [Number(line), proof])));
       } catch {
         cache.set(file, new Map);
@@ -182947,7 +183417,7 @@ print(json.dumps(rows))
 `;
 
 // src/prompt-source-location.ts
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync9 } from "node:fs";
 import { extname as extname6 } from "node:path";
 function structuredExcerpt(text, source) {
   if (source.selector?.pointer === undefined)
@@ -183001,7 +183471,7 @@ function promptDefinitionExcerpt(rootDir, source) {
       return;
     return { ...extraction.range, text: extraction.sourceText, ...extraction.declarationKind ? { declarationKind: extraction.declarationKind } : {} };
   }
-  const text = readFileSync8(file, "utf8");
+  const text = readFileSync9(file, "utf8");
   return structuredExcerpt(text, source);
 }
 function promptDefinitionRange(rootDir, source) {
@@ -183028,7 +183498,7 @@ function reviewEvidence(rootDir, source, evidence) {
     for (const item of evidence) {
       let text;
       try {
-        text = readFileSync9(safePromptEvidencePath(rootDir, item.path), "utf8");
+        text = readFileSync10(safePromptEvidencePath(rootDir, item.path), "utf8");
       } catch (error) {
         if (item.kind === "model_endpoint")
           return { valid: false, endpointVerified: false, reason: error instanceof Error ? error.message : String(error) };
@@ -183143,7 +183613,7 @@ async function independentlyVerifyPromptSource(rootDir, source, verifier) {
   let priorJudgment;
   try {
     const before = JSON.stringify(checked.resolved.sourceDefinition);
-    const sourceBytes = readFileSync10(safePromptEvidencePath(rootDir, source.path), "utf8");
+    const sourceBytes = readFileSync11(safePromptEvidencePath(rootDir, source.path), "utf8");
     const instruction = promptVerificationInstruction(checked.source, checked.sourceHash, promptDefinitionExcerpt(rootDir, checked.source));
     for (let attempt = 0;attempt < 2; attempt++) {
       const repair = attempt ? `
@@ -183174,7 +183644,7 @@ ${output}` : "";
     }
     if (reviewed.truncated || reviewed.sourceHash !== checked.sourceHash)
       return pending("Verifier output is truncated or cites a different source hash", reviewed.evidence, reviewed.role, normalizeUsage(undefined, false));
-    if (before !== snapshot() || readFileSync10(safePromptEvidencePath(rootDir, source.path), "utf8") !== sourceBytes)
+    if (before !== snapshot() || readFileSync11(safePromptEvidencePath(rootDir, source.path), "utf8") !== sourceBytes)
       return pending("Source changed during verification", reviewed.evidence, reviewed.role, normalizeUsage(undefined, false));
     if (reviewed.role === "non_prompt")
       return { status: "rejected", reason: reviewed.reason, evidence: reviewed.evidence, sourceHash: checked.sourceHash, role: reviewed.role, usage: normalizeUsage(undefined, false) };
@@ -183534,8 +184004,8 @@ function applyPromptDiscovery(graph, discovery) {
 }
 
 // src/harness-candidate-promotion.ts
-import { readFileSync as readFileSync11 } from "node:fs";
-import { resolve as resolve9 } from "node:path";
+import { readFileSync as readFileSync12 } from "node:fs";
+import { resolve as resolve10 } from "node:path";
 var PROMOTED_CONFIDENCE = {
   high: 0.85,
   medium: 0.6
@@ -183565,7 +184035,7 @@ function readFileLines(rootDir, path, cache) {
     return cached;
   let lines;
   try {
-    lines = readFileSync11(resolve9(rootDir, path), "utf8").split(/\r?\n/);
+    lines = readFileSync12(resolve10(rootDir, path), "utf8").split(/\r?\n/);
   } catch {
     lines = null;
   }
@@ -184043,9 +184513,46 @@ var SCHEMA_VERSION = "harness.v0.1";
 var REPORT_JSON_BEGIN = "MODA_HARNESS_REPORT_JSON_BEGIN";
 var REPORT_JSON_END = "MODA_HARNESS_REPORT_JSON_END";
 var EXTERNAL_ANALYST_ADAPTERS = ["claude", "codex", "cursor"];
+var HARNESS_FAMILY_FLAGS = [
+  "agent-id",
+  "allow-no-agents",
+  "analyst",
+  "analyst-command",
+  "analyst-model",
+  "assist",
+  "concern",
+  "dry-run",
+  "experimental",
+  "from",
+  "from-report",
+  "github-actions",
+  "harness",
+  "limit",
+  "local",
+  "no-remote",
+  "offset",
+  "out",
+  "path",
+  "remote",
+  "report",
+  "run",
+  "run-id",
+  "shards",
+  "summary",
+  "sync",
+  "tenant",
+  "tenant-id",
+  "to",
+  "version"
+];
+var HARNESS_DRY_RUN_SUBCOMMANDS = new Set(["scan", "sync", "delete", "analyze", "validate-report", "candidates"]);
 async function runHarnessCommand(context) {
   const subcommand = context.positionals[0] ?? "scan";
-  const rootDir = resolve10(context.cwd, context.flags.path ?? ".");
+  assertFlags(`harness ${subcommand}`, context.flags, HARNESS_FAMILY_FLAGS);
+  if (context.dryRun && !HARNESS_DRY_RUN_SUBCOMMANDS.has(subcommand)) {
+    throw new CliInputError(`'moda harness ${subcommand}' has no dry-run mode, so nothing was sent.`, `Remove --dry-run to run it for real. Harness commands with a real dry-run: ${[...HARNESS_DRY_RUN_SUBCOMMANDS].join(", ")}.`);
+  }
+  const rootDir = resolve11(context.cwd, context.flags.path ?? ".");
   const selectedAgentId = selectedRuntimeAgentId(context.flags);
   const tenant = resolveHarnessTenant(context.flags, context);
   const scanPlan = buildCommandScanPlan(context, rootDir);
@@ -184097,6 +184604,10 @@ async function runHarnessCommand(context) {
         if (!approved && !context.dryRun) {
           throw new CliInputError("Harness report is not approved; refusing to sync.", "Run `moda harness validate-report`, review the report, then run `moda harness approve --yes` before syncing.");
         }
+        const wouldRefuse = context.dryRun ? [
+          ...approved ? [] : ["Harness report is not approved; the real sync would refuse. Run `moda harness approve --yes` first."],
+          ...syncQualityRefusal(report.graph, context.flags)
+        ] : [];
         if (!context.dryRun)
           assertHarnessGraphSyncQuality(report.graph, context.flags);
         const syncGraph2 = graphForReport(report.graph);
@@ -184128,7 +184639,7 @@ async function runHarnessCommand(context) {
             reportHash: approval.reportHash
           } : undefined
         };
-        const response2 = await syncHarnessWithRemote(context, syncBody);
+        const response2 = wouldRefuse.length > 0 ? undefined : await syncHarnessWithRemote(context, syncBody);
         const statePath2 = response2 && !context.dryRun ? writeHarnessSyncState(rootDir, {
           schemaVersion: "sync_state.v0.1",
           updatedAt: new Date().toISOString(),
@@ -184168,17 +184679,19 @@ async function runHarnessCommand(context) {
           remote: response2 ?? plannedDryRunRemote(plan2),
           written: written2,
           syncState: statePath2 ? { path: statePath2 } : undefined,
-          dryRun: context.dryRun
-        });
-        return { exitCode: 0 };
+          dryRun: context.dryRun,
+          ...wouldRefuse.length > 0 ? { wouldRefuse } : {}
+        }, wouldRefuse.length > 0 ? { warnings: wouldRefuse, status: "error" } : undefined);
+        return { exitCode: wouldRefuse.length > 0 ? 1 : 0 };
       }
       const graph = scanHarness({
         rootDir,
-        dryRun: context.dryRun,
+        dryRun: false,
         tenantId: tenant?.tenantId,
         tenantSource: tenant?.source,
         pathWasExplicit: context.flags.path !== undefined
       });
+      const scanWouldRefuse = context.dryRun ? syncQualityRefusal(graph, context.flags) : [];
       if (!context.dryRun)
         assertHarnessGraphSyncQuality(graph, context.flags);
       const syncGraph = graphForSync(graph);
@@ -184196,7 +184709,7 @@ async function runHarnessCommand(context) {
       const written = context.dryRun ? [] : writeHarnessArtifacts(graph, rootDir, {
         summary: context.flags.summary === "true"
       });
-      const response = await syncHarnessWithRemote(context, {
+      const response = scanWouldRefuse.length > 0 ? undefined : await syncHarnessWithRemote(context, {
         graph: syncGraph,
         graphHash: localGraphHash,
         sourceCommit
@@ -184225,20 +184738,21 @@ async function runHarnessCommand(context) {
         remote: response ?? plannedDryRunRemote(plan),
         written,
         syncState: statePath ? { path: statePath } : undefined,
-        dryRun: context.dryRun
-      });
-      return { exitCode: 0 };
+        dryRun: context.dryRun,
+        ...scanWouldRefuse.length > 0 ? { wouldRefuse: scanWouldRefuse } : {}
+      }, scanWouldRefuse.length > 0 ? { warnings: scanWouldRefuse, status: "error" } : undefined);
+      return { exitCode: scanWouldRefuse.length > 0 ? 1 : 0 };
     }
     case "delete": {
       const idOrKey = context.positionals[1] ?? (context.flags.harness && context.flags.harness !== "true" ? context.flags.harness : undefined);
       if (!idOrKey) {
         throw new CliInputError("Missing harness id or key to delete.", "Usage: moda harness delete <harness-id-or-key> [--yes]");
       }
-      const profileOptions = { profile: context.profile, env: context.env };
-      if (!resolveApiKey(profileOptions) && !context.dryRun) {
+      const profileOptions2 = { profile: context.profile, env: context.env };
+      if (!resolveApiKey(profileOptions2) && !context.dryRun) {
         throw new CliInputError("No Moda API key found for harness delete.", "Run `moda init` first, set MODA_API_KEY, or select a profile with an API key.");
       }
-      const identity3 = describeSyncIdentity(profileOptions);
+      const identity3 = describeSyncIdentity(profileOptions2);
       if (identity3) {
         const label = identity3.tenantSource === "api-key" ? describeSyncTenantLabel(identity3) : describeSyncTenantLabel({
           tenantId: tenant?.tenantId ?? identity3.tenantId,
@@ -184256,7 +184770,7 @@ async function runHarnessCommand(context) {
         return { exitCode: 0 };
       }
       await confirmHarnessDelete(context, idOrKey);
-      const response = await callControlAPI(`/harnesses/${encodeURIComponent(idOrKey)}`, { method: "DELETE" }, profileOptions);
+      const response = await callControlAPI(`/harnesses/${encodeURIComponent(idOrKey)}`, { method: "DELETE" }, profileOptions2);
       writeHumanProgress(context, `Deleted harness ${response.harnessKey ?? idOrKey} from tenant ${response.tenantId ?? "unknown"} ` + `(${response.deleted?.versions ?? 0} versions, ${response.deleted?.agents ?? 0} agents, ` + `${response.deleted?.artifacts ?? 0} artifacts, ${response.deleted?.relationships ?? 0} relationships).`);
       context.output.writeData({ ...response, dryRun: false });
       return { exitCode: 0 };
@@ -184299,7 +184813,7 @@ async function runHarnessCommand(context) {
         throw new CliInputError("Focused remote prompt analysis is not supported yet.", "Use local --analyst=claude|codex|cursor|local-scan, or drop --concern for a full remote report.");
       }
       if (context.flags["github-actions"] === "true") {
-        const { runGithubActionsAnalyze } = await import("./harness-github-actions-qz5d22rz.js");
+        const { runGithubActionsAnalyze } = await import("./harness-github-actions-1qt4sgxd.js");
         const result = await runGithubActionsAnalyze(rootDir, {
           writeReport: (report2) => {
             const normalized = normalizeHarnessReport(report2);
@@ -184441,7 +184955,7 @@ async function runHarnessCommand(context) {
         throw new CliInputError("Missing output path for --out.", "Usage: moda harness candidates --out=<file>");
       }
       if (outFlag && !context.dryRun) {
-        written.push(writeHarnessCandidatesReport(report, resolve10(context.cwd, outFlag)));
+        written.push(writeHarnessCandidatesReport(report, resolve11(context.cwd, outFlag)));
       }
       writeHumanProgress(context, `Harness candidates: ${report.stats.candidateCount} candidates across ${report.stats.filesWithCandidates} files (${report.stats.filesScanned} scanned, ${report.stats.filesPerSecond.toLocaleString()} files/sec).`);
       context.output.writeData({ scanPlan, ...report, written, dryRun: context.dryRun });
@@ -184529,8 +185043,43 @@ async function runHarnessCommand(context) {
       });
       return { exitCode: 0 };
     }
+    case "list":
+    case "show":
+    case "versions":
+    case "diff": {
+      const readFlags = { list: ["limit", "offset"], show: ["version"], versions: ["limit", "offset"], diff: ["from", "to"] };
+      assertFlags(`harness ${subcommand}`, context.flags, [...readFlags[subcommand], "path"]);
+      assertPositionals(`harness ${subcommand}`, context.positionals, subcommand === "list" ? 1 : 2, `moda harness ${subcommand}${subcommand === "list" ? "" : " <harness-id-or-key>"}`);
+      for (const flag of readFlags[subcommand]) {
+        if (context.flags[flag] === "true")
+          throw new CliInputError(`--${flag} needs a value.`);
+      }
+      const profileOptions2 = { profile: context.profile, env: context.env };
+      if (!resolveApiKey(profileOptions2)) {
+        throw new CliInputError(`No Moda API key found for harness ${subcommand}.`, "Set MODA_API_KEY, run `moda auth login --api-key`, or select a profile with an API key.");
+      }
+      const query = new URLSearchParams;
+      const idOrKey = context.positionals[1];
+      if (subcommand !== "list" && !idOrKey) {
+        throw new CliInputError(`Missing harness id or key for harness ${subcommand}.`, `Usage: moda harness ${subcommand} <harness-id-or-key>${subcommand === "diff" ? " [--from=<versionId>] [--to=<versionId>]" : ""}. List them with \`moda harness list\`.`);
+      }
+      if ((subcommand === "list" || subcommand === "versions") && context.flags.limit)
+        query.set("limit", context.flags.limit);
+      if ((subcommand === "list" || subcommand === "versions") && context.flags.offset)
+        query.set("offset", context.flags.offset);
+      if (subcommand === "show" && context.flags.version)
+        query.set("versionId", context.flags.version);
+      if (subcommand === "diff" && context.flags.from)
+        query.set("from", context.flags.from);
+      if (subcommand === "diff" && context.flags.to)
+        query.set("to", context.flags.to);
+      const suffix = query.toString() ? `?${query.toString()}` : "";
+      const path = subcommand === "list" ? `/harnesses${suffix}` : `/harnesses/${encodeURIComponent(idOrKey)}${subcommand === "show" ? "" : `/${subcommand}`}${suffix}`;
+      context.output.writeData(await callControlAPI(path, {}, profileOptions2));
+      return { exitCode: 0 };
+    }
     default:
-      throw new CliInputError(`Unknown harness command '${subcommand}'.`, "Usage: moda harness analyze|pull|validate-report|approve|scan|candidates|sync|delete|agents|graph|explain|write-summary|status");
+      throw new CliInputError(`Unknown harness command '${subcommand}'.`, "Usage: moda harness analyze|pull|validate-report|approve|scan|candidates|sync|delete|list|show|versions|diff|agents|graph|explain|write-summary|status");
   }
 }
 function writeHarnessAnalyzeResult(context, payload) {
@@ -184598,7 +185147,7 @@ async function runPromptConcernAnalysis(context, rootDir, scanPlan, tenant) {
   const manifest = join4(rootDir, ".moda/prompts.yml");
   let existing = [];
   if (existsSync6(manifest)) {
-    const document = $parseDocument(readFileSync12(manifest, "utf8"));
+    const document = $parseDocument(readFileSync13(manifest, "utf8"));
     if (document.errors.length)
       throw new CliInputError("Invalid prompt manifest.", document.errors[0].message);
     existing = document.toJS({ maxAliasCount: 20 })?.sources ?? [];
@@ -184827,7 +185376,7 @@ function buildExternalAnalystEnv(env) {
   return next;
 }
 function readExternalAnalystReport(rootDir, result, adapter, concern) {
-  const reportPath = resolve10(rootDir, HARNESS_REPORT_PATH);
+  const reportPath = resolve11(rootDir, HARNESS_REPORT_PATH);
   if (existsSync6(reportPath))
     return repairExternalAnalystReport(readHarnessReport(reportPath), rootDir, { concern });
   const output = [
@@ -184842,7 +185391,7 @@ function readExternalAnalystReport(rootDir, result, adapter, concern) {
     return parsed;
   let debugHint = "";
   try {
-    const debugPath = resolve10(rootDir, MODA_DIR, "analyst-debug.log");
+    const debugPath = resolve11(rootDir, MODA_DIR, "analyst-debug.log");
     mkdirSync4(dirname5(debugPath), { recursive: true });
     writeFileSync4(debugPath, [
       `# analyst=${adapter} status=${result.status} signal=${result.signal} timedOut=${result.timedOut} maxBufferExceeded=${result.maxBufferExceeded}`,
@@ -185073,12 +185622,12 @@ function repairCitationLines(report, rootDir) {
     if (citation.type !== "file" && citation.type !== "generated_doc" || !citation.path || !citation.excerpt)
       continue;
     const excerpt = citation.excerpt;
-    const candidatePath = resolve10(rootDir, citation.path);
+    const candidatePath = resolve11(rootDir, citation.path);
     if (!existsSync6(candidatePath))
       continue;
     let text;
     try {
-      text = readFileSync12(candidatePath, "utf8");
+      text = readFileSync13(candidatePath, "utf8");
     } catch {
       continue;
     }
@@ -185678,8 +186227,8 @@ function resolveExternalHarnessAnalystInvocation(options) {
 }
 function createPromptAnalystIsolation(adapter, rootDir) {
   const moduleDir = dirname5(fileURLToPath(import.meta.url));
-  const bundled = resolve10(moduleDir, "prompt-source-mcp.js");
-  const source = resolve10(moduleDir, "prompt-source-mcp.ts");
+  const bundled = resolve11(moduleDir, "prompt-source-mcp.js");
+  const source = resolve11(moduleDir, "prompt-source-mcp.ts");
   const bundledServer = existsSync6(bundled);
   const serverPath = bundledServer ? bundled : source;
   const command = bundledServer ? process.execPath : resolveBunRuntime();
@@ -186188,11 +186737,11 @@ function splitCommandLine(commandLine) {
   return commandLine.trim().split(/\s+/).filter(Boolean);
 }
 function truncateText(value, maxLength) {
-  const compact = value.replace(/\s+/g, " ").trim();
-  return compact.length > maxLength ? `${compact.slice(0, maxLength - 1)}...` : compact;
+  const compact2 = value.replace(/\s+/g, " ").trim();
+  return compact2.length > maxLength ? `${compact2.slice(0, maxLength - 1)}...` : compact2;
 }
 function scanHarness(options = {}) {
-  const rootDir = resolve10(options.rootDir ?? process.cwd());
+  const rootDir = resolve11(options.rootDir ?? process.cwd());
   const skipped = [];
   const files = inventoryFiles(rootDir, skipped);
   const annotations = files.flatMap((file) => parseAnnotations(file));
@@ -186294,7 +186843,7 @@ function collectSnapshotInputs(rootDir, maxFiles, maxTextBytes) {
     let text = "";
     if (isTextFile(path)) {
       try {
-        text = readFileSync12(current, "utf8");
+        text = readFileSync13(current, "utf8");
         inventoryTextBytes += Buffer.byteLength(text, "utf8");
       } catch {
         return;
@@ -186307,7 +186856,7 @@ function collectSnapshotInputs(rootDir, maxFiles, maxTextBytes) {
   return inputs;
 }
 function buildSourceSnapshot(rootDir) {
-  const root = resolve10(rootDir);
+  const root = resolve11(rootDir);
   const maxFiles = numericEnv("MODA_HARNESS_MAX_FILES", DEFAULT_MAX_INVENTORY_FILES);
   const maxTextBytes = numericEnv("MODA_HARNESS_MAX_TEXT_BYTES", DEFAULT_MAX_INVENTORY_TEXT_BYTES);
   const inputs = collectSnapshotInputs(root, maxFiles, maxTextBytes);
@@ -186517,8 +187066,8 @@ function plannedDryRunRemote(plan) {
 }
 async function syncHarnessWithRemote(context, body) {
   assertHarnessGraphSyncSize(body.graph);
-  const profileOptions = { profile: context.profile, env: context.env };
-  const hasApiKey = Boolean(resolveApiKey(profileOptions));
+  const profileOptions2 = { profile: context.profile, env: context.env };
+  const hasApiKey = Boolean(resolveApiKey(profileOptions2));
   if (context.dryRun && !hasApiKey)
     return;
   return await callControlAPI("/harnesses/sync", {
@@ -186527,14 +187076,14 @@ async function syncHarnessWithRemote(context, body) {
       ...body,
       dryRun: context.dryRun
     })
-  }, profileOptions);
+  }, profileOptions2);
 }
 function readHarnessSyncState(rootDir) {
   const path = join4(rootDir, SYNC_STATE_PATH);
   if (!existsSync6(path))
     return;
   try {
-    const parsed = JSON.parse(readFileSync12(path, "utf8"));
+    const parsed = JSON.parse(readFileSync13(path, "utf8"));
     if (!isRecord3(parsed) || parsed.schemaVersion !== "sync_state.v0.1") {
       return;
     }
@@ -186651,7 +187200,7 @@ function findFresherHarnessReports(rootDir) {
   return fresher.sort((a, b) => b.mtimeMs - a.mtimeMs);
 }
 function warnFresherSubdirHarnessReports(context, rootDir, explicitReport) {
-  const explicitReportPath = explicitReport && explicitReport !== "true" ? normalizePath3(relative6(rootDir, resolve10(rootDir, explicitReport))) : undefined;
+  const explicitReportPath = explicitReport && explicitReport !== "true" ? normalizePath3(relative6(rootDir, resolve11(rootDir, explicitReport))) : undefined;
   if (explicitReportPath && explicitReportPath !== normalizePath3(HARNESS_REPORT_PATH))
     return;
   let fresher;
@@ -186668,7 +187217,7 @@ function warnFresherSubdirHarnessReports(context, rootDir, explicitReport) {
   writeHarnessNotice(context, `A fresher harness report exists at ${newest.path} (this directory has ${rootState}). If you meant that report, re-run with --path=${subdir}.`);
 }
 function readHarnessGraph(manifestPath) {
-  return JSON.parse(readFileSync12(manifestPath, "utf8"));
+  return JSON.parse(readFileSync13(manifestPath, "utf8"));
 }
 function writeHarnessArtifacts(graph, rootDir, options = {}) {
   const modaDir = join4(rootDir, MODA_DIR);
@@ -186780,6 +187329,14 @@ function renderFrameworkAndProviderLines(graph) {
   }
   return lines;
 }
+function syncQualityRefusal(graph, flags) {
+  try {
+    assertHarnessGraphSyncQuality(graph, flags);
+    return [];
+  } catch (error) {
+    return [`The real sync would refuse: ${error instanceof Error ? error.message : String(error)}`];
+  }
+}
 function assertHarnessGraphSyncQuality(graph, flags) {
   if (flags["allow-no-agents"] === "true")
     return;
@@ -186845,7 +187402,7 @@ function explainAgent(graph, agent) {
 }
 function inventoryFiles(rootDir, skipped, options = {}) {
   const files = [];
-  const rootReal = resolve10(rootDir);
+  const rootReal = resolve11(rootDir);
   const maxFiles = numericEnv("MODA_HARNESS_MAX_FILES", DEFAULT_MAX_INVENTORY_FILES);
   const maxTextBytes = numericEnv("MODA_HARNESS_MAX_TEXT_BYTES", DEFAULT_MAX_INVENTORY_TEXT_BYTES);
   let textBytes = 0;
@@ -186899,7 +187456,7 @@ function inventoryFiles(rootDir, skipped, options = {}) {
         recordSkipped(skipped, { path: rel, reason: "scan text budget exceeded" });
       } else {
         try {
-          item.text = readFileSync12(current, "utf8");
+          item.text = readFileSync13(current, "utf8");
           textBytes += Buffer.byteLength(item.text, "utf8");
         } catch {
           recordSkipped(skipped, { path: rel, reason: "text read failed" });
@@ -187206,7 +187763,7 @@ function maybeAddPromptArtifact(graph, file) {
   if (!isPrompt)
     return;
   const id = stableId2("prompt", file.path);
-  const text = file.text ?? readFileSync12(file.absPath, "utf8");
+  const text = file.text ?? readFileSync13(file.absPath, "utf8");
   upsertArtifact(graph, {
     id,
     type: "prompt",
@@ -187787,7 +188344,7 @@ function detectProviderPackagesInManifests(rootDir) {
   const packageJsonPath = join4(rootDir, "package.json");
   if (existsSync6(packageJsonPath)) {
     try {
-      const deps = packageDependencyNames(readFileSync12(packageJsonPath, "utf8"));
+      const deps = packageDependencyNames(readFileSync13(packageJsonPath, "utf8"));
       for (const provider of PROVIDER_CATALOG) {
         for (const name of provider.packageNames) {
           if (deps.has(name))
@@ -187799,7 +188356,7 @@ function detectProviderPackagesInManifests(rootDir) {
   const pyprojectPath = join4(rootDir, "pyproject.toml");
   if (existsSync6(pyprojectPath)) {
     try {
-      const deps = pyprojectDependencyNames(readFileSync12(pyprojectPath, "utf8"));
+      const deps = pyprojectDependencyNames(readFileSync13(pyprojectPath, "utf8"));
       for (const provider of PROVIDER_CATALOG) {
         for (const name of provider.packageNames) {
           if (deps.has(name.toLowerCase()))
@@ -188182,7 +188739,7 @@ function upsertDeployment(graph, next) {
 }
 function contentHashForAnnotatedSource(sourcePath, annotation) {
   const bodyAnnotation = annotation;
-  const rootCandidate = resolve10(annotation.rootDir, sourcePath);
+  const rootCandidate = resolve11(annotation.rootDir, sourcePath);
   const candidates = [
     rootCandidate,
     ...annotatedSourceCandidates(sourcePath, bodyAnnotation).filter((c) => c !== rootCandidate)
@@ -188216,7 +188773,7 @@ function readSmallTextFileForHash(absPath, rootDir) {
   if (!isTextFile(rel))
     return;
   try {
-    return readFileSync12(absPath, "utf8");
+    return readFileSync13(absPath, "utf8");
   } catch {
     return;
   }
@@ -188309,4 +188866,4 @@ function hashText(text) {
   return createHash4("sha256").update(text).digest("hex");
 }
 
-export { ApiError, callDataAPI, callControlAPI, getApiRequestCount, resetApiRequestCount, $parseDocument, $stringify, require_typescript, inspectCodeSelectors, inspectPythonSelectors, resolvePromptSource, shouldColorTerminalOutput, terminalStyles, stripAnsi2 as stripAnsi, renderMarkdownForTerminal, HARNESS_REPORT_PATH, HARNESS_REPORT_APPROVAL_PATH, HARNESS_ANALYZE_CONCERNS, validateHarnessReport, readHarnessReport, hashHarnessReport, hashStableJson, startRemoteAnalyze, pollRemoteAnalyzeUntilDone, isRecoverableRemoteRun, checkPromptMapping, safePromptEvidencePath, discoverHarnessPromptSources, renderDoctorHuman, renderStatusHuman, renderInitBanner, renderInitStep, renderInitNote, renderInitSetupPlan, renderInitComplete, runHarnessCommand, writeHarnessAnalyzeResult, emitWrittenArtifacts, analyzeHarnessPrompts, repairExternalAnalystReport, deriveRelationshipsFromGraph, mergeDeterministicArtifacts, describeCodingAgentEvent, analystEventProgress, isRetryableExternalAnalystFailure, sleep, summarizeInvalidAnalystReport, isDeterministicLocalAnalyst, resolveHarnessAnalyzeConcern, detectAvailableCodingAgents, codingAgentDisplayName, runCodingAgent, resolveAnalystModel, renderExternalHarnessAnalystPrompt, CONCERN_CANDIDATE_KINDS, SEED_CANDIDATE_KIND_LABELS, renderAnalystCandidateLines, renderAnalystSeedLines, truncateText, scanHarness, summarizeHarness, buildSourceSnapshot, writeHumanProgress, readHarnessSyncState, describeSyncIdentity, describeSyncTenantLabel, findFresherHarnessReports, writeHarnessArtifacts, assertHarnessGraphSyncQuality, graphForSync, inventoryFiles, numericEnv, numericEnvAllowZero, computeDeterministicFloor, stableId2 as stableId, titleFromId2 as titleFromId, promptNameFromPath };
+export { ApiError, callDataAPI, callControlAPI, getApiRequestCount, resetApiRequestCount, $parseDocument, $stringify, require_typescript, inspectCodeSelectors, inspectPythonSelectors, resolvePromptSource, assertFlags, assertPositionals, runUsersCommand, runUserCommand, runProblemReopenCommand, runSignalsManagementCommand, SIGNALS_MANAGEMENT_SUBCOMMANDS, unknownSignalsSubcommandError, shouldColorTerminalOutput, terminalStyles, stripAnsi2 as stripAnsi, renderMarkdownForTerminal, HARNESS_REPORT_PATH, HARNESS_REPORT_APPROVAL_PATH, HARNESS_ANALYZE_CONCERNS, validateHarnessReport, readHarnessReport, hashHarnessReport, hashStableJson, startRemoteAnalyze, pollRemoteAnalyzeUntilDone, isRecoverableRemoteRun, checkPromptMapping, safePromptEvidencePath, discoverHarnessPromptSources, renderDoctorHuman, renderStatusHuman, renderInitBanner, renderInitStep, renderInitNote, renderInitSetupPlan, renderInitComplete, runHarnessCommand, writeHarnessAnalyzeResult, emitWrittenArtifacts, analyzeHarnessPrompts, repairExternalAnalystReport, deriveRelationshipsFromGraph, mergeDeterministicArtifacts, describeCodingAgentEvent, analystEventProgress, isRetryableExternalAnalystFailure, sleep, summarizeInvalidAnalystReport, isDeterministicLocalAnalyst, resolveHarnessAnalyzeConcern, detectAvailableCodingAgents, codingAgentDisplayName, runCodingAgent, resolveAnalystModel, renderExternalHarnessAnalystPrompt, CONCERN_CANDIDATE_KINDS, SEED_CANDIDATE_KIND_LABELS, renderAnalystCandidateLines, renderAnalystSeedLines, truncateText, scanHarness, summarizeHarness, buildSourceSnapshot, writeHumanProgress, readHarnessSyncState, describeSyncIdentity, describeSyncTenantLabel, findFresherHarnessReports, writeHarnessArtifacts, assertHarnessGraphSyncQuality, graphForSync, inventoryFiles, numericEnv, numericEnvAllowZero, computeDeterministicFloor, stableId2 as stableId, titleFromId2 as titleFromId, promptNameFromPath };