@moda-ai/cli 1.38.0 → 1.40.0

package/dist/{cli-3kcy61fr.js → cli-w9an3j54.js}

@@ -1,6 +1,8 @@
 import {
   $parseDocument,
   $stringify,
+  assertFlags,
+  assertPositionals,
   callControlAPI,
   callDataAPI,
   inventoryFiles,
@@ -11,7 +13,7 @@ import {
   resolvePromptSource,
   safePromptEvidencePath,
   scanHarness
-} from "./cli-07tv75te.js";
+} from "./cli-xsmsjny3.js";
 import {
   SKILL_SOURCE_HARNESS,
   SKILL_SOURCE_INTEGRATION_BUNDLED,
@@ -24,7 +26,7 @@ import {
 import {
   isAuthSessionValid,
   loadAuthSession
-} from "./cli-kegd748v.js";
+} from "./cli-dyeywy9d.js";
 import {
   CliInputError,
   createCommandContext,
@@ -34,13 +36,14 @@ import {
   isLoopbackBaseUrl,
   loadProfileConfig,
   resolveApiKey,
+  resolveApiTenantId,
   resolveIngestUrl,
   resolveModaBaseUrl,
   resolveSecretReference,
   resolveTenantId,
   secretFilePathFromRef,
   validateConfig
-} from "./cli-q79sq80a.js";
+} from "./cli-rp912ypf.js";
 import {
   __commonJS,
   __require,
@@ -5564,54 +5567,89 @@ import {
 import { dirname as dirname2, isAbsolute as isAbsolute3, join, relative, resolve as resolve4 } from "node:path";
 
 // src/prompts-ab.ts
-import { existsSync } from "node:fs";
+import { accessSync, constants as fsConstants, existsSync, statSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
 var DEFAULT_SEEDS_PER_CASE = 3;
+var DEFAULT_AUTO_GENERATE_CASES = 5;
+var MAX_AUTO_GENERATE_CASES = 100;
+var MAX_REPLAY_TRACES = 100;
+var PLAYOUT_CONFIRM_THRESHOLD = 200;
+var REPLAY_MODEL_ALLOWLIST = [
+  "openai/gpt-5.6-luna",
+  "openai/gpt-4o-mini",
+  "openai/gpt-4o",
+  "anthropic/claude-sonnet-4-5",
+  "anthropic/claude-haiku-4-5",
+  "google/gemini-2.5-flash",
+  "google/gemini-2.5-pro"
+];
 var DEFAULT_POLL_INTERVAL_MS = 15000;
 var DEFAULT_WAIT_TIMEOUT_MS = 2 * 60 * 60 * 1000;
 var TERMINAL_RUN_STATUSES = new Set(["completed", "skipped", "error"]);
 async function runPromptAb(flags, profileOptions, context) {
   validateConfig();
-  const tenantId = flags["tenant-id"] || resolveTenantId(profileOptions);
+  const tenantId = flags["tenant-id"] || resolveApiTenantId(profileOptions);
   if (!tenantId) {
     throw new Error("Missing tenant id. Run `moda init` or pass --tenant-id=<id>.");
   }
   const baselineSource = flags.baseline || flags["baseline-file"] || flags["baseline-key"];
   const candidateSource = flags.candidate || flags["candidate-file"] || flags["candidate-key"];
   if (!baselineSource || !candidateSource) {
-    throw new Error("Usage: moda prompts ab --baseline=<file|key> --candidate=<file|key> [--auto-generate|--set-id=ID|--traces=id1,id2] (legacy alias: --conversations=)");
+    throw new Error("Usage: moda prompts ab --baseline=<file|key> --candidate=<file|key> [--auto-generate [--cases=1-100]|--set-id=ID|--traces=id1,id2 (max 100)] [--seeds=1-10] [--model=<slug>] [--yes] (legacy alias: --conversations=)");
+  }
+  assertArmSourceShape(baselineSource, "baseline");
+  assertArmSourceShape(candidateSource, "candidate");
+  const seedsPerCase = parsePositiveInt(flags.seeds ?? flags["seeds-per-case"], DEFAULT_SEEDS_PER_CASE, 10, flags.seeds !== undefined ? "--seeds" : "--seeds-per-case");
+  parsePositiveInt(flags["lookback-days"], 30, 365, "--lookback-days");
+  const timeoutMs = parsePositiveInt(flags.timeout, DEFAULT_WAIT_TIMEOUT_MS, 24 * 60 * 60 * 1000, "--timeout");
+  const pollIntervalMs = parsePositiveInt(flags["poll-interval"], DEFAULT_POLL_INTERVAL_MS, 120000, "--poll-interval");
+  const assistantModel = assertAllowedModel(flags.model ?? flags["assistant-model"], flags, "--model");
+  const plan = await planReplaySet(flags, tenantId, profileOptions);
+  const plannedPlayouts = plan.cases === null ? null : plan.cases * seedsPerCase * 2;
+  assertPlayoutBudget(plannedPlayouts, { seedsPerCase, cases: plan.cases }, context.yes, rerunWithYes("prompts ab", [], flags));
+  if (context.outputMode === "human") {
+    process.stderr.write(`${describePlayouts(plannedPlayouts, plan.cases, seedsPerCase)}
+`);
   }
   if (flags.sync === "true") {
+    for (const [source, label] of [[baselineSource, "baseline"], [candidateSource, "candidate"]]) {
+      try {
+        resolvePromptArmSpec(source, label);
+      } catch (error) {
+        if (!(error instanceof UnresolvedPromptError))
+          throw error;
+      }
+    }
     await runPromptSync({ ...flags, watch: "false" }, profileOptions);
   }
   const promptArms = {
     prod: resolvePromptArmSpec(baselineSource, "baseline"),
     proposed: resolvePromptArmSpec(candidateSource, "candidate")
   };
-  const replaySetId = await ensureReplaySet(flags, tenantId, profileOptions);
-  const seedsPerCase = parsePositiveInt(flags.seeds ?? flags["seeds-per-case"], DEFAULT_SEEDS_PER_CASE, 10);
-  const assistantModel = (flags.model ?? flags["assistant-model"] ?? "").trim();
+  const replaySetId = await ensureReplaySet(plan, flags, tenantId, profileOptions);
   const enqueue = await callControlAPI(`/tenants/${encodeURIComponent(tenantId)}/replay-sets/${encodeURIComponent(replaySetId)}/run`, {
     method: "POST",
     body: JSON.stringify({
       promptArms,
       seedsPerCase,
       assistantModel: assistantModel || undefined,
-      promotePrimary: flags["no-promote"] !== "true"
+      promotePrimary: flags["no-promote"] !== "true",
+      ...plan.kind === "existing" ? replayCasePin(plan.caseIds) : {}
     })
-  }, profileOptions, { timeoutMs: 120000, retries: 1 });
+  }, profileOptions, { timeoutMs: 120000, retries: 0 });
+  if (context.outputMode === "human")
+    warnIfQueued(enqueue);
   const noWait = flags.wait === "false" || flags["no-wait"] === "true";
   if (noWait) {
     context.output.writeData({
       replaySetId,
       runId: enqueue.runId,
       status: enqueue.status,
-      message: enqueue.message ?? "Replay comparison queued"
+      message: enqueue.message ?? "Replay comparison queued",
+      plannedPlayouts
     });
     return;
   }
-  const timeoutMs = parsePositiveInt(flags.timeout, DEFAULT_WAIT_TIMEOUT_MS, 24 * 60 * 60 * 1000);
-  const pollIntervalMs = parsePositiveInt(flags["poll-interval"], DEFAULT_POLL_INTERVAL_MS, 120000);
   const deadline = Date.now() + timeoutMs;
   let latest = null;
   while (Date.now() < deadline) {
@@ -5622,7 +5660,7 @@ async function runPromptAb(flags, profileOptions, context) {
       break;
     }
     if (context.outputMode === "human") {
-      process.stderr.write(`Waiting for replay run (${status || "pending"})...
+      process.stderr.write(`Waiting for replay run (${waitLabel(latest.run)})...
 `);
     }
     await sleep(pollIntervalMs);
@@ -5632,6 +5670,7 @@ async function runPromptAb(flags, profileOptions, context) {
   }
   const result = {
     replaySetId,
+    plannedPlayouts,
     runId: latest.run.runId,
     status: latest.run.status,
     verdict: formatVerdict(latest),
@@ -5643,6 +5682,65 @@ async function runPromptAb(flags, profileOptions, context) {
   }
   context.output.writeData(result);
 }
+function warnIfQueued(enqueue) {
+  const { runsAhead, maxActiveRuns } = enqueue;
+  if (typeof runsAhead !== "number" || typeof maxActiveRuns !== "number")
+    return;
+  if (runsAhead < maxActiveRuns)
+    return;
+  process.stderr.write(`Note: ${runsAhead} replay runs for this tenant are already running or queued ` + `(${maxActiveRuns} at a time); run ${enqueue.runId} waits in the queue until a slot frees.
+`);
+}
+function waitLabel(run) {
+  if (!run?.status)
+    return "pending";
+  if (run.status === "accepted") {
+    return typeof run.runsAhead === "number" ? `queued, ${run.runsAhead} run${run.runsAhead === 1 ? "" : "s"} ahead` : "queued";
+  }
+  return run.status;
+}
+var FILE_ARM_RE = /[\\/]|\.(?:md|txt|json|ya?ml|jinja2?|j2|hbs|tmpl|prompt|[cm]?[jt]sx?|py)$/i;
+var PROMPT_KEY_RE = /^[^\s"'`\x00-\x1f\x7f]+$/;
+function assertArmSourceShape(source, label) {
+  const trimmed = source.trim();
+  if (!trimmed) {
+    throw new CliInputError(`Empty prompt source for ${label}, so nothing was sent.`);
+  }
+  const absPath = isAbsolute(trimmed) ? trimmed : resolve(process.cwd(), trimmed);
+  const exists = existsSync(absPath);
+  if (!exists && FILE_ARM_RE.test(trimmed)) {
+    if (isDiscoveredKey(trimmed))
+      return;
+    throw new CliInputError(`--${label} file not found: ${trimmed}, so nothing was sent.`);
+  }
+  if (exists) {
+    if (!statSync(absPath).isFile()) {
+      throw new CliInputError(`--${label} is not a file: ${trimmed}, so nothing was sent.`);
+    }
+    try {
+      accessSync(absPath, fsConstants.R_OK);
+    } catch {
+      throw new CliInputError(`--${label} file is not readable: ${trimmed}, so nothing was sent.`);
+    }
+    if (/\.(?:[cm]?[jt]sx?|py)$/i.test(absPath)) {
+      throw new CliInputError(`--${label}=${trimmed} is a source module; source modules cannot be replayed as instructions, so nothing was sent.`, "Use the registered prompt key for this code source.");
+    }
+    return;
+  }
+  if (!PROMPT_KEY_RE.test(trimmed)) {
+    throw new CliInputError(`--${label}=${JSON.stringify(trimmed)} is neither an existing prompt file nor a valid prompt key, so nothing was sent.`, "Pass a .prompt.md path or a prompt key (no spaces or quotes).");
+  }
+}
+function isDiscoveredKey(key) {
+  try {
+    return discoverPrompts().some((prompt) => prompt.key === key);
+  } catch {
+    return false;
+  }
+}
+
+class UnresolvedPromptError extends Error {
+}
 function resolvePromptArmSpec(source, label, opts = {}) {
   const trimmed = source.trim();
   if (!trimmed) {
@@ -5676,7 +5774,7 @@ function resolvePromptArmSpec(source, label, opts = {}) {
   } else {
     const match = fromDiscovery();
     if (!match) {
-      throw new Error(`Could not resolve prompt '${trimmed}' — pass a .prompt.md path or a discovered prompt key`);
+      throw new UnresolvedPromptError(`Could not resolve prompt '${trimmed}' — pass a .prompt.md path or a discovered prompt key`);
     }
     key = match.key;
     content = match.content;
@@ -5689,20 +5787,86 @@ function resolvePromptArmSpec(source, label, opts = {}) {
     prompt_label: label
   };
 }
-async function ensureReplaySet(flags, tenantId, profileOptions) {
+async function planReplaySet(flags, tenantId, profileOptions) {
   const existingSetId = (flags["set-id"] || flags["replay-set-id"] || "").trim();
   if (existingSetId) {
-    return existingSetId;
+    const snapshot = await fetchReplaySetCases(tenantId, existingSetId, profileOptions);
+    return { kind: "existing", setId: existingSetId, cases: snapshot?.ids.length ?? null, caseIds: snapshot?.ids };
   }
   const conversations = parseCsv(flags.traces ?? flags.conversations ?? flags["conversation-ids"]);
+  if (conversations.length > MAX_REPLAY_TRACES) {
+    throw new CliInputError(`--traces has ${conversations.length} ids; the limit is ${MAX_REPLAY_TRACES} per replay set, so nothing was sent.`, "Split the traces across several runs, or use --auto-generate.");
+  }
   if (conversations.length) {
-    return createSetFromConversations(conversations, flags, tenantId, profileOptions);
+    return { kind: "traces", traces: conversations, cases: conversations.length };
   }
-  if (flags["auto-generate"] === "false" && !existingSetId) {
+  if (flags["auto-generate"] === "false") {
     throw new Error("Provide --set-id=, --traces= (legacy alias: --conversations=), or allow --auto-generate (default)");
   }
-  const caseCount = parsePositiveInt(flags.cases ?? flags["case-count"], 5, 500);
-  const lookbackDays = parsePositiveInt(flags["lookback-days"], 30, 365);
+  return {
+    kind: "auto-generate",
+    cases: parseCappedInt(flags.cases ?? flags["case-count"], DEFAULT_AUTO_GENERATE_CASES, MAX_AUTO_GENERATE_CASES, "--cases")
+  };
+}
+async function fetchReplaySetCases(tenantId, setId, profileOptions) {
+  try {
+    const set = await callControlAPI(`/tenants/${encodeURIComponent(tenantId)}/replay-sets/${encodeURIComponent(setId)}`, { method: "GET" }, profileOptions);
+    if (!Array.isArray(set?.cases))
+      return null;
+    return {
+      ids: set.cases.filter((c) => String(c?.scenario ?? "").trim()).map((c, index) => String(c?.id ?? `case_${index}`))
+    };
+  } catch (error) {
+    if (error?.statusCode === 404) {
+      throw new CliInputError(`Replay set '${setId}' not found for tenant ${tenantId}, so nothing was sent.`, "Check --set-id (list sets in the dashboard, or omit it to auto-generate).");
+    }
+    return null;
+  }
+}
+function replayCasePin(caseIds) {
+  if (!caseIds)
+    return {};
+  return caseIds.length <= REPLAY_CASE_IDS_PIN_MAX ? { caseIds, expectedCases: caseIds.length } : { expectedCases: caseIds.length };
+}
+var REPLAY_CASE_IDS_PIN_MAX = 500;
+function describePlayouts(planned, cases, seeds) {
+  return planned === null ? `Planned replay playouts: unknown (case count unavailable) × ${seeds} seeds × 2 arms` : `Planned replay playouts: ${planned} (${cases} cases × ${seeds} seeds × 2 arms)`;
+}
+function assertPlayoutBudget(planned, shape, yes, rerun) {
+  if (yes)
+    return;
+  if (planned !== null && planned <= PLAYOUT_CONFIRM_THRESHOLD)
+    return;
+  const what = planned === null ? "an unknown number of replay playouts (the replay set's case count could not be read)" : `${planned} replay playouts (${shape.cases} cases × ${shape.seedsPerCase} seeds × 2 arms)`;
+  throw new CliInputError(`This would run ${what}, above the ${PLAYOUT_CONFIRM_THRESHOLD}-playout limit that needs confirmation. Nothing was sent.`, `Re-run with --yes to confirm: ${rerun}`);
+}
+function assertAllowedModel(raw, flags, flagName) {
+  const model = (raw ?? "").trim();
+  if (!model || flags["allow-any-model"] === "true")
+    return model;
+  if (REPLAY_MODEL_ALLOWLIST.includes(model))
+    return model;
+  throw new CliInputError(`${flagName}=${model} is not in the replay model allowlist, so nothing was sent.`, `Allowed: ${REPLAY_MODEL_ALLOWLIST.join(", ")}. Pass --allow-any-model to use another OpenRouter slug.`);
+}
+function rerunWithYes(command, positionals, flags) {
+  const quote = (v) => /^[\w@%+=:,./-]+$/.test(v) ? v : `'${v.replace(/'/g, `'\\''`)}'`;
+  const parts = ["moda", ...command.split(" "), ...positionals.map(quote)];
+  for (const [key, value] of Object.entries(flags)) {
+    if (key === "yes")
+      continue;
+    parts.push(value === "true" ? `--${key}` : `--${key}=${quote(value)}`);
+  }
+  parts.push("--yes");
+  return parts.join(" ");
+}
+async function ensureReplaySet(plan, flags, tenantId, profileOptions) {
+  if (plan.kind === "existing")
+    return plan.setId;
+  if (plan.kind === "traces") {
+    return createSetFromConversations(plan.traces, flags, tenantId, profileOptions);
+  }
+  const caseCount = plan.cases;
+  const lookbackDays = parsePositiveInt(flags["lookback-days"], 30, 365, "--lookback-days");
   const name = (flags.name ?? flags["set-name"] ?? `Prompt A/B ${new Date().toISOString().slice(0, 10)}`).trim();
   const generated = await callControlAPI(`/tenants/${encodeURIComponent(tenantId)}/replay-sets/auto-generate`, {
     method: "POST",
@@ -5826,9 +5990,12 @@ async function enqueueAndPollComparison(args, profileOptions) {
       promptArms: args.promptArms,
       seedsPerCase: args.seedsPerCase ?? DEFAULT_SEEDS_PER_CASE,
       assistantModel: args.assistantModel || undefined,
-      promotePrimary: args.promotePrimary ?? false
+      promotePrimary: args.promotePrimary ?? false,
+      ...replayCasePin(args.caseIds)
     })
-  }, profileOptions, { timeoutMs: 120000, retries: 1 });
+  }, profileOptions, { timeoutMs: 120000, retries: 0 });
+  if (args.onWaiting)
+    warnIfQueued(enqueue);
   const timeoutMs = args.timeoutMs ?? DEFAULT_WAIT_TIMEOUT_MS;
   const pollIntervalMs = args.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
   const deadline = Date.now() + timeoutMs;
@@ -5840,7 +6007,7 @@ async function enqueueAndPollComparison(args, profileOptions) {
     if (TERMINAL_RUN_STATUSES.has(status) && runId === enqueue.runId) {
       return latest;
     }
-    args.onWaiting?.(status || "pending");
+    args.onWaiting?.(waitLabel(latest.run));
     await sleep(pollIntervalMs);
   }
   if (!latest?.run || latest.run.runId !== enqueue.runId || !TERMINAL_RUN_STATUSES.has(latest.run.status)) {
@@ -5848,13 +6015,21 @@ async function enqueueAndPollComparison(args, profileOptions) {
   }
   return latest;
 }
-function parsePositiveInt(raw, fallback, max) {
-  if (!raw)
-    return fallback;
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isFinite(parsed) || parsed < 1)
+function parsePositiveInt(raw, fallback, max, flagName) {
+  if (raw === undefined)
     return fallback;
-  return Math.min(parsed, max);
+  const text = String(raw).trim();
+  const parsed = Number(text);
+  if (!/^\d+$/.test(text) || !Number.isSafeInteger(parsed) || parsed < 1) {
+    throw new CliInputError(`${flagName}=${raw} must be a whole number of at least 1, so nothing was sent.`, `Use ${flagName}=N with 1 <= N <= ${max}.`);
+  }
+  if (parsed > max) {
+    throw new CliInputError(`${flagName}=${parsed} is above the maximum of ${max}, so nothing was sent.`, `Use ${flagName}=${max} or less.`);
+  }
+  return parsed;
+}
+function parseCappedInt(raw, fallback, max, flagName) {
+  return parsePositiveInt(raw, fallback, max, flagName);
 }
 function parseCsv(raw) {
   if (!raw?.trim())
@@ -5875,10 +6050,31 @@ async function runPromptPropose(positionals, flags, profileOptions, context) {
   const fromRunId = flags["from-run"] || flags["from-run-id"] || flags["run-id"];
   const replaySetId = flags["set-id"] || flags["replay-set-id"];
   if (!promptKey || !fromRunId || !replaySetId) {
-    throw new Error("Usage: moda prompts propose --prompt-key=<key> --from-run=<run_id> --set-id=<replay_set_id> [--max-dossiers=8] [--model=<slug>] [--out=path.prompt.md] [--gate] [--promote-on-win]");
+    throw new Error("Usage: moda prompts propose --prompt-key=<key> --from-run=<run_id> --set-id=<replay_set_id> [--max-dossiers=8] [--model=<slug>] [--out=path.prompt.md] [--gate [--seeds=1-10] [--assistant-model=<slug>] [--yes]] [--promote-on-win] [--allow-any-model]");
+  }
+  const maxDossiers = parsePositiveInt2(flags["max-dossiers"], 8, 16, "--max-dossiers");
+  parsePositiveInt2(flags["gate-timeout"] ?? flags.timeout, 2 * 60 * 60 * 1000, 24 * 60 * 60 * 1000, flags["gate-timeout"] !== undefined ? "--gate-timeout" : "--timeout");
+  parsePositiveInt2(flags["poll-interval"], 15000, 120000, "--poll-interval");
+  const model = assertAllowedModel(flags.model ?? flags["revise-model"], flags, "--model");
+  const wantGate = flags.gate === "true";
+  let gatePlan;
+  if (wantGate) {
+    const tenantId = flags["tenant-id"] || resolveApiTenantId(profileOptions);
+    if (!tenantId) {
+      throw new Error("Missing tenant id for --gate. Run `moda init` or pass --tenant-id=<id>.");
+    }
+    const seedsPerCase = parsePositiveInt2(flags.seeds ?? flags["seeds-per-case"], 3, 10, flags.seeds !== undefined ? "--seeds" : "--seeds-per-case");
+    const assistantModel = assertAllowedModel(flags["assistant-model"], flags, "--assistant-model");
+    const snapshot = await fetchGateSetCases(tenantId, replaySetId, profileOptions);
+    const cases = snapshot?.ids.length ?? null;
+    const plannedPlayouts = cases === null ? null : cases * seedsPerCase * 2;
+    assertPlayoutBudget(plannedPlayouts, { seedsPerCase, cases }, context.yes, rerunWithYes("prompts propose", positionals.slice(1), flags));
+    if (context.outputMode === "human") {
+      process.stderr.write(`Gate: ${describePlayouts(plannedPlayouts, cases, seedsPerCase)}
+`);
+    }
+    gatePlan = { tenantId, seedsPerCase, assistantModel, plannedPlayouts, cases, caseIds: snapshot?.ids };
   }
-  const maxDossiers = parsePositiveInt2(flags["max-dossiers"], 8, 16);
-  const model = (flags.model ?? flags["revise-model"] ?? "").trim();
   const result = await callControlAPI(`/prompts/${encodeURIComponent(promptKey)}/propose`, {
     method: "POST",
     body: JSON.stringify({ fromRunId, replaySetId, maxDossiers, model: model || undefined })
@@ -5888,10 +6084,9 @@ async function runPromptPropose(positionals, flags, profileOptions, context) {
     outPath = isAbsolute2(flags.out) ? flags.out : resolve2(process.cwd(), flags.out);
     writeFileSync(outPath, result.content, "utf8");
   }
-  const wantGate = flags.gate === "true";
   const promoteOnWin = flags["promote-on-win"] === "true";
   let gate;
-  if (wantGate) {
+  if (gatePlan) {
     if (result.status !== "proposed" || !result.content) {
       gate = {
         ran: false,
@@ -5900,7 +6095,8 @@ async function runPromptPropose(positionals, flags, profileOptions, context) {
         verdict: "skipped",
         outcome: "no-run",
         runId: null,
-        promoted: false
+        promoted: false,
+        plannedPlayouts: gatePlan.plannedPlayouts
       };
     } else {
       gate = await runGate({
@@ -5908,6 +6104,7 @@ async function runPromptPropose(positionals, flags, profileOptions, context) {
         promptKey,
         replaySetId,
         flags,
+        plan: gatePlan,
         promoteOnWin,
         profileOptions,
         context
@@ -5923,12 +6120,25 @@ async function runPromptPropose(positionals, flags, profileOptions, context) {
     ...gate ? { gate } : {}
   });
 }
-async function runGate(args) {
-  const { result, promptKey, replaySetId, flags, promoteOnWin, profileOptions, context } = args;
-  const tenantId = flags["tenant-id"] || resolveTenantId(profileOptions);
-  if (!tenantId) {
-    throw new Error("Missing tenant id for --gate. Run `moda init` or pass --tenant-id=<id>.");
+async function fetchGateSetCases(tenantId, replaySetId, profileOptions) {
+  let set;
+  try {
+    set = await callControlAPI(`/tenants/${encodeURIComponent(tenantId)}/replay-sets/${encodeURIComponent(replaySetId)}`, { method: "GET" }, profileOptions);
+  } catch (error) {
+    if (error?.statusCode === 404) {
+      throw new CliInputError(`Replay set '${replaySetId}' not found for tenant ${tenantId}, so nothing was sent.`, "Check --set-id: use the replay set the --from-run run was scored on (see `moda prompts replay-runs <key>`).");
+    }
+    return null;
   }
+  if (!Array.isArray(set?.cases))
+    return null;
+  return {
+    ids: set.cases.filter((c) => String(c?.scenario ?? "").trim()).map((c, index) => String(c?.id ?? `case_${index}`))
+  };
+}
+async function runGate(args) {
+  const { result, promptKey, replaySetId, flags, plan, promoteOnWin, profileOptions, context } = args;
+  const { tenantId, seedsPerCase, assistantModel } = plan;
   const prodArm = resolvePromptArmSpec(promptKey, "baseline", { preferKey: true });
   const proposedArm = {
     content: result.content ?? "",
@@ -5936,10 +6146,8 @@ async function runGate(args) {
     prompt_id: "",
     prompt_label: "candidate"
   };
-  const seedsPerCase = parsePositiveInt2(flags.seeds ?? flags["seeds-per-case"], 3, 10);
-  const assistantModel = (flags["assistant-model"] ?? "").trim();
-  const timeoutMs = parsePositiveInt2(flags["gate-timeout"] ?? flags.timeout, 2 * 60 * 60 * 1000, 24 * 60 * 60 * 1000);
-  const pollIntervalMs = parsePositiveInt2(flags["poll-interval"], 15000, 120000);
+  const timeoutMs = parsePositiveInt2(flags["gate-timeout"] ?? flags.timeout, 2 * 60 * 60 * 1000, 24 * 60 * 60 * 1000, flags["gate-timeout"] !== undefined ? "--gate-timeout" : "--timeout");
+  const pollIntervalMs = parsePositiveInt2(flags["poll-interval"], 15000, 120000, "--poll-interval");
   const scopeNote = result.holdoutCaseIds.length ? `gated over the FULL replay set (${result.holdoutCaseIds.length} holdout case(s) could not be isolated — the run endpoint scores every case)` : "gated over the FULL replay set";
   if (context.outputMode === "human") {
     process.stderr.write(`
@@ -5953,6 +6161,7 @@ Gating candidate for '${promptKey}' — ${scopeNote}...
     seedsPerCase,
     assistantModel: assistantModel || undefined,
     promotePrimary: false,
+    caseIds: plan.caseIds,
     timeoutMs,
     pollIntervalMs,
     onWaiting: context.outputMode === "human" ? (status) => process.stderr.write(`Waiting for gate run (${status})...
@@ -5966,7 +6175,8 @@ Gating candidate for '${promptKey}' — ${scopeNote}...
     verdict: formatVerdict(payload),
     outcome,
     runId: payload.run?.runId ?? null,
-    promoted: false
+    promoted: false,
+    plannedPlayouts: plan.plannedPlayouts
   };
   if (promoteOnWin) {
     if (outcome === "candidate" && result.versionId) {
@@ -6005,6 +6215,8 @@ function printHuman(result, outPath, gate) {
     w("Gate (automatic A/B of candidate vs baseline):");
     w(`  scope:    ${gate.scopeNote}`);
     w(`  verdict:  ${gate.verdict}`);
+    if (gate.plannedPlayouts !== undefined)
+      w(`  playouts: ${gate.plannedPlayouts ?? "unknown"} planned`);
     if (gate.runId)
       w(`  run id:   ${gate.runId}`);
     if (gate.promoted) {
@@ -6037,11 +6249,18 @@ function printHuman(result, outPath, gate) {
   w(`  # or: moda prompts propose ... --gate --promote-on-win  (auto-A/B, promote on a strict win)`);
   w(`  moda prompts promote ${result.promptKey} --label=prod --version=${result.versionId}`);
 }
-function parsePositiveInt2(raw, fallback, max) {
-  const n = Number.parseInt(raw ?? "", 10);
-  if (!Number.isFinite(n) || n <= 0)
+function parsePositiveInt2(raw, fallback, max, flagName) {
+  if (raw === undefined)
     return fallback;
-  return Math.min(n, max);
+  const text = String(raw).trim();
+  const parsed = Number(text);
+  if (!/^\d+$/.test(text) || !Number.isSafeInteger(parsed) || parsed < 1) {
+    throw new CliInputError(`${flagName}=${raw} must be a whole number of at least 1, so nothing was sent.`, `Use ${flagName}=N with 1 <= N <= ${max}.`);
+  }
+  if (parsed > max) {
+    throw new CliInputError(`${flagName}=${parsed} is above the maximum of ${max}, so nothing was sent.`, `Use ${flagName}=${max} or less.`);
+  }
+  return parsed;
 }
 
 // src/prompt-attribution.ts
@@ -6179,6 +6398,77 @@ var DEFAULT_PROMPT_PATHS = [
   "prompts/**/*.prompt.yaml",
   "prompts/**/*.prompt.yml"
 ];
+var PROMPT_WRITE_SUBCOMMAND_FLAGS = {
+  init: ["from-harness"],
+  status: [],
+  diff: [],
+  sync: [
+    "dry-run",
+    "from-harness",
+    "no-analyze",
+    "allow-untrack",
+    "watch",
+    "interval",
+    "analyst",
+    "assist",
+    "analyst-command",
+    "analyst-model"
+  ],
+  promote: ["label", "version", "version-id"],
+  ab: [
+    "baseline",
+    "candidate",
+    "cases",
+    "conversations",
+    "model",
+    "name",
+    "seeds",
+    "sync",
+    "timeout",
+    "traces",
+    "wait",
+    "assistant-model",
+    "auto-generate",
+    "baseline-file",
+    "baseline-key",
+    "candidate-file",
+    "candidate-key",
+    "case-count",
+    "conversation-ids",
+    "lookback-days",
+    "no-promote",
+    "no-wait",
+    "poll-interval",
+    "replay-set-id",
+    "seeds-per-case",
+    "set-id",
+    "set-name",
+    "tenant-id",
+    "allow-any-model"
+  ],
+  propose: [
+    "gate",
+    "model",
+    "out",
+    "seeds",
+    "timeout",
+    "assistant-model",
+    "from-run",
+    "from-run-id",
+    "gate-timeout",
+    "max-dossiers",
+    "poll-interval",
+    "promote-on-win",
+    "prompt-key",
+    "replay-set-id",
+    "revise-model",
+    "run-id",
+    "seeds-per-case",
+    "set-id",
+    "tenant-id",
+    "allow-any-model"
+  ]
+};
 async function runPromptsCommand(input, legacyFlags, legacyProfileOptions) {
   const context = Array.isArray(input) ? createCommandContext({
     command: "prompts",
@@ -6194,6 +6484,9 @@ async function runPromptsCommand(input, legacyFlags, legacyProfileOptions) {
   const flags = context.flags;
   const profileOptions = legacyProfileOptions ?? { profile: context.profile, env: context.env };
   const subcommand = positionals[0] || "status";
+  const writeFlags = PROMPT_WRITE_SUBCOMMAND_FLAGS[subcommand];
+  if (writeFlags)
+    assertFlags(`prompts ${subcommand}`, flags, writeFlags);
   switch (subcommand) {
     case "init": {
       const imported = flags["from-harness"] ? importHarnessPromptSources(flags["from-harness"]) : undefined;
@@ -6219,9 +6512,27 @@ async function runPromptsCommand(input, legacyFlags, legacyProfileOptions) {
     case "status":
       context.output.writeData(await getPromptStatus());
       break;
-    case "diff":
-      context.output.writeData(await getPromptStatus());
+    case "diff": {
+      const status = await getPromptStatus();
+      const differing = status.prompts.filter((row) => row.state !== "unchanged");
+      const tracked = existsSync2(MANIFEST_PATH);
+      const untrackedWarning = tracked ? [] : [
+        `No ${MANIFEST_PATH} here, so diff has no last sync to compare against: it only covers prompts tracked by \`moda prompts sync\`${differing.length > 0 ? ", and every discovered prompt file lists as new" : ""}. For a registry manifest, preview with \`moda registry push --dry-run\`.`
+      ];
+      context.output.writeData({
+        ...status,
+        unchanged: status.total - differing.length,
+        prompts: differing,
+        ...tracked ? {} : { tracked: false }
+      }, {
+        summary: {
+          text: !tracked ? differing.length === 0 ? `Not a prompts-sync project (no ${MANIFEST_PATH}) and no prompt files found; diff has nothing to compare.` : `Not a prompts-sync project (no ${MANIFEST_PATH}): ${differing.length} discovered prompt file(s) are untracked and would be new on \`moda prompts sync\`.` : differing.length === 0 ? "No prompt differs from the last sync." : `${differing.length} prompt(s) differ from the last sync (changed ${status.changed}, new ${status.new}, deleted ${status.deleted}).`,
+          confidence: "high"
+        },
+        ...untrackedWarning.length > 0 ? { warnings: untrackedWarning } : {}
+      });
       break;
+    }
     case "sync":
       await syncPrompts(flags, profileOptions, context);
       break;
@@ -6234,8 +6545,16 @@ async function runPromptsCommand(input, legacyFlags, legacyProfileOptions) {
     case "propose":
       await runPromptPropose(positionals, flags, profileOptions, context);
       break;
+    case "list":
+    case "show":
+    case "proposals":
+    case "usage":
+    case "replay-runs":
+    case "decide":
+      await runPromptRegistryRead(subcommand, positionals, flags, profileOptions, context);
+      break;
     default:
-      throw new Error(`Unknown prompts command '${subcommand}'. Use init, status, diff, sync, promote, ab, or propose.`);
+      throw new Error(`Unknown prompts command '${subcommand}'. Use init, status, diff, sync, promote, ab, propose, list, show, proposals, usage, replay-runs, or decide.`);
   }
 }
 async function initPrompts(options = {}) {
@@ -6320,7 +6639,7 @@ async function runPromptSyncExclusive(flags, profileOptions, options) {
   const analyzedDefinitions = new Map;
   if (flags["no-analyze"] !== "true") {
     options.onProgress?.("Analyzing prompt sources before sync.");
-    const { analyzeHarnessPrompts } = await import("./harness-n2xgzz31.js");
+    const { analyzeHarnessPrompts } = await import("./harness-191xt7bq.js");
     const result = await analyzeHarnessPrompts({
       rootDir: process.cwd(),
       existing: established.flatMap((prompt) => prompt.sourceDefinition ? [prompt.sourceDefinition.source] : []),
@@ -6800,6 +7119,80 @@ function sha256(input) {
 function printJson(value) {
   console.log(JSON.stringify(value, null, 2));
 }
+var PROMPT_LABELS = ["prod", "staging", "dev"];
+async function runPromptRegistryRead(subcommand, positionals, flags, profileOptions, context) {
+  const allowed = {
+    list: ["label", "search"],
+    show: [],
+    proposals: [],
+    usage: [],
+    "replay-runs": [],
+    decide: ["action", "dry-run"]
+  };
+  assertFlags(`prompts ${subcommand}`, flags, allowed[subcommand] ?? []);
+  const maxPositionals = subcommand === "list" ? 1 : subcommand === "decide" ? 3 : 2;
+  assertPositionals(`prompts ${subcommand}`, positionals, maxPositionals, `moda prompts ${subcommand}${subcommand === "list" ? "" : " <key>"}${subcommand === "decide" ? " <proposal_id> --action=merge|reject|reopen" : ""}`);
+  const keyOrId = positionals[1];
+  const needKey = (usage) => {
+    if (!keyOrId)
+      throw new CliInputError("<prompt key or id> is required.", `Usage: ${usage}`);
+    return encodeURIComponent(keyOrId);
+  };
+  switch (subcommand) {
+    case "list": {
+      const label = flags.label;
+      if (label && label !== "unlabeled" && !PROMPT_LABELS.includes(label)) {
+        throw new CliInputError(`--label must be one of ${PROMPT_LABELS.join(", ")}, or unlabeled.`);
+      }
+      const response = asRecordValue(await callControlAPI("/prompts", {}, profileOptions));
+      const all = Array.isArray(response.prompts) ? response.prompts.map(asRecordValue) : [];
+      const search = flags.search?.toLowerCase();
+      const prompts = all.filter((prompt) => {
+        if (search && !`${prompt.key ?? ""} ${prompt.name ?? ""} ${prompt.description ?? ""}`.toLowerCase().includes(search))
+          return false;
+        if (!label)
+          return true;
+        const labelField = (name) => name === "dev" ? prompt.currentVersion ?? prompt.current_version : prompt[`${name}Version`] ?? prompt[`${name}_version`];
+        const labels = PROMPT_LABELS.filter((name) => labelField(name));
+        return label === "unlabeled" ? labels.length === 0 : labels.includes(label);
+      });
+      context.output.writeData({ prompts, total: prompts.length, ...label || search ? { filtered_from: all.length } : {} });
+      return;
+    }
+    case "show":
+      context.output.writeData(await callControlAPI(`/prompts/${needKey("moda prompts show <key>")}`, {}, profileOptions));
+      return;
+    case "proposals":
+      context.output.writeData(await callControlAPI(`/prompts/${needKey("moda prompts proposals <key>")}/proposals`, {}, profileOptions));
+      return;
+    case "usage":
+      context.output.writeData(await callControlAPI(`/prompts/${needKey("moda prompts usage <key>")}/usage`, {}, profileOptions));
+      return;
+    case "replay-runs":
+      context.output.writeData(await callControlAPI(`/prompts/${needKey("moda prompts replay-runs <key>")}/replay-runs`, {}, profileOptions));
+      return;
+    case "decide": {
+      const usage = "moda prompts decide <key> <proposal_id> --action=merge|reject|reopen";
+      const id = needKey(usage);
+      const proposalId = positionals[2];
+      const action = flags.action;
+      if (!proposalId)
+        throw new CliInputError("<proposal_id> is required.", `Usage: ${usage}`);
+      if (!action || !["merge", "reject", "reopen"].includes(action)) {
+        throw new CliInputError("--action must be merge, reject, or reopen.", `Usage: ${usage}`);
+      }
+      if (context.dryRun) {
+        context.output.writeData({ dryRun: true, planned: { method: "PATCH", endpoint: `/api/prompts/${id}/proposals/${encodeURIComponent(proposalId)}`, body: { action } } });
+        return;
+      }
+      context.output.writeData(await callControlAPI(`/prompts/${id}/proposals/${encodeURIComponent(proposalId)}`, { method: "PATCH", body: JSON.stringify({ action }) }, profileOptions, { retries: 0 }));
+      return;
+    }
+  }
+}
+function asRecordValue(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
 
 // src/skills.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
@@ -7339,6 +7732,38 @@ function escapeYamlString(value) {
 function formatProposalRate(value) {
   return `${(Number(value || 0) * 100).toFixed(1)}%`;
 }
+var SKILLS_SUBCOMMAND_FLAGS = {
+  gen: [
+    "replay",
+    "source",
+    "wait",
+    "clustering-poll-seconds",
+    "clustering-run-id",
+    "clustering-timeout-seconds",
+    "end-at",
+    "eval-set-id",
+    "force-reprocess",
+    "harness-url",
+    "improve-candidates",
+    "improvement-rounds",
+    "lookback-hours",
+    "max-cluster-pct",
+    "max-sessions",
+    "max-traces",
+    "no-clustering",
+    "no-replay",
+    "replay-set-id",
+    "reprocess-segments",
+    "start-at",
+    "tenant-id",
+    "wait-for-completion"
+  ],
+  status: ["run-id"],
+  pull: ["status"],
+  proposals: ["status", "generation-run-id", "tenant-id"],
+  proposal: ["proposal-id", "tenant-id"],
+  install: ["list"]
+};
 async function runSkillsCommand(input) {
   const context = "output" in input ? input : createCommandContext({
     command: input.command,
@@ -7351,6 +7776,8 @@ async function runSkillsCommand(input) {
   const sub = context.positional;
   const positionals = context.positionals ?? (sub ? [sub] : []);
   const flags = context.flags;
+  if (sub && SKILLS_SUBCOMMAND_FLAGS[sub])
+    assertFlags(`skills ${sub}`, flags, SKILLS_SUBCOMMAND_FLAGS[sub]);
   if (sub === "gen") {
     const result = await generateSkills(flags);
     if (context.outputMode !== "human") {
@@ -7433,7 +7860,11 @@ async function runSkillsCommand(input) {
     }
     return 0;
   }
+  if (sub === "list" || sub === "show" || sub === "policy") {
+    return runSkillRegistryCommand(sub, positionals, flags, context);
+  }
   if (sub === "sync") {
+    assertFlags("skills sync", flags, ["dry-run"]);
     const result = await runSkillSync(flags, { profile: context.profile, env: context.env });
     context.output.writeData({
       synced: result.synced,
@@ -7446,7 +7877,7 @@ async function runSkillsCommand(input) {
     return runSkillsInstall(context, positionals.slice(1));
   }
   if (sub !== "pull") {
-    throw new CliInputError(sub ? `Unknown skills subcommand '${sub}'` : "A skills subcommand is required", "Usage: moda skills gen [--source=all|sdk] [--max-sessions=N] [--start-at=ISO] [--end-at=ISO] [--replay] [--replay-set-id=ID] [--reprocess-segments] [--force-reprocess] [--wait] | moda skills status [run-id] | moda skills proposals list [--status=ready_for_pr] | moda skills proposal apply <proposal-id> | moda skills pull [--status=approved|proposed|all] | moda skills sync [--dry-run] | moda skills install [--list] <id...>");
+    throw new CliInputError(sub ? `Unknown skills subcommand '${sub}'` : "A skills subcommand is required", "Usage: moda skills gen [--source=all|sdk] [--max-sessions=N (default 200)] [--lookback-hours=N (default 720)] [--max-traces=N] [--improvement-rounds=1-3] [--start-at=ISO] [--end-at=ISO] [--replay] [--replay-set-id=ID] [--reprocess-segments] [--force-reprocess] [--wait] | moda skills status [run-id] | moda skills proposals list [--status=ready_for_pr] | moda skills proposal apply <proposal-id> | moda skills pull [--status=approved|proposed|all] | moda skills sync [--dry-run] | moda skills install [--list] <id...>");
   }
   const status = (flags.status ?? "approved").toLowerCase();
   if (!VALID_STATUSES.has(status)) {
@@ -7487,8 +7918,8 @@ async function generateSkills(flags) {
   }
   const body = compactObject({
     tenant_id: tenantId || undefined,
-    max_sessions: parsePositiveInt3(flags["max-sessions"], 0),
-    lookback_hours: parsePositiveInt3(flags["lookback-hours"], 0),
+    max_sessions: parseScopeInt(flags["max-sessions"], "max-sessions"),
+    lookback_hours: parseScopeInt(flags["lookback-hours"], "lookback-hours"),
     start_at: flags["start-at"] || undefined,
     end_at: flags["end-at"] || undefined,
     clustering_run_id: flags["clustering-run-id"] || undefined,
@@ -7500,9 +7931,9 @@ async function generateSkills(flags) {
     max_cluster_pct: parseOptionalFloat(flags["max-cluster-pct"]),
     reprocess_segments: flags["reprocess-segments"] === "true" || forceReprocess,
     run_replay: flags.replay === "true" && flags["no-replay"] !== "true",
-    max_traces: parsePositiveInt3(flags["max-traces"], 0),
+    max_traces: parseScopeInt(flags["max-traces"], "max-traces"),
     improve_candidates: flags["improve-candidates"] === "true",
-    improvement_rounds: parsePositiveInt3(flags["improvement-rounds"], 2),
+    improvement_rounds: parseScopeInt(flags["improvement-rounds"], "improvement-rounds", MAX_IMPROVEMENT_ROUNDS) ?? 2,
     force_reprocess: forceReprocess,
     wait_for_completion: waitForCompletion
   });
@@ -7523,6 +7954,19 @@ async function generateSkills(flags) {
   }
   return await response.json();
 }
+var MAX_IMPROVEMENT_ROUNDS = 3;
+function parseScopeInt(value, flag, max) {
+  if (value === undefined)
+    return;
+  const parsed = /^\d+$/.test(value.trim()) ? Number.parseInt(value, 10) : Number.NaN;
+  if (!Number.isFinite(parsed) || parsed < 1) {
+    throw new CliInputError(`--${flag}=${value} is not a positive integer, so nothing was sent.`, `0 would mean unlimited server-side; omit --${flag} for the server default, or pass a number of 1 or more.`);
+  }
+  if (max !== undefined && parsed > max) {
+    throw new CliInputError(`--${flag}=${value} is above the maximum of ${max}, so nothing was sent.`);
+  }
+  return parsed;
+}
 function parsePositiveInt3(value, fallback) {
   if (!value)
     return fallback;
@@ -7617,10 +8061,43 @@ async function runSkillsInstall(context, ids) {
   }
   return 0;
 }
+var RESERVED_SKILL_PATHS = new Set(["inbox", "library", "observed", "runs", "sync", "surface", "families", "proposals"]);
+async function runSkillRegistryCommand(sub, positionals, flags, context) {
+  const profileOptions = { profile: context.profile, env: context.env };
+  assertFlags(`skills ${sub}`, flags, sub === "policy" ? ["live", "local", "dry-run"] : []);
+  assertPositionals(`skills ${sub}`, positionals, sub === "list" ? 1 : 2, sub === "list" ? "moda skills list" : `moda skills ${sub} <key>${sub === "policy" ? " --live|--local" : ""}`);
+  if (sub === "list") {
+    context.output.writeData(await callControlAPI("/skills", {}, profileOptions));
+    return 0;
+  }
+  const idOrKey = positionals[1];
+  if (!idOrKey) {
+    throw new CliInputError(`A skill key or id is required for skills ${sub}.`, sub === "show" ? "Usage: moda skills show <key>" : "Usage: moda skills policy <key> --live|--local");
+  }
+  if (RESERVED_SKILL_PATHS.has(idOrKey)) {
+    throw new CliInputError(`'${idOrKey}' is a reserved path, so this skill must be addressed by its id.`, "Find the id (skill_…) with `moda skills list`, then pass that instead of the key.");
+  }
+  if (sub === "show") {
+    context.output.writeData(await callControlAPI(`/skills/${encodeURIComponent(idOrKey)}`, {}, profileOptions));
+    return 0;
+  }
+  const live = flags.live === "true";
+  const local = flags.local === "true";
+  if (live === local) {
+    throw new CliInputError("Pass exactly one of --live or --local.", "Usage: moda skills policy <key> --live|--local");
+  }
+  const surfacePolicy = live ? "include" : "local_only";
+  if (context.dryRun) {
+    context.output.writeData({ dryRun: true, planned: { method: "PATCH", endpoint: `/api/skills/${encodeURIComponent(idOrKey)}/surface-policy`, body: { surfacePolicy } } });
+    return 0;
+  }
+  context.output.writeData(await callControlAPI(`/skills/${encodeURIComponent(idOrKey)}/surface-policy`, { method: "PATCH", body: JSON.stringify({ surfacePolicy }) }, profileOptions, { retries: 0 }));
+  return 0;
+}
 
 // src/doctor.ts
 import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync5, readFileSync as readFileSync4, statSync } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync4, statSync as statSync2 } from "node:fs";
 import { join as join4 } from "node:path";
 async function runDoctorCommand(context) {
   const report = await buildDoctorReport(context, {