@moda-ai/cli 1.44.1 → 1.45.1

package/dist/{harness-sqngqjrd.js → harness-9qpbj2qj.js}

@@ -42,8 +42,8 @@ import {
   writeHarnessAnalyzeResult,
   writeHarnessArtifacts,
   writeHumanProgress
-} from "./cli-5tsqk3jt.js";
-import"./cli-8c60k2p4.js";
+} from "./cli-3xh2w7hb.js";
+import"./cli-bvnw7585.js";
 import"./cli-0v6na3yp.js";
 export {
   writeHumanProgress,

package/dist/{harness-github-actions-pg0azf3h.js → harness-github-actions-ky4ym5n3.js}

@@ -1,7 +1,7 @@
 import {
   buildSourceSnapshot
-} from "./cli-5tsqk3jt.js";
-import"./cli-8c60k2p4.js";
+} from "./cli-3xh2w7hb.js";
+import"./cli-bvnw7585.js";
 import"./cli-0v6na3yp.js";
 
 // src/harness-github-actions.ts

package/dist/{index-nepr7cw7.js → index-bcn5chmf.js}

@@ -3,7 +3,7 @@ import {
   initPrompts,
   runPromptSync,
   runSkillSync
-} from "./cli-j2rdgd3p.js";
+} from "./cli-nnwegmzh.js";
 import {
   codingAgentDisplayName,
   describeCodingAgentEvent,
@@ -22,7 +22,7 @@ import {
   runHarnessCommand,
   startRemoteAnalyze,
   stripAnsi
-} from "./cli-5tsqk3jt.js";
+} from "./cli-3xh2w7hb.js";
 import {
   bundledSkillsDir,
   installIntegrationSkill,
@@ -34,14 +34,14 @@ import {
 } from "./cli-ssfq84k5.js";
 import {
   selectTenantAndCreateKey
-} from "./cli-j2fapt3g.js";
+} from "./cli-phgzghwq.js";
 import {
   ConnectCodeError,
   connectWithCode,
   loadAuthSession,
   loadToken,
   login
-} from "./cli-rycpwqzm.js";
+} from "./cli-dy2aavbe.js";
 import {
   CliAuthError,
   CliInputError,
@@ -49,7 +49,7 @@ import {
   createCommandContext,
   resolveIngestUrl,
   resolveModaBaseUrl
-} from "./cli-8c60k2p4.js";
+} from "./cli-bvnw7585.js";
 import"./cli-0v6na3yp.js";
 
 // src/init/index.ts

package/dist/prompt-source-mcp.js

@@ -5,8 +5,8 @@ import {
   inspectCodeSelectors,
   inspectPythonSelectors,
   safePromptEvidencePath
-} from "./cli-5tsqk3jt.js";
-import"./cli-8c60k2p4.js";
+} from "./cli-3xh2w7hb.js";
+import"./cli-bvnw7585.js";
 import {
   __commonJS,
   __toESM

package/dist/{provision-02wqtkvm.js → provision-mqw8s0jb.js}

@@ -1,15 +1,15 @@
 import {
   selectTenantAndCreateKey
-} from "./cli-j2fapt3g.js";
+} from "./cli-phgzghwq.js";
 import {
   loadAuthSession
-} from "./cli-rycpwqzm.js";
+} from "./cli-dy2aavbe.js";
 import {
   CliAuthError,
   resolveIngestUrl,
   resolveModaBaseUrl,
   stringOption
-} from "./cli-8c60k2p4.js";
+} from "./cli-bvnw7585.js";
 import"./cli-0v6na3yp.js";
 
 // src/provision.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.44.1",
+  "version": "1.45.1",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-10-09T09:20:18.058Z",
-  "cli_version": "1.44.1",
+  "bundled_at": "2026-10-09T20:46:23.241Z",
+  "cli_version": "1.45.1",
   "skills": [
     {
       "id": "integration-cloudflare-think",

package/skills/moda-cli/SKILL.md

@@ -39,8 +39,9 @@ Activate this skill when the user wants to:
 - List/filter traces by user, environment, cluster, outcome, or time
 - Manage code-first prompt versions when the user explicitly asks for prompt
   sync, prompt status, or prompt promotion
-- Push their prompts, skills, and tool definitions to Moda without a repo
-  scan — `moda registry push` (section 7b)
+- Push their prompts, skills, tool definitions, and agent wiring (agents,
+  routing, injected context) to Moda without a repo scan, so replays rebuild
+  their harness — `moda registry push` (section 7b)
 
 **Do not** activate for: writing code that calls the Moda Data API directly
 (use the API docs instead), changing application instrumentation unless the
@@ -832,41 +833,66 @@ Page with `--cursor=<nextCursor>`. Playouts exist only for runs whose
 playouts were captured; `playoutCount: 0` on `run` means there is no
 transcript to read.
 
-### 7b. Push prompts, skills, and tools without a repo scan (`moda registry`)
+### 7b. Register the harness for replays (`moda registry`)
 
-Use when the user wants their prompts, skills, and tools visible in Moda but
-cannot (or does not want to) connect the GitHub App or run `moda harness
-analyze`. This fills the prompt, skill, and tool registries only. It does not
-create the harness graph (agents and how they connect), which still comes from
-`moda harness analyze`, the GitHub App, or an approved report via
-`moda harness sync --from-report`. **You** are the analyst: read the codebase you already have access
-to, write one manifest, and push exactly what it lists. Nothing else in the
-repo is uploaded.
+Use when the user wants their prompts, skills, tools, or agent wiring in Moda
+so replays rebuild their harness faithfully, without the GitHub App or `moda
+harness analyze`. **You** are the analyst: read the codebase you already have,
+write one manifest, and push exactly what it lists. Nothing else in the repo is
+uploaded. For a full guided pass (inventory, prompt switching, context,
+attribution, and verification), run `moda registry prompt` and follow the
+brief it prints.
 
 ```bash
-moda registry template --out=.moda/registry.json   # starter manifest
+moda registry prompt                                # the step-by-step brief for this job
+moda registry template --out=.moda/registry.json   # starter manifest (moda_registry.v2)
 # ...fill in .moda/registry.json from the codebase...
 moda registry validate                              # local only, no network
 moda registry push --dry-run                        # server-side preview, writes nothing
 moda registry push                                  # upload
+moda registry status                                # what is registered (harness version)
+moda registry coverage --days=7                     # production traces vs the registry
+moda registry log                                   # history: one commit per push
+moda registry show <commit|working>                 # a commit's file diffs / changes since the last push
 ```
 
-Manifest (`moda_registry.v1`; every section optional, ≤500 entries each):
+Every successful `push` records a registry **commit**: the whole registry
+(prompts, tools, skills, agents, harness settings) snapshotted as files, with
+your repo's git SHA, branch, and dirty flag. Pass `--message="..."` to label
+it. The dashboard **Registry** page shows these commits git-style: a log,
+per-file diffs, a file browser, and uncommitted changes made outside a push
+(dashboard edits, MCP discovery, `moda prompts sync`).
+
+Manifest (`moda_registry.v2`; `moda_registry.v1` with only prompts, skills, and
+tools still works; every section optional, ≤500 entries in prompts, skills, and tools):
 
 ```json
 {
-  "schema": "moda_registry.v1",
+  "schema": "moda_registry.v2",
   "prompts": [
-    { "key": "support.triage", "name": "Triage", "description": "...",
-      "content": "You are ...", "sourcePath": "src/agents/triage.ts" },
-    { "key": "support.reply", "file": "prompts/reply.md" }
+    { "key": "support.triage", "file": "prompts/triage.md" },
+    { "key": "support.billing", "content": "You handle billing for {{company_name}}..." }
   ],
   "skills": [
-    { "key": "refund-policy", "description": "...", "file": ".claude/skills/refund-policy/SKILL.md" }
+    { "key": "refund-policy", "file": ".claude/skills/refund-policy/SKILL.md" }
   ],
   "tools": [
     { "schema": { "name": "lookup_customer", "description": "...",
       "parameters": { "type": "object", "properties": { "email": { "type": "string" } } } } }
+  ],
+  "runtime": { "framework": "openai-agents", "maxToolRoundsPerTurn": 6, "skillLoading": "tool" },
+  "agents": [
+    { "key": "triage", "entry": true, "prompt": "support.triage",
+      "model": { "id": "openai/gpt-5.1", "temperature": 0.2, "maxTokens": 1024 },
+      "tools": ["lookup_customer"],
+      "handoffs": [{ "to": "billing", "tool": "transfer_to_billing" }],
+      "match": { "agentNames": ["TriageAgent"] } },
+    { "key": "billing", "prompt": "support.billing", "skills": ["refund-policy"] }
+  ],
+  "routing": { "strategy": "handoff", "default": "triage" },
+  "context": [
+    { "key": "company", "variable": "company_name", "source": "static", "value": "Acme" },
+    { "key": "today", "variable": "current_date", "source": "clock", "format": "date" }
   ]
 }
 ```
@@ -881,24 +907,64 @@ Manifest (`moda_registry.v1`; every section optional, ≤500 entries each):
 - **Skills:** `key` (letters, digits, `_`, `-`) plus `skillMd` or `file` (full
   SKILL.md). Pushed skills are *local* by default. Set `"live": true`, or pass
   `--live`, to include them in the served skill surface. Leaving `live` out
-  never demotes a skill that is already live.
+  never demotes a skill that is already live. Replays load the skills an agent
+  lists in `agents[].skills`, whether or not they are live.
 - **Tools:** an OpenAI function `schema` (a wrapped
   `{"type":"function","function":{...}}` is accepted), plus optional
   `isActive`. Copy names and parameter schemas exactly as the agent registers
   them with the model. Tools are upserted by name and never overwrite
   MCP-server-managed tools (those report `skipped`).
+- **Agents:** one per distinct prompt, tool set, or model. Fields: `key`,
+  `name`, `description`, `entry`, `prompt` (prompt key), `model` (`id`,
+  `provider`, `temperature`, `maxTokens`, `topP`, `reasoningEffort`), `tools`
+  (tool names), `skills` (skill keys), `handoffs` (`to`, `tool`,
+  `description`), `subagents` (`agent`, `tool`; the tool must also be in
+  `tools`), `context` (context keys), `maxToolRoundsPerTurn`,
+  `responseSchema`, `match` (`agentNames` as they appear in traces,
+  `promptKeys`).
+- **Routing (prompt switching):** `strategy` is `single`, `handoff`, `router`,
+  `rules`, or `trace_attribute`; `default` is an agent key; put code-level
+  rules in `notes`. Replay runs the agent named on the replayed turn's trace
+  (agent name, then prompt key), else `default`, else the `entry` agent. When
+  the replayed model calls a handoff tool, replay switches to the target
+  agent's prompt, tools, model, and params.
+- **Context:** what the runtime injects. `source` is `static` (with `value`),
+  `clock` (`format`: date, datetime, or iso; replay uses the source
+  conversation's time), or `trace`, `memory`, `retrieval`, `tool`, or
+  `unknown`. Those last ones are reported as unresolved in replay fidelity,
+  never invented. `target` is `prompt_variable` (needs `variable`) or
+  `system_append`.
+- **Runtime:** `framework`, `language`, `maxToolRoundsPerTurn`,
+  `parallelToolCalls`, `history` (`strategy`, `maxMessages`, `maxTokens`),
+  and `skillLoading` (`tool`, `system_prompt`, or `none`).
+- **MCP servers:** `name`, `transport`, `url` or `command`, `tools`, and
+  `description`, with no credentials. List their tools in `tools[]` too.
 - `file` paths are relative to the directory you run the command from and must
   stay inside it (symlinks included).
 
+**Traces must name the agent.** For per-turn prompt switching, each LLM call
+should carry `gen_ai.agent.name` (or `moda.agent_name`; with the Vercel AI SDK
+use `experimental_telemetry.metadata["moda.agent_name"]`; `agent_name` on
+`/v1/ingest`), set to an agent `key` or one of its `match.agentNames`. It
+should also carry `moda.prompt_key` / `moda.prompt_version_id`. Only add these
+to application code when the user asks for it or approves the diff.
+`moda registry coverage` shows how many recent calls resolve to a registered
+agent, which agent names, prompt keys, and tools are unregistered, and which
+agents were never seen.
+
 `push` needs an API key. `push --dry-run` without one only validates locally
 (status `validated`). Each section goes to its own endpoint and reports
 `sections[].status` (`synced`, `dry_run`, `validated`, `skipped`, or `error`).
-If any section fails, `push` exits `1`, lists the failures in `errors[]`, and
-still pushes the other sections. The whole manifest is validated before any
-request, with every error listed at once. Unknown fields and wrong types are
-rejected, matching what the server accepts. Skill keys are stricter than the
-server (letters, digits, `_`, `-`) because they double as `.claude/skills/<key>/`
-directory names.
+The harness sections (`runtime`, `agents`, `routing`, `context`, and
+`mcpServers`) are pushed last, as one versioned document. Re-pushing an
+unchanged one reports `unchanged`. If any section fails, `push` exits `1`,
+lists the failures in `errors[]`, and still pushes the other sections. The
+whole manifest is validated before any request, with every error listed at
+once. `warnings[]` names agent references to prompts, tools, or skills that
+the manifest doesn't define; they must already exist in Moda. Unknown fields
+and wrong types are rejected, matching what the server accepts. Skill keys are
+stricter than the server (letters, digits, `_`, `-`) because they double as
+`.claude/skills/<key>/` directory names.
 
 ### 8. Fixing detected Problems
 
@@ -1226,7 +1292,7 @@ npx: `npx -p @moda-ai/cli moda <command>`.
 | `moda prompts diff` | Read-only: only prompts changed/new/deleted since last sync (hash-level, not a text diff) |
 | `moda prompts sync` | Upload changed prompt versions and update lockfile |
 | `moda prompts promote <key>` | Move a remote prompt label |
-| `moda registry template\|validate\|push` | Push prompts, skills, and tools from one agent-written manifest (`--file`, `--dry-run`, `--live`); no repo scan |
+| `moda registry template\|validate\|push\|status\|coverage\|log\|show\|prompt` | Register prompts, skills, tools, and agent wiring from one agent-written manifest (`--file`, `--dry-run`, `--live`, `--message`, `--days`); every push is a commit in the Registry history; no repo scan |
 | `moda users` / `moda user <id>` | End users with health/activity; one user's profile |
 | `moda problem-reopen <pid>` | Reopen a Problem marked fixed |
 | `moda signals <create\|update\|activate\|pause\|delete\|examples\|refine\|revise\|proposals\|accept\|reject\|search\|preview>` | Manage custom signals (writes take `--dry-run`; LLM-backed ones are rate-limited per key) |